smoodly 0.0.27 → 0.0.29

package/README.md

@@ -490,6 +490,38 @@ Implemented:
   the public keys"); admin ops — `test/admin-auth.test.ts`,
   `test/admin-auth.supabase.test.ts`, `test/admin-ops.test.ts` ("members
   ops").
+- Redirects (spec 2026-09-26 redirects): a `paths` row with `redirect`
+  set is an old address of its target (schema version 4). A published
+  rename or move keeps the old addresses as redirects unless the editor
+  unticks "Redirect the old address" on the live-URL confirm; the live
+  URL wins an address; nothing chains; `renderSmoodlyPath` answers a
+  redirect row with `permanentRedirect` through `href`. Settings ›
+  Redirects (every member) lists, adds by hand (validated old address,
+  target type-ahead) and removes. Tests: `test/path-index-contract.ts`
+  (the rule table, both adapters), the store contracts, `admin-ops`
+  ("redirects on rename and move", "redirects ops"),
+  `next-page-renderer` ("redirects"), `examples/site/e2e/redirects.spec.ts`.
+- Editor safety (spec 2026-09-27 editor safety): schema drift — stored
+  content the code no longer describes — is found by one pure walk
+  (`admin/drift.ts`) over the serialized registry. Broken findings
+  (an unknown section, element, page type or collection; a value that
+  doesn't fit its field; a zone rule broken) refuse publish for pages,
+  entries and global items; left-over ones (a removed field or zone, an
+  element outside its toolset, a localization change) never do. The
+  validator's one type check is `fits` (text and number checked for the
+  first time). Settings › Content health (every member) reports every
+  document, draft and live, grouped by the change; the editors mark the
+  open document (notice, Outline marks, a canvas placeholder, the
+  unknown-section inspector with Remove section, misfits as field
+  errors, a "No longer in the schema" group with Copy and Clear, Clear
+  zone). Turning `.localized()` on no longer deletes the other locales'
+  value (update, discard and restore keep a localized key's shared
+  value); the last `window.alert`s are `notify()`. No bulk writes
+  (OQ 35). Tests: `admin-drift`, `admin-drift-copy`, `admin-health`,
+  `admin-health-list`, `admin-health-page`, `admin-drift-markers`,
+  `admin-unknown-node`, the store contracts (`scanTrees`,
+  `scanEntries`, the pinning tests), `entry-store.supabase` (the
+  localized fix across two schemas), `examples/site/e2e/health.spec.ts`.
 
 Not yet: canvas drag-and-drop (list fields, the outline, manual
 collections and the pages tree drag since 2026-09-09 — spec
@@ -517,6 +549,42 @@ after both are on the registry. From the repo root:
 `prepublishOnly` rebuilds each package. The Claude Code skill
 `.claude/skills/releasing-smoodly` carries the same order with its checks.
 
+## Follow-ups (logged 2026-09-27, editor safety spec)
+
+- Scan paging: `health.scan` makes one bulk read per table (versions by
+  id in chunks of 100), and PostgREST's max-rows would cap a very large
+  space. Page it, and add a rail badge, when a real site's size asks.
+- Refs inside unknown nodes are not indexed: without a schema nothing
+  says which values are refs, so safe-delete cannot see them. Publish
+  refuses such nodes and a live one renders nothing.
+- Leftover shared values after `.localized()` is turned on stay on the
+  entry as every locale's fallback; removing them for good waits on
+  the fix tooling (OQ 35). `localization-on` is reported only where a
+  locale has no value of its own, so a fully translated entry no
+  longer lists it.
+- A visual global item's settings misfits (`settings.x`) don't reach
+  their widgets in the Globals form: `GlobalFields` keys errors by the
+  bare field key, the same gap the validator's refusal keys had before.
+  The notice and the refusal list still name them.
+- A CLI drift report was left out (the admin already has the config and
+  the database; a CLI needs the service key and a TS config loader).
+
+## Follow-ups (logged 2026-09-26, redirects spec)
+
+- Destinations outside Smoodly, extension and query-string addresses,
+  code-owned renames (a collection `path`, a fixed slug): the guide's
+  `next.config` recipe; a `redirects` table is OQ 34.
+- The content API's `getPage("/old")` returns null for a redirect row
+  (spec §7); a `follow` option is a one-line addition if a site asks.
+- A redirect row has no audit columns (who, when); add them with a
+  need. The Redirects page is not paged.
+- The browser suite covers rename, the unticked box, no chains, the
+  Settings tab's list and the manual add/remove; a parent's MOVE
+  redirecting a child's URL is proven at the store contract and ops
+  level only (no tree drag in the suite yet).
+- `remove` on the Supabase index deletes by target, one statement per
+  target (the RPC now spares redirect rows); fine at subtree sizes.
+
 ## Follow-ups (logged 2026-09-26, security pass)
 
