@prenta/admin 0.92.0 → 0.93.0

package/CHANGELOG.md

@@ -1,5 +1,557 @@
 # @actuate-media/cms-admin
 
+## 0.93.0
+
+### Minor Changes
+
+- 6f2eb6d: Add dismissible canvas editing tip, richer empty-canvas copy, lite section hover outlines, and Site preview field chrome for `[data-cms-field]`.
+- 6f2eb6d: Make the page and post editors design-owned: no add, reorder, duplicate, or delete.
+
+  A document's section list now comes from its template in code. Editors change copy,
+  CTAs, and imagery — and can still show or hide a section, which is the one structural
+  property the content model gives them. See
+  [docs/design-owned-sections.md](https://github.com/actuate-media/prenta/blob/main/docs/design-owned-sections.md).
+
+  Structural editing is not gone, it moved to the surfaces that author a template. The
+  **Post Template editor** keeps it by passing `SectionsPanel`'s new `structural` prop;
+  the visual **Page Builder** is unaffected because it uses its own
+  `BuilderSectionsPanel`. `structural` defaults to `false`, so a consumer that forgets it
+  gets the safe behaviour rather than an editor that can quietly restructure a
+  design-owned page.
+
+  Existing documents are untouched — a page with a hand-built section list keeps every
+  section, keeps rendering, and stays fully editable.
+
+  **Deprecated, and deliberately soft — nothing is enforced.** The three endpoints below
+  keep working exactly as before: same status codes, same response bodies, no rate
+  limiting, no warning in the response payload. An integration that calls them will not
+  notice unless it inspects response headers, and a script that adds sections on a
+  schedule will keep doing so until the next major removes the routes.
+
+  If you drive page structure from outside the admin, treat this release as the window to
+  migrate — see [docs/design-owned-sections.md](https://github.com/actuate-media/prenta/blob/main/docs/design-owned-sections.md)
+  for the three common cases and what replaces each. Auditing your own callers is the only
+  way to find them; the deprecation will not surface itself.
+
+  Three REST endpoints now return
+  RFC 8594 `Deprecation` / `Link` / `X-Prenta-Deprecation` headers. The response bodies
+  are unchanged, so a client that ignores the headers sees no difference:
+  - `POST /page-sections/:collection/:id` (add)
+  - `POST /page-sections/:collection/:id/reorder`
+  - `DELETE /page-sections/:collection/:id/:sectionId`
+
+  The matching MCP tools — `add_page_section`, `reorder_page_sections`,
+  `remove_page_section` — carry the same notice in their descriptions so an agent reads
+  it before choosing a tool.
+
+  `PATCH /page-sections/:collection/:id/:sectionId` is **not** deprecated: it is how a
+  design-owned page is edited, including `visible` toggles. `GET` and the discovery /
+  validation routes are unchanged.
+
+- 6f2eb6d: Generate design tokens from a single source, and render the editor canvas at real breakpoint widths.
+
+  **Tokens.** `design-system/tokens.json` is now the source of truth for every token
+  artifact. `pnpm --filter @prenta/admin generate` emits `tokens.css`, `tokens.scss`,
+  `tokens.tailwind.cjs`, and the `.prenta-admin`-scoped runtime copy
+  (`src/styles/prenta-tokens.css`) from it; a test fails the build if any generated file
+  is hand-edited or falls out of date. Previously the runtime copy was a hand
+  transcription of the handoff copy and the two had drifted — the radius scale was
+  renamed in one and not the other, and the WCAG correction to `--muted` existed only
+  downstream, where re-importing the handoff would have silently reverted it.
+
+  New tokens: the `--sp-*` spacing scale, `--h-chip`/`--h-field`/`--h-ctl` control
+  heights, `--bw`/`--bw-ctl`/`--bw-focus` border widths, `--ring`, `--r-field`,
+  `--r-fig`, `--mo-fast`/`--mo-base`/`--mo-slow` + `--ease`, the `--z-*` layer scale,
+  and `--fw-*` weights. `--r-control` and `--motion-fast`/`--motion-base` remain as
+  deprecated aliases resolving to their new names, so existing rules are unaffected.
