create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.changeset/plan-provider-pivot-2026-09-27.md

@@ -0,0 +1,20 @@
+---
+"freeholder": patch
+---
+
+Owner decisions 2026-09-27 (Tony Aly), plan-only (no product code changes).
+paradisemodern's Paradise Comms replaces Daily as the de-facto first-party
+voice/video provider (MASTER.md §4.14, §36, C3.13); the Daily adapter code
+remains in-tree as optional non-first-party code, and C3.13's remaining
+acceptance is live acceptance against a real paradisemodern instance.
+Recorded honestly: the #364 seam and #394 owner-storage import shipped
+against Daily and need the PM adapter re-targeted; transcripts are
+unavailable until PM ships them; provider-side erasure of PM recordings
+lands with PM's recording-delete API. Print-on-demand is deferred to v2
+(MASTER.md §43.18's new second dated subsection, quoting the pre-change
+C3.13 clause verbatim); the Printify adapter remains in-tree as working
+optional code. The native Freeholder store is the product ("freeholder
+should put shopify out of business"): new open item C3.24 proves native
+storefront parity against Shopify-core capability with a published mapping,
+and the Shopify importer is repositioned as a migration-only bridge
+(MASTER.md §36, C3.13, deploy/first-party-plugins.md).

package/dist/template/.changeset/plan-world-class-commerce-editor-2026-09-29.md

@@ -0,0 +1,21 @@
+---
+"freeholder": patch
+---
+
+Owner directive 2026-09-29 (Tony Aly), plan-only (no product code changes).
+Ecommerce must be "truly world-class and best-of-breed" and the WYSIWYG
+"amazing and drag and drop for the store and the rest of the site" — owner
+feedback: "last time I tried the wysiwyg it... was not very wysiwyg." Both
+items are v1-blocking: C11.17 waits until they pass. New open item C3.26
+(world-class merchandising: taxonomy with manual and rule-based membership,
+faceted storefront browsing, native collection pages, merchandising blocks)
+appends C3.25 in MASTER.md, and C3.24's annotation records that its
+parity mapping feeds the parity items C3.25/C2.24. New open item C2.25
+(world-class visual editing: the rendered page as the canvas, inline text/
+image editing, drag-and-drop blocks and sections site-wide and in store
+contexts, no separate preview frame for ordinary edits) appends C2.24 in
+MASTER.md. Both items were renumbered from C3.25/C2.24 at merge: #446's
+storefront-parity items (merged first) took those IDs; each item's §43
+annotation records the renumber. MASTER.md §43.1's control block names both
+in Remaining open. No checkbox state, the signature row and §43.18 are
+untouched; completion rule unchanged.

package/dist/template/.changeset/playbook-schedules.md

@@ -0,0 +1,21 @@
+---
+"freeholder": minor
+---
+
+Playbooks can run on a schedule now. Write "0 7 * * 1-5" against a playbook and
+it runs every weekday at seven — in your business's timezone, so it stays seven
+in the morning when the clocks change rather than drifting to six or eight for
+half the year.
+
+Two things it deliberately will not do:
+
+It will not flood you after an outage. If the instance was down for six hours,
+a five-minute playbook comes back with one overdue run, not seventy-two. You
+can also say that a window missed while nothing was running should simply be
+skipped — a briefing delivered seven hours late is not a briefing.
+
+It will not stack runs on top of each other. If the last run is still going, or
+still waiting for you to approve something, the next window is skipped and the
+playbook tells you what is holding it up.
+
+Each scheduled playbook shows when it runs next and what happened last time.

package/dist/template/.changeset/playground-hardening.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+The public playground is now hardened end to end. Visitors keep their restricted editing sessions, but every privileged operation is refused by the service layer itself — not just hidden in the interface — and outbound mail, text messages and webhooks can no longer leave a playground instance even from background jobs. The shared demo is bounded (300 edits a minute, row caps on each editable surface, uploads off), and the hourly reset now has an automated recovery proof: afterwards the old session is dead, visitor pages are gone, and the sample site is back.

