uniweb 0.69.5 → 0.70.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.69.5",
+  "version": "0.70.1",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/content-writer": "^0.3.4",
-    "@uniweb/core": "^0.29.8",
-    "@uniweb/kit": "^0.19.4",
-    "@uniweb/schemas": "^0.7.0",
-    "@uniweb/runtime": "^0.27.4",
-    "@uniweb/semantic-parser": "^1.4.1"
+    "@uniweb/core": "^0.30.1",
+    "@uniweb/runtime": "^0.27.6",
+    "@uniweb/kit": "^0.19.5",
+    "@uniweb/schemas": "^0.7.1",
+    "@uniweb/semantic-parser": "^1.4.1",
+    "@uniweb/content-writer": "^0.3.4"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.63.4",
+    "@uniweb/build": "^0.64.1",
     "@uniweb/content-reader": "^1.2.5",
     "@uniweb/semantic-parser": "^1.4.1"
   },

package/partials/agents.md

@@ -2717,6 +2717,8 @@ Running `extract` before a build is the usual first mistake — it reads the com
 { "e5f6g7h8": { "default": "Learn More", "overrides": { "/pricing:cta": "See Pricing" } } }
 ```
 
+An override key is the page's route and the section's id (`cta` for `2-cta.md`); a page's own title, label, description and keywords are `/pricing:_meta`, and in `locales/records/` a record is named by its manifest context (`std/article/launch`).
+
 *Free-form bodies* — when a language needs different structure, different images, or copy rewritten rather than translated. The file replaces one section's content:
 
 ```
@@ -2726,7 +2728,7 @@ locales/freeform/es/records/article/x.md       # records work too
 
 These are **body only — no frontmatter**; params and config still come from the source section. `uniweb i18n init-freeform es pages/about hero` creates one pre-filled and records a source hash, so `uniweb i18n status --freeform` can tell you when the original moved on (`update-hash` to acknowledge). `move`, `rename`, and `prune --freeform` keep them aligned when pages get reorganized.
 
-**Records translate in the same `extract` run**, into their own manifest at `locales/records/manifest.json` — keyed by the RECORD, so a record translated once is found by every query that returns it.
+**Records translate in the same `extract` run**, into their own manifest at `locales/records/manifest.json` — keyed by the RECORD, so a record translated once is found by every query that returns it. A record whose query has a data schema translates exactly the fields the schema says are text — never an enum, a URL, a date, a number, a file, a reference or a `translatable: false` field — which are the fields a push carries in each language; mark a string that is a code or a key `translatable: false` and no translator is asked for it. An excerpt the build derives is re-derived from each language's body.
 
 **Component side.** Nothing to do: `content.title` arrives in the active language. The one thing a foundation builds is a switcher.
 

package/src/backend/client.js

@@ -74,10 +74,12 @@ export function resolveBackendOrigin() {
  * The fallback capability doc for when `GET /dev/config` was not asked for (no
  * credential in hand) or did not answer. Keeps the client non-breaking.
  *
- * ⭐ **It is EMPTY, and that is the accurate shape.** The CLI reads exactly one leaf of
- * that document — `delivery.siteSubscriptionRequired` — and its absence is meaningful:
- * unknown reads falsy, and the caller stays silent rather than claiming a deployment
- * does or does not charge. Every other key that used to sit here had no reader.
+ * ⭐ **It is EMPTY, and that is the accurate shape.** The CLI reads only that document's
+ * `siteContent` key lists — `queryFields`, `pageFields`, `settingsFields` — and their absence
+ * is meaningful: unknown means a push sends no optional key, which every deployment accepts,
+ * rather than claiming a deployment takes one. Every other key that used to sit here had no
+ * reader. *(The leaf named here was `delivery.siteSubscriptionRequired` until 2026-09-26; it
+ * went 2026-08-30.)*
  *
  * ⛔ **Do not restore a key "for completeness".** A default for a field nothing reads is
  * a reader waiting to happen, and it is how this file came to describe a client that
@@ -457,9 +459,12 @@ export class BackendClient {
    * were dropped because a serve location is read from the response that carries it
    * (`serve_base`, `serve_url`, `config.base`), never from a handshake; `auth.loginPath`
    * is not read either — the login path is a hardcoded constant
-   * (`utils/registry-auth.js`). What is actually consumed is ONE leaf —
-   * `delivery.siteSubscriptionRequired` — and nothing else. Do not add a reader for the
-   * rest: each one would be a second place a backend's layout is pinned.
+   * (`utils/registry-auth.js`). What is actually consumed is the key lists under
+   * `siteContent` — `queryFields`, `pageFields`, `settingsFields`, the keys the deployment's
+   * Sections declare (`site-sync.js::deploymentFields`) — which is policy, never an address. Do not
+   * add a reader for the rest: each one would be a second place a backend's layout is
+   * pinned. (This named `delivery.siteSubscriptionRequired` until 2026-09-26; that leaf
+   * went 2026-08-30.)
    *
    * @returns {Promise<object>}
    */
@@ -577,6 +582,32 @@ export class BackendClient {
     }
   }
 
