@elytracms/studio 0.0.80 → 0.0.82

package/convex/contract-parity.test.ts

@@ -225,7 +225,7 @@ describe('guard capability gates through the real functions (EC-150/EC-240c, Con
     await expect(
       viewer.cms.upsertDocument(PROJECT_ID, { collection: 'post', id: 'x', values: {} }),
     ).rejects.toThrow(/unauthorized/) // content.write denied
-    await expect(viewer.cliTokens.listTokens()).rejects.toThrow(/unauthorized/) // project.administer denied
+    await expect(viewer.users.listUsers(PROJECT_ID)).rejects.toThrow(/unauthorized/) // project.administer denied
 
     // An authenticated NON-member is rejected even on reads …
     await expect(forSubject('user_stranger').cms.listDocuments(PROJECT_ID)).rejects.toThrow(

package/convex/functions.ts

@@ -52,8 +52,18 @@ export const internalMutation = customMutation(
   internalMutationGeneric as MutationBuilder<DataModel, 'internal'>,
   customCtx(triggers.wrapDB),
 )
-/** Server-only reads (e.g. the EC-157 HTTP sync endpoints) — not callable by clients. */
+/**
+ * Server-only reads — not callable by clients. The mirror of `internalMutation`,
+ * kept as the symmetric half of the codegen-replacement builder set and as the
+ * builder a consumer reaches for when adding its own internal query.
+ * EC-481: the engine itself no longer declares one (its only user was the retired
+ * registry-sync snapshot).
+ */
 export const internalQuery = internalQueryGeneric as QueryBuilder<DataModel, 'internal'>
-/** HTTP action builder (EC-252) — used by the package's `http.ts`/`sync.ts`. Not
- * DataModel-bound: an action reaches data only through `ctx.runQuery`/`runMutation`. */
+/**
+ * HTTP action builder (EC-252). Not DataModel-bound: an action reaches data only
+ * through `ctx.runQuery`/`runMutation`.
+ * EC-481: the engine declares no HTTP action of its own any more (`http.ts` only
+ * mounts the consumer's auth routes); this stays for consumer-defined actions.
+ */
 export const httpAction = httpActionGeneric

