nexus-shared 4.0.0 → 4.1.0

package/CHANGELOG.md

@@ -4,6 +4,801 @@ Notable changes to `nexus-shared`. The **values** of exported constants count as
 Nexus backend's own numbers, and a value that differs from the backend by one does not fail loudly — it silently
 means the wrong thing on every record and every permission check.
 
+## 4.1.0
+
+**Additions only.** Everything written after `4.0.0` was published (2026-11-07 16:14 UTC; the first change after it is
+card SUB4-component-review-fix-finish on 2026-11-09). Checked against the published `4.0.0` (`npm pack nexus-shared@4.0.0`)
+with the four scripts in `Frontend/scripts/release-compare`, on 2026-11-11:
+
+- **Exports** (`compare-exports.cjs`): every export of `4.0.0` is still exported; **279 are new**, 212 from
+  `nexus-shared` and 67 from `nexus-shared/client`, none from `nexus-shared/server`. Per card, as each counted its own:
+  2 are [card SUB4-component-review-fix's](#the-round-4-reviews-fixes-a-hasty-enter-a-question-read-out-a-remembered-value-kept), 4 are [card C-crud-hidden-value-after-save's](#the-row-a-save-leaves-is-what-was-sent), 58 are [card C-mail-thread's](#a-mail-thread-its-source-and-backend-and-three-params-any-page-can-use), 49 are [card C-domain-card's](#a-records-card-in-a-message-read-live-from-its-module), 18 are [card C-message-bell's](#a-message-bell-the-unread-count-on-a-top-bar-one-read-however-many-bells), 3 are [card C-mail-thread-fit's](#a-mail-threads-window-opens-on-its-subject-and-its-reply-box-keeps-one-row-on-a-phone), 1 is [card C-crud-row-confirm's](#a-row-form-asks-before-it-saves-a-picker-reads-another-listing-a-history-names-who), 8 are [card C-documents-add-only's](#an-owners-files-that-a-records-state-lets-only-be-added-to), 9 are [card C-row-picker-narrow's](#a-rows-picker-narrowed-by-the-forms-value-and-the-rows-own), 36 are [card C-mail-client's](#a-mail-client-three-panes-docked-chat-windows-and-a-compose-window), 58 are [card C-dashboard-board's](#a-customisable-dashboard-widgets-in-size-presets-one-call-per-module-only-near-the-screen), 1 is [card C-rows-solve's](#a-rows-worked-out-input-typed-in-a-lines-total-sets-its-rate), 5 are [card C-mail-client-fix's](#the-mail-clients-fixes-and-a-crud-forms-computewith), 5 are [card component-details-0620-look's](#details-as-the-2026-06-20-window-drew-them-a-list-of-rows-as-a-table-history-names-from-the-app), 7 are [card C-gallery-pending-removal's](#a-gallery-whose-removals-wait-for-a-review); the rest are named in their sections
+  ([tree filters](#a-trees-filter-tabs), [the picture column first](#a-tables-picture-column-first-and-unpin-on-a-column-its-page-pins), ...).
+- **Constants** (`compare-values.mjs`): 94 compared (90 from `nexus-shared`, 4 from `nexus-shared/server`), 2 differ,
+  both additions: `NexusModule.Inventory` (131072) and its
+  `NEXUS_MODULES` entry ([card INV-0-comp](#inventory-added-at-bit-17-no-value-moves)). No value changed or moved;
+  `NexusModule.Report` keeps its value and is [deprecated](#nexusmodulereport-is-deprecated-the-backend-retired-it).
+- **Types** (`compare-types.cjs`, new with this release: each exported type's members and optionality, each function's
+  required parameters): 1,410 exports compared, **0 breaks**. 12 members are new and required, all on types this package
+  builds and an app only reads: `ChatRun.notification` (made by `groupChatMessages`), `TreeNode`'s six `shown...` counts
+  (made by `TreeStore`), and `FormStore.setFromPerson` (a method of the class, which no app can implement: it has
+  private members). One member's type widened: `TableState.pinned` may hold `null` for a column its page pins and the
+  user unpinned, which [could not be done before](#a-tables-picture-column-first-and-unpin-on-a-column-its-page-pins);
+  `columnPin(column, pinned)` reads the side. No app in this repository reads it.
+- **Stylesheet**: no class name or custom property of `4.0.0` removed; 241 added.
+- **`nexus-icons ^1.2.0`** (`compare-floor.cjs`): the 130 names this package imports are all in the published `1.2.0`.
+
+The packages built on this one take it as they are: `nexus-admin` `4.0.0` asks `^4.0.0` and is unchanged since it was
+published; `nexus-public` `3.0.2` asks `^3.0.0 || ^4.0.0`.
+
+### `NexusModule.Report` is deprecated: the backend retired it
+
+The backend retired its Report module (`EModules.Report`, 256) on 2026-11-11: print layouts, the print door and their
+history are the Configuration module's now. `NexusModule.Report` is `@deprecated` and **keeps its value**, so bit 8 is
+never given to another module and an old permission mask that holds it still reads; its `NEXUS_MODULES` entry stays as
+well (removing an entry changes a published constant, which only a major may do), so an old `/api/app/report/...` proxy
+URL is still recognised. An app sets no `API_REPORT` any more, and a list a person picks a module from leaves it out
+(`info.module !== NexusModule.Report`). This package builds no such list; `nexus-admin`'s `fallbackModules()`, used only
+when the backend's module list cannot be read, still names it until `nexus-admin` is next released.
+
+### A tree's filter tabs
+
+Card C-tree-filters (2026-11-10), for a permission set editor: small tabs above a checkable `TreeView` (All actions ·
+View only · Add and edit · Trash and delete) that narrow its rows. 2 exports added (`TreeFilter`, `TreeFilterMatch`).
+
+- **`TreeView` `filters`**: each a `TreeFilter` with an `id`, a `label` and a `match` asked of every leaf (none shows
+  all). The tree shows the leaves a filter takes and the parents that hold one. While one is on, checking a parent or
+  Select all checks only the leaves shown, a parent's box and count read only them, and a hidden leaf keeps its check.
+  The value is the same whatever tab is on: switching never changes it and never makes a form dirty.
+  `defaultFilter`, `rememberFilter` (`{ key, viewer }`, kept per signed-in person), `onFilterChange` and
+  `filtersLabel` (default "Show").
+- **`TreeStore`**: `setFilter` and the option `filter`; each node gains its `shown...` counts beside the whole ones,
+  which the value and `counts()` still read.
+- **`TabButtons` `wrap`**: the options wrap onto more rows when they do not fit (`nav` design), as the tree's tabs do on
+  a phone.
+- Proved by `test-tree-store.mts` and nexus.template's `/demo/tree-view` "Filter tabs: a permission set".
+
+### A table's picture column first, and Unpin on a column its page pins
+
+Card C-picture-first (2026-11-10): every data table draws its picture or logo column first, after the row number.
+
+- **`TableColumn.lead`**: drawn first of the page's columns until the user moves it; when the page pins other columns on
+  the left, a lead column is pinned there too, at their head. `pictureColumn` sets it. The user hides, moves, pins and
+  unpins it like any column, and Reset columns brings it back. `leadColumns(columns)` arranges them;
+  `namingColumn(columns)` is the column that names a row in a question ("Delete Kathmandu?"), never a picture.
+- **Unpin works on a column its page pins.** The user's sides are a `TablePins` (`null` for unpinned), read by
+  `columnPin(column, pinned)`; before, a page's own `pinned` came back.
+- Proved by `test-table.mts`.
+
+### A full-size popup fits a phone screen while the address bar shows
+
+A full-size popup is `100dvh` tall where the browser knows it (`100vh` stays for older ones), so on a phone or tablet
+its footer (Save, a tab's footer) is no longer under the screen's edge while the address bar shows; the theme panel's
+height follows the same rule. CSS only.
+
+### The round-4 review's fixes: a hasty Enter, a question read out, a remembered value kept
+
+Cards SUB4-component-review-fix and SUB4-component-review-fix-finish (2026-11-07/08): six findings of the review of
+the subscription round's work in this package. Additions only: 2 exports, both from `nexus-shared`
+(`isAwaitedCrudField` and the type `CrudRecordRead`, the read-state rule the profile and the Details tab share), and
+`Popup`'s `aria-describedby` prop. **One behaviour changes for every message box**: a held Enter, or one within 300 ms of the Enter
+before it, no longer answers it.
+
+- **A hasty Enter never answers a box.** The Enter that opened a question (in a form's box, with `confirm`) could press
+  the Confirm it gave the focus to - by the key's repeat or the second tap of a double press - and save before the
+  details were read. Any Enter inside a message box with `repeat`, or within 300 ms of the Enter before it, is held;
+  the next deliberate Enter answers as before. A check that opens a box with Enter and answers with Enter waits 300 ms.
+- **The question is read out.** A message box is described (`aria-describedby`) by its message and its `details`, so
+  a screen reader reads them with the title as the focus enters, before Confirm.
+- **A remembered choice on a long list is kept.** A picker that cannot name a record by its key is looked through page
+  by page; when the 20 pages ran out before the list ended, a kept value not met was counted gone and forgotten. It is
+  now unknown: kept, not opened. Only the list's end (as the box reads one) makes it gone, and the pages are asked in
+  the box's own `pageSize`, so a loader paging by its own size with no `hasMore` is no longer cut after one page.
+- **A value opened from memory redraws what follows it.** An input worked out from it (`compute`), sized by it
+  (`spanWhen`), shown or labelled by it, drew its old state until something else changed; memory's opening and a
+  picker's late answer now redraw the inputs that follow, as a change does.
