# Changelog Notable changes, newest first. Versions follow [semver](https://semver.org); while the major is 0, a minor may break something and will say so here. ## Unreleased - **The operating record (E43 §13).** The record page and peek's properties rail rows ARE the controls: a column declaring `control:` renders the same trigger, the same ladder and the same `applyControl` POST the table cell renders — one shared builder (`controlbutton.tsx`), so the two surfaces can never drift. The ladder gains its TEXT rung (an edit form whose single non-section field is `text`/`textarea` opens as a modal from a pencil-glyph trigger), which gives the record page title-edit and body-edit with zero new format keys. A `control:` naming a form that fits no rung now warns **`control-unbound`** at load — a new user-visible diagnostic; the control renders nothing and the form keeps its row-action surface — and definition warns now also print when rendering (`dj dashboard --out`) and serving, not only under `dj lint` / `dj parse`. Precedence rule: the record view's title column never renders the text-rung trigger in list/card cells (a title click reads, never renames); its rename affordance is the record page's pencil. - **One collection, two projections (E43 §14).** The board widget gains a board ⇄ list toggle: the list projection renders the SAME filtered collection through the rows presentation (dense table mode, clamps, cell controls), filter and search state survive the flip, and the choice persists per widget id (localStorage `dj-proj`, non-default only). New format key: the board widget accepts **`toggle: off`** to pin the board projection — the only payload byte the feature spends, and only when declared. The board's append footer now opens its form as a MODAL (the board is a spatial surface, the E19 board-card precedent) — which is where §15's composer renders. - **The composer (E43 §15).** A modal append form now renders as Linear's composer, DERIVED from what the form already declares — zero new format keys: the required text field bound bare to the block's title column becomes the borderless hero input, the first textarea the description area, and every options/person/record field a chip in the chip row, each opening the picker its kind already owns (the one menu palette, the directory palette, the relation picker). A "Create more" toggle keeps the modal open across submits through the existing onDone seam, resetting the panel and returning focus to the title; the posted op is byte-identical to what the old layout posted. Append forms' `row:` binding now travels in the payload beside `set:` so the client can read the title binding. - **Radios die; options are a chip everywhere (called-out).** The radio/checkbox fence is replaced by the chip-and-menu control in every presentation (modal edit forms and stacked panels keep their labeled layout with the chip swapped in). Serialization keeps the exact wire bytes via the hidden-input precedent — same names, same `'; '` joins, the same `_rejected` companion computed from the declared choices minus the picks. **Semantic change:** the free-text "Other:" escape now renders ONLY where the field declares `other: true` — the historical default-ON escape let every options field silently undermine its declared vocabulary; a format relying on it declares the one key it always meant. One degenerate corner moved with the fence: `_rejected` is now computed as declared-choices-minus-picks (the spec's own definition), so a typed Other value equal to a declared label is no longer simultaneously accepted AND rejected in the posted body; the wire format itself is byte-identical. ## 0.25.0 — 2026-08-13 - **Relations become visible and queryable (E38 t3+t4).** Record chips render resolved titles and open the peek; a picker adds a relation through the one write door; removing from the inverse end patches the record that actually stores it. Graph views gain a record mode drawing `rel:` edges, and the query grammar gains `has` plus derived fields — so "blocked" is a `where:` clause, not a feature. The linear template declares blocks / blocked-by / relates-to / duplicate-of and ships a Blockers view; no relation cells ship, so a fresh scaffold is unchanged. - **`surface: form` (E40 t1).** A standalone intake page rendering one declared form: submit lands an operational record through the guarded doors, and the thank-you state degrades by sentence rather than showing a reader an unsubstituted token. `dj form` renders it; the surface kind tables move together so a half-declared kind fails the build. ## 0.24.0 — 2026-08-13 - **The relation grammar (E38 t1).** `relations:` declares the vocabulary — names, direction, inverses — and a block carries one by declaring `relation: ` on an authored column: nothing synthesized, no reserved prefixes, `from:` derived from who declares it. Targets are uuids (the portable address), gated by identity and tier, shape-checked in the record funnel (non-uuid, self, >64, duplicates), and resolution-checked at lint with the canonical scope rule. `style: record` and `kind: record` enter the catalogue; their chip renderer and picker land next release. - Relation cells prove themselves cloud-side with ZERO platform changes — they ride the same cell machinery as every other column, which was the design's claim and is now a contract. ## 0.23.0 — 2026-08-13 - **`compileRecordWrite` (E40 t1, engine half).** The record-write compiler extracted from `annotateRecords` — one compiler for every record write, container or none: the cloud's operational command door consumes it directly, and `annotateRecords` is now a container shell around it. Byte-identity pinned: compile + container writer equals the old path exactly, refusal sentences included. - **Forms learn who may run them.** `open: true` on an append form says any member may file this; `self: ` on an edit form says the person that column names may run it — the grammar of capture-class writes, with `{actor}` substituting the resolved handle in `set:` templates. Findings: `form-open-canonical`, `form-self-not-person`, `form-self-append`. - One id-number kernel: `nextId`, `maxRecordNumber` and the new `nextAutoId` all reduce through `maxIdNumber` — three allocators, one answer. ## 0.22.0 — 2026-08-13 - **The side peek.** Opening a record from a board or table shows it in a panel over the view you were reading — scroll, filters and place survive; Escape and the scrim return focus to the cell you opened from; prev/next walk the collection in its rendered order. A direct `#/r/` link still opens standalone: the peek is how a context opens a record, not a new address. - **Board swimlanes.