package/dist/template/.changeset/plugin-contract.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Plugins now have a real authoring contract: `definePlugin` from `@freeholder/plugin-kit` declares platform compatibility, permissions, migrations and capabilities. The proof module uses it, and boot refuses a plugin that does not fit this instance.

package/dist/template/.changeset/popups.md

@@ -0,0 +1,37 @@
+---
+"freeholder": minor
+---
+
+Popups, announcement bars and exit-intent messages, built the same way you
+build a page.
+
+A popup is written in the block editor you already use, so it can hold a
+heading, a picture, a button — anything a page can. Choose its shape (a dialog
+over the page, a bar along the bottom, a small card in the corner) and when it
+appears: straight away, after a few seconds, partway down the page, or when the
+cursor leaves the window.
+
+Say where it appears — one page, a section of the site, or everywhere — and who
+sees it, using the same saved groups your campaigns and price lists already
+use. "Everyone except people already on my list" is one of the choices, so you
+stop asking subscribers to subscribe.
+
+Then say how often. Two a week means two a week: the count is kept per visitor
+and survives them closing the tab, and closing a popup is treated as an answer
+that stands for as long as you set. Nobody gets the same interruption twice a
+day because they came back on Tuesday.
+
+If it collects an email address, you have to write the sentence that goes
+beside the tick box — the platform will not save a sign-up popup without it —
+and those exact words are kept as the record of what that person agreed to.
+Names a newsletter and they get the usual confirmation email; leaves it empty
+and the tick box is the consent. Either way the address becomes a contact like
+any other, not a list off to one side.
+
+Every popup can be closed with the keyboard. The dialog is a real dialog, so
+Escape closes it, focus stays inside it while it is open and goes back where it
+was afterwards, and the close button is the first thing a screen reader
+announces. A popup that would break any of that cannot be switched on.
+
+The screen shows how each one has done: shown, closed, and addresses collected
+over the last thirty days.

package/dist/template/.changeset/portable-plugins.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Plugins can now be installed, isolated, listed from signed registries, and removed with a keep-or-purge choice. First-party gift-registry, print-on-demand, community, voice/video and marketplace plugins ship as `definePlugin` modules. `create-freeholder` and `@freeholder/templates` are real installers and Bench presets. Every Tier-1 recipe has install, verify, backup, restore, migrate and update steps. The owner import studio walks discover → preview → commit → reconcile → publish, and WordPress/generic-site parsers refuse private origins.

package/dist/template/.changeset/portal-rooms.md

@@ -0,0 +1,16 @@
+---
+"freeholder": minor
+---
+
+Your customers can now sign in and see the whole relationship in one place:
+their quotes, agreements, invoices, bookings, orders, hires, projects and
+messages, each in its own room.
+
+What they see is read through the very same queries you use in admin, filtered
+to them — so a figure in the portal and the same figure on your screen cannot
+drift apart, because there is only one of them.
+
+A room only appears when there is something in it, and if a room cannot be
+loaded it says so rather than quietly looking empty. Rooms for things that
+arrive later — subscriptions, passes, referral earnings, shared files — will
+appear on their own as those features are built.

package/dist/template/.changeset/portal-shell.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Give customers a portal to sign into, rather than a folder of emails to keep.
+One home with your details, your language, your privacy choices and the devices
+you are signed in on — reachable by a link sent to your email or by a password,
+whichever you prefer.
+
+You can correct your own name and phone number. Your email stays as the
+business knows it, because that is what ties your history together.

package/dist/template/.changeset/print-on-demand-fulfillment.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Print-on-demand now fulfills paid catalog orders. Map a SKU to a print
+provider product and the order's existing fulfillment records the job,
+including a retry with the provider's message when a `fail-` SKU is refused.

