@uniweb/build 0.57.0 → 0.59.0

package/src/uwx/records-project.js

@@ -1,8 +1,8 @@
 // Records projection — write a pulled folder and its records back to the site's
-// `records/**` files and `records.yml`. The inverse of the producer (`records.js`
-// + `folder.js`): the producer reads the records directory and emits the
-// `@uniweb/folder` entity + one section-keyed `$`-document per record; this takes
-// those documents back and renders them to files.
+// `records/**` files and the folder's organization, `records/folder.yml`. The
+// inverse of the producer (`records.js` + `folder.js`): the producer reads the
+// records directory and emits the `@uniweb/folder` entity + one section-keyed
+// `$`-document per record; this takes those documents back and renders them to files.
 //
 // Identity & placement:
 //   - a record's slug comes from the FOLDER document — each ref leaf is
@@ -38,9 +38,10 @@ import { parseFrontmatter } from './entity-source.js'
 import { writeRecordFile, writeQueriesConfig, writeRecordsConfig } from './project-writer.js'
 import { defaultSchema, deferredFromSchema, foundationDataSchemas } from './queries-config.js'
 import { poolDirsForSchema, resolveRecordsDir } from '../site/entity-pool.js'
-import { recordsYmlPath } from '../site/records-config.js'
+import { folderYmlPath } from '../site/records-config.js'
 import { isContentBodyField } from './data-schema.js'
-import { unresolveSelfScope } from './self-scope.js'
+import { unresolveSelfScope, refuseOrgOption } from './self-scope.js'
+import { parseCatalogRef } from '../site/foundation-ref.js'
 import { unwrapLocalized } from './backfill.js'
 import { createTranslationCollector, writeLocaleTranslations, writeFreeformTranslations } from './locale-sync.js'
 import { buildFreeformRecordPath } from '../i18n/freeform.js'
@@ -151,8 +152,8 @@ function indexFolder(folderDoc) {
 // `schemaForPoolDirs`, and deliberately not a second rule: if the two disagreed,
 // a pulled record would land somewhere the next build reads as a different
 // schema — silently, because both paths are well-formed.
-function recordDirFor(recordsRoot, model, selfOrg) {
-  const dirs = poolDirsForSchema(unresolveSelfScope(model, selfOrg))
+function recordDirFor(recordsRoot, model, scope) {
+  const dirs = poolDirsForSchema(unresolveSelfScope(model, scope))
   return dirs ? join(recordsRoot, ...dirs) : null
 }
 
@@ -173,16 +174,6 @@ function locate(document, folderIndex) {
   return fromFolder || null
 }
 
-/** The site's own org on `backend` — its `site.org` in `sync.json` — bare (`acme`), or null. Stored bare — see `writeSiteOrg`. */
-// ⛔ `site.yml::$org` IS GONE (2026-09-20) — the org lives in
-// `sync.json::backends.<origin>.site.org`. This read `site.yml` and, once step 4
-// moved the key, silently returned null: every `@org/x` model a pull met would have
-// been placed back as if the site had no org. No test spanned it.
-function readSiteOrg(siteRoot, backend) {
-  const org = backend ? readBackendState(siteRoot, backend).site?.org : null
-  return typeof org === 'string' && org ? org : null
-}
-
 // Skip undefined when copying optional fields into a projected declaration.
 function setIf(obj, key, value) {
   if (value !== undefined) obj[key] = value
@@ -239,15 +230,15 @@ function isDerivedDeferred(d, dataSchemas) {
   return d.deferred.every((f) => a.has(f))
 }
 
