canopycms 0.0.68-int.98 → 0.1.0

package/dist/static/seo.js

@@ -92,12 +92,12 @@ export function extractSeoFields(entryData, opts = {}) {
  * THE `noindex` predicate. Every surface that suppresses an entry must route through this one
  * function rather than re-deriving the flag:
  *
- * - the page's own `robots: { index: false }` (canopycms-next's `entryToMetadata`), and
- * - exclusion from the sitemap (canopycms-next's `generateContentSitemap`).
+ * - the page's own `robots: { index: false }` (canopycms-next's `entryToMetadata`),
+ * - exclusion from the sitemap (canopycms-next's `generateContentSitemap`), and
+ * - exclusion from AI content (`ai/generate.ts`, unless `exclude.noindex: false`).
  *
- * Those two shipping from one predicate is the point of shipping them together. Where they were
- * derived separately, a `noindex` entry stayed advertised in one surface while correctly absent
- * from the other, and nothing warned.
+ * Those surfaces shipping from one predicate is the point. Derived separately, a `noindex` entry
+ * stays advertised in one surface while correctly absent from another, and nothing warns.
  *
  * NOT applied to enumeration: `noindex` means "don't advertise this", not "don't build this".
  * `collectRoutableEntries` and `generateStaticParams` must still emit the entry, so its URL

package/dist/submission-attribution.d.ts

@@ -1,3 +1,4 @@
+import type { UserSearchResult } from './auth/types.js';
 import type { CanopyUser } from './user.js';
 /**
  * Who submitted (and edited) a branch, recorded in the submit commit's trailers
@@ -38,6 +39,13 @@ export declare function sanitizeUserId(raw: string | undefined): string | undefi
 export declare function sanitizeEmail(raw: string | undefined): string | undefined;
 /** The submitter as a SubmissionEditor, or undefined for an anonymous user. */
 export declare function submissionEditorFromUser(user: CanopyUser): SubmissionEditor | undefined;
+/** Looks a user up by id, as `AuthPlugin.getUserMetadata` does. */
+export type EditorLookup = (userId: string) => Promise<UserSearchResult | null>;
+/**
+ * Recorded editor ids as SubmissionEditors, with the email and usable name (see personName) the
+ * auth provider gives now. A user the lookup cannot find, or a lookup that throws, keeps just the id.
+ */
+export declare function describeEditors(userIds: readonly string[], lookup: EditorLookup | undefined): Promise<SubmissionEditor[]>;
 export interface CommitTrailerOptions {
     /** One `Edited-by: Name (id)` per editor. */
     editedBy: boolean;

package/dist/submission-attribution.js

@@ -1,3 +1,5 @@
+import { personName } from './auth/person-name.js';
+import { getErrorMessage } from './utils/error.js';
 import { canopyLogWarn } from './utils/logger.js';
 const MAX_NAME_LENGTH = 80;
 const MAX_ID_LENGTH = 128;
@@ -87,6 +89,26 @@ export function submissionEditorFromUser(user) {
         return undefined;
     return { userId: user.userId, name: user.name, email: user.email };
 }
+/**
+ * Recorded editor ids as SubmissionEditors, with the email and usable name (see personName) the
+ * auth provider gives now. A user the lookup cannot find, or a lookup that throws, keeps just the id.
+ */
+export async function describeEditors(userIds, lookup) {
+    return Promise.all(userIds.map(async (userId) => {
+        if (!lookup)
+            return { userId };
+        try {
+            const found = await lookup(userId);
+            return found
+                ? { userId, name: personName(userId, found.name), email: found.email }
+                : { userId };
+        }
+        catch (err) {
+            canopyLogWarn('CanopyCMS: Could not look up an editor; crediting them by id:', getErrorMessage(err));
+            return { userId };
+        }
+    }));
+}
 function cleanEditors(editors) {
     const seen = new Set();
     const result = [];

