nexus-shared 3.1.0 → 4.0.0

package/CHANGELOG.md

@@ -1,446 +1,2268 @@
-# Changelog
-
-Notable changes to `nexus-shared`. The **values** of exported constants count as API here: several of them are the
-Nexus backend's own numbers, and a value that differs from the backend by one does not fail loudly — it silently
-means the wrong thing on every record and every permission check.
-
-## 3.1.0
-
-**New features, no code break.** Every export of `3.0.0` is still exported (49 are new: 33 from `nexus-shared`, 16 from
-`nexus-shared/client`), and no exported constant changed its value, so `^3.0.0` takes it. The owner chose the number
-on 2026-10-08. What can move for an app is its **stylesheet overrides**: these class names and custom properties were
-renamed or dropped, and an override of the old name no longer applies.
-
-| Was | Now |
-|---|---|
-| `.nx-columns__head`, `__title`, `__count`, `__foot` | `.nx-table-panel__head`, `__title`, `__count`, `__foot` |
-| `.nx-table-panel__body` | `.nx-popover__scroll` |
-| `.nx-chat-avatar`, `--nx-chat-avatar` | `.nx-avatar`, `--nx-avatar-size` |
-| `.nx-table__frame`'s border | on `.nx-table` |
-| `--nx-field-scrollbar`, `--nx-field-scrollbar-hover`, `--nx-dropdown-scrollbar`, `--nx-time-scrollbar` | gone: one thin bar everywhere |
-| `.nx-form__skeleton*` | gone: a loading form shows its real inputs, disabled |
-| `.nx-excel__refused` | gone: the import's report lists are `.nx-excel__problems` |
-
-- **Bulk insert, and rows added to an import (the owner, 2026-10-07).** `ExcelImport` and `openExcelImport` take
-  `mode: "bulk"`: the import with no file, its new rows' editor opening with one empty row for the person to type
-  into, sent to the same `Excel/Import` with the same checks, a problem then naming its row ("Row 3 · Region name").
-  `DataTable` offers it as **Bulk insert** beside **Import from a spreadsheet**, and only beside an Add, as it is an Add
-  of many rows (`TableExcel.bulk: false` leaves it out). A sheet with a required list cannot be typed in - a list's key
-  is picked in the spreadsheet - and the panel says so; its file review takes no added rows either. Any other file's
-  new rows take Add, Insert and Duplicate: an added row is numbered after every row the file had
-  (`excelSheetRows(rows, columns, after)`), and one left empty is dropped, not refused. The new rows no longer fold
-  away (folding unmounted the editor and lost every edit), the footer counts what will be sent, and the review is inert
-  while an import is out.
-- **Nothing typed is lost unasked.** Closing the window, or Start over, over rows typed or changed in it asks first
-  (`ExcelImportHandle.unsavedRows`); picking the entry again while its window is minimized brings that window back
-  rather than a fresh one. An untouched date or time is no edit: `toInputValue` reads them as their inputs do.
-- **An import that wrote nothing keeps its rows** and lists under them each refusal, by row, in the backend's words:
-  `readExcelResponse` keeps a refusal's report (`result`, as XLS_X044 sends it) instead of dropping it, so the panel no
-  longer says only "No Region was added". Refusals read in row order.
-- `ExcelEditorRow`'s three own fields are optional, as an added row has none; new helpers `excelRowNumber`,
-  `hasExcelValues` and `isExcelRowTyped`, and `excelProblemPlace(problem, byRow)`. `RowsInputHandle.remove(index,
-  { undo: false })` drops a row with no Undo offered, and keeps the person's own last Undo where it was.
-- **A list shows what an import wrote.** After an import, `DataTable` runs `excel.onImported` first and reads its rows
-  after it: a `Crud` drops its cached lists there, and the reload used to be asked before, so on a page just opened it
-  was answered from the cache and the imported rows stayed off the screen until a reload.
-- **What imported records start as.** `ExcelSettings` gains `recordStatuses` (`ExcelRecordStatus`: `value`, `label`)
-  and `defaultRecordStatus`; when a model offers any, the import shows "New records start as", the default picked,
-  and sends the choice (`importExcelRows(..., { recordStatus })`; `ExcelBackend.importRequest(rows, recordStatus?)`,
-  the Nexus one sending `{ rows, recordStatus }`). The report says "3 cities added as In review".
-- **`Crud`, from the owner's review on 2026-10-07.** The active list is labelled **Active**, not "All" - it leaves out
-  the trash and the deleted. **Recover asks first** ("Recover Asia?", "It goes back to the active list."), one record
-  or many, like trash and delete. Recover and Move back to trash wear the back arrow (`iconArrowBackUp`): the
-  clock-shaped restore icon read as History beside a page's history action.
-- **`details.actions`**: buttons of the page's own in the details popup's footer, before Edit and Close
-  (`CrudDetailsAction`: `id`, `label`, `icon`, `endpoint`, `hidden`, `onSelect(row, popup)`). One that names an
-  `endpoint` shows only to a user who may call it, by the rule every built-in action follows.
-- **The spreadsheet import, as the owner asked on 2026-10-07.** Once a file is picked, the steps and the template and
-  file buttons give way to the file's name; another file is a Start over (now a bordered button) or a fresh popup. The
-  rows already there are read-only and never sent, and the footer says they are skipped. The new rows have Remove and
-  Lock at their end. After an import the review is gone: the panel shows what was added, what was not written and why,
-  and what was skipped and why. The `nx-excel__refused` list is gone with it; the report's lists are
-  `nx-excel__problems` blocks.
-- **`TabularForm` `actionsAt="end"` and `lockable`.** The row's actions in a column fixed at the right edge, as a data
-  table has them: Remove and Lock as buttons of their own, anything else in a menu after them. A locked row's inputs
-  are read-only ("Locked: unlock the row to change it.") and it cannot be removed; the locks are the screen's, never
-  the value's.
-- **A tabular form no longer jumps when a cell is clicked.** The line under the table, which holds the hint or the
-  message of the input with focus, keeps its height whether or not it says anything.
-- **A slow answer lands in the list the user moved to.** `Crud` writes an action's answer into the table only when
-  the table still holds the list the action was asked from, fully loaded. Otherwise (the user switched lists while
-  the request was out, or a list is still loading) it patches every cached list and reads the one on screen again from
-  them, stopping a load that may have been asked before the change. Before, a record trashed from the active list and
-  answered after a switch to the trash was written over by the stale trash list and showed in neither list until the
-  page was opened again. The same rule covers `handle.apply`, Add, Edit and the read-back after an Add; a Create that
-  answers no key now loads the list instead of showing the cached one.
-- **The theme panel is a quick preference panel.** Under the theme, `ThemeSwitcher` now shows `PreferencesPicker`
-  (`preferences={false}` leaves it out): Language and region (interface language, calendar), Dates and times (date
-  picker language, clock, display date format: the existing `DatePreferences`), Numbers (number scale, thousands
-  separator) and Tables (default page size, a row click opens the record). New: `UserPreferences`,
-  `readUserPreferences`, `setUserPreferences`, `useUserPreferences`, `subscribeUserPreferences`, `useNumberLocale`,
-  `DEFAULT_USER_PREFERENCES`, `PREFERENCE_STORAGE_KEYS` (`nx-language`, `nx-number-scale`, `nx-thousands`,
-  `nx-page-size`, `nx-row-click`), `InterfaceLanguage`, `ThousandsSeparator`, and `ENumberScales` (the core's enum, by
-  member value).
-- **Numbers follow the person's settings.** `numberLocale(scale, separator)` gives `en-US`/`en-IN` or a key such as
-  `"en-IN|.|,"` that `formatNumber`, `parseNumber` and `getNumberSymbols` read. `NumberBox` and `Slider` use it when
-  they have no `locale` (they defaulted to `en-US`, which is still the setting's default), and so do a `DataTable`'s and
-  `CrudDetails`' number cells (`CellTextOptions.locale`, new). A number box rewrites its text when the setting changes.
-- **`DataTable` `pageSize` and `openOnClick` give way to the person's choice once it is made**: the default page size
-  (when the table offers it) and the row click. A page size picked in a table with a `stateKey` still wins, and that
-  table now saves a size only when it differs from the one it opens with, so a later default reaches it.
-- **Animations: On, Off or System, chosen in the theme panel.** `ThemeScript` now writes `data-nx-motion`
-  (`reduce` or `full`) on `<html>` before the first paint, from the visitor's choice (`data-nx-animations`, saved as
-  `nx-animations`) and the system's `prefers-reduced-motion`, and keeps it current when the system setting changes.
-  **Every stylesheet reads that attribute instead of the media query**, and so does script motion (the popup's
-  minimize and maximize, smooth scrolls). On animates on a machine whose operating system turned animations off; Off
-  never animates. An app that does not render `ThemeScript` animates whatever the system says. New: `AnimationMode`,
-  `setAnimations`, `motionFor`, `REDUCED_MOTION_QUERY`, the `ANIMATIONS_*` and `MOTION_ATTRIBUTE` constants, and
-  `useTheme()`'s `animations`, `motion` and `setAnimations`.
-- **Density: Compact or Cozy.** `data-nx-density` on `<html>` (`nx-density`; `setDensity`, `useTheme().density`).
-  Cozy makes `--nx-control-sm/md/lg` 32/38/44 and the new `--nx-row` 38; compact is exactly the old sizes. Table rows
-  and headers, menu items, dropdown options and the Columns panel's lines are now sized from `--nx-row`, so they
-  follow it. `ThemeScript` takes `defaultDensity`.
-- **Scale grid, development builds only**: Off, px (a line every 4px, solid every 48px) or mm (millimetres, solid every
-  centimetre), drawn over the window on `[data-nx-grid] body::after`. `ThemeScript`'s `grid` and `ThemePicker`'s
-  `showGrid` default to `isDevelopmentBuild()`, so a production build neither shows the section nor applies a saved
-  grid. New: `ScaleGrid`, `setScaleGrid`, `isDevelopmentBuild`.
-- **`ThemePicker` / `ThemeSwitcher`** add Density, Animations and Scale grid under Mode and Theme (`showDensity`,
-  `showAnimations`, `showGrid`).
-- **Popups fade in and out** (160ms in, 120ms out), with nothing else moving: the slide and scale are gone. **Every
-  popover panel fades** in and out in 120ms through one rule on `.nx-popover`; the menu's, the table panels' and the
-  dropdown's own opening animations are gone. A closing panel takes no clicks, and nothing waits for a fade.
-- **Popover panels fit the window.** `placeUnderAnchor` and `placeAtPoint` pick the side that fits, or the one with
-  more room, and write that room as `--nx-popover-room`; a panel that marks its scrolling part `.nx-popover__scroll`
-  is never taller than it. That part reaches the panel's right wall, so its scroll bar sits on the wall, and carries
-  the right padding inside. Menus, the theme panel and the table's Columns and Filters panels use it; `usePopoverPanel`
-  lost its own height cap. New `showPanel` opens a panel scrolled to the top, and a hovered menu item no longer scrolls
-  its list. Placing an open panel again (on every scroll) no longer throws its list back to the top.
-- **A panel's padding is `--nx-popover-pad`.** `.nx-popover`'s own padding loaded after the menu's and the table
-  panels', so a menu was 16px inside its edge, not the 4px it asked for, and the table panels 16px, not 8px; both now
-  get theirs. `.nx-table-panel__body` is gone (`.nx-popover__scroll`).
-- **One thin, quiet scroll bar everywhere, the design lab's.** `Nexus.Base.css` gives every element
-  `scrollbar-width: thin` and a thumb of the text colour at 22% on no track. The theme panel, menus and context menus,
-  the table's Columns and Filters panels, popup bodies, the date-time panel, the chat, code blocks and tables in
-  Markdown and rich text, and the admin page and menu drew the browser's 15px bar with a painted grey track; on
-  Windows, Chrome and Edge now draw every bar 10px wide, as the lab does (Firefox's thin bar is 8px; Safari draws its
-  own thin bar). The components' own bars are gone: the 8px `::-webkit-scrollbar` pill of the text area, the Markdown
-  preview and the rich text (Chromium and WebKit ignore it once `scrollbar-width` is set), and the thin bar with a
-  stronger thumb of the tree, the tabular form, the dropdown list and the time picker. The data table's rows keep
-  theirs (`Nexus.Table.css`) until a later change, and the time picker's columns still hide the thumb until the
-  pointer or the keys are in them. `--nx-field-scrollbar`, `--nx-field-scrollbar-hover`, `--nx-dropdown-scrollbar` and
-  `--nx-time-scrollbar` are gone; the text area's resize grip reads `--nx-field-grip`. Room kept for a bar narrows with
-  it: every `scrollbar-gutter: stable` (the admin page and its bar, whose right edge moves from 27 to 22px off the
-  window, the chat thread, the dropdown list) and the padding a modal popup keeps for the page's bar
-  (`--nx-scrollbar-gap`, measured).
-- **A form whose values load shows its real inputs, disabled, instead of placeholders.** A `Crud`'s Edit popup, an
-  `ApiForm` with `loadValue` and a `Form` with `loading` have their final size from the first frame, and the values
-  land in the same inputs, as a load (no "Unsaved changes", no "Discard your changes?"). While loading, `FormStore`
-  takes nothing typed, even from an input whose `disabled` was taken off by hand, and draws such an input again from
-  the store when loading ends; a submit already waited. The `.nx-form__skeleton*` classes and their animation are gone.
-- **The form's status line keeps its one line when empty, and a form's bar fills a popup's foot**, so the status sits
-  beside the buttons: "Loading…" or "Unsaved changes" coming and going no longer moves the bar, and a `Crud` popup
-  lost the empty 12px row it had above its buttons.
-- **`Avatar`** (`nexus-shared/client`): a person's round picture, or their initials on a soft tone without one or
-  when it fails to load. `size` `sm`/`md`/`lg` or `--nx-avatar-size`; `onChangePicture` makes it a button with a
-  camera over it on hover. The chat's and the dropdown's avatars are now this one: `ChatAvatar` and
-  `DropdownAvatar` still exist and draw it, `.nx-chat-avatar` is gone (`.nx-avatar`), `.nx-dropdown-avatar` stays
-  as the dropdown's size, and `--nx-chat-avatar` is `--nx-avatar-size`.
-- **`Button` `dot`**: a small dot on the corner, for something new behind it such as unread notifications; `"primary"`
-  marks a state that is on, such as filters.
-- **`Menu`: a control inside a heading is chosen like a row.** An entry `{ heading: <node> }` may hold a button with
-  `role="menuitem"`: the arrow keys walk it with the rows, and a click on it closes the menu. A menu opened from the
-  keyboard still starts on its first row.
-- **The data table is one frame**: the bar, the rows and the footer sit in one border (`.nx-table` carries it now,
-  not `.nx-table__frame`), with a line under the bar and the footer as the bottom band (`--nx-footbar`, a new
-  token). An empty bar takes no room. Column headings are 12px, weight 650.
-- **`DataTable` `add`**: the table's own Add, first in the bar. With `excel`, it is a split button whose arrow holds
-  Download template, Import from a spreadsheet and Export to Excel, which then leave the options menu. `Crud`
-  passes its Add this way.
-- **The data table's bar is one line on a wide table, in a new order**: the Add section (`add`, then the page's
-  `actions`) and the lists (`toolbar`) on the left; Reload, the options menu (⋮) and the search, rows per page inside
-  it, on the right. It was the lists, the search, Reload, ⋮, `actions` and Add, wrapping where they fell: at 1126px
-  on the admin shell the bar broke into three ragged rows. A narrower table now moves whole parts, by its own width
-  (container queries on `.nx-table`): under 670px the search takes the top line (with nothing on the left, it leads
-  the buttons' line), under 375px Reload moves to the end of ⋮ (`DataTable` asks the hidden button, so the width is
-  written once, in the stylesheet), and under 325px, beside lists, the Add section takes the last line with its buttons
-  sharing it. On the admin shell those are windows of 695, 400 and 350px. A bar wider than those widths expect (a
-  long Add label, the page's own buttons, cozy density) is squeezed into the next step as soon as a line would break
-  (`data-squeeze` on `.nx-table__bar`, set a frame after a size change). A `toolbar` or `actions` that renders
-  nothing takes no room and decides no step, and a bar left with nothing else is hidden. New classes
-  `.nx-table__bar-add` (Add and `actions`) and `.nx-table__reload`; the search is now a child of `.nx-table__bar` after
-  `.nx-table__bar-end`, not inside it, and grows to 19rem from a 12rem basis.
-- **Columns opens from the options menu (⋮)**, as its first item; the bar has no Columns button. Reload, Columns
-  and the options button are ghost buttons. `TableColumnsPanel` takes an `anchor` and an `open()` handle for this.
-- **`TabButtons` `labels="auto"`**: every label while its container (a data table) is at least 900px wide, only the
-  chosen one's below. `Crud`'s lists use it.
-- **`DataTable` `selectBy`**: while rows are selected, their count opens a menu that selects again by what the rows
-  are: All on this page, then each `{ label, icon, test }`, which leaves exactly the matching rows on the page
-  selected. `Crud`'s main list offers Pinned, Not pinned, Flagged and Not flagged.
-- **`SplitButton` `fixed`**: the main button never changes; the menu holds other ways to do it, run when picked.
-- **`DataTable` `filterInputs`: an advanced filter.** Input params, each named after the column it filters, become
-  **Filters** in the options menu (⋮): a small form under the button, applied as it changes. The values are
-  `TableQuery.filters` (`TableStore.setFilters` sets them, `{}` clears); a client table matches them in `queryRows`
-  (a fifth argument), and a server gets them flat by name through `CrudBackend.pageRequest`'s third argument, as
-  `filterRequest` writes them (a date range as `{name}From`/`{name}Before`). A `CrudBackend` or loader of your own
-  ignores them until it reads that argument or `query.filters`. Also new: `activeFilters`, `asFilterInput`,
-  `filterMatcher`, `filterNames`; `usePopoverPanel` and `PopoverPanelHandle` (`nexus-shared/client`), the panel
-  Filters and Columns share; `followAnchor`'s second argument, a panel whose size it follows too.
-- **Renamed: `.nx-columns__head`, `__title`, `__count` and `__foot` are `.nx-table-panel__*`**, shared by both panels.
-  An override of the old names no longer applies.
-
-## 3.0.0
-
-**Breaking. This changes the value of exported constants, and `2.0.0` is on npm with the old ones.** Publishing it
-as a patch or a minor would hand `^2.0.0` consumers different numbers under a compatible-looking range, which is the
-worst way to ship this, so it takes a major. The owner chose the number on 2026-10-02, together with `nexus-public`
-and `nexus-admin`, which both depend on this package and so move to `3.0.0` with it; their `nexus-shared` range is
-now `^3.0.0`, because a bump of this one alone would leave them pulling the old, wrong constants.
-
-**`nexus-icons` must be installed at `1.1.0` or newer**, and the dependency range here says so. The chat components
-added in this version use `iconChecks`, `iconCornerUpLeft`, `iconMessageCircle`, `iconPaperclip`, `iconSend` and
-`iconUserPlus`, none of which exist in `nexus-icons@1.0.0`: with the old range a fresh install resolved to `1.0.0`
-and the build failed on six missing exports.
-
-### `NexusModule` — `Chat` added, and every module after it moved up one bit
-
-The backend's `EModules` gained `Chat` at bit 6, and everything after it shifted. `NexusModule` follows it exactly.
-A permission is a bitmask of these flags, so a package that kept the old numbers would grant and deny the wrong
-modules without any error to show for it.
-
-| Module | Was | Now |
-|---|---|---|
-| `None` | 0 | 0 |
-| `Migrations` | 1 | 1 |
-| `Configuration` | 2 | 2 |
-| `Identity` | 4 | 4 |
-| `Enterprise` | 8 | 8 |
-| `Drive` | 16 | 16 |
-| `Message` | 32 | 32 |
-| **`Chat`** | *(did not exist)* | **64** |
-| `Accounting` | 64 | **128** |
-| `Report` | 128 | **256** |
-| `Requisition` | 256 | **512** |
-| `Tenant` | 512 | **1024** |
-| `Subscription` | 1024 | **2048** |
-| `Reservation` | 2048 | **4096** |
-| `School` | 4096 | **8192** |
-| `Pharmacy` | 8192 | **16384** |
-| `Staffing` | 16384 | **32768** |
-| `Portfolio` | 32768 | **65536** |
-
-`NEXUS_MODULES` gained the matching entry (`key: "chat"`, `label: "Chat"`, `env: "API_CHAT"`), so `Chat` can be
-looked up, proxied and named in messages like every other module.
-
-**What to check when you upgrade.** Code that uses the names (`NexusModule.Reservation`) needs nothing. Anything
-that stored, transmitted or hard-coded a **number** has to be revisited:
-
-- permission masks saved in a database, a cache, a token claim or a settings file;
-- proxy URLs written with a number in place of a key (`/api/app/2048/…` is now `/api/app/4096/…`, and `reservation`
-  by key has always worked and still does);
-- a backend that has not taken the `Chat` shift yet — both sides move together or neither does.
-
-### `NEXUS_FLAGGED_STATUS` — 15 → 25
-
-The owner settled the record-status bands, and `ERecordStatus.Flagged` is seeded at **25**. `NexusCrudBackend`
-decides whether a row is flagged by comparing `recordStatus` to this constant, so a package on 15 while the backend
-writes 25 shows the wrong flag on every row, and flagging one writes a status the backend does not recognise.
-
-The bands, for anything that reasons about them:
-
-| Band | Range |
-|---|---|
-| Active | 0–39 |
-| — Active account | 0–29 |
-| — Flag | **25–29** |
-| — Pending, unverified, in review, approval required | 30–39 |
-| Trash | 40–59 |
-| Delete | 60 and above |
-
-`NEXUS_ACTIVE_STATUS` stays 0, and the `recordStatus < 40` reading of "a live record" that the rest of the code
-already assumes stays right.
-
-Note that **the flag is a range, 25–29, and this release still checks a single value.** Only the seeded member at 25
-has a meaning today, and the bands are about to become configurable per project, so a range-aware check belongs with
-that work rather than here. Do not read the single value as the final answer.
-
-### Removed: the archive
-
-The owner removed the archive on 2026-09-30: a record is live, in the trash, or deleted, and the way back from
-deleted lands it in the trash. The second put-away list and its second recovery path were the only reason the CRUD
-had both Restore and Recover, and the bands close up behind it — **Trash is 40–59 and Delete 60 and above**, so
-nothing stored keeps a meaning it no longer has. `recordStatus < 40` still reads "a live record".
-
-What goes, all of it breaking for anything that named it:
-
-- `CrudMode` loses `"archive"`, so a CRUD shows All, Flagged, Trash and Deleted.
-- `CrudRowActionName` and `CrudMassActionName` lose `"archive"` and `"restore"`. Recover, the trash's own way back,
-  is untouched: a CRUD that offered both now offers one.
-- `CrudEndpoints` loses `archive` and `restore`; `apiController` stops naming `Archive`, `Restore`, `MassArchive`,
-  `MassRestore`, `ArchiveListing` and `ArchivePagination`, and `lists`/`pages` lose their `archive` key.
-- `MessageActionName` loses `"archive"`, and the message builder its words and its "It can be restored from the
-  archive." confirmation detail. `"restore"` stays in the vocabulary: it is a plain verb, not the archive's.
-
-**What to check when you upgrade.** A CRUD that listed `"archive"` in `modes` or `actions` no longer compiles,
-which is the point — the endpoint behind it is gone from the backend too. A backend that still answers
-`ArchiveListing` is not asked for it any more.
-
-### Added: the chat
-
-A discussion on any record — a leave request the manager and a co-worker talk through, a purchase order, an
-applicant, a tender — behind one icon that says whether anything is waiting. Nothing that does not use it changes.
-
-- A conversation is named by three values, `ChatScope`: the **domain** (which kind of record), the **parent id** (the
-  record) and the **user id** (who is reading). The domain is the app's own enum, given either as a template
-  (`<Chat<EDomainTypes> …>`) or once in `ChatRegister`, the same way `ApiRegister` names the module enum. Without one
-  it is a plain number.
-- **No domain numbers are defined here.** They belong to the backend's `EDomainTypes`, and the warning at the top of
-  this file applies to them in full. `defineChatDomains` only gives an app's domains their names on screen.
-- `ChatButton` is an icon in three looks: quiet with no messages, the accent on its tint once there are messages, and
-  the accent filled with an unread badge once some are unread. One size in all three, with the badge over the corner,
-  so a column of them in a table does not move as the counts arrive.
-- `ChatSummaryCache` fills every icon that mounted in the same moment with **one call per domain**. A list whose rows
-  already carry their counts passes `summary` and makes no call at all.
-- `Chat` is the icon with the conversation in a popup; `ChatPanel` is the conversation on its own, for a record's own
-  page. Messages are **Markdown**: written in `MarkdownEditor` and drawn by `MarkdownView`. Enter sends and
-  Shift+Enter starts a line, except in a list or a code fence, where the editor keeps Enter; `sendKey="modifier"`
-  moves sending to Ctrl+Enter.
-- One mark where the time sits says how far a message of your own has got: a spinner while sending, a tick once the
-  server has it, two once `deliveredTo` holds somebody, two in the accent once `readBy` does.
-- Where the data comes from is one interface, `ChatSource`. `apiChatSource` goes through the app's `ChatBackend`
-  (`NexusChatBackend` by default); `localChatSource` keeps a conversation in memory for a demo or a test.
-- **The Nexus endpoints are the shape the Chat module is expected to take, not an API that answers today.**
-  `NexusModule.Chat` is a number and a proxy key; the controller is not built. Each difference, when it lands, is one
-  override on `NexusChatBackend`.
-- `check:themes` gained a rule: body text on the primary tint, which is a message bubble of your own. Every theme
-  clears AAA except catppuccin light at 6.84, so it is held to the AA 4.5 that applies to body text.
-- **A record holds many conversations.** `ChatScope` names the record; each conversation in it is a
-  `ChatConversation` with its own id and a type, `one-to-one` or `group`. `ChatPlaceSource` lists them and starts
-  them, `useChatPlace` is the hook, and `apiChatPlace` is the API one. A panel given a `source` still shows that one
-  conversation and no switch, so nothing that used the first round changes.
-- The panel's body has three views — the thread, the list of conversations, and New chat — and the bar moves between
-  them. With several conversations the title is the switch; with one it is just the title.
-- Starting a chat never asks for the type: one person makes a one-to-one, more make a group, and a name makes a
-  group either way. A one-to-one with somebody who already has one is expected to come back rather than be made
-  twice; `localChatPlace` keeps that rule.
-- `@` at the start of a word offers the people in the conversation, narrows as it is typed, and owns Enter while it
-  is open. A mention is plain `@Name`, or a Markdown link with `mentionHref`; either way the ids travel in the
-  draft's `mentions`.
-- `ChatSnapshot` gained `loaded`: a store that has read nothing yet holds empty counts, and a panel must not write
-  those over what a conversation list already knows.
-
-### Added: several at once, `TabButtons multiple`
-
-`TabButtons` picks one option; with `multiple` it picks several, so a list of choices that must be seen all at once
-(the weekdays a rule runs on, the letters or symbols a pattern allows) needs no second control. Nothing that does
-not pass it changes.
-
-- `value` is an array and `onChange` hands back the chosen values **in option order**, whatever order they were
-  clicked in. Values that match no option are ignored and never handed back.
-- The options are native checkboxes in a `role="group"`: Tab moves between them and Space toggles one. The group
-  still needs `aria-label` or `aria-labelledby`.
-- There is no sliding indicator: each chosen option is raised with the indicator's own colors, border and shadow,
-  and keeps the pointer, since a click takes it away again. An option that is not chosen sits flat on the track.
-- The options **wrap** onto more rows when they do not fit, each row as tall as a one-row track's options, and an
-  option is never narrower than it is tall, so a row of single letters lines up. On a touch screen
-  (`pointer: coarse`) every option is a medium control's height: 26 letters on a phone are 34px targets, not 22px.
-- Made and checked for the `nav` design (`/demo/tab-buttons`, "Several at once"); `design="list"` with `multiple`
-  renders checkboxes too, but has not been checked yet.
-
-### Added: inputs that follow others, `dependsOn`, and a row's own params, `cellParams`
-
-Two optional keys, added 2026-09-26 for the builder's class form, whose company model shows only when the class has a
-company or a branch and whose type arguments offer a key type in one row and a model in the next. Nothing that does
-not pass them changes.
-
-- **`dependsOn: ["hasCompany"]`** on an input's params (Form only). When a named input's value changes — typed, or
-  set from code — this input draws again **without mounting again** (nothing typed in it is lost) and its params are
-  read afresh, so getters for `hidden`, `readOnly`, `readOnlyMessage`, `label`, `hint` or `options` answer for the
-  values as they are now. Its rule is asked again too, so a `required` a getter switched on counts at once. An input
-  that names any is asked `hidden` each time it draws, so it can come and go; one that names none is asked once, when
-  the form draws, as before. Name the input itself to follow its own typing.