+
+  **Breakpoints.** Presets moved to `src/lib/breakpoints.ts` — shared by the page and
+  post editors rather than owned by the page editor — and now carry the real CSS width
+  each device reports. `4K / Retina` is 2560px (previously mislabelled at 1920px),
+  `Wide Screen` 1920, `Laptop` 1440, plus `Tablet Landscape` 1024, `Tablet Portrait`
+  768, and `Mobile` 390. The retired `1080p` and `tablet` ids coerce onto the presets
+  with the same width. `views/page-editor/viewports.ts` re-exports under the old names
+  and is deprecated.
+
+  **Canvas reflow.** `.prenta-canvas` now establishes an inline-size query container, and
+  the section renderers reflow on the new `@pv-sm|md|lg|xl|2xl` container steps (460 /
+  700 / 900 / 1100 / 2000px) instead of Tailwind's `sm:`/`md:`/`lg:` viewport
+  breakpoints. Previously the previewed page reflowed against the _browser window_, so
+  selecting "Mobile" on a wide monitor rendered a 390px canvas still laid out for
+  desktop — the preview showed a width, not a layout. Containment lives on the shared
+  `.prenta-canvas` class rather than each host, because four surfaces render these
+  sections and a host that forgot it would silently render every breakpoint at the
+  narrowest layout. A test enforces both halves of the contract.
+
+  **Header controls.** The breakpoint control is now a grouped dropdown
+  (`BreakpointPicker`) rather than a segmented row — six presets with names like "Tablet
+  Landscape" no longer fit a header strip — plus a `ZoomChip` that reports the measured
+  scale and toggles fit ↔ actual size.
+
+  **Canvas.** `EditorCanvas` measures available width from a zero-height sentinel
+  instead of `clientWidth - padding`, which disagreed with the canvas's own metrics
+  once a scrollbar appeared or the host scaled the preview. It re-measures on every
+  render — page height changes on text edits and image swaps that resize nothing a
+  ResizeObserver watches — and the canvas surface now declares
+  `container-type: inline-size`, so sections reflow against the simulated width rather
+  than the browser viewport. A meta line reports breakpoint, page dimensions, and
+  scale.
+
+- 6f2eb6d: Replace the page editor's fixed-width sections panel with a resizable, collapsible rail.
+
+  The rail is 300–620px, defaults to 360px, and persists its width to
+  `localStorage['pb.panelW']`. The resize handle is a real `separator` — arrow keys
+  resize it (Shift for a coarse step), `Home` resets, double-click resets — so the panel
+  is operable without a pointer. Collapsing **unmounts** the rail and swaps in a 38px
+  strip rather than animating the width to zero: a zero-width panel leaves a border
+  sliver and keeps its contents in the accessibility tree, where a screen-reader user
+  would land inside a panel nobody can see.
+
+  A tab strip across the top carries the panel's status so the rail reads at a glance
+  while collapsed — a section count on **Sections**, a band-coloured score dot on
+  **SEO & GEO** (with the score in the tab's accessible name, since colour alone is not
+  a signal). Arrow keys move between tabs.
+
+  **SEO moved from a right-hand aside into the rail.** `SeoEditorPane` now renders
+  directly inside the rail, which supplies the resizable container `ResizableAside` used
+  to provide. The header's SEO chip switches to that tab instead of opening a second
+  panel, so the editor has one settings surface rather than two competing ones.
+  `EditorSeoAside` is no longer used by the page editor.
+
+  The **Page** tab is not in this release — its content (address, publishing, search
+  directives, layout lock, danger zone) lands with the page-settings work. Page settings
+  remain reachable from the header, unchanged.
