uniweb 0.84.0 → 0.85.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.84.0",
+  "version": "0.85.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -42,15 +42,15 @@
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
     "@uniweb/content-writer": "^0.3.4",
+    "@uniweb/runtime": "^0.29.2",
     "@uniweb/kit": "^0.19.18",
+    "@uniweb/schemas": "^0.12.0",
     "@uniweb/core": "^0.37.2",
-    "@uniweb/semantic-parser": "^1.5.1",
-    "@uniweb/runtime": "^0.29.2",
-    "@uniweb/schemas": "^0.12.0"
+    "@uniweb/semantic-parser": "^1.5.1"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.77.0",
     "@uniweb/content-reader": "^1.2.8",
+    "@uniweb/build": "^0.78.0",
     "@uniweb/semantic-parser": "^1.5.1"
   },
   "peerDependenciesMeta": {

package/partials/agents.md

@@ -1962,15 +1962,15 @@ When an external query is enough and when a transport is the answer: `developmen
 
 Full model: `reference/data-fetching.md`. Where-object format with examples: `authoring/predicates.md`.
 
-### Search (`search:`)
+### Search (`services.search`)
 
-Search follows the same arrangement as `fetcher:` — the **site** declares where results come from, and a search UI reads them the same way regardless. Never hardcode a search endpoint in a component; that couples the foundation to one host.
+Search follows the same arrangement as `fetcher:` — the **site** declares where results come from, and a search UI reads them the same way regardless. Never hardcode a search endpoint in a component; that couples the foundation to one host. Search is on by default; its entry under `services:` (see *Services*, below) turns it off, sets options, or — on a site you publish — asks the host for it:
 
 ```yaml
 # site.yml
-search:
-  enabled: true
-  provider: index        # default — download an index, match in the browser
+services:
+  search:
+    provider: index      # default — download an index, match in the browser
 ```
 
 | Provider | Answers with | Trade-off |
@@ -1980,12 +1980,13 @@ search:
 | *any other name* | A foundation-supplied search transport | Fully open — Typesense, Meilisearch, Pagefind, a vendor API |
 
 ```yaml
-search:
-  provider: endpoint
-  endpoint: _search      # REQUIRED — there is no default
+services:
+  search:
+    provider: endpoint
+    endpoint: _search    # REQUIRED — there is no default
 ```
 
-`endpoint:` is **required** with `provider: endpoint`; omit it and the provider refuses the query rather than guessing a path. It resolves against the site's base path — `/` → `/_search`, `base: /docs/` → `/docs/_search`, a subpath-served site follows its subpath. An absolute `https://…` URL points at another origin. A host that serves the site may offer search itself, supplying the address so the site declares none.
+`endpoint:` is **required** with `provider: endpoint`; omit it and the provider refuses the query rather than guessing a path. It resolves against the site's base path — `/` → `/_search`, `base: /docs/` → `/docs/_search`, a subpath-served site follows its subpath. An absolute `https://…` URL points at another origin. A host that serves the site may offer search itself: `search: true` asks for it, and the host supplies the address. An endpoint of your own asks the host to leave its search off, so yours answers.
 
 **Results have one shape, whatever the provider.** Always present: `id`, `type`, `route`, `href`, `title`, `pageTitle`, `excerpt`, `snippetHtml`. Provider-optional (`null` when absent): `sectionId`, `anchor`, `description`, `component`, `snippetText`, `matches`, `group`, `item`. `type` is `page`, `section` or `record`; on a record hit, `item` holds the record's fields and `group` names the set it came from. Whether an optional field arrives is a deployment fact, not a content fact — the same site yields `item` from a server provider and `null` from the local index — so guard them: `result.item?.image`.
 
@@ -2002,26 +2003,27 @@ const { results, isLoading, query } = useSearch(website)   // `query` is a funct
 
 Full reference: `authoring/search.md`.
 
-### Forms (`submit:`)
+### Forms (`services.submit`)
 
 Drawing a form is a foundation's job; delivering what a visitor typed needs a
 server. Where that server is comes from the **site or its host** — never from a
-section type, same arrangement as `fetcher:` and `search:`.
+section type, same arrangement as `fetcher:` and search.
 
 A form gets its destination from the first of these that applies:
 
-1. **One the host supplies** — `services.submit` in the served payload. Where the
-   host handles submissions, that is the destination and nothing in `site.yml`
-   overrides it — so a site published to Uniweb Cloud needs **no `submit:`**: it
-   asks for form handling with `services:` instead (*Uniweb Cloud*, below).
-2. **`submit:` in `site.yml`** — an endpoint you name yourself, for a host that
-   does not handle submissions, or a static site.
+1. **One the host supplies** — `config.services.submit` in the payload it serves. Where the
+   host handles submissions, that is the destination. A site published to Uniweb
+   Cloud asks for it with `submit: true` under `services:` and names no address.
+2. **An address of the site's own** — `submit: <url>` under `services:`, for a
+   static site or a host that does not handle submissions. On a host that does, it
+   asks the host to leave its own off, so this one answers.
 3. **Neither** — there is no destination: render no form, or fall back to contact
    details the site already carries.
 
 That is the general arrangement, not a forms-only one. A host states everything
-it offers in the served payload's `services`, keyed by name, and every service
-resolves by the same rule — the host's offer, then your declaration, then neither.
+it offers in the served payload's `config.services`, keyed by name, and every service
+resolves by the same rule — the host's offer, then the site's own address, then
+neither.
 
 ⭐ **Before you render UI for a service, ask whether the site has it** — one predicate per service,
 no arguments: `isSearchEnabled()`, `isSubmitEnabled()`, `isApiEnabled()`, `isAssistantEnabled()`,
@@ -2116,10 +2118,15 @@ wherever tracking is configured, with no help from your components. List
 leaving it out does not switch the baseline off.
 
 ```yaml
-# site.yml — only when YOU are providing the endpoint. Publishing to Uniweb
-# Cloud needs nothing here; `uniweb export` and most `deploy --host` targets do.
-submit: /forms                              # base-relative, resolved like search.endpoint
-submit: https://forms.example.com/intake    # or another origin
+# site.yml
+services:
+  submit: true                              # your host's form handling (Uniweb Cloud)
+```
+
+```yaml
+# site.yml — when YOU are providing the endpoint: `uniweb export`, most `deploy --host` targets
+services:
+  submit: https://forms.example.com/intake  # or /forms, base-relative like search's endpoint
 ```
 
 ```jsx
@@ -2138,12 +2145,12 @@ if (!canSubmit) return null    // nowhere to send — render no form, or fall ba
 ```
 
 > **The framework never invents an endpoint — but a host may supply one.** Don't
-> reach for `submit:` reflexively: on Uniweb Cloud the host's form handling wins
-> wherever it is on, so a `submit:` there answers only when it is off — ask for it
-> with `services:` instead. Reach for `submit:` when you are the one hosting.
+> write an address reflexively: on Uniweb Cloud an address asks the host to turn its
+> own form handling off — `submit: true` is the whole declaration there. Reach for an
+> address when you are the one hosting.
 >
-> `canSubmit` is false only when neither a declaration nor a host supplies a
-> destination. **Check it when you render, not only on the button press** — a
+> `canSubmit` is false only when neither the host nor an address of the site's own
+> supplies a destination. **Check it when you render, not only on the button press** — a
 > form nobody can send should not be on the page at all. A read that 404s
 > degrades to `[]` and the page still renders; a write that 404s loses what a
 > person typed, so it gets no silent fallback.
@@ -2197,7 +2204,7 @@ from. `values` keeps the `File` so your input can show its selection.
 
 Full reference: `development/receiving-form-submissions.md`.
 
