smoodly 0.0.34 → 0.0.36

package/README.md

@@ -265,12 +265,13 @@ Implemented:
   (`createSmoodlyAdmin` binds registry + op action into `AdminPage`/
   `AdminLayout` for the app's `[[...segments]]` route group;
   `createAdminOpHandler` is the one server action the client ops call),
-  and `smoodly/bridge` (`EditorBridge`, the only piece that ships to the
-  SITE side — runs inside the draft-route iframe, reports node, zone and
+  and `EditorBridge` (never on a live page: the renderer loads it lazily
+  through `next/canvas-slot.tsx` in editor mode only, spec 2026-09-29
+  pre-install fixes §1 — runs inside the draft-route iframe, reports node, zone and
   marked-field geometry, forwards select/hover with the field under the
   pointer, executes refresh/scroll, reports each committed render). Shell
   (registry-derived nav, list views, its own client-side router —
-  `shell/router.ts`, `RouteLink`, a leave guard for dirty forms; the
+  `shell/router.ts`, `RouteLink`, a tab-close guard for pending saves; the
   shell mounts from the layout and the catch-all page only makes the
   URL exist, spec 2026-09-08),
   entry form (widgets by field type, validation errors surfaced inline,
@@ -295,7 +296,8 @@ Implemented:
   `entries.addLocale`/`removeLocale`.
   `pages.list` materializes the code-owned root nodes before an editor
   touches them (`admin/fixed-nodes.ts` derives fixed pages and collection
-  mounts from the registry, never from a column), and every guard asks
+  mounts from the registry and finds their records by the `pages.fixed`
+  owner key, schema v5), and every guard asks
   the same `fixedNodeOf`: a fixed node is never renamed, moved or
   deleted, and no page is created under a mount, and a `homePageSlug`
   guard keeps the site root from being deleted, moved or re-slugged
@@ -521,6 +523,22 @@ Implemented:
   (the rule table, both adapters), the store contracts, `admin-ops`
   ("redirects on rename and move", "redirects ops"),
   `next-page-renderer` ("redirects"), `examples/site/e2e/redirects.spec.ts`.
+- Content API contract (spec 2026-09-29 content API contract): every
+  read returns the public shape — `EntryItem`, `PageItem`, `GlobalItem`
+  (`src/read-shapes.ts`), nothing of other locales, pointers or editors
+  leaves the site layer; a reference resolves as `{ id, path, fields }`
+  as deep as its field says, in lists and single reads alike, and the
+  types follow the depth; `smoodly_list_entries` (schema version 7)
+  filters, orders and limits over the snapshot shown, so `where` sees
+  localized fields and never the live row; a list is tagged by every
+  collection it resolved into; `seo: true` or `{ description, image }`
+  on a collection adds the SEO & Social panel, stored per locale under
+  `$seo` (`src/seo.ts`); every content table admits a write key only, the
+  publishable key serves sign-in and presence (`presenceConfig`). Tests:
+  `test/entry-store-contract.ts` ("query"), `test/site.test.tsx`,
+  `test/next-queries.test.tsx`, `test/types-refs.test.ts`,
+  `test/seo.test.ts`, `test/isolation.supabase.test.ts`,
+  `test/rls.supabase.test.ts`.
 - Editor safety (spec 2026-09-27 editor safety): schema drift — stored
   content the code no longer describes — is found by one pure walk
   (`admin/drift.ts`) over the serialized registry. Broken findings
@@ -623,12 +641,41 @@ Implemented:
   `site`, the page and entry store contracts,
   `examples/site/e2e/entries.spec.ts`.
 
+- Pre-install fixes (spec 2026-09-29 pre-install fixes, schema v6): one
+  permissive policy per table and action (the write key reads through
+  `smoodly_read`; `smoodly_write` splits into insert, update and delete
+  where a public read exists, the media pair too), the missing
+  foreign-key and published-version indexes, `smoodly_space_row_cap`
+  revoked from anon. A live page runs no Smoodly client code: the canvas
+  bridge and the section net load lazily from one stub under 1 KB
+  (`next/canvas-slot.tsx`), and `smoodly/bridge` is no longer an export.
+  Draft mode shows a preview pill (`next/preview-pill.tsx`: an inline
+  Shadow DOM script, bottom centre, movable left/centre/right, hidden
+  until reload, Exit preview through `previewRoute`, which every starter
+  mounts at `app/api/preview/route.ts`; `previewPill()` for routes the
+  renderer does not draw). The page editor, the entry form and the
+  Globals form save a pending edit on unmount (`close()` on the autosave
+  controller, reopened by the hook's effect for StrictMode; it waits for a
+  save in flight and sends the rest with that save's token) and ask only
+  before a tab close (`useUnloadGuard`); `useLeaveGuard`'s in-app "Discard"
+  confirm has no caller now. Draft mode's pill is absent from History's
+  version iframe (`smoodly-version`), whose Exit would end draft mode under
+  the editor.
+  The cached unit is keyed by (locale, path, kind, id). A new list item's
+  required select or radio stores its first option. Every starter sets
+  `metadataBase` from `SITE_URL`, which the installer writes. Tests:
+  `migration-policies`, `sql`, `canvas-slot`, `site-entries`,
+  `next-preview-route`, `next-preview-pill`, `next-page-renderer`,
+  `admin-autosave`, `admin-list-helpers`, `env` (installer),
+  `e2e/publish.spec.ts`, `e2e/editor.spec.ts`, `e2e/languages.spec.ts`,
+  `e2e/site-bundle.spec.ts` (CI-only).
+
 Not yet: canvas drag-and-drop (list fields, the outline, manual
 collections and the pages tree drag since 2026-09-09 — spec
 `docs/superpowers/specs/2026-09-09-drag-and-drop-design.md`), undo/redo, sample/placeholder content
-marking, per-locale section visibility conditions (OQ #3 — each locale
-now has its own tree, so a section's fields are already per locale; what
-is open is hiding a section by a locale-dependent condition).
+marking. Per-locale section visibility is not coming: each locale has its
+own tree, so a locale that does not want a section removes it (DESIGN.md
+§3, 2026-09-14).
 
 ## Releasing
 
@@ -649,78 +696,105 @@ after both are on the registry. From the repo root:
 `prepublishOnly` rebuilds each package. The Claude Code skill
 `.claude/skills/releasing-smoodly` carries the same order with its checks.
 
-## Follow-ups (logged 2026-09-29, nested collection paths)
+## Follow-ups
+
+The code-level debt register, triaged 2026-09-29 into four buckets:
+**Now** (before the first client install), **Next** (hardening soon
+after), **Later** (by area) and **Cloud** (only once Smoodly Cloud
+exists). Each item ends with where it was logged. A fixed item is
+deleted — git history and the specs keep the record — and a new one
+goes straight into its bucket. Design-level questions live in
+`docs/DESIGN.md`'s Open questions, not here.
+
+### Now
+
+Nothing open.
+
+### Next
+
+#### Data integrity
+
+- Older than this plan: the Supabase `addLocale` rollback on
+  `alreadyInLocale` (`supabase-store.ts`, the insertLocale catch)
+  deletes the racing WINNER's locale row and versions. Two admins
+  adding one locale at once converge on the next list; fix by rolling
+  back only what this call inserted. *(2026-09-29, nested collection paths)*
+- A ready asset whose `poster_id` names a pending asset would fail the
+  export's consistency check on every run (pending assets are not
+  exported). Unverified whether the upload flow can leave that state;
+  if it can, export the poster or null the pointer with a warning. *(2026-09-28, export/import)*
+- Publish, discard and restore compare the token, then move the pointer under a
+  pointer filter: a save that rewrites the same draft row in place between the
+  two is published unseen (one round trip wide). A SQL function would close it. *(2026-09-26, concurrency)*
+- Publish integrity for an entry's own refs: an entry can publish while
+  pointing at an unpublished entry; pages are gated, entries are not. *(2026-09-14, collections draft/publish)*
+- Unpublishing a page does not cascade: a published child keeps serving
+  under an unpublished parent's path. Decide whether it should. *(2026-09-13, publish flow)*
+- `entries.move` expires the entry and its descendants but does not fan
+  out to the pages referencing them, nor to the old and the new parent
+  entries the way `pages.move` does — asymmetric with `entries.save` and
+  `entries.setStatus`, which both fan out. *(2026-09-06)*
+
+#### Multi-statement writes (no transaction on the Supabase adapters)
+
+- The Supabase entry adapter's `removeLocale` deletes the row and its
+  versions before the paths rewrite with no rollback; its residue
+  comment describes the opposite case (a surviving path row for a
+  removed locale, not a present node without its path row). *(2026-09-06)*
+- The Supabase entry adapter's rollbacks are best-effort and can mask the
+  original throw: `create`'s catch runs `paths.remove` before the node
+  delete (a failing remove strands the node and replaces the real error),
+  `update` and `move` restore by writing, and those writes can throw in
+  place of the rewrite's rejection. `recordVersion` is two statements
+  (insert, then point at it), so a failure between them leaves an
+  unreferenced `entry_versions` row — invisible to every policy and
+  harmless, but it accumulates. *(2026-09-06)*
+- `move` is best-effort across two statements (reorder, then path rewrite):
+  a failed rewrite restores each destination sibling's prior `sort` row by
+  row, so a failure in the rollback itself still leaves the order changed. *(2026-09-05)*
+- Rollback gaps that remain: a `smoodly_reorder`/`smoodly_reorder_pages`
+  failure AFTER the re-parent update has no rollback at all; the entry
+  `create` rollback discards its delete result (an orphan row survives
+  silently); and a throw inside any rollback replaces — masks — the original
+  error. *(2026-09-05)*
+- `setTemplate`/`saveDraft` insert the version row before the pointer update:
+  an infra failure between the two orphans a version. *(2026-09-05)*
+
+#### Addresses and code-owned records
 
 - `homePageSlug` is compared with a collection's whole default path, so
   `"home/news"` passes boot with the home page as its middle part: the
   home record serves `/`, so `/home` is no page while `/home/news` is.
   Refuse an address whose first part is the home slug if a site trips on
-  it.
+  it. *(2026-09-29, nested collection paths)*
 - An owner key that changes in code — a fixed page that becomes a
   collection's index page (`page:x` → `collection:y`), a collection
   renamed — leaves the old record "No longer in code" with its
   sections and history, and a new empty record takes the address.
-  Carry the record over (rewrite `fixed`) when a site asks.
+  Carry the record over (rewrite `fixed`) when a site asks. *(2026-09-29, nested collection paths)*
 - An index page registration renamed (`a` → `b`) leaves the record on
   template `a`: `ensureFixedNodes` only handles a folder gaining an
-  index page, and `setTemplate` refuses a record that has one.
-- The rename/move confirm's code-address line names the addresses in
-  the selected locale only, though a move re-paths every locale; the
-  Pages list's conflict notice is one ellipsized line (the whole text
-  on hover), and an editor's flagged page cannot be moved from the
-  notice itself.
-- An index page removed from code leaves the collection's record with
-  its template (spec amendment 3): the record keeps rendering as that
-  page type's stale name until an editor or a later pass clears it.
-- The code-owned part of a URL is never stored (spec 2026-09-29 anchored
-  paths): a row names its anchor and the index joins the config's
-  address, so an address changed in code moves its URLs at the deploy
-  with no write, and the old URLs need a `next.config.ts` redirect.
-  Rows written before schema v5's anchors (none installed) would sit
-  under `''` and go dark under a code address until re-saved.
-- `listLive` / `listRedirects` on Supabase read at most PostgREST's
-  `max_rows` (1000) per locale, as before, now ordered by (anchor, path)
-  and sorted by URL in JS; page them if a locale's redirect list grows
-  past it.
-- Older than this plan: the Supabase `addLocale` rollback on
-  `alreadyInLocale` (`supabase-store.ts`, the insertLocale catch)
-  deletes the racing WINNER's locale row and versions. Two admins
-  adding one locale at once converge on the next list; fix by rolling
-  back only what this call inserted.
-
-## Follow-ups (logged 2026-09-29, pre-install fixes)
-
-- Content health lists an entry slug outside the grammar, but its link
-  opens an entry form that marks nothing on the slug: drift leaves the
-  slug out on purpose (a marker would flash while it is typed), so only
-  the publish refusal marks it. Mark it in the form once the box has lost
-  focus, if editors miss it.
-- Content health does not check page slugs: pages refuse a bad slug at
-  create and rename, so only an import of older data or a hand edit could
-  hold one.
+  index page, and `setTemplate` refuses a record that has one. *(2026-09-29, nested collection paths)*
 
-## Follow-ups (logged 2026-09-28, export/import spec)
+#### Security
 
-- `import --replace`: delete the space's content and media first, after
-  typing the space to confirm — a backup restored over a live project.
-  Mention it in the not-empty refusal when it lands.
-- A copy inside one database with fresh IDs — the cloud's "duplicate
-  environment", staging → production; needs the reference walk (parent
-  links, version pointers, refs, paths, asset ids in trees, fields and
-  richtext) the eject avoids by keeping IDs.
-- A readable export for leaving Smoodly: one document per page or entry,
-  fields resolved, no internal IDs.
-- A "Download backup" button in the admin: the same export behind an op,
-  zipped for an editor.
-- A ready asset whose `poster_id` names a pending asset would fail the
-  export's consistency check on every run (pending assets are not
-  exported). Unverified whether the upload flow can leave that state;
-  if it can, export the poster or null the pointer with a warning.
-- Import cannot expire the app's cache tags; it prints a restart note. A
-  revalidate call through the app (an op the CLI could reach) would make
-  the note unnecessary.
+- The bridge posts with `"*"` on both sides. Safe today: the admin
+  accepts a message only when `e.source` is its own iframe's window, and
+  the canvas acts on two kinds, refresh and scroll. The target-origin
+  pass belongs to the content-surface sweep (spec §Out of scope). *(2026-09-26, security pass)*
+- The invite's `redirectTo` is a client-supplied string bounded by the
+  auth project's redirect allow-list; a same-origin check in the op is
+  one line when wanted. *(2026-09-26, security pass)*
+- The content-surface sweep: `f.link` values reach section components
+  unfiltered, uploads allow SVG and PDF on a public bucket (SVG served
+  with `?download=`), the custom CSS refusal list, richtext hrefs. *(2026-09-26, security pass)*
+- `RichText` drops the anchor of a link mark whose href is not http(s),
+  mailto, tel or site-relative (`/`, `#`, `?`, `.`). The href is normalised
+  the way URL parsers do (tab, LF and CR removed) before the scheme test;
+  `javascript:`, `data:`, protocol-relative `//host` and the backslash form
+  `/\host` are rejected. The admin's link field does not validate on input yet. *(2026-09-07, list field)*
 
-## Follow-ups (logged 2026-09-27, shadowed-page detector spec)
+#### The live site
 
 - A section's crash on a live page after data changed outside the page
   editor (an entry or a global item edited in its form): the guard
@@ -728,1406 +802,813 @@ after both are on the registry. From the repo root:
   it renders, in a richtext element's view or in a `'use client'`
   section still fails the page, and no canvas previews those forms.
   Catching it live needs `<Suspense>` (spec 2026-09-27 section guard,
-  measured). Revisit if a real site hits it.
+  measured). Revisit if a real site hits it. *(2026-09-27, shadowed-page detector)*
+- Publishing a global the site layout reads (the footer) serves the old
+  layout on the first public request made right after the publish returns;
+  every request after it, and a first request made ~3 s later, is fresh.
+  Pages do not show it (an unpublish answers 404 at once). Seen on
+  `next dev`; `e2e/globals.spec.ts` polls the home page for it. Find out
+  whether `updateTag` over a layout's `getGlobal` read expires late, and
+  whether `next start` behaves the same. *(2026-09-26, browser suite)*
+- A robots `Disallow` for the admin path from `next/meta`. *(2026-09-17, admin path)*
+- Scripts and the seed write through the stores and expire nothing; a
+  `revalidate` hook for out-of-band writers. *(2026-09-11, queries)*
+- Delivery caching (checked 2026-09-08): Supabase Storage's basic CDN
+  fronts every public-bucket object on a hosted project with no code on
+  our side, and the Smart CDN (Pro plan, automatic) only adds
+  invalidation on overwrite, which never happens — objects are
+  immutable, no upsert on either path, Replace picks a new id. So both
+  upload paths now set a year-long `cache-control`
+  (`MEDIA_CACHE_SECONDS`): the `cacheControl` option on the server-side
+  upload, the header on the browser's signed PUT (without it a signed
+  upload lands as `no-cache`; Storage's default is one hour). The live
+  suite reads the header back from the local stack. Not yet verified
+  against a hosted project's CDN edge; check `cf-cache-status` and
+  `cache-control` on a real upload there once. Remaining: in v1 the
+  site's `<SmoodlyImage>` goes through `next/image`, so the visitor hits
+  the app server's image cache and only its origin fetch touches the
+  CDN; video, files and SVGs hit the CDN directly. A Supabase Image
+  Transformations loader (`/storage/v1/render/image/public/...`, Pro
+  only, must stay optional) would move resizing to the CDN — the transform
+  loader under Cloud. *(2026-09-08, media library)*
+- `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime. *(2026-09-04)*
+- Empty locked zones on the site side: `renderPage` renders nothing for a locked zone with no node. A page that predates the zone shows no prefooter on the published site until an editor opens it (the editor fills and saves). Options: render the component from `sample` when the zone is empty, or fill on `createPage`/schema load server-side. Fine for now — seeded and admin-created pages both arrive filled. *(2026-09-03)*
 
