Changelog

• Unify tenant governance and authorization
• Guarantee plugin data survives license lapse

permalink ↗

• Scope plugin roles and preserve bootstrap events

permalink ↗

• Pair marketplace deployments with account scopes
• Reserve and recognise the Railbase owner tenant

permalink ↗

• Rbac: governance marker tiers — independent_reviewer, first_line_owner, board_viewer
• I18n: regenerate the embedded floor after the v0.24.0 SPA edits

permalink ↗

• Admin: tenants+companies one page; kit-form bodies dialogs; server-side update push
• Admin: reload on the binary actually changing, and update badges in the chrome

permalink ↗

• Site: floating docs-assistant FAB, admin-style
• Authority: weighted voting — levels that count shares, not heads
• Translate the collegial-bodies nav label
• Admin: the collegial-bodies register
• Collegial bodies: four kinds, built-in charters, and a register
• Built-in charters: a collegial body may only be created from a template
• An authority-tier role must be granted inside a company
• Record the role NAME when a role is revoked, not just its id
• Wire /api/board to the installed plugins
• GET /api/board — compose the estate pack from one verb per plugin
• Manifest: the reporting block a plugin contributes to the board
• Seed the collegial bodies as roles — a board is a committee, not a post
• Board.view — let an officer read the estate pack without a plugin role
• GET /api/periods — one calendar for the whole estate
• Resolve the reporting calendar from tenant settings
• Serve the PDF export the shared datatable has always been calling
• Refuse a self-update to the version already running
• Reporting calendar: the core owns the period, plugins read it

permalink ↗

• Re-centre the tab strip when the strip itself resizes, not only on navigation
• Section trigger: no section name on a page that belongs to no section
• Site plugin shell: usable at phone width
• Site widgets: half-width page layout, chart descriptions, donut legend fix

permalink ↗

• An approval ticket cannot be spent outside the band it earned
• Complete approval workflow platform contract

permalink ↗

• Enforce plugin special terms in marketplace

permalink ↗

• Advertise datasource to plugin dockcheck

permalink ↗

• Budget for core datasource drivers
• Add core-mediated datasource capability
• Add dossier reverse-lookup menus

permalink ↗

• A list can offer the filters that split it
• Panels that are supposed to stay put now stay put

permalink ↗

An action that failed no longer reports success. A row or dossier action whose verb answers "I could not do that" — a connection test that did not reach the system, a check that came back negative — is now reported as a failure with the reason, instead of a green confirmation that said the opposite of what happened.

Two screens rejoined the design system. The built-in channel's "Active" treatment on a plugin's Connect page now uses the theme's own colours, so it follows light and dark mode instead of carrying a hand-written pair that could drift; and the first-run wizard's company and country pickers are the standard controls, keyboard- and screen-reader-wired like every other field on the form.

Release tooling. The release now builds the front-ends with the same tool the project uses everywhere else, and refuses to build unless the working tree is clean and matches the tag being published — so what customers download is always exactly what the tag says.

permalink ↗

Closing a console-launched Railbase now really stops it.

Closing the terminal used to leave the supervisor running: it caught the terminal's hangup, found no pending update, and kept going — reparented, with no terminal, still holding the HTTP port and the vault. The next launch then failed with address already in use against an invisible process. A hangup now stops the worker and exits, the way every other Unix service behaves. nohup ./railbase serve still detaches as before.

A server that cannot start no longer restarts forever. A boot that never began serving — the port is taken, the interactive port offer was declined — now exits with a distinct code (7) that the supervisor understands as a startup failure: it reports the error once and stops, instead of retrying every two seconds and re-asking the same question. The signal comes from the server itself rather than from a health probe, so it stays correct when something else (an orphaned instance, another service) is answering on that port.

Rollback stays available the moment an update commits. The rollback anchor is recorded before the update is published as committed, closing a window where the Update Center could show "updated" while offering nothing to roll back to.

