nexus-shared 3.1.0 → 3.2.0

package/CHANGELOG.md

@@ -1,446 +1,704 @@
-# Changelog
-
-Notable changes to `nexus-shared`. The **values** of exported constants count as API here: several of them are the
-Nexus backend's own numbers, and a value that differs from the backend by one does not fail loudly — it silently
-means the wrong thing on every record and every permission check.
-
-## 3.1.0
-
-**New features, no code break.** Every export of `3.0.0` is still exported (49 are new: 33 from `nexus-shared`, 16 from
-`nexus-shared/client`), and no exported constant changed its value, so `^3.0.0` takes it. The owner chose the number
-on 2026-10-08. What can move for an app is its **stylesheet overrides**: these class names and custom properties were
-renamed or dropped, and an override of the old name no longer applies.
-
-| Was | Now |
-|---|---|
-| `.nx-columns__head`, `__title`, `__count`, `__foot` | `.nx-table-panel__head`, `__title`, `__count`, `__foot` |
-| `.nx-table-panel__body` | `.nx-popover__scroll` |
-| `.nx-chat-avatar`, `--nx-chat-avatar` | `.nx-avatar`, `--nx-avatar-size` |
-| `.nx-table__frame`'s border | on `.nx-table` |
-| `--nx-field-scrollbar`, `--nx-field-scrollbar-hover`, `--nx-dropdown-scrollbar`, `--nx-time-scrollbar` | gone: one thin bar everywhere |
-| `.nx-form__skeleton*` | gone: a loading form shows its real inputs, disabled |
-| `.nx-excel__refused` | gone: the import's report lists are `.nx-excel__problems` |
-
-- **Bulk insert, and rows added to an import (the owner, 2026-10-07).** `ExcelImport` and `openExcelImport` take
-  `mode: "bulk"`: the import with no file, its new rows' editor opening with one empty row for the person to type
-  into, sent to the same `Excel/Import` with the same checks, a problem then naming its row ("Row 3 · Region name").
-  `DataTable` offers it as **Bulk insert** beside **Import from a spreadsheet**, and only beside an Add, as it is an Add
-  of many rows (`TableExcel.bulk: false` leaves it out). A sheet with a required list cannot be typed in - a list's key
-  is picked in the spreadsheet - and the panel says so; its file review takes no added rows either. Any other file's
-  new rows take Add, Insert and Duplicate: an added row is numbered after every row the file had
-  (`excelSheetRows(rows, columns, after)`), and one left empty is dropped, not refused. The new rows no longer fold
-  away (folding unmounted the editor and lost every edit), the footer counts what will be sent, and the review is inert
-  while an import is out.
-- **Nothing typed is lost unasked.** Closing the window, or Start over, over rows typed or changed in it asks first
-  (`ExcelImportHandle.unsavedRows`); picking the entry again while its window is minimized brings that window back
-  rather than a fresh one. An untouched date or time is no edit: `toInputValue` reads them as their inputs do.
-- **An import that wrote nothing keeps its rows** and lists under them each refusal, by row, in the backend's words:
-  `readExcelResponse` keeps a refusal's report (`result`, as XLS_X044 sends it) instead of dropping it, so the panel no
-  longer says only "No Region was added". Refusals read in row order.
-- `ExcelEditorRow`'s three own fields are optional, as an added row has none; new helpers `excelRowNumber`,
-  `hasExcelValues` and `isExcelRowTyped`, and `excelProblemPlace(problem, byRow)`. `RowsInputHandle.remove(index,
-  { undo: false })` drops a row with no Undo offered, and keeps the person's own last Undo where it was.
-- **A list shows what an import wrote.** After an import, `DataTable` runs `excel.onImported` first and reads its rows
-  after it: a `Crud` drops its cached lists there, and the reload used to be asked before, so on a page just opened it
-  was answered from the cache and the imported rows stayed off the screen until a reload.
-- **What imported records start as.** `ExcelSettings` gains `recordStatuses` (`ExcelRecordStatus`: `value`, `label`)
-  and `defaultRecordStatus`; when a model offers any, the import shows "New records start as", the default picked,
-  and sends the choice (`importExcelRows(..., { recordStatus })`; `ExcelBackend.importRequest(rows, recordStatus?)`,
-  the Nexus one sending `{ rows, recordStatus }`). The report says "3 cities added as In review".
-- **`Crud`, from the owner's review on 2026-10-07.** The active list is labelled **Active**, not "All" - it leaves out
-  the trash and the deleted. **Recover asks first** ("Recover Asia?", "It goes back to the active list."), one record
-  or many, like trash and delete. Recover and Move back to trash wear the back arrow (`iconArrowBackUp`): the
-  clock-shaped restore icon read as History beside a page's history action.
-- **`details.actions`**: buttons of the page's own in the details popup's footer, before Edit and Close
-  (`CrudDetailsAction`: `id`, `label`, `icon`, `endpoint`, `hidden`, `onSelect(row, popup)`). One that names an
-  `endpoint` shows only to a user who may call it, by the rule every built-in action follows.
-- **The spreadsheet import, as the owner asked on 2026-10-07.** Once a file is picked, the steps and the template and
-  file buttons give way to the file's name; another file is a Start over (now a bordered button) or a fresh popup. The
-  rows already there are read-only and never sent, and the footer says they are skipped. The new rows have Remove and
-  Lock at their end. After an import the review is gone: the panel shows what was added, what was not written and why,
-  and what was skipped and why. The `nx-excel__refused` list is gone with it; the report's lists are
-  `nx-excel__problems` blocks.
-- **`TabularForm` `actionsAt="end"` and `lockable`.** The row's actions in a column fixed at the right edge, as a data
-  table has them: Remove and Lock as buttons of their own, anything else in a menu after them. A locked row's inputs
-  are read-only ("Locked: unlock the row to change it.") and it cannot be removed; the locks are the screen's, never
-  the value's.
-- **A tabular form no longer jumps when a cell is clicked.** The line under the table, which holds the hint or the
-  message of the input with focus, keeps its height whether or not it says anything.
-- **A slow answer lands in the list the user moved to.** `Crud` writes an action's answer into the table only when
-  the table still holds the list the action was asked from, fully loaded. Otherwise (the user switched lists while
-  the request was out, or a list is still loading) it patches every cached list and reads the one on screen again from
-  them, stopping a load that may have been asked before the change. Before, a record trashed from the active list and
-  answered after a switch to the trash was written over by the stale trash list and showed in neither list until the
-  page was opened again. The same rule covers `handle.apply`, Add, Edit and the read-back after an Add; a Create that
-  answers no key now loads the list instead of showing the cached one.
-- **The theme panel is a quick preference panel.** Under the theme, `ThemeSwitcher` now shows `PreferencesPicker`
-  (`preferences={false}` leaves it out): Language and region (interface language, calendar), Dates and times (date
-  picker language, clock, display date format: the existing `DatePreferences`), Numbers (number scale, thousands
-  separator) and Tables (default page size, a row click opens the record). New: `UserPreferences`,
-  `readUserPreferences`, `setUserPreferences`, `useUserPreferences`, `subscribeUserPreferences`, `useNumberLocale`,
-  `DEFAULT_USER_PREFERENCES`, `PREFERENCE_STORAGE_KEYS` (`nx-language`, `nx-number-scale`, `nx-thousands`,
-  `nx-page-size`, `nx-row-click`), `InterfaceLanguage`, `ThousandsSeparator`, and `ENumberScales` (the core's enum, by
-  member value).
-- **Numbers follow the person's settings.** `numberLocale(scale, separator)` gives `en-US`/`en-IN` or a key such as
-  `"en-IN|.|,"` that `formatNumber`, `parseNumber` and `getNumberSymbols` read. `NumberBox` and `Slider` use it when
-  they have no `locale` (they defaulted to `en-US`, which is still the setting's default), and so do a `DataTable`'s and
-  `CrudDetails`' number cells (`CellTextOptions.locale`, new). A number box rewrites its text when the setting changes.
-- **`DataTable` `pageSize` and `openOnClick` give way to the person's choice once it is made**: the default page size
-  (when the table offers it) and the row click. A page size picked in a table with a `stateKey` still wins, and that
-  table now saves a size only when it differs from the one it opens with, so a later default reaches it.
-- **Animations: On, Off or System, chosen in the theme panel.** `ThemeScript` now writes `data-nx-motion`
-  (`reduce` or `full`) on `<html>` before the first paint, from the visitor's choice (`data-nx-animations`, saved as
-  `nx-animations`) and the system's `prefers-reduced-motion`, and keeps it current when the system setting changes.
-  **Every stylesheet reads that attribute instead of the media query**, and so does script motion (the popup's
-  minimize and maximize, smooth scrolls). On animates on a machine whose operating system turned animations off; Off
-  never animates. An app that does not render `ThemeScript` animates whatever the system says. New: `AnimationMode`,
-  `setAnimations`, `motionFor`, `REDUCED_MOTION_QUERY`, the `ANIMATIONS_*` and `MOTION_ATTRIBUTE` constants, and
-  `useTheme()`'s `animations`, `motion` and `setAnimations`.
-- **Density: Compact or Cozy.** `data-nx-density` on `<html>` (`nx-density`; `setDensity`, `useTheme().density`).
-  Cozy makes `--nx-control-sm/md/lg` 32/38/44 and the new `--nx-row` 38; compact is exactly the old sizes. Table rows
-  and headers, menu items, dropdown options and the Columns panel's lines are now sized from `--nx-row`, so they
-  follow it. `ThemeScript` takes `defaultDensity`.
-- **Scale grid, development builds only**: Off, px (a line every 4px, solid every 48px) or mm (millimetres, solid every
-  centimetre), drawn over the window on `[data-nx-grid] body::after`. `ThemeScript`'s `grid` and `ThemePicker`'s
-  `showGrid` default to `isDevelopmentBuild()`, so a production build neither shows the section nor applies a saved
-  grid. New: `ScaleGrid`, `setScaleGrid`, `isDevelopmentBuild`.
-- **`ThemePicker` / `ThemeSwitcher`** add Density, Animations and Scale grid under Mode and Theme (`showDensity`,
-  `showAnimations`, `showGrid`).
-- **Popups fade in and out** (160ms in, 120ms out), with nothing else moving: the slide and scale are gone. **Every
-  popover panel fades** in and out in 120ms through one rule on `.nx-popover`; the menu's, the table panels' and the
-  dropdown's own opening animations are gone. A closing panel takes no clicks, and nothing waits for a fade.
-- **Popover panels fit the window.** `placeUnderAnchor` and `placeAtPoint` pick the side that fits, or the one with
-  more room, and write that room as `--nx-popover-room`; a panel that marks its scrolling part `.nx-popover__scroll`
-  is never taller than it. That part reaches the panel's right wall, so its scroll bar sits on the wall, and carries
-  the right padding inside. Menus, the theme panel and the table's Columns and Filters panels use it; `usePopoverPanel`
-  lost its own height cap. New `showPanel` opens a panel scrolled to the top, and a hovered menu item no longer scrolls
-  its list. Placing an open panel again (on every scroll) no longer throws its list back to the top.
-- **A panel's padding is `--nx-popover-pad`.** `.nx-popover`'s own padding loaded after the menu's and the table
-  panels', so a menu was 16px inside its edge, not the 4px it asked for, and the table panels 16px, not 8px; both now
-  get theirs. `.nx-table-panel__body` is gone (`.nx-popover__scroll`).
