canopycms 0.2.0-int.121 → 0.2.0

package/CHANGELOG.md

@@ -5,18 +5,9 @@ packages release together, at one version.
 
 ## This build
 
-Version `0.2.0-int.121`, built from [`0a53107`](https://github.com/safeinsights/canopycms/tree/0a53107eda329ce0499edad3544a16fb130b5beb).
+Version `0.2.0`, built from [`ecd004a`](https://github.com/safeinsights/canopycms/tree/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463).
 
-### New since int.119
-
-- [Media-library thumbnails are stored at upload and cached by the browser — behaviour change](#media-library-thumbnails-are-stored-at-upload-and-cached-by-the-browser--behaviour-change)
-- [Image fields are bordered cards, and Crop explains itself and works without aspect](#image-fields-are-bordered-cards-and-crop-explains-itself-and-works-without-aspect)
-- [A locked branch shows a lock where a row's "…" menu would be](#a-locked-branch-shows-a-lock-where-a-rows--menu-would-be)
-- [Links clicked in the preview open their entry instead of leaving the editor — behaviour change](#links-clicked-in-the-preview-open-their-entry-instead-of-leaving-the-editor--behaviour-change)
-
-### Revised since int.119
-
-- [Removing a file from the media library hides it, and an admin can restore it — breaking (assets.delete, AssetStore) / behaviour change; template first](#removing-a-file-from-the-media-library-hides-it-and-an-admin-can-restore-it--breaking-assetsdelete-assetstore--behaviour-change-template-first)
+Its entries are [0.2.0](#020), under **Released**.
 
 If you upgraded from a build on another branch, compare the `<!-- changeset: … -->` slugs in your previous build's `CHANGELOG.md` (`npm pack canopycms@<old>` fetches it) with this one's: entries whose slug your old file lacks are new to you.
 
@@ -33,7 +24,7 @@ Each entry has up to three parts:
 `node_modules/canopycms/CHANGELOG.md`, assembled for that build: its **This build** section lists
 what is new since the previous int on the same branch, or on a stable release links its entries, and its links point at the commit the build
 came from. The copy in the repository holds released history and the entries from before changesets;
-every entry written since is a file in [`.changeset/`](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/.changeset/README.md) until a stable release
+every entry written since is a file in [`.changeset/`](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/.changeset/README.md) until a stable release
 moves it here.
 
 **Find your starting point.** From a stable pin, start at the first version under **Released**
@@ -67,21 +58,13 @@ Nothing in this section is edited by hand: each entry is a `.changeset/` file, w
 assembles here and labels with the first int that carries it, and a stable release moves the
 entries under **Released**.
 
-| int | Area | Change | Action |
-| --- | --- | --- | --- |
-| 119 | Assets | [Library removal hides the file; deploy grants before the image](#removing-a-file-from-the-media-library-hides-it-and-an-admin-can-restore-it--breaking-assetsdelete-assetstore--behaviour-change-template-first) | Template first |
-| 119 | Editing | [Content panel docks when stacked; overlay slides; matched dividers](#stacked-layout-docks-the-content-panel-beside-the-form) | None |
-| 119 | Editing | [Editor opens the home page; singletons named by type](#the-editor-opens-the-home-page-and-names-single-entry-types-by-their-type--behaviour-change) | None |
-| 119 | Editing | [Drawers share the content panel's compact header](#compact-drawer-headers-jumpable-comment-headings-and-a-steadier-owner-chip) | None |
-| 119 | Editing | [Object Clear in a "…" menu; Undo stays inline](#an-objects-clear-moves-into-its--menu-with-an-inline-undo) | Editor UI tests |
-| 119 | Editing | [Top bar: one unsaved dot, no "Editing" label](#the-top-bar-shows-one-unsaved-mark-and-a-status-only-when-it-matters--behaviour-change) | None |
-| 119 | Preview | [createPreviewPage takes a layout for the site header and footer](#previews-can-show-the-site-header-and-footer-and-the-preview-stays-put-between-entries) | Optional |
-| 121 | Assets | [Editor thumbnails stored at upload; raw-route redirects cacheable](#media-library-thumbnails-are-stored-at-upload-and-cached-by-the-browser--behaviour-change) | None |
-| 121 | Editing | [Image field card; Crop disabled with reason; free-form crop](#image-fields-are-bordered-cards-and-crop-explains-itself-and-works-without-aspect) | None |
-| 121 | Editing | [Locked branch: tree rows show a lock](#a-locked-branch-shows-a-lock-where-a-rows--menu-would-be) | None |
-| 121 | Preview | [Preview links open their entry; others open a new tab](#links-clicked-in-the-preview-open-their-entry-instead-of-leaving-the-editor--behaviour-change) | None |
-
-### Removing a file from the media library hides it, and an admin can restore it — **breaking (assets.delete, AssetStore) / behaviour change; template first**
+---
+
+## Released
+
+### 0.2.0
+
+#### Removing a file from the media library hides it, and an admin can restore it — **breaking (assets.delete, AssetStore) / behaviour change; template first**
 
 <!-- changeset: ef-g-media -->
 
@@ -110,7 +93,7 @@ the media library and restore a file, and uploading the same file again restores
 - Files removed before this release lost their metadata. Uploading the same bytes again recreates
   it, recorded under the re-uploader's name.
 
-### Stacked layout docks the content panel beside the form
+#### Stacked layout docks the content panel beside the form
 
 <!-- changeset: ef-a-shell -->
 
@@ -118,7 +101,7 @@ _First in int.119._
 
 **What changed.** In a wide window the content panel docks beside the form row in the stacked layout too, keeping the preview full width; in a narrow window it slides in over the form, unless the user prefers reduced motion. Both pane dividers share one width, and a branch banner has a line beneath it.
 
-### The editor opens the home page and names single-entry types by their type — **behaviour change**
+#### The editor opens the home page and names single-entry types by their type — **behaviour change**
 
 <!-- changeset: ef-b-identity -->
 
@@ -126,7 +109,7 @@ _First in int.119._
 
 **What changed.** With no entry in the URL, the editor opens the entry routed at `/`, else the first with a preview. An entry type limited to one entry (`maxItems: 1`) with a label is named by that label, though entry links and search still use its title. Content tree rows show the type on a second line, quick open shows type and route, "Rename…" is "Change URL…" ("Change slug…" for an entry with no page), and the "All content" crumb, the form header's title and the rail's site button are gone.
 
-### Compact drawer headers, jumpable comment headings and a steadier owner chip
+#### Compact drawer headers, jumpable comment headings and a steadier owner chip
 
 <!-- changeset: ef-c-drawers -->
 
@@ -134,7 +117,7 @@ _First in int.119._
 
 **What changed.** The Branches, Comments, Media and staged-changes drawers take the content panel's compact header with no subtitle. In the Comments drawer, each thread's heading is the one control that jumps to it. The Branches drawer no longer offers "New branch comment" or "+ New", since new branch comments start in the Comments drawer. A person's chip keeps its avatar and a long name on one line.
 
-### An object's Clear moves into its "…" menu, with an inline Undo
+#### An object's Clear moves into its "…" menu, with an inline Undo
 
 <!-- changeset: ef-d-clear -->
 
@@ -150,7 +133,7 @@ theirs. Their Undo, and the inline one, now survive edits to other items in an e
 **To adopt.** A UI test that clicked an object's "Clear" button now opens the object's
 "Actions for …" menu and chooses the "Clear" item, then finds "Undo clear" in the label row instead of a toast.
 
-### The top bar shows one unsaved mark and a status only when it matters — **behaviour change**
+#### The top bar shows one unsaved mark and a status only when it matters — **behaviour change**
 
 <!-- changeset: ef-f-topbar -->
 
@@ -158,7 +141,7 @@ _First in int.119._
 
 **What changed.** The branch pill's unsaved count is the same dot as the entry's, with a number, in the brand colour the content tree also uses. "Unsaved · kept on this device" moved into Save's tooltip and description; the bar shows it only as a warning when drafts could not be stored. The pill drops the default "Editing" status and shows In review, Approved, Archived or Protected. The "Read-only" chip no longer repeats a branch-wide lock the banner already explains; it stays for an entry read-only for its own reason.
 
-### Previews can show the site header and footer, and the preview stays put between entries
+#### Previews can show the site header and footer, and the preview stays put between entries
 
 <!-- changeset: ef-e-preview -->
 
@@ -178,15 +161,17 @@ export default createPreviewPage({
 
 A preview page built on `useCanopyPreview` alone can pass `siteChrome: true` when it renders the header and footer for `?chrome=1`.
 
