smoodly 0.0.4 → 0.0.5

package/README.md

@@ -41,26 +41,69 @@ Implemented:
   `coreTablesSQL` emits the once-ever core tables including `entries`
   (`collection` + `fields`/`i18n` jsonb, `space_id` multi-tenancy with
   a default space for self-hosted, `sort` for manual ordering, ONE
-  generic slug-uniqueness index across all spaces and collections);
+  generic slug-uniqueness index across all spaces and collections,
+  scoped to siblings — `(space_id, collection, parent_id, slug)`, like
+  pages, partial on a non-null slug);
   `collectionSQL` emits only the disposable per-collection guardrails —
   a published-only read view over `entries` (typed casts, snake_case
   aliases, refs as plain id values) and partial btree indexes for
-  declared orderBy fields
-- `PageStore` contract + `MemoryPageStore` — draft/publish semantics
-  (versions accumulate; publish moves a pointer; drafts never leak into
-  published reads). The contract is a reusable suite
-  (`test/page-store-contract.ts`); every adapter runs the same tests.
-- `SupabasePageStore` — the Supabase adapter over pages/page_versions
-  (a server-side client from `createSmoodlyClient`: the service role in
-  self-host, a write key in the cloud). Contract-tested against a
-  real local stack: `supabase start` at the repo root (the generated
-  DDL is its one migration), then `npm run test:supabase`; plain
-  `npm test` skips it and never needs Docker.
+  the declared `order.by` field, on the jsonb VALUE (`("fields"->'x')`)
+- `PageStore` contract + `MemoryPageStore` — id-keyed page persistence:
+  every read and write takes the record's `id`, and the URL is derived
+  from the tree, never stored on the record. Pages form a tree (`parentId`,
+  sibling `sort`, a null `template` = folder, `pages.tree.depth` capping
+  how deep editors may nest), carry a `title` and a per-locale `i18n`
+  overlay, and expose `rename` (per-locale slug/title), `move`,
+  `setTemplate`, `resolvePath(locale, path)` and `pathsOf(id)` alongside
+  the draft/publish semantics (versions accumulate; publish moves a
+  pointer; drafts never leak into published reads). The contract is a
+  reusable suite (`test/page-store-contract.ts`); every adapter runs the
+  same tests.
+- `SupabasePageStore` — the same id-keyed contract over
+  pages/page_versions/paths (a server-side client from
+  `createSmoodlyClient`: the service role in self-host, a write key in
+  the cloud). Contract-tested against a real local stack: `supabase
+  start` at the repo root (the generated DDL is its one migration), then
+  `npm run test:supabase`; plain `npm test` skips it and never needs
+  Docker.
+- `paths.ts` — the ONE place a URL is derived: pure, framework-free
+  functions (`segmentFor`, `chainOf`, `pagePath`, `pagePathRows`,
+  `entryPathRows`, `buildPageTree`, segment and depth assertions) that both
+  adapters and the tree query call, so the index and every derived `path`
+  agree by construction. `pagePath` is the single page-path derivation —
+  `pagePathRows`, `buildPageTree` and the site layer all go through it.
+- `PathIndex` — the derived URL index, `MemoryPathIndex` and
+  `SupabasePathIndex` over the `paths` table ((space, locale, path) → page
+  or entry). Pages and entries share ONE instance, so a page and an entry
+  can never claim the same URL; the Supabase adapter rewrites a whole
+  subtree in one statement through the `smoodly_rewrite_paths` SQL
+  function, and a collision surfaces as "the path … is already taken".
+- Collections declare their own URL shape: `path` (the code-owned base
+  segment, per locale — absent = the collection has no URLs), `tree`
+  (entries nest under entries up to a depth), and `order` (`"manual"` or
+  `{ by, direction }`, replacing `admin.orderBy` and driving both the
+  store's list order and the generated index). A declared field orders by
+  its jsonb VALUE, so numbers sort numerically and strings — ISO dates
+  included — alphabetically, the same in Supabase as in memory.
+- `smoodly.entryPage(collection, View)` — a paired component registered
+  like a page (`kind: "entryPage"`, name `entry:<collection>`), served for
+  every entry of the collection by the catch-all through
+  `renderSmoodlyPath`.
 - `resolveTree` — the batched ref-resolution pass: one fetch per
   collection per round, ref-site depth modes (bare ref = entry only,
   `.resolve(names)` = named refs one level, bare `.resolve()` = whole
   chain), per-path cycle cutting with shallow copies, optional `maxDepth`
   safety valve (default unlimited)
+- `resolveFields` — the same pass over ONE entry's fields against its
+  collection's descriptors, for the entry-page route: the shared task
+  collection and batched rounds are factored out, so a ref site behaves
+  identically whether it sits in a page tree or in an entry.
+- `localize.ts` — per-field locale fallback over the two overlays the
+  stores carry: `titleFor` (a page's `i18n[locale].title`, else the default
+  locale's), `localizeFields` (an entry's `i18n[locale]`, per field, with a
+  blank overlay value falling back) and `fixedPathFor` (the path a fixed
+  page registration is served at in one locale — the escape hatch's
+  addressing). Slugs stay `paths.ts`'s business.
 
