@elytracms/studio 0.0.94 → 0.0.95

package/convex/asset-alt-migration.test.ts

@@ -80,7 +80,7 @@ describe('EC-587 — assets:liftLegacyAlt moves the legacy column home, once', (
   it('lifts the column into meta.alt (meta.alt wins when both), unsets it, and keeps every alt reading', async () => {
     const t = await seededBackend()
     const before = await storedRows(t)
-    expect(Object.fromEntries(Object.entries(before).map(([id, r]) => [id, assetAlt(r)]))).toEqual(READ_BEFORE)
+    expect(Object.fromEntries(Object.entries(before).map(([id, r]) => [id, assetAlt(r, null)]))).toEqual(READ_BEFORE)
 
     const report = (await t.mutation(liftLegacyAlt, {})) as { scanned: number; lifted: string[] }
     expect(report.scanned).toBe(4)
@@ -94,7 +94,7 @@ describe('EC-587 — assets:liftLegacyAlt moves the legacy column home, once', (
       expect(measureMaxDepth(stored.meta).depth).toBeLessThanOrEqual(16)
     }
     // The lift changes no reading: every alt is what it was.
-    expect(Object.fromEntries(Object.entries(after).map(([id, r]) => [id, assetAlt(r)]))).toEqual(READ_BEFORE)
+    expect(Object.fromEntries(Object.entries(after).map(([id, r]) => [id, assetAlt(r, null)]))).toEqual(READ_BEFORE)
   })
 