-## Follow-ups (logged 2026-09-27, editor safety spec)
+#### The editors
 
-- Scan paging: `health.scan` makes one bulk read per table (versions by
-  id in chunks of 100), and PostgREST's max-rows would cap a very large
-  space. Page it, and add a rail badge, when a real site's size asks.
-- Refs inside unknown nodes are not indexed: without a schema nothing
-  says which values are refs, so safe-delete cannot see them. Publish
-  refuses such nodes and a live one renders nothing.
-- Leftover shared values after `.localized()` is turned on stay on the
-  entry as every locale's fallback; removing them for good waits on
-  the fix tooling (OQ 35). `localization-on` is reported only where a
-  locale has no value of its own, so a fully translated entry no
-  longer lists it.
 - A visual global item's settings misfits (`settings.x`) don't reach
   their widgets in the Globals form: `GlobalFields` keys errors by the
   bare field key, the same gap the validator's refusal keys had before.
-  The notice and the refusal list still name them.
-- A CLI drift report was left out (the admin already has the config and
-  the database; a CLI needs the service key and a TS config loader).
+  The notice and the refusal list still name them. *(2026-09-27, editor safety)*
+- A `refList` on a global item's `settings` still loads no options in
+  the Globals form or the page editor: both collect targets from the
+  item's `fields` only. *(2026-09-17, reference picker and tags)*
+- A validation failure on a shared save retries with backoff like a
+  transport failure; the field error shows on the widget meanwhile. A
+  distinct "fix the field" state would stop the retries. *(2026-09-13, shared inline editing)*
+- Escape inside any inspector control bubbles to the editor's window
+  handler and clears the block selection — the link popover stops it, a
+  textarea or the TipTap content does not. A `keydown` guard on
+  `.sm-inspector` would fix it for every control. *(2026-09-08, richtext widget)*
+
+#### Admin
+
+- Left open by the pre-install fixes' final review (2026-09-29): the pill
+  has `href="#"` on Exit and no keyboard way to move it; it appears after
+  a soft navigation from a non-Smoodly route only once the page reloads
+  (React never runs a script it creates on the client); a remounted view's
+  `pages.get` can read the draft before the outgoing view's `close()` save
+  commits (the next edit then meets `StaleBanner`); an in-flight save that
+  fails after `close()` is not retried; a required `radio` with no value
+  shows no pill pressed while the list item now stores the first option,
+  and `nodeFromSample` seeds a required `select` as `""`; `useLeaveGuard`
+  has no caller left; `examples/site/.env.local.example` lacks `SITE_URL`.
+  *(2026-09-29, pre-install fixes)*
+- `admin/ui/theme.tsx` pulls Public Sans from Google Fonts with an `@import`.
+  Fine today; a self-hosted font (or `next/font` in the glue layer) removes the
+  third-party request and the flash before it loads. *(2026-09-05)*
 
-## Follow-ups (logged 2026-09-26, redirects spec)
+#### Performance
 
-- Destinations outside Smoodly, extension and query-string addresses,
-  code-owned renames (a collection `path`, a fixed slug): the guide's
-  `next.config` recipe; a `redirects` table is OQ 34.
-- The content API's `getPage("/old")` returns null for a redirect row
-  (spec §7); a `follow` option is a one-line addition if a site asks.
-- A redirect row has no audit columns (who, when); add them with a
-  need. The Redirects page is not paged.
-- The browser suite covers rename, the unticked box, no chains, the
-  Settings tab's list and the manual add/remove; a parent's MOVE
-  redirecting a child's URL is proven at the store contract and ops
-  level only (no tree drag in the suite yet).
-- `remove` on the Supabase index deletes by target, one statement per
-  target (the RPC now spares redirect rows); fine at subtree sizes.
+- `pages.get` makes four sequential store round trips for a non-root page
+  (`getPage`, `getDraftTree`, `pathsOf`, and the parent read behind
+  `parentLocales`; three for a root, which has no parent to read), and the
+  editor calls it on load and after every rename — one store call
+  returning them all would cut the editor's latency. *(2026-09-06)*
 
-## Follow-ups (logged 2026-09-26, security pass)
+#### Code health
 
-- The bridge posts with `"*"` on both sides. Safe today: the admin
-  accepts a message only when `e.source` is its own iframe's window, and
-  the canvas acts on two kinds, refresh and scroll. The target-origin
-  pass belongs to the content-surface sweep (spec §Out of scope).
-- The invite's `redirectTo` is a client-supplied string bounded by the
-  auth project's redirect allow-list; a same-origin check in the op is
-  one line when wanted.
-- Every op call with a junk token costs one `auth.getUser` against the
-  auth project; rate limiting is the session-model spec's (OQ 20).
-- The content-surface sweep: `f.link` values reach section components
-  unfiltered, uploads allow SVG and PDF on a public bucket (SVG served
-  with `?download=`), the custom CSS refusal list, richtext hrefs.
-- A refused private-channel join surfaces as `CHANNEL_ERROR` (about 80
-  ms on the local stack); the suite asserts "not SUBSCRIBED".
-- The isolation suite's `join` helper still uses a bare
-  `realtime.setAuth(key)`: its positive cases resolve on the first
-  SUBSCRIBED, before realtime-js re-asks the default `accessToken`
-  callback and the server closes the channel. Fine for proving the
-  policy; a client that must stay joined passes `accessToken` (what
-  `connectRealtime` does since 3ed8931).
-
-## Follow-ups (logged 2026-09-26, concurrency spec)
-
-- A hard lock with takeover, if a real team asks: presence has the facts.
-- Presence on the members and media screens; today only pages, entries and
-  global items track.
-- Postgres Changes for live list refresh; the lists still load on navigation.
-- Field-level merging of two editors' changes; the guard refuses whole documents.
-- Publish, discard and restore compare the token, then move the pointer under a
-  pointer filter: a save that rewrites the same draft row in place between the
-  two is published unseen (one round trip wide). A SQL function would close it.
-- Publish leaves the token unchanged (the pointer and its saved time do not move),
-  so a publish with a token from before another person's publish of the same
-  draft succeeds — the content is the same. Recorded, not a bug.
-- The read client over the read key (DESIGN.md OQ 31) can reuse `publicContent()`.
-- A dropped socket clears presence on Realtime's timeout (tens of seconds); the
-  lock outlives a closed tab by that much.
-- The live suites wipe `members` and the content tables; a pane walk after
-  them needs `npm run reseed` (or `scripts/demo-editor.ts`) first.
+- `classify` in `ops-impl.ts` is ~20 order-sensitive substring checks over
+  store messages — `"already exists in locale"` must precede
+  `"already exists"`, or an addLocale conflict reads as a slug conflict. A
+  typed code on `pageErrors` (thrown and matched, not re-parsed) would
+  remove the ordering hazard before plan 2 adds the entry messages. *(2026-09-06)*
 
-## Follow-ups (logged 2026-09-26, browser suite)
+#### Tests and CI
 
+- The blank-intl starter is typechecked, not walked: the first tester-agent
+  mission (each tester site on its own local Supabase stack, two at a time),
+  after the 0.0.35 release. *(2026-09-15, locale alternates)*
 - Drag and drop has no browser test (spec §4): the outline, the pages
   tree and list rows reorder by real pointer drags; the first plan that
-  touches `useSortable` adds them.
+  touches `useSortable` adds them. *(2026-09-26, browser suite)*
 - The suite runs Chromium only; the admin's WebKit and Firefox
-  behaviour is unverified.
-- Three `window.confirm` calls remain outside the confirm dialog (the
-  router's leave guard, `ui/confirm.ts`'s fallback) and are not exercised.
-- The media test uploads a starter photo under a suffixed name rather
-  than a fixture file, so `e2e/fixtures/` from the spec does not exist.
-- ListView rows that are not clickable (Members) carry no role; the
-  members test finds its row by `.sm-table__body > div`. A table role
-  set (`table`/`row`/`cell`) on ListView would give every list a proper
-  locator.
-- Publishing a global the site layout reads (the footer) serves the old
-  layout on the first public request made right after the publish returns;
-  every request after it, and a first request made ~3 s later, is fresh.
-  Pages do not show it (an unpublish answers 404 at once). Seen on
-  `next dev`; `e2e/globals.spec.ts` polls the home page for it. Find out
-  whether `updateTag` over a layout's `getGlobal` read expires late, and
-  whether `next start` behaves the same.
-- Fixed in the same session: an inserted section seeded an unsampled
-  optional object as `{}`, which publish then validated as present — an
-  untouched Image and text `link` refused the publish. The insert now
-  leaves it absent and validation reads a blank optional object as absent.
-
-## Follow-ups (logged 2026-09-26, schema migrations spec)
-
-- Existing databases (every install so far is ours; spec 2026-09-26 §7):
-  a database created before version 1 has the schema but not the table.
-  One time, in the SQL editor or psql:
-  `create table if not exists "smoodly_meta" ("key" text primary key, "value" text not null);`
-  `alter table "smoodly_meta" enable row level security;`
-  `insert into "smoodly_meta" ("key", "value") values ('schema_version', '1') on conflict ("key") do update set "value" = excluded."value";`
-  then re-apply the `smoodly_read` policy on `smoodly_meta` from
-  `migrations/20260926120000_smoodly_v1.sql` (a `drop … if exists` /
-  `create policy` pair). The hand-applied statement lists below stay as
-  history; from version 2 on, every change is a file.
-- Drafting version N+1: `npx tsx scripts/emit-migration.ts` prints the
-  whole schema plus the upsert; keep only the delta, name the file with
-  the current UTC stamp and `_smoodly_v<N+1>.sql`, bump `SCHEMA_VERSION`,
-  run `npm run db:migrate` at the root so the repo copy follows, and
-  `npm run check:migrations`. Additive only; a contraction waits for the
-  compatibility window and carries `-- smoodly:contraction`.
-- The views of a removed collection stay (spec 2026-09-26 §3); a
-  `drop view` is the developer's.
-- `smoodly migrate` never pushes; a `--push` flag if the two-step
-  proves annoying.
-- The CLI loads `smoodly/collections.ts` through tsx; a project that
-  registers collections elsewhere passes `--collections <file>`.
-- The site's one warning fires from the Supabase page store's first
-  `resolvePath`, once per store instance; a site that never locates (a
-  pure `q` reader) never warns, and a long-running server that was
-  current when it booted stays quiet — the admin notice is the real
-  signal.
-- A Deploying guide (nav lists it, unwritten) should show
-  `npx smoodly migrate --check` as a build step.
+  behaviour is unverified. *(2026-09-26, browser suite)*
+- The seed's early exit probes `/` alone, and `createPage` writes the path
+  row before the tree is published, so a crash between the home record and
+  the last page leaves a database every later run reports as "already
+  seeded"; recovery is `supabase db reset`. A probe on the last thing the
+  seed writes, or a per-step check, would make it resumable. *(2026-09-07, starter)*
+- The package root (`src/index.ts`) must stay free of Node builtins:
+  every scaffolded section does `import { f, smoodly } from "smoodly"`,
+  and a `"use client"` section's browser build would fail on one.
+  `sharedEntryId` (`src/shared-id.ts`) moved off `node:crypto` onto Web
+  Crypto for this reason (fix pass, 2026-09-07). Nothing tests the
+  invariant itself — a future addition that reaches for `node:fs`,
+  `node:crypto`, etc. from a module reachable through the root would
+  regress it silently. *(2026-09-07, shared content)*
+- The single-language branch — no locale selector in the Pages list, no
+  switcher, no add/remove — has no automated coverage; only three sites
+  branch on the locale count (`PagesList.tsx`, `EditorView.tsx` and
+  `page-renderer.tsx`'s alternates), so a regression there shows up only
+  in a scaffolded single-language app. *(2026-09-06)*
+- The no-database build is the real proof that routes never prerender against the stores; the unit test only stubs `next/server`. Script it (`SUPABASE_URL=http://127.0.0.1:9 npx next build` in `examples/site`, expect `ƒ /`) and add it to CI, which today runs only the package's tests and typecheck — so a regression is caught when Next changes `connection()` semantics. — Partly resolved 2026-09-26: the `browser` job builds the example site and drives it, but with a database; the no-database build is still unscripted. *(2026-09-03)*
+
+### Later
+
+#### Page editor and inline editing
+
+- The page editor's publish banner lists fields as plain text; the forms'
+  lines focus the widget. Selecting the node from a `node.field` path is
+  the missing piece. *(2026-09-14, collections draft/publish)*
+- Richtext instant write from the inspector: the pure `RichText` render
+  swapped into the container while the widget is typed in. *(2026-09-10, inline editing)*
+- Item-level chrome in the canvas ("Key points · 3 of 4" on hover, add,
+  remove, reorder in place, later drag within a list): the item marks are
+  the hook. *(2026-09-10, inline editing)*
+- Placeholder and validation marks on the page (the sample-sourced
+  placeholder treatment, "required, empty" outlines) wait for the tree's
+  placeholder marking. *(2026-09-10, inline editing)*
+- A coverage hint for developers: the admin knows a section's text fields
+  and could list the ones without a mark. *(2026-09-10, inline editing)*
+- AI verbs ("rewrite this heading") need a field under the cursor, which
+  a mark is. *(2026-09-10, inline editing)*
+- Direct-child spacing rules on a richtext container (Tailwind `space-y-*`,
+  `.prose > p`) do not reach the canvas editor's blocks during a session;
+  flex and grid gaps are copied (onto the ProseMirror root since the
+  walk, 69aecc6). Documented, not fixed. *(2026-09-10, inline editing)*
+- The floating toolbar flips below the caret only near the top of the
+  DOCUMENT (where the page box clips it); it scrolls with the content, so
+  a caret at the top of the scrolled canvas has its toolbar out of view
+  until the editor scrolls. A flip keyed to the scroller's viewport would
+  fix it. *(2026-09-10, inline editing)*
+- No starter section gives the canvas a richtext with blocks: the Image
+  and text body is marks-only, and the article body (the `article`
+  toolset) is edited in the entry form. The walk borrowed the article
+  toolset for the block steps; a starter section with a long-form body
+  would let the canvas show them. *(2026-09-10, inline editing)*
+- The caret placed right after an existing `/` reopens the slash menu
+  (TipTap's suggestion re-triggers on the character before the caret).
+  Harmless; a trigger keyed to typing only would be stricter. *(2026-09-10, inline editing)*
 
-## Follow-ups (logged 2026-09-17, admin path spec)
+#### Richtext and elements
 
-- A robots `Disallow` for the admin path from `next/meta`.
+- Image sizing and float in a body (full width, wide, small, left/right):
+  a later additive `styles` on the image node; the site's CSS answers it. *(2026-09-08, block nodes)*
+- Inline elements: `inline: true` on the registration; cursor, marks and
+  selection around an inline atom are a separate node-view effort. *(2026-09-08, block nodes)*
+- The column context (`contexts: ["column"]`) waits for Phase 3 rows;
+  accepted and unused today. *(2026-09-08, block nodes)*
+- Element copy between fields: a pasted element the target toolset
+  forbids is dropped silently; a notice would be kinder. *(2026-09-08, block nodes)*
+- `hasContent` treats an unresolved image node as content, so a body
+  whose only image was deleted from the library still passes "required". *(2026-09-08, block nodes)*
+- The "+" menu and the slash menu share `RichtextInsertMenu` but keep
+  separate active-row state and key handling; one keyboard model would
+  be smaller. *(2026-09-08, block nodes)*
+- A page and entry picker in the link popover: a link inside a richtext
+  document is a reference the refs index, the resolver and the localizer
+  cannot see (they address refs by top-level key). Its own spec. *(2026-09-08, richtext widget)*
+- Every richtext descriptor now carries its toolset, so the serialized
+  registry grew by a few bytes per field; if the AI-facing schema wants
+  the vocabulary once instead of per field, dedupe there. *(2026-09-08, richtext widget)*
 
-## Follow-ups (logged 2026-09-17, reference picker and tags spec)
+#### Forms, fields and pickers
 
 - A `Create…` button in the reference picker: create the target entry
   without leaving the form. Needs its own answer for modal vs navigation
-  and for the parent form's pending autosave.
-- Server search for ref candidates: `useRefOptions` loads the whole
-  target collection once per locale. When a collection outgrows that,
-  the hook changes (a search op, plus "titles for these ids" for the
-  picked rows); `RefPicker` takes options as a prop and does not.
+  and for the parent form's pending autosave. *(2026-09-17, reference picker and tags)*
 - Thumbnails in picker rows: collections have no preview-image
-  convention (`titleField` only).
-- `entries.distinct` flattens in JS over `entries.list`; an RPC over
-  `jsonb_array_elements` when a collection outgrows it.
-- Tags keep insertion order; no drag reorder.
+  convention (`titleField` only). *(2026-09-17, reference picker and tags)*
+- Tags keep insertion order; no drag reorder. *(2026-09-17, reference picker and tags)*
 - Tag suggestions exist on collection entry forms only, and only for
   top-level `f.tags()` fields: a tags field inside an object, on a
-  section, a global or a page is a plain chip input.
+  section, a global or a page is a plain chip input. *(2026-09-17, reference picker and tags)*
 - The picker's "open" link goes to `/admin/<collection>/<id>` without
-  the edited locale; the form opens in the URL's or the default locale.
+  the edited locale; the form opens in the URL's or the default locale. *(2026-09-17, reference picker and tags)*
 - The Combobox list is portaled into the admin wrapper and fixed to the
   viewport (2026-09-27), so a modal body or scrolling form no longer
   clips it; it flips upwards when the viewport has no room under the
   input (`listPlacement`) and follows the input on scroll. It does not
   yet shrink when neither side has room for it. A single select (a
   single `f.ref`, the redirect target) shows its pick inside the input;
-  a single ref's status, open link and remove sit in the input too.
-- `RefOption.status` is the three-way `LocaleStatus` now; the old
-  "(draft)" suffix in option titles is gone with the native select.
-- A `refList` on a global item's `settings` still loads no options in
-  the Globals form or the page editor: both collect targets from the
-  item's `fields` only.
-
-## Follow-ups (logged 2026-09-15, locale alternates spec)
-
-- A layout-only language switch, if a real site needs one: a
-  `q().getAlternates(path)` over the `paths` index plus a proxy header
-  carrying the request path. Not built until asked for — the starters
-  render the switch from the page (`components/PageFrame.tsx`,
-  `components/LocaleNav.tsx`).
-- The walk covered the Lorem example only; blank-intl is typechecked, not
-  walked. Walk it on the next blank-intl install.
+  a single ref's status, open link and remove sit in the input too. *(2026-09-17, reference picker and tags)*
+- A create dialog (title and slug) before "+ New entry", if empty Untitled
+  drafts turn out to litter lists. *(2026-09-14, collections draft/publish)*
+- `f.date()` and `f.datetime()` share one in-house calendar
+  (`admin/forms/DatePicker.tsx` over the pure `date-picker.ts`); the
+  browsers' own pickers were rejected (they differ and take no tokens).
+  Weeks start on Monday and month names come from the browser's language
+  — `weekStart` and a month-name locale as config keys are follow-ups. *(2026-09-25, date pickers)*
+- Not built: a time-only field, a date range, `.min` / `.max` on dates. *(2026-09-25, date pickers)*
+- Refs inside lists and objects are refused at build time (`f.list`,
+  `f.object`). A list of objects each holding a ref (a featured entry with
+  its own caption) needs the resolver, the refs index and the admin's
+  ref-option loading to address nested paths; add when a site asks. *(2026-09-07, list field)*
+- `emptyValue` for an `image`/`video`/`file` item is `undefined`, so a new
+  media row starts empty; a required image item is then a validation
+  error until filled, which is the intended nudge but reads as an error
+  on a row the editor just added. *(2026-09-07, list field)*
+- A list item's subtree still uses the row index as its React key, so a list
+  of objects each holding a list hands the inner rows another item's collapse
+  state when an outer row moves; fix with a stable per-item key when nested
+  lists get real use. *(2026-09-07, list field)*
 