 - `collectEntryRefs` / `collectTreeRefs` — the refs-index feeders: walk
   an entry or a page tree against its schemas and list every outgoing
@@ -70,9 +113,13 @@ Implemented:
   every `saveDraft`/`publish`, so cross-kind safe-delete holds while
   either tree shows an entry. Publish integrity: `publish` walks the
   draft tree directly and blocks on missing/unpublished entries.
-  Revalidation fan-out: `affectedPageSlugs` — reverse BFS over refs
+  Revalidation fan-out: `affectedTargets` — reverse BFS over refs
   (entry ← entry ← page, cycle-safe, optional `maxDepth`) returning
-  published slugs for the Next glue to `revalidateTag`. All wired via
+  `{ pageIds, entryIds }`: every PUBLISHED page whose tree reaches the
+  changed entry, and the entry itself plus every entry that references it.
+  Ids, not slugs — `pageTag(id)`/`entryTag(id)` name the cache tags, and
+  the op handler's `revalidate` effect passes each to Next's `updateTag`,
+  so a rename never orphans a tag. All wired via
   store constructor options (`sections`, `entries`, shared
   `MemoryRefIndex` in memory); the cross-store contract
   (`test/page-refs-contract.ts`) runs against memory AND Supabase.
@@ -84,6 +131,9 @@ Implemented:
   published-route read — a post-publish demotion resolves as missing
   instead of leaking draft fields — DESIGN.md §3 "Page edges in refs"), deletes are blocked while
   referenced,
+  entry slugs are unique among SIBLINGS in both adapters (the same rule
+  pages have: `/docs/guide-a/intro` and `/docs/guide-b/intro` coexist,
+  a slug-less entry never conflicts),
   and `reorder` rewrites sort 1..N through the `smoodly_reorder` SQL
   function (one statement, `updated_at` untouched). Same
   reusable-contract pattern as PageStore; `npm run test:supabase` runs
@@ -91,7 +141,12 @@ Implemented:
 
 - Proven end-to-end in `examples/site` — a real Next.js app wiring the
   config + Supabase stores into routes: tag-cached resolved trees,
-  draft-mode preview, server-action writes with revalidation fan-out
+  draft-mode preview, server-action writes with revalidation fan-out.
+  The example is the multilingual layout (next-intl, `en`/`fi`, the site
+  under `app/[locale]/`, the admin outside it), and `create-smoodly-app`
+  generates both of its templates from it — `templates/next-intl`
+  verbatim, `templates/next` with the four single-language route files
+  from `variants/single/` and two rewritten lines of glue
 
 - The space layer (spec 2026-09-04 §3): `space_id` on every content
   table, `smoodly_current_space()`, the insert trigger, the row cap, the
@@ -137,19 +192,86 @@ Implemented:
   `examples/site/app/(smoodly)/admin` against the local Supabase stack —
   see its README's acceptance walk.
 
