smoodly 0.0.46 → 0.0.47

package/dist/admin/health.d.ts

@@ -13,11 +13,15 @@ export type HealthDocument = {
     collection: string | null;
     findings: HealthFinding[];
 };
+import type { DeliveryStatus } from "../project.ts";
+/** `delivery` (DESIGN §3, the document stamp): the delivery rows behind the current stamp, with the recorded one;
+ *  absent only in a report built without a projector (static tests). */
 export type HealthReport = {
     documents: HealthDocument[];
     collections: {
         name: string;
         count: number;
     }[];
+    delivery?: DeliveryStatus;
 };
 export declare function buildHealthReport(registry: AdminRegistry, pages: PageScan[], entries: EntryScan[]): HealthReport;

package/dist/admin/ops-impl.js

@@ -1311,8 +1311,8 @@ export function createAdminOps(deps) {
         },
         health: {
             scan: () => guard(async () => {
-                const [trees, rows] = await Promise.all([pages.scanTrees(), entries.scanEntries()]);
-                return ok(buildHealthReport(adminRegistry(), trees, rows));
+                const [trees, rows, delivery] = await Promise.all([pages.scanTrees(), entries.scanEntries(), projector.delivery()]);
+                return ok({ ...buildHealthReport(adminRegistry(), trees, rows), delivery });
             }),
         },
         schema: {

package/dist/admin/shell/ContentHealthPage.js

@@ -26,7 +26,9 @@ export function ContentHealthPage({ ops, registry, initial = null }) {
         return _jsx(ErrorPane, { message: error, back: false, onRetry: scan });
     const sections = report ? healthSections(report, registry) : null;
     const brokenCount = sections ? sections.broken.length + sections.collections.length : 0;
-    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: "Content health" }), right: _jsxs(_Fragment, { children: [report && _jsx("span", { className: "sm-hint", children: "Checked just now" }), _jsx(Button, { variant: "secondary", onClick: scan, disabled: !report, children: "Rescan" })] }) }), _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table sm-health", children: [!sections && _jsx("div", { className: "sm-empty", children: "Checking content\u2026" }), sections && brokenCount === 0 && sections.orphan.length === 0 && _jsx("div", { className: "sm-empty", children: "Everything matches the code." }), sections && brokenCount > 0 && (_jsxs("section", { children: [_jsxs("h2", { className: "sm-health__section", children: ["Blocks publishing \u00B7 ", brokenCount] }), sections.collections.map((c) => _jsx("p", { className: "sm-health__headline", children: c.headline }, c.name)), sections.broken.map((g) => _jsx(Group, { group: g }, g.key))] })), sections && sections.orphan.length > 0 && (_jsxs("section", { children: [_jsxs("h2", { className: "sm-health__section", children: ["Left over \u00B7 ", sections.orphan.length] }), sections.orphan.map((g) => _jsx(Group, { group: g }, g.key))] }))] }) })] }));
+    return (_jsxs(_Fragment, { children: [_jsx(TopBar, { left: _jsx("span", { className: "sm-title", children: "Content health" }), right: _jsxs(_Fragment, { children: [report && _jsx("span", { className: "sm-hint", children: "Checked just now" }), _jsx(Button, { variant: "secondary", onClick: scan, disabled: !report, children: "Rescan" })] }) }), _jsx("div", { className: "sm-listwrap", children: _jsxs("div", { className: "sm-table sm-health", children: [!sections && _jsx("div", { className: "sm-empty", children: "Checking content\u2026" }), report?.delivery && (_jsx("p", { className: "sm-health__delivery", children: report.delivery.behind === 0
+                                ? "Every published document is current."
+                                : _jsxs(_Fragment, { children: [report.delivery.behind, " ", report.delivery.behind === 1 ? "document is" : "documents are", " behind the current stamp. Run ", _jsx("code", { children: "npx smoodly rebuild" }), " in the site's folder."] }) })), sections && brokenCount === 0 && sections.orphan.length === 0 && _jsx("div", { className: "sm-empty", children: "Everything matches the code." }), sections && brokenCount > 0 && (_jsxs("section", { children: [_jsxs("h2", { className: "sm-health__section", children: ["Blocks publishing \u00B7 ", brokenCount] }), sections.collections.map((c) => _jsx("p", { className: "sm-health__headline", children: c.headline }, c.name)), sections.broken.map((g) => _jsx(Group, { group: g }, g.key))] })), sections && sections.orphan.length > 0 && (_jsxs("section", { children: [_jsxs("h2", { className: "sm-health__section", children: ["Left over \u00B7 ", sections.orphan.length] }), sections.orphan.map((g) => _jsx(Group, { group: g }, g.key))] }))] }) })] }));
 }
 function Group({ group }) {
     const adminHref = useAdminHref();