** `rows: { by: }` beside `lanes:` — a declared second axis, bands collapsing and persisting like the sidebar. Drag stays within a band on purpose: a cross-band move would need two referee-gated writes, and a half-landed pair leaves a card where nobody dropped it; the band column's own control menu is the honest cross-band path. - **The facepile.** Two or more people in one cell stack into overlapping initials with an honest +N and the whole roster in the label; a single handle keeps the exact chip bytes it always rendered. One builder, server and client, like every person surface before it. ## 0.21.0 — 2026-08-13 - **The comments composer (E36 t5).** The record view's dj/comments section becomes a living thread: fetch-on-open, a markdown composer built on the E34 mention control (@-people and tags work day one, Cmd/Ctrl+Enter posts), optimistic append with refusal-restore, own-message edit/delete, resolve/reopen — and honest read-only degrade where the door says no. Writing at conversation speed, no referee between colleagues. ## 0.20.0 — 2026-08-13 - **Back-references (E37 t4).** Mentions become views: "mentions of @me" and the record view's `of: subject` sections answer from the index using the vocabulary @me already speaks. - **dj/work (E36 t6).** The cross-KB spine as a BINDING, not a table: an operational block maps its columns onto identity/title/state/people/dates roles; `closed_when` names the closed states the wipe report and the archive read. Skip the binding and your KB is invisible to org-wide queries — opt-in, never a tax. - **Extension without forking (E36 t2).** A format extends an installed plugin's schema in its own namespace; plugin upgrades touch only plugin-owned columns, so an extended KB survives an upgrade intact. - **dj/activity (E36 t4).** Declared tier MIXED and saying so: git history is the canonical activity log for free; the plugin supplies only what git never saw. - **dj ops archive (E35 t5 CLI).** Close-out as one command: the snapshot document lands on the _archive/ shelf through the referee, archived reads answer with the shelf address, and the work index rebuilds. ## 0.19.0 — 2026-08-12 - **The record view (E37 t1).** A view whose subject is ONE record: properties from declared columns, prose, plugin slots, addressable at `#/r/…` — and identity cells on boards and tables open it. Collection views stop being the only way to see work. - **The mention index (E37 t2, engine half).** The parser collects `@handle` mentions per document, block and row the way it collects links — prose and cells, fence/code/email-safe, person columns split per the chip grammar. `dj mentions` queries it; `dj parse --json` carries it; the payload gains a `mentions` key only on formats that adopted the new grammar. - **The plugin contract (E36 t1, engine half).** A plugin declares schema, surface and tier; `plugins:` installs by name from the `dj/*` registry; operational plugin TABLES are refused at compile (one operational store — an operational plugin ships block definitions). `dj/comments` is declared: its tables, its thread widget, tier conversational. ## 0.18.0 — 2026-08-12 - **`dj pull --records` (E35 t4).** Materialises a KB's operational records into `.records.local.yaml` mirrors — wholesale rewrite, per-block `op-` stamps in a `# dj:pull` header, stale mirrors deleted, the one gitignore pattern ensured idempotently. `dj rows patch` falls back to the mirror's header stamp when no read was recorded, so a cloned repo plus one command is a working picture whose writes still meet the revision guard. - **`dj ops wipe-report`** prints the working-layer honesty check: what would be lost if the ephemeral store were cleared tonight. - **The linear template is born migrated**: Issues declare `tier: operational` and ship no committed records — a new KB starts with its working layer in the database, no migration ever needed. - Operational writes say what they are: "updated · working layer at op-N (no commit — operational write)" instead of a committed line with placeholder garbage. ## 0.17.0 — 2026-08-12 - **The tier declaration (E35 t1, decision 0021).** A block may declare `tier: canonical | operational | conversational`; canonical is the default and normalizes to absence, so a tier-less format compiles and renders byte-identically. Non-canonical blocks require `identity: uuid`, refuse committed records in both spellings (inline rows and `.records.yaml` entries), and suppress empty-table checks — their canonical body is a bare heading forever. - **The interchange layer (E35 t2 groundwork).** `.records.local.yaml` is the materialised working copy of operational records: exempt by filename, refused when committed, git-ignored by one stable pattern. `serializeSidecar` round-trips byte-stable; `validateRecords` exposes the validation funnel to hosts; `resolveOwner`/`idOf` resolve any location up to its owning entity; one text flattener serves the parser and the graph. ## 0.16.3 — 2026-08-12 - **A mention is atomic only once it NAMES somebody.** `@fff` typed toward the picker resolves to nobody, so it stays ordinary text: Backspace takes one character and a typo is fixable. A resolved handle, and any document link (nobody hand-types one), still deletes whole. With no directory at all, nothing is atomic — exactly the plain-text behaviour fields had before mentions existed. The tag paints under the same rule, so what looks like a tag deletes like one. - **The mention menu is driven from the field, with honest keys.** Arrows move the highlight, Tab or Enter takes it, Escape leaves the text alone — and the numeric badges are gone from this menu, because the reader is typing and a digit belongs in the text, not in a shortcut that never fired. ## 0.16.2 — 2026-08-12 - **A mention behaves — and looks — like ONE thing.** Backspace beside a mention deletes the mention, not its last letter: erasing `[Feedback Capture]()` used to take 40-odd keystrokes through a path the reader never typed. A selection is still the reader's own intent and is never overridden, and away from a mention the browser's editing stands untouched. - Text fields paint a tag behind each mention (a person's handle as typed, a document link as its title). The value a field holds and submits is unchanged portable text — the tag is a mirror layer, aria-hidden and pointer-transparent, so a browser that lays it out badly costs a highlight and never the field. ## 0.16.1 — 2026-08-12 - **@-mention candidates arrive in SECTIONS.