package/dist/system-users.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The user ids CanopyCMS itself acts as, never a person. Dependency-free, so the editor bundle can
+ * import it.
+ */
+/** Owner of a branch CanopyCMS provisions itself (http/handler.ts); see authorization/branch.ts. */
+export declare const SYSTEM_USER_ID = "canopycms-system";
+/** Owner recorded by a content read outside any request (content-reader.ts). */
+export declare const CONTENT_READER_USER_ID = "canopycms-content-reader";
+/** Owner recorded for the active branch a server context provisions (context.ts). */
+export declare const CONTEXT_USER_ID = "canopycms-context";
+/** True for a user id CanopyCMS acts as; the editor shows these as "CanopyCMS bot". */
+export declare const isSystemUserId: (userId: string) => boolean;

package/dist/system-users.js

@@ -0,0 +1,12 @@
+/**
+ * The user ids CanopyCMS itself acts as, never a person. Dependency-free, so the editor bundle can
+ * import it.
+ */
+/** Owner of a branch CanopyCMS provisions itself (http/handler.ts); see authorization/branch.ts. */
+export const SYSTEM_USER_ID = 'canopycms-system';
+/** Owner recorded by a content read outside any request (content-reader.ts). */
+export const CONTENT_READER_USER_ID = 'canopycms-content-reader';
+/** Owner recorded for the active branch a server context provisions (context.ts). */
+export const CONTEXT_USER_ID = 'canopycms-context';
+/** True for a user id CanopyCMS acts as; the editor shows these as "CanopyCMS bot". */
+export const isSystemUserId = (userId) => userId === SYSTEM_USER_ID || userId === CONTENT_READER_USER_ID || userId === CONTEXT_USER_ID;

package/dist/task-queue/cms-task-queue.d.ts

@@ -11,5 +11,5 @@ export type WorkerTask = Task & {
     action: TaskAction;
 };
 export declare const cmsTaskQueueLogger: TaskQueueLogger;
-export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, requeueFailedTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, listCorruptTaskFiles, } from './task-queue.js';
+export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, releaseTask, requeueFailedTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, listCorruptTaskFiles, } from './task-queue.js';
 export type { Task, TaskStatus, QueueStats, TaskQueueLogger, CorruptTaskFile } from './types.js';

package/dist/task-queue/cms-task-queue.js

@@ -10,4 +10,4 @@ export const cmsTaskQueueLogger = {
         debugLogger.debug('task', message, data);
     },
 };
-export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, requeueFailedTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, listCorruptTaskFiles, } from './task-queue.js';
+export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, releaseTask, requeueFailedTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, listCorruptTaskFiles, } from './task-queue.js';

package/dist/task-queue/index.d.ts

@@ -1,2 +1,2 @@
 export type { Task, TaskStatus, QueueStats, TaskQueueLogger, CorruptTaskFile } from './types.js';
-export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, requeueFailedTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, listCorruptTaskFiles, } from './task-queue.js';
+export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, releaseTask, requeueFailedTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, listCorruptTaskFiles, } from './task-queue.js';

package/dist/task-queue/index.js

@@ -1 +1 @@
-export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, requeueFailedTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, listCorruptTaskFiles, } from './task-queue.js';
+export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, releaseTask, requeueFailedTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, listCorruptTaskFiles, } from './task-queue.js';

package/dist/task-queue/task-queue.d.ts

@@ -49,6 +49,12 @@ export declare function failTask(taskDir: string, taskId: string, error: string,
  * and a retryAfter timestamp. Backoff: 5s → 10s → 20s → 40s → 60s cap.
  */
 export declare function retryTask(taskDir: string, taskId: string, error: string, logger?: TaskQueueLogger): Promise<void>;
+/**
+ * Hand an in-flight task back to pending/ unchanged, with no retry spent and no
+ * backoff, for a consumer abandoning it while shutting down. Safe only for an
+ * idempotent action: the abandoned attempt may have done part of its work.
+ */
+export declare function releaseTask(taskDir: string, taskId: string, logger?: TaskQueueLogger): Promise<void>;
 /**
  * Requeue a permanently-failed task: reads failed/{taskId}.json and creates a
  * brand-new pending task with a fresh `id`, never the original — `dequeueTask`