-function declToFileShape(wire, dataSchemas = null, selfOrg = null) {
+function declToFileShape(wire, dataSchemas = null, scope = null) {
   // ⛔ UNDO THE PRODUCER'S QUALIFICATION FIRST, before anything compares against
-  // `schema`. The push qualifies a foundation-relative `@/x` to `@org/x`
+  // `schema`. The push qualifies a foundation-relative `@/x` to `@scope/x`
   // (`site.js::queriesNested`), and both checks below are keyed by the author's
-  // `@/x`: against `@org/x` the query-name default would never match — writing an
+  // `@/x`: against `@scope/x` the query-name default would never match — writing an
   // explicit schema the author never had — and the derived-`deferred` lookup would
   // miss, persisting a derivation into their file (the 2026-08-29 defect).
-  const d = selfOrg && typeof wire.schema === 'string'
-    ? { ...wire, schema: unresolveSelfScope(wire.schema, selfOrg) }
+  const d = scope && typeof wire.schema === 'string'
+    ? { ...wire, schema: unresolveSelfScope(wire.schema, scope) }
     : wire
   const name = d.name || d.$id
   const decl = {}
@@ -329,14 +320,14 @@ function declToFileShape(wire, dataSchemas = null, selfOrg = null) {
  * @param {object} params
  * @param {object} params.document - a site-content `$`-document (`{ queries }`)
  * @param {string} params.siteRoot
- * @param {string} [params.org] - the site's own org, so a `schema` the producer
- *        qualified from `@/x` is written back as `@/x`. Defaults to the org
- *        `sync.json` records for `backend`, the same default `recordsToProject`
- *        places records by.
- * @param {string|null} [params.backend] - whose recorded org is that default
+ * @param {string|null} [params.scope] - the scope the push qualified a `schema` from
+ *        `@/x` with — the site's foundation's — so it is written back as `@/x`.
+ *        Defaults to the scope of the foundation ref the pulled document carries
+ *        (`info.foundation`, the pinned `@org/name@version`), which is that scope.
  * @returns {{ collections?: 'updated'|'unchanged' }}
  */
-export function declarationsToQueriesYml({ document, siteRoot, org, backend = null }) {
+export function declarationsToQueriesYml({ document, siteRoot, scope, ...rest }) {
+  refuseOrgOption(rest, 'declarationsToQueriesYml')
   const decls = Array.isArray(document?.queries) ? document.queries : []
   const report = {}
   if (decls.length === 0) return report
@@ -354,11 +345,12 @@ export function declarationsToQueriesYml({ document, siteRoot, org, backend = nu
     siteYml = null
   }
   const dataSchemas = siteYml ? foundationDataSchemas(siteRoot, siteYml) : null
-  const selfOrg = org ?? readSiteOrg(siteRoot, backend)
+  const selfScope =
+    scope !== undefined ? scope : (parseCatalogRef(document?.info?.foundation)?.scope ?? null)
 
   const queries = {}
   for (const d of decls) {
-    const { name, decl } = declToFileShape(d, dataSchemas, selfOrg)
+    const { name, decl } = declToFileShape(d, dataSchemas, selfScope)
     if (!name) continue
     queries[name] = decl
   }
@@ -370,18 +362,19 @@ export function declarationsToQueriesYml({ document, siteRoot, org, backend = nu
 }
 
 /**
- * Project a pulled `@uniweb/folder` document back to `records.yml`.
+ * Project a pulled `@uniweb/folder` document back to `folder.yml` in the records
+ * directory (`records/folder.yml`, or under `site.yml::paths.records`).
  *
  * ⭐ THE FOLDER ROUND-TRIPS TRIVIALLY, and that is by design rather than luck:
- * `records.yml` holds concrete paths on both sides, so there is nothing to invert.
+ * `folder.yml` holds concrete paths on both sides, so there is nothing to invert.
  * The old shape put QUERY MACROS in the folder — a virtual `folders:` tree naming
  * collections — and inverting a macro is not possible in general. Taking queries
  * out of the folder is what dissolved that.
  *
  * ⭐ ONLY THE SUB-FOLDERS ARE WRITTEN (ruled 2026-09-21 [Diego]). A record at the
  * top of the folder needs no line — being in the records directory is what puts it
- * there — so `records.yml` carries the branches and the records placed in them, and
- * a folder with no branches is a site with no `records.yml`: a local one is REMOVED
+ * there — so `folder.yml` carries the branches and the records placed in them, and
+ * a folder with no branches is a site with no `folder.yml`: a local one is REMOVED
  * (it could only describe sub-folders the backend's folder no longer has). No state
  * of the file removes a record, so this cannot empty anything.
  *
@@ -395,11 +388,13 @@ export function declarationsToQueriesYml({ document, siteRoot, org, backend = nu
  *        under `records/` of the file just written for it. Supplied by
  *        `recordsToProject`, which is the only thing that knows the extension
  *        each record landed with.
- * @returns {{ status: 'updated'|'unchanged'|'removed'|'skipped', entries: Array, warnings: string[] }}
+ * @returns {{ status: 'updated'|'unchanged'|'removed'|'skipped', entries: Array, warnings: string[], file: string }}
+ *   `file` is where the organization lives, as the author would write it
  */
-export function folderToRecordsYml({ folderDoc, siteRoot, poolPathByUuid, sourceLocale = 'en' }) {
+export function folderToFolderYml({ folderDoc, siteRoot, poolPathByUuid, sourceLocale = 'en' }) {
   const warnings = []
-  if (!folderDoc) return { status: 'skipped', entries: [], warnings }
+  const { abs, rel: file } = folderYmlPath(siteRoot)
+  if (!folderDoc) return { status: 'skipped', entries: [], warnings, file }
   let unplaceable = false
 