   it('is idempotent: a second run lifts nothing and writes nothing', async () => {

package/convex/asset-meta-patch.test.ts

@@ -0,0 +1,218 @@
+import { readFileSync } from 'node:fs'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import type { FunctionReference } from 'convex/server'
+import { defaultAssetCollection, measureMaxDepth } from '@elytracms/core/cms-core'
+import { InMemoryBlobStorage, InMemoryPersistenceAdapter, PersistenceValidationError, assetAlt } from '@elytracms/core/persistence'
+import type { AssetRepository } from '@elytracms/core/persistence'
+import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
+import { runUpload } from '../src/lib/assets/upload'
+import {
+  assetMetaDraft,
+  assetMetaDraftPatch,
+  setAssetMetaField,
+  updateAssetMetadata,
+} from '../src/components/assets/asset-metadata'
+import schema from './schema'
+
+// convex-test fires a `runAfter(0)` on a REAL timer; fake timers keep the scheduled
+// revalidation queued (its row written, the `webhooks:deliver` fetch never fired).
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * EC-634 — an asset's `meta` is written per key, inside the mutation, on BOTH adapters:
+ * two sessions (two adapters over ONE backend — two studio tabs on one deployment) whose
+ * dialog saves interleave keep both keys; a dialog save landing while a file replace is in
+ * flight survives the replace; a not-yet-migrated legacy `alt` column is lifted into the
+ * stored bag by the same transaction. convex-test serialises mutations, so this proves the
+ * per-key MERGE in `assets:upsert`, not Convex's OCC retry (which re-runs the same handler
+ * against the newer row — the merge is what makes that retry correct).
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+
+const PROJECT_ID = 'asset-meta-patch'
+const SESSION_USER_ID = 'user_admin'
+const STAMP = '2026-10-27T00:00:00.000Z'
+
+async function convexBackend() {
+  const t = convexTest(schema, modules)
+  const now = new Date().toISOString()
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: SESSION_USER_ID, role: 'admin', createdAt: now, updatedAt: now })
+  })
+  const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
+  const session = () =>
+    new ConvexPersistenceAdapter(
+      {
+        query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin.query(ref, args ?? {}),
+        mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) =>
+          asAdmin.mutation(ref, args ?? {}),
+      } as unknown as ConvexHttpClient,
+      PROJECT_ID,
+    ).assets
+  return { t, a: session(), b: session() }
+}
+
+function memoryBackend() {
+  const adapter = new InMemoryPersistenceAdapter()
+  return { a: adapter.assets, b: adapter.assets }
+}
+
+async function seed(assets: AssetRepository, meta: Record<string, unknown>) {
+  await assets.upsertAsset(PROJECT_ID, {
+    id: 'hero',
+    filename: 'hero.jpg',
+    contentType: 'image/jpeg',
+    byteSize: 1,
+    storageKey: 'blob_old',
+    url: 'https://assets.test/old.jpg',
+    meta,
+  })
+}
+
+async function openDialog(assets: AssetRepository) {
+  const opened = assetMetaDraft(await assets.getAsset(PROJECT_ID, 'hero'))
+  let draft = opened
+  return {
+    edit: (key: string, value: unknown) => {
+      draft = setAssetMetaField(draft, { name: key }, null, value)
+    },
+    commit: () => updateAssetMetadata({ assets }, PROJECT_ID, 'hero', assetMetaDraftPatch(opened, draft)),
+  }
+}
+
+/** Two dialogs open on one asset, each edits one key, the commits interleave. */
+async function interleavedDialogs({ a, b }: { a: AssetRepository; b: AssetRepository }) {
+  await seed(a, { alt: 'old alt', credit: 'old credit' })
+  const dialogA = await openDialog(a)
+  const dialogB = await openDialog(b)
+  dialogA.edit('alt', 'A alt')
+  dialogB.edit('credit', 'B credit')
+  expect((await dialogA.commit()).ok).toBe(true)
+  expect((await dialogB.commit()).ok).toBe(true)
+  return (await b.getAsset(PROJECT_ID, 'hero')).meta
+}
+
+const iptcJpeg = new Uint8Array(
+  readFileSync(new URL('../../core/src/cms-core/__fixtures__/embedded-metadata/iptc-xmp.jpg', import.meta.url)),
+)
+
+/** A replace whose read is followed — before its write — by another session's dialog save. */
+async function replaceRacingADialog({ a, b }: { a: AssetRepository; b: AssetRepository }) {
+  await seed(a, { alt: 'old alt', note: 'old note' })
+  const dialogB = await openDialog(b)
+  dialogB.edit('note', 'B note')
+  const racing: AssetRepository = {
+    // B's dialog commits at the worst moment: right before A's replace writes.
+    upsertAsset: async (projectId, input) => {
