@elytracms/studio 0.0.96 → 0.0.97

package/convex/ingest.ts

@@ -39,8 +39,9 @@ import { findRecordDoc, listRecordWire, saveRecord } from './record-functions'
  *    analytics addon must fail visibly (EC-618's counsel gate relies on it);
  * 7. an accepted `upload` gets ONE short-lived storage URL (`ctx.storage.generateUploadUrl`)
  *    — the bytes go browser → storage, cross-origin by design; the submission that follows
- *    claims the stored file with {@link claimIngestUpload}, which checks it against what the
- *    upload request declared.
+ *    claims the stored file with {@link claimIngestUpload}, which checks that the deployment
+ *    stored it for THIS intent (EC-671) and that it matches what the upload request declared,
+ *    and binds it; {@link releaseIngestUploads} is the only way such bytes are deleted.
  *
  * The engine never imports an addon: the handler is an internal-mutation REFERENCE the
  * consumer passes in its one `http.ts` line (`defineStudioHttp({ auth, ingest: {
@@ -147,10 +148,17 @@ export function ingestReceiver(handlers: IngestHandlers = {}): PublicHttpAction
 // intent (`recordIngestUpload`); a submission CLAIMS it (`claimIngestUpload`), which checks the
 // stored file against the intent. Abuse is bounded by: the route's limiter and bot gate on every
 // URL issued, `INGEST_MAX_UPLOAD_BYTES` per file, the URL's one-hour life, the post-upload check
-// (an over-size or mistyped file is deleted, never kept), and the unclaimed intents an addon can
+// (an over-size or mistyped file is refused, never attached), and the unclaimed intents an addon can
 // list (`unclaimedIngestUploads`) and surface. Convex returns the storage id to the uploader
 // only, so the bytes of an upload no submission ever claims cannot be located by the engine —
 // that is the documented residue, bounded by the limits above.
+//
+// EC-671 — ownership. The storage id a claim names is the VISITOR's word: nothing at intent
+// time can record it (`generateUploadUrl` takes no argument; the id reaches the uploader
+// alone), and an asset's storage id is public on the delivery snapshot. So a claim binds a
+// file only when the deployment's own facts say it is this upload's ({@link claimIngestUpload}),
+// it never deletes, and ingest bytes are deleted only through {@link releaseIngestUploads},
+// which deletes only what a claim bound.
 
 /** The upload intent — an engine-internal record kind (no public functions). */
 export const ingestUploadRecordKind = defineRecordKind({
@@ -165,10 +173,29 @@ export const ingestUploadRecordKind = defineRecordKind({
     size: z.number().int().positive(),
     state: z.enum(['issued', 'claimed', 'rejected']),
     issuedAt: z.string().min(1),
+    /** The id the intent's claim NAMED (claimed or rejected) — what was asked, not what is owned. */
     storageId: z.string().optional(),
   },
 })
 
+/**
+ * EC-671 — the engine's ONE ownership fact for ingest bytes: a record per stored file a claim
+ * bound to its intent, keyed BY the storage id (`recordId`), so a file is bound at most once
+ * and "is it bound?" is one indexed read. Written only by {@link claimIngestUpload}, in the
+ * claim's transaction; read by the claim (a file another claim bound is refused) and by
+ * {@link releaseIngestUploads}. Engine-internal (no public functions), like the intent.
+ */
+export const ingestBindingRecordKind = defineRecordKind({
+  kind: 'ingestBinding',
+  module: 'ingest',
+  time: 'boundAt',
+  fields: {
+    uploadId: z.string().min(1),
+    target: z.string().min(1),
+    boundAt: z.string().min(1),
+  },
+})
+
 let mintUploadUuid: (() => string) | undefined
 
 export interface IngestUploadPolicy {
@@ -221,11 +248,56 @@ export type IngestUploadClaimResult =
   | { ok: true; storageId: string; field: string; contentType: string; size: number }
   | { ok: false; status: 409 | 413 | 415 | 422; message: string }
 