+- **A profile field the row lacks** (`details.profile.fields`) holds its line while the record is read and says "Not
+  loaded" when the read fails, as the Details tab's fields do; before, it was left out of both the profile and the
+  Details tab, and appeared late, moving the profile.
+- **A picker asked for a remembered value says it is busy**: its box is `aria-busy` and described "Loading" while the
+  value may still come (a search's pages stay the list's busy state), and a person in the box keeps the focus when the
+  value opens - any input mounted again under the focus (a late value, a load, a reset) gets it back.
+- Proved by `test-input-memory.mts` (1,200 records, a loader paging by 20, followers drawn), `test-crud-profile-fields.mts`
+  (the read state) and nexus.template's `form-confirm.cjs` E, `crud-workspace.cjs` M and `input-memory-picker.cjs` K;
+  each new line seen red against the package as it was before.
+
+### The row a save leaves is what was sent
+
+Card C-crud-hidden-value-after-save (2026-11-09), found by the HR leave setup (card H2): a value hidden by `showWhen`
+stayed on screen after a save until the list was read again, though the server held none. A CRUD built the saved row
+from the form's own values, over the row, under the answer; a page's `transform` that sends null for a hidden value
+(a leave type's "Carry forward at most" while it does not carry forward) changed only the body, and a Nexus answer
+leaves its nulls out, so nothing took the form's old value off the row. Additions only: 4 exports, all from
+`nexus-shared` (`crudSavedRecord`, `crudHiddenOnSave` and the types `CrudSent`, `ApiFormSent`). **What can move for an
+app:** the row after an Add or an Edit, on a data table and in a tree, wherever it differed from what was sent.
+
+- **The row is what was sent** (`crudSavedRecord`): the row the form was opened on, then the body `transform` made -
+  when it is a record - over the form's values, then the answer. A field the body sends as null is empty on the row;
+  one it reshapes (a range sent as its two days) shows as sent, also when the answer is only a token. A shown field the
+  body leaves out keeps the form's value, as before; a body that is not a record (a list, a `FormData`) changes nothing.
+- **A value `showWhen` hid when the form was saved** is on the row only as the server holds it: as the answer gives it
+  when the answer is a record - a field it leaves out has none - else as the body gives it. So a hidden value the server
+  clears by its own rule leaves the row too, with no `transform` (the demo's amenities: a free one has no charge). The
+  hidden box still keeps what was typed in it, and showing it again brings it back. A picture and an input worked out
+  from others (`compute`) hold no value of the form's and are left as they were.
+- The values of a row are the ones the save sent, never ones typed while it ran.
+- **`ApiForm` `onSuccess`** gets a fourth argument, `sent` (`ApiFormSent`): the values as they were sent and the body
+  `transform` made of them.
+- Not changed: what a form sends. A value `showWhen` hides is still sent unless the page's `transform` clears it.
+- Proved by `test-table.mts` (the leave type's case under the old merge and the new one, a dropped field, a token
+  answer, a reshaped body) and nexus.template's new `crud-saved-row.cjs`, whose answers a route makes Nexus-shaped (nulls
+  left out): its three row lines failed in both motion modes against the package as it was before.
+
+### A mail thread, its source and backend, and three params any page can use
+
+Card C-mail-thread (2026-11-09), card 2 of the domain messages spec: mail inside an app - a thread with a subject, a
+sender and its people (To, Cc, Bcc), whose replies are the chat's own lines, which a module can write into when
+something happens. Built to the spec's wire before the Message module's `Mail` doors exist, and proved against a
+pretend `Mail` controller in nexus.template that answers that wire. Additions only: 58 exports (45 from `nexus-shared`,
+13 from `nexus-shared/client`), compared with the build before the card by `Frontend/scripts/release-compare`; no
+exported constant changed. **What can move for an app:** nothing it already draws - a chat line that names no kind is
+drawn as before, and `.nx-chat-list__badge` is `inline-grid` (the same in the conversation list, where it is a flex
+item; now its own width in a table cell too).
+
+- **`MailThread`** (`nexus-shared/client`): the head - subject, time, From, To, Cc and Bcc **only as the source gives
+  it**, each list folded to three names and a "+2" button that opens the rest in place (`MailPeople`), the reader's own
+  name saying "you", the record it is about (`MailDomainLine`, or `renderDomain`) - over the chat's `ChatThread` and
+  `ChatComposer` on `source.threadSource(id)` through `ChatStore`, unchanged. A person copied unseen reads
+  `MAIL_BCC_NOTE` over the reply box; when they reply, or when anyone else's line arrives, the head is read again
+  (a reply makes a blind copy a Cc). `onChanged` tells the page what arrived (`reason: "notification"` when the record
+  may have changed, which also bumps the record slot's `revision`), `onSummary` its counts (a list's row clears its
+  unread), `onHead` each head read. States: bones while the head loads, a failure with Try again in the head and in
+  the thread, "This message is not available to you." for a 403 or 404, a closed thread read but not answered. A band
+  across the panel, never a box (`Nexus.Mail.css`, new); the chat panel's frame and body.
+- **`ChatMessage.kind`** (`ChatMessageKind`: `chat`, `mail`, `notification`): `NexusChatBackend` reads it from a row's
+  `messageType` (the backend's `EChatMessageTypes` 0, 1, 2, or the word). A notification is its own run
+  (`ChatRun.notification`) and `ChatThread` draws it as an event line (`ChatEventNote`): the bell, who acted, when, and
+  the words, quiet, with no side and no bubble.
+- **`ChatComposer` `notice`**: a line over the writing area that the text area is described by.
+- **`MessageSource`** (`MailInterfaces.ts`, beside `ChatInterfaces.ts`; the builder's `MessageInterfaces.ts` keeps its
+  name): `inbox`, `thread`, `threadSource`, `compose`, `archive`, `unarchive`, `unread`, `people`, `defaults`, in this
+  package's words (`MailRole` `from | to | cc | bcc`, `MailList` `inbox | unread | sent | archived`).
+  **`MessageBackend`** / **`NexusMessageBackend`** / **`defineMessageBackend`** map them to an API (the Message
+  module's `Mail` controller by default; `module` and `controller` overridable, as `NexusChatBackend`), reading the
+  backend's numbers as words; **`apiMessageSource`** (`/client`) is the only file that calls.
+  **`localMessageSource`** keeps a mailbox in memory with a backend's rules (who sees a blind copy, a blind copy's reply
+  made a Cc, archive and unread per person, a retried send written once, every wrong input of a new message at once),
+  `as(userId)` to read it as somebody else and `post` for a module's notification.
+- **Words and helpers**: `mailPeopleLine` (three names then "+2", never "+1"), `mailBccNote`, `mailPreviewText`,
+  `newMailClientId`, `mailInboxLoader` (a server-paged table's loader), `MAIL_ROLE_LABELS`, `MAIL_LIST_LABELS` and the
+  limits `MAIL_PEOPLE_MAX` (50), `MAIL_SUBJECT_MAX` (100), `MAIL_BODY_MAX` (4000).
+- **An inbox's columns** (`mailInboxColumns` `from`, `subject` with the record as a tag before it, `lastMessage`,
+  `when` as "14 min ago", `unread` in the chat's badge; `mailInboxColumnList` all five, fitting a 1280px window beside a
+  menu) read a `MailInboxRow`'s fields, which are the answer's own names, so a CRUD of raw rows uses them too.
+- **Three params any page can use**:
+  - **`pagedPicker(load, options)`** and **`holdPickerItems`**: a dropdown over any server search, paged, that names
+    every value it holds - from the pages shown, items handed over, a lookup by key (`find`), or the server's first
+    pages (`findPages`, 4) - so a form opened on values, or a draft brought back, never shows "Not found" for what a
+    page showed. `mailPeoplePicker(source)` is one for the people a message goes to.
+  - **`Crud` `form.createDefaults(signal)`**: an Add form's values read as it opens, over `newValues` and under the
+    values `create(values)` fixes; the inputs show disabled until they land and a draft comes back over them; a failed
+    read opens the form on `newValues` with a toast, since defaults are a help, not the record.
+    `mailComposeDefaults(source, picker)` is one: To, Cc and Bcc from the reader's defaults, named at once, and a new
+    `clientId` (give `newValues: () => ({ clientId: newMailClientId() })` too, so a form opened without its defaults
+    still sends one).
+  - **`DataTable` `rowStrong(row)`** (and a `Crud`'s `table.rowStrong`): the row's cells heavier in the text colour
+    (`data-strong`), nothing else, so it keeps its height and no column moves when it reads plain.
+- Proved by `test-mail.mts` (146: roles, Bcc hidden also in read marks, a Bcc reply made Cc, archive, unread, a
+  notification, a closed thread, a new message refused with every wrong input at once and written once, paging, the
+  paged picker, the Nexus backend's requests and answers, a notification's run, a thread through `ChatStore`; red with
+  the Bcc rule taken out) and nexus.template's new `mail-thread.cjs` (82 in both motion modes, red with the strong
+  look or the blind copy's head refresh taken out).
+
+### A record's card in a message, read live from its module
+
+Card C-domain-card (2026-11-09), card 5 of the domain messages spec: the owner's "if type is chat and it has domain type
+and id then we fetch those domain info and render those info into its own components ... we fetch that person's
+remaining and taken leave". A message about a record shows the record as a card, read from the module that owns it each
+time it is drawn, never a copy kept in the message. Additions only: 49 exports (39 from `nexus-shared`, 10 from
+`nexus-shared/client`), compared with the build before the card by `Frontend/scripts/release-compare`; no exported
+constant changed. **What can move for an app:** a `MailThread` whose record's kind has a card draws the card where
+`MailDomainLine`'s line was (folded to its title line on a thread narrower than 480px); a kind with no card draws the
+same line as before, now `DomainLine` (`.nx-domain-line`; `.nx-mail__domain` is gone).
