Org

0.18.xMinor

• createOrgLayer takes an events group, so a one-call site can rename event types, swap status wording, replace the location field and add fields.

  The six keys are eventTypeOptions, locationField, statusOptions, statusDefault, extraFields and extraFieldsAfter, the same keys createEventCollection already takes; a site that builds that collection itself passes them there directly. Each is forwarded only when set, the other twelve collections are never touched, and a layer built without the group is unchanged.

  The group's type is exported as OrgLayerEventsConfig. On a SQL database a new field is a new column, so regenerate your migration if you add one.

0.17.xMinor

• Documents can now be read in public, opt-in, and a public register of them cannot leak an internal one.

  createOrgLayer({ publicRead: { documents: true } }) (or createDocumentCollection({ publicRead })) adds a visibility select that defaults to internal, so turning the option on publishes nothing until an editor marks a document public. An anonymous visitor then reads only documents that are public, approved or published (archived and draft are never public) and not restricted to a division or team.

  author and collaborators are hidden from anonymous readers and cannot be used as filters. An explicit access.read still wins.

  New exports: buildPublicDocumentsWhere, publicDocumentsRead, PublicDocumentsReadOptions, PublicDocumentsCollectionOptions, DEFAULT_PUBLIC_DOCUMENT_GUARDED_FIELDS, DEFAULT_PUBLIC_DOCUMENT_STATUSES. A public register (an archive registration) should pass buildPublicDocumentsWhere() as its fixed where: a member's read is unrestricted, so access alone would show internal documents to every member.

  documents: { files: true } (or files on the factory) adds an upload field after content (default name file, relation to mediaCollection unless uploadCollection is set). Uploads are public by URL, so while public read is on the field refuses a file on a document whose visibility is not public, on create and when a document that holds a file is switched to internal; allowOnInternal: true lifts the rule for a site with a private upload collection.

  documents: { categoryOptions } (or categoryOptions on the factory) extends or replaces the category vocabulary; DEFAULT_DOCUMENT_CATEGORY_OPTIONS is exported and equals today's eleven values.

  With none of these options the collection is byte-identical to before: no visibility or file field, read: authenticated, the same category options (a golden cut from the pre-change source holds this). On a SQL database the visibility and file fields are new columns only on sites that opt in, which then generate a migration.

  • Signed in is not the same as a member. With public read on, the full document read (every row, author and collaborators readable and filterable) goes only to staff (a role with accessType: 'admin'), document managers (MANAGE_DOCUMENTS or DELETE_DOCUMENTS) and org members (a row in the member collection whose user is the signed-in user). Every other signed-in account, such as a customer or donor created by a public sign-up, reads exactly what an anonymous visitor reads: approved or published, public, unrestricted documents, with author and collaborators hidden and refused as filters. New exports: isOrgDocumentReader, documentReaderFieldRead, DocumentReaderOptions; publicDocumentsRead also takes memberSlug and memberUserField, and guardFieldsForSignedIn takes an optional field guard. The layer has no restrictedTo* rule for signed-in readers, so members still read restricted rows, as they did before the option. With the option off nothing changes: read: authenticated, held by the default-collection golden.
  • BREAKING: for sites that turned on publicRead.events, .divisions or .members in 0.16.0, signed-in accounts that are not staff, permission holders or org members now read only the public set (see the next bullet). A site that relied on every signed-in account seeing the full read must pass permissions to the rule or set an explicit access.read.
  • Security fix for the 0.16.0 public read of events, divisions and members: signed in is not the same as a member there either. With publicRead.events, .divisions or .members on, any signed-in account got the full read, so on a site with public sign-up a new customer account could read members-only and restricted events (with briefing, organizer and co-hosts), disbanded divisions, and classified members with user, reportsTo, position, timezone, region and last-promoted date. The full read now goes only to staff (accessType: 'admin'), holders of the collection's own write permissions (events: CREATE_EVENTS, EDIT_EVENTS, DELETE_EVENTS, MANAGE_EVENTS; divisions: EDIT_STRUCTURE, DELETE_STRUCTURE, MANAGE_STRUCTURE; members: INDUCT_MEMBERS, MANAGE_UNIT_ROSTER, MANAGE_STRUCTURE) and org members. Every other signed-in account reads exactly what an anonymous visitor reads, with the guarded fields hidden and refused as filters. A site that wants some other signed-in audience to see more can pass permissions to the rule or an explicit access.read. New exports: isOrgReader, orgReaderFieldRead, resolveOrgReaderOptions, ORG_READER_PERMISSIONS, OrgReaderOptions; publicEventsRead, publicDivisionsRead and publicMembersRead take memberSlug, memberUserField and permissions. With the options off nothing changes (read: authenticated on events and divisions, Payload's signed-in default on members).

0.16.xMinor

• createOrgLayer takes includeWaitlistCount and passes it to the events collection.

  createEventCollection already had the option, which adds a read-only waitlistCount counter right after attendeeCount, but createOrgLayer never passed it on, so a site on the one-call layer could not turn it on. createOrgLayer({ includeWaitlistCount: true }) now does.

  It is off by default, and a layer built without it (or with it false) is structurally identical to before. On a SQL database the counter is a new column, so a site that turns it on and uses migrations generates one.

  Purely additive: no peer is added or tightened, and nothing changes for a site that does not set it.

0.15.xMinor

• Security/visibility fix: new opt-in publicRead lets a public site show public events, active divisions and public members to anonymous visitors without leaking private rows or fields.

  createOrgLayer({ publicRead: { events, divisions, members } }), or publicRead on createEventCollection / createDivisionCollection / createMemberCollection, applies the new publicEventsRead, publicDivisionsRead and publicMembersRead rules. Signed-in users keep today's read.

  Anonymous visitors get a database-side filter built from each collection's own fields: events whose visibility is public and whose status is not draft; divisions whose status is active; members whose directory visibility is public and whose standing is active. Field-level access.read hides briefing, the organizer and the co-hosts on events, and user, reportsTo, position, timezone, region and lastPromoted on members (extraGuardedFields adds more).

  Use this instead of reading with overrideAccess: true from a public page, which ignores visibility and exposes members-only events. Nothing changes for a site that does not opt in, and an explicit access.read still wins.

0.14.xMinor

• Thread the fieldShape pipeline, decidedByRelationTo, notification fan-out, and checklist item field names through the recruiting factories (R2-I1.1) — the seam gaps a consumer adapter's correct STOPs found and R2-I2 confirmed empirically (createApplicationCollection({ omitFields: [...] }) silently ignored it).

  Fix — fieldShape pipeline now threaded through Application/JoinRequest/OnboardingRecord. None of the three recruiting factories applied omitFields/fieldOverrides/fieldOrder, and none accepted extraFieldsAfter (interior splice) — extraFields only ever appended at the tail. All three now run the same wiring order createAwardCollection established (extraFields via insertFieldsAfter → applyFieldOverrides → applyOmitFields → applyFieldOrder).

  Zero-config output is byte-identical; every new key is a no-op when omitted.

  Fix — JoinRequest `decidedByRelationTo`. decidedBy unconditionally shared requester's relation (memberSlug) with no way to point it elsewhere. A production consumer's real shape needs decidedBy on 'users', not the member collection.

  New decidedByRelationTo config key, defaulting to memberSlug (byte-identical back-compat).

  New — `adminOverrides` on all three recruiting factories. useAsTitle/defaultColumns/group/description were hardcoded in each factory's return statement, reachable nowhere except adminGroup (which only ever reaches group). This is a new convention, not an existing house mechanism being wired through — no other factory in @wabbit/tome-org exposes more than adminGroup either (Award/EventSlot included).