package/convex/http-routes.test.ts

@@ -0,0 +1,143 @@
+import { describe, expect, it } from 'vitest'
+import { httpRouter } from 'convex/server'
+import type { HttpRouter, PublicHttpAction } from 'convex/server'
+import { defineStudioHttp } from './http'
+
+/**
+ * EC-481 — the studio's HTTP route table, pinned.
+ *
+ * `defineStudioHttp` used to add `GET /api/projects/*` (the EC-157 registry-sync
+ * endpoint). It was Bearer-authenticated, reachable on every deployment, and — after
+ * EC-470 deleted the `builder` CLI — had no client at all. Removing it is only half
+ * the job: the failure mode this file exists to prevent is a future edit quietly
+ * mounting a route again, or re-claiming that very broad prefix. Neither would break
+ * anything, which is exactly why nothing would catch it.
+ *
+ * The `auth` seam is injected (`{ addHttpRoutes }`), so these assertions isolate what
+ * the ENGINE contributes from what Convex Auth contributes — the real question. Every
+ * detector below is paired with a positive control (`AGENTS.md` §1.5): a recorder that
+ * observes nothing is indistinguishable from a router that registers nothing.
+ */
+
+/** An `auth` double that registers nothing — isolates the engine's own contribution. */
+const silentAuth = { addHttpRoutes: () => {} }
+
+/** A stand-in handler; the router only stores it. */
+const handler = (() => {}) as unknown as PublicHttpAction
+
+/** The route table as stable `"<METHOD> <path>"` strings, sorted. */
+function routeTable(http: HttpRouter): string[] {
+  return http
+    .getRoutes()
+    .map(([path, method]) => `${method} ${path}`)
+    .sort()
+}
+
+describe('defineStudioHttp — the engine registers no HTTP routes of its own (EC-481)', () => {
+  it('contributes an EMPTY route table beyond what the injected auth registers', () => {
+    expect(routeTable(defineStudioHttp({ auth: silentAuth }))).toEqual([])
+  })
+
+  it('control: the recorder DOES see routes, so the empty result above is real', () => {
+    const auth = {
+      addHttpRoutes: (http: HttpRouter) => {
+        http.route({ path: '/.well-known/jwks.json', method: 'GET', handler })
+        http.route({ pathPrefix: '/api/auth/callback/', method: 'POST', handler })
+      },
+    }
+    expect(routeTable(defineStudioHttp({ auth }))).toEqual([
+      'GET /.well-known/jwks.json',
+      'POST /api/auth/callback/*',
+    ])
+  })
+
+  it('passes the auth routes through untouched — nothing is added, dropped, or reordered', () => {
+    const registered: string[] = []
+    const auth = {
+      addHttpRoutes: (http: HttpRouter) => {
+        for (const path of ['/.well-known/openid-configuration', '/.well-known/jwks.json']) {
+          http.route({ path, method: 'GET', handler })
+          registered.push(`GET ${path}`)
+        }
+      },
+    }
+    expect(routeTable(defineStudioHttp({ auth }))).toEqual([...registered].sort())
+  })
+})
+
+describe('the /api/projects/ prefix is released (EC-481)', () => {
+  it('routes NOTHING under /api/projects/ — the request falls through to Convex 404', () => {
+    const http = defineStudioHttp({ auth: silentAuth })
+    // `lookup` is exactly what Convex's `runRequest` consults; `null` is the branch
+    // that answers `No HttpAction routed for <path>`.
+    expect(http.lookup('/api/projects/demo/registry-sync/snapshot', 'GET')).toBeNull()
+    expect(http.lookup('/api/projects/', 'GET')).toBeNull()
+    expect(http.lookup('/api/projects/anything-at-all', 'GET')).toBeNull()
+  })
+
+  it('control: the same lookup DOES resolve when something claims the prefix', () => {
+    const auth = {
+      addHttpRoutes: (http: HttpRouter) => {
+        http.route({ pathPrefix: '/api/projects/', method: 'GET', handler })
+      },
+    }
+    const http = defineStudioHttp({ auth })
+    expect(http.lookup('/api/projects/demo/registry-sync/snapshot', 'GET')).not.toBeNull()
+  })
+
+  it('no route the engine mounts may claim a prefix that swallows /api/projects/', () => {
+    const claims = routeTable(defineStudioHttp({ auth: silentAuth })).filter((route) =>
+      route.includes('/api/projects'),
+    )
+    expect(claims).toEqual([])
+  })
+})
+
+describe('auth routes are unaffected by the removal (EC-481)', () => {
+  it('leaves the /api/auth/* prefixes matching exactly as before', () => {
+    // The removed route was `/api/projects/`, which is neither a prefix of nor
+    // prefixed by any auth path — so Convex's longest-prefix-wins ordering cannot
+    // have changed for them. Asserted rather than argued.
+    const auth = {
+      addHttpRoutes: (http: HttpRouter) => {
+        http.route({ pathPrefix: '/api/auth/signin/', method: 'GET', handler })
+        http.route({ pathPrefix: '/api/auth/callback/', method: 'GET', handler })
+      },
+    }
+    const http = defineStudioHttp({ auth })
+    expect(http.lookup('/api/auth/signin/github', 'GET')?.[2]).toBe('/api/auth/signin/*')
+    expect(http.lookup('/api/auth/callback/github', 'GET')?.[2]).toBe('/api/auth/callback/*')
+    // …and the released prefix still resolves to nothing alongside them.
+    expect(http.lookup('/api/projects/demo', 'GET')).toBeNull()
+  })
+})
+
+describe('the registry-sync and CLI-token modules are gone, not merely unrouted (EC-481/EC-485)', () => {
+  // `import.meta.glob` is the module-enumeration pattern this directory already uses
+  // (`contract-parity.test.ts`). A literal `import('./sync')` cannot be used here: TS
+  // fails to *typecheck* a specifier that no longer resolves, so the assertion could
+  // never compile — the glob asks the same question without naming a missing module.
+  const convexModules = Object.keys(import.meta.glob('./*.ts'))
+
+  it('ships no `sync` module — a route can only come back from a handler that exists', () => {
+    expect(convexModules).not.toContain('./sync.ts')
+  })
+
+  it('ships no `cliTokens` module — the whole CLI-token path was retired (EC-485)', () => {
+    // The registry-sync endpoint was its only verifier (EC-481); with that gone the
+    // issuance path was inert and `cliTokens:byHash` was a public, unauthenticated
+    // query with an expired justification. Nothing addresses these functions any
+    // more — `ConvexCliTokenRepository` went with them, in the same change, because
+    // it named them by STRING and a half-rip would typecheck and fail at runtime.
+    expect(convexModules).not.toContain('./cliTokens.ts')
+  })
+
+  it('control: the glob DOES see this directory, so the absences above are real', () => {
+    expect(convexModules).toContain('./http.ts')
+    expect(convexModules).toContain('./users.ts')
+  })
+
+  it('control: `httpRouter()` itself is unchanged — an empty router really is empty', () => {
+    expect(routeTable(httpRouter())).toEqual([])
+  })
+})