   const walk = (nodes, inBranch) => {
@@ -410,7 +405,7 @@ export function folderToRecordsYml({ folderDoc, siteRoot, poolPathByUuid, source
         const entry = { folder: node.name }
         // Only a BRANCH takes a label. A record carries its own title; the folder
         // does not caption its rows. On the wire the label is a localized map;
-        // records.yml carries the source-locale string (a bare string passes).
+        // folder.yml carries the source-locale string (a bare string passes).
         if (node.label !== undefined) entry.label = unwrapLocalized(node.label, sourceLocale)
         entry.records = walk(node.$children, true)
         out.push(entry)
@@ -435,7 +430,7 @@ export function folderToRecordsYml({ folderDoc, siteRoot, poolPathByUuid, source
         // means the folder and the directory disagree, and writing the file without
         // it would move that record to the top of the folder on the next push.
         warnings.push(
-          `records.yml: the folder places a record ("${node.name ?? '?'}") that was not ` +
+          `${file}: the folder places a record ("${node.name ?? '?'}") that was not ` +
             `written locally — the file was left unchanged rather than dropping it.`
         )
         unplaceable = true
@@ -447,14 +442,13 @@ export function folderToRecordsYml({ folderDoc, siteRoot, poolPathByUuid, source
   }
 
   const entries = walk(folderDoc.contents, false)
-  if (unplaceable) return { status: 'skipped', entries: [], warnings }
+  if (unplaceable) return { status: 'skipped', entries: [], warnings, file }
   if (entries.length === 0) {
-    const file = recordsYmlPath(siteRoot)
-    if (!existsSync(file)) return { status: 'unchanged', entries, warnings }
-    unlinkSync(file)
-    return { status: 'removed', entries, warnings }
+    if (!existsSync(abs)) return { status: 'unchanged', entries, warnings, file }
+    unlinkSync(abs)
+    return { status: 'removed', entries, warnings, file }
   }
-  return { status: writeRecordsConfig(siteRoot, entries), entries, warnings }
+  return { status: writeRecordsConfig(siteRoot, entries), entries, warnings, file }
 }
 
 /**
@@ -467,20 +461,21 @@ export function folderToRecordsYml({ folderDoc, siteRoot, poolPathByUuid, source
  * @param {object} params.opts
  * @param {(modelName: string) => object|null|undefined} params.opts.resolveDeclaration
  *        - resolve a Model's data-schema declaration by name (`$model`).
- * @param {string} [params.opts.org] - the site's own org, so a `@org/x` model the
- *        producer resolved from `@/x` is placed back where the author wrote it.
- *        Defaults to the org `sync.json` records for `opts.backend`.
- * @param {string} [params.opts.backend] - whose record map to read and extend, and
- *        whose recorded org is that default
+ * @param {string|null} [params.opts.scope] - the scope the push qualified a record's
+ *        `@/x` Model with — the site's foundation's — so a `@scope/x` model is placed
+ *        back where the author wrote it. The caller resolves it up front, as it does
+ *        Models (`siteSelfScope`); absent, a model is placed under its own scope.
+ * @param {string} [params.opts.backend] - whose record map to read and extend
  * @param {string} [params.opts.sourceLocale]
  * @returns {{ updated: string[], placed: string[], unchanged: string[], skipped: object[], warnings: string[], locales: object }}
  */
 export function recordsToProject({ folderDoc, recordDocs = [], siteRoot, opts = {} }) {
   const { resolveDeclaration, sourceLocale = 'en' } = opts
-  // The site's own org, so a `@org/x` model the producer resolved from `@/x` is
-  // placed back where the author wrote it. Read from `sync.json` (this backend's
-  // `site.org`) unless the caller already has it.
-  const selfOrg = opts.org ?? readSiteOrg(siteRoot, opts.backend)
+  refuseOrgOption(opts, 'recordsToProject')
+  // The scope the push qualified `@/x` with — the site's foundation's — so a
+  // `@scope/x` model is placed back where the author wrote it. ⛔ It was the site
+  // owner's org, read from `sync.json`, until 2026-09-22 (`self-scope.js`).
+  const selfScope = opts.scope ?? null
   if (typeof resolveDeclaration !== 'function') {
     throw new Error('uwx/records-project: opts.resolveDeclaration(modelName) is required')
   }
@@ -506,7 +501,7 @@ export function recordsToProject({ folderDoc, recordDocs = [], siteRoot, opts =
   // own id → their uuid, for every record this pull wrote. Recorded at the end.
   const learned = {}
   // uuid → the path under `records/` the record landed at. Only this loop knows
-  // the extension each one got, so `records.yml` is written from it rather than
+  // the extension each one got, so `folder.yml` is written from it rather than
   // re-derived (a second rule could pick a different extension and the folder
   // would name a file that is not there).
   const poolPathByUuid = new Map()
@@ -523,7 +518,7 @@ export function recordsToProject({ folderDoc, recordDocs = [], siteRoot, opts =
       continue
     }
 