** A list mixing one person with seven epics made the reader classify by eye; the menu now draws a header whenever the kind changes — People first, then documents under the type their own format declared (Epic · Decision · Service…). The section names are the corpus's vocabulary, never the engine's: a vault about kitchens groups recipes and suppliers without the engine learning either word. Typeahead hides a section whose every item is filtered out, and a menu whose items declare no group renders exactly as it always did. ## 0.16.0 — 2026-08-12 - **Person-scoped queries (E34 t5).** A filter value spelled `@me` scopes a view to whoever the host says is reading — resolved client-side from the live directory's own answer, because the baked artifact is role-independent by design (one bake, every reader). With no host naming the reader, `@me` matches NOTHING and the token says why: an empty board reads as "nothing assigned to me", so a filter that quietly matched everyone would lie in the one direction nobody checks. Any `@handle` value matches a cell's handles rather than its text, so a row assigned to two people answers to either. A value carrying no `@` compares exactly as it always did — the vocabulary is opt-in by the reader's own spelling. - Facets on a person column label their buckets with display names while their values stay handles: readers pick a person, documents keep the portable spelling. - **The linear template speaks person (E34 t4).** `Assignee` renders as a chip, the `assign` form offers the host's directory, a starter `people.yaml` ships beside the format, and a "My issues" view is there to type `@me` into. ## 0.15.0 — 2026-08-11 - **The person kind (E34 t1+t2, decision 0020).** People enter the engine as a HOST-SUPPLIED DIRECTORY, never as engine knowledge: documents store handles as portable text (`@felipe` or `felipe`), the format names what a person column means, and the host maps handles to display names. No declaration → every person surface degrades to plain text, and the payload grows no new key (the step-0 byte pins stay green by construction). - **Column style `person`** — a handle, or a comma/space-separated list, drawn as chips: a round initial plus the resolved display name. An unresolved handle renders as the muted handle itself — a state, not an error, so a vault read away from its host still reads. One chip builder (`render/personchip.ts`, the statusicon precedent) serves the server cell ladder and the client alike. - **Field kind `person`** — the palette menu over the directory (display name over @handle); a pick writes the HANDLE. With no directory the field is a plain text input: degrade, never disable. - **People mentions** — after `@` in a form text field, directory entries are offered beside document matches (people first, capped at 5); a person pick inserts `@handle`, a document pick keeps the markdown link. Without a directory the behaviour is byte-identical to before. - **The directory seam** — `buildAppPayload` input gains `people:` (`{mode: inline, entries}` or `{mode: url, url, entries?}`), carried verbatim as `D.people`. A url directory is fetched once per page-life by the client (`ui/peoplesource.ts`, the rowsource doctrine: reading never blocks, a dead endpoint costs nothing) and re-resolves baked chips through their `data-handle` identity when it lands. - **The local host** — `dj dashboard`/`dj serve` accept `--people ` and auto-discover `people.yaml` beside format.yaml (`people: [{handle, name}]`, extra keys carried through). A malformed — or explicitly named but missing — file is one warn finding (`people-file-invalid`) and no directory; everything else degrades silently by design. dj serve re-reads the file per rebuild and sweeps its mtime, so a rename lands in an open page. ## 0.14.0 — 2026-08-11 - **The report surface (E32 t4).** The second member of the surface family (decision 0019) ships: a `surface: report` YAML renders as one scrolling, page-headed, print-shaped document — and the t3 contract is proven from the consuming side: the whole surface landed without touching a view-layer file, and a parameter-free named view placed on both surfaces produces byte-identical payload entries (one constructor built both). - **The grammar** (`report.yaml`): a `report:` header (`title` · `subtitle` · `date` — a malformed date warns `report-date` and the render date takes over) and `sections:` in the SAME placement grammar composite views use (`label` · `notes` markdown · `place` — named views by slug, `label:`/`with:` overrides, inline widgets verbatim). No/empty `sections:` refuses (`surface-sections-empty`). `theme:`/`motion:` work as on any surface; the report's motion default is `off`. - **Views stay portable** — a parameter-free named reference keys under its own name; overridden references and inline entries mint `sec-v` (reports mint no anonymous nav vids). A bare `stat-row`/`coverage`/ `reverse-gap` renders empty with one `view-dashboard-bound` warning — the R8 rule, now exercised by a real second surface. A missing name substitutes the same stub view the dashboard shows; a placed `for_each` view refuses (a section places ONE slot). - **`dj report --surface report.yaml [--json | --out report.html]`** — one evaluation drives the terminal render (new per-kind printers over the evaluated widgets), the exact JSON, and a self-contained artifact baked under the report ceiling (capture-only writes, static sources — clamped through `applyCeiling`, warn `surface-ceiling`). `dj report` with no flags and `dj report --dashboard` are unchanged forever. - **The `surface:` routing is wired** (the t3 promise): `dj dashboard` and `dj report --dashboard` now refuse a file declaring another kind by pointing at the right command, and a typo'd `surface:` finally refuses with `surface-unknown` + did-you-mean instead of rendering as a dashboard. - The client artifact gains a `data-surface` root attribute, the report chrome (title block, generated TOC, per-section headings and notes, the `#/c/` document overlay — live on screen, hidden on paper) and `@media print` styling; the catalogue's `report` surface entry now documents the shipped grammar (`accepts: report · sections · theme · motion`). - **The surface contract: dashboard ported byte-stable (E32 t3).