@drawnagency/primitives 0.1.109 → 0.1.110

package/src/components/shell/SiteSettingsViewerAccess.tsx

@@ -13,12 +13,6 @@ interface Props {
   onAudiencesChange: (audiences: Audience[]) => void;
 }
 
-/** 32 random hex chars — long enough that it can never be guessed or typed. */
-function unusablePassword(): string {
-  const bytes = crypto.getRandomValues(new Uint8Array(16));
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-
 export function SiteSettingsViewerAccess({ audienceManagement, passwordToggle, onAudiencesChange }: Props) {
   const [audiences, setAudiences] = useState<Audience[]>([]);
   // Null until we know: undefined-vs-empty matters, because an empty ARRAY means
@@ -29,6 +23,7 @@ export function SiteSettingsViewerAccess({ audienceManagement, passwordToggle, o
   const [loading, setLoading] = useState(true);
   const [showAddForm, setShowAddForm] = useState(false);
   const [toggleError, setToggleError] = useState<string | null>(null);
+  const [loadError, setLoadError] = useState<string | null>(null);
 
   const loadAudiences = useCallback(async () => {
     try {
@@ -36,13 +31,23 @@ export function SiteSettingsViewerAccess({ audienceManagement, passwordToggle, o
         fetch("/api/auth/audiences"),
         fetch("/api/auth/credentials"),
       ]);
+      // A 4xx/5xx body that happens to parse as JSON used to yield `[]`, which
+      // was pushed up through onAudiencesChange — emptying every section's
+      // audience picker and making filterAccessToKnown strip the configured
+      // default access from every newly-added section. An unreadable response
+      // must leave the known audiences alone, not assert there are none.
+      if (!audienceRes.ok) throw new Error(`audiences ${audienceRes.status}`);
       const data = await audienceRes.json();
-      const list = data.audiences ?? [];
+      if (!Array.isArray(data?.audiences)) throw new Error("malformed audiences response");
+      const list = data.audiences as Audience[];
       setAudiences(list);
       onAudiencesChange(list);
       setPasswordEnabled(data.passwordEnabled ?? true);
       // 501 = no credential support (`.env` mode) — stay in audience-password UI.
       setCredentials(credentialRes.ok ? (await credentialRes.json()).credentials ?? [] : null);
+    } catch (err) {
+      console.error("[SiteSettingsViewerAccess] Failed to load audiences:", err);
+      setLoadError("Couldn't load viewer access — reload to try again.");
     } finally {
       setLoading(false);
     }
@@ -73,16 +78,11 @@ export function SiteSettingsViewerAccess({ audienceManagement, passwordToggle, o
     }
   }
 
-  async function handleAdd(data: { displayName: string; color: string | null; password: string }) {
-    // In credential mode the audience-level password is vestigial but the column
-    // is NOT NULL, so it gets an unguessable value nobody is ever told. Writing
-    // an empty one would leave the audience walk-in-able through the legacy
-    // dropdown login if this site were ever rolled back to an older deployment.
-    const password = data.password.length > 0 ? data.password : unusablePassword();
+  async function handleAdd(data: { displayName: string; color: string | null }) {
     const res = await fetch("/api/auth/audiences", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ ...data, password }),
+      body: JSON.stringify(data),
     });
     if (!res.ok) {
       const err = await res.json().catch(() => ({}));
@@ -94,7 +94,7 @@ export function SiteSettingsViewerAccess({ audienceManagement, passwordToggle, o
 
   async function handleSave(
     name: string,
-    patch: { displayName?: string; color?: string | null; password?: string },
+    patch: { displayName?: string; color?: string | null },
   ) {
     const res = await fetch("/api/auth/audiences", {
       method: "PATCH",
@@ -150,6 +150,12 @@ export function SiteSettingsViewerAccess({ audienceManagement, passwordToggle, o
     return <p className="text-sm text-base-contrast-light">Loading audiences...</p>;
   }
 