-### Media-library thumbnails are stored at upload and cached by the browser — **behaviour change**
+#### Media-library thumbnails are stored at upload and cached by the browser — **breaking (AssetStore.presignPublicObjectRead) / behaviour change**
 
 <!-- changeset: editor-thumbnails-cached -->
 
 _First in int.121._
 
-**What changed.** Finalizing a raster upload also stores the three widths the editor shows it at (`assets/t/w=80`, `w=160`, `w=320`), so the media library's first view reads stored objects instead of transforming in the request. Uploading a file that already exists stores any of those widths it lacks. Animated images are skipped, since re-encoding every frame would hold the upload too long; their first view transforms them as before. This adds roughly 0.1 s to a typical photo's upload and up to about 0.6 s for a 24-megapixel PNG, measured locally; a failure is logged and never fails the upload. On S3, the authenticated asset route's redirect to a presigned URL is now `private, max-age` until the end of the hour rather than `no-store`, and the URL stays the same for that hour, so reopening the media library fetches no thumbnails. A cached redirect can outlive a sign-out by at most that hour; it points only at a public-prefix object under an unguessable key.
+**What changed.** Finalizing a raster upload also stores the three widths the editor shows it at (`assets/t/w=80`, `w=160`, `w=320`), so the media library's first view reads stored objects instead of transforming in the request. Uploading a file that already exists stores any of those widths it lacks. Animated images are skipped; their first view transforms them as before. This adds roughly 0.1 s to a typical photo's upload; a failure is logged and never fails the upload. On S3, the authenticated asset route's redirect to a presigned URL is now `private, max-age` until the end of the hour rather than `no-store`, and the URL stays the same for that hour, so reopening the media library fetches no thumbnails. A cached redirect can outlive a sign-out by at most that hour; it points only at a public-prefix object under an unguessable key. A streamed object stored without a `Cache-Control` is now sent as `private, max-age=31536000, immutable`, since every public-prefix key is content-addressed.
+
+**To adopt.** Only a custom `AssetStore` that implements `presignPublicObjectRead` changes: it returns `PresignedRead` (`{ url, maxAgeSeconds }`, from `canopycms/server`) or `null`, instead of a URL string. `maxAgeSeconds` is how long a browser may reuse that URL; return `0` to keep the old `no-store` behaviour.
 
-### Image fields are bordered cards, and Crop explains itself and works without `aspect`
+#### Image fields are bordered cards, and Crop explains itself and works without `aspect`
 
 <!-- changeset: image-field-cards -->
 
@@ -196,7 +181,7 @@ _First in int.121._
 
 **To adopt.** Nothing. `canopycms/client` now imports `react-image-crop`'s stylesheet through the editor theme, so a bundler that handles the Mantine stylesheets handles it too.
 
-### A locked branch shows a lock where a row's "…" menu would be
+#### A locked branch shows a lock where a row's "…" menu would be
 
 <!-- changeset: locked-row-lock -->
 
@@ -204,7 +189,7 @@ _First in int.121._
 
 **What changed.** On a protected, in-review or approved branch the content tree no longer drops a row's "…" menu without a trace. Each row that would have had a menu shows a lock of the same size, and its tooltip gives the branch's reason ("This branch is in review. Withdraw it to make changes."), on hover, keyboard focus and touch. An entry a path rule locks keeps its own lock beside its title and gets none in the menu slot.
 
-### Links clicked in the preview open their entry instead of leaving the editor — **behaviour change**
+#### Links clicked in the preview open their entry instead of leaving the editor — **behaviour change**
 
 <!-- changeset: preview-links-stay-in-editor -->
 
@@ -212,9 +197,29 @@ _First in int.121._
 
 **What changed.** A plain click on a link in the editor's preview no longer navigates the frame off its preview route to a public page, which could refuse to be framed. A link to another page of the site opens that page's entry in the editor, keeping the draft of the one left, and focus follows into its page. A page no entry has, such as a listing, opens in a new tab, and a note naming it says so; a link to another site opens in a new tab. Cmd/Ctrl/Shift/Alt and middle clicks, links with `download` or a `target` other than `_self`, links to the same page and `mailto:`/`tel:` links behave as they do outside the editor. A click that follows a link no longer also focuses the field it sits in, except while fields are highlighted, when a click on a marked link picks its field instead. The preview takes over links only once the editor has connected, so a public page embedded elsewhere keeps its links. Pages using `useCanopyPreview` or `withCanopyPreview` get this with no change.
 
----
+#### The browser's Back and Forward move between entries in the editor — **behaviour change**
 
-## Released
+<!-- changeset: editor-back-forward-entries -->
+
+_First in 0.2.0._
+
+**What changed.** Opening an entry in the editor adds a browser history entry, whether it is opened from the content panel, quick open, a comment, a preview link or a new entry's creation, and so does switching branch. Back and Forward then open the entry their URL names, without reloading the page; the preview follows, focus moves to the entry's menu in the top bar, and drafts are kept, as on any switch. Choosing the open entry again adds nothing, and the editor's own corrections, such as the home page it opens at load or the URL it fixes after a rename or delete, replace the URL instead. An entry since deleted or renamed opens the home page, with a note saying so. A Back onto another branch switches to it, asking first when there are unsaved changes; staying, or a branch no longer listed, returns to the entry the Back left.
+
+#### A locked branch's row lock shows on the hovered, focused or selected row
+
+<!-- changeset: row-lock-on-hover -->
+
+_First in 0.2.0._
+
+**What changed.** The lock in a content-tree row's menu slot was drawn on every row, repeating the branch pill and banner. It now appears on the row under the pointer, the focused row, the row with focus inside it, and the selected row, so a touch user sees the row they tapped. The slot stays reserved so rows do not shift, and the lock stays in the tab order and the accessibility tree on every row.
+
+#### The dev content watcher waits for a save to finish before comparing
+
+<!-- changeset: dev-watcher-waits-for-writes -->
+
+_First in 0.2.0._
+
+**What changed.** In `dev` mode, the watcher that warns when working-tree content has diverged from the served branch clone now acts on a new or changed file only once its size has held still for 100 ms. A save that truncates and then writes could reach the watcher as one event between the two steps. The check then read a half-written file and warned of a divergence that nothing later retracted. Now any warning about a half-finished save is retracted once the save completes.
 
 ### 0.1.0
 
@@ -267,7 +272,7 @@ URL.
 2. For a branch preview: wrap views with `withCanopyPreview` in a `'use client'` module, add
    `app/preview/[[...path]]/page.server.tsx`, set `editor.previewPrefix: '/preview'`, and serve that
    route with `frame-ancestors 'self'`, not `X-Frame-Options: DENY` (see
-   [Live Preview](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#live-preview)).
+   [Live Preview](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#live-preview)).
 3. A test reading view content from the route's server HTML must load the page in a browser.
    Server output rendered during a preview request carries the signed-in asset prefix; keep it out
    of cross-request caches (`unstable_cache`, module memos).
@@ -282,7 +287,7 @@ kept site styles ahead of Mantine's in the preview.
 server components. A string path marks the form's spelling (`'a.0.b'` marks `a[0].b`), and an empty
 path marks nothing. The editor counts and logs marks naming no field. `createEntrySchemaRegistry`
 refuses a field name that is empty, all digits or contains `.`, `[` or `]`. See
-[Live Preview](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#live-preview).
+[Live Preview](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#live-preview).
 
 **To adopt.** Fix each path that stops compiling; the error lists valid ones. Rewrite computed paths
 as literal segments, or type that component's prop as plain `FieldProps`. Pass `fieldProps` as
@@ -364,7 +369,7 @@ or a failed render) renders as its plain text, with no URL; any other form of th
 fields are nested or renamed, pass the AI config's `seo` the same object you pass
 `createNextCanopyContext({ seo })`, so the sitemap and AI content read the flag from the same
 place. A field that links to a hidden section by plain URL needs a field transform; the README
-shows [the recipe](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#ai-content-configuration).
+shows [the recipe](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#ai-content-configuration).
 
 **Now deletable.** An `exclude.where` that re-read the `noindex` flag by hand.
 
@@ -386,7 +391,7 @@ A `markdown` field with `renderAs: 'mdx'` is checked as MDX, and `mdxAllow` narr
 field or site-wide. New: field options `renderAs`, `mdxAllow`; config key `mdxAllow`; type
 `MdxAllowlist`. (int.110) A component prop allowance can be `'string'` (or
 `{ type: 'string', maxLength }`): a quoted value only, never bare or `{…}`. See
-[MDX content cannot run code](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#mdx-content-cannot-run-code).
+[MDX content cannot run code](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#mdx-content-cannot-run-code).
 
 **To adopt.** Set `renderAs: 'mdx'` on each `markdown` field your site compiles as MDX, and
 `mdxAllow` to what your renderer takes. Set `executable: true` only on a field whose editors you
@@ -523,7 +528,7 @@ a format check.
 