 - The bridge posts with `"*"` on both sides. Safe today: the admin
@@ -649,9 +717,13 @@ after both are on the registry. From the repo root:
   section, a global or a page is a plain chip input.
 - The picker's "open" link goes to `/admin/<collection>/<id>` without
   the edited locale; the form opens in the URL's or the default locale.
-- The Combobox list flips upwards when it does not fit under the input
-  (`opensUp`, measured against the nearest clipping ancestor); it does
-  not yet shrink when neither side has room for it.
+- The Combobox list is portaled into the admin wrapper and fixed to the
+  viewport (2026-09-27), so a modal body or scrolling form no longer
+  clips it; it flips upwards when the viewport has no room under the
+  input (`listPlacement`) and follows the input on scroll. It does not
+  yet shrink when neither side has room for it. A single select (a
+  single `f.ref`, the redirect target) shows its pick inside the input;
+  a single ref's status, open link and remove sit in the input too.
 - `RefOption.status` is the three-way `LocaleStatus` now; the old
   "(draft)" suffix in option titles is gone with the native select.
 - A `refList` on a global item's `settings` still loads no options in

package/dist/admin/client-ops.js

@@ -4,6 +4,8 @@ const GROUPS = {
     globals: ["list", "get", "save", "setStatus", "discardDraft", "listVersions", "getVersion", "restore"],
     assets: ["list", "get", "beginUpload", "finishUpload", "update", "delete", "usage"],
     members: ["list", "me", "invite", "setRole", "remove"],
+    redirects: ["list", "targets", "add", "remove"],
+    health: ["scan"],
     schema: ["status"],
     preview: ["enable", "disable"],
 };

package/dist/admin/drift-copy.d.ts

@@ -0,0 +1,19 @@
+import type { FieldError } from "./validate.ts";
+import { type Finding } from "./drift.ts";
+import type { AdminRegistry } from "./serialize.ts";
+/** A stored value as its JSON, cut at 60 characters. */
+export declare function valuePreview(value: unknown): string;
+/** One line: what a publish refusal lists and what a marker says. */
+export declare function driftMessage(f: Finding): string;
+/** The refusal's list (§6): the validator's errors, then each broken finding once per key. */
+export declare function publishErrors(validator: FieldError[], findings: Finding[]): FieldError[];
+/** The report's group line (§4): what the developer changed. */
+export declare function driftHeadline(f: Finding, _registry: AdminRegistry): string;
+/** The document notice under the top bar (§5): the counts, the live-only line, and what a localization change does on save. */
+export declare function driftNotice(draft: Finding[], live: Finding[]): {
+    summary: string | null;
+    liveOnly: string | null;
+    sentences: string[];
+};
+/** The markers' field-error map (§5): each misfit's message at its path, `strip.` removed. */
+export declare function misfitErrors(findings: Finding[], strip?: string): Record<string, string>;