+  // Deliberately a hard stop rather than an empty list: rendering the normal UI
+  // here would show "no audiences" for a site that has them.
+  if (loadError) {
+    return <p className="text-sm text-red-600">{loadError}</p>;
+  }
+
   return (
     <div className="space-y-4">
       {!audienceManagement && (
@@ -209,7 +215,6 @@ export function SiteSettingsViewerAccess({ audienceManagement, passwordToggle, o
           <AudienceAddForm
             onSubmit={handleAdd}
             onCancel={() => setShowAddForm(false)}
-            requirePassword={credentials === null}
           />
         ) : (
           <Button variant="secondary" onClick={() => setShowAddForm(true)}>

package/src/components/shell/view-branch.ts

@@ -41,7 +41,10 @@ export function computeDisplaySections<T extends { section: { id: string }; meta
   }
 
   if (viewSections === null) return [];
+  // Indexed, not a `find` per id: this runs on every render of the published
+  // view, and a 200-section page against a 200-section fetch is 40k comparisons.
+  const byId = new Map(viewSections.map((s) => [s.section.id, s]));
   return activePageSectionIds
-    .map((id) => viewSections.find((s) => s.section.id === id))
+    .map((id) => byId.get(id))
     .filter((s): s is T => !!s && isSectionVisibleInViewBranch(s.meta.status, "live"));
 }

package/src/document/components/DocRail.tsx

@@ -42,8 +42,33 @@ function ThumbButton({
   onSelect: (id: string) => void;
   children: ReactNode;
 }) {
+  // Each thumbnail is a REAL page subtree — every image at print resolution,
+  // scaled to ~11%. Mounting all of them cost a 40-page document 40 subtrees and
+  // a fresh request for every image before the rail was even scrolled. The
+  // aspect-ratio box below holds its size whether or not the page is mounted, so
+  // deferring costs nothing in layout. Sticky once shown: re-unmounting would
+  // re-request the images on every scroll back.
+  const liRef = useRef<HTMLLIElement>(null);
+  const [shown, setShown] = useState(typeof IntersectionObserver === "undefined");
+  useEffect(() => {
+    if (shown) return;
+    const el = liRef.current;
+    if (!el) return;
+    const obs = new IntersectionObserver(
+      (entries) => {
+        if (entries.some((e) => e.isIntersecting)) {
+          setShown(true);
+          obs.disconnect();
+        }
+      },
+      { rootMargin: "200% 0px" },
+    );
+    obs.observe(el);
+    return () => obs.disconnect();
+  }, [shown]);
+
   return (
-    <li className={indentClass(indentLevel ?? 0)}>
+    <li ref={liRef} className={indentClass(indentLevel ?? 0)}>
       <button
         type="button"
         onClick={() => onSelect(id)}
@@ -56,7 +81,7 @@ function ThumbButton({
             className="block origin-top-left"
             style={{ transform: `scale(${scale})`, width: PAGE_W, height: PAGE_H }}
           >
-            {children}
+            {shown ? children : null}
           </span>
         </span>
         <span className="absolute bottom-0.5 left-1 max-w-[90%] truncate text-[10px] text-neutral-400">

package/src/document/components/DocViewer.tsx

@@ -130,6 +130,10 @@ export function DocViewer({
   const activeIdRef = useRef(activeId);
   activeIdRef.current = activeId;
   useEffect(() => {
+    // Present mode only. In the editor overlay the same keys belong to the
+    // surface the author is working in, and a window-level listener stole them
+    // to flip the previewed page instead.
+    if (mode !== "present") return;
     const onKey = (e: KeyboardEvent) => {
       const t = e.target as HTMLElement | null;
       if (t && (t.tagName === "INPUT" || t.tagName === "TEXTAREA" || t.tagName === "SELECT" || t.isContentEditable)) return;
@@ -145,7 +149,7 @@ export function DocViewer({
     };
     window.addEventListener("keydown", onKey);
     return () => window.removeEventListener("keydown", onKey);
-  }, [entries, selectEntry]);
+  }, [entries, selectEntry, mode]);
 
   const active = entries.find((e) => entryId(e) === activeId) ?? null;
 

package/src/document/components/measure.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useLayoutEffect, useState } from "react";
+import { useEffect, useLayoutEffect, useMemo, useState } from "react";
 import { DOC_GEOM } from "../engine/paginate";
 import type { SectionSettings } from "../engine/settings";
 import type { Chunk, TextBlock } from "../engine/types";
@@ -60,7 +60,10 @@ export function useTextMeasurements(
     };
   }, []);
 