  Scoped to the three recruiting factories per this increment's brief, not a silent package-wide fix. adminOverrides shallow-merges last, so adminOverrides.group wins over adminGroup when both are given.

  Fix — `createPendingStatusNotificationHook` gains `buildNotifications` (plural). The singular buildNotification can express only one notification row per open transition; a production consumer needs N independent rows — one per resolved reviewer/officer. buildNotifications returns an array; each entry is created independently, deduped by its own key (an entry may set dedupKey explicitly — e.g. per-recipient — or falls back to ` ${baseDedupKey}:${index} ), and one entry's create failure is reported via onSyncFailure` without blocking the rest.

  Back-compat: buildNotification alone still works; buildNotifications wins when both are given. The hook now throws at creation time if neither is provided (previously buildNotification was a required config key — this is the same requirement, restated to cover the new either/or).

  Fix — sparse-checklist item field names. buildSparseChecklistGroupField's completions[] rows hardcoded itemKey/completedAt/completedBy with no rename seam — the one holdout among this package's field-producing builders. New itemFieldNames (on the builder directly, and per-entry on createOnboardingRecordCollection's checklistGroups) renames them; a production consumer needs templateItemId/checkedAt/checkedBy.

  Omitted keys keep the default names.

  All five gaps ship with red-first tests (each proven failing against pre-fix behavior) plus zero-config byte-identical pins for all three factories. Full @wabbit/tome-org suite: 849/849 (814 baseline + 35 new).

0.13.xMinor

• New Recruiting cluster — three opt-in collection factories plus three shared hook factories and a sparse-checklist field builder (Recruiting/Onboarding Wave / R2-I1).

  createApplicationCollection — staged-intake application (submitted/in-review/accepted/rejected/withdrawn, generic vocabulary — NOT any one consumer's own status words). createJoinRequestCollection — a join request against ANY org node, with targetRelationTo/targetLabel REQUIRED per the wave's naming directive (no default target — a factory that defaulted to 'teams' would be smuggling in an opinion about what "join requests" are for).

  createOnboardingRecordCollection — a member's onboarding progress record with two sparse-checklist groups (intake/handoff by default) and, per the wave plan's own instruction, NO built-in hooks under any configuration (a production consumer's real shape has none).

  Three factory-generic behaviors absorbed from the R2-I0 coupling map, each opt-in and export-only:

  • createGuardDirectTransitionHook — the STRUCTURE of a direct-approval guard (block a status field from entering a guarded value unless a privilege check passes), with the flag name, error copy, and guarded values 100% config. createApplicationCollection accepts it via guardDirectTransition.
  • createPendingStatusNotificationHook — the SAME upsertNotification/resolveNotificationsByGroupKey open/close fan-out both Applications and WingJoinRequests independently reimplemented byte-for-byte identically at a consumer's integration branch. Built ONCE; both createApplicationCollection and createJoinRequestCollection accept it via pendingStatusNotification.
  • createTaskCleanupOnDeleteHook — a generic afterDelete hook running an injected resolveTasks resolver, never rethrowing. createApplicationCollection accepts it via taskCleanupOnDelete.

  buildSparseChecklistGroupField (collections/recruiting/shared/sparseChecklistField.ts) — the sparse-completions-log shape (a completions[] array of only the items actually done, template lives elsewhere) the coupling map found used three independent times; createOnboardingRecordCollection uses it twice (intake/handoff).

  The approval/assignment contract: createJoinRequestCollection never assigns anything on approval — flipping status to an approved value is a plain field write with no afterChange hook reacting to it by default. This reproduces a production consumer's own proven separation (approval is a decision record; a separate handoff step does the actual assignment) as a hard contract, documented in the factory's own header, not an implementation detail a future change could accidentally erase.

  Three new subpath doors (./collections/application, ./collections/joinRequest, ./collections/onboardingRecord), each proven server-only-free via a dedicated subpath-loadable test plus the package's assert-node-loadable.mjs --every-file gate (196/196 targets pass). @wabbit/tome-workflow added as an optional peer + devDependency solely to prove, against the real claimTransition primitive, that JoinRequest's status field is CAS-compatible — the factory itself has no runtime dependency on the workflow engine.

  Not wired into createOrgLayer (design principle 2). No consumer-specific vocabulary ("wing", rank names) appears in any factory's runtime code — proven by a dedicated test that strips comments/string-literals from each source file and asserts zero "wing" substring remains, plus a consumer-emulation test per factory showing a production consumer's real shape is reachable purely through config injection.

0.12.xMinor

• New Recognition cluster — six opt-in collection factories, three hook factories, one access factory, and GDPR registration (Recognition Wave / R-I1).

  createAwardCollection, createMedalCollection, createRibbonCollection — the catalog trio (formal award/medal/ribbon definitions), sharing a catalogItemFields.ts builder set (shared field/slug builders, not a rigid shared array — the three real collections' field orders and eligibility shapes genuinely diverge). createAwardPresentationCollection — the "who actually got one" record, wiring createDisplayNameComposeHook (compose seam), an opt-in createAwardedBySelfEnforcementHook (admin "on behalf of" bypass, non-admin forced to self), and a default-on createRecipientCountSyncHook (payload.count(), never find({limit:0}) — the historical N+1 regression this cluster's own pins guard against).

  createKudosCollection — peer-to-peer recognition, update access via the new exported createGiverWindowAccess factory (originator self-edit within a configurable minute window). createMemorialCollection — public "In Memoriam" tributes, published-gated read access.

  registerRecognitionGdpr/unregisterRecognitionGdpr (packages/org/src/collections/recognition/gdpr.ts) — kudos hard-deletes the erased member's own rows as RECIPIENT while separately null-refing rows where they were the GIVER (one registry slot, two dispositions); award-presentations and memorials retain. Awards/Medals/Ribbons are deliberately never registered — catalog/definition rows carry no member relationship to key an erasure off of.

  Every factory threads the shared fieldShape mechanism (fieldOverrides/fieldOrder/omitFields/fieldDescriptions-null-suppress/extraFields/extraFieldsAfter) and per-verb access overrides — no held-out defaults. Discord fan-out and any web-framework cache-tag revalidation stay consumer-side (Wave 9 doctrine): no factory attaches notification hooks; createRecipientCountSyncHook's onExtraSync is the composition seam for that coupling instead.

  Opt-in only — nothing in this cluster is wired into createOrgLayer; a consumer imports and assembles these six factories directly. ORG_LAYER_VERSION is unchanged.

0.11.xMinor

• Document factory threaded through the shared `fieldShape` mechanism (Wave 8 D-I1). createDocumentCollection was the last org collection factory not wired to applyFieldOverrides/applyFieldOrder/resolveFieldDescription (./fieldShape.ts) — every other factory (Event, EventAttendance, Division, Team, Rank, ...) already carries it.

  Grown against a production consumer's integration branch's real Documents collection (src/collections/Documents/index.ts, 1158 LOC) so that collection can eventually become a thin adapter over this factory. A default createDocumentCollection() call is byte-identical to today — every seam below is opt-in.