-    const poolDir = recordDirFor(recordsRoot, document.$model, selfOrg)
+    const poolDir = recordDirFor(recordsRoot, document.$model, selfScope)
     if (!poolDir) {
       skipped.push({
         uuid: document.$uuid,
@@ -571,20 +566,20 @@ export function recordsToProject({ folderDoc, recordDocs = [], siteRoot, opts =
     else if (isNew) placed.push(filePath)
     else updated.push(filePath)
     // Keyed by THEIR uuid: the folder document references records in the backend's
-    // terms, so that is what `folderToRecordsYml` will look them up by.
+    // terms, so that is what `folderToFolderYml` will look them up by.
     if (theirs) {
       poolPathByUuid.set(theirs, relative(recordsRoot, filePath).split(sep).join('/'))
       if (own) learned[own] = theirs
     }
   }
 
-  // ⭐ THE FOLDER ITSELF, written back as `records.yml`. Steps that only touched the
+  // ⭐ THE FOLDER ITSELF, written back as `folder.yml`. Steps that only touched the
   // READ path would leave every pull authoring the old shape — the site would build
   // from the new layout and be projected back into the one it replaced.
   //
   // The folder ENTITY still carries no `$uuid` we persist: the backend owns the
   // site's folder, keyed by the site-content uuid.
-  const records = folderToRecordsYml({ folderDoc, siteRoot, poolPathByUuid, sourceLocale })
+  const records = folderToFolderYml({ folderDoc, siteRoot, poolPathByUuid, sourceLocale })
   warnings.push(...records.warnings)
 
   // Flush localized record-field translations to locales/records/{locale}.json,
@@ -596,5 +591,5 @@ export function recordsToProject({ folderDoc, recordDocs = [], siteRoot, opts =
     updateBackendMap(siteRoot, opts.backend, 'records', learned)
   }
 
-  return { updated, placed, unchanged, skipped, warnings, locales, freeform, records: records.status }
+  return { updated, placed, unchanged, skipped, warnings, locales, freeform, records: records.status, recordsFile: records.file }
 }

package/src/uwx/records.js

@@ -48,7 +48,7 @@ import { join, resolve } from 'node:path'
 
 import { resolveQueriesConfig } from './queries-config.js'
 import { readEntityFile } from './entity-source.js'
-import { readRecordsConfig, resolveFolder, RECORDS_YML_RELPATH } from '../site/records-config.js'
+import { readRecordsConfig, resolveFolder } from '../site/records-config.js'
 import {
   readEntityPool,
   groupPoolBySchema,
@@ -57,7 +57,7 @@ import {
 } from '../site/entity-pool.js'
 import { toDataSchemaDeclaration, isProseMirrorField, isMarkupTextField, isContentBodyField } from './data-schema.js'
 import { emitEntitySyncPackage } from './entity-document.js'
-import { resolveSelfScope } from './self-scope.js'
+import { resolveSelfScope, siteSelfScope, refuseOrgOption } from './self-scope.js'
 import { sha256Hex, toJsonBuffer } from './manifest.js'
 import { markdownToProseMirror } from '@uniweb/content-reader'
 import { LOCALIZED_FIELD_ASSUMPTION, localize } from './localize.js'
@@ -80,17 +80,22 @@ const SKIP_KEYS = new Set([
   '$unit',
   '$meta',
   '$body',
-  // The draft flag (`site/record-draft.js`) — framework's, never a Model field.
+  // The draft flag (`site/record-draft.js`) — framework's, never a Model field. It
+  // travels as the entity's `$disabled` (see the document below).
   'draft',
 ])
 