+  /**
+   * GET /dev/site/foundation-schema/{site}/{@scope}/{name}/{version} → the registered version of a
+   * foundation a site uses, as the backend holds it: its `schema` (section types with their
+   * `data:`), `info`, `data_schemas` (names), `module_url` and `css_url`. Read through the SITE,
+   * which is the licence: the caller must be able to read the site, and the site must use the
+   * foundation. Null on a 404 (not registered, or not this site's) and on any failure — a caller
+   * degrades, since what it is read for can be done without it, less well.
+   * @param {string} siteUuid - the site-content uuid
+   * @param {string} ref - the catalog ref, `@scope/name@version`
+   * @returns {Promise<object|null>}
+   */
+  async readRegisteredFoundation(siteUuid, ref) {
+    const m = /^(@[^/]+)\/([^@/]+)@(.+)$/.exec(String(ref || ''))
+    if (!siteUuid || !m) return null
+    try {
+      const res = await this.request(
+        `/dev/site/foundation-schema/${encodeURIComponent(siteUuid)}/${m[1]}/${encodeURIComponent(m[2])}/${encodeURIComponent(m[3])}`
+      )
+      if (!res.ok) return null
+      const body = await res.json().catch(() => null)
+      return body && typeof body === 'object' && body.schema && typeof body.schema === 'object' ? body : null
+    } catch {
+      return null
+    }
+  }
+
   // ── Orgs ──────────────────────────────────────────────────────────────────────
 
   /** GET /dev/orgs → { account_handle, orgs[] }. */

package/src/backend/service-request.js

@@ -76,6 +76,11 @@ export function fingerprintDeclaration(declared) {
     .slice(0, 16)
 }
 
+/** Absent, or an empty list — a stored request that asks for nothing. */
+function isNothing(value) {
+  return value === undefined || value === null || (Array.isArray(value) && value.length === 0)
+}
+
 /** Deterministic JSON: object keys sorted at every depth, arrays left in order. */
 function stableString(value) {
   return JSON.stringify(value, (_k, v) =>
@@ -212,6 +217,12 @@ export function reconcile(localValue, remoteValue, baseFingerprint) {
   const base = baseFingerprint || null
 
   if (local === remote) return { action: 'none', local, remote }
+  // ⛔ A FILE THAT DECLARES NOTHING ASKS NOTHING, so it is never one side of a conflict. With
+  // nothing stored either — an empty list is the store's nothing — there is nothing to do; with
+  // something stored, the file is merely behind. Until 2026-09-26 this was a `conflict`, and the
+  // first publish of a site whose file is silent warned that its services "were changed
+  // elsewhere, and site.yml changed too", listing both as nothing.
+  if (local === null) return { action: isNothing(remoteValue) ? 'none' : 'adopt', local, remote }
   if (!base) return { action: 'conflict', local, remote }
 
   const localMoved = local !== base

package/src/backend/site-sync.js

@@ -46,7 +46,10 @@ import {
   harvestRecordItems,
   storedRecordItems,
   reprintRecordItems,
-  matchStoredRecords
+  matchStoredRecords,
+  parseCatalogRef,
+  readRegisteredFoundation,
+  writeRegisteredFoundation
 } from '@uniweb/build/uwx'
 
 // First entity `$`-document out of a `.uwx` we produced or the backend served.
@@ -326,18 +329,46 @@ function changedSummary(finalized) {
 // 404 → null (the emitter then says "register it first"). The bearer is acquired lazily
 // by the client, so a fully-local sync never authenticates.
 //
-// `offline` (set for `-o` / `--dry-run`) forces every non-local Model to null WITHOUT
-// touching the backend — an offline emit must never authenticate.
-export function makeModelResolver({ client, offline = false }) {
+// `offline` (set for `-o` / `--dry-run`, and for `status`) never touches the backend — an
+// offline emit must never authenticate. It answers with the Models a push or a pull KEPT for
+// this backend (`keptModels`), or null. ⭐ With `siteDir`, an online read keeps each Model it
+// reads, per backend — so a clone, whose foundation is not in the project to declare them, can
+// still compare offline. ⛔ Until 2026-09-26 nothing was kept, and `uniweb status` in a clone
+// could not resolve a Model ("… could not be resolved").
+export function makeModelResolver({ client, offline = false, siteDir = null, backend = null }) {
+  const origin = backend ?? client?.origin ?? null
+  const kept = siteDir && origin ? keptModels(siteDir, origin) : {}
   const cache = new Map()
   return async (modelName) => {
     if (cache.has(modelName)) return cache.get(modelName)
-    const decl = offline ? null : await client.readDataSchema(modelName)
+    let decl
+    if (offline) {
+      decl = kept[modelName] ?? null
+    } else {
+      decl = await client.readDataSchema(modelName)
+      if (decl && siteDir && origin) keepModels(siteDir, origin, { [modelName]: decl })
+    }
     cache.set(modelName, decl)
     return decl
   }
 }
 