+
+- **`ChatDomainInfo.card`** (`DomainCardDefinition`): `load(id, signal, context)` reads the record through its
+  module's card door, which checks the reader; `view(data, context)` maps the answer to `DomainCardParams`; optional
+  `extra(data)` (one more piece of this package's parts), `held` (what the placeholder holds the first time) and
+  `lifetime`. **`domainCard({ load, view })`** types `view` by `load`'s answer; `defineChatDomains` refuses a card
+  without both. **`domainCardOf(kind)`** finds it. This package holds no kind and no number: the app's rows do.
+- **`DomainCard`** (`nexus-shared/client`) `domain`, `id`, `label`, `revision`, `viewer`, `card` (instead of the
+  registered one, or `null`), `kind`, `headingLevel`, `collapsible`, `defaultCollapsed`, `ref` (`reload()`): a
+  placeholder of the card's own parts in the shape of the kind's last card (so the record lands without moving what is
+  under it, at any width - the head is laid out by the card's width, never its words), the card, "You cannot open this
+  leave request." for 403 and 404 alike, "Could not load this leave request." with Try again (which reads once) for any
+  other failure or a `view` that throws, and the kind and the record's words alone for a kind with no card or a message
+  with no id. Read again when `revision` grows, `reload()` or **`refreshDomainCards(kind, id?)`**: the card stays,
+  marked "Updated 2:45 PM" when the record turned out different or "Not up to date" with Try again when the read
+  failed; a refusal drops it. A screen reader is told each. `MailThread` passes its notifications' `revision` and its
+  reader.
+- **`DomainCardFrame`**: a card from `DomainCardParams` alone (title, kind, code and subtitle on one quiet line with the
+  link at its end, state in its tone, fields, figures with a tone mark and a hint, lines with "and 3 more", currency),
+  with an optional fold button. Values by kind with the reader's settings (`domainCardValueText`): `date`, `datetime`,
+  `days`, `money`, `number`, `person`, `text`. **`DomainLine`**: a kind's tag and a record's words.
+  `Nexus.Domain.css` (new): a band, never a box; the mail head draws a line above it, edge to edge.
+- **Reads**: **`DomainCardReads`** / **`domainCardReads`** - one read of a record at a time however many cards draw it,
+  an answer kept 30 seconds per reader (`DOMAIN_CARD_LIFETIME`), a failure never kept, a read nobody waits for aborted,
+  a read again taking only a read started after the change (and forgetting what other readers kept of the record).
+  **`DomainCardRun`** (one card's read outside React: `start`, `stop`, `reload`, `retry`, a snapshot to subscribe to)
+  and **`useDomainCard`** for a page's own look. Words: `domainCardNoun`, `domainCardRefusedText`,
+  `domainCardFailedText`; shapes: `domainCardShape`, `heldDomainCardShape`, `rememberDomainCardShape`,
+  `DEFAULT_DOMAIN_CARD_SHAPE`.
+- **`formatDays(value, { decimals, locale, empty })`** and **`dayWord`** in NumberHelpers: "1 day", "0.5 days", "2.5
+  days", grouped as `formatNumber` does.
+- Proved by `test-domain-card.mts` (100: the registry, keys, shared and kept reads, a read again after a change, abort
+  and remount, every state of a run, `refreshDomainCards`, words, values by kind, shapes; red on each of nine key lines
+  taken out on a scratch copy), `type-checks/domain-cards.tsx` (`view` typed by `load`), and nexus.template's new
+  `domain-card.cjs` (88 in both motion modes: a thread's leave card from a pretend `RequestCard` controller, one read,
+  kept per reader, Accounts' notification read once and marked updated, a reader refused with the thread whole, a
+  requisition's lines, the fold and the keyboard; every state; the placeholder's height kept at seven widths; a phone;
+  seven themes light and dark at AA - red on a scratch copy with the band rule, the revision, the narrow fold, the
+  placeholder's shape or its width-led head taken out).
+
+### Inventory added at bit 17; no value moves
+
+Card INV-0-comp (2026-11-09), card 1 of the Inventory spec (`owner-requests-2026-11-09/inventory-spec.md`): the owner's
+Demand, Dakhila and Clearance get a backend module of their own, `EModules.Inventory = 1 << 17`, after Portfolio.
+
+- **`NexusModule.Inventory`** = `1 << 17` (131072), the last bit. Every other value is what it was (`Portfolio` stays
+  65536), so no permission bitmask an app holds changes meaning - unlike `Chat`'s insertion of 2026-09-25 below. A new
+  module takes the next bit at the end, never one in between; the enum's comment says so.
+- **`NEXUS_MODULES`** gains `{ module: NexusModule.Inventory, key: "inventory", label: "Inventory", env: "API_INVENTORY" }`
+  before the app's own row: its root is read from `API_INVENTORY` on the server and its browser calls go through the
+  proxy at `/api/app/inventory/...`.
+- No export is added or removed (`NexusModule` gains a key); compared with the build before the card, every value of
+  `NexusModule` and every row of `NEXUS_MODULES` is kept and only these two are new.
+- Proved by `test-api.mts` (210: the value, Portfolio's unchanged, the key, the label, the environment name, a lookup by
+  key and by number, the browser root, the proxy, and a new check that the list names every module of the enum with an
+  API exactly once; red on a scratch copy with Inventory on bit 16, its environment misnamed, its key misspelt or its row
+  left out) and nexus.template's `api-calls.cjs` (its modules table's Inventory row, both motion modes).
+- **For an app on the published package**: nothing to do until it calls the Inventory API; then set `API_INVENTORY`
+  (the module's `.../App/Api` root) where the app's other `API_*` roots are, and allow the module in its proxy route.
+
+### A message bell: the unread count on a top bar, one read however many bells
+
+Card C-message-bell (2026-11-09), card 8 of the domain messages spec: how much internal mail waits, on every page.
+Additions only: 18 exports (13 from `nexus-shared`, 5 from `nexus-shared/client`), compared with the build before the
+card by `Frontend/scripts/release-compare`, none removed; no exported constant changed. **What can move for an app:** the
+chat icon's unread badge is drawn by the rule `Button`'s new badge shares (`Nexus.Button.css`; the same look, moved),
+and `localMessageSource`'s `unread()` now counts to 100 as the Message module's does.
+
+- **`MessageBell`** (`nexus-shared/client`) `source`, `href`, `threadHref`, `label` ("Messages"), `interval` (a
+  minute), `size`, `icon`, `maxBadge` (99), `time`: one of a top bar's ghost buttons with the count over its corner in
+  the chat's badge - one size whatever the count, "99+" from 100 on - and named for a screen reader ("Messages: 3
+  unread messages", "not checked yet", "could not be checked"). A click opens a `Menu`: the newest unread threads
+  (subject; who wrote the newest line, the record, "14 min ago"), each a link to `href?thread=<id>`, Try again after a
+  failure, and "Open inbox" (with how many in all when more wait); the arrow keys walk it, Escape and a click outside
+  close it, and opening it reads the count again. When the count goes up, one bell of the page says it once in a polite
+  live region - not on every read, not as the page loads. Drawn in nexus-admin's bar through `renderUtility` with no
+  change to nexus-admin.
+- **`useMessageUnread(source, { interval, enabled })`** and **`MessageUnreadPoller`** / **`messageUnreadPoller(source)`**:
+  one poller per source object, shared by every bell on the page. It reads when the first bell appears, then every
+  `MESSAGE_UNREAD_INTERVAL` (60 s) while the page is in front, at once when the window takes the focus or the tab is
+  shown again (`MESSAGE_UNREAD_WAKE_GAP` keeps the two from reading twice), never while the tab is hidden, never two
+  at once; a failure keeps the count read before; the last bell gone stops everything and the next one starts from what
+  was read. **`refreshMessageUnread(source)`** after a page reads or archives threads. The environment
+  (`MessageUnreadEnvironment`, `browserUnreadEnvironment`) is injected, so the rules are tested with a fake clock.
+- **Words**: `mailUnreadWords`, `mailUnreadBadge`, `mailThreadHref`; **`MAIL_UNREAD_MAX`** (100, the backend's last
+  count). `LocalMailFailure` gains `"unread"`.
+- **`Button` `badge`**: a count over a button's corner, the chat's badge, the button's size unchanged. Generic: any bar
+  or list button with a number on it.
+- Proved by `test-message-bell.mts` (48: one read for two bells, a minute, hidden reads nothing, shown and focused,
+  never two on their way, the shortest interval, failures, what is said and by which bell, the last bell gone, a hidden
+  first draw, the words, the badge, a thread's address, the local count to 100) and nexus.template's new
+  `message-bell.cjs` (77 in both motion modes: a page's clock moved by a minute, a hidden tab, the bar unmoved against
+  the server's drawing, the menu by keyboard and pointer, the arrow, a line said once, a row that opens its thread and
+  lowers the count, every state, nexus-admin's bar, a phone, seven themes light and dark).
+
+### A mail thread's head scrolls with its lines, and its record's card folds by the thread's real width
+
+Card C-mail-thread-head (2026-11-09, a bug card): nexus.web's request and leave cards in `MailThread` (REQ-thread-pages)
+showed two faults. No export added or removed; no constant changed. **What can move for an app:** a mail thread's head is
+no longer a box of its own - it scrolls with the lines; a record's card shows its figures first and folds its details
+(fields, lines, what a kind adds) under them, keeping the figures; a figure's hint keeps two lines.
