smoodly 0.0.6 → 0.0.8

package/README.md

@@ -38,40 +38,49 @@ Implemented:
   pages runtime: policies normalized to plain data, tree nodes mapped to
   registered components, fail-soft on unknown types
 - `collectionSQL` / `coreTablesSQL` — the stable schema (DESIGN.md §3):
-  `coreTablesSQL` emits the once-ever core tables including `entries`
-  (`collection` + `fields`/`i18n` jsonb, `space_id` multi-tenancy with
-  a default space for self-hosted, `sort` for manual ordering, ONE
-  generic slug-uniqueness index across all spaces and collections,
-  scoped to siblings — `(space_id, collection, parent_id, slug)`, like
-  pages, partial on a non-null slug);
+  `coreTablesSQL` emits the once-ever core tables including `entries`,
+  `entry_locales` and `entry_versions` (shared fields on the node,
+  localized fields, slug and status per locale row, merged snapshots
+  per locale for versioned collections; `space_id` multi-tenancy with
+  a default space for self-hosted, `sort` for manual ordering, and no
+  sibling-slug index at all — sibling uniqueness is the primary key of
+  `paths` plus a pre-check the stores make per locale, for entries and
+  pages alike);
   `collectionSQL` emits only the disposable per-collection guardrails —
-  a published-only read view over `entries` (typed casts, snake_case
-  aliases, refs as plain id values) and partial btree indexes for
-  the declared `order.by` field, on the jsonb VALUE (`("fields"->'x')`)
-- `PageStore` contract + `MemoryPageStore` — id-keyed page persistence:
-  every read and write takes the record's `id`, and the URL is derived
-  from the tree, never stored on the record. Pages form a tree (`parentId`,
-  sibling `sort`, a null `template` = folder, `pages.tree.depth` capping
-  how deep editors may nest), carry a `title` and a per-locale `i18n`
-  overlay, and expose `rename` (per-locale slug/title), `move`,
-  `setTemplate`, `resolvePath(locale, path)` and `pathsOf(id)` alongside
-  the draft/publish semantics (versions accumulate; publish moves a
-  pointer; drafts never leak into published reads). The contract is a
-  reusable suite (`test/page-store-contract.ts`); every adapter runs the
-  same tests.
+  a published-only read view joining `entries` and `entry_locales` (one
+  row per published locale, a `locale` column; a versioned collection
+  reads the published snapshot; typed casts, snake_case aliases, refs as
+  plain id values) and partial btree indexes for the declared `order.by`
+  field, on the jsonb VALUE (`("fields"->'x')`)
+- `PageStore` contract + `MemoryPageStore` — id-keyed page persistence
+  over pages/page_locales/page_versions/paths — one node, one row per
+  locale, each locale with its own tree, draft, publish and history
+  (spec 2026-09-06). Every read and write takes the record's `id`, and
+  the URL is derived from the tree, never stored on the record. Pages
+  form a tree (`parentId`, sibling `sort`, a null `template` = folder,
+  `pages.tree.depth` capping how deep editors may nest), and expose
+  `rename` (a locale's slug/title), `move`, `setTemplate`, `addLocale`,
+  `removeLocale`, `resolvePath(locale, path)` and `pathsOf(id)` alongside
+  the draft/publish semantics (versions accumulate; publish moves that
+  locale's pointer; drafts never leak into published reads). The contract
+  is a reusable suite (`test/page-store-contract.ts`); every adapter runs
+  the same tests.
 - `SupabasePageStore` — the same id-keyed contract over
-  pages/page_versions/paths (a server-side client from
+  pages/page_locales/page_versions/paths (a server-side client from
   `createSmoodlyClient`: the service role in self-host, a write key in
   the cloud). Contract-tested against a real local stack: `supabase
   start` at the repo root (the generated DDL is its one migration), then
   `npm run test:supabase`; plain `npm test` skips it and never needs
   Docker.
 - `paths.ts` — the ONE place a URL is derived: pure, framework-free
-  functions (`segmentFor`, `chainOf`, `pagePath`, `pagePathRows`,
-  `entryPathRows`, `buildPageTree`, segment and depth assertions) that both
-  adapters and the tree query call, so the index and every derived `path`
-  agree by construction. `pagePath` is the single page-path derivation —
-  `pagePathRows`, `buildPageTree` and the site layer all go through it.