-### Tracking (`tracking:`)
+### Tracking (`services.tracking`)
 
 A site may declare one **tracking destination**, and everything worth counting
 goes there as an event on a single stream. A page visit is just the event the
@@ -2205,23 +2212,28 @@ runtime emits by itself.
 
 ```yaml
 # site.yml — your own collector, on any host
-tracking: https://collector.example.com/events
+services:
+  tracking: https://collector.example.com/events
+```
 
+```yaml
 # or, when it needs more than an address
-tracking:
-  endpoint: /collect
-  consent: required
+services:
+  tracking:
+    endpoint: /collect
+    consent: required
 ```
 
-A host may also supply one under `services.tracking`, and the usual precedence
-applies: the host's, then yours, then neither.
+A host may also supply one — `tracking: true` asks for it on a site you publish —
+and the usual precedence applies: the host's, then yours, then neither. An
+endpoint of your own asks the host to leave its collector off, so yours answers.
 
 ⚠️ **The endpoint has to accept the framework's own format** — a batched
 `{ "events": [ … ] }` POST, documented in `reference/site-configuration.md`. It
 is not a third-party analytics product's public API, which expects that
 product's own shape.
 
-A site may also name a vendor's own script under `tracking.scripts`, which the
+A site may also name a vendor's own script under `services.tracking.scripts`, which the
 runtime loads once, after consent when a gate is declared, and never in a frame
 or during prerender. That is a **separate path with no connection to the stream
 below** — the vendor measures its own way, and nothing you `track()` reaches it.
@@ -2271,21 +2283,24 @@ Narrow or widen that with `emit`:
 
 ```yaml
 # site.yml — your own collector
-tracking:
-  endpoint: https://collector.example.com/events
-  emit: standard        # minimal | standard | all — or a list of event names
+services:
+  tracking:
+    endpoint: https://collector.example.com/events
+    emit: standard      # minimal | standard | all — or a list of event names
+```
 
+```yaml
 # site.yml — a host that supplies the collector: say what to send, not where
-tracking:
-  emit: minimal
+services:
+  tracking:
+    emit: minimal
 ```
 
 ⭐ **`emit` needs no endpoint of its own.** Where a host provides one, the site
 declares only what it wants sent and the address comes from the host. The two
 are read key by key, so naming `emit` alone overrides nothing else the host
-declared. An `endpoint:` of your own is used wherever the host supplies no
-collector — on a host without one, and on none — and where the host supplies
-one, the host's is used.
+declared. An `endpoint:` of your own means you collect yourself, and asks the host
+to leave its collector off.
 
 `minimal` is `page_view` alone. `standard` is the default when the collector is
 your own. `all` is a standing yes, so an event added in a later framework
@@ -2540,8 +2555,9 @@ permission model and a CSS one.
 You do not need a live backend to build against one. In `site.yml`:
 
 ```yaml
-api: /_api                 # where it answers — the same value in production
-$devApi: ./mock/api.js     # what answers it locally; `$` keys are never published
+services:
+  api: true                # ask your host for an app backend when you publish
+$devApi: ./mock/api.js     # what answers it in `uniweb dev`; `$` keys are never published
 ```
 
 ```js
@@ -2550,8 +2566,10 @@ import { createMockBackend } from '@uniweb/api/mock'
 export default createMockBackend({ seed }).fetch
 ```
 
-`uniweb dev` mounts it at your `api:` address, same-origin, so cookies and your
-site's configuration behave exactly as they will in production. It **enforces** who
+`uniweb dev` answers your site's `api` service with it, at an address the dev server
+supplies on its own origin, so cookies behave exactly as they will in production. Write
+no address of your own for it: under `services:` an address means a backend you run, and
+asks your host to leave its own off. It **enforces** who
 may edit an entry and `append_only`, so a permission you are relying on fails on your
 machine rather than in front of a user. State is in memory; restart to reset.
 
@@ -2657,23 +2675,35 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 
 **`sync.json` says which site this is, on each backend.** The first push to a backend records what that backend assigned — the site's id and owner, the ids of its records and uploaded files — in `sync.json` beside `site.yml`. Commit it; never edit it. **To make a new site from a copy of a project, run `uniweb forget --all` in the copy before its first push** — the copy carries the original's `sync.json`, so otherwise its push updates the original's site. When two projects in one workspace hold the same site, a push or publish from either is refused until that is done. `uniweb forget --backend <url>` removes just one backend's records, such as a scratch server's. A record file's `$uuid` is its own id and stays in both cases. **`push`, `pull` and `publish` go to the backend you are logged in to** — the last `uniweb login --backend <url>` — and never to one you are not logged in to. A bare `uniweb login` logs in to https://uniweb.app; for any other backend, name it — logging in is how you switch, and the backend commands take no `--backend` of their own. When the project has no site on that backend but has one elsewhere, a push says so before creating a new one.
 
-**`services:` in `site.yml` asks your host for services** — site search, form handling, accounts:
+**`services:` in `site.yml` is where a site says which services it uses** — site search, form
+handling, analytics, an assistant, accounts — one entry per service:
 
 ```yaml
 services:
-  search: true       # turn it on
-  submit: false      # turn it off
-  api:               # turn it on, with the service's own settings
+  search: true                                     # on — your host's, or the built-in index
+  submit: false                                    # off
+  tracking: https://collector.example.com/events   # a provider you bring
+  api:                                             # on, with the service's own settings
     grade: pro
 ```
 
-A service you leave out keeps whatever the site has, and settings you leave out keep theirs — to turn
-one off, say `false`. `uniweb push` and `uniweb publish` send what you changed since your last sync;
-if the site's services changed elsewhere in the meantime — an author in the app — they offer to update
-`site.yml` rather than send your older choice over it, and if both changed the same service they ask
-which to keep. `uniweb pull` writes what the site has into `services:`. A change that needs payment is
-settled in the app: `publish` opens it. ⛔ **Not the same as `search:` / `submit:`**, which configure a
-provider the site brings itself — and `services:` never reaches the built site.
+An entry is `true`, `false`, an address of your own (a string, or `endpoint:` in a map), or a map
+of options. On a site you push or publish it is also **what you ask your host for**: `true` asks for
+its service, `false` asks it to turn its service off, and an address asks it to leave its own off so
+yours answers. **On a site your host publishes, a service is off unless `services:` asks for it** —
+list the ones the site uses (the templates list theirs). `records: true` asks for your records to be
+delivered live to the published pages: a query whose records have a data schema shows nothing there
+without it, and `publish` says so; a static build reads records from files and ignores it. An entry
+says everything about its service: a setting you remove from it is removed on the next push, and
+removing the entry switches the service off. `uniweb push` and `uniweb publish` send each service
+`site.yml` lists; a service the site has that this copy has never seen (turned on in the app since
+your last pull) is left as it is, and one changed both in the file and on the site since your last
+pull stops the push, naming it — `uniweb pull --merge`, then push. `uniweb pull` writes what the site
+has into `services:` (an off service with no settings only where the file already names it) — pull
+before you edit. A change that needs payment is settled in the app: `publish` opens it. **Everything in an entry but a
+credential is public** — it is built into the site, except `api`'s settings, which only your host
+reads; a key or token is set in the app. ⛔ The top-level `search:` / `submit:` / `assistant:` /
+`tracking:` / `api:` keys are retired: the build stops on them and says where each one moves.
 