** Surfaces are now an engine-owned family (decision 0019) and the dashboard is its first member — ported onto the contract without moving a byte (the step-0 pins: evaluator, payload incl. key order, split mode, hosted shell, client DOM all hash-identical). - **`surface:`** — a surface file declares its own kind with a top-level `surface:` key; the filename is never semantic. Absent means `dashboard`, so every existing dashboard.yaml stays valid forever; `surface: dashboard` written out is legal and ignored. An unknown kind refuses (`surface-unknown`) with did-you-mean. `dj catalog` gains a **Surfaces** group documenting the family (`dashboard` free-traversal, direct/live; `report` linear, capture-only — its renderer ships next ticket). - **The ceiling** — `applyCeiling` clamps a host config to what a surface can honestly render (warn `surface-ceiling`, never a refusal). The dashboard's ceiling permits everything, so its path is the identity; it is threaded through `dj dashboard` and `dj serve` now so lower-ceiling surfaces clamp through the same seam later. - **Bare shared-state widgets degrade portably** — a bare `stat-row` / `coverage` / `reverse-gap` (no `indicators:`/`bind:`) reads the host dashboard's pack/indicator state; evaluated on a surface without that state it now renders an EMPTY widget with one `view-dashboard-bound` warning instead of failing — the rule that lets one view library serve every surface. - **Internals, moved not changed** (for anyone importing the engine): the view evaluator lives in `core/view-eval.ts` (`evaluateView`), the view-payload constructors in `render/views/payload.ts` (re-exported from `render/page.js`, so no import path breaks), the dashboard payload slices in `render/surfaces/dashboard.ts`, and the client's dashboard chrome in `ui/surfaces/dashboard.tsx` behind an `App` dispatch on `D.surface ?? 'dashboard'` — dashboard payloads gain **no** new key. - **Views place views: the placement grammar and composition (E32 t2).** A view (a `views/` file or an inline one) may now compose OTHER views. One placement grammar, two doors: ```yaml # views/quarterly.yaml — the sections: body view: label: Quarterly sections: - label: Health notes: Prose printed above the section's content. place: - status-tiles # bare name ≡ { view: status-tiles } - view: open-risks span: 8 # 1..12 of a 12-column grid label: Risks this release # this placement's heading only with: { quarter: "Q3" } # {placeholder} substitution over - widget: rows # this placement's copy only from: tasks # inline widgets place too where: "status is open" ``` Inside a `widgets:` list the same placement is spelled `{ widget: view, use: , span?, label?, with? }` — `widgets: [a, b]` is exactly `sections: [{place: [a, b]}]`, so the sugar and the grammar can never disagree. `sections:` and `widgets:` on one view refuse (in a library file the same contradiction is a `view-file-invalid` skip). Spans mount a 12-column grid that collapses to today's stacked flow below the narrow breakpoint; no spans means today's DOM, untouched. **The two channels stay two channels.** Grammar mistakes in the file being edited refuse (bad span, a section without `place:`, `with:` supplying a placeholder the engine resolves itself, a placed `for_each` view — a placement is one slot; the set-shaped spelling is navigation's `views:`). Whether a placed NAME resolves is the warn-level `view-*` family: a missing name, a cycle (`view-cycle` — a repeated name on the resolution path), or the breadth valve (`view-expansion-limit`, 500 placed-view expansions per evaluation) each degrade to a **labelled unresolved slot** in the page — the evaluation always completes. Diamonds are legal. Every placement is an independent instance: two placements of one view get disjoint widget-id subtrees (facet/tab/disclosure state isolates per placement for free), `with:` fills only that placement's clone, and an outer `for_each` fills its `with:` values first so per-document parameters thread down. Placement is transparent to the tabs-in-tabs guard. A placement-free dashboard is byte-identical — the step-0 pins prove it. `dj catalog` grows the **Placement** group and the `view` widget entry. - **Named views: a `views/` library beside the definition (E32 t1).** One reusable view per file — `views/open-work.yaml`: ```yaml view: label: Open work widgets: - { widget: rows, from: tasks, where: "state == open" } ``` **The id IS the filename** (basename minus `.yaml`/`.yml`, verbatim). A declared `id:` that disagrees warns (`view-id-mismatch`) and loses — the filename wins, and references to the declared id will not resolve. Discovery is `/views/`, non-recursive, overridable with the new global `--views `; a missing directory is simply an empty library. **References.** Anywhere `dashboard.yaml views:` lists a view, a name now works — a bare string, or the explicit form with per-placement overrides: ```yaml views: - open-work # by name - view: open-work # explicit form label: Open items # label for this placement only with: { owner: "felipe" } # {placeholder} substitution - id: inline-one # inline views stay valid FOREVER widgets: [ ... ] ``` Resolution is in place (list position preserved), `for_each` templates work by name (nav `views: ` mints as before), and an unknown name substitutes a **visible stub page** with a `view-missing` warning — never a dropped entry, never a crash: every `view-*` finding is warn-level. Names containing `/` are reserved for engine-shipped `dj/*` views (none ship yet). **Shadowing, one table.** An inline or include-fragment view whose id matches an *unreferenced* library view wins locally and warns (`view-shadowed`) — except an `include:` whose path IS the library file (both roles, no finding: that is the migration state below). Referencing a name that is also placed inline keeps the first occurrence and drops later copies (`view-name-collision`). Fragment-vs-inline duplicate mapping ids still refuse at compose time; inline-only duplicates stay as legal as ever. **Migration from `include:` fragments is zero-edit.** A fragment file's one-entry `views:` list is accepted as a view file as-is — move it under `views/`, delete the `include:` line, write the name. The legacy one-entry `views:` file shape is deprecated (documented here, accepted silently) and will be removed no earlier than 1.0; the canonical shape is the `view:` mapping above. Also: `dj records audit` now counts blocks queried in library files (referenced or not) toward the queried axis, so a block read only through a named view no longer buckets as dead weight; serve mode watches `views/*.yaml` and re-renders on an edit; `dj catalog` gains a **Named views** group. Cloud hosts do not read `views/` yet — the engine support ships inert there until the render-pin bump adopts it. ## 0.13.5 — 2026-08-11 - **The sidebar speaks Linear.