+  functions (`segmentFor` — a locale's own segment, no fallback —
+  `chainOf`, `pagePath`, `pagePathIn` (nullable, for the admin),
+  `pagePathRows`, `entryPathRows`, `entrySegment` (a locale's own slug,
+  no fallback), `assertSupportedLocale` (both stores), `buildPageTree`,
+  segment and depth assertions) that both adapters and the tree query call, so the index
+  and every derived `path` agree by construction. `pagePath` is the
+  single page-path derivation — `pagePathRows`, `buildPageTree` and the
+  site layer all go through it.
 - `PathIndex` — the derived URL index, `MemoryPathIndex` and
   `SupabasePathIndex` over the `paths` table ((space, locale, path) → page
   or entry). Pages and entries share ONE instance, so a page and an entry
@@ -98,12 +107,11 @@ Implemented:
   collection's descriptors, for the entry-page route: the shared task
   collection and batched rounds are factored out, so a ref site behaves
   identically whether it sits in a page tree or in an entry.
-- `localize.ts` — per-field locale fallback over the two overlays the
-  stores carry: `titleFor` (a page's `i18n[locale].title`, else the default
-  locale's), `localizeFields` (an entry's `i18n[locale]`, per field, with a
-  blank overlay value falling back) and `fixedPathFor` (the path a fixed
-  page registration is served at in one locale — the escape hatch's
-  addressing). Slugs stay `paths.ts`'s business.
+- `localize.ts` — `fixedPathFor` (the path a fixed page registration
+  is served at in one locale — the escape hatch's addressing; a slug map
+  that omits a locale means "the same segment", since a registration is
+  code, not a record). Pages themselves have no fallback: title and slug
+  live on `page_locales`, and slugs stay `paths.ts`'s business.
 
 - `collectEntryRefs` / `collectTreeRefs` — the refs-index feeders: walk
   an entry or a page tree against its schemas and list every outgoing
@@ -124,16 +132,23 @@ Implemented:
   `MemoryRefIndex` in memory); the cross-store contract
   (`test/page-refs-contract.ts`) runs against memory AND Supabase.
 - `EntryStore` contract + `MemoryEntryStore` + `SupabaseEntryStore` —
-  collection-entry persistence (status-only versioning in v1): saves
-  rewrite the entry's refs rows, `referencesTo` answers the reverse
+  collection-entry persistence over entries/entry_locales/entry_versions/paths
+  — one node, one row per locale, each locale with its own slug, status
+  and `.localized()` fields, shared fields on the node, and a per-locale
+  version history for collections with `versions: true` (spec 2026-09-06
+  §7): `create({ locale })`, `update(id, locale, fields)`,
+  `setStatus(id, locale, status)`, `addLocale`, `removeLocale`,
+  `listVersions`; saves rewrite the entry's refs rows over every locale's
+  live field set, `referencesTo` answers the reverse
   question, `getMany` is the batched read whose signature is
-  `resolveTree`'s `EntryFetcher` (with `{ status: "published" }` for the
+  `resolveTree`'s `EntryFetcher`, now `(collection, ids, locale, { status })`,
+  the published read of a versioned collection being the snapshot
+  (with `{ status: "published" }` for the
   published-route read — a post-publish demotion resolves as missing
   instead of leaking draft fields — DESIGN.md §3 "Page edges in refs"), deletes are blocked while
   referenced,
-  entry slugs are unique among SIBLINGS in both adapters (the same rule
-  pages have: `/docs/guide-a/intro` and `/docs/guide-b/intro` coexist,
-  a slug-less entry never conflicts),
+  entry slugs are unique among SIBLINGS per locale in both adapters
+  (a code pre-check; the `paths` primary key is the invariant),
   and `reorder` rewrites sort 1..N through the `smoodly_reorder` SQL
   function (one statement, `updated_at` untouched). Same
   reusable-contract pattern as PageStore; `npm run test:supabase` runs
@@ -157,9 +172,11 @@ Implemented:
   so they read through the same policy set rather than their owner's
   privileges. Live acceptance test in `test/rls.supabase.test.ts`. Note
   for self-host: the anon key now reads published rows straight off the
-  base tables (`pages`, `entries` including the `i18n` overlay, a page's
-  published `page_versions` tree, `global_sections`), not only through
-  the generated views.