+      await dialogB.commit()
+      return a.upsertAsset(projectId, input)
+    },
+    getAsset: (projectId, id) => a.getAsset(projectId, id),
+    listAssets: (projectId) => a.listAssets(projectId),
+    removeAsset: (projectId, id) => a.removeAsset(projectId, id),
+    resolveMany: (projectId, ids) => a.resolveMany(projectId, ids),
+    findAsset: (projectId, id) => a.findAsset(projectId, id),
+  }
+  const result = await runUpload(
+    {
+      blobs: new InMemoryBlobStorage(),
+      assets: racing,
+      assetFields: defaultAssetCollection().fields,
+      detectDimensions: async () => ({ width: 8, height: 6 }),
+      generateVariants: async () => ({}),
+    },
+    {
+      projectId: PROJECT_ID,
+      file: {
+        name: 'new.jpg',
+        type: 'image/jpeg',
+        size: iptcJpeg.byteLength,
+        arrayBuffer: async () => iptcJpeg.slice().buffer as ArrayBuffer,
+      },
+      replace: { assetId: 'hero' },
+    },
+  )
+  expect(result.ok).toBe(true)
+  return (await a.getAsset(PROJECT_ID, 'hero')).meta
+}
+
+describe('EC-634 — asset meta is patched per key in the write, on both adapters', () => {
+  it('two sessions’ interleaved dialog saves of different keys keep both (the worst row)', async () => {
+    const expected = { alt: 'A alt', credit: 'B credit' }
+    expect(await interleavedDialogs(memoryBackend())).toEqual(expected)
+    expect(await interleavedDialogs(await convexBackend())).toEqual(expected)
+  })
+
+  it('a dialog save landing just before a replace’s write survives the replace', async () => {
+    const memory = await replaceRacingADialog(memoryBackend())
+    const convex = await replaceRacingADialog(await convexBackend())
+    expect(convex).toEqual(memory)
+    expect(convex).toMatchObject({ alt: 'A harbour at dusk & boats', note: 'B note' })
+  })
+
+  it('a patch lifts a not-yet-migrated legacy alt column into the stored bag, in the same mutation', async () => {
+    const { t, a } = await convexBackend()
+    await t.run(async (ctx) => {
+      await ctx.db.insert('assets', {
+        assetId: 'legacy',
+        filename: 'l.jpg',
+        contentType: 'image/jpeg',
+        byteSize: 1,
+        storageKey: 'k_legacy',
+        alt: 'Column alt',
+        createdAt: STAMP,
+        updatedAt: STAMP,
+      })
+    })
+    // An edit of ANOTHER key: the alt it did not name moves home and is kept.
+    const kept = await a.upsertAsset(PROJECT_ID, { id: 'legacy', metaPatch: { credit: 'Ada' } })
+    expect(kept.meta).toEqual({ alt: 'Column alt', credit: 'Ada' })
+    expect(kept.alt).toBeUndefined()
+    expect(assetAlt(kept, null)).toBe('Column alt')
+    // A clear of the alt stays cleared — no column left to re-surface it (ASSETS D21).
+    const cleared = await a.upsertAsset(PROJECT_ID, { id: 'legacy', metaPatch: { alt: null } })
+    expect(assetAlt(cleared, null)).toBeNull()
+    const row = await t.run((ctx) => ctx.db.query('assets').filter((q) => q.eq(q.field('assetId'), 'legacy')).first())
+    expect(row?.alt).toBeUndefined()
+    expect(row?.meta).toEqual({ credit: 'Ada' })
+  })
+
+  it('EC-632 — per-locale buckets are stored by the real mutation, and the stored row measures its depth', async () => {
+    const { t, a, b } = await convexBackend()
+    await seed(a, { credit: 'Ada' })
+    // Two translators, two sessions, interleaved: both locales are kept.
+    await a.upsertAsset(PROJECT_ID, { id: 'hero', localizedMetaPatch: { de: { alt: 'Hafen' } } })
+    await b.upsertAsset(PROJECT_ID, {
+      id: 'hero',
+      localizedMetaPatch: { en: { alt: 'Harbour', disclosure: { shown: true, badge: { corner: 'tl', tone: 'dark' } } } },
+    })
+    const row = await t.run((ctx) => ctx.db.query('assets').filter((q) => q.eq(q.field('assetId'), 'hero')).first())
+    expect(row?.localizedMeta).toEqual({
+      de: { alt: 'Hafen' },
+      en: { alt: 'Harbour', disclosure: { shown: true, badge: { corner: 'tl', tone: 'dark' } } },
+    })
+    expect(row?.meta).toEqual({ credit: 'Ada' })
+    // The stored Convex document (system fields included): 5 of Convex's 16 levels.
+    expect(measureMaxDepth(row).depth).toBe(5)
+  })
+
+  it('refuses meta and metaPatch together, through the rule (a PersistenceValidationError naming metaPatch)', async () => {
+    const { a } = await convexBackend()
+    await seed(a, { alt: 'x' })
+    await expect(
+      a.upsertAsset(PROJECT_ID, { id: 'hero', meta: { alt: 'y' }, metaPatch: { credit: 'z' } }),
+    ).rejects.toBeInstanceOf(PersistenceValidationError)
+    expect((await a.getAsset(PROJECT_ID, 'hero')).meta).toEqual({ alt: 'x' })
+  })
+})