-  const signature = signatureFor(chunks, settingsMap);
+  // Memoized: this walks every chunk's full prose HTML through JSON.stringify,
+  // and it ran on every DocViewer render. Both inputs are memoized upstream
+  // (useDocPages), so the identity check actually holds.
+  const signature = useMemo(() => signatureFor(chunks, settingsMap), [chunks, settingsMap]);
 
   useLayoutEffect(() => {
     if (!fontsReady) return;
@@ -68,6 +71,10 @@ export function useTextMeasurements(
     const next: Record<string, number[]> = {};
     const nextW: Record<string, number> = {};
 
+    // WRITE PASS. Every wrapper is appended before anything is read: interleaving
+    // the two forced a synchronous reflow per text block, so a 200-block document
+    // flushed layout ~400 times inside this one layout effect.
+    const pending: { chunkId: string; wrappers: HTMLDivElement[] }[] = [];
     for (const chunk of chunks) {
       if (chunk.textBlocks.length === 0) {
         next[chunk.id] = [];
@@ -80,8 +87,7 @@ export function useTextMeasurements(
       document.body.appendChild(container);
       containers.push(container);
 
-      const measured: number[] = [];
-      let wMax = 0;
+      const wrappers: HTMLDivElement[] = [];
       for (const block of chunk.textBlocks) {
         const wrapper = document.createElement("div");
         wrapper.className = blockClassName(block);
@@ -96,11 +102,21 @@ export function useTextMeasurements(
         wrapper.style.width = "max-content";
         wrapper.style.maxWidth = "100%";
         container.appendChild(wrapper);
+        wrappers.push(wrapper);
+      }
+      pending.push({ chunkId: chunk.id, wrappers });
+    }
+
+    // READ PASS. One layout for the whole document.
+    for (const { chunkId, wrappers } of pending) {
+      const measured: number[] = [];
+      let wMax = 0;
+      for (const wrapper of wrappers) {
         measured.push(wrapper.offsetHeight / PX_PER_IN);
         wMax = Math.max(wMax, wrapper.getBoundingClientRect().width / PX_PER_IN);
       }
-      next[chunk.id] = measured;
-      nextW[chunk.id] = wMax;
+      next[chunkId] = measured;
+      nextW[chunkId] = wMax;
     }
 
     setHeights(next);

package/src/document/components/useDocPages.ts

@@ -1,7 +1,7 @@
 import { useMemo } from "react";
 import { harvest } from "../engine/harvest";
 import { DOC_GEOM, paginateChunk, type DerivedPage } from "../engine/paginate";
-import { settingsFor, type SectionSettings } from "../engine/settings";
+import { settingsFor, settingsIssuesFor, type SectionSettings } from "../engine/settings";
 import type { Chunk, DocSourceContent, SplitAt } from "../engine/types";
 import { useTextMeasurements } from "./measure";
 
@@ -75,11 +75,21 @@ export function useDocPages(input: {
     for (const c of chunks) {
       const noContent = c.textBlocks.length === 0 && c.images.length === 0;
       const pageWarnings = pages.filter((p) => p.chunkId === c.id).flatMap((p) => p.warnings);
-      const warnings = noContent ? ["Section has no content", ...pageWarnings] : pageWarnings;
+      // A stored setting the schema no longer recognises is reset to its
+      // default. Silent, that reads as the document ignoring an explicit
+      // choice — most visibly `excluded`, whose default puts the section back
+      // in the output.
+      const rejected = settingsIssuesFor(sections, c.id);
+      const settingWarnings = rejected.length > 0
+        ? [`Unrecognised value reset to default: ${rejected.join(", ")}`]
+        : [];
+      const warnings = noContent
+        ? ["Section has no content", ...settingWarnings, ...pageWarnings]
+        : [...settingWarnings, ...pageWarnings];
       if (warnings.length > 0) map[c.id] = warnings;
     }
     return map;
-  }, [chunks, pages]);
+  }, [chunks, pages, sections]);
 
   return { chunks, pages, measuring, warningsByChunk };
 }

package/src/document/engine/blocks.ts

@@ -23,8 +23,22 @@ const DISALLOWED_TAGS = new Set([
 ]);
 const DISALLOWED_SELECTOR = Array.from(DISALLOWED_TAGS).join(",");
 