-- **`cellParams(row, name, index)`** on `TabularForm` and `GroupForm`: the params of one cell that differ from its
-  column's, such as a picker's `options` and `selectedOptions`. Asked as the row draws; return nothing for the
-  column's own params, and the **same object** for the same answer (the merged params are kept per answer, so the cell
-  does not draw again for nothing). Getters on either side stay getters. Rules still come from the column.
-
-### Added: a generated column in a tabular or group form
-
-Two optional props on `TabularForm` and `GroupForm`, for a column whose values a row's **position** decides rather
-than the user — a bitwise enum's value, a line number, a running total. Nothing that does not pass them changes.
-
-- `deriveRows(rows)` returns one patch per row and runs after every change, including a row being added, removed,
-  duplicated or **moved**. The patches are written as code writes, so only the cells whose value really changed
-  mount again and focus stays on the row's own menu: a keyboard can move a row twice in a row.
-- `cellReadOnly(row, name, index)` is asked for every cell as it renders and returns the reason a cell is
-  generated. The cell is locked and shows that reason as its read-only note. Because it is asked per render, a
-  column can lock and unlock while the form around it changes, which params cannot do — they are fixed once a form
-  opens.
-
-### Added: rows nobody may change, `rowReadOnly`
-
-One optional prop on `TabularForm` and `GroupForm`, for rows the user did not write and may not change — the fields
-a class inherits from its parent, shown first in the same grid as its own. Nothing that does not pass it changes.
-
-- `rowReadOnly(row, index)` returns the reason (or `true`). Every cell of such a row is read-only with that reason
-  as its note, the row's menu in a tabular form offers nothing (no insert, duplicate, move or remove), and the row
-  below it cannot move up past it. Nothing reorders the rows: keep the locked ones first.
-- A locked row says nothing about its columns: the column-header lock is worked out from the other rows in view, so
-  a grid of inherited rows and one own row does not put a lock on every header.
-
-### Added: a panel beside a CRUD form, `form.aside`
-
-An Add or Edit popup can show a panel next to its form: a preview of what a save would produce, a summary, a help
-panel. It takes a node, or a function handed `{ form, action, row }` — `form` being that popup's own `FormStore`, so
-a panel follows what is typed through `subscribeValue()` and the form around it never re-renders for it.
-
-The two are columns above 1000px, each scrolling on its own so a long form cannot push the panel off the screen, and
-they stack below that with the **form first**, in the DOM as well as on the screen. `--nx-crud-aside-width` sets the
-panel's share (default `clamp(20rem, 38%, 44rem)`). Pair it with a wide `form.size` — `xl` or `full`; a panel in a
-560px popup leaves the form nothing. A CRUD that passes no `aside` renders exactly what it did before, wrapper and
-all.
-
-### `TabularForm` reworked: one row control, rows that do not move, one lock per column
-
-The owner called the tabular design bad, from a screenshot of an 18-row table with one generated column. Every fault
-was in this component rather than in the page that used it, so every fix is here. Nothing needs a new prop, and a
-table that passed nothing new looks different — deliberately.
-
-**Breaking, visually and for tests.** Two things a consumer may be reaching for have moved:
-
-- **The remove column is gone.** Remove was a column of unlabelled `×` buttons at the end, beside a row menu that
-  already held Remove: two ways to act on one row, and a whole column spent on one of them. Now a row has one
-  control, the menu beside its number, holding Insert above, Insert below, Duplicate, Move up, Move down and Remove.
-  `removable` still decides whether Remove is offered. A test that clicked a button named `Remove <row>` opens the
-  row's menu instead: `Row 2 actions`, then the `Remove` item. `.nx-tabular__end` and `.nx-tabular__remove` are gone
-  from the DOM and the stylesheet; so is `--nx-tabular-end`, replaced by `--nx-tabular-menu` (the menu's slot width).
-- **The row number no longer opens the menu.** It used to *become* the menu on hover: the number faded out and dots
-  faded in over it, so the numbering looked broken and the grid felt unstable as the pointer crossed it. The number
-  now stays where it is, right-aligned, at every moment, and the menu button sits beside it in its own space,
-  always present. The number column is that much wider.
-
-**Fixed, with no change to how a table is written:**
-
-- **Every row is one line high, whatever it holds.** The row's grid track was sized by its tallest cell, so a single
-  `textarea` column of `rows: 2` made every cell of its row 20px taller than the row's own box — drawing the cells,
-  their edges and their focus rings over the rows below. One row of content therefore looked taller than its
-  neighbours, and a focus ring bled outside its cell. The row now has one track exactly its own height, cells keep
-  what they hold inside their bounds, and a `textarea` fills its cell and scrolls inside it.
-- **No resize grips in cells.** A `textarea` in a cell took `resize: vertical` from the multi-line input rule, so
-  every cell of such a column offered a grip that would break the alignment of its row. They are `resize: none` now.
-- **A filled cell and an empty one are drawn the same.** Same consequence as the above: only the cell with text was
-  tall enough to show what the overflow was doing.
-- **`maxHeight` comes down to whole rows.** The scroller used to end wherever the number fell, cutting the last row
-  in half, which reads as broken rather than as scrollable. The component measures its header, its frame and its
-  real row height and caps itself just under what was asked for. A number too small for one row is left alone.
-- **A generated column says so once.** `cellReadOnly` put a lock in every cell of the column it locked — eighteen
-  locks for one fact. The lock is now on the **column header**, with the reason as its title, and the cells keep the
-  read-only tint and their own reason, which still shows under the table when one is used. A lock that really is per
-  row (some rows locked, not all) leaves the header alone and is drawn per cell as before.
-- **Less chrome.** The frame is `--nx-border` rather than `--nx-border-strong`: the sheet draws every line it needs
-  inside itself, and in a popup or a panel the strong edge was a box around a box around boxes.
-
-## 2.0.0
-
-The rewrite: compiled `dist` with the entry points `.`, `/client`, `/server` and `/styles.css`, in place of 1.x's
-raw TypeScript from `src` with `.`, `/client` and `/interface`. A major version, so nobody on `^1.1.21` is moved
-into a different API.
+# Changelog
+
+Notable changes to `nexus-shared`. The **values** of exported constants count as API here: several of them are the
+Nexus backend's own numbers, and a value that differs from the backend by one does not fail loudly — it silently
+means the wrong thing on every record and every permission check.
+
+## 4.0.0
+
+**Breaking: an input's `type` is a number, a member of `EInputTypes`, and a string is refused.** Everything else in
+this version was prepared as `3.3.0`, which was never published; it follows under
+[the changes prepared as 3.3.0](#also-in-400-the-changes-prepared-as-330).
+
+Every export of the published `3.2.0` is still exported (287 are new: 226 from `nexus-shared`, 61 from
+`nexus-shared/client`, none from `nexus-shared/server`; 55 of them are [pictures and documents](#pictures-and-documents-declared-by-params), 19 are [cards C1's and C1-fix's](#the-editor-loads-in-every-bundler-a-reason-initials-one-action-locked-options-narrowed), 24 are [card RF-comp's](#a-printable-document-money-in-a-currency-inputs-shown-by-another-focus-kept-through-a-picture-change), 20 are [card TABS-comp's](#a-records-workspace-a-profile-and-tabs-in-the-details-popup), 3 are [card R2-comp's](#a-servers-page-in-a-sandboxed-frame-code-text-in-a-text-area), 1 is [card C-table-whole's](#a-short-list-read-whole-paging-in-the-footer-only), 1 is [card C-choice-tabs'](#a-choice-drawn-as-tabs), 1 is [card C-input-memory's](#an-input-that-remembers-its-last-value-or-opens-on-the-companys-default), 1 is [card C-label-follows'](#a-label-that-follows-another-input), 6 are [card C-server-preview's](#a-preview-the-server-works-out-as-the-person-types), 1 is [card C-print-logo's](#a-printable-documents-logo), 12 are [card C-crud-scope's](#a-list-that-can-be-widened-to-other-endpoints), 5 are [card C-row-form's](#a-row-action-that-opens-a-form-of-its-own-for-the-record), 3 are [cards C-leave-guard's and C-leave-fix's](#a-form-with-changes-asks-before-a-navigation-inside-the-app), 4 are [cards IMG-comp's and IMG-comp-fix's](#every-picture-through-the-editor-and-within-drives-limits), 2 are [card C-pin-narrow's](#pinned-columns-give-way-on-a-narrow-table), 56 are [card C-record-cards'](#a-records-page-of-cards-every-change-in-a-popup), 2 are [card C-tab-footer's](#a-record-tabs-footer-that-stays-in-view), 13 are [card C-form-figures'](#form-figures-an-input-worked-out-from-others-the-servers-money-rule-and-a-money-column), 7 are [card C-form-confirm's](#a-form-asks-before-it-saves-the-full-details-in-sections), 2 are [card C-profile-fields'](#a-few-fields-in-a-records-profile-left-out-of-its-details-tab), 2 are [card C-span-when's](#an-inputs-width-that-follows-a-value), 6 are [card C-record-cards-fit's](#record-cards-that-fit-what-was-built-on-them); the rest are named in the sections below or
+[in the list at the end of these notes](#new-exports-no-section-names)), and no exported constant changed a value (86
+compared), both checked against the published `3.2.0` with `Frontend/scripts/release-compare` (again on 2026-11-06,
+which corrected the hand count of 195; card C-record-cards' 56 are counted from its three files). What breaks is a type: `InputParams` and
+every params type in it take `type` as an `EInputTypes` member, so every list of inputs an app writes changes.
+`nexus-icons` stays `^1.2.0`; its published copy exports every name this package imports (125). The packages built on
+this one move with it: `nexus-admin` `4.0.0` asks `^4.0.0` (a major, because its range crosses this one), and
+`nexus-public` `3.0.1` asks `^3.0.0 || ^4.0.0` (it imports only `cx`).
+
+### Breaking: an input's type is the numbered `EInputTypes`
+
+The owner, 2026-10-30, pointing at `type: "switch"` and `type: "dropdown"` in an app's inputs: the old project held an
+input's type as a numbered enum, and so does this package now. A number is what a database, a generated page and a C#
+enum can hold, and a member name that does not exist fails to compile where a mistyped string compiled.
+
+```tsx
+// 3.x
+import type { InputParams } from "nexus-shared";
+const INPUTS: InputParams[] = [
+  { type: "text", name: "fullName", label: "Full name", required: true },
+  { type: "dropdown", name: "tags", label: "Tags", multiple: true, options: TAGS },
+  { type: "switch", name: "isActive", label: "Active" },
+];
+
+// 4.0.0
+import { EInputTypes, type InputParams } from "nexus-shared";
+const INPUTS: InputParams[] = [
+  { type: EInputTypes.Text, name: "fullName", label: "Full name", required: true },
+  { type: EInputTypes.Dropdown, name: "tags", label: "Tags", multiple: true, options: TAGS },
+  { type: EInputTypes.Switch, name: "isActive", label: "Active" },
+];
+```
+
+`EInputTypes` is written as `ENumberScales` is: an `as const` object and a type of the same name, so it is a value and
+a type, works in a server component, and `InputParams` still narrows on it (a dropdown's `multiple: true` still makes
+its value a list). Its numbers are this package's own, in blocks by kind with room to grow; **0 is never a kind**, so a
+value left out is never a valid one, and a released number is never reused or given another meaning.
+
+| Block | Kind | Member | Number | Was |
+|---|---|---|---|---|
+| 1–19 | Text boxes | `Text` | 1 | `"text"` |
+| | | `Email` | 2 | `"email"` |
+| | | `Password` | 3 | `"password"` |
+| | | `Search` | 4 | `"search"` |
+| | | `Tel` | 5 | `"tel"` |
+| | | `Url` | 6 | `"url"` |
+| | | `TextArea` | 7 | `"textarea"` |
+| | | `Code` | 8 | `"code"` |
+| 20–39 | Choices | `CheckBox` | 20 | `"checkbox"` |
+| | | `Switch` | 21 | `"switch"` |
+| | | `Radio` | 22 | `"radio"` |
+| | | `CheckBoxGroup` | 23 | `"checkbox-group"` |
+| | | `RadioGroup` | 24 | `"radio-group"` |
+| | | `Dropdown` | 25 | `"dropdown"`, one item or many by `multiple` |
+| 40–59 | Dates and times | `Date` | 40 | `"date"` |
+| | | `DateRange` | 41 | `"date-range"` |
+| | | `Time` | 42 | `"time"` |
+| | | `DateTime` | 43 | `"date-time"` |
+| 60–79 | Numbers and sliders | `Number` | 60 | `"number"` |
+| | | `Slider` | 61 | `"slider"` |
+| | | `RangeSlider` | 62 | `"range-slider"` |
+| 80–99 | Editors | `Markdown` | 80 | `"markdown"` |
+| | | `RichText` | 81 | `"rich-text"` |
+| 100–119 | Structures | `Tree` | 100 | `"tree"` |
+| | | `Tabular` | 101 | `"tabular"` |
+| | | `Group` | 102 | `"group"` |
+| | | `Picture` | 103 | new: [a record's picture](#pictures-and-documents-declared-by-params) |
+
+Every number fits a byte. To move an app: import `EInputTypes` from `nexus-shared` and write the member in place of
+each string in the table; the type checker lists every place it is still a string. A page that compared an input's type
+(`params.type === "radio"`) compares the member. Unchanged: a `TextBox`'s own `type` prop is still its HTML type
+(`<TextBox type="email" />`), which is not an input's params; a dropdown column's `type` (`"code"`, `"muted"`), a table
+column's `format` and the chat's conversation `type` are not inputs either and keep their strings.
+
+New beside it, and counted in the 30 above: `TextInputType` (the six text box members, whose `TextBox` gets its HTML
+type from one map in the renderer) and `inputTypeName(type)`, the member's name for a message or a log
+(`inputTypeName(EInputTypes.RichText)` is `"RichText"`; a number that is no member comes back as its digits). A table's
+filter that cannot filter now warns with the name: *a RichText input cannot filter rows*.
+
+### Pictures and documents, declared by params
+
+Card D2 of the subscription demo round (2026-11-02). A record's pictures and documents - a company's logo, a branch's
+pictures, a person's own picture, a subscriber's documents - are the files of an **owner** (a row of a module) in a
+**category** (what they are for, with its limits), and a page adds them by declaration:
+
+```tsx
+import { EInputTypes, NexusModule } from "nexus-shared";
+import { DocumentList, openPictureGallery, pictureColumn } from "nexus-shared/client";
+
+const BRANCH_PICTURES = { module: NexusModule.Enterprise, category: "branch-picture", aspect: 4 / 3 };
+
+// A form: the owner's main picture, changed at once (Upload, Edit, Remove, All pictures).
+inputs: (action, row) => [{ type: EInputTypes.Picture, name: "picture", label: "Picture", ...BRANCH_PICTURES, ownerId: row?.id }];
+// A table: each row's picture, the page's rows read in one call; a click opens the row's gallery.
+columns: [pictureColumn({ ...BRANCH_PICTURES, rowTitle: row => row.branchName }), ...];
+// A window, and a list for a category that takes PDF.
+openPictureGallery({ ...BRANCH_PICTURES, ownerId: branch.id, title: branch.branchName });
+<DocumentList module={NexusModule.Subscription} category="subscriber-document" ownerId={subscriber.id} />;
+```
+
+- **`EInputTypes.Picture` (103)**, the next number of the structures block: `PictureInput`, the owner's main picture
+  with Upload (choose, edit with the shape locked, store, make it the main one), Edit (a new picture from the main one),
+  Remove (no main picture; the pictures stay) and All pictures. In a category that keeps one file, Upload is Replace
+  (the new picture takes the kept one's place once the editor has saved) and Remove is Delete, so the input is never
+  left with a file it cannot delete. It holds no value of the form: the form store keeps no field for it
+  (**`holdsValue`**), so a save sends nothing under its name, and it takes no `required`, since the form could not
+  refuse a save without a picture. A record not saved yet (`ownerId` null) says "Save the {subject} first".
+- **`PictureGallery` / `openPictureGallery`**: upload several at once up to the category's count (each clamped to
+  2048 px and given its thumbnail by the editor's `renderImage`, without opening it; a picture's size is checked once
+  it is made, so a phone photo over the category's size is stored), make one the main picture, view
+  them in the editor module's viewer, edit one (saved as a new picture), delete. **`DocumentList`**: the same for a
+  category that takes PDF, as a list (kind, size, date, open, rename, delete); the gallery picks it by itself, and
+  `openPictureGallery` without `view` names its window after it ("Documents") once the category is read.
+- **`pictureColumn`**: each row's picture; every row a table draws asks `primaryPictures` (`PrimaryPictures`), which
+  gathers the asks of one moment into **one call per module and category**, at most the adapter's `maxOwners` (200),
+  and keeps the answers until a change on the page writes one in, so a row redraws without a reload. A refused or
+  failed read is kept as no picture for `retryAfter` (30 s), so rows that draw again do not each ask again; `clear()`
+  also drops the reads under way, so an ask after a sign-out never gets the answer meant for the person before.
+- **`loadImageEditor()`** (about 1 KB): the image editor (`nexus-image-editor`) is **never in an app's bundle**. The
+  adapter names its versioned address (with Nexus, Drive's `Assets/File/nexus-image-editor.txt`), and the loader
+  imports it with the bundler told to leave the import alone (`webpackIgnore` / `turbopackIgnore`; proved in a
+  Next.js 16 Turbopack build: the chunk holds a plain `import(url)`), once per page; a failed load is not kept.
+  `preloadImageEditor()` starts it on the hover of an Edit or Upload button. Its types are in `ImageEditorModule`.
+- **`FileAdapter`** is the abstract class an app implements for its own file backend (`list`, `primaries`, `upload`,
+  `setPrimary`, `rename`, `remove`, `fileUrl`, `editorModuleUrl`), registered once with `defineFileAdapter`;
+  **`NexusDriveAdapter`** is the default: a write ticket from the owner's module (`Files/Ticket/{category}/{ownerId}`,
+  kept until a minute before it runs out, asked again once when Drive answers `DRV_X011`), a read ticket
+  (`Files/Owners/{category}`) for a page's rows and for a person who may see but not change an owner's files, then
+  Drive's `File/List`, `Primaries`, `Upload`, `SetPrimary`, `Rename`, `Delete` and `View/{id}/{Original|Thumbnail}`.
+  Nothing generic names a backend's numbers: a category's kinds are MIME types.
+- New shared helpers: `fileRefusal` (a kind or size the category refuses, said before the upload), `fileKindsSentence`,
+  `fileSizeText`, `roomLeft`, `takesDocuments`, `pictureName`; one stylesheet, `Nexus.Files.css` (`nx-picture`,
+  `nx-picture-input`, `nx-files`), whose hovered pictures get a ring and never a new size.
+
+Proved by `npm run test:files` (the adapter against a pretend backend: the tickets, the fresh one after `DRV_X011`, the
+read-only fallback, the page's order, the multipart fields, the pointer file) and nexus.template's `/demo/pictures`
+with its browser check `pictures.cjs`, on a pretend Drive that answers as the C# one.
+
+### The editor loads in every bundler; a reason, initials, one action locked, options narrowed
+
+Card C1 of the subscription demo's second round (2026-11-02): fixes to the pictures above, and two features the
+subscription pages needed and kept as code of their own.
+
+- **The image editor loads in an app's production build.** The package build rewrites "./x.ts" imports to "./x.js"
+  (`rewriteRelativeImportExtensions`), and for an `import()` of a variable it wrapped the address in a run-time helper,
+  `import(__rewriteRelativeImportExtension(url))`. The bundler-ignore comments were then inside a call, and Next 16's
+  Turbopack compiled the import to "Cannot find module as expression is too dynamic": in every app built on `dist`,
+  Upload and Edit on a picture never opened the editor (an app reading the source, like nexus.template, never saw it).
+  The import now lives alone in **`importModule(url)`** (`Services/ModuleImport.ts`, which imports nothing), built a
+  second time without the rewrite (`tsconfig.build.module-import.json`, the second step of `npm run build` and of
+  `copy-packages`' watch), so `dist` keeps `import(/* webpackIgnore: true */ /* turbopackIgnore: true */ /* @vite-ignore */ url)`.
+  The setting stays for every other file. `scripts/test-dist-loader.mts` (in `npm test`) runs the build's steps into a
+  scratch folder and fails if any built file holds the helper.
+- **An editor that cannot load says so.** `loadImageEditor()` rejects in plain words ("The image editor could not be
+  downloaded. Check the connection and try again; ...") and logs the cause (a network error, a 404, a bundler that
+  rewrote the import) with `console.error`; the picture input, the gallery and the viewer show it as a toast.
+- **A picture input says why it is read only.** `OwnerFilesParams.lockReason` (on `PictureInput`, `PictureGallery`,
+  `openPictureGallery`, and `pictureColumn` as a sentence or `row => sentence`) makes the files read only with that
+  sentence under them: a record that is closed, a year that is locked. Without it, a person the backend lets only look
+  is told the backend's own words: `NexusDriveAdapter` keeps the refused write ticket's message as
+  `OwnerFiles.readOnlyReason`, and **`READ_ONLY_REASON`** stands in when there is none.
+- **Initials for an owner with no picture.** `OwnerPicture` `name` and `pictureColumn` `nameKey` (the row's field with
+  a name): without a picture, the name's initials, on the tone the shared `Avatar` gives that name
+  (`.nx-picture--initials`; the avatar tones now also apply to `.nx-picture[data-tone]`).
+- **One action locked on a row: `Crud` `rowActionLock`**: `row => ({ trash: "The head office stays open..." })` switches
+  off single actions of a record, each with its sentence in the row's menu, in a selection that holds it, and for
+  `edit` in its details too; the rest still run. `rowLock` still locks every change at once. New types
+  `CrudLockableAction`, `CrudActionLocks`.
+- **Options narrowed by another input: `narrowedBy`** on any input (Form only), `{ name, key?, placeholder? }`: a
+  Package list only of the Group picked. The form hands the input its params narrowed by the other value as it draws
+  (`narrowInputParams`, `narrowingValue`, `narrowingPlaceholder`, pure): static `options` filtered, `loadOptions` asked
+  with the new **`DropdownPageRequest.narrow`**, a load key per value, nothing offered and "Pick a group first" while the
+  other is empty; the form store follows it as `dependsOn` would and clears the narrowed value when a person changes the
+  other (never when code sets it). `crudPicker` answers `narrow` from its kept list, or, with the new **`narrowQuery`**,
+  asks the server (`activeListing?{narrowQuery}={value}`, one kept list per value, dropped with the others on a save).
+  `FormStore.inputParams(name)` is new.
+- **A list narrowed by a box of its own, remembered per viewer: `Crud` `narrowPicker`** (`CrudNarrowPicker`): the
+  picker's params, the box's label, `remember: { key, viewer }` and `onPick`. The CRUD draws the box in its toolbar, keeps
+  the pick as `narrow` would, and opens the same pick on the next visit in this browser for the same viewer while the
+  box still offers it; only the record's key is stored. `useCrudNarrowPicker` is exported (`nexus-shared/client`).
+
+Proved by `npm test` (`test-dist-loader`, `test-input-narrowing`, `test-files`' reason), nexus.template's `/demo/pictures`
+(`pictures.cjs`: initials, the lock reason, an editor whose module is refused) and `/demo/crud`'s "One group at a time"
+(`crud-narrowing.cjs`), and nexus.web's production build against a Drive API.
+
+Card C1-fix (the review of C1, 2026-11-02):
+
+- **`narrowedBy` clears down a chain.** A person changing the Country clears the Region, and now the District picked
+  among that Region's too, whatever order the form lists them in (before, the District kept a value of the old Region,
+  and could be saved).
+- **A narrowed input's getters answer on every draw.** `Form` copied a `narrowedBy` input's params once and kept the
+  copy, so a `readOnly`, `hint`, `label` or `options` getter that `dependsOn` follows stayed as it first read. The
+  copy is now made afresh each time the input draws.
+- **A `narrowPicker`'s words name its box**: "Pick a group in the Group box to see its amenities.", "... to add a new
+  amenity for it." on Add, and "Added for Bathroom: pick another group in the Group box to add elsewhere." on the Add
+  form's fixed field (before, all three said "the other list"). New on `CrudNarrow` (and so on `narrowPicker`):
+  **`addMessage`** and **`fixedMessage: name => sentence`**, beside `emptyMessage`; the words are
+  **`narrowPickWords(label, subject, plural)`**.
+- **The remembered pick keeps the key alone, and only for a viewer.** No name is written to local storage (a pick kept
+  with one by C1's build still opens, and is written again without it), and without `remember.viewer` nothing is
+  remembered: **`narrowPickerStorageKey`** (now from `nexus-shared`) answers `null`. A kept pick is found again by its
+  key alone, **`findNarrowPick`**: `resolveOptions` when the picker has it, else the box's pages at 50 a page (never one
+  page of everything, which a server-paged source refuses). `readNarrowPick`, `writeNarrowPick`,
+  `narrowPickerPlaceholder` are the rest of `Helpers/CrudNarrowPick.ts`, pure.
+- **An owner not in use is not "not found".** When a module refuses the write ticket with a 404 (the owner pending,
+  ended, in the trash or deleted) and a read ticket still finds it, the files say **`OWNER_NOT_IN_USE_REASON`** ("This
+  record is not in use now, so its files can be seen but not changed.") rather than "The record was not found.".
+- **`test-dist-loader` checks this folder's whole `dist`** with the scratch build's rules (ModuleImport.js there, its
+  import plain, no helper in any file), so a dist built with only the first step fails.
+
+Proved by `npm test` (23 suites; `test-input-narrowing` 49, `test-files` 73, `test-dist-loader` 17) and nexus.template's
+`crud-narrowing.cjs` (55, both motions: the three sentences, a narrowed Icon whose hint follows "Free for guests"),
+`staff-posts.cjs` (86, the other-list words unchanged), `crud.cjs`, `forms.cjs` (154) and `pictures.cjs` (83).
+
+### A record's workspace: a profile and tabs in the details popup
+
+Card TABS-comp (2026-11-03), from the owner's request for the tab buttons of the 2026-06-20 project's record popups:
+View, and a click on a row under `table.openOnClick`, open the record as a wide popup with who it is and its tabs on the
+left and the chosen tab on the right. Additions only.
+
+- **`CrudDetailsOptions.tabs`**: `{ id, label, icon?, endpoint?, hidden?(row), badge?, render(context) }[]`. A tab that
+  names an `endpoint` shows only to a person who may call it (the rule of `CrudDetailsAction`, again whenever the rights
+  change). `render` is handed a **`CrudDetailsTabContext`**: `row` (as the list has it now), `form` (the record in the
+  `FormStore` the `aside` is handed: the row, then the `details` endpoint's record, then each refresh's), `popup`, `tab`,
+  `select(tabId)` and **`refresh()`**, which reads the record again from the `details` endpoint and writes it into the
+  table, the pinned band, every list kept and every tree (`trees`), as an edit's answer is - no list is read again - and
+  answers the record (or `null`). The built-in tab `details` (the fields, with `aside` beside them) comes first; list
+  `{ id: "details" }` to move or rename it, give it `hidden: () => true` to leave it out, or a `render` to replace it.
+  Only the chosen tab is drawn. With tabs the popup's default size is `full`.
+- **`CrudDetailsOptions.profile`**: `row => ({ picture?, title, subtitle?, tags? })` or anything to draw. `picture` is
+  the owner's main picture by the params the picture column takes (`{ ...GUEST_PICTURE, ownerId }`, a
+  **`CrudDetailsPicture`**: a click opens the pictures, initials stand in without one) or a node; `tags` are
+  `{ label, tone? }` in the look of a table's tags. It follows the record as it is loaded and refreshed.
+- **`CrudDetailsOptions.remember`**: `{ key, viewer }` keeps the last tab chosen in this browser
+  (`nx-crud-tab:{key}:{viewer}`) and opens it next time while it is still offered; nothing is kept without a viewer.
+- The layout: a 20rem column (the picture 10rem, the name, the line, the tags, then the tabs as `design="list"` rows)
+  and the tab beside it, which scrolls inside itself; the popup's body never scrolls and a switch never changes its
+  size. The workspace is a size container: below 720px of popup width (a phone) the profile is one row (a 3rem
+  picture) and the tabs one strip that scrolls sideways, above the tab. The focus opens on the chosen tab, a switch
+  that takes away the panel holding the focus puts it on the chosen tab, and it never drops to the page.