-- **One thin, quiet scroll bar everywhere, the design lab's.** `Nexus.Base.css` gives every element
-  `scrollbar-width: thin` and a thumb of the text colour at 22% on no track. The theme panel, menus and context menus,
-  the table's Columns and Filters panels, popup bodies, the date-time panel, the chat, code blocks and tables in
-  Markdown and rich text, and the admin page and menu drew the browser's 15px bar with a painted grey track; on
-  Windows, Chrome and Edge now draw every bar 10px wide, as the lab does (Firefox's thin bar is 8px; Safari draws its
-  own thin bar). The components' own bars are gone: the 8px `::-webkit-scrollbar` pill of the text area, the Markdown
-  preview and the rich text (Chromium and WebKit ignore it once `scrollbar-width` is set), and the thin bar with a
-  stronger thumb of the tree, the tabular form, the dropdown list and the time picker. The data table's rows keep
-  theirs (`Nexus.Table.css`) until a later change, and the time picker's columns still hide the thumb until the
-  pointer or the keys are in them. `--nx-field-scrollbar`, `--nx-field-scrollbar-hover`, `--nx-dropdown-scrollbar` and
-  `--nx-time-scrollbar` are gone; the text area's resize grip reads `--nx-field-grip`. Room kept for a bar narrows with
-  it: every `scrollbar-gutter: stable` (the admin page and its bar, whose right edge moves from 27 to 22px off the
-  window, the chat thread, the dropdown list) and the padding a modal popup keeps for the page's bar
-  (`--nx-scrollbar-gap`, measured).
-- **A form whose values load shows its real inputs, disabled, instead of placeholders.** A `Crud`'s Edit popup, an
-  `ApiForm` with `loadValue` and a `Form` with `loading` have their final size from the first frame, and the values
-  land in the same inputs, as a load (no "Unsaved changes", no "Discard your changes?"). While loading, `FormStore`
-  takes nothing typed, even from an input whose `disabled` was taken off by hand, and draws such an input again from
-  the store when loading ends; a submit already waited. The `.nx-form__skeleton*` classes and their animation are gone.
-- **The form's status line keeps its one line when empty, and a form's bar fills a popup's foot**, so the status sits
-  beside the buttons: "Loading…" or "Unsaved changes" coming and going no longer moves the bar, and a `Crud` popup
-  lost the empty 12px row it had above its buttons.
-- **`Avatar`** (`nexus-shared/client`): a person's round picture, or their initials on a soft tone without one or
-  when it fails to load. `size` `sm`/`md`/`lg` or `--nx-avatar-size`; `onChangePicture` makes it a button with a
-  camera over it on hover. The chat's and the dropdown's avatars are now this one: `ChatAvatar` and
-  `DropdownAvatar` still exist and draw it, `.nx-chat-avatar` is gone (`.nx-avatar`), `.nx-dropdown-avatar` stays
-  as the dropdown's size, and `--nx-chat-avatar` is `--nx-avatar-size`.
-- **`Button` `dot`**: a small dot on the corner, for something new behind it such as unread notifications; `"primary"`
-  marks a state that is on, such as filters.
-- **`Menu`: a control inside a heading is chosen like a row.** An entry `{ heading: <node> }` may hold a button with
-  `role="menuitem"`: the arrow keys walk it with the rows, and a click on it closes the menu. A menu opened from the
-  keyboard still starts on its first row.
-- **The data table is one frame**: the bar, the rows and the footer sit in one border (`.nx-table` carries it now,
-  not `.nx-table__frame`), with a line under the bar and the footer as the bottom band (`--nx-footbar`, a new
-  token). An empty bar takes no room. Column headings are 12px, weight 650.
-- **`DataTable` `add`**: the table's own Add, first in the bar. With `excel`, it is a split button whose arrow holds
-  Download template, Import from a spreadsheet and Export to Excel, which then leave the options menu. `Crud`
-  passes its Add this way.
-- **The data table's bar is one line on a wide table, in a new order**: the Add section (`add`, then the page's
-  `actions`) and the lists (`toolbar`) on the left; Reload, the options menu (⋮) and the search, rows per page inside
-  it, on the right. It was the lists, the search, Reload, ⋮, `actions` and Add, wrapping where they fell: at 1126px
-  on the admin shell the bar broke into three ragged rows. A narrower table now moves whole parts, by its own width
-  (container queries on `.nx-table`): under 670px the search takes the top line (with nothing on the left, it leads
-  the buttons' line), under 375px Reload moves to the end of ⋮ (`DataTable` asks the hidden button, so the width is
-  written once, in the stylesheet), and under 325px, beside lists, the Add section takes the last line with its buttons
-  sharing it. On the admin shell those are windows of 695, 400 and 350px. A bar wider than those widths expect (a
-  long Add label, the page's own buttons, cozy density) is squeezed into the next step as soon as a line would break
-  (`data-squeeze` on `.nx-table__bar`, set a frame after a size change). A `toolbar` or `actions` that renders
-  nothing takes no room and decides no step, and a bar left with nothing else is hidden. New classes
-  `.nx-table__bar-add` (Add and `actions`) and `.nx-table__reload`; the search is now a child of `.nx-table__bar` after
-  `.nx-table__bar-end`, not inside it, and grows to 19rem from a 12rem basis.
-- **Columns opens from the options menu (⋮)**, as its first item; the bar has no Columns button. Reload, Columns
-  and the options button are ghost buttons. `TableColumnsPanel` takes an `anchor` and an `open()` handle for this.
-- **`TabButtons` `labels="auto"`**: every label while its container (a data table) is at least 900px wide, only the
-  chosen one's below. `Crud`'s lists use it.
-- **`DataTable` `selectBy`**: while rows are selected, their count opens a menu that selects again by what the rows
-  are: All on this page, then each `{ label, icon, test }`, which leaves exactly the matching rows on the page
-  selected. `Crud`'s main list offers Pinned, Not pinned, Flagged and Not flagged.
-- **`SplitButton` `fixed`**: the main button never changes; the menu holds other ways to do it, run when picked.
-- **`DataTable` `filterInputs`: an advanced filter.** Input params, each named after the column it filters, become
-  **Filters** in the options menu (⋮): a small form under the button, applied as it changes. The values are
-  `TableQuery.filters` (`TableStore.setFilters` sets them, `{}` clears); a client table matches them in `queryRows`
-  (a fifth argument), and a server gets them flat by name through `CrudBackend.pageRequest`'s third argument, as
-  `filterRequest` writes them (a date range as `{name}From`/`{name}Before`). A `CrudBackend` or loader of your own
-  ignores them until it reads that argument or `query.filters`. Also new: `activeFilters`, `asFilterInput`,
-  `filterMatcher`, `filterNames`; `usePopoverPanel` and `PopoverPanelHandle` (`nexus-shared/client`), the panel
-  Filters and Columns share; `followAnchor`'s second argument, a panel whose size it follows too.
-- **Renamed: `.nx-columns__head`, `__title`, `__count` and `__foot` are `.nx-table-panel__*`**, shared by both panels.
-  An override of the old names no longer applies.
-
-## 3.0.0
-
-**Breaking. This changes the value of exported constants, and `2.0.0` is on npm with the old ones.** Publishing it
-as a patch or a minor would hand `^2.0.0` consumers different numbers under a compatible-looking range, which is the
-worst way to ship this, so it takes a major. The owner chose the number on 2026-10-02, together with `nexus-public`
-and `nexus-admin`, which both depend on this package and so move to `3.0.0` with it; their `nexus-shared` range is
-now `^3.0.0`, because a bump of this one alone would leave them pulling the old, wrong constants.
-
-**`nexus-icons` must be installed at `1.1.0` or newer**, and the dependency range here says so. The chat components
-added in this version use `iconChecks`, `iconCornerUpLeft`, `iconMessageCircle`, `iconPaperclip`, `iconSend` and
-`iconUserPlus`, none of which exist in `nexus-icons@1.0.0`: with the old range a fresh install resolved to `1.0.0`
-and the build failed on six missing exports.
-
-### `NexusModule` — `Chat` added, and every module after it moved up one bit
-
-The backend's `EModules` gained `Chat` at bit 6, and everything after it shifted. `NexusModule` follows it exactly.
-A permission is a bitmask of these flags, so a package that kept the old numbers would grant and deny the wrong
-modules without any error to show for it.
-
-| Module | Was | Now |
-|---|---|---|
-| `None` | 0 | 0 |
-| `Migrations` | 1 | 1 |
-| `Configuration` | 2 | 2 |
-| `Identity` | 4 | 4 |
-| `Enterprise` | 8 | 8 |
-| `Drive` | 16 | 16 |
-| `Message` | 32 | 32 |
-| **`Chat`** | *(did not exist)* | **64** |
-| `Accounting` | 64 | **128** |
-| `Report` | 128 | **256** |
-| `Requisition` | 256 | **512** |
-| `Tenant` | 512 | **1024** |
-| `Subscription` | 1024 | **2048** |
-| `Reservation` | 2048 | **4096** |
-| `School` | 4096 | **8192** |
-| `Pharmacy` | 8192 | **16384** |
-| `Staffing` | 16384 | **32768** |
-| `Portfolio` | 32768 | **65536** |
-
-`NEXUS_MODULES` gained the matching entry (`key: "chat"`, `label: "Chat"`, `env: "API_CHAT"`), so `Chat` can be
-looked up, proxied and named in messages like every other module.
-
-**What to check when you upgrade.** Code that uses the names (`NexusModule.Reservation`) needs nothing. Anything
-that stored, transmitted or hard-coded a **number** has to be revisited:
-
-- permission masks saved in a database, a cache, a token claim or a settings file;
-- proxy URLs written with a number in place of a key (`/api/app/2048/…` is now `/api/app/4096/…`, and `reservation`
-  by key has always worked and still does);
-- a backend that has not taken the `Chat` shift yet — both sides move together or neither does.
-
-### `NEXUS_FLAGGED_STATUS` — 15 → 25
-
-The owner settled the record-status bands, and `ERecordStatus.Flagged` is seeded at **25**. `NexusCrudBackend`
-decides whether a row is flagged by comparing `recordStatus` to this constant, so a package on 15 while the backend
-writes 25 shows the wrong flag on every row, and flagging one writes a status the backend does not recognise.
-
-The bands, for anything that reasons about them:
-
-| Band | Range |
-|---|---|
-| Active | 0–39 |
-| — Active account | 0–29 |
-| — Flag | **25–29** |
-| — Pending, unverified, in review, approval required | 30–39 |
-| Trash | 40–59 |
-| Delete | 60 and above |
-
-`NEXUS_ACTIVE_STATUS` stays 0, and the `recordStatus < 40` reading of "a live record" that the rest of the code
-already assumes stays right.
-
-Note that **the flag is a range, 25–29, and this release still checks a single value.** Only the seeded member at 25
-has a meaning today, and the bands are about to become configurable per project, so a range-aware check belongs with
-that work rather than here. Do not read the single value as the final answer.
-
-### Removed: the archive
-
-The owner removed the archive on 2026-09-30: a record is live, in the trash, or deleted, and the way back from
-deleted lands it in the trash. The second put-away list and its second recovery path were the only reason the CRUD
-had both Restore and Recover, and the bands close up behind it — **Trash is 40–59 and Delete 60 and above**, so
-nothing stored keeps a meaning it no longer has. `recordStatus < 40` still reads "a live record".
-
-What goes, all of it breaking for anything that named it:
-
-- `CrudMode` loses `"archive"`, so a CRUD shows All, Flagged, Trash and Deleted.
-- `CrudRowActionName` and `CrudMassActionName` lose `"archive"` and `"restore"`. Recover, the trash's own way back,
-  is untouched: a CRUD that offered both now offers one.
-- `CrudEndpoints` loses `archive` and `restore`; `apiController` stops naming `Archive`, `Restore`, `MassArchive`,
-  `MassRestore`, `ArchiveListing` and `ArchivePagination`, and `lists`/`pages` lose their `archive` key.
-- `MessageActionName` loses `"archive"`, and the message builder its words and its "It can be restored from the
-  archive." confirmation detail. `"restore"` stays in the vocabulary: it is a plain verb, not the archive's.
