smoodly 0.0.28 → 0.0.30

package/dist/admin/validate.js

@@ -5,7 +5,6 @@
 // A field whose `.hidden()` condition holds is skipped entirely — a hidden
 // required field is not required (spec 2026-09-14 §12); the same isHidden
 // the form uses decides, over the same scope.
-import { optionValues } from "../fields.js";
 import { isHidden } from "../conditions.js";
 import { cssProblem } from "../css.js";
 import { normalizeTag, sameTag } from "../tags.js";
@@ -13,6 +12,7 @@ import { hasContent } from "./richtext-doc.js";
 import { ELEMENT_NODE, richtextBlocks } from "../richtext-walk.js";
 import { rowsProblems } from "../custom/rows.js";
 import { isCalendarDay, isInstant } from "./forms/date-picker.js";
+import { fits, misfitMessage } from "./drift.js";
 const subfields = (d) => d.fields && typeof d.fields === "object" ? d.fields : {};
 const itemOf = (d) => d.item && typeof d.item === "object" ? d.item : undefined;
 const isEmpty = (v) => v === undefined || v === null || v === "" || (Array.isArray(v) && v.length === 0);
@@ -32,6 +32,11 @@ function validateValue(path, value, d, errors, elements, scope) {
             errors.push({ field: path, message: "Required." });
         return;
     }
+    // The one type check (spec 2026-09-27 editor safety §2): drift and publish share it.
+    if (!fits(d, value)) {
+        errors.push({ field: path, message: misfitMessage(d, value) });
+        return;
+    }
     if (d.type === "richtext") {
         if (!hasContent(value)) {
             if (!mayBeAbsent(d))
@@ -58,26 +63,20 @@ function validateValue(path, value, d, errors, elements, scope) {
     }
     // Dates (spec 2026-09-25 date pickers §2): the stored formats exactly, and a day the calendar has.
     if (d.type === "date") {
-        if (typeof value !== "string" || !isCalendarDay(value))
+        if (!isCalendarDay(value))
             errors.push({ field: path, message: "Not a date (2026-09-02)." });
         return;
     }
     if (d.type === "datetime") {
-        if (typeof value !== "string" || !isInstant(value))
+        if (!isInstant(value))
             errors.push({ field: path, message: "Not a date and time." });
         return;
     }
-    if (d.type === "image" || d.type === "video" || d.type === "file") {
-        if (typeof value !== "object" || Array.isArray(value) || typeof value.asset !== "string") {
-            errors.push({ field: path, message: "Must be an uploaded file." });
-        }
+    if (d.type === "image" || d.type === "video" || d.type === "file")
         return;
-    }
     if (d.type === "list") {
-        if (!Array.isArray(value)) {
-            errors.push({ field: path, message: "Must be a list." });
+        if (!Array.isArray(value))
             return;
-        }
         if (typeof d.min === "number" && value.length < d.min)
             errors.push({ field: path, message: `At least ${plural(d.min, "item")}.` });
         if (typeof d.max === "number" && value.length > d.max)
@@ -89,37 +88,19 @@ function validateValue(path, value, d, errors, elements, scope) {
         return;
     }
     if (d.type === "object") {
-        if (typeof value !== "object" || Array.isArray(value)) {
-            errors.push({ field: path, message: "Must be an object." });
-            return;
-        }
         validateMap(path, value, subfields(d), errors, elements, { ...scope, self: value });
         return;
     }
-    if (d.type === "boolean") {
-        if (typeof value !== "boolean")
-            errors.push({ field: path, message: "Must be on or off." });
-        return;
-    }
-    if (d.type === "select" || d.type === "radio") {
-        const allowed = optionValues(d.options);
-        if (allowed.length > 0 && !allowed.includes(value)) {
-            errors.push({ field: path, message: `Must be one of: ${allowed.join(", ")}.` });
-        }
+    // The shape of these is fits' (above); what is left is the count.
+    if (d.type === "boolean" || d.type === "select" || d.type === "radio" || d.type === "checkboxes")
         return;
-    }
     // Refs (spec 2026-09-17 §3): the shape and the count. Whether a target exists
     // and is published is publish integrity's question (store.ts), not this one's.
-    if (d.type === "ref") {
-        if (typeof value !== "string")
-            errors.push({ field: path, message: "Must be an entry." });
+    if (d.type === "ref")
         return;
-    }
     if (d.type === "refList") {
-        if (!Array.isArray(value) || value.some((v) => typeof v !== "string" || v === "")) {
-            errors.push({ field: path, message: "Must be a list of entries." });
+        if (!Array.isArray(value))
             return;
-        }
         if (typeof d.min === "number" && value.length < d.min)
             errors.push({ field: path, message: `At least ${plural(d.min, "item")}.` });
         if (typeof d.max === "number" && value.length > d.max)
@@ -130,10 +111,8 @@ function validateValue(path, value, d, errors, elements, scope) {
         return;
     }
     if (d.type === "tags") {
-        if (!Array.isArray(value)) {
-            errors.push({ field: path, message: "Must be a list of tags." });
+        if (!Array.isArray(value))
             return;
-        }
         if (typeof d.min === "number" && value.length < d.min)
             errors.push({ field: path, message: `At least ${plural(d.min, "item")}.` });
         if (typeof d.max === "number" && value.length > d.max)
@@ -146,17 +125,6 @@ function validateValue(path, value, d, errors, elements, scope) {
         });
         return;
     }
-    if (d.type === "checkboxes") {
-        if (!Array.isArray(value)) {
-            errors.push({ field: path, message: "Must be a list." });
-            return;
-        }
-        const allowed = optionValues(d.options);
-        if (value.some((v) => !allowed.includes(v))) {
-            errors.push({ field: path, message: `Must be one of: ${allowed.join(", ")}.` });
-        }
-        return;
-    }
     if (typeof d.max === "number" && typeof value === "string" && value.length > d.max) {
         errors.push({ field: path, message: `Must be at most ${d.max} characters.` });
     }