package/dist/task-queue/task-queue.js

@@ -214,6 +214,35 @@ export async function retryTask(taskDir, taskId, error, logger = nullLogger) {
     await fs.unlink(processingPath).catch(() => { });
     logger.debug('Retrying task', { id: taskId, retryCount, backoffMs });
 }
+/**
+ * Hand an in-flight task back to pending/ unchanged, with no retry spent and no
+ * backoff, for a consumer abandoning it while shutting down. Safe only for an
+ * idempotent action: the abandoned attempt may have done part of its work.
+ */
+export async function releaseTask(taskDir, taskId, logger = nullLogger) {
+    const processingPath = path.join(taskDir, 'processing', `${taskId}.json`);
+    const pendingPath = path.join(taskDir, 'pending', `${taskId}.json`);
+    let task;
+    try {
+        const content = await fs.readFile(processingPath, 'utf-8');
+        const parsed = parseTaskJson(content);
+        if (!parsed) {
+            logger.debug('Corrupt task file in processing, removing', { id: taskId });
+            await fs.unlink(processingPath).catch(() => { });
+            return;
+        }
+        task = parsed;
+    }
+    catch (err) {
+        if (isNotFoundError(err))
+            return;
+        throw err;
+    }
+    task.status = 'pending';
+    await atomicWriteFile(pendingPath, JSON.stringify(task, null, 2));
+    await fs.unlink(processingPath).catch(() => { });
+    logger.debug('Released task', { id: taskId });
+}
 /**
  * Requeue a permanently-failed task: reads failed/{taskId}.json and creates a
  * brand-new pending task with a fresh `id`, never the original — `dequeueTask`

package/dist/task-queue/worker-status.d.ts

@@ -11,7 +11,7 @@
  * (utils/atomic-write.ts), never a read-modify-write, so whichever write lands
  * last is one writer's complete, self-consistent snapshot. That covers the one
  * window where two holders overlap -- after a lock compromise the old holder's
- * `stop()` drains for up to `taskTimeoutMs` while a new holder is already
+ * `stop()` aborts its in-flight work while a new holder may already be
  * running against the same workspace.
  *
  * Readers are stale-tolerant by design: this is a liveness signal, not
@@ -21,6 +21,40 @@
  */
 import type { WorkerStatusReport } from '../types.js';
 export declare const WORKER_STATUS_FILE = "worker-status.json";
+/**
+ * What a new worker carries from the previous status file into its first snapshot:
+ * `lastFatalError`, so a crash loop keeps its alert, and how the last worker that ran stopped.
+ * A `lastShutdown` written by an earlier worker than the file's own means the last one stopped
+ * without draining, unless the file's own worker recorded its failed start: it never ran, so the
+ * carried record holds. Tolerant like every reader: a missing or unreadable file yields neither.
+ */
+export declare function readCarriedOverStatus(taskDir: string): Promise<Pick<WorkerStatusReport, 'lastFatalError' | 'lastShutdown'>>;
+/**
+ * `startedAt` of the worker that wrote the status file, or `undefined` when there is no file or
+ * it names no worker. Throws on any other read error: a caller deciding whether the file is its
+ * own must not take an unreadable one for an absent one.
+ */
+export declare function readWorkerStatusStartedAt(taskDir: string): Promise<string | undefined>;
+/** A startup failure the worker recorded; see {@link readWorkerStartupFailure}. */
+export interface WorkerStartupFailure {
+    /** Already redacted by the worker. */
+    message: string;
+    at: string;
+    /**
+     * The attempt that wrote the file is the one that failed. False while a newer worker carries
+     * an older failure forward and is starting again.
+     */
+    current: boolean;
+}
+/**
+ * The startup failure in `{taskDir}/worker-status.json`, for a request that found no remote to
+ * clone. A failure is current when the worker that recorded it is the one the snapshot
+ * describes: a worker that starts again writes its own `startedAt` and carries the previous
+ * failure forward, so a retry in progress (a first clone can take minutes) is not reported as a
+ * dead worker. Compared by identity, not by clock, since the two workers can run on different
+ * hosts. Tolerant like every reader: a missing or unreadable file yields none.
+ */
+export declare function readWorkerStartupFailure(taskDir: string): Promise<WorkerStartupFailure | undefined>;
 /**
  * Write the worker's status report to `{taskDir}/worker-status.json`.
  *
@@ -32,12 +66,4 @@ export declare const WORKER_STATUS_FILE = "worker-status.json";
  * `processTaskQueue`, `start()`); any that don't fall back on scheduleLoop's
  * per-cycle catch, which logs and continues.
  */
-/**
- * The `lastFatalError` in the current status file, or undefined when the file is
- * missing, unreadable or has none. Tolerant for the same reason readers are.
- * Its one caller carries the value into a full snapshot right after taking the
- * worker lock; a write racing in between only keeps or drops one crash alert
- * until the next write.
- */
-export declare function readLastFatalError(taskDir: string): Promise<WorkerStatusReport['lastFatalError']>;
 export declare function writeWorkerStatus(taskDir: string, report: WorkerStatusReport): Promise<void>;