package/convex/asset-replace-delete-race.test.ts

@@ -0,0 +1,127 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import type { FunctionReference } from 'convex/server'
+import { InMemoryBlobStorage, InMemoryPersistenceAdapter } from '@elytracms/core/persistence'
+import type { AssetRepository } from '@elytracms/core/persistence'
+import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
+import { runUpload } from '../src/lib/assets/upload'
+import schema from './schema'
+
+// convex-test fires a `runAfter(0)` on a REAL timer; fake timers keep the scheduled
+// revalidation queued (its row written, the `webhooks:deliver` fetch never fired).
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * EC-634 follow-on — a replace is an UPDATE of a stored asset, never a create. Session A
+ * replaces the file; session B deletes the asset in the window between A's check and A's
+ * write. The replace used to carry every column a create needs, so it silently RE-CREATED
+ * the asset B had deleted (a colleague's delete undone). Two sessions over ONE backend,
+ * in-memory AND Convex (the real `assets:upsert` over convex-test).
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+
+const PROJECT_ID = 'asset-replace-race'
+const SESSION_USER_ID = 'user_admin'
+
+async function convexSessions() {
+  const t = convexTest(schema, modules)
+  const now = new Date().toISOString()
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: SESSION_USER_ID, role: 'admin', createdAt: now, updatedAt: now })
+  })
+  const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
+  const session = () =>
+    new ConvexPersistenceAdapter(
+      {
+        query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin.query(ref, args ?? {}),
+        mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) =>
+          asAdmin.mutation(ref, args ?? {}),
+      } as unknown as ConvexHttpClient,
+      PROJECT_ID,
+    ).assets
+  return { a: session(), b: session() }
+}
+
+function memorySessions() {
+  const adapter = new InMemoryPersistenceAdapter()
+  return { a: adapter.assets, b: adapter.assets }
+}
+
+/** A's replace, with B's delete landing right after A checked that the asset exists. */
+async function replaceRacingADelete({ a, b }: { a: AssetRepository; b: AssetRepository }) {
+  await a.upsertAsset(PROJECT_ID, {
+    id: 'hero',
+    filename: 'old.jpg',
+    contentType: 'image/jpeg',
+    byteSize: 1,
+    storageKey: 'blob_old',
+    url: 'https://assets.test/old.jpg',
+  })
+  // B's delete lands immediately before A's write — after anything A checked or read.
+  const racing: AssetRepository = {
+    upsertAsset: async (projectId, input) => {
+      await b.removeAsset(projectId, 'hero')
+      return a.upsertAsset(projectId, input)
+    },
+    getAsset: (projectId, id) => a.getAsset(projectId, id),
+    listAssets: (projectId) => a.listAssets(projectId),
+    removeAsset: (projectId, id) => a.removeAsset(projectId, id),
+    resolveMany: (projectId, ids) => a.resolveMany(projectId, ids),
+    findAsset: (projectId, id) => a.findAsset(projectId, id),
+  }
+  const result = await runUpload(
+    {
+      blobs: new InMemoryBlobStorage(),
+      assets: racing,
+      detectDimensions: async () => ({ width: 8, height: 6 }),
+      generateVariants: async () => ({}),
+    },
+    {
+      projectId: PROJECT_ID,
+      file: { name: 'new.jpg', type: 'image/jpeg', size: 3, arrayBuffer: async () => new Uint8Array([1, 2, 3]).buffer },
+      replace: { assetId: 'hero' },
+    },
+  )
+  return { result, stored: await b.findAsset(PROJECT_ID, 'hero') }
+}
+
+describe('EC-634 follow-on — a replace never re-creates an asset another session deleted', () => {
+  for (const [name, backend] of [
+    ['in-memory', async () => memorySessions()],
+    ['Convex', convexSessions],
+  ] as const) {
+    it(`${name}: the replace is refused, visibly, and the delete stands`, async () => {
+      const { result, stored } = await replaceRacingADelete(await backend())
+      expect(stored).toBeUndefined()
+      expect(result.ok).toBe(false)
+      if (!result.ok) {
+        expect(result.failure.stage).toBe('confirm')
+        expect(result.failure.message).toContain('hero')
+      }
+    })
+  }
+
+  it('control: without the delete the replace lands (same id, the new file)', async () => {
+    const { a } = memorySessions()
+    await a.upsertAsset(PROJECT_ID, { id: 'hero', filename: 'old.jpg', contentType: 'image/jpeg', byteSize: 1 })
+    const result = await runUpload(
+      { blobs: new InMemoryBlobStorage(), assets: a, detectDimensions: async () => undefined, generateVariants: async () => ({}) },
+      {
+        projectId: PROJECT_ID,
+        file: { name: 'new.jpg', type: 'image/jpeg', size: 3, arrayBuffer: async () => new Uint8Array([1, 2, 3]).buffer },
+        replace: { assetId: 'hero' },
+      },
+    )
+    expect(result.ok && result.asset).toMatchObject({ id: 'hero', filename: 'new.jpg' })
+  })
+})