package/convex/http.ts

@@ -1,6 +1,5 @@
 import { httpRouter } from 'convex/server'
 import type { HttpRouter } from 'convex/server'
-import { registrySync } from './sync'
 
 /** The slice of the Convex Auth object the studio's HTTP routes need. */
 interface AuthHttpRoutes {
@@ -8,23 +7,34 @@ interface AuthHttpRoutes {
 }
 
 /**
- * EC-252 — the studio's HTTP routes as a factory. `http`/`sync` are pure engine
- * infra, so they ship in the package; only the consumer's `auth` (provider choice)
- * is injected. The consumer's `convex/http.ts` is a two-liner:
+ * EC-252 — the studio's HTTP routes as a factory. Pure engine infra ships in the
+ * package; only the consumer's `auth` (provider choice) is injected. The consumer's
+ * `convex/http.ts` is a two-liner:
  *
  * ```ts
  * import { auth } from './auth'
  * export default defineStudioHttp({ auth })
  * ```
  *
- * Registers Convex Auth's JWT discovery endpoints (`/.well-known/*`, EC-150) plus the
- * EC-157 Bearer-token registry-sync endpoint. Convex routes by exact path or prefix
- * only, so the dynamic `/api/projects/:projectId/registry-sync/snapshot` segment is
- * parsed inside the action (`sync.ts`).
+ * ## The engine registers NO HTTP routes of its own (EC-481)
+ *
+ * Everything on this router comes from Convex Auth's `addHttpRoutes` — the JWT
+ * discovery endpoints (`/.well-known/*`, EC-150) and, only when a consumer supplies
+ * an OAuth provider, `/api/auth/signin/*` + `/api/auth/callback/*`.
+ *
+ * The engine used to add one more: `GET /api/projects/*`, the EC-157 Bearer-token
+ * registry-sync endpoint backing `builder typegen`/`builder check`. EC-470 deleted
+ * that CLI and with it the endpoint's only client; the handler had in any case
+ * answered with config-owned placeholders since EC-287 retired the project graph
+ * (`project: null`, `collections: []`). EC-481 removed the route and its handler
+ * together rather than leave a Bearer-authenticated surface serving stub data on
+ * every deployment. `http-routes.test.ts` pins that shut.
+ *
+ * A future engine-owned HTTP surface is fine — but it needs a real client and a
+ * narrower prefix than `/api/projects/`.
  */
 export function defineStudioHttp({ auth }: { auth: AuthHttpRoutes }): HttpRouter {
   const http = httpRouter()
   auth.addHttpRoutes(http)
-  http.route({ pathPrefix: '/api/projects/', method: 'GET', handler: registrySync })
   return http
 }