-// Attributes that can carry a URL and therefore need scheme scrutiny.
-const URL_ATTRS = new Set(["href", "src", "xlink:href", "formaction"]);
+// Attributes that can carry a URL and therefore need scheme scrutiny. `poster`
+// and `srcset` matter because <video>/<img>/<source> survive the scrub; the
+// rest belong to elements DISALLOWED_TAGS already removes, and are listed so a
+// future relaxation of that set doesn't quietly open a hole.
+const URL_ATTRS = new Set([
+  "href",
+  "src",
+  "srcset",
+  "poster",
+  "xlink:href",
+  "formaction",
+  "action",
+  "ping",
+  "data",
+  "background",
+]);
 
 function isDangerousUrl(attrName: string, rawValue: string): boolean {
   // Browsers strip ASCII tab/CR/LF anywhere in a URL (and ignore leading
@@ -36,6 +50,16 @@ function isDangerousUrl(attrName: string, rawValue: string): boolean {
   return false;
 }
 
+// srcset is a comma-separated candidate list, so a startsWith check over the
+// whole value misses "a.png 1x, javascript:alert(1) 2x". Scrutinize each
+// candidate's URL part instead.
+function hasDangerousUrl(attrName: string, rawValue: string): boolean {
+  if (attrName !== "srcset") return isDangerousUrl(attrName, rawValue);
+  return rawValue
+    .split(",")
+    .some((candidate) => isDangerousUrl("src", candidate.trim().split(/\s+/)[0] ?? ""));
+}
+
 // Defense-in-depth scrub applied at the dangerouslySetInnerHTML/innerHTML
 // boundary. Upstream portal content is sanitized at authoring time, but
 // /print runs in an authed headless browser, so this engine (kept
@@ -52,13 +76,18 @@ function scrubElement(root: Element): void {
         el.removeAttribute(attr.name);
         continue;
       }
-      if (URL_ATTRS.has(name) && isDangerousUrl(name, attr.value)) {
+      if (URL_ATTRS.has(name) && hasDangerousUrl(name, attr.value)) {
         el.removeAttribute(attr.name);
       }
     }
   }
 }
 
+// Elements that carry meaning with no text of their own. The keep test used to
+// name <img> alone, so a rule, a video, an inline SVG diagram or a <picture>
+// was silently dropped from the printed document.
+const VISIBLE_EMPTY_SELECTOR = "img, hr, video, svg, picture, canvas";
+
 // Split sanitized rich-text HTML into atomic top-level blocks. Pagination
 // never splits inside a block — a block that doesn't fit moves wholesale to
 // the next page (spec: "pagination by block measurement").
@@ -71,7 +100,7 @@ export function splitProseBlocks(html: string): string[] {
       const el = node as Element;
       if (DISALLOWED_TAGS.has(el.tagName.toLowerCase())) continue;
       scrubElement(el);
-      if ((el.textContent ?? "").trim() || el.matches("img") || el.querySelector("img")) {
+      if ((el.textContent ?? "").trim() || el.matches(VISIBLE_EMPTY_SELECTOR) || el.querySelector(VISIBLE_EMPTY_SELECTOR)) {
         blocks.push(el.outerHTML);
       }
     } else if (node.nodeType === Node.TEXT_NODE) {