package/dist/cli/migrate.d.ts

@@ -29,5 +29,15 @@ export type MigrateDeps = {
     env?: Record<string, string | undefined>;
     /** Test seam: replaces the database read behind the key check. */
     readKey?: (env: Record<string, string | undefined>) => Promise<SchemaRead>;
+    /** Test seam: the delivery rows behind the site's document stamp (DESIGN §3); default: the app's config, loaded, against the key's space. */
+    delivery?: (env: Record<string, string | undefined>, cwd: string) => Promise<{
+        behind: number;
+        total: number;
+    }>;
 };
+/** The delivery line of `--check` (DESIGN §3, the document stamp): a count with the one command to run, never a verdict. */
+export declare const deliveryLine: (d: {
+    behind: number;
+    total: number;
+}) => string;
 export declare function runMigrate(args: MigrateArgs, out: (line: string) => void, deps?: MigrateDeps): Promise<number>;

package/dist/cli/migrate.js

@@ -15,6 +15,10 @@ import { resolveSmoodlyEnv } from "../env.js";
 import { loadAppEnv } from "./space-io.js";
 import { planIsEmpty, planMigrate } from "../migrations.js";
 import { loadCollections } from "./load-collections.js";
+import { loadConfig } from "./load-config.js";
+import { siteOptions } from "../bind.js";
+import { documentStamp } from "../document-stamp.js";
+import { SupabasePublishedStore } from "../supabase-published-store.js";
 export const DEFAULT_COLLECTIONS = "smoodly/collections.ts";
 /** The Astro starter keeps the setup under src/ (plan 2026-10-06 astro adapter 3); the default follows it when the Next path is absent. */
 export function collectionsFile(cwd, given, exists = existsSync) {
@@ -47,6 +51,16 @@ export function describePlan(plan, check) {
     }
     return lines;
 }
+/** The delivery line of `--check` (DESIGN §3, the document stamp): a count with the one command to run, never a verdict. */
+export const deliveryLine = (d) => d.behind === 0
+    ? `Delivery: every published document is current (${d.total}).`
+    : `Delivery: ${d.behind} of ${d.total} documents are behind the current stamp — run npx smoodly rebuild.`;
+async function countDelivery(env, cwd) {
+    const config = await loadConfig(cwd);
+    const stamp = documentStamp(siteOptions(config, () => { throw new Error("smoodly: the stamp reads no store"); }));
+    const db = createSmoodlyClient(resolveSmoodlyEnv(env));
+    return new SupabasePublishedStore(db, config.registry.collections ?? []).countBehind(stamp);
+}
 /** Errors that are a verdict on the env itself, not on the network: they fail the build. */
 const ENV_VERDICT = /SMOODLY_(SECRET|PUBLISHABLE)_KEY|SMOODLY_URL "/;
 /** The build's key check (decided 2026-10-02): a key the site would be refused with fails the
@@ -72,8 +86,15 @@ async function checkKey(out, cwd, deps) {
         out(`Key not checked: ${message}`);
         return 0;
     }
-    if ("version" in read)
+    if ("version" in read) {
         out(keyChecked(read.version));
+        try {
+            out(deliveryLine(await (deps.delivery ?? countDelivery)(env, cwd)));
+        }
+        catch (e) {
+            out(`Delivery: not checked: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
     else if (read.missing === "key") {
         out(secretKeyRefusedMessage);
         return 1;

package/dist/cli/space-io.js

@@ -45,10 +45,10 @@ export { readSchemaVersion } from "../schema-read.js";
  *  the site built from the config as the app's glue builds them, then every page and entry. */
 export async function rebuildSpace(db, config) {
     const { pages, entries, assets, published } = createSupabaseStores(db, config);
-    const { projector, cacheKey } = createSmoodlySite(siteOptions(config, () => ({ pages, entries, assets, published })));
+    const { projector, stamp } = createSmoodlySite(siteOptions(config, () => ({ pages, entries, assets, published })));
     const names = [...(config.registry.collections ?? []), ...(config.registry.globals ?? [])].map((c) => c.name);
-    // The model fingerprint every row now carries: what a rebuild after a deploy wrote.
-    return { ...(await projectAll({ stores: { pages, entries }, projector, names })), model: cacheKey };
+    // The document stamp every row now carries, recorded as the space's current one (DESIGN §3).
+    return { ...(await projectAll({ stores: { pages, entries }, projector, names })), model: stamp };
 }
 /** The line a rebuild ends with. */
 export const rebuiltMessage = (counts) => `Rebuilt the delivery tables: ${counts.pages} ${counts.pages === 1 ? "page" : "pages"}, ${counts.entries} ${counts.entries === 1 ? "entry" : "entries"}.`;