+
+  Also restores the stock Tailwind type scale inside `.prenta-canvas`. The admin remaps
+  six size keys onto its own tokens (`text-base` = 13px), which is right for admin chrome
+  and wrong for the canvas — that renders the consumer's website, where `text-base` must
+  be the 16px a visitor reads. The override lives in `@layer utilities` because layer
+  order beats specificity: in `@layer base` it would lose to the very utility it corrects.
+
+- 6f2eb6d: The media block: every image slot is now the design's component, not a URL field
+
+  Section image slots were a URL text input, a Browse button that opened a modal,
+  and a thumbnail strip. The handoff specifies something quite different, and this
+  implements it.
+  - **The frame shows the crop the TEMPLATE renders** — 16:10 for a section image,
+    1.91:1 for a social card — not the asset's own shape. Framing the asset would
+    tell an editor their portrait photo looks fine and then crop its subject out
+    on the page. What the asset actually is gets reported in the toolbar instead,
+    as `2400 × 1600 · 3:2` beside its filename, so both facts are visible and
+    neither is implied.
+  - **The toolbar is always visible**, never hover-only. Replace and Remove are
+    what an editor comes here to do; behind a hover they are undiscoverable on
+    touch and invisible to anyone scanning the panel.
+  - **The picker opens inside the shell**, not as a dialog. Choosing an image is a
+    comparison against the slot it is going into, and a modal covering that slot
+    removes the only context that matters. It lists only images, and shows each
+    asset's dimensions and ratio so a crop can be predicted before it happens.
+  - **The empty state uses the same frame**, so a slot the template renders is
+    visible as a slot before anything is in it — which is also what makes the
+    alt-text field beside it make sense.
+
+  Ratio labels snap to a name within a tolerance: 2401×1600 reads `3:2`, not
+  `1.50:1`. Assets with no stored dimensions say nothing rather than inventing
+  `1.00:1`. The format badge falls back to the MIME subtype, so a signed CDN link
+  with no file extension still shows `AVIF` instead of a blank chip.
+
+  The library is only requested when the picker is opened.
+
+  Clearing a slot now clears its stored width and height too. Leaving them behind
+  sized the next image by the previous one's box.
+
+- 6f2eb6d: Page tab: address, publishing, search directives, layout, danger zone
+
+  The page editor's rail gains its third tab — everything about a page that is
+  neither its content nor its search copy, in five collapsible groups.
+
+  **Address** — the slug, the resolved full URL with a copy button, and a link to
+  the live page. When a page that is _already live_ changes path, the group says
+  so and offers to create the 301 on publish, naming both paths. A draft changing
+  its slug breaks nothing and says nothing: warning there would train editors to
+  dismiss the warning that matters. The redirect defaults to on, because an
+  unwanted rule is one an editor can delete while a missing one is 404s found by
+  visitors — and if creating it fails, the toast names both paths rather than
+  letting the failure pass as success.
+
+  **Publishing** — timestamps, schedule, and a byline picker (CMS user, brand, or
+  a one-off guest). The byline reaches the page's structured data. It does not
+  reassign the document's `createdById`: that records who created the record, and
+  trading an audit trail for a displayed name is not a swap worth making
+  silently. Status itself stays in the toolbar, so there is one way to publish
+  rather than two that can disagree.
+
+  **Search directives** — the five robots switches, an image-preview size, and the
+  literal `<meta name="robots">` line that will ship, composed by the same
+  function the renderer calls. Snippet and archive are disabled under `noindex`,
+  where they have no effect; an enabled control that changes nothing is a lie
+  about what it does.
+
+  These switches are deliberately not the admin's usual purple toggle. Purple
+  means "on", and "on" is the wrong axis — these are permissive vs restrictive,
+  and the state worth noticing is a page no longer allowed to be found. Green for
+  permitted, red for restricted, with the literal token (`index` / `noindex`)
+  beside each, because the failure to prevent is an editor flipping something
+  whose consequence they could not name.
+
+  **Layout** — template and schema, read-only, with the design-owned note.