package/dist/template/.changeset/printify-live-fulfillment.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+"@freeholder/sdk": patch
+---
+
+Printify can fulfill mapped paid catalog lines using an API token and shop ID.
+Product and variant mappings, recoverable retries, and verified carrier tracking
+are available in print administration. Acceptance keeps fulfillment pending;
+retries retain the canonical line identity. Print jobs participate in contact
+merge and privacy handling. Worktree builds also exclude Git pointer files from
+the standalone artifact. (C3.13, C11.15)

package/dist/template/.changeset/private-location-access.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C11.10 / §4.10: Restrict hidden location addresses, hours and service areas to authorized location readers. Public ID/slug reads return no hidden location, and includeHidden requires location read permission. POS and social staff without location access retain visible location choices.
+
+Generated location pages and sitemap metadata stop exposing hidden addresses immediately, including before the location event is delivered. The listener then unpublishes the generated page while retaining its content.

package/dist/template/.changeset/private-mobile-cache.md

@@ -0,0 +1,6 @@
+---
+"freeholder": patch
+"@freeholder/mobile-app": minor
+---
+
+Persist native customer read snapshots as bounded AES-GCM ciphertext with a session-specific key in the platform keychain (C10.30). Private snapshots expire after 60 seconds, disappear on expiry/background, and revalidate on foreground. Permission denials evict cached data; sign-out and account changes prevent late requests from restoring it. Offline restart can restore remembered public branding without extending private access. Cache failures preserve successful live reads and never fall back to plaintext. Native proofing/image caching remains C10.27; physical device validation remains open.

package/dist/template/.changeset/private-note-access.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C7.03/C11.10: Protect private notes when pinning and reading revision history. Colleagues cannot pin or receive another author's private note, and API-key history reads follow the same visibility rules as note lists. Editing and removal lock the authorized row so a concurrent privacy change cannot invalidate their checks.

package/dist/template/.changeset/privileged-two-factor.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Add mandatory two-factor authentication for security-privileged roles, with
+encrypted TOTP seeds, one-use recovery codes, passkeys and physical security
+keys through WebAuthn, two-phase login, forced enrollment, replay-resistant
+verification, and fresh step-up authorization for credential, role,
+invitation, connection, webhook, and agent-authority changes. Add the
+localized account-security and verification screens, short-lived hashed
+challenges, per-session assurance, scheduled cleanup, and additive migration.

package/dist/template/.changeset/product-completion-plan.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+Make `MASTER.md` the sole product and delivery source of truth. It now records
+the verified baseline, the complete scope of DONE, dependency order, universal
+acceptance criteria, and an actionable checklist for every remaining product
+workstream. The superseded roadmap and session backlog are removed; their
+history remains in Git. CI now enforces unique, contiguous checklist IDs,
+rejects dangling work references, and prevents the retired files from returning.

package/dist/template/.changeset/product-gift-share.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Let a customer share a product gift list as a public registry, and send a gift
+card as a private claim link. Neither puts a contact id or a card code in the
+URL; both resolve people through the contact spine.

package/dist/template/.changeset/project-case-studies.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Publish completed projects as consent-gated CMS case studies with typed story
+blocks, measured outcomes, before/after image pairs, contact-backed
+testimonials, and reciprocal links from public service pages.

package/dist/template/.changeset/projects.md

@@ -0,0 +1,24 @@
+---
+"freeholder": minor
+---
+
+Projects gather a job into one place. Start one for a customer — or for
+yourself, because your own work is still work — and attach the quote they
+accepted, the agreement they signed, the appointments in the diary, the hire
+that went out and the invoice that is still unpaid.
+
+Nothing is copied. Everything on a project is a link to the real thing, so the
+invoice shown here is the invoice in your ledger and there is never a second
+answer to what somebody owes.
+
+Each project keeps a list of what still has to happen, so the work inside the
+work sits beside the paperwork rather than in another tab. You can record what
+the job achieved too — "time on site up 40%" — with a field for how you
+measured it, and Freeholder points out when that field is empty, because a
+claim you cannot back up is one you should not publish.
+
+Photographs pair properly: a before and an after belong together rather than
+being two uploads that happen to be next to each other.
+
+This is the same record your public case studies will be built from later, so
+finishing a job and showing it off are the same thing rather than two.