-- `smoodly/next` — `createPageRenderer`, the site-route seam: draft
-  branch, tag-cached published read, ref resolution, 404 and editor
-  bridge behind one `renderSmoodlyPage(Page, { slug?, searchParams? })`,
-  plus `smoodlyMetadata` for `generateMetadata`. Both await Next's
-  `connection()` before reading the stores, so a fixed-slug route is
-  request-rendered without a `force-dynamic` export and `next build`
-  never reaches the database (`test/next-page-renderer.test.tsx`). Bound
-  once by the app, like `createAdminOpHandler`. Page schemas may declare a fixed `slug`
-  (a singleton owned by one route file); the admin reads it to filter
+- The admin is the page TREE (spec 2026-09-05 §7): the ops seam addresses
+  pages by id — `pages.list`/`get`/`create`/`saveDraft`/`publish`/
+  `delete`/`rename`/`move`/`setTemplate`, plus `entries.move`.
+  `pages.list` materializes the code-owned root nodes before an editor
+  touches them (`admin/fixed-nodes.ts` derives fixed pages and collection
+  mounts from the registry, never from a column), and every guard asks
+  the same `fixedNodeOf`: a fixed node is never renamed, moved or
+  deleted, and no page is created under a mount, and a `homePageSlug`
+  guard keeps the site root from being deleted, moved or re-slugged
+  even without a fixed registration. `pages.get` returns the
+  record, its draft, `paths` (locale → CMS path) and `urls` (`href`
+  applied), so the canvas and "View live" get site URLs. A tree write
+  expires the neighbours whose cached units embed it: publish and delete
+  the record and its parent, rename the subtree and its parent, move the
+  subtree plus the old and the new parent; `entries.move` expires the
+  entry and its descendants. The Pages list IS that tree — `admin/shell/pages-tree.ts`
+  is the pure view model (indent per depth, chevron on parents, the
+  derived path as the Path column, and per row its kind, status, sibling
+  position and whether it may take children), rendered by
+  `admin/shell/PagesList.tsx` with a row menu over the tree ops (New
+  subpage, New subfolder, Add page here, Rename…, Move up / Move down,
+  Delete, and Edit index page on a mount a fixed page claims). The editor
+  is keyed by id, with a locale switcher pointing the canvas at
+  `urls[locale]` and, while no block is selected, page settings
+  (`admin/editor/PageSettings.tsx`: title and slug per locale through
+  `pages.rename`; SEO/meta fields stay OQ #17). The entry form prefixes
+  its slug field with the collection's mount path. The serialized
+  registry carries `collections[].path`/`depth`, `pages[].slugs` and
+  `pageDepth`, and `defineConfig` validates `homePageSlug` — a real
+  segment, and never a collection's mount.
+
+- `createSmoodlySite` — the site layer (`site.ts`), framework-free: one
+  place turns a (locale, path) into a loaded page or entry, so the Next
+  renderer and the content API can never disagree about published-only
+  reads, folders or fallback. `locate(locale, path)` is one primary-key
+  hit on the `paths` index; `load(target, locale, path, { draft? })`
+  fetches the record and its tree (draft or published), resolves refs,
+  applies the `i18n` overlays, and returns a `SitePage` — `record`,
+  `template`, `tree`, localized `title`, `path`, `ancestors`, `children`,
+  and `paths` (locale → path, for alternates) — or a `SiteEntry` with the
+  entry's fields localized and resolved. `resolve(locale, path, { draft? })`
+  is the two in sequence — `locate` then `load` — for a caller that just
+  wants the hit. A folder (null template), an
+  unpublished record outside draft mode, or a missing one is `null`.
+  On top of it the published-only content API for menus, sitemaps and
+  custom routes: `getPagesTree({ locale })` (nested
+  `{ id, title, path, hasPage, children }`), `getPage(pathOrId)`,
+  `getEntries(collection, { locale, parent?, order? })`,
+  `getEntry(collection, idOrPath)` (an id, a path, or a bare slug naming a
+  root entry) and `getEntriesTree(collection)`.
+- `smoodly/next` — `createPageRenderer`, the site-route seam over that
+  layer, bound once by the app like `createAdminOpHandler`. The two route
+  files call `renderSmoodlyPath(segments, { locale?, searchParams? })` and
+  `smoodlyMetadata(segments, { locale? })`: a page at any depth in any
+  locale rendered by the shape its `template` names, with the `page` prop
+  (`{ id, title, path, url, ancestors, children }`, every ancestor and
+  child carrying `url` beside its locale-relative `path`, both put through
+  the `href` seam) beside `zones`; a collection
+  entry rendered by its `smoodly.entryPage` as `{ entry, path }`; a folder,
+  an absent locale or an unregistered template a 404. The published read is
+  cached per (locale, path) and tagged `page:<id>` / `entry:<id>` — the
+  `locate` hit runs outside the cache, because the tag needs the id first.
+  Draft mode reads drafts uncached, and the editor param mounts
+  `EditorBridge`. Metadata is the tree's `meta` plus
+  `alternates.languages`, built through the injectable `href(path, locale)`
+  seam (identity by default, `getPathname` with next-intl) and emitted only
+  for a multi-locale site. `renderSmoodlyPage(Paired, …)` and
+  `smoodlyPageMetadata` remain as the escape hatch for a FIXED page
+  rendered from the developer's own route file; each serves only its own
+  registration's record. All four await Next's
+  `connection()` before reading the stores, so a route with no dynamic
+  segment is request-rendered without a `force-dynamic` export and
+  `next build` never reaches the database
+  (`test/next-page-renderer.test.tsx`). Page schemas may declare a fixed `slug`
+  (owned by code, not by editors); the admin reads it to filter
   New Page and protect the record. `defineConfig({ homePageSlug })`
-  (default `"home"`) names the slug the site root serves; the admin's
-  `pagePath()` maps it to `/` — canvas URL and Pages list — and every
-  other slug to `/<slug>`.
+  (default `"home"`) names the slug the site root serves; the paths index
+  derives every URL from it, and `pages.get(id)` hands the admin the
+  finished `paths` (locale → CMS path) and `urls` (`href` applied), so the
+  admin no longer derives a path of its own.
 