+
+- **The fold follows the thread's real width.** `MailThread` measured its width once, before a window had laid out
+  (a closed dialog reads 0), so an inbox window opened the card folded at 1280 px. Now a ResizeObserver follows the
+  width: the card is drawn once a real width is known - the first decision before the browser paints, so it never
+  shows one way and then the other - and folds under 480 px, unfolds over it, until the reader folds or unfolds it
+  themselves. **`DomainCard` `collapsed` / `onCollapsedChange`**: the fold a page holds (`defaultCollapsed` stays for
+  one it does not).
+- **The head scrolls with the lines.** The head was capped at 45% of the thread with a scroll of its own, so a leave's
+  or a requisition's card showed in part at 720 px tall. **`ChatThread` `lead`**: what a conversation opens with, above
+  its first message and in the same scroll - the lines alone stay the screen reader's log. With a lead the thread opens
+  at its top (its first unread line at the top when that would be out of view), older pages load from their button so
+  the lead stays put, and whether the reader is at the bottom is worked out again when the lead grows (a card landing).
+  `MailThread` passes its head as the lead: at 1280×720 a leave's card shows whole as the window opens, every part of
+  either card is read by scrolling the thread, and the reply box keeps its 206 px.
+- **The card's fold keeps the figures.** Folded, a card is its title, its code and its figures - a leave's balance -
+  with "Show the details" for the rest; a card with nothing to fold has no fold button. The figures come first, the
+  details under them, so opening them moves nothing above. A figure's hint keeps two lines (`min-height`), so a long
+  one ("1.5 paid, 0.5 unpaid (1 day's pay)") does not change the card's height against its placeholder.
+- Proved by nexus.template's `domain-card.cjs` (105 in both motion modes; a new section reads every part of the leave
+  and requisition cards in the thread's one scroll at 1280×720 and 390×844, light and dark, the reply box's room
+  beside it) and `mail-thread.cjs` (122; a new section opens Puja's leave thread in the inbox's window: whole at 1280
+  and folded on a phone, never the other way first; the head in the thread's scroll, the thread at its top with the
+  figures in view; the fold following a narrowed and widened window until the reader folds it), red on a scratch copy
+  of the parent commit's sources. The demo's leave card carries the real one's hints: the year under Available, and the
+  paid/unpaid split under This request.
+
+### A bell's refresh asked during a read is read after it, not lost
+
+Card C-unread-requeue (2026-11-09, a bug card): nexus.web's bell (MAIL-bell) found that `MessageUnreadPoller.refresh()`
+did nothing while a read was on its way; when that read had started before a read mark, an archive or an unarchive, the
+bell kept the old count for up to a minute. No export added or removed; no constant changed.
+
+- **`refresh()` (and `refreshMessageUnread(source)`, unchanged in its contract)**: with no read on its way it reads now,
+  as before; with one on its way it asks for exactly one more read after it - however many refreshes are asked
+  meanwhile, and whether that read answers or fails - so never two reads at once. While the page is hidden nothing is
+  read: the read asked for waits and runs at once when the page is shown, even within the two seconds a shown tab's
+  focus otherwise skips. The last bell gone drops it. The minute's timer counts from the read that followed.
+- nexus.template's bell source now counts when asked and answers 150 ms later, as a server does, so the case can be
+  seen: `message-bell.cjs` presses Check now, lets Kiran write while that read is on its way, presses it again, and
+  the bell shows his line at once (red on the parent commit's poller, with the read mark's case beside it).
+- Proved by `test-message-bell.mts` (66: three refreshes during a read make one read after it, the stale answer drawn
+  meanwhile, never two on their way, the minute from the read that followed, hidden then shown, a failed read followed,
+  the last bell gone, a bell drawn again inheriting nothing; red on the parent commit's poller and on each of five lines
+  of the fix broken) and `message-bell.cjs` (79 in both motion modes).
+- **For an app that worked around it** (nexus.web's `recountUnread()` in `admin/mailbox.ts`, which refreshed once more
+  when the read on its way answered): a plain `refreshMessageUnread(source)` now does that by itself.
+
+### A mail thread's window opens on its subject, and its reply box keeps one row on a phone
+
+Card C-mail-thread-fit (2026-11-09, a bug card): nexus.web's Inbox (MAIL-pages) found two faults in `MailThread` that a
+page cannot mend without CSS of its own. Additions only: 3 exports (`fitToolbar`, `ToolbarFit`, `ToolbarSizes`, from
+`nexus-shared`), compared with the build before the card; no exported constant changed. **What can move for an app:** a
+popup given no `initialFocus` now starts on an element of its body or footer marked `data-nx-focus` before the first
+control (only `MessageBox`'s buttons carried the mark, and it names it itself); every `ChatComposer` - a chat panel's
+too - keeps its formatting buttons on one row.
+
+- **Where the focus lands.** A window opened on a thread put the focus on the first control in its body, which for a
+  thread with no "+2" and no record is the lines' scroller (`tabIndex 0`), and opened with its ring showing. The
+  window now starts on the thread's subject (`tabIndex -1`, marked `data-nx-focus`, no ring: a place to start reading,
+  the WAI dialog pattern for a long read), a screen reader reads it first, and Tab goes on through the people, the
+  record's card and the scroller - which shows its ring when the keyboard reaches it. `Popup`: with no `initialFocus`,
+  `[data-nx-focus]` in the body or footer first, then the first control.
+- **The reply box on a phone.** Under 560 px the editor's buttons took a row of their own and wrapped, three rows over a
+  two-line text area, leaving about 190 px for the lines at 390 px. **`MarkdownEditor` `toolbarOverflow`**: `"wrap"`
+  (the default, as before) or `"menu"`, one row at any width - the buttons take the room the views and the full-screen
+  button leave, and those that do not fit go into a "More formatting" menu at their end, with their shortcuts (which
+  keep working); the arrow keys reach it with the other buttons. `ChatComposer` uses `"menu"`: at 390 px the bar is
+  Write, Preview, B, I, S, "…", full screen; the reply box is as tall as on a wide window (206 px) and the lines get
+  258 px. **`fitToolbar(items, width, sizes)`** is the arithmetic, pure.
+- Proved by `test-toolbar-fit.mts` (10; red with the More button's room, the trailing divider, the all-fit case or the
+  gaps taken out) and nexus.template's `mail-thread.cjs` (107 in both motion modes: opened from the keyboard and by a
+  click, the subject focused with no ring and the scroller unringed, Tab reaching the scroller with its ring, the bar's
+  one row at 1280 and 390 light and dark, More formatting's tools at work, End reaching it, the composer's height the
+  same on a phone; red on a scratch copy of the parent commit's sources).
+
+### A row form asks before it saves, a picker reads another listing, a history names who
+
+Card C-crud-row-confirm (2026-11-09): three gaps nexus.web's pay runs (P1a) worked around. One export added
+(`PickerListController`, a type); no constant changed. **What can move for an app:** a row form's save now marks what
+pickers and joins looked up from the controller as old, as every other CRUD change does, so they read it again where it
+is next shown; and `expireLookups` marks a CRUD's own `lists` old too.
+
+- **A row form's question: `CrudRowForm.confirm`.** The same question a form's `confirm` asks (C-form-confirm): after
+  every value passes its checks, what will be saved drawn in full as a record's details, Confirm holding the focus, read
+  out with its line and details, a hasty second Enter never answering it. Params, or a function of the record and of
+  what `load` read, so it names the record: "Lock Kartik 2083?" over the run's totals. `when` asks only for some saves
+  (the demo's Duties asks only when duties are taken away).
+- **A row action that is its question alone: a `CrudRowForm` with no `inputs`.** No popup form: choosing it asks
+  (`confirm`, else "{label} {the record's name}?"), then sends what `load` read - else the record as the list has it -
+  through `transform`, and writes what `writes` names. Its buttons are the action's own word (`submitLabel`, else
+  `label`) and "Cancel". The API's toasts say it was done or why not; a refusal writes nothing; Cancel, Esc and the
+  close button send nothing; choosing it again while it asks or sends does nothing. A pay run's Lock no longer needs
+  `api.confirm` by hand. `inputs` is optional for this; an empty list is still a form.
+- **A picker over another listing: `crudPicker` `list`, `usable` and `option`.** `list` reads a listing in place of
+  the controller's `activeListing` - a controller with none, such as a pay run's CRUD endpoints (`PickerListController`,
+  `findListing` optional: without it a value the list does not offer is not looked up). `usable` says which records
+  count as usable - offered, and untagged when a form holds one - in place of the backend's rule (under 30), so a draft
+  run (31) or an invited person (30) can be picked. `option` makes each record's option, its words from two fields or a
+  state's word, made once per record read; the search reads them too. `expireLookups` also marks a CRUD's own `lists`
+  old, so a picker reading one is read again after a change there. Without them, a picker is as before.
+- **A history names who made a change**: `AuditEntry.creatorName`, when the backend's answer carries it, is said as
+  "by Sita Rai" in place of the start of the token. The Nexus backend's `AuditResponseContract` carries only
+  `CreatorUserId` (a token), so HR's histories - every module's - show "User 3fA9b2…" until it fills a `CreatorName`.