package/dist/admin/drift-copy.js

@@ -0,0 +1,89 @@
+import { isBroken } from "./drift.js";
+/** A stored value as its JSON, cut at 60 characters. */
+export function valuePreview(value) {
+    let text;
+    try {
+        text = JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        text = String(value);
+    }
+    return text.length > 60 ? `${text.slice(0, 60)}…` : text;
+}
+/** One line: what a publish refusal lists and what a marker says. */
+export function driftMessage(f) {
+    switch (f.kind) {
+        case "unknown-section": return f.subject.scope === "global" ? "The code no longer registers this global item." : "The code no longer registers this section.";
+        case "unknown-element": return "The code no longer registers this element.";
+        case "unknown-shape": return "The code no longer registers this page type.";
+        case "unknown-collection": return "The code no longer registers this collection.";
+        case "misfit": return `The stored value doesn't fit this field: ${valuePreview(f.value)}`;
+        case "zone-disallowed": return `Zone \`${f.subject.name}\` no longer allows \`${f.subject.field}\`. Remove or move it to publish.`;
+        case "zone-over-max": return `Zone \`${f.subject.name}\` allows ${f.detail?.max} sections and has ${f.detail?.count}.`;
+        case "orphan-field": return "No longer in the schema.";
+        case "orphan-zone": return `Removed zone \`${f.subject.name}\` · ${f.detail?.count} ${f.detail?.count === 1 ? "section" : "sections"}`;
+        case "element-outside-toolset": return "Not in this field's toolset";
+        case "localization-on": return `\`${f.subject.field}\` is now translated per language. Its shared value shows in every language until it's saved there.`;
+        case "localization-off": return `\`${f.subject.field}\` is now shared. Saving here makes this language's value the one every language shows.`;
+    }
+}
+/** The refusal's list (§6): the validator's errors, then each broken finding once per key. */
+export function publishErrors(validator, findings) {
+    const out = [...validator];
+    const seen = new Set(out.map((e) => e.field));
+    for (const f of findings) {
+        if (!isBroken(f) || seen.has(f.path))
+            continue;
+        seen.add(f.path);
+        out.push({ field: f.path, message: driftMessage(f) });
+    }
+    return out;
+}
+const SCOPE_WORD = { section: "section", element: "element", collection: "collection", global: "global item", page: "page type", zone: "zone" };
+/** The report's group line (§4): what the developer changed. */
+export function driftHeadline(f, _registry) {
+    const s = f.subject;
+    const owner = `${SCOPE_WORD[s.scope]} \`${s.name}\``;
+    switch (f.kind) {
+        case "unknown-section": return s.scope === "global" ? `Unknown global item \`${s.name}\`` : `Unknown section \`${s.name}\``;
+        case "unknown-element": return `Unknown element \`${s.name}\``;
+        case "unknown-shape": return `Unknown page type \`${s.name}\``;
+        case "unknown-collection": return `Collection \`${s.name}\` no longer registered`;
+        case "misfit": return `\`${s.field}\` in ${owner} doesn't fit f.${f.detail?.type}()`;
+        case "zone-disallowed": return `Zone \`${s.name}\` of \`${s.within}\` no longer allows \`${s.field}\``;
+        case "zone-over-max": return `Zone \`${s.name}\` of \`${s.within}\` holds more than its max`;
+        case "orphan-field": return `Field \`${s.field}\` no longer in ${owner}`;
+        case "orphan-zone": return `Zone \`${s.name}\` no longer on page type \`${s.within}\``;
+        case "element-outside-toolset": return `Element \`${s.name}\` not in the toolset of \`${s.field}\``;
+        case "localization-on": return `\`${s.field}\` in ${owner} is now translated — a shared value is left`;
+        case "localization-off": return `\`${s.field}\` in ${owner} is now shared — languages still hold their own`;
+    }
+}
+const n = (count, one, many) => `${count} ${count === 1 ? one : many}`;
+/** The document notice under the top bar (§5): the counts, the live-only line, and what a localization change does on save. */
+export function driftNotice(draft, live) {
+    const broken = draft.filter(isBroken).length;
+    const orphans = draft.length - broken;
+    const parts = [
+        broken > 0 ? `${n(broken, "problem blocks", "problems block")} publishing` : null,
+        orphans > 0 ? `${orphans} left over from an older schema` : null,
+    ].filter(Boolean);
+    const inDraft = new Set(draft.map((f) => `${f.kind}|${f.path}`));
+    const liveOnly = live.filter((f) => !inDraft.has(`${f.kind}|${f.path}`)).length;
+    return {
+        summary: parts.length > 0 ? parts.join(" · ") : null,
+        liveOnly: liveOnly > 0 ? `The live version has ${n(liveOnly, "problem", "problems")} the draft has already fixed — publish to clear it.` : null,
+        sentences: draft.filter((f) => f.kind === "localization-on" || f.kind === "localization-off").map(driftMessage),
+    };
+}
+/** The markers' field-error map (§5): each misfit's message at its path, `strip.` removed. */
+export function misfitErrors(findings, strip) {
+    const out = {};
+    for (const f of findings) {
+        if (f.kind !== "misfit")
+            continue;
+        const path = strip && f.path.startsWith(`${strip}.`) ? f.path.slice(strip.length + 1) : f.path;
+        out[path] = driftMessage(f);
+    }
+    return out;
+}