package/dist/template/.changeset/provider-recording-erasure.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C1.08/C3.13: Keep privacy erasure in progress until durable provider cleanup jobs succeed. Daily cleanup verifies the original room/domain, closes the call, removes recordings and transcripts and checks the resulting inventory. Local deletion commits its retry task in the same transaction. Retention holds protect cascading parent rows; pending receipts survive cleanup and cannot be silently cancelled, denied or overwritten. The privacy request screen explains pending work in English, French and Spanish and links authorized staff to background jobs.

package/dist/template/.changeset/provider-workflows-without-open-transactions.md

@@ -0,0 +1,15 @@
+---
+"freeholder": patch
+---
+
+Connecting Gmail, Outlook, calendars, social profiles, and signup contact
+imports no longer ties up a database connection while an outside provider is
+responding. This removes a pool-exhaustion failure mode without changing any
+public service name or callback.
+
+OAuth state is still single-use: Freeholder commits the claim before spending
+the provider code, validates identity and permissions outside the transaction,
+then atomically stores credentials. Signup contact selections also recheck the
+current account, owner policy, and import limit immediately before staging.
+The private phases stay caller-authorized and audited while remaining hidden
+from HTTP, OpenAPI, and MCP.

package/dist/template/.changeset/public-beta-2.md

@@ -0,0 +1,4 @@
+---
+"freeholder": patch
+---
+Publish the second public beta at 0.2.0-beta.2, carrying everything merged since the first: passkey-first owner setup and guided agent connections, public booking, membership signup, the blog index and client portal, and the adversarial audit fixes. This is still active development, not a release candidate or stable release; live provider acceptance and the independent security review remain open.

package/dist/template/.changeset/public-beta-preparation.md

@@ -0,0 +1,4 @@
+---
+"freeholder": minor
+---
+Prepare the first public beta at 0.2.0-beta.1, with aligned package, SDK and image versions and explicit backup and recovery instructions. This is active development, not a release candidate or stable release; paid-event admission and final acceptance remain open. Pin the npm publisher, support provenance-bearing staging for the first packages and OIDC trusted publishing thereafter, and use the canonical repository URL in package metadata. Discover the signed upstream feed from public release metadata so beta-only releases are available without assigning stable/latest.

package/dist/template/.changeset/public-cart-checkout-confirmation.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Public cart, checkout and order confirmation — the shopper-facing half of the C3.24 parity mapping's G2 gap (C3.25 slice 3), built on the existing C5.20–C5.22 services with no parallel money path. Product cards on `/c/<slug>`, `/search` and the product detail block gain add-to-cart (a variant picker when the product has options), quoted by one new public `catalog.purchaseOptions` projection that reads the same `resolvePrice` and `availability` the cart refreshes from. The guest's cart capability travels in an HttpOnly `fh_cart` cookie (`<cart id>.<cart token>` — the services still refuse an id without the matching token), and a new `cartWidget` chrome block renders the count and a mini-view; fresh instances get it in the default header. Public pages: `/cart` (option labels, quantity, remove, save-for-later handoff to the existing wishlist for signed-in customers), `/checkout` (contact fields resolved through `contacts.resolve`, delivery methods quoted live from `catalog.quoteShipping`, terms, the existing idempotency), and `/orders/confirm` (token-gated order summary with the existing customer-invoice pay path — hosted checkout through the configured adapter when one is live, offline instructions when the business collects manually). Naming a contact is authority, so the public `catalog.shopperCheckout` entry point proves the email first — the platform's existing customer magic link — and only then composes `checkoutCart`; a signed-in customer whose contact email matches checks out in one step. Guests read their order back through `catalog.shopperOrder`, which extends the cart-token gate to the converted cart's order and nothing wider. Checkout and confirmation are noindexed/nofollowed; cart is a noindexed utility with a canonical; chrome translates in en/fr/es/ar. The merchandising editor blocks remain with C2.24.

