smoodly 0.0.46 → 0.0.48

package/dist/document-stamp.js

@@ -0,0 +1,48 @@
+// The stamp a delivery row carries (DESIGN §3, the document stamp, 2026-10-08): which document format and
+// which content model built it. Not the cache key: the package version is in that one, not here, because a
+// release that leaves documents alone must leave them alone.
+import { modelKey } from "./model-key.js";
+import { schemaOf } from "./registration.js";
+/** Bumped by hand when the assembler's output changes shape; the upgrading guide names each bump. */
+export const DOCUMENT_FORMAT = 1;
+/** Schema keys that reach the admin only: a change to one leaves every document as it was. */
+const PRESENTATION = new Set(["title", "description", "sample", "icon", "preview", "group", "admin"]);
+/** A field descriptor without the parts that reach the admin only (a hidden condition decides what the editor shows). */
+function fieldModel(field) {
+    if (!field || typeof field !== "object")
+        return field;
+    const { hidden: _hidden, ...rest } = field;
+    return Object.fromEntries(Object.entries(rest).map(([k, v]) => [k, k === "fields" ? fieldsModel(v) : k === "of" ? fieldModel(v) : v]));
+}
+function fieldsModel(fields) {
+    if (!fields || typeof fields !== "object")
+        return fields;
+    return Object.fromEntries(Object.entries(fields).map(([k, v]) => [k, fieldModel(v)]));
+}
+/** A schema without its presentation. */
+function schemaModel(schema) {
+    if (!schema || typeof schema !== "object")
+        return schema;
+    return Object.fromEntries(Object.entries(schema)
+        .filter(([k]) => !PRESENTATION.has(k))
+        .map(([k, v]) => [k, k === "fields" || k === "settings" ? fieldsModel(v) : v]));
+}
+/** The parts of the registry that reach a document: what `cacheKey` hashes, minus the presentation. */
+export function documentModel(options) {
+    return {
+        collections: options.collections.map(schemaModel),
+        // A global whole, its presentation dropped: its settings' defaults reach a visual item's document.
+        globals: (options.globals ?? []).map(schemaModel),
+        sections: options.sections.map((x) => schemaModel(schemaOf(x))),
+        elements: (options.elements ?? []).map((x) => schemaModel(schemaOf(x))),
+        pages: options.pages.map((x) => schemaModel(schemaOf(x))),
+        locales: options.locales,
+        homePageSlug: options.homePageSlug,
+        styles: options.styles,
+        custom: options.custom,
+    };
+}
+/** `<format>:<model hash>` — what a delivery row's `model` column holds. */
+export function documentStamp(options) {
+    return `${DOCUMENT_FORMAT}:${modelKey(documentModel(options))}`;
+}