package/dist/admin/drift.d.ts

@@ -0,0 +1,76 @@
+import type { AdminField, AdminRegistry } from "./serialize.ts";
+import type { PageTree } from "../render.tsx";
+export type DriftKind = "unknown-section" | "unknown-element" | "unknown-shape" | "unknown-collection" | "misfit" | "zone-disallowed" | "zone-over-max" | "orphan-field" | "orphan-zone" | "element-outside-toolset" | "localization-on" | "localization-off";
+export type Severity = "broken" | "orphan";
+export declare const SEVERITY: Record<DriftKind, Severity>;
+/** Where the change the developer made lives — the report groups by it (§4). */
+export type DriftScope = "section" | "element" | "collection" | "global" | "page" | "zone";
+/** `field` is index-free (`points[].icon`); `within` names an outer owner (a zone's page type, an element's section). */
+export type DriftSubject = {
+    scope: DriftScope;
+    name: string;
+    field?: string;
+    within?: string;
+};
+/** `path` is the error key the publish refusal and the markers use (§6); indices stay in it. */
+export type Finding = {
+    kind: DriftKind;
+    path: string;
+    subject: DriftSubject;
+    /** A misfit's or an orphan's stored value — the marker's read-only copy. */
+    value?: unknown;
+    /** A misfit's field type; a zone's max and its node count. */
+    detail?: {
+        type?: string;
+        max?: number;
+        count?: number;
+    };
+};
+export declare const isBroken: (f: Finding) => boolean;
+/** The validator's empty: an empty value is `required`'s question, never drift's. */
+export declare const isEmptyValue: (v: unknown) => boolean;
+/** Whether a stored value is the shape its field kind stores (§2). Empty always fits; a kind
+ *  this list does not know fits (the custom section's `spans`, whose structure is rowsProblems'). */
+export declare function fits(d: {
+    type: string;
+    options?: unknown;
+}, value: unknown): boolean;
+/** What the validator says when `fits` is false — its long-standing words, plus text and number. */
+export declare function misfitMessage(d: {
+    type: string;
+    options?: unknown;
+}, value: unknown): string;
+export type Holder = {
+    fields?: unknown;
+    settings?: unknown;
+    styles?: unknown;
+};
+export type HolderSchema = {
+    fields: Record<string, AdminField>;
+    settings?: Record<string, AdminField>;
+    styles?: Record<string, AdminField>;
+};
+/** A node-shaped value — a tree node, a visual global item — against a section-shaped schema:
+ *  fields at `prefix`, settings and styles under `prefix.settings` / `prefix.styles` (§1). */
+export declare function holderDrift(registry: AdminRegistry, subject: DriftSubject, prefix: string, holder: Holder, schema: HolderSchema): Finding[];
+/** A page's draft or live tree against its page type (§1): the type itself, each declared zone's
+ *  rules and nodes, stored zones the type no longer declares (orphans, never walked), page fields. */
+export declare function pageDrift(registry: AdminRegistry, template: string | null, tree: PageTree | null): Finding[];
+export type EntryInput = {
+    /** The merged view the editor sees (shared with the locale row on top). */
+    fields: Record<string, unknown>;
+    /** The node's shared fields and the locale row's own — both present to check localization. */
+    shared?: Record<string, unknown>;
+    own?: Record<string, unknown>;
+};
+/** An entry's or a global item's fields against its registration (§1). `name` is the stored
+ *  collection name: a collection, a global item, or neither — an unregistered collection. */
+export declare function entryDrift(registry: AdminRegistry, name: string, input: EntryInput): Finding[];
+/** The report's group (§4): what changed, not where — kind, scope, owner, name, index-free field. */
+export declare const groupKey: (f: Finding) => string;
+export type VersionedFinding = Finding & {
+    draft: boolean;
+    live: boolean;
+};
+/** One list per document and locale: a finding in both versions is listed once with both tags (§3). */
+export declare function mergeVersions(draft: Finding[], live: Finding[]): VersionedFinding[];