  New seams:

  • fieldNames — renames author/restrictedToDivision/restrictedToTeam/lastReviewedAt/scopedTo/status.
  • slugField: Field[] | false — same resolveSlugField contract as Event/Division/Team/Rank. The single-field → Field[] replacement already generalizes a slug + slugLock companion-pair swap; no separate replaceFields seam was needed.
  • scopeOptions/scopeDefault/scopeOrgWideValue — {mode,options} override for the scope select, same contract as Event.statusOptions.
  • scopedToMode: 'dual-fields' | 'polymorphic' — 'dual-fields' (default) keeps today's scopedToDivision/scopedToTeam pair. 'polymorphic' emits ONE relationship field (scopedToRelationTo-injectable relationTo) — a production consumer's real scopedTo is a single polymorphic relation to ['wings', 'units', 'commissioned-ships'].
  • workflowStatusOptions/workflowStatusDefault — {mode,options} override for workflowStatus. includeStatusField opt-in emits a SEPARATE status select (own vocabulary via statusFieldOptions/statusFieldDefault) for consumers who split publication state from review state.
  • fieldOverrides/fieldOrder/fieldDescriptions (suppress-via-null convention)/extraFields/extraFieldsAfter — the standard shared set. fieldOverrides also covers documentId's unique-flag/admin divergences; no dedicated documentIdField seam was needed.

  access was already fully injectable per-verb (shallow-merged over the factory defaults) — verified a query-returning Access function round-trips through config.access.read unchanged. No new hooks: this factory stays hook-free by design.

  38 new tests in document-collection-w8-di1.test.ts (587 total passing). ORG_LAYER_VERSION untouched.

0.10.xMinor

• Wave 7 I5.1/I6.1 — closes the seam gaps the I5 (Events/index.ts) and I6 (EventAttendance/EventSlots/EventTypes) adoption passes at a production consumer's integration branch hit and reported in their STOP lists.

  Every seam is opt-in with an identical default (createEventCollection()/createEventAttendanceCollection()/createEventSlotCollection()/createEventTypeCollection() with no config each emit their exact prior shape — the pre-existing default-shape baseline specs stay green, unmodified).

  New shared mechanism (`packages/org/src/fieldShape.ts`), built once and threaded through all four events-cluster factories — the design rule this increment works under: prefer ONE shared mechanism over ten bespoke options.

  • applyFieldOverrides(fields, overrides) — the fieldNamed() ELIMINATOR. Both adopt passes had to reach into a factory's already-built fields array by hand (I5's Events/index.ts restoring required/index/label/admin.description/field-level access on organizer/coHosts/attendeeCount/waitlistCount/campaign/status; I6's EventSlots/index.ts stripping slotId's admin back off via a manual .map()). fieldOverrides: Record<name, Partial<Field>> merges admin/access one level deep, every other key overwrites, applied post-construction.
  • applyFieldOrder(fields, order) — post-construction reorder by field name; names listed come first in sequence, everything else keeps its original relative order and is appended after; an unknown name throws. This is the fix for I6's real blocking gap: EventAttendance couldn't be routed through the factory AT ALL because "the factory's fixed field-emission order cannot reproduce this collection's real order."
  • resolveFieldDescription(defaultText, override) — the three-state fieldDescriptions: { x: null } suppress convention (undefined keeps the default, a string overrides, null omits the admin.description key entirely). Closes EventSlot.slotId, the one field in the cluster the factory always described with no way to reach a production consumer's real "no admin key at all" shape.

  `createEventCollection`: fieldOverrides/fieldOrder (shared mechanism); eventTypeOptions ({mode,options}, same contract as statusOptions/visibilityOptions — eventType had no options seam at all before this); slugField: Field[] | false (same contract as DivisionCollectionConfig.slugField/resolveSlugField.ts, now shared by Event too — a production consumer's real slugField() helper is a unique: false slug + slugLock companion checkbox with a custom hook and admin component, a wholesale-replace case).

  `createEventAttendanceCollection`: fieldOrder (closes the real blocking gap above); fieldOverrides; extraIndexes: { fields, unique? }[] (a production consumer's real three beyond [event, member]: [event, status], [member, status], [event, selectedSlotId] unique). Converges the local insertFieldsAfterLocal TODO onto the now-merged shared insertFieldsAfter.

  `createEventSlotCollection`: extraFields/extraFieldsAfter (previously append-only, no anchor); fieldOverrides/fieldOrder; slotId/slotIndex now route through resolveFieldDescription, so fieldDescriptions: { slotId: null } suppresses the field's admin key entirely (a production consumer's real shape — the I6 adopt pass had to strip it post-construction).

  `createSlotSyncHook`: hintText({ dupKeys }) overrides the duplicate-key hint on the FAILED log line (default: this factory's own existing text, unchanged — NOT a production consumer's real string, a pre-existing divergence this increment doesn't silently "fix"); logPrefix overrides the [createSlotSyncHook] prefix on all three log lines (that consumer's real hook logs under [syncEventSlots]); extendSlotData(slot, doc) merges extra keys into both the create and update payloads (that consumer's real requiredCertification).

  `createEventTypeCollection`: extraFields/extraFieldsAfter (there was NO anchor mechanism at all before this — closes a production consumer's real description textarea, which has no factory correlate); colorFieldType: 'text' | 'select' + colorOptions (that consumer's real color is a palette select, not freeform text — a field TYPE mismatch fieldOverrides can't reach); fieldOverrides (closes the remaining five real diffs: label.unique+description, value.validate, shortLabel.required, order's default value, isActive.admin).

  `createRestrictStatusChangeHook`/`createEnforceSelfOnlyHook`: both gain skipWhenNoUser. restrictStatusChange's default is false (today's exact behavior — always resolves the Event and calls isPrivileged regardless of req.user); true reproduces a production consumer's real !req.user || checkRole(...) early bypass, including skipping the Event lookup (findByID) entirely — a genuine gap the old isPrivileged-only seam couldn't close (a consumer's predicate could reject an anonymous request but not skip the DB call).

  enforceSelfOnly's default is true — this hook already reproduces that consumer's !req.user bypass unconditionally (walkInHookBypass.spec.ts's pinned source-text assertions match today's code exactly); the option NAMES that existing behavior rather than changing it, and false opts into enforcing the member-id check even for an unauthenticated create.

  New test files: tests/field-shape.test.ts (19 tests, the shared mechanism in isolation), tests/event-collection-w7-i5-1.test.ts (16 tests), tests/event-attendance-collection-w7-i6-1.test.ts (15 tests), tests/event-slot-w7-i6-1.test.ts (17 tests), tests/event-type-w7-i6-1.test.ts (12 tests) — 79 new tests, 549/549 org tests green; tsc --noEmit clean; build + assert-node-loadable.mjs --every-file 148/148 PASS. ORG_LAYER_VERSION untouched — every seam here is export-only/opt-in, none auto-wired into createOrgLayer.

0.9.xMinor

• Wave 7 org-adoption I1 — createEventCollection grown seam-complete against the real Events collection read at a production consumer's integration branch (Events/index.ts, 1705 LOC + 7 relevant hook files).

  Every option is opt-in with an MVP-identical default (createEventCollection() with no config emits the exact 19-field shape it always has — see event-collection-w7-i1.test.ts's baseline); no factory in createOrgLayer calls any of the new options.

  Field-shape seams: statusOptions/statusDefault (a production consumer carries the MVP's seven lifecycle values plus two legacy DB-compatibility values, draft/published, it has never migrated off of); fieldNames (renames division/team/organizer/coHosts/securityLevel/attendeeCount/the two new participating-\* fields — that consumer: leadUnit, participatingWings/participatingUnits, visibility); includeParticipatingDivisions/includeParticipatingTeams (two NEW opt-in hasMany scope fields the MVP never modeled); visibilityOptions/visibilityDefault (that consumer's visibility values, public/members/restricted, diverge from the MVP's public/members-only/restricted); locationField (wholesale override for the MVP's freeform text field — that consumer's real location is a structured group); coHostsMaxRows (that consumer caps at 5, MVP unlimited); includeWaitlistCount (a NEW opt-in readOnly counter beside attendeeCount — the MVP has no waitlist model); fieldDescriptions (every previously-hardcoded admin.description string is now overridable — 2R-I6 precedent: a factory's generic wording replacing a consumer's own string, with no way back, is a rejected-round finding).

