@elytracms/studio 0.0.100 → 0.0.102

package/convex/analytics-cost.test.ts

@@ -485,7 +485,7 @@ function pick<T>(random: () => number, weighted: readonly (readonly [T, number])
 }
 
 const SLUGS = [
-  'sommerfest-im-garten-der-konditorei',
+  'sommerfest-im-garten-der-stadthalle',
   'unsere-torten-fuer-hochzeiten',
   'ueber-uns',
   'kontakt-und-anfahrt',

package/convex/asset-meta-patch.test.ts

@@ -4,7 +4,7 @@ import { convexTest } from 'convex-test'
 import type { ConvexHttpClient } from 'convex/browser'
 import type { FunctionReference } from 'convex/server'
 import { defaultAssetCollection, measureMaxDepth } from '@elytracms/core/cms-core'
-import { InMemoryBlobStorage, InMemoryPersistenceAdapter, PersistenceValidationError, assetAlt } from '@elytracms/core/persistence'
+import { InMemoryBlobStorage, InMemoryPersistenceAdapter, PersistenceValidationError } from '@elytracms/core/persistence'
 import type { AssetRepository } from '@elytracms/core/persistence'
 import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
 import { runUpload } from '../src/lib/assets/upload'
@@ -29,8 +29,7 @@ afterEach(() => {
  * EC-634 — an asset's `meta` is written per key, inside the mutation, on BOTH adapters:
  * two sessions (two adapters over ONE backend — two studio tabs on one deployment) whose
  * dialog saves interleave keep both keys; a dialog save landing while a file replace is in
- * flight survives the replace; a not-yet-migrated legacy `alt` column is lifted into the
- * stored bag by the same transaction. convex-test serialises mutations, so this proves the
+ * flight survives the replace. convex-test serialises mutations, so this proves the
  * per-key MERGE in `assets:upsert`, not Convex's OCC retry (which re-runs the same handler
  * against the newer row — the merge is what makes that retry correct).
  */
@@ -42,7 +41,6 @@ const modules = {
 
 const PROJECT_ID = 'asset-meta-patch'
 const SESSION_USER_ID = 'user_admin'
-const STAMP = '2026-10-27T00:00:00.000Z'
 
 async function convexBackend() {
   const t = convexTest(schema, modules)
@@ -161,31 +159,13 @@ describe('EC-634 — asset meta is patched per key in the write, on both adapter
     expect(convex).toMatchObject({ alt: 'A harbour at dusk & boats', note: 'B note' })
   })
 
-  it('a patch lifts a not-yet-migrated legacy alt column into the stored bag, in the same mutation', async () => {
+  it('EC-708: a write naming alt is refused before the wire — the mutation declares no alt argument', async () => {
     const { t, a } = await convexBackend()
-    await t.run(async (ctx) => {
-      await ctx.db.insert('assets', {
-        assetId: 'legacy',
-        filename: 'l.jpg',
-        contentType: 'image/jpeg',
-        byteSize: 1,
-        storageKey: 'k_legacy',
-        alt: 'Column alt',
-        createdAt: STAMP,
-        updatedAt: STAMP,
-      })
-    })
-    // An edit of ANOTHER key: the alt it did not name moves home and is kept.
-    const kept = await a.upsertAsset(PROJECT_ID, { id: 'legacy', metaPatch: { credit: 'Ada' } })
-    expect(kept.meta).toEqual({ alt: 'Column alt', credit: 'Ada' })
-    expect(kept.alt).toBeUndefined()
-    expect(assetAlt(kept, null)).toBe('Column alt')
-    // A clear of the alt stays cleared — no column left to re-surface it (ASSETS D21).
-    const cleared = await a.upsertAsset(PROJECT_ID, { id: 'legacy', metaPatch: { alt: null } })
-    expect(assetAlt(cleared, null)).toBeNull()
-    const row = await t.run((ctx) => ctx.db.query('assets').filter((q) => q.eq(q.field('assetId'), 'legacy')).first())
-    expect(row?.alt).toBeUndefined()
+    await seed(a, { credit: 'Ada' })
+    await expect(a.upsertAsset(PROJECT_ID, { id: 'hero', alt: 'Column alt' } as never)).rejects.toThrow(/meta\.alt/)
+    const row = await t.run((ctx) => ctx.db.query('assets').filter((q) => q.eq(q.field('assetId'), 'hero')).first())
     expect(row?.meta).toEqual({ credit: 'Ada' })
+    expect(row && 'alt' in row).toBe(false)
   })
 