package/dist/custom/CustomSection.d.ts

@@ -19,6 +19,7 @@ export type CustomSectionProps = {
 export type CustomSectionComponent = ((props: CustomSectionProps) => ReactElement) & {
     schema: {
         name: string;
+        title: string;
     };
 };
 export declare function createCustomSection({ RichText: Bound, breakpoint, elements }: CustomOptions & {

package/dist/custom/CustomSection.js

@@ -4,6 +4,7 @@ import { RichText } from "../richtext-render.js";
 import { FIELD_ATTR, ITEM_ATTR } from "../marks.js";
 import { CUSTOM_NODE_TYPE, DEFAULT_BREAKPOINT } from "./schema.js";
 import { customCss } from "./css.js";
+import { RENDER_VIEW } from "../section-guard.js";
 const isRow = (r) => typeof r === "object" && r !== null && Array.isArray(r.columns);
 export function createCustomSection({ RichText: Bound, breakpoint = DEFAULT_BREAKPOINT, elements = [] }) {
     const Body = Bound ?? (({ doc }) => _jsx(RichText, { doc: doc, elements: elements }));
@@ -15,6 +16,8 @@ export function createCustomSection({ RichText: Bound, breakpoint = DEFAULT_BREA
             : styles;
         return (_jsx(Section, { styles: withLayout, "data-custom": "", children: list.map((row, i) => (_jsx("div", { className: row.reverse ? "smd-row smd-row--reverse" : "smd-row", "data-row": i, [ITEM_ATTR]: `rows.${i}`, children: row.columns.map((doc, j) => (_jsx("div", { className: "smd-col", [FIELD_ATTR]: `columns.${j}`, children: _jsx(Body, { doc: doc }) }, j))) }, i))) }));
     }
-    CustomSection.schema = { name: CUSTOM_NODE_TYPE };
+    CustomSection.schema = { name: CUSTOM_NODE_TYPE, title: "Custom section" };
+    // Smoodly's own plain view: the guard may call it (spec 2026-09-27 section guard §1).
+    CustomSection[RENDER_VIEW] = CustomSection;
     return CustomSection;
 }