+- **`Tabs`** and **`TabPanel`** (`nexus-shared/client`): tabs that switch panels, as a WAI-ARIA `tablist` - the one
+  piece `TabButtons`' own doc pointed to and the package did not have. The look is `TabButtons`', from the same
+  stylesheet (`design` `list`, `nav`, or `auto`: the list, and a strip in a container under 720px); the chosen tab is
+  `aria-selected` and the only one in the Tab order, the arrows (either way), Home and End move and open, the panel is
+  joined by `tabIds(id, value)` and takes the focus itself when it holds nothing that does. `TabOption`, `TabsDesign`,
+  `TabsProps`, `TabPanelProps`.
+- The tabs' rules without a browser, in `nexus-shared`: `offeredCrudTabs`, `openingCrudTab`, `crudTabStorageKey`,
+  `readCrudTab`, `writeCrudTab`, `isCrudProfile`, `isCrudPicture`, `CRUD_DETAILS_TAB`, `OfferedCrudTab`.
+- `OwnerPicture` `size` also takes a CSS length (`"var(--nx-crud-profile-picture)"`), so a picture can follow a
+  container query.
+- Styles: `Nexus.Crud.css` (`nx-crud-workspace`, `__frame`, `__frame--alone`, `__side`, `__profile`, `__nav`,
+  `__panel`; `nx-crud-profile`, `__picture`, `__text`, `__title`, `__subtitle`, `__tags`) and `Nexus.Tab.Buttons.css`
+  (the chosen option is `:checked` or `[aria-selected="true"]`, a button's own look taken away, `nx-tabs--auto`,
+  `nx-tab-panel`).
+- Proved by `scripts/test-crud-details-tabs.mts` (33) and nexus.template's `/demo/crud` "A guest's workspace" with
+  `scripts/browser-checks/crud-workspace.cjs` (60 in both motion modes: the click on a row, the keyboard, one Update
+  and one Detail for a check-in with the row's visits written in, the remembered tab, a role without the endpoint, every
+  theme light and dark at 1280x720 and 390x844).
+- Card TABS-fix1-comp (2026-11-03), from the review of the first page built on it:
+  - **A form in a tab is never thrown away without asking.** A `SubmitForm` (and so an `ApiForm`) joins the place it
+    is drawn in by itself (`FormLeaveGuard`, by the rule of its "leave the page?" question: not while locked, not when
+    a draft keeps it); while one has changes, choosing another tab, Close, Edit, the popup's X, Esc and its bar on the
+    dock ask "Discard your changes?". Keep editing stays where it was. No new export.
+  - **`refresh()` lands after the popup closed.** Only the first read of the record stops when the popup closes; a
+    save in a tab followed at once by Close still writes the row's new status and dates into the lists.
+  - **A record off the page shown is patched in place.** `refresh()` hands the record as the popup held it, so one
+    opened from the pinned band, or from a page turned since, is written into every page kept that has it: no page is
+    dropped and the page shown is not read again.
+  - **A popup closed over another never leaves the focus on the page.** When its opener cannot take the focus back (an
+    item of a menu that closed, a button disabled while its action runs), the popup now on top takes it where it puts
+    it on opening: in a workspace, the chosen tab.
+  - The examples here, in the README and in `CrudDetailsOptions.tabs`' doc are a guest's, as the template's demo is.
+
+### A printable document, money in a currency, inputs shown by another, focus kept through a picture change
+
+Card RF-comp (2026-11-03), from the whole-round review of the subscription demo's second round: three pieces the
+subscription pages had written as code of their own (findings rules-3, rules-4, rules-5), and the picture input and
+gallery keeping a keyboard's focus (packages-3).
+
+- **`PrintDocument`** (`nexus-shared`, no state, so server components too): a receipt, a bill or a statement by params:
+  `paper` (`"a5"`, the default, or `"thermal"`, an 80 mm roll), `title`, `subtitles`, `kind`, `stamp` ("Voided: ..."),
+  `blocks` in order - `{ facts: [{ label, value, hidden? }] }` and `{ columns: [{ label, align? }], lines: [{ cells,
+  note?, hidden? }], totals: [{ label, value }] }`, falsy entries left out - and `footer` (line breaks kept). On screen it
+  reads in the theme's colours at its paper's width (128 mm, or 72 mm); printed with `window.print()` it is the only thing
+  on the paper, black on white, at the paper's left edge, and the component writes the page's `@page` rule (A5 portrait
+  with 10 mm margins, or 80 x 297 mm with 4 mm) while it is on the page. The print rule applies only while a document is
+  on the page (`body:has(.nx-print)`), so any other page prints as it is. **`PRINT_PAPERS`** are the papers as
+  `TabButtons` options. Styles: `Styles/Nexus.Print.css` (`nx-print`, `--thermal`, `__head`, `__title`, `__kind`,
+  `__stamp`, `__facts`, `__lines`, `__end`, `__note`, `__foot`). Types `PrintPaper`, `PrintFact`, `PrintColumn`,
+  `PrintLine`, `PrintFactsBlock`, `PrintLinesBlock`, `PrintBlock`, `PrintDocumentProps`.
+- **Money in the company's currency, set once.** `DataTableProps.currency` (and `Crud` `table.currency`) writes every
+  `money` column as "Rs. 1,250.00" in the cells, the details, the CSV and the print; **`TableColumn.currency`** gives a
+  column its own, a text or `row => row.currencyText`. `formatCellText(column, value, options, row?)` takes the row for
+  it and `CellTextOptions.currency` the table's; **`columnCurrency`** answers which. **`formatMoney(value, { currency,
+  decimals = 2, locale, empty })`** writes the same anywhere else (a dashboard's figures, a receipt): "Rs. 1,250.00".
+  `prefix` still works as before.
+- **An input shown by another input's value: `showWhen`** on any input (Form only): `{ name, in?, notIn?, filled? }`
+  or a list of them, every one holding (`InputCondition`). Values compare as text (1 matches "1"), a list value matches
+  `in` by any item. The form gives such an input a live `hidden` that reads its store and follows the inputs named as
+  `dependsOn` would; a hidden input keeps its value and is not checked; its own `hidden` still hides it. Pure helpers
+  `withInputConditions`, `inputShown`, `inputReadOnly`, `conditionsHold`, `conditionHolds`, `conditionsOf`, `isEmptyValue`.
+- **An input read-only by another input's value: `readOnlyWhen`** (Form only), the same `InputCondition`s: a live
+  `readOnly` that follows the inputs named, the input's own `readOnlyMessage` as the reason, its value kept in the data
+  and not checked while read-only; its own `readOnly` still locks it. A CRUD's Edit form holds the record's key and its
+  Add form does not, so `readOnlyWhen: { name: "id", filled: true }` is a field picked on Add and fixed on Edit (a
+  price's group).
+- **Options narrowed by a fixed value: `narrowedBy: { key, value, orUnset?, placeholder? }`** beside the
+  `{ name }` form (`InputNarrowing` is now `InputNarrowingByInput | InputNarrowingByValue`): the subscriber's own group,
+  known when the form opens; nothing followed, nothing cleared, a `null` value offers nothing. **`orUnset`** (both forms)
+  also offers the options whose field is empty, a fee of every group: `DropdownPageRequest.narrow` carries it (and a
+  `null` value with it), and `crudPicker` honours it from its kept list. `isFixedNarrowing` tells the forms apart.
+- **The picture input and the gallery keep a keyboard's focus.** Their buttons no longer switch themselves off while a
+  change runs (`disabled` sent the focus to the page in every browser): they stay focusable, `aria-disabled`, their
+  press ignored (**`busyProps(busy, run)`**). When a change ends with the focused button gone - Remove and Edit with
+  the main picture, a star once its picture is the main one, a deleted file's buttons - the focus goes to the first
+  control left in its tile, else in the input (**`useFocusThroughChange(root, busy)`**, `nexus-shared/client`).
+
+Proved by `npm test` (24 suites; `test-input-conditions` new, 37; `test-input-narrowing` 61, `test-table` 439,
+`test-number-helpers` 125; the CSS contract), and nexus.template's `/demo/print-document` and `/demo/form`'s "Inputs
+shown by another input" (`print-document.cjs`, 52: the money cells, the receipt, its widths and `@page`, printed alone
+and black on white, a page without one printed whole, `showWhen` and the fixed narrowing, every theme light and dark at
+1280x720 and 390x844 at AA) and `pictures.cjs` (87: Remove, the star and Delete from the keyboard keep the focus).
+
+### A server's page in a sandboxed frame; code text in a text area
+
+Card R2-comp (2026-11-05), for the Report module's Print layouts page: its preview and print door answer a whole HTML
+page (`{ html }`, with its own `@page` sheet, screen style and a CSP that runs no script), and its editor holds a
+layout's HTML. Additions only.
+
+- **`DocumentFrame`** (`nexus-shared/client`): the page in an `<iframe srcdoc>`, sandboxed `""` (an opaque origin) or,
+  with `printable`, `"allow-same-origin allow-modals"`, so the handle's **`print()`** (`DocumentFrameHandle`) opens the
+  print dialog for the page alone; never `allow-scripts`. Props (`DocumentFrameProps`): `html`, `title` (required; the
+  frame's name to a screen reader), `loading` (the page area `aria-busy` at once; a read that lasts 0.4s dims the page
+  and says `loadingMessage`, default "Loading…"), `error` (a `role="alert"` line over the last page, which stays),
+  `emptyMessage` (default "Nothing to show yet."), `actions` (buttons at the end of the frame's bar - the form's bar and
+  status line, shown only with actions or a status - which wrap under the line on a phone), `printable`, `className`,
+  `style`, `ref`. It fills the height its container gives (a flex column, a grid row) and is never under 22rem; the page
+  scrolls inside it, an A4 sheet sideways too. While loading or failed, an `html` of null keeps the last page; a
+  printable page read again keeps its scroll while the title stays. A frame that becomes printable is a new frame (a
+  sandbox counts from the next page). Styles in `Nexus.Print.css` (`nx-document-frame`, `__bar`, `__view`,
+  `__view--busy`, `__page`, `__empty`).
+- **`TextArea` `code`** (and `code: true` in a TextArea's `InputParams`): the monospace token, lines kept as typed
+  (`wrap="off"`, a long line scrolled sideways in the box), `tab-size: 2`, and `spellCheck`, `autoCapitalize`,
+  `autoCorrect`, `autoComplete` off and `translate="no"`; Tab still leaves the box. `nx-field__control--code` in
+  `Nexus.Input.css`; read-only and disabled code keep the look.
+- `.nx-form-status` takes its room beside a bar's buttons from `--nx-form-status-basis` (default 14rem, as before), so
+  the frame's bar, whose words are few, keeps two buttons beside its line in a half-width frame (10rem).
+- A CRUD's details footer and the frame share one rule for a slow read (said after 0.4s, held 0.3s): `useSlowBusy`,
+  internal, moved out of `Crud.tsx`.
+
+Proved by `npm test` (25 suites; the CSS contract) and nexus.template's `/demo/document-frame`
+(`document-frame.cjs`, 68 and 69 with reduced motion: the sandboxes, srcdoc, the empty, slow and failed states, the
+bar's buttons by keyboard, Print firing the frame's `beforeprint` and `false` without a page or when not printable, the
+scroll kept, a script that never runs printable or sealed, the code text area, every theme light and dark at 1280x720
+and 375x812 with no overflow and the status lines at AA), with `crud.cjs` and `crud-workspace.cjs` for the footer.
+
+### A field at the top of a CRUD popup's column keeps its label and focus ring whole
+
+Card R2-fix-label (2026-11-05), the owner's "overflow hidden bug": in a subscriber's window, the outlined "New note" box
+first in the notes beside the details showed only the lower half of its raised label, and its focus outline was cut at
+the top and at the panel's right edge. No export changed.
+
+- **`.nx-crud-aside__main` and `.nx-crud-aside__side`** (side by side, from 1000px) each scroll on their own, and a
+  scroll box clips at its padding edge, so a field first in either lost what it draws past its box. Both now keep room
+  inside their edges, paid back by a negative margin so nothing moves: above, an outlined field's raised label (0.6em
+  of the xs text) and its 2px outline; on every side, the 3px focus ring. The form's column had only 2px (rings), now
+  the same room; the panel's column had none.
+- **`scroll-padding`** on those columns, `.nx-crud-workspace__panel` and **`.nx-popup__body`**: focus scrolls a field's
+  control to the box's edge, and the raised label above it, or the box's border and ring below it, were cut there by 4
+  to 7.2px. The room past the control is now kept the same way in every popup.
+- Proved by nexus.template's `/demo/crud` "A guest's workspace", which now has the guest's notes beside the details (a
+  form first) and the guest's card beside the Add and Edit forms, and `scripts/browser-checks/crud-field-room.cjs`.
+  It measures the label and the outline's and shadows' reach against every box that clips them, focused with text,
+  in the standard, outlined and inbox designs and the sm, md and lg sizes, light and dark, at 1280x720, 1040x720 and
+  390x844, and at each scroll edge. 306 pass. On the old CSS 108 failed: every case in a column side by side. With
+  `scroll-padding` off, 20 failed: the edge cases.
+
+### A short list read whole; paging in the footer only
+
+Card C-table-whole (2026-11-05), the owner on a subscriber's notes: *"footer have gap top side have gap ... used only
+footer for this types of datatable"*, *"or do not put limit here"* (a subscriber keeps at most 50 notes). Additions only:
+a table without the new prop draws as before.
+
+- **`DataTable` `pager`** (`TablePagerMode`: `"bar"` | `"footer"` | `"none"`, default `"bar"`), where the paging lives:
+  - `"bar"`: rows per page inside the search box (or the bar without a search), the pager in the footer - as before.
+  - `"footer"`: rows per page beside the pager, in the footer; a table with nothing else on top draws no bar.
+  - `"none"`: every row on one page, for a short list read whole: no pager, no rows per page, no remembered or
+    preferred page size, and no footer unless a search or the filters leave rows out ("Showing 1–2 of 2 · filtered from
+    6"). The count line stays as a visually hidden live line, so a screen reader still hears it. With
+    `searchable={false}`, `columnsMenu={false}`, `exportable={false}` and `printable={false}` the table is its rows
+    alone in its frame (the bar already hid itself when it held nothing; the empty footer band was what was left). A
+    server's pages cannot all be shown, so `paging="server"` takes `"none"` as `"footer"`.
+- **`Crud`** passes it through `table: { pager }` (`CrudTableOptions`).
+- Proved by nexus.template's `/demo/data-table` "A short list read whole" (`data-table-pager.cjs`, 52 in each motion
+  mode: the whole table with 3, 14 and no notes, the footer's own rows per page and pager, a whole table's search, the
+  default unchanged, every theme light and dark at 1280x720 and 390x844 with no overflow), with `data-table.cjs` and
+  `crud.cjs`.
+
+### A record's workspace draws its panel under the details
+
+Card C-workspace-below (2026-11-05), the owner on a subscriber's window: *"make width full 100% for right side
+content. the details page make full width 100% then bellow show others informations"*. No export changed; one option
+was added to an exported type.
+
+- **`CrudDetailsOptions.asidePlace`**: `"beside"` | `"below"`. `"below"` draws `details.aside` under the fields at
+  every width: the fields across the whole width of the tab, the panel across the whole width under them, as tall as
+  it needs, scrolled with them by the workspace's panel (or the popup's body) - never a column of its own, so no box of
+  its own clips a raised label or a focus ring. `"beside"` is the layout as it was: side by side from 1000px, stacked
+  under that.
+- **The default changed for a record's workspace** (`tabs` or `profile`): `"below"`, so its Details tab reads as the
+  record first, then what belongs to it. Only the Subscribers page passes a workspace aside today; a plain details
+  popup keeps `"beside"`.
+- `nx-crud-aside--below` in `Nexus.Crud.css`; the side-by-side rules now name `:not(.nx-crud-aside--below)`.
+- Proved by nexus.template's `/demo/crud` "A guest's workspace" (a switch: notes under the details / beside them) and
+  `crud-aside-below.cjs` (82 per motion mode: widths, order, no scroll of its own, the note field's label and ring, at
+  1280x720, 1040x720 and 390x844, light and dark); `crud-field-room.cjs` now picks "beside" for the columns it
+  measures; `crud-workspace.cjs` and `crud.cjs` unchanged.
+
+### A choice drawn as tabs
+
+Card C-choice-tabs (2026-11-05), the owner on the counter's "What is it?" (Payment, Activate, Disconnect, each with a
+sentence under it): *"if we make it tab types of design maybe it batter. (nav style) the helper label should be tool tips
+or somethings"*. Additions only.
+
+- **`RadioGroup` `design: "tabs"`** (`RadioGroupDesign` = `ChoiceDesign | "tabs"`, in `nexus-shared/client`; a
+  RadioGroup's `InputParams` take it too): the options as nav-style tabs on one `TabButtons` track, still native
+  radios in a fieldset with `role="radiogroup"` - the arrow keys move the choice, `required` and `validate` stop a
+  form's save with the group's message (the track edged in the danger colour), `readOnly` keeps the value with its
+  lock and note, `disabled` dims every tab, `size` sm/md/lg is the track's. The tabs wrap onto more rows where they do
+  not fit (a phone). `orientation` and `columns` do not apply.
+- **Each option's `description`** is its tooltip (`title`, when it is text) and its input's accessible description
+  (`aria-describedby` to its note, which a screen reader reads even while hidden). The chosen option's note shows
+  under the track, since a phone has no tooltip; it follows every change and a form's reset (`showChosenNote`, the
+  group's `sync` rule), with no React state.
+- **`Nexus.Tab.Buttons.css`**: the rules that raise each chosen option on its own (`multiple`) are shared by
+  `nx-tabs--wrap` (`:is(.nx-tabs--multiple, .nx-tabs--wrap)`, the same specificity), since a radio group's choice lives
+  in its inputs, not in a value a sliding indicator could follow; only `multiple` keeps the pointer on a chosen option.
+  `Nexus.Choice.css`: `nx-choices--tabs` (the danger edge) and `nx-choices__note`.
+- The read-only note finds a tab as it finds a choice (`optionAnchor`: `.nx-choice, .nx-tabs__option`).
+- Proved by nexus.template's `/demo/form` "A choice drawn as tabs" (`choice-tabs.cjs`, both motion modes: the track,
+  the tooltips and descriptions, required, a click and the arrow keys, read-only, disabled, the values sent, a reset,
+  every theme light and dark at 1280x720 and 390x844 with the labels and the note at AA), with `forms.cjs` and
+  `read-only.cjs`.
+
+### An input that remembers its last value, or opens on the company's default
+
+Card C-input-memory (2026-11-05), the owner on the counter's Paid by and Bill: *"we should be remember the input value.
+we also need company level preference to select default, if default not config then we need remember"*. Additions only.
+
+- **`InputLayoutParams.remember`** (`InputRemember`: `key`, `viewer`, `preferred`; Form only, any input type). When
+  the values the form opens with leave the input without one (they do not name it, or hold it empty - a new record), it
+  opens on `preferred` (the company's default, from a setting the page reads), else on the person's last saved choice,
+  else on its own `defaultValue`; `preferred` and the kept choice each only while the input still offers them (a
+  choice group's or a dropdown's own `options`: not disabled, not inactive, still listed; a list keeps what is
+  offered; a server's list is asked since [card C-input-memory-offered](#a-remembered-choice-from-a-servers-list-kept-per-group-on-add-only-and-in-rows)).
+  A value no longer offered is dropped without a word, never drawn as a broken one. It is the value the form opened with, not a change: no "Unsaved changes", no "Discard?".
+- **Kept when a form saves** (`SubmitForm`, so `ApiForm` and a CRUD's forms too), in local storage under
+  `nx-input:{key}:{viewer}` as `{ value }`; an empty value forgets. A form reset after the save (`resetOnSuccess`)
+  opens on the new choice. No `viewer`: nothing read or kept (`preferred` still applies). A hidden input keeps nothing.
+- **No hydration difference:** the storage is read once the form is in the browser (a layout effect, before the first
+  paint), so a form drawn by a server opens the same there and while it hydrates; `preferred` needs no storage and
+  applies from the first draw. A later load (a CRUD's record) opens remembered inputs again from what it was given.
+- `FormStore` gains `attachMemory(storage)` and `rememberSaved(values)` (both `@internal`); the rules are pure in
+  `Helpers/InputMemory.ts` (`scripts/test-input-memory.mts`, 46 checks).
+- **Fixed (card C-input-memory-fix):** an input with `showWhen` whose other input gets its value in the same load (its
+  `defaultValue`, the record's) opened empty - without its own `defaultValue` and without its remembered value -
+  because the form judged it hidden on the store's values from before the load. A load, a reset and a draft's restore
+  now judge `showWhen` on the values they open with (the store's `get` answers from them while they are worked out); a
+  hidden input still keeps only what the data gave it.
+- Proved by nexus.template's `/demo/form` "Remembered choices" (`input-memory.cjs`, both motion modes: empty with
+  nothing kept, a save keeps and the reset opens on it with nothing unsaved, a new form, the company's default winning,
+  a disabled and a gone value dropped with no broken tag, a server-drawn page with no hydration error, Forget, light
+  and dark at 1280x720 and 390x844), with `forms.cjs`.
+
+### A label that follows another input
+
+Card C-label-follows (2026-11-05), the owner on a company's registration number: *"label should dynamic if possible like
+if user choosed pan then pan number if vat then vat number if it possible our component allow minimal code logic"*.
+Additions only.
+
+- **`InputLayoutParams.labelWhen`** (`InputLabelWhen`: `name`, `labels`, `otherwise`, `placeholders`; Form only):
+  the input's label is `labels[value]` for the other input's value as it is now (compared as text, so `1` matches
+  `"1"`), else `otherwise`, else its own `label`; its placeholder is `placeholders[value]` where listed, else its own.
+  Its messages name it by the label shown ("VAT number is required.") unless it has a `fieldName`.
+- Built on the `showWhen` machinery: `withInputConditions` gives such an input a live `label` (and `placeholder`)
+  getter and joins the other input's name into `dependsOn`, so the field draws again when it changes - no remount,
+  what was typed and the focus stay. `textFor` and `labelFor` are the pure rules (`test-input-conditions.mts`, 52 to 59).
+- Proved by nexus.template's `/demo/form` "A label that follows another input" (`label-when.cjs`, both motion modes).
+
+### A preview the server works out as the person types
+
+Card C-server-preview (2026-11-05): nexus.web's counter form and the Print layouts editor each wrote by hand "ask the
+server a moment after the last change, drop the older question, keep the last answer while a new one runs". Additions
+only; nexus.web is not changed here.
+
+- **`useServerPreview(ask, { delay, failure })`** (`nexus-shared/client`): `request(question)` asks `ask(question,
+  signal)` `delay` ms (default 300) after the last request; an older question is aborted (its signal) and a late
+  answer of it is never shown; `result` and the `question` it answers stay while a newer one waits or runs and after
+  one fails; `waiting` during the pause, `loading` while it is with the server; `error` is the thrown error's message (an abort is no failure; `failure`
+  is the words when it has none); `cancel()` drops what waits or runs, `clear()` the answer too; leaving the page
+  stops what runs; `request`, `cancel` and `clear` are the same functions on every draw.
+- **`ServerPreviewStore`**: the same outside React (`getState`, `subscribe`), and the types `ServerPreview`,
+  `ServerPreviewState`, `ServerPreviewAsk`, `ServerPreviewOptions`.
+- Proved by `scripts/test-server-preview.mts` (17: a burst asks once, waiting then loading, an older answer dropped, the last answer kept
+  through a newer question and a failure, cancel, clear, the latest ask) and nexus.template's `/demo/document-frame`
+  layout editor, which now reads its preview through the hook (`document-frame.cjs`, both motion modes, unchanged).
+
+### A printable document's logo
+
+Card C-print-logo (2026-11-05), for the receipt: the company's bill logo at its head. Additions only.
+
+- **`PrintDocument` `logo`** (`PrintLogo` `{ src, alt }`, or any node) and **`logoOnThermal`** (default true). On A5 the
+  logo sits beside the title lines in a 24 mm column (at most 16 mm tall) with a column as wide after the lines, so they
+  stay centred on the paper and the head grows no taller than they are: a one-page receipt stays one page. On an 80 mm
+  roll, and on an A5 document shown narrower than 100 mm (a phone; `.nx-print` is now the `nx-print` container), it
+  sits small and centred above them (at most 36 x 10 mm on the roll); `logoOnThermal={false}` leaves it off a roll.
+  Printed in black and white (`filter: grayscale(1)`). An `{ src }` image is decoded at once (not lazy); it must
+  have loaded before `window.print()`.
+- `Nexus.Print.css`: `nx-print__head--logo`, `nx-print__logo`, `nx-print__heading`. Without a logo the head's markup
+  is as it was.
+- Proved by nexus.template's `/demo/print-document` (a colour logo, switches for it and for the roll) and
+  `print-document.cjs`: beside the title on A5 within 24 x 16 mm, the title centred, the head no taller than its lines;
+  centred above on the roll within 36 x 10 mm; off with `logoOnThermal`; grey in print; the longest receipt, voided,
+  printed alone to PDF: one A5 page (420 pt) and one roll page (227 pt).
+
+### A page's own switch in the table's bar keeps its label on one line
+
+Card C-bar-noshrink (2026-11-06), from nexus.web's Branch users: a `Switch` beside Add ("All branches") broke its label
+between its words at every width, and a non-breaking space made it run into the lists instead. The cause was the Add
+itself: it is a `block` button, `width: 100%` of the Add section, so on a shared line it claimed the section and the
+page's own items shrank (a switch's field may shrink to nothing; a button stopped at its label).
+
+- `Nexus.Table.css`: every item of `.nx-table__bar-add` keeps its width (`flex: none`, `min-width: fit-content`), and
+  the Add beside other parts is as wide as its label (`width: auto`), so a bar that does not fit takes its next step
+  (search, Reload into ⋮, the Add section's own line). On that line the items still share it (`flex: 1 1 0`) and one
+  that would not fit its share wraps whole onto a line of its own. No markup or prop changed.
+- Proved by nexus.template's `/demo/data-table` section "The page's own controls in the bar" (a Switch and a Button in
+  `actions`, lists in `toolbar`) and `/demo/crud`'s amenities ("Reset demo") in `data-table-bar.cjs`: at table widths
+  1000, 899, 680, 660, 380, 370, 330, 320 and 300, with the switch and the button, each alone, and the CRUD's button,
+  in seven themes light and dark, compact and cozy: no label broken or cut, no two controls overlapping, nothing
+  outside the bar, one line from 670px (compact), the search alone under 670, Reload in ⋮ under 375, the Add section
+  last under 325.
+
+### A list that can be widened to other endpoints
+
+Card C-crud-scope (2026-11-06), from nexus.web's Branch users: the branch signed in at (`BranchUser`) and, for a person
+who may, every branch (`AllBranchUser`), picked by a switch in the toolbar and remembered per person - written by hand
+with a remounted `Crud`, a page-level hook for the storage and two copies of its columns and inputs. Additions only.
+
+- **`Crud` `scopes`** (`CrudScopes`: `options`, `label`, `description`, `remember: { key, viewer }`,
+  `onChange`): other lists in place of the CRUD's own, each a **`CrudScope`** (`id`, `label`, `description`, `api`,
+  `when`, and where they differ `columns`, `inputs`, `form`, `table`, `aria-label`; `form` and `table` over the
+  CRUD's, field by field). One scope is a `Switch` after Add (`description` its tooltip); two or more are tabs, the
+  CRUD's own list first. A scope is offered to a person who may call one of its lists and passes `when`, again on every
+  change of their rights; a kept scope not offered opens the CRUD's own list and stays kept.
+- **Switching keeps the CRUD**: the new list is read on its endpoints (`loadKey` names the scope), the switch keeps
+  the focus, popups stay open. Each scope keeps its own cache of lists while the page is open, so switching back costs
+  no request; a change made on one scope drops the other scopes' lists (the server alone knows which hold the record).
+  An answer asked on one scope and landing after a switch (a row action, a mark, a mass action, a form's save, a
+  details refresh) writes nothing into the list on screen: every kept list is dropped and the one on screen read again,
+  quietly, and `onChange` still hears of it.
+- **Each scope keeps its own table settings**: its `table.stateKey`, else the CRUD's and `:{id}`. **`DataTable`
+  reads a changed `stateKey`** as the first draw does (page size, sort, hidden columns with each column's own
+  default, order, widths, pins, open sections) and never writes the settings on screen under the new key;
+  `TableStore.restore(saved, { notify: true })` restores over a table already shown.
+- **`remember`** keeps the choice in this browser (`nx-crud-scope:{key}:{viewer}`, the CRUD's own list as nothing,
+  storage in try/catch), read after the first draw and before any list is asked for: a reload asks for one list.
+- **`CrudHandle.scope`** and **`setScope(id | null)`**.
+- **A `CheckBox`'s or `Switch`'s `title`** is now its whole row's tooltip (its label too), still on the input.