+  base tables (`pages` and `entries` published in any locale, a published
+  `page_locales`/`entry_locales` row, the `page_versions`/`entry_versions`
+  row a published locale points at — shared content included, since it
+  is stored as entries, spec 2026-09-07), not only through the generated
+  views.
 
 - Admin login: `supabaseAdminAuth` + `gateAdminOp` around the ops seam;
   `LoginView` + `useAdminSession` in the shell; `createSmoodlyAdmin({ auth })`.
@@ -195,6 +212,8 @@ Implemented:
 - The admin is the page TREE (spec 2026-09-05 §7): the ops seam addresses
   pages by id — `pages.list`/`get`/`create`/`saveDraft`/`publish`/
   `delete`/`rename`/`move`/`setTemplate`, plus `entries.move`.
+  `entries.get`/`create`/`save`/`setStatus` take a locale;
+  `entries.addLocale`/`removeLocale`.
   `pages.list` materializes the code-owned root nodes before an editor
   touches them (`admin/fixed-nodes.ts` derives fixed pages and collection
   mounts from the registry, never from a column), and every guard asks
@@ -214,11 +233,12 @@ Implemented:
   `admin/shell/PagesList.tsx` with a row menu over the tree ops (New
   subpage, New subfolder, Add page here, Rename…, Move up / Move down,
   Delete, and Edit index page on a mount a fixed page claims). The editor
-  is keyed by id, with a locale switcher pointing the canvas at
-  `urls[locale]` and, while no block is selected, page settings
-  (`admin/editor/PageSettings.tsx`: title and slug per locale through
-  `pages.rename`; SEO/meta fields stay OQ #17). The entry form prefixes
-  its slug field with the collection's mount path. The serialized
+  is keyed by id, with a locale switcher loading that locale's own tree
+  and pointing the canvas at `urls[locale]` and, while no block is
+  selected, page settings (`admin/editor/PageSettings.tsx`: the title and
+  slug of the ACTIVE locale through `pages.rename`; SEO/meta fields stay
+  OQ #17). The entry form prefixes its slug field with the collection's
+  mount path. The serialized
   registry carries `collections[].path`/`depth`, `pages[].slugs` and
   `pageDepth`, and `defineConfig` validates `homePageSlug` — a real
   segment, and never a collection's mount.
@@ -229,10 +249,12 @@ Implemented:
   reads, folders or fallback. `locate(locale, path)` is one primary-key
   hit on the `paths` index; `load(target, locale, path, { draft? })`
   fetches the record and its tree (draft or published), resolves refs,
-  applies the `i18n` overlays, and returns a `SitePage` — `record`,
+  reads the locale's own rows, and returns a `SitePage` — `record`,
   `template`, `tree`, localized `title`, `path`, `ancestors`, `children`,
   and `paths` (locale → path, for alternates) — or a `SiteEntry` with the
-  entry's fields localized and resolved. `resolve(locale, path, { draft? })`
+  locale's merged fields (a versioned collection's published snapshot on
+  the public path) resolved, and `paths` for its published locales.
+  `resolve(locale, path, { draft? })`
   is the two in sequence — `locate` then `load` — for a caller that just
   wants the hit. A folder (null template), an
   unpublished record outside draft mode, or a missing one is `null`.
@@ -280,13 +302,25 @@ Implemented:
   the only way the node gets there — it also covers pages that existed
   before a locked zone was added to their schema.
 
+- Shared content (spec 2026-09-07): `smoodly.shared({ name, title, section })`
+  registers a visual item, `smoodly.shared({ name, title, fields })` an
+  object item; one registration materializes as a singleton entry in
+  every supported locale. `site.getShared(item, { locale })` and the Next
+  glue's `getSmoodlyShared(item, { locale })` fetch it code-side; the
+  editor places a visual item in a zone from the "+" picker as a linked
+  `{ type: "shared", fields: { item, ref } }` node the resolve pass
+  rewrites into the section, and `z.locked(footer)` binds a zone to one.
+  Edited on its own admin page under Shared content (`/admin/shared/<name>`),
+  with "used on N pages" from `refs`. Wired through the `shared` option
+  on the entry store and the site layer.