 - (int.93) Submit commits gain an `Edited-by: Name (id)` trailer; PR bodies gain a section that
   re-submits replace, keeping human text. Options: `gitEditedByTrailers`, `gitCoAuthoredByTrailers`
-  ([reference](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#definecanopyconfig-options)).
+  ([reference](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#definecanopyconfig-options)).
 - (int.110) Submit-commit trailers name every user who saved since the last submit commit, and
   the PR-body section every user who edited the branch, not only the submitter; settings commits
   (permissions, groups) carry the acting user's trailer.
@@ -547,7 +552,7 @@ saves only push the branch, and no failing PR task lands in System health.
 that entry type goes unavailable: the editor says so, and its entries answer 503 with
 `code: 'SCHEMA_UNAVAILABLE'`. Builds, static deploys and `generate-ai-content` still fail. The
 worker holds the base branch for up to 30 minutes while that lasts; see
-[New schemas wait for the editor deploy](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#new-schemas-wait-for-the-editor-deploy).
+[New schemas wait for the editor deploy](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#new-schemas-wait-for-the-editor-deploy).
 Public types gain optional `unavailable` on `EntryTypeConfig` and `FlatSchemaItem`, optional
 `ApiResponse.code`, and a required `SchemaResolutionResult.issues`.
 
@@ -585,7 +590,7 @@ hang until the drain heartbeat lets termination continue. Its in-flight task is
 new stack needs no steps.
 
 **What changed.** (int.109) Detailed in
-[The worker instance](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#the-worker-instance): IMDSv2 with a hop limit of 1; the
+[The worker instance](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#the-worker-instance): IMDSv2 with a hop limit of 1; the
 bundle is one file whose sha256 user data checks, readable as that one object; a file-system policy
 refusing clients without TLS or IAM, replacing the worker's
 `AmazonElasticFileSystemClientReadWriteAccess`; an encrypted gp3 root volume; a boot-time upgrade to
@@ -639,10 +644,10 @@ failure and exits non-zero on `selfStopped`, with a code outside `RestartPrevent
   with its hash, as `worker/dist/index.js` and `index.js.sha256`. The default, `'asset'`, is
   unchanged.
 - `CanopyCmsService` alarms when the worker logs no git sync for 30 minutes. See
-  [Worker-down alarm](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#worker-down-alarm).
+  [Worker-down alarm](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#worker-down-alarm).
 
 **To adopt.** Optional. For parameter-only change sets, see
-[Rolling the worker from CI](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#rolling-the-worker-from-ci). For the alarm, pass
+[Rolling the worker from CI](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#rolling-the-worker-from-ci). For the alarm, pass
 `alarmTopic`.
 
 **Now deletable.** A manual `cdk deploy` after each canopycms bump whose only purpose is moving the
@@ -653,7 +658,7 @@ worker, and a hand-built alarm on the worker log group.
 **What changed.** (int.112) The boot's `dnf upgrade` could be OOM-killed on every retry. A 1 GiB
 swap file now goes on first; an upgrade that still fails starts the worker unpatched and notifies
 `alarmTopic` if set; a retried step names itself when it gives up. See
-[The worker instance](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#the-worker-instance).
+[The worker instance](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#the-worker-instance).
 
 **To adopt.** Deploy, which replaces the worker instance. The bundle needs none of this, so it is
 not Template first and the worker contract stays at 1.
@@ -719,7 +724,7 @@ and operations may reuse GitHub fetches under 30 seconds old.
 
 **To adopt.** Nothing. Seeding `remote.git` stages a copy of the repository beside the gateway's
 mirror, so the root volume needs room for two
-([details](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#the-worker-instance)).
+([details](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#the-worker-instance)).
 
 #### The worker follows a rebased or deleted GitHub branch
 
@@ -741,7 +746,7 @@ changes the template too (the fallback bundle's key and hash), so only the contr
 bundle-only roll is safe.
 
 **To adopt.** Parameter mode: gate bundle-only rolls on the contract
-([recipe](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#rolling-the-worker-from-ci)). The gate refuses a stack without the
+([recipe](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#rolling-the-worker-from-ci)). The gate refuses a stack without the
 `WorkerContract` output, so `cdk deploy` the template once, which adds it. A hand-installed unit
 copies its `Environment=CANOPYCMS_WORKER_CONTRACT=` line from `worker/canopy-worker.service`.
 
@@ -758,8 +763,8 @@ units from the bundle's contract: 2 gets the split, an older bundle the single u
 template, then roll the bundle; on an older template it stops with `template too old for this
 bundle`. Inspect EFS only through `sudo /opt/canopy-worker/canopy-inspect <command>`, never from a root shell. A hand install
 takes `worker/`'s three units and `gateway.env.example`
-([steps](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#installing-the-units-by-hand)). After the first deploy, run the
-[checklist](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#first-deploy-checklist).
+([steps](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#installing-the-units-by-hand)). After the first deploy, run the
+[checklist](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#first-deploy-checklist).
 
 #### `canopycms-cdk`: `CanopyCmsService.attachTo`, and editor response headers — **behaviour change if you frame the CMS**
 
@@ -770,7 +775,7 @@ response headers policy. `CanopyCmsDistribution` sends the same headers: `frame-
 `X-Frame-Options: SAMEORIGIN`, `nosniff`, HSTS and `X-Robots-Tag: noindex`. Unless your app sends
 its own framing headers, no other origin can frame the editor or any page the CMS domain serves. Every such page is
 marked `noindex`. The editor's default preview is same-origin and unaffected. See
-[Serving the editor from a distribution you already own](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#serving-the-editor-from-a-distribution-you-already-own).
+[Serving the editor from a distribution you already own](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#serving-the-editor-from-a-distribution-you-already-own).
 
 **To adopt.** If you wired the Function URL into your own distribution by hand, delete those
 behaviors and call `attachTo`, passing your CMS build's `assetPrefix` as `editorAssetPrefix` and a
@@ -946,7 +951,7 @@ one the exclusions leave out. A throw or any other return is logged and treated
 **To adopt.** If your site's routes, sitemap or bylines decide that some entries have no page,
 apply the same rule here, for example `referenceLink: (target, { body }) =>
 !body?.trim() ? false : undefined` in `defineAIContentConfig` from `canopycms/ai`. See
-[AI Content Configuration](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#ai-content-configuration).
+[AI Content Configuration](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#ai-content-configuration).
 
 **Now deletable.** A `fieldTransforms` entry that re-renders a reference field only to drop or
 change its link.
@@ -1021,7 +1026,7 @@ _First in int.115._
 entry the base branch also changed, the "updated on the base branch" notice and the branch's
 conflict count now stay until the branch merges, so a reviewer still sees which entries replaced a
 base change. They used to clear on the next sync, about five minutes later. README's new [Drafts
-and Unpublishing](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#drafts-and-unpublishing) section covers long-lived branches and
+and Unpublishing](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#drafts-and-unpublishing) section covers long-lived branches and
 unpublishing.
 
 #### The editor calls the content drawer "All content"
@@ -1333,7 +1338,7 @@ editor carries an unsaved draft of a stamped entry onto its stamped version.
 The flag is refused off a top-level `datetime`, on `list: true`, and with `required: true`.
 
 **To adopt.** Add `stampOnPublish: true` to the date field your site sorts or labels by, such as
-`{ name: 'publishedAt', type: 'datetime', stampOnPublish: true }`. See [Stamping a publication date](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#stamping-a-publication-date).
+`{ name: 'publishedAt', type: 'datetime', stampOnPublish: true }`. See [Stamping a publication date](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#stamping-a-publication-date).
 
 **Now deletable.** A build step or hook that writes a missing publication date into new entries.
 
@@ -1380,7 +1385,7 @@ preview/form divider is now keyboard-resizable within the same 15–85% the spli
 stored at, and `react-split-pane` is no longer a dependency.
 `EditorPanes`, `EditorPanesProps`, the `PaneLayout` type and the `SPLIT_PERCENT_*` and `DEFAULT_*_SPLIT_PERCENT` constants are
 no longer exported from `canopycms/client`. See
-[Your root layout](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#editor-customization).
+[Your root layout](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#editor-customization).
 
 **To adopt.** Nothing, unless you import `EditorPanes` or those constants: render `CanopyEditor`
 instead, which lays out its own panes. Hiding your site chrome on the editor route is now
@@ -1491,7 +1496,7 @@ never ended. `canopycms-auth-clerk` skips it while the editor is mounted, and ex
 **To adopt.** Nothing for the editor, if your edit page uses `useClerkAuthConfig()` or
 `ClerkSignIn`. If your CMS build renders `<SignIn>`, `UserButton` or `OrganizationSwitcher` on your
 own pages, mount the hook as in
-[Clerk components on your own pages](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/packages/canopycms-auth-clerk/README.md#clerk-components-on-your-own-pages).
+[Clerk components on your own pages](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/packages/canopycms-auth-clerk/README.md#clerk-components-on-your-own-pages).
 Your own Server Actions in the CMS build still 403 behind OAC.
 