+/**
+ * The Models a push or a pull read from this backend, by name — kept in `.uniweb/backend-cache.json`
+ * so an offline emit resolves what an online one did. Regenerable: losing them costs `status` its
+ * comparison until the next push or pull, never a wrong answer.
+ */
+export function keptModels(siteDir, backend) {
+  const models = readSyncCacheFile(siteDir, backend).models
+  return models && typeof models === 'object' ? models : {}
+}
+
+/** Keep Models read from this backend, beside the ones already kept. */
+export function keepModels(siteDir, backend, models) {
+  if (!models || !Object.keys(models).length) return
+  updateSyncCache(siteDir, backend, { models: { ...keptModels(siteDir, backend), ...models } })
+}
+
 // `.uniweb/backend-cache.json` — what a backend had and what we last sent it, so the
 // next transfer can skip work. Gitignored, per clone, safe to delete.
 //
@@ -653,6 +684,50 @@ export function readAppliedInjections(siteDir, backend) {
   return readMap(siteDir, backend, 'applied')
 }
 
+/**
+ * ⭐ THE REGISTERED FOUNDATION A CLONE KEEPS. A site whose foundation is a catalog ref has no build of
+ * it in the project, and the section types' `data:` it declares are what type a query named for a
+ * data key — `team:` read as `@acme/member` (`typed_by_data_key`). Read once from the backend,
+ * through the site, and kept under `.uniweb/` (`@uniweb/build`'s `registered-foundation.js`), where
+ * the build, the push and the pull read it; a registered version never changes, so a kept copy is
+ * never read again.
+ *
+ * Null when the foundation is not a catalog ref, the site is not on this backend yet, or the read
+ * fails: nothing is then typed by it — a pull writes such a query's schema out, and a push sends
+ * what that says — so both go on.
+ */
+export async function ensureRegisteredFoundation({ client, siteDir, siteUuid, ref }) {
+  if (!parseCatalogRef(ref)) return null
+  const kept = readRegisteredFoundation(siteDir, ref)
+  if (kept) return kept
+  const reply = siteUuid ? await client.readRegisteredFoundation(siteUuid, ref) : null
+  if (reply) writeRegisteredFoundation(siteDir, ref, reply)
+  return reply
+}
+
+// The Sections whose declared keys a push reads before it sends an optional one.
+const DEPLOYMENT_FIELD_LISTS = ['queryFields', 'pageFields', 'settingsFields']
+
+/**
+ * The keys this deployment's `queries`, page and `settings` Sections declare, as it says so itself —
+ * `GET /dev/config` → `siteContent.queryFields` / `pageFields` / `settingsFields` — so a push sends
+ * an optional key only to a deployment that takes it (`typed_by_data_key`; `og_title` and
+ * `og_description`): one that does not declare a key refuses a push carrying it. Offline — a dry
+ * run, `--output` — the lists the last push to this backend banked, so the package is the one that
+ * push would build.
+ *
+ * Only the lists in hand are returned, as emit options: with none, nothing optional is sent, which
+ * every deployment accepts.
+ */
+export async function deploymentFields({ client, siteDir, offline = false }) {
+  const source = offline
+    ? readAppliedInjections(siteDir, client.origin)
+    : (await client.discover())?.siteContent
+  const out = {}
+  for (const name of DEPLOYMENT_FIELD_LISTS) if (Array.isArray(source?.[name])) out[name] = source[name]
+  return out
+}
+
 /**
  * Bank the content hashes and the injections that produced them. ⛔ ONE call, both
  * maps: they describe the same document, so writing either alone leaves the cache
@@ -1430,7 +1505,7 @@ export async function probeUnpushed(siteDir, { backend = null, sendAll = false }
  */
 async function comparisonEmit(
   siteDir,
-  { backend = null, priorHashes = {}, sendAll = false, declarations = null } = {}
+  { backend = null, priorHashes = {}, sendAll = false, declarations = null, fields = null } = {}
 ) {
   const applied = readAppliedInjections(siteDir, backend)
   // ⛔ Per backend: an asset id is minted by one and means nothing to another, so a
@@ -1446,10 +1521,13 @@ async function comparisonEmit(
     // of its Models here, and nothing is banked.
     resolveModel: declarations
       ? async (name) => declarations.get(name) ?? null
-      : makeModelResolver({ client: null, offline: true }),
+      : makeModelResolver({ client: null, offline: true, siteDir, backend }),
     priorHashes,
     sendAll,
     ...applied,
+    // The deployment's own answer (`deploymentFields`), when the caller has just read it, over what
+    // the last push banked.
+    ...(fields || {}),
     ...(Object.keys(queryUuids).length ? { queryUuids } : {}),
     ...(Object.keys(assetIds).length ? { assetIds } : {})
     // ⛔ No `org`: a site's `@/x` refs resolve into its FOUNDATION's scope, which the
@@ -1484,9 +1562,12 @@ async function comparisonEmit(
  * @param {Map<string,object>} [opts.declarations] - the Models the pull read, by name — so a
  *        site whose foundation is not in the project (a clone's) can be re-banked offline
  */
-export async function rebankSyncHashes(siteDir, backend = null, { recordDocs, declarations } = {}) {
-  const pkg = await comparisonEmit(siteDir, { backend, sendAll: true, declarations })
-  writeSyncCache(siteDir, backend, pkg.hashes || {}, pkg.applied || {})
+export async function rebankSyncHashes(siteDir, backend = null, { recordDocs, declarations, fields = null } = {}) {
+  // ⛔ With the keys this deployment's Sections take, when the caller has them (`deploymentFields`):
+  // they shape the document the next push sends (`typed_by_data_key`, `og_title`), so a hash banked
+  // without them marks a clone's first push as changed. Until 2026-09-26 a pull banked none.
+  const pkg = await comparisonEmit(siteDir, { backend, sendAll: true, declarations, fields })
+  writeSyncCache(siteDir, backend, onlyWhatThePullTook(siteDir, backend, pkg, recordDocs), pkg.applied || {})
   // ⭐ And the identity of the records' list items, from the documents the pull just took:
   // the files it wrote hold the stored items in stored order, so the emit over them pairs
   // with each document item for item.
@@ -1505,6 +1586,44 @@ export async function rebankSyncHashes(siteDir, backend = null, { recordDocs, de
   return Object.keys(pkg.hashes || {}).length
 }
 