package/convex/redirect-revalidate.test.ts

@@ -0,0 +1,130 @@
+import { describe, expect, it } from 'vitest'
+import { convexTest } from 'convex-test'
+import { makeFunctionReference } from 'convex/server'
+import schema from './schema'
+
+/**
+ * EC-510 — the Convex half of "a redirect change must reach the live site".
+ *
+ * The browser dispatcher (`src/lib/webhooks`) is one emitter; the EC-286 write
+ * chokepoint is the other, and it is the one that catches writers the studio
+ * does not own. Before this ticket a redirect write reached the host by
+ * NEITHER, while a document publish reached it by both.
+ *
+ * This runs the REAL `redirects.save`/`redirects.remove` mutations through the
+ * REAL `functions.ts` trigger wrapper on `convex-test`'s in-memory backend, and
+ * asserts on the `_scheduled_functions` system table — the observable
+ * `scheduleRevalidate` actually produces (a mutation cannot `fetch`, so it hands
+ * the signed POST to the `webhooks:deliver` action).
+ *
+ * The env var is the gate `scheduleRevalidate` reads: an unconfigured
+ * deployment must stay a silent no-op, because publishing may never depend on a
+ * reachable host. Both sides are pinned here so neither can regress into the
+ * other.
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+
+// EC-223: the studio's convex functions address each other by STRING ref, never
+// a per-deployment `_generated/api` — the same addressing the tests use.
+const saveRedirect = makeFunctionReference<'mutation'>('redirects:save')
+const removeRedirect = makeFunctionReference<'mutation'>('redirects:remove')
+
+const SESSION_USER_ID = 'user_admin'
+const SCOPE = 'ec510-scope'
+
+async function freshBackend() {
+  const t = convexTest(schema, modules)
+  const now = new Date().toISOString()
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', {
+      userId: SESSION_USER_ID,
+      role: 'admin',
+      createdAt: now,
+      updatedAt: now,
+    })
+  })
+  return t
+}
+
+/** The scheduled `webhooks:deliver` calls, in order, as `{event, tags}`. */
+async function scheduledRevalidations(
+  t: Awaited<ReturnType<typeof freshBackend>>,
+): Promise<{ event: unknown; tags: unknown }[]> {
+  return t.run(async (ctx) => {
+    const rows = await ctx.db.system.query('_scheduled_functions').collect()
+    return rows
+      .filter((row) => row.name.startsWith('webhooks'))
+      .map((row) => {
+        const [args] = row.args as [{ event?: unknown; tags?: unknown }]
+        return { event: args?.event, tags: args?.tags }
+      })
+  })
+}
+
+function withScope<T>(scope: string | undefined, run: () => Promise<T>): Promise<T> {
+  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process
+    ?.env
+  const previous = env?.['CANVAS_PROJECT_SCOPE']
+  if (env) {
+    if (scope === undefined) delete env['CANVAS_PROJECT_SCOPE']
+    else env['CANVAS_PROJECT_SCOPE'] = scope
+  }
+  return run().finally(() => {
+    if (!env) return
+    if (previous === undefined) delete env['CANVAS_PROJECT_SCOPE']
+    else env['CANVAS_PROJECT_SCOPE'] = previous
+  })
+}
+
+const redirectArgs = {
+  redirectId: 'redirect_ec510_1',
+  from: '/old-page',
+  to: '/blog/hello',
+  permanent: true,
+  enabled: true,
+  createdAt: '2026-08-01T00:00:00.000Z',
+  updatedAt: '2026-08-01T00:00:00.000Z',
+}
+
+describe('EC-510 — the write chokepoint revalidates on every redirect write', () => {
+  it('schedules a project sweep on create, retarget, disable, and delete', async () => {
+    await withScope(SCOPE, async () => {
+      const t = await freshBackend()
+      const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
+
+      await asAdmin.mutation(saveRedirect, redirectArgs)
+      await asAdmin.mutation(saveRedirect, { ...redirectArgs, to: '/blog/second' })
+      // Pausing a redirect stops it serving (`delivery.ts` keeps only `enabled`
+      // rows), so it is as much a routing change as a delete.
+      await asAdmin.mutation(saveRedirect, { ...redirectArgs, enabled: false })
+      await asAdmin.mutation(removeRedirect, { redirectId: redirectArgs.redirectId })
+
+      expect(await scheduledRevalidations(t)).toEqual([
+        { event: 'redirects.save', tags: [`p:${SCOPE}:project`] },
+        { event: 'redirects.save', tags: [`p:${SCOPE}:project`] },
+        { event: 'redirects.save', tags: [`p:${SCOPE}:project`] },
+        { event: 'redirects.remove', tags: [`p:${SCOPE}:project`] },
+      ])
+    })
+  })
+
+  it('stays a silent no-op on a deployment with no CANVAS_PROJECT_SCOPE', async () => {
+    await withScope(undefined, async () => {
+      const t = await freshBackend()
+      const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
+      await asAdmin.mutation(saveRedirect, redirectArgs)
+      // The known-positive control is the test above: the same call on the same
+      // harness DOES schedule when the scope is configured, so this empty result
+      // is the gate working rather than the instrument being blind.
+      expect(await scheduledRevalidations(t)).toEqual([])
+      // The write itself still happened — silence is at the webhook, not the save.
+      expect(
+        await t.run(async (ctx) => (await ctx.db.query('redirects').collect()).length),
+      ).toBe(1)
+    })
+  })
+})

