@elytracms/studio 0.0.102 → 0.0.103

package/convex/ingest.test.ts

@@ -77,11 +77,12 @@ const testIngestModule = {
       }
       if (payload.kind !== 'submission') return { ok: false, status: 422, message: 'Not a submission.' }
       if (payload.target !== 'contact') return { ok: false, status: 404, message: `No form “${payload.target}”.` }
+      // EC-750: the row's id first — the claim binds every file to it (the owner release is asked for).
+      const id = `sub_${(await ctx.db.query('records').collect()).length + 1}`
       // EC-695: one call for every upload, after every check that can refuse — all bound or none.
-      const claim = await claimIngestUploads(ctx, payload.uploads ?? [], payload.target, args.receivedAt)
+      const claim = await claimIngestUploads(ctx, payload.uploads ?? [], payload.target, args.receivedAt, id)
       if (!claim.ok) return claim
       const files = claim.files.map((file) => file.storageId)
-      const id = `sub_${(await ctx.db.query('records').collect()).length + 1}`
       await saveRecord(
         ctx,
         testSubmissionKind,
@@ -340,9 +341,10 @@ describe('the ingest receiver — dispatch (EC-617)', () => {
 /**
  * EC-671 — a claim binds only bytes the deployment's own facts say are this intent's, each
  * check isolated (the others pass by construction) beside a control the same harness claims;
- * and `releaseIngestUploads` deletes only what a claim bound. The forms addon's end-to-end
- * probe (its rollback and removal, the attacker's harvest) is
- * `packages/forms/src/convex/claim-ownership.convex.test.ts`.
+ * and `releaseIngestUploads` deletes only what a claim bound to the OWNER it is asked for
+ * (EC-750). The forms addon's end-to-end probes (its rollback and removal, the attacker's
+ * harvest; a sibling's removal) are `packages/forms/src/convex/claim-ownership.convex.test.ts`
+ * and `sibling-release.convex.test.ts`.
  */
 describe('the claim binds only this intent’s bytes; release deletes only bound bytes (EC-671)', () => {
   const PNG = { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 500 } as const
@@ -352,6 +354,11 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
   }
   const claimWith = (t: ReturnType<typeof backend>, uploadId: string, storageId: string) =>
     signedPost(t, { ...SUBMISSION, uploads: [{ uploadId, storageId }] })
+  /** The id of the row an accepted submission wrote — the owner its claim bound the files to (EC-750). */
+  const ownerOf = async (answer: Response) => {
+    expect(answer.status).toBe(200)
+    return ((await answer.json()) as { id: string }).id
+  }
   async function insertAsset(t: ReturnType<typeof backend>, files: { storageKey: string; thumb?: string }) {
     await t.run(async (ctx) => {
       await ctx.db.insert('assets', {
@@ -372,6 +379,15 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
         .filter((row) => row.kind === 'ingestBinding')
         .map((row) => ({ storageId: row.recordId, uploadId: (row.data as { uploadId: string }).uploadId })),
     )
+  /** EC-750: every binding's owner, by its storage id. */
+  const owners = (t: ReturnType<typeof backend>) =>
+    t.run(async (ctx) =>
+      Object.fromEntries(
+        (await ctx.db.query('records').collect())
+          .filter((row) => row.kind === 'ingestBinding')
+          .map((row) => [row.recordId, (row.data as { owner: string }).owner]),
+      ),
+    )
 
   it('(1) a file stored BEFORE the intent — in the same millisecond — is refused, rejected and kept; one stored after is claimed', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
@@ -429,18 +445,24 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     expect([await stored(t, original), await stored(t, preview)]).toEqual([true, true])
   })
 
-  it('releaseIngestUploads deletes a bound file and its binding, keeps an unbound one (an asset’s), and dedupes', async () => {
+  it('EC-750: releaseIngestUploads deletes the files its OWNER claimed, with their bindings — never another owner’s, never an asset’s', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
     const t = backend()
-    const uploadId = await declare(t)
+    const [mine, theirs] = [await declare(t), await declare(t)]
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const other = await storeFile(t, 400, 'image/png')
+    const owner = await ownerOf(await claimWith(t, mine, own))
+    const otherOwner = await ownerOf(await claimWith(t, theirs, other))
     const assetFile = await storeFile(t, 400, 'image/png')
     await insertAsset(t, { storageKey: assetFile })
-    const released = await t.run((ctx) => releaseIngestUploads(ctx, [own, assetFile, own]))
-    expect(released).toEqual({ deleted: [own], kept: [assetFile] })
-    expect([await stored(t, own), await stored(t, assetFile)]).toEqual([false, true])
-    expect(await bindings(t)).toEqual([])
+    expect(await owners(t)).toEqual({ [own]: owner, [other]: otherOwner })
+    const released = await t.run((ctx) => releaseIngestUploads(ctx, owner))
+    expect(released).toEqual({ deleted: [own], kept: [] })
+    expect([await stored(t, own), await stored(t, other), await stored(t, assetFile)]).toEqual([false, true, true])
+    expect(await bindings(t)).toEqual([{ storageId: other, uploadId: theirs }])
+    // An owner with nothing bound any more (released already, or a row that never claimed) deletes nothing.
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, owner))).toEqual({ deleted: [], kept: [] })
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, 'sub_never'))).toEqual({ deleted: [], kept: [] })
   })
 
