canopycms 0.1.0-int.115 → 0.1.0

package/CHANGELOG.md

@@ -5,38 +5,11 @@ packages release together, at one version.
 
 ## This build
 
-Version `0.1.0-int.115`, built from [`f8b50b3`](https://github.com/safeinsights/canopycms/tree/f8b50b30170954bf52fb670afe6796d2cb8fa275).
-
-### New since int.114
-
-- [AI content can withhold or redirect a link to an entry with no page](#ai-content-can-withhold-or-redirect-a-link-to-an-entry-with-no-page)
-- [toPlainText takes an entry body and keeps prose after a leading --- — behaviour change](#toplaintext-takes-an-entry-body-and-keeps-prose-after-a-leading------behaviour-change)
-- [People without a name show "Name unavailable"](#people-without-a-name-show-name-unavailable)
-- [Branch access lists stay with admins and reviewers — behaviour change](#branch-access-lists-stay-with-admins-and-reviewers--behaviour-change)
-- [A branch lockdown outranks the branch's access list — security fix](#a-branch-lockdown-outranks-the-branchs-access-list--security-fix)
-- [The base-branch conflict notice stays until the branch merges — behaviour change](#the-base-branch-conflict-notice-stays-until-the-branch-merges--behaviour-change)
-- [The editor calls the content drawer "All content"](#the-editor-calls-the-content-drawer-all-content)
-- [The Branches drawer shows one action per branch, and comments reply in place](#the-branches-drawer-shows-one-action-per-branch-and-comments-reply-in-place)
-- [An object's Clear offers Undo, and refusals say why](#an-objects-clear-offers-undo-and-refusals-say-why)
-- [The collection dialog says what saves at once](#the-collection-dialog-says-what-saves-at-once)
-- [Comments and branches name their people for every editor — behaviour change on two APIs](#comments-and-branches-name-their-people-for-every-editor--behaviour-change-on-two-apis)
-- [A date picker, a form header, and a toolbar that wraps](#a-date-picker-a-form-header-and-a-toolbar-that-wraps)
-- [Editor colours reach 4.5:1 in light and dark mode](#editor-colours-reach-451-in-light-and-dark-mode)
-- [Editor contrast, and blocked buttons stay focusable](#editor-contrast-and-blocked-buttons-stay-focusable)
-- [Editor focus rings and checked controls reach 3:1 for any brand](#editor-focus-rings-and-checked-controls-reach-31-for-any-brand)
-- [Editor requests time out instead of hanging](#editor-requests-time-out-instead-of-hanging)
-- [Field editing: descriptions, list-card titles, and public/ images, continued](#field-editing-descriptions-list-card-titles-and-public-images-continued)
-- [List items and blocks collapse, and reorder from one menu](#list-items-and-blocks-collapse-and-reorder-from-one-menu)
-- ["Add entry" follows path permissions; admin panels and labels tidied](#add-entry-follows-path-permissions-admin-panels-and-labels-tidied)
-- [Quick open, a navigator filter, title-first new entries, and media search](#quick-open-a-navigator-filter-title-first-new-entries-and-media-search)
-- [A save never brings back a deleted or moved entry — behaviour change](#a-save-never-brings-back-a-deleted-or-moved-entry--behaviour-change)
-- [Submit names unsaved entries; unanswered writes recover more](#submit-names-unsaved-entries-unanswered-writes-recover-more)
-- [Unlabelled fields and block templates show their names as words](#unlabelled-fields-and-block-templates-show-their-names-as-words)
-- [Stable releases follow the changes they carry, and ship their changelog](#stable-releases-follow-the-changes-they-carry-and-ship-their-changelog)
-- [List items and blocks carry a \_key, and field comments follow it — behaviour change](#list-items-and-blocks-carry-a-_key-and-field-comments-follow-it--behaviour-change)
-- [stampOnPublish dates a new entry at its first submit](#stamponpublish-dates-a-new-entry-at-its-first-submit)
-
-If you upgraded from a build on another branch, compare the `<!-- changeset: … -->` slugs in your previous build's `CHANGELOG.md` (`npm pack canopycms@<old>` fetches it) with this one's: entries whose slug your old file lacks are new to you. Legacy entries above the changeset entries carry hand-written int labels.
+Version `0.1.0`, built from [`39a755c`](https://github.com/safeinsights/canopycms/tree/39a755c116a52b6d16e0b09e9dde03c67a081754).
+
+Its entries are [0.1.0](#010), under **Released**.
+
+If you upgraded from a build on another branch, compare the `<!-- changeset: … -->` slugs in your previous build's `CHANGELOG.md` (`npm pack canopycms@<old>` fetches it) with this one's: entries whose slug your old file lacks are new to you.
 
 ## How to use this document
 
@@ -51,7 +24,7 @@ Each entry has up to three parts:
 `node_modules/canopycms/CHANGELOG.md`, assembled for that build: its **This build** section lists
 what is new since the previous int on the same branch, or on a stable release links its entries, and its links point at the commit the build
 came from. The copy in the repository holds released history and the entries from before changesets;
-every entry written since is a file in [`.changeset/`](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/.changeset/README.md) until a stable release
+every entry written since is a file in [`.changeset/`](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/.changeset/README.md) until a stable release
 moves it here.
 
 **Find your starting point.** From a stable pin, start at the first version under **Released**
@@ -80,89 +53,16 @@ Nothing in this section is edited by hand: each entry is a `.changeset/` file, w
 assembles here and labels with the first int that carries it, and a stable release moves the
 entries under **Released**.
 