+
+  **Danger zone** — duplicate and move-to-trash, with the trash confirming first
+  and saying when the page is live.
+
+- 6f2eb6d: Reflow guard: per-field line counts, and a warning when an edit changes wrapping
+
+  Every guarded text field in the section inspector now carries a readout: the
+  character count, how many lines the copy runs to on the canvas you are looking
+  at, and one dot per breakpoint. When an edit makes the copy wrap to more lines
+  than the published version, the field says so in words — which breakpoints, how
+  many lines it was, how many it is now — and offers a button that takes the
+  canvas there.
+
+  This is the "it fits on my screen" failure: copy that reads fine on a laptop
+  pushes a hero button below the fold on a phone, and nothing in the editor said
+  so. Every dot is a button, because a warning about a width you are not looking
+  at is worth little if you then have to hunt for the breakpoint switcher.
+
+  **What "published" means here.** The baseline is what is live on the site, not
+  what was last saved. This CMS has no draft/published split — saving a PUBLISHED
+  page updates the live content in place — so the baseline is captured whenever
+  the editor takes delivery of a published page, on load and after each save and
+  publish. A page that has never been published has no baseline, and the guard
+  shows line counts with no deltas: there is no live layout to break.
+
+  **Measurement notes.** Line counts come from counting line boxes over the
+  element's contents, not from dividing its height by its line-height. The latter
+  counts padding as text — a button reading "Get Started" measured two lines
+  because its vertical padding came to about another line's worth of height, so
+  every CTA and boxed heading was over-reported.
+
+  Rich text is deliberately not guarded: the whole body is one marker, so a line
+  count across several paragraphs answers no question an editor is asking.
+
+  Shrinking copy is never flagged. Copy that got shorter cannot break a layout
+  that already held the longer version, and warning about it would put a warning
+  on exactly the edit an editor was asked to make.
+
+  Colour never carries the finding alone — each dot names its breakpoint, its line
+  count and its published line count, and the alert repeats all of it in text.
+
+- 6f2eb6d: Reflow guard foundation: measure real components instead of a class chain
+
+  The editor can now tell you when an edit adds a line of wrapped text at a
+  breakpoint you are not looking at — the "it fits on my screen" failure, where
+  copy that reads fine on a laptop pushes a hero button below the fold on a
+  phone.
+
+  **How it measures.** The guard renders the actual section component off-screen
+  and reads the laid-out element, finding fields by the same `data-cms-field`
+  marker the click-to-edit bridge uses. The alternative — rebuilding each probe
+  from a hardcoded list of wrapper classes — is a second source of truth that has
+  to track the renderers by hand, and it cannot describe a consumer's own
+  registered renderer at all. Nothing here needs to stay in sync, and a renderer
+  refactor cannot silently invalidate it.
+
+  **What guards the guard.** A width cap that applies to the rendered element but
+  not to the probe makes the guard lie at exactly the widths where the cap binds
+  — so it looks correct on mobile and reports the wrong line count on laptop and
+  above. `e2e/reflow-probe.spec.ts` asserts probe width equals rendered width for
+  every guarded field on a real page, in a real browser. It has to run in
+  Playwright: `happy-dom` and `jsdom` do no layout, so the same assertion there
+  would pass while measuring nothing.
+
+  That test has already caught two real defects — a probe mounted outside
+  `.prenta-admin` inheriting the document's default font (a button measured 127px
+  rendered and 139px probed), and field paths being unique only within a section
+  rather than across a page.
+
+  **New in `@prenta/sections-react`:** `paddingClass`, `backgroundClass` and
+  `isDark` are now exported. The editor canvas wraps sections itself rather than
+  using `<Sections>`, so its padding has to match the site's exactly — a section
+  padded differently in the preview than on the site makes every line count taken
+  from it wrong. A parity test asserts the two agree.