+/**
+ * The hashes a pull may bank: the tree's, except for a record the pull did not take.
+ *
+ * ⛔ ONLY WHAT CAME FROM THE BACKEND IS AGREED. A record on disk that the backend did not
+ * hand back — written since the last push, or one a push had refused — is not in sync
+ * because a pull ran. Until 2026-09-26 it was banked with the rest, so every later push
+ * skipped it and `uniweb status` said "in sync": a record written before a `uniweb sync`
+ * (which pulls, then pushes) never reached the backend. One this backend never accepted —
+ * no identity from it — is always sent: a hash it has banked can only be that mistake's.
+ * One it did accept keeps what the last push banked. The folder keeps its hash too while
+ * it places such a record. A pull that took no records (`--no-records`, a 304) leaves
+ * every record's hash as it was.
+ *
+ * @param {object[]|undefined} recordDocs - the record documents the pull took
+ */
+function onlyWhatThePullTook(siteDir, backend, pkg, recordDocs) {
+  const hashes = { ...(pkg.hashes || {}) }
+  const prior = readSyncCache(siteDir, backend)
+  const keep = (key) => {
+    if (Object.hasOwn(prior, key)) hashes[key] = prior[key]
+    else delete hashes[key]
+  }
+  const taken = new Set((recordDocs || []).map((d) => d?.$uuid).filter(Boolean))
+  const recordUuids = readBackendState(siteDir, backend).records || {}
+  let notTaken = 0
+  for (const entry of pkg.records?.index || []) {
+    if (entry.kind === 'folder') continue // the folder itself — held below while it places one
+    const theirs = entry.ownId ? recordUuids[entry.ownId] : null
+    if (theirs && taken.has(theirs)) continue
+    notTaken++
+    const key = `${entry.model} ${entry.id}`
+    if (theirs) keep(key)
+    else delete hashes[key]
+  }
+  if (notTaken) for (const key of Object.keys(hashes)) if (key.startsWith('@uniweb/folder ')) keep(key)
+  return hashes
+}
+
 /**
  * Re-bank the hashes of the records a push sent naming a record it created — `keys`,
  * the emit's `namesNew` — as the next push will hash them, and fingerprint their list
@@ -1714,6 +1833,18 @@ export async function pushSyncPackages({
         if (problem.detail) note(String(problem.detail))
         return null
       }
+      // ⭐ A RECORD KEEPS ITS TYPE. A record file moved to another type's folder keeps its `$uuid`, and
+      // the backend refuses it as that type (`type_changed`, naming the record and both types), before
+      // writing anything. Storing it as the new type makes it a new record.
+      if (problem?.reason === 'type_changed') {
+        error(`${label} push refused — a stored record would change its type.`)
+        if (problem.detail) note(String(problem.detail))
+        note(
+          'A record keeps its type. To store it as the new type, make it a new record: delete the ' +
+            '`$uuid` line from its file, then push again.'
+        )
+        return null
+      }
       if (problem?.reason === 'stale_base') {
         error(
           `${label} push refused — the backend has newer content than your last pull.`
@@ -1798,15 +1929,14 @@ export async function pushSyncPackages({
           `  deleted there  →  uniweb forget --backend ${client.origin}, then push again: it creates a NEW site`
         )
         note('Deleting this folder removes only your local copy, either way.')
-      } else if (res.status === 409) {
-        // The site's @uniweb/folder is genesis-owned: its structure is fixed on first
-        // deploy and not reconciled in place (the v1 rule — see gotcha #20's mode switch).
-        note(
-          "This site's record structure is already established on the backend and can't be changed " +
-            'in place — e.g. adding or removing a schema-backed query, or switching one between ' +
-            'static (data-bundle) and schema-backed delivery. To change it, push it as a new site: ' +
-            `uniweb forget --backend ${client.origin}, then push again (the old site stays until it is deleted).`
-        )
+      } else if (res.status === 409 && (problem?.title || problem?.detail)) {
+        // ⛔ A 409 names its own cause — a reference the store refuses, a rule of the record's type,
+        // an append-only section — so it is shown as the backend put it, not explained by us. Until
+        // 2026-09-26 every one was explained as "this site's record structure is already established
+        // … push it as a new site", a rule the backend no longer has, and it misled over a refused
+        // reference. (`stale_base` and `item_uuid_conflict` have their own explanations, above.)
+        note([problem.title, problem.detail].filter(Boolean).join(' — '))
+        return null
       }
       if (body) note(body.slice(0, 800))
       return null