package/dist/task-queue/worker-status.js

@@ -11,7 +11,7 @@
  * (utils/atomic-write.ts), never a read-modify-write, so whichever write lands
  * last is one writer's complete, self-consistent snapshot. That covers the one
  * window where two holders overlap -- after a lock compromise the old holder's
- * `stop()` drains for up to `taskTimeoutMs` while a new holder is already
+ * `stop()` aborts its in-flight work while a new holder may already be
  * running against the same workspace.
  *
  * Readers are stale-tolerant by design: this is a liveness signal, not
@@ -22,7 +22,90 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { atomicWriteFile } from '../utils/atomic-write.js';
+import { isNotFoundError } from '../utils/error.js';
 export const WORKER_STATUS_FILE = 'worker-status.json';
+/**
+ * What a new worker carries from the previous status file into its first snapshot:
+ * `lastFatalError`, so a crash loop keeps its alert, and how the last worker that ran stopped.
+ * A `lastShutdown` written by an earlier worker than the file's own means the last one stopped
+ * without draining, unless the file's own worker recorded its failed start: it never ran, so the
+ * carried record holds. Tolerant like every reader: a missing or unreadable file yields neither.
+ */
+export async function readCarriedOverStatus(taskDir) {
+    let previous;
+    try {
+        const content = await fs.readFile(path.join(taskDir, WORKER_STATUS_FILE), 'utf-8');
+        previous = JSON.parse(content);
+    }
+    catch {
+        return {};
+    }
+    const { lastFatalError, startedAt, updatedAt } = previous;
+    let { lastShutdown } = previous;
+    const failedStart = lastFatalError?.phase === 'startup' && lastFatalError.workerStartedAt === startedAt;
+    if (startedAt && updatedAt && !failedStart && lastShutdown?.workerStartedAt !== startedAt) {
+        lastShutdown = {
+            reason: 'stopped without draining',
+            at: updatedAt,
+            workerStartedAt: startedAt,
+            outcome: 'not-drained',
+        };
+    }
+    return { lastFatalError, lastShutdown };
+}
+/**
+ * `startedAt` of the worker that wrote the status file, or `undefined` when there is no file or
+ * it names no worker. Throws on any other read error: a caller deciding whether the file is its
+ * own must not take an unreadable one for an absent one.
+ */
+export async function readWorkerStatusStartedAt(taskDir) {
+    let content;
+    try {
+        content = await fs.readFile(path.join(taskDir, WORKER_STATUS_FILE), 'utf-8');
+    }
+    catch (err) {
+        if (isNotFoundError(err))
+            return undefined;
+        throw err;
+    }
+    try {
+        const report = JSON.parse(content);
+        return typeof report.startedAt === 'string' ? report.startedAt : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The startup failure in `{taskDir}/worker-status.json`, for a request that found no remote to
+ * clone. A failure is current when the worker that recorded it is the one the snapshot
+ * describes: a worker that starts again writes its own `startedAt` and carries the previous
+ * failure forward, so a retry in progress (a first clone can take minutes) is not reported as a
+ * dead worker. Compared by identity, not by clock, since the two workers can run on different
+ * hosts. Tolerant like every reader: a missing or unreadable file yields none.
+ */
+export async function readWorkerStartupFailure(taskDir) {
+    let report;
+    try {
+        report = JSON.parse(await fs.readFile(path.join(taskDir, WORKER_STATUS_FILE), 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+    const fatal = report.lastFatalError;
+    if (fatal?.phase !== 'startup' || typeof fatal.message !== 'string')
+        return undefined;
+    let current;
+    if (fatal.workerStartedAt !== undefined) {
+        current = fatal.workerStartedAt === report.startedAt;
+    }
+    else {
+        // A file from a worker that does not link the two: compare clocks instead.
+        const startedAt = report.startedAt ? Date.parse(report.startedAt) : NaN;
+        current = Number.isNaN(startedAt) || !(Date.parse(fatal.at) < startedAt);
+    }
+    return { message: fatal.message, at: fatal.at, current };
+}
 /**
  * Write the worker's status report to `{taskDir}/worker-status.json`.
  *
@@ -34,22 +117,6 @@ export const WORKER_STATUS_FILE = 'worker-status.json';
  * `processTaskQueue`, `start()`); any that don't fall back on scheduleLoop's
  * per-cycle catch, which logs and continues.
  */
-/**
- * The `lastFatalError` in the current status file, or undefined when the file is
- * missing, unreadable or has none. Tolerant for the same reason readers are.
- * Its one caller carries the value into a full snapshot right after taking the
- * worker lock; a write racing in between only keeps or drops one crash alert
- * until the next write.
- */
-export async function readLastFatalError(taskDir) {
-    try {
-        const content = await fs.readFile(path.join(taskDir, WORKER_STATUS_FILE), 'utf-8');
-        return JSON.parse(content).lastFatalError;
-    }
-    catch {
-        return undefined;
-    }
-}
 export async function writeWorkerStatus(taskDir, report) {
     const filePath = path.join(taskDir, WORKER_STATUS_FILE);
     const stamped = { ...report, updatedAt: new Date().toISOString() };