** Navigation items may name an `icon:` from a new engine catalogue of ~30 generic outline glyphs (`dj catalog` → Nav icons) — the engine draws the glyph, the format decides what it means. A typo warns (`dashboard-nav-icon`) and drops rather than failing the dashboard. - **Sub-paths, Linear's anatomy.** A nav item with `children:` renders as an expandable parent — and may carry its own `view:`, so clicking it lands somewhere while the chevron expands it. An icon-bearing child indents with its glyph; an icon-less child indents behind a rail. Groups and parents collapse, and the shut set persists per browser. ## 0.13.4 — 2026-08-11 - **The undo toast is optimistic.** It shows when the op posts — like the paint it narrates — instead of waiting out the write round-trip. A refusal still replaces it with the referee's message, so the correction channel is unchanged; only the timing moved. ## 0.13.3 — 2026-08-11 - **The write answer's delta holds the page order too.** 0.13.2 stabilized the live refetch but the answer's delta still replaced a concept's rows wholesale — in the server re-render's own order, a third ordering — and reshuffled the board at toast-time. Both doors into the payload now merge into the order the page already shows. ## 0.13.2 — 2026-08-11 - **Row order belongs to the page — the kanban reshuffle fixed at the root.** The baked payload orders rows by document; a live host may answer /rows in its own order (the cloud projection: ORDER BY a text id). A write hears both — invalidation refetch, then the answer's delta — and wholesale replacement reshuffled the whole board into the host's order and back a second later. Fresh rows now MERGE into the order the page already shows: persisting rows keep their seats with fresh content, vanished rows leave, new rows append. - The board card row now carries its `data-concept|block|row` identity, so the FLIP reflow actually reaches cards — lane moves slide instead of flashing. - A drag-dropped card is skipped by the reflow once: it is already at its destination under the cursor; only its neighbours slide. ## 0.13.1 — 2026-08-11 - **The kanban jitter on ANY update, fixed at the root.** Every cloud write repaints the board two or three times (the optimistic paint, the write's answer, the invalidation re-query), and FLIP re-measured cards MID-SLIDE on each — getBoundingClientRect reads the transformed position, so the next render computed a bogus move and launched a reverse slide from the halfway point. A card whose slide is still playing is now neither measured nor re-animated; the running slide finishes and the burst of re-renders is idempotent to the eye. ## 0.13.0 — 2026-08-11 - **The Linear-grade surface (E30).** Every enum control becomes a palette picker — typeahead when the vocabulary is long, tone dots or progress icons, numeric shortcuts by declared position, arrows/Enter/Escape. A new `progress` column style draws an enum value as WHERE IT SITS in its declared order (dashed muted start, filling wedge, success check, error ×) — geometry from the declaration, meanings stay the format's. Board cards take the tracker anatomy: separated surfaces on quiet lanes, dim mono eyebrow, compact badge rows. ⌘K gains the palette half: jump targets from the declared navigation and the corpus's document titles. @-mention in every form text field completes the corpus's documents into the link grammar the vault already speaks. Side panel and dialog polish on the same tokens. - **The kanban glitch, fixed.** A dragged card's clone was held until the host answered — a double-rendered card for the seconds a cloud write takes since the optimistic paint. The gesture now settles at drop, and a refusal restores the payload while FLIP walks the card home. The entrance stagger re-ran on every data repaint; it now runs once per view entry. FLIP finally covers the board's actual cards, so a status change slides the card to its new lane. ## 0.12.0 — 2026-08-10 - **A motion layer, declared and reader-respecting (E30).** The Astryx duration/ease tokens the UI barely spent are now spent: a board card SLIDES to its new lane on a status change (FLIP, keyed on the card's identity, WAAPI so it never fights React), a view-swap settles, tiles / cards / lanes rise in a short entrance stagger, and the hover/press feedback the base sheet left flat is filled in. Declarative and catalogued — `motion: full · reduced · off` on the dashboard (a new Surface group in `dj catalog`), full by default. A viewer's own prefers-reduced-motion always downgrades full to reduced: the author sets the ceiling, the reader the floor. Additive — with motion off or reduced-motion set, the page is byte-for-byte its old self. - **The `linear` template: Linear's defaults as a format you own.** `dj init --template linear` scaffolds a tracker — teams hold issues with Linear's exact default lifecycle (Triage / Backlog / Todo / In Progress / In Review / Done / Canceled / Duplicate) as a stored enum, set-status / set-priority / assign as declared forms on the cells, projects as documents with milestones and health, docs as the PRDs beside the work. The five Linear categories are the dashboard's where-clauses; the triage accept-guard is the needs-priority indicator. Scaffold lints clean and its dashboard evaluates with zero findings. ## 0.11.0 — 2026-08-10 - **The cloud verbs: `dj auth`, `dj rows`, `dj kb`, `dj format push` (E29, decision 0018 "One CLI").** djc is deleted; its verbs live here now, the `gh` model with the engine as the open half. `auth` is the RFC 8628 device flow, credential store and git credential helper, ported onto the SAME hosts.json (`DJC_*` environment variables honoured) so an existing djc login carries over with no re-login. `rows get` is the agent API's freshness-stamped read; `rows patch` is the guarded write with the revision guard as the DEFAULT — `get` records each `readAt` (reads.json beside hosts.json), `patch` sends the recorded stamp, a patch with no prior read is refused with the fix named, and `--unguarded` is the opt-out by name. `kb create / list / open` are the registry verbs; `format push` is the set-format govern door, compiling the definition locally with the same engine before sending and relaying a red certify trial with its findings. A minor rather than a patch because the command surface grew; nothing existing changed shape. - **`type: number` columns defer to the evaluator in the SQL count compiler.** REAL storage collapses the author's text ("3"/"3.0"/"3.00" become one value) while the reference evaluator compares strings — so `==`/`!