-
-**What to check when you upgrade.** A CRUD that listed `"archive"` in `modes` or `actions` no longer compiles,
-which is the point — the endpoint behind it is gone from the backend too. A backend that still answers
-`ArchiveListing` is not asked for it any more.
-
-### Added: the chat
-
-A discussion on any record — a leave request the manager and a co-worker talk through, a purchase order, an
-applicant, a tender — behind one icon that says whether anything is waiting. Nothing that does not use it changes.
-
-- A conversation is named by three values, `ChatScope`: the **domain** (which kind of record), the **parent id** (the
-  record) and the **user id** (who is reading). The domain is the app's own enum, given either as a template
-  (`<Chat<EDomainTypes> …>`) or once in `ChatRegister`, the same way `ApiRegister` names the module enum. Without one
-  it is a plain number.
-- **No domain numbers are defined here.** They belong to the backend's `EDomainTypes`, and the warning at the top of
-  this file applies to them in full. `defineChatDomains` only gives an app's domains their names on screen.
-- `ChatButton` is an icon in three looks: quiet with no messages, the accent on its tint once there are messages, and
-  the accent filled with an unread badge once some are unread. One size in all three, with the badge over the corner,
-  so a column of them in a table does not move as the counts arrive.
-- `ChatSummaryCache` fills every icon that mounted in the same moment with **one call per domain**. A list whose rows
-  already carry their counts passes `summary` and makes no call at all.
-- `Chat` is the icon with the conversation in a popup; `ChatPanel` is the conversation on its own, for a record's own
-  page. Messages are **Markdown**: written in `MarkdownEditor` and drawn by `MarkdownView`. Enter sends and
-  Shift+Enter starts a line, except in a list or a code fence, where the editor keeps Enter; `sendKey="modifier"`
-  moves sending to Ctrl+Enter.
-- One mark where the time sits says how far a message of your own has got: a spinner while sending, a tick once the
-  server has it, two once `deliveredTo` holds somebody, two in the accent once `readBy` does.
-- Where the data comes from is one interface, `ChatSource`. `apiChatSource` goes through the app's `ChatBackend`
-  (`NexusChatBackend` by default); `localChatSource` keeps a conversation in memory for a demo or a test.
-- **The Nexus endpoints are the shape the Chat module is expected to take, not an API that answers today.**
-  `NexusModule.Chat` is a number and a proxy key; the controller is not built. Each difference, when it lands, is one
-  override on `NexusChatBackend`.
-- `check:themes` gained a rule: body text on the primary tint, which is a message bubble of your own. Every theme
-  clears AAA except catppuccin light at 6.84, so it is held to the AA 4.5 that applies to body text.
-- **A record holds many conversations.** `ChatScope` names the record; each conversation in it is a
-  `ChatConversation` with its own id and a type, `one-to-one` or `group`. `ChatPlaceSource` lists them and starts
-  them, `useChatPlace` is the hook, and `apiChatPlace` is the API one. A panel given a `source` still shows that one
-  conversation and no switch, so nothing that used the first round changes.
-- The panel's body has three views — the thread, the list of conversations, and New chat — and the bar moves between
-  them. With several conversations the title is the switch; with one it is just the title.
-- Starting a chat never asks for the type: one person makes a one-to-one, more make a group, and a name makes a
-  group either way. A one-to-one with somebody who already has one is expected to come back rather than be made
-  twice; `localChatPlace` keeps that rule.
-- `@` at the start of a word offers the people in the conversation, narrows as it is typed, and owns Enter while it
-  is open. A mention is plain `@Name`, or a Markdown link with `mentionHref`; either way the ids travel in the
-  draft's `mentions`.
-- `ChatSnapshot` gained `loaded`: a store that has read nothing yet holds empty counts, and a panel must not write
-  those over what a conversation list already knows.
-
-### Added: several at once, `TabButtons multiple`
-
-`TabButtons` picks one option; with `multiple` it picks several, so a list of choices that must be seen all at once
-(the weekdays a rule runs on, the letters or symbols a pattern allows) needs no second control. Nothing that does
-not pass it changes.
-
-- `value` is an array and `onChange` hands back the chosen values **in option order**, whatever order they were
-  clicked in. Values that match no option are ignored and never handed back.
-- The options are native checkboxes in a `role="group"`: Tab moves between them and Space toggles one. The group
-  still needs `aria-label` or `aria-labelledby`.
-- There is no sliding indicator: each chosen option is raised with the indicator's own colors, border and shadow,
-  and keeps the pointer, since a click takes it away again. An option that is not chosen sits flat on the track.
-- The options **wrap** onto more rows when they do not fit, each row as tall as a one-row track's options, and an
-  option is never narrower than it is tall, so a row of single letters lines up. On a touch screen
-  (`pointer: coarse`) every option is a medium control's height: 26 letters on a phone are 34px targets, not 22px.
-- Made and checked for the `nav` design (`/demo/tab-buttons`, "Several at once"); `design="list"` with `multiple`
-  renders checkboxes too, but has not been checked yet.
-
-### Added: inputs that follow others, `dependsOn`, and a row's own params, `cellParams`
-
-Two optional keys, added 2026-09-26 for the builder's class form, whose company model shows only when the class has a
-company or a branch and whose type arguments offer a key type in one row and a model in the next. Nothing that does
-not pass them changes.
-
-- **`dependsOn: ["hasCompany"]`** on an input's params (Form only). When a named input's value changes — typed, or
-  set from code — this input draws again **without mounting again** (nothing typed in it is lost) and its params are
-  read afresh, so getters for `hidden`, `readOnly`, `readOnlyMessage`, `label`, `hint` or `options` answer for the
-  values as they are now. Its rule is asked again too, so a `required` a getter switched on counts at once. An input
-  that names any is asked `hidden` each time it draws, so it can come and go; one that names none is asked once, when
-  the form draws, as before. Name the input itself to follow its own typing.
-- **`cellParams(row, name, index)`** on `TabularForm` and `GroupForm`: the params of one cell that differ from its
-  column's, such as a picker's `options` and `selectedOptions`. Asked as the row draws; return nothing for the
-  column's own params, and the **same object** for the same answer (the merged params are kept per answer, so the cell
-  does not draw again for nothing). Getters on either side stay getters. Rules still come from the column.
-
-### Added: a generated column in a tabular or group form
-
-Two optional props on `TabularForm` and `GroupForm`, for a column whose values a row's **position** decides rather
-than the user — a bitwise enum's value, a line number, a running total. Nothing that does not pass them changes.
-
-- `deriveRows(rows)` returns one patch per row and runs after every change, including a row being added, removed,
-  duplicated or **moved**. The patches are written as code writes, so only the cells whose value really changed
-  mount again and focus stays on the row's own menu: a keyboard can move a row twice in a row.
-- `cellReadOnly(row, name, index)` is asked for every cell as it renders and returns the reason a cell is
-  generated. The cell is locked and shows that reason as its read-only note. Because it is asked per render, a
-  column can lock and unlock while the form around it changes, which params cannot do — they are fixed once a form
-  opens.
-
-### Added: rows nobody may change, `rowReadOnly`
-
-One optional prop on `TabularForm` and `GroupForm`, for rows the user did not write and may not change — the fields
-a class inherits from its parent, shown first in the same grid as its own. Nothing that does not pass it changes.
-
-- `rowReadOnly(row, index)` returns the reason (or `true`). Every cell of such a row is read-only with that reason
-  as its note, the row's menu in a tabular form offers nothing (no insert, duplicate, move or remove), and the row
-  below it cannot move up past it. Nothing reorders the rows: keep the locked ones first.
-- A locked row says nothing about its columns: the column-header lock is worked out from the other rows in view, so
-  a grid of inherited rows and one own row does not put a lock on every header.
-
-### Added: a panel beside a CRUD form, `form.aside`
-
-An Add or Edit popup can show a panel next to its form: a preview of what a save would produce, a summary, a help
-panel. It takes a node, or a function handed `{ form, action, row }` — `form` being that popup's own `FormStore`, so
-a panel follows what is typed through `subscribeValue()` and the form around it never re-renders for it.
-
-The two are columns above 1000px, each scrolling on its own so a long form cannot push the panel off the screen, and
-they stack below that with the **form first**, in the DOM as well as on the screen. `--nx-crud-aside-width` sets the
-panel's share (default `clamp(20rem, 38%, 44rem)`). Pair it with a wide `form.size` — `xl` or `full`; a panel in a
-560px popup leaves the form nothing. A CRUD that passes no `aside` renders exactly what it did before, wrapper and
-all.
-
-### `TabularForm` reworked: one row control, rows that do not move, one lock per column
-
-The owner called the tabular design bad, from a screenshot of an 18-row table with one generated column. Every fault
-was in this component rather than in the page that used it, so every fix is here. Nothing needs a new prop, and a
-table that passed nothing new looks different — deliberately.
-
-**Breaking, visually and for tests.** Two things a consumer may be reaching for have moved:
-
-- **The remove column is gone.** Remove was a column of unlabelled `×` buttons at the end, beside a row menu that
-  already held Remove: two ways to act on one row, and a whole column spent on one of them. Now a row has one
-  control, the menu beside its number, holding Insert above, Insert below, Duplicate, Move up, Move down and Remove.
-  `removable` still decides whether Remove is offered. A test that clicked a button named `Remove <row>` opens the
-  row's menu instead: `Row 2 actions`, then the `Remove` item. `.nx-tabular__end` and `.nx-tabular__remove` are gone
-  from the DOM and the stylesheet; so is `--nx-tabular-end`, replaced by `--nx-tabular-menu` (the menu's slot width).
-- **The row number no longer opens the menu.** It used to *become* the menu on hover: the number faded out and dots
-  faded in over it, so the numbering looked broken and the grid felt unstable as the pointer crossed it. The number
-  now stays where it is, right-aligned, at every moment, and the menu button sits beside it in its own space,
-  always present. The number column is that much wider.
-
-**Fixed, with no change to how a table is written:**
-
-- **Every row is one line high, whatever it holds.** The row's grid track was sized by its tallest cell, so a single
-  `textarea` column of `rows: 2` made every cell of its row 20px taller than the row's own box — drawing the cells,
-  their edges and their focus rings over the rows below. One row of content therefore looked taller than its
-  neighbours, and a focus ring bled outside its cell. The row now has one track exactly its own height, cells keep
-  what they hold inside their bounds, and a `textarea` fills its cell and scrolls inside it.
-- **No resize grips in cells.** A `textarea` in a cell took `resize: vertical` from the multi-line input rule, so
-  every cell of such a column offered a grip that would break the alignment of its row. They are `resize: none` now.
-- **A filled cell and an empty one are drawn the same.** Same consequence as the above: only the cell with text was
-  tall enough to show what the overflow was doing.
-- **`maxHeight` comes down to whole rows.** The scroller used to end wherever the number fell, cutting the last row
-  in half, which reads as broken rather than as scrollable. The component measures its header, its frame and its
-  real row height and caps itself just under what was asked for. A number too small for one row is left alone.
-- **A generated column says so once.** `cellReadOnly` put a lock in every cell of the column it locked — eighteen
-  locks for one fact. The lock is now on the **column header**, with the reason as its title, and the cells keep the
-  read-only tint and their own reason, which still shows under the table when one is used. A lock that really is per
-  row (some rows locked, not all) leaves the header alone and is drawn per cell as before.
-- **Less chrome.** The frame is `--nx-border` rather than `--nx-border-strong`: the sheet draws every line it needs
-  inside itself, and in a popup or a panel the strong edge was a box around a box around boxes.
-
-## 2.0.0
-
-The rewrite: compiled `dist` with the entry points `.`, `/client`, `/server` and `/styles.css`, in place of 1.x's
-raw TypeScript from `src` with `.`, `/client` and `/interface`. A major version, so nobody on `^1.1.21` is moved
-into a different API.
