canopycms 0.1.0-int.115 → 0.2.0-int.119

package/CHANGELOG.md

@@ -5,38 +5,11 @@ packages release together, at one version.
 
 ## This build
 
-Version `0.1.0-int.115`, built from [`f8b50b3`](https://github.com/safeinsights/canopycms/tree/f8b50b30170954bf52fb670afe6796d2cb8fa275).
-
-### New since int.114
-
-- [AI content can withhold or redirect a link to an entry with no page](#ai-content-can-withhold-or-redirect-a-link-to-an-entry-with-no-page)
-- [toPlainText takes an entry body and keeps prose after a leading --- — behaviour change](#toplaintext-takes-an-entry-body-and-keeps-prose-after-a-leading------behaviour-change)
-- [People without a name show "Name unavailable"](#people-without-a-name-show-name-unavailable)
-- [Branch access lists stay with admins and reviewers — behaviour change](#branch-access-lists-stay-with-admins-and-reviewers--behaviour-change)
-- [A branch lockdown outranks the branch's access list — security fix](#a-branch-lockdown-outranks-the-branchs-access-list--security-fix)
-- [The base-branch conflict notice stays until the branch merges — behaviour change](#the-base-branch-conflict-notice-stays-until-the-branch-merges--behaviour-change)
-- [The editor calls the content drawer "All content"](#the-editor-calls-the-content-drawer-all-content)
-- [The Branches drawer shows one action per branch, and comments reply in place](#the-branches-drawer-shows-one-action-per-branch-and-comments-reply-in-place)
-- [An object's Clear offers Undo, and refusals say why](#an-objects-clear-offers-undo-and-refusals-say-why)
-- [The collection dialog says what saves at once](#the-collection-dialog-says-what-saves-at-once)
-- [Comments and branches name their people for every editor — behaviour change on two APIs](#comments-and-branches-name-their-people-for-every-editor--behaviour-change-on-two-apis)
-- [A date picker, a form header, and a toolbar that wraps](#a-date-picker-a-form-header-and-a-toolbar-that-wraps)
-- [Editor colours reach 4.5:1 in light and dark mode](#editor-colours-reach-451-in-light-and-dark-mode)
-- [Editor contrast, and blocked buttons stay focusable](#editor-contrast-and-blocked-buttons-stay-focusable)
-- [Editor focus rings and checked controls reach 3:1 for any brand](#editor-focus-rings-and-checked-controls-reach-31-for-any-brand)
-- [Editor requests time out instead of hanging](#editor-requests-time-out-instead-of-hanging)
-- [Field editing: descriptions, list-card titles, and public/ images, continued](#field-editing-descriptions-list-card-titles-and-public-images-continued)
-- [List items and blocks collapse, and reorder from one menu](#list-items-and-blocks-collapse-and-reorder-from-one-menu)
-- ["Add entry" follows path permissions; admin panels and labels tidied](#add-entry-follows-path-permissions-admin-panels-and-labels-tidied)
-- [Quick open, a navigator filter, title-first new entries, and media search](#quick-open-a-navigator-filter-title-first-new-entries-and-media-search)
-- [A save never brings back a deleted or moved entry — behaviour change](#a-save-never-brings-back-a-deleted-or-moved-entry--behaviour-change)
-- [Submit names unsaved entries; unanswered writes recover more](#submit-names-unsaved-entries-unanswered-writes-recover-more)
-- [Unlabelled fields and block templates show their names as words](#unlabelled-fields-and-block-templates-show-their-names-as-words)
-- [Stable releases follow the changes they carry, and ship their changelog](#stable-releases-follow-the-changes-they-carry-and-ship-their-changelog)
-- [List items and blocks carry a \_key, and field comments follow it — behaviour change](#list-items-and-blocks-carry-a-_key-and-field-comments-follow-it--behaviour-change)
-- [stampOnPublish dates a new entry at its first submit](#stamponpublish-dates-a-new-entry-at-its-first-submit)
-
-If you upgraded from a build on another branch, compare the `<!-- changeset: … -->` slugs in your previous build's `CHANGELOG.md` (`npm pack canopycms@<old>` fetches it) with this one's: entries whose slug your old file lacks are new to you. Legacy entries above the changeset entries carry hand-written int labels.
+Version `0.2.0-int.119`, built from [`35953fb`](https://github.com/safeinsights/canopycms/tree/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a).
+
+No earlier int is in this build's history, so read every Unreleased entry.
+
+If you upgraded from a build on another branch, compare the `<!-- changeset: … -->` slugs in your previous build's `CHANGELOG.md` (`npm pack canopycms@<old>` fetches it) with this one's: entries whose slug your old file lacks are new to you.
 
 ## How to use this document
 
@@ -51,7 +24,7 @@ Each entry has up to three parts:
 `node_modules/canopycms/CHANGELOG.md`, assembled for that build: its **This build** section lists
 what is new since the previous int on the same branch, or on a stable release links its entries, and its links point at the commit the build
 came from. The copy in the repository holds released history and the entries from before changesets;
-every entry written since is a file in [`.changeset/`](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/.changeset/README.md) until a stable release
+every entry written since is a file in [`.changeset/`](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/.changeset/README.md) until a stable release
 moves it here.
 
 **Find your starting point.** From a stable pin, start at the first version under **Released**
@@ -80,89 +53,119 @@ Nothing in this section is edited by hand: each entry is a `.changeset/` file, w
 assembles here and labels with the first int that carries it, and a stable release moves the
 entries under **Released**.
 