+/**
+ * EC-671 — whether the deployment's own facts say a stored file is this intent's to claim. The
+ * storage id cannot be recorded at intent time (it reaches the uploader alone), so ownership
+ * is read from `_storage` facts and engine rows; a file is claimable only when ALL hold:
+ *
+ * 1. it was stored AFTER the intent was issued — compared in ONE clock: the intent row's
+ *    `_creationTime` against the file's, both stamped by the deployment at insert (`issuedAt`
+ *    is the HTTP action's clock, at millisecond grain: a file stored in the same millisecond
+ *    before the intent would compare equal);
+ * 2. no claim bound it already ({@link ingestBindingRecordKind});
+ * 3. no asset row references it — `storageKey` or `thumb.storageKey` (an asset's storage id is
+ *    public on the delivery snapshot the moment its row exists).
+ *
+ * Hiding `storageKey` would not be ownership; these are.
+ */
+async function claimableFile(
+  ctx: MutationCtx,
+  file: { _id: GenericId<'_storage'>; _creationTime: number },
+  intentCreatedAt: number,
+): Promise<boolean> {
+  if (file._creationTime < intentCreatedAt) return false
+  if (await findRecordDoc(ctx, ingestBindingRecordKind, file._id)) return false
+  return !(await assetReferencesStorage(ctx, file._id))
+}
+
+/** Check (3): does any asset row reference these bytes, as its file or its preview (`thumb`)? */
+async function assetReferencesStorage(ctx: MutationCtx, storageId: string): Promise<boolean> {
+  const asFile = await ctx.db
+    .query('assets')
+    .withIndex('by_storage', (q) => q.eq('storageKey', storageId))
+    .first()
+  if (asFile) return true
+  const asThumb = await ctx.db
+    .query('assets')
+    .withIndex('by_thumb_storage', (q) => q.eq('thumb.storageKey', storageId))
+    .first()
+  return asThumb !== null
+}
+
 /**
  * Claim one upload for a submission to `target`: the intent must exist, be unclaimed,
- * belong to `target`, be younger than `INGEST_UPLOAD_TTL_MS`, and the STORED file must match
- * it (size ≤ declared, same content type). A mismatched file is deleted and the intent
- * marked `rejected` — never kept.
+ * belong to `target`, be younger than `INGEST_UPLOAD_TTL_MS`; the stored file must be this
+ * intent's ({@link claimableFile}, EC-671) and match it (size ≤ declared, same content type).
+ * A claimed file is BOUND to the intent ({@link ingestBindingRecordKind}) — the fact every
+ * deletion reads ({@link releaseIngestUploads}).
+ *
+ * A refusal marks the intent `rejected` (recording the id it named) and deletes NOTHING
+ * (EC-671): the named id is the visitor's word, and even a file that passed every ownership
+ * check may belong to someone the engine cannot see. A refused upload's bytes stay where the
+ * uploader put them — the same residue as an upload never claimed.
  */
 export async function claimIngestUpload(
   ctx: MutationCtx,
@@ -237,7 +309,9 @@ export async function claimIngestUpload(
   const columns = intent?.data as
     | { target: string; field: string; contentType: string; size: number; state: string; issuedAt: string }
     | undefined
-  if (!columns || columns.target !== target) return { ok: false, status: 422, message: `Unknown upload “${claim.uploadId}”.` }
+  if (!intent || !columns || columns.target !== target) {
+    return { ok: false, status: 422, message: `Unknown upload “${claim.uploadId}”.` }
+  }
   if (columns.state !== 'issued') return { ok: false, status: 409, message: `Upload “${claim.uploadId}” was already claimed.` }