  `extraFields`/`extraFieldsAfter`: interior-positioned passthrough via a NEW shared helper, insertFieldsAfter(fields, anchor, extra) (packages/org/src/insertFieldsAfter.ts) — no factory in this package had an anchor mechanism before this. A production consumer's real leadUnit/participatingUnits/participatingWings sit immediately after coHosts, well before the capacity/counter fields near the end of this factory's array; the tail-append convention every other factory's extraFields uses (Rank/Promotion/StatusRequest/ExpertDesignation) can't reproduce that.

  Omitting extraFieldsAfter keeps the append-at-end default.

  Four adoptable hook factories, export-only, none auto-wired (same posture as every other adoptable hook in this package):

  • createClosedRecordLockHook (event-closed-record-lock.ts) — ports enforceClosedRecordLock: value-diff (not key-presence) based, blocks writes to a terminal-status event outside an allowlist, bypassable via bypassContextKeys (default: a production consumer's own bypassEventLock/migrationBackfill).
  • createLifecycleLogHook (event-lifecycle-log.ts) — ports logLifecycleTransition: append-only log REBUILT from originalDoc only on every save (client-supplied log data always discarded, array-item ids stripped so the save replaces wholesale), actor attribution priority chain (context key → injectable/default member-lookup resolver → system, auto: true).
  • createEventCascadeDeleteHooks (event-cascade-delete.ts) — generalizes a production consumer's four near-identical delete*.ts afterDelete hooks (event-slots/resource-requests/event-attendance/after-action-reports) into one {collection,field}[]-driven factory, per-target error isolation, never throws.
  • createNotificationResolverOnDeleteHook (event-notification-resolver.ts) — ports resolveEventNotificationsOnDelete: same resolveWrite/onResolved injectable seam shape as Wave 6's createPromotionNotificationCleanupHook, adapted to that consumer's real fixed-suffix EXACT-dedupKey resolution (events:{id}:exam-pending/aar-missing) rather than promotion's unbounded prefix scan. Never throws.

  New test files tests/event-collection-w7-i1.test.ts (34 tests: byte-identical-defaults baseline + every field-shape seam) and tests/event-hooks-w7-i1.test.ts (29 tests: all four hook factories, including allowlist/bypass, originalDoc-rebuild, per-target isolation, never-throws). 384/384 org tests green; tsc --noEmit clean; build + assert-node-loadable.mjs --every-file 132/132 PASS. ORG_LAYER_VERSION is NOT bumped (release-time task).

  Not seamed this increment (named per the build brief, not approximated): getEffectiveStatus's time-based lock derivation (an event whose end time has passed behaves as completed even before the status-flip cron runs) is consumer-specific — it reads dateTime.startDate/endDate field names this factory does not own — so createClosedRecordLockHook's terminalStatuses check is value-based against statusField only; a consumer wanting the time-based derivation keeps a synced "effective status" field and points statusField at it.

• Grow createEventAttendanceCollection seam-complete for adoption by a production consumer (Wave 7 I2), ported from that consumer's real EventAttendance collection (its integration branch, src/collections/EventAttendance/index.ts + its hooks/ directory).

  All additive and opt-in — the zero-arg default output is unchanged (same field set, same single beforeValidate uniqueness hook, no indexes key).

  • statusOptions extend/replace override — the MVP's own nine-value vocabulary already matches that consumer's real nine by value (kept verbatim as the default).
  • uniquenessStrategy: 'index' | 'hook' — 'hook' (DEFAULT, unchanged) is today's find-then-throw createAttendanceUniqueHook, TOCTOU-racy under concurrent writes; 'index' adds a real unique compound Mongo index on [event, member] instead, no hook attached.
  • Ten opt-in field groups, each gated behind its own includeX flag and name-overridable via fieldNames/committedAssetFieldNames/readinessFieldNames: selectedSlotId, readiness (5-subfield advisory group), trainingOutcome (passed/failed/incomplete — deliberately never gets an admin.condition; the doc comment records a production consumer's production history of a stale relationship-ID condition hiding the field for the collection's entire life), auditGrades+calibrationDeviation, committedAsset (fleet-asset pledge group; the ship-catalog lookup hook is NOT ported), operationalStatus, rsvpDate (auto-stamped on create), attendanceConfirmedBy/attendanceConfirmedDate (gated on attendedStatusValue), and adminNotes (field-level access seam, default gated on MANAGE_ATTENDANCE/MANAGE_EVENTS).
  • fieldDescriptions override for every hardcoded admin.description this factory can emit (same contract as Wave 7 I1's EventFieldDescriptions).
  • computeDisplayName/displayNameCompose — default OFF (the MVP's displayName field exists today but nothing populates it; defaulting this on would add a hook where none exists, breaking the default-shape guarantee). Same naming as ConductRecordCollectionConfig's W6 seam.
  • extraFields/extraFieldsAfter — local insertFieldsAfterLocal helper (the shared insertFieldsAfter module lives only on the unmerged Wave 7 I1 branch as of this writing; TODO comment marks the post-merge converge point).
  • Four standalone hook factories, export-only and opt-in via dedicated config keys (restrictStatusChange, enforceSelfOnly, attendeeCountSync, engagementOnFirstAttendance) that thread this factory's own resolved slugs automatically:
  • createRestrictStatusChangeHook — port of restrictStatusChange; injectable isPrivileged(req, event) (a production consumer: organizer-OR-co-host).
  • createEnforceSelfOnlyHook — port of enforceSelfOnly; injectable resolveMemberId.
  • createAttendeeCountSyncHook — port of syncAttendeeCount; uses payload.count(), never find({ limit: 0 }) (that consumer's own documented anti-pattern fix); onExtraSync seam for ceremony/promotions maintenance.
  • createEngagementOnFirstAttendanceHook — port of updateOnboarding's idempotent first-attendance flip; isEngaged idempotency gate + consumer-owned write.
• Wave 7 I3 — upstreams a production consumer's EventSlot mirror as two new opt-in exports: createEventSlotCollection (default slug org-event-slots) and createSlotSyncHook.

  Neither is wired into createOrgLayer (design principle 2, same posture as DelegatedAuthority/PersonnelNotes) — a consumer attaches both explicitly.

  `createEventSlotCollection` ports a production consumer's integration branch's EventSlots/index.ts (98 LOC): event relationship (slug injectable via eventSlug), slotId, and the denormalized descriptor fields (groupIndex/assetIndex/slotIndex/roleName/isCommander) — every field name overridable via fieldNames, every admin description overridable via fieldDescriptions. LMS-owned relations (requiredCertification, requiredSpecialistPath) are deliberately NOT modeled — same cross-wave-edges rule already applied in ExpertDesignation.ts/DelegatedAuthority.ts — add them via extraFields.

  read defaults to authenticated; create/update/delete default-gate on CREATE_EVENTS/MANAGE_EVENTS, fully overridable via access.