   it('EC-632 — per-locale buckets are stored by the real mutation, and the stored row measures its depth', async () => {

package/convex/assets.ts

@@ -1,9 +1,9 @@
 import { ConvexError, v } from 'convex/values'
 import type { GenericId, Validator } from 'convex/values'
 import type { DocumentByName, WithoutSystemFields } from 'convex/server'
-import { liftLegacyAlt as legacyAltLift, rejectedWriteMessage, resolveAssetWrite } from '@elytracms/core/persistence'
+import { rejectedWriteMessage, resolveAssetWrite } from '@elytracms/core/persistence'
 import type { DataModel } from './functions'
-import { internalMutation, mutation, query } from './functions'
+import { mutation, query } from './functions'
 import { requireCapability } from './guard'
 import { ingestBindingHolds } from './ingest'
 
@@ -26,9 +26,10 @@ const clearable = <T, F extends string>(validator: Validator<T, 'required', F>)
 /**
  * Write one asset (EC-577). The ONE write rule (`resolveAssetWrite`, shared with
  * the in-memory adapter) runs here, inside the transaction: a column absent from
- * the args keeps its stored value, `null` clears it, a value sets it — the legacy
- * `alt` column can only be cleared (EC-587: an asset's alt is `meta.alt`), and a
- * `metaPatch` changes `meta` per key against the row read here (EC-634). An edit is
+ * the args keeps its stored value, `null` clears it, a value sets it — there is no `alt`
+ * argument (EC-708: an asset's alt is `meta.alt`; the adapter refuses an `alt` write
+ * before the wire), and a `metaPatch` changes `meta` per key against the row read here
+ * (EC-634). An edit is
  * ONE `db.patch` — the rule's store patch, where a cleared column is `undefined`,
  * which `db.patch` removes — so the write-chokepoint triggers fire once. No stored
  * asset → ONE `db.insert` of the complete row (the `defaults` fill what the write
@@ -44,13 +45,6 @@ export const upsert = mutation({
     storageKey: v.optional(v.string()),
     width: clearable(v.number()),
     height: clearable(v.number()),
-    /**
-     * LEGACY column (EC-587): accepted on the wire only so a write that still sets it
-     * is refused BY THE RULE with a message naming `meta.alt` (not a bare validator
-     * error); `null` clears it. Dropped with the column once `liftLegacyAlt` ran on
-     * every deployment.
-     */
-    alt: clearable(v.string()),
     title: clearable(v.string()),
     url: clearable(v.string()),
     focalPoint: clearable(v.object({ x: v.number(), y: v.number() })),
@@ -124,35 +118,6 @@ export const upsert = mutation({
   },
 })
 
