create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.changeset/managed-agent-loop.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Managed agents now actually run. A connection of kind `managed` has its tasks claimed and executed by the platform every minute: the model is shown the task (untrusted input fenced as quoted data) and the same tool surface an MCP client sees, reads run under the agent's own key, and every change goes through the approval gate — executed, proposed, or parked for the owner according to the autonomy ladder. Runs are bounded (24 turns, eight minutes), failures retry to the attempt ceiling and then park as needs-attention, the kill switch stops claiming, and finishing a run no longer overwrites a task the gate parked for approval.

package/dist/template/.changeset/marketplace-channel-sync.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Marketplace channels now pull a paged list of shop orders onto ordinary
+invoices. A refused handshake stays failed so Retry can reconnect the same
+channel; synced buyers land on the contact spine.

package/dist/template/.changeset/mcp-server.md

@@ -0,0 +1,20 @@
+---
+"freeholder": minor
+---
+
+Your site is now an MCP server, so an AI assistant can work in your business
+directly. Point one at `/api/mcp` with an API key and it discovers what your
+business can do — your modules, your plugins, this version — and can then do
+those things: add a contact, publish a page, look up your opening hours.
+
+What it is offered depends on the key you gave it. A key that can only read
+contacts sees only the tools that read contacts, so an assistant is never
+guessing at what it is allowed to do or being refused halfway through a task.
+Everything it does is recorded against that key by name in your activity log,
+alongside everything you and your staff did.
+
+Tools are marked read-only or destructive, so an assistant that asks before
+doing something irreversible knows which those are.
+
+Signing in and managing keys are deliberately not offered as tools. An
+assistant uses the key you gave it; issuing credentials stays your job.

package/dist/template/.changeset/media-and-canvas.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Upload images and place them on your pages. Every image automatically gets
+smaller, modern versions so pages load quickly on a phone. The page editor now
+shows a live preview beside the controls, and clicking something in the preview
+selects it for editing.

package/dist/template/.changeset/media-capture-review.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+A screen, camera or microphone recording is previewed, trimmed, cropped and
+captioned before it enters the media library. Unconfirmed recordings expire
+and are deleted; confirming one runs the normal Asset pipeline with
+capture provenance.

package/dist/template/.changeset/media-capture-sessions.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Owners can record screen, camera or microphone from `/admin/media/record`, then preview, trim, caption and confirm the file into the library. A QR / expiring `/capture/{token}` link and the `/share` Web Share target use the same media pipeline (C1.28, C1.29).

package/dist/template/.changeset/media-delete-and-inline-editing.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+You can now delete files from the media library — it tells you first if a page
+is still using one — and you can type directly onto the live preview to edit
+headings, text and button labels in place.

package/dist/template/.changeset/media-lifecycle.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Complete the media foundation for verified images, video, audio, and documents.
+Add private-S3 resumable multipart uploads, signature and size validation, an
+optional streaming ClamAV seam, canonical metadata and provenance, focal
+points, controlled non-image delivery, recoverable trash, owner-confirmed
+purge, and durable upload/object cleanup.

package/dist/template/.changeset/media-phone-ingest.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+A phone can send a batch of photos or videos through a QR or share-sheet
+link without installing an app. Unfinished uploads resume if the connection
+drops. Files stay off the library until you confirm, and can land on a
+chosen product or page.

package/dist/template/.changeset/memberships.md

@@ -0,0 +1,37 @@
+---
+"freeholder": minor
+---
+
+You can now sell memberships. Create a plan — what it gives people, how often
+it bills, whether it starts with a free trial, whether there is a one-off
+joining fee — and put a contact on it from the memberships screen.
+
+A plan has no price of its own. It points at one of your products, and that
+product's price is what gets billed, so changing what a membership costs is one
+edit rather than two places that can disagree.
+
+Every period raises an ordinary invoice, the same kind everything else in
+Freeholder raises, which you send as usual. Automatic card renewals are not
+here yet: they need a way to charge a saved card without the customer present,
+which the payment providers side of Freeholder does not do yet, and a plan that
+quietly never billed anybody would be worse than saying so. Choosing an
+automatic mode is refused, with that reason.
+
+A month means a month. Somebody who joins on the 31st of January renews on the
+28th of February and stays on the 31st thereafter, rather than sliding a day
+later every year.
+
+Cancelling keeps access until the end of the period already paid for, and then
+stops — access never outlasts the money, and never disappears early. You can
+override that per plan if you would rather cut people off immediately.
+
+Pausing does not burn the rest of the month: somebody who pauses on day three
+and comes back in August still has twenty-seven days waiting for them.
+
+Every subscription keeps its own history — started, trial began, became paying,
+invoiced, paused, resumed, cancelled, ended — so "why did this customer stop
+paying in March" has an answer. A period that could not be billed is recorded
+with the reason instead of being skipped silently, and the period does not
+move, so nobody gets a month they were never billed for.
+
+Customers can cancel their own membership from the portal without emailing you.