package/src/document/engine/masonry.ts

@@ -24,8 +24,14 @@ export interface MasonryBox<T extends Sized = Sized> {
 
 // A "cover" photo is laid out in a SQUARE cell (effective aspect 1) and the
 // image crops to fill it; "contain" (default) uses the photo's natural aspect.
-const effectiveAspect = (im: Sized, fit: "cover" | "contain" | undefined) =>
-  fit === "cover" ? 1 : im.width / im.height;
+const effectiveAspect = (im: Sized, fit: "cover" | "contain" | undefined) => {
+  if (fit === "cover") return 1;
+  const aspect = im.width / im.height;
+  // A 0-height item (a legacy manifest row from before the decode guard) made
+  // this Infinity or NaN, and every downstream width went with it — the whole
+  // page laid out blank. Square is the same fallback the cover path uses.
+  return Number.isFinite(aspect) && aspect > 0 ? aspect : 1;
+};
 
 function layoutRows<T extends Sized>(images: T[], o: MasonryOpts, fits: ("cover" | "contain")[]): { boxes: MasonryBox<T>[]; used: number; endY: number } {
   const asp = images.map((im, i) => effectiveAspect(im, fits[i]));

package/src/document/engine/paginate.ts

@@ -134,8 +134,11 @@ export function paginateChunk(
 
     // 1. Greedy text fill. Top text is capped at half the body so a text-heavy
     // section still leaves room for images below; leftColumn keeps full height.
+    // The cap only earns its keep while images are still waiting for room. Held
+    // on every page, it paginated a text-only section (or the text-only tail of
+    // one) at half utilisation and roughly doubled its page count.
     const capY =
-      settings.textPlacement === "top"
+      settings.textPlacement === "top" && ii < chunk.images.length
         ? geom.titleBandIn + (geom.bodyHIn - geom.titleBandIn) * geom.topTextMaxFraction
         : geom.bodyHIn;
     const placed: TextBlock[] = [];

package/src/document/engine/settings.ts

@@ -45,21 +45,58 @@ export type SectionSettings = z.infer<typeof sectionSettingsSchema>;
 
 const DEFAULTS: SectionSettings = sectionSettingsSchema.parse({});
 
+/**
+ * Field-by-field salvage. The whole-entry `safeParse` fallback was
+ * all-or-nothing: ONE unrecognised value discarded every sibling setting, and
+ * since the defaults have `excluded: false`, a section deliberately excluded
+ * from the printed document silently reappeared in the output. `splitAt` was
+ * lost the same way. An index written by a newer package version — or by an MCP
+ * agent — is the realistic source of such a value.
+ */
+function salvage(raw: unknown): { settings: SectionSettings; rejected: string[] } {
+  const fast = sectionSettingsSchema.safeParse(raw ?? {});
+  if (fast.success) return { settings: fast.data, rejected: [] };
+  // Not an object at all (stale scalar, null): nothing to salvage.
+  if (!raw || typeof raw !== "object") return { settings: DEFAULTS, rejected: [] };
+
+  const src = raw as Record<string, unknown>;
+  const out: Record<string, unknown> = {};
+  const rejected: string[] = [];
+  for (const [key, field] of Object.entries(sectionSettingsSchema.shape)) {
+    // Every field carries a .default(), so an absent key parses to its default.
+    const parsed = (field as z.ZodTypeAny).safeParse(src[key]);
+    if (parsed.success) {
+      out[key] = parsed.data;
+    } else {
+      rejected.push(key);
+      out[key] = DEFAULTS[key as keyof SectionSettings];
+    }
+  }
+  return { settings: out as SectionSettings, rejected };
+}
+
 // Overlay lookup: unknown/stale/malformed entries fall back to defaults —
 // settings for a deleted portal section must be inert, never fatal.
 export function settingsFor(
   all: Record<string, unknown> | undefined,
   chunkId: string,
 ): SectionSettings {
-  const raw = all?.[chunkId];
-  const parsed = sectionSettingsSchema.safeParse(raw ?? {});
-  const s = parsed.success ? parsed.data : DEFAULTS;
+  const s = salvage(all?.[chunkId]).settings;
   if (s.textPlacement === "top" && s.imagePlacement === "right") {
     return { ...s, imagePlacement: "fullWidth" };
   }
   return s;
 }
 