-<!-- legacy:start -->
-
-The entries below predate changesets and keep their hand-written labels.
-
-| int | Area     | Change                                                                                                                                                                                      | Action                       |
-| --- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
-| 93  | Branches | [Path rules match logical paths](#path-permission-rules-now-take-effect-below-the-content-root--security-fix-breaking-for-rules-written-with-on-disk-names)                                 | Review rules                 |
-| 93  | Branches | [`.canopy-meta/` must not be committed](#canopy-meta-must-not-be-committed-and-system-health-says-so)                                                                                       | If tracked                   |
-| 93  | Branches | [`autoCreateSettingsPR` removed](#settings-saves-only-push-the-settings-branch--breaking-config-autocreatesettingspr-is-removed)                                                            | Required                     |
-| 93  | Reading  | [Listings take `branch`; reads report `slug`/`urlPath`](#content-reads-listings-take-a-branch-and-reads-report-slug-and-urlpath) (102)                                                      | Index pages                  |
-| 93  | Editing  | [Field descriptions, list-card titles, `public/` images](#field-editing-descriptions-list-card-titles-and-public-images) (96, 103)                                                          | None                         |
-| 93  | Branches | [Commits name editors; submit refuses an empty branch](#commits-name-their-editors-and-submit-refuses-a-branch-with-nothing-to-submit) (108, 110)                                           | Scripts                      |
-| 94  | Branches | [Reads never create a branch](#reads-never-create-a-requested-branch--security-fix-breaking-for-some-direct-createcontentreader-callers)                                                    | Direct callers               |
-| 94  | Preview  | [Preview URLs: one prefix, `trailingSlash`, own page](#preview-urls-take-one-prefix-follow-trailingslash-and-load-each-entrys-own-page--breaking-env) (98)                                  | Required                     |
-| 94  | Preview  | [`createPreviewPage`, `/preview` entries](#the-preview-route-and-preview-entries--breaking-imports) (95, 101, 103)                                                                          | Required                     |
-| 94  | Refs     | [Restricted and missing references](#a-reference-resolves-to-its-target-a-restricted-stub-or-a-missing-stub--security-fix-breaking-types-and-build) (106)                                   | Required                     |
-| 94  | CDK      | [`attachTo`, editor response headers](#canopycms-cdk-canopycmsserviceattachto-and-editor-response-headers--behaviour-change-if-you-frame-the-cms)                                           | If hand-wired or framed      |
-| 94  | Ops      | [System health shows the build](#system-health-shows-which-build-is-running)                                                                                                                | Optional                     |
-| 100 | Branches | [Crash-safe branch creation](#fast-crash-safe-branch-creation--behaviour-change-branch-clones-hold-only-the-content-root)                                                                   | Upgrade together             |
-| 100 | Ops      | [Prod workspace defaults to `/mnt/efs`](#the-prod-workspace-defaults-to-mntefs--behaviour-change-if-you-run-prod-without-canopycms_workspace_root)                                          | Non-CDK prod                 |
-| 100 | Assets   | [`AssetSupport` serves from S3 only](#canopycms-cdk-assetsupport-serves-images-from-s3-only--breaking)                                                                                      | Required                     |
-| 100 | Assets   | [`collect-asset-refs`, `materialize-assets`](#collect-asset-refs-and-materialize-assets-store-a-builds-images-before-release) (104)                                                         | With S3-only                 |
-| 100 | Assets   | [Editor images via signed-in route](#the-editor-and-its-live-preview-load-images-through-the-signed-in-asset-route)                                                                         | CSP, origin                  |
-| 100 | Assets   | [`assetUrl` applies crop](#asseturl-applies-an-image-values-crop--behaviour-change-for-cropped-images)                                                                                      | Scale `<img>`                |
-| 100 | Assets   | [`media.publicBaseUrl` removed; wider limits](#mediapublicbaseurl-is-removed-and-image-limits-are-wider--breaking-config)                                                                   | Delete key                   |
-| 101 | Editing  | [Saves rewrite only what changed](#a-save-rewrites-only-what-changed) (103)                                                                                                                 | None                         |
-| 102 | Auth     | [`unauthenticatedStatus: 419`](#unauthenticatedstatus-answer-signed-out-api-calls-with-419)                                                                                                 | Basic-auth sites             |
-| 105 | Editing  | [MDXEditor 4.3](#the-markdown-editor-runs-mdxeditor-43)                                                                                                                                     | Direct deps                  |
-| 106 | Refs     | [AI content links references](#ai-content-links-a-reference-to-its-target--behaviour-change-for-ai-output-and-ai-config-callbacks)                                                          | AI config                    |
-| 106 | Refs     | [Deleting a referenced entry asks](#deleting-a-referenced-entry-asks-first--behaviour-change-on-the-delete-api)                                                                             | Scripts                      |
-| 107 | Schema   | [Unknown schemas cost one entry type](#a-schema-the-running-code-lacks-costs-one-entry-type-and-holds-the-worker--behaviour-change)                                                         | Rare                         |
-| 108 | MDX      | [MDX that runs code is refused](#mdx-content-that-runs-code-is-refused-at-save--breaking-behaviour) (109, 110)                                                                              | Required                     |
-| 108 | Worker   | [On-demand worker, drain; `spotMaxPrice` removed](#canopycms-cdk-the-worker-drains-before-replacement-and-runs-on-demand--breaking-props-spotmaxprice-is-removed-behaviour-and-cost-change) | If set                       |
-| 109 | Worker   | [Hardened worker instance](#canopycms-cdk-the-worker-instance-is-hardened--an-existing-stack-upgrades-in-two-deploys-behaviour-and-cost-change)                                             | Two deploys                  |
-| 109 | Worker   | [Failed or stopped worker says why](#a-failed-or-stopped-worker-says-why--behaviour-change-on-the-not-ready-503-new-worker-apis)                                                            | Custom entrypoint            |
-| 109 | Worker   | [CI worker roll; worker-down alarm](#canopycms-cdk-ci-can-roll-the-worker-with-a-parameter-and-alarm-when-it-stops-syncing--new-opt-in)                                                     | Optional                     |
-| 109 | Preview  | [Typed `fieldProps`](#preview-fieldprops-is-typed-with-server-safe-helpers--breaking-types-and-schemas)                                                                                     | Required                     |
-| 110 | Worker   | [Worker needs a state directory](#canopycms-cdk-the-worker-needs-a-state-directory--deploy-the-template-before-the-bundle)                                                                  | Template first               |
-| 110 | Ops      | [Prod detects an unset `defaultBaseBranch`](#prod-detects-an-unset-defaultbasebranch-instead-of-assuming-main--behaviour-change-startup-can-fail)                                           | Base ≠ repo default          |
-| 111 | CDK      | [Example workflow's triggers and checks](#the-aws-example-workflow-gains-the-templates-triggers-and-dependency-checks)                                                                      | If copied by hand            |
-| 111 | Ops      | [Duplicate-ID scan only on request](#get-adminbranch-health-scans-for-duplicate-content-ids-only-on-request--behaviour-change)                                                              | Admin-API scripts            |
-| 111 | Auth     | [CMS image builds a prod editor; mismatch blocks](#the-cms-image-builds-a-prod-editor-and-a-mode-mismatch-blocks-the-editor--behaviour-change-a-hand-built-image-can-fail-its-build)        | Hand-built images            |
-| 111 | Auth     | [Auth plugins look users up in batches](#auth-plugins-look-users-up-in-batches)                                                                                                             | Custom plugins               |
-| 112 | Worker   | [Bundle states the template it needs](#canopycms-cdk-a-worker-bundle-states-the-template-it-needs--template-first-for-the-gate-only)                                                        | Template first               |
-| 112 | Worker   | [Poisoned `remote.git` re-clones](#a-poisoned-remotegit-re-clones-itself)                                                                                                                   | None                         |
-| 112 | Worker   | [Nano worker boots reliably](#canopycms-cdk-a-t4gnano-worker-boots-reliably--behaviour-change-a-deploy-replaces-the-worker)                                                                 | Deploy                       |
-| 112 | Worker   | [Worker never pushes base or default branch](#the-worker-never-pushes-the-base-or-default-branch--security-fix) (114)                                                                       | Protect base on GitHub       |
-| 112 | Worker   | [Worker log is root-owned](#canopycms-cdk-the-workers-log-is-root-owned--security-fix)                                                                                                      | Deploy; hand-installed units |
-| 113 | Worker   | [Push logs say whether GitHub moved](#the-workers-push-logs-say-whether-github-moved)                                                                                                       | None                         |
-| 113 | Editing  | [Unsaved ACL changes show; closing asks](#unsaved-group-and-permission-changes-show-and-closing-asks-first)                                                                                 | None                         |
-| 113 | Worker   | [Credential in a per-command git config](#the-worker-hands-git-its-github-credential-in-a-per-command-file--security-fix-dev-behaviour-change)                                              | Dev: proxy or CA in env      |
-| 114 | Worker   | [GitHub objects cross as bundles](#the-worker-moves-objects-between-github-and-remotegit-as-bundles)                                                                                        | None                         |
-| 114 | AI       | [`noindex` entries leave AI content](#ai-content-leaves-out-noindex-entries--behaviour-change-for-ai-output)                                                                                | `exclude.noindex: false`     |
-| 114 | Worker   | [Worker follows a rebased or deleted branch](#the-worker-follows-a-rebased-or-deleted-github-branch)                                                                                        | None                         |
-| 114 | Worker   | [Worker holds no secret (contract 2)](#canopycms-cdk-the-worker-holds-no-secret--security-fix-template-first-contract-2)                                                                    | Template first               |
-| 115 | AI | [referenceLink decides where AI-export entry links point](#ai-content-can-withhold-or-redirect-a-link-to-an-entry-with-no-page) | Optional |
-| 115 | AI | [toPlainText no longer strips front matter](#toplaintext-takes-an-entry-body-and-keeps-prose-after-a-leading------behaviour-change) | Whole-file callers split first |
-| 115 | Auth | [Clerk users without a name no longer show their id](#people-without-a-name-show-name-unavailable) | None |
-| 115 | Branches | [Non-privileged callers get only their own branch ACL entries](#branch-access-lists-stay-with-admins-and-reviewers--behaviour-change) | None |
-| 115 | Branches | [managerOrAdminAllowed now refuses editors an access list names](#a-branch-lockdown-outranks-the-branchs-access-list--security-fix) | Optional |
-| 115 | Branches | [Conflict notice persists until merge](#the-base-branch-conflict-notice-stays-until-the-branch-merges--behaviour-change) | None |
-| 115 | Editing | [Breadcrumb root and file menu say "All content"](#the-editor-calls-the-content-drawer-all-content) | Editor UI tests |
-| 115 | Editing | [Branches drawer and comment replies](#the-branches-drawer-shows-one-action-per-branch-and-comments-reply-in-place) | Editor UI tests |
-| 115 | Editing | [Clear offers Undo; refusals and conflicts explain themselves](#an-objects-clear-offers-undo-and-refusals-say-why) | None |
-| 115 | Editing | [Collection dialog says what saves at once](#the-collection-dialog-says-what-saves-at-once) | Editor UI tests |
-| 115 | Editing | [Comments and branches name their people](#comments-and-branches-name-their-people-for-every-editor--behaviour-change-on-two-apis) | Direct API callers |
-| 115 | Editing | [Date picker, form header, wrapping toolbar](#a-date-picker-a-form-header-and-a-toolbar-that-wraps) | Editor UI tests |
-| 115 | Editing | [Editor colours reach contrast in both schemes](#editor-colours-reach-451-in-light-and-dark-mode) | Visual snapshot tests |
-| 115 | Editing | [Editor contrast; blocked buttons stay focusable](#editor-contrast-and-blocked-buttons-stay-focusable) | Browser tests |
-| 115 | Editing | [Focus ring, control borders, light badges, sentence-case badges](#editor-focus-rings-and-checked-controls-reach-31-for-any-brand) | Visual snapshot tests |
-| 115 | Editing | [Editor requests time out](#editor-requests-time-out-instead-of-hanging) | Slow-API browser tests |
-| 115 | Editing | [Field descriptions, list-card titles, `public/` images, continued](#field-editing-descriptions-list-card-titles-and-public-images-continued) | None |
-| 115 | Editing | [List items and blocks collapse](#list-items-and-blocks-collapse-and-reorder-from-one-menu) | Editor UI tests |
-| 115 | Editing | [Navigator hides "Add entry" where path permissions refuse it](#add-entry-follows-path-permissions-admin-panels-and-labels-tidied) | None |
-| 115 | Editing | [Quick open, navigator filter, title-first entries, media search](#quick-open-a-navigator-filter-title-first-new-entries-and-media-search) | Editor UI tests |
-| 115 | Editing | [Saving a deleted or moved entry is refused](#a-save-never-brings-back-a-deleted-or-moved-entry--behaviour-change) | None |
-| 115 | Editing | [Submit warns about unsaved entries; unanswered writes keep input](#submit-names-unsaved-entries-unanswered-writes-recover-more) | None |
-| 115 | Editing | [Unlabelled field names are humanised](#unlabelled-fields-and-block-templates-show-their-names-as-words) | Editor UI tests |
-| 115 | Ops | [Stable versions follow changesets; CHANGELOG.md ships](#stable-releases-follow-the-changes-they-carry-and-ship-their-changelog) | None |
-| 115 | Reading | [List items and blocks gain a persisted `_key`](#list-items-and-blocks-carry-a-_key-and-field-comments-follow-it--behaviour-change) | Rename fields named _key |
-| 115 | Schema | [Date new entries at their first submit](#stamponpublish-dates-a-new-entry-at-its-first-submit) | Optional |
-
-### Preview URLs take one prefix, follow `trailingSlash`, and load each entry's own page — **breaking (env)**
+| int | Area | Change | Action |
+| --- | --- | --- | --- |
+| 119 | Assets | [Library removal hides the file; grant the asset-hidden/ prefix](#removing-a-file-from-the-media-library-hides-it-and-an-admin-can-restore-it--breaking-assetsdelete-assetstore--behaviour-change) | Upgrade both; grant asset-hidden |
+| 119 | Editing | [Content panel docks when stacked; overlay slides; matched dividers](#stacked-layout-docks-the-content-panel-beside-the-form) | None |
+| 119 | Editing | [Editor opens the home page; singletons named by type](#the-editor-opens-the-home-page-and-names-single-entry-types-by-their-type--behaviour-change) | None |
+| 119 | Editing | [Drawers share the content panel's compact header](#compact-drawer-headers-jumpable-comment-headings-and-a-steadier-owner-chip) | None |
+| 119 | Editing | [Object Clear in a "…" menu; Undo stays inline](#an-objects-clear-moves-into-its--menu-with-an-inline-undo) | Editor UI tests |
+| 119 | Editing | [Top bar: one unsaved dot, no "Editing" label](#the-top-bar-shows-one-unsaved-mark-and-a-status-only-when-it-matters--behaviour-change) | None |
+| 119 | Preview | [createPreviewPage takes a layout for the site header and footer](#previews-can-show-the-site-header-and-footer-and-the-preview-stays-put-between-entries) | Optional |
+
+### Removing a file from the media library hides it, and an admin can restore it — **breaking (assets.delete, AssetStore) / behaviour change**
+
+<!-- changeset: ef-g-media -->
+
+_First in int.119._
+
+**What changed.** "Remove from library" no longer deletes the file's metadata, so every image
+size and crop keeps working wherever the file is used, including `materialize-assets`. It writes
+a marker under the new `asset-hidden/` prefix instead. Admins can turn on "Show removed files" in
+the media library and restore a file, and uploading the same file again restores it too.
+
+**To adopt.**
+
+- Upgrade `canopycms` and `canopycms-cdk` together.
+- `assets.delete` and `DELETE /assets` are removed (`DELETE /assets` answers 410); use
+  `assets.hide` / `POST /assets/hide` and `assets.restore` / `POST /assets/restore`.
+- A custom `AssetStore` drops `deleteMeta` and must implement `hideAsset` and `unhideAsset`; a
+  custom `AssetPrefixes` must set `hidden`.
+- `AssetSupport.grantUploadAccess()` and `CanopyCmsService`'s `assetBucket` grant `s3:PutObject`
+  and `s3:DeleteObject` on `asset-hidden/*` and no longer grant delete on `asset-meta/*`. If you
+  write the CMS role's bucket policy yourself, do the same (no `s3:GetObject` is needed), and if
+  it scopes `s3:ListBucket` by prefix, include `asset-hidden/`.
+- Files removed before this release lost their metadata. Uploading the same bytes again recreates
+  it, recorded under the re-uploader's name.
+
+### Stacked layout docks the content panel beside the form
+
+<!-- changeset: ef-a-shell -->
+
+_First in int.119._
+
+**What changed.** In a wide window the content panel docks beside the form row in the stacked layout too, keeping the preview full width; in a narrow window it slides in over the form, unless the user prefers reduced motion. Both pane dividers share one width, and a branch banner has a line beneath it.
+
+### The editor opens the home page and names single-entry types by their type — **behaviour change**
+
+<!-- changeset: ef-b-identity -->
+
+_First in int.119._
+
+**What changed.** With no entry in the URL, the editor opens the entry routed at `/`, else the first with a preview. An entry type limited to one entry (`maxItems: 1`) with a label is named by that label, though entry links and search still use its title. Content tree rows show the type on a second line, quick open shows type and route, "Rename…" is "Change URL…" ("Change slug…" for an entry with no page), and the "All content" crumb, the form header's title and the rail's site button are gone.
+
+### Compact drawer headers, jumpable comment headings and a steadier owner chip
+
+<!-- changeset: ef-c-drawers -->
+
+_First in int.119._
+
+**What changed.** The Branches, Comments, Media and staged-changes drawers take the content panel's compact header with no subtitle. In the Comments drawer, each thread's heading is the one control that jumps to it. The Branches drawer no longer offers "New branch comment" or "+ New", since new branch comments start in the Comments drawer. A person's chip keeps its avatar and a long name on one line.
+
+### An object's Clear moves into its "…" menu, with an inline Undo
+
+<!-- changeset: ef-d-clear -->
+
+_First in int.119._
+
+**What changed.** An optional object's Clear is now an item in a "…" menu on its label row, named
+for the object ("Clear "SEO""). After a clear, the label row offers "Undo clear" in the menu's
+place, with focus on it, until it can no longer put the object back where it was (the object was
+filled in again, or the item holding it moved or went), another entry or branch opens, or the entry
+is saved or its draft discarded. It has no timer, and Clear no longer raises a toast; list item and block removals keep
+theirs. Their Undo, and the inline one, now survive edits to other items in an enclosing list.
+
+**To adopt.** A UI test that clicked an object's "Clear" button now opens the object's
+"Actions for …" menu and chooses the "Clear" item, then finds "Undo clear" in the label row instead of a toast.
+
+### The top bar shows one unsaved mark and a status only when it matters — **behaviour change**
+
+<!-- changeset: ef-f-topbar -->
+
+_First in int.119._
+
+**What changed.** The branch pill's unsaved count is the same dot as the entry's, with a number, in the brand colour the content tree also uses. "Unsaved · kept on this device" moved into Save's tooltip and description; the bar shows it only as a warning when drafts could not be stored. The pill drops the default "Editing" status and shows In review, Approved, Archived or Protected. The "Read-only" chip no longer repeats a branch-wide lock the banner already explains; it stays for an entry read-only for its own reason.
+
+### Previews can show the site header and footer, and the preview stays put between entries
+
+<!-- changeset: ef-e-preview -->
+
+_First in int.119._
+
+**What changed.** `createPreviewPage` takes an optional `layout`, a server component that wraps every view and receives `{ children, chrome }`. Given one, the preview toolbar offers a "Show site header and footer" toggle, remembered per device, which adds `?chrome=1` to the preview's URL and sets `chrome`. Without the toggle on, `chrome` is `false`. A page that never connects with them, such as one whose layout throws, is shown without them, and the toggle says so. Switching entries keeps the preview pane and its toolbar in place: the last page stays, dimmed, until the next entry's data arrives.
+
+**To adopt.** Pass the component your public pages use for their header and footer:
+
+```tsx
+export default createPreviewPage({
+  layout: ({ children, chrome }) =>
+    chrome ? <SiteChrome>{children}</SiteChrome> : <main>{children}</main>,
+  views: { post: PostPreview },
+})
+```
+
+A preview page built on `useCanopyPreview` alone can pass `siteChrome: true` when it renders the header and footer for `?chrome=1`.
+
+---
+
+## Released
+
+### 0.1.0
+
+<!-- changeset: legacy-unreleased -->
+<!-- changeset: nice-boxes-battle -->
+
+#### Preview URLs take one prefix, follow `trailingSlash`, and load each entry's own page — **breaking (env)**
 