 **The Cloud also provides a real backend for structured data:** a database for every registered data schema, and a CMS that edits both static page content and dynamic data entities typed by those schemas. That's the piece that makes it viable for teams and client work — the client manages records, not markdown files.
 

package/src/backend/service-request.js

@@ -5,36 +5,30 @@
  * Two of them, kept by two mechanisms:
  *
  *   - ⭐ **The services** — `site.yml::services`, a map by service name *[Diego,
- *     2026-10-06]*. Sent as the site's own list with the owner's CHANGED asks applied,
- *     decided per service by comparing the file, the site now and the record of the
- *     last agreement in `sync.json` (`settleServices`; spec:
- *     kb/framework/reference/site-services-request.md).
+ *     2026-10-06]*. A push STATES them — the file's, and off for each held one it no
+ *     longer lists — and the backend decides per service from the versions sent
+ *     (`statedServices`, `@uniweb/build/uwx`; spec:
+ *     kb/framework/reference/site-services-request.md). All this module does for them
+ *     is say what the file asks that will not be sent (`announceServices`).
  *   - **The language selection** — `site.yml::publishLanguages` — told apart from the
  *     status quo by a fingerprint banked in `deploy.yml` (`reconcile`, `bankLanguages`).
  *
  * ⭐ The model both follow — *"the services in `site.yml` are a request, never a
- * tracking of what is running"* [Diego, 2026-09-05]. You ask by CHANGING the file. An
- * unchanged ask is not re-sent: the backend REPLACES the services it is sent, so a
- * re-send would overwrite a decision the owner made in the app since.
+ * tracking of what is running"* [Diego, 2026-09-05]. You ask by CHANGING the file.
  *
  * ⛔ *From 2026-09-20 to 2026-10-06 the services lived only in `sync.json`, which
- * nobody edits, so a CLI user could ask for nothing; and this module compared them by
- * a fingerprint in `deploy.yml`, which could not tell who moved.*
+ * nobody edits, so a CLI user could ask for nothing; this module then compared them by
+ * a fingerprint in `deploy.yml`, which could not tell who moved; and until 2026-10-07
+ * it read the site's services before every push and settled each against a record in
+ * `sync.json` (`settleServices`), because the backend replaced the list it was sent.*
  *
  * @module
  */
 
 import { createHash } from 'node:crypto'
-import {
-  readServicesRequest,
-  takeServices,
-  mergeServiceRows,
-  reconcileServices,
-  recordAfter,
-  readBackendState,
-  updateBackendState,
-  writeSiteConfig
-} from '@uniweb/build/uwx'
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { readServicesRequest } from '@uniweb/build/uwx'
 
 /**
  * A stable fingerprint of one declared value, or `null` when the key is absent.
@@ -123,142 +117,90 @@ export function bankLanguages(siteYml) {
   return langs ? { publishLanguagesRequest: langs } : {}
 }
 
-/** One service, as an owner reads it: `on`, `off`, `on (grade: pro)`. */
-function describeService(row) {
-  if (!row || typeof row !== 'object') return 'nothing set'
-  const state = row.enabled === false ? 'off' : 'on'
-  const settings =
-    row.config && typeof row.config === 'object' ? Object.entries(row.config) : []
-  if (!settings.length) return state
-  const shown = settings
-    .map(([k, v]) => `${k}: ${v !== null && typeof v === 'object' ? '…' : String(v)}`)
-    .join(', ')
-  return `${state} (${shown})`
+/**
+ * The services the site's foundation says it renders — the build's `_self.supports`, else
+ * `package.json::uniweb.supports` — or null when that is unknown: no local foundation, or
+ * one that declares nothing. ⛔ Absent is UNKNOWN, never "none".
+ *
+ * @param {string} siteDir
+ * @param {object} siteYml - parsed
+ * @returns {Promise<string[]|null>}
+ */
+export async function foundationSupports(siteDir, siteYml) {
+  try {
+    if (!siteYml?.foundation) return null
+    const { detectFoundationType } = await import('@uniweb/build')
+    const found = detectFoundationType(siteYml.foundation, siteDir)
+    if (found?.type !== 'local' || !found.path) return null
+    const built = join(found.path, 'dist', 'meta', 'schema.json')
+    if (existsSync(built)) {
+      const derived = JSON.parse(readFileSync(built, 'utf8'))?._self?.supports
+      if (Array.isArray(derived)) return derived
+    }
+    const declared = JSON.parse(readFileSync(join(found.path, 'package.json'), 'utf8'))?.uniweb?.supports
+    return Array.isArray(declared) ? declared : null
+  } catch {
+    return null
+  }
 }
 
-const rowNamed = (rows, name) =>
-  Array.isArray(rows) ? rows.find((r) => r && typeof r === 'object' && r.name === name) : undefined
+const names = (list) => list.map((n) => `\`${n}\``).join(', ')
 
 /**
- * Decide what a push or publish sends of `site.yml::services` — and, once it has
- * succeeded, what the project records.
- *
- * Per service the file names, three states are compared: the file, the site now
- * (`status.services`), and the record of the last agreement (this backend's entry in
- * `sync.json`). What the owner changed is sent; what the site changed is kept, and
- * offered into `site.yml`; where both changed, the owner is asked. The list sent is the
- * site's own, with only the changed asks applied (`mergeServiceRows`) — so every other
- * service and setting the site holds is sent as it is stored.
- *
- * ⛔ An open decision — an offer declined, a conflict not resolved, or no terminal to
- * ask at — is never sent, and the record keeps the earlier agreement for it, so the
- * next run still sees the site's change rather than reading it as the file's.
+ * Say what `site.yml::services` asks that will not be sent as written — a credential,
+ * an entry that is not one, an `api` address — and where it and the foundation disagree,
+ * before a push or publish sends the rest. What a push sends is the producer's
+ * (`statedServices`), from the same file.
+ *
+ * ⭐ The foundation INFORMS and never decides [Diego, 2026-10-07]: a service the file turns
+ * on that the foundation does not say it renders is said; so is one it renders that the
+ * file does not mention, since every service is off unless the site asks for it. An
+ * explicit `false` is a decision, and quiets the second. `tracking` is in neither — a
+ * foundation may not claim it, since it renders nothing — and `records` is left to
+ * publish, which knows whether the pages show any (`recordsNotAsked`).
  *
  * @param {object} p
- * @param {object} p.client - the backend client (`origin`, `siteStatus`)
- * @param {string} p.siteDir
- * @param {object} p.siteYml - parsed; updated in place when the owner takes the site's services
- * @param {object|null} [p.status] - the site's status, when the caller has just read it
- * @param {boolean} [p.offline] - read nothing from the backend (`--dry-run`, `-o`)
- * @param {boolean} [p.interactive] - whether the owner can be asked
- * @param {(message: string, initial?: boolean) => Promise<boolean>} p.confirm
- * @param {{ info: Function, warn: Function, dim: Function, ok: Function }} p.say
- * @returns {Promise<{ emit: object, after: () => void }>} `emit` — options for the
- *   producer; `after` — call once the push succeeded (or had nothing to send)
+ * @param {object} p.siteYml - parsed
+ * @param {{ warn: Function }} p.say
+ * @param {string[]|null} [p.supports] - from `foundationSupports`; null = unknown
  */
-export async function settleServices({
-  client,
-  siteDir,
-  siteYml,
-  status,
-  offline = false,
-  interactive = false,
-  confirm,
-  say
-}) {
-  const nothing = { emit: {}, after: () => {} }
-  const asks = readServicesRequest(siteYml?.services, { warn: (m) => say.warn(m) })
-  if (!asks) return nothing
-
-  const state = readBackendState(siteDir, client.origin)
-  const record = Array.isArray(state.services) ? state.services : undefined
-  const siteUuid = state.site?.uuid || null
-  let read = status
-  if (read === undefined && !offline && siteUuid) read = await client.siteStatus(siteUuid)
-  const stored = Array.isArray(read?.services) ? read.services : undefined
-
-  const decision = reconcileServices({ asks, record, stored, siteKnown: Boolean(siteUuid) })
-  if (decision.unreadable) {
-    say.warn("site.yml asks for services, but this project has no record of your site's and could not read them, so none were sent.")
-    say.dim('  Run `uniweb pull` to take them, then push again.')
-    return nothing
+export function announceServices({ siteYml, say, supports = null }) {
+  const asks = readServicesRequest(siteYml?.services, { warn: (m) => say.warn(m) }) || []
+  if (!Array.isArray(supports)) return
+  const ignored = new Set(['tracking', 'records'])
+  const has = (ask) => ask.enabled !== false || typeof ask.config?.endpoint === 'string'
+  const unrendered = asks.filter((a) => has(a) && !ignored.has(a.name) && !supports.includes(a.name)).map((a) => a.name)
+  if (unrendered.length) {
+    say.warn(`site.yml turns on ${names(unrendered)}, which your foundation does not say it renders (\`uniweb.supports\`).`)
   }
-
-  const askFor = (name) => asks.find((a) => a.name === name)
-  const send = [...decision.send]
-  let offered = [...decision.adopt]
-  const open = []
-
-  // ⛔ BOTH MOVED: only the owner can rank two of their own decisions. Not a stop — the
-  // content they asked to push is a separate thing — and never a guess.
-  if (decision.conflict.length) {
+  const mentioned = new Set(asks.map((a) => a.name))
+  const unasked = supports.filter((n) => !ignored.has(n) && !mentioned.has(n))
+  if (unasked.length) {
     say.warn(
-      record
-        ? "Your site's services and site.yml both changed since your last sync:"
-        : 'site.yml asks for services your site has set differently:'
+      `Your foundation renders ${names(unasked)}, which site.yml does not ask for — a service is off ` +
+        `unless the site asks for it. Add ${unasked.length === 1 ? 'it' : 'them'} under \`services:\`, or set ` +
+        `${unasked.length === 1 ? 'it' : 'each'} to \`false\` if that is what you mean.`
     )
-    for (const name of decision.conflict) {
-      say.dim(`  ${name}: site.yml asks ${describeService(askFor(name))} — your site has ${describeService(rowNamed(stored, name))}`)
-    }
-    if (!interactive) {
-      say.dim("  Left as your site has them — run without --non-interactive to choose.")
-      open.push(...decision.conflict)
-    } else if (await confirm('Use the services in site.yml?', false)) {
-      send.push(...decision.conflict)
-    } else {
-      // Declining to send is not yet a decision to take the site's: offered below.
-      offered = [...offered, ...decision.conflict]
-    }
-  }
-
-  // The site moved and the file did not: the file is behind. Offered, never done — a
-  // push changes `site.yml` only when the owner says so.
-  if (offered.length) {
-    say.info("Your site's services changed since your last sync:")
-    for (const name of offered) {
-      say.dim(`  ${name}: your site has ${describeService(rowNamed(stored, name))} — site.yml says ${describeService(askFor(name))}`)
-    }
-    if (interactive && (await confirm('Update site.yml to match?', false))) {
-      const services = takeServices(siteYml.services, stored, offered)
-      writeSiteConfig(siteDir, { services })
-      if (services) siteYml.services = services
-      else delete siteYml.services
-      say.ok('site.yml updated.')
-    } else {
-      open.push(...offered)
-    }
-  }
-
-  if (send.length) {
-    say.info(`Asking for: ${send.map((n) => `${n} ${describeService(askFor(n))}`).join(', ')}`)
   }
+}
 