package/dist/template/.changeset/message-templates.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+One set of message templates for everything you send: receipts and confirmations, campaigns, newsletters, texts, and anything an automation writes. Same editor, same variables, same translations.
+
+A template says which values it needs — the invoice total, the customer's first name — and sending refuses if one is missing, rather than letting a customer read `{{invoice.total}}` in their receipt.
+
+Templates that ship with Freeholder keep their original wording alongside your edits, so "put it back how it was" works even after an update, and you can see at a glance which ones you have changed.

package/dist/template/.changeset/mobile-app-package.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Groundwork for the customer mobile app: your instance now publishes
+`/.well-known/freeholder`, so an app can be pointed at your web address and
+pick up your name, branding, currency and timezone — and tell a customer to
+update their app rather than showing them a broken screen when it is too old.
+The app package itself holds only what a phone needs: how to find you, how to
+hold a session in the keychain, and what to show with no signal.

package/dist/template/.changeset/mobile-capture-batches.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+"@freeholder/mobile-app": minor
+---
+
+Owner companion capture can now queue files on the phone while offline: consent,
+destination, progress, pause, resume, cancel and retry are visible on the
+device, and the batch uploads through the same media pipeline as
+`/capture/[token]` once a connection is back.

package/dist/template/.changeset/mobile-dependency-security.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Update the separate Expo application's locked shell-quote, source-map-js and compression dependencies to compatible patched releases. Document the two remaining unpatched mobile advisories without waiving them or treating the root server audit as mobile release acceptance.

package/dist/template/.changeset/mobile-screens.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+The customer app now knows its own map: every screen a customer can reach,
+which of your services it is allowed to ask for, and what it says when there is
+nothing to show. Links land where they should — a push about a ready gallery,
+a link your customer tapped in an email, or a pasted address all open the same
+place, and a link for a different business is refused rather than quietly
+switching which business they are looking at.

package/dist/template/.changeset/mobile-store-ci.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+"freeholder-app": minor
+---
+
+Every change now typechecks, bundles iOS and Android, and fails CI if the demo
+app contract cannot be parsed, a store icon or screenshot is missing, or the
+privacy answers do not match the permissions the app actually asks for. Apple
+and Play checklists ship with the honest note that the stores still decide
+review. Signed store binaries still need your Expo account — CI will not spend
+that quota on a pull request.

package/dist/template/.changeset/mobile-v2-deferral.md

@@ -0,0 +1,12 @@
+---
+"freeholder": patch
+---
+
+Owner decision 2026-09-15: the seven remaining mobile-app acceptance items —
+C10.17, C10.18, C10.25, C10.26, C10.27, C10.28 and C10.30 — are deferred to
+v2 (MASTER.md §43.18). This is a dated, bounded scope decision, not a generic
+escape hatch: the items are quoted verbatim in §43.18 with their obligations
+intact, §35 remains their v2 specification, and the plan gate now encodes the
+same closed set — references to those IDs still resolve, C10 sequence
+contiguity is computed around them, and any change that re-enters one of them
+into the live checklist as a checkbox fails the gate.

package/dist/template/.changeset/n1-schema.md

@@ -0,0 +1,6 @@
+---
+"freeholder": minor
+---
+
+A migration that breaks the previous release must say so, and this build's
+schemaRisk must match. CI boots the previous image, upgrades, and rolls back.

package/dist/template/.changeset/named-roles-grants.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+Replace hard-coded owner/staff/customer rank checks with named, data-backed
+roles and normalized per-module view/manage grants. Seed owner, administrator,
+editor, bookkeeper, service-provider, and customer defaults; preserve an
+unassignable legacy staff role for safe rollback; load grants on every session
+resolution; enforce them through services, admin routes, navigation, HTTP, and
+MCP; and add localized role/grant management with assignment and audit history.