 **Now deletable.** Any local patch of `window.__internal_onBeforeSetActive` (or 6.x's
@@ -1532,12 +1537,12 @@ fast naming the ARN, the field and the keys present, never a value.
 **To adopt.** Nothing, unless one of those secrets holds a JSON document: then set the matching
 prop. The scaffolded stack fills them from the repository _variables_
 `CANOPY_GITHUB_TOKEN_SECRET_JSON_FIELD` and `CLERK_SECRET_KEY_SECRET_JSON_FIELD`
-([why the prefix](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#repository-secrets-and-variables)); a stack scaffolded earlier
+([why the prefix](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#repository-secrets-and-variables)); a stack scaffolded earlier
 adds the props to `infrastructure/bin/app.ts` and `infrastructure/lib/cms-stack.ts` and the two `env`
 lines to `.github/workflows/deploy-cms.yml`, or re-runs the generator and diffs. `cdk synth` refuses a `…JsonField` prop without its `…SecretArn`, and an ARN carrying the ECS `:KEY::` suffix
 (also in `secretsArns`). Don't use CDK's `secretValueFromJson`: it resolves the plaintext into the deployed
 resource's configuration, readable by anyone who can describe it. Only `CLERK_SECRET_KEY` goes through Secrets Manager; `CLERK_JWT_KEY` and the publishable
-key are public material ([Security Model](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#security-model)).
+key are public material ([Security Model](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#security-model)).
 
 **Now deletable.** A wrapper that fetches the secret, parses it and re-exports one field into the
 worker's environment, such as a `jq` step in user data or a wrapper entrypoint around
@@ -1549,7 +1554,7 @@ worker's environment, such as a `jq` step in user data or a wrapper entrypoint a
 `githubToken` is not deprecated and stays the documented default; `canopycms` neither depends on
 nor imports `@octokit/auth-app`. Register one App per site, not one shared across repositories:
 anyone holding an App's key can mint a token for any of its installations
-([why](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/ARCHITECTURE.md#why-one-github-app-per-site-not-one-shared-across-an-organisation)).
+([why](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/ARCHITECTURE.md#why-one-github-app-per-site-not-one-shared-across-an-organisation)).
 
 **To adopt with `canopycms-cdk`** (existing stacks need no edit). `CanopyCmsServiceProps` takes
 `githubAppId`, `githubAppInstallationId`, `githubAppPrivateKeySecretArn` and
@@ -1562,7 +1567,7 @@ anyone holding an App's key can mint a token for any of its installations
    `verify` checks an existing installation's permissions: run it, since an App missing a
    permission only shows up later, as `sync-failed`. `create` needs an interactive terminal and
    never edits an existing JSON secret (create one and point the JSON-field prop at it)
-   ([details](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#register-it-with-canopycms-init-github-app)).
+   ([details](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#register-it-with-canopycms-init-github-app)).
 2. Set the three props and **remove `githubTokenSecretArn`** (with its JSON field). A partial set
    of the three is refused at synth, and so is an App alongside a token.
 3. In the generated workflow, store them as `CANOPY_GITHUB_APP_ID`,
@@ -1573,7 +1578,7 @@ anyone holding an App's key can mint a token for any of its installations
 
 The private key is ARN-only; passing the key itself is refused at synth. Its ARN joins the worker's
 IAM policy automatically, so you need not add it to `secretsArns`. See
-[Authenticating as a GitHub App](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#authenticating-as-a-github-app).
+[Authenticating as a GitHub App](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#authenticating-as-a-github-app).
 
 ```bash
 canopycms init-github-app create -- \
@@ -1621,7 +1626,7 @@ downloads the `.pem` from the App's settings page.
 
 **What changed.** The worker re-reads a Secrets Manager secret (the GitHub token or the Clerk secret
 key) when the operation using it fails. Timings, costs and the store-before-revoke order are in
-[Rotating a secret](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#rotating-a-secret).
+[Rotating a secret](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#rotating-a-secret).
 
 **To adopt.** Nothing for credentials from `*_SECRET_ARN`, which is every scaffolded deployment. A
 GitHub App private key is still read only at boot: store the new key, replace the instance, and
@@ -1675,12 +1680,12 @@ also check the bucket policy for its grant.
 5. `withCanopy()` adds sharp's libvips to Next's file tracing (not for a static export) and, on
    Next 16 and later, sets `turbopack: {}` when your config has neither `turbopack` nor your own
    `webpack` and it can read your Next version. A webpack build still fails its image transforms
-   ([Dual Build Support](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#dual-build-support)).
+   ([Dual Build Support](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#dual-build-support)).
 
 **Breaking:** a stack setting `platform` on `fromImageAsset` without `architecture` gets an arm64
 function while `platform` still decides the image, so `Platform.LINUX_AMD64` builds an image the
 function cannot run. A stack setting neither moves to arm64 with a matching image, built under QEMU
-on an x86 host ([Where the image is built](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#where-the-image-is-built)).
+on an x86 host ([Where the image is built](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#where-the-image-is-built)).
 
 **To adopt.**
 
@@ -1709,7 +1714,7 @@ reason; `platform` on `fromImageAsset`; and, with `withCanopy()`, a hand-written
 
 **What changed.** `media.uploadUrl` (s3 adapter; an absolute http(s) URL or a site-relative path)
 replaces the `url` that `beginUpload()` returns, leaving the presign's `fields` untouched, so
-uploads can be same-origin. See [Media Configuration](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#media-configuration) for the
+uploads can be same-origin. See [Media Configuration](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#media-configuration) for the
 CloudFront behavior it expects.
 
 **To adopt.** Optional. Set it from an environment variable: a site-relative value works only where
@@ -1734,7 +1739,7 @@ needs `lazyPublicTransforms: true`) let you pass a deterministically named role,
 bucket's stack computes `arn:aws:iam::<account>:role/<name>` from literals instead of a
 `Fn::GetStackOutput` reference only the CDK CLI resolves. The constructs re-attach
 `AWSLambdaBasicExecutionRole` (and the VPC policy) that `lambda.Function` drops from a role you
-pass. See [Cross-account asset bucket](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#cross-account-asset-bucket).
+pass. See [Cross-account asset bucket](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#cross-account-asset-bucket).
 
 **To adopt.** Optional:
 
@@ -1844,7 +1849,7 @@ public JWKS PEM, used only to verify signatures.
 to variables (Settings → Secrets and variables → Actions → Variables); `bin/app.ts` refuses the
 deploy at synth while it is unset. Check that `bin/app.ts` passes `CLERK_SECRET_KEY` as
 `clerkSecretKeySecretArn` (read by the worker), never in the Lambda's `environment`, unless you keep
-`clerkMiddleware` ([Security Model](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/docs/deploying-to-aws.md#security-model)).
+`clerkMiddleware` ([Security Model](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/docs/deploying-to-aws.md#security-model)).
 
 #### `readByUrlPath` answers only where `listEntries` publishes — **breaking (routing)**
 
@@ -1943,7 +1948,7 @@ basePath: process.env.NEXT_PUBLIC_BASE_PATH,
 Then pass `baseUrl` to `assetUrl` only if Next serves `/assets` (local adapter, `next dev`, S3 with
 no distribution): `assetUrl(image, { width: 960, baseUrl: BASE_PATH })`. Assets on CloudFront via
 `AssetSupport` stay at the distribution root; pass no `baseUrl` (mount table under "Where `/assets`
-is mounted" in [Media Configuration](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#media-configuration)). Two traps:
+is mounted" in [Media Configuration](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#media-configuration)). Two traps:
 
 - Don't pass a deployment `basePath` to `contentStaticParams({ basePath })`; that option filters by
   a nested route prefix and emits zero params, building green.
@@ -2102,7 +2107,7 @@ Under `exactOptionalPropertyTypes: true`, omit keys instead of assigning `undefi
 `withTrailingSlash` and `isAbsoluteUrl` from `canopycms/server`; `defineSeoFieldGroup()` from
 `canopycms`; `generateContentSitemap` and `entryToMetadata` from `canopycms-next`, bound on
 `createNextCanopyContext`'s result. See
-[Sitemap and SEO Metadata](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#sitemap-and-seo-metadata). Every routable entry type is in
+[Sitemap and SEO Metadata](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#sitemap-and-seo-metadata). Every routable entry type is in
 the sitemap unless `exclude`d or `noindex`; one `noindex` predicate drives both robots metadata and
 sitemap exclusion. `trailingSlash` is never inferred. `lastModified` defaults to `updatedAt`, a
 filesystem mtime. An empty SEO field counts as unset. `siteUrl` must be absolute, colliding URLs are
@@ -2159,7 +2164,7 @@ underscore-prefixed files are skipped.
 
 **What changed.** New scaffolds write `defaultBranchAccess: 'deny'` and
 `defaultPathAccess: { read: 'allow' }`
-([Public read on server deployments](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#public-read-on-server-deployments)).
+([Public read on server deployments](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#public-read-on-server-deployments)).
 
 **To adopt.** An older scaffold's `defaultBranchAccess: 'allow'` is wider than recommended;
 consider `'deny'`. If you deleted `defaultPathAccess: { read: 'allow' }`, anonymous visitors get no content until you
@@ -2212,7 +2217,7 @@ re-checked an entry's type (a `switch` on `meta.entryType` can merge them into o
 **What changed.** `BlockComponentRegistry<Blocks>` (types only, from `canopycms`; `BlockValueOf<Blocks, 'hero'>`
 gives one template's value type) requires exactly
 one component per block template name when written as an object literal. See
-[Block Component Registries](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#block-component-registries) and
+[Block Component Registries](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#block-component-registries) and
 `apps/example1/app/components/PostView.tsx`.
 