+- New exports: `CrudScope`, `CrudScopes`, `offeredCrudScopes`, `shownCrudScope`, `crudScopeProps`,
+  `crudScopeStateKey`, `crudScopeStorageKey`, `readCrudScope`, `writeCrudScope` (`nexus-shared`);
+  `useCrudScopes`, `CrudScopeControl`, `CrudScopeState` (`nexus-shared/client`).
+- Proved by `scripts/test-crud-scopes.mts` (32) and nexus.template's `/demo/crud` section "One desk, or every desk"
+  (posts through `DeskStaffPost` and, for the Admin role, every desk's through `StaffPost`; the demo backend's
+  narrower controllers are views of the same records) in `crud-scopes.cjs`.
+- **Review fixes** (card C-scope-fix, review round 4):
+  - **Opening on a remembered scope no longer wipes the CRUD's own list's table settings.** `DataTable` saves what its
+    store holds, never the draw's settings: the first draw, which still held the opening defaults, wrote them under the
+    own list's key when the kept scope was read, and its sort and hidden columns were gone on the way back.
+  - **A form stays in the scope it was opened on**: an Edit pressed in a details popup after a switch is the details'
+    scope's form - its `inputs`, `form` and endpoints - and its save is that scope's answer (it went to the scope shown,
+    with the other scope's fields).
+  - **Each scope keeps its own Add**, and so its draft (the popup's name is `{name}@{scope}`): a minimized Add of one
+    list never comes back on another. An Edit keeps one popup per record wherever it is opened.
+  - **An answer that lands after a switch** still marks the lookups of the scope it was asked on and of the one shown as
+    old (`expireLookups`: a picker's or a join's next read asks again) and drops every tree's kept pages, as an answer on
+    screen writes them.
+  - Proved by `crud-scopes.cjs` section K, each line failing on the code before: the own list's sort and hidden
+    Department kept through a client navigation that opens on the kept scope; a Spa post's Edit from details restored
+    after a switch is every desk's form and saves to `StaffPost/Update`; the own Add's draft stays the own list's; the
+    demo's "Find a post" box (every desk's `StaffPost/ActiveListing`, its pages dropped on every change of the CRUD)
+    asks its list again after an answer for every desk lands on the front desk's list.
+
+### Pinned columns give way on a narrow table
+
+Card C-pin-narrow (2026-11-06, with C-scope-fix), from nexus.web's Branches at 390 px: Name and Picture pinned left took
+284 of the table's 354 px, leaving 70 for every other column. Additions only, and no page passes anything.
+
+- **The columns that stay - the numbers and checkbox column and the actions, which always stay, and the pinned ones -
+  take at most 60% of the table's width on screen** (`PINNED_SHARE`). Pins are kept from the outer edge in; a pinned
+  column that would pass that share, and every one inside it on the same side, scrolls with the others until the table
+  is wide enough again. Measured after every draw and whenever the table's width changes; staying or scrolling changes
+  no width, so it settles at once.
+- A column that gives way keeps its side: it is drawn there, moves among its side's columns, and its menu still offers
+  Unpin. **`TableViewColumn.side`** (new) is the side chosen; **`pin`** is the side it stays on now (null while it
+  scrolls, so its cells carry no `data-pin`). Headings carry `data-pin-side`, which the drag's drop targets follow.
+- New exports (`nexus-shared`): `PINNED_SHARE`, `releasedPins(view, frame, left, right, share?)`.
+- Proved by `scripts/test-table.mts` (the rule, and `viewColumns` with released columns) and nexus.template's
+  `data-table.cjs` at 390 px with Booking and Guest pinned: the columns that stay keep to 60% of the table, the outer
+  ones stay with their cells and the others scroll, both keep their side, and at 1280 both stay.
+
+### A row action that opens a form of its own for the record
+
+Card C-row-form (2026-11-06), from nexus.web's Permissions row action (`usePermissionSetActions`, written by hand: a
+popup with an `ApiForm` reading the set, saving it elsewhere, then `apply` of the row's count). Additions only.
+
+- **`Crud` `rowForms`**, each a **`CrudRowForm`**: `id`, `label`, `description`, `icon`, `inline`, `modes`
+  (default the lists that offer Edit), `when(row, mode)`, `lock(row)` (listed switched off with its sentence), `target(row)`
+  (the `{id}` the endpoints are called with), `inputs` (params, or a function of the record and of what `load` read;
+  it may answer a promise), `load` (an endpoint or a function), `submit`, `transform(values, row, loaded)`, `writes`
+  (the answer's fields by name, or a function), `title`, `size`, `submitLabel`, `onSaved(result, row, values)`.
+  Offered after the built-in actions and before `rowActions`, to a person who may call `submit` and an endpoint
+  `load`; one popup per record and form (`reopen: "restore"`), a discard question before changes are lost.
+- **A read that fails never leaves a savable form**: the API client answers `ok: false` rather than throwing, so a
+  failed answer (and one with no record, and a function's `null`) is turned into `ApiForm`'s failed state - "Could not
+  load the values" with Retry - and the footer's Save is gone until a read succeeds. (A permission set read that failed
+  opened empty, and its Save wiped the set.)
+- **The write-back is only what the answer names**: `writes` fields merged over the record as the CRUD holds it when the
+  answer lands (the table, else a kept list, else a pinned section), never the record as the action was clicked, so an
+  Edit saved while the popup was minimized stays. Written through the cache sync (`applyRows` with the held record),
+  so every list kept and the pinned sections follow with no list read; an answer after a scope switch writes nothing.
+- **`CrudHandle.openRowForm(id, row)`**. New exports: `CrudRowForm`, `crudRowFormOffered`, `crudRowFormWrites`
+  (`nexus-shared`); `openCrudRowForm`, `CrudRowFormRequest` (`nexus-shared/client`).
+- Proved by `scripts/test-crud-row-forms.mts` (24) and nexus.template's `/demo/crud` posts, whose Duties (PostDuty's
+  Detail and Update in the demo backend, a count joined into each post) are a row form, in `crud-row-form.cjs`.
+
+### A held menu item says why when it is pressed
+
+Card C-held-action-note (2026-11-06), from a review of nexus.accounts' dashboard: a row action switched off with its
+reason (`rowLock`, `rowActionLock`, a row form's `lock`) showed that reason only as its menu line, and a press did
+nothing, where the table's held Add says why under it. Behaviour of `Menu`, `ContextMenu` and `SplitButton`'s list; no
+export is new.
+
+- **`MenuPanel`**: an item `disabled` with a `description` is held (`data-held`). A press - a click, Enter, Space -
+  shows the description in the note a read-only field and a held Add show (`useReadOnlyNotice`, `.nx-field-notice`,
+  `role="status"`), under the item; the menu stays open, nothing is chosen, and the note goes when the menu closes. The
+  arrow keys and the pointer reach a held item (`ENABLED_ITEM` takes `[data-held]`), so the keyboard can press it;
+  a disabled item without a description is skipped as before.
+- Proved by nexus.template's `held-row-actions.cjs` on `/demo/crud`: Wi-Fi's held Move to trash (`rowActionLock`) and
+  a not-yet-joined person's held Duties (a row form's `lock`) say their menu line's words when clicked and on Enter
+  after the arrow keys reach them, with the menu open and no request sent; Esc closes both; `/demo/menus`' Print
+  (switched off with no reason) is still skipped; the note inside the window and its words at 4.5:1 or more in seven
+  themes, light and dark, at 1280 and 390.
+
+### A form with changes asks before a navigation inside the app
+
+Card C-leave-guard (2026-11-06), from a review of nexus.accounts' dashboard: its profile form lost its edits through the
+side menu, since only the page's close (`beforeunload`) asked. Additions only.
+
+- **The page's own forms**: a `SubmitForm` (and so an `ApiForm`) that asks before the page closes (`confirmLeave`, on
+  without a draft) also joins the tab's page guard (`PageLeaveGuard` in `FormLeaveGuard.ts`, beside the workspace's
+  guard), unless it is drawn in a `PopupHost` popup, which stays open through a navigation (`PopupHost` gives its
+  popups no page guard).
+- **Links**: while one of them has changes, a press on a same-origin link - next/link or a plain `<a>`, the side menu,
+  the brand, the trail, a menu's link row - is held in the capture phase on `window` (before any other handler) and
+  asks "Discard your changes?" (`confirmDiscard`'s words, as a workspace tab and a form popup ask); Keep editing stays,
+  Discard follows the link as it was pressed (the app's router for its links). A link to another tab, a download,
+  another site (the browser's close question asks there) or this page is left alone. Set up once, by the first such
+  form.
+- **`confirmPageLeave()`** (`nexus-shared/client`): the same question for a navigation the app makes itself
+  (`if (await confirmPageLeave()) router.push(href)`). A confirmed navigation is let go for a moment
+  (`PageLeaveGuard.allow`), so the form's `beforeunload` does not ask a second time after a plain link's Discard.
+- Proved by nexus.template's `leave-guard.cjs` on `/admin/settings`: the side menu, the brand, the trail, Back to the
+  site, the account menu's link and the module menu each ask and Keep editing keeps what was typed; Discard goes (by the
+  router, and by the address for a plain link with no browser question); a form without changes, and one just saved,
+  goes with no question; a minimized Add with changes (a `PopupHost` popup) holds nothing and is still on the dock; a
+  reload with changes still gets the browser's question.
+- **Review fixes** (card C-leave-fix, review round 4):
+  - **A popup's form keeps the browser's close question**: a confirmed Discard of the page's form let the next moment's
+    full-page load go with no question for every form, so a minimized Add with changes was lost without a word. Only the
+    page's own forms are let go now.
+  - **The page already in view asks nothing**: a module or account menu row for it lost nothing and still asked.
+    **`keepsPage(href, target?, download?)`** (new, `nexus-shared/client`) is the one test, for links and for the
+    rows nexus-admin moves by `router.push`.
+  - **A link inside text being edited** (the rich-text editor's) is not a navigation: a click there places the caret,
+    and nothing is asked.
+  - **`confirmPageLeave({ unload: true })`**, for a move that loads a whole page (a sign-out, `location.assign`): asks
+    about every form with changes, the popups' too, since the load takes them all; once confirmed, neither it nor the
+    browser's close question asks again until the page goes (`pagehide`), however long the call before the move takes.
+    **`endPageLeave()`** (new) gives the questions back when the move did not happen.
+  - Proved by `leave-guard.cjs` section F: the module row for the page in view and a link in the House rules editor ask
+    nothing and keep the typing; a page Discard followed by a full load still gets the browser's question for a
+    minimized Add with changes; Sign out (slowed by 2.5 s) asks about a minimized Add first, Keep editing sends nothing,
+    Discard signs out with no second question.
+
+### Every picture through the editor, and within Drive's limits
+
+Card IMG-comp (2026-11-06), the owner: *"any image editor should be open the editor then it upload ... first compress
+then save ... ~300KB max but put it into config ... max resolutions, max quality (%) in config for drive."* A picture
+of about 3 MB was stored: the gallery's Upload never opened the editor, a PNG stayed a PNG at up to 2048 px, a
+remembered quality could be 100, and nothing kept a byte budget. Drive's side is card IMG-api
+(`drive-picture-limits-contract.md`): its host settings `Nexus:Drive:Pictures` (MaxSide 1920, Quality 80, MaxKilobytes
+300), answered by `File/List` and enforced on every upload.
+
+- **`FileCategoryInfo`** gains `pictureMaxSide` (px), `pictureQuality` (%) and `pictureMaxBytes`, optional, read by
+  `NexusDriveAdapter` from `File/List` with the defaults when an older Drive answers none (so every picture is still
+  made small). **`PICTURE_LIMITS`** (`{ maxSide: 1920, quality: 80, maxBytes: 307200 }`) and **`pictureLimits(category)`**
+  (the category's, else the defaults; the bytes never above its `maxBytes`) are new. `MAX_PICTURE_SIDE` is now the
+  default 1920 (it was 2048) and nothing in the package reads it.
+- **Every picture through the editor** (`useOwnerFiles`): the gallery's Upload - every picture column, the top bar's own
+  picture, a record's workspace, the accounts dashboard - opens the editor for each picture in turn ("Picture 2 of 5 ·
+  {title}"); Cancel skips that one and, with more to come, asks "Go on with the next file?" (Next file, Stop here). It
+  keeps the chosen file's name with the kind written. Documents (a PDF) are sent as they are. `renderImage` is no longer
+  called by the package.
+- **Within the limits**: the editor gets the long edge at most `pictureMaxSide` (less when the params say), `maxQuality`
+  `pictureQuality` / 100 and `maxBytes` `pictureMaxBytes` (`ImageEditorOptions` and `renderImage`'s options take both;
+  `ImageEditorResult.fitted` says what the budget took, see nexus-image-editor's CHANGELOG). The toast after a save
+  says when a picture was made smaller.
+- **`fileRefusal`** checks a picture against `pictureLimits(category).maxBytes` and a document against `maxBytes`; the
+  gallery's line says "up to 300 KB each", or "pictures up to 300 KB, documents up to 10 MB" where both are taken.
+- Proved by `scripts/test-files.mts` (84) and nexus.template, whose pretend Drive answers and enforces the three
+  (`Demo/PictureLimits` raises them for the checks): `picture-limits.cjs` (a 4.2 MB photo stored at about 175 KB with the
+  Save panel's real size and its note, the slider's top 80 and a remembered 95 starting at 80, a see-through PNG stored
+  as a WebP that keeps its see-through parts, an opaque PNG as a JPEG, three pictures each through the editor with a
+  Cancel and Next file, Stop here, DRV_X059 for a client that skips the editor, raised settings letting a 1.8 MB
+  picture through) and `pictures.cjs` (the gallery's three uploads each through the editor, the page's square shape).
+- **Review fixes** (card IMG-comp-fix, review round 4):
+  - **Only into a kind the category takes**: the editor gets the category's picture kinds (`ImageEditorOptions.types`,
+    from `pictureOptions`). Its Save panel offers only those, a picture opens on one of them, and a PNG over the size is
+    made a JPEG or a WebP only where that kind is taken - where neither is, it stays a PNG and is made smaller. A
+    see-through PNG for a category of JPEG and PNG was written as a WebP and then refused.
+  - **A picture the browser could not type** (no type, or `application/octet-stream`: a phone's share, a name with no
+    extension) is typed from its first bytes and goes through the editor, where it was sent as it was:
+    **`sniffPictureType(blob)`** (JPEG, PNG or WebP, else null) and **`typedFile(file)`** (new, `nexus-shared`). Any other
+    untyped file is still the backend's to judge.
+  - **An editor that cannot be downloaded says so where it was asked for**: the picture input's line under its buttons
+    and the gallery's alert say the loader's words ("The image editor is not installed on this server yet." for Drive's
+    DRV_X053) until a try opens it, besides the toast; the button stays ready, and pressing it again tries again.
+    `useOwnerFiles` answers `editorProblem`.
+  - Proved by `test-files.mts` (88) and `picture-limits.cjs` section G: the ID photo's category (JPEG and PNG) offers
+    those two in Save and stores a 3 MB see-through PNG as a PNG under 300 KB that is still see-through; a photo handed
+    over with no type opens the editor and is stored as "IMG_2041.jpg" under 300 KB; with Drive's editor missing the
+    input and the gallery say why, and once it is there the same button opens it and the line goes.
+
+### A record's page of cards, every change in a popup
+
+Card C-record-cards (2026-11-06), from the owner's request for nexus.accounts' profile: *"make card types block
+buetifull design ... when click editor then show popup and apply editor or add or something do not show direct save or
+update"*, and *"Emails / Phones / Addresses - those all put inside profile tab as card. put right side icons to verify if
+not. switch primary like this. single page, CURD from popup show add button, edit, remove like this. primary do not
+allow"*. Additions only.
+
+- **`RecordCards`** (`nexus-shared/client`): one record that is not a list - a person's profile, my company, a
+  subscriber's details - as a hero and cards, declared by params (`RecordCardsProps`): `sources` (each read once by GET
+  through the app's `api`, or a function; `{ read, held }` draws what is known before, such as the session's name),
+  `hero` (`picture` by Drive params - a click opens the pictures window - `title`, `lines`, `marks`, `actions`), `cards`,
+  `readOnly`, `signedOut` (the page's words, `onSignIn`, `onEnded`), `isSessionEnded`, `name`, `headingLevel`. **The page
+  itself never saves.**
+- Three cards, each with an `id` (its element id, so `#emails` leads to it), a `source`, `title`, `icon`, `description`,
+  heading `actions`, `hidden`, `wide`, `readOnly`:
+  - **fields** (`RecordFieldsCardParams`): label over value, each value drawn by the `InputParams` its Edit uses - a
+    choice by its label, a date in the person's format, a number with its format, Yes or No, a multiple choice or
+    `look: "chips"` as chips, long text on its own lines, Markdown and rich text as such, a password never, "Not said"
+    (`empty`) when empty; `show` draws one by the page. **`edit`**: a popup of the card's inputs on the record, its values
+    merged over the record as held now when sent, so an endpoint that takes the whole record works.
+  - **items** (`RecordItemsCardParams`): rows between hairlines (a picture or icon, the title, marks, lines) with **icon
+    actions on the right** (`RecordItemActionParams`), each named as a tooltip and to a screen reader with its item
+    ("Verify: ram@example.com"), hidden, or held with its reason - aria-disabled, the reason in its tooltip and said in
+    the note a held Add shows when pressed; **`add`** in the heading, held at the `limit` ("5 of 5" beside the title,
+    `limitReason`).
+  - **content** (`RecordContentCardParams`): `render(context)`, the page's own; `context.open(flow)` opens a popup.
+- **Every change is a popup** (`RecordFlowParams`): one step, or `steps` with `start` and `next` (a code sent, then
+  typed), each with its `lead`, `inputs`, `submit` (a URL, a request, an endpoint or a function), `transform`,
+  `submitLabel`/`submitTone`, `writes`, `also` (a button that calls and stays, held with a countdown while the server says
+  to wait: "Send again in 20s"), `done` (run another action: the code step after an Add, Make primary after a Verify),
+  `onError`, `render`, `confirmCancel`; one popup per card, action and item, brought back as it was; closing with changes
+  asks first. A form opens only on the plain values its inputs name, so a code box never opens on an item's `code`
+  record. **`confirm`** (`RecordConfirmParams`) asks, then calls.
+- **The card shows the answer at once**: `writes` (`RecordWrites`) - the answer merged over the data as held now (the
+  default), the values, one item replaced or added, the item removed, a read again, named fields, or a function - into
+  the source, so every card on it (the hero too) follows and nothing is read again.
+- **States**: loading draws every card as it will be, held (labels and bones as tall as their values, a held mark row,
+  Edit held with "Still being read."); a source that fails says why in each of its cards with Try again (the first says
+  it aloud); read-only draws no button; an answer that ended the session (default a 401 naming no input - a wrong
+  password names its box) closes the page's popups and leaves the page's words with Sign in again, which takes the
+  focus. The focus comes home when a popup's or a question's opener went with the change (the row's first button, else
+  the card's). A link to a card (`#emails`) is followed again once every source has answered, since the cards above it
+  grow as their records come.
+- **Layout**: the hero across, then as many cards to a row as have 26rem (one on a phone), each as tall as what it
+  holds; fields as many to a row as have 11rem. It sits in the admin page's scroller, so the window never scrolls.
+  `Nexus.Record.css`; the table's tag gets `nx-table__tag--plain` (no dot) for a chip.
+- New exports: `RecordCards` (`nexus-shared/client`); in `nexus-shared` the interfaces `RecordCardsProps`, `RecordRead`,
+  `RecordSourceParams`, `RecordWrites`, `RecordMark`, `RecordSubmit`, `RecordContext`, `RecordStepContext`,
+  `RecordStepAnswer`, `RecordCallParams`, `RecordStepParams`, `RecordFlowParams`, `RecordConfirmParams`,
+  `RecordCardActionParams`, `RecordItemActionParams`, `RecordCardBase`, `RecordFieldParams`, `RecordFieldsCardParams`,
+  `RecordItemView`, `RecordItemsCardParams`, `RecordContentCardParams`, `RecordCardParams`, `RecordHeroParams`,
+  `RecordSignedOutParams`; the typed helpers `fieldsCard`, `itemsCard`, `contentCard`; and the pure half
+  (Helpers/RecordCards.ts) `recordCardKind`, `recordField`, `recordFieldInputs`, `recordOpenedValues`, `recordFieldWide`,
+  `recordFieldHeld`, `recordValueView`, `RecordValueView`, `recordItems`, `recordItemKey`, `recordWithItems`,
+  `recordLimit`, `recordCount`, `recordLimitReason`, `recordWrite`, `RecordWriteRequest`, `RecordWriteOutcome`,
+  `recordActionState`, `recordActionEndpoint`, `RecordActionState`, `recordSteps`, `recordStartStep`, `recordStatusLine`,
+  `recordSessionEnded`, `secondsUntil`, `RecordSources`, `RecordSourceState`, `RecordReader`.
+- Proved by `scripts/test-record-cards.mts` (130) and nexus.template's `/admin/profile` (a pretend person's profile on
+  `src/app/api/demo-profile`, with a menu of demo states) in `record-cards.cjs`.
+
+### The pictures window in two panes, as 2026-06-20's
+
+Card C-gallery (2026-11-06), from the owner's look at the pictures window on nexus.accounts' profile: *"the over all
+design i do not like. when hover then show inside the image the absolute position. look like the second image. this
+image capture from: 06-20 version. when click profile icon then show popup like this."* No new exports, nothing removed;
+the look and where the buttons are changed, every behaviour stayed.
+
+- **`PictureGallery` / `openPictureGallery`**, for pictures: two panes with a hairline between them. On the left the
+  main picture large (about 15rem on its long side, a rounded square for every shape; the picture icon when there is no
+  main one), **Upload** (a solid primary button; Replace in a category that keeps one file) and **Remove** (no main
+  picture, the pictures kept; Delete in a one-file category) under it, then the count and kinds ("2 of 20 · PNG, JPEG or
+  WebP, up to 300 KB each"), a read-only reason and the editor-cannot-load note. On the right the pictures as a grid of
+  rounded squares (about 11rem, at least two a row), a round category's too - only an avatar stays round. The main one
+  has the accent ring and a **Main** mark in its top left corner.
+- **Each picture's buttons are inside it**, centred on a popover's panel: View, Make main and Delete (neither on the
+  main one: it is never deleted from its own picture, as in 2026-06-20's gallery - Remove it first, or make another the
+  main one) and Edit. They show on hover and on a keyboard's focus in the picture (`:has(:focus-visible)`, so a click
+  does not leave them shown), and always where nothing can hover (`@media (hover: none)`: a touch screen); hidden, they
+  stay in the Tab order and to a screen reader, each named as a tooltip and to a screen reader ("Make Sita.png the main
+  picture"). They fade in briefly, and not at all with animations off.
+- **Under 560px of its own width** (a phone, a narrow tab) the main picture is 7rem beside its buttons, over the grid.
+- **The window** (`openPictureGallery`) is `xl` and edge to edge for pictures, with a height of its own
+  (`min(36rem, 100dvh - 10rem)`, the whole window when maximized): only the grid scrolls. Documents stay a list in an
+  `lg` window; one opened without `view` changes to it once the category says it takes PDF.
+- **States**: loading draws the panes at their size, the main picture's place held and three held pictures where the
+  grid will be ("Loading the pictures…"); a gallery with none says "No pictures yet." with Upload on the left; read-only
+  owners (`readOnly`, `lockReason`, a refused write ticket) get no Upload, Remove, Make main, Edit or Delete. Upload
+  and Edit when the category is full are `aria-disabled` with the reason as their tooltip, and say it when pressed.
+- **`PictureInput`**: a click on its picture, or Enter, opens the same window, as All pictures does (read only where the
+  input is); its buttons stay. The picture is named by what it opens ("Picture: open the pictures"), never by the
+  file's name. Its buttons are a `role="group"`, and `useFocusThroughChange` keeps the focus in a tile, row or group, so
+  after a Delete the focus lands on Upload, not on the picture.
+- The data hook is `data-state="loading|ready|failed"` on `.nx-files`; the tile's `.nx-files__tile[data-primary]`,
+  `.nx-files__thumb` and the buttons' names are as before. `.nx-files__tile-bar` and `.nx-files__thumb--round` are gone.
+- Proved by nexus.template's `pictures.cjs` (its section K: the panes, the mark, hover, keyboard and touch, Remove,
+  loading, empty, read only, a 390 px phone, the picture input's picture) and `picture-limits.cjs`, both motion modes.
+
+### A popup has no minimize button unless it asks
+
+Card C-popup-minimize (2026-11-06), from the owner: *"every place do not put minimize popup buttons - for example the
+profile picture viewer, or something just full admin page + CURD this place put minimized option for only the edit and
+add"*. No new exports, nothing removed; **one default changed**, which an app sees without changing a line.
+
+- **`Popup` / `openPopup`'s `minimizable` defaults to false** (it was `closable`, so every closable popup had the
+  button). Maximize and close are as they were. A page may still ask: `minimizable` on a `Popup` or in `openPopup`'s
+  options, or a rule by key (`definePopupRules({ "booking-edit-*": { minimizable: true } })`).
+- **Only a CRUD page's forms ask**: a `Crud`'s Add and Edit (`openCrudForm`: from the list's Add, a row's Edit, a
+  tree's Add inside a row, and the details popup's Edit) and its row forms (`openCrudRowForm`, such as a record's
+  Permissions). They ask with `popupRuleFor(key)?.minimizable ?? true`, so a page's rule for their key can still take it
+  away. The dock, `reopen`, and the leave guard work for them as before: a minimized form with changes is still asked
+  about by a full-page move (`confirmPageLeave({ unload: true })`) and by the browser's `beforeunload`.
+- **Everything else has none**: the details popup and a record's workspace (its Edit opens the form that has one), the
+  mass Description, the audit history, the spreadsheet import and bulk insert, the pictures window and gallery
+  (`openPictureGallery`), a record's cards' popups (`RecordCards`, `openRecordFlow`), a `Chat`'s popup, message boxes
+  and confirms (which already said `minimizable: false`), and any popup a page opens without asking. The image
+  editor's window and the picture viewer are the editor module's own and never had one.
+- `handle.minimize()` from code still minimizes any popup opened with `openPopup`; the dock shows it as before.
+- Proved by nexus.template's `popup-windows.cjs` (a popup that asks has Minimize, Maximize, Close; one that does not -
+  from a page, from code, opening maximized - has Maximize and Close; the dock, the stack, the rules by key, a scrolled
+  body kept), `crud.cjs`, `crud-row-form.cjs`, `staff-posts.cjs`, `leave-guard.cjs` (the forms that minimize),
+  `crud-workspace.cjs` (the workspace has none; a record off the page shown is now opened from the pinned guests),
+  `crud-scopes.cjs` (the details have none; the Edit form they open is minimized across a switch), `excel.cjs`,
+  `pictures.cjs` and `record-cards.cjs` (none), both motion modes, and `test-popup-rules.mts` (the forms' rule).
+
+### A CRUD's narrowing box asks to be set
+
+Card C-narrow-required (2026-11-06), from the owner on nexus.web's subscribers: *"when open it focus on the group and
+high light the required tab which help user to it need to set"*. Every `Crud` `narrowPicker` changes; a page changes
+nothing. New: `Field` / `Dropdown` `invalid`, `DataTable` `add.onDisabledPress`, and in `CrudNarrowPick.ts`
+`findLoneNarrowPick`, `startNarrowPick` (`NarrowPickStart`) and `narrowBoxTakesCursor` (`NarrowCursorMoment`).
+`useCrudNarrowPicker` takes the list's words too (optional) and returns more parts (`CrudNarrowPickerParts`); `Crud`
+is its only caller in the packages.
+
+- **It settles before it asks.** As the page opens, the box shows a spinner and the list waits (no "Pick a group" that
+  flashes before a remembered pick opens) while the kept pick is looked up; a kept pick no longer offered is forgotten.
+- **A box that offers one record picks it by itself**, and keeps it as a person's pick is (`remember`), `onPick` told.
+  Offered as the box offers it: a record it never offers (a person still invited, an inactive one) does not count, and
+  its pages are read at the box's own size, only until a second record shows.
+- **With nothing picked it asks:** the box is required (`aria-required`) and drawn with a field's invalid edge and ring
+  (`invalid`: the look an error gives, with no message line in the toolbar), and a screen reader hears the list's
+  words with it (`aria-describedby`; the page's `emptyMessage` when given). It takes the cursor as the page opens,
+  without scrolling, unless the person has already pressed a key or a pointer there, focus is elsewhere, a popup or a
+  panel is open, the box is not wholly on screen (a CRUD further down a demo page), or the screen is touch-only (a
+  cursor would raise the on-screen keyboard over the list). A pick removes the mark; clearing it brings it back.