-/**
- * EC-587 — the one-shot migration of the legacy `alt` column: every asset row holding
- * it gets the value lifted into `meta.alt` (unless `meta` already carries an `alt`
- * key, which wins — it is what every reader already reads) and the column unset, by
- * the ONE pure rule (core `liftLegacyAlt`, shared with the in-memory runner
- * `liftLegacyAssetAlts`). Idempotent: a second run lifts nothing.
- *
- * Internal: run by an admin from the CLI, never by a client —
- * `npx convex run assets:liftLegacyAlt` (no args). Each lifted row is one `db.patch`
- * through the write-chokepoint triggers, so it schedules the asset's revalidation like
- * any asset edit (the delivered alt is unchanged by the lift; the sweep is harmless).
- * One transaction: Convex bounds it at 8192 written rows, far above any v1 library —
- * documented, not paginated (as `cms:clearDocuments`).
- */
-export const liftLegacyAlt = internalMutation({
-  args: {},
-  handler: async (ctx) => {
-    const rows = await ctx.db.query('assets').collect()
-    const lifted: string[] = []
-    for (const row of rows) {
-      const patch = legacyAltLift(row)
-      if (!patch) continue
-      await ctx.db.patch(row._id, patch as Partial<AssetDoc>)
-      lifted.push(row.assetId)
-    }
-    return { scanned: rows.length, lifted }
-  },
-})
-
 export const get = query({
   args: { assetId: v.string() },
   handler: async (ctx, args) => {

package/convex/cms.ts

@@ -12,9 +12,9 @@ import {
   unfoldValue,
 } from '@elytracms/core/cms-core'
 import type { CmsDocument, DocumentPatch, PatchLogKind, ReplacePrecondition } from '@elytracms/core/cms-core'
-import { isPinnableVersion, planVersionKindStamps } from '@elytracms/core/persistence'
+import { isPinnableVersion } from '@elytracms/core/persistence'
 import type { DocumentVersionKind } from '@elytracms/core/persistence'
-import { internalMutation, mutation, query } from './functions'
+import { mutation, query } from './functions'
 import type { MutationCtx, QueryCtx } from './functions'
 import { requireCapability } from './guard'
 import { assertWithinWriteLimits } from './write-limits'
@@ -866,33 +866,6 @@ export const listAllDocumentVersions = query({
   },
 })
 
-/**
- * EC-707 — the EC-585 kind stamping: every version row recorded before EC-585 (no `kind`)
- * gets the kind `isPinnableVersion` already reads it as — `label: 'published'` → `'publish'`,
- * anything else → `'snapshot'` (core `planVersionKindStamps`, the same inference) — so
- * pinnability is unchanged for every row, and once every deployment reads 0 kind-less rows
- * the tolerant branch and the optional `kind` can go (EC-707's deletions). Idempotent: a
- * second run stamps 0; a row that names a kind is never touched; nothing but `kind` is written.
- *
- * Internal: an admin runs it from the CLI, once per deployment — `npx convex run
- * cms:stampVersionKinds` (no args) → `{ scanned, stamped }`; `pnpm demo:reseed` runs it twice.
- * ONE transaction at a documented bound (`VERSION_KIND_STAMP_BOUND`: 4096 rows / 4 MiB of
- * rewritten rows, half of Convex's per-transaction write limits): it reads every version row,
- * as `listAllDocumentVersions` already does for delivery, and above the bound it throws
- * before writing anything — a refusal is whole, never a partial stamping. `documentVersions`
- * has no write-chokepoint trigger, so the stamp schedules no revalidation (delivery reads the
- * same pins before and after).
- */
-export const stampVersionKinds = internalMutation({
-  args: {},
-  handler: async (ctx) => {
-    const rows = await ctx.db.query('documentVersions').collect()
-    const stamps = planVersionKindStamps(rows)
-    for (const { row, kind } of stamps) await ctx.db.patch(row._id, { kind })
-    return { scanned: rows.length, stamped: stamps.length }
-  },
-})
-
 /**
  * Pin an EXISTING version live (EC-224 `pinVersion`, changeset revert). Pin integrity is
  * enforced here, in the transaction: the version must exist for THIS document

package/convex/delivery.ts

@@ -181,8 +181,8 @@ export async function loadSnapshot(
 
   // Editorial redirects (EC-303): only ENABLED entries serve — a disabled redirect is
   // stored but never live, in either perspective. EC-616: read through the redirect
-  // kind's one server-side reader (records + the marked legacy tolerant read) and
-  // decided by the ONE live-redirect rule, `readLiveRedirects` (EC-590 / EC-627 — this
+  // kind's one server-side reader (the `records` store) and decided by the ONE
+  // live-redirect rule, `readLiveRedirects` (EC-590 / EC-627 — this
   // was the last hand-built copy on Convex). EC-628: a stored redirect the rule cannot
   // read (a non-boolean switch, a non-string `to`) is withheld AND reported — the host
   // carries `redirectIssues` into its source issues — instead of being served or dropped