-## Follow-ups (logged 2026-09-15, custom section spec §6, plan B)
+#### Custom sections and section settings
 
 - Inline editing of a column on the canvas is OFF (2026-09-15, after the
   first day's use): a click on a column reveals its editor in the
   inspector (`onFieldClick` in `EditorView.tsx` skips the session for the
   `custom` type). The marks, paths and session code are in place and
-  tested; turn it on once a walk on a real device passes.
-- A canvas drag on column edges (today the bar in the inspector).
-- A background for a custom section from a config palette.
-- Elements as direct column children (today through richtext's menus).
-- A per-zone cap on columns (`custom: { columns: 2 }` or similar).
-- `--container` is a soft convention: the rows read
-  `var(--smd-width, var(--container, none))` and `var(--smd-gutter, 1rem)`;
-  a project without those variables gets full-width rows with a 1rem
-  gutter. Documented, not enforced.
-- Presets exist for 2, 3 and 4 columns; 5 and 6 have the bar only.
-- Rows reorder with the ↑/↓ buttons only; no grip, no keyboard drag.
+  tested; turn it on once a walk on a real device passes. *(2026-09-15, custom section)*
+- A canvas drag on column edges (today the bar in the inspector). *(2026-09-15, custom section)*
+- A background for a custom section from a config palette. *(2026-09-15, custom section)*
+- Elements as direct column children (today through richtext's menus). *(2026-09-15, custom section)*
+- A per-zone cap on columns (`custom: { columns: 2 }` or similar). *(2026-09-15, custom section)*
+- Presets exist for 2, 3 and 4 columns; 5 and 6 have the bar only. *(2026-09-15, custom section)*
+- Rows reorder with the ↑/↓ buttons only; no grip, no keyboard drag. *(2026-09-15, custom section)*
 - An empty column has no box on the live page (an empty paragraph
   renders 0px tall), so it cannot be clicked into from the canvas; the
   inspector's `Column N` editor is the way in. A `min-height` in editor
-  mode would give it a target.
+  mode would give it a target. *(2026-09-15, custom section)*
 - An empty column publishes (its richtext descriptor is `optional`);
-  whether publish should refuse a row of only empty columns is open.
+  whether publish should refuse a row of only empty columns is open. *(2026-09-15, custom section)*
 - Growing a row copies the LAST span before renormalizing, so `[5, 7]` →
   `[3, 5, 4]`, not thirds; a preset is one click away. Equal thirds on
-  grow would be the other reasonable rule.
-- The picker's click cannot be unit-tested (no DOM in the suite); the
-  walk covers it. A jsdom environment for the admin tests is a future
-  tooling item.
-- No migration: the `rows: true` zone flag became `custom: true` and
-  `config.rows` is gone; no stored data changed shape.
-- A column carries no project class: the starters extend their `.prose`
-  rules to `.smd-col` so headings, figures and callouts inside a column
-  read like body text. A project on its own stylesheet does the same, or
-  targets `[data-custom]`. A `columnClass` in `config.custom` would
-  remove that step.
-
-## Follow-ups (logged 2026-09-15, section settings spec, plan A)
-
-Upgrade note: stored trees, global entries and element nodes changed
-shape (`styles` → `settings`, `meta` gone, the `global` node type and
-`global:` ids, `$settings`/`$styles`/`$css` on global rows). No migration
-tool — reset and reseed a development database (`supabase db reset`,
-`npm run seed`); no installs predate the change.
-
+  grow would be the other reasonable rule. *(2026-09-15, custom section)*
 - A class-mapping API for projects that want the wrapper to emit
-  classes instead of inline values (DESIGN.md OQ 13).
-- `f.global()` — a ref field on a section that renders a global item.
+  classes instead of inline values (DESIGN.md OQ 13). *(2026-09-15, section settings)*
+- `f.global()` — a ref field on a section that renders a global item. *(2026-09-15, section settings)*
 - An AI helper filling the CSS box from a prompt (the box stores CSS,
-  never a prompt, so the helper only fills it).
-- `and` / `or` conditions; today one `f.when()` per field.
+  never a prompt, so the helper only fills it). *(2026-09-15, section settings)*
+- `and` / `or` conditions; today one `f.when()` per field. *(2026-09-15, section settings)*
 - A condition inside a list item can read the item's siblings and the
   top-level namespaces, not another item; per-item scoped `settings.`
-  references inside lists are not a thing yet.
+  references inside lists are not a thing yet. *(2026-09-15, section settings)*
 - An element's settings cannot be hidden by the enclosing section's
   settings: an element card's scope is the element's own fields and
-  settings.
+  settings. *(2026-09-15, section settings)*
 - A hidden field's refs still count as usage in the refs index (its value
-  is kept, so the edge is real; whether usage should hide with it is open).
-- The css refusal list grew past the spec's verbatim six in a security
-  review of the wrapper: the regexes run on the escape-decoded snippet too
-  (`\75 rl(` cannot spell `url(`) and unbalanced braces are refused as
-  `Braces must balance.` (a `}` cannot step out of the `[data-smd-node]`
-  block). Recorded here and in DESIGN.md.
-- The starters' `.prose figure img` is now inline-block without
-  `width: 100%`, so a richtext image narrower than the column follows the
-  section's `align` step; a photo wider than the column still fills it.
-- The Globals page has no tab row: Content's groups, then a `Settings`
-  label and the Settings groups, stacked. A tab row there would match the
-  canvas card.
-- `InspectorFields` filters hidden entries per render; a section with
-  many conditions re-evaluates every keystroke. Fine at the sizes seen.
+  is kept, so the edge is real; whether usage should hide with it is open). *(2026-09-15, section settings)*
 
-## Follow-ups (logged 2026-09-14, collections draft/publish spec)
-
-- Publish integrity for an entry's own refs: an entry can publish while
-  pointing at an unpublished entry; pages are gated, entries are not.
-- A create dialog (title and slug) before "+ New entry", if empty Untitled
-  drafts turn out to litter lists.
-- The page editor's publish banner lists fields as plain text; the forms'
-  lines focus the widget. Selecting the node from a `node.field` path is
-  the missing piece.
-- Discard on a published row from before versioning that nobody has
-  written since is refused as "nothing published" (its pointers are null);
-  the control never offers it there, so nothing shows — the store could
-  answer it as a no-op instead.
-
-## Follow-ups (logged 2026-09-25, settings + members spec)
-
-- Existing databases (every install so far is ours; DESIGN.md OQ #2):
-  `alter table "editors" rename to "members";`
-  `alter table "members" add column "email" text;`
-  `alter table "space_caps" rename to "spaces";`
-  `alter table "spaces" alter column "row_cap" drop not null;`
-  `alter table "spaces" add column "console_url" text;`
-  `update "members" set "role" = 'admin' where "role" = 'owner';`
-  then re-run the regenerated migration's `smoodly_space_row_cap` function
-  and the `smoodly_read` policy on `spaces` (both `create or replace` /
-  `drop … if exists`, so the whole migration file can be re-applied).
-  Policies and triggers follow a table rename. Rows written before the
-  column show their user id on the Members page until re-inserted (the
-  demo-editor upsert fills it on the next seed).
-- Members management shipped 2026-09-25 (spec
-  `docs/superpowers/specs/2026-09-25-members-management-design.md`); out
-  of its scope: a pending-invite status and "resend invite" on a row
-  (needs the Auth user's `last_sign_in_at`, which the cloud projection
-  does not carry); removing the Auth account together with the member
-  row; invites from the cloud's `/admin` (they are smoodly.io's); a
-  project whose Auth is OAuth-only (the invite mail asks for a password);
-  redirects on a published rename (the confirm says "there are none
-  yet").
-- 2026-09-26: the Role column is a badge and the row menu has Change role
-  (confirm, to the other role) and Remove member; `ActionMenu` popovers are
-  fixed-positioned from the button — the cell's overflow clipped them.
-- The members list is not paged (tens of rows, not thousands).
-- The Roles and API Keys pages were dropped 2026-09-25 (DESIGN.md §2
-  "Settings"): Members is the only Settings page, the invite modal
-  describes the two roles, and `/settings/roles` and `/settings/api-keys`
-  are Not found.
-
-## Follow-ups (logged 2026-09-13, history spec)
-
-- Existing databases (every install so far is ours; DESIGN.md OQ #2):
-  `alter table "page_locales" add column "updated_by" text;`
-  `alter table "entry_locales" add column "updated_by" text;`
-  `alter table "page_versions" rename column "created_at" to "saved_at";`
-  `alter table "page_versions" drop column "created_by";`
-  `alter table "entry_versions" rename column "created_at" to "saved_at";`
-  `alter table "entry_versions" drop column "created_by";`
-  The indexes follow the rename. Autosave rows from before read as
-  extra history rows until the page is published again; harmless.
-  Since 2026-09-14 every collection is versioned and `collectionSQL` emits one
-  view shape: re-apply `collectionSQL(collection)` for each collection on an
-  existing install (`supabase db reset` locally), or a published row from
-  before versioning reads through the view's live-row fallback until its
-  first write gives it a snapshot — either way nothing goes dark.
-- Client-side undo in the editor (a stack of tree snapshots); the store
-  is no longer an undo stack by design.
-- The author per version row and in the lists; named versions.
-- History on the canvas card's menu and in the list row menus.
-- A diff between two versions.
-- Ops are built per call (`createAdminOps` inside the handler) so the
-  session rides in as `actor`; if that ever measures, memoize the
-  actor-free parts.
-
-## Follow-ups (logged 2026-09-13, publish flow spec)
-
-- Unpublishing a page does not cascade: a published child keeps serving
-  under an unpublished parent's path. Decide whether it should.
-- Versioning collections by default — decided 2026-09-14: every
-  collection, no flag, the forms autosave (spec
-  `docs/superpowers/specs/2026-09-14-collections-draft-publish-design.md`).
-- A draft-mode banner on the site, or an "exit preview" action in the
-  admin: the same browser shows drafts of unpublished items after an
-  Unpublish, which reads as "it published my draft".
-- The lists' row menus (Pages, Entries) do not offer Unpublish; the
-  document's own control does.
-
-## Follow-ups (logged 2026-09-13, shared inline editing spec)
+#### Globals
 
 - Layout items in the outline: a "From the layout" group the bridge could
-  populate from the `shared:` ids it reports; canvas-only today.
-- The page autosave loses an edit made within the debounce window before
-  navigating away (`useDraftAutosave` only clears timers on unmount). The
-  shared controller flushes on unmount; the page's should too.
-- A validation failure on a shared save retries with backoff like a
-  transport failure; the field error shows on the widget meanwhile. A
-  distinct "fix the field" state would stop the retries.
+  populate from the `shared:` ids it reports; canvas-only today. *(2026-09-13, shared inline editing)*
 - The shared card's usage line lists page ids; titles need a pages
-  lookup the editor does not hold (the usage rows carry only ids).
+  lookup the editor does not hold (the usage rows carry only ids). *(2026-09-13, shared inline editing)*
 - A "save and publish" action for sites that want no draft stage on a
   shared item (every item is versioned since 2026-09-13; the flag is
-  gone).
-
-## Follow-ups (logged 2026-09-11, queries spec)
-
-- `where` on localized fields (a join on the locale row), ranges and
-  negation; any-of over an array-valued field (any-of compares the text
-  form of the field, so it covers selects, refs and numbers; on a
-  checkboxes, refList or list field `site.getEntries` refuses it rather
-  than match nothing — both adapters agree on the text form, so a
-  one-element array never matches its element).
-- `where` filters a versioned collection's LIVE row, not its published
-  snapshot: an entry whose published version had `kind: "x"` and whose
-  draft changed it to `"y"` drops out of `where: { kind: "x" }` before
-  the change is published. The published gate is per locale row, the
-  filter is on the node's shared fields. Fix by filtering the snapshot
-  (a join on the version row) or by documenting that a versioned
-  collection's shared fields are live for filtering.
-- A GIN index on `entries.fields` when a customer's collection is large
-  enough to need it; additive, no migration.
-- OQ 26: whether page units should carry `pages:tree` too, replacing
-  the neighbour list.
-- Scripts and the seed write through the stores and expire nothing; a
-  `revalidate` hook for out-of-band writers.
-- `getEntriesTree` has no `q` counterpart yet; add one when a site
-  needs a nested collection nav.
-- `getShared(["header", "footer", "contact"], { locale })` returning a
-  typed tuple, as sugar over the `Promise.all` the layout writes today.
-  Keep one cache unit per item under its own tag — a single unit tagged
-  with all three would expire the header whenever the footer is edited.
-- `getEntry` by id goes through `site.getEntry`, which lists the whole
-  collection to find one row; a primary-key read first would be cheaper
-  on the uncached path (draft mode, first miss).
-- The read API returns the site layer's shapes unprojected: `getEntries`
-  gives `{ entry: EntryRecord, path }` (the locales map, sort, parentId,
-  collection and timestamps ride along under `entry`), `getPage` gives
-  the renderer's `SitePage` (`record`, `tree`). Project in `queries.ts`,
-  at the public boundary, to `{ id, path, fields, updatedAt }` per entry
-  and a page without renderer internals; the tree item is already lean.
-  Do it before the Astro glue (OQ 29) wraps the same reads and before
-  a second site depends on the shape — it is a breaking change to `q`.
-
-## Follow-ups (logged 2026-09-10, page fields and SEO spec)
-
-- SEO for entry pages: entries have no `meta`; a `titleField`-based
-  title and a description field are the next step.
-- A `styles` block on pages, when a case needs presentation separate
-  from content.
-- Refs in page fields, once the refs index walks them.
-- A canonical URL field and a search-result preview snippet in the
-  SEO & Social tab.
-- Configurable SEO set (`meta: { seo: { twitter: true } }`) if the four
-  values prove too few.
-- Link fields are raw: an image in a page field reaches a nav link as
-  `{ asset, alt }`, not a URL. Resolve on demand if a nav ever wants one.
-- The social image URL goes through the default `next` loader at 1200px;
-  the cloud's transform loader (OQ 28) should serve a real 1200×630.
-- Page-field labels derive from the key (`showInNavigation` → "Show In
-  Navigation"), as every field's do; a `.label()` builder option would
-  read better for long keys.
+  gone). *(2026-09-13, shared inline editing)*
+- The picker offers a shared item only in zones whose allow list includes
+  its section (`allowedShared` in `admin/tree-ops.ts`), so a shared item's
+  section is always also offered as an ordinary section. A "placeable
+  only" mode (a shared item whose section no zone lists) would let the
+  starter keep the quote shared-only. *(2026-09-07, starter)*
+- `f.shared(() => item)` — a ref field on a section that renders a shared
+  item inside the section's own markup (spec 2026-09-07 decision 3). *(2026-09-07, shared content)*
+- Instance mode: a shared *type* with many editor-created items; today
+  the answer is a collection plus a section with `f.ref` (decision 1). *(2026-09-07, shared content)*
+- Zone-shaped shared items (`smoodly.shared({ zone })`) (decision 2). *(2026-09-07, shared content)*
+- Standalone live preview on a visual item's admin page — would need a
+  preview route in the glue. Less pressing since 2026-09-13: every shared
+  render is edited in the page canvas, and the Globals page is the form. *(2026-09-07, shared content)*
+- Built-in meta on shared items and on placements (anchor per placement
+  is the likely shape). *(2026-09-07, shared content)*
+- A placement of an object item or an unregistered item gates the page's
+  publish (the refs edge is emitted without a registry lookup) yet never
+  renders; only a hand-edited tree can produce one. *(2026-09-07, shared content)*
 