package/dist/document-stamp.d.ts

@@ -0,0 +1,7 @@
+import type { SiteOptions } from "./site.ts";
+/** Bumped by hand when the assembler's output changes shape; the upgrading guide names each bump. */
+export declare const DOCUMENT_FORMAT = 1;
+/** The parts of the registry that reach a document: what `cacheKey` hashes, minus the presentation. */
+export declare function documentModel(options: SiteOptions): unknown;
+/** `<format>:<model hash>` — what a delivery row's `model` column holds. */
+export declare function documentStamp(options: SiteOptions): string;

package/dist/document-stamp.js

@@ -0,0 +1,48 @@
+// The stamp a delivery row carries (DESIGN §3, the document stamp, 2026-10-08): which document format and
+// which content model built it. Not the cache key: the package version is in that one, not here, because a
+// release that leaves documents alone must leave them alone.
+import { modelKey } from "./model-key.js";
+import { schemaOf } from "./registration.js";
+/** Bumped by hand when the assembler's output changes shape; the upgrading guide names each bump. */
+export const DOCUMENT_FORMAT = 1;
+/** Schema keys that reach the admin only: a change to one leaves every document as it was. */
+const PRESENTATION = new Set(["title", "description", "sample", "icon", "preview", "group", "admin"]);
+/** A field descriptor without the parts that reach the admin only (a hidden condition decides what the editor shows). */
+function fieldModel(field) {
+    if (!field || typeof field !== "object")
+        return field;
+    const { hidden: _hidden, ...rest } = field;
+    return Object.fromEntries(Object.entries(rest).map(([k, v]) => [k, k === "fields" ? fieldsModel(v) : k === "of" ? fieldModel(v) : v]));
+}
+function fieldsModel(fields) {
+    if (!fields || typeof fields !== "object")
+        return fields;
+    return Object.fromEntries(Object.entries(fields).map(([k, v]) => [k, fieldModel(v)]));
+}
+/** A schema without its presentation. */
+function schemaModel(schema) {
+    if (!schema || typeof schema !== "object")
+        return schema;
+    return Object.fromEntries(Object.entries(schema)
+        .filter(([k]) => !PRESENTATION.has(k))
+        .map(([k, v]) => [k, k === "fields" || k === "settings" ? fieldsModel(v) : v]));
+}
+/** The parts of the registry that reach a document: what `cacheKey` hashes, minus the presentation. */
+export function documentModel(options) {
+    return {
+        collections: options.collections.map(schemaModel),
+        // A global whole, its presentation dropped: its settings' defaults reach a visual item's document.
+        globals: (options.globals ?? []).map(schemaModel),
+        sections: options.sections.map((x) => schemaModel(schemaOf(x))),
+        elements: (options.elements ?? []).map((x) => schemaModel(schemaOf(x))),
+        pages: options.pages.map((x) => schemaModel(schemaOf(x))),
+        locales: options.locales,
+        homePageSlug: options.homePageSlug,
+        styles: options.styles,
+        custom: options.custom,
+    };
+}
+/** `<format>:<model hash>` — what a delivery row's `model` column holds. */
+export function documentStamp(options) {
+    return `${DOCUMENT_FORMAT}:${modelKey(documentModel(options))}`;
+}