package/convex/revalidate.ts

@@ -19,15 +19,17 @@ const webhooksDeliver = makeFunctionReference<'action'>('webhooks:deliver')
  * var. An unconfigured deployment (local dev, no env) is a silent no-op —
  * publishing must never depend on a reachable host.
  *
- * Shared by BOTH graph publish (`publishing.ts`) and CMS **document** publish
- * (`cms.ts`). A content-only site never touches the graph, so without the
- * document-publish call instant-publish silently never fires for it (the
- * footgun this consolidates away).
+ * Called from the EC-286 write-chokepoint triggers only (`triggers.ts`), so
+ * every writer of a live-wire table is covered by construction: `cmsDocuments`
+ * when the published pin moves, and `redirects` on any write (EC-510 — a
+ * saved+enabled redirect IS the live state, with no draft/published split).
  *
  * Doc/collection-scoped tags (matching the client dispatcher's
- * `webhookTagsForEvent`) would be more surgical, but need the project locales —
- * not available in the Convex env here. The sweep is the honest, reliable v1;
- * threading scoped tags is a precision follow-up.
+ * `webhookTagsForEvent`) would be more surgical for DOCUMENTS, but need the
+ * project locales — not available in the Convex env here. The sweep is the
+ * honest, reliable v1; threading scoped tags is a precision follow-up. For
+ * redirects the sweep is not a compromise but the correct answer — see
+ * `ROUTING_OPERATIONS` in `src/lib/webhooks/tags.ts`.
  */
 export async function scheduleRevalidate(ctx: MutationCtx, event: string): Promise<void> {
   const env =

package/convex/schema.ts

@@ -109,25 +109,6 @@ export default defineSchema({
     at: v.string(),
   }).index('by_time', ['at']),
 