-<!-- legacy:start -->
-
-The entries below predate changesets and keep their hand-written labels.
-
-| int | Area     | Change                                                                                                                                                                                      | Action                       |
-| --- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
-| 93  | Branches | [Path rules match logical paths](#path-permission-rules-now-take-effect-below-the-content-root--security-fix-breaking-for-rules-written-with-on-disk-names)                                 | Review rules                 |
-| 93  | Branches | [`.canopy-meta/` must not be committed](#canopy-meta-must-not-be-committed-and-system-health-says-so)                                                                                       | If tracked                   |
-| 93  | Branches | [`autoCreateSettingsPR` removed](#settings-saves-only-push-the-settings-branch--breaking-config-autocreatesettingspr-is-removed)                                                            | Required                     |
-| 93  | Reading  | [Listings take `branch`; reads report `slug`/`urlPath`](#content-reads-listings-take-a-branch-and-reads-report-slug-and-urlpath) (102)                                                      | Index pages                  |
-| 93  | Editing  | [Field descriptions, list-card titles, `public/` images](#field-editing-descriptions-list-card-titles-and-public-images) (96, 103)                                                          | None                         |
-| 93  | Branches | [Commits name editors; submit refuses an empty branch](#commits-name-their-editors-and-submit-refuses-a-branch-with-nothing-to-submit) (108, 110)                                           | Scripts                      |
-| 94  | Branches | [Reads never create a branch](#reads-never-create-a-requested-branch--security-fix-breaking-for-some-direct-createcontentreader-callers)                                                    | Direct callers               |
-| 94  | Preview  | [Preview URLs: one prefix, `trailingSlash`, own page](#preview-urls-take-one-prefix-follow-trailingslash-and-load-each-entrys-own-page--breaking-env) (98)                                  | Required                     |
-| 94  | Preview  | [`createPreviewPage`, `/preview` entries](#the-preview-route-and-preview-entries--breaking-imports) (95, 101, 103)                                                                          | Required                     |
-| 94  | Refs     | [Restricted and missing references](#a-reference-resolves-to-its-target-a-restricted-stub-or-a-missing-stub--security-fix-breaking-types-and-build) (106)                                   | Required                     |
-| 94  | CDK      | [`attachTo`, editor response headers](#canopycms-cdk-canopycmsserviceattachto-and-editor-response-headers--behaviour-change-if-you-frame-the-cms)                                           | If hand-wired or framed      |
-| 94  | Ops      | [System health shows the build](#system-health-shows-which-build-is-running)                                                                                                                | Optional                     |
-| 100 | Branches | [Crash-safe branch creation](#fast-crash-safe-branch-creation--behaviour-change-branch-clones-hold-only-the-content-root)                                                                   | Upgrade together             |
-| 100 | Ops      | [Prod workspace defaults to `/mnt/efs`](#the-prod-workspace-defaults-to-mntefs--behaviour-change-if-you-run-prod-without-canopycms_workspace_root)                                          | Non-CDK prod                 |
-| 100 | Assets   | [`AssetSupport` serves from S3 only](#canopycms-cdk-assetsupport-serves-images-from-s3-only--breaking)                                                                                      | Required                     |
-| 100 | Assets   | [`collect-asset-refs`, `materialize-assets`](#collect-asset-refs-and-materialize-assets-store-a-builds-images-before-release) (104)                                                         | With S3-only                 |
-| 100 | Assets   | [Editor images via signed-in route](#the-editor-and-its-live-preview-load-images-through-the-signed-in-asset-route)                                                                         | CSP, origin                  |
-| 100 | Assets   | [`assetUrl` applies crop](#asseturl-applies-an-image-values-crop--behaviour-change-for-cropped-images)                                                                                      | Scale `<img>`                |
-| 100 | Assets   | [`media.publicBaseUrl` removed; wider limits](#mediapublicbaseurl-is-removed-and-image-limits-are-wider--breaking-config)                                                                   | Delete key                   |
-| 101 | Editing  | [Saves rewrite only what changed](#a-save-rewrites-only-what-changed) (103)                                                                                                                 | None                         |
-| 102 | Auth     | [`unauthenticatedStatus: 419`](#unauthenticatedstatus-answer-signed-out-api-calls-with-419)                                                                                                 | Basic-auth sites             |
-| 105 | Editing  | [MDXEditor 4.3](#the-markdown-editor-runs-mdxeditor-43)                                                                                                                                     | Direct deps                  |
-| 106 | Refs     | [AI content links references](#ai-content-links-a-reference-to-its-target--behaviour-change-for-ai-output-and-ai-config-callbacks)                                                          | AI config                    |
-| 106 | Refs     | [Deleting a referenced entry asks](#deleting-a-referenced-entry-asks-first--behaviour-change-on-the-delete-api)                                                                             | Scripts                      |
-| 107 | Schema   | [Unknown schemas cost one entry type](#a-schema-the-running-code-lacks-costs-one-entry-type-and-holds-the-worker--behaviour-change)                                                         | Rare                         |
-| 108 | MDX      | [MDX that runs code is refused](#mdx-content-that-runs-code-is-refused-at-save--breaking-behaviour) (109, 110)                                                                              | Required                     |
-| 108 | Worker   | [On-demand worker, drain; `spotMaxPrice` removed](#canopycms-cdk-the-worker-drains-before-replacement-and-runs-on-demand--breaking-props-spotmaxprice-is-removed-behaviour-and-cost-change) | If set                       |
-| 109 | Worker   | [Hardened worker instance](#canopycms-cdk-the-worker-instance-is-hardened--an-existing-stack-upgrades-in-two-deploys-behaviour-and-cost-change)                                             | Two deploys                  |
-| 109 | Worker   | [Failed or stopped worker says why](#a-failed-or-stopped-worker-says-why--behaviour-change-on-the-not-ready-503-new-worker-apis)                                                            | Custom entrypoint            |
-| 109 | Worker   | [CI worker roll; worker-down alarm](#canopycms-cdk-ci-can-roll-the-worker-with-a-parameter-and-alarm-when-it-stops-syncing--new-opt-in)                                                     | Optional                     |
-| 109 | Preview  | [Typed `fieldProps`](#preview-fieldprops-is-typed-with-server-safe-helpers--breaking-types-and-schemas)                                                                                     | Required                     |
-| 110 | Worker   | [Worker needs a state directory](#canopycms-cdk-the-worker-needs-a-state-directory--deploy-the-template-before-the-bundle)                                                                  | Template first               |
-| 110 | Ops      | [Prod detects an unset `defaultBaseBranch`](#prod-detects-an-unset-defaultbasebranch-instead-of-assuming-main--behaviour-change-startup-can-fail)                                           | Base ≠ repo default          |
-| 111 | CDK      | [Example workflow's triggers and checks](#the-aws-example-workflow-gains-the-templates-triggers-and-dependency-checks)                                                                      | If copied by hand            |
-| 111 | Ops      | [Duplicate-ID scan only on request](#get-adminbranch-health-scans-for-duplicate-content-ids-only-on-request--behaviour-change)                                                              | Admin-API scripts            |
-| 111 | Auth     | [CMS image builds a prod editor; mismatch blocks](#the-cms-image-builds-a-prod-editor-and-a-mode-mismatch-blocks-the-editor--behaviour-change-a-hand-built-image-can-fail-its-build)        | Hand-built images            |
-| 111 | Auth     | [Auth plugins look users up in batches](#auth-plugins-look-users-up-in-batches)                                                                                                             | Custom plugins               |
-| 112 | Worker   | [Bundle states the template it needs](#canopycms-cdk-a-worker-bundle-states-the-template-it-needs--template-first-for-the-gate-only)                                                        | Template first               |
-| 112 | Worker   | [Poisoned `remote.git` re-clones](#a-poisoned-remotegit-re-clones-itself)                                                                                                                   | None                         |
-| 112 | Worker   | [Nano worker boots reliably](#canopycms-cdk-a-t4gnano-worker-boots-reliably--behaviour-change-a-deploy-replaces-the-worker)                                                                 | Deploy                       |
-| 112 | Worker   | [Worker never pushes base or default branch](#the-worker-never-pushes-the-base-or-default-branch--security-fix) (114)                                                                       | Protect base on GitHub       |
-| 112 | Worker   | [Worker log is root-owned](#canopycms-cdk-the-workers-log-is-root-owned--security-fix)                                                                                                      | Deploy; hand-installed units |
-| 113 | Worker   | [Push logs say whether GitHub moved](#the-workers-push-logs-say-whether-github-moved)                                                                                                       | None                         |
-| 113 | Editing  | [Unsaved ACL changes show; closing asks](#unsaved-group-and-permission-changes-show-and-closing-asks-first)                                                                                 | None                         |
-| 113 | Worker   | [Credential in a per-command git config](#the-worker-hands-git-its-github-credential-in-a-per-command-file--security-fix-dev-behaviour-change)                                              | Dev: proxy or CA in env      |
-| 114 | Worker   | [GitHub objects cross as bundles](#the-worker-moves-objects-between-github-and-remotegit-as-bundles)                                                                                        | None                         |
-| 114 | AI       | [`noindex` entries leave AI content](#ai-content-leaves-out-noindex-entries--behaviour-change-for-ai-output)                                                                                | `exclude.noindex: false`     |
-| 114 | Worker   | [Worker follows a rebased or deleted branch](#the-worker-follows-a-rebased-or-deleted-github-branch)                                                                                        | None                         |
-| 114 | Worker   | [Worker holds no secret (contract 2)](#canopycms-cdk-the-worker-holds-no-secret--security-fix-template-first-contract-2)                                                                    | Template first               |
-| 115 | AI | [referenceLink decides where AI-export entry links point](#ai-content-can-withhold-or-redirect-a-link-to-an-entry-with-no-page) | Optional |
-| 115 | AI | [toPlainText no longer strips front matter](#toplaintext-takes-an-entry-body-and-keeps-prose-after-a-leading------behaviour-change) | Whole-file callers split first |
-| 115 | Auth | [Clerk users without a name no longer show their id](#people-without-a-name-show-name-unavailable) | None |
-| 115 | Branches | [Non-privileged callers get only their own branch ACL entries](#branch-access-lists-stay-with-admins-and-reviewers--behaviour-change) | None |
-| 115 | Branches | [managerOrAdminAllowed now refuses editors an access list names](#a-branch-lockdown-outranks-the-branchs-access-list--security-fix) | Optional |
-| 115 | Branches | [Conflict notice persists until merge](#the-base-branch-conflict-notice-stays-until-the-branch-merges--behaviour-change) | None |
-| 115 | Editing | [Breadcrumb root and file menu say "All content"](#the-editor-calls-the-content-drawer-all-content) | Editor UI tests |
-| 115 | Editing | [Branches drawer and comment replies](#the-branches-drawer-shows-one-action-per-branch-and-comments-reply-in-place) | Editor UI tests |
-| 115 | Editing | [Clear offers Undo; refusals and conflicts explain themselves](#an-objects-clear-offers-undo-and-refusals-say-why) | None |
-| 115 | Editing | [Collection dialog says what saves at once](#the-collection-dialog-says-what-saves-at-once) | Editor UI tests |
-| 115 | Editing | [Comments and branches name their people](#comments-and-branches-name-their-people-for-every-editor--behaviour-change-on-two-apis) | Direct API callers |
-| 115 | Editing | [Date picker, form header, wrapping toolbar](#a-date-picker-a-form-header-and-a-toolbar-that-wraps) | Editor UI tests |
-| 115 | Editing | [Editor colours reach contrast in both schemes](#editor-colours-reach-451-in-light-and-dark-mode) | Visual snapshot tests |
-| 115 | Editing | [Editor contrast; blocked buttons stay focusable](#editor-contrast-and-blocked-buttons-stay-focusable) | Browser tests |
-| 115 | Editing | [Focus ring, control borders, light badges, sentence-case badges](#editor-focus-rings-and-checked-controls-reach-31-for-any-brand) | Visual snapshot tests |
-| 115 | Editing | [Editor requests time out](#editor-requests-time-out-instead-of-hanging) | Slow-API browser tests |
-| 115 | Editing | [Field descriptions, list-card titles, `public/` images, continued](#field-editing-descriptions-list-card-titles-and-public-images-continued) | None |
-| 115 | Editing | [List items and blocks collapse](#list-items-and-blocks-collapse-and-reorder-from-one-menu) | Editor UI tests |
-| 115 | Editing | [Navigator hides "Add entry" where path permissions refuse it](#add-entry-follows-path-permissions-admin-panels-and-labels-tidied) | None |
-| 115 | Editing | [Quick open, navigator filter, title-first entries, media search](#quick-open-a-navigator-filter-title-first-new-entries-and-media-search) | Editor UI tests |
-| 115 | Editing | [Saving a deleted or moved entry is refused](#a-save-never-brings-back-a-deleted-or-moved-entry--behaviour-change) | None |
-| 115 | Editing | [Submit warns about unsaved entries; unanswered writes keep input](#submit-names-unsaved-entries-unanswered-writes-recover-more) | None |
-| 115 | Editing | [Unlabelled field names are humanised](#unlabelled-fields-and-block-templates-show-their-names-as-words) | Editor UI tests |
-| 115 | Ops | [Stable versions follow changesets; CHANGELOG.md ships](#stable-releases-follow-the-changes-they-carry-and-ship-their-changelog) | None |
-| 115 | Reading | [List items and blocks gain a persisted `_key`](#list-items-and-blocks-carry-a-_key-and-field-comments-follow-it--behaviour-change) | Rename fields named _key |
-| 115 | Schema | [Date new entries at their first submit](#stamponpublish-dates-a-new-entry-at-its-first-submit) | Optional |
-
-### Preview URLs take one prefix, follow `trailingSlash`, and load each entry's own page — **breaking (env)**
+---
+
+## Released
+
+### 0.1.0
+
+<!-- changeset: legacy-unreleased -->
+<!-- changeset: nice-boxes-battle -->
+
+#### Preview URLs take one prefix, follow `trailingSlash`, and load each entry's own page — **breaking (env)**
 
 **What changed.**
 
@@ -182,7 +82,7 @@ served at `/` without an `index` slug needs `'content/<slug>': '/'`, or re-model
 **Now deletable.** `previewBase` keys that only added a shared prefix or restate a root entry's own
 URL.
 
-### The preview route and `/preview` entries — **breaking (imports)**
+#### The preview route and `/preview` entries — **breaking (imports)**
 
 **What changed.**
 
@@ -208,7 +108,7 @@ URL.
 2. For a branch preview: wrap views with `withCanopyPreview` in a `'use client'` module, add
    `app/preview/[[...path]]/page.server.tsx`, set `editor.previewPrefix: '/preview'`, and serve that
    route with `frame-ancestors 'self'`, not `X-Frame-Options: DENY` (see
-   [Live Preview](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#live-preview)).
+   [Live Preview](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#live-preview)).
 3. A test reading view content from the route's server HTML must load the page in a browser.
    Server output rendered during a preview request carries the signed-in asset prefix; keep it out
    of cross-request caches (`unstable_cache`, module memos).
@@ -216,14 +116,14 @@ URL.
 **Now deletable.** A hand-built branch-preview route, and CSS layer or specificity workarounds that
 kept site styles ahead of Mantine's in the preview.
 