   if (Date.parse(receivedAt) - Date.parse(columns.issuedAt) > INGEST_UPLOAD_TTL_MS) {
     return { ok: false, status: 422, message: `Upload “${claim.uploadId}” expired.` }
@@ -246,19 +320,51 @@ export async function claimIngestUpload(
   const file = await ctx.db.system.get(storageId).catch(() => null)
   const stamps = { createdAt: receivedAt, updatedAt: receivedAt }
   if (!file) return { ok: false, status: 422, message: `No stored file “${claim.storageId}”.` }
-  const refused =
-    file.size > columns.size
-      ? ({ status: 413, message: 'The stored file is larger than the upload declared.' } as const)
-      : (file.contentType ?? '') !== columns.contentType
-        ? ({ status: 415, message: 'The stored file is not of the declared type.' } as const)
-        : undefined
-  if (refused) {
-    await ctx.storage.delete(storageId)
+  const reject = async (refusal: { status: 413 | 415 | 422; message: string }): Promise<IngestUploadClaimResult> => {
     await saveRecord(ctx, ingestUploadRecordKind, claim.uploadId, { state: 'rejected', storageId: claim.storageId }, stamps)
-    return { ok: false, ...refused }
+    return { ok: false, ...refusal }
+  }
+  const intentRow = await ctx.db.get(intent._id)
+  if (!intentRow || !(await claimableFile(ctx, file, intentRow._creationTime))) {
+    // One answer for all three checks: which one failed is not the visitor's to learn.
+    return reject({ status: 422, message: `Upload “${claim.uploadId}” did not store the file “${claim.storageId}”.` })
+  }
+  if (file.size > columns.size) return reject({ status: 413, message: 'The stored file is larger than the upload declared.' })
+  if ((file.contentType ?? '') !== columns.contentType) {
+    return reject({ status: 415, message: 'The stored file is not of the declared type.' })
   }
+  // Bound — and handed back — under the deployment's own id for the file (`file._id`), the
+  // spelling checks (2) and (3) read, never the string the visitor sent.
+  await saveRecord(ctx, ingestBindingRecordKind, file._id, { uploadId: claim.uploadId, target, boundAt: receivedAt }, stamps)
   await saveRecord(ctx, ingestUploadRecordKind, claim.uploadId, { state: 'claimed', storageId: claim.storageId }, stamps)
-  return { ok: true, storageId: claim.storageId, field: columns.field, contentType: columns.contentType, size: file.size }
+  return { ok: true, storageId: file._id, field: columns.field, contentType: columns.contentType, size: file.size }
+}
+
+/**
+ * Delete ingest bytes an addon holds (EC-671) — the ONE way they are deleted, and it deletes
+ * only files a claim BOUND: the bytes and their binding go together. Any other id is KEPT and
+ * returned in `kept` — an asset's, an id a write put into a row by hand, a file claimed before
+ * bindings existed — because ingest cannot show it owns them. Call it for a refused
+ * submission's already-claimed files and when removing a row that holds claimed files.
+ */
+export async function releaseIngestUploads(
+  ctx: MutationCtx,
+  storageIds: readonly string[],
+): Promise<{ deleted: string[]; kept: string[] }> {
+  const deleted: string[] = []
+  const kept: string[] = []
+  for (const storageId of new Set(storageIds)) {
+    const binding = await findRecordDoc(ctx, ingestBindingRecordKind, storageId)
+    if (!binding) {
+      kept.push(storageId)
+      continue
+    }
+    const id = storageId as GenericId<'_storage'>
+    if (await ctx.db.system.get(id).catch(() => null)) await ctx.storage.delete(id)
+    await ctx.db.delete(binding._id)
+    deleted.push(storageId)
+  }
+  return { deleted, kept }
 }
 