+
 Not yet: richtext components (TipTap; `plainToRichtext`/
 `richtextToPlain` exist but no rich editor widget), drag-and-drop
 reordering (move-up/move-down buttons in the editor, Move up / Move down
 in the Pages list's row menu), undo/redo, sample/placeholder content
-marking, per-locale section field values (OQ #3 — the editor's locale
-switcher moves the canvas and page settings between locales, but a
-section's fields are one set for every locale).
+marking, per-locale section visibility conditions (OQ #3 — each locale
+now has its own tree, so a section's fields are already per locale; what
+is open is hiding a section by a locale-dependent condition).
 
 ## Releasing
 
@@ -302,6 +336,79 @@ Both packages move together. From the repo root:
 `examples/site` in that build, so the template always matches the example
 site at the tagged commit.
 
+## Follow-ups (logged 2026-09-07, shared content spec)
+
+- `f.shared(() => item)` — a ref field on a section that renders a shared
+  item inside the section's own markup (spec 2026-09-07 decision 3).
+- Instance mode: a shared *type* with many editor-created items; today
+  the answer is a collection plus a section with `f.ref` (decision 1).
+- Zone-shaped shared items (`smoodly.shared({ zone })`) (decision 2).
+- Standalone live preview on a visual item's admin page — needs a
+  preview route in the glue; the page canvas shows placements today (§6).
+- Built-in meta on shared items and on placements (anchor per placement
+  is the likely shape).
+- Per-placement overrides (a shared band with a per-page heading) — out
+  of scope; use a normal section with `f.ref` fields.
+- `fillLockedZones` for a zone bound to a shared item waits for
+  `ops.shared.list()`; a page opened before that resolves fills on the
+  next effect run. Not seen in the walk — the example binds no zone, so
+  the path was never exercised — but a double fill is unreachable by
+  construction: the effect depends on `sharedIds`, `record`, `mutate` and
+  `tree === null`, and `fillLockedZones` only touches EMPTY zones.
+  `z.locked(item)` still has no example usage.
+- `SharedForm` lists linking pages by id; a title needs `ops.pages.get`
+  per page (or a usage op returning titles).
+- `getSmoodlyShared` reads the store per request in draft mode and once
+  per (item, locale) otherwise; a layout calling it for several items
+  makes one round trip each — batch if it shows.
+- The Supabase entry store's singleton check is SELECT-then-INSERT with
+  no unique index; two admin loads racing on an item's first
+  materialization can create two rows. `ensureSharedItems` reads the
+  first row either way, and the duplicate cannot be removed through the
+  API — `delete` refuses every shared row. Two ways to make the race
+  impossible: a deterministic row id (uuid v5 of the item name, so the
+  second insert fails on the primary key — no schema change), or a
+  per-item partial unique index emitted by the SQL generator the way
+  `collectionSQL` emits the rest.
+- `SharedForm.tsx` is a near-verbatim fork of `EntryForm.tsx`
+  (`localeFromUrl`, `writeLocaleToUrl`, `applyResult`, `InfoRow`, the
+  ref-options effect) and `SharedList.tsx` is the third copy of the
+  remembered-locale block (`EntriesList`, `PagesList`); extract
+  `shell/locale-url.ts` and a `useFormLocale` hook when the next form
+  arrives.
+- A placement selected in a bound locked zone shows the canvas toolbar's
+  "fields only" label though a placement has no page-level fields; the
+  inspector notice is the real message.
+- A zone whose policy allows a shared item's section also offers that
+  section as an ordinary block, so the picker lists e.g. Testimonials
+  twice (once under Shared); decide whether a section used by a shared
+  item should be hidden from the ordinary list.
+- A placement of an object item or an unregistered item gates the page's
+  publish (the refs edge is emitted without a registry lookup) yet never
+  renders; only a hand-edited tree can produce one.
+- `ops.shared.get` runs `ensureSharedItems` and then lists the item
+  again; one round trip could go.
+- The example's Testimonials `quotes` richtext is required, so the first
+  admin save of the seeded band asks for it; make it optional or seed it.
+- `CollectionSchema.kind` was widened to carry `"shared"`, so a
+  `SharedSchema` typechecks where `registry.collections` is expected;
+  `defineConfig` should throw on a `kind === "shared"` entry listed there.