-### Preview `fieldProps` is typed, with server-safe helpers — **breaking (types and schemas)**
+#### Preview `fieldProps` is typed, with server-safe helpers — **breaking (types and schemas)**
 
 **What changed.** (int.109) `fieldProps` checks each path against the view's content type, and
 `canopycms` exports `FieldProps`, `FieldAttrs`, `fieldAttrs` and `scopeFieldProps`, callable from
 server components. A string path marks the form's spelling (`'a.0.b'` marks `a[0].b`), and an empty
 path marks nothing. The editor counts and logs marks naming no field. `createEntrySchemaRegistry`
 refuses a field name that is empty, all digits or contains `.`, `[` or `]`. See
-[Live Preview](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#live-preview).
+[Live Preview](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#live-preview).
 
 **To adopt.** Fix each path that stops compiling; the error lists valid ones. Rewrite computed paths
 as literal segments, or type that component's prop as plain `FieldProps`. Pass `fieldProps` as
@@ -233,7 +133,7 @@ as literal segments, or type that component's prop as plain `FieldProps`. Pass `
 `fieldProps` defaults; schema-walking tests for misspelled mark paths, once components are typed
 (the editor flags another block template's field).
 
-### A reference resolves to its target, a restricted stub, or a missing stub — **security fix; breaking (types and build)**
+#### A reference resolves to its target, a restricted stub, or a missing stub — **security fix; breaking (types and build)**
 
 **What changed.**
 
@@ -271,7 +171,7 @@ optional if it was required.
 content-integrity test checking reference fields against entry ids, and top-level-only reference
 fields kept for the preview's sake.
 
-### AI content links a reference to its target — **behaviour change for `/ai` output and AI config callbacks**
+#### AI content links a reference to its target — **behaviour change for `/ai` output and AI config callbacks**
 
 **What changed.** (int.106) A `reference` field renders as a link to its target, not the stored id:
 a byline reading `**Author:** 5NVkkrB1MJUv` now links the name `Alice` to that entry's page, then to
@@ -293,7 +193,7 @@ matching: search your AI config for each reference field's name.
 
 **Now deletable.** A `fieldTransforms` entry that looked up a reference id to print its title.
 
-### AI content leaves out `noindex` entries — **behaviour change for `/ai` output**
+#### AI content leaves out `noindex` entries — **behaviour change for `/ai` output**
 
 **What changed.** (int.114) AI content leaves out entries marked `noindex`, both from
 `generate-ai-content` and from the `/ai` route, using the same predicate as the sitemap and robots
@@ -305,11 +205,11 @@ or a failed render) renders as its plain text, with no URL; any other form of th
 fields are nested or renamed, pass the AI config's `seo` the same object you pass
 `createNextCanopyContext({ seo })`, so the sitemap and AI content read the flag from the same
 place. A field that links to a hidden section by plain URL needs a field transform; the README
-shows [the recipe](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#ai-content-configuration).
+shows [the recipe](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#ai-content-configuration).
 
 **Now deletable.** An `exclude.where` that re-read the `noindex` flag by hand.
 
-### Deleting a referenced entry asks first — **behaviour change on the delete API**
+#### Deleting a referenced entry asks first — **behaviour change on the delete API**
 
 **What changed.** (int.106) Deleting an entry that other entries reference (by field or `entry:`
 link) returns 409 with `data.referencedBy`: the referencing entries the user may read, and a
@@ -318,7 +218,7 @@ link) returns 409 with `data.referencedBy`: the referencing entries the user may
 
 **To adopt.** Only scripts calling the delete endpoint: pass the flag or handle the 409.
 
-### `mdx` content that runs code is refused at save — **breaking (behaviour)**
+#### `mdx` content that runs code is refused at save — **breaking (behaviour)**
 
 **What changed.** (int.108) An `mdx` field or body refuses `{…}` expressions other than comments and
 plain values, `import`/`export`, and tags, attributes and URL schemes outside a safe set; other
@@ -327,7 +227,7 @@ A `markdown` field with `renderAs: 'mdx'` is checked as MDX, and `mdxAllow` narr
 field or site-wide. New: field options `renderAs`, `mdxAllow`; config key `mdxAllow`; type
 `MdxAllowlist`. (int.110) A component prop allowance can be `'string'` (or
 `{ type: 'string', maxLength }`): a quoted value only, never bare or `{…}`. See
-[MDX content cannot run code](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#mdx-content-cannot-run-code).
+[MDX content cannot run code](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#mdx-content-cannot-run-code).
 
 **To adopt.** Set `renderAs: 'mdx'` on each `markdown` field your site compiles as MDX, and
 `mdxAllow` to what your renderer takes. Set `executable: true` only on a field whose editors you
@@ -339,7 +239,7 @@ build lists it.
 `javascript:` links in MDX or markdown rendered as MDX, and the path-prefix matching behind its
 entry-type gate. Keep a rule checking that the body compiles.
 
-### A save rewrites only what changed
+#### A save rewrites only what changed
 
 **What changed.**
 
@@ -359,7 +259,7 @@ entry-type gate. Keep a rule checking that the body compiles.
 **Now deletable.** A formatter pass or `.prettierignore` entry over CMS-written content that only
 undoes the editor's re-folding, restyling or date rewriting.
 
-### The markdown editor runs MDXEditor 4.3
+#### The markdown editor runs MDXEditor 4.3
 
 **What changed.** (int.105) `@mdxeditor/editor` is `^4.3.2` (Lexical 0.48), up from `^3.52.4`.
 Two-paragraph list items, multi-block quotes and code fences in any language edit in rich text.
@@ -367,7 +267,7 @@ Two-paragraph list items, multi-block quotes and code fences in any language edi
 **To adopt.** Nothing, unless your app depends on `@mdxeditor/editor` or `lexical` directly: align
 those versions so one copy loads.
 
-### Unsaved group and permission changes show, and closing asks first
+#### Unsaved group and permission changes show, and closing asks first
 
 **What changed.** (int.113) Manage Groups and Manage Permissions still save as one batch, but now
 mark unsaved changes, keep the save bar in view, and ask before closing or leaving drops them. The
@@ -375,7 +275,7 @@ group dialog's buttons read "Add" and "Apply", since neither saves.
 
 **To adopt.** Nothing.
 
-### Field editing: descriptions, list-card titles, and `public/` images
+#### Field editing: descriptions, list-card titles, and `public/` images
 
 **What changed.**
 
@@ -393,7 +293,7 @@ image, upload a raster copy to the media library. For card titles:
 
 **Now deletable.** Editor hints worked into a field's `label` because `description` never showed.
 
-### Content reads: listings take a `branch`, and reads report `slug` and `urlPath`
+#### Content reads: listings take a `branch`, and reads report `slug` and `urlPath`
 
 **What changed.**
 
@@ -406,7 +306,7 @@ branch.
 
 **Now deletable.** Code parsing a slug or URL back out of `path` or `entry.path`.
 
-### Path-permission rules now take effect below the content root — **security fix; breaking for rules written with on-disk names**
+#### Path-permission rules now take effect below the content root — **security fix; breaking for rules written with on-disk names**
 
 **What changed.** (int.93) Rules match an entry's logical path (`content/blog/my-post`). Enforcement
 checked the id-suffixed on-disk path, so collection and entry rules matched nothing; only a glob
@@ -419,7 +319,7 @@ extension in logical form (`content/blog/**`, `content/about`).
 
 **Now deletable.** A content-root grant working around inert collection grants.
 
-### Reads never create a requested branch — **security fix; breaking for some direct `createContentReader` callers**
+#### Reads never create a requested branch — **security fix; breaking for some direct `createContentReader` callers**
 
 **What changed.** (int.94) A branch other than the active one must exist and be readable by the
 user, or `read()`/`readByUrlPath()` treat it as not found; no workspace is created per `?branch=`
@@ -430,7 +330,7 @@ passes `allowCreateBranch: true`, never with a request's branch.
 
 **Now deletable.** Checks that allow-list `?branch=` before it reaches `read()`.
 
-### Fast, crash-safe branch creation — **behaviour change: branch clones hold only the content root**
+#### Fast, crash-safe branch creation — **behaviour change: branch clones hold only the content root**
 
 **What changed.** (int.100) A branch is built under a staging name and appears only when complete.
 The worker repairs branch directories an interrupted create or delete left wedged, and owns
@@ -444,7 +344,7 @@ changed `contentRoot` reaches existing clones within a worker cycle of the API r
 **Now deletable.** Manual EFS cleanup of provisioning locks or half-made branch directories, and
 `remote.git` gc scripts.
 
-### `.canopy-meta/` must not be committed, and System health says so
+#### `.canopy-meta/` must not be committed, and System health says so
 
 **What changed.** (int.93) The schema cache lives in each branch clone's `.git/canopycms/`. Sync,
 editor submits and `canopycms sync` ignore `.canopy-meta/`, and System health shows the base
@@ -458,13 +358,13 @@ repaired or re-created.
 **Now deletable.** Any local step that resets or reformats `.canopy-meta/` files before a commit or
 a format check.
 
-### Commits name their editors, and submit refuses a branch with nothing to submit
+#### Commits name their editors, and submit refuses a branch with nothing to submit
 
 **What changed.**
 
 - (int.93) Submit commits gain an `Edited-by: Name (id)` trailer; PR bodies gain a section that
   re-submits replace, keeping human text. Options: `gitEditedByTrailers`, `gitCoAuthoredByTrailers`
-  ([reference](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#definecanopyconfig-options)).
+  ([reference](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#definecanopyconfig-options)).
 - (int.110) Submit-commit trailers name every user who saved since the last submit commit, and
   the PR-body section every user who edited the branch, not only the submitter; settings commits
   (permissions, groups) carry the acting user's trailer.
@@ -473,7 +373,7 @@ a format check.
 
 **To adopt.** Scripts calling submit: save a change first, or handle the 400.
 
-### Settings saves only push the settings branch — **breaking (config): `autoCreateSettingsPR` is removed**
+#### Settings saves only push the settings branch — **breaking (config): `autoCreateSettingsPR` is removed**
 
 **What changed.** (int.93) The orphan settings branch can never get a PR, so groups and permissions
 saves only push the branch, and no failing PR task lands in System health.
@@ -482,20 +382,20 @@ saves only push the branch, and no failing PR task lands in System health.
 