 /** Upload intents of `target` still unclaimed past their life — the visible orphan finding. */

package/convex/receipt-races.test.ts

@@ -0,0 +1,184 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import { getFunctionName, makeFunctionReference } from 'convex/server'
+import type { FunctionReference } from 'convex/server'
+import { measureMaxDepth } from '@elytracms/core/cms-core'
+import { createChangesets, createOperations } from '@elytracms/core/operations'
+import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
+import schema from './schema'
+
+// convex-test fires a `runAfter(0)` on a REAL timer (the publish trigger's revalidation);
+// fake timers keep it queued.
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime('2026-10-28T00:00:00.000Z')
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * EC-663 — the Codex review's F16 and F17 counterexamples on Convex (round 3,
+ * `races.convex.test.ts`), copied and INVERTED: the real `cms:*` handlers, schema and triggers
+ * under convex-test, driven by the production operations and changesets over the production
+ * `ConvexPersistenceAdapter`. Each race is an explicit interleaving — the client HOLDS one
+ * store mutation after every check, runs the colleague's operation, then sends the held
+ * mutation — and the mutation REFUSES inside its transaction. convex-test serialises
+ * mutations, so this proves the sink's check and its refusal, not Convex's OCC retry.
+ *
+ * F17's wiring changed on purpose (an adapted copy, as the preamble requires): the hidden-clear
+ * no longer lands BEFORE `cms:publishDocument` — it is part of it — so at the pause the draft
+ * still holds the hidden value (the probe asserted it was already gone).
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+const projectId = 'receipt-races'
+const ref = { collection: 'post', id: 'p' }
+const author = { collection: 'author', id: 'a' }
+
+async function world() {
+  const t = convexTest(schema, modules)
+  const stamp = '2026-10-28T00:00:00Z'
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: 'user_admin', role: 'admin', createdAt: stamp, updatedAt: stamp })
+  })
+  const admin = t.withIdentity({ subject: 'user_admin', issuer: 'https://convex.test' })
+  const held = new Map<string, { reached(): void; gate: Promise<void> }>()
+  const client = {
+    query: (fn: FunctionReference<'query'>, args?: Record<string, unknown>) => admin.query(fn, args ?? {}),
+    mutation: async (fn: FunctionReference<'mutation'>, args?: Record<string, unknown>) => {
+      const key = `${getFunctionName(fn)}#${String(args?.docId)}`
+      const pause = held.get(key)
+      if (pause) {
+        held.delete(key)
+        pause.reached()
+        await pause.gate
+      }
+      return admin.mutation(fn, args ?? {})
+    },
+  } as unknown as ConvexHttpClient
+  const adapter = new ConvexPersistenceAdapter(client, projectId)
+  const collections = () => [
+    { id: 'author', kind: 'document' as const, fields: [{ name: 'name', type: 'text' as const }] },
+    { id: 'post', kind: 'document' as const, fields: [
+      { name: 'title', type: 'text' as const },
+      { name: 'hidden', type: 'text' as const, form: { hidden: () => true } },
+      { name: 'author', type: 'relation' as const, target: 'author', multiple: false, strict: true },
+    ] },
+  ]
+  const options = { adapter, collections, validateDocument: () => [] }
+  const ops = createOperations(options)
+  const changesets = createChangesets(options)
+  /** Hold the next `cms:<verb>` mutation for document `id` at the client. */
+  const hold = (verb: string, id: string) => {
+    let reached!: () => void
+    let resume!: () => void
+    const at = new Promise<void>((r) => { reached = r })
+    const gate = new Promise<void>((r) => { resume = r })
+    held.set(`cms:${verb}#${id}`, { reached, gate })
+    return { at, resume }
+  }
+  const put = async (document: { collection: string; id: string; values: Record<string, unknown> }) => {
+    expect((await ops.documents.replace({ projectId, document, precondition: { ifAbsent: true } })).ok).toBe(true)
+  }
+  return { t, admin, adapter, ops, changesets, hold, put }
+}
+
+for (const inverse of ['pin', 'unpublish'] as const) {
+  it(`F16 Convex: a ${inverse} inverse refuses in its mutation when a colleague published after its checks`, async () => {
+    const { adapter, ops, changesets, hold, put } = await world()
+    await put({ ...ref, values: { title: 'one' } })
+    if (inverse === 'pin') expect((await ops.documents.publish({ projectId, ref })).ok).toBe(true)
+    const applied = await changesets.apply(changesets.create({ title: 'publish', steps: [{ operation: 'documents.publish', input: { projectId, ref } }] }))
+    expect(applied.ok).toBe(true)
+    if (!applied.ok) throw new Error(applied.error.message)
+    const pause = hold(inverse === 'pin' ? 'publishDocumentVersion' : 'unpublishDocument', ref.id)
+    const reverting = changesets.revert(applied.value)
+    await pause.at
+    expect((await ops.documents.publish({ projectId, ref })).ok).toBe(true)
+    const b = await adapter.cms.getDocument(projectId, ref)
+    expect(b.publishedVersion).toBe(inverse === 'pin' ? 3 : 2)
+    pause.resume()