package/dist/template/.changeset/public-entity-drafts.md

@@ -0,0 +1,6 @@
+---
+"freeholder": minor
+---
+
+Editing a live product, event or newsletter issue now saves a working draft.
+The public page stays as it was until you publish again.

package/dist/template/.changeset/public-gates.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Every change to Freeholder is now checked by crawling a complete example site
+the way a search engine would — page titles, descriptions, canonical links,
+headings, image descriptions, structured data and the links between pages — and
+by an accessibility pass over the main page templates. A change that would have
+quietly damaged how your site is found or read now fails before it ships.

package/dist/template/.changeset/public-playground-host-updates.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+C1.38/C10.31: Add an isolated public playground with restricted visitor sessions,
+an hourly reset recipe and a persistent privacy notice. Add an opt-in Docker host
+updater with publisher signature verification, restored-backup rehearsal,
+unchanged-schema gating, maintenance cutover and verified image recovery.
+The owner can request an update after fresh two-factor authentication; the host
+can also check daily. Schema-changing releases still require a manual upgrade.

package/dist/template/.changeset/public-project-portfolios.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Publish a template-backed portfolio index and reusable project collections with
+public service, collection and text filters, accessible media, sharing,
+CreativeWork metadata and sitemap-ready URLs.

package/dist/template/.changeset/publish-image.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Freeholder is now published as a ready-built container image, so deploying it
+no longer means building it yourself. Your server pulls the image and starts —
+no GitHub account, no build tooling, and no fork of this project required.

package/dist/template/.changeset/purge-without-open-transactions.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Permanently deleting a trashed file now removes it from the library before
+Freeholder talks to object storage. If deleting the bytes is interrupted, the
+leftover objects stay as sweepable litter rather than a library file that
+points at missing originals. Owner confirmation and the thirty-day trash
+window are unchanged.

package/dist/template/.changeset/push-notifications.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Your customers' phones can now be registered for push. A device is registered
+against the contact like any other way of reaching them, so the same per-topic
+preferences apply and nothing gets pushed that would not also have been
+emailed. Booking confirmed, gallery ready, invoice due and back-in-stock are
+now topics people can turn on or off individually. A phone handed on to
+somebody else moves rather than quietly notifying the wrong person, signing out
+stops the pushes, and merging two duplicate contacts keeps both their devices.

package/dist/template/.changeset/queue-performance-clock.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C11.11: The opt-in performance harness now measures twenty real queue dispatches through the application worker, reports enqueue-to-start p95 from database timestamps, and fails on missing or failed work. Requested auxiliary measurements can no longer disappear from the large-dataset verdict. Reference-host acceptance and the remaining browser, editor, migration and boot clocks remain open.

package/dist/template/.changeset/quote-conversion.md

@@ -0,0 +1,22 @@
+---
+"freeholder": minor
+---
+
+Accepting a quote now starts the work. The moment a customer says yes,
+Freeholder opens the project, issues the agreement if you asked for one, puts
+the appointments you scheduled in the diary, and drafts the deposit and balance
+invoices — all at once, or none of it, so you are never left with an invoice
+and no job to explain it.
+
+You decide what each quote sets in motion. A kitchen refit and a one-hour
+consultation are not the same job, so the plan lives on the quote rather than
+in your settings.
+
+Invoices arrive as drafts. Freeholder never sends money requests on its own and
+never guesses a tax treatment on your behalf — you review and issue them.
+Appointments only appear for times you actually gave it: a quote carries a
+price, not a date, and inventing one would put a fiction in your diary.
+
+Everything lands on the same customer. Not a copy, not a new "billing contact"
+— the person who accepted is the person on the invoice, the agreement and the
+appointment.

