@panphora/clayjs 0.2.0 → 0.4.0

package/src/core/save.js

@@ -16,14 +16,14 @@ import {
   saveHtml,
   getPageContents,
   replacePageWith as replacePageWithCore,
-  beforeSave,
+  addDocumentTransform,
   isSaveInProgress
 } from "./save-core.js";
 import { captureForComparison, captureForSaveAndComparison } from "./snapshot.js";
 import { logSaveCheck, logBaseline } from "../lib/autosave-debug.js";
 
 // Reset savestatus to 'saved' in snapshots (each module cleans up its own attrs)
-beforeSave(clone => {
+addDocumentTransform(clone => {
   clone.setAttribute('savestatus', 'saved');
 });
 
@@ -38,8 +38,9 @@ let savingTimeout = null;
  *
  * @param {string} state - One of: 'saving', 'saved', 'offline', 'error'
  * @param {string} msg - Optional message (e.g., error details)
+ * @param {string} msgType - Optional severity from the server (e.g., 'warning')
  */
-function setSaveState(state, msg = '') {
+function setSaveState(state, msg = '', msgType = '') {
   if (savingTimeout) {
     clearTimeout(savingTimeout);
     savingTimeout = null;
@@ -48,7 +49,7 @@ function setSaveState(state, msg = '') {
   document.documentElement.setAttribute('savestatus', state);
 
   const event = new CustomEvent(`clay:save-${state}`, {
-    detail: { msg, timestamp: Date.now() }
+    detail: { msg, msgType, timestamp: Date.now() }
   });
   document.dispatchEvent(event);
 }
@@ -91,27 +92,68 @@ window.addEventListener('online', () => {
 });
 
 // ============================================
-// POST-SAVE BASELINE RECAPTURE
+// THE BASELINE IS THE BYTES WE SENT
 // ============================================
-// After a successful save, onaftersave handlers may modify the live DOM
-// (e.g., cacheBust updates ?v= query params). We recapture the baseline
-// after these sync handlers complete to prevent false "unsaved changes" warnings.
-
-document.addEventListener('clay:save-saved', () => {
-  // Use setTimeout(0) to run after all sync onaftersave handlers complete
-  setTimeout(() => {
-    // Store stripped version so comparisons are direct (no parsing needed)
-    const contents = captureForComparison();
-    lastSavedContents = contents;
-    logBaseline('recaptured after onaftersave', `${contents.length} chars`);
-  }, 0);
-});
+// There is deliberately no post-save re-read of the live DOM here.
+//
+// One used to exist, because [onaftersave] handlers mutate the page after a save
+// lands (cacheBust rewrites ?v= query params) and without it the page read dirty
+// forever. But a re-read cannot tell that churn apart from something the user typed
+// while the request was in flight, so it recorded those keystrokes as saved without
+// ever sending them: the edit was gone, with no error, no dirty flag, and no
+// close-tab warning.
+//
+// Post-save mutators are made invisible to the comparison instead — they mark what
+// they touch `no-trigger-autosave`, which strips it from every comparison capture
+// (see cache-bust.js and refetch-on-save.js). That leaves the baseline free to stay
+// exactly what savePage sent, which is the only value that is true by construction.
 
 // Re-export from core for backward compatibility
-export { beforeSave, getPageContents };
+export { addDocumentTransform, getPageContents };
 