 **Now deletable.** Filters that hid the failed settings-PR tasks.
 
-### A schema the running code lacks costs one entry type, and holds the worker — **behaviour change**
+#### A schema the running code lacks costs one entry type, and holds the worker — **behaviour change**
 
 **What changed.** (int.107) When synced content names an entry schema the running code lacks, only
 that entry type goes unavailable: the editor says so, and its entries answer 503 with
 `code: 'SCHEMA_UNAVAILABLE'`. Builds, static deploys and `generate-ai-content` still fail. The
 worker holds the base branch for up to 30 minutes while that lasts; see
-[New schemas wait for the editor deploy](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#new-schemas-wait-for-the-editor-deploy).
+[New schemas wait for the editor deploy](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#new-schemas-wait-for-the-editor-deploy).
 Public types gain optional `unavailable` on `EntryTypeConfig` and `FlatSchemaItem`, optional
 `ApiResponse.code`, and a required `SchemaResolutionResult.issues`.
 
 **To adopt.** Code that builds a `SchemaResolutionResult` adds `issues`. A custom worker entrypoint
 can pass `schemaHoldMaxMs` to `CmsWorker`.
 
-### `canopycms-cdk`: the worker drains before replacement and runs on-demand — **breaking (props): `spotMaxPrice` is removed; behaviour and cost change**
+#### `canopycms-cdk`: the worker drains before replacement and runs on-demand — **breaking (props): `spotMaxPrice` is removed; behaviour and cost change**
 
 **What changed.** (int.108) The worker is one on-demand `t4g.nano` by default (about $3 a month,
 against spot's $1–2); a spot shortage could leave no worker: on a first deploy the editor's API answers 503 "CMS worker not
@@ -512,7 +412,7 @@ drain applies from the deploy after this one.
 
 **Now deletable.** Any override stripping `InstanceMarketOptions` from the worker's launch template.
 
-### `canopycms-cdk`: the worker instance is hardened — **an existing stack upgrades in two deploys; behaviour and cost change**
+#### `canopycms-cdk`: the worker instance is hardened — **an existing stack upgrades in two deploys; behaviour and cost change**
 
 **Upgrade an existing stack in two deploys:**
 
@@ -526,7 +426,7 @@ hang until the drain heartbeat lets termination continue. Its in-flight task is
 new stack needs no steps.
 
 **What changed.** (int.109) Detailed in
-[The worker instance](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#the-worker-instance): IMDSv2 with a hop limit of 1; the
+[The worker instance](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#the-worker-instance): IMDSv2 with a hop limit of 1; the
 bundle is one file whose sha256 user data checks, readable as that one object; a file-system policy
 refusing clients without TLS or IAM, replacing the worker's
 `AmazonElasticFileSystemClientReadWriteAccess`; an encrypted gp3 root volume; a boot-time upgrade to
@@ -542,7 +442,7 @@ key, grant the Auto Scaling service-linked role on it. Pass `workerMaxInstanceLi
 **Now deletable.** Any override adding `MetadataOptions`, an encrypted root volume or an EFS
 `FileSystemPolicy`, or narrowing the worker role's asset-bucket grant.
 
-### `canopycms-cdk`: the worker needs a state directory — **deploy the template before the bundle**
+#### `canopycms-cdk`: the worker needs a state directory — **deploy the template before the bundle**
 
 **What changed.** (int.110) The worker's git keeps the GitHub credential in a private mirror
 under the unit's `StateDirectory=`, and the worker does not start without it.
@@ -552,14 +452,14 @@ new template before CI rolls an int.110 or later bundle; a parameter-only change
 the new unit, so the new bundle exits at start. A hand-installed unit needs
 `StateDirectory=canopy-worker` under `[Service]`.
 
-### A poisoned `remote.git` re-clones itself
+#### A poisoned `remote.git` re-clones itself
 
 **What changed.** (int.112) A `remote.git` missing its base branch is re-cloned unless an unpushed ref would be
 lost; the refusal names those refs. A tampered config still refuses and needs an operator.
 
 **To adopt.** Nothing.
 
-### A failed or stopped worker says why — **behaviour change on the not-ready 503; new worker APIs**
+#### A failed or stopped worker says why — **behaviour change on the not-ready 503; new worker APIs**
 
 **What changed.** (int.109) While the latest start's recorded failure stands, the prod not-ready 503
 is `WORKER_FAILED`: no `Retry-After`, the failure named to admins, account ids masked.
@@ -571,7 +471,7 @@ failure and exits non-zero on `selfStopped`, with a code outside `RestartPrevent
 
 **Now deletable.** A watchdog that restarts an idle worker process.
 
-### `canopycms-cdk`: CI can roll the worker with a parameter, and alarm when it stops syncing — **new, opt-in**
+#### `canopycms-cdk`: CI can roll the worker with a parameter, and alarm when it stops syncing — **new, opt-in**
 
 **What changed.** (int.109)
 
@@ -580,28 +480,28 @@ failure and exits non-zero on `selfStopped`, with a code outside `RestartPrevent
   with its hash, as `worker/dist/index.js` and `index.js.sha256`. The default, `'asset'`, is
   unchanged.
 - `CanopyCmsService` alarms when the worker logs no git sync for 30 minutes. See
-  [Worker-down alarm](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#worker-down-alarm).
+  [Worker-down alarm](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#worker-down-alarm).
 
 **To adopt.** Optional. For parameter-only change sets, see
-[Rolling the worker from CI](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#rolling-the-worker-from-ci). For the alarm, pass
+[Rolling the worker from CI](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#rolling-the-worker-from-ci). For the alarm, pass
 `alarmTopic`.
 
 **Now deletable.** A manual `cdk deploy` after each canopycms bump whose only purpose is moving the
 worker, and a hand-built alarm on the worker log group.
 
-### `canopycms-cdk`: a `t4g.nano` worker boots reliably — **behaviour change: a deploy replaces the worker**
+#### `canopycms-cdk`: a `t4g.nano` worker boots reliably — **behaviour change: a deploy replaces the worker**
 
 **What changed.** (int.112) The boot's `dnf upgrade` could be OOM-killed on every retry. A 1 GiB
 swap file now goes on first; an upgrade that still fails starts the worker unpatched and notifies
 `alarmTopic` if set; a retried step names itself when it gives up. See
-[The worker instance](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#the-worker-instance).
+[The worker instance](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#the-worker-instance).
 
 **To adopt.** Deploy, which replaces the worker instance. The bundle needs none of this, so it is
 not Template first and the worker contract stays at 1.
 
 **Now deletable.** An instance type above `t4g.nano` chosen only to get the boot through.
 
-### `canopycms-cdk`: the worker's log is root-owned — **security fix**
+#### `canopycms-cdk`: the worker's log is root-owned — **security fix**
 
 **What changed.** (int.112) `/var/log/canopy-worker` and `worker.log` are root-owned, and the unit
 drops `LogsDirectory=`. systemd opens the log as root, following symlinks, before the sandbox
@@ -619,7 +519,7 @@ contract is unchanged. A hand-installed unit needs the same change:
 
 **Now deletable.** Nothing.
 
-### The worker never pushes the base or default branch — **security fix**
+#### The worker never pushes the base or default branch — **security fix**
 
 **What changed.** (int.112) The worker refuses to push, plainly or replacing history, to the base
 branch or GitHub's default branch, whatever a task asks, and fails the task permanently.
@@ -635,14 +535,14 @@ its bypass list. Set `CANOPYCMS_BASE_BRANCH` (the construct's `baseBranch`) expl
 it, the gateway protects only GitHub's default branch and your list; the worker still refuses the
 base it detected, warning when that base is neither.
 
-### The worker's push logs say whether GitHub moved
+#### The worker's push logs say whether GitHub moved
 
 **What changed.** (int.113) `Pushed … to GitHub` is logged only when the branch moved, saying
 where from; an unmoved branch logs at debug level. An unchanged settings branch is not pushed.
 
 **To adopt.** Nothing.
 
-### The worker hands git its GitHub credential in a per-command file — **security fix; dev behaviour change**
+#### The worker hands git its GitHub credential in a per-command file — **security fix; dev behaviour change**
 
 **What changed.** (int.113) The token leaves git URLs: each GitHub fetch and push reads it from a
 `0600` file named by `GIT_CONFIG_GLOBAL`, deleted afterwards. For those commands the file replaces
@@ -652,7 +552,7 @@ stops applying and no keychain credential is tried.
 **To adopt.** Nothing in production. In dev, move a global-config proxy or CA to `HTTPS_PROXY` or
 `GIT_SSL_CAINFO`.
 
-### The worker moves objects between GitHub and `remote.git` as bundles
+#### The worker moves objects between GitHub and `remote.git` as bundles
 
 **What changed.** (int.114) The worker moves objects between GitHub and
 `remote.git` as git bundles. A new instance's first sync fetches the whole repository from GitHub,
@@ -660,9 +560,9 @@ and operations may reuse GitHub fetches under 30 seconds old.
 
 **To adopt.** Nothing. Seeding `remote.git` stages a copy of the repository beside the gateway's
 mirror, so the root volume needs room for two
-([details](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#the-worker-instance)).
+([details](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#the-worker-instance)).
 
-### The worker follows a rebased or deleted GitHub branch
+#### The worker follows a rebased or deleted GitHub branch
 
 **What changed.** (int.114) When a branch is rebased and force-pushed on GitHub, or deleted there, the
 worker now updates or deletes its own copy of it instead of warning about it on every sync. A rebased
@@ -671,7 +571,7 @@ health lists it with what to do.
 
 **To adopt.** Nothing.
 
-### `canopycms-cdk`: a worker bundle states the template it needs — **template first for the gate only**
+#### `canopycms-cdk`: a worker bundle states the template it needs — **template first for the gate only**
 
 **What changed.** (int.112) The worker unit carries a contract version
 (`Environment=CANOPYCMS_WORKER_CONTRACT=<n>`). Parameter mode outputs it as `WorkerContract`, and
@@ -682,13 +582,13 @@ changes the template too (the fallback bundle's key and hash), so only the contr
 bundle-only roll is safe.
 
 **To adopt.** Parameter mode: gate bundle-only rolls on the contract
-([recipe](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#rolling-the-worker-from-ci)). The gate refuses a stack without the
+([recipe](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#rolling-the-worker-from-ci)). The gate refuses a stack without the
 `WorkerContract` output, so `cdk deploy` the template once, which adds it. A hand-installed unit
 copies its `Environment=CANOPYCMS_WORKER_CONTRACT=` line from `worker/canopy-worker.service`.
 