  CRITICAL, pinned by test: the [event, slotId] compound index is emitted WITHOUT unique: true, by design — a real DB-level unique index here previously caused syncEventSlots's create() to throw a silently-swallowed MongoDB E11000 on any slotId reuse (the CMS "Duplicate" action being the reproducing case), leaving an event with zero mirror rows and every slot unclaimable with no visible symptom. Real de-duplication lives ONLY in the sync hook's reconcile pass, never the database.

  tests/event-slot.test.ts asserts both the field-level and the compound-index level carry no unique flag — do not "fix" this into a unique constraint.

  `createSlotSyncHook` ports Events/hooks/syncEventSlots.ts (225 LOC) as an Event-collection afterChange hook factory: an injectable extractSlots(doc) extracts the flat slot list from whatever nested shape a consumer's Event schema uses (a production consumer: operationDetails.operationalGroups[].assets[].crewSlots[] — this factory has no knowledge of that shape). Reconciles by deleting rows that fell out of the current slot set and creating-or-updating rows that are still current, with every current-slot write isolated under Promise.allSettled (one failing slot — classically a duplicate-key race — never aborts the batch or the others).

  Clears orphaned attendance selectedSlotId-equivalent references via an injectable attendance config (slug + field names), opt-out via attendance: false or omitting it. NEVER throws: the whole body runs under a top-level try/catch routed through the package's existing reportOrgSyncFailure/onSyncFailure seam (same convention as member-count-sync.ts) — an Event save must succeed even when slot sync fails outright.

  New test file tests/event-slot.test.ts (20 tests) — factory shape, the non-unique-index assertions, fieldNames/fieldDescriptions/extraFields/access overrides, sync-hook create/delete/update paths, Promise.allSettled isolation with the E11000 hint text, the never-throws guarantee (including a custom onSyncFailure reporter), and the attendance-clearing opt-out. 341/341 org tests green; tsc --noEmit clean; build + assert-node-loadable.mjs --every-file 126/126 PASS.

  Isolation note: PRs #341 (events/Event.ts, hooks/event-*.ts, insertFieldsAfter.ts) and #342 (events/EventAttendance.ts, types.ts additions) are in flight concurrently. This PR touches none of their files — EventSlot.ts and event-slot-sync.ts are new files, and the only edits to shared barrels (collections/events/index.ts, hooks/index.ts, src/index.ts) are append-only new export lines.

  types.ts is untouched entirely: EventSlotCollectionConfig/SlotSyncHookConfig are defined locally in their own files rather than added to the shared config-type file #342 is already extending, and the collection's own default slug (DEFAULT_EVENT_SLOT_SLUG = 'org-event-slots') is a local constant rather than a new ORG_DEFAULT_SLUGS.eventSlots entry — a follow-up can fold it into OrgSlugs once the sibling PRs land. createOrgLayer and ORG_LAYER_VERSION are untouched; wiring slots into the layer factory is a deferred, explicit follow-up decision, not assumed here.

• Wave 7 I4 — absorbs the EventType delete guard EventType.ts's own header deferred to MVP+1, behind a new opt-in includeDeleteGuard (default false, byte-identical to today's factory).

  `createEventTypeCollection({ includeDeleteGuard: true })` adds a beforeDelete hook (createEventTypeDeleteGuard, new export) that blocks deletion while any Event still references the type, throwing a 400 APIError. Ported from a production consumer's integration branch's src/collections/EventTypes/index.ts beforeDelete hook.

  Two matchOn modes seam the field-shape divergence between today's runtime and upstream's own documented future direction: 'value' (default) counts Events where eventTypeField (default 'eventType') equals the EventType doc's value STRING — that consumer's actual semantics, since its Events.eventType is a select field storing that string, and this package's own createEventCollection ships the identical select shape today; 'relationship' counts Events where eventTypeField equals the EventType doc's own id, for when eventType becomes a real relationship (that consumer's own file header names this as a future migration). eventsSlug defaults to ORG_DEFAULT_SLUGS.events.

  deleteBlockedMessage overrides the thrown text; the built-in default reproduces that consumer's exact string (Cannot delete "${label}": ${count} event(s) are using this type. Re-assign them first.).

  `fieldDescriptions` makes the three previously-hardcoded admin.description strings (value, color, defaultFeatures) overridable — same contract as Wave 7 I1/I2.

  New test file tests/event-type-guard.test.ts (17 tests) — default-shape byte-identical gate, fieldDescriptions overrides, guard wiring (hook count, mergeHooks append with a consumer's own hooks), both matchOn modes, deleteBlockedMessage override, custom eventsSlug/eventTypeField, and the zero-usage / no-value pass-through paths.

  Isolation note: PRs #341 (events/Event.ts, hooks/event-*.ts, insertFieldsAfter.ts), #342 (events/EventAttendance.ts, types.ts additions), and #343 (events/EventSlot.ts, hooks/event-slot-sync.ts, barrels) are in flight concurrently. This PR touches none of their files: event-type-delete-guard.ts and event-type-guard.test.ts are new files, and the only edits to shared files (collections/events/EventType.ts, hooks/index.ts, src/index.ts) are either fully self-contained (EventType.ts, not touched by any sibling) or append-only new export lines (the two barrels).

  types.ts is untouched entirely: EventTypeFactoryConfig/EventTypeFieldDescriptions are defined locally in EventType.ts (extending the existing, unmodified EventTypeCollectionConfig import) rather than added to types.ts, which #342 is already extending. createOrgLayer and ORG_LAYER_VERSION are untouched — this guard is export-only/opt-in, never auto-wired into the layer factory.

0.8.xMinor

• Wave 6 org-adoption I8 — the last three org-domain personnel factories: createStatusRequestCollection, createConductRecordCollection, createExpertDesignationCollection.

  All opt-in, none wired into createOrgLayer (design principle 2). Ownership split: org owns the RECORD shape; a transition engine (e.g. @wabbit/tome-workflow) owns any TRANSITION logic — none of the three factories model a transition/execution hook.

  `createStatusRequestCollection` (default slug status-requests, a production consumer: member-status-requests, 14 live rows). 18 neutral fields absorbed from MemberStatusRequests/index.ts verbatim. type/status default to that consumer's own five-value vocabularies (generic HR/pipeline terms); approverScope ships a Tome-neutral default (division_lead/organization) since that consumer's real values (wing_co/vlc) are organization-specific jargon — replace wholesale via approverScopeOptions.

  The grouped approval/denial fields reuse Promotion's W6-I6 shape verbatim via a new shared helper, buildApprovalDenialGroups (collections/personnel/shared/approvalDenialGroups.ts) — extracted so this factory doesn't fork the same field arrays a second time; createPromotionCollection's own inline fields are left untouched (byte-identical factory-snapshots.test.ts guarantee, no regression risk taken). The built-in title-composition hook (computeTitle, default true) reproduces that consumer's inline beforeChange exactly, reading a configurable titleDisplayField (default 'displayName'; that consumer: 'rsiHandle').

  NOT modeled, by design: the donor consumer's executeStatusRequest afterChange hook. It writes the settled status back via a DIRECT MONGO updateOne, bypassing Payload hooks entirely — that bypass IS the infinite-loop guard.

  Routing it through payload.update() would re-fire the same afterChange hook and offboard the member TWICE. Per the wave plan's Wave 4 precedent, a consumer wires this as a workflow.ts module beside their adapter.