+- Proved by `test-crud-row-forms.mts` (36: a question alone, the question made for the record, its words),
+  `test-crud-picker-plan.mts` (11: the listing read, the lookup, the usable rule) and `test-audit-entries.mts` (8), each
+  key line red when broken on a scratch copy (8 of 8); `type-checks/crud-row-confirm.tsx`; nexus.template's
+  `crud-row-form.cjs` (56 with one theme, in both motion modes: the Duties question, Back, a double Enter; Promote as a
+  question alone, its refusal when the role changed since; a post's history naming Sita Sharma and showing another's
+  token; the question at 1280×720 and 390×844, light and dark) and the new `crud-picker-list.cjs` (17: `/admin/posts?people=all`
+  offers the invited people, says so under their names, and picks Maya Tamang), red on a scratch copy of the parent
+  commit's package sources.
+
+### An owner's files that a record's state lets only be added to
+
+Card C-documents-add-only (2026-11-09): since INV-2b a posted goods receipt's documents may only be added to - Drive
+refuses a rename, a mark or a delete with the core's `API_X084` ("These files can only be added to now") - but
+`DocumentList` still offered Rename and Delete on it. Eight exports added (`FileChange`, `FILE_CHANGES`,
+`allowsFileChange`, `narrowFileChanges`, `fileChangesNote`, `ownerFileActions`, `OwnerFileActions`, `FILES_ADD_ONLY`);
+no constant changed. Without the new params nothing moves.
+
+- **`changes` and `changesReason`** on every owner's files (`OwnerFilesParams`: `DocumentList`, `PictureGallery`,
+  `openPictureGallery`, the picture input, `pictureColumn`): the changes a person may make here from the record's state,
+  within what the backend allows - `["add"]` for a posted receipt keeps Upload and offers no Rename, Delete, Make main or
+  Remove, nor a Replace or an Edit that would delete or mark - with the page's sentence under the files. The changes are
+  words (`FileChange`: `add`, `rename`, `primary`, `remove`), the core's `EFileChanges` one for one, as a category's kinds
+  are MIME types. `readOnly` and `lockReason` are as they were: the files shown, nothing offered.
+- **A stale page learns from the refusal.** `FileAdapter.changesLeft(answer)` says which changes a refusal leaves
+  (`NexusDriveAdapter`: `API_X084` -> `["add"]`); after one, the list offers only those for that owner, under the server's
+  words, so a page read while the receipt was a draft stops offering what the server now refuses. The toast says what
+  was refused and why ("The file was not renamed" - "These files can only be added to now: ...").
+- The buttons offered are one pure rule (`ownerFileActions`), and an action called while not allowed does nothing.
+- Proved by `test-files.mts` (113: the rule for documents, pictures and a one-file category, the note, the refusal read
+  through the Nexus adapter), each of 8 key lines red when broken on a scratch copy; `type-checks/files-add-only.tsx`;
+  nexus.template's `/demo/pictures` "Documents only added to" (a receipt on the demo's Drive, Draft, Posted or Reversed,
+  and "Post it in another window") and its new `documents-add-only.cjs` (16 in both motion modes, light and dark at
+  1280×720 and 390×844), red on a scratch copy of the parent commit's sources (7 lines in each mode); `pictures.cjs` 123.
+
+### A gallery whose removals wait for a review
+
+Card C-gallery-pending-removal (2026-11-11): Drive holds the removals of a reviewed gallery (`company-public-gallery`,
+whose changes Nexus support approves): a Delete of a picture the public sees only marks it `pendingRemoval`, still
+served and listed, until the reviewer decides, and the person may Keep it until then. Seven exports added
+(`removalHeld`, `removalHeldSentence`, `removalHeldQuestion`, `PENDING_REMOVAL_TAG`, `REMOVAL_REVIEWER`,
+`OwnerFilesChange`, `OwnerFilesChangeKind`); no constant changed. Without a holding category nothing moves.
+
+- **Records.** `StoredFile.pendingRemoval?` and `removalAt?` (Drive's `removalTime`, while one waits), and
+  `FileCategoryInfo.holdsRemovals?` (Drive's List); each read only when true, so every other record is as before.
+- **The adapter.** `FileAdapter.remove` in a holding category answers the file marked (`removalHeld(result)` reads it);
+  the new optional `FileAdapter.keep(owner, fileId)` cancels the removal (`NexusDriveAdapter`: `PUT File/Keep/{id}` with
+  `{ ticket, id }`, a run-out ticket asked again once). An adapter without `keep` offers no Keep.
+- **The views.** A waiting picture is faded with "Removal waiting for review" as a warning band across its foot, and its
+  buttons are View and Keep (no Delete, Make main or Edit); a waiting document's row says it with the time it was asked
+  and offers Keep in place of Rename and Delete; a waiting main picture's tag sits beside it. In a holding category the
+  Delete asks "If the public sees this picture, it stays until Nexus support approves its removal." and the answer
+  decides: held, the file stays marked and the toast says "Removal sent for review"; else it is gone, as before. A
+  one-file holding category offers no Replace or in-place Edit (its Delete frees no room until the review).
+  `ownerFileActions` gains `holdsRemovals`, `keeps` and the `keep` button.
+- **Params.** `holdsRemovals` (told before the list is read; the backend's says it too) and `removalReviewer` (default
+  "Nexus support"); **`onFilesChange(files, { kind, file })`** after every change the backend took - `upload`, `edit`,
+  `primary`, `rename`, `delete`, `hold`, `keep` - with the files read again, for a page whose record follows its files.
+  `onChange(primary)` is as it was.
+- Proved by `test-files.mts` (142: the records, the Delete and Keep calls, the buttons), nexus.template's `/demo/pictures`
+  "A reviewed gallery" (the demo's Drive holds `guest-public-gallery`, `Demo/Review` publishes, approves, declines) and the
+  new `gallery-held-removals.cjs` (56 in both motion modes: by keyboard, the list, seven themes light and dark at
+  1280×720 and 390×844).
+
+### A row's picker narrowed by the form's value and the row's own
+
+Card C-row-picker-narrow (2026-11-09): nexus.web's Nikasha (INV-3) had to type an asset line's tags, because a picker
+in a line table could not be narrowed by two values at once - the form's Store and the line's Item. Nine exports added
+(`narrowingsOf`, `inputNarrowingsOf`, `narrowInputParamsBy`, `NarrowingRead`, `isEmptyNarrowed`, `formNarrowingNames`,
+`narrowedFollowers`, `DropdownNarrow`, `RowsFormValue`); no constant changed. **What can move for an app:** a row
+input's `narrowedBy` now narrows in rows (it was ignored there), and a row redraws when a value its inputs `dependsOn`
+changes; `narrowedBy` and `narrowQuery` are wider types, so code that reads `params.narrowedBy.name` reads
+`narrowingsOf(params)` instead.
+
+- **Several narrowings at once: `narrowedBy` as a list.** The options must fit every one; the box asks for the first
+  one still empty ("Pick a store first", then "Pick an item first"); the list loads afresh when any changes (one load key
+  for all). A loader is asked with `request.narrows` (every one) beside `request.narrow` (the first), and one narrowing
+  is asked exactly as before. `narrowInputParamsBy(params, read)` narrows by any values; `narrowInputParams` stays.
+- **In rows, by the row's value and the form's: `from: "form"`.** A row input's narrowing names an input of its row
+  (`{ name: "itemId" }`) or of the form around the rows (`{ name: "storeId", from: "form" }`). The Form hands a rows
+  input the form values its rows follow (`formValues`, a prop a rows input used alone takes from the page) and redraws
+  its rows when one changes. A person's change clears a value picked among the old options: a row's Item clears that
+  row's Tags (and down the row's chain), the form's Store clears every row's (to the input's own empty value); a value
+  set from code - a saved document loading - keeps them. The rule is one pure function, `narrowedFollowers`, for a
+  form, a row and every row of a form.
+- **A cell that follows its row: `dependsOn` in rows.** A change of a row value a row input names in `dependsOn` draws
+  the row again, so `cellParams` answers for the row as it is now: a line's Tags at most its Quantity (`{ max }`), the
+  picker's own rule then stopping a save when the quantity drops under the picks.
+- **`crudPicker` narrowed by several values, or by its door's path.** Each value goes into the listing's path when the
+  path names it (`list: StockBalance/Units/{storeId}/{itemId}`), as a query when `narrowQuery` (now one name or a list)
+  names it, else narrows in the browser; each answer is kept per values, shared by every row that names them, and a
+  saved value is named from them. A path listing is never read unnarrowed.
+- Proved by `test-input-narrowing.mts` (104), `test-rows-store.mts` (132) and `test-crud-picker-plan.mts` (20), each of
+  11 key lines red when broken on a scratch copy; nexus.template's `/demo/tabular-form` "An issue" (a Store, lines of an
+  Item, a Quantity and Tags from the demo backend's `StoreUnit/Units/{storeId}/{itemId}`, and "Open a saved issue") and
+  its new `row-picker-narrow.cjs` (25 in both motion modes, the Item and the Tags from the keyboard, light and dark at
+  1280×720 and 390×844), red on a scratch copy of the parent commit's sources (21 lines in each mode); the tabular,
+  group, forms, input-memory, narrowing, dropdown, form-figures and CRUD checks in both modes.
+
+### A mail client: three panes, docked chat windows and a compose window
+
+Card C-mail-client (2026-11-10), card 1 of the mail client spec (the owner: "the mail project UI make UI as mail,
+compose, send, inbox ... chat exist inside mail ... we separate by this types"). 36 exports added: `MailClient`,
+`MailReader`, `MailComposeWindow`, `ChatPopup` with their props, the pure `MailClientHelpers.ts` (the types a rail lists,
+a row's time, a thread's discussion as a chat source, the split and the drafts kept per viewer), and the wire's
+`MailThreadKind`, `MailFolders`, `MailFolderCount`, `MailKindCount`. No constant changed. **What can move for an app:**
+`NexusMessageBackend.readInboxRow` no longer reads a row's `kind` as what the thread opened with (that is `messageType`
+or `headMessageType`): on the MAIL-hub wire `kind` is the conversation's, Mail 1, Chat 2, Domain 3, and a chat's `kind`
+2 used to read as a notification.