package/dist/admin/drift.js

@@ -0,0 +1,264 @@
+import { optionValues } from "../fields.js";
+import { isHidden } from "../conditions.js";
+import { allowedOf } from "../toolset.js";
+import { CUSTOM_NODE_TYPE } from "../custom/schema.js";
+import { CSS_KEY, GLOBAL_NODE_TYPE, SETTINGS_KEY, STYLES_KEY } from "../global.js";
+export const SEVERITY = {
+    "unknown-section": "broken", "unknown-element": "broken", "unknown-shape": "broken", "unknown-collection": "broken",
+    misfit: "broken", "zone-disallowed": "broken", "zone-over-max": "broken",
+    "orphan-field": "orphan", "orphan-zone": "orphan", "element-outside-toolset": "orphan",
+    "localization-on": "orphan", "localization-off": "orphan",
+};
+export const isBroken = (f) => SEVERITY[f.kind] === "broken";
+/** The validator's empty: an empty value is `required`'s question, never drift's. */
+export const isEmptyValue = (v) => v === undefined || v === null || v === "" || (Array.isArray(v) && v.length === 0);
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const isStrings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+/** Whether a stored value is the shape its field kind stores (§2). Empty always fits; a kind
+ *  this list does not know fits (the custom section's `spans`, whose structure is rowsProblems'). */
+export function fits(d, value) {
+    if (isEmptyValue(value))
+        return true;
+    switch (d.type) {
+        case "text":
+        case "link":
+        case "slug":
+        case "date":
+        case "datetime": return typeof value === "string";
+        case "tags": return isStrings(value);
+        case "number": return typeof value === "number" && Number.isFinite(value);
+        case "boolean": return typeof value === "boolean";
+        case "select":
+        case "radio": {
+            const allowed = optionValues(d.options);
+            return typeof value === "string" && (allowed.length === 0 || allowed.includes(value));
+        }
+        case "checkboxes": {
+            const allowed = optionValues(d.options);
+            return Array.isArray(value) && value.every((v) => typeof v === "string" && allowed.includes(v));
+        }
+        case "image":
+        case "video":
+        case "file": return isObject(value) && typeof value.asset === "string";
+        case "ref": return typeof value === "string";
+        case "refList": return Array.isArray(value) && value.every((v) => typeof v === "string" && v !== "");
+        case "object": return isObject(value);
+        case "list": return Array.isArray(value);
+        case "richtext": return isObject(value) && value.type === "doc";
+        default: return true;
+    }
+}
+/** What the validator says when `fits` is false — its long-standing words, plus text and number. */
+export function misfitMessage(d, value) {
+    const oneOf = () => `Must be one of: ${optionValues(d.options).join(", ")}.`;
+    switch (d.type) {
+        case "text":
+        case "link":
+        case "slug": return "Must be text.";
+        case "number": return "Must be a number.";
+        case "boolean": return "Must be on or off.";
+        case "date": return "Not a date (2026-09-02).";
+        case "datetime": return "Not a date and time.";
+        case "image":
+        case "video":
+        case "file": return "Must be an uploaded file.";
+        case "list": return "Must be a list.";
+        case "object": return "Must be an object.";
+        case "ref": return "Must be an entry.";
+        case "refList": return "Must be a list of entries.";
+        case "tags": return "Must be a list of tags.";
+        case "richtext": return "Must be rich text.";
+        case "select":
+        case "radio": return oneOf();
+        case "checkboxes": return Array.isArray(value) ? oneOf() : "Must be a list.";
+        default: return "Doesn't fit this field.";
+    }
+}
+const join = (a, b) => (a === "" ? b : `${a}.${b}`);
+/** One value map against its descriptors (§1): a stored key no descriptor names is an orphan;
+ *  a declared, visible value is checked. `path` is the error-key prefix, `schema` the index-free
+ *  path the report groups by. */
+function walkMap(path, schema, values, descs, w, scope) {
+    for (const [key, value] of Object.entries(values)) {
+        if (!(key in descs))
+            w.out.push({ kind: "orphan-field", path: join(path, key), subject: { ...w.subject, field: join(schema, key) }, value });
+    }
+    for (const [key, d] of Object.entries(descs)) {
+        if (isHidden(d, scope))
+            continue;