package/dist/entry-store.d.ts

@@ -40,6 +40,12 @@ export type EntryVersion = {
     /** When the content last changed: the unpublished draft row is rewritten in place (spec 2026-09-13 history §1). */
     savedAt: number;
 };
+/** One entry row for the drift scan (spec 2026-09-27 editor safety §3), whatever its collection:
+ *  locale → the live version's merged fields, null where the locale is not published. */
+export type EntryScan = {
+    record: EntryRecord;
+    live: Record<string, Record<string, unknown> | null>;
+};
 export type EntryUsage = {
     sourceKind: string;
     sourceId: string;
@@ -96,6 +102,8 @@ export interface EntryStore {
     create(collection: string, fields: Record<string, unknown>, options: CreateEntryOptions, by?: string): Promise<EntryRecord>;
     get(collection: string, id: string): Promise<EntryRecord | null>;
     list(collection: string, options?: ListOptions): Promise<EntryRecord[]>;
+    /** Every entry row, registered collection or not, with each published locale's live fields (spec 2026-09-27 editor safety §3). */
+    scanEntries(): Promise<EntryScan[]>;
     /** Batched read for the resolver: the MERGED fields in `locale`, keyed
      * by id. An id that is missing, absent in the locale, or (with
      * `status`) unpublished there is omitted. With `{ status: "published" }`
@@ -203,6 +211,10 @@ export type SplitFields = {
  *  Every key that is neither localized nor `slug` is shared — declared or
  *  not — so a stray key never disappears into a locale row. */
 export declare function splitFields(fields: Record<string, unknown>, schema: CollectionSchema<any>): SplitFields;
+/** A localized key's value still in the shared fields — saved while the field was shared — stays
+ *  there as every locale's fallback: a write never deletes it (spec 2026-09-27 editor safety §7).
+ *  Reads merge shared, then the row, so each locale shows its own value once it has one. */
+export declare function keepLocalizedShared(before: Record<string, unknown>, shared: Record<string, unknown>, schema: CollectionSchema<any>): Record<string, unknown>;
 export declare function entryLocaleRow(record: EntryRecord, locale: string): EntryLocale;
 /** The merged view of one locale: shared + that locale's fields + its
  *  slug. A fresh object; throws for an absent locale. */
@@ -285,6 +297,7 @@ export declare class MemoryEntryStore implements EntryStore {
     discardDraft(collection: string, id: string, locale: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     addLocale(collection: string, id: string, locale: string, options: AddEntryLocaleOptions, by?: string): Promise<EntryRecord>;
     removeLocale(collection: string, id: string, locale: string): Promise<EntryRecord>;
+    scanEntries(): Promise<EntryScan[]>;
     listVersions(collection: string, id: string, locale: string): Promise<EntryVersion[]>;
     restore(collection: string, id: string, locale: string, versionId: string, by?: string, expected?: DraftToken | null): Promise<EntryRecord>;
     getVersion(collection: string, versionId: string): Promise<EntryVersion | null>;

package/dist/entry-store.js

@@ -98,6 +98,17 @@ export function splitFields(fields, schema) {
     }
     return { shared: structuredClone(shared), localized: structuredClone(localized), slug: slugOf(fields) };
 }
+/** A localized key's value still in the shared fields — saved while the field was shared — stays
+ *  there as every locale's fallback: a write never deletes it (spec 2026-09-27 editor safety §7).
+ *  Reads merge shared, then the row, so each locale shows its own value once it has one. */
+export function keepLocalizedShared(before, shared, schema) {
+    const out = { ...shared };
+    for (const key of localizedKeys(schema)) {
+        if (key in before && !(key in out))
+            out[key] = structuredClone(before[key]);
+    }
+    return out;
+}
 export function entryLocaleRow(record, locale) {
     const row = record.locales[locale];
     if (!row)
@@ -408,7 +419,7 @@ export class MemoryEntryStore {
             throw entryErrors.noSlug(collection);
         this.assertSiblingSlug(collection, entry.parentId, locale, slug, id);
         const before = { fields: entry.fields, row: { ...row } };
-        entry.fields = shared;
+        entry.fields = keepLocalizedShared(before.fields, shared, schema);
         row.fields = localized;
         row.slug = slug;
         try {
@@ -449,7 +460,7 @@ export class MemoryEntryStore {
         if (!snapshot)
             throw entryErrors.nothingPublished(collection, id, locale);
         const { shared, localized } = splitFields(snapshot.fields, schema);
-        entry.fields = shared;
+        entry.fields = keepLocalizedShared(entry.fields, shared, schema);
         row.fields = localized;
         const abandoned = row.draftVersionId;
         row.draftVersionId = row.publishedVersionId;
@@ -517,6 +528,18 @@ export class MemoryEntryStore {
         this.writeRefs(entry);
         return this.snapshot(entry);
     }
+    async scanEntries() {
+        return [...this.entries.values()].map((entry) => ({
+            record: this.snapshot(entry),
+            live: Object.fromEntries(Object.entries(entry.locales).map(([l, row]) => {
+                if (row.status !== "published")
+                    return [l, null];
+                // A legacy published row without a snapshot serves its live row (spec 2026-09-14 §1).
+                const snap = row.publishedVersionId ? this.versions.get(row.publishedVersionId) : undefined;
+                return [l, snap ? structuredClone(snap.fields) : entryFieldsIn(entry, l)];
+            })),
+        }));
+    }
     async listVersions(collection, id, locale) {
         this.must(collection, id);
         return [...this.versions.values()]
@@ -535,7 +558,7 @@ export class MemoryEntryStore {
         if (versionId === row.publishedVersionId)
             return this.discardDraft(collection, id, locale, by, expected);
         const { shared, localized } = splitFields(version.fields, schema);
-        entry.fields = shared;
+        entry.fields = keepLocalizedShared(entry.fields, shared, schema);
         row.fields = localized; // the slug is the row's own and never versioned
         this.recordVersion(entry, locale);
         this.bump(entry, row, by);

