@typeroll/mcp-server 0.45.95 → 0.45.97

package/dist/tools/deploy.js

@@ -12,7 +12,7 @@ export const deployTools = [
     },
     {
         name: 'trigger_deploy',
-        description: "Enqueue a deploy (static-page build → hosting) of the currently active version. Returns a job_id immediately; poll get_deploy_status until the status leaves queued/running. NOT for previewing iterative design/content edits — that's what get_preview_link is for (it renders live from the DB with no build). Reserve trigger_deploy for publishing, a stakeholder link to the compiled site, or pre-merge validation. Deploys build SAVED content only — unsaved drafts (working copies) are excluded, so commit_working_copy (or save:true on your writes) before deploying, or your changes won't ship. Customer publishing freezes a consistent saved source, then resumes source/Git/build-dispatch checkpoints without recapturing later edits. GitHub or Cloudflare performs rendering and media work. With dry_run:true, customer publishing validates frozen source without a Git push or external build; it does not prove an Astro build succeeds. Other self-hosted adapters may build locally without upload. Check the reported phase.",
+        description: "Enqueue a deploy (static-page build → hosting) of the currently active version. Returns a job_id immediately; poll get_deploy_status until the status leaves queued/running. NOT for previewing iterative design/content edits — that's what get_preview_link is for (it renders live from the DB with no build). Reserve trigger_deploy for publishing, a stakeholder link to the compiled site, or pre-merge validation. Deploys build SAVED content only — unsaved drafts (working copies) are excluded, so commit_working_copy (or save:true on your writes) before deploying, or your changes won't ship. Customer publishing freezes a consistent saved source, then resumes source/Git/build-dispatch checkpoints without recapturing later edits. GitHub or Cloudflare performs rendering and media work. With dry_run:true, customer publishing validates frozen source without a Git push or external build; it does not prove an Astro build succeeds. Other self-hosted adapters may build locally without upload. Check the reported phase. All sites in an organization share one build engine: publish one site at a time, starting the next only when the previous job has finished and read_organization_build_engine shows no active_jobs.",
         inputSchema: {
             environment: z.enum(['production', 'staging']).optional(),
             allow_unsaved: z.boolean().optional().describe('Explicitly publish saved content while leaving the reported unsaved Pages/partials untouched. Only after owner confirmation.'),

package/dist/tools/media.js

@@ -44,7 +44,7 @@ export const mediaTools = [
     },
     {
         name: 'get_media_preparation',
-        description: 'Read background image preparation progress. Originals and prepared draft variants remain private. Requires site access.',
+        description: 'Read background image preparation progress, including the build_job_id of a running preparation job on the organization build engine. Originals and prepared draft variants remain private. Requires site access.',
         inputSchema: {},
         handler: withErrorBoundary(async (_args, { client, siteId }) => ok(await client.get(siteId, 'media/preparation'))),
     },
@@ -79,7 +79,7 @@ export const mediaTools = [
     },
     {
         name: 'upload_media_from_url',
-        description: 'Fetch an image (or PDF) from any public URL and push it to the site\'s media library in one call. The MCP server downloads the source from verified public HTTP(S) destinations; private addresses and unsafe redirects are refused. Integrity-safe: the bytes are streamed, never transcribed as base64 through the model, so (unlike a large `upload_media_inline` payload) they can\'t be silently corrupted in transit. Returns { media_id, cdn_url, filename }.',
+        description: 'Fetch an image (or PDF) from any public URL and push it to the site\'s media library in one call. The MCP server downloads the source from verified public HTTP(S) destinations; private addresses and unsafe redirects are refused. Integrity-safe: the bytes are streamed, never transcribed as base64 through the model, so (unlike a large `upload_media_inline` payload) they can\'t be silently corrupted in transit. Returns { media_id, cdn_url, filename, finalize }. Each upload queues image preparation (finalize.preparation): one job per site on the organization\'s shared build engine, started shortly after the upload. get_media_preparation returns its build_job_id; let it finish, like any other active build, before publishing another site of the organization.',
         inputSchema: {
             source_url: z.string().url().describe('Public URL to download the image from.'),
             filename: z.string().optional().describe('Override the filename used on R2. Defaults to the last path segment of source_url. When its extension does not match the content type, the type\'s extension is appended; the response returns the stored filename.'),
@@ -95,7 +95,7 @@ export const mediaTools = [
     },
     {
         name: 'upload_media_batch_from_urls',
-        description: 'Upload 1–50 public images/PDFs (max 25 MiB each) in one MCP call. Uses the same integrity-safe download → signed PUT → finalize pipeline as upload_media_from_url, with four concurrent workers. Returns one result per source URL; individual failures do not abort the batch.',
+        description: 'Upload 1–50 public images/PDFs (max 25 MiB each) in one MCP call. Uses the same integrity-safe download → signed PUT → finalize pipeline as upload_media_from_url, with four concurrent workers. Returns one result per source URL; individual failures do not abort the batch. Uploads queue image preparation as upload_media_from_url describes.',
         inputSchema: {
             items: z.array(z.object({
                 source_url: z.string().url(),