package/dist/project.d.ts

@@ -9,9 +9,12 @@ import type { SiteEntry, SitePage } from "./site.ts";
 import type { PageStore } from "./store.ts";
 /** The documents one projection writes before the rest are left to heal on read (§2). */
 export declare const PROJECTION_CAP = 100;
-/** `cap` overrides the projector's own for one call: a rebuild passes Infinity, a test a small number. */
+/** `cap` overrides the projector's own for one call: a rebuild passes Infinity, a test a small number. `write`
+ *  false (DESIGN §3, the document stamp): the rows are built but nothing is written, removed or marked — a reader
+ *  whose stamp the space did not record. Default true. */
 export type ProjectOptions = {
     cap?: number;
+    write?: boolean;
 };
 export type Projector = {
     /** Writes the delivery rows of these pages in every supported locale (a row per visible locale, removed where not visible). Returns the keys it could not fit under the cap, already marked stale. */
@@ -26,9 +29,22 @@ export type Projector = {
     healGlobal<V>(item: GlobalSchema<V>, locale: string, options?: HealOptions): Promise<V | null>;
     /** Flags rows to rebuild on their next read: what an op does with the targets of a projection that threw. */
     markStale(keys: PublishedKey[]): Promise<void>;
+    /** Records this projector's stamp as the space's current one (DESIGN §3): what a rebuild ends with. */
+    record(): Promise<void>;
+    /** The delivery tables against this stamp: how many rows are behind it, and which stamp the space recorded. */
+    delivery(): Promise<DeliveryStatus>;
 };
+/** What Content health and `migrate --check` show of the delivery tables (DESIGN §3, the document stamp). */
+export type DeliveryStatus = {
+    total: number;
+    behind: number;
+    recorded: string | null;
+    stamp: string;
+};
+/** `write` false: serve the assembled document, write and remove nothing (a reader at another stamp than the recorded one). */
 export type HealOptions = {
     seen?: boolean;
+    write?: boolean;
 };
 export type ProjectorDeps = {
     assembler: Assembler;
@@ -43,7 +59,7 @@ export type ProjectorDeps = {
     sections: SectionLike[];
     elements?: SectionLike[];
     locales: LocaleSet;
-    /** The fingerprint a row is current against: the site's cacheKey (§4). */
+    /** The stamp a row is current against: the site's document stamp (§4; DESIGN §3). */
     model: string;
     cap?: number;
 };
@@ -60,7 +76,7 @@ export type ProjectAllDeps = {
     cap?: number;
 };
 /** The rebuild (spec 2026-10-07 delivery model §2): every page and entry of the space projected, in batches of
- *  `cap` ids, none left stale. Import ends with it, and `smoodly rebuild` is it. The counts are the pages and the
+ *  `cap` ids, none left stale, and the stamp recorded as the space's current one. Import ends with it, and `smoodly rebuild` is it. The counts are the pages and the
  *  entries (globals included) published in some locale; `stale` is what a batch could not write, 0 by design. */
 export declare function projectAll(deps: ProjectAllDeps): Promise<{
     pages: number;