 // Recursively drop IDENTITY `$`-sigil keys (`$uuid`/`$id`/`$model`/… — never
 // field data; the sigil-exclusivity invariant guarantees this) at every level,
-// so a back-filled `$uuid` doesn't change the hash. `$children` is the exception:
-// it is STRUCTURAL content (a self-nesting record's subtree, e.g. site-content's
-// nested pages/sections), so it is KEPT and recursed into — otherwise a nesting
-// change would be invisible to "send only changed". Flat records carry no
-// `$children`, so this is a no-op for the collection lane.
+// so a back-filled `$uuid` doesn't change the hash. Two are exceptions, because
+// they are content rather than identity:
+//   - `$children` is STRUCTURAL content (a self-nesting record's subtree, e.g.
+//     site-content's nested pages/sections), so it is KEPT and recursed into —
+//     otherwise a nesting change would be invisible to "send only changed". Flat
+//     records carry no `$children`, so this is a no-op for the collection lane.
+//   - `$disabled` is a record's delivery STATE (`draft: true` on the file side). It
+//     is KEPT so that drafting or un-drafting a record with nothing else changed is
+//     still sent; stripped, "send only changed" would never send the toggle.
 function stripSigils(value) {
   if (Array.isArray(value)) return value.map(stripSigils)
   if (value && typeof value === 'object') {
@@ -123,9 +128,9 @@ function stripSigils(value) {
     const out = {}
     for (const [k, v] of Object.entries(value)) {
       if (isFolderRefLeaf && (k === '$ref' || k === 'entry')) continue
-      // `$children` (a self-nesting subtree) is structural CONTENT, not an identity
-      // sigil — kept and recursed into, so a nesting change stays visible.
-      if (k === '$children') {
+      // `$children` (a self-nesting subtree) and `$disabled` (a delivery state) are
+      // CONTENT, not identity sigils — kept, so a change to either stays visible.
+      if (k === '$children' || k === '$disabled') {
         out[k] = stripSigils(v)
         continue
       }
@@ -338,13 +343,19 @@ export function recordsToEntities({
       )
     }
 
-    // The `$`-document, in canonical key order: `$uuid?`, `$id`, `$model`, then each
-    // populated section in declared order (the brief always present as the card).
-    // `$owner`/`$unit`/`$meta` are omitted — the backend binds owner + unit on its side.
+    // The `$`-document, in canonical key order: `$uuid?`, `$id`, `$model`, `$disabled?`,
+    // then each populated section in declared order (the brief always present as the
+    // card). `$owner`/`$unit`/`$meta` are omitted — the backend binds owner + unit on
+    // its side.
     const document = {}
     if (uuid) document.$uuid = uuid
     document.$id = id
     document.$model = declaration.name
+    // ⭐ A DRAFT IS SENT AS A DISABLED ENTITY: it stays in the folder and is never
+    // publicly delivered. Only `true` travels. An absent key means enabled [Diego,
+    // 2026-09-21], so a record whose `draft: true` is removed is sent without the key
+    // and is delivered again.
+    if (isDraftRecord(record, `${label}/${slug}`)) document.$disabled = true
     document[briefName] = sectionData[briefName] || {}
     for (const [secName] of recordSections) {
       if (secName !== briefName && sectionData[secName]) document[secName] = sectionData[secName]
@@ -532,7 +543,7 @@ function resolveDeclaration(schema, modelName) {
  * PURE assembly (no hashing, no emit), so it composes with other entity sources
  * (e.g. site-content) into one sync package. First sync sends no `$uuid` (the
  * backend mints); re-sync round-trips the back-filled `$uuid`. Throws on an
- * unresolvable EXPLICIT Model, an invalid `records.yml`, or a duplicate
+ * unresolvable EXPLICIT Model, an invalid `records/folder.yml`, or a duplicate
  * ($model, $id) within the submission.
  *
  * @param {string} siteRoot - directory containing site.yml
@@ -543,6 +554,9 @@ function resolveDeclaration(schema, modelName) {
  *        `@uniweb/data-schema` declaration (or null). The verb wires this to the
  *        backend's Model-read route. Without it, the local foundation is required.
  * @param {string} [opts.sourceLocale]    - localized-field wrap locale
+ * @param {string|null} [opts.scope] - the scope a record's `@/x` Model resolves into.
+ *        Defaults to the site's foundation's (`siteSelfScope`); a caller that has it
+ *        already passes it, so one emit reads it once.
  * @returns {Promise<{ entities: object[], index: object[], warnings: string[],
  *   schemaless: Array<{name: string, model: string}>, colConfig: object,
  *   folder: object, recordsDirExists: boolean }>}
@@ -556,7 +570,7 @@ export async function buildRecordEntities(siteRoot, opts = {}) {
   // ⭐ EVERY FILE IN `records/` IS A RECORD, AND EVERY RECORD IS PUSHED (ruled
   // 2026-09-21 [Diego]). Placing a file in the directory is what makes it one —
   // the file-side counterpart of placing a ref in the backend's folder — so nothing
-  // lists it and nothing leaves it out. `records.yml` only sorts records into
+  // lists it and nothing leaves it out. `records/folder.yml` only sorts records into
   // sub-folders. A file named with a leading `_` is not read, so it is not a record.
   //
   // ⛔ A PUSHED RECORD IS NOT LIVE. It sits in the site's folder on the backend and
@@ -574,12 +588,13 @@ export async function buildRecordEntities(siteRoot, opts = {}) {
   // twice and the duplicate check refused the push (measured: "appears in more than
   // one query"), and a record no query read was never pushed. Records are walked
   // once, by the schema their folder declares.
+  refuseOrgOption(opts, 'uwx/records')
   const pool = await readEntityPool(siteRoot)
-  const recordsCfg = await readRecordsConfig(siteRoot)
+  const recordsCfg = await readRecordsConfig(siteRoot, { dir: pool.dir })
   if (recordsCfg.error) throw new Error(`uwx/records: ${recordsCfg.error}`)
   const folder = resolveFolder(recordsCfg.entries, pool.entities, { dir: pool.dir })
   if (folder.errors.length) {
-    throw new Error(`uwx/records: ${RECORDS_YML_RELPATH} is invalid —\n  ${folder.errors.join('\n  ')}`)
+    throw new Error(`uwx/records: ${recordsCfg.file} is invalid —\n  ${folder.errors.join('\n  ')}`)
   }
   const warnings = [...pool.errors, ...folder.warnings]
 
