@taprootio/site-authoring 0.10.8 → 0.11.0

package/README.md

@@ -550,8 +550,8 @@ The destination must be new, outside the source workspace, and its parent must e
 `taproot-site --config path/to/taproot-site.json validate --init ../authoring-fixture`
 to select another source configuration. Initialization needs no credential or
 network. It exports editable free-form pages as ProseMirror with navigation,
-redirects, settings, and version-6 appearance/footer metadata, validates the
-result, and leaves the source unchanged. Excluded metadata/read-only pages are
+redirects, settings, and version-7 appearance/footer metadata, validates the
+result, and leaves the source unchanged. Excluded metadata-only pages are
 counted; unresolved references to them fail validation.
 
 Exported UUIDs and HTTP(S) origins are deterministic fixture values under

package/examples/riverbend-wellness/manifest.fixture.json

@@ -1,5 +1,5 @@
 {
-  "manifestVersion": 6,
+  "manifestVersion": 7,
   "siteId": "a0000000-0000-4000-8000-000000000001",
   "pulledAt": "2026-09-04T00:00:00.000Z",
   "pages": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taprootio/site-authoring",
-  "version": "0.10.8",
+  "version": "0.11.0",
   "description": "Taproot site authoring CLI: sign in once in the browser, then pull, validate, push, preview, approve, and deploy a site from the terminal",
   "type": "module",
   "license": "ISC",

package/src/cli.js

@@ -222,7 +222,6 @@ const VERBS = Object.freeze([
     tokens: ["pages", "push"],
     summary: "Create and update pages from the local workspace.",
     positionals: "pagePaths",
-    allowRawHtml: true,
     note:
       "Positional page paths narrow the push to those pages; with none, every workspace page is validated and sent. "
       + "The homepage is recorded with an empty path, so address it as '/'. "
@@ -234,13 +233,7 @@ const VERBS = Object.freeze([
       + "documents of pages it is not sending: an unrelated page left on an obsolete contract is reported by the "
       + "whole-workspace push, not used to block this one. The result states the selection and how many sources were "
       + "discovered and validated. "
-      + "The system 404 projection written by pull is read-only: an unchanged whole-workspace push verifies and skips it, "
-      + "while a changed, missing, or replacement source is refused before any page mutation, and naming it in a "
-      + "selection is refused outright. "
-      + "See 'taproot-site help page free-form' for the stable manifest and error contract. "
-      + "--allow-raw-html permits rawHtml nodes, which render verbatim and"
-      + " unsanitized on the published site. Off by default on purpose; leave"
-      + " it off unless the content is trusted hand-written markup.",
+      + "See 'taproot-site help page free-form' for the stable manifest and error contract.",
   },
   {
     name: VERB_NAV_PUSH,
@@ -573,9 +566,6 @@ function verbHelp(verb) {
   --production     Promote the completed staging deployment to production.
   --allow-failed-preview  Explicitly override the matching candidate's failed preview.`
     : "";
-  const rawHtmlOption = verb.allowRawHtml
-    ? "\n  --allow-raw-html Permit rawHtml nodes. They render verbatim and unsanitized."
-    : "";
   const jsonOption = verb.json
     ? "\n  --json           Emit the stable JSON contract (operational output is always JSON)."
     : "";
@@ -649,7 +639,7 @@ function verbHelp(verb) {
 ${verb.summary}
 ${boundary}
 
-${options}${targetOption}${deliveryTargetOption}${rawHtmlOption}${jsonOption}${dryRunOption}${nameOption}${note}
+${options}${targetOption}${deliveryTargetOption}${jsonOption}${dryRunOption}${nameOption}${note}
 `;
 }
 
@@ -923,7 +913,6 @@ function parseArguments(arguments_) {
   let propagationWaitSeconds;
   let browser;
   let allowFailedPreview = false;
-  let allowRawHtml = false;
   let dryRun = false;
   let json = false;
   let keyName;
@@ -983,13 +972,6 @@ function parseArguments(arguments_) {
       allowFailedPreview = true;
       continue;
     }
-    if (verb.allowRawHtml && argument === "--allow-raw-html") {
-      if (allowRawHtml) {
-        throw usageError("cli.duplicate_option", "--allow-raw-html may be supplied only once.");
-      }
-      allowRawHtml = true;
-      continue;
-    }
     if (verb.dryRun && argument === "--dry-run") {
       if (dryRun) throw usageError("cli.duplicate_option", "--dry-run may be supplied only once.");
       dryRun = true;
@@ -1124,7 +1106,6 @@ function parseArguments(arguments_) {
     ...(propagationWaitSeconds === undefined ? {} : { propagationWaitSeconds }),
     ...(browser === undefined ? {} : { browser }),
     init,
-    allowRawHtml,
     dryRun,
     keyName,
     positionals: verb.positionals
@@ -1202,7 +1183,6 @@ export async function runCli({
       allowFailedPreview: parsed.allowFailedPreview,
       init: parsed.init,
       quiet: parsed.quiet,
-      allowRawHtml: parsed.allowRawHtml,
       dryRun: parsed.dryRun,
       keyName: parsed.keyName,
       capabilities: parsed.capabilities,

package/src/constants.js

@@ -1,5 +1,5 @@
 export const CLI_NAME = "@taprootio/site-authoring";
-export const CLI_VERSION = "0.10.8";
+export const CLI_VERSION = "0.11.0";
 export const CLI_BINARY_NAME = "taproot-site";
 export const RESULT_SCHEMA_VERSION = 1;
 export const CONFIG_FILE_NAME = "taproot-site.json";

package/src/content/free-form-section-registry.json

@@ -1,5 +1,5 @@
 {
-  "version": 6,
+  "version": 7,
   "section": {
     "nodeType": "section",
     "label": "Section",
@@ -488,8 +488,8 @@
       "measure": "wide",
       "placement": "flow"
     },
-    "rawHtml": {
-      "label": "Raw HTML",
+    "integrationFragment": {
+      "label": "Integration content",
       "measure": "wide",
       "placement": "flow"
     },
@@ -593,5 +593,8 @@
       "section": true,
       "measure": "wide"
     }
-  }
+  },
+  "retiredNodeTypes": [
+    "rawHtml"
+  ]
 }

package/src/content/tiptap-prosemirror.ts

@@ -72,10 +72,13 @@ export interface RenderProseMirrorOptions {
   nodeRenderers?: {
     componentBlock?: (node: ProseMirrorNode) => string | undefined;
     taprootImage?: (node: ProseMirrorNode) => string | undefined;
-    rawHtml?: (html: string, node: ProseMirrorNode) => string | undefined;
+    /** Emits an adopted fragment's canonical bytes; without it the node renders nothing. */
+    integrationFragment?: (node: ProseMirrorNode) => string | undefined;
   };
   /** Records visible document-order content after each node is rendered. */
   onRenderedNode?: (node: ProseMirrorNode, html: string) => void;
+  /** Maps an authored heading level (1–4) to the level rendered; defaults to the authored level. */
+  headingLevel?: (authored: number) => number;
   /** Claims the page's one LCP slot before rendering a section photo. */
   claimSectionBackgroundImage?: () => boolean;
 }
@@ -128,16 +131,6 @@ function collectText(node: ProseMirrorNode, parts: string[]): void {
     return;
   }
 