-## Follow-ups (logged 2026-09-10, inline editing spec)
+#### Drag and drop
 
-- Richtext instant write from the inspector: the pure `RichText` render
-  swapped into the container while the widget is typed in.
-- Item-level chrome in the canvas ("Key points · 3 of 4" on hover, add,
-  remove, reorder in place, later drag within a list): the item marks are
-  the hook.
-- Placeholder and validation marks on the page (the sample-sourced
-  placeholder treatment, "required, empty" outlines) wait for the tree's
-  placeholder marking.
-- A coverage hint for developers: the admin knows a section's text fields
-  and could list the ones without a mark.
-- AI verbs ("rewrite this heading") need a field under the cursor, which
-  a mark is.
-- A cross-origin admin needs the bridge-side editing variant (spec §3).
-- Direct-child spacing rules on a richtext container (Tailwind `space-y-*`,
-  `.prose > p`) do not reach the canvas editor's blocks during a session;
-  flex and grid gaps are copied (onto the ProseMirror root since the
-  walk, 69aecc6). Documented, not fixed.
-- The text session's Enter commits: a plain text field has no line breaks.
-  A multi-line text control would be its own descriptor.
-- The floating toolbar flips below the caret only near the top of the
-  DOCUMENT (where the page box clips it); it scrolls with the content, so
-  a caret at the top of the scrolled canvas has its toolbar out of view
-  until the editor scrolls. A flip keyed to the scroller's viewport would
-  fix it.
-- No starter section gives the canvas a richtext with blocks: the Image
-  and text body is marks-only, and the article body (the `article`
-  toolset) is edited in the entry form. The walk borrowed the article
-  toolset for the block steps; a starter section with a long-form body
-  would let the canvas show them.
-- The caret placed right after an existing `/` reopens the slash menu
-  (TipTap's suggestion re-triggers on the character before the caret).
-  Harmless; a trigger keyed to typing only would be stricter.
-- Walk findings, all fixed the same day (69aecc6): the copied flex gap
-  landed on the editor root instead of the ProseMirror element that holds
-  the blocks, so paragraphs lost their spacing; a click on a marked image
-  revealed nothing because the reveal forced the Content tab while the
-  media projection puts the image on Media; Escape after a card's button
-  had taken the focus did not end the session.
+- Cross-zone drag in the outline: each zone is its own sortable list;
+  moving a block between zones is still insert-and-remove. *(2026-09-09)*
+- Nested manual collections show no grip (`canReorder` requires
+  `depth === 1`) until the entry tree UI exists — a flat index is not a
+  sibling index there. *(2026-09-09)*
+- Canvas drag: the overlay should reuse `ui/sortable.ts` across the
+  iframe boundary; `useSortable` measures container children, which the
+  overlay's ghost rows can be. *(2026-09-09)*
+- A dragged subtree stays collapsed after the drop (`onDragStart`
+  collapses it through `toggle` and nothing re-expands it). *(2026-09-09)*
 
-## Follow-ups (logged 2026-09-25, neutral restyle + confirm dialog)
+#### Admin UI
 
+- The Globals page has no tab row: Content's groups, then a `Settings`
+  label and the Settings groups, stacked. A tab row there would match the
+  canvas card. *(2026-09-15, section settings)*
 - The warm look is the comparison block now (`WARM_*` + `WARM_EXTRA` in
   `src/admin/ui/theme.tsx`, `localStorage.smoodly-look = "warm"`); the
   technical block is deleted (tag `look-technical` keeps it). Remove the
-  warm block once the neutral look is judged, the same way.
-- Kept from the app on purpose, against the handoff: the 14px base and
-  18px titles (handoff 13/20/22), the 64px top bar (56), the 360px
-  inspector (296), the Lucide rail icons, the `--table-top` air above the
-  list, the 12px block-tag padding. Inputs stay white on focus (the
-  handoff's focused textarea takes the tile grey) and the locked outline
-  row is a white row like the rest (the handoff's is the ground, invisible
-  on a tile of the same grey).
-- The handoff's status chips collapse Draft into amber; the app keeps its
-  three states (Published green, Unpublished changes amber, Draft grey on
-  `--control-hover`).
-- The Pages list's prompts are dialogs on the same card since the same
-  day (`shell/PageDialogs.tsx` over `ui/Dialog.tsx`): New page / New
-  path / New subpage / New subpath (title, slug following the title
-  through `slugify` in `paths.ts`, page type when more than
-  one open template), Add page here (page type; skipped with one), Rename
-  (title and slug; the home page's title alone). Still native: the
-  `window.alert`s on a refused list op outside a dialog (`run` in
-  PagesList, EntriesList's add/remove) — a notice banner is the follow-up.
-- `slugify` (`paths.ts`, exported) is the one slugifier; the slug-box
-  helpers in `admin/forms/slug-field.ts` (`followsTitle`, `tidySlug`,
-  `slugHint`, `withFollowingSlug`) serve the page dialogs, page Settings,
-  the `f.slug` widget and the entry form (spec 2026-09-28 ASCII slugs).
-- The dialog's fields take the tile tone on the white card
-  (`.sm-dialog__form .sm-input`), the reverse of fields on tiles.
-- The confirm's copy lives at each call site (`title` / `body` /
-  `confirmLabel` / `subject`); the shared ones are `DISCARD_CONFIRM`
-  (`ui/confirm.ts`), `LEAVE_CONFIRM` (router) and `LIVE_URL_CONFIRM`
-  (live-url). A subject path is shown where the screen already holds it;
-  the entries list and the media screen show the name only.
-- `confirm()` without a mounted `<ConfirmHost/>` falls back to
-  `window.confirm` so nothing can hang; the host is mounted once in
-  `AdminApp` beside the shell. The tab-close guard stays native
-  (`beforeunload` cannot await).
-- The handoff's `Styles` tab in the inspector is not built: it exists
-  only where a section registers styles, which is the existing `tabsFor`.
-- The wordmark still takes `--logo-color` (accent); the rail's app icon
-  takes `--logo-outer` / `--logo-inner` and is hidden in the warm look.
-- Polish round the same evening (2026-09-25): list row rules are a
-  `.sm-row::after` pseudo-element, since a border follows the rounded
-  hover corners; the admin remembers ONE locale across lists and forms
-  (`shell/locale-memory.ts`, key `smoodly-locale`; the lists' two
-  session-only keys are gone, `localeFromUrl` falls back to it and
-  remembers what it resolved); the section insert picker opens upward
-  when the room below is short and scrolls inside the room it has
-  (`placePicker` in `editor/InsertPicker.tsx`, measured in a layout
-  effect, no window-resize listener); the prefixed slug input keeps a
-  22px line box so its caret reads as one; `.sm-input--mono` is scoped
-  under `.sm-admin` — the `input{font-family:inherit}` reset had beaten
-  it, so every mono input (slugs, IDs) had rendered in the sans font;
-  richtext block-node cards take `--rtcard-bg` / `--rtcard-border` (tile
-  grey with the soft accent border in the neutral look, white and
-  hairlined in the warm). The custom section's row cards and the list
-  field's rows keep the white-on-tile look — only the richtext cards sat
-  on a white field.
-- Richtext cards, second pass (2026-09-25): the default card border is
-  the hairline (`--rtcard-border:var(--line)`), the accent outline marks
-  the selected card alone, and the widget's focus ring steps back while a
-  block node is selected (`:focus:not(:has(.ProseMirror-selectednode))`).
-  The image card's head carries Edit / Replace / Remove as
-  `.sm-field__action` text buttons, the same three the media field now
-  shows in its field head (`MediaWidget` renders its own `Field`;
-  `FieldWidget` returns it directly, `SeoSettings` passes the label). Edit
-  on a richtext image is the crop editor over the node's `image` attr
-  (an `ImageValue`, so crop/hotspot/aspect store there). The bound
-  `smoodly/richtext` renderer applies it through `<SmoodlyImage>`; the
-  root `RichText`'s plain figure does NOT (it may not import the image
-  layer, `richtext-entry.test.ts`), so a framework-neutral renderer
-  (the Astro adapter, OQ 29) must frame it with `frameFor` itself. The
-  card shows the cropped frame (`forms/ImagePreview.tsx`, shared with the
-  media field), the filename and the caption as text; alt and caption are
-  edited in the crop modal (`CropEditor` takes `caption`), so the card
-  holds no inputs. Fields on a modal panel take the tile tone.
-- A refused publish's per-field errors clear as the fields are fixed
-  (2026-09-25): the entry and global forms revalidate on every change with
-  the op's own rules (`validateFields` / `validateNode` over
-  `elementSchemas(registry.elements)`) and keep only what still fails
-  (`stillFailing` in `validate.ts`); the notice's list shrinks and the
-  notice goes when it empties. Typing never adds an error — only a
-  publish does. The page editor's banner list and the canvas global
-  inspector (save errors) are unchanged.
-
-## Follow-ups (logged 2026-09-25, date pickers)
-
-- `f.date()` and `f.datetime()` share one in-house calendar
-  (`admin/forms/DatePicker.tsx` over the pure `date-picker.ts`); the
-  browsers' own pickers were rejected (they differ and take no tokens).
-  Weeks start on Monday and month names come from the browser's language
-  — `weekStart` and a month-name locale as config keys are follow-ups.
-- `defineConfig({ timeZone })` is validated by constructing an
-  `Intl.DateTimeFormat`, so an alias the runtime's database still knows
-  (`Europe/Kiev`) passes and an offset never does. Admin-owned site
-  settings (a per-space `settings` table with a Site page) were designed
-  and dropped for the zone; the design is in the spec's history should a
-  setting turn up that editors must change without a deploy.
-- Not built: a time-only field, a date range, `.min` / `.max` on dates.
-- Publish refuses a malformed date or datetime now (`validate.ts`); a
-  row saved before this with a bad string shows the message on its next
-  publish, as designed.
-
-## Follow-ups (logged 2026-09-08, block nodes spec)
-
-- Image sizing and float in a body (full width, wide, small, left/right):
-  a later additive `styles` on the image node; the site's CSS answers it.
-- Inline elements: `inline: true` on the registration; cursor, marks and
-  selection around an inline atom are a separate node-view effort.
-- The column context (`contexts: ["column"]`) waits for Phase 3 rows;
-  accepted and unused today.
-- A page or entry picker for `f.link()` inside an element — the link
-  picker spec.
-- Element copy between fields: a pasted element the target toolset
-  forbids is dropped silently; a notice would be kinder.
-- Placeholder marking for sample-populated element fields waits for the
-  tree's own placeholder marking.
-- An element's styles are not merged with the config's `styles.elements`
-  standard set (sections get `resolvedStyles`); add the merge when the
-  set is non-empty somewhere.
-- Element styles are not validated on publish (sections' aren't either).
-- `hasContent` treats an unresolved image node as content, so a body
-  whose only image was deleted from the library still passes "required".
-- Publishing a saved version of a versioned entry: the entry form's
-  status control returns early when the target equals the current status,
-  so a new version of a published entry goes live only by toggling Draft
-  then Published (seen in the block-nodes walk; pre-existing). A "Publish
-  changes" action when the draft version is ahead of the published one.
-- The insert position is recorded when the "+" menu opens and handed to
-  `insertContentAt`, because after the menu or the media picker takes
-  focus the refocused contenteditable placed its DOM caret at the first
-  card and the editor's selection followed it (the walk's first inserts
-  landed at the document top). The explicit position closes the hole;
-  the DOM-caret drift itself was not chased to its root.
-- The "+" menu and the slash menu share `RichtextInsertMenu` but keep
-  separate active-row state and key handling; one keyboard model would
-  be smaller.
-
-## Follow-ups (logged 2026-09-08, tooling session)
-
-- **CI live job red since e09a632, 0.0.11 fresh install broken — fixed
-  2026-09-08, released as 0.0.12: `smoodly/image/config` is the entry
-  `next.config.ts` imports; `test/image-config-entry.test.ts` loads the
-  built file under bare node.** The
-  scaffolded `next.config.ts` imports `smoodlyImages` from `smoodly/image`,
-  whose index re-exports `SmoodlyImage.tsx` and its `import Image from
-  "next/image"`. Next loads the config in plain Node ESM and next@16.3.4
-  has no `exports` map, so the extensionless specifier fails
-  (`ERR_MODULE_NOT_FOUND ... Did you mean "next/image.js"?`) before
-  `next build` starts; the bundler resolves it, which is why nothing else
-  caught it. Reproduce from `examples/site`:
-  `node --input-type=module -e "await import('smoodly/image')"`. Fix: a
-  component-free entry for the config helper (the template and the
-  example comment then import from it), a plain-Node import test, then
-  release 0.0.12. Appending `.js` alone is weaker: Node hands back the
-  CommonJS `module.exports` object as the default, not the component.
-
-## Follow-ups (logged 2026-09-08, client routing spec)
-
+  warm block once the neutral look is judged, the same way. *(2026-09-25, neutral restyle + confirm dialog)*
 - Keep the previous view painted until the next one has data: today a
   navigation switches instantly and the new view shows its own loading
   state; a transition that holds the old view, or prefetches the next
-  view's ops call on hover, is the next step.
-- Browser Back with unsaved changes is not guarded: `popstate` cannot be
-  cancelled cleanly, so a dirty form only asks on a click and on reload.
-  Re-pushing the current URL and asking is possible if editors lose work.
-- Every revalidating op (publish, delete, a save of published content)
-  answers with a fresh RSC render of the admin route — the layout's
-  styles included, ~30 KB — because `updateTag` runs inside the server
-  action and Next re-renders the tree it was posted to. Harmless now
-  that the shell lives in the layout (the empty page subtree is what
-  remounts), but it is the price of server actions as the transport.
-- The bundle split: the editor bridge out of the admin tree and the
-  editor lazy-loaded, so site pages stop loading the admin chunk (the
-  richtext widget register entry below measures it). Its own spec.
-- `SharedForm` and `EntryForm` now share the locale helpers; the rest
-  of the fork (`applyResult`, `InfoRow`, the ref-options effect) is still
-  the 2026-09-07 entry below.
-
-## Follow-ups (logged 2026-09-08, media library spec)
-
-- Video transcoding and adaptive streaming: a Mux or Cloudflare Stream
-  loader behind the `media.loader` seam, if a site ever needs more than
-  an MP4 over Storage's CDN.
-- Sweeping abandoned `pending` asset rows (an upload that began and
-  never called `finishUpload`); a periodic op or a cleanup on `list`.
-- A private bucket with signed reads, for sites that must not expose
-  draft-only media by URL before publish.
-- Pre-generated image variants at upload time, for hosts without sharp.
-- Transform loaders beyond the Next default: Supabase Image
-  Transformations, imgix, Cloudflare Images (DESIGN.md OQ 28).
-- Delivery caching (checked 2026-09-08): Supabase Storage's basic CDN
-  fronts every public-bucket object on a hosted project with no code on
-  our side, and the Smart CDN (Pro plan, automatic) only adds
-  invalidation on overwrite, which never happens — objects are
-  immutable, no upsert on either path, Replace picks a new id. So both
-  upload paths now set a year-long `cache-control`
-  (`MEDIA_CACHE_SECONDS`): the `cacheControl` option on the server-side
-  upload, the header on the browser's signed PUT (without it a signed
-  upload lands as `no-cache`; Storage's default is one hour). The live
-  suite reads the header back from the local stack. Not yet verified
-  against a hosted project's CDN edge; check `cf-cache-status` and
-  `cache-control` on a real upload there once. Remaining: in v1 the
-  site's `<SmoodlyImage>` goes through `next/image`, so the visitor hits
-  the app server's image cache and only its origin fetch touches the
-  CDN; video, files and SVGs hit the CDN directly. A Supabase Image
-  Transformations loader (`/storage/v1/render/image/public/...`, Pro
-  only, must stay optional) would move resizing to the CDN — the loader
-  bullet above.
-- The asset refs inherit the index's scope: it reflects the latest saved
-  version of a source, so a published version still using an asset the
-  draft dropped is not protected from delete — the same gap entry refs
-  have today.
-- Deviations from the spec, decided while building: the starter's Hero
-  declares `aspect: "4:5"` (the design's own ratio), not `16:9`; `assets.list`
-  pages by a `created_at` cursor, 60 per page; the loader seam is the
-  `loader` prop of `<SmoodlyImage>` and `imageUrl`'s third argument — a
-  config-level `media.loader` waits for a second loader to exist.
-- Image dimensions server-side cover JPEG and PNG (`imageDimensions`); a
-  WebP or AVIF seeded through `AssetStore.create` lands without a size
-  and resolves to nothing until the row is edited. Browser uploads
-  measure every type.
-- A section's `styles` are walked for media, the config's standard style
-  set is not (it holds selects). A standard-set image would need the
-  walk to read `resolvedStyles`.
-- `<SmoodlyImage>` sizes the image by the crop factor, so `sizes` picks a
-  candidate for the box, not for the framed image; a CDN loader with
-  `handlesCrop` removes the overfetch.
-- `smoodlyImages()` returns the whole `images` config, not just the
-  patterns (decided 2026-09-08 in the browser walk): Next 16's optimizer
-  answers 400 for an upstream that resolves to a private IP unless
-  `images.dangerouslyAllowLocalIP` is set, and the local stack is
-  `127.0.0.1`. The helper sets the flag only for `localhost`, loopback
-  and RFC 1918 hosts, so a hosted project stays strict; a Docker alias
-  that resolves privately needs the flag by hand. The spec's "a helper
-  on `smoodly/next`" lives on `smoodly/image` instead, beside the
-  components it serves.
-- Build deviations from the plan (2026-09-08, sessions A–C):
-  `test/admin-pages-tree.test.ts` builds its `AdminRegistry` literal by
-  hand and carries `media: { maxSize: 1, accept: [] }`; `MediaPicker`'s
-  `filters` is `readonly KindFilter[]` and the `Segmented` calls pin
-  `<KindFilter>`; `MediaScreen` seeds its metadata state from
-  `initialSelected` because the plan's effect never runs under
-  `renderToStaticMarkup`; `forms/measure.ts` is browser-only and
-  untested by design (`putSigned` is unit-tested over a stubbed fetch
-  and exercised live since 2026-09-08); the installer's templates are
-  generated (gitignored), so "templates rebuilt" is a build step, not a
-  diff.
-
-## Follow-ups (logged 2026-09-09, admin tweaks)
-
-The 2026-09-09 tweak round: view titles sans 18px, the entry and
-Globals forms in one 680px column with a globe-off mark on fields that
-are not `.localized()` (the "Shared across languages" / "In <locale>"
-groups are gone), the image field on a 300px canvas, every locale
-switch a segmented pill (a dropdown past three locales), Media before
-Globals (née Shared) on the rail, richtext paragraph and card spacing,
-element cards collapsed unless blank, and the "+" menu floating under
-the toolbar instead of pushing the content.
-
+  view's ops call on hover, is the next step. *(2026-09-08, client routing)*
 - `LocaleSwitcher` in pill form has no "+ add" affordance: an absent
   locale reads subtle and switching to it lands on the form's or the
   editor's "doesn't exist yet · Add" pane, which adds. The dropdown form
   (four locales and up) still adds straight from its "Add locale" group,
   so the two forms differ by one click; a "+" inside the pill would close
-  that gap.
+  that gap. *(2026-09-09, admin tweaks)*
 - The image field's canvas height (300px) lives twice: `CANVAS_H` in
   `MediaWidget.tsx` sizes the frame, `.sm-media__canvas` /
-  `.sm-media__thumb` cap it in the stylesheet. One token would do.
+  `.sm-media__thumb` cap it in the stylesheet. One token would do. *(2026-09-09, admin tweaks)*
 - `.sm-form>*{max-width:680px}` caps the banner too; if a wide
-  field type ever appears (a table), give it an opt-out class.
+  field type ever appears (a table), give it an opt-out class. *(2026-09-09, admin tweaks)*
 - An element card decides "open" from its fields alone (blank = open);
   an element whose fields are all optional and empty by design stays
-  open on every load. The richtext image card is never collapsible.
+  open on every load. The richtext image card is never collapsible. *(2026-09-09, admin tweaks)*
 - The "+" menu anchors to the toolbar's right end (`right:0` in
   `.sm-richtext__head`), which is under the "+" only while the toolbar
   fits on one line; in the 320px inspector the toolbar wraps and the
-  menu sits below the wrapped row's end.
-- The technical look's `TECHNICAL_SHAPE` tokens were not touched: its
-  title stays sans at `--text-xl`, its label has no mark styling beyond
-  the shared `.sm-label__mark` rule.
-- Browser-pane sign-in (2026-09-09): the magic-link hash on
-  `/admin/...` was NOT consumed by the admin's Supabase client in the
-  pane (the login form stayed); fetching `/auth/v1/user` with the
-  access token and writing the session object to `localStorage`
-  under `smoodly-auth`, then reloading, signed in. The pane was hidden
-  during the walk, so scrolling went through `.sm-form.scrollTop` and
-  clicks through `element.click()` in `javascript_tool`.
-
-## Follow-ups (logged 2026-09-08, richtext widget spec)
-
-- ~~Drag-to-resize the inspector~~ — DONE 2026-09-10 (spec
-  `docs/superpowers/specs/2026-09-10-inspector-resize-design.md`):
-  `ui/ResizeHandle.tsx` writes `--inspector-w` inline on the wrapper,
-  clamped to 260px..the row less the handle and a 440px canvas (`ui/resize.ts`,
-  half the row until 2026-09-26), remembered under
-  `smoodly-inspector-w` and applied by the theme's boot script. Walk
-  finding: the desktop pane hides its tab on every `navigate`, and a
-  hidden tab lays out at zero width, so the handle treats a zero
-  measurement as unknown and re-measures on focus. Real drags through
-  the pane's `left_click_drag` worked (synthetic `PointerEvent`s cannot
-  satisfy `setPointerCapture`); coordinates are the screenshot frame,
-  0.625 × CSS px at the pane's 1280 width.
-- A page and entry picker in the link popover: a link inside a richtext
-  document is a reference the refs index, the resolver and the localizer
-  cannot see (they address refs by top-level key). Its own spec.
-- Escape inside any inspector control bubbles to the editor's window
-  handler and clears the block selection — the link popover stops it, a
-  textarea or the TipTap content does not. A `keydown` guard on
-  `.sm-inspector` would fix it for every control.
-- Every richtext descriptor now carries its toolset, so the serialized
-  registry grew by a few bytes per field; if the AI-facing schema wants
-  the vocabulary once instead of per field, dedupe there.
+  menu sits below the wrapped row's end. *(2026-09-09, admin tweaks)*
 - The entry form's column is narrower than the inspector, so the default
-  toolbar wraps to two rows there; the inspector shows it on one.
+  toolbar wraps to two rows there; the inspector shows it on one. *(2026-09-08, richtext widget)*
+- A list row's collapsed summary shows the item's first string subfield —
+  the header nav rows read `/`, `/posts` — where the label would identify
+  the row; `itemSummary` could prefer a `label`/`title`/`heading` key
+  (walk, 2026-09-07). *(2026-09-07, starter)*
+- Page settings prints `paths[locale]` under each slug field — the
+  locale-relative CMS path, not `urls[locale]`, the site URL the canvas
+  and "View live" actually open. On a translated site the Finnish hint
+  reads `/yritys/tietoa-meista` while the page lives at
+  `/fi/yritys/tietoa-meista`. Both maps are already in `EditorView`;
+  which one belongs under the field is a UI decision, not a missing
+  value. *(2026-09-06)*
+- The row menu in `PagesList.tsx` does not close on Escape — only a click
+  on the backdrop closes it. *(2026-09-06)*
+- `PageSettings` re-seeds its inputs from `record` on every rename (and
+  every publish), so keystrokes typed while a rename is in flight can be
+  dropped. The blur- and Enter-driven commits themselves are unaffected. *(2026-09-06)*
+- A childless folder row is inert on click (a mount opens its collection,
+  a page opens the editor, a folder with children expands); "Add page
+  here" lives in the row menu only. *(2026-09-06)*
+- The tree rows nest interactive buttons — the chevron and the `···`
+  menu — inside a `role="button"` row. It works, because both stop the
+  click and the keydown, but it is an accessibility smell a real treegrid
+  would not have. *(2026-09-06)*
+- The Pages list offers "Add <locale>" on a dimmed row whose parent lacks
+  that locale, and learns the refusal only after the round trip.
+  `pagesTreeRows` already carries every node's locales, so the parent's
+  presence could disable the item with its reason up front, exactly as
+  the editor's switcher does with `parentLocales`. `EntriesList` has the
+  same gap (and `entryRows` would have to carry the locales again — the
+  dead field was deleted rather than left unused); it is unreachable
+  today, since nothing in the admin creates a child entry. *(2026-09-06)*
+- Design system pass (DESIGN.md §2, "The admin's visual system"): the shell,
+  lists, entry form, login and editor were restyled onto `admin/ui/theme.tsx`.
+  Deferred deliberately, because each is a feature rather than a restyle: the
+  list search field and status filter, the locale select in the shell's top bar
+  (the editor has one; the lists always read the default locale), the article
+  sidebar's taxonomy/SEO/publish-date sections, and the rich-text toolbar. The
+  pages list's tree shape (chevrons, depth indent) and its row `···` menu
+  shipped 2026-09-06, without the drag handle. The tokens for all of them are
+  already in place. *(2026-09-05)*
+- `lucide-react` is now a runtime dependency, for the toggle's two icons. The
+  rest of the UI still uses the design system's unicode glyphs (↑ ↓ ⧉ × ··· ▾
+  ← ⋮⋮); swapping them for Lucide is the next step whenever it is wanted. *(2026-09-05)*
+
+#### Addresses and the Pages tree
+
+- The rename/move confirm's code-address line names the addresses in
+  the selected locale only, though a move re-paths every locale; the
+  Pages list's conflict notice is one ellipsized line (the whole text
+  on hover), and an editor's flagged page cannot be moved from the
+  notice itself. *(2026-09-29, nested collection paths)*
+- An index page removed from code leaves the collection's record with
+  its template (spec amendment 3): the record keeps rendering as that
+  page type's stale name until an editor or a later pass clears it. *(2026-09-29, nested collection paths)*
+
+#### Collections
+
+- Nested entries have no admin UI beyond `entries.move`: nothing creates
+  a child entry or shows the entry tree, and the entry form's slug prefix
+  is the collection's mount base only, not the parent chain. *(2026-09-06)*
+- A published entry under a draft parent is dropped from `getEntriesTree`
+  (the parent is not in the list to hang it from) but returned flat by
+  `getEntries`. Untested either way. *(2026-09-05)*
+
+#### Queries (`q`)
+
+- `presence()` serves the presence channel only; a future read gateway (DESIGN.md OQ 31) is not built on it — no key but a write key reads content. *(2026-09-26, concurrency; 2026-09-30 §8)*
+- `where` ranges and negation. *(2026-09-11, queries)*
+- `EntryItem.updatedAt`, and `order: updatedAt`, read the LIVE locale row, so a draft autosave bumps the public timestamp and can reorder a public list; read the published version's `saved_at` for published reads. *(2026-09-30, content API contract final review)*
+- The bare-slug `getEntry` fallback re-reads the whole collection and resolves every entry's references and media before matching one slug; match on `record` first, then resolve only the hit (or query by slug). *(2026-09-30, content API contract final review)*
+- `SmoodlySite.resolve` (and `load`) still return the full `EntryRecord` (every locale, `updatedBy`) on the object the developer holds; the types are unexported and the spec calls it internal — mark it `@internal` or move both off the public interface. *(2026-09-30, content API contract final review)*
+- A nested `.resolve({ a: { b: true } })` types only the top level (`Rebase<V, keyof P>`) while the runtime resolves deeper; type the nesting. *(2026-09-30, content API contract final review)*
+- Any-of over an array-valued field: any-of compares the text form of
+  the field, so it covers selects, refs and numbers; on a checkboxes,
+  refList or list field `site.getEntries` refuses it rather than match
+  nothing — both adapters agree on the text form, so a one-element array
+  never matches its element. *(2026-09-11, queries)*
+- `getEntriesTree` has no `q` counterpart yet; add one when a site
+  needs a nested collection nav. *(2026-09-11, queries)*
+- `getShared(["header", "footer", "contact"], { locale })` returning a
+  typed tuple, as sugar over the `Promise.all` the layout writes today.
+  Keep one cache unit per item under its own tag — a single unit tagged
+  with all three would expire the header whenever the footer is edited. *(2026-09-11, queries)*
+- An explicit JSON `null` VALUE in a declared `order.by` field sorts
+  FIRST in Supabase (a jsonb null is the lowest jsonb value, not SQL
+  NULL, so `nullsFirst: false` does not reach it) and LAST in memory. A
+  MISSING key is SQL NULL and sorts last in both, and the admin only ever
+  produces that — a cleared number field emits `undefined`, which the
+  JSON body drops — so this needs a programmatic or external writer.
+  Mixed types in one field diverge for the same reason: Postgres orders
+  jsonb by type first (null < string < number), memory by `String(...)`. *(2026-09-05)*
+
+#### SEO and page fields
+
+- A `styles` block on pages, when a case needs presentation separate
+  from content. *(2026-09-10, page fields and SEO)*
+- Refs in page fields, once the refs index walks them. *(2026-09-10, page fields and SEO)*
+- A canonical URL field and a search-result preview snippet in the
+  SEO & Social tab. *(2026-09-10, page fields and SEO)*
+- Configurable SEO set (`meta: { seo: { twitter: true } }`) if the four
+  values prove too few. *(2026-09-10, page fields and SEO)*
+- Link fields are raw: an image in a page field reaches a nav link as
+  `{ asset, alt }`, not a URL. Resolve on demand if a nav ever wants one. *(2026-09-10, page fields and SEO)*
+- Page-field labels derive from the key (`showInNavigation` → "Show In
+  Navigation"), as every field's do; a `.label()` builder option would
+  read better for long keys. *(2026-09-10, page fields and SEO)*
 