 let unsavedChanges = false;
 let lastSavedContents = '';
+// A save was requested while one was on the wire; run one more when it settles.
+let pendingSave = false;
+
+function skipped_(msg) {
+  return { ok: false, msg, msgType: 'skipped', code: null, etag: null };
+}
+
+/**
+ * Apply one save result to the page's state.
+ *
+ * A 'skipped' result means the bytes never reached the wire, so the baseline must
+ * NOT advance: recording content as saved when it was never sent is the same defect
+ * as re-reading the live DOM after a save, one layer down. 'unknown' is a timeout,
+ * where the write may or may not have landed, so it is not treated as success
+ * either.
+ */
+function applySaveResult(result, forComparison, label) {
+  if (result.ok) {
+    lastSavedContents = forComparison;
+    unsavedChanges = false;
+    // The server's severity rides through untouched: a save can land AND carry a
+    // warning, and the UI module is what decides how to render that.
+    setSaveState('saved', result.msg || 'Saved', result.msgType);
+    logBaseline(label, `${lastSavedContents.length} chars`);
+  } else if (result.msgType !== 'skipped') {
+    if (!navigator.onLine) {
+      setSaveState('offline', result.msg);
+    } else {
+      setSaveState('error', result.msg);
+    }
+  }
+}
+
+// Run the save that arrived while this one was in flight. savePage does its own
+// dirty check, so if nothing actually changed it resolves 'skipped' and stops:
+// this cannot spin.
+function drainPendingSave() {
+  if (!pendingSave) return;
+  pendingSave = false;
+  savePage();
+}
 
 // State accessors for autosave module
 export function getUnsavedChanges() { return unsavedChanges; }
@@ -132,14 +174,18 @@ export function setLastSavedContents(val) { lastSavedContents = val; }
 export function savePage(callback = () => {}) {
   return new Promise((resolve) => {
     if (!isEditMode && !window.clay?.testMode) {
-      const skipped = { msg: 'Not in edit mode', msgType: 'skipped' };
+      const skipped = skipped_('Not in edit mode');
       callback(skipped);
       return resolve(skipped);
     }
 
-    // Don't start a new save if one is already in progress
+    // A save is already on the wire. Remember that a newer state is waiting rather
+    // than dropping it: the in-flight request carries the older bytes, and if no
+    // further mutation happens to retrigger autosave, the newer ones would never
+    // reach disk at all.
     if (isSaveInProgress()) {
-      const skipped = { msg: 'Save already in progress', msgType: 'skipped' };
+      pendingSave = true;
+      const skipped = skipped_('Save already in progress');
       callback(skipped);
       return resolve(skipped);
     }
@@ -154,13 +200,13 @@ export function savePage(callback = () => {}) {
     // Single capture: clone once, get both versions
     // forSave strips non-persisted regions ([no-save]/[save-remove])
     // forComparison additionally strips every autosave-off region
-    let forSave, forComparison;
+    let forSave, forComparison, snapshotHtml;
     try {
-      ({ forSave, forComparison } = captureForSaveAndComparison());
+      ({ forSave, forComparison, snapshotHtml } = captureForSaveAndComparison());
     } catch (err) {
       console.error('savePage: captureForSaveAndComparison failed', err);
       setSaveState('error', err.message);
-      const result = { msg: err.message, msgType: 'error' };
+      const result = { msg: err.message, msgType: 'error', code: null, etag: null };
       if (typeof callback === 'function') {
         callback(result);
       }
@@ -173,7 +219,7 @@ export function savePage(callback = () => {}) {
 
     // Skip if content hasn't changed
     if (!unsavedChanges) {
-      const skipped = { msg: 'No changes to save', msgType: 'skipped' };
+      const skipped = skipped_('No changes to save');
       callback(skipped);
       return resolve(skipped);
     }
@@ -182,32 +228,14 @@ export function savePage(callback = () => {}) {
     setSavingState();
 
     // Use saveHtml directly with our pre-captured content (avoids double capture)
-    saveHtml(forSave, (err, data) => {
-      if (!err) {
-        // SUCCESS - store stripped version for future comparisons
-        lastSavedContents = forComparison;
-        unsavedChanges = false;
-        setSaveState('saved', data?.msg || 'Saved');
-        logBaseline('updated after save', `${lastSavedContents.length} chars`);
-      } else {
-        // FAILED - determine if it's offline or server error
-        if (!navigator.onLine) {
-          setSaveState('offline', err.message);
-        } else {
-          setSaveState('error', err.message);
-        }
-      }
-
-      // Call user callback if provided (preserve server's msgType)
-      const result = {
-        msg: err?.message || data?.msg,
-        msgType: err ? 'error' : (data?.msgType || 'success')
-      };
+    saveHtml(forSave, (result) => {
+      applySaveResult(result, forComparison, 'updated after save');
       if (typeof callback === 'function') {
         callback(result);
       }
       resolve(result);
-    });
+      drainPendingSave();
+    }, { snapshotHtml });
   });
 }
 