package/convex/record-functions.ts

@@ -3,7 +3,6 @@ import type { GenericId } from 'convex/values'
 import type { RegisteredMutation, RegisteredQuery } from 'convex/server'
 import {
   PersistenceValidationError,
-  matchesRecordQuery,
   orderRecords,
   recordSlots,
   recordWireRow,
@@ -65,33 +64,6 @@ type RecordDoc = {
   updatedAt: string
 }
 
-/**
- * TOLERANT READ (marked; EC-616's redirect move, the EC-587 precedent): a kind whose rows
- * used to live in a table of their own declares where, so a deployment whose functions
- * moved but whose migration has not run yet serves exactly what it served before — no
- * gap. Reads union the legacy rows a record does not shadow; a save of a legacy-only id
- * lifts it (the record is created from the legacy columns, the legacy row deleted, one
- * transaction); a remove deletes both. Writes NEVER go to the legacy table. Removed with
- * the legacy table once its migration is reported run on every deployment (a gated item).
- */
-export interface LegacyRecordSource {
-  /** The legacy row for one id: its columns and stamps, and a handle to delete it. */
-  find(ctx: QueryCtx | MutationCtx, recordId: string): Promise<LegacyRecord | null>
-  /** Every legacy row (the tables are small editorial sets: read whole). */
-  list(ctx: QueryCtx | MutationCtx): Promise<LegacyRecord[]>
-  /** Delete one legacy row (after its record exists). */
-  remove(ctx: MutationCtx, record: LegacyRecord): Promise<void>
-}
-
-export interface LegacyRecord {
-  recordId: string
-  columns: RecordColumns
-  createdAt: string
-  updatedAt: string
-  /** The legacy row's own id, opaque to the factory. */
-  handle: unknown
-}
-
 /** A `PersistenceValidationError` from the shared rule, as the `ConvexError` the client maps back. */
 function asConvexValidation(error: unknown): unknown {
   if (!(error instanceof PersistenceValidationError)) return error
@@ -161,47 +133,26 @@ function indexedDoc(doc: RecordDoc): IndexedRecord & { doc: RecordDoc } {
 }
 
 /**
- * The wire rows of one kind for a query — the records, plus (while a legacy source is
- * declared) the legacy rows no record shadows, matched and ordered by the SAME pure
- * functions the in-memory store uses. The one list reader: the kind's `list` and any
- * server-side reader of the kind (the delivery snapshot) go through it.
+ * The wire rows of one kind for a query, matched and ordered by the store's query. The one
+ * list reader: the kind's `list` and any server-side reader of the kind (the delivery
+ * snapshot) go through it.
  */
 export async function listRecordWire(
   ctx: QueryCtx | MutationCtx,
   kind: AnyRecordKind,
   resolved: ResolvedRecordQuery,
-  legacy?: LegacyRecordSource,
 ): Promise<RecordWireRow[]> {
-  if (!legacy) return (await queryRecordDocs(ctx, kind, resolved)).map((doc) => recordDocWire(kind, doc))
-  // TOLERANT READ (marked): the union is read unbounded and ordered once, here.
-  const { limit: _limit, ...unbounded } = resolved
-  const docs = await queryRecordDocs(ctx, kind, { ...unbounded, order: 'asc' })
-  const shadowed = new Set(docs.map((doc) => doc.recordId))
-  const legacyRows = (await legacy.list(ctx))
-    .filter((row) => !shadowed.has(row.recordId))
-    .map((row) => ({
-      id: row.recordId,
-      slots: recordSlots(kind, row.columns, row.createdAt),
-      columns: row.columns,
-      wire: recordWireRow(kind, row.recordId, row.columns, row.createdAt, row.updatedAt),
-    }))
-    .filter((row) => matchesRecordQuery(row, resolved))
-  // Legacy rows predate every record, so they lead in insertion order.
-  const union = [...legacyRows, ...docs.map((doc) => ({ ...indexedDoc(doc), wire: recordDocWire(kind, doc) }))]
-  return orderRecords(kind, union, resolved).map((row) => row.wire)
+  return (await queryRecordDocs(ctx, kind, resolved)).map((doc) => recordDocWire(kind, doc))
 }
 