   // EC-685 (Codex r4 F20, ordering 2): a fact checked at claim time is not permanent — an
@@ -460,12 +482,20 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const promoted = await storeFile(t, 400, 'image/png')
     const preview = await storeFile(t, 40, 'image/png')
     const unreferenced = await storeFile(t, 400, 'image/png')
-    for (const [uploadId, file] of [[asFile, promoted], [asThumb, preview], [plain, unreferenced]] as const) {
-      expect((await claimWith(t, uploadId, file)).status).toBe(200)
-    }
+    // One submission claims all three (EC-750: one owner).
+    const owner = await ownerOf(
+      await signedPost(t, {
+        ...SUBMISSION,
+        uploads: [
+          { uploadId: asFile, storageId: promoted },
+          { uploadId: asThumb, storageId: preview },
+          { uploadId: plain, storageId: unreferenced },
+        ],
+      }),
+    )
     // An editor promotes two of the uploads to an asset (its file and its preview) — after the claims.
     await insertAsset(t, { storageKey: promoted, thumb: preview })
-    const released = await t.run((ctx) => releaseIngestUploads(ctx, [promoted, preview, unreferenced]))
+    const released = await t.run((ctx) => releaseIngestUploads(ctx, owner))
     expect(released).toEqual({ deleted: [unreferenced], kept: [promoted, preview] })
     expect([await stored(t, promoted), await stored(t, preview), await stored(t, unreferenced)]).toEqual([true, true, false])
     expect(await bindings(t)).toEqual([]) // ownership passed: no binding is left to hold the asset's bytes
@@ -480,7 +510,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const t = backend()
     const uploadId = await declare(t)
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const owner = await ownerOf(await claimWith(t, uploadId, own))
     await insertAsset(t, { storageKey: own }) // promoted to an asset while the submission still holds it
     const editor = await asEditor(t)
     expect(await editor.mutation(deleteBlob, { storageKey: own })).toEqual({ deleted: false, heldBy: 'ingest' })
@@ -490,7 +520,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     await t.run(async (ctx) => {
       for (const row of await ctx.db.query('assets').collect()) await ctx.db.delete(row._id)
     })
-    expect(await t.run((ctx) => releaseIngestUploads(ctx, [own]))).toEqual({ deleted: [own], kept: [] })
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, owner))).toEqual({ deleted: [own], kept: [] })
     expect(await stored(t, own)).toBe(false)
   })
 
@@ -593,9 +623,12 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const t = backend()
     const uploadId = await declare(t)
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const owner = await ownerOf(await claimWith(t, uploadId, own))
     const row = await t.run(async (ctx) => (await ctx.db.query('records').collect()).find((r) => r.kind === 'ingestBinding')!)
-    expect(row.data).toEqual({ uploadId, target: 'contact', boundAt: '2026-10-26T12:00:00.000Z' })
+    expect(row.data).toEqual({ uploadId, target: 'contact', owner, boundAt: '2026-10-26T12:00:00.000Z' })
+    // EC-750: the owner fills the static `key1` slot (`by_kind_key1`) — no schema or index change.
+    expect(row.key1).toBe(owner)
+    expect(row.key2).toBeUndefined()
     expect(measureMaxDepth(row).depth).toBe(2) // the row object → `data` → its string columns
     expect(measureMaxDepth(row).depth).toBeLessThanOrEqual(CONVEX_MAX_NESTING_DEPTH)
   })
@@ -610,7 +643,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
       ),
     )
   const claimDirect = (t: ReturnType<typeof backend>, claims: { uploadId: string; storageId: string }[]) =>
-    t.run((ctx) => claimIngestUploads(ctx, claims, 'contact', '2026-10-26T12:00:00.000Z'))
+    t.run((ctx) => claimIngestUploads(ctx, claims, 'contact', '2026-10-26T12:00:00.000Z', 'sub_direct'))
 
   it('EC-695: a submission with one refused claim binds NOTHING — the claims before it stay issued; nothing is deleted', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET

package/convex/ingest.ts

@@ -18,7 +18,7 @@ import type { IngestHandlerResult, IngestPayload, IngestUploadClaim } from '@ely
 import { defineRecordKind, resolveRecordQuery } from '@elytracms/core/persistence'
 import { createUuidIdFactory } from '@elytracms/core/determinism'
 import type { MutationCtx, QueryCtx } from './functions'
-import { findRecordDoc, listRecordWire, saveRecord } from './record-functions'
+import { findRecordDoc, listRecordWire, queryRecordDocs, saveRecord } from './record-functions'
 