package/src/commands/build.js

@@ -668,7 +668,10 @@ async function buildSiteLink(projectDir, options = {}) {
             projectDir,
             i18nConfig.localesDir,
             'records'
-          )
+          ),
+          // Free-form record translations live under it — the default was `locales/`
+          // whatever the site said.
+          localesDir: join(projectDir, i18nConfig.localesDir)
         })
         const recordCount = Object.values(recordOutputs).reduce(
           (sum, localeOutputs) => sum + Object.keys(localeOutputs).length,
@@ -789,7 +792,10 @@ async function buildSite(projectDir, options = {}) {
             projectDir,
             i18nConfig.localesDir,
             'records'
-          )
+          ),
+          // Free-form record translations live under it — the default was `locales/`
+          // whatever the site said.
+          localesDir: join(projectDir, i18nConfig.localesDir)
         })
 
         // Count collections translated

package/src/commands/clone.js

@@ -426,6 +426,12 @@ export async function clone(args = [], deps = {}) {
 
   const pullExtra = []
   if (noRecords) pullExtra.push('--no-records')
+  // The workspace this clone was told to work in: the pull is another process, and asks the same
+  // question. ⛔ Until 2026-09-26 it was not told, so it used the login's — or, with none chosen,
+  // refused: "none is chosen". A workspace from the login or the environment reaches it by itself.
+  const orgFlag = flagValue(args, '--org')
+  if (orgFlag) pullExtra.push('--org', orgFlag)
+  if (args.includes('--personal')) pullExtra.push('--personal')
 
   if (deps.skipPull) {
     note('Skipping pull (test mode).')

package/src/commands/publish.js

@@ -37,9 +37,9 @@
  *   uniweb publish --no-save       Do not record this publish in deploy.yml
  */
 
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
-import { join } from 'node:path'
+import { join, dirname } from 'node:path'
 import { execSync } from 'node:child_process'
 import yaml from 'js-yaml'
 
@@ -87,6 +87,8 @@ import {
   ensureItemUuids,
   readFolderItemUuids,
   readRecordItemUuids,
+  deploymentFields,
+  ensureRegisteredFoundation,
   recoverUnbankedIdentity,
   ensureSiteExists,
   refuseUnsendableRecords,
@@ -143,14 +145,27 @@ function readSiteYml(path) {
   }
 }
 
-// Languages from the BUILT site-content.json (config.languages) — the authority
-// after a build. Three accepted shapes: 'en', { value, label }, { code, label }.
-function languagesFromContent(siteContent) {
+// Languages from the BUILT site — the authority after a build: `config.languages` where
+// the site declares them (three accepted shapes: 'en', { value, label }, { code, label }),
+// else its default and each language the build produced (`dist/<locale>/site-content.json`).
+// ⛔ Until 2026-09-26 a site that declares no `languages:` — its languages made by its
+// translation files — went live as `['en']`, though the build had produced the others.
+export function languagesFromContent(siteContent, distDir = null) {
   const langs = siteContent?.config?.languages
-  if (!Array.isArray(langs) || langs.length === 0) return ['en']
-  return langs
-    .map((l) => (typeof l === 'string' ? l : l?.value || l?.code))
-    .filter(Boolean)
+  if (Array.isArray(langs) && langs.length > 0) {
+    return langs
+      .map((l) => (typeof l === 'string' ? l : l?.value || l?.code))
+      .filter(Boolean)
+  }
+  const source = siteContent?.config?.defaultLanguage || 'en'
+  const built =
+    distDir && existsSync(distDir)
+      ? readdirSync(distDir, { withFileTypes: true })
+          .filter((e) => e.isDirectory() && e.name !== source && existsSync(join(distDir, e.name, 'site-content.json')))
+          .map((e) => e.name)
+          .sort()
+      : []
+  return [source, ...built]
 }
 