package/dist/types.d.ts

@@ -33,11 +33,23 @@ export interface BranchMetadata {
     baseBranch?: string;
     pullRequestUrl?: string;
     pullRequestNumber?: number;
+    /**
+     * ISO timestamp of the branch's latest submit. A queued PR task carries it, so the worker's
+     * failure handling acts only on the submit that queued it.
+     */
+    submittedAt?: string;
+    /**
+     * ISO timestamp of the CMS's latest push of this branch to GitHub: a worker push GitHub
+     * accepted, or a direct-path submit. Branch delete takes it as
+     * proof that a same-named GitHub branch is this branch's, since a submit whose PR GitHub refused
+     * leaves no PR number. Absent on branches the CMS never pushed there.
+     */
+    pushedToGitHubAt?: string;
     /** Sync status for async GitHub operations (used when Lambda has no internet) */
     syncStatus?: SyncStatus;
-    /** Whether this branch has unresolved merge conflicts with the base branch */
+    /** Whether any rebase of this branch kept its version of an entry base also changed */
     conflictStatus?: ConflictStatus;
-    /** ContentIds of entries where --theirs was applied during rebase; cleared on clean rebase */
+    /** ContentIds of the entries where a rebase kept the branch's version; cleared when it merges */
     conflictFiles?: ContentId[];
     /**
      * Lifecycle state of the branch's PR as last observed by the worker's merge-poll
@@ -78,14 +90,21 @@ export interface BranchMetadata {
      */
     historyRewrittenFrom?: string;
     /**
-     * Short, sanitized reason the worker's last GitHub sync task failed permanently,
-     * set alongside `syncStatus: 'sync-failed'` by
-     * CmsWorker.updateBranchMetadataOnFailure -- e.g. a non-fast-forward push
-     * rejection naming the branch. Absent until a task has failed permanently, and
-     * reset to undefined by the next successful sync task, so a stale reason never
-     * survives a later successful push.
+     * Short, sanitized reason the last GitHub sync failed, set alongside
+     * `syncStatus: 'sync-failed'` by the worker's updateBranchMetadataOnFailure or a
+     * direct-path submit -- e.g. a non-fast-forward push rejection naming the branch.
+     * Shown on the branch's row in the editor. Reset to undefined by the next submit
+     * and the next successful sync task, so a stale reason never outlives it.
      */
     syncFailureReason?: string;
+    /**
+     * Every user whose successful change to the branch's working tree is recorded, in first-save
+     * order (recordBranchEditor in branch-metadata.ts). Never reset, because each submit rebuilds
+     * the whole PR body and credits them all. User ids only: names are looked up at submit.
+     */
+    editors?: CanopyUserId[];
+    /** The `editors` who saved since the last submit commit; the next one's trailers name them. */
+    uncommittedEditors?: CanopyUserId[];
 }
 export interface BranchPaths {
     /** Root where all branches live (e.g., /mnt/efs/site, ~/.canopycms/branches) */
@@ -127,6 +146,29 @@ export interface BuildIdentity {
     /** Adopter source revision the deployed image was built from (CANOPY_SOURCE_SHA); absent when unset. */
     sourceRevision?: string;
 }
+/**
+ * The worker holding the base branch at its current tip because the incoming tip references
+ * entry schemas the serving editor does not define (worker/schema-gate.ts).
+ */
+export interface BaseSchemaHold {
+    /** The earliest of `firstSeen`. */
+    since: string;
+    /** When each missing schema was first seen missing; the earliest bounds the hold. */