package/dist/index.d.ts

@@ -51,7 +51,7 @@ export type { PathIndex } from "./path-index.ts";
 export { MemoryEntryStore } from "./entry-store.ts";
 export { SupabaseEntryStore } from "./supabase-entry-store.ts";
 export { SupabasePathIndex } from "./supabase-path-index.ts";
-export type { EntryStore, EntryRecord, EntryLocale, EntryVersion, EntryUsage, ListOptions, CreateEntryOptions, AddEntryLocaleOptions, EntryStoreOptions, Where, WhereValue, } from "./entry-store.ts";
+export type { EntryStore, EntryRecord, EntryLocale, EntryVersion, EntryScan, EntryUsage, ListOptions, CreateEntryOptions, AddEntryLocaleOptions, EntryStoreOptions, Where, WhereValue, } from "./entry-store.ts";
 export { entryErrors, compareEntries, DEFAULT_ENTRY_LOCALES, localizedKeys, splitFields, entryLocaleRow, entryFieldsIn, entryRefEdges, entryTitleIn, matchesWhere, } from "./entry-store.ts";
 export { affectedTargets, pageTag, entryTag, globalTag, pagesTreeTag, collectionTag } from "./revalidate.ts";
 export type { AffectedTargets } from "./revalidate.ts";
@@ -60,7 +60,7 @@ export type { EntryFetcher, ResolveFieldsOptions, AssetFetcher } from "./resolve
 export { SEGMENT_RE, isSegment, assertSegment, joinPath, splitPath, segmentFor, isHomeNode, pagePathIn, chainOf, assertDepth, pagePath, pagePathRows, entryPathRows, collectionSegment, buildPageTree, perLocaleSegments, assertSupportedLocale, unsupportedLocale, pageAlternates, entryAlternates, } from "./paths.ts";
 export type { LocaleSet, PathTarget, PathRow, PageLike, EntryLike, PageTreeNode, PagePathOptions, LocaleAlternate, PageAlternate } from "./paths.ts";
 export { fixedPathFor } from "./localize.ts";
-export type { PageStore, PageRecord, PageLocale, PageVersion, PageStoreOptions, CreatePageInput, AddLocaleOptions } from "./store.ts";
+export type { PageStore, PageRecord, PageLocale, PageVersion, PageScan, PageStoreOptions, CreatePageInput, AddLocaleOptions } from "./store.ts";
 export { pathOptions, pageErrors, localeRow, pageRefEdges, DEFAULT_LOCALES } from "./store.ts";
 export type { SmoodlyConfig, ResolvedConfig } from "./config.ts";
 export type { FieldBuilder, Descriptor, ValueOf, Option, OptionInput, OptionValue } from "./fields.ts";

package/dist/marks.d.ts

@@ -53,4 +53,16 @@ export type Scope<T> = Marks<T> & {
 export declare function marks<S extends {
     __f?: BuilderMap;
 }>(_schema: S): Marks<NamespaceValues<NonNullable<S["__f"]>>>;
+/** A crashed section's placeholder (spec 2026-09-27 section guard §5): `section` — the guard caught
+ *  it and the live site leaves it out; `page` — only the canvas net caught it, the live page would fail. */
+export declare const CRASHED_ATTR = "data-smd-crashed";
+/** One crashed section as the bridge reports it. */
+export type CrashedSection = {
+    id: string;
+    live: "left-out" | "page-fails";
+};
+/** The crashed sections among the marked elements, in document order — what the bridge posts. */
+export declare function crashedOf(els: ReadonlyArray<{
+    getAttribute(name: string): string | null;
+}>): CrashedSection[];
 export {};