package/dist/project.js

@@ -89,7 +89,7 @@ export function createProjector(deps) {
         };
     }
     /** Builds rows for each (id, locale) until the cap; the rest are marked stale and returned. */
-    async function project(cap, kind, targets, idOf, build, put) {
+    async function project(cap, kind, targets, idOf, build, put, write) {
         const { published } = deps.stores();
         const rows = [];
         const gone = [];
@@ -107,6 +107,8 @@ export function createProjector(deps) {
                     gone.push({ kind, id: idOf(t), locale });
             }
         }
+        if (!write)
+            return over;
         if (rows.length > 0)
             await put(rows);
         if (gone.length > 0)
@@ -117,14 +119,15 @@ export function createProjector(deps) {
     }
     return {
         async pages(ids, options) {
+            const write = options?.write !== false;
             const all = await deps.stores().pages.listPages();
             const a = assembler.batch({ pages: all });
             const byId = new Map(all.map((p) => [p.id, p]));
             // A page no longer in the tree has no row in any locale.
             const missing = ids.filter((id) => !byId.has(id));
-            if (missing.length > 0)
+            if (write && missing.length > 0)
                 await deps.stores().published.remove(missing.map((id) => ({ kind: "page", id })));
-            return project(options?.cap ?? cap, "page", ids.filter((id) => byId.has(id)).map((id) => byId.get(id)), (p) => p.id, (p, locale) => pageRow(a, p, all, locale), (rows) => deps.stores().published.putPages(rows));
+            return project(options?.cap ?? cap, "page", ids.filter((id) => byId.has(id)).map((id) => byId.get(id)), (p) => p.id, (p, locale) => pageRow(a, p, all, locale), (rows) => deps.stores().published.putPages(rows), write);
         },
         async entries(ids, options) {
             const a = assembler.batch();
@@ -137,9 +140,10 @@ export function createProjector(deps) {
                 else
                     missing.push({ kind: "entry", id });
             }
-            if (missing.length > 0)
+            const write = options?.write !== false;
+            if (write && missing.length > 0)
                 await deps.stores().published.remove(missing);
-            return project(options?.cap ?? cap, "entry", found, (h) => h.record.id, (h, locale) => entryRow(a, h.schema, h.record, locale), (rows) => deps.stores().published.putEntries(rows));
+            return project(options?.cap ?? cap, "entry", found, (h) => h.record.id, (h, locale) => entryRow(a, h.schema, h.record, locale), (rows) => deps.stores().published.putEntries(rows), write);
         },
         async healPage(id, locale, options) {
             const { pages, published } = deps.stores();
@@ -149,24 +153,28 @@ export function createProjector(deps) {
             const visible = row !== undefined && (record.template === null || row.status === "published");
             const all = visible ? await pages.listPages() : [];
             const projected = visible ? await pageRow(assembler.batch({ pages: all }), record, all, locale) : null;
+            const write = options?.write !== false;
             if (!projected) {
-                if (options?.seen !== false)
+                if (write && options?.seen !== false)
                     await bestEffort(`removing page ${id} (${locale})`, () => published.remove([{ kind: "page", id, locale }]));
                 return null;
             }
-            await bestEffort(`writing page ${id} (${locale})`, () => published.putPages([projected]));
+            if (write)
+                await bestEffort(`writing page ${id} (${locale})`, () => published.putPages([projected]));
             return projected.document;
         },
         async healEntry(id, locale, options) {
             const { published } = deps.stores();
             const hit = await findEntry(id);
             const row = hit ? await entryRow(assembler.batch(), hit.schema, hit.record, locale) : null;
+            const write = options?.write !== false;
             if (!row) {
-                if (options?.seen !== false)
+                if (write && options?.seen !== false)
                     await bestEffort(`removing entry ${id} (${locale})`, () => published.remove([{ kind: "entry", id, locale }]));
                 return null;
             }
-            await bestEffort(`writing entry ${id} (${locale})`, () => published.putEntries([row]));
+            if (write)
+                await bestEffort(`writing entry ${id} (${locale})`, () => published.putEntries([row]));
             return row.document;
         },
         async healGlobal(item, locale, options) {
@@ -175,19 +183,27 @@ export function createProjector(deps) {
             if (!record)
                 return null;
             const row = await entryRow(assembler.batch(), item, record, locale);
+            const write = options?.write !== false;
             if (!row) {
-                if (options?.seen !== false)
+                if (write && options?.seen !== false)
                     await bestEffort(`removing global ${item.name} (${locale})`, () => published.remove([{ kind: "entry", id: record.id, locale }]));
                 return null;
             }
-            await bestEffort(`writing global ${item.name} (${locale})`, () => published.putEntries([row]));
+            if (write)
+                await bestEffort(`writing global ${item.name} (${locale})`, () => published.putEntries([row]));
             return row.document;
         },
         markStale: (keys) => deps.stores().published.markStale(keys),
+        record: () => deps.stores().published.recordModel(model),
+        async delivery() {
+            const { published } = deps.stores();
+            const [counts, recorded] = await Promise.all([published.countBehind(model), published.recordedModel()]);
+            return { ...counts, recorded, stamp: model };
+        },
     };
 }
 /** The rebuild (spec 2026-10-07 delivery model §2): every page and entry of the space projected, in batches of
- *  `cap` ids, none left stale. Import ends with it, and `smoodly rebuild` is it. The counts are the pages and the
+ *  `cap` ids, none left stale, and the stamp recorded as the space's current one. Import ends with it, and `smoodly rebuild` is it. The counts are the pages and the
  *  entries (globals included) published in some locale; `stale` is what a batch could not write, 0 by design. */
 export async function projectAll(deps) {
     const size = deps.cap ?? PROJECTION_CAP;
@@ -202,6 +218,8 @@ export async function projectAll(deps) {
     for (let i = 0; i < entries.length; i += size) {
         stale += (await deps.projector.entries(entries.slice(i, i + size).map((e) => e.id), whole)).length;
     }
+    // Every row now carries this stamp: it is the space's current one, and this deployment the writer of record (DESIGN §3).
+    await deps.projector.record();
     return {
         pages: pages.filter((p) => p.template !== null && published(p)).length,
         entries: entries.filter(published).length,