@@ -220,13 +248,14 @@ export function savePage(callback = () => {}) {
 export function savePageForce(callback = () => {}) {
   return new Promise((resolve) => {
     if (!isEditMode && !window.clay?.testMode) {
-      const skipped = { msg: 'Not in edit mode', msgType: 'skipped' };
+      const skipped = skipped_('Not in edit mode');
       callback(skipped);
       return resolve(skipped);
     }
 
     if (isSaveInProgress()) {
-      const skipped = { msg: 'Save already in progress', msgType: 'skipped' };
+      pendingSave = true;
+      const skipped = skipped_('Save already in progress');
       callback(skipped);
       return resolve(skipped);
     }
@@ -236,13 +265,13 @@ export function savePageForce(callback = () => {}) {
       setOfflineStateQuiet();
     }
 
-    let forSave, forComparison;
+    let forSave, forComparison, snapshotHtml;
     try {
-      ({ forSave, forComparison } = captureForSaveAndComparison());
+      ({ forSave, forComparison, snapshotHtml } = captureForSaveAndComparison());
     } catch (err) {
       console.error('savePageForce: captureForSaveAndComparison failed', err);
       setSaveState('error', err.message);
-      const result = { msg: err.message, msgType: 'error' };
+      const result = { msg: err.message, msgType: 'error', code: null, etag: null };
       if (typeof callback === 'function') {
         callback(result);
       }
@@ -251,29 +280,14 @@ export function savePageForce(callback = () => {}) {
 
     setSavingState();
 
-    saveHtml(forSave, (err, data) => {
-      if (!err) {
-        lastSavedContents = forComparison;
-        unsavedChanges = false;
-        setSaveState('saved', data?.msg || 'Saved');
-        logBaseline('updated after force save', `${lastSavedContents.length} chars`);
-      } else {
-        if (!navigator.onLine) {
-          setSaveState('offline', err.message);
-        } else {
-          setSaveState('error', err.message);
-        }
-      }
-
-      const result = {
-        msg: err?.message || data?.msg,
-        msgType: err ? 'error' : (data?.msgType || 'success')
-      };
+    saveHtml(forSave, (result) => {
+      applySaveResult(result, forComparison, 'updated after force save');
       if (typeof callback === 'function') {
         callback(result);
       }
       resolve(result);
-    });
+      drainPendingSave();
+    }, { snapshotHtml });
   });
 }
 
@@ -288,13 +302,16 @@ export function replacePageWith(url) {
     return;
   }
 
-  replacePageWithCore(url, (err, data) => {
-    if (err) {
-      // Emit error event (save-toast will show toast if loaded)
-      setSaveState('error', err.message || "Failed to save template");
-    } else {
-      // Only reload if save was successful
+  replacePageWithCore(url, (result) => {
+    // Reload ONLY on a save that actually landed. A skipped result means the
+    // replacement never happened (busy lane, or not in edit mode), and reloading
+    // then presented a no-op as a completed swap.
+    if (result.ok) {
       window.location.reload();
+    } else if (result.msgType === 'skipped') {
+      setSaveState('error', result.msg || 'Template not saved');
+    } else {
+      setSaveState('error', result.msg || 'Failed to save template');
     }
   });
 }
@@ -304,6 +321,9 @@ const throttledSave = throttle(savePage, 1200);
 