package/dist/marks.js

@@ -44,3 +44,17 @@ function level() {
 export function marks(_schema) {
     return level();
 }
+/** A crashed section's placeholder (spec 2026-09-27 section guard §5): `section` — the guard caught
+ *  it and the live site leaves it out; `page` — only the canvas net caught it, the live page would fail. */
+export const CRASHED_ATTR = "data-smd-crashed";
+/** The crashed sections among the marked elements, in document order — what the bridge posts. */
+export function crashedOf(els) {
+    const out = [];
+    for (const el of els) {
+        const id = el.getAttribute(NODE_ATTR);
+        const mark = el.getAttribute(CRASHED_ATTR);
+        if (id && (mark === "section" || mark === "page"))
+            out.push({ id, live: mark === "section" ? "left-out" : "page-fails" });
+    }
+    return out;
+}

package/dist/next/canvas-boundary.d.ts

@@ -0,0 +1,16 @@
+import { Component, type ReactNode } from "react";
+type Props = {
+    id: string;
+    title: string;
+    children?: ReactNode;
+};
+type State = {
+    failed: boolean;
+    error: unknown;
+};
+export declare class CanvasBoundary extends Component<Props, State> {
+    state: State;
+    static getDerivedStateFromError(error: unknown): State;
+    render(): string | number | bigint | boolean | Iterable<ReactNode> | Promise<string | number | bigint | boolean | import("react").ReactPortal | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | import("react").JSX.Element | null | undefined;
+}
+export {};

package/dist/next/canvas-boundary.js

@@ -0,0 +1,25 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+// The Next adapter's canvas net (spec 2026-09-27 section guard §5): in
+// editor mode each section sits in <Suspense> and this boundary, so a
+// throw the guard cannot catch — in a component the section renders, or
+// in a 'use client' section — fails only that section: Server Components
+// hand it to the browser to retry, and this catches it there. Never
+// rendered outside editor mode. Imports nothing from `next`, but it is
+// Next's mechanism, so it lives with the adapter.
+import { Component } from "react";
+import { CrashPlaceholder } from "../section-crash.js";
+export class CanvasBoundary extends Component {
+    constructor() {
+        super(...arguments);
+        this.state = { failed: false, error: undefined };
+    }
+    static getDerivedStateFromError(error) {
+        return { failed: true, error };
+    }
+    render() {
+        return this.state.failed
+            ? _jsx(CrashPlaceholder, { id: this.props.id, title: this.props.title, error: this.state.error, live: "page" })
+            : this.props.children;
+    }
+}

package/dist/next/page-renderer.d.ts

@@ -1,9 +1,11 @@
-import type { ComponentType, ReactElement } from "react";
+import { type ComponentType, type ReactElement } from "react";
 import type { Metadata } from "next";
 import type { Descriptor } from "../fields.ts";
 import { type PairedPage } from "../render.tsx";
 import type { GlobalSchema } from "../global.ts";
 import { type SmoodlySite } from "../site.ts";
+/** Logged once per renderer when Next's cacheComponents is on (spec 2026-09-27 cache components §2). */
+export declare const CACHE_COMPONENTS_WARNING = "smoodly: Next's cacheComponents is on, and Smoodly does not support it \u2014 a missing page answers 200 with noindex instead of 404, and a redirect answers 200 instead of 308. Turn cacheComponents off in next.config.ts; the Next.js guide's \"Cache Components\" section says why (https://smoodly.io/docs/frameworks/nextjs).";
 /** A registered section, as renderPage's registry needs it. */
 type SectionEntry = ComponentType<any> & {
     schema: {