+
+- 6f2eb6d: Per-page `nosnippet`, `noarchive` and `max-image-preview`
+
+  Pages could set `noindex` and `nofollow` and nothing else. Three directives that
+  matter for how a page appears in results — and, for `nosnippet`, whether it can
+  be cited by an answer engine at all — had no representation anywhere in the
+  product.
+
+  The GEO audit made this visible: it already gated on whether snippets were
+  allowed, reading a value that was hardcoded `true` because nothing could set it.
+  A check that cannot fail and a control that does not exist are the same defect
+  seen from two ends.
+
+  **What ships.** `nosnippet`, `noarchive` and `max-image-preview` are now stored
+  per page, accepted by `PUT /seo/content/:type/:id`, returned by the matching
+  GET, and composed into the rendered `<meta name="robots">`. The GEO gate reads
+  the real value.
+
+  **One composer.** `@prenta/core/seo/robots-directives` owns composition, and
+  both the rendered head and the editor's preview call it. A preview computed by
+  different code from the one that renders is a preview that eventually lies —
+  the first version of this differed from the real output by a self-closing slash,
+  which is now asserted against the actual renderer.
+
+  The composer also encodes two rules worth stating. Nothing is emitted when every
+  directive is permissive: `index, follow` tells a crawler what it already
+  assumed, and a head full of no-op tags makes the meaningful ones harder to find.
+  And `noindex` suppresses the snippet and archive tokens, because a page that
+  cannot appear in results cannot show a snippet from them.
+
+  **Storage is restrictive-form** (`nosnippet: true` means blocked), matching the
+  existing `noindex`/`nofollow` keys, so every document written before this reads
+  as fully permissive rather than fully blocked.
+
+  No migration: these live in the document's existing content JSON.
+
+- 6f2eb6d: Show the SEO/GEO audit in the editor rail, and fix the two scores that disagreed.
+
+  The rail's SEO tab now opens with twin score rings over the SEO and GEO check lists.
+  Each check states its outcome in text — the status square is decorative — and each one
+  that fails says what to do about it. A check that cannot apply is greyed **with the
+  reason and the enabling action**, so a score that moves because the applicable set
+  changed is explainable rather than mysterious.
+
+  The two scores stay separate rather than averaging into one headline: classic search
+  and AI answer visibility fail for different reasons and are fixed by different edits, so
+  an average would hide whichever half is broken.
+
+  **Fixes a live inconsistency.** The rail's tab dot called `computeLiveSeoScore` without
+  a focus keyword while the panel inside that tab analysed _with_ one, so the same page
+  showed two different scores an inch apart. The dot now reads the audit the panel
+  reports — the weaker of the two groups, so it reflects the half that needs work.
+
+  A gated group reads "not rated", not zero. A page held back from search has no search
+  performance to rate, and shouting zero at someone who noindexed a thank-you page on
+  purpose is noise.
+
+  Two inputs are passed as _unknown_ rather than absent, so their checks report
+  not-applicable instead of failing an editor for a gap in the plumbing: the OG image is
+  stored as a URL with no dimensions, which the check needs, and no author is surfaced
+  until the Page tab's author picker exists.
+
+- 6f2eb6d: Make the editor canvas render the same section components the public site does.
+
+  `<AdminRoot sectionRenderers>` has always been documented as the way to "hand the
+  admin the exact same components it registers for the public site," but the canvas
+  consulted that map **only for section types it didn't already know**. Every built-in
+  type — hero, text, feature, stats, cta and the rest — short-circuited to the admin's
+  own approximation first, so a consumer passing `DEFAULT_SECTION_RENDERERS` from
+  `@prenta/sections-react` had most of their map silently ignored.
+
+  The two implementations had drifted accordingly. For a hero heading the public
+  component renders `text-4xl` at weight 700 stepping to `text-5xl`; the admin's
+  rendered `text-3xl` at weight 600. Body copy was 16px against the site's 18px. The
+  canvas was presenting itself as a preview of a page it was not rendering — copy that
+  fit on two lines there could wrap to three on the live site.