 // Baseline for autosave comparison
 let baselineContents = '';
+// The baseline veto only guards the load-time settle window; captureBaseline
+// disarms it. See the comment there.
+let baselineActive = true;
 
 // ============================================
 // BASELINE CAPTURE (Settled Signal)
@@ -371,6 +391,14 @@ function initBaselineCapture() {
       logBaseline('settled skipped', userEdited ? 'user edited' : 'save occurred during settle');
     }
 
+    // The load-time veto has done its job. It exists so setup churn from modules
+    // booting cannot trigger a save, and that window is over once mutations have
+    // settled. Leaving it armed for the life of the tab is what made an undo back
+    // to the page's original state unsaveable: it differed from lastSavedContents
+    // but matched baselineContents, so autosave vetoed it forever and only a manual
+    // save could persist the revert.
+    baselineActive = false;
+
     document.documentElement.setAttribute('savestatus', 'saved');
   };
 
@@ -407,29 +435,41 @@ if (document.readyState === 'loading') {
  */
 export function savePageThrottled(callback = () => {}) {
   if (!isEditMode) {
-    const skipped = { msg: 'Not in edit mode', msgType: 'skipped' };
+    const skipped = skipped_('Not in edit mode');
     callback(skipped);
     return Promise.resolve(skipped);
   }
 
-  // For autosave: check both that content changed from baseline AND from last save
-  // This prevents saves from initial setup mutations
+  // For autosave: while the page is still settling, content must differ from BOTH
+  // the load-time baseline and the last save, so module setup churn cannot trigger
+  // a save. Once settled, the baseline veto is disarmed and only the last save
+  // matters — otherwise undoing back to the page's original state can never be
+  // persisted, because it matches the baseline forever.
   // Compare directly - stored versions are already stripped
   const currentForCompare = captureForComparison();
-  const differsFromBaseline = currentForCompare !== baselineContents;
+  const differsFromBaseline = !baselineActive || currentForCompare !== baselineContents;
   const differsFromLastSave = currentForCompare !== lastSavedContents;
 
   logSaveCheck('throttled vs baseline', !differsFromBaseline);
   logSaveCheck('throttled vs lastSave', !differsFromLastSave);
 
   if (!(differsFromBaseline && differsFromLastSave)) {
-    const skipped = { msg: 'No changes to save', msgType: 'skipped' };
+    const skipped = skipped_('No changes to save');
     callback(skipped);
     return Promise.resolve(skipped);
   }
 
   unsavedChanges = true;
-  return throttledSave(callback);
+  // The throttled promise can reject now that a throwing save no longer strands
+  // its callers (see throttle.js), and both autosave call sites are fire-and-forget,
+  // with no reach into this module's error path. Catch it here, the one place that
+  // owns that path, so every caller keeps the never-rejects contract savePage
+  // documents and a throw surfaces as a failed save instead of an unhandled rejection.
+  return throttledSave(callback).catch(err => {
+    const result = { ok: false, msg: err?.message || 'Save failed', msgType: 'error', code: null, etag: null };
+    setSaveState('error', result.msg);
+    return result;
+  });
 }
 
 /**

package/src/core/snapshot.js

@@ -19,7 +19,7 @@
  *              ▼                               ▼
  *   ┌─────────────────────────┐     ┌─────────────────────────┐
  *   │  3a. PREPARE HOOKS      │     │  3b. DONE               │
- *   │  onPrepareForSave       │     │  (live-sync stops here) │
+ *   │  addDocumentTransform   │     │  (live-sync stops here) │
  *   │  [onbeforesave]         │     │                         │
  *   │  [save-remove]          │     │  → emits snapshot-ready │
  *   │                         │     └─────────────────────────┘
@@ -38,13 +38,38 @@
 
 import { stripExtensionNoise } from '../lib/extension-noise.js';
 import { STRIP_FROM_SAVE, STRIP_FROM_COMPARISON, SNAPSHOT_REMOVE_SELECTOR } from '../lib/region-policy.js';
+import { saveTransport, DESKTOP_JSON } from './host-attrs.js';
+import { TAB_LOCAL_ROOT_ATTRS } from '../lib/root-attrs.js';
 