@@ -646,19 +661,25 @@ export async function buildRecordEntities(siteRoot, opts = {}) {
   //
   // ⛔ The rule lives in `./self-scope.js`, shared with the `queries` Section
   // (`site.js::queriesNested`): a query's `schema` must name exactly the Model
-  // these records are stored under, so both go through one function with one org.
+  // these records are stored under, so both go through one function with one scope.
+  //
+  // ⭐ THE SCOPE IS THE FOUNDATION'S — the one `register` stored these Models under —
+  // never the site owner's (2026-09-22; `self-scope.js` has the record).
+  const scope =
+    opts.scope !== undefined ? opts.scope : await siteSelfScope(siteRoot, { foundationDir: opts.foundationDir })
   const warnedUnscoped = new Set()
   const modelFor = (schema, where) => {
-    const modelName = resolveSelfScope(schema, opts.org)
-    // Unresolvable `@/` — no org is known. Ship it rather than throwing (a `status`
-    // probe on a never-pushed site has no org and must still count), but say so:
-    // the backend's refusal names a missing Model and cannot name this cause.
+    const modelName = resolveSelfScope(schema, scope)
+    // Unresolvable `@/` — the foundation has no scope yet. Ship it rather than
+    // throwing (a `status` probe on a never-registered foundation must still count),
+    // but say so: the backend's refusal names a missing Model and cannot name this cause.
     if (modelName === schema && typeof schema === 'string' && schema.startsWith('@/') && !warnedUnscoped.has(schema)) {
       warnedUnscoped.add(schema)
       warnings.push(
-        `${where}: \`${schema}\` is foundation-relative and no org is known, ` +
+        `${where}: \`${schema}\` is foundation-relative and the foundation has no scope yet, ` +
           `so it ships unresolved. The backend resolves Models by name and will refuse it. ` +
-          `Pass \`--org @handle\`, or push once so the site records its org.`
+          `A foundation's scope is part of its name — \`name: '@org/<name>'\` in its main.js, ` +
+          `which \`uniweb register\` writes.`
       )
     }
     return modelName
@@ -682,7 +703,7 @@ export async function buildRecordEntities(siteRoot, opts = {}) {
         (alternative
           ? ` If you meant \`${pool.dir}/${dirs[0]}/\` (${alternative}) organised by ` +
             `\`${dirs[1]}\`, note that a folder inside a schema folder is read as an ` +
-            `org scope. Organise records in records.yml, not on disk.`
+            `org scope. Organise records in records/folder.yml, not on disk.`
           : '')
     )
   }
@@ -717,8 +738,6 @@ export async function buildRecordEntities(siteRoot, opts = {}) {
   const index = []
   // pool id (the FILE) → the records it produced, so the folder places records.
   const producedBy = new Map()
-  // `draft: true` records found on the way — the push is refused if there are any.
-  const drafts = []
   // Schemas (as written) whose Model resolved to nothing — soft-skipped.
   const unresolved = new Set()
   // The sync response is keyed per ($model, $id), so the pair must be unique
@@ -751,10 +770,10 @@ export async function buildRecordEntities(siteRoot, opts = {}) {
           warnings.push(`${pooled.relPath}: a record without a slug was skipped`)
           continue
         }
-        if (isDraftRecord(r.data, pooled.relPath)) {
-          drafts.push(r.multiRecord ? `${pooled.relPath} (${r.slug})` : pooled.relPath)
-          continue
-        }
+        // A draft is a record like any other, placed in the folder; the mapper sends it
+        // disabled. Checked here too so that a malformed `draft:`, or the retired
+        // `published: false`, is refused naming the FILE rather than the record.
+        isDraftRecord(r.data, r.multiRecord ? `${pooled.relPath} (${r.slug})` : pooled.relPath)
         const rec = { ...r.data, slug: r.slug }
         if (r.body !== undefined) rec.$body = r.body
         // ⭐ THE RECORD'S IDENTITY IS ITS POSITION IN THE DIRECTORY — `<dirs>/<slug>`,
@@ -828,27 +847,14 @@ export async function buildRecordEntities(siteRoot, opts = {}) {
         // document → authoring shape (variant A): unwrap localized fields, route
         // the content body field to the md body, drop the brief record `$uuid`.
         declaration,
+        // Sent disabled, so the back-fill can check that the backend kept it that way.
+        draft: e.document.$disabled === true,
       })
     }
     entities.push(...mappedOut.entities)
     warnings.push(...mappedOut.warnings)
   }
 