-/** One record's wire row by id — the record, else (while declared) its legacy row. */
+/** One record's wire row by id. */
 export async function getRecordWire(
   ctx: QueryCtx | MutationCtx,
   kind: AnyRecordKind,
   recordId: string,
-  legacy?: LegacyRecordSource,
 ): Promise<RecordWireRow | null> {
   const doc = await findRecordDoc(ctx, kind, recordId)
-  if (doc) return recordDocWire(kind, doc)
-  const old = legacy ? await legacy.find(ctx, recordId) : null // TOLERANT READ (marked)
-  return old ? recordWireRow(kind, old.recordId, old.columns, old.createdAt, old.updatedAt) : null
+  return doc ? recordDocWire(kind, doc) : null
 }
 
 /**
@@ -214,14 +165,10 @@ export async function saveRecord(
   recordId: string,
   write: Readonly<Record<string, unknown>>,
   stamps: { createdAt: string; updatedAt: string },
-  legacy?: LegacyRecordSource,
 ): Promise<RecordWireRow> {
   const existing = await findRecordDoc(ctx, kind, recordId)
-  // TOLERANT READ (marked): a legacy-only record is edited from its legacy columns.
-  const lifted = !existing && legacy ? await legacy.find(ctx, recordId) : null
-  const stored = existing?.data ?? lifted?.columns
-  const columns = rethrowAsConvex(() => resolveRecordSave(kind, recordId, stored, write))
-  const createdAt = existing?.createdAt ?? lifted?.createdAt ?? stamps.createdAt
+  const columns = rethrowAsConvex(() => resolveRecordSave(kind, recordId, existing?.data, write))
+  const createdAt = existing?.createdAt ?? stamps.createdAt
   const slots = recordSlots(kind, columns, createdAt)
   if (existing) {
     // `key1`/`key2` are always written: an edit that empties a key unsets its slot.
@@ -243,7 +190,6 @@ export async function saveRecord(
       createdAt,
       updatedAt: stamps.updatedAt,
     })
-    if (lifted && legacy) await legacy.remove(ctx, lifted)
   }
   return recordWireRow(kind, recordId, columns, createdAt, stamps.updatedAt)
 }
@@ -256,14 +202,8 @@ export interface RecordFunctions {
   remove: RegisteredMutation<'public', Record<string, unknown>, Promise<void>>
 }
 
-export interface RecordFunctionsOptions {
-  /** TOLERANT READ (marked) — see {@link LegacyRecordSource}. Only a kind that moved declares one. */
-  legacy?: LegacyRecordSource
-}
-
 /** The public CRUD functions of one record kind — see the module header. */
-export function defineRecordFunctions(kind: AnyRecordKind, options: RecordFunctionsOptions = {}): RecordFunctions {
-  const { legacy } = options
+export function defineRecordFunctions(kind: AnyRecordKind): RecordFunctions {
   const idArg = { [kind.idKey]: v.string() }
   const columnArgs = Object.fromEntries(
     [...Object.keys(kind.fields), 'meta', 'metaPatch'].map((column) => [column, v.optional(v.any())]),
@@ -274,14 +214,10 @@ export function defineRecordFunctions(kind: AnyRecordKind, options: RecordFuncti
     handler: async (ctx, args: Record<string, unknown>) => {
       await requireCapability(ctx, kind.access.write)
       const { [kind.idKey]: recordId, createdAt, updatedAt, ...write } = args
-      return saveRecord(
-        ctx,
-        kind,
-        recordId as string,
-        write,
-        { createdAt: createdAt as string, updatedAt: updatedAt as string },
-        legacy,
-      )
+      return saveRecord(ctx, kind, recordId as string, write, {
+        createdAt: createdAt as string,
+        updatedAt: updatedAt as string,
+      })
     },
   })
 