-  // rawHtml is an intentional, already-sanitized node in the JSON document
-  // contract. It is not the retired outer HTML-body transport. Preserve its
-  // reader-visible text when a consumer (for example Recipe JSON-LD) needs a
-  // plain-text representation of the document.
-  if (node.type === "rawHtml") {
-    const html = stringAttr(node.attrs?.html);
-    if (html) parts.push(plainTextFromRawHtml(html));
-    return;
-  }
-
   for (const child of node.content ?? []) {
     collectText(child, parts);
   }
@@ -157,12 +150,6 @@ function isTextBlock(type: string): boolean {
     || type === "tableHeader";
 }
 
-function plainTextFromRawHtml(html: string): string {
-  return html
-    .replace(/<(?:br\s*\/?|\/(?:p|div|li|h[1-6]|blockquote|pre|tr|table|section|article))\s*[^>]*>/giu, " ")
-    .replace(/<[^>]*>/gu, "");
-}
-
 type RenderPlacement = "root" | "section" | "nested";
 
 function renderNodes(
@@ -292,10 +279,10 @@ function renderNode(
         placement === "root" ? "section" : "nested",
         compactFollowing,
       );
-    case "rawHtml": {
-      const html = stringAttr(node.attrs?.html) ?? "";
-      return options.nodeRenderers?.rawHtml?.(html, node) ?? html;
-    }
+    case "integrationFragment":
+      // Root only: a fragment nested in a section, list or quote is not one
+      // adoption wrote, so it renders nothing whatever hook is supplied.
+      return placement === "root" ? options.nodeRenderers?.integrationFragment?.(node) ?? "" : "";
     default:
       return renderNodes(node.content ?? [], options, "nested");
   }
@@ -363,7 +350,8 @@ function wrapMark(html: string, mark: ProseMirrorMark): string {
 
 function renderHeading(node: ProseMirrorNode, options: RenderProseMirrorOptions): string {
   const rawLevel = numberAttr(node.attrs?.level) ?? 1;
-  const level = Math.min(4, Math.max(1, Math.trunc(rawLevel)));
+  const authored = Math.min(4, Math.max(1, Math.trunc(rawLevel)));
+  const level = Math.min(6, Math.max(1, options.headingLevel?.(authored) ?? authored));
   return renderElement(
     `h${level}`,
     withProseMeasure(textBlockAttrs(node.attrs), node.type, options),

package/src/content/validate-document.js

@@ -22,6 +22,7 @@ import {
   NODE_TYPE_SET,
   normalizeCssLengthOverride,
   pointerSegment,
+  RETIRED_NODE_TYPE_SET,
   TEXT_ALIGNMENTS,
   TIPTAP_SITE_DEFAULT,
 } from "./vocabulary.js";
@@ -280,14 +281,19 @@ const BLOCKS = Object.freeze([
   "taprootImage",
   "componentBlock",
   "integrationPlacement",
-  "rawHtml",
 ]);
 const SECTION_BLOCKS = Object.freeze([
   ...BLOCKS,
   TABLE_NODE_TYPES.table,
   INLINE_FACTS_CONTRACT.nodeType,
 ]);
-const ROOT_BLOCKS = Object.freeze([...SECTION_BLOCKS, FREE_FORM_SECTION_REGISTRY.section.nodeType]);
+// integrationFragment is root-only: adoption writes one per source fragment
+// as a direct child of the doc, and nothing nests it anywhere else.
+const ROOT_BLOCKS = Object.freeze([
+  ...SECTION_BLOCKS,
+  FREE_FORM_SECTION_REGISTRY.section.nodeType,
+  "integrationFragment",
+]);
 const NONE = Object.freeze([]);
 
 const rule = (options) => Object.freeze({ attrs: Object.freeze({}), children: NONE, minChildren: 0, ...options });
@@ -401,6 +407,24 @@ const NODE_RULES = Object.freeze({
         ? null : "a positive server-assigned configuration revision"),
     }),
   }),
+  // Integration adoption's frozen fragment. Authors keep or delete one, never
+  // create or alter it; the API holds every pushed fragment to a stored copy,
+  // so this checks only that the shape is one adoption could have written.
+  integrationFragment: rule({
+    attrs: Object.freeze({
+      html: spec((value) => (typeof value === "string" && value !== "" ? null : "a non-empty string"), {
+        required: true,
+      }),
+      // Strictly ascending ordinal order, which also makes the ids distinct:
+      // adoption writes them sorted, and the API's PageBodyNodePolicy refuses
+      // any other order. Lowercase UUIDs are ASCII, so `<` is ordinal here.
+      imageIds: spec((value) => (Array.isArray(value)
+          && value.every(isUuid)
+          && value.every((id, index) => index === 0 || value[index - 1] < id)
+        ? null
+        : "an array of distinct lowercase image UUIDs in ascending order"), { required: true }),
+    }),
+  }),
   section: rule({
     attrs: SECTION_ATTRS,
     children: SECTION_BLOCKS,
@@ -417,12 +441,6 @@ const NODE_RULES = Object.freeze({
     }),
     inlineFacts: true,
   }),
-  rawHtml: rule({
-    attrs: Object.freeze({
-      html: spec((value) => (typeof value === "string" ? null : "a string"), { required: true }),
-    }),
-    rawHtml: true,
-  }),
   [TABLE_NODE_TYPES.table]: rule({
     attrs: TABLE_ATTRS,
     children: Object.freeze([TABLE_NODE_TYPES.row]),
@@ -975,6 +993,15 @@ function validateNode(node, path, parentRule, index, state, depth) {
     report(state, path, CODES.nodeInvalid, "A node must be an object with a string 'type'.");
     return;
   }
+  if (RETIRED_NODE_TYPE_SET.has(node.type)) {
+    report(
+      state,
+      path,
+      CODES.rawHtmlForbidden,
+      `'${identifier(node.type)}' is a retired node type. Rewrite its content as ordinary nodes.`,
+    );
+    return;
+  }
   if (!NODE_TYPE_SET.has(node.type)) {
     report(
       state,
@@ -1003,14 +1030,6 @@ function validateNode(node, path, parentRule, index, state, depth) {
   }
 