+# Changelog
+
+Notable changes to `nexus-shared`. The **values** of exported constants count as API here: several of them are the
+Nexus backend's own numbers, and a value that differs from the backend by one does not fail loudly — it silently
+means the wrong thing on every record and every permission check.
+
+## 3.2.0
+
+**New features, no code break.** Every export of `3.1.0` is still exported (99 are new: 72 from `nexus-shared`, 16
+from `nexus-shared/client`, 11 from `nexus-shared/server`), and no exported constant changed a value: six only gained
+keys or entries (`API_ACTIONS`, `CRUD_ROW_ACTIONS`, `CRUD_MASS_ACTIONS`, `MESSAGE_ACTION_NAMES`,
+`DEFAULT_USER_PREFERENCES`, `PREFERENCE_STORAGE_KEYS`). Both were checked against the published `3.1.0`: its exports
+by the TypeScript checker, its constants by importing both builds. The owner chose the number on 2026-10-10. It needs
+`nexus-icons` `^1.2.0`, the first with `iconStarOff`. What can move for an app:
+
+- **A CRUD built from `apiController` reads `BookmarkListing` and writes `SwitchBookmarks`**, the Nexus backend's
+  names since 2026-10-07, in place of `PinListing` / `Pin`. See "Pins and favourites from one call" below.
+- **Stylesheet overrides** of the pinned section's classes and of the outlined field's raised label (both below).
+- **`TablePinnedHead` is deprecated**: `TableSectionHead` takes the section's icon. The old name still renders the
+  pinned section's head, with the pin icon and the new classes, so an import of it keeps building.
+
+### A tree whose children load when they are opened
+
+The owner, 2026-10-09: administrative regions in two versions, a data table and a tree, both paged on the server; the
+tree "when a node is expanded, calls the API, gets the info and caches it". The data table already paged on the
+server, so the change is the tree's. Added only; a tree without `loadChildren` works as before, with one fix it shares.
+
+- **`TreeView` `loadChildren`** (`nexus-shared/client`): asks for an item's children when it is first expanded, a page
+  at a time - `{ parent, parentValue, skip, take, signal }` in, `{ items, total?, hasMore? }` out, at once or in a
+  promise - and for the top level too when `items` is left out. The children go under the item asked for, whatever
+  their own parent field says. New params `childPageSize` (default 50), `hasChildrenKey` (a boolean or a count such as
+  `childCount`; without it an item shows a chevron until its first page answers, and loses it when that is empty),
+  `cacheKey`, `cacheLifetime` and `partialMessage`; `items` is optional now.
+- **Status rows**, rows of the windowed list like the others, reached with the arrows and pressed with Enter or Space:
+  a loading row while a page comes (the parent `aria-busy`, a polite announcement), "Could not load the items." /
+  "Could not load more items." with Retry (the Dropdown's words), and **Load more** with how many are left when the
+  total is known. Focus on one of them follows the page to its first new item. New classes `.nx-tree__row--status`,
+  `--loading`, `--error`, `--more`, `.nx-tree__status-icon`, `.nx-tree__status-text`, `.nx-tree__retry`.
+- **What is loaded stays**: collapse and expand again asks nothing. With `cacheKey`, pages are kept in `treePages`, a
+  `RequestCache` shared by every tree on the page, for 5 minutes: a remount or a second tree asks nothing, and a request
+  already on its way is shared. A failure is not kept, so Retry asks again.
+- **`refresh(value?)`** on the handle drops the kept pages (all, or an item's and everything under it) and loads again
+  only what is on screen - the top level and the open items with rows in view; the rest load fresh when next opened or
+  scrolled to. What is drawn stays until the fresh pages replace it, and an item still there keeps what is open under it.
+- **Checking, with `cascade`**: an item whose items are not all loaded (`TreeNode.partial`) cannot be checked as a
+  whole - a check stands for everything under it, and the value can only hold items that were loaded, so it would
+  silently leave the rest out. A click says so (`partialMessage`); it shows mixed when something loaded under it is
+  checked, never checked; Select all checks the loaded parts. A saved value whose item is not loaded yet stays in the
+  value and checks the item when it comes. Without `cascade` nothing changes.
+- **Nothing asks in bulk**: Expand all, `*` and `defaultExpanded` open loaded items only.
+- **`TreeStore`**: options `lazy`, `lazyRoots`, `hasChildrenKey`; `canExpand`, `find`, `pagesOf`, `beginLoad`,
+  `receivePage`, `failLoad`, `replacePages`, `markStale`, `rootPages`, and `insertMany`, a batch insert that updates
+  counts along one path (a page of 50 into 100,000 items: 0.3 ms); `TreeNode.pages`, `.partial`, `.status`. Helpers
+  `treePages`, `treePagesKey`, `treePageKey`, `expireTreePages`, `treeHasChildren`, `treeStatusKey`, and the types
+  `TreeChildrenRequest`, `TreeChildrenPage`, `TreeChildPages`, `TreeStatusKind`.
+- **`RequestCache`** (`Helpers/RequestCache.ts`, `nexus-shared`): answers kept by key for a lifetime, a request on its
+  way shared, a failure not kept, `drop` by key prefix or test; `REQUEST_CACHE_LIFETIME`, `isPromiseLike`.
+- **Fix, every tree**: a node's `uid` counted from one counter for the whole page, so a page rendered on a server that
+  had rendered trees before numbered its rows differently from the browser, and React reported a hydration mismatch
+  in development (production does not check attributes). It is counted per store now.
+- **Fix, every tree: a scroll that takes the focused row out of view keeps its position** (nexus.web, the same
+  evening: after a client-side navigation a jump to the end came back up to 1,120px, and a wheel step left Load more
+  out of view). Chrome lays the page out inside the removal of a focused element, in the middle of React's commit,
+  when the leaving rows are gone and the new ones not yet in, and clamped or anchored the scroll position to that short
+  list. Focus now moves from a row to the tree's viewport in the event that moves the window, before the row leaves
+  (a name box being edited lets go without saving, as when its row unmounted), and `.nx-tree__list` gets a `min-height`
+  of all its rows, so a layout at any moment of a commit sees its full height.
+
+### Focus rings shown whole
+
+The owner, 2026-10-08: the theme panel cut the focus ring of its last example input (bottom) and of the date-format
+dropdown (left), and a focused outlined input's raised label sat across its own ring. No export changed; what a
+consumer may notice:
+
+- **`.nx-popover__scroll` keeps 4px of room** on its top, bottom and left for focus rings, with a matching negative
+  margin so nothing moves, and `scroll-padding` of 4px. Every panel that scrolls through it gets it: the theme panel,
+  menus, and the table's Columns and Filters panels. A panel's `--nx-popover-pad` must be 4px or more. Where the
+  scroller is its panel's first or last child, as a menu's list is, its left corner follows the panel's curve (the
+  inner radius less that room: 9px in a menu), so a scrolled item's highlight never paints over the rounded border.
+- **A focused outlined field** (`design="outlined"`) draws a 2px accent outline over its border instead of the soft
+  ring outside it, so the raised label sits in a clean gap. The raised label is placed with `top: -0.6em` instead of a
+  transform, and its backing is now the label's `::before`: it starts exactly on the box's edge at every screen scale
+  and paints nothing above it. The gradient it replaces painted a strip of the field's colour above read-only and
+  disabled boxes and in dark popovers. An app that styles the outlined label's `::before` overrides that backing. The
+  standard and inbox designs are unchanged.
+
+### The API proxy hides the backend
+
+The owner, 2026-10-08: nexus.web's network tab showed `POST /api/app/configuration/Region/MassRecover` answer
+`307 Temporary Redirect` with the backend's own https address in it, which the browser then called directly, and
+asked for a proxy behind which the app looks like the backend itself. `createApiProxy({ token })` is called as before
+and no export is removed; what a route may notice:
+
+- **No redirect reaches the browser** (was: passed on, its Location rewritten only on the backend's own host). One that
+  stays inside the module - the root's origin, or its host moved to https, under the root's path - is followed on the
+  server as `fetch` follows it, up to 3; any other answers 502 `BACKEND_REDIRECT_REFUSED` or `BACKEND_REDIRECT_LIMIT`.
+- **Response headers by an allowlist** (was: all but the hop headers): `DEFAULT_PROXY_RESPONSE_HEADERS` and the Nexus
+  backend's `X-Nexus-*`. A header an app read through the proxy (`X-Request-Id`, `X-Total-Count`) must now be named in
+  `responseHeaders`; Server, X-Powered-By, X-AspNet-*, HSTS, CORS, Location, Link and Set-Cookie never pass (Set-Cookie
+  with `passCookies`). Every answer gets `X-Content-Type-Options: nosniff`, and `Cache-Control: private, no-store`
+  when the backend sent none.
+- **Error pages are replaced** with the failure envelope and the backend's status (`BACKEND_ERROR_PAGE`): HTML, text,
+  stack traces, and JSON that repeats the user's token. JSON refusals pass as they came.
+- **Refusals carry `errorCode` and `errorMessages`** beside `message` and `messageCode`, and say nothing about the
+  server: an unset module answers "The School API is not set up on this server." (was: "... is not set (API_SCHOOL).",
+  which named a setting; the log has it now), and a module the browser calls directly "... is not available at this
+  address." New: 403 `CROSS_SITE_REFUSED`, 413 `REQUEST_TOO_LARGE`, 400 `REQUEST_UNREADABLE`.
+- **The request**: the browser's X-Forwarded-*, Forwarded, X-Real-IP, method and path overrides, `Expect` and Next.js's
+  own headers never go on; the proxy writes X-Forwarded-For (the last address the app received, and only ever an IPv4
+  or IPv6 address) and X-Forwarded-Host and -Proto (the app's configured origin, else the request's). A module whose
+  root is a path on the app is called at this server's own host and port, over http (was: the request URL's protocol,
+  which Next.js takes from X-Forwarded-Proto), and never at the configured origin or anywhere a request header names.
+- **`configureServerApi({ origin })` must not trust the Host header.** `serverApi` calls a relative root at that origin,
+  so one built from a request's Host lets a client pick an address on the server's machine. The template's
+  `api-setup.ts` now takes the Host only as `localhost:<PORT>` or `127.0.0.1:<PORT>` (Next.js sets `PORT` to the port
+  it listens on); an app with a copy of the older one, which took any localhost port, should change it the same way.
+- **A server call can say who the client is.** `lastForwardedAddress` (which now takes anything with a `get`, Next.js's
+  `headers()` included) and `readIpAddress` are exported from `nexus-shared/server`: the client's address as the proxy
+  reads it, an IP address or nothing. The template's `api-setup.ts` uses the first in `configureServerApi({ headers })`
+  to give Identity calls, and only them, `X-Forwarded-For` and the browser's `User-Agent`: sign-in leaves from the
+  server, and Identity's rate limit counts per address. An app that signs in through `serverApi` should do the same,
+  for Identity's calls only, since reading the request makes a page render per request.
+- **New options** `responseHeaders`, `passCookies`, `maxBodySize` (100 MB), `maxRedirects`, `clientAddress`,
+  `allowCrossSite`, `failure`, `onProblem`; **new exports** `DEFAULT_PROXY_RESPONSE_HEADERS`, `DEFAULT_PROXY_BODY_LIMIT`,
+  `DEFAULT_PROXY_REDIRECTS`, `PROXY_REFUSALS`, `nexusFailure`, `lastForwardedAddress`, `readIpAddress` and the types
+  `ApiProxyFailure`, `ApiProxyProblem`, `ApiProxyCode` (`nexus-shared/server`), and `serverAppOrigin`.