package/dist/tools/redirects.js

@@ -16,6 +16,7 @@ export const redirectTools = [
     {
         name: 'create_redirect',
         description: 'Create a redirect rule, or update the rule that already has this from_path in place (same id, no gap). ' +
+            'The response action says which happened; every distinct from_path gets its own rule, however long. ' +
             'Defaults to 301; pass status_code=302 for a temporary redirect. ' +
             'WILDCARDS: a trailing "*" captures everything under a prefix and ":splat" replays it into the ' +
             'target — `from_path="/category/*", to_path="/blogg/:splat"` retires an entire WordPress taxonomy ' +

package/dist/tools/settings.js

@@ -124,7 +124,7 @@ export const settingsTools = [
                     accept_all: z.string().optional(),
                     privacy_link: z.string().optional(),
                     manage: z.string().optional(),
-                }).optional().describe('Plain-text replacements for the banner heading, buttons and links (max 120 characters each). Omitted or blank labels follow the page language: Swedish, German, otherwise English. Replaces the whole labels object.'),
+                }).optional().describe('Plain-text replacements for the banner heading, buttons and links (max 120 characters each). Omitted or blank labels follow the page language: Swedish, German, Dutch, otherwise English. Replaces the whole labels object.'),
             }).optional().describe('Native consent banner configuration. Partial updates preserve omitted fields. Script fields execute in visitor browsers and are accepted under the API key authority.'),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {

package/dist/version.js

@@ -8,4 +8,4 @@
 //
 // Keep it in lockstep with package.json: tests/version.test.ts asserts
 // VERSION === package.json.version, so a bump that forgets this line fails CI.
-export const VERSION = '0.45.95';
+export const VERSION = '0.45.97';

package/dist/workspace.js

@@ -69,6 +69,11 @@ Public documentation: https://typeroll.com/docs/llms.txt
   upload/finalization. Never put image bytes or customer secrets in Git.
 - Inspect desktop/mobile layouts and interaction states. Read changes back.
   Record exact version, tested pages, evidence and unresolved issues in qa/.
+- The signed preview is for content and layout review. Verify embeds, consent,
+  analytics, fonts and measured design checks on the published test address.
+- Publish one Site at a time per Organization: all Sites share one build engine.
+- Record Typeroll defects in qa/typeroll-platform-feedback.md. Do not resume
+  affected publishing until the fix is confirmed live.
 - Never edit generated publishing source to change CMS content. Do not overwrite
   current CMS or owner answers from an old local snapshot.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typeroll/mcp-server",
-  "version": "0.45.95",
+  "version": "0.45.97",
   "description": "Typeroll CMS MCP server \u2013 connect AI agents to the REST API to manage content and publish static websites.",
   "license": "MIT",
   "repository": {

package/skills/tr-brand.md

@@ -143,6 +143,18 @@ Pick from high-quality Google Fonts pairings:
 Same font for heading and body is fine if it has enough weight variation
 (Inter at 700 + 400 works well).
 