 **What changed.**
 
@@ -182,7 +185,7 @@ served at `/` without an `index` slug needs `'content/<slug>': '/'`, or re-model
 **Now deletable.** `previewBase` keys that only added a shared prefix or restate a root entry's own
 URL.
 
-### The preview route and `/preview` entries — **breaking (imports)**
+#### The preview route and `/preview` entries — **breaking (imports)**
 
 **What changed.**
 
@@ -208,7 +211,7 @@ URL.
 2. For a branch preview: wrap views with `withCanopyPreview` in a `'use client'` module, add
    `app/preview/[[...path]]/page.server.tsx`, set `editor.previewPrefix: '/preview'`, and serve that
    route with `frame-ancestors 'self'`, not `X-Frame-Options: DENY` (see
-   [Live Preview](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#live-preview)).
+   [Live Preview](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#live-preview)).
 3. A test reading view content from the route's server HTML must load the page in a browser.
    Server output rendered during a preview request carries the signed-in asset prefix; keep it out
    of cross-request caches (`unstable_cache`, module memos).
@@ -216,14 +219,14 @@ URL.
 **Now deletable.** A hand-built branch-preview route, and CSS layer or specificity workarounds that
 kept site styles ahead of Mantine's in the preview.
 
-### Preview `fieldProps` is typed, with server-safe helpers — **breaking (types and schemas)**
+#### Preview `fieldProps` is typed, with server-safe helpers — **breaking (types and schemas)**
 
 **What changed.** (int.109) `fieldProps` checks each path against the view's content type, and
 `canopycms` exports `FieldProps`, `FieldAttrs`, `fieldAttrs` and `scopeFieldProps`, callable from
 server components. A string path marks the form's spelling (`'a.0.b'` marks `a[0].b`), and an empty
 path marks nothing. The editor counts and logs marks naming no field. `createEntrySchemaRegistry`
 refuses a field name that is empty, all digits or contains `.`, `[` or `]`. See
-[Live Preview](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#live-preview).
+[Live Preview](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#live-preview).
 
 **To adopt.** Fix each path that stops compiling; the error lists valid ones. Rewrite computed paths
 as literal segments, or type that component's prop as plain `FieldProps`. Pass `fieldProps` as
@@ -233,7 +236,7 @@ as literal segments, or type that component's prop as plain `FieldProps`. Pass `
 `fieldProps` defaults; schema-walking tests for misspelled mark paths, once components are typed
 (the editor flags another block template's field).
 
-### A reference resolves to its target, a restricted stub, or a missing stub — **security fix; breaking (types and build)**
+#### A reference resolves to its target, a restricted stub, or a missing stub — **security fix; breaking (types and build)**
 
 **What changed.**
 
@@ -271,7 +274,7 @@ optional if it was required.
 content-integrity test checking reference fields against entry ids, and top-level-only reference
 fields kept for the preview's sake.
 
-### AI content links a reference to its target — **behaviour change for `/ai` output and AI config callbacks**
+#### AI content links a reference to its target — **behaviour change for `/ai` output and AI config callbacks**
 
 **What changed.** (int.106) A `reference` field renders as a link to its target, not the stored id:
 a byline reading `**Author:** 5NVkkrB1MJUv` now links the name `Alice` to that entry's page, then to
@@ -293,7 +296,7 @@ matching: search your AI config for each reference field's name.
 
 **Now deletable.** A `fieldTransforms` entry that looked up a reference id to print its title.
 
-### AI content leaves out `noindex` entries — **behaviour change for `/ai` output**
+#### AI content leaves out `noindex` entries — **behaviour change for `/ai` output**
 
 **What changed.** (int.114) AI content leaves out entries marked `noindex`, both from
 `generate-ai-content` and from the `/ai` route, using the same predicate as the sitemap and robots
@@ -305,11 +308,11 @@ or a failed render) renders as its plain text, with no URL; any other form of th
 fields are nested or renamed, pass the AI config's `seo` the same object you pass
 `createNextCanopyContext({ seo })`, so the sitemap and AI content read the flag from the same
 place. A field that links to a hidden section by plain URL needs a field transform; the README
-shows [the recipe](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#ai-content-configuration).
+shows [the recipe](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#ai-content-configuration).
 
 **Now deletable.** An `exclude.where` that re-read the `noindex` flag by hand.
 
-### Deleting a referenced entry asks first — **behaviour change on the delete API**
+#### Deleting a referenced entry asks first — **behaviour change on the delete API**
 
 **What changed.** (int.106) Deleting an entry that other entries reference (by field or `entry:`
 link) returns 409 with `data.referencedBy`: the referencing entries the user may read, and a
@@ -318,7 +321,7 @@ link) returns 409 with `data.referencedBy`: the referencing entries the user may
 
 **To adopt.** Only scripts calling the delete endpoint: pass the flag or handle the 409.
 
-### `mdx` content that runs code is refused at save — **breaking (behaviour)**
+#### `mdx` content that runs code is refused at save — **breaking (behaviour)**
 
 **What changed.** (int.108) An `mdx` field or body refuses `{…}` expressions other than comments and
 plain values, `import`/`export`, and tags, attributes and URL schemes outside a safe set; other
@@ -327,7 +330,7 @@ A `markdown` field with `renderAs: 'mdx'` is checked as MDX, and `mdxAllow` narr
 field or site-wide. New: field options `renderAs`, `mdxAllow`; config key `mdxAllow`; type
 `MdxAllowlist`. (int.110) A component prop allowance can be `'string'` (or
 `{ type: 'string', maxLength }`): a quoted value only, never bare or `{…}`. See
-[MDX content cannot run code](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#mdx-content-cannot-run-code).
+[MDX content cannot run code](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#mdx-content-cannot-run-code).
 
 **To adopt.** Set `renderAs: 'mdx'` on each `markdown` field your site compiles as MDX, and
 `mdxAllow` to what your renderer takes. Set `executable: true` only on a field whose editors you
@@ -339,7 +342,7 @@ build lists it.
 `javascript:` links in MDX or markdown rendered as MDX, and the path-prefix matching behind its
 entry-type gate. Keep a rule checking that the body compiles.
 
-### A save rewrites only what changed
+#### A save rewrites only what changed
 
 **What changed.**
 
@@ -359,7 +362,7 @@ entry-type gate. Keep a rule checking that the body compiles.
 **Now deletable.** A formatter pass or `.prettierignore` entry over CMS-written content that only
 undoes the editor's re-folding, restyling or date rewriting.
 
-### The markdown editor runs MDXEditor 4.3
+#### The markdown editor runs MDXEditor 4.3
 
 **What changed.** (int.105) `@mdxeditor/editor` is `^4.3.2` (Lexical 0.48), up from `^3.52.4`.
 Two-paragraph list items, multi-block quotes and code fences in any language edit in rich text.
@@ -367,7 +370,7 @@ Two-paragraph list items, multi-block quotes and code fences in any language edi
 **To adopt.** Nothing, unless your app depends on `@mdxeditor/editor` or `lexical` directly: align
 those versions so one copy loads.
 
-### Unsaved group and permission changes show, and closing asks first
+#### Unsaved group and permission changes show, and closing asks first
 
 **What changed.** (int.113) Manage Groups and Manage Permissions still save as one batch, but now
 mark unsaved changes, keep the save bar in view, and ask before closing or leaving drops them. The
@@ -375,7 +378,7 @@ group dialog's buttons read "Add" and "Apply", since neither saves.
 