+- **The list points at it:** its empty message has a button with the box's placeholder ("↑ Pick a group") that sends
+  the cursor to the box and opens its list. A read-only list (no Add for this person) asks the same way.
+- **Add pressed with nothing picked** sends the cursor to the box and nudges it (the field's nudge, as a read-only lock's;
+  none with reduced motion), and the box's description becomes Add's reason (`addMessage`), so a screen reader hears
+  why it landed there; the note under Add no longer shows for it. Add still looks unavailable and keeps its tooltip.
+- **A failed read** of the box's records leaves it asking, the cursor in it; its own list says "Could not load the
+  options." with Retry when opened.
+- Proved by nexus.template's new **Admin › Posts** page (`/admin/posts`: one person's posts, the Person box in the CRUD's
+  toolbar; `?people=one` offers one person) and `crud-narrow-required.cjs` (settling, the mark, the cursor, Add from the
+  mouse and the keyboard, the list's button, a pick, remembered, forgotten, at work, a popup open, a failed read and
+  Retry, one person offered among invited ones, below the fold and the Viewer role on /demo/crud, 390 px with a mouse
+  and on a touch screen, the edge at 3:1 and the button at AA in all seven themes light and dark), both motion modes,
+  and `test-input-narrowing.mts` (the opening and the cursor rule).
+
+### A remembered choice from a server's list, kept per group, on Add only, and in rows
+
+Cards C-input-memory-offered (2026-11-06, committed unfinished) and C-input-memory-offered-finish (2026-11-07), from what
+nexus.web's Subscribers Add (card SUB-defaults) found in [`remember`](#an-input-that-remembers-its-last-value-or-opens-on-the-companys-default):
+a kept type, area or package since trashed opened tagged "Inactive", one moved to another group opened untagged and the
+save was refused, a contact's or a box's kind could not be remembered, and the page wrote "on Add only" and "per group"
+by hand. Additions only; no new export.
+
+- **A picker confirms a kept choice before it opens.** A dropdown whose options come from `loadOptions` (as `crudPicker`
+  gives) is asked by the value's key: at once from what the page holds (`peekOption`), else by `resolveOptions`, and for a
+  key that answers nothing (a picker that names only its kept list) or a record without its narrowing's field, through
+  its own pages narrowed as the form narrows them. Offered = found, not disabled, not inactive (`isOptionInactive`, else
+  `inactive`/`isActive: false`), and inside its `narrowedBy` narrowing; for a list of values, the part offered. A kept
+  choice not offered never opens and is forgotten; `preferred` gives way to the kept choice the same way. Before it was
+  "a server's list takes any value".
+- **While it is asked** the box shows its spinner (`Dropdown` `loading`, through the new `InputOverrides.loading`) and
+  opens nothing; the answer opens the value as the one the form opened with. It opens nothing over the person: a pick
+  (even one cleared again) or a value set from code ends the ask at once. A save, a reset and a later load stop it. An
+  answer given for a group (the `narrowedBy`, `per` or `when` inputs) the form no longer holds opens nothing. A picker
+  that cannot be read opens nothing and forgets nothing; it is asked again by the next form. A reset that finds the
+  kept choice gone, or still to be asked, takes back the value memory opened before instead of leaving it in.
+- **`remember.per`:** one value kept per value of another input, under `nx-input:{key}-{that value}:{viewer}`: a package
+  per group, since a package is one of its group's. While the other input holds no single value nothing is read or kept.
+- **`remember.when`:** remember only while these `InputCondition`s hold on the values the form opens with and saves.
+  A CRUD's Edit form holds the record's key and its Add form does not, so `{ name: "id", filled: false }` remembers on
+  Add only: Edit opens on the record's values, asks no picker, and its save keeps nothing.
+- **Rows remember** (a tabular or group form's row inputs): a new row's input opens on its kept value unless `newRow` or
+  the values it is added with name it (so a remembered row input takes its first choice as its own `defaultValue`, not
+  in `newRow`); a save of the form around them (`SubmitForm`) keeps the value of the row added last that is still there
+  (one added then removed does not count; none added, nothing kept). `per` and `when` read the row's own values. A
+  picker in a row is asked the same way (no spinner there), judged on the row as it was added.
+- Inside: `Helpers/InputMemory.ts` (`keptStandingNow`, `findKeptStanding`, `rememberedOpeningNow`,
+  `findRememberedOpening`, `rememberDependencies`, `lastAddedRowKey`; pure), `FormStore` (`isRemembering`, internal),
+  `RowsStore` (`attachMemory`, `rememberAdded`), `RowsInput` and `SubmitForm` (the save tells the rows inside the
+  `<form>`). `test-input-memory.mts` 115 checks, `test-rows-store.mts` 123.
+- Proved by nexus.template's `/demo/form` "Remembered picks from a server's list, and in rows" (an order's amenity, a
+  `crudPicker` narrowed by the order's group and kept per group on a new order only; a contact's kind in rows) and
+  `input-memory-picker.cjs`: nothing kept, a save and the reset, another group, a page drawn by the server with the
+  lookup held (the spinner, then the value, no hydration error), a trashed amenity and another group's (asked by key on
+  a cold page, and at once from the list the page holds; no tag), a pick before the answer, the lookup down and the
+  whole picker down, Edit, a row added then removed, a pick by the keyboard while asked and the kept value heard with
+  the box, light and dark at 1280x720 and 390x844, both motion modes.
+
+### A record tab's footer that stays in view
+
+Card C-tab-footer (2026-11-07), the owner's first ask of the day for the subscriber window's counter tabs: their line
+("To pay …") and Save sat under the form, so at 1280x720 Save was at y=807 of a 644px panel and had to be scrolled to.
+Additions only: 2 exports.
+
+- **`CrudTabFooter`** (`nexus-shared/client`), with **`CrudTabFooterProps`** (`children`, `className`): put last in a
+  tab's content, it holds the tab's words (a `<p>`) at the start and its buttons (`FormButtons`, or `Button`s) at the
+  end. In a record's workspace it sticks to the bottom of the tab's scrolling panel while the tab scrolls and sits in its
+  place at the end of the content, so Save is always in view; it reaches across the panel's whole inner width on the
+  panel's own surface under a `--nx-border` hairline, with the popup footer's room (`--nx-space-3` above and below, the
+  panel's side padding at the sides) and gap, no shadow and no frame of its own. On a phone the words and the buttons
+  wrap as whole groups. Outside a workspace it is a plain bar where it stands.
+  ```tsx
+  <ApiForm form={form} buttons={false} api={COUNTER_CREATE} inputs={inputs} />
+  <CrudTabFooter>
+    <p role="status" aria-live="polite">{summary}</p>
+    <FormButtons form={form} submitLabel="Save" />
+  </CrudTabFooter>
+  ```
+- **The keyboard and the footer.** A field (or a text box's caret) the focus moves to is scrolled clear of the footer:
+  the panel keeps the footer's height as room (`scroll-padding`), from `--nx-crud-tab-footer-size`, which the footer
+  measures and keeps on its panel while it is drawn. While the focus is in the footer that room goes, so Save taking
+  the focus never scrolls the tab. A Save that finds a problem scrolls the field to above the footer.
+- Styles: `Nexus.Crud.css` (`nx-crud-tab-footer`; the panel's side padding is now `--nx-crud-panel-pad-x`, the same
+  `--nx-space-5`, and `--nx-space-4` under 720px, and it keeps no padding under a footer).
+- Proved by nexus.template's `/demo/crud` "A guest's workspace", a new tab, **Book a stay** (a form longer than the
+  panel at 1280x720, its line and Save in the footer, saved into the guest's notes), and `crud-workspace.cjs` section K
+  and section F: the footer at the panel's foot scrolled to the top and to the end (Save hit at its centre both times),
+  across the panel's inner width, covering what scrolls under it, a field reached by Tab and Shift+Tab clear of it, Save
+  focused by code and by Shift+Tab without the tab moving, the first problem scrolled to, one Update and one Detail for
+  a save, the panel's own padding back on another tab, and a plain bar outside a workspace; then in 7 themes, light and
+  dark, at 1280x720 and 390x844, a `--nx-border` hairline, the panel's background, no shadow, the line at AA, nothing
+  past the bar or the window, whole groups wrapped.
+
+### Form figures: an input worked out from others, the server's money rule, and a money column
+
+Card C-form-figures (2026-11-07), the owner's first ask of the day: *"after the calculate what is actual value here not
+showing the old version 06-20 showing as calculate value"*, on the price list, the miscellaneous fees and the counters.
+Additions only: 13 exports, all from `nexus-shared`. One look moved by a pixel: a column dropdown's cells now meet their
+headings' edges (below).
+
+- **`InputLayoutParams.compute`** (`InputCompute`: `from`, `value(values, withValue)`; Form only): an input worked out
+  from others, shown and never typed. It is written when the form opens (new values, a loaded record) and again when an
+  input in `from` changes - typed, set from code, loaded, reset - or when the form's `computeWith` changes. It is **no
+  form value**: the store keeps none under its name (a loaded record's own field of that name is dropped), so it is
+  never in `getValue()`, `getChanges()` or what Save sends, never checked (`problems()`), never a change (`isChanged()`,
+  the leave guard, drafts), never remembered, and a value set from code or an `onFieldChange` patch naming it is not
+  taken. A server's message or the form's rule naming it is the form's message. In rows it is ignored, as `showWhen` is.
+  ```ts
+  { type: EInputTypes.Number, name: "netAmount", label: "Calculated amount", decimals: 2, compute: { from: ["price", "vatPercentage"], value: values => priceAmounts(values).netAmount } }
+  ```
+- **The box**: the field's frame (label, hint, prefix, suffix, size, design) around an `<output>` named by its label,
+  `aria-live="polite"`, on the read-only tint, its value in `--nx-text`: no lock, no read-only note, no − / +, no Tab
+  stop. A Number is written with its `decimals` always (1,073.50), grouped, in the person's number format; null,
+  undefined, "" and NaN leave it blank, never "NaN" or "0.00". While the values load (`loading`, an ApiForm's
+  `loadValue`) it is blank and disabled with the inputs beside it; in a disabled or read-only form it takes that look.
+  It is as tall as a NumberBox beside it, with the same edge, in every input design. A rule that throws shows nothing and
+  says so in the console. Styles: `nx-field__control--output` and `nx-field__output-text` in `Nexus.Input.css`.
+- **`FormProps.computeWith`** (so `SubmitForm`'s and `ApiForm`'s too): what the page knows beside the values, such as a
+  server's preview answer, handed to each `compute` as `withValue`. Only the worked-out inputs draw again when it
+  changes, compared by identity, so pass state or a `useMemo` value. `compute: { from: [], value: (_values, line) =>
+  line?.netAmount }` shows a figure the server worked out, and nothing until it answers.
+- `withInputConditions` joins `compute.from` into the input's `dependsOn`. **`isComputedInput`**, **`computedValue`**
+  and **`computedText`** are the pure rules (`test-input-conditions.mts`).
+- **`priceAmounts(input, places = 2)`** (`PriceAmountsInput`: `price`, `quantity`, `discountPercentage`,
+  `vatPercentage`; `PriceAmounts`: `amount`, `discountAmount`, `vatAmount`, `netAmount`): the Nexus server's money rule
+  (`SubscriberRenewals.Price`, 06-20's `FN_CalculateAmount`), each step rounded half away from zero, on exact decimals
+  (a scaled BigInt, each figure read from its shortest text), never on floats. A missing, null or NaN figure is 0, and a
+  missing quantity 1. 1,000 at 5 % off and 13 % VAT is 1,073.50; 99.99 at 12.5 % and 13 % is 98.86.
+- **`priceLadder(row, { keys, locale, totalLabel })`** (`PriceLadderKeys`, `PriceLadderLine`, `PriceLadderOptions`): a
+  receipt's money lines from a row's own figures, on the server's `CounterAmounts` names by default: Rate (left out
+  when the row has none), Amount, "Discount (5%)" and "VAT (13%)" (each left out at 0), then "Calculated amount". A
+  percentage has up to 4 places and no trailing zeros, in `locale` ("Discount (2,5%)" with a decimal comma).
+- **The presets** (`CrudColumns.ts`, one wording for every page; **`PriceKeys`**: `price`, `quantity`, `discount`,
+  `vat`, by default `price`, `discountPercentage`, `vatPercentage` and no quantity):
+  - `crudInputs.netAmount(keys?, changes?)`: a Number `netAmount` labelled "Calculated amount", 2 places, span 3, hint
+    "Price less the discount, plus VAT on the rest.", worked out from the keys, and blank while the price is empty.
+    `changes` replaces any key, `compute` included (a counter's box shows the server's preview instead).
+  - `crudColumns.amounts(keys?, { group })`: Price (money), Discount and VAT (percents) and Calculated amount
+    (`netAmount`, money, worked out from the row's own figures, so a row a save just answered shows it), under one band,
+    "Amount details". A page spreads them: `...crudColumns.amounts()`.
+  - `crudColumns.priceLadder(row, { keys, locale, totalLabel, group = "Money" })`: the ladder's lines as money columns
+    for a record's details.
+- **A money column in a dropdown**: `DropdownColumnType` gains `"money"`: the item's figure with 2 places in the
+  person's number format (1,00,000.00 under lakh and crore), at the end of its column (its heading too), in even digits,
+  and empty for a missing one. Its track is `auto` unless it has a `width`. **`dropdownColumnAlign`** says where a
+  column's cells sit. A column dropdown's rows now take the list's gutters (`column-gap: normal` on the row's subgrid),
+  so every cell meets its heading's edges. Before, a row's own 8px gap set each cell a pixel past both sides of its
+  heading.
+- Proved by `test-number-helpers.mts` (SubscriberRenewalCheck's money cases and more, and the ladder),
+  `test-form-store.mts` (a computed input never in getValue, getChanges or problems, never a change; the presets),
+  `test-input-conditions.mts` and `test:types`. Also by nexus.template's `/demo/form` "Worked out from other inputs"
+  and `/demo/dropdown`'s Fee, with `form-figures.cjs` in both motion modes: 1,073.50 on open, every keystroke followed
+  (900 / 0 / 13 gives 1,017.00), Reset, a held Load blank and disabled then 904.00, a cleared price blank, a 12-digit
+  price's figure whole inside its box, the disabled look, and no netAmount sent; an `<output>` with no lock, stepper or Tab stop, as tall as Price with its edge in the
+  three designs; the "From the page" pair blank, then 800.00 | 904.00; the money column at 1,00,000.00 and
+  100,000.00, ending on its heading's edge; and in 7 themes, light and dark, at 1280x720 and 390x844, the figure at
+  7.54:1 or more with nothing past its box or the window.
+
+### A form asks before it saves, the full details in sections
+
+Card C-form-confirm (2026-11-07), the owner's second ask of the day: *"the misc counter and payment counter when click
+save show popup all full details then user do contirm then save"*, as 2026-06-20's "Confirm Counter Payment" did. 7
+exports, all from `nexus-shared`, and three additions to existing options. Two looks change without a line of the
+app's: a record's details whose columns name a `group` now show a heading over each run (below), and a press outside a
+popup that stays open through it no longer takes the focus.
+
+- **`SubmitFormProps.confirm`** (**`FormConfirmParams`**: `when`, `title`, `message`, `details`, `confirmLabel`,
+  `cancelLabel`, `size`), so `ApiForm`'s too, and **`CrudFormOptions.confirm`** for a CRUD's Add and Edit: a question
+  after every value has passed its checks and before the save starts. It is always a `question`, so its confirm button
+  has the focus and Enter saves. While it is open nothing else submits the form (Save, Enter, Ctrl+S, `form.submit()`),
+  Ctrl+S does not open the browser's Save page, and the form says no "Saving…". **Back to the form** (the default
+  `cancelLabel`), Esc and × send nothing and leave every value as it was, the focus back on what opened it; a click
+  outside leaves it open. **Confirm and save** (the default `confirmLabel`) goes on to the save as before. A rule here
+  that throws shows its message under the form and asks nothing. `when` limits it to some saves (the kinds that take
+  money). The question goes if the form leaves while it asks.
+  ```tsx
+  <ApiForm api={COUNTER_CREATE} transform={saveBody} confirm={{
+    when: values => ASKS_BEFORE_SAVING.includes(values.counterType),
+    title: "Save this payment?",
+    message: summary,
+    details: () => ({ row: line, columns: counterDetailColumns(line, "confirm"), currency }),
+    confirmLabel: "Confirm payment",
+    size: "xl",
+  }} />
+  ```
+- **What it shows is what is sent.** Each text and the details are handed the values and **`body`**, what will be sent:
+  an `ApiForm`'s `transform` runs once, before the question (a throw there shows under the form and asks nothing), and
+  that very body is sent after Confirm, never worked out again; a plain `SubmitForm`'s body is its values. Without
+  `confirm`, `ApiForm` sends as before.
+- **`details`** answers **`FormConfirmDetails`** (`row`, `columns`, `currency`; the row and columns may be the page's own
+  types) and is drawn by `CrudDetails`, in the normal text colour, under the muted line. The box is `lg` with details
+  (two fields to a line) and `sm` without, unless `size` says otherwise (`xl`: three to a line). Its body scrolls while
+  the buttons stay in view.
+- **`CrudDetails` draws `column.group`**: each run of neighbouring columns that name one group is a section under an
+  `h3` heading (`nx-crud-details__section`, `nx-crud-details__heading`, the small muted heading style of a dropdown's
+  groups), the heading nearer its fields than the section above it. Columns with no group draw as before, without a
+  heading; with no group anywhere the markup is exactly as before. So every details view gets it: the View popup, a
+  workspace's Details tab, a counter's preview, the question. **`crudDetailsRuns(columns)`** (**`CrudDetailsRun`**) is
+  the rule; a group named again further on starts a new run, as a table's band does.
+- **`formConfirmAsks(confirm, values)`** and **`formConfirmQuestion(confirm, values, body)`**
+  (**`FormConfirmQuestion`**) are the question's pure rules: whether to ask, each text settled, the defaults.
+- **The message box** (`messageBox.confirm`, `show`, `alert`, `prompt`) takes **`details`**: drawn after the message in
+  its own `.nx-message__details`, in the normal text colour (the message stays muted), scrolling with the body. Also
+  **`closeOnBackdrop`** (default: as `closable`; `false` keeps a box open through a click outside while Esc and × still
+  dismiss it) and **`signal`** (an abort dismisses the box). A box without them draws exactly as before.
+- **`Popup`**: a press on the backdrop of a popup that stays open through it (`closeOnBackdrop: false`: the question, a
+  CRUD's Add and Edit, a row's form, a spreadsheet import) leaves the focus where it was. It used to move to the
+  dialog, so after a stray click Enter no longer confirmed and a field lost its caret.
+- Styles: `Nexus.Crud.css` (`nx-crud-details__section`, `nx-crud-details__heading`), `Nexus.Popup.css`
+  (`nx-message__details`).
+- Proved by `test-form-confirm.mts` (the runs, `when`, the texts and the defaults) and `test:types` (`form-confirm.tsx`:
+  a page's own row type in the details, the mistakes refused). Also by nexus.template's `/demo/form` "Confirm before
+  saving" (an order: "Place this order?", the body in Order and Money sections, "Place order", `xl`, a transform that
+  can throw, a customer the demo server refuses), with `form-confirm.cjs` in both motion modes: Place order, Enter in a box
+  and Ctrl+S in a box each open one question with no call and no "Saving…"; a click where the form's button is, the
+  form's own submit, Ctrl+S (its default held) and a backdrop click while it asks change nothing and leave the focus on
+  Place order; Enter sends one call whose body is the figures shown; Esc, × and Back send nothing, keep every value and
+  give the focus back to the button or the box that opened it; a throw and a refusal show under the form and the next
+  save asks again; and in 7 themes, light and dark, at 1280x720 and 390x844, the details at 8.3:1 or more in the text
+  colour, the headings at 4.85:1 or more, three fields to a line at `xl` and one on a phone, nothing past the window,
+  and in windows too short for them the body scrolling with Place order still in view. `/demo/crud`'s guest workspace
+  shows its Details in Contact and Account sections (`crud-workspace.cjs`, in every theme and both sizes).
+
+### A few fields in a record's profile, left out of its Details tab
+
+Card C-profile-fields (2026-11-07), the owner's third ask of the day: *"in subscriber profile when open then show the
+expirations status like the how much will run when disconnect the status which displaying in the datatable"* - a
+subscriber's Expiry and Inactive under the status tags of its window. Additions only: 2 exports, both from
+`nexus-shared`, and one addition to an existing type. A profile without `fields` draws exactly as before.
+
+- **`CrudDetailsProfile.fields`** (the type takes the row now, `CrudDetailsProfile<TRow>`, defaulting as before): a
+  few of the record's fields under the profile's tags, each a label and a value, the value drawn as the table and the
+  details draw it (`TableCellValue`): its format in the person's settings (a date in their date format, read again when
+  they change it), an option's tone, the column's `tag` after it. A field is a column given whole or a key of the
+  details' `columns` (the table's, unless the details name their own); a key no column has is left out, and so is a
+  field with no value for the record (null, undefined, blank text, an empty list, NaN; `false` and `0` are values).
+  ```ts
+  profile: row => ({ title: row.fullName, tags: [...], fields: [EXPIRY_COLUMN, INACTIVE_COLUMN] })
+  ```
+- **The built-in Details tab leaves out every key `fields` names**, an empty one too, so a record's window never shows
+  a field twice and a page filters nothing by hand. Sections (`group`) stay as they were for the columns left.
+- **The look**: a `<dl class="nx-crud-profile__fields">`, a `div.nx-crud-profile__field` a pair (`dt.nx-crud-profile__label`,
+  `dd.nx-crud-profile__value`). Beside a wide popup's tabs it is a small grid in the middle of the 20rem column, a pair a
+  line on the grid's two tracks, labels in `--nx-text-muted` and values in `--nx-text` at `--nx-text-sm`; a long value
+  wraps inside the column and a tag that no longer fits goes under its value, at its start. Under 720px of popup width
+  (the one-row profile) the pairs follow the tags as one wrapped line - beside them when they all fit, else on the next
+  line - each pair wrapping as words do with its label kept with the start of its value.
+- **`crudProfileFields(fields, columns, row)`** (the fields a profile shows for a record) and
+  **`crudDetailsWithoutProfile(columns, fields)`** (the details' columns less the keys named; the same list when none
+  are) are the rules. `isCrudProfile` takes the row type too.
+- Styles: `Nexus.Crud.css`, beside the profile's.
+- Proved by `test-crud-profile-fields.mts` (37 checks: a column or a key, an unknown key, a key named twice, every kind of
+  empty value, a column's own `value` and a path, the keys taken out of the Details and the groups kept) and
+  `test:types` (`crud-profile.tsx`: a page's own row type, a column written in place with its tag typed from the row,
+  a column of another row's type refused). Also by nexus.template's `/demo/crud` "A guest's workspace" (the guest's next
+  stay, Arrives with how soon as a tag and Leaves, in the profile and not in the Details; Book a stay moves them), with
+  `crud-workspace.cjs` section L: the `<dl>` after the tags, the dates in the default format and again as DD/MM/YYYY
+  after a live change of the preference, no Arrives or Leaves in the Details, a long date (`dddd, MMMM DD, YYYY`) inside
+  the 20rem column with its tag under it, one wrapped line at 700px and 390px with each label beside its value, a stay
+  booked followed with one Update and one Detail, and a guest with no stay with no fields; then in 7 themes, light and
+  dark, at 1280x720 and 390x844, the labels muted, the values and the tag at AA, the tag's dot in `--nx-info`, the
+  date in two formats, nothing past the profile, its column or the window, and no Arrives or Leaves in the Details.
+
+### An input's width that follows a value
+
+Card C-span-when (2026-11-07), the owner's fourth ask of the day: *"if possible and easy: in the cash counter make:
+Bill date as col-12 when it put value and during the visible input time make it col-6."* - read as: Bill date takes
+the whole row while it is empty and half once a date is put, with the switch that counts from it beside it, so Bill
+number and what follows never move. Additions only: 2 exports, both from `nexus-shared`. An input without `spanWhen`
+draws exactly as before.
+
+- **`InputLayoutParams.spanWhen`** (`InputSpanWhen`: `when`, `span`; Form only): the input spans `span` columns while
+  every condition of `when` holds - `showWhen`'s conditions, one or a list, each on an input's value as it is now; the
+  input's own name follows its own typing - else its own `span` (a value or a getter).
+  ```ts
+  { type: EInputTypes.Date, name: "billDate", label: "Bill date", span: 6, spanWhen: { when: { name: "billDate", filled: false }, span: 12 } }
+  ```
+- Built on the `showWhen` machinery: `withInputConditions` gives such an input a live `span` getter and joins the names
+  its conditions read into `dependsOn`, so its cell takes the new width on the key that makes or unmakes the value,
+  without mounting the input again: the text, the caret, the focus and an open calendar stay. Form's grid and
+  `Nexus.Form.css` are unchanged (a cell reads `span` each time it draws), so a narrow form (under 34rem) still gives
+  every input the whole row. **`spanFor(spanWhen, read, own)`** is the pure rule.
+- The `dependsOn` docs now name `span` among the getters a followed change reads afresh: a `get span()` with
+  `dependsOn` already worked (nexus.builder.web's class shape uses one); `spanWhen` says it without a getter.
+- Like `showWhen`, it is Form's only: a tabular or group form's rows ignore it.
+- Proved by `test-input-conditions.mts` (21 new checks: the rule both ways, a list, an empty list, the live span both
+  ways, a condition on the input's own name, its own `span` getter kept and giving way, with `showWhen` on the same
+  input, `dependsOn` joined once each, the page's params unchanged; in a form store, the cell drawn again on its own
+  typing with the same stamp, and a load) and `test:types` (`input-types.ts`: one condition or a list; refused without
+  `span`, without `when`, a condition with no name, a span as text). Also by nexus.template's `/demo/form` "Inputs
+  shown by another input", whose form now ends with a Bill section - Bill date, the switch "Count the dates from the bill
+  date" (shown while the date is filled) and Bill number - with `label-when.cjs` section S in both motion modes: on every
+  key the width follows the value and the focus and caret stay at the end of the same box, the calendar the click opened
+  stays open at the box's start, the switch's top is the date's with its knob level with the date's box, Bill number
+  never moves (typing, a key that unmakes the date, ×, a calendar pick), Tab goes from the date to the switch and then
+  Bill number; every density and input design; then 7 themes, light and dark, at 1280x720 and, where every cell is the
+  whole row, 390x844. Seen red with the rule broken (42 lines) and with a remount on a width change (33 lines).
+
+### Record cards that fit what was built on them
+
+Card C-record-cards-fit (2026-11-07): the nine gaps the two Accounts agents met while building nexus.accounts'
+dashboard on `RecordCards`, and the seven findings of the round-2 review in this package. Additions only: 6 exports, all
+from `nexus-shared` (`keepsTyping`, `recordActionName`, `recordBusyKeys`, `recordHeldLines`, `RECORD_STILL_READ`, the
+type `RecordGoToOptions`), and new optional params. **Three looks change with no app change**: a card's heading buttons
+go under its title where the card is narrow, a window popup's description wraps under its title on a phone, and a
+picture's hidden buttons take no press. **One behaviour changes**: a password or a one-time code typed is no longer
+asked about before it is dropped (below).
+
+- **A step's form** (`RecordStepContext.form`): every step is handed its `FormStore`, and `inputs` as a function gets
+  it, so an input's label, `hidden` or options can follow another input as typed (getters with `dependsOn`) - the
+  region levels of an address, named after the place picked above. nexus.accounts' address card can now be a flow.
+  ```tsx
+  add: { title: "Add an address", inputs: ({ form }) => addressInputs(form), submit: ACCOUNT_API.addAddress }
+  ```
+- **A step's own rule**, `RecordStepParams.validate(values, context)`, the form's `validate` (messages by input, or one
+  for the step), asked before anything is sent: a new password and its confirmation that differ.
+- **A step shown fresh**: `goTo(step, { fresh: true })`, and `RecordStepParams.fresh` for a step shown fresh each time
+  it is reached again (by `next` or `goTo`): its form is dropped and it opens on its values, so an old code or
+  password is gone.
+- **Nothing worth keeping** (`FormStore.isWorthKeeping()`, `keepsTyping(params)`): a value typed in a `Password` or
+  `Code` input is a change (Save and the status line say so) but never asked about - not by Cancel or a popup's close
+  (`confirmDiscard`), not by a link inside the app, not by `beforeunload` or `confirmPageLeave`. Any other change is
+  asked about as before. A record step with `confirmCancel: false` also leaves the page's guards.
+- **A heading's buttons while the data is read**: a card's (and the hero's) action `hidden` and `held`, typed on the
+  data, are asked only once it is read; until then the button is held, saying "Still being read." (the hero's were
+  hidden), or not drawn yet with the new `loading: "hidden"`. `recordActionState(action, null, ...)` is that rule.