package/convex/assets.ts

@@ -25,8 +25,9 @@ const clearable = <T, F extends string>(validator: Validator<T, 'required', F>)
 /**
  * Write one asset (EC-577). The ONE write rule (`resolveAssetWrite`, shared with
  * the in-memory adapter) runs here, inside the transaction: a column absent from
- * the args keeps its stored value, `null` clears it, a value sets it — and the legacy
- * `alt` column can only be cleared (EC-587: an asset's alt is `meta.alt`). An edit is
+ * the args keeps its stored value, `null` clears it, a value sets it — the legacy
+ * `alt` column can only be cleared (EC-587: an asset's alt is `meta.alt`), and a
+ * `metaPatch` changes `meta` per key against the row read here (EC-634). An edit is
  * ONE `db.patch` — the rule's store patch, where a cleared column is `undefined`,
  * which `db.patch` removes — so the write-chokepoint triggers fire once. No stored
  * asset → ONE `db.insert` of the complete row (the `defaults` fill what the write
@@ -65,6 +66,30 @@ export const upsert = mutation({
     lqip: clearable(v.string()),
     /** Schema-driven asset metadata bag (EC-301): alt, copyright, credit, …. `null` clears it. */
     meta: v.optional(v.any()),
+    /**
+     * EC-634 — a per-key change to `meta` (a value sets the key, `null` removes it), applied
+     * by the rule to the row as stored HERE, in this transaction — so an editor's save never
+     * carries a stale copy of a key another session changed. Validated by the rule (an
+     * object of keys, never beside `meta`), as `meta` is.
+     */
+    metaPatch: v.optional(v.any()),
+    /**
+     * EC-632 — the per-locale buckets of the asset collection's `localized: true` fields
+     * (`{ [locale]: { [field]: value } }`): `null` clears them, an object replaces them
+     * whole (a create, an import); an editor sends `localizedMetaPatch` instead.
+     */
+    localizedMeta: v.optional(v.any()),
+    /**
+     * EC-632 — a per-locale, per-key change to those buckets, applied by the rule to the
+     * row as stored HERE (as `metaPatch` is to `meta`). Validated by the rule.
+     */
+    localizedMetaPatch: v.optional(v.any()),
+    /**
+     * EC-634 follow-on — this write only UPDATES a stored asset (a file replace): with the
+     * row gone (deleted by another session) the rule refuses it here, so it never re-creates
+     * what a colleague deleted.
+     */
+    mustExist: v.optional(v.boolean()),
     /**
      * What a CREATE fills in when the write leaves it absent (`assetCreateDefaults`
      * in core). Sent by the adapter because only it knows the project — rows carry