 ```ts
@@ -2234,7 +2239,7 @@ templates against the schema.
 
 **What changed.** Spreading a `const` field array into several schemas, and nesting
 `defineInlineFieldGroup()` inside a block template, are documented
-([Reusable Field Fragments](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#reusable-field-fragments)); `defineFieldFragment()` is an
+([Reusable Field Fragments](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#reusable-field-fragments)); `defineFieldFragment()` is an
 identity helper for them.
 
 ```ts
@@ -2253,7 +2258,7 @@ field by composing from the same `const` field object.
 A block template holding a `reference` field is a shared block; `read()`/`readByUrlPath()` resolve
 it, and listings do with
 [`resolveReferences`](#listings-resolve-references-and-a-resolved-reference-carries-urlpath-and-optionally-its-body-16--breaking-type-level)
-(0.0.64). See [Shared / Referenced Blocks](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#shared--referenced-blocks).
+(0.0.64). See [Shared / Referenced Blocks](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#shared--referenced-blocks).
 
 **Now deletable.** A second `read()` in page code to unwrap a shared block's reference.
 
@@ -2275,7 +2280,7 @@ Not retro-documented, apart from these:
 
 #### The registry is keyed by entry-type name (0.0.42)
 
-**What changed.** `createEntrySchemaRegistry` keys are the entry-type names that `.collection.json` files name in `entry.schema`, and `EntryTypesFromRegistry` derives the typed entry-type map from them. Schema-variable keys (`{ postSchema }`) still work but derive nothing; [README's registry convention](https://github.com/safeinsights/canopycms/blob/0a53107eda329ce0499edad3544a16fb130b5beb/README.md#convention-why-key-the-registry-by-entry-type-name) says when to keep them.
+**What changed.** `createEntrySchemaRegistry` keys are the entry-type names that `.collection.json` files name in `entry.schema`, and `EntryTypesFromRegistry` derives the typed entry-type map from them. Schema-variable keys (`{ postSchema }`) still work but derive nothing; [README's registry convention](https://github.com/safeinsights/canopycms/blob/ecd004a19d226d3b93e175eb8a2bd2c5a4ef2463/README.md#convention-why-key-the-registry-by-entry-type-name) says when to keep them.
 
 **To adopt.**
 

package/dist/dev-content-watcher.js

@@ -194,7 +194,14 @@ export function startDevContentWatcher(services, options = {}) {
             }
         }
     };
-    const watcher = chokidar.watch(workingTreeContentDir, { ignoreInitial: true });
+    // A save can truncate and then write. chokidar's 50 ms per-path throttle passes only the first
+    // `change`, which can land between the two steps: a check then reads a half-written file and
+    // reports a divergence nothing retracts. `awaitWriteFinish` emits only once the file's size has
+    // held still, and bypasses that throttle.
+    const watcher = chokidar.watch(workingTreeContentDir, {
+        ignoreInitial: true,
+        awaitWriteFinish: { stabilityThreshold: 100, pollInterval: 25 },
+    });
     watcher.on('add', () => void check());
     watcher.on('change', () => void check());
     watcher.on('unlink', () => void check());

package/dist/editor/Editor.js

@@ -62,6 +62,7 @@ import { findFieldTarget, focusFieldTarget } from './field-target.js';
 import { UndoToastMessage } from './components/UndoToastMessage.js';
 import { getNotificationDuration } from './utils/env.js';
 import { MayHaveLandedError } from './unanswered.js';
+import { sanitizeBranchName } from '../paths/branch-name.js';
 // Stable fallbacks, so reference resolution's memo and effect don't re-run on every render
 // while no entry is open.
 const EMPTY_SCHEMA = [];
@@ -182,6 +183,8 @@ const EditorContent = ({ entries, title, siteTitle = title, branchName = '', col
     // A row's lock reason on an unanswered branch would be "details could not be loaded", which is
     // not yet true; once the fetch has failed it is, and the lock says so.
     const branchRowsPending = branchLoading && !branchesLoadFailed;
+    // Set once the branch actions below exist; they depend on the drafts, which depend on the entries.
+    const switchBranchRef = useRef(async () => { });
     // 2. Entry manager (depends on branchNameState, owns selectedPath)
     const { selectedPath, setSelectedPath, closeEntry, entries: entriesState, collections: collectionsFromApi, currentEntry, availableSchemas, entriesInitializing, entriesLoadFailed, navigatorOpen, setNavigatorOpen, refreshEntries, refreshContent, handleCreateEntry, renameEntry, loadEntry, readEntryValue, saveEntry, getEntryVersion, adoptEntryVersion, followMovedEntry, recreateEntry, createModalOpen, createModalCollection, createModalError, createModalCreating, createModalExistingSlugs, handleCreateModalSubmit, closeCreateModal, } = useEntryManager({
         initialEntries: entries,
@@ -197,6 +200,13 @@ const EditorContent = ({ entries, title, siteTitle = title, branchName = '', col
         }),
         resolvePreviewRoute: (entry) => buildPreviewRoute(entry, { previewBaseByCollection, contentRoot }),
         setBusy: setEntriesLoading,
+        switchBranch: (branch) => switchBranchRef.current(branch),
+        // To the entry menu, which names the entry opened; a dialog keeps focus.
+        onHistoryRestore: () => requestAnimationFrame(() => {
+            if (!document.activeElement?.closest('[role="dialog"]')) {
+                navigatorToggleRef.current?.focus({ preventScroll: true });
+            }
+        }),
     });
     // The content overlay and a maximized preview hide the form; `navigatorOpen` is only the
     // overlay's. Anything that focuses something in the form reveals it first. Opening an entry
@@ -296,6 +306,17 @@ const EditorContent = ({ entries, title, siteTitle = title, branchName = '', col
         onBranchCreated: addCreatedBranch,
         userId: userContext?.userId,
     });
+    switchBranchRef.current = async (branch) => {
+        const listed = (name) => name === branch || name === sanitizeBranchName(branch);
+        if (branchSummaries.length > 0 && !branchSummaries.some((b) => listed(b.name))) {
+            notifications.show({
+                message: `Branch “${branch}” no longer exists or you can no longer open it, so you're still on “${branchNameState}”.`,
+                color: 'yellow',
+            });
+            throw new Error(`Branch ${branch} is not listed`);
+        }
+        await handleBranchChange(branch);
+    };
     // 5. Comment system (depends on branchNameState)
     const { comments, getCommentUser, focusedFieldPath, highlightThreadId, commentsPanelOpen, setCommentsPanelOpen, handleAddComment, handleResolveThread, handleJumpToField, handleJumpToEntry, handleJumpToBranch, } = useCommentSystem({
         branchName: branchNameState,
@@ -885,8 +906,8 @@ const EditorContent = ({ entries, title, siteTitle = title, branchName = '', col
                 setDeletingEntryReferencedBy(result.referencedBy);
                 return;
             }
-            if (result.ok && selectedPath === deletingEntryPath)
-                closeEntry();
+            if (result.ok)
+                closeEntry(deletingEntryPath, branchNameState);
             closeDeleteEntryModal();
         }
         finally {

package/dist/editor/EntryNavigator.js

@@ -522,8 +522,9 @@ export const EntryNavigator = ({ items, collections, selectedPath, onSelect, onT
             !entryUnavailable &&
             !entryLocked &&
             (onDeleteEntry || onRenameEntry || onReorderEntry);
-        // The lock stands where the menu would, on exactly the rows that would otherwise have one. It
-        // is always shown: on hover alone, touch and keyboard users would see neither menu nor reason.
+        // The lock holds the slot where the menu would be, on exactly the rows that would otherwise have
+        // one, so rows never shift. The stylesheet reveals it on the hovered, focused or selected
+        // row (`data-nav-selected`), which keeps touch and keyboard users' route to the reason.
         const wouldHaveCollectionMenu = isCollection &&
             !!(rawOnAdd ||
                 rawOnEdit ||
@@ -540,7 +541,7 @@ export const EntryNavigator = ({ items, collections, selectedPath, onSelect, onT
         const showCollectionDirtyDot = !isEntry && dirtyCollections.has(node.value);
         const adminItems = onAddSubCollection || onEdit || onDelete;
         const hasCollectionContentItems = onAdd || canReorder;
-        return (_jsxs(Box, { ...elementProps, ref: selected ? selectedNodeRef : undefined, "data-nav-row": true, "data-testid": `entry-nav-item-${testIdSuffix}`, onClick: (event) => {