package/dist/project.d.ts

@@ -9,9 +9,15 @@ import type { SiteEntry, SitePage } from "./site.ts";
 import type { PageStore } from "./store.ts";
 /** The documents one projection writes before the rest are left to heal on read (§2). */
 export declare const PROJECTION_CAP = 100;
-/** `cap` overrides the projector's own for one call: a rebuild passes Infinity, a test a small number. */
+/** `cap` overrides the projector's own for one call: a rebuild passes Infinity, a test a small number. `write`
+ *  false (DESIGN §3, the document stamp): the rows are built but nothing is written, removed or marked — a reader
+ *  whose stamp the space did not record. Default true. */
 export type ProjectOptions = {
     cap?: number;
+    write?: boolean;
+    /** `false` (a behind rebuild on a read, spec 2026-10-09 static mode §5): an existing row keeps its publishedAt, so
+     *  the rebuild is not counted as a publish the static site has not got. Default true: a publish, `npx smoodly rebuild`. */
+    stamp?: boolean;
 };
 export type Projector = {
     /** Writes the delivery rows of these pages in every supported locale (a row per visible locale, removed where not visible). Returns the keys it could not fit under the cap, already marked stale. */
@@ -26,9 +32,22 @@ export type Projector = {
     healGlobal<V>(item: GlobalSchema<V>, locale: string, options?: HealOptions): Promise<V | null>;
     /** Flags rows to rebuild on their next read: what an op does with the targets of a projection that threw. */
     markStale(keys: PublishedKey[]): Promise<void>;
+    /** Records this projector's stamp as the space's current one (DESIGN §3): what a rebuild ends with. */
+    record(): Promise<void>;
+    /** The delivery tables against this stamp: how many rows are behind it, and which stamp the space recorded. */
+    delivery(): Promise<DeliveryStatus>;
 };
+/** What Content health and `migrate --check` show of the delivery tables (DESIGN §3, the document stamp). */
+export type DeliveryStatus = {
+    total: number;
+    behind: number;
+    recorded: string | null;
+    stamp: string;
+};
+/** `write` false: serve the assembled document, write and remove nothing (a reader at another stamp than the recorded one). */
 export type HealOptions = {
     seen?: boolean;
+    write?: boolean;
 };
 export type ProjectorDeps = {
     assembler: Assembler;
@@ -43,7 +62,7 @@ export type ProjectorDeps = {
     sections: SectionLike[];
     elements?: SectionLike[];
     locales: LocaleSet;
-    /** The fingerprint a row is current against: the site's cacheKey (§4). */
+    /** The stamp a row is current against: the site's document stamp (§4; DESIGN §3). */
     model: string;
     cap?: number;
 };
@@ -60,7 +79,7 @@ export type ProjectAllDeps = {
     cap?: number;
 };
 /** The rebuild (spec 2026-10-07 delivery model §2): every page and entry of the space projected, in batches of
- *  `cap` ids, none left stale. Import ends with it, and `smoodly rebuild` is it. The counts are the pages and the
+ *  `cap` ids, none left stale, and the stamp recorded as the space's current one. Import ends with it, and `smoodly rebuild` is it. The counts are the pages and the
  *  entries (globals included) published in some locale; `stale` is what a batch could not write, 0 by design. */
 export declare function projectAll(deps: ProjectAllDeps): Promise<{
     pages: number;