+
+  **Supplied renderers now take precedence for every type**, built-ins included. The
+  admin's own components remain as the fallback for consumers who pass nothing, and a
+  supplied renderer that throws falls back to the built-in for that type rather than to
+  the "custom section" placeholder.
+
+  Two things had to change for supplied renderers to actually run:
+  - `ADMIN_RENDER_OPTIONS` now carries `lcp` and `prefetchedForms`. Public renderers
+    call `options.lcp.claim()` during render, so hero, feature and gallery would have
+    thrown on their first image. The canvas controller always declines the priority
+    slot — nothing competes for bandwidth there, so every image lazy-loads.
+  - `AdminSectionRendererProps['options'].prefetchedForms` is typed loosely enough for
+    the real `SectionRendererMap` to remain assignable. Renderers are function types, so
+    `strictFunctionTypes` compares their parameters contravariantly and a narrower type
+    on the admin side made the whole map unassignable — defeating the point of the
+    mirror. `admin-renderer-compat.test.ts` now performs that assignment so the shapes
+    cannot drift apart silently again.
+
+  **Scaffolded projects get parity by default.** `create-prenta` wires
+  `DEFAULT_SECTION_RENDERERS` into `<AdminRoot>` for every template, merging any custom
+  section map over the top, and the generated admin route imports the site stylesheet so
+  those components arrive with their styles. Admin CSS still loads last and wins — it is
+  namespaced under `.prenta-admin` with a doubled-class specificity defence that exists
+  precisely because consumer sites import their stylesheet there.
+
+  **Consumers who wire the admin by hand** should pass `DEFAULT_SECTION_RENDERERS` (or
+  their own registered map) to `<AdminRoot sectionRenderers>` and ensure the admin
+  route's CSS covers `@prenta/sections-react`. Without both, the canvas keeps using the
+  admin's approximations — the previous behaviour, so nothing breaks by omission.
+
+### Patch Changes
+
+- 6f2eb6d: Make every score in the page editor come from one model, banded by one scale.
+
+  Three surfaces showed a score and no two agreed. The rail's tab dot banded with
+  `gradeFromScore` (80/60) while the rings it summarised banded with the audit's
+  `scoreBand` (80/55), so a page scoring 57 read "fair" in the panel and "poor" on the
+  tab above it. The header chip showed `computeLiveSeoScore` — a third number from the
+  content analyser — so the header read 53 beside rings reading 0 and 57.
+
+  Now the tab dot and the header chip both read the audit and band with `scoreBand`.
+  `EditorSeoScoreBadge` takes the band from its caller rather than deriving one, because
+  the two scales legitimately differ: the audit bands at 80/55, `analyzeContent` at
+  80/60/1, and colouring one model's number with another's thresholds is what caused
+  this.
+
+  **Removes a fallback that quietly reinstated the second scorer.** When both audit
+  groups were gated off, the tab fell back to `computeLiveSeoScore` — putting a number
+  from a different model, with different bands, on a tab summarising the audit. The tab
+  score is now three-valued: a number bands normally, `null` (deliberately unrated, e.g.
+  a noindexed page) renders neutral and announces "not rated", and `undefined` (not known
+  yet) renders no dot at all. No dot beats a dot computed by the wrong model.
+
+  One visible consequence: the header chip shows no number until the SEO tab has been
+  opened, because the audit is computed where the SEO record is fetched. That is a
+  deliberate trade — see `docs/page-builder-handoff-followups.md` for the fix that
+  removes it.
+
+  Also pins `@prenta/admin`'s packaging: a test asserts `sideEffects` is never `false`,
+  which would let bundlers drop the precompiled CSS import and render the admin unstyled
+  with no error anywhere. `@prenta/sections-react` hit exactly that and had to be
+  corrected before publish.