+    firstSeen: Record<string, string>;
+    /** GitHub's base tip the worker is not advancing to. */
+    incomingSha: string;
+    /** Schema names the incoming tip references and the serving editor's registry lacks. */
+    missingSchemas: string[];
+    /** `.collection.json` files referencing them, repo-relative, at most 10. */
+    files: string[];
+    /** How many files reference them, `files` being the first 10. */
+    fileCount: number;
+    /** The build that recorded the registry the gate checked against. */
+    editorBuild: BuildIdentity;
+    editorRecordedAt: string;
+    /** Set on the cycle the hold outlived its bound and the worker advanced anyway. */
+    expired?: true;
+}
 /**
  * Wire shape of the worker's self-reported status file (worker-status.json, under
  * the task queue dir), written by the CmsWorker daemon. Read-only here: GET
@@ -164,7 +206,8 @@ export interface WorkerStatusReport {
         baseRefresh?: BaseRefreshReport;
         /**
          * Outcome of reconciling remote.git's `refs/heads/*` against GitHub's fetched
-         * tips, non-destructively (worker/git-sync.ts's `reconcileTrackedBranches`).
+         * tips, never moving a head the worker finds editor work in (worker/git-sync.ts's
+         * `reconcileTrackedBranches`, worker/stale-mirror.ts).
          * Optional: a status file written by a worker without that reconcile has no
          * such key, and readers must tolerate its absence rather than assume every
          * status file has it.
@@ -180,11 +223,49 @@ export interface WorkerStatusReport {
              * queued -- expected and self-resolving, unlike `diverged`.
              */
             rewritten?: string[];
+            /**
+             * Optional for the same reason. Heads that diverged while holding no editor
+             * work, moved to GitHub's tip, and heads of branches GitHub no longer has,
+             * deleted (worker/stale-mirror.ts).
+             */
+            repointed?: string[];
+            pruned?: string[];
         };
     };
     lastFatalError?: {
         message: string;
         at: string;
         phase: 'startup' | 'run';
+        /**
+         * `startedAt` of the worker that recorded it. Equal to the snapshot's own `startedAt` until a
+         * newer worker carries the failure forward. Optional: older workers do not write it.
+         */
+        workerStartedAt?: string;
     };
+    /**
+     * Present while the schema gate holds the base branch, and on the cycle a hold expires. Carried
+     * into a restarted worker's first snapshot, so the bound survives restarts.
+     */
+    baseHold?: BaseSchemaHold;
+    /**
+     * How the last worker that ran stopped, carried into each new worker's snapshot
+     * (task-queue/worker-status.ts's `readCarriedOverStatus`). A worker that fails at startup
+     * leaves it alone and records the failure as `lastFatalError`.
+     */
+    lastShutdown?: WorkerShutdownRecord;
+}
+export interface WorkerShutdownRecord {
+    /** Why the worker stopped, as its entrypoint described it (e.g. 'SIGTERM'). */
+    reason: string;
+    at: string;
+    /** The stopped worker's `startedAt`, which ties the record to that worker. */
+    workerStartedAt: string;
+    /**
+     * `deadline`: in-flight work was still running at the drain deadline, and
+     * `abandoned` names it. `not-drained`: the worker stopped without recording
+     * a shutdown (a crash or a forced kill); `at` is its last status write.
+     */
+    outcome: 'drained' | 'deadline' | 'not-drained';
+    drainMs?: number;
+    abandoned?: string[];
 }