package/dist/template/.changeset/native-customer-invoices.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+"@freeholder/mobile-app": minor
+"@freeholder/sdk": minor
+---
+
+Add native invoice list/detail screens with an invoice-specific browser handoff and a return link to the app (C10.26). The app never calls payment services or puts a user session in a URL. Browser capabilities are live reads restricted to the invoice's customer and are retired when payment closes the invoice.
+
+Exclude Git metadata, agent/workspace folders, mobile sources and test output from standalone server artifacts. The artifact gate now rejects or scrubs these roots without changing its size limits.

package/dist/template/.changeset/native-gallery-proofing.md

@@ -0,0 +1,6 @@
+---
+"freeholder": patch
+"@freeholder/mobile-app": minor
+---
+
+Add the native galleries tab and proofing screen (C10.27). Customers open a gallery with the existing login mutation, then read the live session and mark, clear or submit choices through the same services as the website. Private image bytes from `/g/{slug}/view/{itemId}` share the 60-second encrypted cache lease: denials evict immediately, offline failures never renew access, expiry clears displayed photos, and a late request from a signed-out session cannot refill the next account. Proofing writes are live-only. The invoices tab is now included in the customer tab order.

package/dist/template/.changeset/next-critical-advisories.md

@@ -0,0 +1,6 @@
+---
+"freeholder": patch
+---
+
+Takes Next 16.3.4, which fixes two critical security advisories in the
+framework that serves every page of your site.

package/dist/template/.changeset/no-double-booking.md

@@ -0,0 +1,13 @@
+---
+"freeholder": patch
+---
+
+Fixed: a class or group session could be overbooked if two people booked the
+last places at exactly the same moment. One-to-one appointments were already
+safe — the database itself refuses those — but a shared calendar is meant to
+allow overlapping bookings, so it was counting seats instead, and two
+simultaneous requests could both count the same free place.
+
+Seat counting is now serialised per calendar, so the second request sees the
+first one's booking and is told how many places are actually left. Two people
+booking different rooms still never wait on each other.

package/dist/template/.changeset/no-live-phone-example.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+The call-to-action block's phone-number validation message now shows a fiction-reserved example number instead of a real, live line.

package/dist/template/.changeset/note-task-recovery.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+"@freeholder/sdk": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C7.02/C7.03/C11.14: Move notes and tasks to recoverable trash, preserving their IDs, revisions and contact links. Trash stays out of normal lists, search, reminders and briefings; authorized staff can restore it or confirm permanent deletion. Retention holds protect both manual and scheduled purge, and privacy erasure cannot be undone through recovery. Contact merge and undo now also update contact-subject links. A localized, paginated trash screen and view/manage-aware controls support the workflow; a daily sweep removes eligible trash after thirty days. Project checklists and their counts exclude trashed tasks, and task navigation and saved views use the task grant.

package/dist/template/.changeset/notes.md

@@ -0,0 +1,22 @@
+---
+"freeholder": minor
+---
+
+Notes you can trust. Write something down against a customer, a deal, a quote,
+an invoice, an appointment, a job or an agreement — and when somebody changes
+it later, what it said before is kept. A note is often the only record of what
+was agreed on a phone call, and a record that can be quietly rewritten is not
+worth much.
+
+Choose who sees each one: the whole team, only you, or the customer as well.
+The private ones are genuinely private — a colleague cannot read them, edit
+them, or see they exist.
+
+Mention a colleague and they hear about it once, through the same notification
+settings they already chose. Fixing a typo afterwards does not tell everybody
+again.
+
+Pin the one thing everybody needs to know before they open their mouth, and it
+stays at the top whatever the dates say. Notes about a customer show on their
+timeline whatever they were attached to, so a note on their invoice is still
+part of their story.

package/dist/template/.changeset/notification-fanout-inbox.md

@@ -0,0 +1,17 @@
+---
+"freeholder": minor
+---
+
+Add a personal notification inbox and durable fanout model. In-app and email
+delivery now share per-topic preferences, scheduled daily or weekly digests,
+replay receipts, live-condition coalescing, delivery evidence, bounded retries,
+and a one-time escalation for critical work that remains unread.
+
+The admin header shows an unread bell and the inbox presents critical work
+first with read, unread, archive, filter, channel, digest, timezone, and
+escalation controls in English, French, and Spanish. Form submissions and core
+connection, agent, and mail-health events use the same transactional path.
+
+SMS and push have honest adapter contracts but stay unavailable until their
+later production carrier and consent/device-registration checkpoints. Doctor
+reports that state without making external or billable calls.