-  /**
-   * Revocable CLI sync tokens (EC-150, consumed by the EC-147 push CLI).
-   * Only the SHA-256 hash of a token is ever stored; revoked tokens keep
-   * their row (with `revokedAt`) for auditability.
-   *
-   * Single-tenant (EC-182/EC-183): a deployment hosts one project, so a token
-   * carries no per-project scope — `projectId` is gone (it was `optional`
-   * through EC-182; this drops the field now that both deployments are migrated).
-   */
-  cliTokens: defineTable({
-    tokenId: v.string(),
-    label: v.string(),
-    tokenHash: v.string(),
-    createdAt: v.string(),
-    revokedAt: v.optional(v.string()),
-  })
-    .index('by_token', ['tokenId'])
-    .index('by_hash', ['tokenHash']),
-
   /**
    * CMS documents (EC-043). The stored `document` is the continuous working
    * **draft**; `publishedVersion` pins which `documentVersions` row is live

package/convex/triggers.ts

@@ -21,9 +21,11 @@ import { scheduleRevalidate } from './revalidate'
  * via `customMutation(…, customCtx(triggers.wrapDB))`. `referenceEntries` has no
  * trigger, so the index writes these derivations perform never recurse.
  *
- * EC-287 retired the DB-resident project graph and its publish path, so this is
- * now the SINGLE `cmsDocuments` trigger — one publish path, the dual-path footgun
- * gone at the source (the EC-146 revalidation gap is now impossible by construction).
+ * EC-287 retired the DB-resident project graph and its publish path, so
+ * `cmsDocuments` is the SINGLE document trigger — one publish path, the
+ * dual-path footgun gone at the source. EC-510 added `redirects`, the other
+ * table whose rows go straight onto the live wire; both are registered here so
+ * "which writes reach the host" has one place to read.
  */
 export const triggers = new Triggers<DataModel>()
 
@@ -62,3 +64,31 @@ triggers.register('cmsDocuments', async (ctx, change) => {
     await scheduleRevalidate(ctx, after === undefined ? 'documents.unpublish' : 'documents.publish')
   }
 })
+
+/**
+ * Editorial redirects (EC-303 → EC-510). Every *enabled* redirect row is
+ * projected into the delivery snapshot the router and `resolvePage` consume, in
+ * BOTH perspectives (`delivery.ts`), so any write here changes published output
+ * — and unlike a document there is no draft/published split to gate on: the
+ * write IS the live state.
+ *
+ * Why this exists at all (EC-510): the studio's browser dispatcher
+ * (`src/lib/webhooks`) never carried the redirect operations either, so before
+ * this a redirect change reached the host by **no** path while a document
+ * publish reached it by two — measured 2026-08-01, five redirect writes on a
+ * connected studio delivered zero webhooks, and a production host kept serving
+ * the routing it had cached before the redirect existed. This trigger is the
+ * half that catches every writer by construction (EC-286): a CLI import, a
+ * future automation API, or any new mutation that forgets to call a helper.
+ *
+ * The tag is `scheduleRevalidate`'s whole-project sweep, which is also the right
+ * granularity here rather than merely the available one — `ROUTING_OPERATIONS`
+ * in `src/lib/webhooks/tags.ts` records why a targeted `route:<from>:<locale>`
+ * tag cannot be correct. Every write fires, including a save that changed
+ * nothing: the trigger cannot cheaply prove a no-op, and a redirect save is an
+ * explicit editorial action, not a keystroke (EC-501's cost argument does not
+ * transfer).
+ */
+triggers.register('redirects', async (ctx, change) => {
+  await scheduleRevalidate(ctx, change.operation === 'delete' ? 'redirects.remove' : 'redirects.save')
+})

package/convex/users.ts

@@ -42,7 +42,7 @@ export const me = query({
  * onto `@elytracms/core/persistence` `UserRecord`s.
  *
  * Admin-only, server-side: the list exposes every member's email + role — an
- * administration concern (like `cliTokens:list`), not a content read. UI gating
+ * administration concern (like `invites:list`), not a content read. UI gating
  * alone is never trusted.
  */
 

