caracms 0.8.0 → 0.8.2

package/src/live/cloud.ts

@@ -12,11 +12,18 @@
  * - `cloudSettings()`: the site's repo from those settings (`github.repo`; null is
  *   `no_repo`, with the cloud's own sentence). Only the editor needs a repo.
  * - `cloudToken()`: `POST /v1/github/token`, a fresh installation token on the site's repo,
- *   about an hour long. `GitHubClient` calls it and refreshes five minutes early.
+ *   about an hour long. `GitHubClient` calls it and refreshes five minutes early. It waits
+ *   35 s (`CLOUD_TOKEN_TIMEOUT_MS`), every other call 20 s (`CLOUD_TIMEOUT_MS`).
+ * - `confirmCloudRepo()`: a token answer naming another repo is a rename or transfer on
+ *   GitHub (the cloud's M2b: "A `full_name` change GitHub reports updates the site's repo").
+ *   The settings are read again; when they name it too, the held copy takes the new repo
+ *   and `GitHubClient` carries on under it.
  * - **A refusal** (any answer that isn't 2xx, carrying `{ error, message }`) throws a
  *   `CloudRefusal` with the cloud's `message` as it came, and `installUrl` when there is
  *   one. A cloud that can't be reached, or answers with something else, throws a
- *   `CloudRefusal` whose `error` is `unreachable`, with the package's own sentence.
+ *   `CloudRefusal` whose `error` is `unreachable`, with the package's own sentence and a
+ *   `detail` for logs (timed out, the connection failed, or the status of an answer that
+ *   wasn't the API's).
  *
  * - `cloudUnavailable()`: the sign-in guard's 503 for a refusal at start (Decision 14),
  *   the sentence escaped and the install link a link.
@@ -33,19 +40,37 @@ export const CLOUD_KEY_SHAPE = /^cck_[A-Za-z0-9_-]{43}$/;
 export const CLOUD_UNREACHABLE = "CaraCMS Cloud couldn't be reached, so the editor can't start. Try again in a minute.";
 /** M3 Decision 20: the build's own sentence for a cloud it can't reach. */
 export const CLOUD_UNREACHABLE_BUILD = "CaraCMS Cloud couldn't be reached, so the site can't be built. Try again in a minute.";
-/** The cloud's own `no_repo` sentence (Contracts), for `github.repo: null` in the settings. */
-export const CLOUD_NO_REPO = 'This site has no GitHub repo in CaraCMS Cloud yet. Ask CaraCMS to set one.';
-/** Decision 13: a token answer named another repo than the one the server started with. */
-export const CLOUD_REPO_CHANGED = (repo: string) => `This site's repo was changed in CaraCMS Cloud to ${repo}. Restart the server to use it.`;
+/**
+ * The cloud's own `no_repo` sentence, word for word (caracms-cloud `convex/http.ts`, the token
+ * route), for `github.repo: null` in the settings, which carry no sentence of their own. The
+ * token route's `no_repo` refusal is shown as it came (`cloudCall`); this is only the copy for
+ * the settings (caracms-cloud adversarial review, seam note: it was M1's "Ask CaraCMS to set one").
+ */
+export const CLOUD_NO_REPO = 'This site has no GitHub repo in CaraCMS Cloud yet. A team owner can pick one in app.caracms.com.';
+/**
+ * A token answer named another repo than the one the server is on, and the settings, read
+ * again, don't say so yet (or couldn't be read): this refresh fails, and the next one asks
+ * again (caracms-cloud adversarial review, finding 7; once the settings agree, the new name
+ * is taken, github.ts).
+ */
+export const CLOUD_REPO_CHANGED = (repo: string) =>
+	`This site's repo is now ${repo} on GitHub, but CaraCMS Cloud's settings don't say so yet, so changes can't be saved to GitHub for now. The editor tries again on its own; if this stays, ask CaraCMS to check the site.`;
 
 /** How long a call to the cloud may take before it counts as unreachable. */
 export const CLOUD_TIMEOUT_MS = 20_000;
+/**
+ * The token call's own, longer timeout (caracms-cloud adversarial review, seam note): the
+ * cloud's worst case, an id mint refused and then the installation found and a token minted
+ * by name (10 s to GitHub each), can pass 20 s, which would read as `unreachable`.
+ */
+export const CLOUD_TOKEN_TIMEOUT_MS = 35_000;
 
 export interface CloudConnection {
 	key: string;
 	url: string;
 	/** For tests. Default: global fetch. */
 	fetch?: typeof fetch;
+	/** Default: `CLOUD_TIMEOUT_MS`, or `CLOUD_TOKEN_TIMEOUT_MS` for `cloudToken()`. */
 	timeoutMs?: number;
 }
 