-  // The list to send: the site's rows with the changed asks applied. With the site
-  // unreadable and nothing changed, nothing is sent — the record may be stale, and
-  // sending it would be asking for what the site may have moved away from.
-  const base = stored ?? record ?? (siteUuid ? undefined : [])
-  if (!stored && !send.length) {
-    return {
-      emit: { declareServices: false },
-      after: () => {}
-    }
-  }
-  const rows = mergeServiceRows(base, asks.filter((a) => send.includes(a.name)))
-  return {
-    emit: { serviceRows: rows },
-    after: () => {
-      const next = recordAfter({ record, agreed: rows, open })
-      if (next) updateBackendState(siteDir, client.origin, { services: next })
-    }
-  }
+/**
+ * The publish warning for `records`: the site's pages show records live, and `site.yml`
+ * does not ask for the service that delivers them on a published site [Diego, 2026-10-07:
+ * "When records is off and the site is published with us, there is no meant to be a fall
+ * back at all"]. Syncing records does not depend on it, so push and pull say nothing.
+ *
+ * @param {object} p
+ * @param {object} p.siteYml - parsed
+ * @param {string[]} p.shown - from the package (`recordsShown`)
+ * @returns {string|null} the warning, or null
+ */
+export function recordsNotAsked({ siteYml, shown }) {
+  if (!Array.isArray(shown) || !shown.length) return null
+  const records = (readServicesRequest(siteYml?.services) || []).find((a) => a.name === 'records')
+  if (records && records.enabled !== false) return null
+  return (
+    `Your pages show records from ${names(shown)}, but site.yml does not ask for \`records\` — ` +
+    'a published site delivers them only with it on. Add `records: true` under `services:`.'
+  )
 }

package/src/backend/site-sync.js

@@ -34,10 +34,12 @@ import {
   diffSiteUnits,
   describeSiteDiff,
   computeUnitHashes,
-  collectSiteUnits,
   collectUnitUuids,
   collectFolderItemUuids,
   collectQueryUuids,
+  siteItemsByKey,
+  sameServiceRow,
+  heldServices,
   readBackendState,
   updateBackendMap,
   clearBackendSections,
@@ -118,6 +120,35 @@ async function explainStaleSiteContent({ client, siteDir, localBuffer, uuid }) {
   }
 }
 