+    // Inverted: the revert refuses and the colleague's publication stays live.
+    const reverted = await reverting
+    expect(reverted.ok).toBe(false)
+    if (!reverted.ok) expect(reverted.error.code).toBe('conflict')
+    expect((await adapter.cms.getDocument(projectId, ref)).publishedVersion).toBe(b.publishedVersion)
+  })
+}
+
+it('F16 Convex control: a revert with nothing racing it lands (the precondition is not a blanket refusal)', async () => {
+  const { adapter, ops, changesets, put } = await world()
+  await put({ ...ref, values: { title: 'one' } })
+  expect((await ops.documents.publish({ projectId, ref })).ok).toBe(true) // v1
+  const applied = await changesets.apply(changesets.create({ title: 'publish', steps: [{ operation: 'documents.publish', input: { projectId, ref } }] }))
+  if (!applied.ok) throw new Error(applied.error.message)
+  expect((await adapter.cms.getDocument(projectId, ref)).publishedVersion).toBe(2)
+  expect((await changesets.revert(applied.value)).ok).toBe(true)
+  expect((await adapter.cms.getDocument(projectId, ref)).publishedVersion).toBe(1)
+})
+
+it('F17 Convex (adapted wiring): a publish its mutation refuses cleared nothing — compensation’s rollback claim is true', async () => {
+  const { adapter, ops, changesets, hold, put } = await world()
+  await put({ ...author, values: { name: 'Ada' } })
+  await put({ ...ref, values: { hidden: 'KEEP DRAFT', author: { type: 'reference', ...author } } })
+  expect((await ops.documents.publish({ projectId, ref: author })).ok).toBe(true)
+  const before = await adapter.cms.getDocument(projectId, ref)
+  const pause = hold('publishDocument', ref.id)
+  const applying = changesets.apply(changesets.create({ title: 'publish', steps: [{ operation: 'documents.publish', input: { projectId, ref } }] }))
+  await pause.at
+  // Changed wiring: the clear is part of the held mutation, so nothing is cleared yet.
+  expect((await adapter.cms.getDocument(projectId, ref)).document.values.hidden).toBe('KEEP DRAFT')
+  expect((await ops.documents.unpublish({ projectId, ref: author })).ok).toBe(true)
+  pause.resume()
+  const result = await applying
+  expect(result.ok).toBe(false)
+  if (result.ok) throw new Error('expected strict conflict')
+  expect(result.error.message).toContain('All previously applied steps were rolled back')
+  // Inverted: the refused publish wrote nothing.
+  const after = await adapter.cms.getDocument(projectId, ref)
+  expect(after.document.values.hidden).toBe('KEEP DRAFT')
+  expect(after.revision).toBe(before.revision)
+  expect(after.publishedVersion).toBeUndefined()
+})
+
+describe('EC-663 Convex — the mutations enforce the new preconditions themselves', () => {
+  const pinRef = makeFunctionReference<'mutation'>('cms:publishDocumentVersion')
+  const unpublishRef = makeFunctionReference<'mutation'>('cms:unpublishDocument')
+
+  it('cms:publishDocumentVersion / cms:unpublishDocument with a stale expectedRevision return conflict and write nothing', async () => {
+    const { admin, adapter, ops, put } = await world()
+    await put({ ...ref, values: { title: 'one' } })
+    expect((await ops.documents.publish({ projectId, ref })).ok).toBe(true) // r2, v1
+    const at = '2026-10-28T00:00:01Z'
+    const pin = await admin.mutation(pinRef, { collection: 'post', docId: 'p', version: 1, updatedAt: at, publishedAt: at, expectedRevision: 1 })
+    expect(pin).toMatchObject({ status: 'conflict', current: { revision: 2 } })
+    const unpublish = await admin.mutation(unpublishRef, { collection: 'post', docId: 'p', updatedAt: at, expectedRevision: 1 })
+    expect(unpublish).toMatchObject({ status: 'conflict', current: { revision: 2 } })
+    const kept = await adapter.cms.getDocument(projectId, ref)
+    expect([kept.revision, kept.publishedVersion]).toEqual([2, 1])
+    // Control: at the current revision both land.
+    expect(await admin.mutation(unpublishRef, { collection: 'post', docId: 'p', updatedAt: at, expectedRevision: 2 })).toMatchObject({ revision: 3 })
+    expect(await admin.mutation(pinRef, { collection: 'post', docId: 'p', version: 1, updatedAt: at, publishedAt: at, expectedRevision: 3 })).toMatchObject({ status: 'ok' })
+  })
+
+  it('a publish with a hidden-clear is ONE mutation: patch row at +1, publish row at +2, the pinned snapshot cleared', async () => {
+    const { t, adapter, ops, put } = await world()
+    await put({ ...ref, values: { title: 'T', hidden: 'gone' } })
+    const published = await ops.documents.publish({ projectId, ref })
+    expect(published.ok).toBe(true)
+    const log = await adapter.cms.listDocumentPatches(projectId, ref)
+    expect(log.map((row) => `${row.revision}:${row.kind}`)).toEqual(['1:replace', '2:patch', '3:publish'])
+    const record = await adapter.cms.getDocument(projectId, ref)
+    expect(record.document.values).toEqual({ title: 'T' })
+    expect(record.hasUnpublishedChanges).toBe(false)
+    expect((await adapter.cms.getDocumentVersion(projectId, ref, 1)).snapshot.values).toEqual({ title: 'T' })
+    // The stored row stays inside Convex's 16-level cap.
+    const rows = await t.run((ctx) => ctx.db.query('cmsDocuments').collect())
+    for (const row of rows) expect(measureMaxDepth(row).depth).toBeLessThanOrEqual(16)
+  })
+})