-  // ⛔ A DRAFT IS REFUSED, NOT PUSHED AND NOT SKIPPED. It is a record that stays in the
-  // folder but is not delivered — which a backend holds as the entity's `disabled`, a
-  // state this producer cannot send yet. Pushed without it, the backend would serve the
-  // draft once the site is published; skipped, it would leave the folder — and a site
-  // whose records were all drafts would send no folder at all, leaving the backend's
-  // live. So the push stops and says which records, until the flag can travel.
-  if (drafts.length) {
-    throw new Error(
-      `uwx/records: a push cannot mark a record as a draft yet, and the backend would serve it ` +
-        `once the site is published —\n  ${drafts.join('\n  ')}\n` +
-        '  Push them as records by removing `draft: true`, or keep them off the backend by ' +
-        'starting their names with `_`.'
-    )
-  }
-
   // Queries whose schema resolved to nothing — not pushed as entities. The composite
   // deploy delivers these statically (the "data ball") instead, so the caller can
   // route them there.
@@ -867,8 +873,8 @@ export async function buildRecordEntities(siteRoot, opts = {}) {
       ? !unresolved.has(schema)
       : Boolean(await declarationFor(modelFor(schema, `query "${name}"`)))
     if (!resolved) {
-      if (decl.schemaExplicit) throw unresolvedExplicit(resolveSelfScope(schema, opts.org), name)
-      schemaless.push({ name, model: resolveSelfScope(schema, opts.org) })
+      if (decl.schemaExplicit) throw unresolvedExplicit(resolveSelfScope(schema, scope), name)
+      schemaless.push({ name, model: resolveSelfScope(schema, scope) })
       continue
     }
     if (!hasRecords) {

package/src/uwx/registry-package.js

@@ -17,15 +17,17 @@
  * `@uniweb/data-schema` entities, no foundation-schema — for a schemas-only
  * package (the standard schemas under `@std`, or an org's own `@org/schemas`).
  *
- * Scope: pass `scope` ('@acme' or 'acme') to resolve a schema's own `@/x` (and the
- * foundation's `data-schemas.refs`) to a concrete `@acme/x` for submission. With no
- * `scope`, names stay `@/x` (local preview / dry-run). See `uwx-format.md`.
+ * Scope: a foundation whose name is scoped (`@acme/fnd`) registers under that scope —
+ * its name and its schemas' own `@/x` alike. A bare name takes `scope` ('@acme' or
+ * 'acme'). With neither, names stay `@/x` (local preview / dry-run). A schemas-only
+ * package has no name to carry one, so it always takes `scope`. See `uwx-format.md`.
  */
 