 **Now deletable.** Deciding from the template diff whether a bundle-only roll is safe.
 
-### `canopycms-cdk`: the worker holds no secret — **security fix; template first (contract 2)**
+#### `canopycms-cdk`: the worker holds no secret — **security fix; template first (contract 2)**
 
 **What changed.** (int.114) The worker runs with no network and no secret. `canopy-github`, a gateway
 service under its own user with no view of EFS, holds the GitHub credential and the Clerk key, and
@@ -699,10 +599,10 @@ units from the bundle's contract: 2 gets the split, an older bundle the single u
 template, then roll the bundle; on an older template it stops with `template too old for this
 bundle`. Inspect EFS only through `sudo /opt/canopy-worker/canopy-inspect <command>`, never from a root shell. A hand install
 takes `worker/`'s three units and `gateway.env.example`
-([steps](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#installing-the-units-by-hand)). After the first deploy, run the
-[checklist](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#first-deploy-checklist).
+([steps](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#installing-the-units-by-hand)). After the first deploy, run the
+[checklist](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#first-deploy-checklist).
 
-### `canopycms-cdk`: `CanopyCmsService.attachTo`, and editor response headers — **behaviour change if you frame the CMS**
+#### `canopycms-cdk`: `CanopyCmsService.attachTo`, and editor response headers — **behaviour change if you frame the CMS**
 
 **What changed.** (int.94) `cmsService.attachTo(distribution, { viewerRequestFunction?, behaviorOverrides? })`
 adds the editor's behaviors (`/edit`, `/edit/*`, `/api/canopycms/*`) to a distribution you already
@@ -711,7 +611,7 @@ response headers policy. `CanopyCmsDistribution` sends the same headers: `frame-
 `X-Frame-Options: SAMEORIGIN`, `nosniff`, HSTS and `X-Robots-Tag: noindex`. Unless your app sends
 its own framing headers, no other origin can frame the editor or any page the CMS domain serves. Every such page is
 marked `noindex`. The editor's default preview is same-origin and unaffected. See
-[Serving the editor from a distribution you already own](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#serving-the-editor-from-a-distribution-you-already-own).
+[Serving the editor from a distribution you already own](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#serving-the-editor-from-a-distribution-you-already-own).
 
 **To adopt.** If you wired the Function URL into your own distribution by hand, delete those
 behaviors and call `attachTo`, passing your CMS build's `assetPrefix` as `editorAssetPrefix` and a
@@ -723,12 +623,12 @@ gate, and read the synth warning if your distribution has custom error responses
 `x-forwarded-host` function made for them, and any response-headers policy added only to stop
 framing.
 
-### `unauthenticatedStatus`: answer signed-out API calls with 419
+#### `unauthenticatedStatus`: answer signed-out API calls with 419
 
 **To adopt.** (int.102) Set `unauthenticatedStatus: 419` if your pages sit behind HTTP Basic auth on
 the editor's origin; the editor still detects sign-out. Otherwise nothing.
 
-### Auth plugins look users up in batches
+#### Auth plugins look users up in batches
 
 **What changed.** (int.111) `AuthPlugin` gains an optional `getUsersMetadata(userIds)`, and the
 editor batches its user-badge lookups.
@@ -736,7 +636,7 @@ editor batches its user-badge lookups.
 **To adopt.** Nothing. A custom auth plugin may implement it; otherwise the server falls back to
 bounded single lookups.
 
-### The CMS image builds a prod editor, and a mode mismatch blocks the editor — **behaviour change: a hand-built image can fail its build**
+#### The CMS image builds a prod editor, and a mode mismatch blocks the editor — **behaviour change: a hand-built image can fail its build**
 
 **What changed.** (int.111) `Dockerfile.cms` defaults `NEXT_PUBLIC_CANOPY_MODE` to `prod`, not
 `dev`, and fails its build on any value but `prod` or `dev`. An editor built for the other mode than its
@@ -745,7 +645,7 @@ server runs now gets a blocking screen naming that variable, not a sign-in that
 **To adopt.** A hand-built image running a dev-mode server passes
 `--build-arg NEXT_PUBLIC_CANOPY_MODE=dev`.
 
-### Prod detects an unset `defaultBaseBranch` instead of assuming `main` — **behaviour change: startup can fail**
+#### Prod detects an unset `defaultBaseBranch` instead of assuming `main` — **behaviour change: startup can fail**
 
 **What changed.** (int.110) Unset, prod reads the base branch from the HEAD of the workspace's `remote.git`,
 which the worker points at the branch it uses. Before the worker creates `remote.git`, requests
@@ -759,7 +659,7 @@ does not follow a later change of GitHub's default branch, so set it before a cu
 
 **Now deletable.** A `defaultBaseBranch: 'main'` in a repository whose default branch is `main`.
 
-### The prod workspace defaults to `/mnt/efs` — **behaviour change if you run prod without `CANOPYCMS_WORKSPACE_ROOT`**
+#### The prod workspace defaults to `/mnt/efs` — **behaviour change if you run prod without `CANOPYCMS_WORKSPACE_ROOT`**
 
 **What changed.** (int.100) With `CANOPYCMS_WORKSPACE_ROOT` unset, prod mode keeps its branches,
 settings, task queue and auth cache under `/mnt/efs` instead of `/mnt/efs/workspace`
@@ -770,7 +670,7 @@ the worker, so CDK deployments are unaffected.
 `/mnt/efs/workspace` to keep your existing workspace, or move that directory's contents up to
 `/mnt/efs`.
 
-### System health shows which build is running
+#### System health shows which build is running
 
 **What changed.** (int.94) System health gains a Build section (canopycms version, source revision,
 worker version, media-storage state) and warns when API and worker versions differ.
@@ -783,7 +683,7 @@ worker version, media-storage state) and warns when API and worker versions diff
 
 **Now deletable.** Hand-rolled version or commit stamping, or a build-info endpoint.
 
-### The AWS example workflow gains the template's triggers and dependency checks
+#### The AWS example workflow gains the template's triggers and dependency checks
 
 **What changed.** (int.111) Like the one `init-deploy aws` writes, `examples/aws-deployment/deploy-cms.yml`
 now deploys on `next.config.*`, `middleware.ts` and `public/**` changes, and checks `canopycms` and
@@ -791,7 +691,7 @@ now deploys on `next.config.*`, `middleware.ts` and `public/**` changes, and che
 
 **To adopt.** If you copied it by hand, add those `paths:` and packages.
 
-### `GET /admin/branch-health` scans for duplicate content IDs only on request — **behaviour change**
+#### `GET /admin/branch-health` scans for duplicate content IDs only on request — **behaviour change**
 
 **What changed.** (int.111) The duplicate-ID scan runs only with `?duplicates=1`, under a 20 s
 budget. Each healthy entry then carries `duplicateIdScan` (`none`, `found` or `unknown`), replacing
@@ -799,7 +699,7 @@ budget. Each healthy entry then carries `duplicateIdScan` (`none`, `found` or `u
 
 **To adopt.** Scripts reading `duplicateContentIds`: pass `duplicates=1`, read `duplicateIdScan`.
 
-### `canopycms-cdk`: `AssetSupport` serves images from S3 only — **breaking**
+#### `canopycms-cdk`: `AssetSupport` serves images from S3 only — **breaking**
 
 **What changed.** (int.100) `/assets/*` and `/assets/t/*` come from the bucket alone, with an
 optional `replicaBucket` for 5xx failover. An unmaterialized URL is a 403; no transform Lambda or
@@ -816,7 +716,7 @@ opt-in and those props, and pass `replicaBucket` if you replicate `assets/`.
 
 **Now deletable.** Your `assets/t/` expiry rule, before leaving lazy mode.
 
-### `collect-asset-refs` and `materialize-assets` store a build's images before release
+#### `collect-asset-refs` and `materialize-assets` store a build's images before release
 
 **What changed.** (int.100) `canopycms collect-asset-refs <outDir>` writes the image keys a static
 build references to `<outDir>/canopy-asset-refs.json`. `canopycms materialize-assets --refs <file>`
@@ -831,7 +731,7 @@ Run `materialize-assets` before the release is served, with the S3 grants the RE
 
 **Now deletable.** A pre-release warm-up step that requests image URLs to get them transformed.
 
-### The editor and its live preview load images through the signed-in asset route
+#### The editor and its live preview load images through the signed-in asset route
 
 **What changed.** (int.100) The editor loads asset-store images from
 `GET /api/canopycms/assets/raw/…` under your `basePath`, which transforms on demand and, on S3,
@@ -848,7 +748,7 @@ same-origin or set `lazyPublicTransforms: true`.
 
 **Now deletable.** Code passing `assetBaseUrl` into the editor.
 
-### `assetUrl` applies an image value's crop — **behaviour change for cropped images**
+#### `assetUrl` applies an image value's crop — **behaviour change for cropped images**
 
 **What changed.** (int.100) `assetUrl`/`assetSrcSet` apply an `image` value's `crop`; `opts.crop`
 overrides.
@@ -857,7 +757,7 @@ overrides.
 
 **Now deletable.** Copying `value.crop` into `opts.crop`.
 
-### `media.publicBaseUrl` is removed, and image limits are wider — **breaking (config)**
+#### `media.publicBaseUrl` is removed, and image limits are wider — **breaking (config)**
 
 **What changed.** (int.100) Nothing read `media.publicBaseUrl`, and the strict `media` schema fails a
 config that sets it. Uploads go up to 24 MP (6000×4000), up from 16.7 MP. Widths are any integer up
@@ -869,9 +769,7 @@ asset URLs.
 
 **Now deletable.** Anything that only fed `publicBaseUrl`, and rounding widths to a multiple of 160.
 
-<!-- legacy:end -->
-
-### AI content can withhold or redirect a link to an entry with no page
+#### AI content can withhold or redirect a link to an entry with no page
 
 <!-- changeset: ai-reference-link-hook -->
 
@@ -889,12 +787,12 @@ one the exclusions leave out. A throw or any other return is logged and treated
 **To adopt.** If your site's routes, sitemap or bylines decide that some entries have no page,
 apply the same rule here, for example `referenceLink: (target, { body }) =>
 !body?.trim() ? false : undefined` in `defineAIContentConfig` from `canopycms/ai`. See
-[AI Content Configuration](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#ai-content-configuration).
+[AI Content Configuration](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#ai-content-configuration).
 