@@ -66,27 +91,30 @@ export function isCloudRefusal(value: unknown): value is CloudRefusal {
 /** The cloud said no (or couldn't be reached). `message` is safe to show and to log. */
 export class CloudRefusal extends Error {
 	readonly [REFUSAL_BRAND] = true;
-	/** The cloud's `error` (`no_repo`, `app_not_installed`, `unknown_key`…), or the package's `unreachable` / `repo_changed`. */
+	/** The cloud's `error` (`no_repo`, `app_not_installed`, `unknown_key`…), or the package's `unreachable` / `repo_changed` (finding 7: a rename the settings don't confirm yet). */
 	readonly error: string;
 	/** An `https://` link the message names (the App's install page), or null. */
 	readonly installUrl: string | null;
-	constructor(error: string, message: string, installUrl: string | null = null) {
+	/** For `unreachable`, what happened, for a log line (never a secret): `timed out`, `answered HTTP 502`… */
+	readonly detail: string | null;
+	constructor(error: string, message: string, installUrl: string | null = null, detail: string | null = null) {
 		super(message);
 		this.name = 'CloudRefusal';
 		this.error = error;
 		this.installUrl = installUrl;
+		this.detail = detail;
 	}
 }
 
-const unreachable = () => new CloudRefusal('unreachable', CLOUD_UNREACHABLE);
+const unreachable = (detail: string | null = null) => new CloudRefusal('unreachable', CLOUD_UNREACHABLE, null, detail);
 
 /**
  * One call to the API: `path` with its query, a JSON `body` for a POST. The answer's JSON
  * object, or a `CloudRefusal` (the cloud's own, or `unreachable`). The media bucket
  * (editor/server/media/cloud-bucket.ts) calls it too.
  */
-export async function cloudCall(connection: CloudConnection, method: 'GET' | 'POST', path: string, body?: unknown): Promise<Record<string, unknown>> {
-	let res: Response;
+export async function cloudCall(connection: CloudConnection, method: 'GET' | 'POST', path: string, body?: unknown, defaultTimeoutMs = CLOUD_TIMEOUT_MS): Promise<Record<string, unknown>> {
+	let res: Response | undefined;
 	let answer: unknown;
 	try {
 		res = await (connection.fetch ?? fetch)(`${connection.url}${path}`, {
@@ -98,17 +126,18 @@ export async function cloudCall(connection: CloudConnection, method: 'GET' | 'PO
 				...(body === undefined ? {} : { 'content-type': 'application/json' }),
 			},
 			...(body === undefined ? {} : { body: JSON.stringify(body) }),
-			signal: AbortSignal.timeout(connection.timeoutMs ?? CLOUD_TIMEOUT_MS),
+			signal: AbortSignal.timeout(connection.timeoutMs ?? defaultTimeoutMs),
 		});
 		answer = await res.json();
-	} catch {
-		throw unreachable();
+	} catch (error) {
+		const timedOut = (error as { name?: unknown } | null)?.name === 'TimeoutError';
+		throw unreachable(timedOut ? 'timed out' : res ? `answered HTTP ${res.status}, not with JSON` : 'the connection failed');
 	}
 	const object = answer && typeof answer === 'object' && !Array.isArray(answer) ? (answer as Record<string, unknown>) : null;
-	if (!object) throw unreachable();
+	if (!object) throw unreachable(`answered HTTP ${res.status}, not with an object`);
 	if (!res.ok) {
 		const { error, message, installUrl } = object;
-		if (typeof error !== 'string' || typeof message !== 'string' || !message.trim()) throw unreachable();
+		if (typeof error !== 'string' || typeof message !== 'string' || !message.trim()) throw unreachable(`answered HTTP ${res.status} without a reason`);
 		throw new CloudRefusal(error, message, typeof installUrl === 'string' && /^https:\/\//i.test(installUrl) ? installUrl : null);
 	}
 	return object;
@@ -147,9 +176,9 @@ export async function fetchCloudSettings(connection: CloudConnection): Promise<C
 	const github = answer.github as { repo?: unknown } | undefined;
 	const media = answer.media as { bucket?: unknown; imageHost?: unknown } | undefined;
 	const pair = answer.imgproxy as { key?: unknown; salt?: unknown } | undefined;
-	if (!github || typeof github !== 'object') throw unreachable();
+	if (!github || typeof github !== 'object') throw unreachable('answered settings without github');
 	const m = typeof github.repo === 'string' ? REPO.exec(github.repo) : null;
-	if (github.repo !== null && !m) throw unreachable();
+	if (github.repo !== null && !m) throw unreachable('answered settings with a malformed repo');
 	const folder = str(answer.folder);
 	const bucket = str(media && typeof media === 'object' ? media.bucket : null);
 	const imageHost = str(media && typeof media === 'object' ? media.imageHost : null);
@@ -221,14 +250,29 @@ export function heldCloudSettings(connection: Pick<CloudConnection, 'key' | 'url
 	return h.failure ? { kind: 'failed', refusal: h.failure } : null;
 }
 