package/convex/delivery-redirects.test.ts

@@ -0,0 +1,167 @@
+import { describe, expect, it } from 'vitest'
+import { convexTest } from 'convex-test'
+import { makeFunctionReference } from 'convex/server'
+import type { FunctionReference } from 'convex/server'
+import type { ConvexHttpClient } from 'convex/browser'
+// The host's two readers, from their own modules — the package index also loads the React
+// delivery kit, which the edge-runtime environment cannot evaluate.
+import { assembleLiveSource } from '../../next/src/host-content'
+import { createContentSnapshot } from '../../next/src/snapshot'
+import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
+import schema from './schema'
+
+/**
+ * The delivery snapshot's redirect strand, end to end: rows stored in the deployment's
+ * `records` table (kind `redirect`) → the REAL `delivery:snapshot` query (convex-test) →
+ * the REAL host loader (`assembleLiveSource`, `@elytracms/next`).
+ *
+ * EC-628 (Codex F04, `tasks/codex-review-2026-10-27/backend.convex.test.ts` "F04 upstream"):
+ * the record store's open data bag accepts drift the normal CRUD refuses (a dashboard edit,
+ * an older writer). Before, an enabled row with `to: 42` was SERVED by the snapshot and
+ * vanished in the host with zero issues, and a switch that is not a boolean was decided by
+ * truthiness (`'false'` served, a missing switch silently paused). Now the snapshot reads
+ * every stored redirect through the one rule (`readLiveRedirects`): what it cannot read is
+ * withheld and reported on the snapshot's `redirectIssues` strand, which the host carries
+ * into its `sourceIssues` and onto the 404 at the redirect's `from`.
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+const snapshot = makeFunctionReference<'query'>('delivery:snapshot')
+
+const AT = '2026-10-27T12:00:00.000Z'
+const LOCALES = { default: 'en', locales: ['en'] }
+
+/** Insert redirect rows as the record store holds them — raw, as drift reaches it. */
+async function deploymentWith(rows: ReadonlyArray<{ id: string; data: Record<string, unknown> }>) {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    for (const row of rows) {
+      await ctx.db.insert('records', { kind: 'redirect', recordId: row.id, data: row.data, at: AT, createdAt: AT, updatedAt: AT })
+    }
+  })
+  return t
+}
+
+const redirect = (id: string, data: Record<string, unknown> = {}) => ({
+  id,
+  data: { from: `/${id}`, to: '/target', permanent: true, enabled: true, ...data },
+})
+
+describe('EC-628 — the snapshot names every stored redirect it cannot serve', () => {
+  it('drift is withheld and reported upstream, then located by the host (F04 + disabled-state drift)', async () => {
+    const t = await deploymentWith([
+      redirect('good'),
+      redirect('bad', { to: 42 }), // F04's row
+      redirect('paused', { enabled: false }), // a paused redirect: not live, not a finding
+      redirect('string-off', { enabled: 'false' }), // truthy: was SERVED before
+      { id: 'no-switch', data: { from: '/no-switch', to: '/target', permanent: true } }, // falsy: was silently paused
+    ])
+    const payload = (await t.query(snapshot, { projectId: 'site' })) as {
+      redirects: unknown[]
+      redirectIssues: Array<{ code: string; path: unknown[] }>
+    }
+    expect(payload.redirects).toEqual([{ id: 'good', from: '/good', to: '/target', permanent: true }])
+    expect(payload.redirectIssues.map((issue) => [issue.code, issue.path])).toEqual([
+      ['invalid-redirect', ['redirects', 'bad']],
+      ['invalid-redirect', ['redirects', 'no-switch']],
+      ['invalid-redirect', ['redirects', 'string-off']],
+    ])
+
+    const client = assembleLiveSource(payload as never, { locales: LOCALES, collections: [], routes: [] }, 'published').client({
+      perspective: 'published',
+    })
+    // Control: the readable redirect traverses the whole pipeline, with no issue.
+    expect(client.resolvePage('/good').status).toBe('redirect')
+    expect(client.resolvePage('/good').issues).toEqual([])
+    expect(client.sourceIssues.map((issue) => issue.path[1])).toEqual(['bad', 'no-switch', 'string-off'])
+    for (const path of ['/bad', '/string-off', '/no-switch']) {
+      const result = client.resolvePage(path)
+      expect(result.status).toBe('notFound')
+      expect(result.issues.map((issue) => issue.code)).toEqual(['invalid-redirect'])
+    }
+    // The paused redirect is a 404 with nothing to say — pausing is not drift.
+    expect(client.resolvePage('/paused').status).toBe('notFound')
+    expect(client.resolvePage('/paused').issues).toEqual([])
+  })
+})
+
+/**
+ * EC-627 — "which redirects are live" is decided by ONE reader on every side. The same