-## Follow-ups (logged 2026-09-07, starter)
+#### Site rendering and starters
 
+- A separate canvas route would take the last Smoodly bytes off live
+  pages (the lazy stub that loads the bridge and the canvas boundary in
+  the editor frame), at the cost of the frame no longer loading the
+  page's real address: the site's layout would have to be reached from
+  a sibling route, and a developer's own route file or the escape hatch
+  would preview differently from live. Only if a site needs zero.
+  *(2026-09-29, pre-install fixes)*
+- A layout-only language switch, if a real site needs one: a
+  `q().getAlternates(path)` over the `paths` index plus a proxy header
+  carrying the request path. Not built until asked for — the starters
+  render the switch from the page (`components/PageFrame.tsx`,
+  `components/LocaleNav.tsx`). *(2026-09-15, locale alternates)*
 - A paired component (`smoodly.section`) accepts only its schema's props, so
   a layout cannot hand the footer the contact item or the header the locale
   links through the paired `Footer`/`Header`; the starter's layouts render
   `FooterView`/`HeaderView` directly with the extra prop. A supported way
   to pass layout-only props through a paired component (or a `children`
-  slot) would let the layouts use the registered component.
-- Page views and entry pages receive no `locale`; the starter's views get
-  it from the app's strings seam (`next-intl`'s `getLocale`, or a constant
-  in the single-language scaffold). Adding `locale` to `PageContext` and
-  `EntryPageProps` would remove that dependency and let sections that
-  format dates stay synchronous.
-- The image widget edits the URL only; `alt` is set by the seed and cannot
-  be changed in the admin.
+  slot) would let the layouts use the registered component. *(2026-09-07, starter)*
 - A per-locale collection path or fixed slug must name the default locale;
   the installer rewrites the starter's two lines to name exactly the
   chosen locales (`articlesSegments` in `scaffold.ts`), since a path
   claiming a locale the site lacks fails the index-page rule at config
   load. A "fall back to the first declared segment" rule in
-  `defineConfig` would make the patch unnecessary.
-- The picker offers a shared item only in zones whose allow list includes
-  its section (`allowedShared` in `admin/tree-ops.ts`), so a shared item's
-  section is always also offered as an ordinary section. A "placeable
-  only" mode (a shared item whose section no zone lists) would let the
-  starter keep the quote shared-only.
+  `defineConfig` would make the patch unnecessary. *(2026-09-07, starter)*
 - Registry names are one namespace across sections, elements, collections
   and page shapes (`assertUniqueNames`); the starter names its People
   section `peopleSection` and its Articles page `articlesIndex` to stay
   clear of the collections. Namespacing by kind would let a section and a
-  collection share a name.
-- The seed's early exit probes `/` alone, and `createPage` writes the path
-  row before the tree is published, so a crash between the home record and
-  the last page leaves a database every later run reports as "already
-  seeded"; recovery is `supabase db reset`. A probe on the last thing the
-  seed writes, or a per-step check, would make it resumable.
+  collection share a name. *(2026-09-07, starter)*
 - With `fi` as the default locale the seed writes the English content into
   `fi`. Before this fix the index page was seeded at `posts`
   while the collection's `fi` path is `artikkelit`, so `ensureFixedNodes`
   materialized a second, empty Articles page at `artikkelit` and the
   links pointed at `/posts`; the seed now derives the segment from the
   collection's `path` per locale. Left: the starter's copy in a `fi`
-  default is still English.
-- Config-level section style defaults (`styles.sections` in `defineConfig`)
-  are not filled at render: a node saved without an explicit style emits
-  no `data-spacing`/`data-tone`, so a stylesheet cannot key the default
-  on the attribute. The starter pads body sections by element instead.
-  Filling the resolved defaults in the render pass (as the admin form
-  does) would make the attributes reliable (walk, 2026-09-07).
-- A new list item's `select` subfield shows the first option but stores
-  nothing (`emptyValue` leaves it undefined), so publish fails with
-  `points.3.icon: Required` until the editor re-picks the value that is
-  already on screen. Seed the first option, or render a blank option so
-  the screen matches the value (walk, 2026-09-07).
-- Publish validates the last saved draft, so a click inside the autosave
-  debounce reports fields the editor has just filled as `Required`. Flush
-  the pending save before validating, or disable Publish while a save is
-  pending (walk, 2026-09-07).
-- The entry form cannot republish a published entry's newer draft: Save
-  writes a new draft version, the status control's `setPublished` returns
-  early when the status is unchanged, and nothing shows that the draft
-  differs from the published version. The workaround unpublishes and
-  republishes, which 404s the entry in between. Needs a "Publish changes"
-  action and a draft-edits indicator like the page editor's (walk,
-  2026-09-07).
-- Versions accumulate (`entry_versions` grew to four rows after one edit)
-  but no admin screen lists or restores them (walk, 2026-09-07).
-- A list row's collapsed summary shows the item's first string subfield —
-  the header nav rows read `/`, `/posts` — where the label would identify
-  the row; `itemSummary` could prefer a `label`/`title`/`heading` key
-  (walk, 2026-09-07).
-- New page / New path (a folder, "path" in the UI since 2026-09-09) ask for the slug through `window.prompt`, which
-  browser automation blocks and which cannot validate as you type; an
-  inline field would do both (walk, 2026-09-07).
-
-## Follow-ups (logged 2026-09-07, list field spec)
-
-- Saving the interim richtext textarea drops marks (bold, italic, link);
-  flattens a hard break inside a heading, list item or blockquote line to a
-  space (a prefixed line cannot carry one, DESIGN.md §3 Richtext); and drops
-  anything the line syntax cannot express at all — nested lists,
-  multi-paragraph list items (joined with a space instead), and unknown
-  nodes such as a horizontal rule. All of it goes away with the TipTap
-  widget.
-- Refs inside lists and objects are refused at build time (`f.list`,
-  `f.object`). A list of objects each holding a ref (a featured entry with
-  its own caption) needs the resolver, the refs index and the admin's
-  ref-option loading to address nested paths; add when a site asks.
-- Heading levels 4–6 render but the line syntax writes `####`…`######`
-  for them; the spec names 1–3 as the supported set.
-- `emptyValue` for an `image`/`video`/`file` item is `undefined`, so a new
-  media row starts empty; a required image item is then a validation
-  error until filled, which is the intended nudge but reads as an error
-  on a row the editor just added.
-- `RichText` drops the anchor of a link mark whose href is not http(s),
-  mailto, tel or site-relative (`/`, `#`, `?`, `.`). The href is normalised
-  the way URL parsers do (tab, LF and CR removed) before the scheme test;
-  `javascript:`, `data:`, protocol-relative `//host` and the backslash form
-  `/\host` are rejected. The admin's link field does not validate on input yet.
-- The list widget has no test for an object item holding a nested list
-  subfield.
-- A list item's subtree still uses the row index as its React key, so a list
-  of objects each holding a list hands the inner rows another item's collapse
-  state when an outer row moves; fix with a stable per-item key when nested
-  lists get real use.
+  default is still English. *(2026-09-07, starter)*
+- Cache tags are still `page:<id>`: publishing one locale expires every
+  locale's cached unit of that page (spec 2026-09-06 §4). A
+  `page:<id>:<locale>` tag would halve the revalidations on a bilingual
+  site. *(2026-09-06)*
+- Examples and guides write `url(entry.path!)`: `path` is `string | null` on every entry, though a collection that declares `path` always has one — type it `string` for those and drop the assertions. *(2026-09-30, content API contract final review)*
+- `smoodlyMetadata` does not apply the registration check `renderSmoodlyPath`
+  applies: a record whose `template` has no registration is a 404 body with
+  its meta emitted beside it. *(2026-09-05)*
 