+/** Setting names for `chunkId` that failed to parse and were reset to their
+ *  default. Surfaced as document warnings so a silent reset is visible. */
+export function settingsIssuesFor(
+  all: Record<string, unknown> | undefined,
+  chunkId: string,
+): string[] {
+  return salvage(all?.[chunkId]).rejected;
+}
+
 const documentMetaSchema = z.object({
   client: z.string().default(""),
   project: z.string().default(""),

package/src/hooks/useBuildStatus.ts

@@ -141,6 +141,12 @@ export function useBuildStatus(): BuildStatusResult {
   // Initial fetch on mount
   useEffect(() => {
     let cancelled = false;
+    // Re-arm on every mount. The cleanup below sets this false and nothing ever
+    // set it back, so under StrictMode's dev mount->unmount->remount every
+    // mountedRef guard stayed closed for the whole session and the publish
+    // indicator never left its initial state — and the same happened on any
+    // real remount in production.
+    mountedRef.current = true;
 
     async function check() {
       const data = await fetchStatus();

package/src/hooks/useDocumentUploads.ts

@@ -61,6 +61,15 @@ export function useDocumentUploads({
   const manifestRef = useRef<DocumentManifest>(documentManifest);
   useEffect(() => { manifestRef.current = documentManifest; }, [documentManifest]);
 
+  /** Git-tier ids claimed by an in-flight uploadDocument. `pendingRef` only
+   *  catches a duplicate once React has re-rendered and the sync effect has
+   *  run, so two rapid drops of the same file both cleared the dedup check
+   *  below and staged duplicate rows. Updated eagerly, like undeleteDocument's
+   *  ref in useMediaPipeline. Bucket-tier ids are server-minted after the
+   *  upload, so they cannot be reserved — that re-pick case stays accepted
+   *  (documented at the dedup check). */
+  const reservedIdsRef = useRef<Set<string>>(new Set());
+
   /** Restore documents staged in a previous session (Dexie survives reload). */
   const hydratePendingDocuments = useCallback(async () => {
     // Never throws: it runs from a mount effect, before/independently of the
@@ -105,6 +114,9 @@ export function useDocumentUploads({
         onUploadError?.(`"${filename}" couldn't be stored locally — try again.`);
         return false;
       }
+      // Eager, so the dedup check sees it the moment staging lands rather than
+      // one render later (the reservation above is released immediately after).
+      pendingRef.current = [...pendingRef.current, { id, entry }];
       setPendingDocuments((prev) => [...prev, { id, entry }]);
       setPendingDocumentUrls((prev) => ({ ...prev, [id]: localUrl }));
       setLocalChangesExist(true);
@@ -135,7 +147,11 @@ export function useDocumentUploads({
       // bucket-tier ids are server-minted, so re-picking a large file stages a
       // second entry. Accepted: the manifest is correct either way, and the
       // publish-time docs GC collects whichever object stops being referenced.
-      if (manifestRef.current[hash] || pendingRef.current.some((d) => d.id === hash)) {
+      if (
+        manifestRef.current[hash] ||
+        pendingRef.current.some((d) => d.id === hash) ||
+        reservedIdsRef.current.has(hash)
+      ) {
         // A committed document deleted but not yet saved is only DOOMED, never
         // gone: its bytes and its manifest entry are still on the branch, and
         // deletion deliberately leaves documentManifest alone. So re-adding one
@@ -158,7 +174,14 @@ export function useDocumentUploads({
           path: documentGitPath(file.name, hash, plan.ext),
         };
         const localUrl = URL.createObjectURL(file);
-        if (await stage(hash, entry, file, localUrl, file.name)) onComplete?.(hash);
+        // Claim the id across the staging await; released either way, so a
+        // failed stage leaves the file re-addable.
+        reservedIdsRef.current.add(hash);
+        try {
+          if (await stage(hash, entry, file, localUrl, file.name)) onComplete?.(hash);
+        } finally {
+          reservedIdsRef.current.delete(hash);
+        }
         return;
       }
 