+- `ensureSharedItems` runs on every `ops.shared.list()` — which is every
+  editor mount, not only the Shared content page — costing one
+  `entries.list` per registration per open.
+- `fanOut` resolves every shared registration's row id (one
+  `entries.list` each) on every entry write, so it can expire
+  `shared:<name>` when something the item references changes; a row-id
+  cache would remove the reads but has to survive materialization.
+- Because `fanOut` lists every shared registration, an entry store built
+  without `options.shared` now fails on every ordinary entry write with
+  "no collection named", not only on `ops.shared.*`; both scaffolds pass
+  the same `shared` array to the store and the config, so this bites only
+  a hand-wired app.
+- `ops.entries.move` expires entry tags directly and does not `fanOut`,
+  so a reorder that changes what a shared item's `refList` renders does
+  not expire `shared:<name>`.
+
 ## Follow-ups (logged 2026-09-06)
 
 - Drag-and-drop in the Pages list — the ops it needs exist
@@ -310,17 +417,13 @@ site at the tagged commit.
 - Nested entries have no admin UI beyond `entries.move`: nothing creates
   a child entry or shows the entry tree, and the entry form's slug prefix
   is the collection's mount base only, not the parent chain.
-- A blank translated slug cannot be CLEARED from the settings panel: the
-  panel skips an empty non-default value (a blank falls back to the
-  default locale) and the store reads `slug: undefined` as "no change",
-  so removing an existing override would need a `null` patch through
-  `rename`.
 - SEO/meta fields in page settings — DESIGN.md OQ #17. Title and slug per
   locale shipped; nothing writes `PageTree.meta` yet.
-- `pages.get` makes three sequential store round trips (`getPage`,
-  `getDraftTree`, `pathsOf`), and the editor calls it on load and after
-  every rename — one store call returning the three would halve the
-  editor's latency.
+- `pages.get` makes four sequential store round trips for a non-root page
+  (`getPage`, `getDraftTree`, `pathsOf`, and the parent read behind
+  `parentLocales`; three for a root, which has no parent to read), and the
+  editor calls it on load and after every rename — one store call
+  returning them all would cut the editor's latency.
 - `entries.move` expires the entry and its descendants but does not fan
   out to the pages referencing them, nor to the old and the new parent
   entries the way `pages.move` does — asymmetric with `entries.save` and
@@ -389,8 +492,23 @@ site at the tagged commit.
   menu — inside a `role="button"` row. It works, because both stop the
   click and the keydown, but it is an accessibility smell a real treegrid
   would not have.
-- `EditorView.tsx` is ~720 lines. The inspector and the canvas column are
-  the extraction seam whenever it is next touched.
+- `ensureFixedNodes` warns on every `pages.list` while a fixed node's
+  locale cannot land (an editor page holds its path); a one-time notice
+  in the admin would be kinder than a warning per listing.
+- Cache tags are still `page:<id>`: publishing one locale expires every
+  locale's cached unit of that page (spec 2026-09-06 §4). A
+  `page:<id>:<locale>` tag would halve the revalidations on a bilingual
+  site.
+- The Pages list's confirms (`Add <locale>`, `Remove from <locale>`,
+  `Delete … in every language`) are `window.confirm`, and `EntriesList`
+  reports a refused add or remove with `window.alert`; the design
+  system's dialog is the follow-up for both, together with the row menu
+  extraction already logged above.
+- `EditorView.tsx` is ~850 lines now that it also holds the locale switch,
+  add and remove flows — see the 2026-09-03 follow-up below for the seams
+  (that entry is the one to act on).
+- The `LocaleSwitcher` is a native `<select>`; a `Segmented` with an
+  "+ add" affordance would match the Pages list.
 - `i18n/request.ts` returns `{ locale, messages: {} }`. next-intl 4.14.2
   throws `No messages found` when the provider inherits none, and the
   example has no UI strings of its own, so the object is empty; a
@@ -426,6 +544,134 @@ site at the tagged commit.
   (`/((?!admin|api|_next|_vercel|.*\..*).*)`). An app that mounts the
   admin somewhere else edits `proxy.ts` by hand; nothing derives the
   matcher from the config.
+- `classify` in `ops-impl.ts` is ~20 order-sensitive substring checks over
+  store messages — `"already exists in locale"` must precede
+  `"already exists"`, or an addLocale conflict reads as a slug conflict. A
+  typed code on `pageErrors` (thrown and matched, not re-parsed) would
+  remove the ordering hazard before plan 2 adds the entry messages.