 **To adopt.** Nothing.
 
-### Field editing: descriptions, list-card titles, and `public/` images
+#### Field editing: descriptions, list-card titles, and `public/` images
 
 **What changed.**
 
@@ -393,7 +396,7 @@ image, upload a raster copy to the media library. For card titles:
 
 **Now deletable.** Editor hints worked into a field's `label` because `description` never showed.
 
-### Content reads: listings take a `branch`, and reads report `slug` and `urlPath`
+#### Content reads: listings take a `branch`, and reads report `slug` and `urlPath`
 
 **What changed.**
 
@@ -406,7 +409,7 @@ branch.
 
 **Now deletable.** Code parsing a slug or URL back out of `path` or `entry.path`.
 
-### Path-permission rules now take effect below the content root — **security fix; breaking for rules written with on-disk names**
+#### Path-permission rules now take effect below the content root — **security fix; breaking for rules written with on-disk names**
 
 **What changed.** (int.93) Rules match an entry's logical path (`content/blog/my-post`). Enforcement
 checked the id-suffixed on-disk path, so collection and entry rules matched nothing; only a glob
@@ -419,7 +422,7 @@ extension in logical form (`content/blog/**`, `content/about`).
 
 **Now deletable.** A content-root grant working around inert collection grants.
 
-### Reads never create a requested branch — **security fix; breaking for some direct `createContentReader` callers**
+#### Reads never create a requested branch — **security fix; breaking for some direct `createContentReader` callers**
 
 **What changed.** (int.94) A branch other than the active one must exist and be readable by the
 user, or `read()`/`readByUrlPath()` treat it as not found; no workspace is created per `?branch=`
@@ -430,7 +433,7 @@ passes `allowCreateBranch: true`, never with a request's branch.
 
 **Now deletable.** Checks that allow-list `?branch=` before it reaches `read()`.
 
-### Fast, crash-safe branch creation — **behaviour change: branch clones hold only the content root**
+#### Fast, crash-safe branch creation — **behaviour change: branch clones hold only the content root**
 
 **What changed.** (int.100) A branch is built under a staging name and appears only when complete.
 The worker repairs branch directories an interrupted create or delete left wedged, and owns
@@ -444,7 +447,7 @@ changed `contentRoot` reaches existing clones within a worker cycle of the API r
 **Now deletable.** Manual EFS cleanup of provisioning locks or half-made branch directories, and
 `remote.git` gc scripts.
 
-### `.canopy-meta/` must not be committed, and System health says so
+#### `.canopy-meta/` must not be committed, and System health says so
 
 **What changed.** (int.93) The schema cache lives in each branch clone's `.git/canopycms/`. Sync,
 editor submits and `canopycms sync` ignore `.canopy-meta/`, and System health shows the base
@@ -458,13 +461,13 @@ repaired or re-created.
 **Now deletable.** Any local step that resets or reformats `.canopy-meta/` files before a commit or
 a format check.
 
-### Commits name their editors, and submit refuses a branch with nothing to submit
+#### Commits name their editors, and submit refuses a branch with nothing to submit
 
 **What changed.**
 
 - (int.93) Submit commits gain an `Edited-by: Name (id)` trailer; PR bodies gain a section that
   re-submits replace, keeping human text. Options: `gitEditedByTrailers`, `gitCoAuthoredByTrailers`
-  ([reference](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#definecanopyconfig-options)).
+  ([reference](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#definecanopyconfig-options)).
 - (int.110) Submit-commit trailers name every user who saved since the last submit commit, and
   the PR-body section every user who edited the branch, not only the submitter; settings commits
   (permissions, groups) carry the acting user's trailer.
@@ -473,7 +476,7 @@ a format check.
 
 **To adopt.** Scripts calling submit: save a change first, or handle the 400.
 
-### Settings saves only push the settings branch — **breaking (config): `autoCreateSettingsPR` is removed**
+#### Settings saves only push the settings branch — **breaking (config): `autoCreateSettingsPR` is removed**
 
 **What changed.** (int.93) The orphan settings branch can never get a PR, so groups and permissions
 saves only push the branch, and no failing PR task lands in System health.
@@ -482,20 +485,20 @@ saves only push the branch, and no failing PR task lands in System health.
 
 **Now deletable.** Filters that hid the failed settings-PR tasks.
 
-### A schema the running code lacks costs one entry type, and holds the worker — **behaviour change**
+#### A schema the running code lacks costs one entry type, and holds the worker — **behaviour change**
 
 **What changed.** (int.107) When synced content names an entry schema the running code lacks, only
 that entry type goes unavailable: the editor says so, and its entries answer 503 with
 `code: 'SCHEMA_UNAVAILABLE'`. Builds, static deploys and `generate-ai-content` still fail. The
 worker holds the base branch for up to 30 minutes while that lasts; see
-[New schemas wait for the editor deploy](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#new-schemas-wait-for-the-editor-deploy).
+[New schemas wait for the editor deploy](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#new-schemas-wait-for-the-editor-deploy).
 Public types gain optional `unavailable` on `EntryTypeConfig` and `FlatSchemaItem`, optional
 `ApiResponse.code`, and a required `SchemaResolutionResult.issues`.
 
 **To adopt.** Code that builds a `SchemaResolutionResult` adds `issues`. A custom worker entrypoint
 can pass `schemaHoldMaxMs` to `CmsWorker`.
 
-### `canopycms-cdk`: the worker drains before replacement and runs on-demand — **breaking (props): `spotMaxPrice` is removed; behaviour and cost change**
+#### `canopycms-cdk`: the worker drains before replacement and runs on-demand — **breaking (props): `spotMaxPrice` is removed; behaviour and cost change**
 
 **What changed.** (int.108) The worker is one on-demand `t4g.nano` by default (about $3 a month,
 against spot's $1–2); a spot shortage could leave no worker: on a first deploy the editor's API answers 503 "CMS worker not
@@ -512,7 +515,7 @@ drain applies from the deploy after this one.
 
 **Now deletable.** Any override stripping `InstanceMarketOptions` from the worker's launch template.
 
-### `canopycms-cdk`: the worker instance is hardened — **an existing stack upgrades in two deploys; behaviour and cost change**
+#### `canopycms-cdk`: the worker instance is hardened — **an existing stack upgrades in two deploys; behaviour and cost change**
 
 **Upgrade an existing stack in two deploys:**
 
@@ -526,7 +529,7 @@ hang until the drain heartbeat lets termination continue. Its in-flight task is
 new stack needs no steps.
 
 **What changed.** (int.109) Detailed in
-[The worker instance](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#the-worker-instance): IMDSv2 with a hop limit of 1; the
+[The worker instance](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#the-worker-instance): IMDSv2 with a hop limit of 1; the
 bundle is one file whose sha256 user data checks, readable as that one object; a file-system policy
 refusing clients without TLS or IAM, replacing the worker's
 `AmazonElasticFileSystemClientReadWriteAccess`; an encrypted gp3 root volume; a boot-time upgrade to
@@ -542,7 +545,7 @@ key, grant the Auto Scaling service-linked role on it. Pass `workerMaxInstanceLi
 **Now deletable.** Any override adding `MetadataOptions`, an encrypted root volume or an EFS
 `FileSystemPolicy`, or narrowing the worker role's asset-bucket grant.
 
-### `canopycms-cdk`: the worker needs a state directory — **deploy the template before the bundle**
+#### `canopycms-cdk`: the worker needs a state directory — **deploy the template before the bundle**
 
 **What changed.** (int.110) The worker's git keeps the GitHub credential in a private mirror
 under the unit's `StateDirectory=`, and the worker does not start without it.
@@ -552,14 +555,14 @@ new template before CI rolls an int.110 or later bundle; a parameter-only change
 the new unit, so the new bundle exits at start. A hand-installed unit needs
 `StateDirectory=canopy-worker` under `[Service]`.
 
-### A poisoned `remote.git` re-clones itself
+#### A poisoned `remote.git` re-clones itself
 
 **What changed.** (int.112) A `remote.git` missing its base branch is re-cloned unless an unpushed ref would be
 lost; the refusal names those refs. A tampered config still refuses and needs an operator.
 
 **To adopt.** Nothing.
 
-### A failed or stopped worker says why — **behaviour change on the not-ready 503; new worker APIs**
+#### A failed or stopped worker says why — **behaviour change on the not-ready 503; new worker APIs**
 
 **What changed.** (int.109) While the latest start's recorded failure stands, the prod not-ready 503
 is `WORKER_FAILED`: no `Retry-After`, the failure named to admins, account ids masked.
@@ -571,7 +574,7 @@ failure and exits non-zero on `selfStopped`, with a code outside `RestartPrevent
 
 **Now deletable.** A watchdog that restarts an idle worker process.
 
-### `canopycms-cdk`: CI can roll the worker with a parameter, and alarm when it stops syncing — **new, opt-in**
+#### `canopycms-cdk`: CI can roll the worker with a parameter, and alarm when it stops syncing — **new, opt-in**
 
 **What changed.** (int.109)
 
@@ -580,28 +583,28 @@ failure and exits non-zero on `selfStopped`, with a code outside `RestartPrevent
   with its hash, as `worker/dist/index.js` and `index.js.sha256`. The default, `'asset'`, is
   unchanged.
 - `CanopyCmsService` alarms when the worker logs no git sync for 30 minutes. See
-  [Worker-down alarm](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#worker-down-alarm).
+  [Worker-down alarm](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#worker-down-alarm).
 
 **To adopt.** Optional. For parameter-only change sets, see
-[Rolling the worker from CI](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#rolling-the-worker-from-ci). For the alarm, pass
+[Rolling the worker from CI](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#rolling-the-worker-from-ci). For the alarm, pass
 `alarmTopic`.
 
 **Now deletable.** A manual `cdk deploy` after each canopycms bump whose only purpose is moving the
 worker, and a hand-built alarm on the worker log group.
 
-### `canopycms-cdk`: a `t4g.nano` worker boots reliably — **behaviour change: a deploy replaces the worker**
+#### `canopycms-cdk`: a `t4g.nano` worker boots reliably — **behaviour change: a deploy replaces the worker**
 
 **What changed.** (int.112) The boot's `dnf upgrade` could be OOM-killed on every retry. A 1 GiB
 swap file now goes on first; an upgrade that still fails starts the worker unpatched and notifies
 `alarmTopic` if set; a retried step names itself when it gives up. See
-[The worker instance](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#the-worker-instance).
+[The worker instance](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#the-worker-instance).
 
 **To adopt.** Deploy, which replaces the worker instance. The bundle needs none of this, so it is
 not Template first and the worker contract stays at 1.
 
 **Now deletable.** An instance type above `t4g.nano` chosen only to get the boot through.
 
-### `canopycms-cdk`: the worker's log is root-owned — **security fix**
+#### `canopycms-cdk`: the worker's log is root-owned — **security fix**
 
 **What changed.** (int.112) `/var/log/canopy-worker` and `worker.log` are root-owned, and the unit
 drops `LogsDirectory=`. systemd opens the log as root, following symlinks, before the sandbox
@@ -619,7 +622,7 @@ contract is unchanged. A hand-installed unit needs the same change:
 
 **Now deletable.** Nothing.
 
-### The worker never pushes the base or default branch — **security fix**
+#### The worker never pushes the base or default branch — **security fix**
 
 **What changed.** (int.112) The worker refuses to push, plainly or replacing history, to the base
 branch or GitHub's default branch, whatever a task asks, and fails the task permanently.
@@ -635,14 +638,14 @@ its bypass list. Set `CANOPYCMS_BASE_BRANCH` (the construct's `baseBranch`) expl
 it, the gateway protects only GitHub's default branch and your list; the worker still refuses the
 base it detected, warning when that base is neither.
 
