smoodly 0.0.27 → 0.0.29

package/dist/admin/forms/RichtextElementCard.js

@@ -11,13 +11,16 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // document's element nodes. Collapse is component state only: a card
 // starts collapsed (2026-09-09) unless it holds nothing yet — a freshly
 // inserted element opens, so its fields can be filled straight away.
+// Drift (spec 2026-09-27 editor safety §5): an unregistered element's card
+// takes the broken stripe and lists its stored fields read-only; a
+// registered one the field's toolset leaves out says so in its head.
 import { useState } from "react";
 import { NodeViewWrapper } from "@tiptap/react";
 import { isHidden } from "../../conditions.js";
-import { IconButton, SectionLabel } from "../ui/primitives.js";
+import { IconButton, SectionLabel, cx } from "../ui/primitives.js";
 import { FieldWidget } from "./FieldWidget.js";
 import { useElements } from "./elements-context.js";
-import { cardClass, useRichtextForm } from "./richtext-form-context.js";
+import { cardClass, elementCardState, useRichtextForm } from "./richtext-form-context.js";
 import { elementIndexAt } from "./richtext-insert.js";
 /** No field holds a value yet — the state right after an insert. */
 function isBlank(fields) {
@@ -31,6 +34,9 @@ export function RichtextElementCard({ node, editor, getPos, updateAttributes, de
     const fields = (node.attrs.fields && typeof node.attrs.fields === "object" ? node.attrs.fields : {});
     const settings = (node.attrs.settings && typeof node.attrs.settings === "object" ? node.attrs.settings : {});
     const [open, setOpen] = useState(() => isBlank(fields));
+    // As drift decides it: an element whose contexts dropped "richtext" is outside every toolset.
+    const allowed = form.elements?.filter((n) => elements.find((e) => e.name === n)?.contexts.includes("richtext"));
+    const state = elementCardState(name, Boolean(element), allowed);
     const pos = getPos();
     const index = typeof pos === "number" ? elementIndexAt(editor.state.doc, pos) : 0;
     const base = `${form.path}.elements.${index}`;
@@ -39,5 +45,5 @@ export function RichtextElementCard({ node, editor, getPos, updateAttributes, de
     const scope = { fields, settings };
     const visibleFields = Object.entries(element?.fields ?? {}).filter(([, d]) => !isHidden(d, { self: fields, ...scope }));
     const visibleSettings = Object.entries(element?.settings ?? {}).filter(([, d]) => !isHidden(d, { self: settings, ...scope }));
-    return (_jsxs(NodeViewWrapper, { className: cardClass(selected, form.canvas), "data-theme": form.canvas ? "light" : undefined, children: [_jsxs("div", { className: "sm-rtcard__head", "data-drag-handle": true, onClick: select, children: [_jsx("span", { className: "sm-rtcard__icon", "aria-hidden": "true", children: element?.icon ?? "▤" }), _jsx("span", { className: "sm-rtcard__title", children: element?.title ?? `Unknown element "${name}"` }), _jsx(IconButton, { label: open ? "Collapse" : "Expand", onClick: (e) => { e.stopPropagation(); setOpen((o) => !o); }, children: open ? "▾" : "▸" }), _jsx(IconButton, { label: "Delete element", onClick: (e) => { e.stopPropagation(); deleteNode(); }, children: "\u00D7" })] }), open && element && (_jsxs("div", { className: "sm-rtcard__body", contentEditable: false, children: [visibleFields.map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: fields[key], errors: form.errors, path: `${base}.${key}`, scope: scope, onChange: (v) => updateAttributes({ fields: { ...fields, [key]: v } }) }, key))), visibleSettings.length > 0 && _jsx(SectionLabel, { caps: true, children: "Settings" }), visibleSettings.map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: settings[key], errors: form.errors, path: `${base}.settings.${key}`, scope: scope, onChange: (v) => updateAttributes({ settings: { ...settings, [key]: v } }) }, `setting-${key}`)))] }))] }));
+    return (_jsxs(NodeViewWrapper, { className: cx(cardClass(selected, form.canvas), state.unknown && "sm-rtcard--broken"), "data-theme": form.canvas ? "light" : undefined, children: [_jsxs("div", { className: "sm-rtcard__head", "data-drag-handle": true, onClick: select, children: [_jsx("span", { className: "sm-rtcard__icon", "aria-hidden": "true", children: element?.icon ?? "▤" }), _jsx("span", { className: "sm-rtcard__title", children: element?.title ?? `Unknown element "${name}"` }), state.outside && _jsx("span", { className: "sm-hint", children: "Not in this field's toolset" }), _jsx(IconButton, { label: open ? "Collapse" : "Expand", onClick: (e) => { e.stopPropagation(); setOpen((o) => !o); }, children: open ? "▾" : "▸" }), _jsx(IconButton, { label: "Delete element", onClick: (e) => { e.stopPropagation(); deleteNode(); }, children: "\u00D7" })] }), open && !element && (_jsx("div", { className: "sm-rtcard__body", contentEditable: false, children: Object.entries(fields).map(([key, value]) => (_jsxs("div", { className: "sm-orphans__row", children: [_jsx("code", { children: key }), _jsx("span", { className: "sm-orphans__value", children: typeof value === "string" ? value : JSON.stringify(value) })] }, key))) })), open && element && (_jsxs("div", { className: "sm-rtcard__body", contentEditable: false, children: [visibleFields.map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: fields[key], errors: form.errors, path: `${base}.${key}`, scope: scope, onChange: (v) => updateAttributes({ fields: { ...fields, [key]: v } }) }, key))), visibleSettings.length > 0 && _jsx(SectionLabel, { caps: true, children: "Settings" }), visibleSettings.map(([key, d]) => (_jsx(FieldWidget, { fieldKey: key, descriptor: d, value: settings[key], errors: form.errors, path: `${base}.settings.${key}`, scope: scope, onChange: (v) => updateAttributes({ settings: { ...settings, [key]: v } }) }, `setting-${key}`)))] }))] }));
 }