+- **A backend on a development certificate**: the proxy now calls the backend's https address itself, and Node.js
+  trusts ASP.NET Core's development certificate only when started with `NODE_USE_SYSTEM_CA=1` (or
+  `NODE_EXTRA_CA_CERTS`). Without it such a module answers 502 `BACKEND_UNREACHABLE`, and the server's log says why.
+
+### The code box
+
+The owner, 2026-10-08: one shared input for codes typed a box to a character - one-time codes, SSNs, and more - as
+dynamic as possible (numbers, strings, hex). New exports, nothing removed:
+
+- **`CodeBox`** (`nexus-shared/client`): one real input lying unseen over a box per character, so autofill
+  (`autoComplete="one-time-code"`), a paste and a screen reader see one field. `length` or `groups`, a `separator`
+  outside the value, `characters` (`digits`, `letters`, `alphanumeric`, `hex`) or an `allowed` one-character pattern,
+  `letterCase`, `masked`, `slotPlaceholder`, `block`, `onComplete`, and the field shell's label, hint, error, sizes and
+  read-only note.
+- **`type: "code"`** in `InputParams` (`CodeInputParams`): `renderInput`, `validateInput`, `normalizeInputValue` and
+  `formatInputValue` know it.
+- **One typing model** for every way text arrives - a key, a phone's keyboard or its suggestion, an input method, a
+  paste, autofill: a whole code replaces everything; a character replaces a selected box, or goes into the box with the
+  ring - inserted while the code has an empty box, so a box Backspace removed takes the right digit back, and over that
+  box once the code is full. ← → Home End select box by box, and a full code's caret selects its last box. An input
+  method's word goes in once, when it commits. A pasted message gives its one code ("Your 2-step code is 482913" is
+  482913; "482 913" and "123-45-6789" are read whole), or nothing when it holds more characters than boxes and no one
+  code. `onComplete` runs once per code, and again once the boxes were short - by typing, a form's reset, or the page
+  emptying a controlled `value`.
+- **A saved code is never cut**: `value`, `defaultValue` and a form's loaded record (`normalizeInputValue`) lose only
+  separators, case and a hex "#". A code the boxes cannot hold is kept, shown invalid at once, and a form refuses to
+  save it. The over-long message names the count: "The code is 6 digits long, not 7."
+- **What a screen reader hears** is what the boxes show: "9 digits, in groups of 3, 2 and 4", "8 digits: DD/MM/YYYY".
+  A read-only code shows the accent border on every box while it has focus.
+- **Styles**: a box without `block` keeps its own width (`.nx-code:not([data-block]) .nx-code__slot`), about as wide
+  as it is tall, and the boxes shrink alike on a narrow screen.
+- **Helpers and types** (`nexus-shared`): `validateCode`, `formatCode`, `codeGroups`, `codeLength`, `loadCode`,
+  `codeFits`, `describeCode`, `readCodeText`, `typeCode`, `settleCode`, `moveCode`, `codeAfterInput`,
+  `CODE_CHARACTER_PATTERNS`, `DEFAULT_CODE_LENGTH`, `CodeCharacters`, `CodeRules`, `CodeShape`, `CodeEdit`, `CodeText`,
+  `CodeMove`; `normalizeCode` stays exported, though the box itself now loads a code with `loadCode`.
+
+### Another record's name, joined by the database or by the table
+
+Added only; nothing an app uses changes (2026-10-08, the owner: "some columns we joined into DB, some frontend").
+
+- **A column whose value is another record's** (`TableColumn.join`): the row holds the key (`from`), and the table asks
+  the source once for every key its rows hold - a Nexus controller's `findListing`, or a `TableJoinSource` of the
+  page's own - then shows the record's field, searched, sorted, exported and shown in the details like any column. A key
+  with no record shows "Not found". `crudColumns.clientJoin(SUB_REGIONS, { key: "subRegionName", label: "Sub-region",
+  from: "subRegionId" })` is the Nexus form.
+- **One cache for the page** (`tableJoins`, `Helpers/TableJoins.ts`): keys asked for in the same moment by every table and
+  picker go in one call per source; a call already out is waited for; answers are kept 5 minutes (`JOIN_LIFETIME`) and an
+  aged one is still drawn while it is asked again; a failed call is not repeated for 30 seconds. A Reload of a table, and
+  a `Crud` write on the controller looked up, mark its answers old (`expireLookups`).
+- **A short tag after a value** (`TableColumn.tag`), and the one every reference to a record gets when that record is no
+  longer available: `CrudBackend.unavailableTag(status)` - Nexus: "Trashed" (warning) from 40, "Deleted" (danger) from 60,
+  none for a live record. `crudColumns.dbJoin({ key: "regionName", label: "Region", status: "regionRecordStatus" })` reads
+  it from a status the database joined into the row; `clientJoin` from the record it looked up. New class
+  `.nx-table__tag--after`.
+- **A picker of a controller's usable records** (`crudPicker(REGIONS, { labelKey: "regionName" })`, `nexus-shared/client`):
+  its `ActiveListing` read once for the page and searched in the browser, a saved value it no longer offers found through
+  the same cached `findListing`, tagged and never offered again. `CrudBackend.isPickable(record)` - Nexus: under 30.
+- `TableStore.refreshValues()` searches and sorts again when values changed without the rows; `CrudEndpoints` takes the
+  `findListing` and `activeListing` an `apiController` already has.
+
+### Pins and favourites from one call
+
+Two things move for an app:
+
+- **A CRUD built from `apiController` now reads `BookmarkListing` and writes `SwitchBookmarks` / `MassSwitchBookmarks`**,
+  the Nexus backend's names since 2026-10-07. An app whose backend still answers only `PinListing` / `Pin` / `MassPin`
+  passes its own endpoints without `bookmarks`, `bookmark` and `mass.bookmark`, and keeps the pin-only behaviour.
+- **The section classes are renamed** (an app's override of an old name stops matching):
+
+| Was | Now |
+|---|---|
+| `tbody.nx-table__pins` | `tbody.nx-table__section[data-section="pins"]` (and `"favorites"`) |
+| `.nx-table__pin-row`, `__pin-cell`, `__pin-toggle`, `__pin-caret`, `__pin-icon`, `__pin-title`, `__pin-count`, `__pin-loading` | `.nx-table__section-row`, `__section-cell`, `__section-toggle`, `__section-caret`, `__section-icon`, `__section-title`, `__section-count`, `__section-loading` |
+| `.nx-table__pin-mark` | `.nx-table__mark`, inside `.nx-table__marks` |
+| `data-pinned` on a section's row, `data-table-pins` on its toggle | gone: `data-section` on the section |
+| saved `pinsOpen` | `openSections` (an old `pinsOpen: true` still opens the pinned section) |
+
+What is new (the owner's rules, `Project-Skills/README.RULES.md`, "Rules for Favorite or Pin"):
+
+- **Favourites beside pins, from one call.** `CrudEndpoints.bookmarks` (`Room/BookmarkListing`) answers every record
+  this user marked, each with its bits (`bookmarkTypes`: 1 pinned, 2 favourite); `Crud` splits them into a **Pinned**
+  and a **Favourites** section above the active list, each folding on its own and remembered. The lists' own rows need
+  not carry marks: every record's marks come from that call.
+- **The marks show where a row's number is**, one under the other: a pinned favourite wears the pin above the star, in
+  the list and in both sections, with no column of its own (the owner, 2026-10-08). `DataTable` takes
+  `rowMarks(row)`; a section's row with none wears the section's icon.
+- **Directed switches, never a toggle.** Pin and **Add to favourites** / **Remove from favourites** on a row send the
+  record's whole set (`bookmark`, `?bookmarkTypes=3`, built by `CrudBackend.marksRequest`); on a selection they send
+  one bit and the way (`mass.bookmark`, `?bookmarkTypes=2&isAdding=true`, `massMarksRequest`), only the records it
+  is for, and a selection is offered only the ways it can still go - both, when it is mixed. Bits the package does not
+  know are kept. While a whole-set backend's marks are not read yet, the actions wait and say why.
+- **A limit each:** `configureCrud({ maxFavorites })`, the same as `maxPins` unless set (`markLimit`). Nothing is ever
+  taken off to meet a lowered limit.
+- **No reload:** a switch's answer (`answeredMarks`, or the ids a mass switch answers) is written into the sections,
+  the table and every list kept. A record trashed leaves the sections and keeps its marks; recovered, it comes back.
+- `DataTable` takes `sections` (`TableRowSection`: key, label, icon, rows, loading, max); `pinnedRows` and the other
+  `pinned*` props stay, as one section with the key `pins`. Select by **Favourites** / **Not favourites**. The message
+  builder knows `favorite` and `unfavorite` ("3 guests added to the favourites."). New helpers: `CRUD_MARKS`,
+  `CRUD_MARK_BITS`, `hasMark`, `withMark`, `markLimit`, `markDirections`, `markedRecords`, `patchMarkedRecords`,
+  `dropMarkedRows`, `crudMassEndpoint`.
+- **Needs `nexus-icons` with `iconStarOff`**, which is new in its source (not on npm): release `nexus-icons` with a
+  raised version first, and raise this package's `nexus-icons` range to it.
+
+### A CRUD page passes params and the CRUD does the rest (2026-10-08)
+
+The owner: *"we just pass params no logic, due to we have 1000+ similar page"*. What the Regions page did itself is
+now `Crud`'s, so a page is its controller, columns and inputs:
+
+- **`apiController(module, controller, subject, options)`**: `commands: "switch"` (the default, the Nexus backend since
+  2026-10-07: `SwitchFlag`, `MassSwitchFlag`, `BookmarkListing`, `SwitchBookmarks`, `MassSwitchBookmarks`) or
+  `"toggle"` (`Flag`, `MassFlag`, `PinListing`, `Pin`, `MassPin`), and `without` for what a backend lacks (`"pages"`,
+  `"audit"`, `"flag"`, `"marks"`, `"mass.description"`, ...). **The return type now marks those members optional**
+  (`pages`, `pagination`, `flag`, `audit`, the marks, the mass actions): a caller that reads one adds `!` or `?.`.
+  `MODULES.controller` takes the same options.
+- **A directed flag.** Flag and Unflag send the way (`CrudBackend.flagRequest`, Nexus `?isFlagged=`); a selection is
+  offered Flag and Unflag only as it can still go, sends only the records each is for, and says "the other N already
+  were" when the answer lists fewer. `NexusCrudBackend.isFlagged` is the band 25-29, and `canFlag` keeps Flag off a
+  pending record (30-39). The old "Flag / unflag" toggle of a mixed selection is gone.
+- **History built in.** With an `audit` endpoint the person may call, every row offers **History** and the details
+  **View history**: `AuditHistory` and `openAuditHistory` (moved from nexus.web), its words from
+  `CrudBackend.auditWords`.
+- **Presets:** `crudColumns.status()`, `.description()` (a `markdown` column: text in the table, formatted in the
+  details), `.added()`, `.changed()`, and `crudInputs.description()` (Markdown, 1000 characters, one hint for every
+  model). `TableColumn.markdown` is new.
+- **A Create answered with the payload** (no status, so no list can place it) is read back once through `details`.
+- **The export names the list on screen** (`CrudBackend.exportFilters`, Nexus `{ flag: 50 | 52 | 54 | 55 }`).
+### The theme panel: grouped, twice as wide, and the input design (2026-10-08)
+
+- **Input design is a quick preference** (`UserPreferences.inputDesign`, key `nx-input-design`): Standard, Outlined or
+  Inbox for every labelled input whose page and form name none (`useInputDesign`). An input with a design of its own
+  (a grid's cells) keeps it, and one with no label (a table's search box) stays standard: it has no label to place.
+- **`ThemeSwitcher`'s panel is 680px wide** (was 340), its settings in named sections two to a row - Theme across the
+  top, then Appearance, Language and region, Dates and times, Numbers, Tables, and Forms (the input design, with a box
+  to try it) - and one under the other on a narrow window. `ThemePicker`'s card group is named Colors now, under Theme.