+/**
+ * caracms-cloud adversarial review, finding 7: a token answer named `fullName`, not the repo
+ * the server is on. `GET /v1/settings` afresh: when it names `fullName` too, that repo is
+ * returned and the held copy takes it (a start later in this process begins on it; the media
+ * are left as held). Null when the settings name another repo, or none, or can't be read.
+ */
+export async function confirmCloudRepo(connection: CloudConnection, fullName: string): Promise<{ owner: string; repo: string } | null> {
+	const settings = await fetchCloudSettings(connection).catch(() => null);
+	const repo = settings?.repo ?? null;
+	if (!repo || `${repo.owner}/${repo.repo}`.toLowerCase() !== fullName.toLowerCase()) return null;
+	const h = held()[HELD];
+	if (h?.value && h.key === connection.key && h.url === connection.url) h.value = { ...h.value, repo };
+	return repo;
+}
+
 /** Forget the held settings (tests). */
 export function resetCloudSettings(): void {
 	delete held()[HELD];
 }
 
-/** A fresh installation token on the site's repo, from `POST /v1/github/token`. */
+/** A fresh installation token on the site's repo, from `POST /v1/github/token` (35 s unless `timeoutMs` says otherwise). */
 export async function cloudToken(connection: CloudConnection): Promise<{ token: string; expiresAt: number; repo: string }> {
-	const answer = await cloudCall(connection, 'POST', '/v1/github/token');
+	const answer = await cloudCall(connection, 'POST', '/v1/github/token', undefined, CLOUD_TOKEN_TIMEOUT_MS);
 	const { token, expiresAt, repo } = answer;
 	const at = typeof expiresAt === 'string' ? Date.parse(expiresAt) : Number.NaN;
 	if (typeof token !== 'string' || !token || Number.isNaN(at) || typeof repo !== 'string') throw unreachable();

package/src/live/drafts-store.ts

@@ -80,12 +80,16 @@ export function unavailable(error: unknown): WriteRefused {
  * expire, so a file with none was never changed in the editor or Redis lost its data, and
  * the server can't tell which: the keeper holds edits on unknown rather than re-send them.
  */
-/** `known`: the file's change record as the caller already read it (the status poll's cache); otherwise read here. */
+/**
+ * `known`: the file's change record as the caller already read it (the status poll's cache); otherwise read here.
+ * Discard changes: its `discard` is `discarded`, so a browser drops edits held from before it.
+ */
 export async function lastChangeOf(parts: Pick<LiveStoreParts, 'git' | 'autosaves'>, file: string, known?: ChangeRecord | null): Promise<LastChange> {
 	const record = known !== undefined ? known : await parts.autosaves.changed(file);
-	if (record) return { by: record.by, version: record.version, at: record.at };
+	const discarded = record?.discard ? { discarded: { by: record.discard.by, at: record.discard.at } } : {};
+	if (record) return { by: record.by, version: record.version, at: record.at, ...discarded };
 	const editor = parts.git.waiting().find((w) => w.file === file)?.editors[0];
-	return editor ? { by: editor.person, version: null, at: editor.at } : { by: null, version: null, at: null, known: false };
+	return editor ? { by: editor.person, version: null, at: editor.at, ...discarded } : { by: null, version: null, at: null, known: false, ...discarded };
 }
 
 export function liveDraftsStore(parts: LiveStoreParts): DraftsStore {
@@ -400,7 +404,7 @@ export function liveDraftsStore(parts: LiveStoreParts): DraftsStore {
 			guard(async () => {
 				const file = posix(relative(site.root, resolveDocumentFile(site, collection, path)));
 				const save = (await autosaves.get(file))?.value ?? null;
-				const read = await readDocument(site, collection, path, overlay(save ? [save] : []));
+				const read = await readDocument(site, collection, path, overlay(save ? [save] : []), { untitled: true });
 				return { ...read, mtimeMs: save?.updatedAt ?? 0, version: fileVersion(read.text), lastChange: await lastChangeOf(parts, file) };
 			}),
 
@@ -415,8 +419,15 @@ export function liveDraftsStore(parts: LiveStoreParts): DraftsStore {
 				const current = git.read(request.file);
 				// It exists: in the copy, or as a new document's autosave (M5a); a "gone" autosave is a deletion.
 				const missing = () => new WriteRefused(404, `${site.collections[target.collection]!.label}: no document "${target.path}".`);
-				const saved = await autosaves.get(request.file);
+				const [saved, changed] = await autosaves.getWithChange(request.file);
 				if (saved?.value.gone || (current === null && !saved)) throw missing();
+				// Discard changes: a tab that had the document when someone put it back to what's live
+				// can't write until it has let go of its copy (it's stale: its edits would come back).
+				const discard = changed?.discard;
+				if (discard && discard.tabs.includes(tab)) {
+					const title = saved?.value.text ? titleOf(request.file, saved.value.text) : titleOf(request.file, current);
+					throw new WriteRefused(409, `${displayName(discard.by)} discarded the unpublished changes to ${title}, so these edits weren't kept.`, { code: 'discarded', by: discard.by, at: discard.at });
+				}
 
 				const text = writeText(site, target.collection, request);
 