+/**
+ * The items a `stale_base` refusal names by key — `stale_keys`, one
+ * `{ section, key }` per clashing item of a Section matched by a field of its own
+ * (`services` and `queries` by `name`) — as one line per Section.
+ *
+ * @param {*} staleKeys - the refusal's `stale_keys`
+ * @returns {string[]}
+ */
+export function describeStaleKeys(staleKeys) {
+  const bySection = new Map()
+  for (const entry of Array.isArray(staleKeys) ? staleKeys : []) {
+    const section = typeof entry?.section === 'string' && entry.section ? entry.section : null
+    if (!section) continue
+    const key = entry?.key
+    // A single-item Section (`settings`) is named by the Section alone, `key: {}`.
+    const single = key && typeof key === 'object' && !Object.keys(key).length
+    const name =
+      key && typeof key === 'object'
+        ? typeof key.name === 'string' ? key.name : Object.values(key).filter((v) => typeof v === 'string').join(' ')
+        : typeof key === 'string' ? key : null
+    if (!single && !name) continue
+    if (!bySection.has(section)) bySection.set(section, [])
+    if (name) bySection.get(section).push(name)
+  }
+  return [...bySection].map(([section, names]) =>
+    `Changed on your site since your last pull — ${section}${names.length ? `: ${names.join(', ')}` : ''}`
+  )
+}
+
 // A unit in the form it is compared in across the two representations: keys sorted,
 // `$`-keys dropped (`$uuid`, `$id` — identity and payload handles, not content).
 const canonicalUnit = (v) =>
@@ -172,42 +203,65 @@ function writtenAsSent(sent, written) {
  * changes it is `pkg != base, host != base` and refused. And while the backend holds
  * units we don't, the entity token stays where it was, so the next push keeps them.
  *
- * With either document missing there is nothing to compare, and the tokens are banked
- * as the backend sent them — the contract is that `finalized[].document` is always
- * there.
- *
+ * ⭐ SINCE 2026-10-07 A HELD VERSION IS ALSO WHAT LETS A PUSH DELETE, so the rule covers
+ * every item, not only units. The site-content entity sends every version this copy
+ * holds, for items present and items the files dropped (`withBaseVersion`), and the
+ * backend deletes only the items a push holds a version for, while the site left them
+ * unchanged [Diego: "yes, apply it to pages too"; kb/framework/plans/services-exchange.md].
+ * A version banked for an item this copy never saw would therefore delete it. The map
+ * returned is the WHOLE set this copy now holds, in every Section but `secrets`
+ * (`siteItemsByKey`), and it replaces the one held before:
+ *
+ *   - an item the backend holds as we sent it → its new version;
+ *   - an item we sent that it kept for someone else → the version we held, for OUR content;
+ *   - an item it holds that we did not send → the version we held, if we had seen it, and
+ *     none if we had not (a unit of it is `foreign`);
+ *   - an item we held that it no longer holds → none: the push deleted it, or the site did.
+ *
+ * ⛔ Until then only units were compared, and every other item's version was banked as
+ * the backend returned it — harmless only while none of them was ever sent.
+ *
+ * A service is compared by its switch and its whole `config` (`sameServiceRow`), every
+ * other item on the keys we sent (`writtenAsSent`).
+ *
+ * With either document missing there is nothing to compare, and with no versions
+ * returned (an older backend) nothing to bank: `itemVersions` is null, and the versions
+ * held stay as they were. The contract is that `finalized[].document` is always there.
+ *
+ * @param {object} p
+ * @param {object|null} p.sent - the site-content document this push sent
+ * @param {object|null} p.written - the backend's post-write copy of it
+ * @param {string|null} [p.version] - the entity's post-write version
+ * @param {Object<string,string>|null} [p.itemVersions] - the post-write version of every item
+ * @param {Object<string,string>} [p.held] - the versions this copy held before the push
  * @returns {{ version: string|null, itemVersions: Object<string,string>|null,
- *   held: string[], kept: string[], foreign: string[] }} `held`: units the backend
+ *   held: string[], kept: string[], foreign: string[] }} `itemVersions`: the versions
+ *   this copy now holds, or null to leave them as they were; `held`: units the backend
  *   holds as we sent them; `kept`: units it kept someone else's content for;
  *   `foreign`: units it holds that we did not send. All paths.
  */
-export function heldTokens({ sent, written, version = null, itemVersions = null }) {
-  if (!sent || !written) return { version, itemVersions, held: [], kept: [], foreign: [] }
-  const ours = collectSiteUnits(sent)
-  const theirs = collectSiteUnits(written)
-  const uuidAt = collectUnitUuids(written)
-  const units = new Set(Object.values(uuidAt))
+export function heldTokens({ sent, written, version = null, itemVersions = null, held: before = {} }) {
+  if (!sent || !written) return { version, itemVersions: null, held: [], kept: [], foreign: [] }
+  const prior = before && typeof before === 'object' ? before : {}
+  const ours = siteItemsByKey(sent)
+  const theirs = siteItemsByKey(written)
+  const same = (key, a, b) => (key.startsWith('services:') ? sameServiceRow(a, b) : writtenAsSent(a, b))
   const held = []
   const kept = []
   const foreign = []
   const items = {}
-  for (const [path, uuid] of Object.entries(uuidAt)) {
-    if (!ours.has(path)) {
-      foreign.push(path)
+  for (const [key, item] of theirs) {
+    if (!item.uuid) continue
+    const unit = key.startsWith('unit:') ? key.slice('unit:'.length) : null
+    const mine = ours.get(key)
+    if (mine && same(key, mine.record, item.record)) {
+      if (unit) held.push(unit)
+      const token = itemVersions?.[item.uuid] ?? prior[item.uuid]
+      if (token) items[item.uuid] = token
       continue
     }
-    if (!writtenAsSent(ours.get(path), theirs.get(path))) {
-      kept.push(path)
-      continue
-    }
-    held.push(path)
-    if (itemVersions?.[uuid]) items[uuid] = itemVersions[uuid]
-  }
-  // A token for an item that is not a unit (a `queries` declaration) is never sent
-  // back — the emit narrows preconditions to units (`withBaseVersion`) — so it is
-  // banked as before: it can neither arm nor disarm anything.
-  for (const [uuid, token] of Object.entries(itemVersions || {})) {
-    if (!units.has(uuid)) items[uuid] = token
+    if (unit) (mine ? kept : foreign).push(unit)
+    if (prior[item.uuid]) items[item.uuid] = prior[item.uuid]
   }
   return {
     version: foreign.length ? null : version,
@@ -218,6 +272,26 @@ export function heldTokens({ sent, written, version = null, itemVersions = null
   }
 }
 
+/**
+ * The versions a pull leaves this copy holding: one for every site-content item the
+ * pulled document carries, in every Section but `secrets` (`siteItemsByKey`) — the
+ * whole set, replacing what was held. A pull is how a copy sees the site, so an item
+ * the site no longer has is forgotten, and the next push does not send its version.
+ *
+ * @param {object|null} doc - the pulled site-content document
+ * @param {Object<string,string>|null} itemVersions - the pull manifest's `item_versions`
+ * @returns {Object<string,string>|null} null when there is nothing to bank (no document, or
+ *   an older backend that sends no item versions)
+ */
+export function pulledItemVersions(doc, itemVersions) {
+  if (!doc || !itemVersions || typeof itemVersions !== 'object') return null
+  const out = {}
+  for (const { uuid } of siteItemsByKey(doc).values()) {
+    if (uuid && typeof itemVersions[uuid] === 'string') out[uuid] = itemVersions[uuid]
+  }
+  return out
+}
+
 // The files a unit projects to, under the site's own roots — `site.yml::paths` can
 // relocate `pages` and `layout`. `site.yml` stands for the `info` unit, which projects
 // to three files.
@@ -378,7 +452,9 @@ export function keepModels(siteDir, backend, models) {
 // ⭐ **Everything here is regenerable and losing it never produces a WRONG result** —
 // only a slower transfer or a round trip. That is the membership test; anything
 // failing it belongs in `sync.json` (which is where the uuid maps went on
-// 2026-09-20 — see `readItemUuids` below).
+// 2026-09-20 — see `readItemUuids` below). ⚠️ One exception since 2026-10-07, and it
+// is said where it lives: the item versions are what lets a push delete, so without
+// them a dropped page is kept until the next pull (`readItemBaseVersions`).
 //
 // ⚠️ It was `sync-cache.json` and its header called it "a pure wire-efficiency
 // cache — NOT identity, the minted `$uuid` lives in the source files". That was
@@ -771,20 +847,35 @@ export function readBaseVersions(siteDir, backend) {
 }
 