 - Locked zones are usable: `fillLockedZones` (a pure tree op) materializes
   the one node of every empty locked zone from the component's `sample`
@@ -160,9 +282,11 @@ Implemented:
 
 Not yet: richtext components (TipTap; `plainToRichtext`/
 `richtextToPlain` exist but no rich editor widget), drag-and-drop
-reordering (move-up/move-down buttons only), undo/redo, sample/
-placeholder content marking, editor localization (the
-locale switcher — examples/site is single-locale so it stays hidden).
+reordering (move-up/move-down buttons in the editor, Move up / Move down
+in the Pages list's row menu), undo/redo, sample/placeholder content
+marking, per-locale section field values (OQ #3 — the editor's locale
+switcher moves the canvas and page settings between locales, but a
+section's fields are one set for every locale).
 
 ## Releasing
 
@@ -178,6 +302,259 @@ Both packages move together. From the repo root:
 `examples/site` in that build, so the template always matches the example
 site at the tagged commit.
 
+## Follow-ups (logged 2026-09-06)
+
+- Drag-and-drop in the Pages list — the ops it needs exist
+  (`pages.move(id, { parentId, index })`); the row menu's Move up / Move
+  down is the interim.
+- Nested entries have no admin UI beyond `entries.move`: nothing creates
+  a child entry or shows the entry tree, and the entry form's slug prefix
+  is the collection's mount base only, not the parent chain.
+- A blank translated slug cannot be CLEARED from the settings panel: the
+  panel skips an empty non-default value (a blank falls back to the
+  default locale) and the store reads `slug: undefined` as "no change",
+  so removing an existing override would need a `null` patch through
+  `rename`.
+- SEO/meta fields in page settings — DESIGN.md OQ #17. Title and slug per
+  locale shipped; nothing writes `PageTree.meta` yet.
+- `pages.get` makes three sequential store round trips (`getPage`,
+  `getDraftTree`, `pathsOf`), and the editor calls it on load and after
+  every rename — one store call returning the three would halve the
+  editor's latency.
+- `entries.move` expires the entry and its descendants but does not fan
+  out to the pages referencing them, nor to the old and the new parent
+  entries the way `pages.move` does — asymmetric with `entries.save` and
+  `entries.setStatus`, which both fan out.
+- The row menu's item set (`menuItems`) and the row-click routing live in
+  `PagesList.tsx`, untested; extract them into `pages-tree.ts` before
+  plan 4 adds entry rows to the same menu.
+- The shell derives the fixed nodes a second time, over the serialized
+  registry (`mountOf` / `isFixedNode` in `pages-tree.ts`), beside the
+  server's `fixedNodeOf` — one derivation shipped to the client would do.
+- The locale switcher points the canvas at `urls[locale]`, and `href` is
+  identity in the example, so every path serves the default locale: a
+  page with a translated slug shows a 404 in the canvas for that locale
+  until next-intl is wired (plan 4). **Done 2026-09-06** — `href` is
+  `getPathname` in the example now; the canvas loads
+  `/fi/yritys/tietoa-meista?smoodly-editor=1` and renders (walked in
+  `examples/site/README.md`).
+- Page settings prints `paths[locale]` under each slug field — the
+  locale-relative CMS path, not `urls[locale]`, the site URL the canvas
+  and "View live" actually open. On a translated site the Finnish hint
+  reads `/yritys/tietoa-meista` while the page lives at
+  `/fi/yritys/tietoa-meista`. Both maps are already in `EditorView`;
+  which one belongs under the field is a UI decision, not a missing
+  value.
+- `ensureFixedNodes` runs on every `pages.list` and every ROOT
+  `pages.create` — one `listPages()` each, and a second one when it
+  tried to create something. It also treats a root record sitting at a
+  fixed slug as that node even when its `template` is a foreign one: the
+  node is adopted, never recreated, and the ops then guard it as
+  code-owned.
+- Two admins loading at once race on materialization. Any spec whose
+  create fails is warned about and skipped, not fatal to the rest of the
+  list — except the loser's `slugTaken`, which means the other admin won
+  the same race: that one message is swallowed on purpose, silently,
+  with no warn.
+- The `smoodly_reorder` / `smoodly_reorder_pages` RPCs keep their
+  implicit sibling scope (decided 2026-09-06: every caller passes exactly
+  one sibling set). A parent argument waits for a caller that needs it.
+- The row menu in `PagesList.tsx` does not close on Escape — only a click
+  on the backdrop closes it.
+- `PageSettings` re-seeds its inputs from `record` on every rename (and
+  every publish), so keystrokes typed while a rename is in flight can be
+  dropped. The blur- and Enter-driven commits themselves are unaffected.
+- `subtreeIds` and `entrySubtreeIds` in `ops-impl.ts` are the same O(n²)
+  walk over a full list, written twice. One generic descendant walk when
+  the list sizes make it matter.
+- `publish`'s "has no draft to publish" branch is unreachable with the
+  memory store — `createPage` gives every templated page a first version
+  — and is untested. It is defence for the Supabase adapter.
+- Classifications the ops tests do not assert: a move that breaks the
+  home page's no-children rule or exceeds the tree depth (create asserts
+  both), and `entries.move`'s cross-collection and sibling-slug guards.
+  `MemoryEntryStore.move` has no children guard at all — the subtree
+  rides along — so `has child` is reachable from delete only.
+- The seed's early exit still probes `/` alone: a run that dies between
+  the two publishes reports "Already seeded" on the next run and never
+  gets its `company` folder.