package/dist/admin/forms/RichtextWidget.js

@@ -8,6 +8,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // flag, so its own cards stay admin-styled.
 import { useMemo } from "react";
 import { EditorContent } from "@tiptap/react";
+import { allowedOf } from "../../toolset.js";
 import { RichtextToolbar } from "./RichtextToolbar.js";
 import { RichtextInsertMenu } from "./RichtextInsertMenu.js";
 import { RichtextLinkRow, RichtextMenu } from "./RichtextPopovers.js";
@@ -17,7 +18,8 @@ import { useRichtextEditor } from "./useRichtextEditor.js";
 export function RichtextWidget({ value, toolset, onChange, errors, path = "" }) {
     const rt = useRichtextEditor({ value, toolset, onChange, contentClass: "sm-richtext__content" });
     const parent = useRichtextForm();
-    const formInfo = useMemo(() => ({ errors, path, canvas: parent.canvas }), [errors, path, parent.canvas]);
+    const allowed = useMemo(() => allowedOf(toolset).elements, [toolset]);
+    const formInfo = useMemo(() => ({ errors, path, canvas: parent.canvas, elements: allowed }), [errors, path, parent.canvas, allowed]);
     return (_jsx(RichtextFormProvider, { value: formInfo, children: _jsxs("div", { className: "sm-richtext", children: [_jsxs("div", { className: "sm-richtext__head", children: [_jsx(RichtextToolbar, { allowed: rt.allowed, active: rt.active, canInsert: rt.canInsert, onCommand: rt.run }), rt.menu.open && _jsx(RichtextMenu, { menu: rt.menu })] }), rt.link.open && _jsx(RichtextLinkRow, { link: rt.link }), _jsxs("div", { className: "sm-richtext__body", children: [_jsx(EditorContent, { editor: rt.editor }), rt.slash && (_jsx("div", { className: "sm-richtext__slash", style: { top: rt.slash.state.rect ? rt.slash.state.rect.bottom - (editorTop(rt.editor) ?? 0) + 4 : 0 }, children: _jsx(RichtextInsertMenu, { items: rt.slash.state.items, active: rt.slash.active, onPick: (item) => rt.slash?.state.pick(item) }) }))] }), rt.picker.open && _jsx(MediaPicker, { kinds: ["image"], onPick: rt.picker.pick, onClose: rt.picker.close })] }) }));
 }
 /** The editor's top in viewport coordinates, to place the slash menu relative to the body wrapper. */

package/dist/admin/forms/TagsField.js

@@ -27,7 +27,7 @@ export function TagsField({ value, onChange, max, suggestions, label, initialAdd
             timer.current = setTimeout(() => setFlash(null), 600);
         }
     };
-    return (_jsxs("div", { className: "sm-tags", children: [tags.map((t, i) => (_jsxs("span", { className: cx("sm-tag", flash === t && "sm-tag--flash"), children: [t, _jsx("button", { type: "button", className: "sm-tag__x", "aria-label": `Remove ${t}`, onClick: () => onChange(tags.filter((_, j) => j !== i)), children: "\u00D7" })] }, t))), adding && !atMax && (_jsx(Combobox, { className: "sm-combo--tag", label: `Add to ${label}`, placeholder: "Add a tag", autoFocus: true, keepOpen: true, initialOpen: true, options: (suggestions ?? []).filter((s) => !tags.some((t) => sameTag(t, s))).map((s) => ({ value: s, label: s })), onPick: commit, onSubmit: commit, createRow: suggestions !== undefined, onQueryChange: (next) => { if (!next.includes(","))
+    return (_jsxs("div", { className: "sm-tags", children: [tags.map((t, i) => (_jsxs("span", { className: cx("sm-tag", flash === t && "sm-tag--flash"), children: [t, _jsx("button", { type: "button", className: "sm-tag__x", "aria-label": `Remove ${t}`, onClick: () => onChange(tags.filter((_, j) => j !== i)), children: "\u00D7" })] }, t))), adding && !atMax && (_jsx(Combobox, { className: "sm-combo--tag", listClassName: "sm-combo__list--tag", label: `Add to ${label}`, placeholder: "Add a tag", autoFocus: true, keepOpen: true, initialOpen: true, options: (suggestions ?? []).filter((s) => !tags.some((t) => sameTag(t, s))).map((s) => ({ value: s, label: s })), onPick: commit, onSubmit: commit, createRow: suggestions !== undefined, onQueryChange: (next) => { if (!next.includes(","))
                     return next; commit(next); return ""; }, onInputKey: (e, query) => {
                     if (e.key !== "Backspace" || query !== "" || tags.length === 0)
                         return false;