+
+- 6f2eb6d: Editor canvas paints section backgrounds in the site's palette, not the admin theme's
+
+  The canvas used admin theme tokens (`bg-brand`, `bg-card`, `bg-muted`) for
+  section backgrounds. Those follow the editor's light/dark preference; the live
+  site does not. So an editor working in dark mode previewed a hero in `#9D71F0`
+  sitting on dark body sections, while the published page rendered `violet-600`
+  on white — a page no visitor would ever see.
+
+  In light mode this changes nothing visible: `--brand` resolves to `#7C3AED`,
+  which is `violet-600`, and `--card` is white. The entire discrepancy lived in
+  dark mode, which is where it was least likely to be spotted and most likely to
+  mislead. Six dark-mode baselines are updated; no light-mode capture moved.
+
+  It also resolves an inconsistency inside the admin's own implementation, where
+  a _gradient_ purple background used the site's raw palette while a _solid_
+  purple used a theme token — the two halves of an unfinished migration
+  disagreeing with each other.
+
+  **New in `@prenta/core/page-sections`:** `backgroundPreset`, `isDarkBackground`,
+  `BACKGROUND_PRESETS` and the `BackgroundPreset` type.
+
+  The two renderers still hold their own class strings, and have to. Tailwind
+  generates utilities by scanning source text, and each package's stylesheet
+  scans only its own `src/` tree — a literal shared from a third package is
+  generated by nobody, so the section renders with correct markup and no
+  background at all. (That failure mode is why `@prenta/sections-react` ships a
+  precompiled stylesheet in the first place.)
+
+  So core owns the _decision_ and each renderer maps it to its own strings
+  through a `Record<BackgroundPreset, string>`. Adding a preset now fails both
+  builds until each has handled it — verified by adding one and watching both
+  packages refuse to compile — and a parity test asserts the strings still match.
+
+- 6f2eb6d: Let a saved draft's SEO be edited.
+
+  `GET /seo/content/:entityType/:entityId` resolved the record through
+  `gatherAuditEntities()`, which filters `status: 'PUBLISHED'`. A saved-but-unpublished
+  page therefore had no record, the GET 404'd, and the SEO pane rendered an error where
+  its form belongs — so title, description, focus keyword, schema, social preview and
+  length meters were all unreachable. The affected state is the normal one: saved, being
+  worked on, not yet published, which is exactly when metadata gets written.
+
+  It was an asymmetry rather than a policy — the matching `PUT` has no status filter, so
+  SEO could be written for a draft and never read back.
+
+  `GatherAuditOptions` gains an opt-in `documentIds`. When supplied the gather drops the
+  status filter: asking for a named document is a different question from auditing live
+  content. Every other caller — audits, redirect sweeps, navigation, the SEO list — is
+  unchanged and stays published-only. The per-document GET now scopes to the single id it
+  was asked for, which also avoids building every record to find one.
+
+  `SeoEditorPane` degrades instead of erroring: when no record loads it seeds the form
+  from the document's own meta and saving creates the record. That matters on its own,
+  because `@prenta/admin` peer-depends on `@prenta/core >=0.1.0` and can run against a
+  core without the route fix.
+
+  One visible consequence on unpublished pages: the GEO score rises, because the schema
+  type is now readable where it previously could not be loaded at all.
+
+- 6f2eb6d: Give every page a score, from first paint, from one computation.
+
+  The header chip and the rail's tab dot now read an audit computed in the page
+  editor itself, so a score is present as soon as the page loads rather than only
+  after someone opens the SEO tab. While that tab is open it reports a live audit
+  built from unsaved form state, which supersedes the saved one — the score still
+  moves as you type.
+
+  Both paths build their input through `lib/page-audit-input.ts`, so they can differ
+  only in saved-versus-unsaved metadata — the difference an editor expects to see — and
+  never in which field feeds which check. A test asserts the two produce identical scores
+  for identical data. Three hand-written copies of that mapping is how the editor ended up
+  showing three different numbers.