 // =============================================================================
 // HOOK REGISTRIES
 // =============================================================================
 
 const snapshotHooks = [];       // Phase 2: Always run (form sync)
-const prepareForSaveHooks = []; // Phase 3a: Save only (strip admin)
+const documentTransforms = [];  // Phase 3a: Save only (strip admin)
+
+/**
+ * Run every authored handler of one kind over a clone, and never let one of them
+ * take the page down with it.
+ *
+ * These attributes hold page-author JavaScript, and the capture pipeline runs on
+ * the boot path: save.js captures a baseline during module evaluation, inside the
+ * dynamic import the loader awaits. An unguarded throw in one page attribute
+ * therefore cost the document its entire client rather than costing that one
+ * handler its effect.
+ *
+ * @param {HTMLElement} clone
+ * @param {string} attr - e.g. 'onbeforesave'
+ */
+function runAuthoredHandlers(clone, attr) {
+  for (const el of clone.querySelectorAll(`[${attr}]`)) {
+    try {
+      new Function(el.getAttribute(attr)).call(el);
+    } catch (err) {
+      console.error(`[${attr}] handler failed:`, err);
+    }
+  }
+}
 
 /**
  * Register a hook that runs on EVERY snapshot (save AND sync).
@@ -57,18 +82,21 @@ export function onSnapshot(callback) {
 }
 
 /**
- * Register a hook that runs ONLY when preparing for save.
+ * Register a transform that runs over a detached clone when preparing to save.
  * Use for: stripping admin elements, cleanup.
  *
+ * It is a TRANSFORM, not a save lifecycle event: it runs over the clone that
+ * gets saved AND over the clone used to answer "has anything changed", and that
+ * second one runs on dirty checks that never become a save. So it must be pure
+ * and repeatable — no counters, no logging, no network. The two clones have
+ * different visibility rules, which is why neither run can be skipped.
+ *
  * @param {Function} callback - Receives the cloned document element
  */
-export function onPrepareForSave(callback) {
-  prepareForSaveHooks.push(callback);
+export function addDocumentTransform(callback) {
+  documentTransforms.push(callback);
 }
 
-// Backwards compat alias
-export const beforeSave = onPrepareForSave;
-
 // =============================================================================
 // CAPTURE FUNCTIONS
 // =============================================================================
@@ -94,8 +122,8 @@ export function captureSnapshot() {
   // mid-typing would leave the idle batch open across the save boundary, and
   // Cmd+Z after save would restore to a state earlier than the last save.
   // No-op when undo isn't loaded or no batch is pending.
-  if (typeof window !== 'undefined' && window.hyperclay && window.hyperclay.undo && window.hyperclay.undo.flush) {
-    window.hyperclay.undo.flush();
+  if (typeof window !== 'undefined' && window.clay?.undo?.flush) {
+    window.clay.undo.flush();
   }
 
   const clone = clonePreventingOnclone(document.documentElement);
@@ -104,9 +132,7 @@ export function captureSnapshot() {
     hook(clone);
   }
 
-  for (const el of clone.querySelectorAll('[onbeforesnapshot]')) {
-    new Function(el.getAttribute('onbeforesnapshot')).call(el);
-  }
+  runAuthoredHandlers(clone, 'onbeforesnapshot');
 
   for (const el of clone.querySelectorAll(SNAPSHOT_REMOVE_SELECTOR)) {
     el.remove();
@@ -129,20 +155,20 @@ export function captureSnapshot() {
  */
 function prepareCloneForSave(clone) {
   // Run inline [onbeforesave] handlers
-  for (const el of clone.querySelectorAll('[onbeforesave]')) {
-    new Function(el.getAttribute('onbeforesave')).call(el);
+  runAuthoredHandlers(clone, 'onbeforesave');
+
+  // Run registered prepare hooks ([freeze]/[save-freeze] innerHTML restore lives here)
+  for (const hook of documentTransforms) {
+    hook(clone);
   }
 
