An admin's change to the catalog, a discount or a tax rate is a row that names who made it #53

Changes requested: a change that lands can be missing its row.

diff compares values that say has already clipped to 120 characters, so an edit past the cap is invisible to the trail. Running it against this head: create a product with a 300-character description, then edit only its tail and move its category — the category row is written, the description row is not.

ROWS: ["title:  -> <script>…", "slug:  -> probe-thing", "category:  -> Gifts", "blurb:  -> b",
       "description:  -> aaaaaaaaaaaaaaaaaaaa", "active:  -> yes", "category: Gifts -> Coffee"]

The form takes 2,000 characters of description and 200 of blurb, and a tax label is 60, so this is the normal case for the longest fields on the page, not a corner. src/changes.ts says in its own header that "a change that lands cannot be missing one", and here it can — silently, no message and no row.

Fix this first, in src/changes.ts: compare whole, clip only on the way in. Split the two jobs say is doing —

const flat = (value: Value): string =>
  value === null || value === undefined ? "" :
  typeof value === "boolean" ? (value ? "yes" : "no") :
  String(value).replace(/\s+/g, " ").trim();
export const say = (value: Value): string => clip(flat(value));

— and have diff decide on flat(before[name]) !== flat(value) while still storing say(...). record clips again on write, so the row stays short and the comparison stops lying. The test that would have caught it: edit the tail of a description longer than CAP and expect exactly one description row.

Two smaller things, neither blocking:

1. tax_default has no arm in READING's CASE and a subject_id of 0, so the default rate reads as tax_default #0 on the page and in the terminal. nameOf could name it — "anywhere else" is what /admin/tax and the tty tab already call it.
2. In src/desk.ts the paragraph about a change at the desk leaving the same row is attached to percent, a formatter that has nothing to do with it. Move it onto TABS or onto the first recording call, or it reads as documenting the wrong thing.

The rest holds up, and I checked rather than assumed:

• Identity. The actor is ctx.who on the web and atKeyboard() at the desk, never a form field, never a client-written header; actorOf refuses to name an anonymous. Every new call site is behind the existing guard, every insert is parameterised, every value on the page goes through escape — a product titled <script>alert(1)</script> comes back as entities. Nothing spendable is a subject, and the gift-card exclusion is argued in the code rather than left implicit.
• Atomicity. Each write and its rows share one db.transaction, including the create paths whose unique-slug and unique-sku catches used to swallow a half-write; a rollback takes the audit row with it, and a no-op form writes nothing.
• Both doors. changes is read: "admin" in the one DESK table both gates read, so the existing visible(shopper) assertion still pins the tab list to ["stock", "tax"] and the tab is marked closed rather than drawn. The five desk writes record the same rows the pages do, and the README documents 7 and /admin/changes.
• Preview. /admin/changes is 403 for anyone the forge did not sign as an admin, with the security floor intact on the refusal; the page renders in 1.7 ms locally behind the new (at DESC, id DESC) index. bun test at this head: 92 pass, 0 fail.
• Scope. One new module named for one concept, no dependency added; tax.rateAt and upsertRate's returned id are the minimum needed to say what a rate was before.

(Anchored on the comparison itself: line 71 is where the clipped values are compared.)

probe

Changes requested — the verdict for my full review on src/changes.ts:71 above, which two stray API probes of mine displaced. Nothing new here; read that one.

In short: diff compares values say has already clipped to 120 characters, so an admin's edit to a description, blurb or label past the cap writes no row at all — the ledger silently misses a change that landed. Fix it by comparing the whole normalized value and clipping only on the way into record, with a test that edits the tail of a description longer than CAP and expects one description row. Everything else — the actor from ctx.who and atKeyboard(), the transactions, the admin gate on both doors, the escaping, 92 green tests, the 403 in the preview — holds up.