package/dist/project.js

@@ -89,7 +89,7 @@ export function createProjector(deps) {
         };
     }
     /** Builds rows for each (id, locale) until the cap; the rest are marked stale and returned. */
-    async function project(cap, kind, targets, idOf, build, put) {
+    async function project(cap, kind, targets, idOf, build, put, write) {
         const { published } = deps.stores();
         const rows = [];
         const gone = [];
@@ -107,6 +107,8 @@ export function createProjector(deps) {
                     gone.push({ kind, id: idOf(t), locale });
             }
         }
+        if (!write)
+            return over;
         if (rows.length > 0)
             await put(rows);
         if (gone.length > 0)
@@ -117,14 +119,16 @@ export function createProjector(deps) {
     }
     return {
         async pages(ids, options) {
+            const write = options?.write !== false;
             const all = await deps.stores().pages.listPages();
             const a = assembler.batch({ pages: all });
             const byId = new Map(all.map((p) => [p.id, p]));
             // A page no longer in the tree has no row in any locale.
             const missing = ids.filter((id) => !byId.has(id));
-            if (missing.length > 0)
+            if (write && missing.length > 0)
                 await deps.stores().published.remove(missing.map((id) => ({ kind: "page", id })));
-            return project(options?.cap ?? cap, "page", ids.filter((id) => byId.has(id)).map((id) => byId.get(id)), (p) => p.id, (p, locale) => pageRow(a, p, all, locale), (rows) => deps.stores().published.putPages(rows));
+            const keep = options?.stamp === false;
+            return project(options?.cap ?? cap, "page", ids.filter((id) => byId.has(id)).map((id) => byId.get(id)), (p) => p.id, (p, locale) => pageRow(a, p, all, locale), (rows) => deps.stores().published.putPages(rows, { keep }), write);
         },
         async entries(ids, options) {
             const a = assembler.batch();
@@ -137,9 +141,11 @@ export function createProjector(deps) {
                 else
                     missing.push({ kind: "entry", id });
             }
-            if (missing.length > 0)
+            const write = options?.write !== false;
+            if (write && missing.length > 0)
                 await deps.stores().published.remove(missing);
-            return project(options?.cap ?? cap, "entry", found, (h) => h.record.id, (h, locale) => entryRow(a, h.schema, h.record, locale), (rows) => deps.stores().published.putEntries(rows));
+            const keep = options?.stamp === false;
+            return project(options?.cap ?? cap, "entry", found, (h) => h.record.id, (h, locale) => entryRow(a, h.schema, h.record, locale), (rows) => deps.stores().published.putEntries(rows, { keep }), write);
         },
         async healPage(id, locale, options) {
             const { pages, published } = deps.stores();
@@ -149,24 +155,29 @@ export function createProjector(deps) {
             const visible = row !== undefined && (record.template === null || row.status === "published");
             const all = visible ? await pages.listPages() : [];
             const projected = visible ? await pageRow(assembler.batch({ pages: all }), record, all, locale) : null;
+            const write = options?.write !== false;
             if (!projected) {
-                if (options?.seen !== false)
+                if (write && options?.seen !== false)
                     await bestEffort(`removing page ${id} (${locale})`, () => published.remove([{ kind: "page", id, locale }]));
                 return null;
             }
-            await bestEffort(`writing page ${id} (${locale})`, () => published.putPages([projected]));
+            // A heal keeps the row's publishedAt: it rebuilds what a publish wrote, it is not one (spec 2026-10-09 static mode §5).
+            if (write)
+                await bestEffort(`writing page ${id} (${locale})`, () => published.putPages([projected], { keep: true }));
             return projected.document;
         },
         async healEntry(id, locale, options) {
             const { published } = deps.stores();
             const hit = await findEntry(id);
             const row = hit ? await entryRow(assembler.batch(), hit.schema, hit.record, locale) : null;
+            const write = options?.write !== false;
             if (!row) {
-                if (options?.seen !== false)
+                if (write && options?.seen !== false)
                     await bestEffort(`removing entry ${id} (${locale})`, () => published.remove([{ kind: "entry", id, locale }]));
                 return null;
             }
-            await bestEffort(`writing entry ${id} (${locale})`, () => published.putEntries([row]));
+            if (write)
+                await bestEffort(`writing entry ${id} (${locale})`, () => published.putEntries([row], { keep: true }));
             return row.document;
         },
         async healGlobal(item, locale, options) {
@@ -175,19 +186,27 @@ export function createProjector(deps) {
             if (!record)
                 return null;
             const row = await entryRow(assembler.batch(), item, record, locale);
+            const write = options?.write !== false;
             if (!row) {
-                if (options?.seen !== false)
+                if (write && options?.seen !== false)
                     await bestEffort(`removing global ${item.name} (${locale})`, () => published.remove([{ kind: "entry", id: record.id, locale }]));
                 return null;
             }
-            await bestEffort(`writing global ${item.name} (${locale})`, () => published.putEntries([row]));
+            if (write)
+                await bestEffort(`writing global ${item.name} (${locale})`, () => published.putEntries([row], { keep: true }));
             return row.document;
         },
         markStale: (keys) => deps.stores().published.markStale(keys),
+        record: () => deps.stores().published.recordModel(model),
+        async delivery() {
+            const { published } = deps.stores();
+            const [counts, recorded] = await Promise.all([published.countBehind(model), published.recordedModel()]);
+            return { ...counts, recorded, stamp: model };
+        },
     };
 }
 /** The rebuild (spec 2026-10-07 delivery model §2): every page and entry of the space projected, in batches of
- *  `cap` ids, none left stale. Import ends with it, and `smoodly rebuild` is it. The counts are the pages and the
+ *  `cap` ids, none left stale, and the stamp recorded as the space's current one. Import ends with it, and `smoodly rebuild` is it. The counts are the pages and the
  *  entries (globals included) published in some locale; `stale` is what a batch could not write, 0 by design. */
 export async function projectAll(deps) {
     const size = deps.cap ?? PROJECTION_CAP;
@@ -202,6 +221,8 @@ export async function projectAll(deps) {
     for (let i = 0; i < entries.length; i += size) {
         stale += (await deps.projector.entries(entries.slice(i, i + size).map((e) => e.id), whole)).length;
     }
+    // Every row now carries this stamp: it is the space's current one, and this deployment the writer of record (DESIGN §3).
+    await deps.projector.record();
     return {
         pages: pages.filter((p) => p.template !== null && published(p)).length,
         entries: entries.filter(published).length,