-### The worker's push logs say whether GitHub moved
+#### The worker's push logs say whether GitHub moved
 
 **What changed.** (int.113) `Pushed … to GitHub` is logged only when the branch moved, saying
 where from; an unmoved branch logs at debug level. An unchanged settings branch is not pushed.
 
 **To adopt.** Nothing.
 
-### The worker hands git its GitHub credential in a per-command file — **security fix; dev behaviour change**
+#### The worker hands git its GitHub credential in a per-command file — **security fix; dev behaviour change**
 
 **What changed.** (int.113) The token leaves git URLs: each GitHub fetch and push reads it from a
 `0600` file named by `GIT_CONFIG_GLOBAL`, deleted afterwards. For those commands the file replaces
@@ -652,7 +655,7 @@ stops applying and no keychain credential is tried.
 **To adopt.** Nothing in production. In dev, move a global-config proxy or CA to `HTTPS_PROXY` or
 `GIT_SSL_CAINFO`.
 
-### The worker moves objects between GitHub and `remote.git` as bundles
+#### The worker moves objects between GitHub and `remote.git` as bundles
 
 **What changed.** (int.114) The worker moves objects between GitHub and
 `remote.git` as git bundles. A new instance's first sync fetches the whole repository from GitHub,
@@ -660,9 +663,9 @@ and operations may reuse GitHub fetches under 30 seconds old.
 
 **To adopt.** Nothing. Seeding `remote.git` stages a copy of the repository beside the gateway's
 mirror, so the root volume needs room for two
-([details](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#the-worker-instance)).
+([details](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#the-worker-instance)).
 
-### The worker follows a rebased or deleted GitHub branch
+#### The worker follows a rebased or deleted GitHub branch
 
 **What changed.** (int.114) When a branch is rebased and force-pushed on GitHub, or deleted there, the
 worker now updates or deletes its own copy of it instead of warning about it on every sync. A rebased
@@ -671,7 +674,7 @@ health lists it with what to do.
 
 **To adopt.** Nothing.
 
-### `canopycms-cdk`: a worker bundle states the template it needs — **template first for the gate only**
+#### `canopycms-cdk`: a worker bundle states the template it needs — **template first for the gate only**
 
 **What changed.** (int.112) The worker unit carries a contract version
 (`Environment=CANOPYCMS_WORKER_CONTRACT=<n>`). Parameter mode outputs it as `WorkerContract`, and
@@ -682,13 +685,13 @@ changes the template too (the fallback bundle's key and hash), so only the contr
 bundle-only roll is safe.
 
 **To adopt.** Parameter mode: gate bundle-only rolls on the contract
-([recipe](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#rolling-the-worker-from-ci)). The gate refuses a stack without the
+([recipe](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#rolling-the-worker-from-ci)). The gate refuses a stack without the
 `WorkerContract` output, so `cdk deploy` the template once, which adds it. A hand-installed unit
 copies its `Environment=CANOPYCMS_WORKER_CONTRACT=` line from `worker/canopy-worker.service`.
 
 **Now deletable.** Deciding from the template diff whether a bundle-only roll is safe.
 
-### `canopycms-cdk`: the worker holds no secret — **security fix; template first (contract 2)**
+#### `canopycms-cdk`: the worker holds no secret — **security fix; template first (contract 2)**
 
 **What changed.** (int.114) The worker runs with no network and no secret. `canopy-github`, a gateway
 service under its own user with no view of EFS, holds the GitHub credential and the Clerk key, and
@@ -699,10 +702,10 @@ units from the bundle's contract: 2 gets the split, an older bundle the single u
 template, then roll the bundle; on an older template it stops with `template too old for this
 bundle`. Inspect EFS only through `sudo /opt/canopy-worker/canopy-inspect <command>`, never from a root shell. A hand install
 takes `worker/`'s three units and `gateway.env.example`
-([steps](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#installing-the-units-by-hand)). After the first deploy, run the
-[checklist](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#first-deploy-checklist).
+([steps](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#installing-the-units-by-hand)). After the first deploy, run the
+[checklist](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#first-deploy-checklist).
 
-### `canopycms-cdk`: `CanopyCmsService.attachTo`, and editor response headers — **behaviour change if you frame the CMS**
+#### `canopycms-cdk`: `CanopyCmsService.attachTo`, and editor response headers — **behaviour change if you frame the CMS**
 
 **What changed.** (int.94) `cmsService.attachTo(distribution, { viewerRequestFunction?, behaviorOverrides? })`
 adds the editor's behaviors (`/edit`, `/edit/*`, `/api/canopycms/*`) to a distribution you already
@@ -711,7 +714,7 @@ response headers policy. `CanopyCmsDistribution` sends the same headers: `frame-
 `X-Frame-Options: SAMEORIGIN`, `nosniff`, HSTS and `X-Robots-Tag: noindex`. Unless your app sends
 its own framing headers, no other origin can frame the editor or any page the CMS domain serves. Every such page is
 marked `noindex`. The editor's default preview is same-origin and unaffected. See
-[Serving the editor from a distribution you already own](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#serving-the-editor-from-a-distribution-you-already-own).
+[Serving the editor from a distribution you already own](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#serving-the-editor-from-a-distribution-you-already-own).
 
 **To adopt.** If you wired the Function URL into your own distribution by hand, delete those
 behaviors and call `attachTo`, passing your CMS build's `assetPrefix` as `editorAssetPrefix` and a
@@ -723,12 +726,12 @@ gate, and read the synth warning if your distribution has custom error responses
 `x-forwarded-host` function made for them, and any response-headers policy added only to stop
 framing.
 
-### `unauthenticatedStatus`: answer signed-out API calls with 419
+#### `unauthenticatedStatus`: answer signed-out API calls with 419
 
 **To adopt.** (int.102) Set `unauthenticatedStatus: 419` if your pages sit behind HTTP Basic auth on
 the editor's origin; the editor still detects sign-out. Otherwise nothing.
 
-### Auth plugins look users up in batches
+#### Auth plugins look users up in batches
 
 **What changed.** (int.111) `AuthPlugin` gains an optional `getUsersMetadata(userIds)`, and the
 editor batches its user-badge lookups.
@@ -736,7 +739,7 @@ editor batches its user-badge lookups.
 **To adopt.** Nothing. A custom auth plugin may implement it; otherwise the server falls back to
 bounded single lookups.
 
-### The CMS image builds a prod editor, and a mode mismatch blocks the editor — **behaviour change: a hand-built image can fail its build**
+#### The CMS image builds a prod editor, and a mode mismatch blocks the editor — **behaviour change: a hand-built image can fail its build**
 
 **What changed.** (int.111) `Dockerfile.cms` defaults `NEXT_PUBLIC_CANOPY_MODE` to `prod`, not
 `dev`, and fails its build on any value but `prod` or `dev`. An editor built for the other mode than its
@@ -745,7 +748,7 @@ server runs now gets a blocking screen naming that variable, not a sign-in that
 **To adopt.** A hand-built image running a dev-mode server passes
 `--build-arg NEXT_PUBLIC_CANOPY_MODE=dev`.
 
-### Prod detects an unset `defaultBaseBranch` instead of assuming `main` — **behaviour change: startup can fail**
+#### Prod detects an unset `defaultBaseBranch` instead of assuming `main` — **behaviour change: startup can fail**
 
 **What changed.** (int.110) Unset, prod reads the base branch from the HEAD of the workspace's `remote.git`,
 which the worker points at the branch it uses. Before the worker creates `remote.git`, requests
@@ -759,7 +762,7 @@ does not follow a later change of GitHub's default branch, so set it before a cu
 
 **Now deletable.** A `defaultBaseBranch: 'main'` in a repository whose default branch is `main`.
 
-### The prod workspace defaults to `/mnt/efs` — **behaviour change if you run prod without `CANOPYCMS_WORKSPACE_ROOT`**
+#### The prod workspace defaults to `/mnt/efs` — **behaviour change if you run prod without `CANOPYCMS_WORKSPACE_ROOT`**
 
 **What changed.** (int.100) With `CANOPYCMS_WORKSPACE_ROOT` unset, prod mode keeps its branches,
 settings, task queue and auth cache under `/mnt/efs` instead of `/mnt/efs/workspace`
@@ -770,7 +773,7 @@ the worker, so CDK deployments are unaffected.
 `/mnt/efs/workspace` to keep your existing workspace, or move that directory's contents up to
 `/mnt/efs`.
 
-### System health shows which build is running
+#### System health shows which build is running
 
 **What changed.** (int.94) System health gains a Build section (canopycms version, source revision,
 worker version, media-storage state) and warns when API and worker versions differ.
@@ -783,7 +786,7 @@ worker version, media-storage state) and warns when API and worker versions diff
 
 **Now deletable.** Hand-rolled version or commit stamping, or a build-info endpoint.
 
-### The AWS example workflow gains the template's triggers and dependency checks
+#### The AWS example workflow gains the template's triggers and dependency checks
 
 **What changed.** (int.111) Like the one `init-deploy aws` writes, `examples/aws-deployment/deploy-cms.yml`
 now deploys on `next.config.*`, `middleware.ts` and `public/**` changes, and checks `canopycms` and
@@ -791,7 +794,7 @@ now deploys on `next.config.*`, `middleware.ts` and `public/**` changes, and che
 
 **To adopt.** If you copied it by hand, add those `paths:` and packages.
 
-### `GET /admin/branch-health` scans for duplicate content IDs only on request — **behaviour change**
+#### `GET /admin/branch-health` scans for duplicate content IDs only on request — **behaviour change**
 
 **What changed.** (int.111) The duplicate-ID scan runs only with `?duplicates=1`, under a 20 s
 budget. Each healthy entry then carries `duplicateIdScan` (`none`, `found` or `unknown`), replacing
@@ -799,7 +802,7 @@ budget. Each healthy entry then carries `duplicateIdScan` (`none`, `found` or `u
 
 **To adopt.** Scripts reading `duplicateContentIds`: pass `duplicates=1`, read `duplicateIdScan`.
 
-### `canopycms-cdk`: `AssetSupport` serves images from S3 only — **breaking**
+#### `canopycms-cdk`: `AssetSupport` serves images from S3 only — **breaking**
 
 **What changed.** (int.100) `/assets/*` and `/assets/t/*` come from the bucket alone, with an
 optional `replicaBucket` for 5xx failover. An unmaterialized URL is a 403; no transform Lambda or
@@ -816,7 +819,7 @@ opt-in and those props, and pass `replicaBucket` if you replicate `assets/`.
 
 **Now deletable.** Your `assets/t/` expiry rule, before leaving lazy mode.
 
-### `collect-asset-refs` and `materialize-assets` store a build's images before release
+#### `collect-asset-refs` and `materialize-assets` store a build's images before release
 
 **What changed.** (int.100) `canopycms collect-asset-refs <outDir>` writes the image keys a static
 build references to `<outDir>/canopy-asset-refs.json`. `canopycms materialize-assets --refs <file>`
@@ -831,7 +834,7 @@ Run `materialize-assets` before the release is served, with the S3 grants the RE
 
 **Now deletable.** A pre-release warm-up step that requests image URLs to get them transformed.
 
-### The editor and its live preview load images through the signed-in asset route
+#### The editor and its live preview load images through the signed-in asset route
 
 **What changed.** (int.100) The editor loads asset-store images from
 `GET /api/canopycms/assets/raw/…` under your `basePath`, which transforms on demand and, on S3,
@@ -848,7 +851,7 @@ same-origin or set `lazyPublicTransforms: true`.
 