 **Now deletable.** A `fieldTransforms` entry that re-renders a reference field only to drop or
 change its link.
 
-### `toPlainText` takes an entry body and keeps prose after a leading `---` — **behaviour change**
+#### `toPlainText` takes an entry body and keeps prose after a leading `---` — **behaviour change**
 
 <!-- changeset: to-plain-text-body-only -->
 
@@ -918,7 +816,7 @@ import { toPlainText } from 'canopycms/ai'
 const text = toPlainText(matter(file, {}).content)
 ```
 
-### People without a name show "Name unavailable"
+#### People without a name show "Name unavailable"
 
 <!-- changeset: people-without-a-name-show-name-unavailable -->
 
@@ -926,7 +824,7 @@ _First in int.115._
 
 **What changed.** The Clerk plugin no longer uses the Clerk user id as a user's name: a user with no full name or username has an empty name, and the editor shows "Name unavailable" wherever that person appears. Core and the editor also treat a blank name, or one equal to the user id, as no name: `/users/:userId`, `/users/batch` and the `users` lists on comments and branches return an empty `name` for that person. The users snapshot the worker writes follows the same rule.
 
-### Branch access lists stay with admins and reviewers — **behaviour change**
+#### Branch access lists stay with admins and reviewers — **behaviour change**
 
 <!-- changeset: branch-access-list-withheld-from-non-privileged -->
 
@@ -938,7 +836,7 @@ access updates) sends a caller who is not an admin or reviewer only the `access.
 `withheldAccess` field. A branch card's access list shows the people the viewer can name, then
 "and N others", instead of a row of "Name unavailable" avatars.
 
-### A branch lockdown outranks the branch's access list — **security fix**
+#### A branch lockdown outranks the branch's access list — **security fix**
 
 <!-- changeset: branch-lockdown-outranks-branch-acl -->
 
@@ -954,7 +852,7 @@ the editor's Submit and Withdraw controls follow the same rule.
 branch: those editors lose access. To give it back, set `managerOrAdminAllowed` to `false` in
 that branch's `branch.json`, and the access list decides again.
 
-### The base-branch conflict notice stays until the branch merges — **behaviour change**
+#### The base-branch conflict notice stays until the branch merges — **behaviour change**
 
 <!-- changeset: conflict-notice-persists-until-merge -->
 
@@ -964,10 +862,10 @@ _First in int.115._
 entry the base branch also changed, the "updated on the base branch" notice and the branch's
 conflict count now stay until the branch merges, so a reviewer still sees which entries replaced a
 base change. They used to clear on the next sync, about five minutes later. README's new [Drafts
-and Unpublishing](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#drafts-and-unpublishing) section covers long-lived branches and
+and Unpublishing](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#drafts-and-unpublishing) section covers long-lived branches and
 unpublishing.
 
-### The editor calls the content drawer "All content"
+#### The editor calls the content drawer "All content"
 
 <!-- changeset: all-content-label -->
 
@@ -977,7 +875,7 @@ _First in int.115._
 
 **To adopt.** Nothing, unless your browser tests find either by the text "All entries".
 
-### The Branches drawer shows one action per branch, and comments reply in place
+#### The Branches drawer shows one action per branch, and comments reply in place
 
 <!-- changeset: branches-drawer-and-comment-replies -->
 
@@ -991,7 +889,7 @@ form has a "Field comments" button, so tests that find buttons by `/comment/i` m
 one; and the editor listens for Ctrl+Alt+M (⌘⌥M on macOS) on the whole document, taking it while a
 form is open.
 
-### An object's Clear offers Undo, and refusals say why
+#### An object's Clear offers Undo, and refusals say why
 
 <!-- changeset: clear-undo-and-clearer-refusals -->
 
@@ -1006,7 +904,7 @@ conflict in yellow; the API marks it with the new error code `SETTINGS_CHANGED`.
 `sanitizeHref` returns its fallback for `undefined` or `null`, which a live preview's draft can
 pass for a link field it doesn't hold yet, instead of throwing.
 
-### The collection dialog says what saves at once
+#### The collection dialog says what saves at once
 
 <!-- changeset: collection-dialog-says-what-saves -->
 
@@ -1019,7 +917,7 @@ inline instead of as toasts.
 
 **To adopt.** Nothing, unless browser tests click the old buttons or wait for those toasts.
 
-### Comments and branches name their people for every editor — **behaviour change on two APIs**
+#### Comments and branches name their people for every editor — **behaviour change on two APIs**
 
 <!-- changeset: comments-and-branches-name-their-people -->
 
@@ -1032,7 +930,7 @@ Your auth plugin answers through the `/users/batch` cache; a failed lookup leave
 
 **To adopt.** Nothing, unless you call either API yourself: read `data.users`.
 
-### A date picker, a form header, and a toolbar that wraps
+#### A date picker, a form header, and a toolbar that wraps
 
 <!-- changeset: date-picker-form-header-wrapping-toolbar -->
 
@@ -1046,7 +944,7 @@ editor styles.
 
 **To adopt.** Nothing. Browser tests that typed into a `datetime-local` input pick a date instead.
 
-### Editor colours reach 4.5:1 in light and dark mode
+#### Editor colours reach 4.5:1 in light and dark mode
 
 <!-- changeset: editor-colours-reach-contrast-in-both-schemes -->
 
@@ -1068,7 +966,7 @@ defaults.
 **Now deletable.** Local overrides that darkened light buttons, badges, placeholders or input
 borders for contrast.
 
-### Editor contrast, and blocked buttons stay focusable
+#### Editor contrast, and blocked buttons stay focusable
 
 <!-- changeset: editor-contrast-and-focusable-blocked-buttons -->
 
@@ -1087,7 +985,7 @@ old "Reload File" or "Discard File Draft" use the new labels.
 
 **Now deletable.** Local overrides that darkened the same text or buttons.
 
-### Editor focus rings and checked controls reach 3:1 for any brand
+#### Editor focus rings and checked controls reach 3:1 for any brand
 
 <!-- changeset: editor-focus-ring-and-control-contrast -->
 
@@ -1106,7 +1004,7 @@ their tint instead of the primary colour, and Markdown popups have a border in d
 text, such as the System Health panel's "corrupt metadata", now "Corrupt metadata". A
 `themeOverride` that sets `primaryShade` moves where the ring starts.
 
-### Editor requests time out instead of hanging
+#### Editor requests time out instead of hanging
 
 <!-- changeset: editor-requests-time-out -->
 
@@ -1122,7 +1020,7 @@ write in flight says why.
 **To adopt.** Nothing, unless browser tests hold an API response for longer than a deadline to
 observe a busy state; keep such holds under it.
 
-### Field editing: descriptions, list-card titles, and public/ images, continued
+#### Field editing: descriptions, list-card titles, and public/ images, continued
 
 <!-- changeset: list-card-titles-and-block-descriptions -->
 
@@ -1135,7 +1033,7 @@ takes its title from its first non-blank `string` field, then "Item N" (or its `
 "Team member N"). A block template's `description` now renders; see
 [List items and blocks collapse](#list-items-and-blocks-collapse-and-reorder-from-one-menu).
 
-### List items and blocks collapse, and reorder from one menu
+#### List items and blocks collapse, and reorder from one menu
 
 <!-- changeset: list-items-and-blocks-collapse -->
 
@@ -1152,7 +1050,7 @@ a second value) or "Add section".
 
 **Now deletable.** Template labels that repeated the template's description.
 
-### "Add entry" follows path permissions; admin panels and labels tidied
+#### "Add entry" follows path permissions; admin panels and labels tidied
 
 <!-- changeset: navigator-add-follows-path-access-and-ux-batch2-rest -->
 
@@ -1167,7 +1065,7 @@ labels such as "All entries", "Manage permissions" and "Create group" are now in
 Discarding an entry's changes toasts only for a read-only branch's hidden draft, where the form shows
 no change.
 
-### Quick open, a navigator filter, title-first new entries, and media search
+#### Quick open, a navigator filter, title-first new entries, and media search
 
 <!-- changeset: quick-open-navigator-filter-media-search -->
 
@@ -1183,7 +1081,7 @@ library searches, sorts and filters all its files, in a grid or a list.
 **To adopt.** Nothing, unless browser tests add an entry by typing only a slug: fill in "Title"
 too when the entry type has one.
 
-### A save never brings back a deleted or moved entry — **behaviour change**
+#### A save never brings back a deleted or moved entry — **behaviour change**
 
 <!-- changeset: save-never-recreates-deleted-entry -->
 
@@ -1196,7 +1094,7 @@ its new name with the changes still in the form, ready to save again. For a dele
 the changes and offers "Save as new entry", a deliberate create. This also covers an editor's own
 delete or rename that got no answer. Creating an entry is unchanged.
 
-### Submit names unsaved entries; unanswered writes recover more
+#### Submit names unsaved entries; unanswered writes recover more
 
 <!-- changeset: submit-warns-unsaved-and-unanswered-writes-recover -->
 
@@ -1212,7 +1110,7 @@ out). The save-outcome toasts name their
 entry. A lookup sent as a POST that times out says to try again. Removing a staged entry type
 from a new collection goes at once, with Undo in the dialog.
 
-### Unlabelled fields and block templates show their names as words
+#### Unlabelled fields and block templates show their names as words
 
 <!-- changeset: unlabelled-fields-read-as-words -->
 
@@ -1225,7 +1123,7 @@ block picker and the Remove toast.
 **To adopt.** Nothing, unless your browser tests find such a field by its raw name. Give it a
 `label` to choose the words yourself.
 
-### Stable releases follow the changes they carry, and ship their changelog
+#### Stable releases follow the changes they carry, and ship their changelog
 
 <!-- changeset: stable-releases-from-changesets -->
 
@@ -1238,7 +1136,7 @@ as int builds already do.
 
 **To adopt.** Nothing. With `0.1.0` and later, a `^0.1.0` range takes patches without action.
 
-### List items and blocks carry a `_key`, and field comments follow it — **behaviour change**
+#### List items and blocks carry a `_key`, and field comments follow it — **behaviour change**
 
 <!-- changeset: list-items-and-blocks-carry-keys -->
 
@@ -1261,7 +1159,7 @@ a `validateEntry` hook included, checks content against a strict schema, allow `
 items and blocks. Don't spread a list item onto a DOM element (`<li {...item}>`), or it renders
 a `_key` attribute. `_key` also suits React's `key` when rendering a list.
 
-### `stampOnPublish` dates a new entry at its first submit
+#### `stampOnPublish` dates a new entry at its first submit
 
 <!-- changeset: datetime-stamp-on-publish -->
 
@@ -1276,13 +1174,151 @@ editor carries an unsaved draft of a stamped entry onto its stamped version.
 The flag is refused off a top-level `datetime`, on `list: true`, and with `required: true`.
 
 **To adopt.** Add `stampOnPublish: true` to the date field your site sorts or labels by, such as
-`{ name: 'publishedAt', type: 'datetime', stampOnPublish: true }`. See [Stamping a publication date](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#stamping-a-publication-date).
+`{ name: 'publishedAt', type: 'datetime', stampOnPublish: true }`. See [Stamping a publication date](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#stamping-a-publication-date).
 
 **Now deletable.** A build step or hook that writes a missing publication date into new entries.
 
----
+#### A left activity rail and a docked content panel
 
-## Released
+<!-- changeset: editor-activity-rail -->
+
+_First in 0.1.0._
+
+**What changed.** A rail down the editor's left edge opens the content panel, quick open, the
+Branches and Comments drawers and the media library, with Settings and the account control at its
+foot. Comments open from the rail only, with the unresolved count on the button, and the media
+library has its own button instead of a Settings menu item. In a wide side-by-side window the
+content panel docks beside the preview and stays open as you move between entries. Its width and
+whether it is open survive a reload. Narrower than 1024px, or stacked, it lays over the form
+only, so the preview stays in view. Below 1024px the editor also starts stacked until you choose
+a layout. Notifications moved to the bottom-right corner, opposite the rail.
+
