diff --git a/CHANGELOG.md b/CHANGELOG.md
index 321230c..c41f008 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,6 +46,24 @@ First release candidate of `qqq` 1.0: the command-line client and the full-scree
   validation review, widgets, downloads), with back steps, record limits, progress with elapsed time and
   cancel.
 - **Developer mode** (`D`): a record's associated scripts, revisions and logs; a table's APIs.
+- **Bulk load and bulk changes**: a wizard for bulk insert and bulk edit from a file (upload through the
+  file navigator, a column mapping grid with typed defaults and field help, value mapping, review with
+  optional validation, result), bulk edit of switched-on fields, bulk delete, saved bulk-load profiles and
+  the upload template.
+- **Reports and saved reports**: run reports (process reports and streaming ones), and edit a saved
+  report's filter, columns and pivot, including through an application API.
+- **Sharing** (`Z`, `:share`): share records of shareable tables (saved reports, saved views) with users
+  or groups.
+- **Sign-in in the UI**: TABLE_BASED username and password, OAuth2 in the browser (authorization code with
+  PKCE, the device flow as the alternative) and Auth0; sign-out ends the server or provider session; a
+  session that expires mid-use opens sign-in on top and returns to the screen.
+- **Widgets that act**: dropdowns and date pickers, parent widgets with children in a grid or tabs,
+  process widgets, data bag versions, script revisions, export, ad hoc buttons and inputs, dynamicForm
+  editing and composite widgets; disabled tables, processes and apps explain the denial, and
+  capabilities gate new, edit, delete and copy.
+- **Help**: F1 shows the application's help for the app, widget, table, process or step you are on, and
+  the grid footer shows the column's help. Large tables stay quick: on a 10,000 x 40 table the first page
+  draws in about 100 ms.
 - **Dashboards and widgets** in block characters: stats, bar charts, sparklines, percentage bars, tables
   and steppers.
 - **Terminal care**: `qqq ui --check` (and a quick check at startup) finds tmux key and colour problems and
@@ -81,6 +99,26 @@ First release candidate of `qqq` 1.0: the command-line client and the full-scree
 - **Developer mode**: `table apis`, `table api-doc`, `table developer`, and `script list | show | store |
   logs` for associated scripts.
 - **Tags**: `collab tags list | add | remove | create`, by id or label.
+- **Home, find and dashboards**: `qqq home` (the landing page: counts, quick actions, recent records),
+  `qqq find` (the command palette: an app, table, process or report by label), `apps show --widgets`, and
+  `widget get --record` / `--run`, with widgets rendered as the web renders them (statistics, maps,
+  pivots, forms, composite blocks, empty states).
+- **Reports**: `report run` (through the report's process or the report route, with its input fields),
+  and `saved-report list | show | preview | run | set | pivot | schedules | schedule` (filter, sort and
+  columns, pivots, schedules).
+- **Sharing**: `qqq share` for any record of a shareable table (saved reports, saved views).
+- **TABLE_BASED sign-in**: `qqq login --username` (password asked, or `QQQ_PASSWORD`) keeps only the
+  server session; a refused password stores nothing.
+- **Record, query and process details**: `table columns` (the query columns per table, shared with the
+  UI), `table api-call` (the API playground), `script test`, `table widget-form` (a dynamicForm on a record
+  form), `table get --copy`, `table update -e` (edit HTML and code fields in `$EDITOR`), labels accepted
+  for possible-value fields in `--where`, the chosen table variant remembered per server, and CHIP values
+  in their colours.
+- **Text filters ask for case-insensitive matching** (`CONTAINS`, `STARTS_WITH`, `ENDS_WITH` and the quick
+  search); `~=`, `OPERATOR:CS` or `--case-sensitive` ask for a case-sensitive match. The server does not
+  read the option over the UI API yet (finding 27), so matching stays case-sensitive until it does.
+- **Disabled tables and processes** are listed with the reason, and queries, writes, copies, bulk commands
+  and runs on them are refused before any request, as the web explains the denial.
 - **Bulk load and bulk changes**: `table bulk-insert` from a CSV or Excel file (the upload template,
   the server's column suggestion, a mapping document, flags or `-i`, value mapping, the validation
   review, `--dry-run`), `table bulk-edit` of chosen records or by key rows from a file (only the fields
@@ -123,14 +161,15 @@ First release candidate of `qqq` 1.0: the command-line client and the full-scree
 