 /**
- * Per-ITEM staleness tokens: `{ <record $uuid>: <opaque version> }`.
+ * Per-ITEM staleness tokens: `{ <item $uuid>: <opaque version> }` — one for every item
+ * of the site-content entity this copy has seen.
  *
  * The entity token gates the whole document, so a stale base on any one record
  * refuses the entire push — which fires on the common case of two people editing
- * different sections and teaches them to reach for `--force`. These gate per record
+ * different sections and teaches them to reach for `--force`. These gate per item
  * instead. Same contract as the entity token: opaque, cached, echoed, never parsed.
  *
- * Merged rather than replaced: a push carries only CHANGED entities, so a response
- * reports tokens for a subset of the site. Replacing would drop the tokens of every
- * record that wasn't in this package and silently degrade those to ungated.
+ * ⭐ AND THEY ARE WHAT LETS A PUSH DELETE (2026-10-07): the backend deletes only the
+ * items a push holds a version for, so every one held is sent, present or dropped
+ * (`withBaseVersion`). Hence the set is REPLACED, never merged — by a pull
+ * (`pulledItemVersions`) and by a push of the site-content lane (`heldTokens`) — and
+ * holds only items this copy has seen. ⚠️ The one thing losing this cache now costs that
+ * is not a round trip: until the next pull, a page or section the files dropped is kept
+ * on the site rather than deleted, since there is no version to send for it.
+ * ⛔ *It was merged until then, across both lanes, for a push that sent only units.*
  */
 export function readItemBaseVersions(siteDir, backend) {
   return readMap(siteDir, backend, 'itemBaseVersions')
 }
+/**
+ * Replace the item versions this copy holds — a push's (`heldTokens`) or a pull's
+ * (`pulledItemVersions`) whole set. ⛔ Not a merge: an item that left the set must
+ * leave the map, or its version is sent again and asks the backend to delete it.
+ */
+export function writeItemBaseVersions(siteDir, backend, versions) {
+  if (!versions || typeof versions !== 'object') return
+  updateSyncCache(siteDir, backend, { itemBaseVersions: { ...versions } })
+}
 export function mergeItemBaseVersions(siteDir, backend, versions) {
   if (!versions || !Object.keys(versions).length) return
   // ⛔ The read names the backend. Without it the read keyed nothing, came back `{}`,
@@ -1933,7 +2024,11 @@ export async function pushSyncPackages({
         // for choosing between pulling and forcing.
         const detail = await explainStale()
         for (const line of detail) note(line)
-        if (!detail.length) {
+        // ⭐ Items no file path names — a service, a query — come named by their Section's
+        // key (`stale_keys`, `{ section, key: { name } }`), so say them by name.
+        const keyed = describeStaleKeys(problem.stale_keys)
+        for (const line of keyed) note(line)
+        if (!detail.length && !keyed.length) {
           const stale = Array.isArray(problem.stale_entities)
             ? problem.stale_entities
             : []
@@ -2079,9 +2174,11 @@ export async function pushSyncPackages({
   // otherwise the next attempt would re-send lane 1 with a base the backend has
   // already moved past, and refuse a push the user just made.
   const newVersions = {}
-  // Per-item tokens from the SAME response. Keyed by record `$uuid` and flat
-  // across entities (the cache is a single map), unlike `newVersions`, which is
-  // keyed by entity uuid.
+  // Per-item tokens from the SAME response — the site-content entity's, keyed by item
+  // `$uuid`: the whole set this copy now holds (`heldTokens`), which replaces the one
+  // it held. Null until that lane lands, which leaves the held set as it was.
+  // ⛔ The records lane's are not kept: that lane is gated by its entity version, and
+  // until 2026-10-07 they were merged into the same map, which was sent for nothing.
   //
   // ⛔ Both grains must be re-armed from the push, for one reason: a push writes,
   // so every token this clone holds for a record it just changed is now stale. Read
@@ -2094,22 +2191,19 @@ export async function pushSyncPackages({
   // exact shape one grain up (see delivery-lane.md "Both feed directions are
   // load-bearing"); the item grain had the same hole until backend `d7e46335`
   // started echoing `item_versions` here.
-  const newItemVersions = {}
+  let heldItemVersions = null
   const harvest = (finalized) => {
     for (const f of finalized || []) {
+      // NOT gated on `changed`: the backend pins "zero-write ⇒ version unmoved", so a
+      // no-op resubmit hands back the value we already hold. (The site-content lane
+      // filters first, `harvestSiteContent`.)
       if (f.uuid && f.version) newVersions[f.uuid] = f.version
-      // NOT gated on `changed` — same rule as the entity token: the backend pins
-      // "zero-write ⇒ version unmoved", so a no-op resubmit hands back the value we
-      // already hold. (The site-content lane filters first, `harvestSiteContent`.)
-      // An older backend omits the field entirely, which leaves the cached tokens
-      // alone and degrades to the entity grain, exactly as before.
-      if (f.itemVersions) Object.assign(newItemVersions, f.itemVersions)
     }
   }
   // Both grains land together, at every point the old code banked the entity one.
   const mergeHarvested = () => {
     mergeBaseVersions(siteDir, client.origin, newVersions)
-    mergeItemBaseVersions(siteDir, client.origin, newItemVersions)
+    if (heldItemVersions) writeItemBaseVersions(siteDir, client.origin, heldItemVersions)
   }
   // ⛔ The site-content lane banks only the tokens for content this copy holds — the
   // document we sent against the one the backend stored (`heldTokens`, and the two
@@ -2124,9 +2218,11 @@ export async function pushSyncPackages({
         sent: sentSiteDoc,
         written: f.document,
         version: f.version,
-        itemVersions: f.itemVersions
+        itemVersions: f.itemVersions,
+        held: heldItemVersions ?? readItemBaseVersions(siteDir, client.origin)
       })
-      harvest([{ ...f, version: held.version, itemVersions: held.itemVersions }])
+      harvest([{ ...f, version: held.version }])
+      if (held.itemVersions) heldItemVersions = held.itemVersions
       heldUnits.push(...held.held)
       notHeld.kept.push(...held.kept)
       notHeld.foreign.push(...held.foreign)
@@ -2153,6 +2249,17 @@ export async function pushSyncPackages({
     if (siteFinalizedDoc) {
       const recordIds = collectQueryUuids(siteFinalizedDoc)
       if (Object.keys(recordIds).length) writeQueryUuids(siteDir, client.origin, recordIds)
+      // ⭐ THE SERVICES THIS COPY NOW HOLDS, `{ name: $uuid }`: those the push stated and
+      // those held before, as the site returned them (`heldServices`). A service added on
+      // the site since this copy's last pull is left out — held, the next push would state
+      // it off, switching off a service nobody here has seen. Replaced, not merged.
+      updateBackendState(siteDir, client.origin, {
+        services: heldServices({
+          written: siteFinalizedDoc.services,
+          sent: Array.isArray(sentSiteDoc?.services) ? sentSiteDoc.services : [],
+          prior: readBackendState(siteDir, client.origin).services
+        })
+      })
     }
     // Re-base the page attribution: our emitted document and the backend's post-write
     // copy of it are the two sides' new agreed state.

package/src/commands/doctor.js

@@ -19,6 +19,7 @@ import {
 } from '@uniweb/build'
 import { loadDeployYml, AGENTS_KEYS } from '@uniweb/build/site'
 import { listAdapters } from '@uniweb/build/hosts'
+import { RUNTIME_KEYS } from '@uniweb/build/uwx'
 import { getCliVersion } from '../versions.js'
 import { readAgentsVersion } from '../utils/agents-stamp.js'
 import { writeJsonPreservingStyle } from '../utils/json-file.js'
@@ -388,17 +389,12 @@ function nearestKnownKey(input, known) {
 }
 
 /**
- * The options `tracking:` actually has a reader.
- *
- * ⚠️ **Kept here rather than imported, because nothing at runtime enumerates
- * them** — `wireTracker` reads named properties off the resolved declaration, it
- * does not iterate a list. So there is no existing array to import and this
- * duplicates nothing. It does mean the list can drift: the readers are
- * `runtime/src/wire-foundation.js::wireTracker` (`consent`, `scripts`, `debug`)
- * and `core/src/services.js::readEndpoint` (`endpoint`). Add a key there, add it
- * here.
+ * The options `services.tracking` has a reader for — the build's list, which also
+ * decides what a push sends the host as its settings (`RUNTIME_KEYS`, `@uniweb/build`).
+ * ⛔ *Until 2026-10-06 doctor kept a copy of its own, which had drifted: it lacked
+ * `emit` and `flushIntervalMs`, which `wireTracker` reads.*
  */
-const TRACKING_KEYS = ['endpoint', 'consent', 'scripts', 'debug']
+const TRACKING_KEYS = RUNTIME_KEYS.tracking
 
 /**
  * Spellings that read as an ATTEMPT to require consent but do not require it.
@@ -414,10 +410,10 @@ const TRACKING_KEYS = ['endpoint', 'consent', 'scripts', 'debug']
 const CONSENT_NEAR_MISSES = new Set(['require', 'requires', 'required.', 'true', 'yes', 'on', '1'])
 
 /**
- * `tracking:` — flag the keys and values that are carried and never acted on.
+ * `services.tracking` — flag the keys and values that are carried and never acted on.
  *
- * The block is forwarded to the host as opaque data and resolved at render, so
- * nothing downstream rejects a mistake in it. Every error here therefore fails
+ * A key the site's tracking does not read goes to the host as a setting, and the
+ * rest is resolved at render, so nothing downstream rejects a mistake in it. Every error here therefore fails
  * the same way: **silently, at a visitor's browser, as an absence** — which is
  * also exactly what a site that configured nothing looks like. There is no
  * symptom to notice and nothing to grep for.
@@ -425,8 +421,8 @@ const CONSENT_NEAR_MISSES = new Set(['require', 'requires', 'required.', 'true',
  * ⭐ That is the whole argument for checking it at `doctor` time: it is the only
  * moment in the chain where a person who can fix it is looking at it.
  *
- * A bare `tracking: <url>` string is the documented shorthand and carries no
- * options — there is nothing in it to be wrong.
+ * An address, `true` or `false` carries no options — there is nothing in it to be
+ * wrong.
  */
 /**
  * `uniweb doctor` — is `package.json` behind what the build derived?
@@ -806,8 +802,8 @@ export function checkUngatedServiceControls({ foundationName, folderName, srcDir
 }
 
 export function checkTrackingBlock({ siteName, siteYml, issues }) {
-  const tracking = siteYml?.tracking
-  if (tracking === undefined || tracking === null) return
+  const tracking = siteYml?.services?.tracking
+  if (tracking === undefined || tracking === null || typeof tracking === 'boolean') return
   if (typeof tracking === 'string') return
 
   if (typeof tracking !== 'object' || Array.isArray(tracking)) {
@@ -816,9 +812,9 @@ export function checkTrackingBlock({ siteName, siteYml, issues }) {
       id,
       type: 'warning',
       site: siteName,
-      message: `site.yml: \`tracking:\` should be an endpoint string, or a map of options`
+      message: `site.yml: \`services.tracking\` should be true, false, an address, or a map of options`
     })
-    warn(`[${id}] ${siteName}: \`tracking:\` is neither an endpoint string nor a map of options.`)
+    warn(`[${id}] ${siteName}: \`services.tracking\` is neither true, false, an address nor a map of options.`)
     return
   }
 