 // Languages from site.yml — used only for the dry-run summary (no build yet).
@@ -326,9 +341,11 @@ export async function publish(args = []) {
   // (2026-08-30). Restoring a reader for it would re-create a check that cannot fail
   // while implying a capability that was never negotiable.
   //
-  // Discovery is not consulted on this path at all. The one leaf the CLI still reads
-  // (`delivery.siteSubscriptionRequired`) is read after the site create, where a
-  // credential is already in hand.
+  // Discovery is not consulted for a gate: the CLI reads the key lists under `siteContent`
+  // (`queryFields`, `pageFields`, `settingsFields`), which say what the push below may SEND
+  // (`deploymentFields`), never whether to publish. (`delivery.siteSubscriptionRequired`
+  // was deleted 2026-08-30; this said it was still read, after the site create, until
+  // 2026-09-26.)
 
   // ⛔ NOTHING about a runtime is sent from here. `site.yml::runtime` was a
   // vestigial prop and is no longer read [Diego, 2026-08-22]; `?runtime=` is no
@@ -537,7 +554,7 @@ export async function publish(args = []) {
   }
 
   // Non-local @std/registry Model schemas resolve through the backend (same as push).
-  const resolveModel = makeModelResolver({ client, offline: false })
+  const resolveModel = makeModelResolver({ client, offline: false, siteDir })
 
   // ⛔ AN EMPTY RECORDS DIRECTORY REMOVES. It is the one path where an ordinary act
   // is destructive — a directory emptied by accident, or kept with only a
@@ -948,8 +965,19 @@ export async function publish(args = []) {
   // edited since this clone last synced, the push is refused rather than
   // overwriting them, and nothing goes live. `--force` drops the precondition.
   const forced = args.includes('--force')
+  const fields = await deploymentFields({ client, siteDir })
+  // A foundation named by catalog ref — a clone's: its kept registered version types a query named
+  // for a data key (`ensureRegisteredFoundation`).
+  await ensureRegisteredFoundation({
+    client,
+    siteDir,
+    siteUuid: readBackendState(siteDir, client.origin).site?.uuid,
+    ref: siteYml?.foundation
+  })
   const emitOptions = {
     backend: client.origin,
+    // The keys this deployment's Sections take — see deploymentFields.
+    ...fields,
     ...(declaration.declare ? {} : { declareServices: false }),
     // Placement identity for the folder — see writeFolderItemUuids.
     folderItemUuids: readFolderItemUuids(siteDir, client.origin),
@@ -1005,7 +1033,7 @@ export async function publish(args = []) {
 
   // 7. Go live — make the just-pushed composite live (its current backend state).
   const siteContent = JSON.parse(await readFile(contentPath, 'utf8'))
-  const languages = languagesFromContent(siteContent)
+  const languages = languagesFromContent(siteContent, dirname(contentPath))
   say.info(`Publishing to ${c.dim}${client.origin}${c.reset} …`)
   let pubRes
   try {

package/src/commands/pull.js

@@ -60,7 +60,9 @@ import {
   writeFileSync,
   mkdirSync,
   mkdtempSync,
-  rmSync
+  rmSync,
+  readdirSync,
+  statSync
 } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { createHash } from 'node:crypto'
@@ -87,6 +89,8 @@ import {
 } from '../utils/pull-written.js'
 import {
   makeModelResolver,
+  ensureRegisteredFoundation,
+  deploymentFields,
   rebankSyncHashes,
   writeQueryUuids,
   mergeBaseVersions,
@@ -427,6 +431,27 @@ function readManifestTokens(buf) {
  * @param {object} [deps] - injectable seams for testing: `fetch` (default global
  *   fetch), `resolveSiteDir`, `getToken` (skip auth).
  */
+// Every file under `roots` (site-relative paths, files or directories), site-relative.
+function filesUnder(siteDir, roots) {
+  const out = []
+  const walk = (rel) => {
+    const abs = join(siteDir, rel)
+    let stat
+    try {
+      stat = statSync(abs)
+    } catch {
+      return
+    }
+    if (stat.isDirectory()) {
+      for (const name of readdirSync(abs)) walk(join(rel, name))
+    } else if (stat.isFile()) {
+      out.push(rel)
+    }
+  }
+  for (const root of roots) walk(root)
+  return out
+}
+
 /**
  * Refuse a pull that would overwrite unsaved work. Returns a result object to
  * return from `pull`, or null to proceed.
@@ -440,7 +465,12 @@ async function checkWorkingTree(siteDir, args) {
   let dirty = uncommittedUnder(siteDir, roots)
 