   const nodeRule = NODE_RULES[node.type];
-  if (nodeRule.rawHtml && !state.allowRawHtml) {
-    report(
-      state,
-      path,
-      CODES.rawHtmlForbidden,
-      "A 'rawHtml' node is published verbatim and unsanitised. Pass allowRawHtml to accept one deliberately.",
-    );
-  }
   if (node.type === "text") {
     if (typeof node.text !== "string") {
       report(state, path, CODES.textInvalid, "A text node must carry a string 'text'.");
@@ -1036,16 +1055,11 @@ function validateNode(node, path, parentRule, index, state, depth) {
  * itself, `/content/3/content/0` its fourth block's first child, and a
  * component finding continues *through* the `componentData` JSON string into
  * the parsed data). `code` is one of `CONTENT_ERROR_CODES`.
- *
- * `allowRawHtml` opts a caller into `rawHtml` nodes, which are published
- * unsanitised. It is off by default precisely because an agent should not be
- * able to emit one by accident.
  */
-export function validateDocument(document, options = {}) {
+export function validateDocument(document) {
   const state = {
     errors: [],
     truncated: false,
-    allowRawHtml: options?.allowRawHtml === true,
   };
 
   if (!isPlainObject(document) || document.type !== "doc") {

package/src/content/vocabulary.js

@@ -50,9 +50,9 @@ export const NODE_TYPES = Object.freeze([
   "taprootImage",
   "componentBlock",
   "integrationPlacement",
+  "integrationFragment",
   "section",
   freeFormSectionRegistry.inlineFacts.nodeType,
-  "rawHtml",
   freeFormSectionRegistry.table.nodeTypes.table,
   freeFormSectionRegistry.table.nodeTypes.row,
   freeFormSectionRegistry.table.nodeTypes.header,
@@ -73,6 +73,12 @@ export const MARK_TYPES = Object.freeze([
 export const NODE_TYPE_SET = Object.freeze(new Set(NODE_TYPES));
 export const MARK_TYPE_SET = Object.freeze(new Set(MARK_TYPES));
 
+// Node names the contract has retired. Each is refused by name rather than
+// reported as unknown, so an old document gets a pointed answer instead of a
+// generic one, and the parity test keeps every name out of NODE_TYPES.
+export const RETIRED_NODE_TYPES = Object.freeze([...freeFormSectionRegistry.retiredNodeTypes]);
+export const RETIRED_NODE_TYPE_SET = Object.freeze(new Set(RETIRED_NODE_TYPES));
+
 /**
  * Every code this module emits. They are wire identities an agent branches on,
  * so they are appended to, never reworded or renumbered.
@@ -109,7 +115,7 @@ export const CONTENT_ERROR_CODES = Object.freeze({
   componentUnknown: "content.component_unknown",
   componentData: "content.component_data",
   sectionContextUnknown: "content.section_context_unknown",
-  // Raw HTML
+  // Retired rawHtml node
   rawHtmlForbidden: "content.raw_html_forbidden",
   // Tables
   tableHeader: "content.table_header",
@@ -283,78 +289,24 @@ export function isUuid(value) {
 // Server-parity: RichTextBody.IsPresent
 // ---------------------------------------------------------------------------
 
-const NAMED_ENTITIES = Object.freeze({
-  amp: "&",
-  apos: "'",
-  gt: ">",
-  lt: "<",
-  nbsp: " ",
-  quot: "\"",
-});
-
-/**
- * A bounded stand-in for `WebUtility.HtmlDecode`, used only to answer "does
- * this raw HTML contain visible text?". The named set covers the entities that
- * can hide a `<` or a space; an unknown named entity stays literal, which
- * makes the answer *more* likely to be "yes, there is text" — the safe
- * direction, because a false "empty" would refuse a page the server accepts.
- */
-function decodeHtmlEntities(html) {
-  return html.replace(/&(#[0-9]{1,7}|#[xX][0-9a-fA-F]{1,6}|[a-zA-Z][a-zA-Z0-9]{1,31});/g, (match, body) => {
-    if (body[0] === "#") {
-      const codePoint = body[1] === "x" || body[1] === "X"
-        ? Number.parseInt(body.slice(2), 16)
-        : Number.parseInt(body.slice(1), 10);
-      if (!Number.isFinite(codePoint) || codePoint < 0 || codePoint > 0x10ffff) return match;
-      try {
-        return String.fromCodePoint(codePoint);
-      } catch {
-        return match;
-      }
-    }
-    return NAMED_ENTITIES[body] ?? match;
-  });
-}
-
-/** Mirrors `RichTextBody.HasMeaningfulHtml`: text outside tags, after decoding. */
-function hasMeaningfulHtml(html) {
-  if (typeof html !== "string" || html.trim() === "") return false;
-  const decoded = decodeHtmlEntities(html).replaceAll("\u00a0", " ");
-  let insideTag = false;
-  for (const character of decoded) {
-    if (character === "<") {
-      insideTag = true;
-      continue;
-    }
-    if (character === ">") {
-      insideTag = false;
-      continue;
-    }
-    if (!insideTag && character.trim() !== "") return true;
-  }
-  return false;
-}
-
 /**
  * Mirrors `RichTextBody.HasMeaningfulContent` in
  * `api/src/Taproot.Domain/Entities/PageModel/RichTextBody.cs`. Text counts when
- * it is non-whitespace, raw HTML when it has visible text, and images and
- * component blocks always count; every other node counts only through its
- * children. A body that fails this is refused by the server with "Body is
- * required", which is why this package names it locally instead.
+ * it is non-whitespace; images, component blocks, integration placements and
+ * adopted integration fragments always count; every other node counts only
+ * through its children. A body that fails this is refused by the server with
+ * "Body is required", which is why this package names it locally instead.
  */
 function hasMeaningfulContent(node, depth = 0) {
   if (!isPlainObject(node) || depth > CONTENT_LIMITS.documentDepth) return false;
   if (node.type === "text") {
     return typeof node.text === "string" && node.text.trim() !== "";
   }
-  if (node.type === "rawHtml") {
-    return isPlainObject(node.attrs) && hasMeaningfulHtml(node.attrs.html);
-  }
   if (
     node.type === "taprootImage"
     || node.type === "componentBlock"
     || node.type === "integrationPlacement"
+    || node.type === "integrationFragment"
     || node.type === freeFormSectionRegistry.inlineFacts.nodeType
   ) return true;
   if (!Array.isArray(node.content)) return false;

package/src/reference-help.js

@@ -39,10 +39,8 @@ import {
   INTERNAL_PAGE_BASELINE_DIRECTORY,
   MANIFEST_VERSION,
   NAVIGATION_FILE_NAME,
-  PAGE_READ_ONLY_REASON_SYSTEM_404,
   PAGE_SOURCE_EXTENSIONS,
   PAGE_WORKSPACE_MODE_EDITABLE,
-  PAGE_WORKSPACE_MODE_READ_ONLY,
   PAGES_DIRECTORY,
   pageSourceFormat,
   SETTINGS_DIRECTORY,
@@ -51,7 +49,7 @@ import {
 
 export { getAppearanceReference, getFooterReference, getThemeReference };
 