  `createConductRecordCollection` (default slug conduct-records, a production consumer: discipline-records, 2 live rows). 20 fields — every field name defaults to that consumer's own verbatim (only the collection slug differs by default; no field-shape divergence was found). Absorbs enforceCoolingPeriod (coolingPeriod — new createConductRecordCoolingPeriodHook, hooks/conduct-record-cooling-period.ts), setDisplayName (computeDisplayName/displayNameCompose, default composes from severityOptions's resolved label + a configurable subjectDisplayField), autoAssignAppealReviewer's transition-detection bookkeeping (autoAssignReviewer — new createConductRecordAutoAssignReviewerHook, hooks/conduct-record-appeal-reviewer.ts — the chain-of-command WALK is an injected poolQuery), and anonymizeForSubject (subjectRedaction — new createConductRecordSubjectRedactionHook, hooks/conduct-record-subject-redaction.ts — the "is this reader the subject" ABAC is an injected predicate).

  relatedStandingChange gets a field-level MODIFY_STANDING-gated access.update default (relatedStandingChangeAccess to override).

  Stays consumer-side, never modeled: triggerStandingChange (cascades a standing change onto members — real re-entrant hook machinery this package doesn't own), auditDisciplineRecord (writes to an audit-logs collection this package doesn't own), and the 4 bespoke ABAC access functions (rank-floor + led-unit queries this package has no hierarchy resolver for).

  `createExpertDesignationCollection` (default slug expert-designations, a production consumer: sme-designations, 0 live rows). 10 fields — LMS territory (that consumer's specialistPath/qualifyingTier) is deliberately NOT modeled per the wave plan's cross-wave-edges rule; add it via extraFields. canEndorse is an endorsement-access seam layered on top of MANAGE_SME_DESIGNATIONS.

  Discord notification stays entirely consumer-side and runs last automatically — this factory attaches no afterChange hooks of its own, so a consumer's notifyDiscord passed via hooks.afterChange is appended after everything else by mergeHooks (design principle 5), reproducing that consumer's "Discord fires last" ordering with no special wiring.

  GDPR: registerPersonnelGdpr extended to register all three new collections as retain/post-identity (Wave 5 compliance plan §3a's own dispositions, verbatim), and closes two gaps the W6-I7 adopt pass hit: every one of the now-five registrations has independently-overridable phase/order (*Phase/*Order config keys) and its own register*: boolean opt-out (default true, mirrors createFulfillmentLayer's/createSCLayer's registerGdpr: false, scoped per-collection); personnelNotesDeleteShape: 'bulk' | 'tolerant-per-row' — 'tolerant-per-row' finds then per-row try/catch deletes, matching a production consumer's real pinned erasure-engine shape for the 20,351-row personnel-notes collection (one bad row under 'bulk' previously aborted the WHOLE delete with zero rows erased).

  New test files tests/status-request-collection.test.ts (20 tests), tests/conduct-record-collection.test.ts (29 tests), tests/expert-designation-collection.test.ts (17 tests); tests/personnel-gdpr.test.ts extended (10 → 22 tests). 321/321 org tests green; tsc --noEmit clean; build + assert-node-loadable.mjs --every-file 122/122 PASS.

0.7.xMinor

• Wave 6 org-adoption I3.1 + I7 — closes the four Position factory gaps the real adoption by a production consumer's billets hit (69af1fe6), and adds two new opt-in personnel factories under a consistent naming convention.

  All opt-in, defaults byte-identical.

  I3.1 — Position follow-up. Billets/index.ts (a production consumer's actual adapter over createPositionCollection) needed four things the I3 pass didn't model:

  • `divisionField`/`teamField`: Position's own division/team field names were hardcoded — that consumer's Billets call these wing/unit. Renaming also renames admin.defaultColumns and the field descriptions.
  • `extraScopeFields`: that consumer has a THIRD, mutually-exclusive scope anchor with no Tome structural correlate — ship (relationTo: 'commissioned-ships'). scopeFields (for enforceScopeExclusivity) now defaults to [divisionField, teamField, ...extraScopeFields.map(f => f.name)] automatically.
  • `includeAuthorityTier` (default true, today's shape): that consumer passes false — no use for a second, purely-descriptive classification column alongside its real authorityLevel.
  • `categoryRequired` (default false) + `categoryOptions`: category had no requiredness/vocabulary override, unlike Rank's identically-shaped field. The consumer's Billets.category is required: true. New export DEFAULT_POSITION_CATEGORY_OPTIONS.
  • `createPositionDeleteGuard`'s S2 check widened, in position-delete-guard.ts: Team's leadership check goes from 2 fields (leader/other) to that consumer's real 4 (leader/executiveOfficer/seniorNCO/other) — the new two are only queried when explicitly named via teamLeadershipFields, so an unconfigured consumer's query stays byte-identical.
  • `createPositionDerivationsHook`'s `composeDisplayTitle` signature changed from (data, ctx) to a plain { title, scopeName, scopeKind } object (nothing outside this package's own tests referenced the old shape) so a consumer's composer can react to ANY scope anchor — including extraScopeFields — not just division/team. The walk itself is generalized to N scopeAnchors, checked in priority order, wrapped in a single try/catch matching that consumer's own whole-chain (not per-branch) shape.

  New test file tests/position-collection-w6-i3-1.test.ts (20 tests, incl. a full consumer-shaped integration test: wing/unit/ship scopes, includeAuthorityTier: false, the 4-field Team guard, and a ship-anchored display title). factory-snapshots.test.ts and position-collection-w6-i3.test.ts untouched in behavior (two tests updated only for the composeDisplayTitle signature change) and green — every default output is unchanged.

  I7 — two new factories, under a consistent naming convention decided the same day.

  • `createDelegatedAuthorityCollection` (default slug delegated-authority, a production consumer: acting-authority, 0 live rows): temporary cross-scope command delegation, 11 fields mirroring that consumer's ActingAuthority verbatim under neutral names, all overridable via fieldNames. The scope select's option VALUES are derived from divisionField/teamField rather than a separate vocabulary — that consumer's real values (wing/unit) already equal its own field names for exactly this reason. The compound-uniqueness beforeValidate guard (at most one ACTIVE record per member/scope-entity/position) is always attached — a brand-new factory has no existing consumer to keep byte-identical for. createDelegatedAuthorityExpiryTask (new hooks/delegated-authority-expiry.ts) wraps the pure expireDelegatedAuthority(payload, now, options) as a standard JobHandler for asPayloadTask/asCronEndpoint (@wabbit/tome-core/jobs) — paged 50-at-a-time, optimistic re-check before each write, never deletes, never throws.
  • `createPersonnelNotesCollection` (default slug personnel-notes, a production consumer: member-notes, 20,351 live rows): 7 fields mirroring that consumer's MemberNotes verbatim. IMPORTANT: author is a MEMBER relationship, not users — matches that consumer's real shape (fetchMember(req)-resolved). immutable defaults true (update: () => false). Opt-in authorRankOrder config absorbs setAuthorRankOrder (denormalizes the author's rank order at create time, fail-secures to 99999 on any resolution failure, falls back to a direct Rank lookup when the author's rank relationship is an unpopulated ID). auditCreate/auditRead seams absorb auditNoteCreation/logReadAccess — both fire-and-log-only, never block the write/read on failure.
  • `registerPersonnelGdpr` (new src/gdpr.ts, mirrors @wabbit/tome-sc's registerScGdpr): registers delegated-authority as retain/post-identity (org history) and personnel-notes as hard-delete/pre-identity with a CUSTOM onDelete — the registry's built-in userField/memberField OR pair can't express "match one memberId against two DIFFERENT member-keyed fields" (member AND author), which is what a production consumer's real "both directions" erasure actually needs. deleteAs: ['member', 'author'] (default: both) narrows to one direction if ever needed. Dispositions match the Wave 5 compliance plan §3a's own rows for these two collections verbatim.