+        walkValue(join(path, key), join(schema, key), values[key], d, w, scope);
+    }
+}
+function walkValue(path, schema, value, d, w, scope) {
+    if (isEmptyValue(value))
+        return;
+    if (!fits(d, value)) {
+        w.out.push({ kind: "misfit", path, subject: { ...w.subject, field: schema }, value, detail: { type: d.type } });
+        return;
+    }
+    if (d.type === "object") {
+        walkMap(path, schema, value, d.fields ?? {}, w, { ...scope, self: value });
+    }
+    else if (d.type === "list") {
+        // As the validator: an item descriptor that is present and not hidden.
+        if (d.item && !isHidden(d.item, scope))
+            value.forEach((v, i) => walkValue(`${path}.${i}`, `${schema}[]`, v, d.item, w, scope));
+    }
+    else if (d.type === "richtext") {
+        walkDoc(path, schema, value, d, w);
+    }
+}
+/** Element nodes' attrs in document order at any depth — the validator's `elements.<i>`. Never mutates. */
+function elementAttrs(doc) {
+    const out = [];
+    const walk = (n) => {
+        if (!isObject(n))
+            return;
+        if (n.type === "element")
+            out.push(isObject(n.attrs) ? n.attrs : {});
+        if (Array.isArray(n.content))
+            n.content.forEach(walk);
+    };
+    walk(doc);
+    return out;
+}
+function walkDoc(path, schema, doc, d, w) {
+    const allowed = allowedOf(d.toolset).elements;
+    elementAttrs(doc).forEach((a, i) => {
+        const at = `${path}.elements.${i}`;
+        const name = typeof a.name === "string" ? a.name : "";
+        const el = w.registry.elements.find((e) => e.name === name);
+        if (!el) {
+            w.out.push({ kind: "unknown-element", path: at, subject: { scope: "element", name } });
+            return;
+        }
+        if (!allowed.includes(name) || !el.contexts.includes("richtext")) {
+            w.out.push({ kind: "element-outside-toolset", path: at, subject: { scope: "element", name, field: schema, within: `${w.subject.scope}:${w.subject.name}` } });
+        }
+        const fields = isObject(a.fields) ? a.fields : {};
+        const settings = isObject(a.settings) ? a.settings : {};
+        const inner = { ...w, subject: { scope: "element", name } };
+        walkMap(at, "", fields, el.fields, inner, { self: fields, fields, settings });
+        walkMap(`${at}.settings`, "settings", settings, el.settings, inner, { self: settings, fields, settings });
+    });
+}
+/** A node-shaped value — a tree node, a visual global item — against a section-shaped schema:
+ *  fields at `prefix`, settings and styles under `prefix.settings` / `prefix.styles` (§1). */
+export function holderDrift(registry, subject, prefix, holder, schema) {
+    const w = { registry, out: [], subject };
+    const fields = isObject(holder.fields) ? holder.fields : {};
+    const settings = isObject(holder.settings) ? holder.settings : {};
+    const styles = isObject(holder.styles) ? holder.styles : {};
+    walkMap(prefix, "", fields, schema.fields, w, { self: fields, fields, settings });
+    walkMap(join(prefix, "settings"), "settings", settings, schema.settings ?? {}, w, { self: settings, fields, settings });
+    walkMap(join(prefix, "styles"), "styles", styles, schema.styles ?? {}, w, { self: styles, fields, settings });
+    return w.out;
+}
+/** Whether a zone's policy still takes a node of this type (§1). Global placements are not checked here. */
+function zoneAllows(policy, type) {
+    if (policy.kind === "locked")
+        return type === policy.component;
+    if (policy.kind === "sections")
+        return policy.allow.includes(type);
+    if (type === CUSTOM_NODE_TYPE)
+        return policy.custom;
+    return policy.allow === "*" || policy.allow.includes(type);
+}
+function nodeDrift(registry, shape, zone, policy, node, out) {
+    if (node.type === GLOBAL_NODE_TYPE) {
+        const name = typeof node.fields?.item === "string" ? node.fields.item : "";
+        if (!registry.globals.some((g) => g.name === name))
+            out.push({ kind: "unknown-section", path: node.id, subject: { scope: "global", name } });
+        return;
+    }
+    const section = node.type === CUSTOM_NODE_TYPE ? registry.custom : registry.sections.find((s) => s.name === node.type);
+    if (!section) {
+        out.push({ kind: "unknown-section", path: node.id, subject: { scope: "section", name: node.type } });
+        return;
+    }
+    if (!zoneAllows(policy, node.type)) {
+        out.push({ kind: "zone-disallowed", path: node.id, subject: { scope: "zone", name: zone, field: node.type, within: shape } });