+Use the exact Google Fonts family name ("Plus Jakarta Sans", not "plus
+jakarta"). Fonts are self-hosted by default (`fonts.delivery: "self_hosted"`,
+Core 0.2.130+): when a publication is frozen, Typeroll copies the Google Fonts
+CSS and woff2 files (weights 400–700) into the build. The site serves
+`/_typeroll/fonts/fonts.css` and the files under `/_typeroll/fonts/`; visitors
+never contact `fonts.googleapis.com` or `fonts.gstatic.com`, before or after
+consent. A family Google does not serve is skipped without an error and the
+browser falls back to the next font in the stack. `system`, or only local
+fonts such as Arial, captures nothing. `fonts.delivery: "google"` links the
+Google CDN directly and sends every visitor's IP address to Google: that is a
+privacy/consent decision for the owner, never your default.
+
 `size_base` should be 16 for most sites; 17–18 for text-heavy editorial
 sites; 15 for dense dashboards.
 
@@ -324,7 +336,7 @@ Better default:
 
 Reserve a third column only when there's a genuinely different surface (locations, languages, partner pages). Don't pad the footer with content-type columns — navigation to those happens via top nav + topic pages.
 
-## Step 7 — Preview
+## Step 7 — Preview, then verify fonts on the published site
 
 ```
 get_preview_link
@@ -332,10 +344,19 @@ get_preview_link
 
 Open in browser. Check:
 - Colors render as intended (not "undefined" or missing)
-- Fonts load (Google Fonts link is in `<head>`)
 - Nav text is readable against header background
 - Body text has sufficient contrast
 
+The preview loads fonts from Google inside a sandbox, so it proves nothing
+about font delivery. After an authorized publish, check the published
+temporary/test address:
+- `/_typeroll/fonts/fonts.css` has `@font-face` rules for every chosen family.
+  A comment instead of rules means Google did not serve that name: fix it.
+- Every font file `url(...)` in it returns 200.
+- No request goes to `fonts.googleapis.com` or `fonts.gstatic.com`.
+- After `await document.fonts.ready`, `[...document.fonts]` has a `loaded`
+  face for each family, and headings/body compute to that family.
+
 ## Pitfalls
 
 - **Don't set colors without checking the header contrast.** If `primary`
@@ -344,9 +365,9 @@ Open in browser. Check:
 - **Custom_css is global.** Rules here apply to every page. Keep it to
   `:root {}` token additions and truly global utilities. Page-specific
   styles go in the page's HTML `<style>` block.
-- **Google Fonts load time.** Two different font families is fine; three
-  adds measurable LCP impact. Stick to two families with variable-font
-  versions when possible.
+- **Font weight on every page.** Two families is fine; a third adds
+  measurable LCP impact even when self-hosted. A misspelled family name
+  fails silently to the fallback font — verify it as in Step 7.
 - **Dark themes need dark surface too.** Setting `background: #0f0f0f`
   but leaving `surface: #f8fafc` (white) breaks every card/input. Always
   update all 7 tokens as a set.

package/skills/tr-design-review.md

@@ -37,14 +37,21 @@ So, always:
 1. Get a URL for the version under review. While iterating, use the DB-live
    `get_preview_link` (mint once, reuse — defaults to a 24h TTL) — it renders
    from the DB with no build, so fixes show on reload without re-deploying, and
-   it's the loop for the review-fix-recheck cycle. For a FINAL bit-for-bit check
-   of the compiled output before merge, deploy once (`trigger_deploy
-   version="<branch>"` → poll `get_deploy_status` → use the immutable
-   `deploy_url`, a Cloudflare Pages hash URL). Review the SAME url end to end.
+   it's the loop for content and layout review (screenshots, reading). It is
+   NOT a measurement surface: it serves the page from the portal origin as a
+   nested frame in an opaque-origin sandbox, so evaluate/DOM/computed-style
+   reads from your browser tool do not reach it reliably, the same-origin
+   iframe snippets below fail, third-party iframes usually stay empty, cookies
+   and storage do not persist, and fonts load from Google. `?consent=all|necessary`
+   on the link only pre-answers the cookie banner for that session.
+   Run the measured dimensions, third-party embeds, consent, analytics and
+   font checks on the published temporary/test address (an authorized