 /**
  * EC-617 — the ONE inbound receiver of the public ingest seam (ruling EC-565 § 6c), and the
@@ -44,7 +44,8 @@ import { findRecordDoc, listRecordWire, saveRecord } from './record-functions'
  *    claims its stored files with {@link claimIngestUploads}, which checks that the deployment
  *    stored each for ITS intent (EC-671) — its bytes the ones the upload request declared by
  *    SHA-256 (EC-685) — and that it matches the declared size and type, and binds them all or
- *    none (EC-695); {@link releaseIngestUploads} is the only way such bytes are deleted.
+ *    none (EC-695) to the record that claims them (EC-750); {@link releaseIngestUploads}, asked
+ *    for that record, is the only way such bytes are deleted.
  *
  * The engine never imports an addon: the handler is an internal-mutation REFERENCE the
  * consumer passes in its one `http.ts` line (`defineStudioHttp({ auth, ingest: {
@@ -195,6 +196,11 @@ export function ingestReceiver(handlers: IngestHandlers = {}): PublicHttpAction
 // it never deletes, and ingest bytes are deleted only through {@link releaseIngestUploads},
 // which deletes only what a claim bound.
 //
+// EC-750 (Codex r9 F46) — bound to WHOM. A binding records the record that claimed the file
+// (`owner`), and release is asked for an owner, never for storage ids: removing a row deletes
+// only the files that row claimed. Before, release took the removed row's `files` ids — a column
+// a whole-record write can fill with another row's file — and deleted any bound one.
+//
 // EC-685 — causation. Eligibility (stored after the intent, unbound, no asset's) is not
 // ownership: with intents A and B open, bytes stored through B's URL were eligible for A. So
 // the intent DECLARES the bytes' SHA-256 before they exist, and the claim requires the digest
@@ -236,14 +242,25 @@ export const ingestUploadRecordKind = defineRecordKind({
  * and "is it bound?" is one indexed read. Written only by {@link claimIngestUploads}, in the
  * claim's transaction; read by the claim (a file another claim bound is refused) and by
  * {@link releaseIngestUploads}. Engine-internal (no public functions), like the intent.
+ *
+ * EC-750 (Codex r9 F46) — and WHOSE: `owner` is the id of the record that claimed the file (a
+ * forms submission), its `key1` slot, so "this record's files" is one indexed read
+ * (`by_kind_key1`) and release asks that question, never "is this id bound?". `target` is the
+ * intent's (the form every submission to it shares), so it cannot say whose a file is. A
+ * binding written before EC-750 has no owner and no slot: no release reads it, so it is never
+ * deleted and keeps protecting its bytes from `assets:deleteBlob` (residue, never loss — EC-671's
+ * no-migration precedent).
  */
 export const ingestBindingRecordKind = defineRecordKind({
   kind: 'ingestBinding',
   module: 'ingest',
+  keys: ['owner'],
   time: 'boundAt',
   fields: {
     uploadId: z.string().min(1),
     target: z.string().min(1),
+    /** EC-750: the id of the record that claimed the file — what {@link releaseIngestUploads} is asked for. */
+    owner: z.string().min(1),
     boundAt: z.string().min(1),
   },
 })
@@ -403,12 +420,18 @@ async function assetReferencesStorage(ctx: MutationCtx, storageId: string): Prom
  * A handler calls this ONCE per submission, after every check of its own that can refuse: a
  * mutation that RETURNS commits its writes (a claim made before a later refusal stays bound with
  * no row to hold it); one that THROWS commits nothing.
+ *
+ * EC-750: `owner` is the id of the record the handler is about to write — mint it BEFORE the
+ * claim. Every binding records it, and {@link releaseIngestUploads} deletes a file only for the
+ * owner that claimed it: a row naming another row's file (an editor's whole-record write can
+ * put any id in its `files`) never deletes it.
  */
 export async function claimIngestUploads(
   ctx: MutationCtx,
   claims: readonly IngestUploadClaim[],
   target: string,
   receivedAt: string,
+  owner: string,
 ): Promise<IngestUploadsClaimResult> {
   const accepted: AcceptedClaim[] = []
   for (const [index, claim] of claims.entries()) {
@@ -418,7 +441,13 @@ export async function claimIngestUploads(
   }
   const stamps = { createdAt: receivedAt, updatedAt: receivedAt }
   for (const claim of accepted) {
-    await saveRecord(ctx, ingestBindingRecordKind, claim.storageId, { uploadId: claim.uploadId, target, boundAt: receivedAt }, stamps)
+    await saveRecord(
+      ctx,
+      ingestBindingRecordKind,
+      claim.storageId,
+      { uploadId: claim.uploadId, target, owner, boundAt: receivedAt },
+      stamps,
+    )
     await saveRecord(ctx, ingestUploadRecordKind, claim.uploadId, { state: 'claimed', storageId: claim.storageId }, stamps)
   }
   return { ok: true, files: accepted.map(({ storageId, field, contentType, size }) => ({ storageId, field, contentType, size })) }
@@ -508,18 +537,25 @@ async function judgeIngestUploadClaim(
 }
 