Connect is gated on a connection test — without blocking what cannot be tested. On a plugin's Connect page, a system whose configuration can be probed keeps Connect disabled until "Test connection" passes for the values currently in the form; editing a field re-locks it. Where the server cannot reach the system itself — an on-prem database read by the agent — the test says so ("Not verified yet…") and creation proceeds, because the source must exist before the agent can be pointed at it. File and push sources are unaffected.

permalink ↗

• Assert the claim watermark on rows walked, not on a stopwatch

permalink ↗

• A row action must say what happened

permalink ↗

• Complete locale coverage for the built-in card strings
• Built-in card mode — explain instead of offering to connect
• Ship the strings the idle auto-logout feature references
• Native checksum spec — multi control digit + any_of alternatives

permalink ↗

• Sync the learn corpus (companies, versioning, multi-instance licensing)

permalink ↗

• Two-id detection: pair the split company and raise it with the site

permalink ↗

• Per-node tenant licensing: enforce tenant_plans[].node_lock, claim via credential

permalink ↗

• First-run journey targets the exact Company / workspace label
• Updates: identified poll; wizard manual path collects the legal identity

permalink ↗

• Bootstrap connect: pin the account at fetch; activate by credential

permalink ↗

• Bootstrap connect: the credential field refuses an email, and autofill

permalink ↗

• Bootstrap: connect to railbase.app and ADOPT the company at install

permalink ↗

• First-run journey expects the normalized (uppercase) company name
• Company identity: one normalization, one row, full legal facets

permalink ↗

• Marketplace: pin the credentialed licenses relay; regenerate the site floor
• Marketplace: ensureMarketColl tolerates a pluginManager without an app
• Marketplace: the licenses relay gets a sane timeout and a context
• Marketplace: the licenses relay presents this instance's credential

permalink ↗

• Site: fix dead "Re-import data" on Safari — picker must open inside the gesture

permalink ↗

• Site: end inactive sessions — idle auto-logout for the app-user frontend

permalink ↗

• I18n: regenerate the embedded admin floor
• Site/masterdetail: the notice takes the warning token, not raw amber

permalink ↗

• Site: masterdetail renders a verb-attached notice under the list count
• Mint a checkout grant before opening the payment iframe

permalink ↗

• The core's half of company parity with railbase.app

permalink ↗

• Site/cards: the last conformance finding pays off — kit Select in the connect panel
• Admin: settings_ai pays its conformance debt — the release lint gate is green again
• Frontends: the workspace toolchain is BUN — bun.lock replaces package-lock.json
• Deps: Go + frontend to latest releases; i18n floor regenerated and healed

permalink ↗

• Dao: queryIndex after_id rides full-tuple prefix scans too
• Core: tenant adoption in chunked txs — the 14-hour port-down boot, cured
• Charts/histogram: the skyline was invisible — percent bars against an auto-height column
• Site+ui: Ф4 in-place drill wired end to end; charts consume selections (Ф3 closes)
• Site: Ф4 register mode for table — the kit's server fetch drives the page
• Site: GraphWidget interpolates {param} tokens from the page's route params
• Site: Ф3 associativity wired — chips in the shell, chart emits, fetch hooks consume
• Site+core: Ф4 heavy charts (xychart, pareto) + Ф5 relationship graph, wired end to end
• Site+core: wire the Ф2 charts into the renderer and the manifest gate
• Site: Ф2 substrate — five chart primitives ported from qlik, kernel extracted, dependency-free
• Site: Ф3 substrate — the plugin-scoped associative selection store
• Site: Ф5 substrate — the Sugiyama layout as a pure, tested module
• Site+core: Ф1 — the three dossier analytic blocks, gated end to end
• Site: the pager's jump and size ride the kit controls
• Site: Ф1 — the list pager becomes navigation: first/last, page jump, page size with persistence
• Site: Ф1 — every fetch surface can recover: retry() + a stuck state in all five hooks
• Core: the manifest widget-type gate — a packaging error stops reaching the customer's screen
• Site: Phase 0.3 — the dossier splits out of masterdetail, byte-identical
• Site+ui: Phase 0.2 — the two tone dictionaries, as tokens, spiked in both themes
• Site: Phase 0 (0.0+0.1) — text-clean renderer, one object hook
• QueryIndex after_id — keyset paging reaches data-resident JS
• Dev tool: idxprobe — answer "is this collection's read path healthy?" without a server
• Env-catalog guard: grandfather RAILBASE_LOG_CONSOLE

permalink ↗

• Personnel canon fields + bulk role assignment + admin UI fixes

permalink ↗

• Logger: RAILBASE_LOG_CONSOLE=false silences the terminal, file logs stay

permalink ↗

• Backups: retention, manual delete, configurable dir — and an update that says why it failed

permalink ↗

• Drawer: read-only facts + ledger grids; pages can be routable-but-hidden

permalink ↗

• Update center: downloads get deadlines; stale phases self-heal at boot

permalink ↗

• Re-import: pull from the REMEMBERED folder, no picker (Chromium)

permalink ↗