package/dist/next/page-renderer.js

@@ -1,15 +1,29 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+// The site-route seam (spec 2026-09-05 §5): the two route files call
+// renderSmoodlyPath; everything else — request gating, draft mode, the
+// cache keyed by (locale, path) and tagged by id, 404s, the editor
+// bridge — lives here, over the framework-free site layer. Bound once by
+// the app, exactly like createAdminOpHandler.
+import { Suspense } from "react";
 import { unstable_cache } from "next/cache";
 import { draftMode } from "next/headers";
-import { notFound, permanentRedirect } from "next/navigation";
+import { notFound, permanentRedirect, unstable_rethrow } from "next/navigation";
 import { connection } from "next/server";
 import { EditorBridge } from "../admin/next/bridge.js";
+import { CanvasBoundary } from "./canvas-boundary.js";
+import { DRAFT_META_NAME } from "../admin/editor/canvas-diagnosis.js";
 import { fixedPathFor } from "../localize.js";
 import { joinPath } from "../paths.js";
 import { renderPage } from "../render.js";
 import { entryTag, pageTag, globalTag } from "../revalidate.js";
 import { pageContextOf } from "../site.js";
 import { metadataFrom } from "./meta.js";
+/** Logged once per renderer when Next's cacheComponents is on (spec 2026-09-27 cache components §2). */
+export const CACHE_COMPONENTS_WARNING = "smoodly: Next's cacheComponents is on, and Smoodly does not support it — a missing page answers 200 with noindex instead of 404, and a redirect answers 200 instead of 308. Turn cacheComponents off in next.config.ts; the Next.js guide's \"Cache Components\" section says why (https://smoodly.io/docs/frameworks/nextjs).";
+/** The canvas net (spec 2026-09-27 section guard §5): Server Components hand a section that failed to the
+ *  browser, where CanvasBoundary catches it. Defined here, not in the client file: a function exported
+ *  from a "use client" module is a reference on the server and cannot be called. */
+const canvasWrap = (child, section) => (_jsx(Suspense, { fallback: null, children: _jsx(CanvasBoundary, { id: section.id, title: section.title, children: child }) }));
 export function createPageRenderer(options) {
     const { site } = options;
     const href = options.href ?? ((path) => path);
@@ -48,7 +62,7 @@ export function createPageRenderer(options) {
                 notFound();
             }
             const page = pageContextOf(hit, href);
-            return renderPage(Page, hit.tree, { sections: options.sections, elements: options.elements, styles: site.styles, custom: site.custom }, { editor, page });
+            return renderPage(Page, hit.tree, { sections: options.sections, elements: options.elements, styles: site.styles, custom: site.custom }, { editor, page, rethrow: unstable_rethrow, editorWrap: canvasWrap });
         }
         const View = entryPages.get(hit.collection);
         if (!View) {
@@ -67,10 +81,22 @@ export function createPageRenderer(options) {
                 languages[locale] = href(alt.path, locale);
         return { alternates: { languages } };
     }
+    // Next's cacheComponents serves the catch-all from a fallback shell that
+    // commits 200 before the page renders, so 404s and 308s are lost (spec
+    // 2026-09-27 cache components). The variable is Next's own, inlined at
+    // build: a warning, never an error, and once per renderer.
+    let cacheComponentsWarned = false;
+    function warnCacheComponents() {
+        if (cacheComponentsWarned || String(process.env.__NEXT_CACHE_COMPONENTS) !== "true")
+            return;
+        cacheComponentsWarned = true;
+        console.warn(CACHE_COMPONENTS_WARNING);
+    }
     async function page(pathFor, opts, accept) {
+        warnCacheComponents(); // before connection(), so a build's prerender prints it too
         // A CMS route is request-rendered by construction: without this a
         // route with no dynamic segment would be prerendered against the
-        // database at build time (DESIGN.md §3, OQ #19).
+        // database at build time (DESIGN.md §3).
         await connection();
         const locale = opts?.locale ?? site.locales.default;
         const path = pathFor(locale);
@@ -86,7 +112,10 @@ export function createPageRenderer(options) {
         const hit = target ? await load(target, locale, path, draft, version) : null;
         if (!hit || !accept(hit))
             notFound();
-        return (_jsxs(_Fragment, { children: [editor ? _jsx(EditorBridge, {}) : null, render(hit, editor, locale)] }));
+        // The draft marker tells the page editor's canvas diagnosis that Smoodly
+        // rendered this response (spec 2026-09-27 shadowed-page detector §3);
+        // React hoists the meta into the head. Never outside draft mode.
+        return (_jsxs(_Fragment, { children: [draft ? _jsx("meta", { name: DRAFT_META_NAME }) : null, editor ? _jsx(EditorBridge, {}) : null, render(hit, editor, locale)] }));
     }
     async function metadata(pathFor, opts, accept) {
         // generateMetadata runs alongside the page render, so it gates too.