 /**
- * Delete ingest bytes an addon holds (EC-671) — the ONE way they are deleted, and it deletes
- * only files a claim BOUND that no asset references NOW: the bytes and their binding go
- * together. Any other id is KEPT and returned in `kept`:
+ * Delete the ingest bytes ONE record claimed (EC-671, EC-750) — the ONE way ingest bytes are
+ * deleted. It is asked for an OWNER (the id {@link claimIngestUploads} bound the files to), never
+ * for storage ids: it reads that owner's bindings by their key (`by_kind_key1`) and deletes each
+ * file with its binding — so it never sees, and never writes, another owner's binding. A row's
+ * `files` column is the visitor's and the editor's word (a whole-record write can name any id,
+ * or clear the list), so release never reads it: a row naming another row's file deletes
+ * nothing, and a row whose list was cleared still deletes what it claimed.
+ *
+ * Of the owner's files it KEEPS, returned in `kept`:
  *
- * - an id with no binding — an asset's, an id a write put into a row by hand, a file claimed
- *   before bindings existed — because ingest cannot show it owns them;
  * - EC-685: a bound file an asset row references now (`storageKey` or `thumb.storageKey` — an
  *   editor promoted the upload to an asset with `assets:upsert`, a legitimate edit). Ownership
  *   has passed to the asset: the binding is spent (deleted) and the bytes stay, so the
  *   asset's own delete removes them later. Read in this transaction, so no asset can acquire
  *   the file between the check and the delete.
  *
+ * Never touched: a binding of another owner, and a binding written before EC-750 (no owner, no
+ * key slot — residue, never loss; it keeps protecting its bytes from `assets:deleteBlob`).
+ *
  * Call it when removing a row that holds claimed files — never for a refused submission, which
  * bound nothing ({@link claimIngestUploads}, EC-695). The mirror is `assets:deleteBlob`, which keeps bytes a binding holds
  * ({@link ingestBindingHolds}): each delete path re-checks the OTHER owner in its own
@@ -527,16 +563,17 @@ async function judgeIngestUploadClaim(
  */
 export async function releaseIngestUploads(
   ctx: MutationCtx,
-  storageIds: readonly string[],
+  owner: string,
 ): Promise<{ deleted: string[]; kept: string[] }> {
   const deleted: string[] = []
   const kept: string[] = []
-  for (const storageId of new Set(storageIds)) {
-    const binding = await findRecordDoc(ctx, ingestBindingRecordKind, storageId)
-    if (!binding) {
-      kept.push(storageId)
-      continue
-    }
+  const owned = await queryRecordDocs(
+    ctx,
+    ingestBindingRecordKind,
+    resolveRecordQuery(ingestBindingRecordKind, { where: { owner } }),
+  )
+  for (const binding of owned) {
+    const storageId = binding.recordId
     await ctx.db.delete(binding._id)
     if (await assetReferencesStorage(ctx, storageId)) {
       kept.push(storageId) // the asset owns the bytes now (EC-685)

package/dist/components/ai/translate-document-dialog.d.ts

@@ -1,5 +1,48 @@
+import type { CollectionDef, Locale } from '@elytracms/core/cms-core';
+import type { TranslateMode, TranslatePlan, TranslateSkip, TranslateWrite } from '../../lib/ai/index.js';
 import type { TranslateDocumentActionProps } from './translate-document-action.js';
+/** What the done phase reports — what the run actually wrote, against what it planned. */
+export interface TranslateRunSummary {
+    mode: TranslateMode;
+    plan: TranslatePlan;
+    /** Units translated (the fill message's count). */
+    translated: number;
+    locales: number;
+    cancelled: boolean;
+    /** EC-752: the writes that landed (a write refused at its revision is in {@link refused}). */
+    writes: readonly TranslateWrite[];
+    refused: readonly TranslateWrite[];
+    /** EC-752: the version saved before a re-translation wrote. */
+    restorePoint?: number;
+    /** EC-593: every text position the run could not translate — listed, never silent. */
+    skipped: readonly TranslateSkip[];
+}
 export declare function TranslateDocumentDialog({ projectId, collection, docRef, document, revision, localeConfig, flushDraft, open, onOpenChange, }: TranslateDocumentActionProps & {
     open: boolean;
     onOpenChange: (open: boolean) => void;
 }): import("react").JSX.Element;
+/**
+ * EC-752 — the confirm phase: the target languages, the scope choice and, for a
+ * re-translation, its plan (what it replaces, fills and leaves as it is — "up to").
+ */
+export declare function TranslateConfirm({ mode, onModeChange, base, targets, plan, collection, }: {
+    mode: TranslateMode;
+    onModeChange: (mode: TranslateMode) => void;
+    base: Locale;
+    targets: readonly Locale[];
+    /** The run's plan — present in `retranslate-all`. */
+    plan: TranslatePlan | null;
+    collection: CollectionDef;
+}): import("react").JSX.Element;
+/** The headline of the done phase (EC-752: mode-aware; slugs and replacements are listed below it). */
+export declare function translateDoneMessage(summary: TranslateRunSummary, base: Locale): string;
+/**
+ * EC-752 — the done phase: what was actually written (a re-translation lists what it
+ * replaced and filled), the slugs it set, what was refused at its revision, what a
+ * re-translation planned but left as it was, its restore point, and what was not translated.
+ */
+export declare function TranslateDoneSummary({ summary, base, collection, }: {
+    summary: TranslateRunSummary;
+    base: Locale;
+    collection: CollectionDef;
+}): import("react").JSX.Element;