package/dist/url-collision.js

@@ -18,7 +18,7 @@ import { parseTypedFilename } from './utils/typed-filename.js';
  * `doc.index.{id}.json` inside an md-only collection claims no URL yet still blocks a sibling
  * write. Closing it means threading each collection's configured formats into a deliberately
  * schema-free module; tracked in
- * .claude/future-tasks/url-collision-guard-superset-of-listing.md.
+ * safeinsights/canopycms#878.
  *
  * A literal rather than derived: deriving it needs the `ContentFormat` union this module has no
  * reason to import. `url-collision.test.ts` carries the drift tripwire — a compile-time
@@ -65,7 +65,7 @@ async function findChildCollectionDir(dir, name) {
  *
  * The claimant set is nonetheless a strict superset of the listing's in three ways, all
  * over-blocking and all needing the same fix — the schema this module deliberately does not have
- * — so they are one task (.claude/future-tasks/url-collision-guard-superset-of-listing.md):
+ * — so they are one task (safeinsights/canopycms#878):
  *
  *   1. extension — see `CONTENT_EXTENSIONS` above;
  *   2. entry TYPE — parsing is structural (no `entryTypes` list), so a file whose type is not in
@@ -155,7 +155,7 @@ export async function findUrlPathClaimant(opts) {
     // KNOWN DEPENDENCY: this resolves ONE child collection by name, and the index direction above
     // likewise looks only for a parent ENTRY. Neither considers a second collection sharing the same
     // name, because nothing stops one being created -- `createCollectionInner` does not check
-    // sibling names (tracked in collection-sibling-name-uniqueness.md). With two `guides.{id}`
+    // sibling names (tracked in safeinsights/canopycms#624). With two `guides.{id}`
     // directories side by side, an index entry can be written into each: both writes pass this
     // guard, two entries claim one URL, and only the build guard catches it. Fixing sibling-name
     // uniqueness closes this without changing anything here, so that task is a prerequisite for

package/dist/url-exclusivity-fixtures.d.ts

@@ -15,7 +15,7 @@
  * Scope of the invariant it checks: entries written in the `{type}.{slug}.{id}.{ext}` grammar
  * with a type their collection declares -- exactly the set `listEntries` can see. A legacy
  * untyped file (`overview.json`) is invisible to enumeration and is deliberately NOT probed here;
- * see `.claude/future-tasks/legacy-untyped-files-url-addressable.md`.
+ * see safeinsights/canopycms#728.
  */
 import { type RootCollectionConfig } from './config/index.js';
 import type { ListEntriesItem } from './content-listing.js';
@@ -54,6 +54,13 @@ export interface UrlExclusivityReport {
         expectedEntryId?: string;
         actualEntryId?: string;
     }>;
+    /** Published URLs whose read reports a `meta.slug` or `meta.urlPath` other than the listing's. */
+    misreported: Array<{
+        urlPath: string;
+        slug: string;
+        readSlug: string;
+        readUrlPath: string;
+    }>;
     /** Every adjacent URL probed, sorted. */
     probes: string[];
     /** Probes that resolved despite not being published -- the phantom URLs. Must be empty. */