+- `create-smoodly-app` scaffolds now ship `pages: { tree: { depth: 3 } }`
+  — the template build rewrites only the locale set in `smoodly/config.ts`
+  and `href` in `smoodly/server.ts` (each with its comment) — so nesting
+  is on by default in a fresh app.
+- A childless folder row is inert on click (a mount opens its collection,
+  a page opens the editor, a folder with children expands); "Add page
+  here" lives in the row menu only.
+- The tree rows nest interactive buttons — the chevron and the `···`
+  menu — inside a `role="button"` row. It works, because both stop the
+  click and the keydown, but it is an accessibility smell a real treegrid
+  would not have.
+- `EditorView.tsx` is ~720 lines. The inspector and the canvas column are
+  the extraction seam whenever it is next touched.
+- `i18n/request.ts` returns `{ locale, messages: {} }`. next-intl 4.14.2
+  throws `No messages found` when the provider inherits none, and the
+  example has no UI strings of its own, so the object is empty; a
+  scaffolded site that translates its own UI fills it in (the comment in
+  the file points at next-intl's configuration docs). No `messages/`
+  folder is scaffolded — UI-string translation is next-intl's job, not
+  Smoodly's.
+- `i18n/request.ts` reads `next/root-params` (next-intl's current
+  guidance; `requestLocale` is deprecated). Its real types are generated
+  into `.next/types/` by `next dev` / `next build` / `next typegen`;
+  `tsc` before a first build still passes, because `next` ships a bare
+  `declare module 'next/root-params'` for exactly that window.
+- The four single-language route files in
+  `packages/create-smoodly-app/variants/single/` are compiled by nothing
+  but the CI hosted-mode e2e's `next build` — the example is the
+  multilingual layout, so `npm test` never type-checks them. A renderer
+  or admin signature change breaks them there, a whole CI job later than
+  it should. The fix is a `tsconfig` project for `variants/` with the
+  scaffold's `@/*` paths mapped into the example, or a scaffold-then-
+  `tsc` smoke test.
+- `ArticleList` renders titles, not links. A section that linked to its
+  entries would put the entry's `path` through the app's `Link` / `href`
+  the way `components/pages/Page.tsx` does — `getEntries` returns `path`
+  already; the section simply does not use it.
+- `smoodlyMetadata` emits `alternates.languages` as relative URLs and
+  neither the example nor either template sets `metadataBase`, so the
+  rendered `hreflang` hrefs are relative (`/fi/yritys/tietoa-meista`).
+  Crawlers want absolute ones: a real site sets `metadataBase` in its
+  root layout. `next build` on the example (2026-09-06, Next 16.3.4) does
+  not warn — every route is request-rendered, so nothing resolves the
+  relative URLs at build time.
+- The proxy's matcher hard-codes `admin` and `api`
+  (`/((?!admin|api|_next|_vercel|.*\..*).*)`). An app that mounts the
+  admin somewhere else edits `proxy.ts` by hand; nothing derives the
+  matcher from the config.
+
+## Follow-ups (logged 2026-09-05)
+
+- A page's cached unit embeds its ancestors' and children's titles and
+  paths (the `page` prop) but is tagged `page:<own id>` only. The admin
+  ops now expire the neighbours they change — publish and delete the
+  parent, rename and move the subtree and both parents (2026-09-06) — so
+  what remains stale is a write that does not go through them: the seed,
+  a script, any out-of-band writer. Closing that needs one tree-wide tag
+  instead of a neighbour list (DESIGN.md OQ #26).
+- The cached unit is keyed by (locale, path) but tagged by the id found at
+  the first miss, so a path that changes hands without both ids' tags firing
+  serves the previous occupant. Delete fires its own tag and the rename/move
+  fan-out covers the moving record; re-keying the unit by
+  (locale, kind, id) would remove the class (DESIGN.md OQ #26).
+- `ancestors` on a page hit are NOT filtered by locale (children are): a
+  page ancestor whose `locales` exclude `fi` (`hasPage` true) still
+  produces a breadcrumb link whose path 404s in `fi`.
+- `smoodlyMetadata` does not apply the registration check `renderSmoodlyPath`
+  applies: a record whose `template` has no registration is a 404 body with
+  its meta emitted beside it.
+- `sections` is passed twice — to `createSmoodlySite` (ref resolution) and to
+  `createPageRenderer` (the component map) — and `elements` cannot be passed
+  at all; the two lists can drift silently.
+- `getEntry` by bare slug matches `entrySegment` on the ALREADY-localized
+  entry, so the overlay is applied twice; it diverges only for a non-string
+  `i18n[locale].slug`. `getEntry` by id reads the whole collection to find
+  one row.
+- `locate` (one primary-key hit on `paths`) runs per request outside the
+  cache, because the cache tag needs the id before the unit can be cached; a
+  later `"use cache"` migration (OQ #19) can fold it in.
+- Entry-page metadata is alternates only — entries have no `meta`. A
+  `titleField`-based title is a later nicety.
+- Localized tree content (per-locale section fields) is not rendered: there
+  is no storage model for it yet (OQ #3). `title` and entry `fields` are
+  localized.
+- `getEntries`/`getEntriesTree` return refs as ids (cheap lists); `getEntry`
+  by path resolves them, `getEntry` by id or slug does not — document or
+  unify when a site needs resolved lists.
+- `loadPage` calls `listPages()` for ancestors and children on every cache
+  miss; fine for hundreds of nodes, a `children(id)`/`chain(id)` store query
+  is the fix when a site outgrows it.
+- Views rendered outside the site get `EMPTY_PAGE_CONTEXT`: tests and any
+  preview of a shape that isn't going through `site.load`.