package/dist/components/ai/translate-document-dialog.js

@@ -2,17 +2,19 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { createCollectionRegistry } from '@elytracms/core/cms-core';
 import { Check, Languages, Loader2, X } from 'lucide-react';
-import { Badge, Button, Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle, Row, Stack, Text, } from '@elytracms/studio/ui';
+import { Badge, Button, Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle, Row, SegmentedControl, Stack, Text, } from '@elytracms/studio/ui';
 import { translate } from '../../lib/i18n/index.js';
 import { localeChipLabel } from '../../lib/locale/index.js';
 import { getStudioOperations } from '../../lib/operations/index.js';
 import { resolveDeploymentAi } from '../../lib/workspace/index.js';
-import { resolveAiConfig, resolveKnowledge, translateDocument } from '../../lib/ai/index.js';
+import { planTranslation, resolveAiConfig, resolveKnowledge, translateDocument } from '../../lib/ai/index.js';
+import { applyTranslation } from '../../lib/ai/translate-apply.js';
 import { cmsValidationIssueMessage } from '../../lib/persona/labels.js';
 import { useCms } from '../cms/cms-store.js';
-import { TranslateSkipped } from './translate-skipped.js';
+import { TranslateBucketList, TranslateSkipped } from './translate-skipped.js';
 export function TranslateDocumentDialog({ projectId, collection, docRef, document, revision, localeConfig, flushDraft, open, onOpenChange, }) {
     const [phase, setPhase] = useState('confirm');
+    const [mode, setMode] = useState('fill-empty');
     const [progress, setProgress] = useState(null);
     const [summary, setSummary] = useState(null);
     /**
@@ -20,7 +22,7 @@ export function TranslateDocumentDialog({ projectId, collection, docRef, documen
      * EC-473 `ai.error.applyInvalid` copy ("the proposal no longer fits the current
      * document: …"), which is exactly this situation: no new catalog string, and the
      * editor is told WHICH rules the translation would have broken rather than a bare
-     * "failed".
+     * "failed". EC-752: also why a re-translation wrote nothing (no restore point).
      */
     const [refusal, setRefusal] = useState(null);
     const abortRef = useRef(null);
@@ -32,6 +34,10 @@ export function TranslateDocumentDialog({ projectId, collection, docRef, documen
     useEffect(() => () => abortRef.current?.abort(), []);
     const base = localeConfig.default;
     const targets = localeConfig.locales.filter((l) => l !== base);
+    // EC-752 rule 4: the confirm lists the run's OWN plan — the same judge, on the same input.
+    const plan = useMemo(() => mode === 'retranslate-all'
+        ? planTranslation({ collection, document, localeConfig, mode, validateOptions: cms.validateOptions })
+        : null, [mode, collection, document, localeConfig, cms.validateOptions]);
     const run = useCallback(async () => {
         if (projectId === undefined) {
             setPhase('error');
@@ -56,6 +62,7 @@ export function TranslateDocumentDialog({ projectId, collection, docRef, documen
                 collection,
                 document,
                 localeConfig,
+                mode,
                 knowledge,
                 signal: controller.signal,
                 onProgress: setProgress,
@@ -78,36 +85,44 @@ export function TranslateDocumentDialog({ projectId, collection, docRef, documen
                 setPhase('error');
                 return;
             }
-            if (result.translated > 0 || result.slugsDerived > 0) {
-                // EC-595 A2: the translation persists as the patches of the buckets it filled
-                // (never the whole document) — through the session's queue, at the revision
-                // the draft it was authored on is at (EC-647); a bucket a colleague changed
-                // meanwhile is refused on that field and shown there.
-                const outcome = await cms.commitPatches(docRef, result.patches, result.patches.map(() => revision));
-                if (outcome?.status === 'failed') {
-                    setPhase('error');
-                    return;
-                }
-                const { operations } = await getStudioOperations();
-                // Provenance: an AI-tagged version snapshot (best-effort — the draft already landed).
-                try {
-                    await operations.documents.snapshot({
+            const { operations } = await getStudioOperations();
+            // EC-752 rule 3 (in `applyTranslation`): a re-translation records a labelled restore
+            // point of the stored draft BEFORE it writes; then the patches go through the session's
+            // queue at the revision the draft was authored on (EC-595 A2 / EC-647 — a bucket a
+            // colleague changed meanwhile is refused on that field and shown there); then the
+            // AI-provenance snapshot.
+            const applied = await applyTranslation(result, {
+                commit: (patches) => cms.commitPatches(docRef, patches, patches.map(() => revision)),
+                snapshot: async ({ label, origin }) => {
+                    const recorded = await operations.documents.snapshot({
                         projectId,