   if (dirty === null) {
-    // Not a git work tree. Nothing to fall back on if this goes wrong.
+    // Not a git work tree. Nothing to fall back on if this goes wrong — unless nothing here is the
+    // author's: every file under pull's roots is one a pull, or the clone that made this site, wrote
+    // and nothing has changed since (`pull-written.js`). ⛔ Until 2026-09-26 a fresh clone's own pull,
+    // which runs with no terminal to ask, refused here, and `uniweb clone` could not finish.
+    const written = readWritten(siteDir)
+    if (filesUnder(siteDir, roots).every((f) => isPullOutput(siteDir, f, written))) return null
     if (isNonInteractive(args)) {
       error('Refusing to pull: this site is not in a git repository.')
       note(
@@ -684,6 +714,8 @@ export async function pull(args = [], deps = {}) {
     args,
     command: 'Pulling'
   })
+  // One reader of Models for the whole pull, so a Model is read once whichever lane asks first.
+  const readModel = makeModelResolver({ client, siteDir })
 
   // ⭐ No scope check any more — and none is needed. This project's identity on
   // `client.origin` is read from that origin's own section of sync.json, so a
@@ -942,9 +974,28 @@ export async function pull(args = [], deps = {}) {
         // which is the pre-existing behaviour and right for a fresh clone.
       }
 
+      // ⭐ The Models the site's queries name — what a clone, with no foundation to read them from,
+      // tells a query's derived `deferred:` from its author's by. ⛔ Until 2026-09-26 a clone wrote
+      // the derivation into its queries as though authored. One that cannot be read is judged
+      // without it, which keeps the value: the safe direction.
+      const models = {}
+      for (const model of pulledQueryModels) {
+        try {
+          const declaration = await readModel(model)
+          if (declaration) models[model] = declaration
+        } catch {
+          // unreadable here
+        }
+      }
+      // A foundation named by catalog ref — a clone's: keep its registered version before the
+      // queries are written, since its section types are what type a query named for a data key.
+      if (!keepAuthoredFoundation) {
+        await ensureRegisteredFoundation({ client, siteDir, siteUuid: siteContentUuid, ref: siteDoc?.info?.foundation })
+      }
       const report = siteContentDocumentToProject({
         document: siteDoc,
         siteRoot: siteDir,
+        models,
         // Which backend's asset ids to read back as the author's own paths. Without
         // it a pull leaves every image pointing at a backend route.
         backend: client.origin,
@@ -985,7 +1036,7 @@ export async function pull(args = [], deps = {}) {
     if (folder && !folder.notModified && folder.docs?.length) {
       const { folderDoc, recordDocs } = splitRecordsPull(folder.docs)
       pulledRecordDocs = recordDocs
-      const resolveModel = makeModelResolver({ client })
+      const resolveModel = readModel
       const declByModel = new Map()
       pulledDeclarations = declByModel
       for (const model of [
@@ -1102,7 +1153,6 @@ export async function pull(args = [], deps = {}) {
       // in the project (a clone's) resolves none of them otherwise: every template clone
       // said "could not re-bank" until 2026-09-25, and banked nothing.
       const declarations = pulledDeclarations || new Map()
-      const readModel = makeModelResolver({ client })
       for (const model of pulledQueryModels) {
         if (declarations.has(model)) continue
         try {
@@ -1113,7 +1163,8 @@ export async function pull(args = [], deps = {}) {
       }
       await rebankSyncHashes(siteDir, client.origin, {
         recordDocs: pulledRecordDocs,
-        ...(declarations.size ? { declarations } : {})
+        ...(declarations.size ? { declarations } : {}),
+        fields: await deploymentFields({ client, siteDir })
       })
     } catch (err) {
       note(`! could not re-bank the sync cache: ${err.message}`)