+- `loadEntry` probes each mounted collection in turn: the `paths` row
+  carries the target id but not its collection.
+- A published entry under a draft parent is dropped from `getEntriesTree`
+  (the parent is not in the list to hang it from) but returned flat by
+  `getEntries`. Untested either way.
+- `SmoodlyConfig.registry.pages` (`Registered` in `src/config.ts`) has no
+  call signature, so every app's glue casts it `as PageRegistration[]`.
+- The entry-page view receives the whole `EntryRecord`, every locale's
+  `i18n` included; a client entry page would ship all of it to the browser.
+- `move` is best-effort across two statements (reorder, then path rewrite):
+  a failed rewrite restores each destination sibling's prior `sort` row by
+  row, so a failure in the rollback itself still leaves the order changed.
+- The live suites run on vitest's DEFAULT 5s per-test timeout against a real
+  database, while a single contract test makes dozens of round trips. On a
+  loaded or degraded local stack `npm run test:supabase` then fails with bare
+  timeouts on arbitrary tests (every file passes on its own, and the whole
+  run passes with `--testTimeout=30000`). Either raise the timeout in
+  `scripts/test-supabase.sh` or accept the flake in CI.
+- The `smoodly_reorder` RPC takes no parent scope — the caller always passes
+  one sibling set, so scoping is implicit. Give it a parent argument if a
+  caller ever passes a mixed list.
+- An explicit JSON `null` VALUE in a declared `order.by` field sorts
+  FIRST in Supabase (a jsonb null is the lowest jsonb value, not SQL
+  NULL, so `nullsFirst: false` does not reach it) and LAST in memory. A
+  MISSING key is SQL NULL and sorts last in both, and the admin only ever
+  produces that — a cleared number field emits `undefined`, which the
+  JSON body drops — so this needs a programmatic or external writer.
+  Mixed types in one field diverge for the same reason: Postgres orders
+  jsonb by type first (null < string < number), memory by `String(...)`.
+- Rollback gaps that remain: a `smoodly_reorder`/`smoodly_reorder_pages`
+  failure AFTER the re-parent update has no rollback at all; the entry
+  `create` rollback discards its delete result (an orphan row survives
+  silently); and a throw inside any rollback replaces — masks — the original
+  error.
+- Duplicate sibling `sort` values are reachable — create uses count + 1 while
+  delete and move leave gaps — so `sort` is an ordering hint and creation
+  order breaks ties.
+- Folders have path rows and resolve as `kind: "page"`; the published-only
+  read policy makes them public 404s, while the admin (write key) sees them.
+- `setTemplate`/`saveDraft` insert the version row before the pointer update:
+  an infra failure between the two orphans a version.
+- No `rebuildPaths()`: the index is documented as derived and rebuildable, but
+  nothing rebuilds it.
+- Two `entryPage` registrations for one collection are silently accepted.
+  `PageStore.rename` still accepts a locale outside `supported`; the admin
+  op rejects it first, so only a direct store caller reaches it.
+- Entry `move` coverage is thinner than pages' — no omitted-index, clamp or
+  cross-collection tests.
+- The memory stores default to SEPARATE private path indexes while the
+  Supabase stores share one `paths` table: pages and entries share a URL space
+  only when the wiring passes one `paths` option to both (convention, not
+  structure).
+- `SupabasePathIndex` falls back to `pathTakenError("?", "?")` when
+  Postgres reports a unique violation without `details` — the message then
+  names no path.
+- `chainOf` has no cycle guard: a corrupted `parent_id` loop would spin
+  forever. The stores prevent cycles on `move`, so it is unreachable today.
+- `EntryRecord.i18n` has no writer yet — the store reads and derives paths
+  from it, but nothing sets it, so per-locale entry slugs are unreachable
+  until the ops layer exposes them.
+- Design system pass (DESIGN.md §2, "The admin's visual system"): the shell,
+  lists, entry form, login and editor were restyled onto `admin/ui/theme.tsx`.
+  Deferred deliberately, because each is a feature rather than a restyle: the
+  list search field and status filter, the locale select in the shell's top bar
+  (the editor has one; the lists always read the default locale), the article
+  sidebar's taxonomy/SEO/publish-date sections, and the rich-text toolbar. The
+  pages list's tree shape (chevrons, depth indent) and its row `···` menu
+  shipped 2026-09-06, without the drag handle. The tokens for all of them are
+  already in place.
+- The `scroll` message in `admin/editor/protocol.ts` is no longer sent: with the
+  canvas column as the scroller, `EditorView` scrolls it directly instead of
+  asking the bridge to `scrollIntoView` across the frame. `EditorBridge` still
+  handles the message, so old and new admins interoperate; drop the message on
+  the next protocol change.
+- Light/dark toggle (nav foot): the choice is stored in `localStorage`
+  (`smoodly-theme`) and written as `data-theme` on the admin wrapper, never on
+  the host `<html>`. It is per browser, not per editor account — a server-side
+  preference would need a place to live (`editors`, or a cloud user profile).
+- `lucide-react` is now a runtime dependency, for the toggle's two icons. The
+  rest of the UI still uses the design system's unicode glyphs (↑ ↓ ⧉ × ··· ▾
+  ← ⋮⋮); swapping them for Lucide is the next step whenever it is wanted.
+- `admin/ui/theme.tsx` pulls Public Sans from Google Fonts with an `@import`.
+  Fine today; a self-hosted font (or `next/font` in the glue layer) removes the
+  third-party request and the flash before it loads.
+
 ## Follow-ups (logged 2026-09-04)
 