  New test files tests/delegated-authority.test.ts (18 tests), tests/personnel-notes.test.ts (19 tests), tests/personnel-gdpr.test.ts (10 tests). Neither factory is wired into createOrgLayer (design principle 2 — individual factories, explicit slugs, same as Position/Rank/Promotion).

  I6.1 — Promotion follow-up. Promotions/index.ts (a production consumer's actual adapter over createPromotionCollection, 26c86583 on that consumer's integration branch) hit three more gaps, documented in that commit's adapter header and pinned by promotionsHooksParity.spec.ts:

  • `extraFields`: the only one of the six adoptable factories in this wave without this passthrough — that consumer's 7 no-factory-correlate fields (authorizedBy, systemGenerated, generatedBy, triggeredByAcademy, attendingCeremonies, calledAtCeremony, calledAt) had nowhere to go until now.
  • `approvalModel: 'grouped'` completeness, all additive-only under new validateBypassField/groupedModelOverrides options: validateBypassField adds the array-level validate bypassing "at least one recommendation required" when the named field (that consumer: systemGenerated) is true; groupedModelOverrides.{recommendations,approval,denial} add admin.condition per group/array (that consumer hides approval/denial until populated or status matches), a beforeValidate hook seam on recommendations[].reason (that consumer: link canonicalization + inline-data-URI guard), and a rich-text editor override for denial.reason (that consumer needs a richer node vocabulary to avoid a Lexical crash on member-facing content).
  • `createPromotionNotificationCleanupHook`'s resolve-write: promotionsHooksParity.spec.ts proved the hook's one-field write ({ bucket: 'done' }) was a strict SUBSET of that consumer's real resolveNotificationByDedupKey, which writes FOUR fields (bucket/resolutionMode/resolvedAt/expiresAt) — missing expiresAt specifically meant the 30-day retention cron would never sweep the row. New resolveWrite (default: today's one-field write) and onResolved (default: none; that consumer: socket emit + triage-cache bust, called per resolved row, errors caught and reported per-row without aborting the sweep) close the gap to parity.

  New test file tests/wave6-i6-1.test.ts (20 tests). factory-snapshots.test.ts and wave6-i2-1-i6.test.ts untouched in behavior and green — every default output (including the pinned approvalModel: 'grouped' field shapes) is unchanged.

  243/243 org tests green; tsc --noEmit clean; build + assert-node-loadable.mjs --every-file 108/108 PASS.

0.6.xMinor

• Wave 6 org-adoption I2.1 + I6 — closes the four Division/Team factory gaps the real adoption by a production consumer hit, and makes createPromotionCollection adoptable.

  All opt-in, defaults byte-identical.

  I2.1 — Division/Team follow-up. Wings/index.ts/Units/index.ts (a production consumer's actual adapters over these factories) each documented a gap they had to work around locally instead of via config:

  • `extraFields` (Division + Team): neither factory had the passthrough Rank/Position already had — added, same contract.
  • `leadershipAccess` (Division + Team): field-level access for the position-mode leadership group — that consumer locks it behind canManageHierarchy and previously had no seam for that at all, forcing the whole group to be kept as its own object, verbatim.
  • `divisionField` (Team): the Division-backlink field name was hardcoded to 'division' with no override, so that consumer's 'wing' name could never be produced by the factory. Renaming it also renames the admin.defaultColumns entry and description.
  • `leadershipFields.executiveOfficer`/`.seniorNCO` (Team): the position-mode leadership group had only leader + other[] where that consumer's real shape has FOUR fields — the same 3-singular + other[] shape Division already had. Each new field is emitted ONLY when named, so the original 2-field default stays byte-identical. Division and Team now share the identical option surface.

  I6 — Promotion adoptable.

  • `statusOptions` + `statusDefault`: enums are config, not code — a production consumer's capitalized five (Pending/Approved/Completed/Denied/Canceled, 2663 live rows) replace Tome's lowercase five via the same {mode, options} contract as Rank.categoryOptions. Exported DEFAULT_PROMOTION_STATUS_OPTIONS.
  • `fromRankRequired` (default false) + `memberImmutable` (default false, adds field-level access.update: () => false on member).
  • `approvalModel: 'flat' | 'grouped'` (default 'flat'): 'grouped' swaps the flat recommendedBy/approvedBy for a production consumer's real shape — a recommendations[] array (recommendedBy + reason) plus approval (approvedBy+approvedAt) and denial (deniedBy+deniedAt+reason) groups, field names read verbatim from Promotions/index.ts.
  • `createPromotionNotificationCleanupHook` (new promotion-notification-cleanup.ts): export-only afterDelete factory absorbing resolvePromotionNotificationsOnDelete (the 7-orphaned-tasks incident) — discovers open notifications by dedup-key PREFIX (the suffix set embeds a variable recipient id, so it isn't finite) with a like-then-real-startsWith re-check, then resolves each one. Collection slug, key field, status field, and the prefix function are all injectable.
  • `createMemberRankSyncHook` (new member-rank-sync.ts): export-only afterChange factory absorbing the CORE of updateMemberRank — writes member.rank (+ an optional last-promoted date field) when a promotion transitions to its completed status, WITH both of that consumer's re-entry guards ported as named, overridable context-flag options (ceremonyClearContextFlag default 'rankUpdateClearCeremonies', reconcilerPassContextFlag default 'reconcilerPass'). Ceremony linking, onboarding auto-graduation, Discord sync, notifications, and cache revalidation stay consumer-local (events-wave territory) — chain a consumer hook after this one for those.
  • `fourEyes` (default true): gates the built-in promotionFourEyesHook off. That consumer enforces four-eyes itself at the application layer (canApprovePromotion's self-block + submitter-block, also checked in confirmSoftBan) — running Tome's hook too would be a second, independent enforcement of the same rule against fields approvalModel: 'grouped' doesn't even populate.

  Both new hooks follow the same export-only, never-auto-wired, never-rethrows posture as the I2 structural hooks (OrgSyncFailureReporter injectable). New test file tests/wave6-i2-1-i6.test.ts (41 tests); factory-snapshots.test.ts and wings-units-w6-i2.test.ts untouched and green — every default output is unchanged.

0.5.xMinor

• Wave 6 org-adoption I3 — createPositionCollection grows the config surface a production consumer's Billets needs to adopt it, and closes the wave's headline risk: the authorityLevel enum collision.