-export const REFERENCE_VERSION = 26;
+export const REFERENCE_VERSION = 27;
 export const PAGE_TYPES = Object.freeze(["free-form"]);
 
 function deepFreeze(value) {
@@ -716,9 +714,9 @@ const WORKFLOW_REFERENCES = Object.freeze({
       + "with no duplicates. Fixtures are copied and shipped, so a real delivery host in one would be a live "
       + "reference in every copy.",
       "validate reads the fixture and writes nothing to it. Copy the directory somewhere writable before editing it.",
-      "validate --init <new-directory> exports the current pulled workspace as a validated version-6 fixture with "
+      "validate --init <new-directory> exports the current pulled workspace as a validated version-7 fixture with "
       + "appearance and footer metadata. Run from the workspace or its configured project; --config may select the source.",
-      "Initialization keeps editable free-form pages as ProseMirror sources and reports excluded metadata/read-only pages. "
+      "Initialization keeps editable free-form pages as ProseMirror sources and reports excluded metadata-only pages. "
       + "References to excluded pages must be resolved before the fixture can validate. It never copies credentials, "
       + "internal reconciliation state, or deployment receipts. UUIDs and HTTP(S) origins are replaced with deterministic "
       + "fixture identities and example.test origins; URL credentials, queries and fragments are removed. Authored prose is retained.",
@@ -1315,26 +1313,9 @@ const FREE_FORM_REFERENCE = Object.freeze({
           "Read from .taproot-site-manifest.json at the workspace root; the document file contains only the ProseMirror root.",
       }),
     ]),
-    systemPages: Object.freeze([
-      Object.freeze({
-        path: SYSTEM_PAGE_NOT_FOUND_PATH,
-        mode: PAGE_WORKSPACE_MODE_READ_ONLY,
-        reason: PAGE_READ_ONLY_REASON_SYSTEM_404,
-        projection:
-          "pull writes the exact stored ProseMirror body and records its SHA-256 in .taproot-site-manifest.json",
-        unchangedPush: "A whole-workspace pages push verifies the hash and skips this file without updating the page.",
-        approval:
-          "An unscoped approve excludes this projection even when the live system page carries a draft; naming it explicitly is refused.",
-        modifiedError: "pages.read_only_modified",
-        missingError: "pages.read_only_missing",
-        replacementError: "pages.system_page_read_only",
-        scopedPushError: "pages.page_read_only",
-        scopedApprovalError: "approve.page_read_only",
-        guidance:
-          "Do not delete, replace, or edit this file. Run pull to restore it; author the system 404 through an owner-controlled surface.",
-      }),
-    ]),
-    systemHome: "The pulled home page remains an ordinary editable page.",
+    systemPages:
+      `Home and ${SYSTEM_PAGE_NOT_FOUND_PATH} are ordinary editable pages. Taproot seeds both, so they are update-only `
+      + "and their paths are immutable.",
   }),
   document: Object.freeze({
     root: Object.freeze({ type: "doc", content: "array of supported block nodes" }),
@@ -1369,19 +1350,9 @@ const FREE_FORM_REFERENCE = Object.freeze({
     }),
     tableNode: TABLE_REFERENCE,
     inlineFactsNode: INLINE_FACTS_REFERENCE,
-    rawHtml: Object.freeze({
-      default: "rejected",
-      trackedProseMirror: Object.freeze({
-        format: ".pm.json",
-        optIn: `${CLI_BINARY_NAME} pages push --allow-raw-html`,
-        behavior: "The flag permits explicit rawHtml nodes only in a tracked ProseMirror document.",
-      }),
-      markdown: Object.freeze({
-        format: ".md",
-        supported: false,
-        behavior: "Inline HTML remains unsupported and is rejected even when --allow-raw-html is present.",
-      }),
-      warning: "rawHtml renders verbatim and unsanitized; use it only for trusted hand-written markup.",
+    integrationFragmentNode: Object.freeze({
+      type: "integrationFragment",
+      note: "Adopted integration content: preserved or deleted, never authored.",
     }),
   }),
   sections: Object.freeze({
@@ -1592,13 +1563,7 @@ export function formatReferenceResult(result) {
         page.workspace.formats.map((format) => `  ${format.extension.padEnd(9)} ${format.purpose}`).join("\n")
       }\n\nOne source per page:\n  rule                  ${sourceRule.rule}\n  manifest fields       ${
         sourceRule.manifestFields.join(", ")
-      }\n  pull                  ${sourceRule.pull}\n  internal state        ${sourceRule.internalState}\n  format change         ${sourceRule.formatChange} (${sourceRule.formatChangeError})\n  renamed source        ${sourceRule.renamedSource} (${sourceRule.renamedSourceError})\n  conflicts             ${sourceRule.conflict} (${sourceRule.conflictError})\n  conflict detail       ${sourceRule.conflictDetail}\n  push conflicts        ${sourceRule.pushConflict} (${sourceRule.pushConflictError})\n  revision              ${sourceRule.revisionSource}\n  recovery              ${sourceRule.conflictRecovery}\n  push selection        ${sourceRule.pushSelection}\n\nSystem page projections:\n${
-        page.workspace.systemPages.map((systemPage) =>
-          `  ${systemPage.path.padEnd(9)} ${systemPage.mode}; ${systemPage.projection}.\n${
-            " ".repeat(12)
-          }${systemPage.unchangedPush} ${systemPage.approval}\n${" ".repeat(12)}${systemPage.guidance}`
-        ).join("\n")
-      }\n  home      editable; ${page.workspace.systemHome}\n\nMarkdown front matter:\n${
+      }\n  pull                  ${sourceRule.pull}\n  internal state        ${sourceRule.internalState}\n  format change         ${sourceRule.formatChange} (${sourceRule.formatChangeError})\n  renamed source        ${sourceRule.renamedSource} (${sourceRule.renamedSourceError})\n  conflicts             ${sourceRule.conflict} (${sourceRule.conflictError})\n  conflict detail       ${sourceRule.conflictDetail}\n  push conflicts        ${sourceRule.pushConflict} (${sourceRule.pushConflictError})\n  revision              ${sourceRule.revisionSource}\n  recovery              ${sourceRule.conflictRecovery}\n  push selection        ${sourceRule.pushSelection}\n\nSystem pages: ${page.workspace.systemPages}\n\nMarkdown front matter:\n${
         markdownFormat.metadata.map(formatMetadata).join("\n")
       }\n\nDocument root: { "type": "doc", "content": [...] }\nSupported nodes: ${
         page.document.nodes.join(", ")
@@ -1633,7 +1598,7 @@ export function formatReferenceResult(result) {
         page.inlineFacts.attrs.items.itemFieldOrder.join(", ")
       } order\n  value                 ${page.inlineFacts.valuePolicy}\n  label                 ${page.inlineFacts.labelPolicy}\n  url                   ${page.inlineFacts.urlPolicy}\n  Markdown              fenced ${page.inlineFacts.markdown.fence} block whose body is a JSON array\n\nInline-facts Markdown example:\n${page.inlineFacts.markdown.example}\n\nDirect ProseMirror inlineFacts example:\n${
         JSON.stringify(page.inlineFacts.examples.proseMirror, null, 2)
-      }\n\nRaw HTML: ${page.document.rawHtml.default} by default. For a tracked ${page.document.rawHtml.trackedProseMirror.format} document only: ${page.document.rawHtml.trackedProseMirror.behavior} Opt in with ${page.document.rawHtml.trackedProseMirror.optIn}. For ${page.document.rawHtml.markdown.format}, ${page.document.rawHtml.markdown.behavior} ${page.document.rawHtml.warning}\n\nComponents:\n${
+      }\n\n${page.document.integrationFragmentNode.type}: ${page.document.integrationFragmentNode.note}\n\nComponents:\n${
         page.components.map((component) => `  ${component.type.padEnd(16)} ${component.summary}`).join("\n")
       }\n\nWorkflow:\n${
         page.workflow.map((step) => `  ${step.command}: ${step.result}`).join("\n")