+
+- **`MailClient`**: a bar (title, search, the split button, the app's `settings` slot - the ⚙ to its admin pages), the
+  rail (Compose; Inbox, Unread, Sent, Archived with their unread counts; Types - Mail, Chat, one per record kind the app
+  named in `defineChatDomains`, each with its unread count, a type with nothing in it left out), the list, and the
+  reading pane. Side by side, or one over the other by the reader's choice, remembered for them in this browser
+  (`nx-mail-split:<viewer>`); one over the other under 1000px of its own width; one pane at a time under 700px, with a
+  back arrow and a Folders button. It fills what holds it and never scrolls: each pane does. Params only: `source`,
+  `userId`, `view`/`onViewChange` and `threadId`/`onThreadChange` for a page's URL, `settings`, `chatSourceFor`,
+  `renderDomain`, `onChanged` (a bell's `refreshMessageUnread`), `pageSize`, `pollInterval`.
+- **The list reads as mail**: avatar, sender (strong while unread, with the thread's line count), subject — last line (a
+  chat: its last line after its author), the type as a tag in its kind's tone, the time (today's as a time, yesterday's
+  as "Yesterday", older as a date, in the reader's zone and calendar), a select box and a star (only when the source
+  stars). Ticked rows take Archive or Move to inbox, Mark read and Mark unread in one `SplitButton`. The arrow keys,
+  Home and End move between rows, Enter opens (and puts the focus at the subject); more rows load as the end shows.
+- **`MailReader`**: the subject, its type, From → To · Cc (· Bcc as the source gives it), when; the record's
+  `DomainCard`; the mails, the newest open and the earlier folded to a line each, a module's notifications as notes
+  among them; **Discuss (n)** (the thread's chat lines) and **Reply**. A chat is drawn by its head - who, since when, its
+  last line - and Open chat. Opening a conversation reads it.
+- **`ChatPopup`**: a conversation's lines and composer in a window docked at the bottom right, minimisable to the dock,
+  several at once side by side (each next one to the left; on a screen too narrow, over each other, the last used on
+  top), Esc inside one closes it. A mail's Discuss opens its discussion (`mailDiscussionSource`: the chat lines alone,
+  whatever is written there a chat line, a chat line quoting a mail quoting nothing); a chat opens in one at once.
+- **`MailComposeWindow`**: docked, minimise, maximise, close; To, Cc and Bcc (the source's people, To from its
+  `defaults`), subject, a Markdown body that fills the window, Send (Ctrl+Enter) and Discard. What is typed is kept per
+  viewer (`nx-mail-draft:<viewer>:new` or `:reply:<thread>`, every access in try/catch) until it is sent or discarded;
+  closing with words asks "Keep draft" or "Discard". A reply is a new mail in the thread (`ChatDraft.kind: "mail"`).
+- **`Popup` `docked` and `height`** (general): a docked popup is non-modal (no backdrop, no page lock, Tab leaves it),
+  drawn on the body through a portal, placed along the bottom edge above the dock's bars. `height` sets any popup's
+  height (`--nx-popup-height`); without it a popup is `fit-content` tall as before.
+- **The wire MAIL-hub answers** (the backend card may still change it, and says so in its card): an inbox row's `kind`
+  (1-3), `starred`, `fromAvatar`; the Inbox body's `kind` and `domainType` alone (a type); `GET Mail/Folders` answering
+  `{ folders: [{ list, unread }], kinds: [{ kind, domainType, unread, total }] }`; `PUT Mail/MarkRead`, `MarkUnread`,
+  `Star`, `Unstar` with `{ ids }`; Reply's `messageType: 1` for a mail (Chat stays the default). `MessageSource`'s
+  `folders`, `markRead`, `markUnread` and `star` are optional, and `MessageBackend.supports(...)` turns them off for an
+  older API. `localMessageSource` answers all of it (`chat` threads, `starredBy`, the failures `folders` and `marks`).
+- Proved by `test-mail-client.mts` (103) and the CSS contract; nexus.template's `/demo/mail-client` (a mailbox with a
+  discussion, chats, two record kinds and a month of reports; Kiran writes, Keep a draft, Answer slowly, Server down,
+  Full window; empty, loading, failed and a 390px phone) measured by a 73-check browser pass (the client never scrolls,
+  one row height, the keyboard, Discuss and chat windows non-modal at the bottom right and side by side, Esc, minimise,
+  compose with its draft, a reply as mail, types, the record's card, stars, Archive, the remembered split, no layout
+  shift, no box in a box, a phone's one pane and no sideways scroll, the muted words at 4.5:1 or more on the open and
+  the hovered row in all seven themes light and dark, cozy density, animations on), and `popup-windows.cjs`,
+  `mail-thread.cjs` and the CRUD popup checks unchanged.
+
+### A worked-out input that can be typed in: the total sets the price
+
+Card C-editable-calculated-amount (2026-11-10), the owner: *"if i put final 2500 inside the calculate amount then it
+calculate or set the price which is very easy. this logic we have inside 06-20 ... as possible generic dynamic."*
+Additions only: 6 exports, all from `nexus-shared` (`priceFromNet`, `PriceFromNetOptions`, `PriceFromNetFound`,
+`PriceFromNetRefused`, `InputSolved`, `NetAmountOptions`). **One behaviour changes:** `crudInputs.netAmount()` can be
+typed in by default (below); `{ editable: false }` keeps it as it was.
+
+- **`InputCompute.solve(typed, values, withValue)`**: a worked-out input worked backwards. With it a Number input's box
+  is a real text box (a NumberBox: its own Tab stop, the person's number format, its prefix and suffix) instead of the
+  `<output>`. Typing does nothing until the person leaves the box (Tab, a click away) or presses Enter; then `solve`
+  answers the values of the inputs it is worked out from (`InputSolved`: `{ values, note? }`), a sentence to refuse, or
+  `null` to change nothing. The answer is written as the person's own change (**`FormStore.setFromPerson(values)`**:
+  the inputs mount again with it, their rules are asked, the form's `onFieldChange` runs, inputs narrowed by them lose
+  their picks, it is a change for Save, drafts and the leave guard; nothing while the values load) and the input still
+  holds no value of its own. The box then shows the figure worked forward again, and a line under it says what was set
+  ("Price set to 2,458.21."), and when the typed figure cannot be reached exactly, the nearest it now shows ("2,500.04
+  cannot be reached exactly; nearest is 2,500.05. Price set to 2,458.26."). A refusal is said in `--nx-danger` with the
+  alert icon and the box goes back. An input that is read-only or disabled is never written: that is refused by name.
+  Escape puts back the figure (and closes nothing); Enter with nothing new submits the form as from any box; an emptied
+  box or the same figure changes nothing. Read-only, disabled and loading forms keep the box read-only, disabled, blank.
+- **The line under the box** shares one place with the hint (`nx-field__notes`, a one-cell grid, at least a line tall),
+  so nothing below moves when it comes and goes; it is `aria-live="polite"` and part of the box's description. It shows
+  until the figure moves on (another input changed), then the hint is back.
+- **`priceFromNet(target, { quantity, discountPercentage, vatPercentage, decimals = 2, places = 2 })`**: the price that
+  comes to a net amount by the server's rule (`priceAmounts`). Plain division (06-20's `FindOriginalPrice`) often lands
+  a paisa off, because each step is rounded; this gallops from that estimate and halves among the prices at the
+  price's own places, each worked forward on exact decimals. The net amount never falls as the price rises, so **when
+  any price reaches the figure exactly, the smallest such price is answered** (`exact: true`); otherwise the price whose
+  net amount is nearest (a tie goes above, so the total is never short), with the net amount it reaches. A quantity of 0
+  or none counts as 1; a negative figure or quantity, a 100 % discount and VAT of -100 % are refused in words
+  (`{ ok: false, message }`). 2,500 at 10 % and 13 % is 2,458.21 exactly.
+- **`crudInputs.netAmount(keys?, changes?, { editable = true, priceDecimals = 2 })`** wires `solve` to `priceFromNet`
+  on the `PriceKeys` (the quantity key too) and writes the price at `priceDecimals`. Its hint is "Price less the
+  discount, plus VAT. Type a total to set the price." (the old hint with `editable: false`). A `changes.compute` of the
+  page's own (a counter's server preview) has no `solve` and stays read-only, as before.
+- **Not in rows** in this card: rows came with [card C-rows-solve](#a-rows-worked-out-input-typed-in-a-lines-total-sets-its-rate).
+- Proved by `test-number-helpers.mts`: the owner's case and 20 more, and **560,000 targets** (every 0.01 to 100.00,
+  against 8 rate pairs from -5 % to 60 % off and 0 % to 13 % VAT, quantities 1, 2, 3, 7 and 1.5, and a price in 0, 2
+  and 3 places) against a sweep of every price: the net amount never fell, every one of the 287,075 reachable targets
+  was answered with its smallest exact price, every one of the 272,925 others with the nearest net amount any price
+  reaches, and every answer's net amount is what its price comes to (about 3.5 s). `test-form-store.mts` (the preset's
+  `solve`, `setFromPerson`: a change, its rule, `onFieldChange`, a new stamp, nothing while loading), the CSS contract,
+  and nexus.template's `/demo/form` "Worked out from other inputs" with `form-figures.cjs` (156 in each motion mode): 2,500
+  typed sets 2,458.21; 2,500.04 the nearest; Enter, Escape, an emptied box; a refusal; nothing below moving in compact
+  and cozy at 1280 and 390 wide; a percentage of marks with no money in it; the box as tall as Price with its edge and
+  background in three designs; the line under it at 4.85:1 or more and a refusal at 5.5:1 or more in 7 themes light and
+  dark. `form-confirm.cjs` unchanged (80).