-## Follow-ups (logged 2026-09-07, shared content spec)
+#### Media
 
-- `f.shared(() => item)` — a ref field on a section that renders a shared
-  item inside the section's own markup (spec 2026-09-07 decision 3).
-- Instance mode: a shared *type* with many editor-created items; today
-  the answer is a collection plus a section with `f.ref` (decision 1).
-- Zone-shaped shared items (`smoodly.shared({ zone })`) (decision 2).
-- Standalone live preview on a visual item's admin page — would need a
-  preview route in the glue. Less pressing since 2026-09-13: every shared
-  render is edited in the page canvas, and the Globals page is the form.
-- Built-in meta on shared items and on placements (anchor per placement
-  is the likely shape).
-- Per-placement overrides (a shared band with a per-page heading) — out
-  of scope; use a normal section with `f.ref` fields.
-- `fillLockedZones` for a zone bound to a shared item waits for
-  `ops.shared.list()`; a page opened before that resolves fills on the
-  next effect run. Not seen in the walk — the example binds no zone, so
-  the path was never exercised — but a double fill is unreachable by
-  construction: the effect depends on `sharedIds`, `record`, `mutate` and
-  `tree === null`, and `fillLockedZones` only touches EMPTY zones.
-  `z.locked(item)` still has no example usage.
-- `SharedForm` lists linking pages by id; a title needs `ops.pages.get`
-  per page (or a usage op returning titles).
-- `getSmoodlyShared` reads the store per request in draft mode and once
-  per (item, locale) otherwise; a layout calling it for several items
-  makes one round trip each — batch if it shows.
-- A shared item's row id is now uuid v5 of (space, name), so the primary
-  key ends the materialization race — but only for rows created from now
-  on: an item materialized before this change keeps its random
-  `gen_random_uuid()` id, and a second load would still be able to insert
-  a duplicate beside it. Re-materializing such an item (delete the row in
-  SQL, reload the admin) moves it onto the derived id.
-- `SharedForm.tsx` is a near-verbatim fork of `EntryForm.tsx`
-  (`applyResult`, `InfoRow`, the ref-options effect; the locale helpers
-  are shared since 2026-09-08) and `SharedList.tsx` is the third copy of
-  the remembered-locale block (`EntriesList`, `PagesList`); extract a
-  `useFormLocale` hook when the next form arrives.
-- A placement selected in a bound locked zone shows the canvas toolbar's
-  "fields only" label though a placement has no page-level fields; the
-  inspector notice is the real message.
-- A zone whose policy allows a shared item's section also offers that
-  section as an ordinary block, so the picker lists e.g. Testimonials
-  twice (once under Shared); decide whether a section used by a shared
-  item should be hidden from the ordinary list.
-- A placement of an object item or an unregistered item gates the page's
-  publish (the refs edge is emitted without a registry lookup) yet never
-  renders; only a hand-edited tree can produce one.
-- `ops.shared.get` runs `ensureSharedItems` and then lists the item
-  again; one round trip could go.
-- The example's Testimonials `quotes` richtext is required, so the first
-  admin save of the seeded band asks for it; make it optional or seed it.
-- `CollectionSchema.kind` was widened to carry `"shared"`, so a
-  `SharedSchema` typechecks where `registry.collections` is expected;
-  `defineConfig` should throw on a `kind === "shared"` entry listed there.
-- `ensureSharedItems` runs on every `ops.shared.list()` — which is every
-  editor mount, not only the Shared content page — costing one
-  `entries.list` per registration per open.
-- `fanOut` resolves every shared registration's row id (one
-  `entries.list` each) on every entry write, so it can expire
-  `shared:<name>` when something the item references changes; a row-id
-  cache would remove the reads but has to survive materialization.
-- Because `fanOut` lists every shared registration, an entry store built
-  without `options.shared` now fails on every ordinary entry write with
-  "no collection named", not only on `ops.shared.*`; both scaffolds pass
-  the same `shared` array to the store and the config, so this bites only
-  a hand-wired app.
-- `ops.entries.move` expires entry tags directly and does not `fanOut`,
-  so a reorder that changes what a shared item's `refList` renders does
-  not expire `shared:<name>`.
-- The package root (`src/index.ts`) must stay free of Node builtins:
-  every scaffolded section does `import { f, smoodly } from "smoodly"`,
-  and a `"use client"` section's browser build would fail on one.
-  `sharedEntryId` (`src/shared-id.ts`) moved off `node:crypto` onto Web
-  Crypto for this reason (fix pass, 2026-09-07). Nothing tests the
-  invariant itself — a future addition that reaches for `node:fs`,
-  `node:crypto`, etc. from a module reachable through the root would
-  regress it silently.
+- Video transcoding and adaptive streaming: a Mux or Cloudflare Stream
+  loader behind the `media.loader` seam, if a site ever needs more than
+  an MP4 over Storage's CDN. *(2026-09-08, media library)*
+- Sweeping abandoned `pending` asset rows (an upload that began and
+  never called `finishUpload`); a periodic op or a cleanup on `list`. *(2026-09-08, media library)*
+- A private bucket with signed reads, for sites that must not expose
+  draft-only media by URL before publish. *(2026-09-08, media library)*
+- Pre-generated image variants at upload time, for hosts without sharp. *(2026-09-08, media library)*
+- Image dimensions server-side cover JPEG and PNG (`imageDimensions`); a
+  WebP or AVIF seeded through `AssetStore.create` lands without a size
+  and resolves to nothing until the row is edited. Browser uploads
+  measure every type. *(2026-09-08, media library)*
 
-## Follow-ups (logged 2026-09-09)
+#### History and publishing
 
-- Cross-zone drag in the outline: each zone is its own sortable list;
-  moving a block between zones is still insert-and-remove.
-- Nested manual collections show no grip (`canReorder` requires
-  `depth === 1`) until the entry tree UI exists — a flat index is not a
-  sibling index there.
-- Canvas drag: the overlay should reuse `ui/sortable.ts` across the
-  iframe boundary; `useSortable` measures container children, which the
-  overlay's ghost rows can be.
-- ~~The Pages row menu's Move up / Move down could retire once the grip's
-  arrow keys are familiar; they stay for now as the discoverable path.~~
-  Retired 2026-09-15, with the outline rows' ↑/↓; list-field rows keep theirs.
-- The grip's arrow keys in the pages tree step one VISIBLE slot with the
-  depth clamped — among siblings in a flat run, but across a depth change
-  the step follows the clamp. Documented as is.
-- A dragged subtree stays collapsed after the drop (`onDragStart`
-  collapses it through `toggle` and nothing re-expands it).
-- Walk findings (2026-09-09, every surface walked signed-in; the pointer
-  path with synthetic pointer events, autoscroll in Playwright because
-  the desktop pane pauses animation frames while hidden):
-  - FIXED: the lifted row's transform grew the scroller's overflow, so
-    the bottom-edge autoscroll chased it forever and the list scrolled
-    away under the pointer; `clampOffset` now holds the transform inside
-    the rows' extent while the slot keeps following the pointer.
-  - A depth-1 row dragged to the very end of the tree with no drift
-    projects onto the last root row's child slot, which a mount or the
-    home page refuses (muted row); the editor must drift left 20px to
-    land at the root. By spec §4 (depth = own depth + drift), noted as a
-    discoverability question for the canvas-drag round.
-  - The rows are held in place until the reload lands (checked with a
-    1.2 s fetch delay): no flicker on a fast stack either.
-
-## Follow-ups (logged 2026-09-06)
+- Client-side undo in the editor (a stack of tree snapshots); the store
+  is no longer an undo stack by design. *(2026-09-13, history)*
+- The author per version row and in the lists; named versions. *(2026-09-13, history)*
+- History on the canvas card's menu and in the list row menus. *(2026-09-13, history)*
+- A diff between two versions. *(2026-09-13, history)*
+- The lists' row menus (Pages, Entries) do not offer Unpublish; the
+  document's own control does. *(2026-09-13, publish flow)*
 