package/dist/admin/forms/richtext-form-context.d.ts

@@ -4,6 +4,8 @@ export type RichtextFormInfo = {
     path: string;
     /** Mounted in the canvas: cards carry the admin's classes and the light theme (spec 2026-09-10 §5). */
     canvas?: boolean;
+    /** The field toolset's insertable elements — a card outside them says so (spec 2026-09-27 editor safety §5). */
+    elements?: string[];
 };
 export declare function RichtextFormProvider({ value, children }: {
     value: RichtextFormInfo;
@@ -14,3 +16,9 @@ export declare function useRichtextForm(): RichtextFormInfo;
  *  (`sm-admin`, light — the page stays light) and opts out of Tailwind
  *  typography (`not-prose`), which would otherwise style its internals. */
 export declare function cardClass(selected: boolean, canvas: boolean | undefined): string;
+/** What an element card marks (spec 2026-09-27 editor safety §5): an unregistered name, or a
+ *  registered one the field's toolset leaves out — the toolset gates insertion only, so it renders. */
+export declare function elementCardState(name: string, known: boolean, allowed: string[] | undefined): {
+    unknown: boolean;
+    outside: boolean;
+};

package/dist/admin/forms/richtext-form-context.js

@@ -16,3 +16,8 @@ export function useRichtextForm() { return useContext(Ctx); }
 export function cardClass(selected, canvas) {
     return ["sm-rtcard", selected && "sm-rtcard--selected", canvas && "sm-admin not-prose"].filter(Boolean).join(" ");
 }
+/** What an element card marks (spec 2026-09-27 editor safety §5): an unregistered name, or a
+ *  registered one the field's toolset leaves out — the toolset gates insertion only, so it renders. */
+export function elementCardState(name, known, allowed) {
+    return { unknown: !known, outside: known && allowed !== undefined && !allowed.includes(name) };
+}

package/dist/admin/health.d.ts

@@ -0,0 +1,23 @@
+import type { AdminRegistry } from "./serialize.ts";
+import type { PageScan } from "../store.ts";
+import { type EntryScan } from "../entry-store.ts";
+import { type VersionedFinding } from "./drift.ts";
+export type HealthDocKind = "page" | "entry" | "global";
+export type HealthFinding = VersionedFinding & {
+    locale: string;
+};
+export type HealthDocument = {
+    kind: HealthDocKind;
+    id: string;
+    title: string;
+    collection: string | null;
+    findings: HealthFinding[];
+};
+export type HealthReport = {
+    documents: HealthDocument[];
+    collections: {
+        name: string;
+        count: number;
+    }[];
+};
+export declare function buildHealthReport(registry: AdminRegistry, pages: PageScan[], entries: EntryScan[]): HealthReport;

package/dist/admin/health.js

@@ -0,0 +1,42 @@
+import { entryFieldsIn } from "../entry-store.js";
+import { entryDrift, mergeVersions, pageDrift } from "./drift.js";
+export function buildHealthReport(registry, pages, entries) {
+    const documents = [];
+    const def = registry.locales.default;
+    for (const scan of pages) {
+        const findings = [];
+        for (const locale of Object.keys(scan.record.locales)) {
+            const draft = pageDrift(registry, scan.record.template, scan.draft[locale] ?? null);
+            const live = scan.live[locale] ? pageDrift(registry, scan.record.template, scan.live[locale]) : [];
+            for (const f of mergeVersions(draft, live))
+                findings.push({ ...f, locale });
+        }
+        if (findings.length === 0)
+            continue;
+        const row = scan.record.locales[def] ?? Object.values(scan.record.locales)[0];
+        documents.push({ kind: "page", id: scan.record.id, title: row?.title ?? scan.record.id, collection: null, findings });
+    }
+    const unknown = new Map();
+    for (const { record, live } of entries) {
+        const collection = registry.collections.find((c) => c.name === record.collection);
+        const item = registry.globals.find((g) => g.name === record.collection);
+        if (!collection && !item) {
+            unknown.set(record.collection, (unknown.get(record.collection) ?? 0) + 1);
+            continue;
+        }
+        const findings = [];
+        for (const [locale, row] of Object.entries(record.locales)) {
+            const draft = entryDrift(registry, record.collection, { fields: entryFieldsIn(record, locale), shared: record.fields, own: row.fields });
+            const lived = live[locale] ? entryDrift(registry, record.collection, { fields: live[locale] }) : [];
+            for (const f of mergeVersions(draft, lived))
+                findings.push({ ...f, locale });
+        }
+        if (findings.length === 0)
+            continue;
+        const locale = record.locales[def] ? def : Object.keys(record.locales)[0];
+        const titleValue = collection?.titleField && locale ? entryFieldsIn(record, locale)[collection.titleField] : undefined;
+        const title = item ? item.title : typeof titleValue === "string" && titleValue !== "" ? titleValue : record.id;
+        documents.push({ kind: item ? "global" : "entry", id: record.id, title, collection: record.collection, findings });
+    }
+    return { documents, collections: [...unknown].map(([name, count]) => ({ name, count })) };
+}