                         ref: docRef,
-                        label: translate('cms.version.aiAuthoredTitle'),
-                        origin: 'assistant',
+                        label,
+                        ...(origin ? { origin } : {}),
                     });
-                }
-                catch {
-                    // ignore — provenance is additive
-                }
+                    if (!recorded.ok)
+                        throw new Error(recorded.error.message);
+                    return recorded.value;
+                },
+            }, { restorePoint: translate('ai.translate.snapshotLabel'), provenance: translate('cms.version.aiAuthoredTitle') });
+            if (applied.status === 'snapshot-failed') {
+                setRefusal(translate('ai.translate.snapshotFailed'));
+                setPhase('error');
+                return;
+            }
+            if (applied.status === 'failed') {
+                setPhase('error');
+                return;
             }
             setSummary({
+                mode,
+                plan: result.plan,
                 translated: result.translated,
-                slugs: result.slugsDerived,
                 locales: Object.keys(result.perLocale).length,
                 cancelled: result.cancelled,
-                nothing: result.total === 0 && result.skipped.length === 0,
+                writes: applied.writes,
+                refused: applied.refused,
+                ...(applied.restorePoint !== undefined ? { restorePoint: applied.restorePoint } : {}),
                 skipped: result.skipped,
             });
             setPhase('done');
@@ -118,21 +133,74 @@ export function TranslateDocumentDialog({ projectId, collection, docRef, documen
         finally {
             abortRef.current = null;
         }
-    }, [projectId, collection, document, revision, localeConfig, docRef, flushDraft, registry, cms]);
+    }, [projectId, collection, document, revision, localeConfig, mode, docRef, flushDraft, registry, cms]);
     const close = () => {
         if (phase === 'running')
             return; // never close mid-run — Cancel aborts instead
         onOpenChange(false);
     };
-    const doneMessage = (s) => {
-        if (s.nothing)
-            return translate('ai.translate.nothing');
-        if (s.cancelled)
-            return translate('ai.translate.cancelled');
-        return translate('ai.translate.applied', { count: s.translated, locales: s.locales });
-    };
-    return (_jsx(Dialog, { open: open, onOpenChange: (next) => (!next ? close() : undefined), children: _jsxs(DialogContent, { children: [_jsxs(DialogHeader, { children: [_jsx(DialogTitle, { children: _jsxs(Row, { gap: "2", align: "center", children: [_jsx(Languages, { className: "size-4" }), " ", translate('ai.translate.dialogTitle')] }) }), _jsx(DialogDescription, { children: translate('ai.translate.dialogDescription', { base: localeChipLabel(base) }) })] }), phase === 'confirm' ? (_jsxs(Stack, { gap: "4", className: "py-2", children: [_jsxs(Stack, { gap: "1", children: [_jsx(Text, { size: "xs", weight: "medium", tone: "muted", children: translate('ai.translate.targetsLabel') }), _jsx(Row, { gap: "1", wrap: true, children: targets.map((l) => (_jsx(Badge, { variant: "outline", children: localeChipLabel(l) }, l))) })] }), _jsxs(Stack, { gap: "1", children: [_jsx(Text, { size: "xs", weight: "medium", tone: "muted", children: translate('ai.translate.scopeLabel') }), _jsxs(Row, { gap: "2", align: "center", children: [_jsx(Badge, { variant: "default", children: translate('ai.translate.fillMissing') }), _jsx(Button, { size: "sm", variant: "ghost", disabled: true, title: translate('ai.translate.retranslateSoon'), children: translate('ai.translate.retranslateAll') }), _jsx(Text, { size: "xs", tone: "muted", children: translate('ai.translate.retranslateSoon') })] })] })] })) : null, phase === 'running' ? (_jsxs(Stack, { gap: "3", align: "center", className: "py-6", children: [_jsx(Loader2, { className: "size-6 animate-spin text-primary" }), _jsx(Text, { size: "sm", tone: "muted", "data-testid": "translate-progress", children: progress && progress.total > 0
+    const replaces = (plan?.buckets ?? []).some((bucket) => bucket.kind === 'replace');
+    return (_jsx(Dialog, { open: open, onOpenChange: (next) => (!next ? close() : undefined), children: _jsxs(DialogContent, { children: [_jsxs(DialogHeader, { children: [_jsx(DialogTitle, { children: _jsxs(Row, { gap: "2", align: "center", children: [_jsx(Languages, { className: "size-4" }), " ", translate('ai.translate.dialogTitle')] }) }), _jsx(DialogDescription, { children: translate('ai.translate.dialogDescription', { base: localeChipLabel(base) }) })] }), phase === 'confirm' ? (_jsx(TranslateConfirm, { mode: mode, onModeChange: setMode, base: base, targets: targets, plan: plan, collection: collection })) : null, phase === 'running' ? (_jsxs(Stack, { gap: "3", align: "center", className: "py-6", children: [_jsx(Loader2, { className: "size-6 animate-spin text-primary" }), _jsx(Text, { size: "sm", tone: "muted", "data-testid": "translate-progress", children: progress && progress.total > 0
                                 ? translate('ai.translate.progress', { completed: progress.completed, total: progress.total })