+   `trigger_deploy version="<branch>"` → poll `get_deploy_status` → its
+   `deploy_url`). Review the SAME url end to end.
 2. The snippets below run in a browser tool's "evaluate JavaScript" (Playwright /
-   chrome-devtools / puppeteer MCP). **One origin per eval:** the iframe trick
-   needs same-origin, so run each variant's snippet on its own page (different
-   `*.pages.dev` hashes are cross-origin → `contentDocument` is null).
+   chrome-devtools / puppeteer MCP) on that published page. **One origin per
+   eval:** the iframe trick needs same-origin, so run each variant's snippet on
+   its own page (different hosts are cross-origin → `contentDocument` is null).
 3. If you run several variants with one shared browser profile, do them
    SEQUENTIALLY — parallel browser agents on one profile contaminate each other's
    tabs/screenshots.
@@ -293,9 +300,9 @@ then a one-line verdict. Rules:
   unqualified "approved" off a partial pass is not.
 - Brand FIT (palette/voice matching `brand.md`) is a direction judgment, not a
   pass/fail defect — call it out separately so the user decides direction.
-- If you fixed anything mid-review, just reload the DB-live preview and re-run
-  the affected dimension before signing off — no re-deploy needed (deploy only
-  for the final compiled-output check, if any).
+- If you fixed anything mid-review, check it on the DB-live preview, then
+  re-run the affected measured dimension on the next authorized publish of the
+  test address before signing off.
 
 See `tr-redesign-branch` for the surrounding branch → preview → approve → merge
 flow; this skill is its measured approval round.

package/skills/tr-edit-site.md

@@ -68,6 +68,18 @@ for the content type default). `discard_working_copy` throws an unsaved draft
 away. Publishing means saving the draft, `update_page` `status: "published"`
 (applies immediately) and, when the user wants it live now, `trigger_deploy`.
 
+**Publishing and failed deploys.** Poll `get_deploy_status` until the job is
+`succeeded` or `failed`. Every site in an organization shares one build
+engine: publish one site at a time, and start another site's publish only when
+the previous job has finished and `read_organization_build_engine` shows no
+`active_jobs`. `build_result_missing` means the engine stopped without
+reporting a result — a runner never ran the task, not a content problem;
+publish again once the engine is idle. `retry_deploy_verification` only
+retries public verification of an already-served publication
+(`publication_observation_timeout`, `publication_cache_refresh_*`); a build or
+engine-side static verification failure needs a new publish after fixing the
+reported cause.
+
 **Site-wide changes are composition, not a series of page edits.** "Change
 every hero", "a CTA on every product page", "our phone number in every
 footer":

package/skills/tr-header-footer.md

@@ -121,6 +121,9 @@ desktop 1280, wide 1536); do not independently hide all links at the menu bounda
 Verify 1023/1024 px, Tab/Shift-Tab, Enter/Space, Escape returning focus,
 visible focus, long labels, no-JavaScript links and no horizontal overflow.
 
+Each entry in `links` (`core/navigation_links` and `core/navigation`) may set
+`link_rel`, for example `nofollow sponsored` on an affiliate or partner link.
+
 ## Footer tree and consent
 
 Use an accessible footer navigation landmark and `core/navigation_links`, not
@@ -145,9 +148,10 @@ Cookie consent is a site feature, not a footer widget. Configure it separately:
 ```
 
 The heading, buttons and links follow the page language: Swedish for `sv`,
-German for `de`, otherwise English. For any other language, write `text` and
-set `labels` (`title`, `reject`, `necessary`, `accept_all`, `privacy_link`,
-`manage`) in that language.
+German for `de`, Dutch for `nl`, otherwise English. For any other language,
+write `text` and set `labels` (`title`, `reject`, `necessary`, `accept_all`,
+`privacy_link`, `manage`) in that language. The publication's job `warnings`
+list any banner wording and built-in control labels that fall back to English.
 
 Use `update_site_settings`, then read settings back. `scripts_necessary` and
 `scripts_optional` execute in visitors' browsers and must be reviewed like

package/skills/tr-migrate-multisite.md

@@ -228,7 +228,24 @@ A cluster of one is meaningless markup.
 