+- **Heading buttons named with their card** to a screen reader ("Edit: Personal details"), as an item's icons are with
+  their item (`recordActionName`); the visible label is unchanged and starts the name.
+- **Nothing moves when the records come**: a held list row is a read row's height (its name's line and lines under it
+  as line boxes; a row's title is at least a mark's height, with marks or without), a content card's two held lines
+  are two lines of text, a count in a title no longer makes its line a pixel taller, and the new
+  `RecordFieldParams.heldLines` and `RecordItemsCardParams.heldRowLines` hold as many lines as a value or a row
+  usually takes (`heldRows` already held as many rows). Text that wraps by the width can still grow its card.
+- **A narrow card's buttons under its title**: the heading's text keeps 12rem (8rem for a title alone) beside its
+  buttons, else the buttons go on a line under it, at its start - no title squeezed to a word a line on a phone.
+- **A window popup's description on a phone** (600px and under) takes the lines under the title it needs, in full; the
+  icon and the window buttons keep the bar's first line. Wider, it is the one low bar as before.
+- Review fixes: a page's popups close with it and are keyed by the page that opened them, so a page drawn afresh never
+  brings back a popup bound to the old data (whose Save sent the stale record); an Edit with a Tabular or Group input
+  opens on its rows (`recordOpenedValues`), so its Save no longer wipes them; a card keeps a list of its calls on their
+  way (`recordBusyKeys`), so one that ends first never frees a row whose own call still runs; the once-only scroll to
+  a linked card (`#emails`) is skipped once the person has scrolled, touched, pressed a key or 5 seconds have gone, or
+  when the card is already in view; a picture's hidden buttons take no press (`pointer-events: none` until shown) and
+  are always shown where any pointer is coarse (a laptop's touch screen); a list that could not be read in the pictures
+  window has the window's padding; the document list's Upload in a full one-file category is held with its reason
+  ("This keeps one file: delete it first.").
+- Proved by `test-record-cards.mts` (151 checks: rows opened, the rules not asked while read, `loading`, busy keys,
+  held lines), `test-form-store.mts` (worth keeping), `test:types` (`record-cards.tsx`), and nexus.template's
+  `/admin/profile`, whose demo now has an address's lines named after what it is, Change password with its
+  confirmation, Send a reset link, Back on the code step, and held rows as many as the lists: `record-cards.cjs` section
+  K and new lines in A (every card's place and height through the load at 1280, every heading button's name), and
+  `pictures.cjs` K7. Seen red with the busy list, the popups' closing, and the row's height undone.
+
+### Also in 4.0.0: the changes prepared as 3.3.0
+
+Prepared on 2026-10-22 with asks 1-6 of the template's auth follow-ups and everything unreleased since `3.2.0`, with the
+solid fills' hover added on 2026-10-26, and never published. On their own they are new features with no code break;
+the sections below say what each added. What can move for an app:
+
+- **A list's Add button reads "Add New"** on every `Crud`, whatever its subject; the form it opens keeps its subject.
+- **Menus** fade a switched-off item's icon and label, not its reason, and wrap a long second line.
+- **A table's spreadsheet menu** offers only what the app's permissions allow; the template and the export stop at a
+  failed settings call, with that call's one toast.
+- **A Nexus save is not read back**, except a new record with a `crudColumns.dbJoin` column given no `from`.
+- **An Edit saved while the CRUD shows another list** goes where its band says, no longer into that list.
+- **A `crudPicker` with a `valueKey` other than `id` and no `find`** no longer posts its values to `findListing`.
+- **A solid fill under the pointer is darker than at rest in every theme**, light and dark (it turned lighter in a dark
+  theme): a primary or danger `Button`, and so `SplitButton`, `FormButtons` and every solid button built on them, the
+  chat's unread button and Send, and the popup's close button while it is pressed. **An app's own theme that puts a
+  dark label on a light solid fill** loses contrast under the pointer now: give its fills a light label at 4.6:1 or
+  more, as the README's example does.
+- **Nord's dark solid fills are a little lighter and carry white**: `--nx-primary-solid` `#557b86` (was `#4b717c`),
+  `--nx-danger-solid` `#99686d` (was `#8e5e63`), and `--nx-primary-text` and `--nx-danger-text` `#ffffff` (were snow,
+  `#eceff4`), on every button, check, selected day and tab indicator in Nord's dark mode.
+
+### A solid fill under the pointer keeps its label readable
+
+2026-10-26, the owner's decision of 2026-10-22: "fix it everywhere". `--nx-primary-hover` and `--nx-danger-hover` mixed
+the fill 16% toward `--nx-text`. That darkened it in light mode, but lightened it in dark mode, where the fill is already
+as light as its white label allows, so the label under the pointer fell from 4.6:1 to 3.48-3.69:1 in all seven dark
+themes. Both are now the fill with **12% black** mixed in (OKLab), in every theme and in both modes:
+
+- the label under the pointer, and pressed, measures **6.06:1 or more** in a dark theme and **7.09:1 or more** in a light
+  one (it was 5.94:1 or more there); at rest and with the keyboard's focus nothing changed (4.60:1 or more);
+- the step from rest is the same size in every theme, an OKLab difference of **5.8 to 7.4** (x100). Light mode's was
+  1.9 to 6.0, so a light theme's hover is a little darker than it was (Rosé Pine's, Nord's and Solarized's the most),
+  and now seen in every theme.
+
+Measured in a browser under a real mouse, the colours composited through a canvas, on every solid fill the packages
+hover: `Button` primary and danger, both halves of a `SplitButton`, `FormButtons`' danger submit, the chat's unread
+button and Send, and the popup's close button. The close button still turns `--nx-danger-solid` under the pointer;
+pressed, it takes `--nx-danger-hover`, so it now turns darker instead of lighter. Its minimise, maximise and restore
+buttons did not change. `npm run check:themes` reads the two lines from `Nexus.Tokens.css` and checks both: the label at
+4.5:1 or more, and a step of 5 or more. No export or constant changed. An app that used either token for something
+other than a solid fill's hover gets the darker colour in dark mode too.
+
+**The fill under the pointer keeps 2:1 on the panel**, as it does at rest. In a dark theme the darker step moves the
+fill toward the panel. In Nord's dark mode it reached 1.79:1 on `#2e3440`, under the 2:1 every solid fill keeps at rest:
+Nord's panel is lighter than other themes' and its label was snow (`#eceff4`), which left the fill no room to darken.
+Nord's dark fills now carry white, as five of the other six themes' do, and were set the way every dark fill was: the
+same hue and chroma, at the lightness where white reaches 4.6:1. They stand 2.71:1 off the panel at rest (were 2.35)
+and 2.04:1 under the pointer, and the label reads 4.60:1 at rest and 6.11:1 under the pointer. The other dark themes'
+fills keep 2.30:1 or more under the pointer. `check:themes` now holds every hovered fill to 2:1 on `--nx-surface`. A
+solid fill's label is light in every theme and both modes, because hover and pressed darken the fill: a dark label on
+a light fill reads at rest and loses contrast under the pointer.
+
+### A QR code, `QrCodeImage`
+
+2026-10-22, ask 4 of the template's two-step pages (`nexus.accounts`, whose authenticator setup drew its own). Added
+only.
+
+- **`QrCodeImage`** (`nexus-shared`; a server component can render it: nothing in it needs the browser): `value`,
+  `label` for screen readers, `level` (L, M, Q, H; M by default), `className` and `style` for where the page puts it.
+  One SVG path of black modules on a white square that holds the quiet zone, black on white in every theme and in
+  forced colours. New stylesheet `Nexus.QrCode.css`, class `nx-qr`: 9rem wide, a control's rounded corners - the look
+  of nexus.accounts' `.tp-auth__qr`, whose grid area stays the page's.
+- **`encodeQr(text, level)`** and **`qrPath(code, border)`** (`QrCode`, `QrLevel`): QR Code Model 2 written by hand,
+  byte mode (UTF-8), versions 1 to 40, levels L, M, Q and H, Reed-Solomon, the eight masks scored by the four penalty
+  rules. A text past version 40 throws, with how much the level holds. Plain erasable TypeScript, so Node runs it as it
+  is: `Project-Skills/Checks/qr-code-check.mjs` reads every code back with jsQR 1.4.0 (410 of 410 against this file),
+  and `npm run test:qr` checks its shape without a decoder.
+
+### A list beside the record picked in another, and a picker's own find
+
+2026-10-22, asks 5 and 6 of nexus.web's company users page. The owner picked "the places of the person picked beside
+the people", and decided that a person is given a place only once they have joined. Added only: no export removed and no
+exported constant changed. A table or CRUD that passes none of the new props is unchanged, but for the two fixes at the
+end, which any app can see.
+
+- **A picked row, `DataTable` `onPick`** (and `Crud` `onPick`): rows the user picks one of, for a page that shows the
+  picked one's records beside the table.
+  - A click on a row picks it; a double-click still opens it, and `openOnClick` gives way. The keyboard reaches the rows
+    through a radio button each, out of sight in the first column and named with the row: Tab to the picked one, and the
+    arrow keys move the pick.
+  - The picked row is tinted as a selected one is, a ring round it shows the radio's focus, and the rows are numbered
+    unless `numbered` is false.
+  - The pick lives in the store (**`TableState.picked`**, **`TableStore.pick`**, **`TableStoreOptions.onPickChange`**)
+    and follows the record: a search, a sort or another page keep it, an upsert hands the page its new copy, and it is
+    let go when the record is removed, is gone after a load, or another list starts over.
+  - New attributes `data-pick` and `data-picked` on a row, and the class `nx-table__pick`.
+- **A list narrowed to it, `Crud` `narrow`** (**`CrudNarrow`**: `picked`, `key`, `valueKey`, `labelKey`, `addLock`,
+  `emptyMessage`), fed from the other list's `onPick`.
+  - Only the picked record's records show, under a caption naming it ("Places of: Ram Thapa"). The table's name for
+    screen readers says it too.
+  - A list paged in the browser keeps the whole list and shows the picked record's rows from it, so another pick costs
+    no request. A server's pages carry the value as a filter named `key`, and are kept per picked record.
+  - Add fixes the value in the new record, read-only with the lock and a note, in a form of its own per picked record
+    ("For Ram Thapa" in its title bar). Its box is named from the picked record, with no lookup.
+  - Add waits, saying why on a press, while nothing is picked or the picked record may take none: `addLock`, by default
+    the backend's rule (`CrudBackend.isPickable`), so a Nexus record pending (30-39), trashed or deleted takes none.
+  - A save lands in the list of the record it names and in no other, whichever record is picked when it is saved.
+    Joined names come from the picked record with no call (a `crudColumns.dbJoin` given `from`).
+  - New helpers **`crudNarrowing`** and **`crudInNarrowing`** (**`CrudNarrowing`**).
+- **`DataTable` `caption`**: a line inside the table's frame, over its bar, saying what its rows are. Beside another
+  table, the two frames still start level. New class `nx-table__caption`.
+- **`DataTable` `add`** takes `disabled` and `description`, as `TreeView`'s own button does. The button stays in the Tab
+  order, `aria-disabled`, and a press shows the description in a note under it; the description is its tooltip too. While
+  it waits, the spreadsheet's items stay in the options menu, without Bulk insert.
+- **`crudPicker` `find`**: where a value the kept list does not offer is looked up when `valueKey` is not `id` - an
+  endpoint POSTed such values, as `findListing` is the keys, whose answers are read by `valueKey` (a person's `userId`,
+  which their company row carries beside its own key); or a source of the page's own. Its answers are kept apart from
+  `findListing`'s, and `expireLookups` marks them old with the controller's own. **`joinSource(source, backend, key)`**
+  takes the field the answers are filed under.
+- **`lockInputs(inputs, locked, values, known)`** and **`CrudFormRequest.known`**: records the caller holds for the values
+  it fixes. A fixed dropdown whose value one of them holds gets it as a selected option.
+- A save names its joined columns from a dropdown's `selectedOptions` too, after what the user picked.
+
+What can move for an app on 3.2.0:
+
+- **An Edit saved while the CRUD shows another list** - its form minimized, the trash shown meanwhile - no longer goes into
+  that list's table, which then filed it in the cache under that list's name. It goes where its band says, and out of
+  the table when an edit took it out of the list on screen.
+- **A `crudPicker` whose `valueKey` is not `id`, with no `find`**, no longer posts its values to `findListing`, which
+  takes the records' keys and could answer none of them. The form names such a value from the record it holds
+  (`selectedOptions`), or shows it as not found, without the call.
+
+### A step that removes something
+
+2026-10-22, asks 1-3 of the template's two-step pages (`nexus.accounts`, `/account/security`): a step that removes an
+authenticator app, turns two-step off or makes new codes confirms with a password, and carried two stand-ins of its own.
+Added only: no export removed, no exported constant changed, and a form that passes none of the new props is unchanged.
+
+- **`FormButtons` `submitTone="danger"`** (and so `SubmitForm`, `ApiForm`): the submit button filled with
+  `--nx-danger-solid` and `--nx-danger-text`, the `Button` `danger` variant every solid danger fill uses, for a save
+  that removes something. Default `primary`, as before. New type **`FormSubmitTone`**.
+- **`downloadText(name, text, type)`** (`nexus-shared/client`): the file a table's CSV export hands over, for any text
+  made in the browser - a Blob behind a link that is clicked and taken out, its address let go ten seconds later, the
+  text after a byte order mark so Excel and Windows editors read UTF-8.
+- **`SubmitForm` `aria-describedby`** (and so `ApiForm`): passed to the `<form>` beside `aria-label` and
+  `aria-labelledby`, so a step that puts the focus straight into its password box can point at the line saying what
+  goes.
+
+### A record nobody may change here, and a switched-off item's reason readable
+
+2026-10-12, for the Builder's locked system models (the auth tables a person may only read). Added only: no export
+removed, no exported constant changed, and a `Crud` without the new prop behaves as before.
+
+- **`Crud` `rowLock`** (`(row) => string | null | undefined`): why a record may not be changed here. Its Edit, Flag,
+  Move to trash, Recover, Delete permanently and Move back to trash are listed **switched off** with that sentence under
+  each (none on the row as an icon), its details offer no Edit, the handle's `edit(row)` opens its details instead, and
+  a selection holding it has the mass actions that change records switched off. View, History, Pin and Favourite stay.
+  It fills the gap pages worked around with row actions of their own ("`Crud` cannot switch a built-in action off for
+  one row"); a page's own `rowActions` are still the page's to switch off.
+- **Menus** (`Nexus.Menu.css`): a switched-off item fades its icon, check, label and shortcut to half, no longer the
+  whole item, so its second line (why it is off) is read at full strength: at half it measured 2.0 to 3.1:1 in every
+  theme. `.nx-menu` sets `white-space: normal`, so a row's menu inside a table's actions cell (which does not wrap)
+  wraps its items' second lines instead of cutting them. An app that undid either rule for its own menus can drop that.
+
+### A table's spreadsheet menu asks the permissions
+
+A review of 2026-10-10 found an Admin offered a model's whole spreadsheet menu on nexus.web, every item of it refused
+by the backend (the sheets are SuperAdmin's). No export or constant changed. What can move for an app on 3.2.0:
+
+- **`DataTable` `excel`** (and so `Crud` `table={{ excel }}`): each item is offered only when the app's permissions
+  (`canCall`) allow every endpoint it calls - Download template the settings and the template, Import from a
+  spreadsheet and Bulk insert the settings, Verify and Import, Export to Excel the settings and the export - and the
+  menu follows a change of rights. An app with no permissions registered allows everything, so it sees no change; one
+  with `NexusPermissions` now needs its users' access actions to hold the `{Model}/Excel/...` actions for the menu to show.
+- **`downloadExcelTemplate` and `exportExcel`** stop at a failed settings call and answer it (`ok: false`, its status
+  and message): the person sees that call's one toast. Before, the template went on to a second refused call and a
+  second toast, and the export went on without knowing its row limit.
+
+### The list's Add button says "Add New"
+
+The owner, 2026-10-10: *"the CRUD has Add Region, Add Country and ... I want just fixed name Add New ... no dynamic"*.
+A `Crud`'s Add button above its list reads **Add New** on every page, whatever its `subject`; it was `Add <subject>`.
+The form it opens keeps its subject in the title and on its submit button ("Add region"), and Edit still says Save.
+No export or constant changed. An app's test that finds the list's button by its old name ("Add region") finds
+nothing now; one that finds the form's submit button is unaffected.
+
+### A tree that fills
+
+The owner, 2026-10-10, on nexus.web's administrative region tree: *"make full height here similar datatable both side
+panel, make sure responsive"*. Added only; a tree without the new prop is unchanged.
+
+- **`TreeView` `fill`**: the tree takes the height it is given, as `DataTable` `fill` does - the toolbar on top, the
+  rows scrolling inside under it - and `height` and `maxHeight` are ignored while it is on. New class
+  `nx-tree-field--fill` on the field. Give it a cell with a height: a side of nexus-admin's `AdminSplit` on an
+  `AdminPage` with `fill` (both new in nexus-admin), or a parent of your own.
+
+### CRUD inside a tree, and changes written into a tree's kept pages
+
+The owner, 2026-10-10, on the same page: *"allow CRUD ... inside the treeview"*. Added only: no export removed, no
+exported constant changed, and a page that passes none of the new params behaves as before - with one call fewer where
+a picker's saved value is in the list it keeps (see `crudPicker` below).
+
+- **`CrudTree`** (`nexus-shared/client`): a controller's records as a lazy tree with Add New (under a row, or from the
+  toolbar), Edit, Move to trash, Recover, Delete permanently, Move back to trash and History - through the **same**
+  Add/Edit popup and calls `Crud` uses. Row icons for Add New, Edit and Move to trash (Insert, F2 and Delete on a
+  focused row, all in its context menu); the picked record's fields and buttons go to a panel the page draws
+  (`details`). Every change is written into the tree and the pages it keeps: a record added is placed where its
+  siblings' order puts it, an edit is written in place or moved to its new parent, one in the trash leaves, and the
+  parents' counts and chevrons follow. A Create still reads its record back once (as `Crud` does), and an edit that
+  moved a record reads it once for the names joined from its new parent. New class `nx-crud-tree__actions`.
+- **`CrudTreePlacement`** (`cacheKey`, `rules`, `itemOf`, `parentOf`, `recordOf`, `childValues`): where a controller's
+  records sit in a tree, given to `CrudTree` and to **`Crud` `trees`** - a data table on another page then writes its
+  changes into that tree's kept pages too (an import drops them instead). `crudTreeChanges` turns a `CrudChange` into
+  tree changes; **`CrudChange.before`** carries the records as they were.
+- **Changes into a tree's kept pages**: `writeTreeChanges(cacheKey, changes, rules)` patches `treePages`
+  (`patchTreePages`) and every tree on screen with that `cacheKey` (`subscribeTreeChanges`); `TreeItemChange`
+  (`put` / `remove`) and `TreeChangeRules` (`valueKey`, `hasChildrenKey`, `compare`). `TreeStore.placeItem` and
+  `removeItem` keep a lazy parent's `loaded`/`total` and its own count right, so the next page skips the right number.
+- **`TreeView`**: `rowActions` (`TreeRowAction`: `TableRowAction` and a `shortcut` of Insert, F2 or Delete), `add` (a
+  toolbar button of the page's own), and on the handle `apply(changes, rules)`, `getItem(value)`, and a `reveal` that
+  waits for an item still loading. Focus follows a row that leaves or moves, released before the row leaves the page.
+- `RequestCache.entries(prefix)` and `set(key, value, at)` (a value written over a kept one keeps its age);
+  `TableJoins.remember(source, records)` and `peekList(name)`.
+- **`crudPicker`'s `resolveOptions` names a saved value from the list it keeps** before asking `findListing`, so a form
+  opened with a value the list offers (an Edit, an Add under a tree's country) makes no lookup. A value the list does not
+  offer - a parent since trashed - is still looked up and shown tagged.
+- `Crud`'s form popup, its call for an action on one record and its action words now come from one internal module
+  shared with `CrudTree` (`Components/Forms/CrudActions.tsx`): no change to what `Crud` shows or sends.
+
+### A tree that fixes where a record sits
+
+The owner, 2026-10-10, on the same tree: *"I have select the row to add, auto add inside this. Not allow to switch
+parent ... both should be disabled, not allow to change those values."* Added only: no export removed, no exported
+constant changed, and a tree whose placement names no `placeKeys` behaves as before - except that a `CrudTree` now
+selects the row it shows (below).
+
+- **`CrudTreePlacement.placeKeys`**: the fields that say where a record sits (its parent, its country). Given, `CrudTree`
+  fixes them in every form it opens - an Add inside a row takes them from `childValues` (a field it leaves out is fixed
+  empty), an Edit keeps the record's own - and every Add goes inside a row: the row's +, Insert, the context menu, the
+  panel's Add New, `handle.create(parent)`, and the toolbar's Add New, which now adds inside the selected row - the one
+  the panel shows - and, while there is none (or the selected record is in the trash), says why on a press (a click, a
+  tap, Enter); it used to open with nothing filled. A record then moves only where those fields are offered, such as a
+  data table's form. Fixed is read-only, the design's "cannot change" look: the lock, and a note on any try ("Added
+  inside Bagmati: pick another row in the tree to add elsewhere.", "Its place cannot be changed in the tree."); the
+  values stay and are sent as before, and a form's own `onFieldChange` never rewrites them (**`lockedFieldChange`**).
+- **The selected row**: a click or Enter on a `CrudTree` row selects it - tinted, and staying so while focus, the arrow
+  keys and the chevrons move on - and a record's row shows that record in the panel, while a row that is no record (a
+  country above its regions) empties the panel and opens. So the toolbar's Add New and the panel's never disagree.
+- **`lockInputs(inputs, locked, values)`**: inputs fixed for one opening of a form (input name -> why), copied with their
+  own property descriptors so a getter param keeps working; a required input with no value stays free. The Add and
+  Edit popup `Crud` and `CrudTree` share (internal) takes them as `locked`. An Add with fixed inputs is a popup of its
+  own per set of fixed values (**`crudFormPlace`**, added to the popup's and the draft's keys) and says where in its
+  title bar ("Inside Bagmati"): an Add started inside one row never comes back inside another, and asking for an Add
+  replaces every untouched Add of the controller, so only forms with work in them wait on the dock. A record keeps **one**
+  Edit popup wherever it is asked for: with the same inputs fixed it comes back; with others (a tree's fixed form, a
+  data table's free one) an untouched one is replaced, and one with changes comes back as it is, with a note saying
+  why - an older form's save would undo what a newer one saved. Drafts stay one per set of fixed values, so a draft
+  written before a record moved is not brought back over its new place.
+- **`TreeView`**: `selectedValue` - the row the page picked, marked `aria-selected` and tinted (new class
+  `nx-tree__row--selected`); moving focus, a chevron, opening or closing a row leave it where it is. `add.disabled` with
+  `add.description`: the toolbar button stays in the Tab order (`aria-disabled`) and a press shows the description in a
+  note under it; the description is also its tooltip and what a screen reader hears after its name.
+- **`Button`** with `aria-disabled="true"` looks disabled, stays focusable, and draws a stronger ring through the dimming.
+- **The dock** shows a popup's `description` under its title (`DockedWindow.description`, new classes `nx-dock__text`
+  and `nx-dock__description`), in the bar's tooltip and in its buttons' names: two Edit forms, or two Adds, read apart.
+- A **read-only** field's placeholder is drawn in muted text, at least 4.5:1 on the read-only box (it was under 3:1 in
+  light themes), since it is all the field shows ("None: directly under the country").
+- The details panel's Add New says "Add New: inside {name}" in its tooltip (it said "under").
+
+### A save is never read back
+
+The owner, 2026-10-10: *"When I created a new item it calls a new API and gets details; this is not needed. We return the
+details during the creating time, so use this; the creationTime, recordStatus we will provide fake or just right now."*
+With the Nexus backend an Add is now one Create and an Edit one Update, on a data table and in a tree: the row shown is
+built from the answer, the form and what the page holds. This replaces the read backs described under "CRUD inside a
+tree" above (a Create read once, a move read once). Added only: no export removed, no exported constant changed. What
+can move for an app on 3.2.0:
+
+- **A `crudColumns.dbJoin` column without `from`** - the form 3.2.0 documented - still has its new record read back once
+  after an Add (`details`), as 3.2.0 read every Create with a payload answer back; it is now the only reason a Nexus save
+  reads anything. Give the column `from` (the field of the joined record's key) and the read goes.
+- `TableColumn.dbJoin` is set by every `crudColumns.dbJoin` column, its `from` optional.
+
+The changes:
+
+- **`CrudBackend.savedRow(action, record, before)`**: the fields only the server keeps, written as the backend writes
+  them. The default leaves the record as it is, and a CRUD still reads a record back once when its list cannot be told
+  from it (another app's backend). **`NexusCrudBackend`**: a new record lacking them is Active (`NEXUS_ACTIVE_STATUS`),
+  has no marks, was added now (`creationTime`, a UTC ISO string) and never changed; an edited one takes the status, the
+  marks and the time added from the record the page holds now (`before`) - over its form's copies, which a flag or a
+  mark made while the form was open has left behind - and was changed now.
+- **Joined names with no call**: `crudColumns.dbJoin` takes `from`, the field holding the joined record's key (kept as
+  **`TableColumn.dbJoin`**), and after a save **`crudJoinedNames`** writes each such column again. A key kept keeps its
+  name and status, an emptied one empties both, and a new or changed one takes the name (the dropdown's `labelKey`) and
+  the `recordStatus` of the record behind it. That record is the one the user picked (the form now keeps a dropdown's
+  item: **`FormStore.pickedItem(name)`**, `input(name, value, stamp, item)`), else one the page holds (**`Dropdown`
+  `peekOption(key)`**: `crudPicker` gives one from its kept list and the FindListing cache, and **`peekFound(findListing,
+  key)`** serves a picker of a page's own), else, in a tree, the parent the record sits under, else one the page held
+  and has marked old (`peekOption(key, true)`). A key nothing names is left unnamed - an edit drops the old key's name -
+  and **`crudJoinsMissing`** then has the record read back once. A data table's Edit that moves a record now shows the
+  new parent's name; it showed the old one until the page was read again.
+- **Counts**: with `trees`, **`crudSavedCount`** gives a new record its placement's count (0) and an edited one the count
+  the page holds now (a child added since its form opened counts), and **`crudParentCounts`** moves the counts on the
+  parents' own rows that a data table holds - one more under the new parent, one fewer under the old - on a create, a
+  move, the trash and back, as the tree's parents already did; each parent row once, however many placements the page
+  gives. Both write what `CrudTreePlacement.recordOf` gives over the row, so `recordOf` carries the item's count back.
+- **In a tree**, a record added under a parent never opened is counted there and shown in the panel; the parent stays
+  closed, since opening it would read its page.
+- `Dropdown` `peekOption` on its own: a value the page already holds is named from the first draw, with no
+  `resolveOptions` call - while it is fresh: a record marked old since (a save on its controller, a Reload) is asked for
+  again, so the box shows it as it is now. **`TableJoins.peekFresh(name, key)`**, and `peekFound`'s `aged`.
+
+### New exports no section names
+
+The types and small helpers that come with the parts the sections describe, so that every new name is listed once:
+
+- `nexus-shared`: the file types `FileOwner`, `FileCopy`, `StoredFile`, `FileUpload`, `FileCallOptions`,
+  `PictureType`, `PICTURE_TYPES`, `isPictureType`, `ImageViewerItem`, `PictureParams`; the file helpers `fileKindName`,
+  `fileOwnerKey`, `acceptOf`, `readStoredFile`, `readOwnerFiles`, `FileApiClient`, `NexusDriveAdapterOptions`,
+  `PrimariesReader`, `PrimaryPicturesOptions`; `QrCodeImageProps`, `MoneyFormatOptions`, `CrudJoinedRecord`,
+  `NarrowPickWords`, `CrudNarrowPickerSource`, `CrudDetailsProfile`, `CrudDetailsTab`, `TableDbJoin`.
+- `nexus-shared/client`: `getFileAdapter`, `toastFileFailure`, `usePrimaryPicture`, the props types
+  `PictureInputProps`, `OwnerPictureProps`, `PictureGalleryProps`, `OpenPictureGalleryOptions`, `PictureColumnParams`,
+  and the tree CRUD's `CrudTreeProps`, `CrudTreeDetails`, `CrudTreeHandle`.