 **Now deletable.** Code passing `assetBaseUrl` into the editor.
 
-### `assetUrl` applies an image value's crop — **behaviour change for cropped images**
+#### `assetUrl` applies an image value's crop — **behaviour change for cropped images**
 
 **What changed.** (int.100) `assetUrl`/`assetSrcSet` apply an `image` value's `crop`; `opts.crop`
 overrides.
@@ -857,7 +860,7 @@ overrides.
 
 **Now deletable.** Copying `value.crop` into `opts.crop`.
 
-### `media.publicBaseUrl` is removed, and image limits are wider — **breaking (config)**
+#### `media.publicBaseUrl` is removed, and image limits are wider — **breaking (config)**
 
 **What changed.** (int.100) Nothing read `media.publicBaseUrl`, and the strict `media` schema fails a
 config that sets it. Uploads go up to 24 MP (6000×4000), up from 16.7 MP. Widths are any integer up
@@ -869,9 +872,7 @@ asset URLs.
 
 **Now deletable.** Anything that only fed `publicBaseUrl`, and rounding widths to a multiple of 160.
 
-<!-- legacy:end -->
-
-### AI content can withhold or redirect a link to an entry with no page
+#### AI content can withhold or redirect a link to an entry with no page
 
 <!-- changeset: ai-reference-link-hook -->
 
@@ -889,12 +890,12 @@ one the exclusions leave out. A throw or any other return is logged and treated
 **To adopt.** If your site's routes, sitemap or bylines decide that some entries have no page,
 apply the same rule here, for example `referenceLink: (target, { body }) =>
 !body?.trim() ? false : undefined` in `defineAIContentConfig` from `canopycms/ai`. See
-[AI Content Configuration](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#ai-content-configuration).
+[AI Content Configuration](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#ai-content-configuration).
 
 **Now deletable.** A `fieldTransforms` entry that re-renders a reference field only to drop or
 change its link.
 
-### `toPlainText` takes an entry body and keeps prose after a leading `---` — **behaviour change**
+#### `toPlainText` takes an entry body and keeps prose after a leading `---` — **behaviour change**
 