+        return (_jsxs(Box, { ...elementProps, ref: selected ? selectedNodeRef : undefined, "data-nav-row": true, "data-nav-selected": selected ? '' : undefined, "data-testid": `entry-nav-item-${testIdSuffix}`, onClick: (event) => {
                 elementProps.onClick(event);
                 if (isLeaf && isEntry) {
                     onSelect(node.value);
@@ -585,7 +586,8 @@ export const EntryNavigator = ({ items, collections, selectedPath, onSelect, onT
                                                         onDelete();
                                                     }, children: "Delete collection" }))] })] })), showsLockSlot &&
                                     (readOnlyReason ? (_jsx(BranchRowLock, { label: isCollection ? 'Collection actions' : 'Entry actions', reason: readOnlyReason })) : (
-                                    // The branch's state is still loading: hold the slot so rows do not shift.
+                                    // The branch's state is still loading: hold the slot so rows do not shift. It draws
+                                    // nothing, so it needs no reveal.
                                     _jsx(Box, { w: 18, h: 18, "aria-hidden": true, "data-testid": "branch-lock-pending" }))), hasEntryMenu && (_jsxs(Menu, { shadow: "md", width: 180, withinPortal: true, position: "bottom-end", children: [_jsx(Menu.Target, { children: _jsx(ActionIcon, { size: "xs", variant: "subtle", color: "gray", onClick: (event) => event.stopPropagation(), "aria-label": "Entry actions", "data-testid": `entry-menu-${testIdSuffix}`, children: _jsx(IconDots, { size: 14 }) }) }), _jsxs(Menu.Dropdown, { onKeyDown: stopTreeKeys, children: [onRenameEntry && (_jsxs(Menu.Item, { leftSection: _jsx(IconEdit, { size: 14 }), onClick: (event) => {
                                                         event.stopPropagation();
                                                         onRenameEntry(entryPath);

package/dist/editor/components/BranchRowLock.d.ts

@@ -4,7 +4,9 @@ import React from 'react';
  * writes. It matches the menu button's footprint so rows do not shift between branches, and takes
  * the menu's name; the reason is its Tooltip and its description. It stays `aria-disabled` rather
  * than `disabled`, so the reason opens on keyboard focus and touch too. Space is stopped here: the
- * tree would read it as expand/collapse.
+ * tree would read it as expand/collapse. `data-row-lock` marks it for the theme stylesheet, which
+ * draws it only on the hovered, focused or selected row (opacity, never `display`, so
+ * focusing it reveals it); a touch user sees it on the row they tapped.
  */
 export declare const BranchRowLock: React.FC<{
     label: string;

package/dist/editor/components/BranchRowLock.js

@@ -8,11 +8,13 @@ import { IconLock } from '@tabler/icons-react';
  * writes. It matches the menu button's footprint so rows do not shift between branches, and takes
  * the menu's name; the reason is its Tooltip and its description. It stays `aria-disabled` rather
  * than `disabled`, so the reason opens on keyboard focus and touch too. Space is stopped here: the
- * tree would read it as expand/collapse.
+ * tree would read it as expand/collapse. `data-row-lock` marks it for the theme stylesheet, which
+ * draws it only on the hovered, focused or selected row (opacity, never `display`, so
+ * focusing it reveals it); a touch user sees it on the row they tapped.
  */
 export const BranchRowLock = ({ label, reason }) => {
     const reasonId = useId();
-    return (_jsx(Tooltip, { label: reason, withinPortal: true, position: "bottom-end", multiline: true, w: 240, events: { hover: true, focus: true, touch: true }, children: _jsxs(ActionIcon, { size: "xs", variant: "transparent", c: "dimmed", "aria-disabled": true, "aria-label": label, "aria-describedby": reasonId, "data-testid": "branch-lock", style: { cursor: 'default' }, onClick: (event) => event.stopPropagation(), onKeyDown: (event) => {
+    return (_jsx(Tooltip, { label: reason, withinPortal: true, position: "bottom-end", multiline: true, w: 240, events: { hover: true, focus: true, touch: true }, children: _jsxs(ActionIcon, { size: "xs", variant: "transparent", c: "dimmed", "aria-disabled": true, "aria-label": label, "aria-describedby": reasonId, "data-testid": "branch-lock", "data-row-lock": true, style: { cursor: 'default' }, onClick: (event) => event.stopPropagation(), onKeyDown: (event) => {
                 if (event.nativeEvent.code === 'Space')
                     event.stopPropagation();
             }, children: [_jsx(IconLock, { size: 14, "aria-hidden": true }), _jsx(VisuallyHidden, { component: "span", id: reasonId, children: reason })] }) }));

package/dist/editor/hooks/editor-history.d.ts

@@ -0,0 +1,7 @@
+/** Shows `url`, pushed, or replaced keeping the entry's other state; never rewrites the URL shown. */
+export declare function writeEditorUrl(url: string, push: boolean): void;
+/** Stamps the history entry the editor opened on, keeping Next.js's keys: the URL is unchanged. */
+export declare function markEditorHistoryStart(): void;
+/** On `popstate`: entries moved, undefined if an end is not this run's, null for an undo's. */
+export declare function recordHistoryMove(): number | undefined | null;
+export declare function undoHistoryMove(moved: number): void;

package/dist/editor/hooks/editor-history.js

@@ -0,0 +1,80 @@
+/** Session-history writes stamped with their position, so a refused Back can be undone. */
+const STAMP_KEY = 'canopyHistory';
+// Next.js's router keys: its patched history methods copy `__NA` and the tree back and record the
+// URL, but do neither for state already holding `__NA` or `_N` (app-router.js, next 15.5).
+const ROUTER_KEYS = ['__NA', '__PRIVATE_NEXTJS_INTERNALS_TREE', '_N'];
+// A run restarts wherever the position is lost, so positions from two runs are never compared.
+let run = '';
+let position;
+let undoTarget;
+const newRun = () => {
+    run = Math.random().toString(36).slice(2);
+    position = undefined;
+};
+const currentState = () => {
+    const state = window.history.state;
+    return state !== null && typeof state === 'object' ? { ...state } : {};
+};
+const stampIn = (state) => {
+    const value = state[STAMP_KEY];
+    if (value === null || typeof value !== 'object')
+        return undefined;
+    const [stampRun, at] = [Reflect.get(value, 'run'), Reflect.get(value, 'position')];
+    return typeof stampRun === 'string' && typeof at === 'number'
+        ? { run: stampRun, position: at }
+        : undefined;
+};
+const samePage = (a, b) => {
+    const [x, y] = [new URL(a, window.location.href), new URL(b, window.location.href)];
+    const query = (u) => new URLSearchParams(u.search).toString();
+    return (x.origin === y.origin && x.pathname === y.pathname && query(x) === query(y) && x.hash === y.hash);
+};
+/** Shows `url`, pushed, or replaced keeping the entry's other state; never rewrites the URL shown. */
+export function writeEditorUrl(url, push) {
+    if (samePage(url, window.location.href))
+        return;
+    if (!run)
+        newRun();
+    const at = (position ?? 0) + (push ? 1 : 0);
+    const kept = push ? {} : currentState();
+    for (const key of ROUTER_KEYS)
+        delete kept[key];
+    const method = push ? window.history.pushState : window.history.replaceState;
+    method.call(window.history, { ...kept, [STAMP_KEY]: { run, position: at } }, '', url);
+    position = at;
+}
+/** Stamps the history entry the editor opened on, keeping Next.js's keys: the URL is unchanged. */
+export function markEditorHistoryStart() {
+    const state = currentState();
+    const stamp = stampIn(state);
+    if (stamp) {
+        run = stamp.run;
+        position = stamp.position;
+        return;
+    }
+    newRun();
+    position = 0;
+    window.history.replaceState({ ...state, [STAMP_KEY]: { run, position } }, '', window.location.href);
+}
+/** On `popstate`: entries moved, undefined if an end is not this run's, null for an undo's. */
+export function recordHistoryMove() {
+    const arrived = stampIn(currentState());
+    const undone = undoTarget !== undefined &&
+        arrived?.run === undoTarget.run &&
+        arrived.position === undoTarget.position;
+    undoTarget = undefined;
+    const moved = arrived?.run === run && position !== undefined ? arrived.position - position : undefined;
+    if (arrived) {
+        run = arrived.run;
+        position = arrived.position;
+    }
+    else
+        newRun();
+    return undone ? null : moved;
+}
+export function undoHistoryMove(moved) {
+    if (position === undefined)
+        return;
+    undoTarget = { run, position: position - moved };
+    window.history.go(-moved);
+}

package/dist/editor/hooks/useBranchActions.js

@@ -5,6 +5,7 @@ import { notifications } from '@mantine/notifications';
 import { Text } from '@mantine/core';