package/convex/records-zod-copy.test.ts

@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest'
+import { convexTest } from 'convex-test'
+import { makeFunctionReference } from 'convex/server'
+import { z } from 'zod'
+import { z as newerZod } from 'zod-copy-newer'
+import { defineRecordKind } from '@elytracms/core/persistence'
+import type { AnyRecordKind } from '@elytracms/core/persistence'
+import schema from './schema'
+import { defineRecordFunctions } from './record-functions'
+
+/**
+ * EC-639 — the Convex write path (`defineRecordFunctions(kind).save` → `saveRecord` →
+ * `resolveRecordSave`) for a kind declared with ANOTHER zod copy than the engine's: an addon
+ * or a consumer's studio declares its kind with its own zod, and its Convex module validates
+ * the write in-transaction with that kind. Measured before: a `.default()` column of zod 4.6
+ * inside the engine's object (an older copy) refused every create on BOTH adapters
+ * (`expected nonoptional, received undefined`). `zod-copy-newer` is a real second copy (an
+ * aliased devDependency), not a mock.
+ */
+
+const sameCopyKind = defineRecordKind({
+  kind: 'sameTicket',
+  module: 'sameTickets',
+  fields: { title: z.string().min(1), done: z.boolean().default(false), note: z.string().optional() },
+})
+const newerCopyKind = defineRecordKind({
+  kind: 'newerTicket',
+  module: 'newerTickets',
+  fields: { title: newerZod.string().min(1), done: newerZod.boolean().default(false), note: newerZod.string().optional() },
+})
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+  [`./${sameCopyKind.module}.ts`]: async () => defineRecordFunctions(sameCopyKind),
+  [`./${newerCopyKind.module}.ts`]: async () => defineRecordFunctions(newerCopyKind),
+}
+
+const STAMP = '2026-10-28T00:00:00.000Z'
+
+async function editorBackend() {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: 'editor', role: 'editor', createdAt: STAMP, updatedAt: STAMP })
+  })
+  return { t, editor: t.withIdentity({ subject: 'editor', issuer: 'https://convex.test' }) }
+}
+
+describe.each([
+  ['a NEWER zod copy (refused every create before)', newerCopyKind],
+  ['the engine’s own copy (control — unchanged)', sameCopyKind],
+] as const)('EC-639 — Convex record save with %s', (_label, kind: AnyRecordKind) => {
+  const save = makeFunctionReference<'mutation'>(`${kind.module}:save`)
+  const get = makeFunctionReference<'query'>(`${kind.module}:get`)
+  const idArg = (id: string) => ({ [kind.idKey]: id })
+
+  it('creates with the default applied, edits keep it, a clear removes the optional column', async () => {
+    const { editor } = await editorBackend()
+    await editor.mutation(save, { ...idArg('t1'), title: 'First', note: 'n', createdAt: STAMP, updatedAt: STAMP })
+    expect(await editor.query(get, idArg('t1'))).toMatchObject({ title: 'First', done: false, note: 'n' })
+    await editor.mutation(save, { ...idArg('t1'), done: true, createdAt: STAMP, updatedAt: STAMP })
+    await editor.mutation(save, { ...idArg('t1'), title: 'Renamed', note: null, createdAt: STAMP, updatedAt: STAMP })
+    const edited = (await editor.query(get, idArg('t1'))) as Record<string, unknown>
+    expect(edited).toMatchObject({ title: 'Renamed', done: true })
+    expect(edited.note).toBeUndefined()
+  })
+
+  it('refuses an invalid column with the column’s own message, in the transaction', async () => {
+    const { t, editor } = await editorBackend()
+    await expect(
+      editor.mutation(save, { ...idArg('bad'), title: '', createdAt: STAMP, updatedAt: STAMP }),
+    ).rejects.toThrow(/title: Too small/)
+    const stored = await t.run(async (ctx) => ctx.db.query('records').collect())
+    expect(stored).toEqual([])
+  })
+})

package/convex/schema.ts

@@ -207,6 +207,21 @@ export default defineSchema({
     .index('by_doc', ['collection', 'docId', 'variant'])
     .index('by_doc_session', ['collection', 'docId', 'variant', 'sessionId']),
 