package/dist/published.d.ts

@@ -15,6 +15,7 @@ export type PublishedPageRow = {
     linkFields: Record<string, unknown>;
     document: SitePage | null;
     tags: string[];
+    /** The document stamp that built the row (document-stamp.ts); the column name predates the name. */
     model: string;
     stale: boolean;
     publishedAt: number;
@@ -34,6 +35,7 @@ export type PublishedEntryRow = {
     fields: Record<string, unknown>;
     document: SiteEntry | unknown;
     tags: string[];
+    /** The document stamp that built the row (document-stamp.ts); the column name predates the name. */
     model: string;
     stale: boolean;
     publishedAt: number;
@@ -64,10 +66,15 @@ export type PublishedKey = {
     id: string;
     locale?: string;
 };
+export type PutOptions = {
+    keep?: boolean;
+};
 export interface PublishedStore {
     /** Upsert by (id, locale). */
-    putPages(rows: PublishedPageRow[]): Promise<void>;
-    putEntries(rows: PublishedEntryRow[]): Promise<void>;
+    /** `keep` (a heal, a behind rebuild on read): an existing row keeps its publishedAt, a new row is dated now; without it
+     *  every row is dated now (a publish, `npx smoodly rebuild`). The static build's count reads publishedAt (spec 2026-10-09 §5). */
+    putPages(rows: PublishedPageRow[], options?: PutOptions): Promise<void>;
+    putEntries(rows: PublishedEntryRow[], options?: PutOptions): Promise<void>;
     /** Every locale of the id when `locale` is absent. */
     remove(keys: PublishedKey[]): Promise<void>;
     /** The one-call lookup: a reachable page or entry at the address, else null. With `globals` (collection names of
@@ -80,13 +87,52 @@ export interface PublishedStore {
     /** The light columns of every row in the locale, with the model and stale flag, in tree order (sort asc nulls last, published, id). */
     tree(locale: string): Promise<PublishedTreeRow[]>;
     markStale(keys: PublishedKey[]): Promise<void>;
+    /** The document stamp this space recorded as current (DESIGN §3): what `rebuild` last wrote, or the first
+     *  writer's; null until then. Only a reader at this stamp rewrites rows. */
+    recordedModel(): Promise<string | null>;
+    /** Record `model` as the space's current stamp (upsert by space). */
+    recordModel(model: string): Promise<void>;
+    /** Rows of both tables, and how many of them carry a stamp other than `model`: what `migrate --check` and Content health show. */
+    countBehind(model: string): Promise<{
+        behind: number;
+        total: number;
+    }>;
+    /** The latest published_at over the space's pages and entries (ms); null when nothing is published. The static build's watermark (spec 2026-10-09 static mode §5). */
+    newestPublishedAt(): Promise<number | null>;
+    /** Rows published strictly after `since` (ms), pages plus entries: the Deploy tile's "changes waiting". */
+    countPublishedAfter(since: number): Promise<number>;
+    /** The space's last Deploy press (schema v11, space_deploys); null until the first press. */
+    deployRequest(): Promise<{
+        at: number;
+        by: string | null;
+    } | null>;
+    requestDeploy(by: string | null, at?: number): Promise<void>;
+    /** When a row last went (an unpublish, a delete): a change the count of newer rows cannot see (same row, `removed_at`). */
+    lastRemovalAt(): Promise<number | null>;
 }
 export declare class MemoryPublishedStore implements PublishedStore {
     private pages;
     private entryRows;
-    putPages(rows: PublishedPageRow[]): Promise<void>;
-    putEntries(rows: PublishedEntryRow[]): Promise<void>;
+    private recorded;
+    recordedModel(): Promise<string | null>;
+    recordModel(model: string): Promise<void>;
+    private deploy;
+    newestPublishedAt(): Promise<number | null>;
+    countPublishedAfter(since: number): Promise<number>;
+    deployRequest(): Promise<{
+        at: number;
+        by: string | null;
+    } | null>;
+    requestDeploy(by: string | null, at?: number): Promise<void>;
+    countBehind(model: string): Promise<{
+        behind: number;
+        total: number;
+    }>;
+    putPages(rows: PublishedPageRow[], options?: PutOptions): Promise<void>;
+    putEntries(rows: PublishedEntryRow[], options?: PutOptions): Promise<void>;
+    private removedAt;
     remove(keys: PublishedKey[]): Promise<void>;
+    lastRemovalAt(): Promise<number | null>;
     byAddress(locale: string, path: string, globals?: readonly string[]): Promise<PublishedRoute | null>;
     page(id: string, locale: string): Promise<PublishedPageRow | null>;
     entry(id: string, locale: string): Promise<PublishedEntryRow | null>;