+
+- **`Crud` takes `backend`**, for an app whose pages sit on two backends. `CrudBackend` gains `canFlag`, `flagRequest`,
+  `exportFilters`, `statusText` and `auditWords`, each with a default, so an app's own backend class still compiles.
+
+## 3.1.0
+
+**New features, no code break.** Every export of `3.0.0` is still exported (49 are new: 33 from `nexus-shared`, 16 from
+`nexus-shared/client`), and no exported constant changed its value, so `^3.0.0` takes it. The owner chose the number
+on 2026-10-08. What can move for an app is its **stylesheet overrides**: these class names and custom properties were
+renamed or dropped, and an override of the old name no longer applies.
+
+| Was | Now |
+|---|---|
+| `.nx-columns__head`, `__title`, `__count`, `__foot` | `.nx-table-panel__head`, `__title`, `__count`, `__foot` |
+| `.nx-table-panel__body` | `.nx-popover__scroll` |
+| `.nx-chat-avatar`, `--nx-chat-avatar` | `.nx-avatar`, `--nx-avatar-size` |
+| `.nx-table__frame`'s border | on `.nx-table` |
+| `--nx-field-scrollbar`, `--nx-field-scrollbar-hover`, `--nx-dropdown-scrollbar`, `--nx-time-scrollbar` | gone: one thin bar everywhere |
+| `.nx-form__skeleton*` | gone: a loading form shows its real inputs, disabled |
+| `.nx-excel__refused` | gone: the import's report lists are `.nx-excel__problems` |
+
+- **Bulk insert, and rows added to an import (the owner, 2026-10-07).** `ExcelImport` and `openExcelImport` take
+  `mode: "bulk"`: the import with no file, its new rows' editor opening with one empty row for the person to type
+  into, sent to the same `Excel/Import` with the same checks, a problem then naming its row ("Row 3 · Region name").
+  `DataTable` offers it as **Bulk insert** beside **Import from a spreadsheet**, and only beside an Add, as it is an Add
+  of many rows (`TableExcel.bulk: false` leaves it out). A sheet with a required list cannot be typed in - a list's key
+  is picked in the spreadsheet - and the panel says so; its file review takes no added rows either. Any other file's
+  new rows take Add, Insert and Duplicate: an added row is numbered after every row the file had
+  (`excelSheetRows(rows, columns, after)`), and one left empty is dropped, not refused. The new rows no longer fold
+  away (folding unmounted the editor and lost every edit), the footer counts what will be sent, and the review is inert
+  while an import is out.
+- **Nothing typed is lost unasked.** Closing the window, or Start over, over rows typed or changed in it asks first
+  (`ExcelImportHandle.unsavedRows`); picking the entry again while its window is minimized brings that window back
+  rather than a fresh one. An untouched date or time is no edit: `toInputValue` reads them as their inputs do.
+- **An import that wrote nothing keeps its rows** and lists under them each refusal, by row, in the backend's words:
+  `readExcelResponse` keeps a refusal's report (`result`, as XLS_X044 sends it) instead of dropping it, so the panel no
+  longer says only "No Region was added". Refusals read in row order.
+- `ExcelEditorRow`'s three own fields are optional, as an added row has none; new helpers `excelRowNumber`,
+  `hasExcelValues` and `isExcelRowTyped`, and `excelProblemPlace(problem, byRow)`. `RowsInputHandle.remove(index,
+  { undo: false })` drops a row with no Undo offered, and keeps the person's own last Undo where it was.
+- **A list shows what an import wrote.** After an import, `DataTable` runs `excel.onImported` first and reads its rows
+  after it: a `Crud` drops its cached lists there, and the reload used to be asked before, so on a page just opened it
+  was answered from the cache and the imported rows stayed off the screen until a reload.
+- **What imported records start as.** `ExcelSettings` gains `recordStatuses` (`ExcelRecordStatus`: `value`, `label`)
+  and `defaultRecordStatus`; when a model offers any, the import shows "New records start as", the default picked,
+  and sends the choice (`importExcelRows(..., { recordStatus })`; `ExcelBackend.importRequest(rows, recordStatus?)`,
+  the Nexus one sending `{ rows, recordStatus }`). The report says "3 cities added as In review".
+- **`Crud`, from the owner's review on 2026-10-07.** The active list is labelled **Active**, not "All" - it leaves out
+  the trash and the deleted. **Recover asks first** ("Recover Asia?", "It goes back to the active list."), one record
+  or many, like trash and delete. Recover and Move back to trash wear the back arrow (`iconArrowBackUp`): the
+  clock-shaped restore icon read as History beside a page's history action.
+- **`details.actions`**: buttons of the page's own in the details popup's footer, before Edit and Close
+  (`CrudDetailsAction`: `id`, `label`, `icon`, `endpoint`, `hidden`, `onSelect(row, popup)`). One that names an
+  `endpoint` shows only to a user who may call it, by the rule every built-in action follows.
+- **The spreadsheet import, as the owner asked on 2026-10-07.** Once a file is picked, the steps and the template and
+  file buttons give way to the file's name; another file is a Start over (now a bordered button) or a fresh popup. The
+  rows already there are read-only and never sent, and the footer says they are skipped. The new rows have Remove and
+  Lock at their end. After an import the review is gone: the panel shows what was added, what was not written and why,
+  and what was skipped and why. The `nx-excel__refused` list is gone with it; the report's lists are
+  `nx-excel__problems` blocks.
+- **`TabularForm` `actionsAt="end"` and `lockable`.** The row's actions in a column fixed at the right edge, as a data
+  table has them: Remove and Lock as buttons of their own, anything else in a menu after them. A locked row's inputs
+  are read-only ("Locked: unlock the row to change it.") and it cannot be removed; the locks are the screen's, never
+  the value's.
+- **A tabular form no longer jumps when a cell is clicked.** The line under the table, which holds the hint or the
+  message of the input with focus, keeps its height whether or not it says anything.
+- **A slow answer lands in the list the user moved to.** `Crud` writes an action's answer into the table only when
+  the table still holds the list the action was asked from, fully loaded. Otherwise (the user switched lists while
+  the request was out, or a list is still loading) it patches every cached list and reads the one on screen again from
+  them, stopping a load that may have been asked before the change. Before, a record trashed from the active list and
+  answered after a switch to the trash was written over by the stale trash list and showed in neither list until the
+  page was opened again. The same rule covers `handle.apply`, Add, Edit and the read-back after an Add; a Create that
+  answers no key now loads the list instead of showing the cached one.
+- **The theme panel is a quick preference panel.** Under the theme, `ThemeSwitcher` now shows `PreferencesPicker`
+  (`preferences={false}` leaves it out): Language and region (interface language, calendar), Dates and times (date
+  picker language, clock, display date format: the existing `DatePreferences`), Numbers (number scale, thousands
+  separator) and Tables (default page size, a row click opens the record). New: `UserPreferences`,
+  `readUserPreferences`, `setUserPreferences`, `useUserPreferences`, `subscribeUserPreferences`, `useNumberLocale`,
+  `DEFAULT_USER_PREFERENCES`, `PREFERENCE_STORAGE_KEYS` (`nx-language`, `nx-number-scale`, `nx-thousands`,
+  `nx-page-size`, `nx-row-click`), `InterfaceLanguage`, `ThousandsSeparator`, and `ENumberScales` (the core's enum, by
+  member value).
+- **Numbers follow the person's settings.** `numberLocale(scale, separator)` gives `en-US`/`en-IN` or a key such as
+  `"en-IN|.|,"` that `formatNumber`, `parseNumber` and `getNumberSymbols` read. `NumberBox` and `Slider` use it when
+  they have no `locale` (they defaulted to `en-US`, which is still the setting's default), and so do a `DataTable`'s and
+  `CrudDetails`' number cells (`CellTextOptions.locale`, new). A number box rewrites its text when the setting changes.
+- **`DataTable` `pageSize` and `openOnClick` give way to the person's choice once it is made**: the default page size
+  (when the table offers it) and the row click. A page size picked in a table with a `stateKey` still wins, and that
+  table now saves a size only when it differs from the one it opens with, so a later default reaches it.
+- **Animations: On, Off or System, chosen in the theme panel.** `ThemeScript` now writes `data-nx-motion`
+  (`reduce` or `full`) on `<html>` before the first paint, from the visitor's choice (`data-nx-animations`, saved as
+  `nx-animations`) and the system's `prefers-reduced-motion`, and keeps it current when the system setting changes.
+  **Every stylesheet reads that attribute instead of the media query**, and so does script motion (the popup's
+  minimize and maximize, smooth scrolls). On animates on a machine whose operating system turned animations off; Off
+  never animates. An app that does not render `ThemeScript` animates whatever the system says. New: `AnimationMode`,
+  `setAnimations`, `motionFor`, `REDUCED_MOTION_QUERY`, the `ANIMATIONS_*` and `MOTION_ATTRIBUTE` constants, and
+  `useTheme()`'s `animations`, `motion` and `setAnimations`.
+- **Density: Compact or Cozy.** `data-nx-density` on `<html>` (`nx-density`; `setDensity`, `useTheme().density`).
+  Cozy makes `--nx-control-sm/md/lg` 32/38/44 and the new `--nx-row` 38; compact is exactly the old sizes. Table rows
+  and headers, menu items, dropdown options and the Columns panel's lines are now sized from `--nx-row`, so they
+  follow it. `ThemeScript` takes `defaultDensity`.
+- **Scale grid, development builds only**: Off, px (a line every 4px, solid every 48px) or mm (millimetres, solid every
+  centimetre), drawn over the window on `[data-nx-grid] body::after`. `ThemeScript`'s `grid` and `ThemePicker`'s
+  `showGrid` default to `isDevelopmentBuild()`, so a production build neither shows the section nor applies a saved
+  grid. New: `ScaleGrid`, `setScaleGrid`, `isDevelopmentBuild`.
+- **`ThemePicker` / `ThemeSwitcher`** add Density, Animations and Scale grid under Mode and Theme (`showDensity`,
+  `showAnimations`, `showGrid`).
+- **Popups fade in and out** (160ms in, 120ms out), with nothing else moving: the slide and scale are gone. **Every
+  popover panel fades** in and out in 120ms through one rule on `.nx-popover`; the menu's, the table panels' and the
+  dropdown's own opening animations are gone. A closing panel takes no clicks, and nothing waits for a fade.
+- **Popover panels fit the window.** `placeUnderAnchor` and `placeAtPoint` pick the side that fits, or the one with
+  more room, and write that room as `--nx-popover-room`; a panel that marks its scrolling part `.nx-popover__scroll`
+  is never taller than it. That part reaches the panel's right wall, so its scroll bar sits on the wall, and carries
+  the right padding inside. Menus, the theme panel and the table's Columns and Filters panels use it; `usePopoverPanel`
+  lost its own height cap. New `showPanel` opens a panel scrolled to the top, and a hovered menu item no longer scrolls
+  its list. Placing an open panel again (on every scroll) no longer throws its list back to the top.
+- **A panel's padding is `--nx-popover-pad`.** `.nx-popover`'s own padding loaded after the menu's and the table
+  panels', so a menu was 16px inside its edge, not the 4px it asked for, and the table panels 16px, not 8px; both now
+  get theirs. `.nx-table-panel__body` is gone (`.nx-popover__scroll`).