@@ -494,7 +505,7 @@ export function liveDraftsStore(parts: LiveStoreParts): DraftsStore {
 					if (await autosaves.putIf(existing, next)) break;
 				}
 				const version = fileVersion(text);
-				await autosaves.setChanged(request.file, { by: person, version, at: new Date(t).toISOString() });
+				await autosaves.setChanged(request.file, { by: person, version, at: new Date(t).toISOString(), ...autosaves.carryDiscard(changed) });
 				if (context?.release) await locks.release(request.file, tab, person);
 				sweep.poke();
 				return { ok: true, file: request.file, changed: text !== (existing?.value.text ?? current), mtimeMs: t, version };

package/src/live/editor.ts

@@ -1,7 +1,17 @@
 /**
  * Live mode's editor server (M4 Phase 2): the live drafts store, the sweep, locks and
  * presence, and the handlers behind `/_caracms/status`, `lock`, `publish`, `history`,
- * `try-again` and `notice` (the routes in ../editor/routes/ are one line each).
+ * `try-again`, `notice` and `discard` (the routes in ../editor/routes/ are one line each).
+ *
+ * **Discard changes** (`discard`): one waiting document back to what's live. Its autosave,
+ * committed record and move records go and its files on `drafts` are committed as `main` has
+ * them (git.ts → `restoreDrafts`), all under the sweep's locks (sweep.ts → `exclusively`), so
+ * no tick commits the edit meanwhile. A moved document first moves back through the move
+ * engine (its links and redirects too), unredirected. Every other tab that had it open or
+ * was editing it is listed in its discard record (autosaves.ts): their writes are refused
+ * until they let go (`{ file, seen: true }`), and each other person who edited it or had it
+ * open gets a "discarded" notice. Refused while someone else is editing it now (a fresh
+ * lock), while a Publish runs, and for nothing waiting.
  *
  * One per process, beside the runtime (`liveEditor`), or made by tests
  * (`createLiveEditor`) on a runtime from `createLiveRuntime` with the in-memory
@@ -32,8 +42,11 @@ import type { DraftsStore } from '../editor/server/drafts-store.ts';
 import { handleCreate, handleDelete } from '../editor/server/create.ts';
 import { checkOrigin, confinePath, fileVersion, handleWrite, tabOf, WriteRefused } from '../editor/server/write.ts';
 import { missingAltIn } from '../editor/server/media/alt.ts';
+import { settingsWithRedirectsBack } from '../editor/server/move.ts';
+import { parseAnyDocument } from '../document.ts';
 import type {
 	ApiError,
+	DiscardResponse,
 	HistoryResponse,
 	LockRefusal,
 	LockResponse,
@@ -47,7 +60,7 @@ import type {
 } from '../editor/types.ts';
 import { Autosaves, splitMoves } from './autosaves.ts';
 import { lastChangeOf, liveDraftsStore, unavailable } from './drafts-store.ts';
-import { LiveGit, movesIn, NO_REDEPLOYER_REASON, titleOf } from './git.ts';
+import { LiveGit, movesIn, NO_REDEPLOYER_REASON, titleOf, type DraftsLost } from './git.ts';
 import { accessProblemMessage, type GitHubAccessProblem } from './github.ts';
 import { parseRedirects, type Redirect } from '../redirects.ts';
 import { Locks } from './locks.ts';
@@ -56,7 +69,9 @@ import type { LiveSettings } from './mode.ts';
 import { Notices, type StoodNotice } from './notices.ts';
 import { RedisUnavailableError } from './redis.ts';
 import { liveRuntime, type LiveRuntime } from './runtime.ts';
-import { Sweep, type Schedule } from './sweep.ts';
+import { Sweep, SweepBusyError, type Schedule } from './sweep.ts';
+import { readCappedText } from '../body.ts';
+import { textProblems } from '../document-problems.ts';
 
 type Handler = (request: Request, person: Person | null) => Promise<Response>;
 
@@ -67,8 +82,33 @@ const ACCESS_TITLE: Record<GitHubAccessProblem['kind'], string> = {
 	permission: 'GitHub refused a change',
 	expiring: "This site's GitHub token expires soon",
 	cloud: 'No GitHub access through CaraCMS Cloud',
+	// caracms-cloud adversarial review, finding 7: information, not a problem.
+	renamed: "This site's repo has a new name",
 };
 