package/dist/components/ai/ai-chat-panel.js

@@ -9,10 +9,9 @@ import { translate } from '@elytracms/studio/lib/i18n';
 import { STUDIO_PROJECT_ROUTE, studioPath, useNavigate } from '@elytracms/studio/router';
 import { resolveDeploymentAi } from '@elytracms/studio/lib/workspace';
 import { getStudioOperations } from '@elytracms/studio/lib/operations';
-import { DEFAULT_MAX_STEPS, buildChatContext, chatReviewReducer, clearConversation, createChatCandidateStore, createChatToolExecutor, initialChatReviewState, renderCurrentDocumentSection, resolveAiConfig, resolveChatTarget, resolveKnowledge, withStepCap, } from '@elytracms/studio/lib/ai';
+import { DEFAULT_MAX_STEPS, buildChatContext, chatReviewReducer, clearConversation, createChatCandidateStore, createChatToolExecutor, initialChatReviewState, introducedErrors, renderCurrentDocumentSection, resolveAiConfig, resolveChatTarget, resolveKnowledge, withStepCap, } from '@elytracms/studio/lib/ai';
 import { getAiCurrentDocument } from '@elytracms/studio/lib/ai-current-document';
 import { useCms } from '../cms/cms-store.js';
-import { validateComposition, validateRichTextEmbeds } from '../cms/cms-composition-validators.js';
 import { AssistantTurn, ChatErrorNote, Conversation, ConversationEmpty, PromptInput, ToolStatus, UserTurn, WorkingIndicator, describeToolPart, messageText, segmentMessageParts, } from './chat-ui.js';
 import { ProposalCard } from './proposal-card.js';
 import { setAiPanelOpen } from '@elytracms/studio/lib/ai-panel';
@@ -202,8 +201,11 @@ export function AiChatPanel() {
             currentDocument: () => getAiCurrentDocument(),
             locale: activeLocale,
             ...(cms.localeConfig ? { localeConfig: cms.localeConfig } : {}),
-            validateRichTextEmbeds,
-            validateComposition,
+            // EC-473 established that the assistant must validate with the EDITOR's
+            // rules, not a subset. EC-497 hands over THE bag itself — one value, built
+            // once by `gateValidateOptions` — so the assistant's gate and the editor's
+            // gate cannot drift by someone forgetting a key at a call site.
+            validateOptions: cms.validateOptions,
             ...(maxRepairAttempts !== undefined ? { maxRepairAttempts } : {}),
         });
     }, [
@@ -211,6 +213,7 @@ export function AiChatPanel() {
         registry,
         cms.collections,
         cms.localeConfig,
+        cms.validateOptions,
         readers,
         mintDocumentId,
         activeLocale,
@@ -288,6 +291,25 @@ export function AiChatPanel() {
             values: proposal.patch.values,
             ...(proposal.patch.localized ? { localized: proposal.patch.localized } : {}),
         };
+        // EC-473 — re-validate BEFORE the write. The proposal was validated when it was
+        // built, but the editor may have changed the document since (or applied an
+        // earlier proposal on top of it), so the patch is re-judged against what is in
+        // the session NOW. Same gate as every other AI write path: only errors the
+        // apply would INTRODUCE block it — pre-existing brokenness on the document is
+        // not the assistant's doing and must not make an unrelated change unappliable.
+        const introduced = introducedErrors(existing ? cms.validate(existing) : [], cms.validate(doc));
+        if (introduced.length > 0) {
+            dispatch({
+                type: 'fail',
+                message: translate('ai.error.applyInvalid', {
+                    issues: introduced
+                        .slice(0, 3)
+                        .map((issue) => issue.message)
+                        .join('; '),
+                }),
+            });
+            return;
+        }
         const { operations } = await getStudioOperations();
         const upserted = await operations.documents.upsert({ projectId, document: doc });
         if (!upserted.ok) {