=`/`in`/`contains`/`startswith` on a number column now return null (ask the evaluator) exactly as an unresolvable frontmatter field does, and a mixed-affinity multi-block selection refuses the whole union. Latent: nothing wired `sqlCountFor` into a read path yet; fixed before anything could. ## 0.10.3 — 2026-08-10 - **Facet buckets follow the vocabulary, not the casing (E13 t18).** The filter strip bucketed rows by exact cell text, while the server chip raises a value's first letter and a declared `default:` or an optimistic paint carries the raw enum value. Measured on production: one status change showed "Open (5) · Open (1) · Deferred (1) · Deferred (1)" until the server delta merged them — and, the latent half, every rows view's declared `default:` has been silently dead ('open' never matched a cell reading 'Open'), so views opened unfiltered. Buckets are now keyed by the case-folded value with the first-seen casing as the label, and selections match case-insensitively — the rule parseDoc's enum check and the board's lanes already keep. Authors' `filter: default:` values start applying on entry, which is what they always declared. ## 0.10.2 — 2026-08-10 - **A control pick paints immediately, and snaps back on refusal (E13 t17).** Measured on production with an instrumented page: the status dropdown's pick fired its POST at the click, and then nothing visible happened for the seconds a cloud command write takes to commit and answer its delta — so the pick read as "did nothing" and users submitted the same write twice. Direct mode now keeps the rule the board drop and proposal mode's `stageOp` already keep: the picked value is painted into the payload rows before the host answers, and a refusal restores the previous value beside the referee's toast, so the page never keeps a state the vault refused. ## 0.10.1 — 2026-08-10 - **Indicators drawn as view widgets now live-refresh (E13 t16).** Measured on 0.10.0, on production, the day the command door started announcing its writes: one status change moved the dashboard home's OPEN QUESTIONS tile 7 → 6 while Triage's own OPEN QUESTIONS stat-row held 7. `refreshIndicators` merged fresh values into `dash.tiles` and nothing else, and `tilesReading` filtered the same array — so a block only a widget reads routed no fetch at all, and a widget copy of a shared tile was never written even when the fetch happened. Not an authoring mistake: a stat-row naming its indicators by id holds the same tile object at build time, and JSON has no reference sharing, so the payload's round-trip makes them distinct copies. One new walker (`core/tilewalk.ts`) is now the single answer to "which objects are tiles" — the client routes and merges over every copy, and `GET /indicators` serves one value per id, which gives an indicator declared inline on a widget (the `for_each` person boards) a wire address for the first time. Hosts embedding the engine should serve `uniqueTilesById(collectTileObjects(result))` instead of `result.tiles`. ## 0.10.0 — 2026-08-08 - **BREAKING (small, and it was already wrong): an indicator naming an undeclared block is now refused (E28 t1).** `dj dashboard` previously rendered `value: 0` for `from: not-a-real-block` and exited 0. It now refuses with `block "X" is not declared by the format` — the exact sentence the chart, board and timeline paths have always used, because two spellings of one mistake must not give two different answers. A dashboard carrying a stale `from:` will start failing; that number was never real. - **Schema lint over dashboard references (E28 t1).** A `where:` field that resolves in NONE of the block's declared columns, any type's declared frontmatter or flags, the reserved names (`id` · `state` · `type` · `path` · `domain`), `cites_`, or the keys the corpus carries is reported as `dashboard-unknown-field` (warn; fatal under `--warnings-as-errors`). Measured before this: `where: "stattus == open"` — one transposed letter — rendered `"value":0` with `dj dashboard` and `dj lint --all` both exiting 0. The set is a union because declared-but-unused and used-but-undeclared are BOTH legitimate; consulting the definition alone or the corpus alone invents a false positive either way. - **Live indicator values (E28 t2).** Each tile now carries `blocks` — what its selection actually read — and the payload declares `indicatorSource` beside `rowSource`. `dj serve` answers `GET /indicators` with the tiles of the CURRENT payload, so a live client and a reloaded one cannot disagree. The client half (`render/ui/indicatorsource.ts`) has NO events channel of its own: the row driver's `{path, block}` frame already arrives, so an invalidation is ROUTED rather than broadcast — a block no tile reads costs no fetch at all. Measured before this: a status change moved the number in the tab that made the edit and in no other, until a reload. - **Declared column types (E28 t4).** `type: number | date | text` plus an optional `unit:` on a column. Absent means text, so every existing format is untouched. A cell that breaks a declared type is an ERROR where the record is parsed, beside the enum check and with the same code convention (`--type`, overridable by `code:`). Declared empty markers are exempt — "not applicable" is an answer, and it is what becomes NULL rather than zero, which is what keeps an average honest. - **A summed column should be one the format calls a number (E28 t5).** A chart series whose `y:` sums an untyped column now reports `dashboard-metric-type`, naming the column, the fix, and how many cells actually failed to parse and were silently skipped. The numbers the chart draws are unchanged; this says the quiet part out loud. - **Typed projection tables (E28 t6).** One table per block, `rec_`, derived from the compiled definition on every rebuild and never migrated: id, the declared identity (so a record's `uuid` is addressable for the first time), then EVERY declared column, REAL where the format says `type: number`. Identifiers are QUOTED rather than sanitised — a lossy transform is what creates collisions, and block names are already unique. `row_` is joined, never replaced, so FTS and `cite` are untouched and the largest column is not copied. `SqlSink` gains an optional `all` used for one thing: sweeping tables the format no longer declares, because a lingering one is stale-but-queryable. Measured on a real vault: `SUM` 123, `AVG` 41 rather than 30.75, `WHERE now > 10` no longer returning every row because `'5.00' > '10'` lexically. - **The dashboard's query language compiles to SQL (E28 t7).