+  /**
+   * EC-669 — the FLOOR of a removed identity: the highest `revision` (of its rows) and
+   * `version` (of its history) any deleted or cleared lifetime of `collection:docId` reached.
+   * Written by `cms:deleteDocument` and `cms:clearDocuments` (raised, never lowered, never
+   * deleted — one row per identity ever removed); read by a create and by a lifetime's first
+   * version, which start above it — so a revision or version token names one state of ONE
+   * lifetime and a stale writer of a removed lifetime is refused. Never on the delivery wire.
+   */
+  documentFloors: defineTable({
+    collection: v.string(),
+    docId: v.string(),
+    revision: v.number(),
+    version: v.number(),
+  }).index('by_doc', ['collection', 'docId']),
+
   /**
    * CMS document version snapshots — append-only (EC-224). One row per recorded
    * version (created on publish or a pre-restore snapshot, never on a plain draft
@@ -285,7 +300,11 @@ export default defineSchema({
     localizedMeta: v.optional(v.any()),
     createdAt: v.string(),
     updatedAt: v.string(),
-  }).index('by_asset', ['assetId']),
+  })
+    .index('by_asset', ['assetId'])
+    // EC-671: an ingest claim refuses a storage id an asset row references (`claimIngestUpload`).
+    .index('by_storage', ['storageKey'])
+    .index('by_thumb_storage', ['thumb.storageKey']),
 
   /**
    * Editorial redirects (EC-303) — 301/302 forwards an editor owns, stored as