+
+## 3.2.0
+
+**New features, no code break.** Every export of `3.1.0` is still exported (99 are new: 72 from `nexus-shared`, 16
+from `nexus-shared/client`, 11 from `nexus-shared/server`), and no exported constant changed a value: six only gained
+keys or entries (`API_ACTIONS`, `CRUD_ROW_ACTIONS`, `CRUD_MASS_ACTIONS`, `MESSAGE_ACTION_NAMES`,
+`DEFAULT_USER_PREFERENCES`, `PREFERENCE_STORAGE_KEYS`). Both were checked against the published `3.1.0`: its exports
+by the TypeScript checker, its constants by importing both builds. The owner chose the number on 2026-10-10. It needs
+`nexus-icons` `^1.2.0`, the first with `iconStarOff`. What can move for an app:
+
+- **A CRUD built from `apiController` reads `BookmarkListing` and writes `SwitchBookmarks`**, the Nexus backend's
+  names since 2026-10-07, in place of `PinListing` / `Pin`. See "Pins and favourites from one call" below.
+- **Stylesheet overrides** of the pinned section's classes and of the outlined field's raised label (both below).
+- **`TablePinnedHead` is deprecated**: `TableSectionHead` takes the section's icon. The old name still renders the
+  pinned section's head, with the pin icon and the new classes, so an import of it keeps building.
+
+### A tree whose children load when they are opened
+
+The owner, 2026-10-09: administrative regions in two versions, a data table and a tree, both paged on the server; the
+tree "when a node is expanded, calls the API, gets the info and caches it". The data table already paged on the
+server, so the change is the tree's. Added only; a tree without `loadChildren` works as before, with one fix it shares.
+
+- **`TreeView` `loadChildren`** (`nexus-shared/client`): asks for an item's children when it is first expanded, a page
+  at a time - `{ parent, parentValue, skip, take, signal }` in, `{ items, total?, hasMore? }` out, at once or in a
+  promise - and for the top level too when `items` is left out. The children go under the item asked for, whatever
+  their own parent field says. New params `childPageSize` (default 50), `hasChildrenKey` (a boolean or a count such as
+  `childCount`; without it an item shows a chevron until its first page answers, and loses it when that is empty),
+  `cacheKey`, `cacheLifetime` and `partialMessage`; `items` is optional now.
+- **Status rows**, rows of the windowed list like the others, reached with the arrows and pressed with Enter or Space:
+  a loading row while a page comes (the parent `aria-busy`, a polite announcement), "Could not load the items." /
+  "Could not load more items." with Retry (the Dropdown's words), and **Load more** with how many are left when the
+  total is known. Focus on one of them follows the page to its first new item. New classes `.nx-tree__row--status`,
+  `--loading`, `--error`, `--more`, `.nx-tree__status-icon`, `.nx-tree__status-text`, `.nx-tree__retry`.
+- **What is loaded stays**: collapse and expand again asks nothing. With `cacheKey`, pages are kept in `treePages`, a
+  `RequestCache` shared by every tree on the page, for 5 minutes: a remount or a second tree asks nothing, and a request
+  already on its way is shared. A failure is not kept, so Retry asks again.
+- **`refresh(value?)`** on the handle drops the kept pages (all, or an item's and everything under it) and loads again
+  only what is on screen - the top level and the open items with rows in view; the rest load fresh when next opened or
+  scrolled to. What is drawn stays until the fresh pages replace it, and an item still there keeps what is open under it.
+- **Checking, with `cascade`**: an item whose items are not all loaded (`TreeNode.partial`) cannot be checked as a
+  whole - a check stands for everything under it, and the value can only hold items that were loaded, so it would
+  silently leave the rest out. A click says so (`partialMessage`); it shows mixed when something loaded under it is
+  checked, never checked; Select all checks the loaded parts. A saved value whose item is not loaded yet stays in the
+  value and checks the item when it comes. Without `cascade` nothing changes.
+- **Nothing asks in bulk**: Expand all, `*` and `defaultExpanded` open loaded items only.
+- **`TreeStore`**: options `lazy`, `lazyRoots`, `hasChildrenKey`; `canExpand`, `find`, `pagesOf`, `beginLoad`,
+  `receivePage`, `failLoad`, `replacePages`, `markStale`, `rootPages`, and `insertMany`, a batch insert that updates
+  counts along one path (a page of 50 into 100,000 items: 0.3 ms); `TreeNode.pages`, `.partial`, `.status`. Helpers
+  `treePages`, `treePagesKey`, `treePageKey`, `expireTreePages`, `treeHasChildren`, `treeStatusKey`, and the types
+  `TreeChildrenRequest`, `TreeChildrenPage`, `TreeChildPages`, `TreeStatusKind`.
+- **`RequestCache`** (`Helpers/RequestCache.ts`, `nexus-shared`): answers kept by key for a lifetime, a request on its
+  way shared, a failure not kept, `drop` by key prefix or test; `REQUEST_CACHE_LIFETIME`, `isPromiseLike`.
+- **Fix, every tree**: a node's `uid` counted from one counter for the whole page, so a page rendered on a server that
+  had rendered trees before numbered its rows differently from the browser, and React reported a hydration mismatch
+  in development (production does not check attributes). It is counted per store now.
+- **Fix, every tree: a scroll that takes the focused row out of view keeps its position** (nexus.web, the same
+  evening: after a client-side navigation a jump to the end came back up to 1,120px, and a wheel step left Load more
+  out of view). Chrome lays the page out inside the removal of a focused element, in the middle of React's commit,
+  when the leaving rows are gone and the new ones not yet in, and clamped or anchored the scroll position to that short
+  list. Focus now moves from a row to the tree's viewport in the event that moves the window, before the row leaves
+  (a name box being edited lets go without saving, as when its row unmounted), and `.nx-tree__list` gets a `min-height`
+  of all its rows, so a layout at any moment of a commit sees its full height.
+
+### Focus rings shown whole
+
+The owner, 2026-10-08: the theme panel cut the focus ring of its last example input (bottom) and of the date-format
+dropdown (left), and a focused outlined input's raised label sat across its own ring. No export changed; what a
+consumer may notice:
+
+- **`.nx-popover__scroll` keeps 4px of room** on its top, bottom and left for focus rings, with a matching negative
+  margin so nothing moves, and `scroll-padding` of 4px. Every panel that scrolls through it gets it: the theme panel,
+  menus, and the table's Columns and Filters panels. A panel's `--nx-popover-pad` must be 4px or more. Where the
+  scroller is its panel's first or last child, as a menu's list is, its left corner follows the panel's curve (the
+  inner radius less that room: 9px in a menu), so a scrolled item's highlight never paints over the rounded border.
+- **A focused outlined field** (`design="outlined"`) draws a 2px accent outline over its border instead of the soft
+  ring outside it, so the raised label sits in a clean gap. The raised label is placed with `top: -0.6em` instead of a
+  transform, and its backing is now the label's `::before`: it starts exactly on the box's edge at every screen scale
+  and paints nothing above it. The gradient it replaces painted a strip of the field's colour above read-only and
+  disabled boxes and in dark popovers. An app that styles the outlined label's `::before` overrides that backing. The
+  standard and inbox designs are unchanged.
+
+### The API proxy hides the backend
+
+The owner, 2026-10-08: nexus.web's network tab showed `POST /api/app/configuration/Region/MassRecover` answer
+`307 Temporary Redirect` with the backend's own https address in it, which the browser then called directly, and
+asked for a proxy behind which the app looks like the backend itself. `createApiProxy({ token })` is called as before
+and no export is removed; what a route may notice:
+
+- **No redirect reaches the browser** (was: passed on, its Location rewritten only on the backend's own host). One that
+  stays inside the module - the root's origin, or its host moved to https, under the root's path - is followed on the
+  server as `fetch` follows it, up to 3; any other answers 502 `BACKEND_REDIRECT_REFUSED` or `BACKEND_REDIRECT_LIMIT`.
+- **Response headers by an allowlist** (was: all but the hop headers): `DEFAULT_PROXY_RESPONSE_HEADERS` and the Nexus
+  backend's `X-Nexus-*`. A header an app read through the proxy (`X-Request-Id`, `X-Total-Count`) must now be named in
+  `responseHeaders`; Server, X-Powered-By, X-AspNet-*, HSTS, CORS, Location, Link and Set-Cookie never pass (Set-Cookie
+  with `passCookies`). Every answer gets `X-Content-Type-Options: nosniff`, and `Cache-Control: private, no-store`
+  when the backend sent none.
+- **Error pages are replaced** with the failure envelope and the backend's status (`BACKEND_ERROR_PAGE`): HTML, text,
+  stack traces, and JSON that repeats the user's token. JSON refusals pass as they came.
+- **Refusals carry `errorCode` and `errorMessages`** beside `message` and `messageCode`, and say nothing about the
+  server: an unset module answers "The School API is not set up on this server." (was: "... is not set (API_SCHOOL).",
+  which named a setting; the log has it now), and a module the browser calls directly "... is not available at this
+  address." New: 403 `CROSS_SITE_REFUSED`, 413 `REQUEST_TOO_LARGE`, 400 `REQUEST_UNREADABLE`.
+- **The request**: the browser's X-Forwarded-*, Forwarded, X-Real-IP, method and path overrides, `Expect` and Next.js's
+  own headers never go on; the proxy writes X-Forwarded-For (the last address the app received, and only ever an IPv4
+  or IPv6 address) and X-Forwarded-Host and -Proto (the app's configured origin, else the request's). A module whose
+  root is a path on the app is called at this server's own host and port, over http (was: the request URL's protocol,
+  which Next.js takes from X-Forwarded-Proto), and never at the configured origin or anywhere a request header names.
+- **`configureServerApi({ origin })` must not trust the Host header.** `serverApi` calls a relative root at that origin,
+  so one built from a request's Host lets a client pick an address on the server's machine. The template's
+  `api-setup.ts` now takes the Host only as `localhost:<PORT>` or `127.0.0.1:<PORT>` (Next.js sets `PORT` to the port
+  it listens on); an app with a copy of the older one, which took any localhost port, should change it the same way.
+- **A server call can say who the client is.** `lastForwardedAddress` (which now takes anything with a `get`, Next.js's
+  `headers()` included) and `readIpAddress` are exported from `nexus-shared/server`: the client's address as the proxy
+  reads it, an IP address or nothing. The template's `api-setup.ts` uses the first in `configureServerApi({ headers })`
+  to give Identity calls, and only them, `X-Forwarded-For` and the browser's `User-Agent`: sign-in leaves from the
+  server, and Identity's rate limit counts per address. An app that signs in through `serverApi` should do the same,
+  for Identity's calls only, since reading the request makes a page render per request.
+- **New options** `responseHeaders`, `passCookies`, `maxBodySize` (100 MB), `maxRedirects`, `clientAddress`,
+  `allowCrossSite`, `failure`, `onProblem`; **new exports** `DEFAULT_PROXY_RESPONSE_HEADERS`, `DEFAULT_PROXY_BODY_LIMIT`,
+  `DEFAULT_PROXY_REDIRECTS`, `PROXY_REFUSALS`, `nexusFailure`, `lastForwardedAddress`, `readIpAddress` and the types
+  `ApiProxyFailure`, `ApiProxyProblem`, `ApiProxyCode` (`nexus-shared/server`), and `serverAppOrigin`.
+- **A backend on a development certificate**: the proxy now calls the backend's https address itself, and Node.js
+  trusts ASP.NET Core's development certificate only when started with `NODE_USE_SYSTEM_CA=1` (or
+  `NODE_EXTRA_CA_CERTS`). Without it such a module answers 502 `BACKEND_UNREACHABLE`, and the server's log says why.
+
+### The code box
+
+The owner, 2026-10-08: one shared input for codes typed a box to a character - one-time codes, SSNs, and more - as
+dynamic as possible (numbers, strings, hex). New exports, nothing removed:
+
+- **`CodeBox`** (`nexus-shared/client`): one real input lying unseen over a box per character, so autofill
+  (`autoComplete="one-time-code"`), a paste and a screen reader see one field. `length` or `groups`, a `separator`
+  outside the value, `characters` (`digits`, `letters`, `alphanumeric`, `hex`) or an `allowed` one-character pattern,
+  `letterCase`, `masked`, `slotPlaceholder`, `block`, `onComplete`, and the field shell's label, hint, error, sizes and
+  read-only note.
+- **`type: "code"`** in `InputParams` (`CodeInputParams`): `renderInput`, `validateInput`, `normalizeInputValue` and
+  `formatInputValue` know it.
+- **One typing model** for every way text arrives - a key, a phone's keyboard or its suggestion, an input method, a
+  paste, autofill: a whole code replaces everything; a character replaces a selected box, or goes into the box with the
+  ring - inserted while the code has an empty box, so a box Backspace removed takes the right digit back, and over that
+  box once the code is full. ← → Home End select box by box, and a full code's caret selects its last box. An input
+  method's word goes in once, when it commits. A pasted message gives its one code ("Your 2-step code is 482913" is
+  482913; "482 913" and "123-45-6789" are read whole), or nothing when it holds more characters than boxes and no one
+  code. `onComplete` runs once per code, and again once the boxes were short - by typing, a form's reset, or the page
+  emptying a controlled `value`.
+- **A saved code is never cut**: `value`, `defaultValue` and a form's loaded record (`normalizeInputValue`) lose only
+  separators, case and a hex "#". A code the boxes cannot hold is kept, shown invalid at once, and a form refuses to
+  save it. The over-long message names the count: "The code is 6 digits long, not 7."
+- **What a screen reader hears** is what the boxes show: "9 digits, in groups of 3, 2 and 4", "8 digits: DD/MM/YYYY".
+  A read-only code shows the accent border on every box while it has focus.
+- **Styles**: a box without `block` keeps its own width (`.nx-code:not([data-block]) .nx-code__slot`), about as wide
+  as it is tall, and the boxes shrink alike on a narrow screen.
+- **Helpers and types** (`nexus-shared`): `validateCode`, `formatCode`, `codeGroups`, `codeLength`, `loadCode`,
+  `codeFits`, `describeCode`, `readCodeText`, `typeCode`, `settleCode`, `moveCode`, `codeAfterInput`,
+  `CODE_CHARACTER_PATTERNS`, `DEFAULT_CODE_LENGTH`, `CodeCharacters`, `CodeRules`, `CodeShape`, `CodeEdit`, `CodeText`,
+  `CodeMove`; `normalizeCode` stays exported, though the box itself now loads a code with `loadCode`.
+
+### Another record's name, joined by the database or by the table
+
+Added only; nothing an app uses changes (2026-10-08, the owner: "some columns we joined into DB, some frontend").
+
+- **A column whose value is another record's** (`TableColumn.join`): the row holds the key (`from`), and the table asks
+  the source once for every key its rows hold - a Nexus controller's `findListing`, or a `TableJoinSource` of the
+  page's own - then shows the record's field, searched, sorted, exported and shown in the details like any column. A key
+  with no record shows "Not found". `crudColumns.clientJoin(SUB_REGIONS, { key: "subRegionName", label: "Sub-region",
+  from: "subRegionId" })` is the Nexus form.
+- **One cache for the page** (`tableJoins`, `Helpers/TableJoins.ts`): keys asked for in the same moment by every table and
+  picker go in one call per source; a call already out is waited for; answers are kept 5 minutes (`JOIN_LIFETIME`) and an
+  aged one is still drawn while it is asked again; a failed call is not repeated for 30 seconds. A Reload of a table, and
+  a `Crud` write on the controller looked up, mark its answers old (`expireLookups`).
+- **A short tag after a value** (`TableColumn.tag`), and the one every reference to a record gets when that record is no
+  longer available: `CrudBackend.unavailableTag(status)` - Nexus: "Trashed" (warning) from 40, "Deleted" (danger) from 60,
+  none for a live record. `crudColumns.dbJoin({ key: "regionName", label: "Region", status: "regionRecordStatus" })` reads
+  it from a status the database joined into the row; `clientJoin` from the record it looked up. New class
+  `.nx-table__tag--after`.
+- **A picker of a controller's usable records** (`crudPicker(REGIONS, { labelKey: "regionName" })`, `nexus-shared/client`):
+  its `ActiveListing` read once for the page and searched in the browser, a saved value it no longer offers found through
+  the same cached `findListing`, tagged and never offered again. `CrudBackend.isPickable(record)` - Nexus: under 30.
+- `TableStore.refreshValues()` searches and sorts again when values changed without the rows; `CrudEndpoints` takes the
+  `findListing` and `activeListing` an `apiController` already has.
+
+### Pins and favourites from one call
+
+Two things move for an app:
+
+- **A CRUD built from `apiController` now reads `BookmarkListing` and writes `SwitchBookmarks` / `MassSwitchBookmarks`**,
+  the Nexus backend's names since 2026-10-07. An app whose backend still answers only `PinListing` / `Pin` / `MassPin`
+  passes its own endpoints without `bookmarks`, `bookmark` and `mass.bookmark`, and keeps the pin-only behaviour.
+- **The section classes are renamed** (an app's override of an old name stops matching):
+
+| Was | Now |
+|---|---|
+| `tbody.nx-table__pins` | `tbody.nx-table__section[data-section="pins"]` (and `"favorites"`) |
+| `.nx-table__pin-row`, `__pin-cell`, `__pin-toggle`, `__pin-caret`, `__pin-icon`, `__pin-title`, `__pin-count`, `__pin-loading` | `.nx-table__section-row`, `__section-cell`, `__section-toggle`, `__section-caret`, `__section-icon`, `__section-title`, `__section-count`, `__section-loading` |
+| `.nx-table__pin-mark` | `.nx-table__mark`, inside `.nx-table__marks` |
+| `data-pinned` on a section's row, `data-table-pins` on its toggle | gone: `data-section` on the section |
+| saved `pinsOpen` | `openSections` (an old `pinsOpen: true` still opens the pinned section) |
+
+What is new (the owner's rules, `Project-Skills/README.RULES.md`, "Rules for Favorite or Pin"):
+
+- **Favourites beside pins, from one call.** `CrudEndpoints.bookmarks` (`Room/BookmarkListing`) answers every record
+  this user marked, each with its bits (`bookmarkTypes`: 1 pinned, 2 favourite); `Crud` splits them into a **Pinned**
+  and a **Favourites** section above the active list, each folding on its own and remembered. The lists' own rows need
+  not carry marks: every record's marks come from that call.
+- **The marks show where a row's number is**, one under the other: a pinned favourite wears the pin above the star, in
+  the list and in both sections, with no column of its own (the owner, 2026-10-08). `DataTable` takes
+  `rowMarks(row)`; a section's row with none wears the section's icon.
+- **Directed switches, never a toggle.** Pin and **Add to favourites** / **Remove from favourites** on a row send the
+  record's whole set (`bookmark`, `?bookmarkTypes=3`, built by `CrudBackend.marksRequest`); on a selection they send
+  one bit and the way (`mass.bookmark`, `?bookmarkTypes=2&isAdding=true`, `massMarksRequest`), only the records it
+  is for, and a selection is offered only the ways it can still go - both, when it is mixed. Bits the package does not
+  know are kept. While a whole-set backend's marks are not read yet, the actions wait and say why.
+- **A limit each:** `configureCrud({ maxFavorites })`, the same as `maxPins` unless set (`markLimit`). Nothing is ever
+  taken off to meet a lowered limit.
+- **No reload:** a switch's answer (`answeredMarks`, or the ids a mass switch answers) is written into the sections,
+  the table and every list kept. A record trashed leaves the sections and keeps its marks; recovered, it comes back.
+- `DataTable` takes `sections` (`TableRowSection`: key, label, icon, rows, loading, max); `pinnedRows` and the other
+  `pinned*` props stay, as one section with the key `pins`. Select by **Favourites** / **Not favourites**. The message
+  builder knows `favorite` and `unfavorite` ("3 guests added to the favourites."). New helpers: `CRUD_MARKS`,
+  `CRUD_MARK_BITS`, `hasMark`, `withMark`, `markLimit`, `markDirections`, `markedRecords`, `patchMarkedRecords`,
+  `dropMarkedRows`, `crudMassEndpoint`.
+- **Needs `nexus-icons` with `iconStarOff`**, which is new in its source (not on npm): release `nexus-icons` with a
+  raised version first, and raise this package's `nexus-icons` range to it.
+
+### A CRUD page passes params and the CRUD does the rest (2026-10-08)
+
+The owner: *"we just pass params no logic, due to we have 1000+ similar page"*. What the Regions page did itself is
+now `Crud`'s, so a page is its controller, columns and inputs:
+
+- **`apiController(module, controller, subject, options)`**: `commands: "switch"` (the default, the Nexus backend since
+  2026-10-07: `SwitchFlag`, `MassSwitchFlag`, `BookmarkListing`, `SwitchBookmarks`, `MassSwitchBookmarks`) or
+  `"toggle"` (`Flag`, `MassFlag`, `PinListing`, `Pin`, `MassPin`), and `without` for what a backend lacks (`"pages"`,
+  `"audit"`, `"flag"`, `"marks"`, `"mass.description"`, ...). **The return type now marks those members optional**
+  (`pages`, `pagination`, `flag`, `audit`, the marks, the mass actions): a caller that reads one adds `!` or `?.`.
+  `MODULES.controller` takes the same options.
+- **A directed flag.** Flag and Unflag send the way (`CrudBackend.flagRequest`, Nexus `?isFlagged=`); a selection is
+  offered Flag and Unflag only as it can still go, sends only the records each is for, and says "the other N already
+  were" when the answer lists fewer. `NexusCrudBackend.isFlagged` is the band 25-29, and `canFlag` keeps Flag off a
+  pending record (30-39). The old "Flag / unflag" toggle of a mixed selection is gone.
+- **History built in.** With an `audit` endpoint the person may call, every row offers **History** and the details
+  **View history**: `AuditHistory` and `openAuditHistory` (moved from nexus.web), its words from
+  `CrudBackend.auditWords`.
+- **Presets:** `crudColumns.status()`, `.description()` (a `markdown` column: text in the table, formatted in the
+  details), `.added()`, `.changed()`, and `crudInputs.description()` (Markdown, 1000 characters, one hint for every
+  model). `TableColumn.markdown` is new.
+- **A Create answered with the payload** (no status, so no list can place it) is read back once through `details`.
+- **The export names the list on screen** (`CrudBackend.exportFilters`, Nexus `{ flag: 50 | 52 | 54 | 55 }`).
+### The theme panel: grouped, twice as wide, and the input design (2026-10-08)
+
+- **Input design is a quick preference** (`UserPreferences.inputDesign`, key `nx-input-design`): Standard, Outlined or
+  Inbox for every labelled input whose page and form name none (`useInputDesign`). An input with a design of its own
+  (a grid's cells) keeps it, and one with no label (a table's search box) stays standard: it has no label to place.
+- **`ThemeSwitcher`'s panel is 680px wide** (was 340), its settings in named sections two to a row - Theme across the
+  top, then Appearance, Language and region, Dates and times, Numbers, Tables, and Forms (the input design, with a box
+  to try it) - and one under the other on a narrow window. `ThemePicker`'s card group is named Colors now, under Theme.
+
+- **`Crud` takes `backend`**, for an app whose pages sit on two backends. `CrudBackend` gains `canFlag`, `flagRequest`,
+  `exportFilters`, `statusText` and `auditWords`, each with a default, so an app's own backend class still compiles.
+
+## 3.1.0
+
+**New features, no code break.** Every export of `3.0.0` is still exported (49 are new: 33 from `nexus-shared`, 16 from
+`nexus-shared/client`), and no exported constant changed its value, so `^3.0.0` takes it. The owner chose the number
+on 2026-10-08. What can move for an app is its **stylesheet overrides**: these class names and custom properties were
+renamed or dropped, and an override of the old name no longer applies.
+
+| Was | Now |
+|---|---|
+| `.nx-columns__head`, `__title`, `__count`, `__foot` | `.nx-table-panel__head`, `__title`, `__count`, `__foot` |
+| `.nx-table-panel__body` | `.nx-popover__scroll` |
+| `.nx-chat-avatar`, `--nx-chat-avatar` | `.nx-avatar`, `--nx-avatar-size` |
+| `.nx-table__frame`'s border | on `.nx-table` |
+| `--nx-field-scrollbar`, `--nx-field-scrollbar-hover`, `--nx-dropdown-scrollbar`, `--nx-time-scrollbar` | gone: one thin bar everywhere |
+| `.nx-form__skeleton*` | gone: a loading form shows its real inputs, disabled |
+| `.nx-excel__refused` | gone: the import's report lists are `.nx-excel__problems` |
+
+- **Bulk insert, and rows added to an import (the owner, 2026-10-07).** `ExcelImport` and `openExcelImport` take
+  `mode: "bulk"`: the import with no file, its new rows' editor opening with one empty row for the person to type
+  into, sent to the same `Excel/Import` with the same checks, a problem then naming its row ("Row 3 · Region name").
+  `DataTable` offers it as **Bulk insert** beside **Import from a spreadsheet**, and only beside an Add, as it is an Add
+  of many rows (`TableExcel.bulk: false` leaves it out). A sheet with a required list cannot be typed in - a list's key
+  is picked in the spreadsheet - and the panel says so; its file review takes no added rows either. Any other file's
+  new rows take Add, Insert and Duplicate: an added row is numbered after every row the file had
+  (`excelSheetRows(rows, columns, after)`), and one left empty is dropped, not refused. The new rows no longer fold
+  away (folding unmounted the editor and lost every edit), the footer counts what will be sent, and the review is inert
+  while an import is out.
+- **Nothing typed is lost unasked.** Closing the window, or Start over, over rows typed or changed in it asks first
+  (`ExcelImportHandle.unsavedRows`); picking the entry again while its window is minimized brings that window back
+  rather than a fresh one. An untouched date or time is no edit: `toInputValue` reads them as their inputs do.
+- **An import that wrote nothing keeps its rows** and lists under them each refusal, by row, in the backend's words:
+  `readExcelResponse` keeps a refusal's report (`result`, as XLS_X044 sends it) instead of dropping it, so the panel no
+  longer says only "No Region was added". Refusals read in row order.
+- `ExcelEditorRow`'s three own fields are optional, as an added row has none; new helpers `excelRowNumber`,
+  `hasExcelValues` and `isExcelRowTyped`, and `excelProblemPlace(problem, byRow)`. `RowsInputHandle.remove(index,
+  { undo: false })` drops a row with no Undo offered, and keeps the person's own last Undo where it was.
+- **A list shows what an import wrote.** After an import, `DataTable` runs `excel.onImported` first and reads its rows
+  after it: a `Crud` drops its cached lists there, and the reload used to be asked before, so on a page just opened it
+  was answered from the cache and the imported rows stayed off the screen until a reload.
+- **What imported records start as.** `ExcelSettings` gains `recordStatuses` (`ExcelRecordStatus`: `value`, `label`)
+  and `defaultRecordStatus`; when a model offers any, the import shows "New records start as", the default picked,
+  and sends the choice (`importExcelRows(..., { recordStatus })`; `ExcelBackend.importRequest(rows, recordStatus?)`,
+  the Nexus one sending `{ rows, recordStatus }`). The report says "3 cities added as In review".
+- **`Crud`, from the owner's review on 2026-10-07.** The active list is labelled **Active**, not "All" - it leaves out
+  the trash and the deleted. **Recover asks first** ("Recover Asia?", "It goes back to the active list."), one record
+  or many, like trash and delete. Recover and Move back to trash wear the back arrow (`iconArrowBackUp`): the
+  clock-shaped restore icon read as History beside a page's history action.
+- **`details.actions`**: buttons of the page's own in the details popup's footer, before Edit and Close
+  (`CrudDetailsAction`: `id`, `label`, `icon`, `endpoint`, `hidden`, `onSelect(row, popup)`). One that names an
+  `endpoint` shows only to a user who may call it, by the rule every built-in action follows.
+- **The spreadsheet import, as the owner asked on 2026-10-07.** Once a file is picked, the steps and the template and
+  file buttons give way to the file's name; another file is a Start over (now a bordered button) or a fresh popup. The
+  rows already there are read-only and never sent, and the footer says they are skipped. The new rows have Remove and
+  Lock at their end. After an import the review is gone: the panel shows what was added, what was not written and why,
+  and what was skipped and why. The `nx-excel__refused` list is gone with it; the report's lists are
+  `nx-excel__problems` blocks.
+- **`TabularForm` `actionsAt="end"` and `lockable`.** The row's actions in a column fixed at the right edge, as a data
+  table has them: Remove and Lock as buttons of their own, anything else in a menu after them. A locked row's inputs
+  are read-only ("Locked: unlock the row to change it.") and it cannot be removed; the locks are the screen's, never
+  the value's.
+- **A tabular form no longer jumps when a cell is clicked.** The line under the table, which holds the hint or the
+  message of the input with focus, keeps its height whether or not it says anything.