@@ -289,7 +225,7 @@ export function defineRecordFunctions(kind: AnyRecordKind, options: RecordFuncti
     args: idArg,
     handler: async (ctx, args: Record<string, unknown>) => {
       await requireCapability(ctx, kind.access.read)
-      return getRecordWire(ctx, kind, args[kind.idKey] as string, legacy)
+      return getRecordWire(ctx, kind, args[kind.idKey] as string)
     },
   })
 
@@ -304,7 +240,7 @@ export function defineRecordFunctions(kind: AnyRecordKind, options: RecordFuncti
     handler: async (ctx, args: RecordQuery) => {
       await requireCapability(ctx, kind.access.read)
       const resolved = rethrowAsConvex(() => resolveRecordQuery(kind, args))
-      return listRecordWire(ctx, kind, resolved, legacy)
+      return listRecordWire(ctx, kind, resolved)
     },
   })
 
@@ -315,9 +251,6 @@ export function defineRecordFunctions(kind: AnyRecordKind, options: RecordFuncti
       const recordId = args[kind.idKey] as string
       const doc = await findRecordDoc(ctx, kind, recordId)
       if (doc) await ctx.db.delete(doc._id)
-      // TOLERANT READ (marked): a legacy row of the same id goes too, or it would resurface.
-      const old = legacy ? await legacy.find(ctx, recordId) : null
-      if (old && legacy) await legacy.remove(ctx, old)
     },
   })
 

package/convex/redirects.ts

@@ -1,18 +1,7 @@
-import { internalMutationGeneric } from 'convex/server'
-import type { MutationBuilder } from 'convex/server'
-import {
-  PersistenceValidationError,
-  recordColumnsOf,
-  recordSlots,
-  redirectRecordKind,
-  resolveRecordQuery,
-  resolveRecordSave,
-} from '@elytracms/core/persistence'
+import { recordEntryFromWire, redirectRecordKind, resolveRecordQuery } from '@elytracms/core/persistence'
 import type { RedirectEntry } from '@elytracms/core/persistence'
-import type { DataModel, MutationCtx, QueryCtx } from './functions'
-import { defineRecordFunctions, findRecordDoc, listRecordWire } from './record-functions'
-import type { LegacyRecord, LegacyRecordSource } from './record-functions'
-import { recordEntryFromWire } from '@elytracms/core/persistence'
+import type { QueryCtx } from './functions'
+import { defineRecordFunctions, listRecordWire } from './record-functions'
 