+
+### A customisable dashboard: widgets in size presets, one call per module, only near the screen
+
+Card C-dashboard-board (2026-11-10), card 1 of the dashboard widgets spec (the owner: "customizable dashboard ...
+similar lighweight best optimize ... some can specific module base components only allow to add on same module, some
+can allow to add any place ... what's new, version info and more. comming soon"). Additions only: 58 exports, 35 from
+`nexus-shared` (`DashboardInterfaces.ts`, `DashboardHelpers.ts`) and 23 from `nexus-shared/client` (`DashboardBoard`,
+`WidgetFrame`, `WidgetLink`, `WidgetNavigateContext`, and the looks). No constant changed. Two shared components gained a
+prop: `Popup` `drawer` and `ChatFailure` `flat`; without them both draw as before.
+
+- **`DashboardBoard`**: a bar (the place's `title`, the page's `actions`, Refresh, Customise) over a 12-column grid whose
+  rows are three controls tall (102px compact, 114 cozy), `grid-auto-flow: dense`. A widget takes a size preset - S 3×1,
+  M 6×2, L 6×4, W 12×2, T 12×4 (`WIDGET_SPANS`) - from the sizes it declares, the first its default. The board is a size
+  container: under 48rem of its own width a small widget takes half and a medium or large one the whole; under 30rem
+  every widget is the full width, in the layout's order. A layout is an ordered list of `{ code, size }`; no coordinates.
+  Params only: `place`, `placeModule` (default `place`), `widgets` (the app's registry), `canSee(widget)` (the module
+  held, the key held), `layout` / `version` (the person's, or `null`), `defaultLayout` (the company's, else the code's),
+  `onSave(layout, version)`, `onReset(version)`, `canCustomise`, `canSaveCompanyDefault` + `onSaveCompanyDefault(layout)`,
+  `loadModule(module, codes)`, `initialData` (read with the page: drawn at once), `moduleLabel`, `onNavigate(href)` (the
+  app's router for every link inside), `loadMargin`.
+- **Edit mode** (Customise): a dashed edge on every widget, its heading the drag handle, a size menu holding only its sizes,
+  and Remove. **Drag** by pointer events, no library: the widget follows the pointer and the others make room as it
+  passes over them; Esc puts the order back; listened for on the window, since the grid moves the widget in the document
+  and a moved element loses a pointer capture. **Keyboard**: a focused widget moves with the arrow keys (up and down to
+  the nearest widget in the row above or below, `neighbourInColumn`), Home and End; Enter or Space opens its size menu;
+  Delete or Backspace removes it, the focus going to the widget in its place. Every move is read out. **Add widget**
+  opens a drawer (`Popup drawer`) listing the widgets this place may hold, by module (the place's own first), each with
+  its shape on a small grid, its sizes, and Add or "On the board"; closing it shows the widget added last with the focus
+  on it. **Save** (with "Save as the company's default" in its menu when allowed), **Cancel**, **Reset to default** (Save
+  then calls `onReset`). A save answered `stale` (the server's 409 with the saved layout) draws that layout and says
+  "Changed in another window: the layout saved there is shown."
+- **Hidden widgets**: a widget the person cannot see now (`canSee`), one not allowed in the place (`placement: "own"` on
+  another module's board), or one the app no longer declares, is drawn nowhere and offered nowhere, but **keeps its place
+  in the saved layout** (`mergeHidden`: each after the drawn widget it followed), so it comes back where it was.
+- **Data**: `WidgetDefinition.batch: { module, codes?, pick? }` puts a widget in its module's one call per draw
+  (`createWidgetBatcher`: everything asked in one task goes together, a call per module with every code its widgets
+  need); `load(context)` is a widget's own call; a widget with neither needs no data. **Only widgets near the screen
+  load** (one IntersectionObserver for the board, `rootMargin` and `scrollMargin` of `loadMargin`, so a scroller between,
+  as an admin shell's page area, is widened too). Each answer is kept for the page's life, or `refresh` seconds while on
+  screen (one 5-second timer for the board, nothing while the page is hidden); Refresh reads everything near the screen
+  again and the rest when it comes near. A module that fails fails its own widgets alone.
+- **`WidgetFrame`**: the title, an optional link ("View all"), its own refresh, and its body in one of four states - bones
+  by its size while it loads (one line for S, three for M and W, seven for L and T), the `empty` sentence, the failure
+  with Try again (`ChatFailure flat`: the tint without an edge, no box in the frame), or its content. Its size is the
+  grid's, so nothing moves when the data lands. Usable alone.
+- **The looks**: `StatWidget` (figures side by side as they fit, each a link if it has `href`, a tone dot), `ListWidget`
+  (picture or icon, words and a muted second line, a time and a tag; **only the rows that fit whole**, the rest counted
+  on its more line: `total`, `more: { href, label? }`, `fit`), `CalendarWidget` (the package's `Calendar` with typed
+  marks under each day - `holiday`, `leave`, `event` or the app's own `kinds` - a holiday's number in the danger tone,
+  a legend counting the month's marks, the picked day's marks beside the month or under it; AD or BS; `marksByDay`
+  spreads a mark over its days), `NewsWidget` (release notes: title, version and Released / Coming soon tags, the
+  application and day, the first lines of the Markdown notes, Read more), `VersionWidget` (the version large, the
+  application and build day, What's new).
+- **`Popup drawer`** (general): the window's whole height at its end edge, its width from `size` (all of it on a phone),
+  modal, neither moving nor maximising, fading in as every popup does.
+- Proved by `test-dashboard.mts` (63: the sizes, own and anywhere, canSee, a layout kept whole with hidden widgets, moving
+  by keyboard and pointer, the Add list, the batcher - one call per module, the cache, refresh seconds, a shared call,
+  failures per module, a pick that throws), the CSS contract, and nexus.template's `/demo/dashboard` measured by
+  `dashboard-board.cjs` (98 in each motion mode): the first draw asks each module once and nothing below the fold until
+  it is scrolled near (then one call of its module alone), no layout shift, the spans, rows three controls tall in compact
+  and cozy, no list with a half row, the keyboard (move, size menu with only its sizes, Delete, focus kept), the drawer at
+  the right edge the window's height (the whole width at 360px), Add, Save, Cancel, Reset, drag and Esc, a stale save, the
+  company's default, Kiran's hidden Request widgets back in place for Puja after Kiran's save, a failed module with Try
+  again, 360px with no sideways scroll and every widget the full width in order, no box inside a widget, and every word
+  at 4.5:1 or more (the lowest 4.85) in all seven themes light and dark, the drawer's too. `popup-windows.cjs` unchanged.
+
+### A row's worked-out input, typed in: a line's total sets its rate
+
+Card C-rows-solve (2026-11-10), the follow-up C-editable-calculated-amount named: the owner's "if i put final 2500 inside
+the calculate amount then it ... set the price", for a table of lines (Inventory's Dakhila). Additions only: 1 export
+(`withComputeSources`, `nexus-shared`), and new members of exports already listed (`RowsStore.setFromPerson`,
+`RowsInputProps.computeWith`, `crudInputs.lineAmount`, `PriceKeys.other`, `NetAmountOptions.taxed`). **One behaviour
+changes:** a row input with `compute` was ignored in rows (drawn as a plain input holding a value); it is now worked out
+on each row and holds none.
+
+- **`compute` works in a tabular or group form's rows**, as in a form: `from` names the row's inputs, `values` is the
+  row, `withValue` is the rows' new **`computeWith`** (a `Form` hands the rows its own unless their params name one;
+  a new one draws every row's worked-out cells again). Read-only by default (an `<output>` on the read-only tint, no Tab
+  stop, named "Amount, line 2" in a table); with `solve` a Number is a box that can be typed in. A table has no line under
+  a cell, so the note ("Line 3: Rate set to 2,458.21.", or the nearest, or a refusal in red) goes in the line under the
+  rows until the figure moves on, and a hidden live region in the cell says it. Enter with a new figure sets it and
+  stays; with nothing new it moves down the column (on the last line it adds one), as from any cell. Escape puts the
+  figure back.
+- **The rows hold no value under a worked-out name** (as `FormStore`'s `isComputedInput`): a loaded row's field of that
+  name is dropped, a value from code, an `onRowChange` or `deriveRows` patch, `newRow` or a new row's values naming it is
+  not taken, it has no rule and is never remembered, so the rows' value, `isChanged`, Save and the leave guard never see it.
+- **`compute.from` joins the row input's `dependsOn`** (`withComputeSources`), so the row draws again when a source changes.
+- **`RowsStore.setFromPerson(key, values)`**: a person's change of a row made through another cell, written as code
+  writes (the cells mount again with it) and followed as typing is (`onRowChange` runs for each value, narrowed followers
+  clear, value listeners hear it, so a parent form has unsaved changes and its leave guard asks).
+- **`ComputedInput`** (inside the package, `Components/Inputs/ComputedInput.tsx`) is the one worked-out box, lifted out
+  of `Form.tsx` with `read`/`write` callbacks; `Form` and the rows' cells both draw it, and the Form behaves as before
+  (`form-figures.cjs` unchanged, 156 in each motion mode). `formInputLabel` moved with it and is still exported from the
+  same place.