+- **A slow answer lands in the list the user moved to.** `Crud` writes an action's answer into the table only when
+  the table still holds the list the action was asked from, fully loaded. Otherwise (the user switched lists while
+  the request was out, or a list is still loading) it patches every cached list and reads the one on screen again from
+  them, stopping a load that may have been asked before the change. Before, a record trashed from the active list and
+  answered after a switch to the trash was written over by the stale trash list and showed in neither list until the
+  page was opened again. The same rule covers `handle.apply`, Add, Edit and the read-back after an Add; a Create that
+  answers no key now loads the list instead of showing the cached one.
+- **The theme panel is a quick preference panel.** Under the theme, `ThemeSwitcher` now shows `PreferencesPicker`
+  (`preferences={false}` leaves it out): Language and region (interface language, calendar), Dates and times (date
+  picker language, clock, display date format: the existing `DatePreferences`), Numbers (number scale, thousands
+  separator) and Tables (default page size, a row click opens the record). New: `UserPreferences`,
+  `readUserPreferences`, `setUserPreferences`, `useUserPreferences`, `subscribeUserPreferences`, `useNumberLocale`,
+  `DEFAULT_USER_PREFERENCES`, `PREFERENCE_STORAGE_KEYS` (`nx-language`, `nx-number-scale`, `nx-thousands`,
+  `nx-page-size`, `nx-row-click`), `InterfaceLanguage`, `ThousandsSeparator`, and `ENumberScales` (the core's enum, by
+  member value).
+- **Numbers follow the person's settings.** `numberLocale(scale, separator)` gives `en-US`/`en-IN` or a key such as
+  `"en-IN|.|,"` that `formatNumber`, `parseNumber` and `getNumberSymbols` read. `NumberBox` and `Slider` use it when
+  they have no `locale` (they defaulted to `en-US`, which is still the setting's default), and so do a `DataTable`'s and
+  `CrudDetails`' number cells (`CellTextOptions.locale`, new). A number box rewrites its text when the setting changes.
+- **`DataTable` `pageSize` and `openOnClick` give way to the person's choice once it is made**: the default page size
+  (when the table offers it) and the row click. A page size picked in a table with a `stateKey` still wins, and that
+  table now saves a size only when it differs from the one it opens with, so a later default reaches it.
+- **Animations: On, Off or System, chosen in the theme panel.** `ThemeScript` now writes `data-nx-motion`
+  (`reduce` or `full`) on `<html>` before the first paint, from the visitor's choice (`data-nx-animations`, saved as
+  `nx-animations`) and the system's `prefers-reduced-motion`, and keeps it current when the system setting changes.
+  **Every stylesheet reads that attribute instead of the media query**, and so does script motion (the popup's
+  minimize and maximize, smooth scrolls). On animates on a machine whose operating system turned animations off; Off
+  never animates. An app that does not render `ThemeScript` animates whatever the system says. New: `AnimationMode`,
+  `setAnimations`, `motionFor`, `REDUCED_MOTION_QUERY`, the `ANIMATIONS_*` and `MOTION_ATTRIBUTE` constants, and
+  `useTheme()`'s `animations`, `motion` and `setAnimations`.
+- **Density: Compact or Cozy.** `data-nx-density` on `<html>` (`nx-density`; `setDensity`, `useTheme().density`).
+  Cozy makes `--nx-control-sm/md/lg` 32/38/44 and the new `--nx-row` 38; compact is exactly the old sizes. Table rows
+  and headers, menu items, dropdown options and the Columns panel's lines are now sized from `--nx-row`, so they
+  follow it. `ThemeScript` takes `defaultDensity`.
+- **Scale grid, development builds only**: Off, px (a line every 4px, solid every 48px) or mm (millimetres, solid every
+  centimetre), drawn over the window on `[data-nx-grid] body::after`. `ThemeScript`'s `grid` and `ThemePicker`'s
+  `showGrid` default to `isDevelopmentBuild()`, so a production build neither shows the section nor applies a saved
+  grid. New: `ScaleGrid`, `setScaleGrid`, `isDevelopmentBuild`.
+- **`ThemePicker` / `ThemeSwitcher`** add Density, Animations and Scale grid under Mode and Theme (`showDensity`,
+  `showAnimations`, `showGrid`).
+- **Popups fade in and out** (160ms in, 120ms out), with nothing else moving: the slide and scale are gone. **Every
+  popover panel fades** in and out in 120ms through one rule on `.nx-popover`; the menu's, the table panels' and the
+  dropdown's own opening animations are gone. A closing panel takes no clicks, and nothing waits for a fade.
+- **Popover panels fit the window.** `placeUnderAnchor` and `placeAtPoint` pick the side that fits, or the one with
+  more room, and write that room as `--nx-popover-room`; a panel that marks its scrolling part `.nx-popover__scroll`
+  is never taller than it. That part reaches the panel's right wall, so its scroll bar sits on the wall, and carries
+  the right padding inside. Menus, the theme panel and the table's Columns and Filters panels use it; `usePopoverPanel`
+  lost its own height cap. New `showPanel` opens a panel scrolled to the top, and a hovered menu item no longer scrolls
+  its list. Placing an open panel again (on every scroll) no longer throws its list back to the top.
+- **A panel's padding is `--nx-popover-pad`.** `.nx-popover`'s own padding loaded after the menu's and the table
+  panels', so a menu was 16px inside its edge, not the 4px it asked for, and the table panels 16px, not 8px; both now
+  get theirs. `.nx-table-panel__body` is gone (`.nx-popover__scroll`).
+- **One thin, quiet scroll bar everywhere, the design lab's.** `Nexus.Base.css` gives every element
+  `scrollbar-width: thin` and a thumb of the text colour at 22% on no track. The theme panel, menus and context menus,
+  the table's Columns and Filters panels, popup bodies, the date-time panel, the chat, code blocks and tables in
+  Markdown and rich text, and the admin page and menu drew the browser's 15px bar with a painted grey track; on
+  Windows, Chrome and Edge now draw every bar 10px wide, as the lab does (Firefox's thin bar is 8px; Safari draws its
+  own thin bar). The components' own bars are gone: the 8px `::-webkit-scrollbar` pill of the text area, the Markdown
+  preview and the rich text (Chromium and WebKit ignore it once `scrollbar-width` is set), and the thin bar with a
+  stronger thumb of the tree, the tabular form, the dropdown list and the time picker. The data table's rows keep
+  theirs (`Nexus.Table.css`) until a later change, and the time picker's columns still hide the thumb until the
+  pointer or the keys are in them. `--nx-field-scrollbar`, `--nx-field-scrollbar-hover`, `--nx-dropdown-scrollbar` and
+  `--nx-time-scrollbar` are gone; the text area's resize grip reads `--nx-field-grip`. Room kept for a bar narrows with
+  it: every `scrollbar-gutter: stable` (the admin page and its bar, whose right edge moves from 27 to 22px off the
+  window, the chat thread, the dropdown list) and the padding a modal popup keeps for the page's bar
+  (`--nx-scrollbar-gap`, measured).
+- **A form whose values load shows its real inputs, disabled, instead of placeholders.** A `Crud`'s Edit popup, an
+  `ApiForm` with `loadValue` and a `Form` with `loading` have their final size from the first frame, and the values
+  land in the same inputs, as a load (no "Unsaved changes", no "Discard your changes?"). While loading, `FormStore`
+  takes nothing typed, even from an input whose `disabled` was taken off by hand, and draws such an input again from
+  the store when loading ends; a submit already waited. The `.nx-form__skeleton*` classes and their animation are gone.
+- **The form's status line keeps its one line when empty, and a form's bar fills a popup's foot**, so the status sits
+  beside the buttons: "Loading…" or "Unsaved changes" coming and going no longer moves the bar, and a `Crud` popup
+  lost the empty 12px row it had above its buttons.
+- **`Avatar`** (`nexus-shared/client`): a person's round picture, or their initials on a soft tone without one or
+  when it fails to load. `size` `sm`/`md`/`lg` or `--nx-avatar-size`; `onChangePicture` makes it a button with a
+  camera over it on hover. The chat's and the dropdown's avatars are now this one: `ChatAvatar` and
+  `DropdownAvatar` still exist and draw it, `.nx-chat-avatar` is gone (`.nx-avatar`), `.nx-dropdown-avatar` stays
+  as the dropdown's size, and `--nx-chat-avatar` is `--nx-avatar-size`.
+- **`Button` `dot`**: a small dot on the corner, for something new behind it such as unread notifications; `"primary"`
+  marks a state that is on, such as filters.
+- **`Menu`: a control inside a heading is chosen like a row.** An entry `{ heading: <node> }` may hold a button with
+  `role="menuitem"`: the arrow keys walk it with the rows, and a click on it closes the menu. A menu opened from the
+  keyboard still starts on its first row.
+- **The data table is one frame**: the bar, the rows and the footer sit in one border (`.nx-table` carries it now,
+  not `.nx-table__frame`), with a line under the bar and the footer as the bottom band (`--nx-footbar`, a new
+  token). An empty bar takes no room. Column headings are 12px, weight 650.
+- **`DataTable` `add`**: the table's own Add, first in the bar. With `excel`, it is a split button whose arrow holds
+  Download template, Import from a spreadsheet and Export to Excel, which then leave the options menu. `Crud`
+  passes its Add this way.
+- **The data table's bar is one line on a wide table, in a new order**: the Add section (`add`, then the page's
+  `actions`) and the lists (`toolbar`) on the left; Reload, the options menu (⋮) and the search, rows per page inside
+  it, on the right. It was the lists, the search, Reload, ⋮, `actions` and Add, wrapping where they fell: at 1126px
+  on the admin shell the bar broke into three ragged rows. A narrower table now moves whole parts, by its own width
+  (container queries on `.nx-table`): under 670px the search takes the top line (with nothing on the left, it leads
+  the buttons' line), under 375px Reload moves to the end of ⋮ (`DataTable` asks the hidden button, so the width is
+  written once, in the stylesheet), and under 325px, beside lists, the Add section takes the last line with its buttons
+  sharing it. On the admin shell those are windows of 695, 400 and 350px. A bar wider than those widths expect (a
+  long Add label, the page's own buttons, cozy density) is squeezed into the next step as soon as a line would break
+  (`data-squeeze` on `.nx-table__bar`, set a frame after a size change). A `toolbar` or `actions` that renders
+  nothing takes no room and decides no step, and a bar left with nothing else is hidden. New classes
+  `.nx-table__bar-add` (Add and `actions`) and `.nx-table__reload`; the search is now a child of `.nx-table__bar` after
+  `.nx-table__bar-end`, not inside it, and grows to 19rem from a 12rem basis.
+- **Columns opens from the options menu (⋮)**, as its first item; the bar has no Columns button. Reload, Columns
+  and the options button are ghost buttons. `TableColumnsPanel` takes an `anchor` and an `open()` handle for this.
+- **`TabButtons` `labels="auto"`**: every label while its container (a data table) is at least 900px wide, only the
+  chosen one's below. `Crud`'s lists use it.
+- **`DataTable` `selectBy`**: while rows are selected, their count opens a menu that selects again by what the rows
+  are: All on this page, then each `{ label, icon, test }`, which leaves exactly the matching rows on the page
+  selected. `Crud`'s main list offers Pinned, Not pinned, Flagged and Not flagged.
+- **`SplitButton` `fixed`**: the main button never changes; the menu holds other ways to do it, run when picked.
+- **`DataTable` `filterInputs`: an advanced filter.** Input params, each named after the column it filters, become
+  **Filters** in the options menu (⋮): a small form under the button, applied as it changes. The values are
+  `TableQuery.filters` (`TableStore.setFilters` sets them, `{}` clears); a client table matches them in `queryRows`
+  (a fifth argument), and a server gets them flat by name through `CrudBackend.pageRequest`'s third argument, as
+  `filterRequest` writes them (a date range as `{name}From`/`{name}Before`). A `CrudBackend` or loader of your own
+  ignores them until it reads that argument or `query.filters`. Also new: `activeFilters`, `asFilterInput`,
+  `filterMatcher`, `filterNames`; `usePopoverPanel` and `PopoverPanelHandle` (`nexus-shared/client`), the panel
+  Filters and Columns share; `followAnchor`'s second argument, a panel whose size it follows too.
+- **Renamed: `.nx-columns__head`, `__title`, `__count` and `__foot` are `.nx-table-panel__*`**, shared by both panels.
+  An override of the old names no longer applies.
+
+## 3.0.0
+
+**Breaking. This changes the value of exported constants, and `2.0.0` is on npm with the old ones.** Publishing it
+as a patch or a minor would hand `^2.0.0` consumers different numbers under a compatible-looking range, which is the
+worst way to ship this, so it takes a major. The owner chose the number on 2026-10-02, together with `nexus-public`
+and `nexus-admin`, which both depend on this package and so move to `3.0.0` with it; their `nexus-shared` range is
+now `^3.0.0`, because a bump of this one alone would leave them pulling the old, wrong constants.
+
+**`nexus-icons` must be installed at `1.1.0` or newer**, and the dependency range here says so. The chat components
+added in this version use `iconChecks`, `iconCornerUpLeft`, `iconMessageCircle`, `iconPaperclip`, `iconSend` and
+`iconUserPlus`, none of which exist in `nexus-icons@1.0.0`: with the old range a fresh install resolved to `1.0.0`
+and the build failed on six missing exports.
+
+### `NexusModule` — `Chat` added, and every module after it moved up one bit
+
+The backend's `EModules` gained `Chat` at bit 6, and everything after it shifted. `NexusModule` follows it exactly.
+A permission is a bitmask of these flags, so a package that kept the old numbers would grant and deny the wrong
+modules without any error to show for it.
+
+| Module | Was | Now |
+|---|---|---|
+| `None` | 0 | 0 |
+| `Migrations` | 1 | 1 |
+| `Configuration` | 2 | 2 |
+| `Identity` | 4 | 4 |
+| `Enterprise` | 8 | 8 |
+| `Drive` | 16 | 16 |
+| `Message` | 32 | 32 |
+| **`Chat`** | *(did not exist)* | **64** |
+| `Accounting` | 64 | **128** |
+| `Report` | 128 | **256** |
+| `Requisition` | 256 | **512** |
+| `Tenant` | 512 | **1024** |
+| `Subscription` | 1024 | **2048** |
+| `Reservation` | 2048 | **4096** |
+| `School` | 4096 | **8192** |
+| `Pharmacy` | 8192 | **16384** |
+| `Staffing` | 16384 | **32768** |
+| `Portfolio` | 32768 | **65536** |
+
+`NEXUS_MODULES` gained the matching entry (`key: "chat"`, `label: "Chat"`, `env: "API_CHAT"`), so `Chat` can be
+looked up, proxied and named in messages like every other module.
+
+**What to check when you upgrade.** Code that uses the names (`NexusModule.Reservation`) needs nothing. Anything
+that stored, transmitted or hard-coded a **number** has to be revisited:
+
+- permission masks saved in a database, a cache, a token claim or a settings file;
+- proxy URLs written with a number in place of a key (`/api/app/2048/…` is now `/api/app/4096/…`, and `reservation`
+  by key has always worked and still does);
+- a backend that has not taken the `Chat` shift yet — both sides move together or neither does.
+
+### `NEXUS_FLAGGED_STATUS` — 15 → 25
+
+The owner settled the record-status bands, and `ERecordStatus.Flagged` is seeded at **25**. `NexusCrudBackend`
+decides whether a row is flagged by comparing `recordStatus` to this constant, so a package on 15 while the backend
+writes 25 shows the wrong flag on every row, and flagging one writes a status the backend does not recognise.
+
+The bands, for anything that reasons about them:
+
+| Band | Range |
+|---|---|
+| Active | 0–39 |
+| — Active account | 0–29 |
+| — Flag | **25–29** |
+| — Pending, unverified, in review, approval required | 30–39 |
+| Trash | 40–59 |
+| Delete | 60 and above |
+
+`NEXUS_ACTIVE_STATUS` stays 0, and the `recordStatus < 40` reading of "a live record" that the rest of the code
+already assumes stays right.
+
+Note that **the flag is a range, 25–29, and this release still checks a single value.** Only the seeded member at 25
+has a meaning today, and the bands are about to become configurable per project, so a range-aware check belongs with
+that work rather than here. Do not read the single value as the final answer.
+
+### Removed: the archive
+
+The owner removed the archive on 2026-09-30: a record is live, in the trash, or deleted, and the way back from
+deleted lands it in the trash. The second put-away list and its second recovery path were the only reason the CRUD
+had both Restore and Recover, and the bands close up behind it — **Trash is 40–59 and Delete 60 and above**, so
+nothing stored keeps a meaning it no longer has. `recordStatus < 40` still reads "a live record".
+
+What goes, all of it breaking for anything that named it:
+
+- `CrudMode` loses `"archive"`, so a CRUD shows All, Flagged, Trash and Deleted.
+- `CrudRowActionName` and `CrudMassActionName` lose `"archive"` and `"restore"`. Recover, the trash's own way back,
+  is untouched: a CRUD that offered both now offers one.
+- `CrudEndpoints` loses `archive` and `restore`; `apiController` stops naming `Archive`, `Restore`, `MassArchive`,
+  `MassRestore`, `ArchiveListing` and `ArchivePagination`, and `lists`/`pages` lose their `archive` key.
+- `MessageActionName` loses `"archive"`, and the message builder its words and its "It can be restored from the
+  archive." confirmation detail. `"restore"` stays in the vocabulary: it is a plain verb, not the archive's.
+
+**What to check when you upgrade.** A CRUD that listed `"archive"` in `modes` or `actions` no longer compiles,
+which is the point — the endpoint behind it is gone from the backend too. A backend that still answers
+`ArchiveListing` is not asked for it any more.
+
+### Added: the chat
+
+A discussion on any record — a leave request the manager and a co-worker talk through, a purchase order, an
+applicant, a tender — behind one icon that says whether anything is waiting. Nothing that does not use it changes.
+
+- A conversation is named by three values, `ChatScope`: the **domain** (which kind of record), the **parent id** (the
+  record) and the **user id** (who is reading). The domain is the app's own enum, given either as a template
+  (`<Chat<EDomainTypes> …>`) or once in `ChatRegister`, the same way `ApiRegister` names the module enum. Without one
+  it is a plain number.
+- **No domain numbers are defined here.** They belong to the backend's `EDomainTypes`, and the warning at the top of
+  this file applies to them in full. `defineChatDomains` only gives an app's domains their names on screen.
+- `ChatButton` is an icon in three looks: quiet with no messages, the accent on its tint once there are messages, and
+  the accent filled with an unread badge once some are unread. One size in all three, with the badge over the corner,
+  so a column of them in a table does not move as the counts arrive.
+- `ChatSummaryCache` fills every icon that mounted in the same moment with **one call per domain**. A list whose rows
+  already carry their counts passes `summary` and makes no call at all.
+- `Chat` is the icon with the conversation in a popup; `ChatPanel` is the conversation on its own, for a record's own
+  page. Messages are **Markdown**: written in `MarkdownEditor` and drawn by `MarkdownView`. Enter sends and
+  Shift+Enter starts a line, except in a list or a code fence, where the editor keeps Enter; `sendKey="modifier"`
+  moves sending to Ctrl+Enter.
+- One mark where the time sits says how far a message of your own has got: a spinner while sending, a tick once the
+  server has it, two once `deliveredTo` holds somebody, two in the accent once `readBy` does.
+- Where the data comes from is one interface, `ChatSource`. `apiChatSource` goes through the app's `ChatBackend`
+  (`NexusChatBackend` by default); `localChatSource` keeps a conversation in memory for a demo or a test.
+- **The Nexus endpoints are the shape the Chat module is expected to take, not an API that answers today.**
+  `NexusModule.Chat` is a number and a proxy key; the controller is not built. Each difference, when it lands, is one
+  override on `NexusChatBackend`.
+- `check:themes` gained a rule: body text on the primary tint, which is a message bubble of your own. Every theme
+  clears AAA except catppuccin light at 6.84, so it is held to the AA 4.5 that applies to body text.
+- **A record holds many conversations.** `ChatScope` names the record; each conversation in it is a
+  `ChatConversation` with its own id and a type, `one-to-one` or `group`. `ChatPlaceSource` lists them and starts
+  them, `useChatPlace` is the hook, and `apiChatPlace` is the API one. A panel given a `source` still shows that one
+  conversation and no switch, so nothing that used the first round changes.
+- The panel's body has three views — the thread, the list of conversations, and New chat — and the bar moves between
+  them. With several conversations the title is the switch; with one it is just the title.
+- Starting a chat never asks for the type: one person makes a one-to-one, more make a group, and a name makes a
+  group either way. A one-to-one with somebody who already has one is expected to come back rather than be made
+  twice; `localChatPlace` keeps that rule.
+- `@` at the start of a word offers the people in the conversation, narrows as it is typed, and owns Enter while it
+  is open. A mention is plain `@Name`, or a Markdown link with `mentionHref`; either way the ids travel in the
+  draft's `mentions`.
+- `ChatSnapshot` gained `loaded`: a store that has read nothing yet holds empty counts, and a panel must not write
+  those over what a conversation list already knows.
+
+### Added: several at once, `TabButtons multiple`
+
+`TabButtons` picks one option; with `multiple` it picks several, so a list of choices that must be seen all at once
+(the weekdays a rule runs on, the letters or symbols a pattern allows) needs no second control. Nothing that does
+not pass it changes.
+
+- `value` is an array and `onChange` hands back the chosen values **in option order**, whatever order they were
+  clicked in. Values that match no option are ignored and never handed back.
+- The options are native checkboxes in a `role="group"`: Tab moves between them and Space toggles one. The group
+  still needs `aria-label` or `aria-labelledby`.
+- There is no sliding indicator: each chosen option is raised with the indicator's own colors, border and shadow,
+  and keeps the pointer, since a click takes it away again. An option that is not chosen sits flat on the track.
+- The options **wrap** onto more rows when they do not fit, each row as tall as a one-row track's options, and an
+  option is never narrower than it is tall, so a row of single letters lines up. On a touch screen
+  (`pointer: coarse`) every option is a medium control's height: 26 letters on a phone are 34px targets, not 22px.
+- Made and checked for the `nav` design (`/demo/tab-buttons`, "Several at once"); `design="list"` with `multiple`
+  renders checkboxes too, but has not been checked yet.
+
+### Added: inputs that follow others, `dependsOn`, and a row's own params, `cellParams`
+
+Two optional keys, added 2026-09-26 for the builder's class form, whose company model shows only when the class has a
+company or a branch and whose type arguments offer a key type in one row and a model in the next. Nothing that does
+not pass them changes.
+
+- **`dependsOn: ["hasCompany"]`** on an input's params (Form only). When a named input's value changes — typed, or
+  set from code — this input draws again **without mounting again** (nothing typed in it is lost) and its params are
+  read afresh, so getters for `hidden`, `readOnly`, `readOnlyMessage`, `label`, `hint` or `options` answer for the
+  values as they are now. Its rule is asked again too, so a `required` a getter switched on counts at once. An input
+  that names any is asked `hidden` each time it draws, so it can come and go; one that names none is asked once, when
+  the form draws, as before. Name the input itself to follow its own typing.
+- **`cellParams(row, name, index)`** on `TabularForm` and `GroupForm`: the params of one cell that differ from its
+  column's, such as a picker's `options` and `selectedOptions`. Asked as the row draws; return nothing for the
+  column's own params, and the **same object** for the same answer (the merged params are kept per answer, so the cell
+  does not draw again for nothing). Getters on either side stay getters. Rules still come from the column.
+
+### Added: a generated column in a tabular or group form
+
+Two optional props on `TabularForm` and `GroupForm`, for a column whose values a row's **position** decides rather
+than the user — a bitwise enum's value, a line number, a running total. Nothing that does not pass them changes.
+
+- `deriveRows(rows)` returns one patch per row and runs after every change, including a row being added, removed,
+  duplicated or **moved**. The patches are written as code writes, so only the cells whose value really changed
+  mount again and focus stays on the row's own menu: a keyboard can move a row twice in a row.
+- `cellReadOnly(row, name, index)` is asked for every cell as it renders and returns the reason a cell is
+  generated. The cell is locked and shows that reason as its read-only note. Because it is asked per render, a
+  column can lock and unlock while the form around it changes, which params cannot do — they are fixed once a form
+  opens.
+
+### Added: rows nobody may change, `rowReadOnly`
+
+One optional prop on `TabularForm` and `GroupForm`, for rows the user did not write and may not change — the fields
+a class inherits from its parent, shown first in the same grid as its own. Nothing that does not pass it changes.
+
+- `rowReadOnly(row, index)` returns the reason (or `true`). Every cell of such a row is read-only with that reason
+  as its note, the row's menu in a tabular form offers nothing (no insert, duplicate, move or remove), and the row
+  below it cannot move up past it. Nothing reorders the rows: keep the locked ones first.
+- A locked row says nothing about its columns: the column-header lock is worked out from the other rows in view, so
+  a grid of inherited rows and one own row does not put a lock on every header.
+
+### Added: a panel beside a CRUD form, `form.aside`
+
+An Add or Edit popup can show a panel next to its form: a preview of what a save would produce, a summary, a help
+panel. It takes a node, or a function handed `{ form, action, row }` — `form` being that popup's own `FormStore`, so
+a panel follows what is typed through `subscribeValue()` and the form around it never re-renders for it.
+
+The two are columns above 1000px, each scrolling on its own so a long form cannot push the panel off the screen, and
+they stack below that with the **form first**, in the DOM as well as on the screen. `--nx-crud-aside-width` sets the
+panel's share (default `clamp(20rem, 38%, 44rem)`). Pair it with a wide `form.size` — `xl` or `full`; a panel in a
+560px popup leaves the form nothing. A CRUD that passes no `aside` renders exactly what it did before, wrapper and
+all.
+
+### `TabularForm` reworked: one row control, rows that do not move, one lock per column
+
+The owner called the tabular design bad, from a screenshot of an 18-row table with one generated column. Every fault
+was in this component rather than in the page that used it, so every fix is here. Nothing needs a new prop, and a
+table that passed nothing new looks different — deliberately.
+
+**Breaking, visually and for tests.** Two things a consumer may be reaching for have moved:
+
+- **The remove column is gone.** Remove was a column of unlabelled `×` buttons at the end, beside a row menu that
+  already held Remove: two ways to act on one row, and a whole column spent on one of them. Now a row has one
+  control, the menu beside its number, holding Insert above, Insert below, Duplicate, Move up, Move down and Remove.
+  `removable` still decides whether Remove is offered. A test that clicked a button named `Remove <row>` opens the
+  row's menu instead: `Row 2 actions`, then the `Remove` item. `.nx-tabular__end` and `.nx-tabular__remove` are gone
+  from the DOM and the stylesheet; so is `--nx-tabular-end`, replaced by `--nx-tabular-menu` (the menu's slot width).
+- **The row number no longer opens the menu.** It used to *become* the menu on hover: the number faded out and dots
+  faded in over it, so the numbering looked broken and the grid felt unstable as the pointer crossed it. The number
+  now stays where it is, right-aligned, at every moment, and the menu button sits beside it in its own space,
+  always present. The number column is that much wider.
+
+**Fixed, with no change to how a table is written:**
+
+- **Every row is one line high, whatever it holds.** The row's grid track was sized by its tallest cell, so a single
+  `textarea` column of `rows: 2` made every cell of its row 20px taller than the row's own box — drawing the cells,
+  their edges and their focus rings over the rows below. One row of content therefore looked taller than its
+  neighbours, and a focus ring bled outside its cell. The row now has one track exactly its own height, cells keep
+  what they hold inside their bounds, and a `textarea` fills its cell and scrolls inside it.
+- **No resize grips in cells.** A `textarea` in a cell took `resize: vertical` from the multi-line input rule, so
+  every cell of such a column offered a grip that would break the alignment of its row. They are `resize: none` now.
+- **A filled cell and an empty one are drawn the same.** Same consequence as the above: only the cell with text was
+  tall enough to show what the overflow was doing.
+- **`maxHeight` comes down to whole rows.** The scroller used to end wherever the number fell, cutting the last row
+  in half, which reads as broken rather than as scrollable. The component measures its header, its frame and its
+  real row height and caps itself just under what was asked for. A number too small for one row is left alone.
+- **A generated column says so once.** `cellReadOnly` put a lock in every cell of the column it locked — eighteen
+  locks for one fact. The lock is now on the **column header**, with the reason as its title, and the cells keep the
+  read-only tint and their own reason, which still shows under the table when one is used. A lock that really is per
+  row (some rows locked, not all) leaves the header alone and is drawn per cell as before.
+- **Less chrome.** The frame is `--nx-border` rather than `--nx-border-strong`: the sheet draws every line it needs
+  inside itself, and in a popup or a panel the strong edge was a box around a box around boxes.
+
+## 2.0.0
+
+The rewrite: compiled `dist` with the entry points `.`, `/client`, `/server` and `/styles.css`, in place of 1.x's
+raw TypeScript from `src` with `.`, `/client` and `/interface`. A major version, so nobody on `^1.1.21` is moved
+into a different API.