package/dist/pairing.js

@@ -1,14 +1,21 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { defaultsOf } from "./field-defaults.js";
+import { isPlainView, RENDER_VIEW } from "./section-guard.js";
 function pair(schema, View) {
     const defaults = defaultsOf(schema.settings);
-    const Component = (props) => {
+    const viewProps = (props) => {
         const { settings: overrides, styles, ...fields } = props ?? {};
-        const settings = { ...defaults, ...overrides };
+        return { ...fields, settings: { ...defaults, ...overrides }, styles: styles ?? {} };
+    };
+    const Component = (props) => {
         const V = View;
-        return _jsx(V, { ...fields, settings: settings, styles: styles ?? {} });
+        return _jsx(V, { ...viewProps(props) });
     };
     Component.schema = schema;
+    // The guard's direct call (spec 2026-09-27 section guard §1): only a plain-function view may be called.
+    if (isPlainView(View)) {
+        Component[RENDER_VIEW] = (props) => View(viewProps(props));
+    }
     return Component;
 }
 export function section(schema, View) {

package/dist/render.d.ts

@@ -1,4 +1,4 @@
-import type { ComponentType, ReactElement } from "react";
+import { type ComponentType, type ReactElement, type ReactNode } from "react";
 import type { PageAlternate } from "./paths.ts";
 import type { PageSchema } from "./page.ts";
 import type { BuilderMap, NamespaceValues } from "./schema.ts";
@@ -70,8 +70,14 @@ export declare const EMPTY_PAGE_CONTEXT: PageContext;
 type AnyPaired = ComponentType<any> & {
     schema: {
         name: string;
+        title?: string;
     };
 };
+/** The adapter's canvas net (spec 2026-09-27 section guard §5): called per section, in editor mode only. */
+export type EditorWrap = (child: ReactNode, section: {
+    id: string;
+    title: string;
+}) => ReactNode;
 export type ZoneContent = {
     readonly name: string;
     readonly nodes: TreeNode[];
@@ -79,6 +85,9 @@ export type ZoneContent = {
     /** The config's CSS values behind the styles set (spec 2026-09-14 §2). */
     readonly styleValues: StyleValues;
     readonly editor: boolean;
+    /** Control flow the guard must let through — the adapter's (Next: unstable_rethrow; spec 2026-09-27 section guard §2). */
+    readonly rethrow?: (error: unknown) => void;
+    readonly editorWrap?: EditorWrap;
 };
 export declare function Zone({ of: content }: {
     of: ZoneContent;
@@ -102,5 +111,7 @@ export type Registry = {
 export declare function renderPage<Zones extends Record<string, unknown>>(Page: PairedPage<Zones>, tree: PageTree, registry: Registry, options?: {
     editor?: boolean;
     page?: PageContext;
+    rethrow?: (error: unknown) => void;
+    editorWrap?: EditorWrap;
 }): ReactElement;
 export {};

package/dist/render.js

@@ -1,8 +1,11 @@
-import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
-import { EMPTY_ATTR, ZONE_ATTR } from "./marks.js";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Fragment } from "react";
+import { EMPTY_ATTR, NODE_ATTR, ZONE_ATTR } from "./marks.js";
 import { SMD_KEY } from "./section-wrapper.js";
 import { DEFAULT_STYLE_VALUES } from "./styles.js";
 import { CUSTOM_NODE_TYPE, createCustomSection } from "./custom/index.js";
+import { renderGuarded } from "./section-guard.js";
+import { PLACEHOLDER_STYLE } from "./section-crash.js";
 /** The `page` prop of a view rendered outside the site (a test, a preview
  *  of a shape): a real object, so a view never guards an optional prop, but
  *  no position in the tree. Frozen: one singleton shared by every such
@@ -23,12 +26,20 @@ export function Zone({ of: content }) {
     return (_jsx(_Fragment, { children: nodes.map((node) => {
             const Component = content.components.get(node.type);
             if (!Component) {
+                // Editor mode draws a box the bridge can measure, so the node is selectable in place
+                // (spec 2026-09-27 editor safety §5); the site renders nothing, as before.
+                if (content.editor) {
+                    return (_jsxs("div", { [NODE_ATTR]: node.id, style: PLACEHOLDER_STYLE, children: ["Unknown section `", node.type, "`"] }, node.id));
+                }
                 console.warn(`smoodly: no registered component for node type "${node.type}" — skipping.`);
                 return null;
             }
             // The node id, the css and the values ride the styles under one reserved key; the wrapper reads and strips it.
             const styles = { ...(node.styles ?? {}), [SMD_KEY]: { node: node.id, css: typeof node.css === "string" ? node.css : undefined, values: content.styleValues } };
-            return _jsx(Component, { ...node.fields, settings: node.settings ?? {}, styles: styles }, node.id);
+            // Through the guard (spec 2026-09-27 section guard): a throw in the section's own code leaves it out, not the page.
+            const title = Component.schema.title ?? node.type;
+            const section = renderGuarded(Component, { ...node.fields, settings: node.settings ?? {}, styles }, { id: node.id, type: node.type, title, editor: content.editor, rethrow: content.rethrow });
+            return (_jsx(Fragment, { children: content.editor && content.editorWrap ? content.editorWrap(section, { id: node.id, title }) : section }, node.id));
         }) }));
 }
 export function page(schema, View) {
@@ -49,7 +60,7 @@ export function renderPage(Page, tree, registry, options) {
     const styleValues = registry.styles ?? DEFAULT_STYLE_VALUES;
     const zones = Object.fromEntries(Object.keys(Page.schema.zones).map((zone) => [
         zone,
-        { name: zone, nodes: tree.zones?.[zone] ?? [], components, styleValues, editor: options?.editor ?? false },
+        { name: zone, nodes: tree.zones?.[zone] ?? [], components, styleValues, editor: options?.editor ?? false, rethrow: options?.rethrow, editorWrap: options?.editorWrap },
     ]));
     return _jsx(Page, { zones: zones, page: (options?.page ?? EMPTY_PAGE_CONTEXT) });
 }