+- `ops-impl.ts` is ~436 lines with a ~165-line `pages` group. The guard
+  helpers (`nameOf`, `isHomeNode`, `supportedLocale`, `mountGuard`,
+  `owned`) are the extraction seam — a `pages-ops.ts` taking them as
+  collaborators. The `entries` group now duplicates two of them outright:
+  the `supportedLocale` guard and the `parentLocales` computation exist
+  once per group.
+- `fixedNodeSpecs(config)` rebuilds the whole spec list on every
+  `fixedNodeOf` call, and the ops call `fixedNodeOf` per guarded write. A
+  `WeakMap` memo keyed by the config object is the whole fix.
+- `SupabasePageStore.updateLocale` re-reads the record (`must(id)`) after
+  every update, so `setTemplate` is N+1 in the page's locales: one update
+  and one full read each. Only the last read is used. The Supabase entry
+  adapter is the same shape: `create` is insert → insert → read →
+  version → read → paths → refs, and `removeLocale` re-fetches the entry
+  three times.
+- The single-language branch — no locale selector in the Pages list, no
+  switcher, no add/remove — has no automated coverage; only three sites
+  branch on the locale count (`PagesList.tsx`, `EditorView.tsx` and
+  `page-renderer.tsx`'s alternates), so a regression there shows up only
+  in a scaffolded single-language app.
+- No test pins that a published child's breadcrumb carries an UNPUBLISHED
+  ancestor's title with `hasPage: false`; `site.test.tsx` covers the
+  folder ancestor only, and the two paths share one `hasPage` predicate.
+- A locale dropped from `locales.supported` leaves its `page_locales`,
+  `page_versions` and `paths` rows in place but unreachable — nothing
+  lists or serves them, and nothing cleans them up. It is the mirror of
+  the materializer's top-up, and wants the same deliberate answer (an
+  admin-visible orphan list, or a prune op).
+- `LOCALE_CODE_RE` accepts any 2–4 letter subtag as script or region
+  (`en-ZZZZ` passes), and a duplicate entry in `supported` passes
+  silently — boot validation catches typos in shape, not in fact.
+- `MemoryPageStore.publish` throws the "is a folder" message when a
+  templated row has no draft version. Unreachable through the ops (a
+  templated page always gets a first version), but the message would be
+  wrong if it ever were.
+- The Pages list offers "Add <locale>" on a dimmed row whose parent lacks
+  that locale, and learns the refusal only after the round trip.
+  `pagesTreeRows` already carries every node's locales, so the parent's
+  presence could disable the item with its reason up front, exactly as
+  the editor's switcher does with `parentLocales`. `EntriesList` has the
+  same gap (and `entryRows` would have to carry the locales again — the
+  dead field was deleted rather than left unused); it is unreachable
+  today, since nothing in the admin creates a child entry.
+- No version history UI for entries (nor pages): `listVersions` exists on
+  both stores; a history pane with restore is the follow-up. Restoring a
+  versioned entry's snapshot must also restore the shared fields (the
+  snapshot is merged).
+- `entries.list` filters `{ locale, status }` in memory after fetching
+  every row (PostgREST cannot filter the parent by an embedded row
+  without `!inner`, which would drop the other rows); fine at collection
+  sizes today.
+- The entry form's ref picker offers only targets present in the locale
+  being edited; a target present but unpublished there is offered marked
+  `(draft)` and blocks a page publish in that locale until published —
+  the picker could say so.
+- A collection's `path` map that omits a supported locale falls back to
+  the default segment for entry paths (`collectionSegment`) while the
+  mount node is materialized map-keys-only; the two should agree as
+  fixed pages now do.
+- `removeLocale` on the Supabase entry adapter is deliberately
+  non-atomic (row and versions go, then paths), the same trade-off as
+  pages.
+- `EntryForm.tsx` grew the locale lifecycle beside the fields; the
+  `LocaleSwitcher` is shared with the editor now, the add/remove flows
+  are not (`doAddLocale`/`doRemoveLocale` exist twice).