 import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
 
 import { toDataSchemaDeclaration } from './data-schema.js'
+import { checkFoundationName, splitFoundationName } from '../foundation-name.js'
 
 const FOUNDATION_SCHEMA = '@uniweb/foundation-schema'
 const DATA_SCHEMA = '@uniweb/data-schema'
@@ -45,7 +47,9 @@ try {
  * @param {Object} params
  * @param {Object} params.schema - parsed `dist/meta/schema.json`.
  * @param {string} [params.foundationDir] - foundation root, for the `i18n/` bundles.
- * @param {string} [params.scope] - org scope (`@acme` or `acme`) resolving `@/x` -> `@acme/x`.
+ * @param {string} [params.scope] - org scope (`@acme` or `acme`) resolving `@/x` -> `@acme/x`,
+ *   for a foundation whose name is bare. A scoped name's own scope is used instead, and
+ *   a `scope` that contradicts it throws.
  * @param {Object} [params.exporter] - `{ tool, version, instance }` for the envelope.
  * @param {string} [params.exportedAt] - ISO timestamp (default: now).
  * @param {string} [params.runtime] - the `@uniweb/runtime` version this build
@@ -69,7 +73,10 @@ export function buildRegistryPackage({ schema, foundationDir, scope, exporter, e
   // own `@/x`), each resolved to the concrete publish scope. Shared refs
   // (`@std/x`, `@other/x`) are named in the foundation's data-schemas.refs but
   // their declarations are not bundled — already published.
-  const { entities: dataSchemaEntities, scoped, org } = buildDataSchemaEntities(dataSchemas, scope)
+  const { entities: dataSchemaEntities, scoped, org } = buildDataSchemaEntities(
+    dataSchemas,
+    registrationScope(self.name, scope)
+  )
 
   const foundationEntity = {
     model: FOUNDATION_SCHEMA,
@@ -107,6 +114,27 @@ export function buildSchemaOnlyPackage({ schemas, scope, exporter, exportedAt }
   return wrapEntities(entities, exporter, exportedAt)
 }
 
+// The scope a foundation registers under: the one in its name, else `scope`.
+//
+// ⭐ A SCOPED NAME IS THE SCOPE (2026-09-22). `@acme/fnd` registers under `@acme` —
+// the foundation and its data schemas both, because a site's records name those
+// schemas by the same scope. ⛔ Until then the schemas took `scope` while the name
+// kept its own, so one foundation registered `@acme/fnd` beside `@proximify/member`.
+// A `scope` that contradicts the name is refused rather than chosen between: which
+// org was meant is not ours to guess.
+function registrationScope(name, scope) {
+  const { scope: nameScope } = splitFoundationName(name)
+  const handle = scope ? String(scope).replace(/^@/, '').replace(/\/.*$/, '') : ''
+  const given = handle ? `@${handle}` : null
+  if (nameScope && given && given !== nameScope) {
+    throw new Error(
+      `buildRegistryPackage: the foundation is named ${name}, so it registers under ` +
+        `${nameScope} — not ${given}. A foundation's scope is the one in its name.`
+    )
+  }
+  return nameScope || scope
+}
+
 // Lower a `{ '@/<name>': normalizedSchema }` map into the sorted
 // `@uniweb/data-schema` entity list, resolving each own `@/x` to the publish
 // scope. Shared by the foundation publish (buildRegistryPackage) and the
@@ -148,8 +176,14 @@ function wrapEntities(entities, exporter, exportedAt) {
 // optional `digest` (sha256:…) is the foundation's content fingerprint; the
 // backend stores it opaque and returns it on the foundation-latest read.
 function buildInfo(self, org, digest, runtime) {
-  // Scope a bare foundation name (`src` -> `@acme/src`); leave an already-scoped name.
+  // Scope a bare foundation name (`marketing` -> `@acme/marketing`); leave an
+  // already-scoped name.
   const name = org && !String(self.name).startsWith('@') ? `@${org}/${self.name}` : self.name
+  // ⛔ The producer's own guard. `uniweb register` asks for a name before it gets
+  // here; this refuses for any other caller, so nothing registers as `@org/src`
+  // (`foundation-name.js`).
+  const problem = checkFoundationName(name)
+  if (problem) throw new Error(`buildRegistryPackage: ${problem}`)
   const info = { name, version: self.version, role: self.role || 'foundation' }
   if (self.description !== undefined) info.description = self.description
   if (digest) info.digest = digest