package/dist/url-exclusivity-fixtures.js

@@ -15,7 +15,7 @@
  * Scope of the invariant it checks: entries written in the `{type}.{slug}.{id}.{ext}` grammar
  * with a type their collection declares -- exactly the set `listEntries` can see. A legacy
  * untyped file (`overview.json`) is invisible to enumeration and is deliberately NOT probed here;
- * see `.claude/future-tasks/legacy-untyped-files-url-addressable.md`.
+ * see safeinsights/canopycms#728.
  */
 import { flattenSchema } from './config/index.js';
 import { findDuplicateUrlPaths } from './static/index.js';
@@ -80,12 +80,21 @@ export const collectUrlExclusivityReport = async (ctx, schema, contentRoot = 'co
     const items = await ctx.listEntries();
     const unresolved = [];
     const mismatched = [];
+    const misreported = [];
     for (const item of items) {
         const result = await ctx.readByUrlPath(item.urlPath);
         if (!result) {
             unresolved.push(item.urlPath);
             continue;
         }
+        if (result.meta.slug !== item.slug || result.meta.urlPath !== item.urlPath) {
+            misreported.push({
+                urlPath: item.urlPath,
+                slug: item.slug,
+                readSlug: result.meta.slug,
+                readUrlPath: result.meta.urlPath,
+            });
+        }
         if (result.meta.entryId !== item.entryId) {
             mismatched.push({
                 urlPath: item.urlPath,
@@ -108,6 +117,7 @@ export const collectUrlExclusivityReport = async (ctx, schema, contentRoot = 'co
         duplicates: findDuplicateUrlPaths(items),
         unresolved: unresolved.sort(),
         mismatched,
+        misreported,
         probes: [...probes].sort(),
         phantoms: phantoms.sort(),
     };

package/dist/user.js

@@ -1,5 +1,6 @@
 // Import from client-safe subpaths to avoid pulling in server-only loader code
 import { RESERVED_GROUPS, stripReservedGroups } from './authorization/helpers.js';
+import { personName } from './auth/person-name.js';
 /** Pass this constant explicitly wherever anonymous access is intended. */
 export const ANONYMOUS_USER = Object.freeze({
     type: 'anonymous',
@@ -37,7 +38,7 @@ export function authResultToCanopyUser(authResult, bootstrapAdminIds, internalGr
         type: 'authenticated',
         userId: authResult.user.userId,
         email: authResult.user.email,
-        name: authResult.user.name,
+        name: personName(authResult.user.userId, authResult.user.name),
         avatarUrl: authResult.user.avatarUrl,
         groups,
     };

package/dist/utils/atomic-write.js

@@ -8,8 +8,9 @@ export async function atomicWriteFile(filePath, content) {
     const dir = path.dirname(filePath);
     await fs.mkdir(dir, { recursive: true });
     const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-    await fs.writeFile(tempPath, content, typeof content === 'string' ? 'utf-8' : undefined);
+    // A temp file a failed write leaves behind would sit in the working tree for a commit to pick up.
     try {
+        await fs.writeFile(tempPath, content, typeof content === 'string' ? 'utf-8' : undefined);
         await fs.rename(tempPath, filePath);
     }
     catch (err) {

package/dist/utils/base-branch.d.ts

@@ -0,0 +1,13 @@
+import type { CanopyConfig } from '../config/index.js';
+/** The base branch is unknown, and prod never assumes one. */
+export declare class BaseBranchUnresolvedError extends Error {
+    constructor(detail: string);
+}
+/**
+ * `config`'s resolved base branch. Prod resolves an unset one from the remote's HEAD
+ * (createCanopyServices, then resolvePendingBaseBranch per request), so an unset value in prod
+ * means that has not happened yet, or the path skipped it, and it throws rather than guessing
+ * 'main'. In the other modes a config that never went through
+ * services keeps the 'main' default; services itself resolves dev's from git HEAD.
+ */
+export declare function baseBranchOf(config: Pick<CanopyConfig, 'mode' | 'defaultBaseBranch'>): string;