package/dist/template/.changeset/on-danger-token.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Fixes unreadable text on every destructive button. The colour reserved for
+text on a red background was being dropped before it reached the page, so
+"Delete", "Submit refund" and everything like them rendered dark grey on red —
+about half the contrast accessibility requires. The colour itself was always
+correct; it was being lost in transit.

package/dist/template/.changeset/one-answer-to-who.md

@@ -0,0 +1,24 @@
+---
+"freeholder": minor
+---
+
+An audience now means the same thing everywhere. The groups you define under
+Segments are what campaigns send to, what automations let in, and what reports
+can be cut by — one definition, so two screens can never disagree about who
+"customers in Ontario who bought twice" are.
+
+Automations gained the audience setting on their own page, and it now actually
+holds: before this, an automation could be given an audience and would still
+run for everyone, including the people it was written to leave out. It is also
+pinned to the version you published, so narrowing an audience this morning does
+not change what a run that started last night was doing.
+
+Because an audience says a rule is about people, you can now build a manual
+automation that acts on a contact — "do this for everyone in the group" — which
+the editor previously refused.
+
+Reports can be narrowed to an audience too: pick a group and the cohort report
+shows what those customers went on to spend.
+
+One fix worth naming: saving an automation's settings used to quietly clear its
+audience, so renaming a rule could widen it to everybody without saying so.

package/dist/template/.changeset/open-source-demo-only.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Keep the open-source distribution focused on the generic Freeholder product.
+It now ships only the Aurora Coast Photography demo fixture; industry-specific
+site packs are supplied by downstream products instead.

package/dist/template/.changeset/order-read-authorization.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C5.16/C5.17/C5.22/C11.10: Require catalog read authorization for order details. Knowing an order ID no longer grants anonymous access to its shipping address or line items. The staff order screen and API keys explicitly authorized for catalog.getOrder retain access; customer self-service order lists keep their existing contact ownership checks.
+
+Raw stock reservations now require catalog management authority; checked cart and checkout composition remains available. Stock notification enrollment requires the signed-in contact’s own profile or authorized catalog management, preventing anonymous enrollment of another contact.

package/dist/template/.changeset/outbox-dead-letters.md

@@ -0,0 +1,13 @@
+---
+"freeholder": minor
+---
+
+Make transactional event delivery durable per listener. Stable listener
+identities, leased receipts, exponential retries, explicit unconsumed and
+permanently failing dead letters, and 90-day retention replace the former
+whole-event success marker.
+
+Add a human-only event-delivery console with redacted detail and audited,
+step-up-protected replay. Replay preserves completed receipts and queues only
+unfinished listeners; webhook fan-out additionally deduplicates on the source
+outbox event ID.

package/dist/template/.changeset/owner-agent-launch.md

@@ -0,0 +1,4 @@
+---
+"freeholder": minor
+---
+Set up owner protection in the wizard with a passkey or authenticator and downloadable recovery codes, then sign in with a passkey without typing a password. Connect Replit, Lovable or another assistant through a guided page with named, expiring credentials, bounded permissions and a real MCP discovery test. Prepare independent launch credentials and a private owner claim link with one command, preserving existing secrets and reporting missing infrastructure; document Replit provisioning and Lovable's hosted-backend connection without claiming those live launches are already verified.