package/src/verbs/approve.js

@@ -1,20 +1,8 @@
-import {
-  listSitePages,
-  PAGE_STATUS_DELETED,
-  publishDrafts,
-  TEMPLATE_TYPE_FREE_FORM,
-  withRefusalGuidance,
-} from "../api.js";
+import { listSitePages, PAGE_STATUS_DELETED, publishDrafts, withRefusalGuidance } from "../api.js";
 import { VERB_APPROVE } from "../constants.js";
 import { SiteAuthoringError } from "../errors.js";
 import { boundedList, openSession, successResult, warnIfExternalWritesPaused } from "../session.js";
-import {
-  normalizePagePath,
-  readManifest,
-  readOnlySystem404Projections,
-  SYSTEM_PAGE_NOT_FOUND_PATH,
-  writeManifest,
-} from "../workspace.js";
+import { normalizePagePath, readManifest, writeManifest } from "../workspace.js";
 
 /**
  * `approve` — publish the site's drafts.
@@ -46,7 +34,6 @@ export async function approve(invocation) {
   const manifestByPageId = new Map(
     manifest.pages.filter((entry) => typeof entry?.pageId === "string").map((entry) => [entry.pageId, entry]),
   );
-  const readOnlyProjections = readOnlySystem404Projections(manifest);
 
   // Positional arguments narrow the selection to those page paths; `cli.js`
   // hands them over as `pagePaths`, and a programmatic caller can supply the
@@ -84,41 +71,10 @@ export async function approve(invocation) {
         { field: "pages" },
       );
     }
-    const pagesById = new Map(pages.map((summary) => [summary.pageId, summary]));
-    for (const projection of readOnlyProjections) {
-      const summary = pagesById.get(projection.pageId);
-      if (
-        summary?.status === PAGE_STATUS_DELETED
-        || normalizePagePath(summary?.path)?.toLowerCase() !== SYSTEM_PAGE_NOT_FOUND_PATH
-        || summary?.templateType !== TEMPLATE_TYPE_FREE_FORM
-      ) {
-        const index = manifest.pages.indexOf(projection);
-        throw new SiteAuthoringError(
-          "workspace.manifest_invalid",
-          `The read-only page projection at pages[${index}] does not identify the live free-form system 404. `
-            + "Nothing was approved; run 'taproot-site pull' again.",
-          { field: `pages[${index}].pageId` },
-        );
-      }
-    }
-    const readOnlyPageIds = new Set(readOnlyProjections.map((entry) => entry.pageId));
-    if (requestedPaths !== undefined) {
-      const requestedReadOnly = readOnlyProjections.find((entry) =>
-        requestedPaths.has(normalizePagePath(entry.path) ?? entry.path));
-      if (requestedReadOnly !== undefined) {
-        const pagePath = normalizePagePath(requestedReadOnly.path) ?? requestedReadOnly.path;
-        throw new SiteAuthoringError(
-          "approve.page_read_only",
-          `Page path '${pagePath}' is the pulled read-only system 404 projection and cannot be approved.`,
-          { field: pagePath },
-        );
-      }
-    }
     const candidates = pages.filter((summary) =>
       summary.status !== PAGE_STATUS_DELETED
       && summary.hasDraft
       && manifestByPageId.has(summary.pageId)
-      && !readOnlyPageIds.has(summary.pageId)
       && (requestedPaths === undefined || requestedPaths.has(normalizePagePath(summary.path) ?? summary.path)));
 
     if (requestedPaths !== undefined) {

package/src/verbs/index.js

@@ -63,7 +63,6 @@ import { whoami } from "./whoami.js";
  *   configPath,    // an explicit --config path, or undefined
  *   deployTarget,  // "staging" | "production" for `deploy`, else undefined
  *   quiet,         // --quiet; suppresses progress, never the JSON result
- *   allowRawHtml,  // --allow-raw-html; `pages push` only, false everywhere else
  *   keyName,       // --name; `login` only, undefined everywhere else
  *   onProgress,    // human progress sink (stderr, or a no-op when quiet)
  *   fetch,         // injectable fetch, for tests

package/src/verbs/pages-push.js

@@ -32,7 +32,6 @@ import {
   readManifest,
   readMediaManifest,
   readObservedPageRevision,
-  readOnlySystem404Projections,
   readWorkspaceFile,
   readWorkspaceJson,
   requireManifestSourceRegistry,
@@ -81,15 +80,6 @@ import {
  * - Creates are POST and updates are PATCH with a *whole* template, not a patch
  *   mask. Neither is replayed by the transport, so each is issued once and an
  *   ambiguous outcome surfaces as ambiguous.
- *
- * `rawHtml` renders verbatim and unsanitized. It is rejected unless the caller
- * explicitly asks for it via `allowRawHtml`, which is exactly the thing an
- * agent must not be able to emit by accident.
- *
- * Pull's system 404 is the deliberate exception to "every file is authored."
- * Its exact bytes remain inspectable in the workspace but carry a manifest
- * hash and read-only marker. An unchanged whole-workspace push skips it;
- * changing, deleting, or replacing it is a refusal before any remote write.
  */
 
 const MAXIMUM_REPORTED = 200;
@@ -337,8 +327,8 @@ function requireContentFunctions(content) {
   return content;
 }
 