+- Turning `.localized()` off for a field with per-locale values leaves
+  those values in `entry_locales.fields` until the next save of each
+  locale (a save writes only the current split) — the drift/codemod
+  pipeline (Phase 2) is where "keep en, discard fi" belongs.
+- The repo-root migration (`supabase/migrations/00000000000000_smoodly.sql`)
+  is generated by `packages/smoodly/scripts/emit-sql.ts` from that
+  script's OWN fixture collections, not from
+  `examples/site/smoodly/collections.ts`; the create-smoodly-app template
+  migration IS generated from the example. Since the example's `articles`
+  is now `versions: true`, the repo-root `articles` view reads the live
+  locale row while the example's model serves the published snapshot —
+  the two should share one source.
+- In the entry form, a shared ref field (e.g. an article's author) shows
+  `—` in a locale where the target is absent, because the picker offers
+  only targets present in the edited locale; the value is kept on the
+  node and the other locale's byline is unchanged, but it looks empty
+  and cannot be re-set from that locale.
+- `entryPathRows` relies on the stores validating locale keys on write
+  (no guard of its own); `list`/`getMany` accept an unsupported locale
+  silently and read as "no content".
+- The Supabase entry adapter's `removeLocale` deletes the row and its
+  versions before the paths rewrite with no rollback; its residue
+  comment describes the opposite case (a surviving path row for a
+  removed locale, not a present node without its path row).
+- The entry form's locale switch, add and remove confirm before
+  discarding unsaved edits (a `dirty` flag; the form has no autosave,
+  unlike the page editor's flush).
+- `addLocale` does not bump the entry's `updatedAt` while `removeLocale`
+  does. Both adapters agree, so the contract is honest, but "adding a
+  language is not an edit and removing one is" is arbitrary — decide it
+  deliberately before someone sorts a list by Updated.
+- The Supabase entry adapter's rollbacks are best-effort and can mask the
+  original throw: `create`'s catch runs `paths.remove` before the node
+  delete (a failing remove strands the node and replaces the real error),
+  `update` and `move` restore by writing, and those writes can throw in
+  place of the rewrite's rejection. `recordVersion` is two statements
+  (insert, then point at it), so a failure between them leaves an
+  unreferenced `entry_versions` row — invisible to every policy and
+  harmless, but it accumulates.
+- `removeLocale`'s blocker list (`localeInUse`) is unordered in the
+  Supabase adapter — the children query has no `.order()` — so a
+  multi-blocker message can name the titles in a different order than the
+  memory adapter's. Message text only; the contract case has one blocker.
+- `entry-store.ts` is ~624 lines. The pure helpers (`localizedKeys`,
+  `splitFields`, `entryFieldsIn`, `entryRefEdges`, `entryTitleIn`) are the
+  extraction seam from the memory adapter, the same shape as the
+  `EditorView.tsx` and `ops-impl.ts` entries above.
+- In a single-language project the entry form renders `slug` last:
+  `localizedFieldKeys` puts it in the `own` group, which follows
+  `shared`, and no section labels are shown — so the field order the
+  schema declares is not the order on screen.
+- `admin-entries-list.test.ts` has no case for a row with differing
+  pointers (the `draft edits` status), nor one asserting that an absent
+  row's `updatedAt` falls back to the node's. Two assertions.
+- `assertPublishable` (`store.ts`) awaits one `entries.get` per
+  referenced entry, sequentially, on every publish — a `refList` of a
+  dozen articles is a dozen serial reads, now per locale. `getMany(ids,
+  locale)` takes exactly that shape and would make it one call.
 
 ## Follow-ups (logged 2026-09-05)
 
@@ -450,18 +696,18 @@ site at the tagged commit.
 - `sections` is passed twice — to `createSmoodlySite` (ref resolution) and to
   `createPageRenderer` (the component map) — and `elements` cannot be passed
   at all; the two lists can drift silently.
-- `getEntry` by bare slug matches `entrySegment` on the ALREADY-localized
-  entry, so the overlay is applied twice; it diverges only for a non-string
-  `i18n[locale].slug`. `getEntry` by id reads the whole collection to find
-  one row.
+- `getEntry` by bare slug matches `entrySegment` — the locale row's own
+  `slug`, the same value `paths` is written from — so the two cannot
+  diverge (the double-overlay hazard went with `EntryRecord.i18n`).
+  `getEntry` by id still reads the whole collection to find one row.