-  // Remove elements that shouldn't be saved ([no-save] / legacy [save-remove])
+  // Strip [no-save] / legacy [save-remove] LAST (snapshot-algorithm step 7): a
+  // prepare hook (freeze restore) can re-inject [no-save] content into the clone,
+  // so the strip must run after the hooks or that content leaks to disk.
   for (const el of clone.querySelectorAll(STRIP_FROM_SAVE)) {
     el.remove();
   }
 
-  // Run registered prepare hooks ([freeze]/[save-freeze] innerHTML restore lives here)
-  for (const hook of prepareForSaveHooks) {
-    hook(clone);
-  }
-
   return "<!DOCTYPE html>" + clone.outerHTML;
 }
 
@@ -159,9 +185,7 @@ export function captureForComparison() {
   const clone = captureSnapshot();
 
   // Run inline [onbeforesave] handlers
-  for (const el of clone.querySelectorAll('[onbeforesave]')) {
-    new Function(el.getAttribute('onbeforesave')).call(el);
-  }
+  runAuthoredHandlers(clone, 'onbeforesave');
 
   // Strip before hooks (hooks see the "final" state)
   for (const el of clone.querySelectorAll(STRIP_FROM_COMPARISON)) {
@@ -169,7 +193,7 @@ export function captureForComparison() {
   }
 
   // Run registered prepare hooks
-  for (const hook of prepareForSaveHooks) {
+  for (const hook of documentTransforms) {
     hook(clone);
   }
 
@@ -184,53 +208,56 @@ export function captureForComparison() {
  *
  * @param {Object} options
  * @param {boolean} options.emitForSync - Whether to emit snapshot-ready event (default: true)
- * @returns {{ forSave: string, forComparison: string }}
+ * @returns {{ forSave: string, forComparison: string, snapshotHtml: ?string }}
  */
 export function captureForSaveAndComparison({ emitForSync = true } = {}) {
   const clone = captureSnapshot();
 
+  // The unstripped snapshot, for a host that asked for the desktop JSON envelope:
+  // the save then sends both the stripped document and this. Returned to the caller
+  // rather than parked on a window global, so it can only ever be paired with the
+  // content captured alongside it. As a global it was cleared on success only, so
+  // two captures without an intervening successful save shipped a stale snapshot
+  // next to fresh content. Captured only when the document DECLARES the transport;
+  // this used to key off `location.hostname`, which set it on every localhost page
+  // whether or not its host wanted it.
+  const snapshotHtml = saveTransport() === DESKTOP_JSON
+    ? '<!DOCTYPE html>' + clone.outerHTML
+    : null;
+
   // Emit for live-sync before any stripping
   if (emitForSync) {
     document.dispatchEvent(new CustomEvent('clay:snapshot-ready', {
       detail: { documentElement: clone }
     }));
-
-    // Store snapshot HTML for Hyperclay Local platform sync
-    // This allows the save system to send both stripped and full versions
-    const isHyperclayLocal = window.location.hostname === 'localhost' ||
-                             window.location.hostname === '127.0.0.1';
-    if (isHyperclayLocal) {
-      window.__hyperclaySnapshotHtml = '<!DOCTYPE html>' + clone.outerHTML;
-    }
   }
 
   // Run inline [onbeforesave] handlers
-  for (const el of clone.querySelectorAll('[onbeforesave]')) {
-    new Function(el.getAttribute('onbeforesave')).call(el);
-  }
+  runAuthoredHandlers(clone, 'onbeforesave');
 
   // Clone for comparison before stripping (cheaper than cloning live DOM)
   const compareClone = clonePreventingOnclone(clone);
 