@@ -317,6 +340,25 @@ export function useDocumentUploads({
     }
   }, []);
 
+  /** Discard-path counterpart to `unstageDocuments`: drops every staged document
+   *  and releases its blob URL. Reads `pendingRef` rather than state so a
+   *  memoized caller (handleDiscard) can't act on a stale snapshot. */
+  const unstageAllDocuments = useCallback(async () => {
+    const ids = pendingRef.current.map((d) => d.id);
+    pendingRef.current = [];
+    setPendingDocuments([]);
+    setPendingDocumentUrls((prev) => {
+      for (const url of Object.values(prev)) URL.revokeObjectURL(url);
+      return {};
+    });
+    if (ids.length === 0) return;
+    try {
+      await clearPendingDocumentsByIds(ids);
+    } catch (err) {
+      console.error("[useDocumentUploads] Failed to clear staged documents:", err);
+    }
+  }, []);
+
   // Memoized: useMediaPipeline lists this object in handleMediaUpload's and
   // enqueueFile's dependency arrays, and those two callbacks sit in
   // contextValue's deps — a fresh literal every render would defeat all three
@@ -329,8 +371,9 @@ export function useDocumentUploads({
       uploadDocument,
       publishDocuments,
       unstageDocuments,
+      unstageAllDocuments,
       hydratePendingDocuments,
     }),
-    [pendingDocuments, pendingDocumentUrls, documentUploadProgress, uploadDocument, publishDocuments, unstageDocuments, hydratePendingDocuments],
+    [pendingDocuments, pendingDocumentUrls, documentUploadProgress, uploadDocument, publishDocuments, unstageDocuments, unstageAllDocuments, hydratePendingDocuments],
   );
 }

package/src/hooks/useEditorPersistence.ts

@@ -1,4 +1,4 @@
-import { useCallback, useRef, useEffect } from "react";
+import { useCallback, useMemo, useRef, useEffect } from "react";
 import type { SectionContent } from "../schemas/sections";
 import type { SiteIndex, SiteConfig } from "../schemas/site-config";
 import { persistAll, persistSiteConfig, deleteSectionRows } from "../lib/dexie";
@@ -236,22 +236,36 @@ export function useEditorPersistence(
     [],
   );
 
-  return {
-    markSectionDirty,
-    markIndexDirty,
-    removeSection,
-    dropPendingSection,
-    hasPendingSection,
-    persistConfig,
-    flushNow: flushToDexie,
-    cancelPendingFlush,
-    isConfigDirty,
-    clearConfigDirty,
-    isIndexDirty,
-    hasUnsavedIndex,
-    clearUnsavedIndex,
-    noteUnsavedIndex,
-    currentGeneration,
-    sectionDirtiedAfter,
-  };
+  // Memoized, and every member above is already identity-stable, so this object
+  // is too. A fresh literal per render changed `persistence`'s identity on every
+  // EditorShell render — which churned onBlockMove, getEditIntent,
+  // onSectionChange, onAddSection, performDeleteSection, onReorderSections and
+  // all twelve page/nav handlers, and made EditorContent tear down and
+  // re-register its atlaskit drag monitors on every keystroke.
+  return useMemo(
+    () => ({
+      markSectionDirty,
+      markIndexDirty,
+      removeSection,
+      dropPendingSection,
+      hasPendingSection,
+      persistConfig,
+      flushNow: flushToDexie,
+      cancelPendingFlush,
+      isConfigDirty,
+      clearConfigDirty,
+      isIndexDirty,
+      hasUnsavedIndex,
+      clearUnsavedIndex,
+      noteUnsavedIndex,
+      currentGeneration,
+      sectionDirtiedAfter,
+    }),
+    [
+      markSectionDirty, markIndexDirty, removeSection, dropPendingSection, hasPendingSection,
+      persistConfig, flushToDexie, cancelPendingFlush, isConfigDirty, clearConfigDirty,
+      isIndexDirty, hasUnsavedIndex, clearUnsavedIndex, noteUnsavedIndex, currentGeneration,
+      sectionDirtiedAfter,
+    ],
+  );
 }