+/** Finding 4: the save bar's sentence while draft commits keep failing. */
+export const COMMIT_TROUBLE_MESSAGE = "Saved here, but not reaching GitHub. Ask your developer to check the site's GitHub access.";
+
+/** Finding 5: the note's sentence once `drafts` had to be made again from `main`. */
+export function draftsLostMessage(lost: DraftsLost): string {
+	const lastCommit = lost.commit ? `its last commit (${lost.commit.slice(0, 7)}) couldn't be found` : 'no record of its last commit was kept';
+	return `The drafts branch went missing on GitHub and ${lastCommit}, so it was made again from the live site. Changes saved since the last Publish are gone from the editor. Ask your developer to protect the drafts branch from deletion.`;
+}
+
+/** Force-push note (caracms-cloud adversarial review): `main` was rolled back past the last Publish. */
+export const MAIN_ROLLED_BACK_TITLE = 'The live site was rolled back on GitHub';
+export const MAIN_ROLLED_BACK_MESSAGE =
+	"The changes waiting here include what was rolled back, and publishing will put it back. Discard what you don't want first: each waiting document has Discard… in the Publish list.";
+
+/**
+ * A Redis outage before a Publish's refs move (finding 6): nothing went out, and nothing is
+ * held in the browser either (that's the write route's sentence, `unavailable`).
+ */
+export function publishUnavailable(error: unknown): WriteRefused {
+	const what = error instanceof Error ? error.message : String(error);
+	return new WriteRefused(503, `The server can't reach its store right now, so it couldn't publish. Your changes are still waiting: try again in a minute (${what}).`, { code: 'unavailable' });
+}
+
 export interface LiveEditor {
 	readonly runtime: Pick<LiveRuntime, 'site' | 'settings' | 'git' | 'redis' | 'timings' | 'now'>;
 	readonly autosaves: Autosaves;
@@ -85,6 +125,8 @@ export interface LiveEditor {
 	history: Handler;
 	tryAgain: Handler;
 	notice: Handler;
+	/** Discard changes: POST /_caracms/discard `{ file }` (types.ts → DiscardRequest). */
+	discard: Handler;
 }
 
 export interface LiveEditorOptions {
@@ -99,8 +141,8 @@ const HEADERS = { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Cont
 const json = (status: number, body: unknown) => new Response(JSON.stringify(body), { status, headers: HEADERS });
 const sameEmail = (a: Person, b: Person) => a.email.toLowerCase() === b.email.toLowerCase();
 
-/** A notice id: `kept:<file>:<commit>` or `stood:<commit>:<file>:<email>`, no spaces or controls, capped. */
-const NOTICE_ID = /^(kept|stood):[^\s\p{C}]+$/u;
+/** A notice id: `kept:<file>:<commit>`, `stood:<commit>:<file>:<email>` or `discarded:<at>:<file>:<email>`, no spaces or controls, capped. */
+const NOTICE_ID = /^(kept|stood|discarded):[^\s\p{C}]+$/u;
 const NOTICE_ID_MAX = 512;
 
 /** Map a site file to its document (collection and path), or nulls. */
@@ -152,9 +194,9 @@ export async function createLiveEditor(
 	// hook above in place, so a merge from main commits every pending autosave first.
 	await git.check({ force: true }).catch((error: unknown) => log(`check at startup: ${error instanceof Error ? error.message : String(error)}`));
 
-	/** Common gate: a person, the same origin for anything but GET, Redis outages as 503. */
+	/** Common gate: a person, the same origin for anything but GET, Redis outages as 503 (`outage`: that route's sentence for one). */
 	const handler =
-		(methods: string[], fn: (request: Request, person: Person) => Promise<Response>): Handler =>
+		(methods: string[], fn: (request: Request, person: Person) => Promise<Response>, outage: (error: unknown) => WriteRefused = unavailable): Handler =>
 		async (request, person) => {
 			try {
 				if (!methods.includes(request.method)) {
@@ -167,7 +209,7 @@ export async function createLiveEditor(
 				if (request.method !== 'GET') checkOrigin(request);
 				return await fn(request, person);
 			} catch (error) {
-				const refused = error instanceof RedisUnavailableError ? unavailable(error) : error;
+				const refused = error instanceof RedisUnavailableError ? outage(error) : error;
 				if (refused instanceof WriteRefused) return json(refused.status, { error: refused.message, ...refused.body });
 				log(`${new URL(request.url).pathname} failed: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
 				return json(502, { error: `That didn't work (${error instanceof Error ? error.message : String(error)}).` } satisfies ApiError);
@@ -175,8 +217,9 @@ export async function createLiveEditor(
 		};
 