 <!-- changeset: to-plain-text-body-only -->
 
@@ -918,7 +919,7 @@ import { toPlainText } from 'canopycms/ai'
 const text = toPlainText(matter(file, {}).content)
 ```
 
-### People without a name show "Name unavailable"
+#### People without a name show "Name unavailable"
 
 <!-- changeset: people-without-a-name-show-name-unavailable -->
 
@@ -926,7 +927,7 @@ _First in int.115._
 
 **What changed.** The Clerk plugin no longer uses the Clerk user id as a user's name: a user with no full name or username has an empty name, and the editor shows "Name unavailable" wherever that person appears. Core and the editor also treat a blank name, or one equal to the user id, as no name: `/users/:userId`, `/users/batch` and the `users` lists on comments and branches return an empty `name` for that person. The users snapshot the worker writes follows the same rule.
 
-### Branch access lists stay with admins and reviewers — **behaviour change**
+#### Branch access lists stay with admins and reviewers — **behaviour change**
 
 <!-- changeset: branch-access-list-withheld-from-non-privileged -->
 
@@ -938,7 +939,7 @@ access updates) sends a caller who is not an admin or reviewer only the `access.
 `withheldAccess` field. A branch card's access list shows the people the viewer can name, then
 "and N others", instead of a row of "Name unavailable" avatars.
 
-### A branch lockdown outranks the branch's access list — **security fix**
+#### A branch lockdown outranks the branch's access list — **security fix**
 
 <!-- changeset: branch-lockdown-outranks-branch-acl -->
 
@@ -954,7 +955,7 @@ the editor's Submit and Withdraw controls follow the same rule.
 branch: those editors lose access. To give it back, set `managerOrAdminAllowed` to `false` in
 that branch's `branch.json`, and the access list decides again.
 
-### The base-branch conflict notice stays until the branch merges — **behaviour change**
+#### The base-branch conflict notice stays until the branch merges — **behaviour change**
 
 <!-- changeset: conflict-notice-persists-until-merge -->
 
@@ -964,10 +965,10 @@ _First in int.115._
 entry the base branch also changed, the "updated on the base branch" notice and the branch's
 conflict count now stay until the branch merges, so a reviewer still sees which entries replaced a
 base change. They used to clear on the next sync, about five minutes later. README's new [Drafts
-and Unpublishing](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#drafts-and-unpublishing) section covers long-lived branches and
+and Unpublishing](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#drafts-and-unpublishing) section covers long-lived branches and
 unpublishing.
 
-### The editor calls the content drawer "All content"
+#### The editor calls the content drawer "All content"
 
 <!-- changeset: all-content-label -->
 
@@ -977,7 +978,7 @@ _First in int.115._
 
 **To adopt.** Nothing, unless your browser tests find either by the text "All entries".
 
-### The Branches drawer shows one action per branch, and comments reply in place
+#### The Branches drawer shows one action per branch, and comments reply in place
 
 <!-- changeset: branches-drawer-and-comment-replies -->
 
@@ -991,7 +992,7 @@ form has a "Field comments" button, so tests that find buttons by `/comment/i` m
 one; and the editor listens for Ctrl+Alt+M (⌘⌥M on macOS) on the whole document, taking it while a
 form is open.
 
-### An object's Clear offers Undo, and refusals say why
+#### An object's Clear offers Undo, and refusals say why
 
 <!-- changeset: clear-undo-and-clearer-refusals -->
 
@@ -1006,7 +1007,7 @@ conflict in yellow; the API marks it with the new error code `SETTINGS_CHANGED`.
 `sanitizeHref` returns its fallback for `undefined` or `null`, which a live preview's draft can
 pass for a link field it doesn't hold yet, instead of throwing.
 
-### The collection dialog says what saves at once
+#### The collection dialog says what saves at once
 
 <!-- changeset: collection-dialog-says-what-saves -->
 
@@ -1019,7 +1020,7 @@ inline instead of as toasts.
 
 **To adopt.** Nothing, unless browser tests click the old buttons or wait for those toasts.
 
-### Comments and branches name their people for every editor — **behaviour change on two APIs**
+#### Comments and branches name their people for every editor — **behaviour change on two APIs**
 
 <!-- changeset: comments-and-branches-name-their-people -->
 
@@ -1032,7 +1033,7 @@ Your auth plugin answers through the `/users/batch` cache; a failed lookup leave
 
 **To adopt.** Nothing, unless you call either API yourself: read `data.users`.
 
-### A date picker, a form header, and a toolbar that wraps
+#### A date picker, a form header, and a toolbar that wraps
 
 <!-- changeset: date-picker-form-header-wrapping-toolbar -->
 
@@ -1046,7 +1047,7 @@ editor styles.
 
 **To adopt.** Nothing. Browser tests that typed into a `datetime-local` input pick a date instead.
 
-### Editor colours reach 4.5:1 in light and dark mode
+#### Editor colours reach 4.5:1 in light and dark mode
 
 <!-- changeset: editor-colours-reach-contrast-in-both-schemes -->
 
@@ -1068,7 +1069,7 @@ defaults.
 **Now deletable.** Local overrides that darkened light buttons, badges, placeholders or input
 borders for contrast.
 
-### Editor contrast, and blocked buttons stay focusable
+#### Editor contrast, and blocked buttons stay focusable
 
 <!-- changeset: editor-contrast-and-focusable-blocked-buttons -->
 
@@ -1087,7 +1088,7 @@ old "Reload File" or "Discard File Draft" use the new labels.
 
 **Now deletable.** Local overrides that darkened the same text or buttons.
 
-### Editor focus rings and checked controls reach 3:1 for any brand
+#### Editor focus rings and checked controls reach 3:1 for any brand
 
 <!-- changeset: editor-focus-ring-and-control-contrast -->
 
@@ -1106,7 +1107,7 @@ their tint instead of the primary colour, and Markdown popups have a border in d
 text, such as the System Health panel's "corrupt metadata", now "Corrupt metadata". A
 `themeOverride` that sets `primaryShade` moves where the ring starts.
 
-### Editor requests time out instead of hanging
+#### Editor requests time out instead of hanging
 
 <!-- changeset: editor-requests-time-out -->
 
@@ -1122,7 +1123,7 @@ write in flight says why.
 **To adopt.** Nothing, unless browser tests hold an API response for longer than a deadline to
 observe a busy state; keep such holds under it.
 
-### Field editing: descriptions, list-card titles, and public/ images, continued
+#### Field editing: descriptions, list-card titles, and public/ images, continued
 
 <!-- changeset: list-card-titles-and-block-descriptions -->
 
@@ -1135,7 +1136,7 @@ takes its title from its first non-blank `string` field, then "Item N" (or its `
 "Team member N"). A block template's `description` now renders; see
 [List items and blocks collapse](#list-items-and-blocks-collapse-and-reorder-from-one-menu).
 
-### List items and blocks collapse, and reorder from one menu
+#### List items and blocks collapse, and reorder from one menu
 
 <!-- changeset: list-items-and-blocks-collapse -->
 
@@ -1152,7 +1153,7 @@ a second value) or "Add section".
 
 **Now deletable.** Template labels that repeated the template's description.
 
-### "Add entry" follows path permissions; admin panels and labels tidied
+#### "Add entry" follows path permissions; admin panels and labels tidied
 
 <!-- changeset: navigator-add-follows-path-access-and-ux-batch2-rest -->
 
@@ -1167,7 +1168,7 @@ labels such as "All entries", "Manage permissions" and "Create group" are now in
 Discarding an entry's changes toasts only for a read-only branch's hidden draft, where the form shows
 no change.
 
-### Quick open, a navigator filter, title-first new entries, and media search
+#### Quick open, a navigator filter, title-first new entries, and media search
 
 <!-- changeset: quick-open-navigator-filter-media-search -->
 
@@ -1183,7 +1184,7 @@ library searches, sorts and filters all its files, in a grid or a list.
 **To adopt.** Nothing, unless browser tests add an entry by typing only a slug: fill in "Title"
 too when the entry type has one.
 
-### A save never brings back a deleted or moved entry — **behaviour change**
+#### A save never brings back a deleted or moved entry — **behaviour change**
 
 <!-- changeset: save-never-recreates-deleted-entry -->
 
@@ -1196,7 +1197,7 @@ its new name with the changes still in the form, ready to save again. For a dele
 the changes and offers "Save as new entry", a deliberate create. This also covers an editor's own
 delete or rename that got no answer. Creating an entry is unchanged.
 
-### Submit names unsaved entries; unanswered writes recover more
+#### Submit names unsaved entries; unanswered writes recover more
 
 <!-- changeset: submit-warns-unsaved-and-unanswered-writes-recover -->
 
@@ -1212,7 +1213,7 @@ out). The save-outcome toasts name their
 entry. A lookup sent as a POST that times out says to try again. Removing a staged entry type
 from a new collection goes at once, with Undo in the dialog.
 
-### Unlabelled fields and block templates show their names as words
+#### Unlabelled fields and block templates show their names as words
 
 <!-- changeset: unlabelled-fields-read-as-words -->
 
@@ -1225,7 +1226,7 @@ block picker and the Remove toast.
 **To adopt.** Nothing, unless your browser tests find such a field by its raw name. Give it a
 `label` to choose the words yourself.
 
-### Stable releases follow the changes they carry, and ship their changelog
+#### Stable releases follow the changes they carry, and ship their changelog
 
 <!-- changeset: stable-releases-from-changesets -->
 
@@ -1238,7 +1239,7 @@ as int builds already do.
 
 **To adopt.** Nothing. With `0.1.0` and later, a `^0.1.0` range takes patches without action.
 
-### List items and blocks carry a `_key`, and field comments follow it — **behaviour change**
+#### List items and blocks carry a `_key`, and field comments follow it — **behaviour change**
 
 <!-- changeset: list-items-and-blocks-carry-keys -->
 
@@ -1261,7 +1262,7 @@ a `validateEntry` hook included, checks content against a strict schema, allow `
 items and blocks. Don't spread a list item onto a DOM element (`<li {...item}>`), or it renders
 a `_key` attribute. `_key` also suits React's `key` when rendering a list.
 
-### `stampOnPublish` dates a new entry at its first submit
+#### `stampOnPublish` dates a new entry at its first submit
 
 <!-- changeset: datetime-stamp-on-publish -->
 
@@ -1276,13 +1277,151 @@ editor carries an unsaved draft of a stamped entry onto its stamped version.
 The flag is refused off a top-level `datetime`, on `list: true`, and with `required: true`.
 
 **To adopt.** Add `stampOnPublish: true` to the date field your site sorts or labels by, such as
-`{ name: 'publishedAt', type: 'datetime', stampOnPublish: true }`. See [Stamping a publication date](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#stamping-a-publication-date).
+`{ name: 'publishedAt', type: 'datetime', stampOnPublish: true }`. See [Stamping a publication date](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#stamping-a-publication-date).
 
 **Now deletable.** A build step or hook that writes a missing publication date into new entries.
 
----
+#### A left activity rail and a docked content panel
 
-## Released
+<!-- changeset: editor-activity-rail -->
+
+_First in 0.1.0._
+
+**What changed.** A rail down the editor's left edge opens the content panel, quick open, the
+Branches and Comments drawers and the media library, with Settings and the account control at its
+foot. Comments open from the rail only, with the unresolved count on the button, and the media
+library has its own button instead of a Settings menu item. In a wide side-by-side window the
+content panel docks beside the preview and stays open as you move between entries. Its width and
+whether it is open survive a reload. Narrower than 1024px, or stacked, it lays over the form
+only, so the preview stays in view. Below 1024px the editor also starts stacked until you choose
+a layout. Notifications moved to the bottom-right corner, opposite the rail.
+
+#### `editor.subtitle` removed; the tab names the open entry — **breaking (`editor.subtitle` removed)**
+
+<!-- changeset: editor-subtitle-removed-tab-title -->
+
+_First in 0.1.0._
+
+**What changed.** `editor.subtitle` is no longer a config option, and `Editor` no longer takes
+`subtitle` or `siteSubtitle`: nothing has shown them since the top bar replaced the old header.
+While the editor is mounted, the browser tab reads "Entry label · Site title", or the site title
+with no entry open, and your page's own title comes back when it unmounts, unless a page navigated to has set its own.
+
+**To adopt.** Delete `editor.subtitle` from your config; it was no longer shown.
+
+#### The editor takes over the window — **breaking (`EditorPanes` export removed)**
+
+<!-- changeset: editor-takes-over-the-window -->
+
+_First in 0.1.0._
+
+**What changed.** The editor renders as one full-window layer above your page, so a header or
+footer your root layout renders no longer pushes it down or makes the page scroll. While it is
+mounted, its sign-in and loading screens included, your layout's elements are hidden and out of
+the Tab order, and the page does not scroll; unmount restores them. The footer is gone: the version and an "About CanopyCMS" link are
+in the Settings menu. The two read-only banners sit in their own row under the header. The
+preview/form divider is now keyboard-resizable within the same 15–85% the split was always
+stored at, and `react-split-pane` is no longer a dependency.
+`EditorPanes`, `EditorPanesProps`, the `PaneLayout` type and the `SPLIT_PERCENT_*` and `DEFAULT_*_SPLIT_PERCENT` constants are
+no longer exported from `canopycms/client`. See
+[Your root layout](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#editor-customization).
+
+**To adopt.** Nothing, unless you import `EditorPanes` or those constants: render `CanopyEditor`
+instead, which lays out its own panes. Hiding your site chrome on the editor route is now
+optional, but keeping analytics and global fetches out of it is still worthwhile.
+
+**Now deletable.** A wrapper that drops the site header and footer on the editor route only to
+stop them shifting the editor.
+
+#### The editor's top bar, with Save all — **behaviour change**
+
+<!-- changeset: editor-top-bar-and-save-all -->
+
+_First in 0.1.0._
+
+**What changed.** The editor's header is a 48px top bar. Its breadcrumb's crumbs navigate: "All
+content" opens the content panel, and a collection crumb opens it on that collection. The open
+entry's crumb holds the entry menu, whose "Reload entry" is now "Refresh from server". A
+"Read-only" chip says why the entry or branch takes no edits. The branch pill shows the branch,
+its status and how many entries are unsaved, and its menu lists them; its "Reload all entries" is
+now "Refresh branch" and re-reads the entry list too. Beside Save, a caret offers "Save all", which
+saves every unsaved entry on the branch and names any it could not save, with the reason, keeping
+their changes. The site title and `editor.subtitle` no longer appear in the header; the rail's
+monogram carries the site title. Below 62em the breadcrumb takes its own row and the actions wrap, so no control is clipped. A content save refused because the
+branch is mid-rebase now carries `code: 'BRANCH_SYNCING'`.
+
+**To adopt.** Nothing, unless your browser tests find the header by its old text: "Reload entry",
+"Reload all entries", "Recently modified", "No entry selected", or the file menu's "All content"
+item, which the breadcrumb's "All content" replaces.
+
+#### Rename and delete from the entry menu; Save says "Saved" itself — **behaviour change**
+
+<!-- changeset: entry-menu-rename-delete-inline-saved -->
+
+_First in 0.1.0._
+
+**What changed.** The open entry's menu, on its name in the top bar, offers "Rename…" and
+"Delete entry", through the same dialogs as the content panel's. On a locked branch both stay in
+the menu, blocked, with the reason; for an entry a path rule refuses they are hidden, as in the
+content panel. A Save reads "Saving…" on the button, then "Saved" for two seconds, announced to
+screen readers, instead of a green "Saved" toast; on a phone the button shows a spinner, then a
+check. Failures still show their toast or alert, and Save all its result. Save is the top bar's
+one filled button; "Submit for review" and "Withdraw from review" are tinted. From either menu,
+deleting the open entry leaves no entry open instead of opening the first, and renaming it keeps
+it open under its new name. The delete dialog names the entry.
+
+**To adopt.** Nothing, unless your browser tests wait for a "Saved" toast after Save: wait for the
+save request's response, or for the Save button to read "Saved".
+
+#### The preview has a toolbar with device widths, reload and the saved version
+
+<!-- changeset: preview-toolbar -->
+
+_First in 0.1.0._
+
+**What changed.** A toolbar above the editor's preview shows the page's path on your site
+(without `editor.previewPrefix` or `?branch=`), which copies on click. Its width selector
+renders the page at Fit, Desktop (1280 px), Tablet (768 px) or Mobile (390 px): the iframe takes
+exactly that CSS width, so your site's own breakpoints apply, scaled down when the pane is
+narrower. The choice persists per browser. Reload reloads the preview, the same action as the
+"Live updates off" Retry. "Open saved version" opens the page's `?branch=` URL in a new tab,
+which shows the branch's last saved state, without unsaved edits. A preview error now sits
+between the toolbar and the page instead of over it, naming the field by its labels. A custom
+`renderPreview` gets no toolbar. `PreviewFrame` takes two new optional props, `iframeStyle` and
+`onReload`.
+
+#### The preview toolbar holds the highlight toggle and maximizes the preview; the layout toggle moves to the rail
+
+<!-- changeset: preview-toolbar-controls -->
+
+_First in 0.1.0._
+
+**What changed.** The highlight toggle moves from the strip at the editor's right edge into the
+preview toolbar, and the layout toggle into the rail, above Settings, so it works with any
+preview or none; the strip is gone. The layout button shows the current layout and switches to
+the other; while the preview is maximized it says to restore the preview first. Layout, preview
+width and highlights persist per browser. Maximize lays the preview over the preview and form
+area, without reloading it, and drafts keep reaching it. Restore brings the form back, and so
+does Esc unless focus is inside the page. Anything that needs the form restores it too: a click
+on a highlighted element, which scrolls to its field, opening the content panel over the form,
+or a save refused for field errors. Dragging the divider between preview and form shows the
+preview's width over it, and resizing the panes, by drag or key, switches the width to Fit.
+Admins with highlights on see an "N unmapped" chip when the page marks fields that don't exist
+in the entry. It explains what that means and points to the browser console, which names the
+nearest field of each. Editors see no such diagnostics. A custom `renderPreview`, and an entry
+with no preview page, get no toolbar.
+
+#### Linear-time mount paths and push refusals, and a fixed message for non-Error gateway failures — **security fix**
+
+<!-- changeset: codeql-release-alerts -->
+
+_First in 0.1.0._
+
+**What changed.** The AI export trims slashes from `AIContentConfig.mountPath`, and the worker
+and its GitHub gateway recognise GitHub's refusal of a workflow push, in time linear in their
+length; a long run of slashes or a repeated phrase took seconds before. When the gateway fails with
+a thrown value that is not an `Error`, the worker gets a fixed message and the gateway's log gets
+the value, scrubbed and capped, since it could hold a stack.
 
 ### 0.0.67
 
@@ -1296,7 +1435,7 @@ never ended. `canopycms-auth-clerk` skips it while the editor is mounted, and ex
 **To adopt.** Nothing for the editor, if your edit page uses `useClerkAuthConfig()` or
 `ClerkSignIn`. If your CMS build renders `<SignIn>`, `UserButton` or `OrganizationSwitcher` on your
 own pages, mount the hook as in
-[Clerk components on your own pages](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/packages/canopycms-auth-clerk/README.md#clerk-components-on-your-own-pages).
+[Clerk components on your own pages](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/packages/canopycms-auth-clerk/README.md#clerk-components-on-your-own-pages).
 Your own Server Actions in the CMS build still 403 behind OAC.
 
 **Now deletable.** Any local patch of `window.__internal_onBeforeSetActive` (or 6.x's
@@ -1337,12 +1476,12 @@ fast naming the ARN, the field and the keys present, never a value.
 **To adopt.** Nothing, unless one of those secrets holds a JSON document: then set the matching
 prop. The scaffolded stack fills them from the repository _variables_
 `CANOPY_GITHUB_TOKEN_SECRET_JSON_FIELD` and `CLERK_SECRET_KEY_SECRET_JSON_FIELD`
-([why the prefix](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#repository-secrets-and-variables)); a stack scaffolded earlier
+([why the prefix](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#repository-secrets-and-variables)); a stack scaffolded earlier
 adds the props to `infrastructure/bin/app.ts` and `infrastructure/lib/cms-stack.ts` and the two `env`
 lines to `.github/workflows/deploy-cms.yml`, or re-runs the generator and diffs. `cdk synth` refuses a `…JsonField` prop without its `…SecretArn`, and an ARN carrying the ECS `:KEY::` suffix
 (also in `secretsArns`). Don't use CDK's `secretValueFromJson`: it resolves the plaintext into the deployed
 resource's configuration, readable by anyone who can describe it. Only `CLERK_SECRET_KEY` goes through Secrets Manager; `CLERK_JWT_KEY` and the publishable
-key are public material ([Security Model](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#security-model)).
+key are public material ([Security Model](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#security-model)).
 
 **Now deletable.** A wrapper that fetches the secret, parses it and re-exports one field into the
 worker's environment, such as a `jq` step in user data or a wrapper entrypoint around
@@ -1354,7 +1493,7 @@ worker's environment, such as a `jq` step in user data or a wrapper entrypoint a
 `githubToken` is not deprecated and stays the documented default; `canopycms` neither depends on
 nor imports `@octokit/auth-app`. Register one App per site, not one shared across repositories:
 anyone holding an App's key can mint a token for any of its installations
-([why](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/ARCHITECTURE.md#why-one-github-app-per-site-not-one-shared-across-an-organisation)).
+([why](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/ARCHITECTURE.md#why-one-github-app-per-site-not-one-shared-across-an-organisation)).
 
 **To adopt with `canopycms-cdk`** (existing stacks need no edit). `CanopyCmsServiceProps` takes
 `githubAppId`, `githubAppInstallationId`, `githubAppPrivateKeySecretArn` and
@@ -1367,7 +1506,7 @@ anyone holding an App's key can mint a token for any of its installations
    `verify` checks an existing installation's permissions: run it, since an App missing a
    permission only shows up later, as `sync-failed`. `create` needs an interactive terminal and
    never edits an existing JSON secret (create one and point the JSON-field prop at it)
-   ([details](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#register-it-with-canopycms-init-github-app)).
+   ([details](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#register-it-with-canopycms-init-github-app)).
 2. Set the three props and **remove `githubTokenSecretArn`** (with its JSON field). A partial set
    of the three is refused at synth, and so is an App alongside a token.
 3. In the generated workflow, store them as `CANOPY_GITHUB_APP_ID`,
@@ -1378,7 +1517,7 @@ anyone holding an App's key can mint a token for any of its installations
 
 The private key is ARN-only; passing the key itself is refused at synth. Its ARN joins the worker's
 IAM policy automatically, so you need not add it to `secretsArns`. See
-[Authenticating as a GitHub App](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#authenticating-as-a-github-app).
+[Authenticating as a GitHub App](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#authenticating-as-a-github-app).
 