 - Cloud-ready foundation — done, including the self-host init
@@ -193,7 +570,7 @@ site at the tagged commit.
 - `isEditor` reads `editors` with no space filter: under a cloud write key RLS scopes it, but a service-role client bypasses RLS and would admit an editor of any space. Harmless in self-host (one space); never use a service-role client against the shared content project.
 - The `sb_secret_` branch of `clientOptions` (secret key as the sole `apikey`, no bearer) was exercised live on 2026-09-05 against a hosted project: PostgREST reads with the service-role template and the GoTrue admin API (`listUsers`, `createUser`) both accept it; a password sign-in with the matching `sb_publishable_` key returns a session. Unit tests still cover the shape only; the local stack stays on legacy JWT keys.
 - The migration is not re-appliable to a pre-rename (`project_id`) database: `create table if not exists` leaves it untouched and the `space_id` policies then fail. No installs predate the rename; fold into DESIGN.md OQ #2 (schema upgrades).
-- `examples/site/lib/smoodly/index.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.
+- `examples/site/smoodly/server.ts` should carry `import "server-only"` now that it also exports `publicAuth` — a client-side import would fail loudly at build instead of at runtime.
 - `exports` has no `"./package.json"` entry, so tooling that reads a dependency's `package.json` through the exports map cannot. One line to add when something needs it.
 - `src/ref-index.ts` contains two raw NUL bytes used as key separators, which makes git show the file as binary in diffs. Replacing them with `\0` escapes would make it diffable again.
 