package/dist/template/.changeset/owner-authored-assessments.md

@@ -0,0 +1,15 @@
+---
+"freeholder": patch
+---
+
+C8.14: Guided assessments an owner authors end to end. The owner writes the questions, the answer options and the scores each option carries, then writes the outcome bands a total can land in — and a respondent is only ever shown a band the owner wrote. Nothing composes outcome text, so an assessment cannot diagnose, certify, guarantee or recommend, which is what makes a triage questionnaire safe to put on a clinic, trade or lender site. A single answer can escalate past the score to an authored instruction ("leave the building and call the gas emergency line"), shown above the band rather than instead of it.
+
+Two rules are enforced by the database rather than by the service. `assessment_bands_no_overlap` is an exclusion constraint, so two bands can never cover one score and the outcome can never depend on row order; `assessment_responses.band_id` is `NOT NULL` and restricts deletion, so an unauthored outcome is unrepresentable and a band somebody was already shown cannot be deleted out from under them. Publishing is refused until the bands cover every score the questions can reach, so a gap is a refusal the owner sees while editing rather than a stranger meeting mid-enquiry.
+
+The public surface is a server-rendered block with no client component: the redirect carries the band's key and the words are read from the owner's row, keeping attacker-supplied text out of the outcome. Responses join the contact spine through `contacts.resolve`, repoint on merge, and export and erase under the new `assessments.responses` privacy scope. Also adds MASTER.md §4.18 and principle 13 — owner-authored truth — which C8.15, C8.16, C5.26 and C6.18 build on.
+
+The admin is at `/admin/assessments`. The question builder puts the score beside each answer rather than behind a settings panel, because the owner is authoring the judgement and not just the wording, and it shows the range those questions can reach while they are being written. The outcome editor shows coverage live against the same `coverageGaps` the service refuses with, so "no outcome covers 4 to 7" appears next to the outcomes rather than arriving as a surprise at publish time, and deleting an outcome somebody has already been shown is refused with the count of people who saw it. Escalations pick their trigger from the questions that exist, so a rule that could never fire cannot be written, and the answer queue marks escalated responses rather than leaving a reader to interpret a number.
+
+A repeated post resolves to the answer already stored rather than producing a second: a page issues a nonce, the response carries it, and a partial unique index makes the duplicate impossible. The concurrent case goes through `ON CONFLICT DO NOTHING` rather than catching the violation, because a constraint error aborts the transaction and the re-read would fail too — so somebody who merely double-clicked would have seen an error for doing nothing wrong. Being told a second time that your boiler is urgent is not a duplicate row; it is the same judgement arriving twice as though it were two.
+
+Ships with a demo heating check (English, French and Spanish) that loads, verifies and purges through the tracked demo run, chosen because it shows the two things prose cannot: an answer that outranks the score, and an outcome nobody composed. A real-browser spec proves the whole journey — an owner refused a gap, fixing it, publishing, a visitor answering, an escalation outranking a low score, and the owner seeing it marked — with axe WCAG A/AA clean on every new surface in both light and dark.

package/dist/template/.changeset/owner-companion.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+"@freeholder/mobile-app": minor
+---
+
+The same mobile app now opens owner companion mode when the signed-in role is
+not a customer: today's briefing, tap-to-invoice, inbox, reviews, approvals,
+agent status, critical alerts, and camera/camera-roll/screen/share ingest
+through the existing media capture pipeline. Uploads still need a live
+connection; offline capture batches are a later change.

package/dist/template/.changeset/owner-content-builder.md

@@ -0,0 +1,21 @@
+---
+"freeholder": minor
+---
+
+Freeholder now includes the first complete owner-facing self-builder lane.
+Describe a site-wide content outcome in one brief and the configured builder
+returns a typed, rendered before/after proposal across pages and shared chrome.
+Nothing changes until the owner approves it. Approval applies the exact
+previewed operations atomically through the ordinary CMS services, records the
+builder as the author, and offers one-click rollback; proposals fail stale
+instead of overwriting newer human work.
+
+The builder is available in admin, through the generated HTTP API and MCP
+tools, and from a signed-in-owner affordance on the public site. Site content
+is isolated as untrusted reference data, `builder.*` remains separate from
+workforce scopes, model usage has visible hard budgets, and the PM Brain
+adapter uses a purpose-bound Paradise Modern site credential.
+
+The CMS also gains an editable phone-callout block with separate E.164 routing
+and human-readable display fields for prominent, accessible click-to-call
+lines in pages or shared chrome.

package/dist/template/.changeset/owner-facing-helper.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+The six identical private copies of `ownerFacing()` — the helper that strips machine addressing off service errors before showing them to an owner — are now one shared helper in the admin action layer. Groundwork for catalog keys on service errors: one place to resolve a key instead of six.

package/dist/template/.changeset/owner-storage-recording-import.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C3.13: A verified voice or video recording is now copied automatically into the owner's configured storage, transcript included when present, using the media storage conventions: content-addressed keys, content type and a SHA-256 checksum. Retries converge on the same objects instead of duplicating them, and a failed copy stays visible on the recording with an admin retry plus scheduled in-place retries. Contact erasure deletes the imported owner-storage copies through the same durable job receipt as provider copies, and recording retention holds protect them. Recordings above 512 MiB are not imported and report the failure. Live Daily acceptance remains incomplete.

package/dist/template/.changeset/ownership-recovery.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add secret-safe complete ownership exports, media manifests, credential-key recovery guidance, and a CI-proven PostgreSQL backup/restore drill.

package/dist/template/.changeset/ownership.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+Freeholder now consistently identifies Tony Aly as its creator, original
+author, copyright owner, and maintainer. The `CampDenman` GitHub organization
+is only the repository host. Contributors retain copyright in their own
+contributions under the DCO.