 /**
  * Editorial redirects persistence (EC-303) — since EC-616 the redirect RECORD KIND over
@@ -22,112 +11,18 @@ import { recordEntryFromWire } from '@elytracms/core/persistence'
  * `export * from '@elytracms/studio/convex/redirects'` line are unchanged. Content-gated
  * (a viewer reads, an editor writes), NOT admin-only — redirects are content.
  *
- * ## The move from the `redirects` table (stored data — KON and NK hold real redirects)
- *
- * The EC-587 precedent, with no gap:
- *
- * - **writes go to `records`** (kind `redirect`); nothing writes the legacy table again;
- * - **reads union the legacy rows no record shadows** — the TOLERANT READ below, marked:
- *   a deployment with these functions pushed and the migration NOT yet run serves the
- *   same redirects it served before (`list`, `get`, the delivery snapshot);
- * - a save of a legacy-only redirect lifts it (record from its columns, legacy row
- *   deleted, one transaction); a remove deletes both;
- * - **`redirects:migrateLegacy`** moves every legacy row in one idempotent internal
- *   mutation and reports counts — run per deployment (both consumers + the prod harness:
- *   owner-run); the legacy table and this tolerant read are dropped together once it is
- *   reported run everywhere (a gated item, like EC-587's alt column).
+ * The legacy `redirects` table, its tolerant read and its one-time move
+ * (`redirects:migrateLegacy`) are deleted (EC-708), after every deployment's scan read 0
+ * legacy rows: `records` is the one home.
  */
-
-type LegacyRedirectDoc = DataModel['redirects']['document']
-
-/** TOLERANT READ (marked) — the legacy `redirects` table as the kind's legacy source. */
-const legacyRedirects: LegacyRecordSource = {
-  find: async (ctx, recordId) => {
-    const row = await ctx.db
-      .query('redirects')
-      .withIndex('by_redirect', (q) => q.eq('redirectId', recordId))
-      .first()
-    return row ? legacyRecord(row) : null
-  },
-  list: async (ctx) => (await ctx.db.query('redirects').withIndex('by_redirect').collect()).map(legacyRecord),
-  remove: async (ctx, record) => {
-    await ctx.db.delete(record.handle as LegacyRedirectDoc['_id'])
-  },
-}
-
-function legacyRecord(row: LegacyRedirectDoc): LegacyRecord {
-  return {
-    recordId: row.redirectId,
-    columns: recordColumnsOf(redirectRecordKind, row),
-    createdAt: row.createdAt,
-    updatedAt: row.updatedAt,
-    handle: row._id,
-  }
-}
-
-export const { save, get, list, remove } = defineRecordFunctions(redirectRecordKind, { legacy: legacyRedirects })
+export const { save, get, list, remove } = defineRecordFunctions(redirectRecordKind)
 
 /**
- * Every stored redirect of this deployment (records + the tolerant legacy read), ordered
- * by `from` — the ONE server-side reader; the delivery snapshot projects it through
- * `readLiveRedirects` (EC-590 / EC-627 / EC-628: the one live-redirect rule).
+ * Every stored redirect of this deployment, ordered by `from` — the ONE server-side
+ * reader; the delivery snapshot projects it through `readLiveRedirects` (EC-590 / EC-627
+ * / EC-628: the one live-redirect rule).
  */
 export async function loadRedirectEntries(ctx: QueryCtx, projectId: string): Promise<RedirectEntry[]> {
-  const rows = await listRecordWire(ctx, redirectRecordKind, resolveRecordQuery(redirectRecordKind), legacyRedirects)
+  const rows = await listRecordWire(ctx, redirectRecordKind, resolveRecordQuery(redirectRecordKind))
   return rows.map((row) => recordEntryFromWire(redirectRecordKind, row, projectId))
 }
-
-/**
- * EC-616 — move every legacy `redirects` row into `records` (kind `redirect`), the
- * redirect move's migration. Per row: a record of the same id already exists (a save
- * lifted it, or an earlier run) → the legacy row is dropped as shadowed; otherwise the
- * row's columns are written as a record CREATE through the one rule (`resolveRecordSave`
- * — a legacy row the current schema refuses is REPORTED and left where it is, still
- * served by the tolerant read, never dropped silently) and the legacy row deleted.
- * Idempotent: a second run scans nothing.
- *
- * Internal: an admin runs it from the CLI, once per deployment —
- * `npx convex run redirects:migrateLegacy` (no args). Built on the RAW internal-mutation
- * builder, deliberately outside the write-chokepoint triggers: the served redirect set is
- * identical before and after by construction (the tolerant read), so the move needs no
- * revalidation — through the triggers it would schedule two sweeps per row (an insert
- * into `records`, a delete from `redirects`). One transaction: Convex bounds it at 8192
- * written rows, far above any editorial redirect set (KON's import holds 192).
- */
-export const migrateLegacy = (internalMutationGeneric as MutationBuilder<DataModel, 'internal'>)({
-  args: {},
-  handler: async (ctx) => {
-    const legacy = await ctx.db.query('redirects').withIndex('by_redirect').collect()
-    const moved: string[] = []
-    const shadowed: string[] = []
-    const refused: Array<{ redirectId: string; message: string }> = []
-    for (const row of legacy) {
-      const record = legacyRecord(row)
-      if (await findRecordDoc(ctx as unknown as MutationCtx, redirectRecordKind, record.recordId)) {
-        await ctx.db.delete(row._id)
-        shadowed.push(record.recordId)
-        continue
-      }
-      let columns: Record<string, unknown>
-      try {
-        columns = resolveRecordSave(redirectRecordKind, record.recordId, undefined, record.columns)
-      } catch (error) {
-        if (!(error instanceof PersistenceValidationError)) throw error
-        refused.push({ redirectId: record.recordId, message: error.message })
-        continue
-      }
-      const slots = recordSlots(redirectRecordKind, columns, record.createdAt)
-      await ctx.db.insert('records', {
-        kind: redirectRecordKind.kind,
-        recordId: record.recordId,
-        data: columns,
-        at: slots.at,
-        createdAt: record.createdAt,
-        updatedAt: record.updatedAt,
-      })
-      await ctx.db.delete(row._id)
-      moved.push(record.recordId)
-    }
-    return { scanned: legacy.length, moved: moved.length, shadowed: shadowed.length, refused, movedIds: moved }
-  },
-})