package/dist/template/.changeset/quote-partner-share.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Let a prospect send a quote to a business partner as a view-only link. The
+partner can read the offer; they cannot accept, decline, change options or
+invite anyone else. The prospect's own link is still the one that decides.

package/dist/template/.changeset/quotes.md

@@ -0,0 +1,22 @@
+---
+"freeholder": minor
+---
+
+Quotes are here. Draft an offer with as many lines as it needs, mark some of
+them optional so the customer can choose, and send it — they get a private link
+with no account to create.
+
+They can read it, tick the extras they want and watch the total update, ask a
+question, accept it by typing their name, or say no with a reason you can
+actually learn from. You see when they opened it, which is usually the moment
+worth following up on.
+
+Every version is kept. If you revise a quote — because they asked, or because
+you had a better idea — the old lines stay exactly where they were, so "you
+quoted me a different price" has an answer rather than an argument. A quote
+already with the customer cannot be quietly edited: the only way to change it
+is a revision they can see, and the link they already have opens it.
+
+What they accept is frozen at the moment they accept it, down to which optional
+lines they chose. Quotes with a date on them lapse on their own and land on a
+list to follow up.

package/dist/template/.changeset/real-browser-accessibility.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Add translated skip-to-content paths, stronger reduced-motion behaviour and
+mobile admin reflow, enforced by real-Chromium accessibility checks across
+setup, admin, editor, storefront and portal in both light and dark themes.

package/dist/template/.changeset/recipe-bootstrap-fixes.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Deploying to your own server now actually works end to end. Three things were
+stopping it: the server setup script was silently ignored, starting the site
+left you with an empty database and an error page, and the published image
+could not be told where to keep your files. Fixed, with tests so they stay
+fixed.

package/dist/template/.changeset/recipe-update-backup-gate.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+The Tier-1 recipe gate now enforces the tested backup the 2026-09-21 readiness repair requires. A recipe that wants to stay Tier 1 must declare `operations.backup` producing a custom-format PostgreSQL dump and `operations.restore` that restores it into a database, alongside its existing update/rollback strategy and immutable-pin checks — a rollback pin is only real if the data it returns to still exists (C10.10).

package/dist/template/.changeset/recipient-messaging-policy.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Enforce recipient-local quiet hours and daily/weekly message caps through one
+service-layer policy for global, canonical-segment, and contact scopes. Ship a
+safe 8am–9pm baseline, business-timezone fallback, system-only transactional
+exceptions with durable evidence, and time-independent regression coverage.

package/dist/template/.changeset/record-search-orders-subscriptions-gifts.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C11.14: Find orders by ID, product name or SKU, subscriptions by ID or plan name, and gift registries by title or slug in global search. Results use each record's exact read permission. Add a read-authorized subscription detail page and English, French and Spanish labels. Remaining record-search opt-outs and per-record restore are still incomplete.

package/dist/template/.changeset/record-studio-permissions.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Allow same-origin camera, microphone, and screen capture so Record Studio can
+request the browser permissions it needs. Geolocation and Payment Request stay
+disabled, and every capture still requires the browser's explicit user grant.

package/dist/template/.changeset/record-trash-every-row.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+"@freeholder/sdk": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C11.14: Pages, forms, popups, segments and saved views now move to recoverable trash, on the same guarantees notes and tasks shipped with (#381) through one shared factory. Removal keeps the original row and its identity — a trashed page holds its slug, submissions stay live while a form definition is in trash, and a trashed segment stops answering so popups, price lists, automations and messaging windows fail closed instead of widening. Restore returns the same record; permanent purge requires typed confirmation and recent identity verification, honours privacy retention holds on cascaded contact data, and a daily bounded sweep reclaims every family's thirty-day trash. The trash screen gains a tab per family with the records' existing view/manage (or ownership) grants, locales ship in en/fr/es, and the SDK/OpenAPI/MCP surfaces expose the new remove/restore/purge methods. Erasure still reaches evidence rows inside trash, and restoring never resurrects erased personal fields. Money ledgers, append-only evidence, credentials and never-deleted families are documented as deliberately not recoverable in `deploy/record-trash.md`.