package/dist/section-crash.d.ts

@@ -0,0 +1,11 @@
+import type { CSSProperties } from "react";
+/** The canvas placeholders' look — the unknown section's too (spec 2026-09-27 editor safety §5). */
+export declare const PLACEHOLDER_STYLE: CSSProperties;
+/** Why it crashed, for the placeholder: the message, or the digest when a production build stripped the message. */
+export declare function crashMessage(error: unknown): string;
+export declare function CrashPlaceholder({ id, title, error, live }: {
+    id: string;
+    title: string;
+    error: unknown;
+    live: "section" | "page";
+}): import("react").JSX.Element;

package/dist/section-crash.js

@@ -0,0 +1,16 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { CRASHED_ATTR, NODE_ATTR } from "./marks.js";
+/** The canvas placeholders' look — the unknown section's too (spec 2026-09-27 editor safety §5). */
+export const PLACEHOLDER_STYLE = {
+    padding: "24px 16px", border: "1px dashed #b54708", color: "#b54708", font: "500 14px/1.4 system-ui, sans-serif", textAlign: "center",
+};
+/** Why it crashed, for the placeholder: the message, or the digest when a production build stripped the message. */
+export function crashMessage(error) {
+    const digest = typeof error === "object" && error !== null ? error.digest : undefined;
+    if (typeof digest === "string")
+        return `the server log has the error (digest ${digest})`;
+    return error instanceof Error ? error.message : String(error);
+}
+export function CrashPlaceholder({ id, title, error, live }) {
+    return (_jsx("div", { [NODE_ATTR]: id, [CRASHED_ATTR]: live, style: PLACEHOLDER_STYLE, children: `Section “${title}” failed to render — ${crashMessage(error)}` }));
+}

package/dist/section-guard.d.ts

@@ -0,0 +1,27 @@
+import type { ComponentType, ReactNode } from "react";
+/** The paired component's own view call, set by pair() and the custom section — only for a plain-function view. */
+export declare const RENDER_VIEW: unique symbol;
+/** A view the guard may call: a plain function — not a client reference or memo/forwardRef ($$typeof), not a class. */
+export declare function isPlainView(View: unknown): boolean;
+export type GuardContext = {
+    id: string;
+    type: string;
+    title: string;
+    editor: boolean;
+    rethrow?: (error: unknown) => void;
+};
+type Settled = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    error: unknown;
+};
+/** A section through the guard when its component offers the view call; any other component as an element, unguarded. */
+export declare function renderGuarded(Component: ComponentType<any>, props: Record<string, unknown>, ctx: GuardContext): ReactNode;
+/** An async section, awaited in place — no <Suspense>, so it renders where it always did. */
+export declare function SectionGuard({ settled, ctx }: {
+    settled: Promise<Settled>;
+    ctx: GuardContext;
+}): Promise<ReactNode>;
+export {};