+ * stored set is read (1) by the Convex delivery snapshot (`delivery:snapshot`, through
+ * `readLiveRedirects`) and assembled by the host's live loader, and (2) by the host's OTHER
+ * reader, `createContentSnapshot` (`next/src/snapshot.ts`, `readLiveRedirects` over
+ * `adapter.records(redirectRecordKind).list`) — through the REAL `ConvexPersistenceAdapter`
+ * over the same convex-test deployment, so both sides read the very same stored rows.
+ *
+ * The set holds what a hand-built copy of the rule gets wrong: a paused redirect (a copy that
+ * forgets the switch serves it), a switch that is not a boolean (a truthy copy serves
+ * `'false'`), a duplicate `from` (`/old` and `/old/` — the lower id applies on both sides)
+ * and an editorial `meta` bag (never on the routing record). Measured: replacing either
+ * side's call with a hand-built `.filter((r) => r.enabled)` projection turns this red.
+ */
+describe('EC-627 — the Convex snapshot and the host adapter snapshot serve one live set', () => {
+  const STORED = [
+    redirect('a', { meta: { note: 'editorial only' } }),
+    redirect('paused', { enabled: false }),
+    redirect('string-off', { enabled: 'false' }),
+    { id: 'dup-1', data: { from: '/old', to: '/one', permanent: true, enabled: true } },
+    { id: 'dup-2', data: { from: '/old/', to: '/two', permanent: false, enabled: true } },
+  ]
+  const PATHS = ['/a', '/paused', '/string-off', '/old', '/old/']
+
+  /** The decision a reader makes per URL: what a visitor gets. */
+  const outcomes = (client: { resolvePage(url: string): { status: string; redirect: unknown } }) =>
+    PATHS.map((path) => {
+      const result = client.resolvePage(path)
+      return { path, status: result.status, redirect: result.redirect }
+    })
+
+  it('the same stored set yields the same live set through both readers', async () => {
+    const t = await deploymentWith(STORED)
+    await t.run(async (ctx) => {
+      await ctx.db.insert('members', { userId: 'admin', role: 'admin', createdAt: AT, updatedAt: AT })
+    })
+
+    // (1) the deployment's public snapshot → the host's live loader
+    const payload = await t.query(snapshot, { projectId: 'site' })
+    const viaSnapshot = assembleLiveSource(payload as never, { locales: LOCALES, collections: [], routes: [] }, 'published')
+      .client({ perspective: 'published' })
+
+    // (2) the host's adapter reader over the same deployment
+    const asAdmin = t.withIdentity({ subject: 'admin', issuer: 'https://convex.test' })
+    const adapter = new ConvexPersistenceAdapter(
+      {
+        query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin.query(ref, args ?? {}),
+        mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) => asAdmin.mutation(ref, args ?? {}),
+      } as unknown as ConvexHttpClient,
+      'site',
+    )
+    const viaAdapter = (await createContentSnapshot(adapter, 'site', { locales: LOCALES, collections: [], routes: [] }))
+      .client({ perspective: 'published' })
+
+    // The instrument can tell outcomes apart — pinned explicitly, not only compared.
+    expect(outcomes(viaSnapshot)).toEqual([
+      { path: '/a', status: 'redirect', redirect: { target: '/target', permanent: true } },
+      { path: '/paused', status: 'notFound', redirect: null },
+      { path: '/string-off', status: 'notFound', redirect: null },
+      { path: '/old', status: 'redirect', redirect: { target: '/one', permanent: true } },
+      { path: '/old/', status: 'redirect', redirect: { target: '/one', permanent: true } },
+    ])
+    expect(outcomes(viaAdapter)).toEqual(outcomes(viaSnapshot))
+    // The duplicate is one issue, the same on both sides (the router's one redirect set).
+    const duplicates = (issues: readonly { code: string; path: readonly unknown[] }[]) =>
+      issues.filter((issue) => issue.code === 'invalid-redirect').map((issue) => issue.path)
+    expect(duplicates(viaSnapshot.routerIssues)).toEqual([['redirects', 'dup-2']])
+    expect(duplicates(viaAdapter.routerIssues)).toEqual(duplicates(viaSnapshot.routerIssues))
+
+    // EC-628 (the adapter snapshot): the drifted row is NAMED on both sides, not only withheld —
+    // on the source and on the 404 at its `from`. (Before, the adapter path withheld it silently.)
+    const sourcePaths = (client: typeof viaSnapshot) => client.sourceIssues.map((issue) => [issue.code, issue.path])
+    expect(sourcePaths(viaSnapshot)).toEqual([['invalid-redirect', ['redirects', 'string-off']]])
+    expect(sourcePaths(viaAdapter)).toEqual(sourcePaths(viaSnapshot))
+    expect(viaAdapter.resolvePage('/string-off').issues.map((issue) => issue.code)).toEqual(['invalid-redirect'])
+  })
+})