package/convex/strict-delete.test.ts

@@ -0,0 +1,129 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import { getFunctionName } from 'convex/server'
+import type { FunctionReference } from 'convex/server'
+import { fieldPath } from '@elytracms/core/cms-core'
+import { createOperations } from '@elytracms/core/operations'
+import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
+import schema from './schema'
+
+// convex-test fires a `runAfter(0)` on a REAL timer (the publish trigger's revalidation);
+// fake timers keep it queued.
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime('2026-10-28T00:00:00.000Z')
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * EC-668 — the Codex review's F08-residual counterexample on Convex (round 3,
+ * `races.convex.test.ts`), copied and INVERTED: the client HOLDS `cms:deleteDocument` after the
+ * operation's guard, a colleague saves a strict draft reference to the target, the held
+ * mutation is sent — and it REFUSES, because its transaction reads the draft reference index
+ * (`referenceEntries` `by_target`, variant `draft`) and finds a referrer the guard did not judge
+ * at its current revision. The probe's positive detection control (a fresh guard refuses a
+ * second delete) is kept as written. convex-test serialises mutations: this proves the sink's
+ * data check and its refusal, not Convex's OCC retry.
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+const projectId = 'strict-delete'
+const ref = { collection: 'post', id: 'p' }
+const author = { collection: 'author', id: 'a' }
+
+async function world() {
+  const t = convexTest(schema, modules)
+  const stamp = '2026-10-28T00:00:00Z'
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: 'user_admin', role: 'admin', createdAt: stamp, updatedAt: stamp })
+  })
+  const admin = t.withIdentity({ subject: 'user_admin', issuer: 'https://convex.test' })
+  const held = new Map<string, { reached(): void; gate: Promise<void> }>()
+  const client = {
+    query: (fn: FunctionReference<'query'>, args?: Record<string, unknown>) => admin.query(fn, args ?? {}),
+    mutation: async (fn: FunctionReference<'mutation'>, args?: Record<string, unknown>) => {
+      const key = `${getFunctionName(fn)}#${String(args?.docId)}`
+      const pause = held.get(key)
+      if (pause) {
+        held.delete(key)
+        pause.reached()
+        await pause.gate
+      }
+      return admin.mutation(fn, args ?? {})
+    },
+  } as unknown as ConvexHttpClient
+  const adapter = new ConvexPersistenceAdapter(client, projectId)
+  const collections = () => [
+    { id: 'author', kind: 'document' as const, fields: [{ name: 'name', type: 'text' as const }] },
+    { id: 'post', kind: 'document' as const, fields: [
+      { name: 'author', type: 'relation' as const, target: 'author', multiple: false, strict: true },
+      { name: 'soft', type: 'relation' as const, target: 'author', multiple: false },
+    ] },
+  ]
+  const ops = createOperations({ adapter, collections, validateDocument: () => [] })
+  const hold = (verb: string, id: string) => {
+    let reached!: () => void
+    let resume!: () => void
+    const at = new Promise<void>((r) => { reached = r })
+    const gate = new Promise<void>((r) => { resume = r })
+    held.set(`cms:${verb}#${id}`, { reached, gate })
+    return { at, resume }
+  }
+  const put = async (document: { collection: string; id: string; values: Record<string, unknown> }) => {
+    expect((await ops.documents.replace({ projectId, document, precondition: { ifAbsent: true } })).ok).toBe(true)
+  }
+  return { adapter, ops, hold, put }
+}
+
+it('F08 residual Convex: a strict draft saved before the delete mutation protects its target', async () => {
+  const { adapter, ops, hold, put } = await world()
+  await put({ ...author, values: { name: 'Ada' } })
+  await put({ ...ref, values: {} })
+  const pause = hold('deleteDocument', author.id)
+  const deleting = ops.documents.delete({ projectId, ref: author })
+  await pause.at
+  expect((await ops.documents.patch({ projectId, ref, baseRevision: 1, patches: [{ op: 'set', path: fieldPath('author'), value: { type: 'reference', ...author } }] })).ok).toBe(true)
+  // Positive detection control (kept as written): the guard already sees the now-saved draft and blocks a second delete.
+  expect((await ops.documents.delete({ projectId, ref: author })).ok).toBe(false)
+  pause.resume()
+  // Inverted: the held delete refuses in its transaction; the target survives.
+  const deleted = await deleting
+  expect(deleted.ok).toBe(false)
+  if (!deleted.ok) expect(deleted.error.code).toBe('conflict')
+  expect(await adapter.cms.findDocument(projectId, author)).toBeDefined()
+})
+
+describe('EC-668 Convex — the delete mutation checks the draft referrers the guard judged', () => {
+  it('a judged SOFT draft referrer edited to a strict one while the delete is held refuses (its revision moved)', async () => {
+    const { adapter, ops, hold, put } = await world()
+    await put({ ...author, values: { name: 'Ada' } })
+    await put({ ...ref, values: { soft: { type: 'reference', ...author } } })
+    const pause = hold('deleteDocument', author.id)
+    const deleting = ops.documents.delete({ projectId, ref: author })
+    await pause.at
+    expect((await ops.documents.patch({ projectId, ref, baseRevision: 1, patches: [{ op: 'set', path: fieldPath('author'), value: { type: 'reference', ...author } }] })).ok).toBe(true)
+    pause.resume()
+    expect((await deleting).ok).toBe(false)
+    expect(await adapter.cms.findDocument(projectId, author)).toBeDefined()
+  })
+
+  it('control: the held delete with nothing racing it lands, a judged soft referrer and all', async () => {
+    const { adapter, ops, hold, put } = await world()
+    await put({ ...author, values: { name: 'Ada' } })
+    await put({ ...ref, values: { soft: { type: 'reference', ...author } } })
+    const pause = hold('deleteDocument', author.id)
+    const deleting = ops.documents.delete({ projectId, ref: author })
+    await pause.at
+    // An unrelated write in the window is not a referrer.
+    await put({ collection: 'author', id: 'b', values: { name: 'Bea' } })
+    pause.resume()
+    expect((await deleting).ok).toBe(true)
+    expect(await adapter.cms.findDocument(projectId, author)).toBeUndefined()
+  })
+})

package/dist/components/cms/cms-store.d.ts

@@ -73,8 +73,11 @@ export interface CmsStore {
      * editor's `doc`): the value and its revision travel together, so a writer authoring
      * from what it displayed names that revision. `undefined` for a value the session never
      * showed (a fixture session, a copy) or a provisional one (a create in flight).
+     * EC-667: with `path`, the revision the content at that position was authored against
+     * (a view showing a pending write is a composite); without it, the EARLIEST of any
+     * position — the whole-document writer's token.
      */
-    revisionOfView(view: CmsDocument): number | undefined;
+    revisionOfView(view: CmsDocument, path?: ValuePath): number | undefined;
     /**
      * EC-595 A2 / EC-578 — create a document from a whole value (duplicate, import of a
      * new row, an AI create, a transfer, a reuse promote): insert-if-absent