package/dist/published.d.ts

@@ -15,6 +15,7 @@ export type PublishedPageRow = {
     linkFields: Record<string, unknown>;
     document: SitePage | null;
     tags: string[];
+    /** The document stamp that built the row (document-stamp.ts); the column name predates the name. */
     model: string;
     stale: boolean;
     publishedAt: number;
@@ -34,6 +35,7 @@ export type PublishedEntryRow = {
     fields: Record<string, unknown>;
     document: SiteEntry | unknown;
     tags: string[];
+    /** The document stamp that built the row (document-stamp.ts); the column name predates the name. */
     model: string;
     stale: boolean;
     publishedAt: number;
@@ -80,10 +82,27 @@ export interface PublishedStore {
     /** The light columns of every row in the locale, with the model and stale flag, in tree order (sort asc nulls last, published, id). */
     tree(locale: string): Promise<PublishedTreeRow[]>;
     markStale(keys: PublishedKey[]): Promise<void>;
+    /** The document stamp this space recorded as current (DESIGN §3): what `rebuild` last wrote, or the first
+     *  writer's; null until then. Only a reader at this stamp rewrites rows. */
+    recordedModel(): Promise<string | null>;
+    /** Record `model` as the space's current stamp (upsert by space). */
+    recordModel(model: string): Promise<void>;
+    /** Rows of both tables, and how many of them carry a stamp other than `model`: what `migrate --check` and Content health show. */
+    countBehind(model: string): Promise<{
+        behind: number;
+        total: number;
+    }>;
 }
 export declare class MemoryPublishedStore implements PublishedStore {
     private pages;
     private entryRows;
+    private recorded;
+    recordedModel(): Promise<string | null>;
+    recordModel(model: string): Promise<void>;
+    countBehind(model: string): Promise<{
+        behind: number;
+        total: number;
+    }>;
     putPages(rows: PublishedPageRow[]): Promise<void>;
     putEntries(rows: PublishedEntryRow[]): Promise<void>;
     remove(keys: PublishedKey[]): Promise<void>;

package/dist/published.js

@@ -49,6 +49,17 @@ export class MemoryPublishedStore {
     constructor() {
         this.pages = new Map();
         this.entryRows = new Map();
+        this.recorded = null;
+    }
+    async recordedModel() {
+        return this.recorded;
+    }
+    async recordModel(model) {
+        this.recorded = model;
+    }
+    async countBehind(model) {
+        const rows = [...this.pages.values(), ...this.entryRows.values()];
+        return { behind: rows.filter((r) => r.model !== model).length, total: rows.length };
     }
     async putPages(rows) {
         vacate(this.pages, rows);

package/dist/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export declare const SCHEMA_VERSION = 9;
+export declare const SCHEMA_VERSION = 10;
 export declare const SCHEMA_VERSION_KEY = "schema_version";
 export declare const CORE_FILE_RE: RegExp;
 export declare const VIEWS_FILE_RE: RegExp;

package/dist/schema-version.js

@@ -7,7 +7,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export const SCHEMA_VERSION = 9;
+export const SCHEMA_VERSION = 10;
 export const SCHEMA_VERSION_KEY = "schema_version";
 export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
 export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;

package/dist/site.d.ts

@@ -122,6 +122,8 @@ export interface SmoodlySite {
     /** The package version and a hash of the registered model: a part of every cache key, so an upgrade or a
      *  model change never serves a unit cached in the old shape (spec 2026-09-30 tester findings §3). */
     readonly cacheKey: string;
+    /** The document stamp a delivery row carries (DESIGN §3): the format number and the model hash, never the version. */
+    readonly stamp: string;
     /** The resolved styles values the renderer and `getGlobal` hand the wrapper. */
     readonly styles: StyleValues;
     /** The custom section's resolved options the renderer hands renderPage. */