+#### `editor.subtitle` removed; the tab names the open entry — **breaking (`editor.subtitle` removed)**
+
+<!-- changeset: editor-subtitle-removed-tab-title -->
+
+_First in 0.1.0._
+
+**What changed.** `editor.subtitle` is no longer a config option, and `Editor` no longer takes
+`subtitle` or `siteSubtitle`: nothing has shown them since the top bar replaced the old header.
+While the editor is mounted, the browser tab reads "Entry label · Site title", or the site title
+with no entry open, and your page's own title comes back when it unmounts, unless a page navigated to has set its own.
+
+**To adopt.** Delete `editor.subtitle` from your config; it was no longer shown.
+
+#### The editor takes over the window — **breaking (`EditorPanes` export removed)**
+
+<!-- changeset: editor-takes-over-the-window -->
+
+_First in 0.1.0._
+
+**What changed.** The editor renders as one full-window layer above your page, so a header or
+footer your root layout renders no longer pushes it down or makes the page scroll. While it is
+mounted, its sign-in and loading screens included, your layout's elements are hidden and out of
+the Tab order, and the page does not scroll; unmount restores them. The footer is gone: the version and an "About CanopyCMS" link are
+in the Settings menu. The two read-only banners sit in their own row under the header. The
+preview/form divider is now keyboard-resizable within the same 15–85% the split was always
+stored at, and `react-split-pane` is no longer a dependency.
+`EditorPanes`, `EditorPanesProps`, the `PaneLayout` type and the `SPLIT_PERCENT_*` and `DEFAULT_*_SPLIT_PERCENT` constants are
+no longer exported from `canopycms/client`. See
+[Your root layout](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#editor-customization).
+
+**To adopt.** Nothing, unless you import `EditorPanes` or those constants: render `CanopyEditor`
+instead, which lays out its own panes. Hiding your site chrome on the editor route is now
+optional, but keeping analytics and global fetches out of it is still worthwhile.
+
+**Now deletable.** A wrapper that drops the site header and footer on the editor route only to
+stop them shifting the editor.
+
+#### The editor's top bar, with Save all — **behaviour change**
+
+<!-- changeset: editor-top-bar-and-save-all -->
+
+_First in 0.1.0._
+
+**What changed.** The editor's header is a 48px top bar. Its breadcrumb's crumbs navigate: "All
+content" opens the content panel, and a collection crumb opens it on that collection. The open
+entry's crumb holds the entry menu, whose "Reload entry" is now "Refresh from server". A
+"Read-only" chip says why the entry or branch takes no edits. The branch pill shows the branch,
+its status and how many entries are unsaved, and its menu lists them; its "Reload all entries" is
+now "Refresh branch" and re-reads the entry list too. Beside Save, a caret offers "Save all", which
+saves every unsaved entry on the branch and names any it could not save, with the reason, keeping
+their changes. The site title and `editor.subtitle` no longer appear in the header; the rail's
+monogram carries the site title. Below 62em the breadcrumb takes its own row and the actions wrap, so no control is clipped. A content save refused because the
+branch is mid-rebase now carries `code: 'BRANCH_SYNCING'`.
+
+**To adopt.** Nothing, unless your browser tests find the header by its old text: "Reload entry",
+"Reload all entries", "Recently modified", "No entry selected", or the file menu's "All content"
+item, which the breadcrumb's "All content" replaces.
+
+#### Rename and delete from the entry menu; Save says "Saved" itself — **behaviour change**
+
+<!-- changeset: entry-menu-rename-delete-inline-saved -->
+
+_First in 0.1.0._
+
+**What changed.** The open entry's menu, on its name in the top bar, offers "Rename…" and
+"Delete entry", through the same dialogs as the content panel's. On a locked branch both stay in
+the menu, blocked, with the reason; for an entry a path rule refuses they are hidden, as in the
+content panel. A Save reads "Saving…" on the button, then "Saved" for two seconds, announced to
+screen readers, instead of a green "Saved" toast; on a phone the button shows a spinner, then a
+check. Failures still show their toast or alert, and Save all its result. Save is the top bar's
+one filled button; "Submit for review" and "Withdraw from review" are tinted. From either menu,
+deleting the open entry leaves no entry open instead of opening the first, and renaming it keeps
+it open under its new name. The delete dialog names the entry.
+
+**To adopt.** Nothing, unless your browser tests wait for a "Saved" toast after Save: wait for the
+save request's response, or for the Save button to read "Saved".
+
+#### The preview has a toolbar with device widths, reload and the saved version
+
+<!-- changeset: preview-toolbar -->
+
+_First in 0.1.0._
+
+**What changed.** A toolbar above the editor's preview shows the page's path on your site
+(without `editor.previewPrefix` or `?branch=`), which copies on click. Its width selector
+renders the page at Fit, Desktop (1280 px), Tablet (768 px) or Mobile (390 px): the iframe takes
+exactly that CSS width, so your site's own breakpoints apply, scaled down when the pane is
+narrower. The choice persists per browser. Reload reloads the preview, the same action as the
+"Live updates off" Retry. "Open saved version" opens the page's `?branch=` URL in a new tab,
+which shows the branch's last saved state, without unsaved edits. A preview error now sits
+between the toolbar and the page instead of over it, naming the field by its labels. A custom
+`renderPreview` gets no toolbar. `PreviewFrame` takes two new optional props, `iframeStyle` and
+`onReload`.
+
+#### The preview toolbar holds the highlight toggle and maximizes the preview; the layout toggle moves to the rail
+
+<!-- changeset: preview-toolbar-controls -->
+
+_First in 0.1.0._
+
+**What changed.** The highlight toggle moves from the strip at the editor's right edge into the
+preview toolbar, and the layout toggle into the rail, above Settings, so it works with any
+preview or none; the strip is gone. The layout button shows the current layout and switches to
+the other; while the preview is maximized it says to restore the preview first. Layout, preview
+width and highlights persist per browser. Maximize lays the preview over the preview and form
+area, without reloading it, and drafts keep reaching it. Restore brings the form back, and so
+does Esc unless focus is inside the page. Anything that needs the form restores it too: a click
+on a highlighted element, which scrolls to its field, opening the content panel over the form,
+or a save refused for field errors. Dragging the divider between preview and form shows the
+preview's width over it, and resizing the panes, by drag or key, switches the width to Fit.
+Admins with highlights on see an "N unmapped" chip when the page marks fields that don't exist
+in the entry. It explains what that means and points to the browser console, which names the
+nearest field of each. Editors see no such diagnostics. A custom `renderPreview`, and an entry
+with no preview page, get no toolbar.
+
+#### Linear-time mount paths and push refusals, and a fixed message for non-Error gateway failures — **security fix**
+
+<!-- changeset: codeql-release-alerts -->
+
+_First in 0.1.0._
+
+**What changed.** The AI export trims slashes from `AIContentConfig.mountPath`, and the worker
+and its GitHub gateway recognise GitHub's refusal of a workflow push, in time linear in their
+length; a long run of slashes or a repeated phrase took seconds before. When the gateway fails with
+a thrown value that is not an `Error`, the worker gets a fixed message and the gateway's log gets
+the value, scrubbed and capped, since it could hold a stack.
 
 ### 0.0.67
 
@@ -1296,7 +1332,7 @@ never ended. `canopycms-auth-clerk` skips it while the editor is mounted, and ex
 **To adopt.** Nothing for the editor, if your edit page uses `useClerkAuthConfig()` or
 `ClerkSignIn`. If your CMS build renders `<SignIn>`, `UserButton` or `OrganizationSwitcher` on your
 own pages, mount the hook as in
-[Clerk components on your own pages](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/packages/canopycms-auth-clerk/README.md#clerk-components-on-your-own-pages).
+[Clerk components on your own pages](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/packages/canopycms-auth-clerk/README.md#clerk-components-on-your-own-pages).
 Your own Server Actions in the CMS build still 403 behind OAC.
 
 **Now deletable.** Any local patch of `window.__internal_onBeforeSetActive` (or 6.x's
@@ -1337,12 +1373,12 @@ fast naming the ARN, the field and the keys present, never a value.
 **To adopt.** Nothing, unless one of those secrets holds a JSON document: then set the matching
 prop. The scaffolded stack fills them from the repository _variables_
 `CANOPY_GITHUB_TOKEN_SECRET_JSON_FIELD` and `CLERK_SECRET_KEY_SECRET_JSON_FIELD`
-([why the prefix](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#repository-secrets-and-variables)); a stack scaffolded earlier
+([why the prefix](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#repository-secrets-and-variables)); a stack scaffolded earlier
 adds the props to `infrastructure/bin/app.ts` and `infrastructure/lib/cms-stack.ts` and the two `env`
 lines to `.github/workflows/deploy-cms.yml`, or re-runs the generator and diffs. `cdk synth` refuses a `…JsonField` prop without its `…SecretArn`, and an ARN carrying the ECS `:KEY::` suffix
 (also in `secretsArns`). Don't use CDK's `secretValueFromJson`: it resolves the plaintext into the deployed
 resource's configuration, readable by anyone who can describe it. Only `CLERK_SECRET_KEY` goes through Secrets Manager; `CLERK_JWT_KEY` and the publishable
-key are public material ([Security Model](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#security-model)).
+key are public material ([Security Model](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#security-model)).
 
 **Now deletable.** A wrapper that fetches the secret, parses it and re-exports one field into the
 worker's environment, such as a `jq` step in user data or a wrapper entrypoint around
@@ -1354,7 +1390,7 @@ worker's environment, such as a `jq` step in user data or a wrapper entrypoint a
 `githubToken` is not deprecated and stays the documented default; `canopycms` neither depends on
 nor imports `@octokit/auth-app`. Register one App per site, not one shared across repositories:
 anyone holding an App's key can mint a token for any of its installations
-([why](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/ARCHITECTURE.md#why-one-github-app-per-site-not-one-shared-across-an-organisation)).
+([why](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/ARCHITECTURE.md#why-one-github-app-per-site-not-one-shared-across-an-organisation)).
 
 **To adopt with `canopycms-cdk`** (existing stacks need no edit). `CanopyCmsServiceProps` takes
 `githubAppId`, `githubAppInstallationId`, `githubAppPrivateKeySecretArn` and
@@ -1367,7 +1403,7 @@ anyone holding an App's key can mint a token for any of its installations
    `verify` checks an existing installation's permissions: run it, since an App missing a
    permission only shows up later, as `sync-failed`. `create` needs an interactive terminal and
    never edits an existing JSON secret (create one and point the JSON-field prop at it)
-   ([details](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#register-it-with-canopycms-init-github-app)).
+   ([details](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#register-it-with-canopycms-init-github-app)).
 2. Set the three props and **remove `githubTokenSecretArn`** (with its JSON field). A partial set
    of the three is refused at synth, and so is an App alongside a token.
 3. In the generated workflow, store them as `CANOPY_GITHUB_APP_ID`,
@@ -1378,7 +1414,7 @@ anyone holding an App's key can mint a token for any of its installations
 
 The private key is ARN-only; passing the key itself is refused at synth. Its ARN joins the worker's
 IAM policy automatically, so you need not add it to `secretsArns`. See
-[Authenticating as a GitHub App](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#authenticating-as-a-github-app).
+[Authenticating as a GitHub App](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#authenticating-as-a-github-app).
 