-- Nested entries have no admin UI beyond `entries.move`: nothing creates
-  a child entry or shows the entry tree, and the entry form's slug prefix
-  is the collection's mount base only, not the parent chain.
-- `pages.get` makes four sequential store round trips for a non-root page
-  (`getPage`, `getDraftTree`, `pathsOf`, and the parent read behind
-  `parentLocales`; three for a root, which has no parent to read), and the
-  editor calls it on load and after every rename — one store call
-  returning them all would cut the editor's latency.
-- `entries.move` expires the entry and its descendants but does not fan
-  out to the pages referencing them, nor to the old and the new parent
-  entries the way `pages.move` does — asymmetric with `entries.save` and
-  `entries.setStatus`, which both fan out.
-- The row menu's item set (`menuItems`) and the row-click routing live in
-  `PagesList.tsx`, untested; extract them into `pages-tree.ts` before
-  plan 4 adds entry rows to the same menu.
-- The shell derives the fixed nodes a second time, over the serialized
-  registry (`mountOf` / `isFixedNode` in `pages-tree.ts`), beside the
-  server's `fixedNodeOf` — one derivation shipped to the client would do.
-- The locale switcher points the canvas at `urls[locale]`, and `href` is
-  identity in the example, so every path serves the default locale: a
-  page with a translated slug shows a 404 in the canvas for that locale
-  until next-intl is wired (plan 4). **Done 2026-09-06** — `href` is
-  `getPathname` in the example now; the canvas loads
-  `/fi/yritys/tietoa-meista?smoodly-editor=1` and renders (walked in
-  `examples/site/README.md`).
-- Page settings prints `paths[locale]` under each slug field — the
-  locale-relative CMS path, not `urls[locale]`, the site URL the canvas
-  and "View live" actually open. On a translated site the Finnish hint
-  reads `/yritys/tietoa-meista` while the page lives at
-  `/fi/yritys/tietoa-meista`. Both maps are already in `EditorView`;
-  which one belongs under the field is a UI decision, not a missing
-  value.
+#### Collaboration
+
+- A hard lock with takeover, if a real team asks: presence has the facts. *(2026-09-26, concurrency)*
+- Presence on the members and media screens; today only pages, entries and
+  global items track. *(2026-09-26, concurrency)*
+- Postgres Changes for live list refresh; the lists still load on navigation. *(2026-09-26, concurrency)*
+- Field-level merging of two editors' changes; the guard refuses whole documents. *(2026-09-26, concurrency)*
+- A dropped socket clears presence on Realtime's timeout (tens of seconds); the
+  lock outlives a closed tab by that much. *(2026-09-26, concurrency)*
+
+#### Members
+
+- Members management shipped 2026-09-25 (spec
+  `docs/superpowers/specs/2026-09-25-members-management-design.md`); out
+  of its scope: a pending-invite status and "resend invite" on a row
+  (needs the Auth user's `last_sign_in_at`, which the cloud projection
+  does not carry); removing the Auth account together with the member
+  row; invites from the cloud's `/admin` (they are smoodly.io's); a
+  project whose Auth is OAuth-only (the invite mail asks for a password). *(2026-09-25, settings + members)*
+- The members list is not paged (tens of rows, not thousands). *(2026-09-25, settings + members)*
+
+#### Redirects
+
+- Destinations outside Smoodly, extension and query-string addresses,
+  code-owned renames (a collection `path`, a fixed slug): the guide's
+  `next.config` recipe; a `redirects` table is OQ 34. *(2026-09-26, redirects)*
+- The content API's `getPage("/old")` returns null for a redirect row
+  (spec §7); a `follow` option is a one-line addition if a site asks. *(2026-09-26, redirects)*
+- A redirect row has no audit columns (who, when); add them with a
+  need. The Redirects page is not paged. *(2026-09-26, redirects)*
+
+#### Export and import
+
+- `import --replace`: delete the space's content and media first, after
+  typing the space to confirm — a backup restored over a live project.
+  Mention it in the not-empty refusal when it lands. *(2026-09-28, export/import)*
+- A readable export for leaving Smoodly: one document per page or entry,
+  fields resolved, no internal IDs. *(2026-09-28, export/import)*
+- A "Download backup" button in the admin: the same export behind an op,
+  zipped for an editor. *(2026-09-28, export/import)*
+- Import cannot expire the app's cache tags; it prints a restart note. A
+  revalidate call through the app (an op the CLI could reach) would make
+  the note unnecessary. *(2026-09-28, export/import)*
+
+#### Content health and drift
+
+- Content health lists an entry slug outside the grammar, but its link
+  opens an entry form that marks nothing on the slug: drift leaves the
+  slug out on purpose (a marker would flash while it is typed), so only
+  the publish refusal marks it. Mark it in the form once the box has lost
+  focus, if editors miss it. *(2026-09-29, pre-install fixes)*
+- Content health does not check page slugs: pages refuse a bad slug at
+  create and rename, so only an import of older data or a hand edit could
+  hold one. *(2026-09-29, pre-install fixes)*
+- Refs inside unknown nodes are not indexed: without a schema nothing
+  says which values are refs, so safe-delete cannot see them. Publish
+  refuses such nodes and a live one renders nothing. *(2026-09-27, editor safety)*
+- Leftover shared values after `.localized()` is turned on stay on the
+  entry as every locale's fallback; removing them for good waits on
+  the fix tooling (OQ 35). `localization-on` is reported only where a
+  locale has no value of its own, so a fully translated entry no
+  longer lists it. *(2026-09-27, editor safety)*
+- A CLI drift report was left out (the admin already has the config and
+  the database; a CLI needs the service key and a TS config loader). *(2026-09-27, editor safety)*
+- Turning `.localized()` off for a field with per-locale values leaves
+  those values in `entry_locales.fields` until the next save of each
+  locale (a save writes only the current split) — the drift/codemod
+  pipeline (Phase 2) is where "keep en, discard fi" belongs. *(2026-09-06)*
+
+#### Schema and migrations
+
+- The views of a removed collection stay (spec 2026-09-26 §3); a
+  `drop view` is the developer's. *(2026-09-26, schema migrations)*
+- `smoodly migrate` never pushes; a `--push` flag if the two-step
+  proves annoying. *(2026-09-26, schema migrations)*
+
+#### Data lifecycle
+
+- A locale dropped from `locales.supported` leaves its `page_locales`,
+  `page_versions` and `paths` rows in place but unreachable — nothing
+  lists or serves them, and nothing cleans them up. It is the mirror of
+  the materializer's top-up, and wants the same deliberate answer (an
+  admin-visible orphan list, or a prune op). *(2026-09-06)*
+- `addLocale` does not bump the entry's `updatedAt` while `removeLocale`
+  does. Both adapters agree, so the contract is honest, but "adding a
+  language is not an edit and removing one is" is arbitrary — decide it
+  deliberately before someone sorts a list by Updated. *(2026-09-06)*
+- No `rebuildPaths()`: the index is documented as derived and rebuildable, but
+  nothing rebuilds it. *(2026-09-05)*
+
+#### Config and registration
+
+- `LOCALE_CODE_RE` accepts any 2–4 letter subtag as script or region
+  (`en-ZZZZ` passes), and a duplicate entry in `supported` passes
+  silently — boot validation catches typos in shape, not in fact. *(2026-09-06)*
+- `entryPathRows` relies on the stores validating locale keys on write
+  (no guard of its own); `list`/`getMany` accept an unsupported locale
+  silently and read as "no content". *(2026-09-06)*
+- `sections` is passed twice — to `createSmoodlySite` (ref resolution) and to
+  `createPageRenderer` (the component map) — and `elements` cannot be passed
+  at all; the two lists can drift silently. *(2026-09-05)*
+- `SmoodlyConfig.registry.pages` (`Registered` in `src/config.ts`) has no
+  call signature, so every app's glue casts it `as PageRegistration[]`. *(2026-09-05)*
+- Two `entryPage` registrations for one collection are silently accepted.
+  `PageStore.rename` still accepts a locale outside `supported`; the admin
+  op rejects it first, so only a direct store caller reaches it. *(2026-09-05)*
+
+#### Scale and performance
+
+- `listLive` / `listRedirects` on Supabase read at most PostgREST's
+  `max_rows` (1000) per locale, as before, now ordered by (anchor, path)
+  and sorted by URL in JS; page them if a locale's redirect list grows
+  past it. *(2026-09-29, nested collection paths)*
+- Scan paging: `health.scan` makes one bulk read per table (versions by
+  id in chunks of 100), and PostgREST's max-rows would cap a very large
+  space. Page it, and add a rail badge, when a real site's size asks. *(2026-09-27, editor safety)*
+- Server search for ref candidates: `useRefOptions` loads the whole
+  target collection once per locale. When a collection outgrows that,
+  the hook changes (a search op, plus "titles for these ids" for the
+  picked rows); `RefPicker` takes options as a prop and does not. *(2026-09-17, reference picker and tags)*
+- `entries.distinct` flattens in JS over `entries.list`; an RPC over
+  `jsonb_array_elements` when a collection outgrows it. *(2026-09-17, reference picker and tags)*
+- `InspectorFields` filters hidden entries per render; a section with
+  many conditions re-evaluates every keystroke. Fine at the sizes seen. *(2026-09-15, section settings)*
+- Ops are built per call (`createAdminOps` inside the handler) so the
+  session rides in as `actor`; if that ever measures, memoize the
+  actor-free parts. *(2026-09-13, history)*
+- A GIN index on `entries.fields` when a customer's collection is large
+  enough to need it; additive, no migration. *(2026-09-11, queries)*
+- Every revalidating op (publish, delete, a save of published content)
+  answers with a fresh RSC render of the admin route — the layout's
+  styles included, ~30 KB — because `updateTag` runs inside the server
+  action and Next re-renders the tree it was posted to. Harmless now
+  that the shell lives in the layout (the empty page subtree is what
+  remounts), but it is the price of server actions as the transport. *(2026-09-08, client routing)*
+- `getSmoodlyShared` reads the store per request in draft mode and once
+  per (item, locale) otherwise; a layout calling it for several items
+  makes one round trip each — batch if it shows. *(2026-09-07, shared content)*
+- `ops.shared.get` runs `ensureSharedItems` and then lists the item
+  again; one round trip could go. *(2026-09-07, shared content)*
+- `ensureSharedItems` runs on every `ops.shared.list()` — which is every
+  editor mount, not only the Shared content page — costing one
+  `entries.list` per registration per open. *(2026-09-07, shared content)*
+- `fanOut` resolves every shared registration's row id (one
+  `entries.list` each) on every entry write, so it can expire
+  `shared:<name>` when something the item references changes; a row-id
+  cache would remove the reads but has to survive materialization. *(2026-09-07, shared content)*
 - `ensureFixedNodes` runs on every `pages.list` and every ROOT
   `pages.create` — one `listPages()` each, and a second one when it
   tried to create something. It also treats a root record sitting at a
   fixed slug as that node even when its `template` is a foreign one: the
   node is adopted, never recreated, and the ops then guard it as
-  code-owned.
-- Two admins loading at once race on materialization. Any spec whose
-  create fails is warned about and skipped, not fatal to the rest of the
-  list — except the loser's `slugTaken`, which means the other admin won
-  the same race: that one message is swallowed on purpose, silently,
-  with no warn.
-- The `smoodly_reorder` / `smoodly_reorder_pages` RPCs keep their
-  implicit sibling scope (decided 2026-09-06: every caller passes exactly
-  one sibling set). A parent argument waits for a caller that needs it.
-- The row menu in `PagesList.tsx` does not close on Escape — only a click
-  on the backdrop closes it.
-- `PageSettings` re-seeds its inputs from `record` on every rename (and
-  every publish), so keystrokes typed while a rename is in flight can be
-  dropped. The blur- and Enter-driven commits themselves are unaffected.
-- `subtreeIds` and `entrySubtreeIds` in `ops-impl.ts` are the same O(n²)
-  walk over a full list, written twice. One generic descendant walk when
-  the list sizes make it matter.
-- `publish`'s "has no draft to publish" branch is unreachable with the
-  memory store — `createPage` gives every templated page a first version
-  — and is untested. It is defence for the Supabase adapter.
-- Classifications the ops tests do not assert: a move that breaks the
-  home page's no-children rule or exceeds the tree depth (create asserts
-  both), and `entries.move`'s cross-collection and sibling-slug guards.
-  `MemoryEntryStore.move` has no children guard at all — the subtree
-  rides along — so `has child` is reachable from delete only.
-- The seed's early exit still probes `/` alone: a run that dies between
-  the two publishes reports "Already seeded" on the next run and never
-  gets its `company` folder.
-- `create-smoodly-app` scaffolds now ship `pages: { tree: { depth: 3 } }`
-  — the template build rewrites only the locale set in `smoodly/config.ts`
-  and `href` in `smoodly/server.ts` (each with its comment) — so nesting
-  is on by default in a fresh app.
-- A childless folder row is inert on click (a mount opens its collection,
-  a page opens the editor, a folder with children expands); "Add page
-  here" lives in the row menu only.
-- The tree rows nest interactive buttons — the chevron and the `···`
-  menu — inside a `role="button"` row. It works, because both stop the
-  click and the keydown, but it is an accessibility smell a real treegrid
-  would not have.
-- `ensureFixedNodes` warns on every `pages.list` while a fixed node's
-  locale cannot land (an editor page holds its path); a one-time notice
-  in the admin would be kinder than a warning per listing.
-- Cache tags are still `page:<id>`: publishing one locale expires every
-  locale's cached unit of that page (spec 2026-09-06 §4). A
-  `page:<id>:<locale>` tag would halve the revalidations on a bilingual
-  site.
-- The Pages list's confirms (`Add <locale>`, `Remove from <locale>`,
-  `Delete …`) are the design system's dialog since 2026-09-25;
-  `EntriesList` still reports a refused add or remove with
-  `window.alert` — the follow-up, together with the row menu extraction
-  already logged above.
-- `EditorView.tsx` is ~850 lines now that it also holds the locale switch,
-  add and remove flows — see the 2026-09-03 follow-up below for the seams
-  (that entry is the one to act on).
-- `i18n/request.ts` returns `{ locale, messages: {} }`. next-intl 4.14.2
-  throws `No messages found` when the provider inherits none, and the
-  example has no UI strings of its own, so the object is empty; a
-  scaffolded site that translates its own UI fills it in (the comment in
-  the file points at next-intl's configuration docs). No `messages/`
-  folder is scaffolded — UI-string translation is next-intl's job, not
-  Smoodly's.
-- `i18n/request.ts` reads `next/root-params` (next-intl's current
-  guidance; `requestLocale` is deprecated). Its real types are generated
-  into `.next/types/` by `next dev` / `next build` / `next typegen`;
-  `tsc` before a first build still passes, because `next` ships a bare
-  `declare module 'next/root-params'` for exactly that window.
-- The four single-language route files in
-  `packages/create-smoodly-app/variants/single/` are compiled by nothing
-  but the CI hosted-mode e2e's `next build` — the example is the
-  multilingual layout, so `npm test` never type-checks them. A renderer
-  or admin signature change breaks them there, a whole CI job later than
-  it should. The fix is a `tsconfig` project for `variants/` with the
-  scaffold's `@/*` paths mapped into the example, or a scaffold-then-
-  `tsc` smoke test.
-- `ArticleList` renders titles, not links. A section that linked to its
-  entries would put the entry's `path` through the app's `Link` / `href`
-  the way `components/pages/Page.tsx` does — `getEntries` returns `path`
-  already; the section simply does not use it.
-- `smoodlyMetadata` emits `alternates.languages` as relative URLs and
-  neither the example nor either template sets `metadataBase`, so the
-  rendered `hreflang` hrefs are relative (`/fi/yritys/tietoa-meista`).
-  Crawlers want absolute ones: a real site sets `metadataBase` in its
-  root layout. `next build` on the example (2026-09-06, Next 16.3.4) does
-  not warn — every route is request-rendered, so nothing resolves the
-  relative URLs at build time.
-- The proxy's matcher hard-codes `admin` and `api`
-  (`/((?!admin|api|_next|_vercel|.*\..*).*)`). An app that mounts the
-  admin somewhere else edits `proxy.ts` by hand; nothing derives the
-  matcher from the config.
-- `classify` in `ops-impl.ts` is ~20 order-sensitive substring checks over
-  store messages — `"already exists in locale"` must precede
-  `"already exists"`, or an addLocale conflict reads as a slug conflict. A
-  typed code on `pageErrors` (thrown and matched, not re-parsed) would
-  remove the ordering hazard before plan 2 adds the entry messages.
-- `ops-impl.ts` is ~436 lines with a ~165-line `pages` group. The guard
-  helpers (`nameOf`, `isHomeNode`, `supportedLocale`, `mountGuard`,
-  `owned`) are the extraction seam — a `pages-ops.ts` taking them as
-  collaborators. The `entries` group now duplicates two of them outright:
-  the `supportedLocale` guard and the `parentLocales` computation exist
-  once per group.
+  code-owned. *(2026-09-06)*
 - `fixedNodeSpecs(config)` rebuilds the whole spec list on every
   `fixedNodeOf` call, and the ops call `fixedNodeOf` per guarded write. A
-  `WeakMap` memo keyed by the config object is the whole fix.
+  `WeakMap` memo keyed by the config object is the whole fix. *(2026-09-06)*
 - `SupabasePageStore.updateLocale` re-reads the record (`must(id)`) after
   every update, so `setTemplate` is N+1 in the page's locales: one update
   and one full read each. Only the last read is used. The Supabase entry
   adapter is the same shape: `create` is insert → insert → read →
   version → read → paths → refs, and `removeLocale` re-fetches the entry
-  three times.
-- The single-language branch — no locale selector in the Pages list, no
-  switcher, no add/remove — has no automated coverage; only three sites
-  branch on the locale count (`PagesList.tsx`, `EditorView.tsx` and
-  `page-renderer.tsx`'s alternates), so a regression there shows up only
-  in a scaffolded single-language app.
-- No test pins that a published child's breadcrumb carries an UNPUBLISHED
-  ancestor's title with `hasPage: false`; `site.test.tsx` covers the
-  folder ancestor only, and the two paths share one `hasPage` predicate.
-- A locale dropped from `locales.supported` leaves its `page_locales`,
-  `page_versions` and `paths` rows in place but unreachable — nothing
-  lists or serves them, and nothing cleans them up. It is the mirror of
-  the materializer's top-up, and wants the same deliberate answer (an
-  admin-visible orphan list, or a prune op).
-- `LOCALE_CODE_RE` accepts any 2–4 letter subtag as script or region
-  (`en-ZZZZ` passes), and a duplicate entry in `supported` passes
-  silently — boot validation catches typos in shape, not in fact.
-- `MemoryPageStore.publish` throws the "is a folder" message when a
-  templated row has no draft version. Unreachable through the ops (a
-  templated page always gets a first version), but the message would be
-  wrong if it ever were.
-- The Pages list offers "Add <locale>" on a dimmed row whose parent lacks
-  that locale, and learns the refusal only after the round trip.
-  `pagesTreeRows` already carries every node's locales, so the parent's
-  presence could disable the item with its reason up front, exactly as
-  the editor's switcher does with `parentLocales`. `EntriesList` has the
-  same gap (and `entryRows` would have to carry the locales again — the
-  dead field was deleted rather than left unused); it is unreachable
-  today, since nothing in the admin creates a child entry.
-- No version history UI for entries (nor pages): `listVersions` exists on
-  both stores; a history pane with restore is the follow-up. Restoring a
-  versioned entry's snapshot must also restore the shared fields (the
-  snapshot is merged).
+  three times. *(2026-09-06)*
 - `entries.list` filters `{ locale, status }` in memory after fetching
   every row (PostgREST cannot filter the parent by an embedded row
   without `!inner`, which would drop the other rows); fine at collection
-  sizes today.
-- The entry form's ref picker offers only targets present in the locale
-  being edited; a target present but unpublished there is offered marked
-  `(draft)` and blocks a page publish in that locale until published —
-  the picker could say so.
-- A collection's `path` map that omits a supported locale falls back to
-  the default segment for entry paths (`collectionSegment`) while the
-  mount node is materialized map-keys-only; the two should agree as
-  fixed pages now do.
-- `removeLocale` on the Supabase entry adapter is deliberately
-  non-atomic (row and versions go, then paths), the same trade-off as
-  pages.
+  sizes today. *(2026-09-06)*
+- `assertPublishable` (`store.ts`) awaits one `entries.get` per
+  referenced entry, sequentially, on every publish — a `refList` of a
+  dozen articles is a dozen serial reads, now per locale. `getMany(ids,
+  locale)` takes exactly that shape and would make it one call. *(2026-09-06)*
+- `loadPage` calls `listPages()` for ancestors and children on every cache
+  miss; fine for hundreds of nodes, a `children(id)`/`chain(id)` store query
+  is the fix when a site outgrows it. *(2026-09-05)*
+- `loadEntry` probes each mounted collection in turn: the `paths` row
+  carries the target id but not its collection. *(2026-09-05)*
+
+#### Code health
+
+- `SharedForm.tsx` is a near-verbatim fork of `EntryForm.tsx`
+  (`applyResult`, `InfoRow`, the ref-options effect; the locale helpers
+  are shared since 2026-09-08) and `SharedList.tsx` is the third copy of
+  the remembered-locale block (`EntriesList`, `PagesList`); extract a
+  `useFormLocale` hook when the next form arrives. *(2026-09-07, shared content)*
+- `CollectionSchema.kind` was widened to carry `"shared"`, so a
+  `SharedSchema` typechecks where `registry.collections` is expected;
+  `defineConfig` should throw on a `kind === "shared"` entry listed there. *(2026-09-07, shared content)*
+- Because `fanOut` lists every shared registration, an entry store built
+  without `options.shared` now fails on every ordinary entry write with
+  "no collection named", not only on `ops.shared.*`; both scaffolds pass
+  the same `shared` array to the store and the config, so this bites only
+  a hand-wired app. *(2026-09-07, shared content)*
+- `subtreeIds` and `entrySubtreeIds` in `ops-impl.ts` are the same O(n²)
+  walk over a full list, written twice. One generic descendant walk when
+  the list sizes make it matter. *(2026-09-06)*
+- `ops-impl.ts` is ~436 lines with a ~165-line `pages` group. The guard
+  helpers (`nameOf`, `isHomeNode`, `supportedLocale`, `mountGuard`,