+
+  **Also scores pages that have no SEO record yet.** A page that has never had SEO edited
+  had nothing to audit against, so the chip stayed blank on exactly the pages most in need
+  of a nudge. It now falls back to the document's own title and description, treating the
+  record-only inputs (focus keyword, schema, robots, OG image) as unset. That is honest —
+  none of them have been chosen — and the score improves the moment SEO is filled in.
+
+- 6f2eb6d: Fix Page tab slug/path sync, publisher redirects, and stale audit after directives.
+
+  Changing the URL slug on the Page tab now keeps `path` in lockstep when it was
+  derived from the previous slug — the displayed full URL and the 301-on-publish
+  detector both read `path`, so a slug-only edit silently skipped the redirect
+  warning. Custom paths (e.g. `/team/about`) are left alone.
+
+  `POST /redirects` accepts the same roles that can publish a page (OWNER, ADMIN,
+  EDITOR), so an editor who moves a live slug can create the 301 the UI offers.
+  Users who cannot create redirects still see the URL-changed warning, without a
+  checkbox that would promise a redirect the API would reject.
+
+  Saving or publishing robots directives reloads the page audit so the header chip
+  and rail score update immediately after noindex/nosnippet flips.
+
+- 6f2eb6d: Add a real search-result preview and length meters to the SEO editor.
+
+  `SerpPreview` renders the URL, title and description the way a searcher sees them.
+  The previous inline card painted the title in the brand accent, which made it a preview
+  of the admin rather than of a search result — the link blue is deliberately a literal
+  (`#1a0dab`, `#8ab4f8` in dark) rather than a token, because a brand accent repainting it
+  would quietly stop it being a preview.
+
+  `SeoCharCount` gains a meter bar and now names _which way_ a field is wrong: "too short"
+  means engines have less to match on, "will be truncated" means the tail is written but
+  nobody will read it. The old wording collapsed the short case into "aim for 30–60",
+  which states the target without saying which direction to edit. The bar stays full past
+  the maximum — one that kept growing would imply more is better.
+
+  **Removes a duplicate.** The pane carried its own `CharCount` (count only, no minimum)
+  while the fuller `SeoCharCount` existed but was referenced by nothing except its own
+  test. Both meta fields now use the one component, `min` is optional for cap-only fields,
+  and its range constants are the same ones the audit's title and description checks score
+  against — so the meter cannot say "good" while the check fails.
+
+  Note: these render only for pages that have a SEO content record, which today means
+  published pages. See `docs/page-builder-handoff-followups.md` #16 — the per-document GET
+  resolves through a published-only pipeline, so a saved draft cannot have its SEO edited
+  at all. That is a pre-existing gap, unchanged here.
+
+- 6f2eb6d: Make the share image settable from the SEO editor.
+
+  The social card showed `record.ogImage` and nothing else — there was no way to choose,
+  replace or clear a share image from the SEO editor at all, so the one field with the
+  largest effect on how a link looks when shared could only be set elsewhere.
+
+  The card is now the control: an empty state that opens the media picker, a persistent
+  toolbar with Choose/Replace and Remove, and the filename alongside. The toolbar is
+  always visible rather than hover-only — a control an editor has to discover by hovering
+  is one most never find. Domain, title and description stay between the image and the
+  toolbar, so the card reads as the shared post rather than as a form with a thumbnail on
+  top.
+
+  The audit reacts immediately: `hasOgImage` reads the live form value, so picking or
+  clearing an image moves the score without a save round-trip. An empty string is treated
+  as a deliberate removal (the check fails) and is distinct from "an image exists but its
+  dimensions are unknown here" (not-applicable) — a test pins both.
+
+  The accordion carries an `Image set` / `No image` badge, so the state is readable while
+  collapsed. A shared link with no image is the single biggest drop in engagement, which
+  is worth stating without expanding the group.
+
+  Card type (`summary_large_image` vs `summary`) is not included: `PUT /seo/content`
+  accepts no `twitterCard` field, so it would need an API change rather than a UI one.
+
 ## 0.92.0
 
 ### Minor Changes