package/dist/admin/ops-impl.js

@@ -7,10 +7,15 @@ import { affectedTargets, collectionTag, entryTag, pageTag, pagesTreeTag, global
 import { ensureFixedNodes, fixedNodeOf } from "./fixed-nodes.js";
 import { ensureGlobalItems } from "./global-items.js";
 import { validateCustomNode, validateFields, validateNode } from "./validate.js";
+import { serializeAdminConfig } from "./serialize.js";
+import { entryDrift, pageDrift } from "./drift.js";
+import { publishErrors } from "./drift-copy.js";
+import { buildHealthReport } from "./health.js";
 import { CUSTOM_NODE_TYPE, customSchema } from "../custom/index.js";
 import { SETTINGS_KEY, CSS_KEY } from "../global.js";
 import { withDefaults } from "../field-defaults.js";
 import { elementSchemas } from "../richtext-walk.js";
+import { REDIRECT_PATH_MESSAGE, redirectPathProblem } from "./redirect-path.js";
 import { SCHEMA_VERSION } from "../schema-version.js";
 import { draftToken, isDraftToken, StaleDraftError } from "../draft-token.js";
 const ok = (data) => ({ ok: true, data });
@@ -65,6 +70,8 @@ const classify = (e) => {
         return err("not_found", message);
     if (message.includes("cannot take a slug"))
         return err("validation", message);
+    if (message.includes("is a live address"))
+        return err("validation", message);
     // Ahead of the generic "already exists" check below: the singleton
     // refusal's message ("...already exists — it is a singleton.") contains
     // "already exists" as a substring, so it must classify here first or it
@@ -109,12 +116,23 @@ export function createAdminOps(deps) {
     const by = deps.actor?.email ?? undefined;
     const collectionFields = (name) => config.registry.collections?.find((c) => c.name === name)?.fields ?? null;
     // Element nodes inside richtext validate against these (spec 2026-09-08 block nodes §2).
+    // The serialized registry drift walks (spec 2026-09-27 editor safety §2) — the admin client's shape.
+    let adminRegistryMemo = null;
+    const adminRegistry = () => (adminRegistryMemo ?? (adminRegistryMemo = serializeAdminConfig(config)));
     const elementDescs = elementSchemas((config.registry.elements ?? []).map((e) => ({ name: e.schema.name, fields: e.schema.fields ?? {}, settings: e.schema.settings })));
     // The custom section (spec 2026-09-14 §6) validates like a section, over its own schema.
     const sectionFields = (type) => (type === CUSTOM_NODE_TYPE ? customSchema(config.custom.toolset) : config.registry.sections?.find((s) => s.schema.name === type)?.schema);
     const globalItem = (name) => config.registry.globals?.find((s) => s.name === name) ?? null;
     /** One row per registration; null when materialization could not create it. */
     const globalRecord = async (name) => (await entries.list(name))[0] ?? null;
+    /** The published snapshot's drift for the editors' live-only line (spec 2026-09-27 editor safety §5). */
+    const liveEntryFindings = async (name, record, locale) => {
+        const row = record.locales[locale];
+        if (row?.status !== "published" || !row.publishedVersionId)
+            return [];
+        const snap = await entries.getVersion(name, row.publishedVersionId);
+        return snap ? entryDrift(adminRegistry(), name, { fields: snap.fields }) : [];
+    };
     const fanOut = async (entryId) => {
         if (!effects?.revalidate)
             return;
@@ -208,6 +226,22 @@ export function createAdminOps(deps) {
     const def = config.locales.default;
     /** The name messages use for a node: its default-locale slug, else any locale's, else the id. */
     const nameOf = (r) => r.locales[def]?.slug ?? Object.values(r.locales)[0]?.slug ?? r.id;
+    /** "kind:id" → title in the locale (+ collection for an entry): every page with a template, every entry of a routed collection. */
+    const targetTitles = async (locale) => {
+        const out = new Map();
+        for (const p of await pages.listPages()) {
+            if (p.template === null)
+                continue;
+            out.set(`page:${p.id}`, { title: p.locales[locale]?.title ?? nameOf(p), collection: null });
+        }
+        for (const c of config.registry.collections ?? []) {
+            if (!c.path)
+                continue;
+            for (const e of await entries.list(c.name))
+                out.set(`entry:${e.id}`, { title: entryTitleIn(e, locale, c), collection: c.name });
+        }
+        return out;
+    };
     const assets = deps.assets;
     const noMedia = () => err("internal", "smoodly: no media store is configured — pass `assets` to createAdminOpHandler.");
     const noMembers = () => err("internal", "smoodly: no member store is configured — pass `members` to createAdminOpHandler.");
@@ -292,12 +326,15 @@ export function createAdminOps(deps) {
                 const draft = record.template === null || !record.locales[locale] ? null : await pages.getDraftTree(id, locale);
                 const paths = await pages.pathsOf(id);
                 const urls = Object.fromEntries(Object.entries(paths).map(([l, path]) => [l, href(path, l)]));
+                const redirects = await pages.redirectsOf(id);
                 // A locale can only be added where the parent already has it; a
                 // root has no parent, so every supported locale is open.
                 const parentLocales = record.parentId === null
                     ? config.locales.supported
                     : Object.keys((await pages.getPage(record.parentId))?.locales ?? {});
-                return ok({ record, locale, draft, paths, urls, parentLocales });
+                const liveTree = record.locales[locale]?.publishedVersionId ? await pages.getPublishedTree(id, locale) : null;
+                const liveFindings = liveTree ? pageDrift(adminRegistry(), record.template, liveTree) : [];
+                return ok({ record, locale, draft, paths, urls, redirects, parentLocales, liveFindings });
             }),
             create: (input) => guard(async () => {