@@ -203,9 +580,6 @@ site at the tagged commit.
 
 - Editor canvas URL mapping: now `homePageSlug` config (done 2026-09-03); remaining follow-up is a registration-declared `path` for fixed pages at arbitrary paths.
 - `serialize.ts` structural cast duplicates `PageSchema`; tighten `Registered.schema` so the cast goes.
-- Pages list: no re-entrancy guard on a fast double-click of "New page" / a not-created row, and the row `onClick` promise is unhandled (a transport throw is an unhandled rejection); fix both together with a `.catch` → alert.
-- `pagesRows`: pin with a test the case of a record at a fixed slug whose `template` is an open registration (self-healing today: `/` 404s, `/<slug>` serves it, delete is allowed, then the singleton row reappears).
 - Catch-all `templates` map should filter to open registrations to state its intent (unreachable today).
 - The no-database build is the real proof that routes never prerender against the stores; the unit test only stubs `next/server`. Script it (`SUPABASE_URL=http://127.0.0.1:9 npx next build` in `examples/site`, expect `ƒ /`) and add it to CI, which today runs only the package's tests and typecheck — so a regression is caught when Next changes `connection()` semantics.
-- Next acceptance walk: start from a database with no `home` record so the "not created" singleton row is exercised.
 - `EditorView` split, remaining seams (autosave extracted 2026-09-03): pull the canvas overlay and the insert picker into components when the dnd-kit outline work starts; the sidebar form stays put until inline editing lands (DESIGN.md §3 puts TipTap in the canvas, not the sidebar).

package/dist/admin/client-ops.js

@@ -1,6 +1,6 @@
 const GROUPS = {
-    pages: ["list", "get", "create", "saveDraft", "publish", "delete"],
-    entries: ["list", "get", "create", "save", "setStatus", "delete"],
+    pages: ["list", "get", "create", "saveDraft", "publish", "delete", "rename", "move", "setTemplate"],
+    entries: ["list", "get", "create", "save", "setStatus", "delete", "move"],
     preview: ["enable", "disable"],
 };
 export function makeClientOps(action, token) {

package/dist/admin/editor/EditorView.d.ts

@@ -1,7 +1,8 @@
 import type { AdminOps } from "../ops.ts";
 import type { AdminRegistry } from "../serialize.ts";
-export declare function EditorView({ ops, registry, slug }: {
+export declare const withEditorParam: (url: string) => string;
+export declare function EditorView({ ops, registry, id }: {
     ops: AdminOps;
     registry: AdminRegistry;
-    slug: string;
+    id: string;
 }): import("react").JSX.Element;