package/convex/schema.ts

@@ -239,10 +239,10 @@ export default defineSchema({
     origin: v.optional(v.string()),
     // EC-585: which mutation recorded the row — 'publish' (`publishDocument`, the only
     // kind `publishDocumentVersion` pins) or 'snapshot' (`saveDocumentVersion`: a restore
-    // point). Optional ONLY for rows recorded before EC-585 (read through
-    // `isPinnableVersion`, which keeps a kind-less `label: 'published'` row pinnable). A
-    // top-level scalar beside the folded snapshot: it adds no nesting depth.
-    kind: v.optional(v.union(v.literal('publish'), v.literal('snapshot'))),
+    // point). Required (EC-708: every deployment stamped and read 0 kind-less rows first;
+    // the push refuses a row without it). A top-level scalar beside the folded snapshot: it
+    // adds no nesting depth.
+    kind: v.union(v.literal('publish'), v.literal('snapshot')),
     createdAt: v.string(),
   })
     .index('by_doc', ['collection', 'docId'])
@@ -259,7 +259,6 @@ export default defineSchema({
     byteSize: v.number(),
     width: v.optional(v.number()),
     height: v.optional(v.number()),
-    alt: v.optional(v.string()),
     /** Editable display title (EC-152; persisted for parity with in-memory — EC-153). */
     title: v.optional(v.string()),
     storageKey: v.string(),
@@ -306,24 +305,6 @@ export default defineSchema({
     .index('by_storage', ['storageKey'])
     .index('by_thumb_storage', ['thumb.storageKey']),
 
-  /**
-   * Editorial redirects (EC-303) — 301/302 forwards an editor owns, stored as
-   * DATA (not config) so they change dynamically without a deploy. The delivery
-   * snapshot projects enabled entries onto the routing `RedirectRecord` the
-   * catch-all resolves; static/infra redirects stay native (next.config/vercel).
-   */
-  redirects: defineTable({
-    redirectId: v.string(),
-    from: v.string(),
-    to: v.string(),
-    permanent: v.boolean(),
-    enabled: v.boolean(),
-    // Schema-driven additive-field bag (EC-311 Tier 2) — see the `assets.meta` bag.
-    meta: v.optional(v.any()),
-    createdAt: v.string(),
-    updatedAt: v.string(),
-  }).index('by_redirect', ['redirectId']),
-
   /**
    * The generic RECORD STORE (EC-616) — one row per record of a DECLARED record kind
    * (`defineRecordKind` in `@elytracms/core/persistence`): the engine's own kinds and