+- **One thin, quiet scroll bar everywhere, the design lab's.** `Nexus.Base.css` gives every element
+  `scrollbar-width: thin` and a thumb of the text colour at 22% on no track. The theme panel, menus and context menus,
+  the table's Columns and Filters panels, popup bodies, the date-time panel, the chat, code blocks and tables in
+  Markdown and rich text, and the admin page and menu drew the browser's 15px bar with a painted grey track; on
+  Windows, Chrome and Edge now draw every bar 10px wide, as the lab does (Firefox's thin bar is 8px; Safari draws its
+  own thin bar). The components' own bars are gone: the 8px `::-webkit-scrollbar` pill of the text area, the Markdown
+  preview and the rich text (Chromium and WebKit ignore it once `scrollbar-width` is set), and the thin bar with a
+  stronger thumb of the tree, the tabular form, the dropdown list and the time picker. The data table's rows keep
+  theirs (`Nexus.Table.css`) until a later change, and the time picker's columns still hide the thumb until the
+  pointer or the keys are in them. `--nx-field-scrollbar`, `--nx-field-scrollbar-hover`, `--nx-dropdown-scrollbar` and
+  `--nx-time-scrollbar` are gone; the text area's resize grip reads `--nx-field-grip`. Room kept for a bar narrows with
+  it: every `scrollbar-gutter: stable` (the admin page and its bar, whose right edge moves from 27 to 22px off the
+  window, the chat thread, the dropdown list) and the padding a modal popup keeps for the page's bar
+  (`--nx-scrollbar-gap`, measured).
+- **A form whose values load shows its real inputs, disabled, instead of placeholders.** A `Crud`'s Edit popup, an
+  `ApiForm` with `loadValue` and a `Form` with `loading` have their final size from the first frame, and the values
+  land in the same inputs, as a load (no "Unsaved changes", no "Discard your changes?"). While loading, `FormStore`
+  takes nothing typed, even from an input whose `disabled` was taken off by hand, and draws such an input again from
+  the store when loading ends; a submit already waited. The `.nx-form__skeleton*` classes and their animation are gone.
+- **The form's status line keeps its one line when empty, and a form's bar fills a popup's foot**, so the status sits
+  beside the buttons: "Loading…" or "Unsaved changes" coming and going no longer moves the bar, and a `Crud` popup
+  lost the empty 12px row it had above its buttons.
+- **`Avatar`** (`nexus-shared/client`): a person's round picture, or their initials on a soft tone without one or
+  when it fails to load. `size` `sm`/`md`/`lg` or `--nx-avatar-size`; `onChangePicture` makes it a button with a
+  camera over it on hover. The chat's and the dropdown's avatars are now this one: `ChatAvatar` and
+  `DropdownAvatar` still exist and draw it, `.nx-chat-avatar` is gone (`.nx-avatar`), `.nx-dropdown-avatar` stays
+  as the dropdown's size, and `--nx-chat-avatar` is `--nx-avatar-size`.
+- **`Button` `dot`**: a small dot on the corner, for something new behind it such as unread notifications; `"primary"`
+  marks a state that is on, such as filters.
+- **`Menu`: a control inside a heading is chosen like a row.** An entry `{ heading: <node> }` may hold a button with
+  `role="menuitem"`: the arrow keys walk it with the rows, and a click on it closes the menu. A menu opened from the
+  keyboard still starts on its first row.
+- **The data table is one frame**: the bar, the rows and the footer sit in one border (`.nx-table` carries it now,
+  not `.nx-table__frame`), with a line under the bar and the footer as the bottom band (`--nx-footbar`, a new
+  token). An empty bar takes no room. Column headings are 12px, weight 650.
+- **`DataTable` `add`**: the table's own Add, first in the bar. With `excel`, it is a split button whose arrow holds
+  Download template, Import from a spreadsheet and Export to Excel, which then leave the options menu. `Crud`
+  passes its Add this way.
+- **The data table's bar is one line on a wide table, in a new order**: the Add section (`add`, then the page's
+  `actions`) and the lists (`toolbar`) on the left; Reload, the options menu (⋮) and the search, rows per page inside
+  it, on the right. It was the lists, the search, Reload, ⋮, `actions` and Add, wrapping where they fell: at 1126px
+  on the admin shell the bar broke into three ragged rows. A narrower table now moves whole parts, by its own width
+  (container queries on `.nx-table`): under 670px the search takes the top line (with nothing on the left, it leads
+  the buttons' line), under 375px Reload moves to the end of ⋮ (`DataTable` asks the hidden button, so the width is
+  written once, in the stylesheet), and under 325px, beside lists, the Add section takes the last line with its buttons
+  sharing it. On the admin shell those are windows of 695, 400 and 350px. A bar wider than those widths expect (a
+  long Add label, the page's own buttons, cozy density) is squeezed into the next step as soon as a line would break
+  (`data-squeeze` on `.nx-table__bar`, set a frame after a size change). A `toolbar` or `actions` that renders
+  nothing takes no room and decides no step, and a bar left with nothing else is hidden. New classes
+  `.nx-table__bar-add` (Add and `actions`) and `.nx-table__reload`; the search is now a child of `.nx-table__bar` after
+  `.nx-table__bar-end`, not inside it, and grows to 19rem from a 12rem basis.
+- **Columns opens from the options menu (⋮)**, as its first item; the bar has no Columns button. Reload, Columns
+  and the options button are ghost buttons. `TableColumnsPanel` takes an `anchor` and an `open()` handle for this.
+- **`TabButtons` `labels="auto"`**: every label while its container (a data table) is at least 900px wide, only the
+  chosen one's below. `Crud`'s lists use it.
+- **`DataTable` `selectBy`**: while rows are selected, their count opens a menu that selects again by what the rows
+  are: All on this page, then each `{ label, icon, test }`, which leaves exactly the matching rows on the page
+  selected. `Crud`'s main list offers Pinned, Not pinned, Flagged and Not flagged.
+- **`SplitButton` `fixed`**: the main button never changes; the menu holds other ways to do it, run when picked.
+- **`DataTable` `filterInputs`: an advanced filter.** Input params, each named after the column it filters, become
+  **Filters** in the options menu (⋮): a small form under the button, applied as it changes. The values are
+  `TableQuery.filters` (`TableStore.setFilters` sets them, `{}` clears); a client table matches them in `queryRows`
+  (a fifth argument), and a server gets them flat by name through `CrudBackend.pageRequest`'s third argument, as
+  `filterRequest` writes them (a date range as `{name}From`/`{name}Before`). A `CrudBackend` or loader of your own
+  ignores them until it reads that argument or `query.filters`. Also new: `activeFilters`, `asFilterInput`,
+  `filterMatcher`, `filterNames`; `usePopoverPanel` and `PopoverPanelHandle` (`nexus-shared/client`), the panel
+  Filters and Columns share; `followAnchor`'s second argument, a panel whose size it follows too.
+- **Renamed: `.nx-columns__head`, `__title`, `__count` and `__foot` are `.nx-table-panel__*`**, shared by both panels.
+  An override of the old names no longer applies.
+
+## 3.0.0
+
+**Breaking. This changes the value of exported constants, and `2.0.0` is on npm with the old ones.** Publishing it
+as a patch or a minor would hand `^2.0.0` consumers different numbers under a compatible-looking range, which is the
+worst way to ship this, so it takes a major. The owner chose the number on 2026-10-02, together with `nexus-public`
+and `nexus-admin`, which both depend on this package and so move to `3.0.0` with it; their `nexus-shared` range is
+now `^3.0.0`, because a bump of this one alone would leave them pulling the old, wrong constants.
+
+**`nexus-icons` must be installed at `1.1.0` or newer**, and the dependency range here says so. The chat components
+added in this version use `iconChecks`, `iconCornerUpLeft`, `iconMessageCircle`, `iconPaperclip`, `iconSend` and
+`iconUserPlus`, none of which exist in `nexus-icons@1.0.0`: with the old range a fresh install resolved to `1.0.0`
+and the build failed on six missing exports.
+
+### `NexusModule` — `Chat` added, and every module after it moved up one bit
+
+The backend's `EModules` gained `Chat` at bit 6, and everything after it shifted. `NexusModule` follows it exactly.
+A permission is a bitmask of these flags, so a package that kept the old numbers would grant and deny the wrong
+modules without any error to show for it.
+
+| Module | Was | Now |
+|---|---|---|
+| `None` | 0 | 0 |
+| `Migrations` | 1 | 1 |
+| `Configuration` | 2 | 2 |
+| `Identity` | 4 | 4 |
+| `Enterprise` | 8 | 8 |
+| `Drive` | 16 | 16 |
+| `Message` | 32 | 32 |
+| **`Chat`** | *(did not exist)* | **64** |
+| `Accounting` | 64 | **128** |
+| `Report` | 128 | **256** |
+| `Requisition` | 256 | **512** |
+| `Tenant` | 512 | **1024** |
+| `Subscription` | 1024 | **2048** |
+| `Reservation` | 2048 | **4096** |
+| `School` | 4096 | **8192** |
+| `Pharmacy` | 8192 | **16384** |
+| `Staffing` | 16384 | **32768** |
+| `Portfolio` | 32768 | **65536** |
+
+`NEXUS_MODULES` gained the matching entry (`key: "chat"`, `label: "Chat"`, `env: "API_CHAT"`), so `Chat` can be
+looked up, proxied and named in messages like every other module.
+
+**What to check when you upgrade.** Code that uses the names (`NexusModule.Reservation`) needs nothing. Anything
+that stored, transmitted or hard-coded a **number** has to be revisited:
+
+- permission masks saved in a database, a cache, a token claim or a settings file;
+- proxy URLs written with a number in place of a key (`/api/app/2048/…` is now `/api/app/4096/…`, and `reservation`
+  by key has always worked and still does);
+- a backend that has not taken the `Chat` shift yet — both sides move together or neither does.
+
+### `NEXUS_FLAGGED_STATUS` — 15 → 25
+
+The owner settled the record-status bands, and `ERecordStatus.Flagged` is seeded at **25**. `NexusCrudBackend`
+decides whether a row is flagged by comparing `recordStatus` to this constant, so a package on 15 while the backend
+writes 25 shows the wrong flag on every row, and flagging one writes a status the backend does not recognise.
+
+The bands, for anything that reasons about them:
+
+| Band | Range |
+|---|---|
+| Active | 0–39 |
+| — Active account | 0–29 |
+| — Flag | **25–29** |
+| — Pending, unverified, in review, approval required | 30–39 |
+| Trash | 40–59 |
+| Delete | 60 and above |
+
+`NEXUS_ACTIVE_STATUS` stays 0, and the `recordStatus < 40` reading of "a live record" that the rest of the code
+already assumes stays right.
+
+Note that **the flag is a range, 25–29, and this release still checks a single value.** Only the seeded member at 25
+has a meaning today, and the bands are about to become configurable per project, so a range-aware check belongs with
+that work rather than here. Do not read the single value as the final answer.
+
+### Removed: the archive
+
+The owner removed the archive on 2026-09-30: a record is live, in the trash, or deleted, and the way back from
+deleted lands it in the trash. The second put-away list and its second recovery path were the only reason the CRUD
+had both Restore and Recover, and the bands close up behind it — **Trash is 40–59 and Delete 60 and above**, so
+nothing stored keeps a meaning it no longer has. `recordStatus < 40` still reads "a live record".
+
+What goes, all of it breaking for anything that named it:
+
+- `CrudMode` loses `"archive"`, so a CRUD shows All, Flagged, Trash and Deleted.
+- `CrudRowActionName` and `CrudMassActionName` lose `"archive"` and `"restore"`. Recover, the trash's own way back,
+  is untouched: a CRUD that offered both now offers one.
+- `CrudEndpoints` loses `archive` and `restore`; `apiController` stops naming `Archive`, `Restore`, `MassArchive`,
+  `MassRestore`, `ArchiveListing` and `ArchivePagination`, and `lists`/`pages` lose their `archive` key.
+- `MessageActionName` loses `"archive"`, and the message builder its words and its "It can be restored from the
+  archive." confirmation detail. `"restore"` stays in the vocabulary: it is a plain verb, not the archive's.