 	const readBody = async (request: Request): Promise<Record<string, unknown>> => {
-		const raw = await request.text();
-		if (raw.length > 16_384) throw new WriteRefused(413, 'That body is too large.');
+		// caracms-cloud adversarial review, finding 10: 16 KB counted as it's read, never the whole body first.
+		const raw = await readCappedText(request, 16_384);
+		if (raw === null) throw new WriteRefused(413, 'That body is too large.');
 		try {
 			const body = JSON.parse(raw || '{}') as unknown;
 			if (body && typeof body === 'object' && !Array.isArray(body)) return body as Record<string, unknown>;
@@ -320,7 +363,11 @@ export async function createLiveEditor(
 		// autosave's text, else the copy's). A deleted document has none.
 		const textNow = new Map(saves.map((a) => [a.file, a.text]));
 		for (const w of waiting.values()) {
-			w.missingAlt = w.change === 'deleted' ? [] : missingAltOf(w.file, w.collection, textNow.has(w.file) ? (textNow.get(w.file) ?? null) : git.read(w.file));
+			const text = textNow.has(w.file) ? (textNow.get(w.file) ?? null) : git.read(w.file);
+			w.missingAlt = w.change === 'deleted' ? [] : missingAltOf(w.file, w.collection, text);
+			// caracms-cloud adversarial review, finding 15: what Publish will leave waiting, by the same rule (git.ts → heldBack).
+			const [problem] = w.change !== 'deleted' && w.collection !== null && text !== null ? textProblems(text) : [];
+			if (problem) w.heldBack = problem.reason;
 		}
 		// Pre-M7 item 8: a moved document is one entry, on its new file, with its old address.
 		// Read from the moves as recorded, not Site Settings' redirects: removing the redirect leaves it a move.
@@ -359,9 +406,16 @@ export async function createLiveEditor(
 			if (save ? save.gone : git.read(file) === null) {
 				deleted = record?.gone ? { by: record.by, at: record.at } : { by: null, at: null };
 			}
-			open = { file, state: Locks.state(lock), lock, lastChange: await lastChangeOf({ git, autosaves }, file, record), deleted };
+			// Discard changes: this tab had it when someone put it back to what's live (its copy is stale).
+			const discard = record?.discard;
+			const discarded = discard && tab && discard.tabs.includes(tab) ? { by: discard.by, at: discard.at } : null;
+			open = { file, state: Locks.state(lock), lock, lastChange: await lastChangeOf({ git, autosaves }, file, record), deleted, discarded };
 		}
 		const access = git.backend.accessProblem();
+		// Finding 4: only while something is waiting to reach GitHub.
+		const trouble = saves.length ? git.commitTrouble() : null;
+		const lost = git.draftsLost();
+		const rolledBack = git.mainRolledBack();
 		const body: StatusResponse = {
 			mode: 'live',
 			you: person,
@@ -373,11 +427,14 @@ export async function createLiveEditor(
 			locks: lockViews,
 			presence,
 			notices: Notices.forPerson(person, git.keptDraftNotices(), titleFor, snap.set(noticeStore.dismissedKey), snap.hash(noticeStore.noticesKey).values()),
-			publish: await publishView({ running: snap.string(git.publishLockKey) !== null, record: LiveGit.publishRecordFrom(snap.string(git.publishRecordKey)) }),
+			publish: await publishView({ running: snap.string(git.publishLockKey) !== null, record: git.publishRecordOr(LiveGit.publishRecordFrom(snap.string(git.publishRecordKey))) }),
 			// Runs-anywhere Decision 5: while it holds, not dismissable.
 			githubAccess: access
 				? { kind: access.kind, title: ACCESS_TITLE[access.kind], message: accessProblemMessage(access), link: access.kind === 'cloud' ? access.installUrl : null }
 				: null,
+			commitTrouble: trouble ? { since: new Date(trouble.since).toISOString(), failures: trouble.failures, message: COMMIT_TROUBLE_MESSAGE } : null,
+			draftsLost: lost ? { title: 'Unpublished changes were lost', message: draftsLostMessage(lost), commit: lost.commit, at: lost.at } : null,
+			mainRolledBack: rolledBack ? { title: MAIN_ROLLED_BACK_TITLE, message: MAIN_ROLLED_BACK_MESSAGE, publish: rolledBack.publish, main: rolledBack.main, at: rolledBack.at } : null,
 			// M5a Decision 10: from the committed copy, never an autosave.
 			brand: editorBrand(brandFrom(git.read(SITE_SETTINGS_FILE), site)),
 			// Arrange pages (Decision 18): from the autosaves already in the snapshot, else the copy; no Redis command of its own.
@@ -428,7 +485,10 @@ export async function createLiveEditor(
 	const publish = handler(['POST'], async (_request, person) => {
 		const before = await locks.presence();
 		const work = git.publish(person).then(async (result) => {
-			await stoodNotices(result, before, person);
+			// Finding 6: the notices are kept in Redis, so with Redis gone they can't be sent; the Publish happened all the same.
+			await stoodNotices(result, before, person).catch((error: unknown) => {
+				log(`publish: the "published as it stood" notices weren't sent (${error instanceof Error ? error.message : String(error)})`);
+			});
 			return result;
 		});
 		// Runs-anywhere (Watch-outs): Cloudflare gives up on an answer after 100 s, and a
@@ -444,8 +504,17 @@ export async function createLiveEditor(
 			work.catch((error: unknown) => log(`publish (answered early): ${error instanceof Error ? error.message : String(error)}`));
 			return json(200, { result: 'joined', publish: await publishView() } satisfies PublishResponse);
 		}
+		if (result.kind === 'published') {
+			// Finding 6: the record as made, not as Redis has it (it may not have taken it); the lock read is the only Redis call, and its failure isn't the Publish's.
+			const running = await redis.get(git.publishLockKey).then(
+				(v) => v !== null,
+				() => false,
+			);
+			return json(200, { result: result.kind, publish: await publishView({ running, record: result.record }), held: result.held } satisfies PublishResponse);
+		}
+		if (result.kind === 'held-back') return json(200, { result: result.kind, publish: await publishView(), held: result.held } satisfies PublishResponse);
 		return json(200, { result: result.kind, publish: await publishView() } satisfies PublishResponse);
-	});
+	}, publishUnavailable);
 