                 const unsupported = supportedLocale(input.locale);
@@ -367,7 +404,10 @@ export function createAdminOps(deps) {
                         : err("blocked", `smoodly: "${row.slug}" has no draft to publish.`);
                 }
                 const fieldErrors = [];
-                for (const nodes of Object.values(draft.zones)) {
+                // Only the page type's zones (spec 2026-09-27 editor safety §1): a removed zone's nodes never block.
+                const shapeZones = Object.keys(openTemplate(record.template)?.schema?.zones ?? {});
+                for (const zone of shapeZones) {
+                    const nodes = Array.isArray(draft.zones[zone]) ? draft.zones[zone] : [];
                     for (const node of nodes) {
                         const schema = sectionFields(node.type);
                         if (!schema?.fields)
@@ -386,8 +426,9 @@ export function createAdminOps(deps) {
                 for (const fe of validateFields(draft.fields ?? {}, pageDescs, elementDescs)) {
                     fieldErrors.push({ field: `page.fields.${fe.field}`, message: fe.message });
                 }
-                if (fieldErrors.length > 0) {
-                    return err("validation", `smoodly: cannot publish "${row.slug}" — fix the listed fields first.`, fieldErrors);
+                const refused = publishErrors(fieldErrors, pageDrift(adminRegistry(), record.template, draft));
+                if (refused.length > 0) {
+                    return err("validation", `smoodly: cannot publish "${row.slug}" — fix the listed problems first.`, refused);
                 }
                 const published = await pages.publish(id, locale, by, token);
                 // The parent's cached unit lists its published children.
@@ -494,7 +535,8 @@ export function createAdminOps(deps) {
                     return unsupported;
                 if (record.parentId === null && patch.slug !== undefined && adminSlug(patch.slug))
                     return slugTaken();
-                const renamed = await pages.rename(id, patch, by);
+                const { redirect, ...rest } = patch;
+                const renamed = await pages.rename(id, rest, by, { redirect: redirect ?? true });
                 // Every descendant's path changed with this segment; the parent
                 // lists this node's title and path.
                 expirePages([...(await subtreeIds(id)), record.parentId]);
@@ -521,7 +563,8 @@ export function createAdminOps(deps) {
                     if (blocked)
                         return blocked;
                 }
-                const moved = await pages.move(id, to);
+                const { redirect, ...dest } = to;
+                const moved = await pages.move(id, dest, { redirect: redirect ?? true });
                 expirePages([...(await subtreeIds(id)), record.parentId, moved.parentId]);
                 expireTree();
                 return ok(moved);
@@ -607,7 +650,9 @@ export function createAdminOps(deps) {
                     : Object.keys((await entries.get(collection, record.parentId))?.locales ?? {});
                 const paths = await entries.pathsOf(collection, id);
                 const urls = Object.fromEntries(Object.entries(paths).map(([l, p]) => [l, href(p, l)]));
-                return ok({ record, locale, fields, parentLocales, urls });
+                const redirects = await entries.redirectsOf(collection, id);
+                const liveFindings = await liveEntryFindings(collection, record, locale);
+                return ok({ record, locale, fields, parentLocales, urls, redirects, liveFindings });
             }),
             create: (collection, input) => guard(async () => {
                 const unsupported = supportedLocale(input.locale);
@@ -620,7 +665,7 @@ export function createAdminOps(deps) {
                 expireCollection(collection);
                 return ok(created);
             }),
-            save: (collection, id, locale, fields, expected) => guard(async () => {
+            save: (collection, id, locale, fields, expected, options) => guard(async () => {
                 const unsupported = supportedLocale(locale);
                 if (unsupported)
                     return unsupported;
@@ -630,7 +675,7 @@ export function createAdminOps(deps) {
                 const descriptors = collectionFields(collection);
                 if (!descriptors)
                     return err("not_found", `smoodly: no collection named "${collection}".`);
-                const entry = await entries.update(collection, id, locale, fields, by, token);
+                const entry = await entries.update(collection, id, locale, fields, by, token, { redirect: options?.redirect ?? true });
                 await fanOut(id);
                 expireCollection(collection);
                 return ok(entry);
@@ -652,7 +697,8 @@ export function createAdminOps(deps) {
                         return err("not_found", `smoodly: no entry "${id}" in "${collection}".`);
                     if (!record.locales[locale])
                         return err("not_found", `smoodly: entry "${id}" does not exist in locale "${locale}".`);
-                    const fieldErrors = validateFields(entryFieldsIn(record, locale), descriptors, elementDescs);
+                    const merged = entryFieldsIn(record, locale);
+                    const fieldErrors = publishErrors(validateFields(merged, descriptors, elementDescs), entryDrift(adminRegistry(), collection, { fields: merged }));
                     if (fieldErrors.length > 0)
                         return err("validation", "Some fields need attention.", fieldErrors);
                 }
@@ -707,7 +753,8 @@ export function createAdminOps(deps) {
             // The tag expires only after the delete succeeded; a blocked delete expires nothing.
             delete: (collection, id) => guard(async () => (await entries.delete(collection, id), await fanOut(id), expireCollection(collection), ok(null))),
             move: (collection, id, to) => guard(async () => {