+    }
+    out.push(...holderDrift(registry, { scope: "section", name: section.name }, node.id, node, section));
+}
+/** A page's draft or live tree against its page type (§1): the type itself, each declared zone's
+ *  rules and nodes, stored zones the type no longer declares (orphans, never walked), page fields. */
+export function pageDrift(registry, template, tree) {
+    if (template === null)
+        return [];
+    const shape = registry.pages.find((p) => p.name === template);
+    if (!shape)
+        return [{ kind: "unknown-shape", path: "page", subject: { scope: "page", name: template } }];
+    if (!tree)
+        return [];
+    const out = [];
+    for (const [zone, stored] of Object.entries(tree.zones ?? {})) {
+        const nodes = Array.isArray(stored) ? stored : [];
+        const policy = shape.zones[zone];
+        if (!policy) {
+            if (nodes.length > 0)
+                out.push({ kind: "orphan-zone", path: `zone:${zone}`, subject: { scope: "zone", name: zone, within: shape.name }, detail: { count: nodes.length } });
+            continue;
+        }
+        if (policy.kind === "sections" && typeof policy.max === "number" && nodes.length > policy.max) {
+            out.push({ kind: "zone-over-max", path: `zone:${zone}`, subject: { scope: "zone", name: zone, within: shape.name }, detail: { max: policy.max, count: nodes.length } });
+        }
+        for (const node of nodes)
+            nodeDrift(registry, shape.name, zone, policy, node, out);
+    }
+    out.push(...holderDrift(registry, { scope: "page", name: shape.name }, "page.fields", { fields: tree.fields ?? {} }, { fields: shape.fields }));
+    return out;
+}
+const RESERVED = new Set(["slug", SETTINGS_KEY, STYLES_KEY, CSS_KEY]);
+function localization(subject, descs, input, out) {
+    if (!input.shared || !input.own)
+        return;
+    for (const [key, d] of Object.entries(descs)) {
+        if (RESERVED.has(key))
+            continue;
+        // On only where this locale still shows the shared value: once the row has its own, the
+        // leftover shared value is only a fallback (the leftover itself waits on OQ 35).
+        if (d.localized === true && key in input.shared && !(key in input.own))
+            out.push({ kind: "localization-on", path: key, subject: { ...subject, field: key }, value: input.shared[key] });
+        if (d.localized !== true && key in input.own)
+            out.push({ kind: "localization-off", path: key, subject: { ...subject, field: key }, value: input.own[key] });
+    }
+}
+/** An entry's or a global item's fields against its registration (§1). `name` is the stored
+ *  collection name: a collection, a global item, or neither — an unregistered collection. */
+export function entryDrift(registry, name, input) {
+    const out = [];
+    const collection = registry.collections.find((c) => c.name === name);
+    if (collection) {
+        const subject = { scope: "collection", name };
+        const { slug: _slug, ...fields } = input.fields;
+        out.push(...holderDrift(registry, subject, "", { fields }, { fields: collection.fields }));
+        localization(subject, collection.fields, input, out);
+        return out;
+    }
+    const item = registry.globals.find((g) => g.name === name);
+    if (item) {
+        const subject = { scope: "global", name };
+        const { [SETTINGS_KEY]: settings, [STYLES_KEY]: styles, [CSS_KEY]: _css, slug: _slug, ...fields } = input.fields;
+        out.push(...holderDrift(registry, subject, "", { fields, settings, styles }, item));
+        localization(subject, item.fields, input, out);
+        return out;
+    }
+    return [{ kind: "unknown-collection", path: "collection", subject: { scope: "collection", name } }];
+}
+/** The report's group (§4): what changed, not where — kind, scope, owner, name, index-free field. */
+export const groupKey = (f) => [f.kind, f.subject.scope, f.subject.within ?? "", f.subject.name, f.subject.field ?? ""].join("|");
+/** One list per document and locale: a finding in both versions is listed once with both tags (§3). */
+export function mergeVersions(draft, live) {
+    const out = new Map();
+    for (const f of draft)
+        out.set(`${f.kind}|${f.path}`, { ...f, draft: true, live: false });
+    for (const f of live) {
+        const hit = out.get(`${f.kind}|${f.path}`);
+        if (hit)
+            hit.live = true;
+        else
+            out.set(`${f.kind}|${f.path}`, { ...f, draft: false, live: true });
+    }
+    return [...out.values()];
+}