-function assertValid(content, document_, file, allowRawHtml) {
-  const outcome = content.validateDocument(document_, { allowRawHtml });
+function assertValid(content, document_, file) {
+  const outcome = content.validateDocument(document_);
   const errors = outcome === null || typeof outcome !== "object" ? undefined : outcome.errors;
   if (!Array.isArray(errors)) {
     throw new SiteAuthoringError(
@@ -579,11 +569,10 @@ export async function validateWorkspacePageDocument({
   file,
   document: document_,
   content: injectedContent,
-  allowRawHtml = false,
   getSharedThemeContexts,
 }) {
   const content = requireContentFunctions(await loadContentModule(injectedContent));
-  assertValid(content, document_, file, allowRawHtml);
+  assertValid(content, document_, file);
   if (hasNamedFreeFormSectionContext(document_)) {
     const contexts = typeof getSharedThemeContexts === "function"
       ? await getSharedThemeContexts()
@@ -607,7 +596,6 @@ export async function pagesPush(invocation) {
   // exchange said the platform is paused. It changes nothing else: the write
   // still runs and its refusal still classifies as platform_paused (TR00692).
   warnIfExternalWritesPaused(session, VERB_PAGES_PUSH);
-  const allowRawHtml = invocation.allowRawHtml === true;
   // Both manifests are bound to the site before anything is planned or sent:
   // every id in them is site-scoped, and a workspace pulled from another site
   // reads as entirely valid until phase two is already writing.
@@ -630,72 +618,19 @@ export async function pagesPush(invocation) {
   // Manifest integrity is never scoped: a registry that contradicts itself
   // describes some other workspace, and a selection cannot make that safe.
   requireManifestSourceRegistry(pageSourceRegistry(manifest));
-  const readOnlyProjections = readOnlySystem404Projections(manifest);
   const targeted = requestedPaths !== undefined;
-  const readOnlyByFile = new Map(readOnlyProjections.map((entry) => [entry.file, entry]));
-  const readOnlyByPath = new Map(readOnlyProjections.map((entry) => [normalizePagePath(entry.path), entry]));
-
-  // Naming the projection in a selection is refused by name before anything is
-  // read. It is the one page this workspace may never send, and a selection is
-  // an explicit request rather than something to quietly drop.
-  if (targeted) {
-    const requestedReadOnly = readOnlyProjections.find((entry) =>
-      requestedPaths.has(normalizePagePath(entry.path) ?? entry.path));
-    if (requestedReadOnly !== undefined) {
-      const pagePath = normalizePagePath(requestedReadOnly.path) ?? requestedReadOnly.path;
-      throw new SiteAuthoringError(
-        "pages.page_read_only",
-        `Page path '${pagePath}' is the pulled read-only system 404 projection and cannot be pushed.`,
-        { field: pagePath },
-      );
-    }
-  }
 
   // The shared list, so the set `pull` refuses to write over is exactly the set
   // this walks: a file one counted and the other ignored would be a page pushed
   // from a workspace nothing proved the ownership of.
   const files = await walkWorkspaceFiles(config.workspaceDir, PAGES_DIRECTORY, PAGE_SOURCE_EXTENSIONS);
-  const editableFiles = files.filter((file) => !readOnlyByFile.has(file));
-  if (editableFiles.length === 0 && readOnlyProjections.length === 0) {
+  if (files.length === 0) {
     throw new SiteAuthoringError(
       "pages.none_found",
       `No Markdown or ProseMirror page files were found under '${PAGES_DIRECTORY}/' in the workspace.`,
       { field: PAGES_DIRECTORY },
     );
   }
-  // The projection's own integrity is a whole-workspace check. A targeted push
-  // has already refused to name it and cannot reach it any other way, so an
-  // edited projection is something `pages push` with no path reports — not
-  // something that blocks a different page from being sent.
-  const skippedReadOnly = [];
-  if (!targeted) {
-    for (const entry of readOnlyProjections) {
-      if (!files.includes(entry.file)) {
-        throw documentError(
-          "pages.read_only_missing",
-          `The pulled read-only system 404 projection '${entry.file}' is missing or was replaced. Run pull again; `
-            + "author the system 404 through an owner-controlled surface.",
-          entry.file,
-        );
-      }
-      const bytes = await readWorkspaceFile(config.workspaceDir, entry.file, WORKSPACE_LIMITS.documentBytes);
-      if (workspaceContentHash(bytes) !== entry.workspaceContentHash) {
-        throw documentError(
-          "pages.read_only_modified",
-          `The pulled read-only system 404 projection '${entry.file}' changed after pull. No page was pushed. `
-            + "Restore it or pull again; author the system 404 through an owner-controlled surface.",
-          entry.file,
-        );
-      }
-      skippedReadOnly.push({
-        file: entry.file,
-        path: normalizePagePath(entry.path),
-        pageId: entry.pageId,
-        reason: entry.readOnlyReason,
-      });
-      onProgress(`Verified read-only system 404 projection '${entry.file}'; it will not be pushed.`);
-    }
-  }
   let sharedThemeContexts;
   const manifestByFile = new Map(
     manifest.pages.filter((entry) => typeof entry?.file === "string").map((entry) => [entry.file, entry]),
@@ -727,25 +662,6 @@ export async function pagesPush(invocation) {
     const live = livePages.filter((summary) => summary.status !== PAGE_STATUS_DELETED);
     const liveById = new Map(live.map((summary) => [summary.pageId, summary]));
     const liveByPath = new Map(live.map((summary) => [normalizePagePath(summary.path) ?? summary.path, summary]));
-    // The projection's live identity is the other half of the whole-workspace
-    // read-only check above, and is scoped with it for the same reason.
-    if (!targeted) {
-      for (const projection of readOnlyProjections) {
-        const summary = liveById.get(projection.pageId);
-        if (
-          normalizePagePath(summary?.path)?.toLowerCase() !== SYSTEM_PAGE_NOT_FOUND_PATH
-          || summary?.templateType !== TEMPLATE_TYPE_FREE_FORM
-        ) {
-          const index = manifest.pages.indexOf(projection);
-          throw documentError(
-            "workspace.manifest_invalid",
-            `The read-only page projection at pages[${index}] does not identify the live free-form system 404. `
-              + "No page was pushed; run 'taproot-site pull' again.",
-            `pages[${index}].pageId`,
-          );
-        }
-      }
-    }
 