 ## Phase 7 — Verify BEFORE touching DNS
 
-Deploy each site (`trigger_deploy`), then check what it actually serves:
+Deploy each site (`trigger_deploy`), then check what it actually serves.
+
+**Publish one site at a time.** All sites in an organization share one
+organization build engine, and its runners claim the oldest task in the
+organization. Start the next site's `trigger_deploy` only when the previous
+job is `succeeded` or `failed` and `read_organization_build_engine` shows no
+`active_jobs`. Concurrent publications at best queue; on Core ≤0.2.132 they
+could fail each other with `build_result_missing`.
+
+- `build_result_missing` ("the build engine stopped without reporting a
+  result") means a runner never ran the task. Content did not cause it.
+  Publish that site again once the engine is idle.
+- `retry_deploy_verification` only retries public verification of an
+  already-served publication (`publication_observation_timeout`,
+  `publication_cache_refresh_*`). Build failures and the engine's static
+  verification failures need a new publish after fixing the reported cause.
+
+When a site's job has succeeded, check what it serves:
 
 ```
 verify_migration_urls site_id=<de-site> source_origin="https://example.de" check_source=true
@@ -296,6 +313,8 @@ new canonical build and is not an inventory-only operation):
   path; two markets both have `/kontakt`. One site, one inventory.
 - **Don't build all N sites in parallel from scratch.** Build one, approve,
   replicate. Parallel building multiplies every design mistake by N.
+- **Don't publish the markets in parallel.** One shared build engine serves
+  the organization; publish site by site (Phase 7).
 - **Don't skip the parity check because coverage says 100%.** Coverage is a
   claim about the data; parity is a measurement of the server. They disagree
   exactly when it matters — an unpublished target page, a typo'd path, a

package/skills/tr-new-site.md

@@ -160,7 +160,9 @@ One `update_site_settings` call with every field you know:
 ```
 
 Read it back with `read_site_settings`. Google Fonts names are
-case-sensitive display names ("Plus Jakarta Sans", not "plus jakarta").
+case-sensitive display names ("Plus Jakarta Sans", not "plus jakarta"). Fonts
+are self-hosted on the site by default; a name Google does not serve falls
+back silently, so verify fonts on the published address (`tr-brand` Step 7).
 
 **Site icons are part of brand setup** — upload favicon (32–64px), a
 180×180 apple touch icon, and a 192×192 app icon; set `favicon`,

package/skills/tr-redesign-branch.md

@@ -161,9 +161,15 @@ bulk_replace_text pattern="OldCo" replacement="NewCo" dry_run=false version="<br
 **Self-review is a multi-DIMENSION pass, not a glance — and most of it you
 MEASURE, not eyeball.** Structural checks (copy present, images return 200) are
 NOT a design review; never report "approved" off them. Don't just list the bugs
-you happened to notice — walk every dimension below on the DB-live preview
-(a reused `get_preview_link`; browser tool + DOM reads), fix what you find,
-reload, re-check. No re-deploy between fixes — the preview renders from the DB.
+you happened to notice — walk every dimension below. Use the DB-live preview
+(a reused `get_preview_link`) for content and layout review: fix, reload,
+re-check, no re-deploy between fixes. It is a sandboxed, opaque-origin frame
+served from the portal, so DOM/computed-style reads from your browser tool are
+limited, third-party iframes usually stay empty, and consent, analytics,
+cookies and font loading cannot be verified there (`?consent=all|necessary`
+only pre-answers the banner). Run the measured checks, embeds, consent,
+analytics and fonts on the published temporary/test address of the branch
+after an authorized publish.
 
 **Use `tr-design-review` (`read_skill tr-design-review`) for the HOW** — it has
 the per-dimension measurement snippets (overflow ladder, computed contrast, touch
@@ -241,7 +247,7 @@ link for your own verification:
   details is for your own one-off checks (a new hash each deploy).
 
 Default: review/iterate on the reused DB-live preview; deploy only for the
-compiled output or merge. Wait for an explicit "looks good, ship it."
+compiled output, the published-address checks in step 6, or merge. Wait for an explicit "looks good, ship it."
 