 ```bash
 canopycms init-github-app create -- \
@@ -1426,7 +1462,7 @@ downloads the `.pem` from the App's settings page.
 
 **What changed.** The worker re-reads a Secrets Manager secret (the GitHub token or the Clerk secret
 key) when the operation using it fails. Timings, costs and the store-before-revoke order are in
-[Rotating a secret](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#rotating-a-secret).
+[Rotating a secret](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#rotating-a-secret).
 
 **To adopt.** Nothing for credentials from `*_SECRET_ARN`, which is every scaffolded deployment. A
 GitHub App private key is still read only at boot: store the new key, replace the instance, and
@@ -1480,12 +1516,12 @@ also check the bucket policy for its grant.
 5. `withCanopy()` adds sharp's libvips to Next's file tracing (not for a static export) and, on
    Next 16 and later, sets `turbopack: {}` when your config has neither `turbopack` nor your own
    `webpack` and it can read your Next version. A webpack build still fails its image transforms
-   ([Dual Build Support](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#dual-build-support)).
+   ([Dual Build Support](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#dual-build-support)).
 
 **Breaking:** a stack setting `platform` on `fromImageAsset` without `architecture` gets an arm64
 function while `platform` still decides the image, so `Platform.LINUX_AMD64` builds an image the
 function cannot run. A stack setting neither moves to arm64 with a matching image, built under QEMU
-on an x86 host ([Where the image is built](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#where-the-image-is-built)).
+on an x86 host ([Where the image is built](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#where-the-image-is-built)).
 
 **To adopt.**
 
@@ -1514,7 +1550,7 @@ reason; `platform` on `fromImageAsset`; and, with `withCanopy()`, a hand-written
 
 **What changed.** `media.uploadUrl` (s3 adapter; an absolute http(s) URL or a site-relative path)
 replaces the `url` that `beginUpload()` returns, leaving the presign's `fields` untouched, so
-uploads can be same-origin. See [Media Configuration](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#media-configuration) for the
+uploads can be same-origin. See [Media Configuration](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#media-configuration) for the
 CloudFront behavior it expects.
 
 **To adopt.** Optional. Set it from an environment variable: a site-relative value works only where
@@ -1539,7 +1575,7 @@ needs `lazyPublicTransforms: true`) let you pass a deterministically named role,
 bucket's stack computes `arn:aws:iam::<account>:role/<name>` from literals instead of a
 `Fn::GetStackOutput` reference only the CDK CLI resolves. The constructs re-attach
 `AWSLambdaBasicExecutionRole` (and the VPC policy) that `lambda.Function` drops from a role you
-pass. See [Cross-account asset bucket](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#cross-account-asset-bucket).
+pass. See [Cross-account asset bucket](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#cross-account-asset-bucket).
 
 **To adopt.** Optional:
 
@@ -1649,7 +1685,7 @@ public JWKS PEM, used only to verify signatures.
 to variables (Settings → Secrets and variables → Actions → Variables); `bin/app.ts` refuses the
 deploy at synth while it is unset. Check that `bin/app.ts` passes `CLERK_SECRET_KEY` as
 `clerkSecretKeySecretArn` (read by the worker), never in the Lambda's `environment`, unless you keep
-`clerkMiddleware` ([Security Model](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#security-model)).
+`clerkMiddleware` ([Security Model](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/docs/deploying-to-aws.md#security-model)).
 
 #### `readByUrlPath` answers only where `listEntries` publishes — **breaking (routing)**
 
@@ -1748,7 +1784,7 @@ basePath: process.env.NEXT_PUBLIC_BASE_PATH,
 Then pass `baseUrl` to `assetUrl` only if Next serves `/assets` (local adapter, `next dev`, S3 with
 no distribution): `assetUrl(image, { width: 960, baseUrl: BASE_PATH })`. Assets on CloudFront via
 `AssetSupport` stay at the distribution root; pass no `baseUrl` (mount table under "Where `/assets`
-is mounted" in [Media Configuration](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#media-configuration)). Two traps:
+is mounted" in [Media Configuration](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#media-configuration)). Two traps:
 
 - Don't pass a deployment `basePath` to `contentStaticParams({ basePath })`; that option filters by
   a nested route prefix and emits zero params, building green.
@@ -1907,7 +1943,7 @@ Under `exactOptionalPropertyTypes: true`, omit keys instead of assigning `undefi
 `withTrailingSlash` and `isAbsoluteUrl` from `canopycms/server`; `defineSeoFieldGroup()` from
 `canopycms`; `generateContentSitemap` and `entryToMetadata` from `canopycms-next`, bound on
 `createNextCanopyContext`'s result. See
-[Sitemap and SEO Metadata](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#sitemap-and-seo-metadata). Every routable entry type is in
+[Sitemap and SEO Metadata](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#sitemap-and-seo-metadata). Every routable entry type is in
 the sitemap unless `exclude`d or `noindex`; one `noindex` predicate drives both robots metadata and
 sitemap exclusion. `trailingSlash` is never inferred. `lastModified` defaults to `updatedAt`, a
 filesystem mtime. An empty SEO field counts as unset. `siteUrl` must be absolute, colliding URLs are
@@ -1964,7 +2000,7 @@ underscore-prefixed files are skipped.
 
 **What changed.** New scaffolds write `defaultBranchAccess: 'deny'` and
 `defaultPathAccess: { read: 'allow' }`
-([Public read on server deployments](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#public-read-on-server-deployments)).
+([Public read on server deployments](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#public-read-on-server-deployments)).
 
 **To adopt.** An older scaffold's `defaultBranchAccess: 'allow'` is wider than recommended;
 consider `'deny'`. If you deleted `defaultPathAccess: { read: 'allow' }`, anonymous visitors get no content until you
@@ -2017,7 +2053,7 @@ re-checked an entry's type (a `switch` on `meta.entryType` can merge them into o
 **What changed.** `BlockComponentRegistry<Blocks>` (types only, from `canopycms`; `BlockValueOf<Blocks, 'hero'>`
 gives one template's value type) requires exactly
 one component per block template name when written as an object literal. See
-[Block Component Registries](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#block-component-registries) and
+[Block Component Registries](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#block-component-registries) and
 `apps/example1/app/components/PostView.tsx`.
 
 ```ts
@@ -2039,7 +2075,7 @@ templates against the schema.
 
 **What changed.** Spreading a `const` field array into several schemas, and nesting
 `defineInlineFieldGroup()` inside a block template, are documented
-([Reusable Field Fragments](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#reusable-field-fragments)); `defineFieldFragment()` is an
+([Reusable Field Fragments](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#reusable-field-fragments)); `defineFieldFragment()` is an
 identity helper for them.
 
 ```ts
@@ -2058,7 +2094,7 @@ field by composing from the same `const` field object.
 A block template holding a `reference` field is a shared block; `read()`/`readByUrlPath()` resolve
 it, and listings do with
 [`resolveReferences`](#listings-resolve-references-and-a-resolved-reference-carries-urlpath-and-optionally-its-body-16--breaking-type-level)
-(0.0.64). See [Shared / Referenced Blocks](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#shared--referenced-blocks).
+(0.0.64). See [Shared / Referenced Blocks](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#shared--referenced-blocks).
 
 **Now deletable.** A second `read()` in page code to unwrap a shared block's reference.
 
@@ -2080,7 +2116,7 @@ Not retro-documented, apart from these:
 
 #### The registry is keyed by entry-type name (0.0.42)
 
-**What changed.** `createEntrySchemaRegistry` keys are the entry-type names that `.collection.json` files name in `entry.schema`, and `EntryTypesFromRegistry` derives the typed entry-type map from them. Schema-variable keys (`{ postSchema }`) still work but derive nothing; [README's registry convention](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#convention-why-key-the-registry-by-entry-type-name) says when to keep them.
+**What changed.** `createEntrySchemaRegistry` keys are the entry-type names that `.collection.json` files name in `entry.schema`, and `EntryTypesFromRegistry` derives the typed entry-type map from them. Schema-variable keys (`{ postSchema }`) still work but derive nothing; [README's registry convention](https://github.com/safeinsights/canopycms/blob/39a755c116a52b6d16e0b09e9dde03c67a081754/README.md#convention-why-key-the-registry-by-entry-type-name) says when to keep them.
 
 **To adopt.**