package/dist/template/.changeset/recurring-invoices.md

@@ -0,0 +1,24 @@
+---
+"freeholder": minor
+---
+
+Invoices that come round again. Set up a retainer or anything else you bill on
+a cycle — weekly, monthly, quarterly or yearly — and Freeholder raises each
+period's invoice for you. Each one is its own invoice with its own due date and
+its own receipt, which is what makes your aged-debtors list mean something.
+
+It raises a draft by default. Sending an invoice to a customer with nobody
+looking is the one thing you cannot take back, so it waits for you unless you
+tick the box. And if Freeholder is off for a fortnight it picks up from now
+rather than sending a fortnight of invoices when it wakes up.
+
+Editing a schedule changes what the next invoice says, never what an issued one
+said. Putting your retainer up in March does not re-issue February.
+
+Overdue invoices now actually go overdue. The status existed but nothing set
+it, so an invoice sailed past its date and still said "sent" until you noticed;
+it is swept hourly now.
+
+And you can chase. Pick a nudge before the due date and one or two after, and
+Freeholder sends them — except to anybody who has already paid, which it checks
+at the moment of sending rather than when you set it up.

package/dist/template/.changeset/referral-attribution.md

@@ -0,0 +1,20 @@
+---
+"freeholder": minor
+---
+
+Know where your customers actually came from. Give a referrer a code, and every
+way somebody can arrive with it — a link, a QR code scanned at a market stall,
+a code typed at the till, an invitation followed — is recorded in one place, on
+your own server, with no third party involved.
+
+A click counts even when it happened long before the person told you who they
+were: the visit is matched to them when they finally get in touch.
+
+You choose how credit is awarded — the first touch, the last, or split across
+the whole journey — and you can change your mind. Because every touch is kept,
+changing the rule re-reads your history rather than rewriting it, and last
+month's answer updates with it.
+
+Nobody can refer themselves, and there are no chains of referrers earning off
+each other — the shape of the data refuses it rather than a policy asking
+nicely.

package/dist/template/.changeset/referral-commissions.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Referrals now pay. A conversion by a referred customer writes a commission against the referrer, held back until the programme's refund window closes and then approved automatically. A refund inside the window reverses it; a refund after the money has gone out writes a negative row that nets off the next payout batch instead of becoming an argument.
+
+Payouts are batched, one line per person however many codes they have, and export as CSV in minor units for a bank or an accountant. Tax paperwork is tracked and prompted for above a threshold — the platform records it and does not file it.
+
+Referrers see their own earnings in the customer portal, through the same query the owner reads.
+
+A programme can pay its referrers in loyalty points instead of cash by setting its commission to "none": the conversion is still recorded, and a loyalty earn rule matching it grants the points.

package/dist/template/.changeset/register-stored-original-without-open-transactions.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Confirming a capture or generating a social variant no longer holds a
+database connection open while Freeholder scans the staged file and builds
+renditions. Leftover objects from a failed confirm stay as sweepable litter.

package/dist/template/.changeset/release-channels.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Releases declare a channel (stable, security or edge) plus compatibility,
+schema risk, CVSS and any manual steps. The updater reads that metadata; it
+does not infer safety from a version number.

package/dist/template/.changeset/remove-forced-builder-credit.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+C2.11: Remove the fixed WeVibeSites credit and phone number from public pages. A site's footer now contains only the content its owner publishes.