** `expr.ts` now parses to an AST with two backends over one parse: `evalQ` — the reference semantics — and a SQL compiler over the typed tables. Authors write exactly what they wrote before; no raw SQL is exposed, so the physical schema stays free to change. It refuses rather than guesses: a frontmatter field is projected nowhere, so the compiler returns null and the evaluator answers. Tested differentially — both paths, one vault, same number, every operator. - **The authoring skills teach the new surface (E28 t9).** A coding agent only uses `type:` if the guide names it. Four pitfalls in format-authoring and three rules in dashboard-authoring, each stating a measured failure rather than advice. ## 0.9.3 — 2026-08-07 - **The RowSource seam: tables ask a driver where rows come from (E27 t1/t2).** One client module (`render/ui/rowsource.ts`) now answers "the rows of {path, block}"; the payload declares the source. Absent a declaration the page is exactly what it always was — `rowSource: {mode:'static'}`, rows baked in, file:// works with no network. A host may declare `mode: live` with a rows endpoint and an events channel: the driver serves the snapshot synchronously (reading never blocks on the network), kicks one background refresh per block per page-life, lands fresh rows with a store bump, and degrades to the snapshot when the endpoint is dead — a live page falls back to today's page, never to a blank one. One invalidation message shape (`{path, block}`) over two transports (websocket or SSE), so the module cannot tell which host it is on — which is what makes the loop testable locally before any cloud exists. Payload rows now carry a sidecar record's `uuid` (conditional — a table row's payload is byte-identical), the stable address a live write holds across renames. - **dj serve is the local live host (E27 t5).** The serve payload declares `{mode:'live', url:'/rows', events:'/rows/events'}` — the exact shape a cloud host mints. `GET /rows` answers the payload's own rows (they can never disagree); `PATCH /rows` is the RAW record write beside the form write — same referee gate, same byte-preserving writers, identity never settable, undeclared columns refused, by-uuid addressing (`by: uuid`), and an append into a table-backed block refused by the gate itself as `sidecar-both-sources` rather than by a special case. One SSE message announces a PATCH, a form write, and an out-of-band editor save alike; the watcher is the existing mtime sweep on a timer, running only while someone is listening. Git is not in the local loop: disk is truth, you commit when the work deserves it. - **`dj records audit` — the records census (E27 t7).** Every persisted record type, cross-referenced over three axes — DECLARED (format.yaml), POPULATED (raw sidecar YAML, because `readSidecar` drops undeclared blocks before the IR: a census over the IR could never see an orphan) and QUERIED (`from:` and `bind.rows` collected by spelling, fragments included, WITHOUT evaluating — a broken dashboard still answers) — into four buckets: healthy, dead weight, orphaned, empty. Phantoms (queried, exists nowhere), templated `from:` values and twinless sidecars surface beside them. Orphaned records exit 1: a shape change must never strand records silently. The `_archive/` shelf is carved out of `sidecar-not-a-concept` (a vault that accepts a deletion gate's archive offer stays green) and always reports as dead weight — parked is not invisible. Command surface 14 → 15, recorded in the ratchet with the full design decision. ## 0.9.2 — 2026-08-06 - **Modal form polish: Astryx chrome in the body, one date-range picker for the gesture shape (E19 t7).** The t6 dialog hosted the legacy panel markup bare — two visual languages in one surface, and the reschedule form Felipe called out ("working but it looks bad, and we should be using a date range picker not 2 single date pickers"). The modal body now speaks Astryx end-to-end: `FormLayout` owns the field spacing, every field renders under Astryx `Field` chrome (FieldLabel typography, the declared `hint:` as the field's description, group-shaped kinds as labelled groups), and the button row is a footer-shaped Cancel + primary pair under a divider. And a form whose shape IS the date gesture's — exactly two date-kind fields feeding two distinct `set:` keys — renders them as ONE `DateRangeInput` instead of two single date pickers, in both containers (a block's rows form and a type's frontmatter form). **Same detection, no new grammar**: the range presentation asks `gestureDateForm`, the ONE two-date-two-keys matcher the drag already stands on, through a third thin consumer (`formDateRange`, form-first over the form's own two `set:` keys); orientation, which the gesture takes from the timeline's bind, is deterministic here — field declaration order, first declared date field is the start. **The submit contract is untouched**: the Astryx widget is strictly controlled and renders no form input, so two hidden inputs mirror its state under the fields' own `data-fname` names (the image field's hidden-input precedent) and `submitPanel` serialises the SAME two fields byte-identically — the suite pins the modal's POST against the stacked panel's, through the range markup. Where a DateRange cannot hold the row's truth — one date set and the other empty, non-ISO cell text, a reversed pair — the form FALLS BACK to the per-field date inputs (still Astryx-wrapped) rather than render a widget whose untouched submit would blank the lone value through annotate's whole-set replay; clearing the range is the same explicit act emptying the two inputs always was. Stacked panels are structurally unchanged — the shared control markup moved into one `FieldControl`, but the in-flow presentation renders byte-identical legacy chrome. The toast/dialog lesson, checked: the calendar popover needs no token bridge — app.css carries the compiled component styles and every custom property they lean on is served by tokens.ts in both themes; and the t6 constraint "no modal-hosted form field opens either today" is retired — the range popover uses the NATIVE popover API, so it stacks on the browser top layer ABOVE the open `` (unlike the body-appended menu.ts dropdown), and the Dialog's Escape defers to the popover's focus trap: calendar first, dialog second. Real-browser check of that layering (the stub-DOM suite cannot see the top layer) rides the next manual pass. Also corrected here: the t10 entry's NUL-sweep sentence now names all three files the sweep covered (`store.ts`, `forms.tsx`, `graph/build.ts`), not two. - **Genericity Audit 2 pre-merge hygiene (E18 t10).