package/dist/published.js

@@ -49,24 +49,63 @@ export class MemoryPublishedStore {
     constructor() {
         this.pages = new Map();
         this.entryRows = new Map();
+        this.recorded = null;
+        this.deploy = null;
+        this.removedAt = null;
     }
-    async putPages(rows) {
+    async recordedModel() {
+        return this.recorded;
+    }
+    async recordModel(model) {
+        this.recorded = model;
+    }
+    async newestPublishedAt() {
+        const all = [...this.pages.values(), ...this.entryRows.values()].map((r) => r.publishedAt);
+        return all.length === 0 ? null : Math.max(...all);
+    }
+    async countPublishedAfter(since) {
+        return [...this.pages.values(), ...this.entryRows.values()].filter((r) => r.publishedAt > since).length;
+    }
+    async deployRequest() {
+        return this.deploy;
+    }
+    async requestDeploy(by, at = Date.now()) {
+        this.deploy = { at, by };
+    }
+    async countBehind(model) {
+        const rows = [...this.pages.values(), ...this.entryRows.values()];
+        return { behind: rows.filter((r) => r.model !== model).length, total: rows.length };
+    }
+    async putPages(rows, options) {
         vacate(this.pages, rows);
-        for (const row of rows)
-            this.pages.set(keyOf(row.id, row.locale), structuredClone(row));
+        for (const row of rows) {
+            const kept = options?.keep ? this.pages.get(keyOf(row.id, row.locale))?.publishedAt : undefined;
+            this.pages.set(keyOf(row.id, row.locale), structuredClone(kept === undefined ? row : { ...row, publishedAt: kept }));
+        }
     }
-    async putEntries(rows) {
+    async putEntries(rows, options) {
         vacate(this.entryRows, rows);
-        for (const row of rows)
-            this.entryRows.set(keyOf(row.id, row.locale), structuredClone(row));
+        for (const row of rows) {
+            const kept = options?.keep ? this.entryRows.get(keyOf(row.id, row.locale))?.publishedAt : undefined;
+            this.entryRows.set(keyOf(row.id, row.locale), structuredClone(kept === undefined ? row : { ...row, publishedAt: kept }));
+        }
     }
     async remove(keys) {
+        let deleted = 0;
         for (const key of keys) {
             const map = key.kind === "page" ? this.pages : this.entryRows;
             for (const [k, row] of map)
-                if (row.id === key.id && (key.locale === undefined || row.locale === key.locale))
+                if (row.id === key.id && (key.locale === undefined || row.locale === key.locale)) {
                     map.delete(k);
+                    deleted += 1;
+                }
         }
+        // Only a row that went is a change (a key with no row is not): the Deploy tile counts it (spec 2026-10-09 §5).
+        if (deleted > 0)
+            this.removedAt = Date.now();
+    }
+    async lastRemovalAt() {
+        return this.removedAt;
     }
     async byAddress(locale, path, globals) {
         const found = () => {

package/dist/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export declare const SCHEMA_VERSION = 9;
+export declare const SCHEMA_VERSION = 11;
 export declare const SCHEMA_VERSION_KEY = "schema_version";
 export declare const CORE_FILE_RE: RegExp;
 export declare const VIEWS_FILE_RE: RegExp;

package/dist/schema-version.js

@@ -7,7 +7,7 @@
 /** The minimum schema version the package needs. Moves ONLY in a release
  *  that adds a table, column, function or policy the package reads; a
  *  unit test holds it equal to the highest file in `migrations/`. */
-export const SCHEMA_VERSION = 9;
+export const SCHEMA_VERSION = 11;
 export const SCHEMA_VERSION_KEY = "schema_version";
 export const CORE_FILE_RE = /^(\d{14})_smoodly_v(\d+)\.sql$/;
 export const VIEWS_FILE_RE = /^(\d{14})_smoodly_views\.sql$/;

package/dist/site.d.ts

@@ -122,6 +122,8 @@ export interface SmoodlySite {
     /** The package version and a hash of the registered model: a part of every cache key, so an upgrade or a
      *  model change never serves a unit cached in the old shape (spec 2026-09-30 tester findings §3). */
     readonly cacheKey: string;
+    /** The document stamp a delivery row carries (DESIGN §3): the format number and the model hash, never the version. */
+    readonly stamp: string;
     /** The resolved styles values the renderer and `getGlobal` hand the wrapper. */
     readonly styles: StyleValues;
     /** The custom section's resolved options the renderer hands renderPage. */