-                const moved = await entries.move(collection, id, to);
+                const { redirect, ...dest } = to;
+                const moved = await entries.move(collection, id, dest, { redirect: redirect ?? true });
                 if (effects?.revalidate) {
                     for (const entryId of await entrySubtreeIds(collection, id))
                         effects.revalidate(entryTag(entryId));
@@ -752,7 +799,8 @@ export function createAdminOps(deps) {
                 if (!record?.locales[locale])
                     return err("not_found", `smoodly: global item "${name}" does not exist in locale "${locale}".`);
                 const usage = await entries.referencesTo(name, record.id);
-                return ok({ name, record, locale, fields: entryFieldsIn(record, locale), usage });
+                const liveFindings = await liveEntryFindings(name, record, locale);
+                return ok({ name, record, locale, fields: entryFieldsIn(record, locale), usage, liveFindings });
             }),
             save: (name, locale, fields, expected) => guard(async () => {
                 const unsupported = supportedLocale(locale);
@@ -794,8 +842,9 @@ export function createAdminOps(deps) {
                     const { [SETTINGS_KEY]: settings, [CSS_KEY]: css, ...fields } = entryFieldsIn(record, locale);
                     const settingsDescs = item.section !== undefined ? sectionFields(item.section)?.settings : undefined;
                     const fieldErrors = validateNode({ fields, settings: settings !== null && typeof settings === "object" ? settings : {}, css }, { fields: item.fields, settings: settingsDescs }, elementDescs);
-                    if (fieldErrors.length > 0)
-                        return err("validation", "Some fields need attention.", fieldErrors);
+                    const refused = publishErrors(fieldErrors, entryDrift(adminRegistry(), name, { fields: entryFieldsIn(record, locale) }));
+                    if (refused.length > 0)
+                        return err("validation", "Some fields need attention.", refused);
                 }
                 const changed = await entries.setStatus(name, record.id, locale, status, by, token);
                 // see save: the fan-out carries the item's own tag.
@@ -973,6 +1022,67 @@ export function createAdminOps(deps) {
                 return ok(null);
             }),
         },
+        redirects: {
+            list: (locale) => guard(async () => {
+                const unsupported = supportedLocale(locale);
+                if (unsupported)
+                    return unsupported;
+                const rows = await pages.listRedirects(locale);
+                const titles = await targetTitles(locale);
+                const items = [];
+                for (const r of rows) {
+                    const t = titles.get(`${r.kind}:${r.id}`);
+                    const currentPath = (await pages.targetPaths({ kind: r.kind, id: r.id }))[locale] ?? null;
+                    items.push({ locale, path: r.path, target: { kind: r.kind, id: r.id }, collection: t?.collection ?? null, title: t?.title ?? r.id, currentPath, url: currentPath ? href(currentPath, locale) : null });
+                }
+                return ok(items.sort((a, b) => a.path.localeCompare(b.path)));
+            }),
+            targets: (locale) => guard(async () => {
+                const unsupported = supportedLocale(locale);
+                if (unsupported)
+                    return unsupported;
+                const titles = await targetTitles(locale);
+                const out = [];
+                for (const r of await pages.listLive(locale)) {
+                    const t = titles.get(`${r.kind}:${r.id}`);
+                    if (!t)
+                        continue; // a folder, or an entry outside a routed collection
+                    out.push({ target: { kind: r.kind, id: r.id }, collection: t.collection, title: t.title, path: r.path });
+                }
+                return ok(out.sort((a, b) => a.path.localeCompare(b.path)));
+            }),
+            add: (locale, path, target) => guard(async () => {
+                const unsupported = supportedLocale(locale);
+                if (unsupported)
+                    return unsupported;
+                const problem = redirectPathProblem(path, { adminPath: config.admin.path, multilingual: config.locales.supported.length > 1 });
+                if (problem)
+                    return err("validation", REDIRECT_PATH_MESSAGE[problem]);
+                const titles = await targetTitles(locale);
+                if (!titles.has(`${target.kind}:${target.id}`))
+                    return err("not_found", `smoodly: no ${target.kind} "${target.id}" to redirect to.`);
+                const holder = await pages.resolvePath(locale, path);
+                if (holder && !holder.redirect) {
+                    const owner = titles.get(`${holder.kind}:${holder.id}`)?.title ?? holder.id;
+                    return err("validation", `smoodly: "${path}" is the address of "${owner}".`);
+                }
+                await pages.addRedirect({ kind: target.kind, id: target.id, locale, path });
+                return ok(null);
+            }),
+            remove: (locale, path) => guard(async () => {
+                const unsupported = supportedLocale(locale);
+                if (unsupported)
+                    return unsupported;
+                await pages.removeRedirect(locale, path);
+                return ok(null);
+            }),
+        },
+        health: {
+            scan: () => guard(async () => {
+                const [trees, rows] = await Promise.all([pages.scanTrees(), entries.scanEntries()]);
+                return ok(buildHealthReport(adminRegistry(), trees, rows));
+            }),
+        },
         schema: {
             status: () => guard(async () => ok({ database: await pages.schemaVersion(), required: SCHEMA_VERSION })),
         },