-                                : translate('ai.translate.preparing') }), progress && progress.total > 0 ? (_jsx("div", { className: "h-1.5 w-56 overflow-hidden rounded-full bg-muted", children: _jsx("div", { className: "h-full rounded-full bg-primary transition-all", style: { width: `${Math.round((progress.completed / progress.total) * 100)}%` } }) })) : null] })) : null, phase === 'done' && summary ? (_jsxs(Stack, { gap: "2", align: "center", className: "py-6", children: [_jsx(Check, { className: "size-6 text-success" }), _jsx(Text, { size: "sm", tone: "muted", className: "text-center", "data-testid": "translate-summary", children: doneMessage(summary) }), _jsx(TranslateSkipped, { skipped: summary.skipped, collection: collection })] })) : null, phase === 'error' ? (_jsxs(Stack, { gap: "2", align: "center", className: "py-6", children: [_jsx(X, { className: "size-6 text-destructive" }), _jsx(Text, { size: "sm", tone: "muted", className: "text-center", "data-testid": "translate-error", children: refusal ?? translate('ai.translate.failed') })] })) : null, _jsx(DialogFooter, { className: "mt-2", children: phase === 'confirm' ? (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "ghost", size: "sm", onClick: close, children: translate('common.cancel') }), _jsxs(Button, { size: "sm", onClick: () => void run(), "data-testid": "translate-confirm", children: [_jsx(Languages, {}), " ", translate('ai.translate.confirm')] })] })) : phase === 'running' ? (_jsx(Button, { variant: "outline", size: "sm", onClick: () => abortRef.current?.abort(), "data-testid": "translate-cancel", children: translate('common.cancel') })) : (_jsx(Button, { size: "sm", onClick: close, "data-testid": "translate-close", children: translate('ai.translate.close') })) })] }) }));
+                                : translate('ai.translate.preparing') }), progress && progress.total > 0 ? (_jsx("div", { className: "h-1.5 w-56 overflow-hidden rounded-full bg-muted", children: _jsx("div", { className: "h-full rounded-full bg-primary transition-all", style: { width: `${Math.round((progress.completed / progress.total) * 100)}%` } }) })) : null] })) : null, phase === 'done' && summary ? (_jsxs(Stack, { gap: "2", align: "center", className: "py-6", children: [_jsx(Check, { className: "size-6 text-success" }), _jsx(TranslateDoneSummary, { summary: summary, base: base, collection: collection })] })) : null, phase === 'error' ? (_jsxs(Stack, { gap: "2", align: "center", className: "py-6", children: [_jsx(X, { className: "size-6 text-destructive" }), _jsx(Text, { size: "sm", tone: "muted", className: "text-center", "data-testid": "translate-error", children: refusal ?? translate('ai.translate.failed') })] })) : null, _jsx(DialogFooter, { className: "mt-2", children: phase === 'confirm' ? (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "ghost", size: "sm", onClick: close, children: translate('common.cancel') }), mode === 'retranslate-all' && replaces ? (_jsxs(Button, { size: "sm", variant: "destructive", onClick: () => void run(), "data-testid": "translate-confirm", children: [_jsx(Languages, {}), " ", translate('ai.translate.confirmReplace')] })) : (_jsxs(Button, { size: "sm", onClick: () => void run(), "data-testid": "translate-confirm", children: [_jsx(Languages, {}), " ", translate('ai.translate.confirm')] }))] })) : phase === 'running' ? (_jsx(Button, { variant: "outline", size: "sm", onClick: () => abortRef.current?.abort(), "data-testid": "translate-cancel", children: translate('common.cancel') })) : (_jsx(Button, { size: "sm", onClick: close, "data-testid": "translate-close", children: translate('ai.translate.close') })) })] }) }));
+}
+/**
+ * EC-752 — the confirm phase: the target languages, the scope choice and, for a
+ * re-translation, its plan (what it replaces, fills and leaves as it is — "up to").
+ */
+export function TranslateConfirm({ mode, onModeChange, base, targets, plan, collection, }) {
+    const baseLabel = localeChipLabel(base);
+    return (_jsxs(Stack, { gap: "4", className: "py-2", children: [_jsxs(Stack, { gap: "1", children: [_jsx(Text, { size: "xs", weight: "medium", tone: "muted", children: translate('ai.translate.targetsLabel') }), _jsx(Row, { gap: "1", wrap: true, children: targets.map((l) => (_jsx(Badge, { variant: "outline", children: localeChipLabel(l) }, l))) })] }), _jsxs(Stack, { gap: "1", children: [_jsx(Text, { size: "xs", weight: "medium", tone: "muted", children: translate('ai.translate.scopeLabel') }), _jsx(SegmentedControl, { ariaLabel: translate('ai.translate.scopeLabel'), testId: "translate-scope", items: [
+                            {
+                                key: 'fill-empty',
+                                label: translate('ai.translate.fillMissing'),
+                                active: mode === 'fill-empty',
+                                onClick: () => onModeChange('fill-empty'),
+                                testId: 'translate-scope-fill',
+                            },
+                            {
+                                key: 'retranslate-all',
+                                label: translate('ai.translate.retranslateAll'),
+                                active: mode === 'retranslate-all',