package/dist/site.js

@@ -3,6 +3,7 @@ import { entrySegment } from "./paths.js";
 import { lastPart } from "./addresses.js";
 import { withDefaults } from "./field-defaults.js";
 import { modelKey } from "./model-key.js";
+import { documentStamp } from "./document-stamp.js";
 import { SMOODLY_VERSION } from "./version.js";
 import { toEntryItem, toPageItem } from "./read-shapes.js";
 import { pageSeo } from "./seo.js";
@@ -33,30 +34,63 @@ export function createSmoodlySite(options) {
     const cacheKey = `${SMOODLY_VERSION}:${modelKey({
         // Whole schemas: a collection's order, tree or title field changes a read as its fields do (functions drop out in the hash).
         collections: options.collections,
-        globals: (options.globals ?? []).map((g) => ({ name: g.name, fields: g.fields, section: g.section })),
+        globals: (options.globals ?? []).map((g) => ({ name: g.name, fields: g.fields, settings: g.settings, section: g.section })),
         sections: options.sections.map((x) => ("schema" in x ? x.schema : x)),
         elements: (options.elements ?? []).map((x) => ("schema" in x ? x.schema : x)),
         pages: pageSchemas,
         locales, homePageSlug, styles, custom,
     })}`;
+    // What a delivery row is stamped with (DESIGN §3, the document stamp): the document format and the schema parts
+    // that reach a document, never the package version, so a release leaves current documents current.
+    const stamp = documentStamp(options);
     const localeOf = (o) => o?.locale ?? locales.default;
     const published = () => options.stores().published;
     const projector = createProjector({
         assembler,
         stores: () => { const s = options.stores(); return { pages: s.pages, entries: s.entries, published: s.published }; },
         collections: options.collections, globals: options.globals ?? [], sections: options.sections, elements: options.elements,
-        locales, model: cacheKey,
+        locales, model: stamp,
     });
     // Delivery (spec 2026-10-07 delivery model §3–§4): outside draft mode a read takes the stored document when it is
     // current — built by this model and not marked stale — and otherwise assembles that one document, stores it and serves it.
-    const current = (row) => row.model === cacheKey && !row.stale;
+    const current = (row) => row.model === stamp && !row.stale;
+    /** One writer of record (DESIGN §3, the document stamp): only the deployment whose stamp the space recorded rewrites
+     *  rows; the first writer into an empty record records itself; every other deployment serves assembled documents
+     *  and writes nothing. Read only when a heal is about to write, so a current page stays one call. A "no" is kept for
+     *  the process (a later rebuild at this stamp is seen by the next process, which costs assembled reads, never wrong
+     *  ones); a "yes" is read again on each heal, so a rebuild elsewhere stops this writer at its next heal. */
+    let yields = false;
+    async function mayWrite() {
+        if (yields)
+            return false;
+        // The record is derived like the rows: a read or write of it that fails is logged, and the page is served
+        // assembled with nothing written (spec 2026-10-07 §2 Failure), never failed on it.
+        try {
+            const recorded = await published().recordedModel();
+            if (recorded === null) {
+                await published().recordModel(stamp);
+                return true;
+            }
+            yields = recorded !== stamp;
+            return !yields;
+        }
+        catch (e) {
+            console.error("smoodly: reading the space's recorded document stamp failed; served assembled, nothing written.", e);
+            return false;
+        }
+    }
     const fresh = (row) => current(row) && row.document != null;
     const itemOf = (doc) => toEntryItem(doc.entry, doc.entry.fields, { path: doc.path, locale: doc.locale, locales: doc.locales, ...(doc.seo ? { seo: doc.seo } : {}) });
     /** A page row's answer: its document when current (null for a folder or a hidden node), else the healed one. */
-    const pageOf = (row, id, locale) => row && current(row) ? Promise.resolve(row.document) : projector.healPage(id, locale, { seen: row !== null });
+    const pageOf = async (row, id, locale) => row && current(row) ? row.document : projector.healPage(id, locale, { seen: row !== null, write: await mayWrite() });
     /** An entry document is served at an address only when its collection has addresses. */
     const served = (doc) => (doc && doc.path !== null ? doc : null);
-    const entryOf = async (row, id, locale) => row && fresh(row) ? row.document : projector.healEntry(id, locale, { seen: row !== null });
+    const entryOf = async (row, id, locale) => row && fresh(row) ? row.document : projector.healEntry(id, locale, { seen: row !== null, write: await mayWrite() });
+    /** An entry document as the projector would write it, from an assembled read (the address-less shape, path from the item). */
+    const assembledEntry = (collection, locale) => (read) => ({
+        kind: "entry", locale, collection, entry: { ...read.record, fields: read.item.fields },