package/dist/template/.changeset/package-artifact-integrity.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+"create-freeholder": patch
+"@freeholder/plugin-kit": patch
+"@freeholder/sdk": patch
+"@freeholder/templates": patch
+---
+
+Make every published package a compiled, clean-install-tested artifact and turn create-freeholder into an integrity-checked, transactional source scaffold instead of a placeholder project.

package/dist/template/.changeset/paradise-comms-adapter.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Voice and video calls can now run on paradisemodern's Paradise Comms, the first-party provider: admins pick the provider in the voice-video settings, save an encrypted site key or portfolio token, verify the connection (the prepaid-balance 402 shows its top-up link), open rooms with LiveKit credentials for host and guest, control recording, and see recordings imported into their own storage. The Daily adapter remains available for existing configurations, webhooks from Paradise Comms close rooms and drop erased recordings automatically, and contact erasure now deletes the provider's copies of imported recordings with the privacy receipt completing only after Paradise Comms confirms.

package/dist/template/.changeset/patch-uuid-buffer-advisory.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Override the Replit storage dependency graph to patched uuid 11.1.1, resolving
+GHSA-w5hq-g745-h8pq while preserving the CommonJS v4 API used by Google Cloud
+Storage's gaxios and teeny-request clients.

package/dist/template/.changeset/paywalls.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Pages no longer hide the rest of an article in the browser. A paywall is a
+rule that selects content, and a grant answers for the person looking. Hard
+walls show a teaser. Soft walls show a short lead-in. Metered walls give
+the same number of free views to readers and to search engines. Signed-in
+contacts can open a registration wall. The gated copy is simply not in the
+HTML until it is allowed.

package/dist/template/.changeset/perf-harness-windows.md

@@ -0,0 +1,11 @@
+---
+"freeholder": patch
+---
+
+The C11.11 performance harness now runs on Windows. It shelled out to `pnpm`,
+which cannot work there: `spawnSync` finds no bare `pnpm` to execute, and naming
+`pnpm.cmd` is refused outright with EINVAL because Node will not spawn a `.cmd`
+without a shell. The harness therefore exited before measuring anything, which
+matters because C11.11 asks the product owner for acceptance evidence and a gate
+that only runs on the CI image cannot be the gate somebody signs. Vitest is now
+run through Node directly, so no package manager is involved on any platform.

package/dist/template/.changeset/perf-measurement-families.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C11.11: The performance harness can now measure the remaining budget families — real-browser Core Web Vitals and page timings, the editor's first-paint and keystroke-to-preview clocks, full migration-chain apply time on a fresh database, and cold-boot-to-serving time — each opt-in behind its own flag and failing rather than passing when it cannot run honestly. Reference-host acceptance remains open.

package/dist/template/.changeset/phase-0-foundations.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Every word in the admin and setup screens now comes from a translation file, so
+Freeholder can be published in a language other than English — and sign-in is
+protected against password guessing, with security headers on every page.

package/dist/template/.changeset/pipelines.md

@@ -0,0 +1,21 @@
+---
+"freeholder": minor
+---
+
+A pipeline, if you want one. Freeholder does not assume you do — a shop never
+opens a deal — so nothing appears until you press the button, and then you get
+the standard stages, fully editable, with as many boards as you need.
+
+The deal board shows what you are working on, what each stage is worth, and a
+forecast weighted by how likely each one is. Set the odds once on a stage and
+every deal in it inherits them; override a particular deal only when it is
+unusual. Losing a deal asks why, because the moment you lose it is the only
+moment you know, and that answer is the only thing a lost deal is still worth.
+
+The lifecycle board shows who is where — subscriber, lead, prospect, customer,
+repeat, advocate — and you can rename or reorder any of it. Moving somebody
+keeps the lifecycle your price lists and reports read exactly in step, so the
+two can never quietly disagree.
+
+Everything works without JavaScript, so the board is usable on a phone with a
+bad signal.

package/dist/template/.changeset/plan-evidence-gate.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+The product plan now fails CI if a checked C-item has no repository
+citation, or if Current focus still names work that is already done. The
+live focus is remaining C0 integrity, then C9.29.

package/dist/template/.changeset/plan-proof-clause.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+The build now refuses a completion claim that cannot be checked: a plan item
+marked done must cite files that actually exist, and must say who can use the
+feature, how an agent reaches it, what happens when it goes wrong, how it is
+operated, and what proves it works with the rest of the product — or say why
+one of those does not apply.