 ```bash
 canopycms init-github-app create -- \
@@ -1426,7 +1565,7 @@ downloads the `.pem` from the App's settings page.
 
 **What changed.** The worker re-reads a Secrets Manager secret (the GitHub token or the Clerk secret
 key) when the operation using it fails. Timings, costs and the store-before-revoke order are in
-[Rotating a secret](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#rotating-a-secret).
+[Rotating a secret](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#rotating-a-secret).
 
 **To adopt.** Nothing for credentials from `*_SECRET_ARN`, which is every scaffolded deployment. A
 GitHub App private key is still read only at boot: store the new key, replace the instance, and
@@ -1480,12 +1619,12 @@ also check the bucket policy for its grant.
 5. `withCanopy()` adds sharp's libvips to Next's file tracing (not for a static export) and, on
    Next 16 and later, sets `turbopack: {}` when your config has neither `turbopack` nor your own
    `webpack` and it can read your Next version. A webpack build still fails its image transforms
-   ([Dual Build Support](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#dual-build-support)).
+   ([Dual Build Support](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#dual-build-support)).
 
 **Breaking:** a stack setting `platform` on `fromImageAsset` without `architecture` gets an arm64
 function while `platform` still decides the image, so `Platform.LINUX_AMD64` builds an image the
 function cannot run. A stack setting neither moves to arm64 with a matching image, built under QEMU
-on an x86 host ([Where the image is built](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#where-the-image-is-built)).
+on an x86 host ([Where the image is built](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#where-the-image-is-built)).
 
 **To adopt.**
 
@@ -1514,7 +1653,7 @@ reason; `platform` on `fromImageAsset`; and, with `withCanopy()`, a hand-written
 
 **What changed.** `media.uploadUrl` (s3 adapter; an absolute http(s) URL or a site-relative path)
 replaces the `url` that `beginUpload()` returns, leaving the presign's `fields` untouched, so
-uploads can be same-origin. See [Media Configuration](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#media-configuration) for the
+uploads can be same-origin. See [Media Configuration](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#media-configuration) for the
 CloudFront behavior it expects.
 
 **To adopt.** Optional. Set it from an environment variable: a site-relative value works only where
@@ -1539,7 +1678,7 @@ needs `lazyPublicTransforms: true`) let you pass a deterministically named role,
 bucket's stack computes `arn:aws:iam::<account>:role/<name>` from literals instead of a
 `Fn::GetStackOutput` reference only the CDK CLI resolves. The constructs re-attach
 `AWSLambdaBasicExecutionRole` (and the VPC policy) that `lambda.Function` drops from a role you
-pass. See [Cross-account asset bucket](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#cross-account-asset-bucket).
+pass. See [Cross-account asset bucket](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#cross-account-asset-bucket).
 
 **To adopt.** Optional:
 
@@ -1649,7 +1788,7 @@ public JWKS PEM, used only to verify signatures.
 to variables (Settings → Secrets and variables → Actions → Variables); `bin/app.ts` refuses the
 deploy at synth while it is unset. Check that `bin/app.ts` passes `CLERK_SECRET_KEY` as
 `clerkSecretKeySecretArn` (read by the worker), never in the Lambda's `environment`, unless you keep
-`clerkMiddleware` ([Security Model](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/docs/deploying-to-aws.md#security-model)).
+`clerkMiddleware` ([Security Model](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/docs/deploying-to-aws.md#security-model)).
 
 #### `readByUrlPath` answers only where `listEntries` publishes — **breaking (routing)**
 
@@ -1748,7 +1887,7 @@ basePath: process.env.NEXT_PUBLIC_BASE_PATH,
 Then pass `baseUrl` to `assetUrl` only if Next serves `/assets` (local adapter, `next dev`, S3 with
 no distribution): `assetUrl(image, { width: 960, baseUrl: BASE_PATH })`. Assets on CloudFront via
 `AssetSupport` stay at the distribution root; pass no `baseUrl` (mount table under "Where `/assets`
-is mounted" in [Media Configuration](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#media-configuration)). Two traps:
+is mounted" in [Media Configuration](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#media-configuration)). Two traps:
 
 - Don't pass a deployment `basePath` to `contentStaticParams({ basePath })`; that option filters by
   a nested route prefix and emits zero params, building green.
@@ -1907,7 +2046,7 @@ Under `exactOptionalPropertyTypes: true`, omit keys instead of assigning `undefi
 `withTrailingSlash` and `isAbsoluteUrl` from `canopycms/server`; `defineSeoFieldGroup()` from
 `canopycms`; `generateContentSitemap` and `entryToMetadata` from `canopycms-next`, bound on
 `createNextCanopyContext`'s result. See
-[Sitemap and SEO Metadata](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#sitemap-and-seo-metadata). Every routable entry type is in
+[Sitemap and SEO Metadata](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#sitemap-and-seo-metadata). Every routable entry type is in
 the sitemap unless `exclude`d or `noindex`; one `noindex` predicate drives both robots metadata and
 sitemap exclusion. `trailingSlash` is never inferred. `lastModified` defaults to `updatedAt`, a
 filesystem mtime. An empty SEO field counts as unset. `siteUrl` must be absolute, colliding URLs are
@@ -1964,7 +2103,7 @@ underscore-prefixed files are skipped.
 
 **What changed.** New scaffolds write `defaultBranchAccess: 'deny'` and
 `defaultPathAccess: { read: 'allow' }`
-([Public read on server deployments](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#public-read-on-server-deployments)).
+([Public read on server deployments](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#public-read-on-server-deployments)).
 
 **To adopt.** An older scaffold's `defaultBranchAccess: 'allow'` is wider than recommended;
 consider `'deny'`. If you deleted `defaultPathAccess: { read: 'allow' }`, anonymous visitors get no content until you
@@ -2017,7 +2156,7 @@ re-checked an entry's type (a `switch` on `meta.entryType` can merge them into o
 **What changed.** `BlockComponentRegistry<Blocks>` (types only, from `canopycms`; `BlockValueOf<Blocks, 'hero'>`
 gives one template's value type) requires exactly
 one component per block template name when written as an object literal. See
-[Block Component Registries](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#block-component-registries) and
+[Block Component Registries](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#block-component-registries) and
 `apps/example1/app/components/PostView.tsx`.
 
 ```ts
@@ -2039,7 +2178,7 @@ templates against the schema.
 
 **What changed.** Spreading a `const` field array into several schemas, and nesting
 `defineInlineFieldGroup()` inside a block template, are documented
-([Reusable Field Fragments](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#reusable-field-fragments)); `defineFieldFragment()` is an
+([Reusable Field Fragments](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#reusable-field-fragments)); `defineFieldFragment()` is an
 identity helper for them.
 
 ```ts
@@ -2058,7 +2197,7 @@ field by composing from the same `const` field object.
 A block template holding a `reference` field is a shared block; `read()`/`readByUrlPath()` resolve
 it, and listings do with
 [`resolveReferences`](#listings-resolve-references-and-a-resolved-reference-carries-urlpath-and-optionally-its-body-16--breaking-type-level)
-(0.0.64). See [Shared / Referenced Blocks](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#shared--referenced-blocks).
+(0.0.64). See [Shared / Referenced Blocks](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#shared--referenced-blocks).
 
 **Now deletable.** A second `read()` in page code to unwrap a shared block's reference.
 
@@ -2080,7 +2219,7 @@ Not retro-documented, apart from these:
 
 #### The registry is keyed by entry-type name (0.0.42)
 
-**What changed.** `createEntrySchemaRegistry` keys are the entry-type names that `.collection.json` files name in `entry.schema`, and `EntryTypesFromRegistry` derives the typed entry-type map from them. Schema-variable keys (`{ postSchema }`) still work but derive nothing; [README's registry convention](https://github.com/safeinsights/canopycms/blob/f8b50b30170954bf52fb670afe6796d2cb8fa275/README.md#convention-why-key-the-registry-by-entry-type-name) says when to keep them.
+**What changed.** `createEntrySchemaRegistry` keys are the entry-type names that `.collection.json` files name in `entry.schema`, and `EntryTypesFromRegistry` derives the typed entry-type map from them. Schema-variable keys (`{ postSchema }`) still work but derive nothing; [README's registry convention](https://github.com/safeinsights/canopycms/blob/35953fbf6f9e0e0bb8181ed89c3ade8cd14db72a/README.md#convention-why-key-the-registry-by-entry-type-name) says when to keep them.
 
 **To adopt.**