+        path: read.item.path, locales: read.item.locales, ...(read.item.seo ? { seo: read.item.seo } : {}),
+    });
     /** The published documents of a collection's query. Stale rows are rebuilt in one batched projection and the
      *  query read once more (spec §4): a rebuild that finds an entry unpublished removes its row, so it drops out. */
     async function deliveredEntries(collection, o) {
@@ -70,9 +104,12 @@ export function createSmoodlySite(options) {
         let rows = await read();
         const behind = rows.filter((r) => !fresh(r)).map((r) => r.id);
         if (behind.length > 0) {
+            // Not the writer of record: the list assembled now, nothing written (DESIGN §3).
+            if (!(await mayWrite()))
+                return (await assembler.entries(collection, { ...o, locale, draft: false })).map(assembledEntry(collection, locale));
             // A failed rebuild never fails the read: the rows as read are served, and the next read tries again.
             try {
-                await projector.entries(behind, { cap: Infinity });
+                await projector.entries(behind, { cap: Infinity, stamp: false });
                 rows = await read();
             }
             catch (e) {
@@ -96,10 +133,13 @@ export function createSmoodlySite(options) {
             let rows = await published().tree(locale);
             const behind = rows.filter((r) => !current(r)).map((r) => r.id);
             if (behind.length > 0) {
+                // Not the writer of record: the tree assembled now, nothing written (DESIGN §3).
+                if (!(await mayWrite()))
+                    return assembler.tree(locale, { draft: false });
                 // One batched projection for every row behind (one tree read in the projector), then one more tree read.
                 // A failed rebuild never fails the read: the rows as read are served, and the next read tries again.
                 try {
-                    await projector.pages(behind, { cap: Infinity });
+                    await projector.pages(behind, { cap: Infinity, stamp: false });
                     rows = await published().tree(locale);
                 }
                 catch (e) {
@@ -147,7 +187,7 @@ export function createSmoodlySite(options) {
                     return itemOf(row.document);
                 // A miss is a record no projection wrote yet, or a slug: one `get` tells them apart.
                 if (row?.collection === collection || (await options.stores().entries.get(collection, idOrPath))) {
-                    const doc = await projector.healEntry(idOrPath, locale, { seen: row !== null });
+                    const doc = await projector.healEntry(idOrPath, locale, { seen: row !== null, write: await mayWrite() });
                     if (doc)
                         return itemOf(doc);
                 }
@@ -169,7 +209,7 @@ export function createSmoodlySite(options) {
                 return assembler.global(item, locale, { draft: true });
             // The item's row by its collection, in one read: a global is a one-record collection.
             const [row] = await published().entries(item.name, { locale, limit: 1 });
-            return row && fresh(row) ? row.document : projector.healGlobal(item, locale, { seen: row !== undefined });
+            return row && fresh(row) ? row.document : projector.healGlobal(item, locale, { seen: row !== undefined, write: await mayWrite() });
         },
     };
     /** The published read of an address; `code`: the code-owned page answers where the index has no row. */
@@ -182,7 +222,8 @@ export function createSmoodlySite(options) {
         let healed = null;
         if (route) {
             // Stale: rebuilt by id. Unpublished or moved since the row was written, the address is answered as a miss.
-            healed = route.kind === "page" ? await projector.healPage(route.row.id, locale) : served(await projector.healEntry(route.row.id, locale));
+            const write = await mayWrite();
+            healed = route.kind === "page" ? await projector.healPage(route.row.id, locale, { write }) : served(await projector.healEntry(route.row.id, locale, { write }));
             if (healed && healed.path === path)
                 return { hit: healed, rows };
         }
@@ -225,6 +266,7 @@ export function createSmoodlySite(options) {
         locales,
         homePageSlug,
         cacheKey,
+        stamp,
         styles,
         custom,
         locate: (locale, path) => options.stores().pages.resolvePath(locale, path),
@@ -251,7 +293,7 @@ export function createSmoodlySite(options) {
                     // pays the call where a page renders it. A stale row heals once and is written.
                     if (!row)
                         continue;
-                    globals.set(item.name, fresh(row) ? row.document : await projector.healGlobal(item, locale, { seen: true }));
+                    globals.set(item.name, fresh(row) ? row.document : await projector.healGlobal(item, locale, { seen: true, write: await mayWrite() }));
                 }
             }
             return { hit, globals };