 ### 7. Merge + deploy
 

package/skills/tr-responsive.md

@@ -201,6 +201,17 @@ Menus use matching SVG symbols; `close_size_px` overrides the close symbol size
 without shrinking the44px hit area. Compare exact threshold boundaries in real
 preview and static output before deleting corrective CSS.
 
+## Constrained containers in a column (render version 12)
+
+From render version 12 (Core 0.2.132), a `core/container` with width narrow,
+normal or wide inside a container whose direction is column at every
+breakpoint fills the column up to its maximum width, centered. Below 12, auto
+margins shrink it to its content, so setting width `wide` does NOT make a card
+fill a column. Read `read_site_settings` → `render.version` before advising;
+when it is below 12, raise it with `tr-upgrade-rendering` instead of working
+around it in content. Rows, and containers that become rows at some
+breakpoint, are unchanged.
+
 ## Native image framing and body heading scales (Core 0.2.35+)
 
 Use `core/image.scale_percent` (100–200, responsive) for deliberate horizontal

package/skills/tr-upgrade-rendering.md

@@ -60,6 +60,14 @@ comparison first.
    `version` to do it on a branch first). The preview changes at once; the
    live site changes at the next deploy. To undo, write the previous number.
 
+## Platform fixes behind a newer version
+
+When a layout defect is fixed in a newer render version (for example version
+12: constrained containers fill column layouts), the fix is to raise
+`render_version` through steps 3–8 — compare, report, upgrade with approval,
+then publish. Do not work around it in content (extra wrappers, widths,
+paddings or custom CSS); those workarounds outlive the fix and fight it.
+
 ## Pitfalls
 
 - Comparing a draft against saved content shows content edits, not

package/workspace-templates/qa/checklist.md

@@ -3,10 +3,16 @@
 - Confirm Organization, Site, Version and deployed/source identity.
 - Run `python3 scripts/typeroll/check_unsaved.py` before trigger_deploy. Review
   and explicitly save authorized Pages and partials; templates save immediately.
+- Publish one Site at a time per Organization (shared build engine): start the
+  next only when the previous job finished and read_organization_build_engine
+  shows no active_jobs.
 - Compare preserved text with capture_text.cjs + compare_text.py and an explicit
   selector. Check intentional additions, source comments and images separately.
 - Inspect desktop/mobile previews and actual hosted output around breakpoints.
   Use shootframe.cjs / shoot_hosted.cjs and inspect full screenshots, not only tiles.
+- Use the signed preview for content/layout review only: it is a sandboxed,
+  opaque-origin frame. Verify third-party embeds, consent, analytics, cookies,
+  fonts and measured design checks on the published test address.
 - Exercise menus, keyboard focus, current links, forms and enabled app states.
   Use card-stacking-check.cjs for whole-card excerpt/media/whitespace targets.
 - Check actual contrast on light/dark/photo backgrounds, image subjects and
@@ -46,6 +52,9 @@ indexing have distinct effects but do not require repeated approval if covered.
   print files, private archive manifest, verified copies and a restore test.
 - [ ] Review ICC-converted derivatives visually; preserve originals separately.
 - [ ] Verify Analytics configuration and actual beacon/cookie behavior after build.
+- [ ] Fonts on the published address: `/_typeroll/fonts/fonts.css` has `@font-face`
+  rules for each chosen family, every font file returns 200, no request goes to
+  fonts.googleapis.com/fonts.gstatic.com, and `document.fonts` shows each family loaded.
 - [ ] Read domain publication intent before deployment; distinguish test-host
   updates, future-host candidates and explicit traffic approval.
 - [ ] Inspect the frozen candidate's noindex/robots output, not only current CMS settings.

package/workspace-templates/qa/typeroll-platform-feedback.md

@@ -1,11 +1,35 @@
 # Platform feedback
 
-Record site-specific observations here, without credentials or private exports.
+Record Typeroll product defects and gaps here, without credentials or private
+exports. Distinguish bugs, missing capabilities, unclear instructions and
+project choices; project choices belong in decisions.md.
 