+- **Found and fixed on the way, in Form too:** a click straight into the Price after typing a total dropped the focus to
+  the page, because the Price box mounts again with its new value; it now lands in the box that took its place.
+- **`crudInputs.lineAmount(keys?, changes?, options?)`**: `netAmount` for a table of lines - the rate (`unitPrice`)
+  times the `quantity`, less the discount, plus VAT - as a 9rem column, typed in per row with `priceFromNet`.
+  **`PriceKeys.other`** adds an amount whole after VAT (a line's other costs, rounded to 2 places: the Inventory
+  service's `StockMaths.Line`), taken off a typed total before the rate is worked out ("The amount cannot be less than
+  the other costs."). **`NetAmountOptions.taxed(withValue, values)`** says when the discount and VAT count (a purchase's
+  lines, not a donation's), read from `computeWith`.
+- **An `<output>`'s text fills its box** (`.nx-field__output-text { flex: 1 }`), so the box's `text-align` places it: at
+  the end of a table's number column, as a typed figure is.
+- Proved by `test-rows-store.mts` (section Z: no value held, `dependsOn` joined, `setFromPerson` with `onRowChange`, the
+  value listeners and a remount, other costs, `taxed`), the CSS contract, and nexus.template's `/demo/tabular-form` "A
+  goods receipt" with `rows-solve.cjs` (50 in each motion mode): figures on open and per keystroke, exact (Enter) and
+  nearest (Tab), Escape, a refusal, Tab order, a click into the Rate, Donation through the form's `computeWith`, Save
+  sending neither worked-out figure; 7 themes light and dark at 1280 and 390 wide, the Amount and the note at 4.5:1 or
+  more. `tabular-form.cjs` (85), `group-form.cjs` (61), `form-confirm.cjs` (80) and `input-memory.cjs` (22) unchanged.
+
+### The mail client's fixes, and a Crud form's computeWith
+
+Card C-mail-client-fix (2026-11-10), the four gaps nexus.web's Message › Inbox (card MAIL-client-pages) found in the mail
+client, and the gap C-rows-solve left for a Crud page (Inventory's Dakhila). Additions only: 5 exports (`nexus-shared`:
+`followMailReadMarks`, `followMailboxReadMarks`, `MailReadMarks`, `crudComputeWith`, `sameShallow`) and new members of
+exports already listed (`MailClientProps.title` may be `false`, `.description`, `.headingLevel`;
+`CrudFormOptions.computeWith`). **Two behaviours change:** a `threadId` that names a chat opens its chat window, and the
+client's folder counts and its `onChanged` wait for the read marks on their way.
+
+- **A long list no longer makes the page scroll.** `.nx-mailbox__rows` scrolled but was not positioned, so each unread
+  row's visually hidden ", unread" (`nx-visually-hidden` is `position: absolute`) was placed against the page at its
+  row's place down the list: 126 unread rows made the demo page 8,253px tall instead of 3,286px, and nexus.web's Inbox
+  taller than the window. Every scroller of the client and the chat is now `position: relative` (the list, the rail, the
+  reader's body and record card; the chat's thread, list, New chat, mentions and people), and the CSS contract holds
+  every rule of `Nexus.Mail.css` and `Nexus.Chat.css` that scrolls to setting a position (9 today).
+- **A link to a chat opens its window.** A `threadId` the page sets (the bell's `?thread=`, an e-mail copy's) that names
+  a chat opens its chat window as a click on its row does - once its kind is known, from its row in the list or from its
+  head when the list shown does not hold it - once per opening, so a window closed stays closed until the row is clicked.
+- **The counts wait for the read mark.** A conversation shows read as soon as it opens, before its read mark reaches the
+  server; the client read its counts at once, so the Unread folder stayed one too high (nexus.web's `mailbox.ts` waited
+  for its marks itself). The reader's and the chat windows' read marks now go through `followMailboxReadMarks`: the
+  folder counts are read once no mark is on its way, and read again (with `onChanged`, the page's bell) when each is
+  answered. A page needs no wrapper of its own for its counts.
+- **One heading on a page.** `title={false}` draws no title in the bar (the search starts it), for a page whose own
+  heading names the client (nexus-admin's `AdminPage` with the menu row's words); `description` draws a sentence beside
+  the title, clipped to the rail's width with the whole of it on hover; `headingLevel` (default 2) makes it the page's h1.
+- **`CrudFormOptions.computeWith(values, { action, row })`**: what a Crud's Add and Edit forms hand their worked-out
+  inputs (`compute`, and the rows' `crudInputs.lineAmount` with `taxed`), worked out from the form's own values after
+  every change and before the browser paints. The answer is compared field by field with the last (`sameShallow`), so a
+  fresh object of the same figures redraws nothing; a new one redraws the worked-out cells alone, with nothing remounted
+  and the focus kept. A rule that throws keeps its last answer and says why in the console (`crudComputeWith`).
+- Proved by `test-mail-client.mts` (112: a mark held while on its way, let go and counted again once answered or refused,
+  every other door kept), `test-table.mts` (490: `crudComputeWith`, `sameShallow`), the CSS contract (3,035), and
+  nexus.template's browser checks on a production build of their own: `mail-client.cjs` 92 (new M: 126 unread rows keep
+  the page's height, every hidden word inside the client, the client as the window leaves the document no taller than it;
+  N: a link opens the chat's window, from its head when not listed, a closed one stays closed, a row click brings it back;
+  O: with read marks 1.5s slower than a count, the Unread folder still drops by one; P: one heading, the bar one height),
+  `rows-solve.cjs` 56 in each motion mode (new L: the receipt on a Crud page, `/demo/tabular-form` "The same receipt on a
+  Crud page", Source switched from the keyboard redraws the lines with the same inputs and the focus kept, a donation's
+  line typed in, the save's total), and `form-figures.cjs` 156 in each motion mode, unchanged.
+
+### Details as the 2026-06-20 window drew them, a list of rows as a table, history names from the app
+
+Card component-details-0620-look (2026-11-10), the owner's asks 1, 2 and 6 for the subscriber window, built for every
+page with a details view.
+
+- **The built-in details look** (`CrudDetails`: a Crud's details popup and workspace tab, a tree's panel, a form's
+  question): each field a label and its value in a box - a `--nx-border` hairline on `--nx-surface-2` - two pairs to a
+  line where the details are 46rem or wider and one where they are not, the label over its value under 20rem. The details
+  are their own size container (`nx-crud-details`), so a popup, a tab, a column beside a panel and a question's box each
+  get the look their width allows; every label has one width, so the values of both columns and of a field across the
+  line start on shared edges, and a label sits on its value's first line. Sections from the columns' `group` get a
+  numbered heading, "01. Contact", "02. Account", in the order they come. A `wrap` or Markdown column takes the whole
+  line. A form's question (`confirm`) now shows two fields to a line on a wide box, not three.
+- **`TableColumn.table?: readonly TableColumn[]`**: the value is a list of rows (a subscriber's contacts, devices). The
+  details draw it as a small read-only table across the line - a header row, each row's number first, an option's tone
+  as its tag, a boolean as Yes or No in words - and say "None" for an empty list. A data table, an export and a search
+  show how many rows it holds (`formatCellText`).
+- **`setAuditActorNames(resolver | null)`** and its type **`AuditActorNamesResolver`** = `(tokens: string[], signal:
+  AbortSignal) => Promise<Record<string, string>>` (`nexus-shared`): how `AuditHistory` names the person behind an entry
+  its answer names nobody for. It asks once for each page it shows, only for tokens it has had no answer for, and says
+  "by {the answer}" ("by Sita Rai (sita.rai)"); answers are kept for the page's life, a failed call keeps
+  "User 3fA9b2…" and is asked again by the next history, a token left out of the answer keeps it. The answer's own
+  `creatorName` still comes first.
+- **A workspace's popup footer is the Details tab's alone.** View history, Edit, Close and the load's line show only
+  while the built-in Details tab is chosen; every other tab runs to the popup's foot and has its own `CrudTabFooter`. The
+  title bar's X and Esc still ask about unsaved changes, as do the footer's Edit and Close on Details. A details popup
+  without a workspace is unchanged.
+- **A section that changes on its own** (`details.sections: [{ group, edit, label?, hidden? }]`, type
+  **`CrudDetailsSection`**): in a workspace's Details tab, a small ghost Edit at the end of the section's heading opens
+  the Crud's own Edit form (`edit: "edit"`) or one of its `rowForms` (`edit: "<id>"`) over the workspace, offered by the
+  row menu's rules (a list that offers Edit, the endpoint allowed, no lock); once saved the workspace reads the record
+  again (`refresh()`), the Details are drawn again in place, and the focus is back on the button. `CrudDetails` takes
+  `headingEnd(group)` for anything at the end of a heading, and follows a new `row` in place.
+- **`openCrudForm`** and its **`CrudFormRequest`** are exported from `nexus-shared/client`: a controller's Add or Edit
+  form in a popup, opened from anywhere.
+- **The workspace's profile picture is a circle** (`ProfilePicture`'s new `round`; the pictures window keeps the
+  picture's own shape and aspect).
+- Proved by `test-audit-entries.mts` (25), `test-table.mts` (491), the CSS contract, and nexus.template's
+  `crud-workspace.cjs`, `form-confirm.cjs` and `crud-row-form.cjs` on a production build.
+
 ## 4.0.0
 
 **Breaking: an input's `type` is a number, a member of `EInputTypes`, and a string is refused.** Everything else in