package/dist/admin/ops.d.ts

@@ -7,6 +7,9 @@ import type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts
 import type { MemberRole } from "../permissions.ts";
 import type { FieldError } from "./validate.ts";
 import type { DraftToken } from "../draft-token.ts";
+import type { PathTarget } from "../paths.ts";
+import type { Finding } from "./drift.ts";
+import type { HealthReport } from "./health.ts";
 export type OpError = {
     ok: false;
     code: "not_found" | "conflict" | "blocked" | "validation" | "internal" | "unauthorized";
@@ -44,11 +47,15 @@ export type PageGetResult = {
     paths: Record<string, string>;
     /** locale → site URL, `href` applied server-side (the canvas and "View live" use these). */
     urls: Record<string, string>;
+    /** locale → the page's old addresses that redirect to it (spec 2026-09-26 redirects §6). */
+    redirects: Record<string, string[]>;
     /** The locales the PARENT exists in — a locale can only be added here
      *  once the parent has it (DESIGN.md, Localization), so the editor
      *  disables the rest with a reason. Every supported locale for a root
      *  page: a root can be added to any locale. */
     parentLocales: string[];
+    /** The live version's drift (spec 2026-09-27 editor safety §5) — the editors' "live only" notice line. Empty when nothing is published. */
+    liveFindings: Finding[];
 };
 export type EntryCreateInput = {
     /** The one locale the entry is created in; others are added with addLocale. */
@@ -65,8 +72,12 @@ export type EntryGetResult = {
     fields: Record<string, unknown> | null;
     /** locale → site URL (`href` applied server-side) for the locales the entry has a path in; empty for a collection without a path. */
     urls: Record<string, string>;
+    /** locale → the entry's old addresses that redirect to it (spec 2026-09-26 redirects §6). */
+    redirects: Record<string, string[]>;
     /** The locales the PARENT exists in (every supported locale for a root) — the form disables the rest with a reason. */
     parentLocales: string[];
+    /** The live version's drift (spec 2026-09-27 editor safety §5) — the editors' "live only" notice line. Empty when nothing is published. */
+    liveFindings: Finding[];
 };
 export type GlobalListItem = {
     name: string;
@@ -81,6 +92,8 @@ export type GlobalGetResult = {
     fields: Record<string, unknown>;
     /** Who links it: "used on N pages". */
     usage: EntryUsage[];
+    /** The live version's drift (spec 2026-09-27 editor safety §5) — the editors' "live only" notice line. Empty when nothing is published. */
+    liveFindings: Finding[];
 };
 /** A history row: the version id and when its content last changed (spec 2026-09-13 history §5). */
 export type VersionSummary = {
@@ -109,6 +122,23 @@ export type SchemaStatus = {
     database: number | null;
     required: number;
 };
+/** A redirect row with its target joined (spec 2026-09-26 redirects §6): `currentPath`/`url` null when the target has no live path in the locale. */
+export type RedirectItem = {
+    locale: string;
+    path: string;
+    target: PathTarget;
+    collection: string | null;
+    title: string;
+    currentPath: string | null;
+    url: string | null;
+};
+/** A page or entry live in the locale, for the Add dialog's type-ahead. */
+export type RedirectTargetItem = {
+    target: PathTarget;
+    collection: string | null;
+    title: string;
+    path: string;
+};
 export type AdminOps = {
     pages: {
         /** Lists every node, materializing fixed pages and collection mounts (in every supported locale) first. */
@@ -127,14 +157,17 @@ export type AdminOps = {
         /** The draft back to the published version (§4); `blocked` when nothing is published in the locale. */
         discardDraft(id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<PageRecord>>;
         delete(id: string): Promise<OpResult<null>>;
+        /** `redirect` (default true) keeps a published row's old address as a redirect (spec 2026-09-26 redirects §1). */
         rename(id: string, patch: {
             locale: string;
             slug?: string;
             title?: string;
+            redirect?: boolean;
         }): Promise<OpResult<PageRecord>>;
         move(id: string, to: {
             parentId: string | null;
             index?: number;
+            redirect?: boolean;
         }): Promise<OpResult<PageRecord>>;
         /** "Add page here": a folder becomes a page. */
         setTemplate(id: string, template: string): Promise<OpResult<PageRecord>>;
@@ -159,7 +192,9 @@ export type AdminOps = {
         get(collection: string, id: string, locale: string): Promise<OpResult<EntryGetResult>>;
         create(collection: string, input: EntryCreateInput): Promise<OpResult<EntryRecord>>;
         /** `expected` as on pages: the token the client last saw; `undefined` skips the check. */
-        save(collection: string, id: string, locale: string, fields: Record<string, unknown>, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
+        save(collection: string, id: string, locale: string, fields: Record<string, unknown>, expected?: DraftToken | null, options?: {
+            redirect?: boolean;
+        }): Promise<OpResult<EntryRecord>>;
         setStatus(collection: string, id: string, locale: string, status: "draft" | "published", expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
         /** The live row back to the published snapshot (§4); `blocked` when the locale has no published version. */
         discardDraft(collection: string, id: string, locale: string, expected?: DraftToken | null): Promise<OpResult<EntryRecord>>;
@@ -167,6 +202,7 @@ export type AdminOps = {
         move(collection: string, id: string, to: {
             parentId: string | null;
             index?: number;
+            redirect?: boolean;
         }): Promise<OpResult<EntryRecord>>;
         /** Copies `from`'s localized fields and slug as the new locale's draft (spec 2026-09-06 §7). Expires nothing. */
         addLocale(collection: string, id: string, locale: string, options: {
@@ -225,6 +261,22 @@ export type AdminOps = {
         /** Admins only, self-host only; the same two guards. The Auth account stays. */
         remove(userId: string): Promise<OpResult<null>>;
     };
+    /** Redirects by hand (spec 2026-09-26 redirects §5): open to every member, as renaming is; nothing here expires a cache. */
+    redirects: {
+        /** The locale's redirect rows with their targets' titles and current URLs, sorted by old address. */
+        list(locale: string): Promise<OpResult<RedirectItem[]>>;
+        /** Every page with a template and every routed entry live in the locale, for the Add dialog's type-ahead. */
+        targets(locale: string): Promise<OpResult<RedirectTargetItem[]>>;
+        /** Validates the old address (redirect-path.ts), refuses a live address naming its owner, `not_found` for an unknown target. */
+        add(locale: string, path: string, target: PathTarget): Promise<OpResult<null>>;
+        /** Deletes a redirect row; a live row is never touched. */
+        remove(locale: string, path: string): Promise<OpResult<null>>;
+    };
+    /** Content health (spec 2026-09-27 editor safety §3): read-only, every member. */
+    health: {
+        /** Every page, entry and global item against the registry, draft and live; unregistered collections counted. */
+        scan(): Promise<OpResult<HealthReport>>;
+    };
     schema: {
         /** Every member. The shell calls it once on mount and blocks when behind. */
         status(): Promise<OpResult<SchemaStatus>>;