package/dist/site.js

@@ -3,6 +3,7 @@ import { entrySegment } from "./paths.js";
 import { lastPart } from "./addresses.js";
 import { withDefaults } from "./field-defaults.js";
 import { modelKey } from "./model-key.js";
+import { documentStamp } from "./document-stamp.js";
 import { SMOODLY_VERSION } from "./version.js";
 import { toEntryItem, toPageItem } from "./read-shapes.js";
 import { pageSeo } from "./seo.js";
@@ -33,30 +34,63 @@ export function createSmoodlySite(options) {
     const cacheKey = `${SMOODLY_VERSION}:${modelKey({
         // Whole schemas: a collection's order, tree or title field changes a read as its fields do (functions drop out in the hash).
         collections: options.collections,
-        globals: (options.globals ?? []).map((g) => ({ name: g.name, fields: g.fields, section: g.section })),
+        globals: (options.globals ?? []).map((g) => ({ name: g.name, fields: g.fields, settings: g.settings, section: g.section })),
         sections: options.sections.map((x) => ("schema" in x ? x.schema : x)),
         elements: (options.elements ?? []).map((x) => ("schema" in x ? x.schema : x)),
         pages: pageSchemas,
         locales, homePageSlug, styles, custom,
     })}`;
+    // What a delivery row is stamped with (DESIGN §3, the document stamp): the document format and the schema parts
+    // that reach a document, never the package version, so a release leaves current documents current.
+    const stamp = documentStamp(options);
     const localeOf = (o) => o?.locale ?? locales.default;
     const published = () => options.stores().published;
     const projector = createProjector({
         assembler,
         stores: () => { const s = options.stores(); return { pages: s.pages, entries: s.entries, published: s.published }; },
         collections: options.collections, globals: options.globals ?? [], sections: options.sections, elements: options.elements,
-        locales, model: cacheKey,
+        locales, model: stamp,
     });
     // Delivery (spec 2026-10-07 delivery model §3–§4): outside draft mode a read takes the stored document when it is
     // current — built by this model and not marked stale — and otherwise assembles that one document, stores it and serves it.
-    const current = (row) => row.model === cacheKey && !row.stale;
+    const current = (row) => row.model === stamp && !row.stale;
+    /** One writer of record (DESIGN §3, the document stamp): only the deployment whose stamp the space recorded rewrites
+     *  rows; the first writer into an empty record records itself; every other deployment serves assembled documents
+     *  and writes nothing. Read only when a heal is about to write, so a current page stays one call. A "no" is kept for
+     *  the process (a later rebuild at this stamp is seen by the next process, which costs assembled reads, never wrong
+     *  ones); a "yes" is read again on each heal, so a rebuild elsewhere stops this writer at its next heal. */
+    let yields = false;
+    async function mayWrite() {
+        if (yields)
+            return false;
+        // The record is derived like the rows: a read or write of it that fails is logged, and the page is served
+        // assembled with nothing written (spec 2026-10-07 §2 Failure), never failed on it.
+        try {
+            const recorded = await published().recordedModel();
+            if (recorded === null) {
+                await published().recordModel(stamp);
+                return true;
+            }
+            yields = recorded !== stamp;
+            return !yields;
+        }
+        catch (e) {
+            console.error("smoodly: reading the space's recorded document stamp failed; served assembled, nothing written.", e);
+            return false;
+        }
+    }
     const fresh = (row) => current(row) && row.document != null;
     const itemOf = (doc) => toEntryItem(doc.entry, doc.entry.fields, { path: doc.path, locale: doc.locale, locales: doc.locales, ...(doc.seo ? { seo: doc.seo } : {}) });
     /** A page row's answer: its document when current (null for a folder or a hidden node), else the healed one. */
-    const pageOf = (row, id, locale) => row && current(row) ? Promise.resolve(row.document) : projector.healPage(id, locale, { seen: row !== null });
+    const pageOf = async (row, id, locale) => row && current(row) ? row.document : projector.healPage(id, locale, { seen: row !== null, write: await mayWrite() });
     /** An entry document is served at an address only when its collection has addresses. */
     const served = (doc) => (doc && doc.path !== null ? doc : null);
-    const entryOf = async (row, id, locale) => row && fresh(row) ? row.document : projector.healEntry(id, locale, { seen: row !== null });
+    const entryOf = async (row, id, locale) => row && fresh(row) ? row.document : projector.healEntry(id, locale, { seen: row !== null, write: await mayWrite() });
+    /** An entry document as the projector would write it, from an assembled read (the address-less shape, path from the item). */
+    const assembledEntry = (collection, locale) => (read) => ({
+        kind: "entry", locale, collection, entry: { ...read.record, fields: read.item.fields },
+        path: read.item.path, locales: read.item.locales, ...(read.item.seo ? { seo: read.item.seo } : {}),
+    });
     /** The published documents of a collection's query. Stale rows are rebuilt in one batched projection and the
      *  query read once more (spec §4): a rebuild that finds an entry unpublished removes its row, so it drops out. */
     async function deliveredEntries(collection, o) {
@@ -70,6 +104,9 @@ export function createSmoodlySite(options) {
         let rows = await read();
         const behind = rows.filter((r) => !fresh(r)).map((r) => r.id);
         if (behind.length > 0) {
+            // Not the writer of record: the list assembled now, nothing written (DESIGN §3).
+            if (!(await mayWrite()))
+                return (await assembler.entries(collection, { ...o, locale, draft: false })).map(assembledEntry(collection, locale));
             // A failed rebuild never fails the read: the rows as read are served, and the next read tries again.
             try {
                 await projector.entries(behind, { cap: Infinity });
@@ -96,6 +133,9 @@ export function createSmoodlySite(options) {
             let rows = await published().tree(locale);
             const behind = rows.filter((r) => !current(r)).map((r) => r.id);
             if (behind.length > 0) {
+                // Not the writer of record: the tree assembled now, nothing written (DESIGN §3).
+                if (!(await mayWrite()))
+                    return assembler.tree(locale, { draft: false });
                 // One batched projection for every row behind (one tree read in the projector), then one more tree read.
                 // A failed rebuild never fails the read: the rows as read are served, and the next read tries again.
                 try {
@@ -147,7 +187,7 @@ export function createSmoodlySite(options) {
                     return itemOf(row.document);
                 // A miss is a record no projection wrote yet, or a slug: one `get` tells them apart.
                 if (row?.collection === collection || (await options.stores().entries.get(collection, idOrPath))) {
-                    const doc = await projector.healEntry(idOrPath, locale, { seen: row !== null });
+                    const doc = await projector.healEntry(idOrPath, locale, { seen: row !== null, write: await mayWrite() });
                     if (doc)
                         return itemOf(doc);
                 }
@@ -169,7 +209,7 @@ export function createSmoodlySite(options) {
                 return assembler.global(item, locale, { draft: true });
             // The item's row by its collection, in one read: a global is a one-record collection.
             const [row] = await published().entries(item.name, { locale, limit: 1 });
-            return row && fresh(row) ? row.document : projector.healGlobal(item, locale, { seen: row !== undefined });
+            return row && fresh(row) ? row.document : projector.healGlobal(item, locale, { seen: row !== undefined, write: await mayWrite() });
         },
     };
     /** The published read of an address; `code`: the code-owned page answers where the index has no row. */
@@ -182,7 +222,8 @@ export function createSmoodlySite(options) {
         let healed = null;
         if (route) {
             // Stale: rebuilt by id. Unpublished or moved since the row was written, the address is answered as a miss.
-            healed = route.kind === "page" ? await projector.healPage(route.row.id, locale) : served(await projector.healEntry(route.row.id, locale));
+            const write = await mayWrite();
+            healed = route.kind === "page" ? await projector.healPage(route.row.id, locale, { write }) : served(await projector.healEntry(route.row.id, locale, { write }));
             if (healed && healed.path === path)
                 return { hit: healed, rows };
         }
@@ -225,6 +266,7 @@ export function createSmoodlySite(options) {
         locales,
         homePageSlug,
         cacheKey,
+        stamp,
         styles,
         custom,
         locate: (locale, path) => options.stores().pages.resolvePath(locale, path),
@@ -251,7 +293,7 @@ export function createSmoodlySite(options) {
                     // pays the call where a page renders it. A stale row heals once and is written.
                     if (!row)
                         continue;
-                    globals.set(item.name, fresh(row) ? row.document : await projector.healGlobal(item, locale, { seen: true }));
+                    globals.set(item.name, fresh(row) ? row.document : await projector.healGlobal(item, locale, { seen: true, write: await mayWrite() }));
                 }
             }
             return { hit, globals };