package/src/commands/push.js

@@ -83,6 +83,8 @@ import {
   readFolderItemUuids,
   readQueryUuids,
   readRecordItemUuids,
+  deploymentFields,
+  ensureRegisteredFoundation,
   recoverUnbankedIdentity,
   ensureItemUuids,
   refuseUnsendableRecords,
@@ -405,7 +407,7 @@ export async function push(args = [], deps = {}) {
       // Placement identity for the folder — see writeFolderItemUuids.
       folderItemUuids: readFolderItemUuids(siteDir, client.origin),
         ...(foundationDir ? { foundationDir } : {}),
-        resolveModel: makeModelResolver({ client, offline: false })
+        resolveModel: makeModelResolver({ client, offline: false, siteDir })
       })
       mediaRefs = probe.localAssets || []
       refusals = probe.refusals || []
@@ -498,6 +500,21 @@ export async function push(args = [], deps = {}) {
     output || dryRun
       ? readItemUuids(siteDir, client.origin)
       : await ensureItemUuids({ client, siteDir, note })
+  const fields = await deploymentFields({
+    client,
+    siteDir,
+    offline: Boolean(output) || dryRun
+  })
+  // A foundation named by catalog ref — a clone's: its kept registered version types a query named
+  // for a data key (`ensureRegisteredFoundation`). Offline, only what is already kept.
+  if (!output && !dryRun) {
+    await ensureRegisteredFoundation({
+      client,
+      siteDir,
+      siteUuid: readBackendState(siteDir, client.origin).site?.uuid,
+      ref: siteYml?.foundation
+    })
+  }
   const emitOptions = {
     backend: client.origin,
     // Placement identity for the folder — see writeFolderItemUuids.
@@ -505,12 +522,15 @@ export async function push(args = [], deps = {}) {
     // Identity for the `queries` section — see readQueryUuids. Keyed by
     // name, because a declaration has no file for a path-keyed map to hold.
     queryUuids: readQueryUuids(siteDir, client.origin),
+    // The keys this deployment's Sections take — see deploymentFields.
+    ...fields,
     // Identity for the records' list items — see readRecordItemUuids.
     recordItemUuids: readRecordItemUuids(siteDir, client.origin),
     ...(foundationDir ? { foundationDir } : {}),
     resolveModel: makeModelResolver({
       client,
-      offline: Boolean(output) || dryRun
+      offline: Boolean(output) || dryRun,
+      siteDir
     }),
     priorHashes,
     sendAll,

package/src/commands/register.js

@@ -835,10 +835,18 @@ async function runRegister(args = []) {
   if (!res.ok) {
     // Resume path: a registered version is immutable, so re-running after a
     // partial code delivery hits the duplicate rejection here — a STRUCTURED
-    // 409 (problem+json, title "Conflict") — and proceeds to phase 2 (the
-    // code-uploads plan authorizes against the REGISTERED version; files it
-    // already stores come back `present` and are skipped).
-    const isDuplicate = !standalone && res.status === 409
+    // 409 (problem+json, title "Conflict", naming the `version` it refused) — and
+    // proceeds to phase 2 (the code-uploads plan authorizes against the REGISTERED
+    // version; files it already stores come back `present` and are skipped).
+    //
+    // ⛔ ONE STATUS, MORE THAN ONE MEANING. A 409 that names no version is another
+    // refusal — a data schema changed where the backend holds records of it
+    // (`reason: "destructive_republish"`) — and until 2026-09-26 it was read as a
+    // resume too: "already registered — resuming code delivery", then a 404 for a
+    // version that was never registered, and the refusal's own sentence never shown.
+    // A body with no shape to read resumes, as it always did.
+    const isDuplicate =
+      !standalone && res.status === 409 && (!parsedBody || typeof parsedBody !== 'object' || parsedBody.version !== undefined)
     if (isDuplicate) {
       alreadyRegistered = true
       info(
@@ -869,8 +877,9 @@ async function runRegister(args = []) {
       // because a 422 the CLI did not know about arrived exactly that way.
       if (parsedBody?.detail) {
         log(`  ${parsedBody.detail}`)
-        if (parsedBody.code) {
-          log(`  ${colors.dim}(${parsedBody.code})${colors.reset}`)
+        const code = parsedBody.code ?? parsedBody.reason
+        if (code) {
+          log(`  ${colors.dim}(${code})${colors.reset}`)
         }
       } else if (rawBody) {
         log(`  ${colors.dim}${rawBody.slice(0, 500)}${colors.reset}`)

package/src/framework-index.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-25T17:28:23.816Z",
+  "generatedAt": "2026-09-26T21:30:58.826Z",
   "packages": {
     "@uniweb/api": {
-      "version": "0.6.2",
+      "version": "0.6.3",
       "path": "framework/api",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/build": {
-      "version": "0.63.4",
+      "version": "0.64.1",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -35,7 +35,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.29.8",
+      "version": "0.30.1",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -48,14 +48,14 @@
       "deps": []
     },
     "@uniweb/icons": {
-      "version": "0.4.20",
+      "version": "0.4.21",
       "path": "framework/icons",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/kit": {
-      "version": "0.19.4",
+      "version": "0.19.5",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -75,7 +75,7 @@
       "deps": []
     },
     "@uniweb/projections": {
-      "version": "0.7.3",
+      "version": "0.7.4",
       "path": "framework/projections",
       "deps": [
         "@uniweb/content-writer",
@@ -83,7 +83,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.27.4",
+      "version": "0.27.6",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -96,7 +96,7 @@
       "deps": []
     },
     "@uniweb/schemas": {
-      "version": "0.7.0",
+      "version": "0.7.1",
       "path": "framework/schemas",
       "deps": []
     },
@@ -116,7 +116,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.17.2",
+      "version": "0.17.3",
       "path": "framework/templates",
       "deps": []
     },
@@ -126,7 +126,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.10.6",
+      "version": "0.10.7",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",