-| ID | Priority | Surface / version | Observation | Evidence | Workaround | Status |
-| --- | --- | --- | --- | --- | --- | --- |
+Index:
 
-For each finding record expected versus actual behavior, minimal reproduction,
-Site/Version, page/block locator, relevant schema, tested widths, source revision
-and whether it blocks launch. Distinguish bugs, capabilities, instructions and
-project choices. Link upstream fixes; verify deployed output before closing them.
+| ID | Site / Organization | Surface | Summary | Blocks launch | Status |
+| --- | --- | --- | --- | --- | --- |
+
+One entry per finding:
+
+```markdown
+## DE-03 — <short title>
+
+- Site / Organization / Version: <names and IDs>
+- Core / MCP version: <from /api/version or get_site_capabilities>
+- Tool or surface: <e.g. trigger_deploy, get_preview_link, core/container>
+- Observed: <what happened, with exact error codes, job IDs, URLs, widths and
+  timestamps; minimal reproduction; expected versus actual>
+- Impact: <what is blocked or wrong, and for whom>
+- Ask: <the product change requested>
+- Acceptance criteria: <checks that prove it is fixed>
+- Workaround: <none, or what was done and how to remove it later>
+- Status: open | fixed in <version> | verified <date, version, result>
+```
+
+Prefix IDs per site or market (for example DE-03) and never reuse one.
+
+After reporting a defect that affects publishing, do not resume the affected
+publishing until the fix is confirmed live: check `/api/version` or the release
+note for the fixed version. Then retest against the acceptance criteria and
+record the result and version under Status. Verify deployed output before
+closing a finding.

package/workspace-templates/workflows/design.md

@@ -12,6 +12,10 @@ starting points, not permission to overwrite an approved design.
 - Sections own gutters. Do not erase side padding with `padding: 3rem 0` when
   only vertical spacing is intended. Wrap column-slot contents in a flow
   container with article rhythm when they need vertical block spacing.
+- A narrow/normal/wide container inside an always-column container fills the
+  column only from render version 12; below it, it shrinks to its content
+  (width `wide` does not help). Raise render_version with tr-upgrade-rendering
+  instead of working around it in content.
 - Give cards one clear destination. Use whole_card_link without action_label
   or download actions. Check excerpt, image, whitespace and keyboard activation.
 - Do not fade body text with opacity. Verify actual text/background contrast,
@@ -55,6 +59,12 @@ schema: counts, widths and breakpoints are not spacing steps. Pixel values are
 explicit exceptions, not the default authoring method. Configure scales in
 `design_scales`, then reuse them in role styles and blocks.
 
+Use exact Google Fonts family names. Published sites self-host them by default
+(`fonts.delivery: self_hosted`); a name Google does not serve falls back
+silently, and the preview loads fonts from Google, so check fonts on the
+published address (qa/checklist.md). `delivery: google` sends each visitor's IP
+address to Google: a privacy decision for the owner.
+
 Record deliberate exceptions in `decisions.md`, with source/block, reason and
 review criteria (for example white text on a photograph). Run `lint_design_tokens`
 before launch and after major design changes. It warns, never blocks launch.

package/workspace-templates/workflows/migration.md

@@ -75,6 +75,15 @@ A deploy with working copies returns `unsaved_content`; review the targets.
 Save explicitly or obtain approval to publish saved content only using
 `allow_unsaved: true`. Never silently save somebody else's work.
 
+All Sites in an Organization share one build engine. Run trigger_deploy for one
+Site at a time: start the next only when the previous job is succeeded/failed
+and read_organization_build_engine shows no active_jobs. `build_result_missing`
+means a runner never ran the task (not a content fault): publish again once the
+engine is idle. retry_deploy_verification only retries public verification of an
+already-served publication (`publication_observation_timeout`,
+`publication_cache_refresh_*`); build and engine-side static verification
+failures need a new publish.
+
 Keep the bound Organization/Site/Version explicit. A site API key cannot switch
 to another Organization: use an authorized OAuth connection or a separate key.
 Read the schema for target envelopes and pagination; do not guess aliases.