  • `authorityLevel` collision closed at the root, via rename. Tome's original authorityLevel field (strategic/operational/tactical/technical) was DESCRIPTIVE — a monorepo-wide grep (plus the starter and wabbit-site-core) found zero consumers of its value. The consumer's Billets.authorityLevel (organization/cascading/direct/advisory) is EXECUTABLE — read by getLeadershipProfile, resolveLowestCommonAuthority, and checkActionPermission/*. Same field name, disjoint vocabularies, one load-bearing: a naive merge would have silently disabled cascading authority with no error and no failing test. The fix is a rename, not a merge: the old field is now `authorityTier` (same four values, same meaning) — freeing authorityLevel for the executable semantics. This is the one deliberate default-output change in this release: tests/factory-snapshots.test.ts's Position field-shape assertion now expects authorityTier in place of authorityLevel, updated deliberately in this same commit. Every other option below is opt-in with byte-identical defaults.
  • `includeAuthorityLevel` (default `false`) + `authorityLevelOptions`: adds a SEPARATE authorityLevel select carrying the consumer's four executable values verbatim (labels + admin description), exported as DEFAULT_AUTHORITY_LEVEL_OPTIONS. Tome adopts that consumer's behavior as the platform default for this field once a consumer opts in.
  • `enforceScopeExclusivity` (default `false`) + `scopeFields` (default `['division', 'team']`): absorbs the consumer's REAL Billets/index.ts beforeValidate hook, ported faithfully from the source (its integration branch) rather than the wave plan's looser paraphrase — it throws only when MORE THAN ONE scope anchor is set; zero is a valid org-wide position, matching that consumer's own inline comment ("or none for org-wide billets"). New position-scope-exclusivity.ts.
  • `guardDeleteWhenReferenced` (default `false`): absorbs beforeDeleteBillet's S2 (refuses delete when a Division/Team running leadershipMode: 'position' references this Position in a leadership slot) + S3 (directly clears the holder's Member doc, bypassing any afterChange chain — same re-entrancy reasoning rank-delete-guard.ts already documents for Rank). Configurable memberPositionField (default 'position', that consumer: 'billet') and divisionLeadershipFields/teamLeadershipFields (same shape as DivisionCollectionConfig/TeamCollectionConfig.leadershipFields). New position-delete-guard.ts.
  • `deriveDisplayTitle` (default `false`) + `composeDisplayTitle` override: absorbs the consumer's beforeChange hook, which computes isVacant (= !currentHolder) and composes displayTitle together in one pass — both fields have existed since MVP with nothing computing them. Default composition is "<scope name> — <title>"; pass composeDisplayTitle to match that consumer's own "<title>, <scope name>" shape verbatim. New position-derivations.ts, exports defaultComposeDisplayTitle.
  • `extraFields` passthrough, same contract as Rank/Division/Team — for the consumer's ship, requiredCertifications (both stay consumer-local, no Tome correlate). academyGrants/syncAcademyGrants (ADR-012) stay consumer-local entirely — LMS-domain, not absorbed here.

  All three new hooks are wired directly into createPositionCollection behind their opt-in flags (not export-only) via mergeHooks, so a consumer's own hooks compose alongside them rather than replacing them — same pattern as Rank's guardDeleteWhenHeld.

0.4.xMinor

• Wave 6 org-adoption I2 — createDivisionCollection/createTeamCollection grow an opt-in leadershipMode + divisionRequired surface, and four structural sync hooks absorbed from a production consumer's Wings/Units/Members production behavior are exported (never auto-wired).

  Every option below is opt-in; the existing factory-snapshots.test.ts Division/Team assertions stay green, proving default output is byte-identical.

  • `leadershipMode: 'member' | 'position'` (default 'member', today's leader/deputy member-relationship fields, unchanged). 'position' drops those two fields and emits a leadership group of Position relationships instead — Division: commanderPosition/executiveOfficerPosition/seniorNCOPosition; Team: leaderPosition/otherLeadershipPositions[]. Field names are overridable via leadershipFields so that consumer can adopt with its existing commanderBillet/executiveOfficerBillet/seniorNCOBillet/otherLeadershipBillets names, no data rename. positionSlug threads the relationTo (default ORG_DEFAULT_SLUGS.positions).
  • `Team.divisionRequired` (default true, today's shape). That consumer's units.wing is nullable — wing deletion nulls the backlink rather than cascading — pass false to match.
  • `createMemberCountSync({ memberSlug, divisionSlug, teamSlug, fields })` — Member afterChange/afterDelete hooks that atomically sync Division/Team.memberCount, replacing the "not auto-synced" honesty gap those two fields' descriptions have carried since MVP. Counts the union of a member's hasMany array (divisions/teams) and singular primary field (primaryDivision/primaryTeam) so neither assignment convention silently undercounts. Uses a real atomic $inc when the DB adapter is Mongoose (duck-typed at runtime — this package has no @payloadcms/db-mongodb dependency), falling back to a documented, non-atomic read-modify-write otherwise. Export-only: a consumer opts in from their own Member collection's hooks.
  • `createDivisionTeamReciprocityHook`, `createTeamSunsetHook`, `createDivisionCleanupHook` / `createTeamCleanupHook` — exported factories porting the consumer's afterWingChange (de-dupe + reciprocal backlink, preventRecursion-guarded), handleUnitSunset (member/position cascade on an operational→sunset status flip), and cleanupWingReferences/afterUnitDelete (afterDelete reference cleanup) behavior, all fully configurable by slug/field name. All accept an injectable onSyncFailure reporter (that consumer: reportSyncFailure) and never rethrow — a failed cross-collection sync is reported, not allowed to fail the write that triggered it. None are auto-wired onto createDivisionCollection/createTeamCollection; see the README's "Adopting divisions/teams from an existing app" section for the hook ORDER requirement (consumer-side reference-reading cleanup, e.g. Discord, must run BEFORE the cleanup hooks in afterDelete).
  • `includeAbbreviation` (Rank, default `true`) and `slugField` (Rank/Division/Team, default = today's built-in `slug` field; `false` omits it; `Field[]` replaces it verbatim) — a same-PR follow-up. That consumer's ranks adapter (W6-I1 adopt) had to FILTER createRankCollection's emitted fields post-hoc to drop abbreviation and swap the built-in slug field for its own slugField('name') pair; consumer-side editing of factory output isn't an adoption contract, so both are now first-class options. slugField is shared verbatim across Rank/Division/Team (identical built-in field shape, new resolveSlugField.ts helper); includeAbbreviation is Rank-only since Division/Team have no abbreviation field to gate.

0.3.xMinor

• Converge onto the single platform permission engine.

  tome-org now registers ORG_PERMISSIONS and its super-permission map (translated to value-space) into @wabbit/tome-core/auth/permissions and delegates checkOrgRole/hasPermission to the shared engine — the parallel org permission resolver is removed (no more two-systems redundancy). Public API is unchanged and verified to resolve identically to the prior implementation across representative role fixtures (a production-consumer-shaped role.permissions map, multi-role, unpopulated/string-id roles, null user) plus super-permission implication.

  Adds exports registerOrgPermissions, buildOrgSuperPermissionMap, ORG_OVERRIDABLE_PERMISSIONS.

0.2.xMinor

• Publish pipeline setup — first-publish prep. Adds tsup config, dist build script with NODE_OPTIONS heap bump, publishConfig (restricted, npm.wabbit.com), main/module/types fields, files allowlist (dist, README.md, LICENSE.md), and exports map pointing at dist/.

  Mirrors the canonical @wabbit/tome-* publish template (catalog/economy/admin shape).

  Peer-dep correction: moves @wabbit/tome-core from dependencies (which was incorrect for a peer) to peerDependencies (workspace:*). Also keeps it in devDependencies so workspace install still resolves it at build time.

  Existing peerDependenciesMeta block was already declaring @wabbit/tome-core as a peer, so this fixes the orphan declaration. devDeps gains cross-env, rimraf, and tsup to match the canonical template.

  One source change to make the published `.d.ts` consumable. Annotated createMemberCollection return type as CollectionConfig (it was the lone factory without an explicit return type — the other 12 already had it). Without the annotation, tsup's dts rollup couldn't resolve some Payload internal subpath types referenced by the inferred wide return type and emitted literal import 'node_modules/payload/dist/...' paths in the d.ts that would 404 from a published consumer.

  This is the same pattern catalog/economy already follow; matches the discipline in feedback_payload_config_typed_for_callback_inference. Public API surface (collections, access helpers, hooks, factory, terminology, permissions) is otherwise unchanged.

  Why now: unblocks the agency-stack roadmap (@wabbit/tome-crm, @wabbit/tome-deals) — those layers depend on tome-org and consumer registry consumption requires tome-org to be on Verdaccio. Same template that catalog and economy got on 2026-04-27.

0.1.x