@@ -830,10 +826,10 @@ export function checkTrackingBlock({ siteName, siteYml, issues }) {
       id,
       type: 'warning',
       site: siteName,
-      message: `site.yml: \`tracking:\` has ${unknown.length === 1 ? 'an unknown key' : 'unknown keys'}: ${unknown.join(', ')}`
+      message: `site.yml: \`services.tracking\` has ${unknown.length === 1 ? 'an unknown key' : 'unknown keys'}: ${unknown.join(', ')}`
     })
     warn(
-      `[${id}] ${siteName}: \`tracking:\` ${unknown.length === 1 ? 'key' : 'keys'} ${unknown
+      `[${id}] ${siteName}: \`services.tracking\` ${unknown.length === 1 ? 'key' : 'keys'} ${unknown
         .map((k) => `'${k}'`)
         .join(', ')} ${unknown.length === 1 ? 'is' : 'are'} not recognized.`
     )
@@ -842,7 +838,7 @@ export function checkTrackingBlock({ siteName, siteYml, issues }) {
       if (near) log(`    ${colors.dim}'${key}' — did you mean ${colors.reset}${colors.green}${near}${colors.reset}${colors.dim}?${colors.reset}`)
     }
     log(
-      `    ${colors.dim}Carried to the host as opaque data and never read. Known: ${TRACKING_KEYS.join(', ')}.${colors.reset}`
+      `    ${colors.dim}Not an option the site's tracking reads — sent to your host as a setting. Known: ${TRACKING_KEYS.join(', ')}.${colors.reset}`
     )
   }
 
@@ -869,9 +865,9 @@ export function checkTrackingBlock({ siteName, siteYml, issues }) {
         id,
         type: 'warning',
         site: siteName,
-        message: `site.yml: \`tracking.consent:\` is ${shown} — only the exact value \`required\` turns the gate on`
+        message: `site.yml: \`services.tracking.consent\` is ${shown} — only the exact value \`required\` turns the gate on`
       })
-      warn(`[${id}] ${siteName}: \`tracking.consent:\` is ${shown}; the gate is OFF.`)
+      warn(`[${id}] ${siteName}: \`services.tracking.consent\` is ${shown}; the gate is OFF.`)
       log(
         `    ${colors.dim}Only \`consent: required\` holds events until a visitor answers. Anything else${colors.reset}`
       )
@@ -894,10 +890,10 @@ export function checkTrackingBlock({ siteName, siteYml, issues }) {
         id,
         type: 'warning',
         site: siteName,
-        message: `site.yml: \`tracking.scripts:\` has ${bad.length} ${bad.length === 1 ? 'entry' : 'entries'} with no URL`
+        message: `site.yml: \`services.tracking.scripts\` has ${bad.length} ${bad.length === 1 ? 'entry' : 'entries'} with no URL`
       })
       warn(
-        `[${id}] ${siteName}: ${bad.length} \`tracking.scripts:\` ${bad.length === 1 ? 'entry has' : 'entries have'} no URL and will not load.`
+        `[${id}] ${siteName}: ${bad.length} \`services.tracking.scripts\` ${bad.length === 1 ? 'entry has' : 'entries have'} no URL and will not load.`
       )
       log(
         `    ${colors.dim}An entry is a URL, or an object with a \`src\`. Anything else is dropped silently.${colors.reset}`
@@ -927,19 +923,19 @@ function editDistance(a, b) {
 /**
  * A site whose content declares a form needs somewhere to send it.
  *
- * Two things can supply that: `submit:` in site.yml, or the host at serve time.
- * Doctor can only see the first — so it warns only when *nothing* could
- * plausibly supply one: no declaration, and no deploy target that would put a
- * host in the picture. On a site bound to a host, having no `submit:` is the
- * correct configuration, and warning there would nag exactly the people who got
- * it right.
+ * Two things can supply that: `services.submit` in site.yml — asking the host for
+ * form handling, or naming the site's own — or the host at serve time. Doctor can
+ * only see the first — so it warns only when *nothing* could plausibly supply one:
+ * no entry, and no deploy target that would put a host in the picture. On a site
+ * bound to a host, an absent entry can be the correct configuration, and warning
+ * there would nag exactly the people who got it right.
  *
  * The consequence of being wrong in the other direction is what justifies the
- * check at all: a form with no destination renders disabled, which is visible
- * on the page but easy to ship without noticing.
+ * check at all: a form with no destination is not drawn, which is easy to ship
+ * without noticing.
  */
 export async function checkFormSubmitTarget({ sitePath, siteName, siteYml, issues }) {
-  if (siteYml?.submit) return
+  if (siteYml?.services?.submit) return
 
   const forms = findFormContent(sitePath, siteYml)
   if (forms.length === 0) return
@@ -966,7 +962,7 @@ export async function checkFormSubmitTarget({ sitePath, siteName, siteYml, issue
   for (const f of forms.slice(0, 5)) log(`    • ${f}`)
   if (n > 5) log(`    ${colors.dim}…and ${n - 5} more${colors.reset}`)
   log(
-    `    Set ${colors.green}submit${colors.reset} in site.yml if you are providing the endpoint.`
+    `    Ask your host for form handling — ${colors.green}services: { submit: true }${colors.reset} — or name your own: ${colors.green}services: { submit: https://… }${colors.reset}.`
   )
   log(
     `    ${colors.dim}A host that handles submissions supplies one itself — this check is skipped once a deploy target is configured.${colors.reset}`

package/src/commands/publish.js

@@ -57,7 +57,9 @@ import { emitSyncPackages } from '@uniweb/build/uwx'
 import {
   bankLanguages,
   reconcile,
-  settleServices
+  announceServices,
+  foundationSupports,
+  recordsNotAsked
 } from '../backend/service-request.js'
 import { isSiteRelativeExtensionUrl } from '@uniweb/build'
 import { resolveDefaultLocale } from '@uniweb/core/locale-config'
@@ -804,26 +806,16 @@ export async function publish(args = []) {
   const injectInfo = {
     ...(fnd.ref ? { foundation: fnd.ref } : {})
   }
-  // ⭐ WHAT THE SITE HAS — read before the push, for the two requests a publish
-  // carries: the services (`site.yml::services`) and the language selection. Only
-  // this read sees a decision the owner made in the app since this clone last synced.
-  // It reads this backend's site, from sync.json; a never-synced site has none.
+  // ⭐ WHAT THE SITE HAS — read before the push, for the language selection. Only this
+  // read sees a decision the owner made in the app since this clone last synced. It
+  // reads this backend's site, from sync.json; a never-synced site has none.
   const boundUuid = readBackendState(siteDir, client.origin).site?.uuid || null
   const status = boundUuid ? await client.siteStatus(boundUuid) : null
 