 ### Known limitations
 
-- Jobs need a durable-jobs server; TABLE_BASED sign-in is refused (no documented native recipe). See
-  `docs/server-findings.md`.
+- Jobs need a durable-jobs server. Auth0 sign-in (CLI and UI) is built but has not met a real Auth0
+  tenant (finding 28). See `docs/server-findings.md` for the server-side issues the clients work around.
 - The binaries are not Developer ID signed or notarized (macOS: Gatekeeper prompt for browser downloads,
   `xattr -d com.apple.quarantine` clears it) nor Authenticode signed (Windows: SmartScreen warning). The
   Windows and macOS x64 binaries are cross-compiled and were not run before this candidate.
 - The npm package is the CLI only; `qqq ui` comes with the binaries.
-- Parity with the web UI is not complete in either the CLI or the TUI (`docs/parity/feature-matrix.md`;
-  `npm run release -- --check` lists what is open). 1.0.0 final waits for it.
+- Parity with the web UI (`docs/parity/feature-matrix.md`): the CLI has no open row (290 pass, 107 n/a,
+  4 blocked on cited server findings); the UI has one (SEC-030, Auth0 against a real tenant).
+  `npm run release -- --check` lists what is open; 1.0.0 final waits for none.
 
 ## [0.1.0]
 
diff --git a/README.md b/README.md
index 06a801c..d19e554 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,8 @@ $ qqq table query person -w "lastName STARTS_WITH S" -o -id -l 5
 
 - **OAuth2 and Auth0** servers use the device flow; `--browser` uses the authorization code with PKCE on
   a loopback redirect. Tokens are refreshed before they expire; `qqq logout --provider-logout` also
-  revokes them at the provider. **MOCK** and fully anonymous servers get a server session.
+  revokes them at the provider. **TABLE_BASED** servers: `qqq login --username <user>` (password asked, or
+  `QQQ_PASSWORD`). **MOCK** and fully anonymous servers get a server session.
 - **Profiles** name servers, as `aws --profile`: `qqq --profile prod …`, `QQQ_PROFILE`, `qqq config profile
   list|use|remove`. The first sign-in becomes the default.
 - **Sign-ins** live in the OS keyring: macOS Keychain, Secret Service on Linux, DPAPI on Windows, or a
@@ -77,10 +78,10 @@ $ qqq table query person -w "lastName STARTS_WITH S" -o -id -l 5
 
 | Noun | Verbs |
 |---|---|
-| `table` | `list`, `describe`, `query`, `count`, `stats`, `get`, `create`, `copy`, `update`, `delete`, `export`, `children`, `download`, `variants`, `actions`, `bulk-insert`, `bulk-edit`, `bulk-delete` |
+| `table` | `list`, `describe`, `query`, `count`, `stats`, `get`, `create`, `copy`, `update`, `delete`, `export`, `children`, `download`, `variants`, `columns`, `actions`, `bulk-insert`, `bulk-edit`, `bulk-delete`, `apis`, `api-doc`, `api-call`, `developer`, `widget-form` |
 | `process` | `list`, `describe`, `run` (every step screen, async jobs with progress, Ctrl-C cancels on the server) |
-| `apps`, `search`, `tail`, `whoami` | app homes, global search, the live event stream |
-| `saved-view`, `bulk-profile`, `audit`, `report`, `widget`, `job`, `prefs`, `help-search` | saved views, saved bulk-load mappings, audit history, reports, dashboard widgets as text, jobs, preferences, help |
+| `home`, `find`, `apps`, `search`, `tail`, `whoami` | the landing page, the command palette, app homes (`--widgets`), global search, the live event stream |
+| `report`, `saved-report`, `saved-view`, `share`, `bulk-profile`, `audit`, `widget`, `script`, `job`, `prefs`, `help-search` | reports and saved reports (pivots, schedules), saved views, sharing, saved bulk-load mappings, audit history, dashboard widgets as text, associated scripts, jobs, preferences, help |
 | `api <operationId>` | any of the 202 UI API operations by id: the escape hatch |
 | `extensions`, and one noun per extension | `esb`, `collab`, `health`, `alerts`, `assistant`, `sql-workbench`, … gated on what the server has installed |
 | `login`, `logout`, `config`, `cache`, `completion`, `doctor` | sign-in, profiles and settings, the metadata cache, shell completion (bash, zsh, fish, PowerShell) |
@@ -95,6 +96,9 @@ qqq api getTableMetaData --path tableName=person -Q 'fields.*.label'
 eval "$(qqq completion zsh)"
 ```
 
+Text filters (`~`, `STARTS_WITH`, `ENDS_WITH`, quick search) ask the server for case-insensitive matching;
+`~=` or `--case-sensitive` for an exact-case match. Possible-value fields take labels in filters too.
+
 Output is a table on a terminal and JSON in a pipe; `-O json|table|text|csv|yaml` (or `QQQ_OUTPUT`)
 chooses, and `-Q` reshapes it with JMESPath. Values are labels and display values from the server;
 DATE_TIME values are shown in your zone (`--utc` for raw). Exit codes: 0 ok, 1 error, 2 usage or bad