     // Resolution: which file is each page path's one authoritative source.
     // This reads metadata only — a manifest entry, or a front-matter block —
@@ -754,7 +670,7 @@ export async function pagesPush(invocation) {
     const sources = [];
     const claimants = [];
     const unresolved = [];
-    for (const file of editableFiles) {
+    for (const file of files) {
       const manifestEntry = manifestByFile.get(file);
       try {
         const source = await readWorkspacePageSource({ workspaceDir: config.workspaceDir, file, manifestEntry });
@@ -844,14 +760,6 @@ export async function pagesPush(invocation) {
       const manifestEntry = manifestByFile.get(file);
       requireCompletePageMetadata(source);
       const document_ = await convertWorkspacePageSource({ source, mediaManifest, content });
-      if (readOnlyByPath.has(pagePath)) {
-        throw documentError(
-          "pages.system_page_read_only",
-          `'${file}' attempts to replace the read-only system 404 projection. No page was pushed. `
-            + "Run pull again; author the system 404 through an owner-controlled surface.",
-          file,
-        );
-      }
 
       const target = manifestEntry?.pageId !== undefined
         ? liveById.get(manifestEntry.pageId)
@@ -930,7 +838,6 @@ export async function pagesPush(invocation) {
         file,
         document: document_,
         content,
-        allowRawHtml,
         getSharedThemeContexts: async () => {
           sharedThemeContexts ??= await readSharedThemeContexts(config.workspaceDir, siteId);
           return sharedThemeContexts;
@@ -1044,18 +951,15 @@ export async function pagesPush(invocation) {
     const reported = boundedList(applied, MAXIMUM_REPORTED);
     const reportedUnresolved = boundedList(unresolved, MAXIMUM_REPORTED);
     return successResult(VERB_PAGES_PUSH, siteId, {
-      allowRawHtml,
       pages: {
         total: planned.length,
         created: applied.filter((entry) => entry.action === "created").length,
         updated: applied.filter((entry) => entry.action === "updated").length,
-        skippedReadOnly: skippedReadOnly.length,
-        readOnlyItems: skippedReadOnly,
         // What this run actually looked at, so automation can tell a targeted
         // push from a whole-workspace one without inferring it from counts.
         selection: targeted ? "targeted" : "workspace",
         ...(targeted ? { selectedPaths: [...requestedPaths].sort().map((pagePath) => pagePath || "/") } : {}),
-        discovered: editableFiles.length,
+        discovered: files.length,
         validated: planned.length,
         ...(unresolved.length > 0
           ? {

package/src/verbs/pull.js

@@ -46,12 +46,10 @@ import {
   NAVIGATION_FILE_NAME,
   normalizePageBodyRevision,
   normalizePagePath,
-  PAGE_READ_ONLY_REASON_SYSTEM_404,
   PAGE_SOURCE_EXTENSIONS,
   PAGE_SOURCE_FORMAT_MARKDOWN,
   PAGE_WORKSPACE_MODE_EDITABLE,
   PAGE_WORKSPACE_MODE_METADATA_ONLY,
-  PAGE_WORKSPACE_MODE_READ_ONLY,
   PAGES_DIRECTORY,
   pageSourceFormat,
   pageSourceRegistry,
@@ -59,7 +57,6 @@ import {
   readWorkspaceFile,
   readWorkspaceJson,
   SETTINGS_DIRECTORY,
-  SYSTEM_PAGE_NOT_FOUND_PATH,
   walkWorkspaceFiles,
   WORKSPACE_LIMITS,
   workspaceContentHash,
@@ -118,10 +115,6 @@ const APPEARANCE_SETTINGS_TYPES = Object.freeze([
   SETTINGS_TYPE_SITE_HEADER,
 ]);
 
-function isSystemNotFound(pagePath) {
-  return normalizePagePath(pagePath)?.toLowerCase() === SYSTEM_PAGE_NOT_FOUND_PATH;
-}
-
 /**
  * The refusal for a remote body this workspace cannot represent.
  *
@@ -342,11 +335,6 @@ function assignPageFiles(pages, tracked) {
 async function resolveTrackedSources(workspaceDir, pages, registry, onProgress) {
   const tracked = new Map();
   for (const summary of pages) {
-    // The system 404 is never authored locally: pull owns its bytes and
-    // records their hash, and every other verb refuses to send them back.
-    // Tracking it would offer to keep local edits to a file whose whole
-    // contract is that local edits are a refusal.
-    if (isSystemNotFound(summary.path)) continue;
     const entry = registry.get(summary.pageId);
     if (entry === undefined) continue;
     // One file cannot be two pages' source. Keeping either entry would hash
@@ -412,10 +400,31 @@ async function readSourceRegistry(workspaceDir, siteId) {
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || parsed.siteId !== siteId) {
     return new Map();
   }
-  const registry = pageSourceRegistry(parsed);
+  const registry = pageSourceRegistry(withoutRetiredReadOnlyProjections(parsed));
   return parsed.manifestVersion === MANIFEST_VERSION ? registry : withoutSupersededRemoteHashes(registry);
 }
 