 	/** "Aoife published Home as it stood at 14:20" for whoever had a published document open (Decision 10 step 1). */
 	const stoodNotices = async (result: Awaited<ReturnType<typeof git.publish>>, before: Awaited<ReturnType<typeof locks.presence>>, person: Person) => {
@@ -493,7 +562,154 @@ export async function createLiveEditor(
 		return json(200, { ok: true });
 	});
 
-	return { runtime, autosaves, locks, sweep, store, write, create, delete: remove, status, lock, publish, history, tryAgain, notice };
+	/**
+	 * Discard changes (see the header). `{ file }`: the document's file now (a moved one's new
+	 * file). `{ file, seen: true }`: this tab has let go of its copy of a discarded document.
+	 */
+	const discard = handler(['POST'], async (request, person) => {
+		const tab = tabOf(request);
+		if (!tab) throw new WriteRefused(400, 'Discard requests name their tab (X-Caracms-Tab).', { code: 'no-tab' });
+		const body = await readBody(request);
+		const extra = Object.keys(body).filter((k) => k !== 'file' && k !== 'seen');
+		if (extra.length || typeof body.file !== 'string' || (body.seen !== undefined && body.seen !== true)) {
+			throw new WriteRefused(400, 'Malformed body: send { file } (or { file, seen: true }).', { code: 'bad-request' });
+		}
+		const file = body.file;
+		confinePath(site, file);
+		if (body.seen === true) {
+			await autosaves.ackDiscard(file, tab);
+			return json(200, { ok: true });
+		}
+		if ((await redis.get(git.publishLockKey)) !== null) throw new WriteRefused(409, "A Publish is running. Try again once it's done.", { code: 'publishing' });
+
+		// What's waiting for it: an autosave, a commit on drafts that main hasn't got, or a move to it.
+		const save = (await autosaves.get(file))?.value ?? null;
+		const textNow = save ? save.text : git.read(file);
+		const fromGit = git.waiting().find((w) => w.file === file) ?? null;
+		const moves = await autosaves.moves();
+		const from = [...moves].find(([, to]) => to === file)?.[0] ?? null;
+		const change = git.changeOf(file, textNow);
+		const title = save?.gone ? save.gone.title : textNow !== null ? titleOf(file, textNow) : git.titleFor(file);
+		if (!change || (!save && !fromGit && !from)) {
+			if (!from && (await autosaves.addresses()).has(file)) {
+				throw new WriteRefused(409, `${title} moved with the page that holds it. Discard that page's changes to put it back.`, { code: 'held-move' });
+			}
+			throw new WriteRefused(404, `${title} has no unpublished changes.`, { code: 'not-waiting' });
+		}
+
+		// Someone else editing it right now (a fresh lock, not one held only until their autosave is committed).
+		const own = [file, ...(from ? [from] : [])];
+		for (const f of own) {
+			const held = await locks.read(f);
+			if (held && !sameEmail(held.lock.person, person) && held.lock.releasing === null && now() - held.lock.beat < timings.lockLapseMs) {
+				throw new WriteRefused(409, `${displayName(held.lock.person)} is editing ${title} right now, so its changes can't be discarded yet.`, { code: 'locked' });
+			}
+		}
+
+		const t0 = now();
+		let movedBack: DiscardResponse['movedBack'] = null;
+		if (from && git.mainHas(from)) {
+			// Back to its old address first, through the move engine (its links, the redirects, what
+			// moved with it), with no redirect. A swap (it took a live document's place) isn't undone here.
+			const there = docOf(site, file);
+			const back = docOf(site, from);
+			if (git.mainHas(file)) throw new WriteRefused(409, `${title} took the place of a page that's live, so it can't be discarded on its own.`, { code: 'swap' });
+			if (!there.collection || !there.path || !back.path || back.collection !== there.collection) {
+				throw new WriteRefused(409, `${title} can't go back to its old address from here.`, { code: 'swap' });
+			}
+			// Any lock someone left on it (only held until their autosave is committed) goes, so the move can take it.
+			for (const f of own) {
+				const held = await locks.read(f);
+				if (held && held.lock.tab !== tab) await locks.drop(held, f);
+			}
+			const context = { person, tab, release: false, seq: null };
+			const moved = await store.move({ collection: there.collection, path: there.path, to: back.path, redirect: false }, context);
+			// A redirect the move took out of Site Settings (from the address it took) comes back, as it is live.
+			const vacated = moved.moved.filter((m) => m.fromUrl !== m.toUrl).map((m) => m.fromUrl);
+			const current = (await autosaves.get(SITE_SETTINGS_FILE))?.value.text ?? git.read(SITE_SETTINGS_FILE);