package/dist/sql-space.d.ts

@@ -8,8 +8,10 @@ export declare const CONTENT_TABLES: readonly ["pages", "page_locales", "page_ve
 export type ContentTable = (typeof CONTENT_TABLES)[number];
 /** The delivery model's derived tables (spec 2026-10-07 §1): policy-covered and
  *  space-stamped like content, but not transferred (export skips them, import
- *  rebuilds them) and not counted toward the row cap, since they are derived. */
-export declare const DELIVERY_TABLES: readonly ["published_pages", "published_entries"];
+ *  rebuilds them) and not counted toward the row cap, since they are derived.
+ *  `published_models` (schema v10) holds one row per space: the document stamp the space recorded as current;
+ *  `space_deploys` (schema v11) one row per space: the last Deploy press of static mode. */
+export declare const DELIVERY_TABLES: readonly ["published_pages", "published_entries", "published_models", "space_deploys"];
 export declare function currentSpaceSQL(): string;
 /** One permissive policy per action (spec 2026-09-29 pre-install fixes §3):
  *  the write key's insert, update and delete, each alone for its action; its

package/dist/sql-space.js

@@ -21,8 +21,10 @@ export const CONTENT_TABLES = [
 ];
 /** The delivery model's derived tables (spec 2026-10-07 §1): policy-covered and
  *  space-stamped like content, but not transferred (export skips them, import
- *  rebuilds them) and not counted toward the row cap, since they are derived. */
-export const DELIVERY_TABLES = ["published_pages", "published_entries"];
+ *  rebuilds them) and not counted toward the row cap, since they are derived.
+ *  `published_models` (schema v10) holds one row per space: the document stamp the space recorded as current;
+ *  `space_deploys` (schema v11) one row per space: the last Deploy press of static mode. */
+export const DELIVERY_TABLES = ["published_pages", "published_entries", "published_models", "space_deploys"];
 export function currentSpaceSQL() {
     return `
 -- The space a request acts in: the key's claim in Smoodly Cloud, the

package/dist/sql.js

@@ -9,7 +9,7 @@
 // locale (spec 2026-09-06 §7); a versioned collection reads its
 // fields from the published snapshot.
 import { SEO_KEY } from "./seo.js";
-import { currentSpaceSQL, grantsSQL, SPACE_COL, spaceLayerSQL } from "./sql-space.js";
+import { currentSpaceSQL, grantsSQL, SPACE_COL, spaceLayerSQL, DEFAULT_SPACE } from "./sql-space.js";
 const snake = (s) => s.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
 const q = (s) => `"${s}"`;
 // Casts are fine in views.
@@ -173,8 +173,27 @@ create unique index if not exists "published_entries_address_idx"
 create index if not exists "published_entries_fields_idx"
   on "published_entries" using gin ("fields");
 
+-- The document stamp a space recorded as current (DESIGN §3, schema v10): set by \`npx smoodly rebuild\`
+-- and by the first writer into an empty record; only a reader at this stamp rewrites the rows above.
+create table if not exists "published_models" (
+  "space_id" uuid primary key default ${DEFAULT_SPACE},
+  "model" text not null,
+  "recorded_at" timestamptz not null default now()
+);
+
+-- The last Deploy press of a space (spec 2026-10-09 static mode §7, schema v11): who pressed and when;
+-- the admin compares it with the build marker the live site serves.
+create table if not exists "space_deploys" (
+  "space_id" uuid primary key default ${DEFAULT_SPACE},
+  "requested_at" timestamptz,
+  "requested_by" text,
+  "removed_at" timestamptz
+);
+
 alter table "published_pages" enable row level security;
 alter table "published_entries" enable row level security;
+alter table "published_models" enable row level security;
+alter table "space_deploys" enable row level security;
 
 -- smoodly_list_entries without the draft branch, over the delivery table (spec 2026-10-07 §3):
 -- \`where\` and \`order\` read the raw published snapshot, the row answers with its document.