+/**
+ * Drops every page entry a version-6 manifest recorded as the retired
+ * `workspaceMode: "read-only"` system-404 projection.
+ *
+ * That entry carries a file but no baseline, and push skipped it, so its bytes
+ * are the site's old `rawHtml` body rather than anything the author wrote.
+ * Tracking it would keep those bytes as local work: once the owner converts the
+ * 404 on the site, this pull would neither refresh nor conflict on it, and the
+ * next whole-workspace push would refuse with `content.raw_html_forbidden` on
+ * a page the author never touched. Forgetting the entry sends the page through
+ * the ordinary fresh pull instead, which overwrites the file with the site's
+ * body and records a baseline.
+ */
+function withoutRetiredReadOnlyProjections(manifest) {
+  if (!Array.isArray(manifest.pages)) return manifest;
+  return {
+    ...manifest,
+    pages: manifest.pages.filter((entry) => entry?.workspaceMode !== "read-only"),
+  };
+}
+
 /**
  * Forgets `baseline.remoteHash` on every entry of a registry read out of a
  * manifest that is not this version's.
@@ -1031,23 +1040,14 @@ export async function pull(invocation) {
         } else {
           entry.file = pageFiles.get(summary.pageId);
           const source = Buffer.from(`${JSON.stringify(body, undefined, 2)}\n`, "utf8");
-          if (isSystemNotFound(summary.path)) {
-            entry.workspaceMode = PAGE_WORKSPACE_MODE_READ_ONLY;
-            entry.readOnlyReason = PAGE_READ_ONLY_REASON_SYSTEM_404;
-            entry.workspaceContentHash = workspaceContentHash(source);
-            onProgress(
-              `Page '${summary.path}' is the system 404; writing an integrity-checked read-only projection.`,
-            );
-          } else {
-            entry.workspaceMode = PAGE_WORKSPACE_MODE_EDITABLE;
-            entry.sourceFormat = pageSourceFormat(entry.file);
-            const revision = normalizePageBodyRevision(page.bodyRevision);
-            entry.baseline = {
-              remoteHash: canonicalDocumentHash(body),
-              sourceHash: workspaceContentHash(source),
-              ...(revision === undefined ? {} : { revision }),
-            };
-          }
+          entry.workspaceMode = PAGE_WORKSPACE_MODE_EDITABLE;
+          entry.sourceFormat = pageSourceFormat(entry.file);
+          const revision = normalizePageBodyRevision(page.bodyRevision);
+          entry.baseline = {
+            remoteHash: canonicalDocumentHash(body),
+            sourceHash: workspaceContentHash(source),
+            ...(revision === undefined ? {} : { revision }),
+          };
           await writeWorkspaceFile(config.workspaceDir, entry.file, source);
           bodies += 1;
           const baselineFile = internalPageBaselineFile(summary.pageId);
@@ -1132,7 +1132,6 @@ export async function pull(invocation) {
         // Markdown page to survive the pull can assert on it.
         tracked: tracked.size,
         revisionsRecordedWithoutBodyComparison,
-        readOnly: manifestPages.filter((entry) => entry.workspaceMode === PAGE_WORKSPACE_MODE_READ_ONLY).length,
         truncated,
         items: reported.items,
         ...(reported.truncated ? { itemsTruncated: true } : {}),

package/src/workspace.js

@@ -128,6 +128,10 @@ export function internalPageObservedRevisionFile(pageId) {
     : undefined;
 }
 
+// Version 7 tracks the system 404 as an ordinary editable page with a
+// baseline, like home; version 6 wrote it as a hash-checked read-only
+// projection that push and approve skipped.
+//
 // Version 6 records the site's own `baseline.revision` for every tracked page:
 // the opaque revision of the stored authoring state the site reported when this
 // workspace last agreed with it. Version 5 could only compare one pull's body
@@ -139,7 +143,7 @@ export function internalPageObservedRevisionFile(pageId) {
 // classified pulled files but recorded no registry. The package is in-repo and
 // its manifests are workspace state, so an older one is re-pulled rather than
 // migrated.
-export const MANIFEST_VERSION = 6;
+export const MANIFEST_VERSION = 7;
 
 /**
  * The shape of a page body revision as the site reports it: a scheme name and
@@ -240,10 +244,7 @@ function normalizeObservedDifferences(value) {
 
 export const PAGE_WORKSPACE_MODE_EDITABLE = "editable";
 export const PAGE_WORKSPACE_MODE_METADATA_ONLY = "metadata-only";
-export const PAGE_WORKSPACE_MODE_READ_ONLY = "read-only";
-export const PAGE_READ_ONLY_REASON_SYSTEM_404 = "system-404";
 export const SYSTEM_PAGE_NOT_FOUND_PATH = "404";
-export const SYSTEM_PAGE_NOT_FOUND_FILE = `${PAGES_DIRECTORY}/404.pm.json`;
 export const WORKSPACE_CONTENT_HASH = /^sha256:[0-9a-f]{64}$/u;
 // Bumped when the media manifest gained its `siteId` binding: a manifest
 // without one cannot be proved to belong to the site being written to, and the
@@ -273,7 +274,7 @@ export const WORKSPACE_LIMITS = Object.freeze({
   pagePathBytes: 512,
 });
 
-/** Hashes the exact bounded bytes pull wrote for a read-only projection. */
+/** Hashes the exact bounded bytes of a workspace source. */
 export function workspaceContentHash(bytes) {
   return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 }
@@ -489,47 +490,6 @@ export function requireManifestSourceRegistry(registry) {
   return registry;
 }
 
-/**
- * Returns only the complete read-only projection shape that `pull` writes.
- *
- * A manifest is editable input, so a caller must not treat an arbitrary
- * `workspaceMode: read-only` as permission to omit a page from push or
- * approval. The live page identity is checked separately after listing the
- * site; this function proves only the deterministic on-disk half.
- */
-export function readOnlySystem404Projections(manifest) {
-  const projections = [];
-  for (const [index, entry] of manifest.pages.entries()) {
-    if (entry?.workspaceMode !== PAGE_WORKSPACE_MODE_READ_ONLY) continue;
-    const pagePath = normalizePagePath(entry.path);
-    if (
-      pagePath?.toLowerCase() !== SYSTEM_PAGE_NOT_FOUND_PATH
-      || entry.file !== SYSTEM_PAGE_NOT_FOUND_FILE
-      || typeof entry.pageId !== "string"
-      || entry.pageId.trim() === ""
-      || entry.readOnlyReason !== PAGE_READ_ONLY_REASON_SYSTEM_404
-      || typeof entry.workspaceContentHash !== "string"
-      || !WORKSPACE_CONTENT_HASH.test(entry.workspaceContentHash)
-    ) {
-      throw new SiteAuthoringError(
-        "workspace.manifest_invalid",
-        `The read-only page projection at pages[${index}] is not the complete system-404 shape written by pull. `
-          + "Run 'taproot-site pull' again.",
-        { field: `pages[${index}].workspaceMode` },
-      );
-    }
-    projections.push(entry);
-  }
-  if (projections.length > 1) {
-    throw new SiteAuthoringError(
-      "workspace.manifest_invalid",
-      "The manifest records more than one read-only system 404 projection. Run 'taproot-site pull' again.",
-      { field: "pages" },
-    );
-  }
-  return projections;
-}
-
 const WINDOWS_DEVICE_BASENAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/iu;
 
 /**