package/dist/admin/redirect-path.d.ts

@@ -0,0 +1,6 @@
+export type RedirectPathProblem = "empty" | "leading-slash" | "root" | "trailing-slash" | "double-slash" | "whitespace" | "query-or-hash" | "admin" | "extension";
+export declare const REDIRECT_PATH_MESSAGE: Record<RedirectPathProblem, string>;
+export declare function redirectPathProblem(path: string, opts: {
+    adminPath: string;
+    multilingual: boolean;
+}): RedirectPathProblem | null;

package/dist/admin/redirect-path.js

@@ -0,0 +1,33 @@
+export const REDIRECT_PATH_MESSAGE = {
+    empty: "Enter the old address.",
+    "leading-slash": "Start with a slash: /old-address.",
+    root: "The site root cannot redirect.",
+    "trailing-slash": "Leave out the trailing slash.",
+    "double-slash": "An address cannot have an empty part.",
+    whitespace: "An address cannot contain spaces.",
+    "query-or-hash": "Leave out the query string and the hash: they are not part of the address.",
+    admin: "That is the admin's address.",
+    extension: "An address with a file extension never reaches Smoodly on a multilingual site — redirect it in next.config instead.",
+};
+export function redirectPathProblem(path, opts) {
+    if (path === "")
+        return "empty";
+    if (/\s/.test(path))
+        return "whitespace";
+    if (/[?#]/.test(path))
+        return "query-or-hash";
+    if (!path.startsWith("/"))
+        return "leading-slash";
+    if (path === "/")
+        return "root";
+    if (path.endsWith("/"))
+        return "trailing-slash";
+    if (path.includes("//"))
+        return "double-slash";
+    if (path === opts.adminPath || path.startsWith(`${opts.adminPath}/`))
+        return "admin";
+    const last = path.slice(path.lastIndexOf("/") + 1);
+    if (opts.multilingual && /\.[A-Za-z0-9]+$/.test(last))
+        return "extension";
+    return null;
+}

package/dist/admin/shell/AddRedirectModal.d.ts

@@ -0,0 +1,11 @@
+import type { PathTarget } from "../../paths.ts";
+import type { RedirectTargetItem } from "../ops.ts";
+import type { AdminRegistry } from "../serialize.ts";
+export declare function AddRedirectModal({ locale, registry, targets, onClose, onAdd }: {
+    locale: string;
+    registry: AdminRegistry;
+    targets: RedirectTargetItem[];
+    onClose(): void;
+    /** Resolves to an error message, or null when the redirect landed (the caller closes). */
+    onAdd(path: string, target: PathTarget): Promise<string | null>;
+}): import("react").JSX.Element;