+			const restored = settingsWithRedirectsBack(site, current, (await git.readMain([SITE_SETTINGS_FILE])).get(SITE_SETTINGS_FILE) ?? null, vacated);
+			if (restored !== null && current !== null) {
+				const settings = site.collections.settings ?? Object.values(site.collections).find((c) => c.kind === 'settings');
+				if (settings) {
+					await store.write({ file: SITE_SETTINGS_FILE, base: current, document: parseAnyDocument(JSON.parse(restored), site, settings) }, context);
+					await locks.release(SITE_SETTINGS_FILE, tab, person);
+				}
+			}
+			await locks.release(from, tab, person);
+			movedBack = { collection: back.collection, path: back.path, file: from };
+		}
+
+		const result = await sweep
+			.exclusively(async () => {
+				// The document's files, and any file the move back left exactly as main has it (a link put back).
+				const files = new Set(own);
+				if (movedBack) {
+					const mine = (await autosaves.all()).map((r) => r.value).filter((a) => a.tab === tab && sameEmail(a.editor, person) && a.updatedAt >= t0 && !files.has(a.file));
+					const main = await git.readMain(mine.map((a) => a.file));
+					for (const a of mine) if (a.text === (main.get(a.file) ?? null)) files.add(a.file);
+				}
+				const list = [...files];
+				// Every tab that has it or had edits in it, but this one: their copies are stale from now.
+				const tabs = new Set<string>();
+				const people = new Map<string, Person>();
+				const note = (p: Person) => {
+					if (!sameEmail(p, person)) people.set(p.email.toLowerCase(), p);
+				};
+				for (const e of fromGit?.editors ?? []) note(e.person);
+				for (const f of list) {
+					const a = (await autosaves.get(f))?.value;
+					if (a) {
+						tabs.add(a.tab);
+						note(a.editor);
+					}
+					const c = await autosaves.committed(f);
+					if (c) tabs.add(c.tab);
+					const l = await locks.read(f);
+					if (l) tabs.add(l.lock.tab);
+					for (const p of await locks.tabsOn(f)) {
+						tabs.add(p.tab);
+						note(p.person);
+					}
+				}
+				tabs.delete(tab);
+				const at = new Date(now()).toISOString();
+				const titles = [title];
+				const restored = await git.restoreDrafts(list, titles, person);
+				// Who changed it last, as it reads now, with the discard and the tabs that had it.
+				const changeOf = (f: string) => {
+					const text = restored.texts.get(f) ?? null;
+					const discard = { by: person, at, tabs: [...tabs] };
+					return text === null ? { by: person, version: '', at, gone: true, discard } : { by: person, version: fileVersion(text), at, discard };
+				};
+				for (const f of list) await autosaves.setChanged(f, changeOf(f));
+				for (const f of list) {
+					for (const gone of await autosaves.removeAll(f)) if (gone.tab !== tab) tabs.add(gone.tab);
+					await autosaves.forgetCommitted(f);
+				}
+				await autosaves.forgetMovesOf(list);
+				for (const f of list) {
+					await autosaves.setChanged(f, changeOf(f)); // any tab whose autosave was removed just now too
+					// This tab's lock lets go; one left by a tab that's gone is dropped; a live one (your other tab) stays, and that tab is told.
+					const l = await locks.read(f);
+					const fresh = !!l && l.lock.releasing === null && now() - l.lock.beat < timings.lockLapseMs;
+					if (l && l.lock.tab === tab) await locks.release(f, tab, person);
+					else if (l && !fresh) await locks.drop(l, f);
+				}
+				// "Aoife discarded the unpublished changes to About", for everyone else who had it.
+				await noticeStore
+					.addStood([...people.values()].map((p) => ({ id: `discarded:${at}:${file}:${p.email.toLowerCase()}`, for: p.email.toLowerCase(), file: movedBack?.file ?? file, title, by: person, at, kind: 'discarded' as const })))
+					.catch((error: unknown) => log(`discard: the notices weren't left (${error instanceof Error ? error.message : String(error)})`));
+				log(`${person.email} discarded the unpublished changes to ${list.join(', ')}`);
+				return { files: list };
+			})
+			.catch((error: unknown) => {
+				if (error instanceof SweepBusyError) throw new WriteRefused(409, 'The server is busy saving changes. Try again in a moment.', { code: 'busy' });
+				throw error;
+			});
+		return json(200, { ok: true, file, change, files: result.files, movedBack } satisfies DiscardResponse);
+	});
+
+	return { runtime, autosaves, locks, sweep, store, write, create, delete: remove, status, lock, publish, history, tryAgain, notice, discard };
 }
 
 const SHARED = Symbol.for('caracms.liveEditor');