package/dist/sql-space.d.ts

@@ -8,8 +8,9 @@ export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_ve
 export type ContentTable = (typeof CONTENT_TABLES)[number];
 /** The delivery model's derived tables (spec 2026-10-07 §1): policy-covered and
  *  space-stamped like content, but not transferred (export skips them, import
- *  rebuilds them) and not counted toward the row cap, since they are derived. */
-export declare const DELIVERY_TABLES: readonly ["published_pages", "published_entries"];
+ *  rebuilds them) and not counted toward the row cap, since they are derived.
+ *  `published_models` (schema v10) holds one row per space: the document stamp the space recorded as current. */
+export declare const DELIVERY_TABLES: readonly ["published_pages", "published_entries", "published_models"];
 export declare function currentSpaceSQL(): string;
 /** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
  *  the write key's insert, update and delete, each alone for its action; its

package/dist/sql-space.js

@@ -21,8 +21,9 @@ export const CONTENT_TABLES = [
 ];
 /** The delivery model's derived tables (spec 2026-10-07 §1): policy-covered and
  *  space-stamped like content, but not transferred (export skips them, import
- *  rebuilds them) and not counted toward the row cap, since they are derived. */
-export const DELIVERY_TABLES = ["published_pages", "published_entries"];
+ *  rebuilds them) and not counted toward the row cap, since they are derived.
+ *  `published_models` (schema v10) holds one row per space: the document stamp the space recorded as current. */
+export const DELIVERY_TABLES = ["published_pages", "published_entries", "published_models"];
 export function currentSpaceSQL() {
     return `
 -- The space a request acts in: the key's claim in Smoodly Cloud, the