+  `owned`) are the extraction seam — a `pages-ops.ts` taking them as
+  collaborators. The `entries` group now duplicates two of them outright:
+  the `supportedLocale` guard and the `parentLocales` computation exist
+  once per group. *(2026-09-06)*
 - `EntryForm.tsx` grew the locale lifecycle beside the fields; the
   `LocaleSwitcher` is shared with the editor now, the add/remove flows
-  are not (`doAddLocale`/`doRemoveLocale` exist twice).
-- Turning `.localized()` off for a field with per-locale values leaves
-  those values in `entry_locales.fields` until the next save of each
-  locale (a save writes only the current split) — the drift/codemod
-  pipeline (Phase 2) is where "keep en, discard fi" belongs.
-- Resolved 2026-09-26 (schema migrations spec): the repo-root
-  `supabase/migrations/` is the package's core files plus a views file
-  that `npm run db:migrate` writes from
-  `examples/site/smoodly/collections.ts` — the same source the
-  create-smoodly-app templates use; `scripts/emit-sql.ts` and its own
-  fixture collections are gone (`scripts/emit-migration.ts` drafts the
-  next core file).
-- In the entry form, a shared ref field (e.g. an article's author) shows
-  `—` in a locale where the target is absent, because the picker offers
-  only targets present in the edited locale; the value is kept on the
-  node and the other locale's byline is unchanged, but it looks empty
-  and cannot be re-set from that locale.
-- `entryPathRows` relies on the stores validating locale keys on write
-  (no guard of its own); `list`/`getMany` accept an unsupported locale
-  silently and read as "no content".
-- The Supabase entry adapter's `removeLocale` deletes the row and its
-  versions before the paths rewrite with no rollback; its residue
-  comment describes the opposite case (a surviving path row for a
-  removed locale, not a present node without its path row).
-- The entry form's locale switch, add and remove confirm before
-  discarding unsaved edits (a `dirty` flag; the form has no autosave,
-  unlike the page editor's flush).
-- `addLocale` does not bump the entry's `updatedAt` while `removeLocale`
-  does. Both adapters agree, so the contract is honest, but "adding a
-  language is not an edit and removing one is" is arbitrary — decide it
-  deliberately before someone sorts a list by Updated.
-- The Supabase entry adapter's rollbacks are best-effort and can mask the
-  original throw: `create`'s catch runs `paths.remove` before the node
-  delete (a failing remove strands the node and replaces the real error),
-  `update` and `move` restore by writing, and those writes can throw in
-  place of the rewrite's rejection. `recordVersion` is two statements
-  (insert, then point at it), so a failure between them leaves an
-  unreferenced `entry_versions` row — invisible to every policy and
-  harmless, but it accumulates.
+  are not (`doAddLocale`/`doRemoveLocale` exist twice). *(2026-09-06)*
 - `removeLocale`'s blocker list (`localeInUse`) is unordered in the
   Supabase adapter — the children query has no `.order()` — so a
   multi-blocker message can name the titles in a different order than the
-  memory adapter's. Message text only; the contract case has one blocker.
+  memory adapter's. Message text only; the contract case has one blocker. *(2026-09-06)*
 - `entry-store.ts` is ~624 lines. The pure helpers (`localizedKeys`,
   `splitFields`, `entryFieldsIn`, `entryRefEdges`, `entryTitleIn`) are the
   extraction seam from the memory adapter, the same shape as the
-  `EditorView.tsx` and `ops-impl.ts` entries above.
-- In a single-language project the entry form renders `slug` last:
-  `localizedFieldKeys` puts it in the `own` group, which follows
-  `shared`, and no section labels are shown — so the field order the
-  schema declares is not the order on screen.
-- `admin-entries-list.test.ts` has no case for a row with differing
-  pointers (the `draft edits` status), nor one asserting that an absent
-  row's `updatedAt` falls back to the node's. Two assertions.
-- `assertPublishable` (`store.ts`) awaits one `entries.get` per
-  referenced entry, sequentially, on every publish — a `refList` of a
-  dozen articles is a dozen serial reads, now per locale. `getMany(ids,
-  locale)` takes exactly that shape and would make it one call.
-
-## Follow-ups (logged 2026-09-05)
-
-- A page's cached unit embeds its ancestors' and children's titles and
-  paths (the `page` prop) but is tagged `page:<own id>` only. The admin
-  ops now expire the neighbours they change — publish and delete the
-  parent, rename and move the subtree and both parents (2026-09-06) — so
-  what remains stale is a write that does not go through them: the seed,
-  a script, any out-of-band writer. Closing that needs one tree-wide tag
-  instead of a neighbour list (DESIGN.md OQ #26).
-- The cached unit is keyed by (locale, path) but tagged by the id found at
-  the first miss, so a path that changes hands without both ids' tags firing
-  serves the previous occupant. Delete fires its own tag and the rename/move
-  fan-out covers the moving record; re-keying the unit by
-  (locale, kind, id) would remove the class (DESIGN.md OQ #26).
-- `ancestors` on a page hit are NOT filtered by locale (children are): a
-  page ancestor whose `locales` exclude `fi` (`hasPage` true) still
-  produces a breadcrumb link whose path 404s in `fi`.
-- `smoodlyMetadata` does not apply the registration check `renderSmoodlyPath`
-  applies: a record whose `template` has no registration is a 404 body with
-  its meta emitted beside it.
-- `sections` is passed twice — to `createSmoodlySite` (ref resolution) and to
-  `createPageRenderer` (the component map) — and `elements` cannot be passed
-  at all; the two lists can drift silently.
-- `getEntry` by bare slug matches `entrySegment` — the locale row's own
-  `slug`, the same value `paths` is written from — so the two cannot
-  diverge (the double-overlay hazard went with `EntryRecord.i18n`).
-  `getEntry` by id still reads the whole collection to find one row.
-- `locate` (one primary-key hit on `paths`) runs per request outside the
-  cache, because the cache tag needs the id before the unit can be cached; a
-  later `"use cache"` migration (OQ #19) can fold it in.
-- Entry-page metadata is alternates only — entries have no `meta`. A
-  `titleField`-based title is a later nicety.
-- Per-locale section visibility conditions are not modelled (OQ #3). Tree
-  content itself is per locale now — each `page_locales` row points at its
-  own version — so the section fields a locale sees are its own.
-- `getEntries`/`getEntriesTree` return refs as ids (cheap lists); `getEntry`
-  by path resolves them, `getEntry` by id or slug does not — document or
-  unify when a site needs resolved lists.
-- `loadPage` calls `listPages()` for ancestors and children on every cache
-  miss; fine for hundreds of nodes, a `children(id)`/`chain(id)` store query
-  is the fix when a site outgrows it.
-- Views rendered outside the site get `EMPTY_PAGE_CONTEXT`: tests and any
-  preview of a shape that isn't going through `site.load`.
-- `loadEntry` probes each mounted collection in turn: the `paths` row
-  carries the target id but not its collection.
-- A published entry under a draft parent is dropped from `getEntriesTree`
-  (the parent is not in the list to hang it from) but returned flat by
-  `getEntries`. Untested either way.
-- `SmoodlyConfig.registry.pages` (`Registered` in `src/config.ts`) has no
-  call signature, so every app's glue casts it `as PageRegistration[]`.
-- The entry-page view receives the whole `EntryRecord`, every locale's
-  row in `locales` included (fields, slug, status and version pointers); a
-  client entry page would ship all of it to the browser.
-- `move` is best-effort across two statements (reorder, then path rewrite):
-  a failed rewrite restores each destination sibling's prior `sort` row by
-  row, so a failure in the rollback itself still leaves the order changed.
-- The live suites run on vitest's DEFAULT 5s per-test timeout against a real
-  database, while a single contract test makes dozens of round trips. On a
-  loaded or degraded local stack `npm run test:supabase` then fails with bare
-  timeouts on arbitrary tests (every file passes on its own, and the whole
-  run passes with `--testTimeout=30000`). Either raise the timeout in
-  `scripts/test-supabase.sh` or accept the flake in CI.
-- The `smoodly_reorder` RPC takes no parent scope — the caller always passes
-  one sibling set, so scoping is implicit. Give it a parent argument if a
-  caller ever passes a mixed list.
-- An explicit JSON `null` VALUE in a declared `order.by` field sorts
-  FIRST in Supabase (a jsonb null is the lowest jsonb value, not SQL
-  NULL, so `nullsFirst: false` does not reach it) and LAST in memory. A
-  MISSING key is SQL NULL and sorts last in both, and the admin only ever
-  produces that — a cleared number field emits `undefined`, which the
-  JSON body drops — so this needs a programmatic or external writer.
-  Mixed types in one field diverge for the same reason: Postgres orders
-  jsonb by type first (null < string < number), memory by `String(...)`.
-- Rollback gaps that remain: a `smoodly_reorder`/`smoodly_reorder_pages`
-  failure AFTER the re-parent update has no rollback at all; the entry
-  `create` rollback discards its delete result (an orphan row survives
-  silently); and a throw inside any rollback replaces — masks — the original
-  error.
-- Duplicate sibling `sort` values are reachable — create uses count + 1 while
-  delete and move leave gaps — so `sort` is an ordering hint and creation
-  order breaks ties.
-- Folders have path rows and resolve as `kind: "page"`; the published-only
-  read policy makes them public 404s, while the admin (write key) sees them.
-- `setTemplate`/`saveDraft` insert the version row before the pointer update:
-  an infra failure between the two orphans a version.
-- No `rebuildPaths()`: the index is documented as derived and rebuildable, but
-  nothing rebuilds it.
-- Two `entryPage` registrations for one collection are silently accepted.
-  `PageStore.rename` still accepts a locale outside `supported`; the admin
-  op rejects it first, so only a direct store caller reaches it.
-- Entry `move` coverage is thinner than pages' — no omitted-index, clamp or
-  cross-collection tests.
+  `EditorView.tsx` and `ops-impl.ts` entries in this list. *(2026-09-06)*
 - The memory stores default to SEPARATE private path indexes while the
   Supabase stores share one `paths` table: pages and entries share a URL space
   only when the wiring passes one `paths` option to both (convention, not
-  structure).
+  structure). *(2026-09-05)*
 - `SupabasePathIndex` falls back to `pathTakenError("?", "?")` when
   Postgres reports a unique violation without `details` — the message then
-  names no path.
+  names no path. *(2026-09-05)*
 - `chainOf` has no cycle guard: a corrupted `parent_id` loop would spin
-  forever. The stores prevent cycles on `move`, so it is unreachable today.
-- Design system pass (DESIGN.md §2, "The admin's visual system"): the shell,
-  lists, entry form, login and editor were restyled onto `admin/ui/theme.tsx`.
-  Deferred deliberately, because each is a feature rather than a restyle: the
-  list search field and status filter, the locale select in the shell's top bar
-  (the editor has one; the lists always read the default locale), the article
-  sidebar's taxonomy/SEO/publish-date sections, and the rich-text toolbar. The
-  pages list's tree shape (chevrons, depth indent) and its row `···` menu
-  shipped 2026-09-06, without the drag handle. The tokens for all of them are
-  already in place.
+  forever. The stores prevent cycles on `move`, so it is unreachable today. *(2026-09-05)*
 - The `scroll` message in `admin/editor/protocol.ts` is no longer sent: with the
   canvas column as the scroller, `EditorView` scrolls it directly instead of
   asking the bridge to `scrollIntoView` across the frame. `EditorBridge` still
   handles the message, so old and new admins interoperate; drop the message on
-  the next protocol change.
+  the next protocol change. *(2026-09-05)*
+- `exports` has no `"./package.json"` entry, so tooling that reads a dependency's `package.json` through the exports map cannot. One line to add when something needs it. *(2026-09-04)*
+- `src/ref-index.ts` contains two raw NUL bytes used as key separators, which makes git show the file as binary in diffs. Replacing them with `\0` escapes would make it diffable again. *(2026-09-04)*
+- `serialize.ts` structural cast duplicates `PageSchema`; tighten `Registered.schema` so the cast goes. *(2026-09-03)*
+- `EditorView` split (autosave extracted 2026-09-03; the rest 2026-09-08, before the TipTap widget): `usePageLocale` (switch/add/remove, over `locale-url.ts`), `useCanvasBridge` (geometry, select/hover, `postToCanvas`, the geometry timeout), `CanvasOverlay` over `overlay-geometry.ts` (`plusButtonsFor`, pure and tested), `InsertPicker`, `Outline`, `NoticePane`. `EditorView.tsx` is ~660 lines of load, gestures, publish and layout. Remaining seam: the inspector's field form (`FieldWidget` rows plus the tabs) stays put until inline editing lands (DESIGN.md §3 puts TipTap in the canvas, not the sidebar). The ref-option loading became `forms/useRefOptions.ts` (2026-09-17). (logged 2026-09-06, updated 2026-09-08) *(2026-09-03)*
+
+#### Tests
+
+- The media test uploads a starter photo under a suffixed name rather
+  than a fixture file, so `e2e/fixtures/` from the spec does not exist. *(2026-09-26, browser suite)*
+- ListView rows that are not clickable (Members) carry no role; the
+  members test finds its row by `.sm-table__body > div`. A table role
+  set (`table`/`row`/`cell`) on ListView would give every list a proper
+  locator. *(2026-09-26, browser suite)*
+- The picker's click cannot be unit-tested (no DOM in the suite); the
+  walk covers it. A jsdom environment for the admin tests is a future
+  tooling item. *(2026-09-15, custom section)*
+- The list widget has no test for an object item holding a nested list
+  subfield. *(2026-09-07, list field)*
+- The row menu's item set (`menuItems`) and the row-click routing live in
+  `PagesList.tsx`, untested; extract them into `pages-tree.ts` before
+  plan 4 adds entry rows to the same menu. *(2026-09-06)*
+- `publish`'s "has no draft to publish" branch is unreachable with the
+  memory store — `createPage` gives every templated page a first version
+  — and is untested. It is defence for the Supabase adapter. *(2026-09-06)*
+- Classifications the ops tests do not assert: a move that breaks the
+  home page's no-children rule or exceeds the tree depth (create asserts
+  both), and `entries.move`'s cross-collection and sibling-slug guards.
+  `MemoryEntryStore.move` has no children guard at all — the subtree
+  rides along — so `has child` is reachable from delete only. *(2026-09-06)*
+- No test pins that a published child's breadcrumb carries an UNPUBLISHED
+  ancestor's title with `hasPage: false`; `site.test.tsx` covers the
+  folder ancestor only, and the two paths share one `hasPage` predicate. *(2026-09-06)*
+- `MemoryPageStore.publish` throws the "is a folder" message when a
+  templated row has no draft version. Unreachable through the ops (a
+  templated page always gets a first version), but the message would be
+  wrong if it ever were. *(2026-09-06)*
+- `admin-entries-list.test.ts` has no case for a row with differing
+  pointers (the `draft edits` status), nor one asserting that an absent
+  row's `updatedAt` falls back to the node's. Two assertions. *(2026-09-06)*
+- The live suites run on vitest's DEFAULT 5s per-test timeout against a real
+  database, while a single contract test makes dozens of round trips. On a
+  loaded or degraded local stack `npm run test:supabase` then fails with bare
+  timeouts on arbitrary tests (every file passes on its own, and the whole
+  run passes with `--testTimeout=30000`). Either raise the timeout in
+  `scripts/test-supabase.sh` or accept the flake in CI. *(2026-09-05)*
+- Entry `move` coverage is thinner than pages' — no omitted-index, clamp or
+  cross-collection tests. *(2026-09-05)*
+
+### Cloud
+
+- A copy inside one database with fresh IDs — the cloud's "duplicate
+  environment", staging → production; needs the reference walk (parent
+  links, version pointers, refs, paths, asset ids in trees, fields and
+  richtext) the eject avoids by keeping IDs. *(2026-09-28, export/import)*
+- Every op call with a junk token costs one `auth.getUser` against the
+  auth project; rate limiting is the session-model spec's (OQ 20). *(2026-09-26, security pass)*
+- The social image URL goes through the default `next` loader at 1200px;
+  the cloud's transform loader (OQ 28) should serve a real 1200×630. *(2026-09-10, page fields and SEO)*
+- A cross-origin admin needs the bridge-side editing variant (spec §3). *(2026-09-10, inline editing)*
+- Transform loaders beyond the Next default: Supabase Image
+  Transformations, imgix, Cloudflare Images (DESIGN.md OQ 28). *(2026-09-08, media library)*
+- `<SmoodlyImage>` sizes the image by the crop factor, so `sizes` picks a
+  candidate for the box, not for the framed image; a CDN loader with
+  `handlesCrop` removes the overfetch. *(2026-09-08, media library)*
 - Light/dark toggle (nav foot): the choice is stored in `localStorage`
   (`smoodly-theme`) and written as `data-theme` on the admin wrapper, never on
   the host `<html>`. It is per browser, not per editor account — a server-side
-  preference would need a place to live (`members`, or a cloud user profile).
-- `lucide-react` is now a runtime dependency, for the toggle's two icons. The
-  rest of the UI still uses the design system's unicode glyphs (↑ ↓ ⧉ × ··· ▾
-  ← ⋮⋮); swapping them for Lucide is the next step whenever it is wanted.
-- `admin/ui/theme.tsx` pulls Public Sans from Google Fonts with an `@import`.
-  Fine today; a self-hosted font (or `next/font` in the glue layer) removes the
-  third-party request and the flash before it loads.
-
-## Follow-ups (logged 2026-09-04)
-
-- Cloud-ready foundation — done, including the self-host init
-  (`create-smoodly-app`, spec 2026-09-04). Remaining from the spec: none
-  in the package. The two-mode contract suites and the isolation suite
-  run in CI in the `smoodly-supabase` job (a local stack on the runner) — if that job
-  proves flaky, the fallback is a Postgres service container applying
-  the one migration.
-- Once the policy-based published read exists, decide whether it becomes the canonical headless read path and the generated per-collection views turn optional (cloud has no views).
-- Add an index on `pages(published_version_id)`: the `page_versions` read policy's `exists` probe runs on every anon/read-key read and has no supporting index.
-- A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one.
-- **Verified and kept 2026-09-26 (security pass §3)** — Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row).
-- **Verified and kept 2026-09-26 (security pass §3)** — `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
-- The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
-- The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
-- `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.
-- `exports` has no `"./package.json"` entry, so tooling that reads a dependency's `package.json` through the exports map cannot. One line to add when something needs it.
-- `src/ref-index.ts` contains two raw NUL bytes used as key separators, which makes git show the file as binary in diffs. Replacing them with `\0` escapes would make it diffable again.
-
-## Follow-ups (logged 2026-09-03)
-
-- Empty locked zones on the site side: `renderPage` renders nothing for a locked zone with no node. A page that predates the zone shows no prefooter on the published site until an editor opens it (the editor fills and saves). Options: render the component from `sample` when the zone is empty, or fill on `createPage`/schema load server-side. Fine for now — seeded and admin-created pages both arrive filled.
-
-- Editor canvas URL mapping: now `homePageSlug` config (done 2026-09-03); remaining follow-up is a registration-declared `path` for fixed pages at arbitrary paths.
-- `serialize.ts` structural cast duplicates `PageSchema`; tighten `Registered.schema` so the cast goes.
-- Catch-all `templates` map should filter to open registrations to state its intent (unreachable today).
-- The no-database build is the real proof that routes never prerender against the stores; the unit test only stubs `next/server`. Script it (`SUPABASE_URL=http://127.0.0.1:9 npx next build` in `examples/site`, expect `ƒ /`) and add it to CI, which today runs only the package's tests and typecheck — so a regression is caught when Next changes `connection()` semantics. — Partly resolved 2026-09-26: the `browser` job builds the example site and drives it, but with a database; the no-database build is still unscripted.
-- `EditorView` split (autosave extracted 2026-09-03; the rest 2026-09-08, before the TipTap widget): `usePageLocale` (switch/add/remove, over `locale-url.ts`), `useCanvasBridge` (geometry, select/hover, `postToCanvas`, the geometry timeout), `CanvasOverlay` over `overlay-geometry.ts` (`plusButtonsFor`, pure and tested), `InsertPicker`, `Outline`, `NoticePane`. `EditorView.tsx` is ~660 lines of load, gestures, publish and layout. Remaining seam: the inspector's field form (`FieldWidget` rows plus the tabs) stays put until inline editing lands (DESIGN.md §3 puts TipTap in the canvas, not the sidebar). The ref-option loading became `forms/useRefOptions.ts` (2026-09-17). (logged 2026-09-06, updated 2026-09-08)
+  preference would need a place to live (`members`, or a cloud user profile). *(2026-09-05)*
+- Once the policy-based published read exists, decide whether it becomes the canonical headless read path and the generated per-collection views turn optional (cloud has no views). *(2026-09-04)*
+- A malformed `space_id`/`key_id` claim raises `22P02` inside the policy: fails closed but surfaces as a 500. Only reachable from a validly-signed key, so it is a cloud key-minting guard, not a request-path one. *(2026-09-04)*
+- **Verified and kept 2026-09-26 (security pass §3)** — Authorization trusts the JWT claims alone; `smoodly_space_key_revoked()` checks only `revoked_at`. When cloud key-minting exists, make it a full key check (the claims must match the `space_keys` row). *(2026-09-04)*
+- **Verified and kept 2026-09-26 (security pass §3)** — `memberOf` and `SupabaseMemberStore` read `members` (and `spaces`) with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project. *(2026-09-04)*
+
+## Notes for maintainers
+
+- The live suites wipe `members` and the content tables; a pane walk after
+  them needs `npm run reseed` (or `scripts/demo-editor.ts`) first. *(2026-09-26, concurrency)*
+- Drafting version N+1: `npx tsx scripts/emit-migration.ts` prints the
+  whole schema plus the upsert; keep only the delta, name the file with
+  the current UTC stamp and `_smoodly_v<N+1>.sql`, bump `SCHEMA_VERSION`,
+  run `npm run db:migrate` at the root so the repo copy follows, and
+  `npm run check:migrations`. Additive only; a contraction waits for the
+  compatibility window and carries `-- smoodly:contraction`. *(2026-09-26, schema migrations)*