-  // Save clone: strip [no-save]/[save-remove], then run hooks (freeze restore in hooks)
+  // Save clone: run hooks (freeze restore lives here), THEN strip [no-save]/[save-remove]
+  // LAST (snapshot-algorithm step 7) so freeze-restored [no-save] content can't leak to disk.
+  for (const hook of documentTransforms) {
+    hook(clone);
+  }
   for (const el of clone.querySelectorAll(STRIP_FROM_SAVE)) {
     el.remove();
   }
-  for (const hook of prepareForSaveHooks) {
-    hook(clone);
-  }
   const forSave = "<!DOCTYPE html>" + clone.outerHTML;
 
   // Compare clone: strip every autosave-off region, then run hooks
   for (const el of compareClone.querySelectorAll(STRIP_FROM_COMPARISON)) {
     el.remove();
   }
-  for (const hook of prepareForSaveHooks) {
+  for (const hook of documentTransforms) {
     hook(compareClone);
   }
   const forComparison = "<!DOCTYPE html>" + compareClone.outerHTML;
 
-  return { forSave, forComparison };
+  return { forSave, forComparison, snapshotHtml };
 }
 
 /**
@@ -257,6 +284,35 @@ export function captureForSave({ emitForSync = true } = {}) {
   return prepareCloneForSave(clone);
 }
 
+/**
+ * The bytes a live-sync broadcast carries: the snapshot, minus the root
+ * attributes that belong to this tab alone. A third serialization of the same
+ * clone alongside the snapshot and the document, and the only one that crosses
+ * into another person's browser.
+ *
+ * Takes the clone rather than capturing one, because the caller already has the
+ * snapshot-ready clone and capturing again would run every hook a second time.
+ * (Not to be confused with captureBodyForSync below, which is the older
+ * body-innerHTML helper and unrelated to the live-sync lane.)
+ *
+ * The clone is detached and unobserved, so removing the attributes in place and
+ * putting them back is exact, and far cheaper than cloning the tree again. The
+ * finally is load-bearing: the save path reads this same clone afterwards.
+ */
+export function serializeForSync(clone) {
+  const removed = [];
+  for (const name of TAB_LOCAL_ROOT_ATTRS) {
+    if (!clone.hasAttribute(name)) continue;
+    removed.push([name, clone.getAttribute(name)]);
+    clone.removeAttribute(name);
+  }
+  try {
+    return clone.outerHTML;
+  } finally {
+    for (const [name, value] of removed) clone.setAttribute(name, value);
+  }
+}
+
 /**
  * PHASE 1-2 (body only): For live-sync between admin users.
  *

package/src/core/unsaved-warning.js

@@ -13,7 +13,7 @@
  * Requires the 'save-system' module (automatically included as dependency).
  */
 
-import { isOwner, isEditMode } from "./is-edit-mode.js";
+import { isEditMode } from "./is-edit-mode.js";
 import { captureForComparison } from "./snapshot.js";
 import { getLastSavedContents } from "./save.js";
 import { logUnloadDiffSync, preloadIfEnabled } from "../lib/autosave-debug.js";
@@ -21,8 +21,14 @@ import { logUnloadDiffSync, preloadIfEnabled } from "../lib/autosave-debug.js";
 // Pre-load diff library if debug mode is on (so it's ready for unload)
 preloadIfEnabled();
 
+// Gated on isEditMode, not isOwner. isOwner means the platform's admin cookie
+// specifically, so gating on it switched the warning off for every host that
+// authenticates another way: htmlclay, anything using a root save token, and any
+// sandboxed document, which cannot read cookies at all. Those are exactly the
+// documents where an unsaved edit is easiest to lose. If the page is editable,
+// the person editing it deserves the warning.
 window.addEventListener('beforeunload', (event) => {
-  if (!isOwner || !isEditMode) return;
+  if (!isEditMode) return;
 
   // Compare directly - both are already stripped
   const currentForCompare = captureForComparison();