 import { useApiClient } from '../context/index.js';
 import { requestBranchCreate } from './create-branch-request.js';
+import { writeEditorUrl } from './editor-history.js';
 const MAX_LISTED_LABELS = 5;
 /** 'Unsaved changes in: "A", "B".' */
 export const describeUnsaved = ({ labels }) => {
@@ -25,10 +26,11 @@ export function useBranchActions(options) {
     const [confirmOpen, setConfirmOpen] = useState(false);
     const performBranchSwitch = (next) => {
         options.setBranchName(next);
+        // Its own history entry; a Back onto another branch already shows this URL, so writes nothing.
         if (typeof window !== 'undefined') {
             const url = new URL(window.location.href);
             url.searchParams.set('branch', next);
-            window.history.replaceState({}, '', url.toString());
+            writeEditorUrl(url.toString(), true);
         }
         options.onBranchSwitch?.(next);
     };

package/dist/editor/hooks/useBranchManager.js

@@ -18,6 +18,7 @@ import { RetryToastMessage } from '../components/RetryToastMessage.js';
 import { isNonApiResponse } from '../../api/client.js';
 import { isGatewayFailure, isUnanswered, UnansweredError } from '../unanswered.js';
 import { describeUnsaved } from './useBranchActions.js';
+import { writeEditorUrl } from './editor-history.js';
 const BRANCHES_LOAD_FAILED_TOAST_ID = 'canopy-branches-load-failed';
 const BRANCH_OUTCOME_UNKNOWN_TOAST_ID = 'canopy-branch-outcome-unknown';
 /** The error a refused branch action throws; a gateway's 5xx says nothing of whether it ran. */
@@ -583,16 +584,18 @@ export function useBranchManager(options) {
     const handleReloadBranchData = async () => {
         await loadBranches();
     };
+    // The editor's own page; a Back off it to a page of the host leaves that page's URL alone.
+    const editorPathRef = useRef(typeof window === 'undefined' ? '' : window.location.pathname);
     useEffect(() => {
         if (typeof window === 'undefined')
             return;
-        if (!branchName)
+        if (!branchName || window.location.pathname !== editorPathRef.current)
             return;
         const url = new URL(window.location.href);
         const current = url.searchParams.get('branch');
         if (current !== branchName) {
             url.searchParams.set('branch', branchName);
-            window.history.replaceState({}, '', url.toString());
+            writeEditorUrl(url.toString(), false);
         }
     }, [branchName]);
     return {

package/dist/editor/hooks/useEntryManager.d.ts

@@ -4,6 +4,8 @@ import type { LogicalPath } from '../../paths/types.js';
 import type { FormValue } from '../FormRenderer.js';
 import type { EntryFieldError } from '../../validation/entry-validator.js';
 /** @internal Exported for tests. */
+export declare const RESTORED_ENTRY_GONE_MESSAGE = "The entry you returned to is no longer on this branch, so the home page opened.";
+/** @internal Exported for tests. */
 export { listAllEntries } from './useEntriesData.js';
 /**
  * Thrown by saveEntry when the API returns a non-200 response. Carries the
@@ -37,12 +39,17 @@ export interface UseEntryManagerOptions {
     /** An entry's route on the site (`buildPreviewRoute`), which picks the home page to open first. */
     resolvePreviewRoute?: (entry: EditorEntry) => string | undefined;
     setBusy: (busy: boolean) => void;
+    /** Switches to the branch a Back or Forward reached; rejects when the switch does not happen. */
+    switchBranch?: (branch: string) => Promise<void>;
+    /** Called when a Back or Forward has opened another entry. */
+    onHistoryRestore?: () => void;
 }
 export interface UseEntryManagerReturn {
     selectedPath: string;
+    /** Opens an entry the user chose, adding a history entry, so Back returns to the one before. */
     setSelectedPath: (path: string) => void;
-    /** Leaves no entry open, as after deleting the open one, instead of opening the first. */
-    closeEntry: () => void;
+    /** Leaves no entry open if `path` on `branch` is still open, as after deleting it. */
+    closeEntry: (path: string, branch: string) => void;
     entries: EditorEntry[];
     setEntries: (entries: EditorEntry[]) => void;
     collections: EditorCollection[];

package/dist/editor/hooks/useEntryManager.js

@@ -10,7 +10,11 @@ import { SCHEMA_UNAVAILABLE_CODE } from '../unavailable-entry-type.js';
 import { entriesKey, fetchEntriesAndSchema } from './useEntriesData.js';
 import { RetryToastMessage } from '../components/RetryToastMessage.js';
 import { isGatewayFailure, isUnanswered, MayHaveLandedError, UnansweredError } from '../unanswered.js';
+import { sanitizeBranchName } from '../../paths/branch-name.js';
+import { markEditorHistoryStart, recordHistoryMove, undoHistoryMove, writeEditorUrl, } from './editor-history.js';
 const ENTRIES_LOAD_FAILED_TOAST_ID = 'canopy-entries-load-failed';
+/** @internal Exported for tests. */
+export const RESTORED_ENTRY_GONE_MESSAGE = 'The entry you returned to is no longer on this branch, so the home page opened.';
 // Re-exported so existing imports of `listAllEntries` from this module keep
 // working -- the implementation lives in useEntriesData.ts alongside the
 // other fetch/key/type pieces useEntryManager shares with the SWR layer.
@@ -56,6 +60,23 @@ const EMPTY_SCHEMAS = [];
  * from an entry that crashes the editor); null opens the home page (`resolveHomeEntry`).
  */
 const readUrlEntry = () => typeof window === 'undefined' ? null : new URLSearchParams(window.location.search).get('entry');
+/** The current URL with `branch` and the `entry` that `selectedPath` shows, as `readUrlEntry` reads it. */
+const entryUrl = (selectedPath, noEntry, branch) => {
+    const url = new URL(window.location.href);
+    if (branch)
+        url.searchParams.set('branch', branch);
+    if (selectedPath) {
+        url.searchParams.set('entry', selectedPath);
+    }
+    else if (noEntry) {
+        // Kept, so a reload still opens no entry.
+        url.searchParams.set('entry', '');
+    }
+    else {
+        url.searchParams.delete('entry');
+    }
+    return url.toString();
+};
 /**
  * Custom hook for managing editor entries (CRUD operations).
  */
@@ -102,6 +123,18 @@ export function useEntryManager(options) {
     selectedPathRef.current = selectedPath;
     // Counts selections through the returned setter, not this hook's own fallbacks.
     const selectionsByCallerRef = useRef(0);
+    // The path the user chose, which the URL sync pushes; any other selection replaces the URL.
+    const pushTargetRef = useRef(null);
+    // The `entry` a Back onto another branch opens once that branch shows; a later move drops it.
+    const entryAfterBranchChangeRef = useRef(undefined);
+    // Counts Back and Forward moves, so a branch switch one asked for knows when another followed.
+    const historyMovesRef = useRef(0);
+    // The path a Back or Forward opened, until the entries show whether it is still there.
+    const restoredPathRef = useRef(null);
+    // The editor's own page: a Back off it to another page of the host is no move between entries.
+    const editorPathRef = useRef(typeof window === 'undefined' ? '' : window.location.pathname);
+    const onHistoryRestoreRef = useRef(options.onHistoryRestore);
+    onHistoryRestoreRef.current = options.onHistoryRestore;
     const [navigatorOpen, setNavigatorOpen] = useState(() => readUrlEntry() === '');
     const isInitialMount = useRef(true);
     const hasSyncedFromUrl = useRef(false);
@@ -188,13 +221,18 @@ export function useEntryManager(options) {
     const noEntryRequested = useRef(initialUrlEntry.current === '');
     const selectEntryPath = useCallback((path) => {
         selectionsByCallerRef.current += 1;
+        pushTargetRef.current = path;
         setSelectedPath(path);
     }, []);
     // No entry open, as the URL's empty `entry` asks, where a lost selection opens the home page.
-    const closeEntry = useCallback(() => {
+    // Replaces the history entry: it follows a delete, which Back could not undo.
+    const closeEntry = useCallback((path, branch) => {
+        if (selectedPathRef.current !== path || currentBranchRef.current !== branch)
+            return;
         noEntryRequested.current = true;
-        selectEntryPath('');
-    }, [selectEntryPath]);
+        selectionsByCallerRef.current += 1;
+        setSelectedPath('');
+    }, []);
     const collectionByPath = useMemo(() => {
         const map = new Map();
         const walk = (collections) => {
@@ -470,6 +508,7 @@ export function useEntryManager(options) {
             // still empty when this function runs (slow server / cold start).
             const createdEntry = refreshed.find((e) => e.collectionPath === createModalCollection.path && e.slug === slug);