+                                onClick: () => onModeChange('retranslate-all'),
+                                testId: 'translate-scope-retranslate',
+                            },
+                        ] }), _jsx(Text, { size: "xs", tone: "muted", children: translate(mode === 'retranslate-all' ? 'ai.translate.retranslateHint' : 'ai.translate.fillMissingHint', {
+                            base: baseLabel,
+                        }) })] }), mode === 'retranslate-all' && plan ? _jsx(RetranslatePlan, { plan: plan, base: base, collection: collection }) : null] }));
+}
+/** EC-752 rule 4 — what a re-translation will do, from its own pre-provider plan. */
+function RetranslatePlan({ plan, base, collection }) {
+    const baseLabel = localeChipLabel(base);
+    const replace = plan.buckets.filter((bucket) => bucket.kind === 'replace');
+    const fill = plan.buckets.filter((bucket) => bucket.kind === 'fill');
+    return (_jsxs(Stack, { gap: "2", "data-testid": "translate-plan", children: [replace.length > 0 ? (_jsx(TranslateBucketList, { title: translate('ai.translate.planReplaceTitle', { base: baseLabel, count: replace.length }), buckets: replace, collection: collection, testId: "translate-plan-replace" })) : (_jsx(Text, { size: "xs", tone: "muted", children: translate('ai.translate.planReplaceNone') })), _jsx(TranslateBucketList, { title: translate('ai.translate.planFillTitle', { base: baseLabel, count: fill.length }), buckets: fill, collection: collection, testId: "translate-plan-fill" }), _jsx(TranslateSkipped, { skipped: plan.skipped, collection: collection, mode: plan.mode, title: translate('ai.translate.planKeptTitle', { count: plan.skipped.length }) }), _jsxs(Stack, { gap: "px", children: [_jsx(Text, { size: "xs", tone: "muted", children: translate('ai.translate.planWhole') }), _jsx(Text, { size: "xs", tone: "muted", children: translate('ai.translate.planSlugsKept') }), replace.length > 0 ? (_jsx(Text, { size: "xs", tone: "muted", children: translate('ai.translate.planRestorePoint') })) : null] })] }));
+}
+/** The headline of the done phase (EC-752: mode-aware; slugs and replacements are listed below it). */
+export function translateDoneMessage(summary, base) {
+    const retranslate = summary.mode === 'retranslate-all';
+    const nothing = summary.plan.total === 0 && summary.skipped.length === 0 && summary.writes.length === 0 && summary.refused.length === 0;
+    if (nothing) {
+        return retranslate
+            ? translate('ai.translate.retranslateNothing', { base: localeChipLabel(base) })
+            : translate('ai.translate.nothing');
+    }
+    if (summary.cancelled)
+        return translate(retranslate ? 'ai.translate.retranslateCancelled' : 'ai.translate.cancelled');
+    if (retranslate)
+        return translate('ai.translate.retranslateDone');
+    return translate('ai.translate.applied', { count: summary.translated, locales: summary.locales });
+}
+/**
+ * EC-752 — the done phase: what was actually written (a re-translation lists what it
+ * replaced and filled), the slugs it set, what was refused at its revision, what a
+ * re-translation planned but left as it was, its restore point, and what was not translated.
+ */
+export function TranslateDoneSummary({ summary, base, collection, }) {
+    const retranslate = summary.mode === 'retranslate-all';
+    const of = (kind) => summary.writes.filter((write) => write.kind === kind);
+    const done = (bucket) => [...summary.writes, ...summary.refused].some((write) => write.field === bucket.field && write.locale === bucket.locale);
+    const kept = retranslate ? summary.plan.buckets.filter((bucket) => !done(bucket)) : [];
+    return (_jsxs(Stack, { gap: "2", className: "w-full", children: [_jsx(Text, { size: "sm", tone: "muted", className: "text-center", "data-testid": "translate-summary", children: translateDoneMessage(summary, base) }), retranslate ? (_jsxs(_Fragment, { children: [_jsx(TranslateBucketList, { title: translate('ai.translate.replacedTitle', { count: of('replace').length }), buckets: of('replace'), collection: collection, testId: "translate-replaced" }), _jsx(TranslateBucketList, { title: translate('ai.translate.filledTitle', { count: of('fill').length }), buckets: of('fill'), collection: collection, testId: "translate-filled" })] })) : null, _jsx(TranslateBucketList, { title: translate('ai.translate.slugsTitle', { count: of('slug').length }), buckets: of('slug'), collection: collection, testId: "translate-slugs" }), _jsx(TranslateBucketList, { title: translate('ai.translate.refusedTitle', { count: summary.refused.length }), buckets: summary.refused, collection: collection, testId: "translate-refused" }), _jsx(TranslateBucketList, { title: translate('ai.translate.keptTitle', { count: kept.length }), buckets: kept, collection: collection, testId: "translate-kept" }), summary.restorePoint !== undefined ? (_jsx(Text, { size: "xs", tone: "muted", "data-testid": "translate-restore-point", children: translate('ai.translate.restorePoint', { version: summary.restorePoint }) })) : null, _jsx(TranslateSkipped, { skipped: summary.skipped, collection: collection, mode: summary.mode })] }));
 }
 //# sourceMappingURL=translate-document-dialog.js.map