 - `locate` (one primary-key hit on `paths`) runs per request outside the
   cache, because the cache tag needs the id before the unit can be cached; a
   later `"use cache"` migration (OQ #19) can fold it in.
 - Entry-page metadata is alternates only — entries have no `meta`. A
   `titleField`-based title is a later nicety.
-- Localized tree content (per-locale section fields) is not rendered: there
-  is no storage model for it yet (OQ #3). `title` and entry `fields` are
-  localized.
+- Per-locale section visibility conditions are not modelled (OQ #3). Tree
+  content itself is per locale now — each `page_locales` row points at its
+  own version — so the section fields a locale sees are its own.
 - `getEntries`/`getEntriesTree` return refs as ids (cheap lists); `getEntry`
   by path resolves them, `getEntry` by id or slug does not — document or
   unify when a site needs resolved lists.
@@ -478,7 +724,8 @@ site at the tagged commit.
 - `SmoodlyConfig.registry.pages` (`Registered` in `src/config.ts`) has no
   call signature, so every app's glue casts it `as PageRegistration[]`.
 - The entry-page view receives the whole `EntryRecord`, every locale's
-  `i18n` included; a client entry page would ship all of it to the browser.
+  row in `locales` included (fields, slug, status and version pointers); a
+  client entry page would ship all of it to the browser.
 - `move` is best-effort across two statements (reorder, then path rewrite):
   a failed rewrite restores each destination sibling's prior `sort` row by
   row, so a failure in the rollback itself still leaves the order changed.
@@ -527,9 +774,6 @@ site at the tagged commit.
   names no path.
 - `chainOf` has no cycle guard: a corrupted `parent_id` loop would spin
   forever. The stores prevent cycles on `move`, so it is unreachable today.
-- `EntryRecord.i18n` has no writer yet — the store reads and derives paths
-  from it, but nothing sets it, so per-locale entry slugs are unreachable
-  until the ops layer exposes them.
 - Design system pass (DESIGN.md §2, "The admin's visual system"): the shell,
   lists, entry form, login and editor were restyled onto `admin/ui/theme.tsx`.
   Deferred deliberately, because each is a feature rather than a restyle: the
@@ -582,4 +826,4 @@ site at the tagged commit.
 - `serialize.ts` structural cast duplicates `PageSchema`; tighten `Registered.schema` so the cast goes.
 - Catch-all `templates` map should filter to open registrations to state its intent (unreachable today).
 - The no-database build is the real proof that routes never prerender against the stores; the unit test only stubs `next/server`. Script it (`SUPABASE_URL=http://127.0.0.1:9 npx next build` in `examples/site`, expect `ƒ /`) and add it to CI, which today runs only the package's tests and typecheck — so a regression is caught when Next changes `connection()` semantics.
-- `EditorView` split, remaining seams (autosave extracted 2026-09-03): pull the canvas overlay and the insert picker into components when the dnd-kit outline work starts; the sidebar form stays put until inline editing lands (DESIGN.md §3 puts TipTap in the canvas, not the sidebar).
+- `EditorView` split, remaining seams (autosave extracted 2026-09-03): the locale lifecycle — `localeFromUrl`, `LocaleSwitcher`, `switchLocale`, `doAddLocale`, `doRemoveLocale` — is the cleanest extraction available now (self-contained, no canvas geometry); pull the canvas overlay and the insert picker into components when the dnd-kit outline work starts; the sidebar form stays put until inline editing lands (DESIGN.md §3 puts TipTap in the canvas, not the sidebar). (logged 2026-09-06)

package/dist/admin/client-ops.js

@@ -1,6 +1,7 @@
 const GROUPS = {
-    pages: ["list", "get", "create", "saveDraft", "publish", "delete", "rename", "move", "setTemplate"],
-    entries: ["list", "get", "create", "save", "setStatus", "delete", "move"],
+    pages: ["list", "get", "create", "saveDraft", "publish", "delete", "rename", "move", "setTemplate", "addLocale", "removeLocale"],
+    entries: ["list", "get", "create", "save", "setStatus", "delete", "move", "addLocale", "removeLocale"],
+    shared: ["list", "get", "save", "setStatus"],
     preview: ["enable", "disable"],
 };
 export function makeClientOps(action, token) {