** The nine S-sized actions the audit ruled before merge, each shown failing without its fix (test/genericity-hygiene.test.ts). Refusals, first: `sharedEnums` is now prototype-free with an own-key lookup, so `enum: shared.constructor` as a reference miss gets the normal unknown-shared-enum refusal (now with the loader's did-you-mean) instead of crashing the loader with a raw TypeError off Object.prototype — discipline 7, actively enforced. A **block-less op that names a `row:`** — the one silent-wrong-container hole in the write grammar — is refused loudly at BOTH entry points (`applyChangeSet` and the CLI/serve `applyAnnotation`), naming the op's contradictory shape instead of silently dropping the row. A multi-block board (or timeline `color:`) whose lane/colour column resolves to **DIFFERENT enum vocabularies across `from:`** refuses at load naming both vocabularies — never first-block-wins with the other block's rows mis-laned against words their column never declared. A `wip:` key naming a lane `lanes.order` excludes is a dead declaration (it validated and could never render) — refused at load, the d717a26 rule. Rulings, second: **over-limit presentation is now doctrine** — a lane holding more cards than its `wip:` number marks itself with a `data-over-wip` attribute and shifts the header count to the warning tone (was the error tone under a bare class), no new English, no behaviour beyond the tone — and **`limit:` is accepted as wip's generic-name alias** (one meaning, two spellings; refusals speak the spelling the author wrote; both at once is refused as a contradiction). The **ISO-8601 date grammar and engine-English calendar chrome** are written into the timeline catalogue entry as a ruling (one engine-owned grammar across lint, gate, evaluator and renderers; chrome speaks engine words by the q6 precedent) — doctrine, not accident. Prose and bytes, last: the timeline's `filter:`/`filters:`/`search:` refusal now names filtering/search as not-yet-supported (the old hint misdirected to the zoom/duration planned list); the one vault-namespace literal in catalogue prose ("a self-referencing Depends") is now the engine's neutral phrase; and the four literal NUL bytes in `store.ts`, `forms.tsx` and `graph/build.ts` (two in the last) are `\u0000` escapes — same strings, and diffs of those files stop going binary (a guard test now sweeps `src/` for raw NULs). - **Modal form presentation: spatial surfaces open their forms OVER the page (E19 t6).** Where the invoking surface is spatial, a declared form now opens as a modal instead of a stacked in-page panel: the gantt's edit affordance first — the rail's ✎, the missing-list's labelled button, and the under-threshold bar click, in BOTH containers (rows-mode date form and the concepts-mode frontmatter form) — because the old panel rendered after the whole grid and scrolled the reader away from the bar they touched; and every form a board CARD invokes (its action buttons, and the capture forms offered inside the card's comments panel). Presentation is decided **by invocation context, engine-owned, at open time**: `togglePanel` gained a `modal` argument the surface passes, the fact rides `ui.openPanel`, and it is fixed for the panel's life — uncontrolled inputs never change parents. Normal page flow (table rows, concept pages, append forms — the board's re-hosted append forms included, which render where their toggle lives and scroll nothing away) keeps the stacked panel unchanged. Same machinery, same write path: the app-level `ModalFormHost` renders the EXISTING `FormPanel`/ `FbPanel` inside the vendored Astryx Dialog — the suite pins that the modal's submit POSTS the byte-identical op the stacked panel posts, a refusal keeps the modal open with the referee's finding in the panel's own error surface, and success closes it through the delta merge. The dialog title is the form's declared label; the one-panel invariant holds by one rule (`isPanelOpen` answers false for a modal panel, so every inline site yields to the host — the timeline's below-the-grid panel sites are gone entirely). Dismissal policy, stated: Dialog `purpose="form"` — **Escape closes without submitting; backdrop click does NOT dismiss** (a stray click must not discard half-typed uncontrolled input); close is explicit — Escape, the header's ✕, or the panel's own cancel. Focus: `showModal()` moves focus into the dialog; on close the ONE close funnel (`closeOpenPanel`) restores the remembered invoker, re-queried by its own data-* facts when a delta merge re-created the element — focus never falls silently to body. The toast lesson applied BEFORE shipping this time: the dialog panel inherits the engine-served tokens, but `::backdrop` historically does not inherit custom properties, so page.css supplies the scrim with the token plus its literal per-theme fallback (doubled-class specificity, values from tokens.ts light and dark), and the hosted `.fform` drops its stacked padding inside the dialog's own padded container (scoped — the pinned global rule is untouched). ⌘K is guarded while a modal is open (the palette would open under the inert-enforcing top layer). **Format hint deferred**: the ticket allows the format to hint placement, but the engine default per invocation context needs zero grammar, while a `present:` key would touch both schema nodes, both parse loops, the payload whitelists and the catalogue — and under the V070 unknown-key ruling would hard-error every older engine on vaults using it; it waits for a format that demonstrates the need. Known constraints, on the record: the imperative body-appended dropdown (menu.ts) and the toast host paint UNDER the native top layer — no modal-hosted form field opens either today (options render as radios/ checkboxes, the concept picker is inline), and panel submit errors use the in-panel surface, so nothing is currently unreachable; re-parenting menus into the dialog is the follow-up if a field kind ever grows one. - **Review hardening: the modal's a11y claims become wired, tested facts (E19 t6 review).** Four fixes, each behind a test its mutation fails. First, the claims were reachable only by mouse: every form affordance was an unfocusable ``, so a keyboard or screen-reader user could never OPEN a board card's or the timeline missing-list's modal at all, and `document.activeElement` at capture time was never the affordance — the remembered "invoker" was body or a stale element. All `fa-btn` affordances are now real `