-  // ⭐ THE SERVICES: what the owner changed in `site.yml::services` is sent, applied
-  // over the site's own list; what the site changed is kept and offered into the file;
-  // where both changed, the owner is asked (`settleServices`). An ask whose decision is
-  // still open is never sent over the decision the site holds.
-  const services = await settleServices({
-    client,
-    siteDir,
-    siteYml,
-    status,
-    interactive: !isNonInteractive(args),
-    confirm,
-    say
-  })
+  // ⭐ THE SERVICES are stated by the push itself — the file's, and off for each held
+  // one it no longer lists (`statedServices`) — and the backend decides per service.
+  // Said here: what the file asks that will not be sent as written.
+  announceServices({ siteYml, say, supports: await foundationSupports(siteDir, siteYml) })
 
   // ⭐ THE LANGUAGE SELECTION IS A REQUEST TOO, and it is the one that costs.
   //
@@ -873,8 +865,6 @@ export async function publish(args = []) {
     backend: client.origin,
     // The keys this deployment's Sections take — see deploymentFields.
     ...fields,
-    // The `services` Section as settled above — or withheld.
-    ...services.emit,
     // Placement identity for the folder — see writeFolderItemUuids.
     folderItemUuids: readFolderItemUuids(siteDir, client.origin),
     // Identity for the records' list items — see readRecordItemUuids.
@@ -908,6 +898,10 @@ export async function publish(args = []) {
   if (refuseUnsendableRecords(pkg.refusals, { error: say.err, note: say.dim })) {
     return { exitCode: 1 }
   }
+  // ⭐ `records` is what delivers the records the pages show on the published site — said
+  // here, at publish, and never at push: syncing records does not depend on it.
+  const notAsked = recordsNotAsked({ siteYml, shown: pkg.recordsShown })
+  if (notAsked) say.warn(notAsked)
   const report = {
     info: (m) => say.info(m),
     note: (m) => say.dim(m),
@@ -921,9 +915,6 @@ export async function publish(args = []) {
     report
   })
   if (pushResult.exitCode !== 0) return { exitCode: pushResult.exitCode }
-  // The push stored what it sent: the services agreed on are recorded now, whether or
-  // not the site then goes live.
-  services.after()
   const siteUuid = pushResult.boundSiteUuid
   if (!siteUuid) {
     say.err('Push did not yield a site uuid — cannot go live.')

package/src/commands/pull.js

@@ -95,7 +95,8 @@ import {
   rebankSyncHashes,
   writeQueryUuids,
   mergeBaseVersions,
-  mergeItemBaseVersions,
+  writeItemBaseVersions,
+  pulledItemVersions,
   writeUnitBases,
   writeItemUuids,
   writeFolderItemUuids
@@ -887,6 +888,9 @@ export async function pull(args = [], deps = {}) {
   // The Models the pulled site's queries name, as the push qualified them — the re-bank
   // below resolves with them too (see there).
   let pulledQueryModels = []
+  // The versions this copy holds after the pull: every site-content item the pulled
+  // document carries (`pulledItemVersions`), banked below once the files have taken it.
+  let pulledVersions = null
   if (content && !content.notModified) {
     const siteDoc =
       content.docs &&
@@ -905,6 +909,7 @@ export async function pull(args = [], deps = {}) {
       // The next push re-establishes it; until then our side reports as unknown,
       // which is honest rather than wrong.
       writeUnitBases(siteDir, client.origin, { remote: computeUnitHashes(siteDoc), local: {} })
+      pulledVersions = pulledItemVersions(siteDoc, content.itemVersions)
       // Per-item identity for the next push. Without it the backend reads our
       // records as new and re-mints every page and section row.
       writeItemUuids(siteDir, client.origin, collectUnitUuids(siteDoc))
@@ -1216,7 +1221,13 @@ export async function pull(args = [], deps = {}) {
       // Records this pull did not place were not taken, so neither is their lane.
       if (lane === folderLane && recordsNotPlaced) continue
       mergeBaseVersions(siteDir, client.origin, lane.versions)
-      mergeItemBaseVersions(siteDir, client.origin, lane.itemVersions)
+    }
+    // ⭐ The site-content items' versions REPLACE what this copy held: a pull is how it
+    // sees the site, and a version kept for an item the site no longer has would be sent
+    // again, asking the backend to delete it. The folder lane's are not kept — that lane
+    // is gated by its entity version. (Both were merged into one map until 2026-10-07.)
+    if (pulledVersions && content && !content.notModified && !content.refused) {
+      writeItemBaseVersions(siteDir, client.origin, pulledVersions)
     }
     // Persist the ETags so the next pull is conditional (304 when unchanged). The
     // folder's is DROPPED when records were not placed, so the next pull fetches

package/src/commands/push.js

@@ -75,7 +75,7 @@ import {
   describeSyncedElsewhere
 } from '../utils/site-identity.js'
 import { confirm, isNonInteractive } from '../utils/interactive.js'
-import { settleServices } from '../backend/service-request.js'
+import { announceServices, foundationSupports } from '../backend/service-request.js'
 import { guardEmptyRecords } from '../utils/records-guard.js'
 import { bringFoundationAlong } from '../backend/foundation-bring-along.js'
 import {
@@ -521,20 +521,10 @@ export async function push(args = [], deps = {}) {
       ref: siteYml?.foundation
     })
   }
-  // ⭐ THE SERVICES `site.yml` ASKS FOR — what the owner changed is sent over the site's
-  // own list; what the site changed is kept and offered into the file; where both
-  // changed, the owner is asked. Shared with `uniweb publish` (`settleServices`).
-  // Offline for `-o` and `--dry-run`: nothing is read, and nothing is recorded.
-  const offline = Boolean(output) || dryRun
-  const services = await settleServices({
-    client,
-    siteDir,
-    siteYml,
-    offline,
-    interactive: !offline && !isNonInteractive(args),
-    confirm,
-    say: { info, warn, dim: note, ok: success }
-  })
+  // ⭐ THE SERVICES `site.yml` ASKS FOR are stated by the emit — the file's, and off for
+  // each held one it no longer lists (`statedServices`) — and the backend decides per
+  // service. Said here: what the file asks that will not be sent as written.
+  announceServices({ siteYml, say: { warn }, supports: await foundationSupports(siteDir, siteYml) })
   const emitOptions = {
     backend: client.origin,
     // Placement identity for the folder — see writeFolderItemUuids.
@@ -570,9 +560,7 @@ export async function push(args = [], deps = {}) {
           itemBaseVersions: readItemBaseVersions(siteDir, client.origin)
         }),
     ...(assetRewrite ? { assetRewrite } : {}),
-    ...(assetIds ? { assetIds } : {}),
-    // The `services` Section as settled above — or withheld.
-    ...services.emit
+    ...(assetIds ? { assetIds } : {})
   }
   let pkg
   try {
@@ -601,8 +589,6 @@ export async function push(args = [], deps = {}) {
 
   // Nothing changed since the last push — the backend is already up to date.
   if (totalEntities === 0) {
-    // The site already holds what this copy has, so what was settled is agreed.
-    if (!offline) services.after()
     success(
       `Nothing to push — ${skipped} entit${skipped === 1 ? 'y' : 'ies'} unchanged since the last push.`
     )
@@ -663,7 +649,6 @@ export async function push(args = [], deps = {}) {
     }
   })
   if (result.exitCode !== 0) return { exitCode: result.exitCode }
-  services.after()
   success(
     `Pushed ${result.finalizedTotal} entit${result.finalizedTotal === 1 ? 'y' : 'ies'}` +
       (result.wrote.length ? ` — ${result.wrote.join(', ')}` : '')

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-06T19:21:14.306Z",
+  "generatedAt": "2026-10-07T11:39:54.164Z",
   "packages": {
     "@uniweb/api": {
       "version": "0.6.10",
@@ -10,7 +10,7 @@
       ]
     },
     "@uniweb/build": {
-      "version": "0.77.0",
+      "version": "0.78.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -117,7 +117,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.17.14",
+      "version": "0.18.0",
       "path": "framework/templates",
       "deps": []
     },
@@ -127,7 +127,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.10.21",
+      "version": "0.10.22",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",