+
+**What to check when you upgrade.** A CRUD that listed `"archive"` in `modes` or `actions` no longer compiles,
+which is the point — the endpoint behind it is gone from the backend too. A backend that still answers
+`ArchiveListing` is not asked for it any more.
+
+### Added: the chat
+
+A discussion on any record — a leave request the manager and a co-worker talk through, a purchase order, an
+applicant, a tender — behind one icon that says whether anything is waiting. Nothing that does not use it changes.
+
+- A conversation is named by three values, `ChatScope`: the **domain** (which kind of record), the **parent id** (the
+  record) and the **user id** (who is reading). The domain is the app's own enum, given either as a template
+  (`<Chat<EDomainTypes> …>`) or once in `ChatRegister`, the same way `ApiRegister` names the module enum. Without one
+  it is a plain number.
+- **No domain numbers are defined here.** They belong to the backend's `EDomainTypes`, and the warning at the top of
+  this file applies to them in full. `defineChatDomains` only gives an app's domains their names on screen.
+- `ChatButton` is an icon in three looks: quiet with no messages, the accent on its tint once there are messages, and
+  the accent filled with an unread badge once some are unread. One size in all three, with the badge over the corner,
+  so a column of them in a table does not move as the counts arrive.
+- `ChatSummaryCache` fills every icon that mounted in the same moment with **one call per domain**. A list whose rows
+  already carry their counts passes `summary` and makes no call at all.
+- `Chat` is the icon with the conversation in a popup; `ChatPanel` is the conversation on its own, for a record's own
+  page. Messages are **Markdown**: written in `MarkdownEditor` and drawn by `MarkdownView`. Enter sends and
+  Shift+Enter starts a line, except in a list or a code fence, where the editor keeps Enter; `sendKey="modifier"`
+  moves sending to Ctrl+Enter.
+- One mark where the time sits says how far a message of your own has got: a spinner while sending, a tick once the
+  server has it, two once `deliveredTo` holds somebody, two in the accent once `readBy` does.
+- Where the data comes from is one interface, `ChatSource`. `apiChatSource` goes through the app's `ChatBackend`
+  (`NexusChatBackend` by default); `localChatSource` keeps a conversation in memory for a demo or a test.
+- **The Nexus endpoints are the shape the Chat module is expected to take, not an API that answers today.**
+  `NexusModule.Chat` is a number and a proxy key; the controller is not built. Each difference, when it lands, is one
+  override on `NexusChatBackend`.
+- `check:themes` gained a rule: body text on the primary tint, which is a message bubble of your own. Every theme
+  clears AAA except catppuccin light at 6.84, so it is held to the AA 4.5 that applies to body text.
+- **A record holds many conversations.** `ChatScope` names the record; each conversation in it is a
+  `ChatConversation` with its own id and a type, `one-to-one` or `group`. `ChatPlaceSource` lists them and starts
+  them, `useChatPlace` is the hook, and `apiChatPlace` is the API one. A panel given a `source` still shows that one
+  conversation and no switch, so nothing that used the first round changes.
+- The panel's body has three views — the thread, the list of conversations, and New chat — and the bar moves between
+  them. With several conversations the title is the switch; with one it is just the title.
+- Starting a chat never asks for the type: one person makes a one-to-one, more make a group, and a name makes a
+  group either way. A one-to-one with somebody who already has one is expected to come back rather than be made
+  twice; `localChatPlace` keeps that rule.
+- `@` at the start of a word offers the people in the conversation, narrows as it is typed, and owns Enter while it
+  is open. A mention is plain `@Name`, or a Markdown link with `mentionHref`; either way the ids travel in the
+  draft's `mentions`.
+- `ChatSnapshot` gained `loaded`: a store that has read nothing yet holds empty counts, and a panel must not write
+  those over what a conversation list already knows.
+
+### Added: several at once, `TabButtons multiple`
+
+`TabButtons` picks one option; with `multiple` it picks several, so a list of choices that must be seen all at once
+(the weekdays a rule runs on, the letters or symbols a pattern allows) needs no second control. Nothing that does
+not pass it changes.
+
+- `value` is an array and `onChange` hands back the chosen values **in option order**, whatever order they were
+  clicked in. Values that match no option are ignored and never handed back.
+- The options are native checkboxes in a `role="group"`: Tab moves between them and Space toggles one. The group
+  still needs `aria-label` or `aria-labelledby`.
+- There is no sliding indicator: each chosen option is raised with the indicator's own colors, border and shadow,
+  and keeps the pointer, since a click takes it away again. An option that is not chosen sits flat on the track.
+- The options **wrap** onto more rows when they do not fit, each row as tall as a one-row track's options, and an
+  option is never narrower than it is tall, so a row of single letters lines up. On a touch screen
+  (`pointer: coarse`) every option is a medium control's height: 26 letters on a phone are 34px targets, not 22px.
+- Made and checked for the `nav` design (`/demo/tab-buttons`, "Several at once"); `design="list"` with `multiple`
+  renders checkboxes too, but has not been checked yet.
+
+### Added: inputs that follow others, `dependsOn`, and a row's own params, `cellParams`
+
+Two optional keys, added 2026-09-26 for the builder's class form, whose company model shows only when the class has a
+company or a branch and whose type arguments offer a key type in one row and a model in the next. Nothing that does
+not pass them changes.
+
+- **`dependsOn: ["hasCompany"]`** on an input's params (Form only). When a named input's value changes — typed, or
+  set from code — this input draws again **without mounting again** (nothing typed in it is lost) and its params are
+  read afresh, so getters for `hidden`, `readOnly`, `readOnlyMessage`, `label`, `hint` or `options` answer for the
+  values as they are now. Its rule is asked again too, so a `required` a getter switched on counts at once. An input
+  that names any is asked `hidden` each time it draws, so it can come and go; one that names none is asked once, when
+  the form draws, as before. Name the input itself to follow its own typing.
+- **`cellParams(row, name, index)`** on `TabularForm` and `GroupForm`: the params of one cell that differ from its
+  column's, such as a picker's `options` and `selectedOptions`. Asked as the row draws; return nothing for the
+  column's own params, and the **same object** for the same answer (the merged params are kept per answer, so the cell
+  does not draw again for nothing). Getters on either side stay getters. Rules still come from the column.
+
+### Added: a generated column in a tabular or group form
+
+Two optional props on `TabularForm` and `GroupForm`, for a column whose values a row's **position** decides rather
+than the user — a bitwise enum's value, a line number, a running total. Nothing that does not pass them changes.
+
+- `deriveRows(rows)` returns one patch per row and runs after every change, including a row being added, removed,
+  duplicated or **moved**. The patches are written as code writes, so only the cells whose value really changed
+  mount again and focus stays on the row's own menu: a keyboard can move a row twice in a row.
+- `cellReadOnly(row, name, index)` is asked for every cell as it renders and returns the reason a cell is
+  generated. The cell is locked and shows that reason as its read-only note. Because it is asked per render, a
+  column can lock and unlock while the form around it changes, which params cannot do — they are fixed once a form
+  opens.
+
+### Added: rows nobody may change, `rowReadOnly`
+
+One optional prop on `TabularForm` and `GroupForm`, for rows the user did not write and may not change — the fields
+a class inherits from its parent, shown first in the same grid as its own. Nothing that does not pass it changes.
+
+- `rowReadOnly(row, index)` returns the reason (or `true`). Every cell of such a row is read-only with that reason
+  as its note, the row's menu in a tabular form offers nothing (no insert, duplicate, move or remove), and the row
+  below it cannot move up past it. Nothing reorders the rows: keep the locked ones first.
+- A locked row says nothing about its columns: the column-header lock is worked out from the other rows in view, so
+  a grid of inherited rows and one own row does not put a lock on every header.
+
+### Added: a panel beside a CRUD form, `form.aside`
+
+An Add or Edit popup can show a panel next to its form: a preview of what a save would produce, a summary, a help
+panel. It takes a node, or a function handed `{ form, action, row }` — `form` being that popup's own `FormStore`, so
+a panel follows what is typed through `subscribeValue()` and the form around it never re-renders for it.
+
+The two are columns above 1000px, each scrolling on its own so a long form cannot push the panel off the screen, and
+they stack below that with the **form first**, in the DOM as well as on the screen. `--nx-crud-aside-width` sets the
+panel's share (default `clamp(20rem, 38%, 44rem)`). Pair it with a wide `form.size` — `xl` or `full`; a panel in a
+560px popup leaves the form nothing. A CRUD that passes no `aside` renders exactly what it did before, wrapper and
+all.
+
+### `TabularForm` reworked: one row control, rows that do not move, one lock per column
+
+The owner called the tabular design bad, from a screenshot of an 18-row table with one generated column. Every fault
+was in this component rather than in the page that used it, so every fix is here. Nothing needs a new prop, and a
+table that passed nothing new looks different — deliberately.
+
+**Breaking, visually and for tests.** Two things a consumer may be reaching for have moved:
+
+- **The remove column is gone.** Remove was a column of unlabelled `×` buttons at the end, beside a row menu that
+  already held Remove: two ways to act on one row, and a whole column spent on one of them. Now a row has one
+  control, the menu beside its number, holding Insert above, Insert below, Duplicate, Move up, Move down and Remove.
+  `removable` still decides whether Remove is offered. A test that clicked a button named `Remove <row>` opens the
+  row's menu instead: `Row 2 actions`, then the `Remove` item. `.nx-tabular__end` and `.nx-tabular__remove` are gone
+  from the DOM and the stylesheet; so is `--nx-tabular-end`, replaced by `--nx-tabular-menu` (the menu's slot width).
+- **The row number no longer opens the menu.** It used to *become* the menu on hover: the number faded out and dots
+  faded in over it, so the numbering looked broken and the grid felt unstable as the pointer crossed it. The number
+  now stays where it is, right-aligned, at every moment, and the menu button sits beside it in its own space,
+  always present. The number column is that much wider.
+
+**Fixed, with no change to how a table is written:**
+
+- **Every row is one line high, whatever it holds.** The row's grid track was sized by its tallest cell, so a single
+  `textarea` column of `rows: 2` made every cell of its row 20px taller than the row's own box — drawing the cells,
+  their edges and their focus rings over the rows below. One row of content therefore looked taller than its
+  neighbours, and a focus ring bled outside its cell. The row now has one track exactly its own height, cells keep
+  what they hold inside their bounds, and a `textarea` fills its cell and scrolls inside it.
+- **No resize grips in cells.** A `textarea` in a cell took `resize: vertical` from the multi-line input rule, so
+  every cell of such a column offered a grip that would break the alignment of its row. They are `resize: none` now.
+- **A filled cell and an empty one are drawn the same.** Same consequence as the above: only the cell with text was
+  tall enough to show what the overflow was doing.
+- **`maxHeight` comes down to whole rows.** The scroller used to end wherever the number fell, cutting the last row
+  in half, which reads as broken rather than as scrollable. The component measures its header, its frame and its
+  real row height and caps itself just under what was asked for. A number too small for one row is left alone.
+- **A generated column says so once.** `cellReadOnly` put a lock in every cell of the column it locked — eighteen
+  locks for one fact. The lock is now on the **column header**, with the reason as its title, and the cells keep the
+  read-only tint and their own reason, which still shows under the table when one is used. A lock that really is per
+  row (some rows locked, not all) leaves the header alone and is drawn per cell as before.
+- **Less chrome.** The frame is `--nx-border` rather than `--nx-border-strong`: the sheet draws every line it needs
+  inside itself, and in a popup or a panel the strong edge was a box around a box around boxes.
+
+## 2.0.0
+
+The rewrite: compiled `dist` with the entry points `.`, `/client`, `/server` and `/styles.css`, in place of 1.x's
+raw TypeScript from `src` with `.`, `/client` and `/interface`. A major version, so nobody on `^1.1.21` is moved
+into a different API.