package/convex/delivery.ts

@@ -1,5 +1,5 @@
 import { v } from 'convex/values'
-import { DRAFT_PERSPECTIVE, DRAFT_VARIANT, liveRedirectRecords, unfoldValue, variantOf } from '@elytracms/core/cms-core'
+import { DRAFT_PERSPECTIVE, DRAFT_VARIANT, readLiveRedirects, unfoldValue, variantOf } from '@elytracms/core/cms-core'
 import type { Perspective } from '@elytracms/core/cms-core'
 import { assetRecordFromRow, deliveryAssetRecord } from '@elytracms/core/persistence'
 import { constantTimeEquals } from '@elytracms/core/revalidation'
@@ -77,6 +77,12 @@ interface DeliverySnapshot {
    * infra redirects stay native (`next.config`/`vercel`), evaluated before these.
    */
   redirects: unknown[]
+  /**
+   * EC-628 — one `invalid-redirect` issue per stored redirect the live rule withheld because
+   * it could not read it (id, `from` and the kind of fault — never the target or a value).
+   * Paused redirects are not here: pausing is not drift.
+   */
+  redirectIssues: unknown[]
 }
 
 /**
@@ -161,16 +167,20 @@ export async function loadSnapshot(
   // Editorial redirects (EC-303): only ENABLED entries serve — a disabled redirect is
   // stored but never live, in either perspective. EC-616: read through the redirect
   // kind's one server-side reader (records + the marked legacy tolerant read) and
-  // projected by the ONE enabled-redirect reader, `liveRedirectRecords` (EC-590 / EC-627 —
-  // this was the last hand-built copy on Convex).
-  const redirects = liveRedirectRecords(await loadRedirectEntries(ctx, projectId))
+  // decided by the ONE live-redirect rule, `readLiveRedirects` (EC-590 / EC-627 — this
+  // was the last hand-built copy on Convex). EC-628: a stored redirect the rule cannot
+  // read (a non-boolean switch, a non-string `to`) is withheld AND reported — the host
+  // carries `redirectIssues` into its source issues — instead of being served or dropped
+  // by truthiness. The record kind's own read, not the project schema (EC-585 1e).
+  const live = readLiveRedirects(await loadRedirectEntries(ctx, projectId))
 
   return {
     projectId,
     perspective,
     documents,
     assets,
-    redirects,
+    redirects: live.redirects,
+    redirectIssues: live.issues,
   }
 }
 

package/convex/rail-write-parity.test.ts

@@ -70,19 +70,19 @@ async function seedHero(adapter: PersistenceAdapter) {
 
 /**
  * "Reset to centre", then clear alt — the two connected clears that never persisted.
- * EC-587: the alt is cleared the way the options dialog clears it, by writing the bag
- * without it (`meta.alt` is its one home).
+ * EC-587: the alt is cleared the way the options dialog clears it — since EC-634 the
+ * per-key patch removing `meta.alt` (its one home).
  */
 async function metadataClears(adapter: PersistenceAdapter) {
   await seedHero(adapter)
   const assets = adapter.assets
   const reset = await updateAssetMetadata({ assets }, PROJECT_ID, 'asset_hero', { focalPoint: null })
-  const clearedAlt = await updateAssetMetadata({ assets }, PROJECT_ID, 'asset_hero', { meta: { legacyKey: 'kept' } })
+  const clearedAlt = await updateAssetMetadata({ assets }, PROJECT_ID, 'asset_hero', { metaPatch: { alt: null } })
   expect([reset.ok, clearedAlt.ok]).toEqual([true, true])
   const after = await adapter.assets.getAsset(PROJECT_ID, 'asset_hero')
   return {
     focalPoint: after.focalPoint ?? null,
-    alt: assetAlt(after),
+    alt: assetAlt(after, null),
     title: after.title ?? null,
     thumb: after.thumb ?? null,
     lqip: after.lqip ?? null,
@@ -131,7 +131,7 @@ describe('EC-577 — the asset writers mean the same thing on both adapters', ()
         async get() {
           // An editor saves alt while the backfill is fetching this original — the
           // backfill's write lands after it, from a listing taken before it.
-          await updateAssetMetadata({ assets: adapter.assets }, PROJECT_ID, 'asset_big', { meta: { alt: 'Mid-run alt' } })
+          await updateAssetMetadata({ assets: adapter.assets }, PROJECT_ID, 'asset_big', { metaPatch: { alt: 'Mid-run alt' } })
           return new Uint8Array([1])
         },
       }
@@ -145,7 +145,7 @@ describe('EC-577 — the asset writers mean the same thing on both adapters', ()
       )
       expect(progress.generated).toBe(1)
       const after = await adapter.assets.getAsset(PROJECT_ID, 'asset_big')
-      expect([assetAlt(after), after.thumb, after.lqip]).toEqual(['Mid-run alt', THUMB, LQIP])
+      expect([assetAlt(after, null), after.thumb, after.lqip]).toEqual(['Mid-run alt', THUMB, LQIP])
     }
   })
 })