             if (createdEntry) {
+                pushTargetRef.current = createdEntry.path;
                 setSelectedPath(createdEntry.path);
             }
             else {
@@ -566,8 +605,16 @@ export function useEntryManager(options) {
             isInitialMount.current = false;
         }
         else {
-            noEntryRequested.current = false;
-            setSelectedPath('');
+            const restored = entryAfterBranchChangeRef.current;
+            entryAfterBranchChangeRef.current = undefined;
+            const entry = restored?.branch === options.branchName ? restored.entry : undefined;
+            noEntryRequested.current = entry === '';
+            setSelectedPath(entry ?? '');
+            if (entry !== undefined) {
+                restoredPathRef.current = entry;
+                setNavigatorOpen(entry === '');
+                onHistoryRestoreRef.current?.();
+            }
             // Bound version-map growth across switches. Correctness no longer
             // depends on this clear: tokens are keyed by `${branch}:${contentId}`
             // (see entryVersionsRef), so a late response from the previous branch
@@ -703,33 +750,100 @@ export function useEntryManager(options) {
                 return;
             }
         }
+        const restored = restoredPathRef.current === selectedPath;
+        if (restored)
+            restoredPathRef.current = null;
         // If the selected entry exists, keep it
         if (entriesState.find((e) => e.path === selectedPath))
             return;
         if (selectedPath === '' && noEntryRequested.current)
             return;
+        if (restored && selectedPath) {
+            notifications.show({ message: RESTORED_ENTRY_GONE_MESSAGE, color: 'blue' });
+        }
         setSelectedPath(resolveHomeEntry(entriesState, resolvePreviewRouteRef.current)?.path ?? '');
     }, [entriesState, selectedPath]);
     // Update URL when selection changes (skip until URL sync has happened)
     useEffect(() => {
         if (typeof window === 'undefined')
             return;
+        // Pushed only once listed: a path the check above replaces would leave a stale entry behind.
+        const push = pushTargetRef.current === selectedPath && entriesState.some((e) => e.path === selectedPath);
+        pushTargetRef.current = null;
         // Don't update URL until we've synced from it first
         if (!hasSyncedFromUrl.current)
             return;
-        const url = new URL(window.location.href);
-        if (selectedPath) {
-            url.searchParams.set('entry', selectedPath);
-        }
-        else if (noEntryRequested.current) {
-            // Kept, so a reload still opens no entry.
-            url.searchParams.set('entry', '');
-        }
-        else {
-            url.searchParams.delete('entry');
-        }
-        window.history.replaceState({}, '', url.toString());
+        if (window.location.pathname !== editorPathRef.current)
+            return;
+        writeEditorUrl(entryUrl(selectedPath, noEntryRequested.current, currentBranchRef.current), push);
     }, [selectedPath]);
+    const entriesRef = useRef(entriesState);
+    entriesRef.current = entriesState;
+    const switchBranchRef = useRef(options.switchBranch);
+    switchBranchRef.current = options.switchBranch;
+    // Back and Forward open the entry their URL names, without a reload.
+    useEffect(() => {
+        if (typeof window === 'undefined')
+            return;
+        markEditorHistoryStart();
+        const restore = () => {
+            const moved = recordHistoryMove();
+            if (moved === null || window.location.pathname !== editorPathRef.current)
+                return;
+            historyMovesRef.current += 1;
+            entryAfterBranchChangeRef.current = undefined;
+            const params = new URLSearchParams(window.location.search);
+            const entry = params.get('entry');
+            const branch = params.get('branch');
+            const current = currentBranchRef.current;
+            // A legacy name and its sanitized form are one branch; a switch would key drafts by the other.
+            if (branch && sanitizeBranchName(branch) !== sanitizeBranchName(current)) {
+                const move = historyMovesRef.current;
+                const stay = () => {
+                    if (move !== historyMovesRef.current)
+                        return;
+                    if (moved)
+                        undoHistoryMove(moved);
+                    else {
+                        const url = entryUrl(selectedPathRef.current, noEntryRequested.current, currentBranchRef.current);
+                        writeEditorUrl(url, false);
+                    }
+                };
+                const switchBranch = switchBranchRef.current;
+                if (!switchBranch) {
+                    stay();
+                    return;
+                }
+                entryAfterBranchChangeRef.current = { branch, entry };
+                if (!hasSyncedFromUrl.current)
+                    initialUrlEntry.current = entry;
+                switchBranch(branch).catch(() => {
+                    if (move === historyMovesRef.current)
+                        entryAfterBranchChangeRef.current = undefined;
+                    stay();
+                });
+                return;
+            }
+            // A Back is a selection, so a rename, move or re-create landing afterwards leaves it open.
+            selectionsByCallerRef.current += 1;
+            noEntryRequested.current = entry === '';
+            setNavigatorOpen(entry === '');
+            if (!hasSyncedFromUrl.current) {
+                initialUrlEntry.current = entry;
+                setSelectedPath(entry ?? '');
+                return;
+            }
+            const target = entry ?? resolveHomeEntry(entriesRef.current, resolvePreviewRouteRef.current)?.path ?? '';
+            if (target === selectedPathRef.current)
+                return;
+            restoredPathRef.current = target;
+            // A path no longer listed falls back to the home page, through the selection check above.
+            setSelectedPath(target);
+            onHistoryRestoreRef.current?.();
+        };
+        window.addEventListener('popstate', restore);
+        return () => window.removeEventListener('popstate', restore);
+    }, []);
     return {
         selectedPath,
         setSelectedPath: selectEntryPath,

package/dist/editor/theme.js

@@ -320,7 +320,11 @@ const canopyCssVariablesResolver = (theme) => ({
  * Switch thumbs, white text on the primary colour (moved to the fill), and dimmed text Mantine
  * draws itself (a blocked menu item, a combobox's empty message, outside days). Outside days lose
  * Mantine's half opacity, under 4.5:1. The crop box and its handles sit on an arbitrary image, where
- * no single colour holds 3:1, so they take a white and black pair.
+ * no single colour holds 3:1, so they take a white and black pair. A navigator row's lock is
+ * drawn only while its row is hovered, focused (Mantine's Tree focuses the `li` around the row, on click and arrow keys), has focus
+ * within, or is selected. It hides by opacity alone, so it keeps its place and stays in the tab order
+ * and the accessibility tree; while hidden it takes no pointer events, so a tap on its slot reaches
+ * the row.
  */
 const CANOPY_STYLES = `
 .mantine-Checkbox-input:not(:checked, :disabled, [data-indeterminate], [data-error]),
@@ -353,6 +357,23 @@ const CANOPY_STYLES = `
   outline: 2px solid var(--mantine-color-white);
   box-shadow: 0 0 0 4px var(--mantine-color-black);
 }
+[data-nav-row] [data-row-lock] {
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 120ms ease;
+}
+[data-nav-row]:hover [data-row-lock],
+[data-nav-row]:focus-within [data-row-lock],
+[role='treeitem']:focus > [data-nav-row] [data-row-lock],
+[data-nav-row][data-nav-selected] [data-row-lock] {
+  opacity: 1;
+  pointer-events: auto;
+}
+@media (prefers-reduced-motion: reduce) {
+  [data-nav-row] [data-row-lock] {
+    transition: none;
+  }
+}
 [data-combobox-selected] {
   --mantine-primary-color-filled: var(--canopy-primary-fill);
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CANOPYCMS_VERSION = "0.2.0-int.121";
+export declare const CANOPYCMS_VERSION = "0.2.0";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated by scripts/bump-version.mjs, its only writer. The package builds with plain
 // tsc (rootDir: src), so src/ cannot import ../package.json; version.test.ts keeps the two equal.
-export const CANOPYCMS_VERSION = '0.2.0-int.121';
+export const CANOPYCMS_VERSION = '0.2.0';

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.2.0-int.121",
+  "version": "0.2.0",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {