feat: Create structured MDX entries from collection folders

[kof]

Paragraph editing follow-up — 42a16db (September 9)

Nested formatted paragraphs now retain their text, links, styling identity, and existing labels during editing and saving. No database migration.

• Review all four changed text-editor files.
• Preserve text before and after nested links inside emphasis, strong text, and spans.
• Preserve existing instance labels on save and keep inherited formatting from overwriting a link's styling identifier.
• Demonstrate regression failures without each fix, then pass all 41 focused text-editor and MDX synchronization tests.
• Pass Builder typecheck, lint, formatting, and diff checks.
• Verify the reported paragraph in Design and Content modes: edits reach MDX and survive reload; original text restored. Verify matching link color and underline inside and outside editing.
• Review documentation and fixture impact: this restores existing documented behavior; no fixture inputs, generated output, or documentation changes are needed.
• Commit and push the reviewed fixes.
• Confirm CI on this commit before merging.

Full E2E and agent evaluations were not rerun for this focused follow-up. Earlier CI and suite results below apply to their recorded commits, not this new head.

---

Final verification — 50093ed (September 9)

Article edits now retain inline formatting and save newly inserted custom components reliably. Saving a file no longer sends a second project-sync write that could restore an older revision. No database migration.

• Fix iframe-blur saves, inherited template defaults, unused resolved assets, and stale template tag metadata.
• Remove duplicate server writes for already saved file revisions; share the result with the canvas using the existing external-content sync channel.
• Demonstrate new regression tests fail without their fixes and pass with them. Keep E2E file-write, content-order, and reload assertions; remove the obsolete duplicate metadata-write wait.
• Pass all 2,955 Builder tests, all 2,409 Project Build tests, and all 8 focused MDX E2E checks.
• Pass Builder and Project Build typechecks, lint, formatting, and diff checks.
• Run the complete fixture pipeline with no generated changes. The later Builder-only save-acknowledgment changes affect no fixture inputs or outputs.
• Verify live article fields, hero replacement/save/reload/restore, Accordion text edits, and YouTube URL edits. Verify UI edits reach MDX and MDX edits persist after reload. Restore original article content.
• Review documentation impact: these fixes restore the documented Content Block editing behavior; no further documentation change is needed.
• Apply visual-change-approved after the user's explicit approval of the 24 reviewed intended visual changes.
• Commit and push the reviewed changes; worktree is clean.
• Confirm CI and mergeability on this final commit: all 19 Main workflow jobs passed, including all six E2E shards; PR lint and submodule checks passed. Visual approval run 34383497017 passed. Its predecessor reported the 24 intended differences; all 24 current images were byte-identical to the reviewed report, with zero capture errors. GitHub reports no merge conflict.

Agent evaluations were explicitly skipped for these final runtime fixes, as requested. Earlier evaluation results below apply to their recorded commits, not this final commit. This summary supersedes historical pending-check notes below. The PR has not been merged.

---

Final merge check — 9bc31ca (September 9)

• Merge main without rewriting branch history. Preserve main's image-picker fix and description-list validation.
• Reset inherited HTML parent context at template boundaries. All four new regressions fail without the fix and pass with it.
• Fix shared navigation style composition and alignment; verify the browser regression fails before and passes after. Review focused screenshots.
• Pass 2,408 Project Build tests, 251 design-system tests, and 3 image-picker tests; Builder, Project Build, and design-system typechecks; lint, formatting, and diff checks.
• Run the complete fixture pipeline with no generated changes.
• Rerun all six agent evaluation scenarios on the merged code with GPT-5.5. All functional checks pass; incompatible/missing token-baseline comparison remains explicitly disabled.
• Review documentation impact: this merge preserves documented behavior; the image-editing guidance was already updated in f90e39c.
• Commit and push; worktree is clean and GitHub reports no merge conflict.
• Confirm Main CI on 9bc31ca: all 19 jobs passed, including all six E2E shards.
• Review final visual artifact 10110845203 from run 34367911826: 24 added/changed stories, zero capture errors. Reviewed collection dialogs and icons, light/dark login gradients, dashboard and project-settings navigation, panel spacing, button variants, inset lists, and resettable labels. Fourteen captures are byte-identical to the previously inspected CI images. Updated navigation and collection-settings captures were inspected; the formerly blank story renders normally. Pixel measurements confirm the columns story retains its intended column positions (second column x=261, third around x=388).
• Apply visual approval after renewed explicit user approval. Final-head CI is tracked above.

The live hero replacement and article/custom-component checks below are now complete. The PR has not been merged.

---

Merge-readiness follow-up — September 9

• Remove contradictory image guidance and add an executable writable-source/read-only-alt binding recipe. Regenerate CLI/MCP docs.
• Verify the recipe regression fails with the old guidance and passes with the new guidance. All 10 focused documentation tests, 2 content-reference tests, CLI/docs typechecks, lint, formatting, and generated-documentation checks passed.
• Rerun all six agent evaluation scenarios with GPT-5.5: all functional checks passed. The incompatible/missing token-baseline gate was explicitly disabled; existing baselines are unchanged.
• Commit the documentation follow-up as f90e39c.
• Review existing CI screenshots and identify unintended shared-list alignment changes. Implement a local shared-style composition/alignment fix with a regression test demonstrated failing before and passing after; all 251 design-system tests and its typecheck passed.
• Visually verify and push the shared list fix in 9bc31ca. The focused run compared 28 stories; navigation is left aligned, column layouts remain intact, and the previously blank collection-settings story rendered normally. No product fix was inferred from that one blank capture.
• Review and approve the intended visual differences. See the current final-head CI status above.
• Verify these changes affect no fixture inputs or generated fixture output. No database migration.

The previously pending live hero-swap and article/custom-component checks are now complete. See the current verification summary above.

---

Article editing follow-up — d307c8b (September 9)

The target blog's hero source was incorrectly marked read-only. It now uses the existing writable image picker. Reading time and the author URL also use direct writable values. Time properties now have native date/date-time controls. No database migration.

• Fix the target's hero source, reading-time structure, and author URL bindings while preserving the current content and link destination.
• Verify Content-mode category, title, excerpt, date, reading-time, shared image Description, author name/URL, MDX heading, and list-item edits reach their source files. Check reloads and restore test values.
• Add date-only, local timestamp, UTC timestamp, empty-value, and legacy-value regression coverage; demonstrate failure without the date control and passing results with it.
• Fix the macOS Bash runner's empty-argument failure. Demonstrate default invocation and argument-forwarding regressions fail without their behavior and pass afterward.
• Update authoritative Content Block/Time docs and generated CLI/MCP guidance: inventory every article field, use direct writable bindings and appropriate controls, check saved source and reload, and never infer full editability from one heading.
• Pass 291 date/text/Time/design-system tests (one existing skip), 2 runner tests, and 9 documentation tests; relevant typechecks, lint, package boundaries, formatting, and diff checks.
• Run the complete fixture pipeline: no generated fixture changes. The later runner/docs-only edits do not affect fixture inputs or outputs.
• Run the full Builder E2E suite: 82 passed. This used an explicit reporter; the default invocation correction was then covered by the runner tests.
• Run all six agent evaluation scenarios on gpt-5.5 after the final image guidance correction. All functional checks passed. The older-model token-baseline gate was disabled explicitly; accepted baselines were not changed.
• Review, commit, and push code and generated documentation.
• With explicit approval, replace the live hero image through Content mode, verify the MDX reference and reload, then restore and verify the original image.
• Complete the article-field checks listed above. Insert Accordion and YouTube from templates; verify UI edits reach MDX and MDX edits persist after reload. Restore the original article content.
• Inspect CI for 7834d90: formatting, lint, typechecks, generated docs, package/Builder tests, build checks, and five E2E shards passed. The long MDX lifecycle exhausted its total 120-second budget at its final assertion; the trace showed completed edits and reloads, not a stalled save.
• Give only that lifecycle a 180-second total budget; leave individual save waits and assertions unchanged. Both local repeats passed (plus setup). Push d307c8b; this test-timeout-only follow-up affects no fixture inputs or generated output.
• Verify Main CI for d307c8b: all 19 jobs passed, including all six E2E shards. Visual approval remains separate.
• Finish visual review and approval after correcting navigation alignment and verifying the collection-settings story renders. The user approved the reviewed 24 intended differences.
• Recheck target publication preparation: seven documents included, zero omitted, zero missing-template omissions. No deployment.
• Deferred: manual Storybook/screenshots; not authorized for this pass.

These results supersede the earlier pending image-product decisions and live-check notes. Evaluation status for the latest fixes is recorded above.

---

Blog authoring fixes — 6359f97 (September 9)

This review fixes failed UI-to-MDX saves, missing source Undo/Redo, editor recovery and focus, and publication preparation for the migrated blog. No database migration.

• Stop treating template-record ordering as a style edit; still reject actual style changes that cannot be saved in MDX.
• Share save-preparation errors with property controls across the canvas frame.
• Keep malformed MDX as an unsaved draft, with repair and discard paths; focus the source editor when opened from the Navigator.
• Enable supported Content-mode Move actions using the existing central permission rules.
• Keep source Undo/Redo separate from transient rendering history. Serialize rapid commands, wait for pending canvas edits, reject stale-source conflicts, and retain the last 20 edits per project session.
• Fix publication candidate discovery for projected documents and unrelated author references; keep rejecting unsupported references used as the actual MDX source.
• Demonstrate regression tests failing without their fixes and passing afterward.
• Run the complete Builder (2,938), Content Engine (559), and Project Build (2,395) suites: 5,892 tests passed.
• Pass relevant package typechecks, root lint, formatting, package boundaries, and diff checks.
• Run the full fixture pipeline; no generated fixture changes.
• Review documentation impact and document draft recovery and source Undo/Redo.
• Verify live heading edits, author-file edits, malformed-draft recovery, and immediate delete/Undo/Redo; restore test content and confirm persisted source.
• Verify target publication preparation: seven documents included, zero omitted, no missing-template omissions. This did not deploy the site.
• Review, commit, and push.

Remaining verification and decisions

• Correct the target's read-only Image source binding. The existing Content-mode picker replaces the article reference; shared Description edits use Asset settings. No new image-editing API or data model is needed. See the latest verification limits above.
• Repeat the full E2E and agent evaluation suites after these changes: 82 E2E tests and all six evaluation scenarios passed.
• Repeat the live Accordion/YouTube insertion and editing flow after the save fixes, including UI-to-MDX saves and MDX edits surviving reload.
• Historical note: this round did not run CI or Storybook checks; later results are recorded above.

Unknown JSX already has source-range lint diagnostics; it remains an editable missing-template placeholder, not an unconditionally blocked save. The target author's binding was also repaired through the UI so Content mode can edit its referenced author file. Shared resolved URLs remain read-only text; the image picker changes the article reference, and Asset settings edits the shared Description.

This section supersedes earlier claims of complete verification for the latest code; historical results below remain records of earlier runs.

---

Sync and import verification — a2a5675 (September 9)

Ordinary link → sync → import now exports the current saved Builder project with its current assets. It no longer mixes an older published build with current files. Import uploads assets before assigning their source folders, then restores those assignments when importing the bundle.

• Fix foldered asset imports without a database migration.
• Preserve file formats, folder assignments, build metadata, and stable repeat-sync output.
• Keep explicit --buildId export behavior unchanged; default sync does not require publishing.
• Review implementation and demonstrate regression tests failing before the fixes and passing afterward.
• Update protocol test servers for the current Builder data endpoint.
• Review documentation impact and update CLI documentation and README.
• Run all 1,121 CLI tests and 43 HTTP-client tests, both package typechecks, root lint, package boundaries, formatting, and diff checks.
• Run the full fixture pipeline and include expected current-build fixture changes.
• Verify the real source through the local CLI: repeated sync gives identical output; import into the supplied target succeeds. Blog listing and article rendering were also checked during the import investigation.
• Commit and push the fix.
• Deferred at user request: agent evaluations for this round. Later CI results are recorded above.

Sync still downloads the project and missing asset files and builds the content index locally. This is not a transfer-free operation. Default sync exports editable-build metadata rather than published deployment metadata; use the explicit build option when selecting a particular build.

---

Final review and verification — ab3a6b7 (September 9)

Existing entries now use the same field controls as New entry. The author-name permission fix, field-level validation, publishing warnings, and final cache fixes are included. No database migration.

Completed

• Review all 38 local files, including entry autosave, revision conflicts, permissions, shared fields, collection discovery, and publishing diagnostics.
• Allow existing-folder setup without rewriting entries or rejecting unconfigured frontmatter.
• Add Entry settings with autosave, repairable invalid fields, immutable filename slugs, and preserved MDX body/unknown properties.
• Warn before publication when missing or ambiguous custom templates omit content, including discovered dynamic sources.
• Allow authorized frontmatter writes to referenced Markdown author files and preserve error messages across the canvas-frame boundary.
• Reject impossible integer limits, slugless generated-filename patterns, and slug maximum length zero. Existing raw configurations remain readable for repairs.
• Share collection discovery across Assets, file editors, and property controls. Builder first synchronizes project asset metadata into the browser. The browser then groups that metadata once per update and shares configuration/template reads, instead of repeating them for each control. This does not remove initial synchronization or entry-frontmatter reads. Preserve project/access isolation, refresh retries, stale-response protection, and duplicate-filename invalidation.
• Demonstrate new regressions fail before fixes and pass afterward.
• Correct the folder-drag E2E's obsolete root-folder assumption and verify remembered-folder persistence.
• Review and update authoritative Content Engine and Content Block documentation.
• Merge current main and regenerate the conflicting CLI documentation from its source.
• Fix generated previews with shared development dependencies: invoke React Router binaries through Node, isolate each preview's Vite cache, and forward script options correctly through npm and pnpm.
• Fix a false MDX conflict when a new edit arrives immediately after the previous save is acknowledged. Advance the local revision before asynchronous parsing and ignore stale refresh results.
• Run the full fixture link/sync/build pipeline. Generated changes contain only the expected React Router scripts and Vite cache location. No database migration.
• Review the final diff and scan added lines for credential patterns.

Verification results

• Builder: 2,934 tests passed. CLI: 1,120 tests passed.
• Content Engine: 559 passed; Asset Uploader: 291 passed; Project Build: 2,394 passed; Design system: 250 passed.
• The clean full workspace run passed all 35 non-CLI packages. Its two CLI failures exposed pnpm argument forwarding; the complete CLI rerun passed after that fix. Earlier load-related test timeouts did not recur in the clean run.
• All workspace typechecks passed. Builder and CLI typechecks and repository lint were repeated after their final changes. Package boundaries, generated API checks, and the complete generated-documentation gate passed. Documentation was regenerated from source; the post-commit clean-file check passed.
• Full Builder E2E: 82 passed from a fresh build, including generated previews, collection creation/reload, MDX editing, stale revisions, and permission checks. The isolated disposable test database was cleaned up afterward; development data was untouched.
• Full agent evaluations: all six scenarios passed on gpt-5.5, including every functional check for Markdown blogs, reference discovery, MDX article editing, authentication, fonts, and design input. The account cannot use the old gpt-5.4-mini baseline model. Five baseline comparisons are incompatible and the MDX scenario has no accepted baseline; token-baseline gating was disabled explicitly. Accepted baselines are unchanged.
• New preview and MDX regressions were demonstrated failing before their fixes and passing afterward.
• Working-tree/diff checks passed. Main was merged without rewriting branch history. CI was not checked, as requested.

Final delivery checklist

• Finish the full Builder E2E rerun.
• Finish the full agent evaluation rerun with the authorized accessible model.
• Commit, verify the clean generated-documentation gate, and push. GitHub reports the branch mergeable with current main.

No known code or functional-test blocker remains from this review. CI was not checked at the user's request. Manual Storybook/screen-reader checks remain deferred; the automated E2E and agent visual checks above passed.

The historical review sections below retain their original run results. This section supersedes earlier claims about strict entry validation, entry editing, browsing reads, and evaluation authorization.

Outcome

Content editors can create structured MDX entries from a collection folder without writing frontmatter. Designers configure flat fields, limits, optional slug behavior, and the Markdown template in the Builder.

High-level goals

• Keep folders ordinary in the database and derive collection behavior from a direct collection.json.
• Add Use as content collection to folder creation.
• Give designers a visual configurator for the JSON Schema and MDX template.
• Show a collection badge and a generic New entry action.
• Generate independent MDX entries from the configured schema and template.
• Keep the current page unchanged after creating an entry; no automatic preview navigation.
• Select direct MDX entries with URLPattern filename rules; keep ignored files as ordinary supporting assets.
• Keep reserved collection files out of collection query results and generated content indexes.
• Preserve broken collections as visible, repairable collection folders.
• Restore normal folder behavior when collection.json is removed.

Implementation todos

• Add the Content Engine collection contract, default schema/template, slug normalization, validation, serialization, and entry generation.
• Discover collections from Assets files without a database folder type or migration.
• Create template.mdx and collection.json when the folder checkbox is selected.
• Add basic field controls for text, long text, slug, number, integer, and Boolean values.
• Support required fields, string length limits, numeric limits, template defaults, and generated slugs.
• Add designer collection settings and template editing.
• Remove dynamic preview-page configuration and ignore its legacy metadata.
• Add the schema-generated New entry form and creation endpoint.
• Preserve reserved-file portability in authenticated export/import while excluding it from content query and generated-index results.
• Document the feature in the authoritative Content Engine guide.

Deep review checklist

A checked item means the area was inspected and evidence was recorded. It does not mean the behavior passed. Unresolved defects and product decisions remain listed in Review findings.

1. Product contract

• Decide whether the collection checkbox creates defaults immediately or opens the configurator first.
• Decide whether existing folders can be converted through the UI.
• Define collection activation when collection.json exists but is invalid.
• Define an entry: every valid direct MDX child or only files created through New entry.
• Confirm collection membership is direct-child only and nested folders can define their own collections.
• Define designer, content editor, viewer, service, CLI/MCP, old-client, and direct-API authority.
• Decide whether content mode is simplified UI or a server authorization boundary.
• Decide whether slugs are permanently immutable.
• Decide whether schema changes may invalidate existing entries or must migrate them.
• Decide whether invalid unused collections block unrelated queries or whole-project publication.
• Decide what happens to the preserved template after collection removal.
• Define the promised JSON Schema dialect and supported subset.
• Decide whether temporary invalid collection states are admitted for repair.
• Define duplicate-request semantics: no duplicates, exactly one success, and retry behavior.
• Decide whether entries require valid frontmatter only or valid complete MDX.

2. State machine

• Review ordinary folders and root-level collection.json.
• Review empty-folder, template-only, config-uploading, and config-loading initialization states.
• Review ready collections.
• Review invalid JSON, UTF-8, size, schema, and duplicate-config states.
• Review missing, duplicate, wrong-type, oversized, invalid-frontmatter, and invalid-MDX template states.
• Review forbidden direct files, invalid entries, and slug/filename mismatches.
• Distinguish transient read/network failures from persistent invalid content.
• Review removing, removed, moved, renamed, restored, duplicated, and deleted collection states.
• For every state, inspect visibility, allowed actions, server admission, query/publish behavior, recovery, and concurrent-client behavior; record recovery behavior.

3. Activation and deactivation paths

• Review checkbox creation.
• Review create/upload/rename/move/paste/duplicate of collection.json.
• Review restore, import, project duplication, and sync behavior.
• Review delete/rename/move/replace of collection.json.
• Verify all activation paths produce the same state and validation.
• Verify all deactivation paths restore ordinary-folder behavior without accidental data loss.

4. Folder membership and nested collections

• Verify only direct children are collection entries or reserved files.
• Verify a nested folder with its own direct config becomes its own collection.
• Verify parent rules do not leak into nested folders.
• Define filename and extension case sensitivity.
• Define duplicate logical-name behavior over generated storage names.
• Define how uploading, deleted, and stale assets affect folder state.
• Review moving entries out and between collections with different schemas.
• Review ordinary subfolders with arbitrary files inside a collection.
• Review template behavior after collection removal.

5. Roles and authorization

• Review config/template listing and download for every role.
• Review config/template content edits for every role.
• Review config/template rename, move, restore, and deletion for every role.
• Review entry create/edit/rename/move/delete/restore for every role.
• Review generic upload and subfolder operations for every role.
• Review collection removal and repair for every role.
• Verify server enforcement separately from hidden or disabled controls.
• Recheck permission changes while operations are in flight.

6. Mutation surfaces

• Review REST upload-ticket creation and upload completion.
• Review asset-content replacement and asset metadata changes.
• Review runtime add/update/duplicate operations.
• Review sync patches and direct persistence helpers.
• Review clipboard, drag/drop, move, rename, and duplicate paths.
• Review import/export, restore, and project/folder duplication paths.
• Review delete-unused-assets and recursive folder deletion.
• Verify invariants at the final persistence boundary, not only in UI preflight.

7. Concurrent operations

• Review create entry against schema save, template save, raw config edit, and collection removal.
• Review edit/delete/restore entry against schema and template changes.
• Review two collection-settings editors and raw editor versus configurator.
• Review schema writer A interleaved with template writer B.
• Review upload/move/rename against collection activation and removal.
• Review template/config deletion against creation and publication.
• Review folder deletion/move and project switch against all async operations.
• Review final validity, conflict detection, cleanup, user outcome, cache invalidation, and publish behavior across the implemented intersections; record conflict and recovery behavior.
• Review retry after the server commits but the HTTP response is lost.

8. Collection initialization and recovery

• Review project switch, permission revocation, dialog close, folder rename/move/delete, and conflicting uploads during initialization.
• Verify retry is idempotent and does not duplicate reserved files.
• Verify partial setup has a visible finish, retry, or cleanup path.
• Verify generic actions cannot corrupt the initialization window.
• Verify project and folder identities are captured for the whole operation.
• Review asset-count, storage, filename, and folder limits with cleanup.

9. JSON Schema conformance

• Confirm the exact draft and validate configs against its meta-schema.
• Review unknown dialects, boolean schemas, malformed keyword types, and duplicate JSON keys.
• Review refs/defs, recursion, composition, conditionals, dependencies, and nullable/multiple types.
• Review enum, const, format, pattern, patternProperties, and additionalProperties.
• Review min/max properties, array constraints, contains, and uniqueItems.
• Review exclusive numeric bounds and all string/number/integer limits.
• Differential-test validation against an independent draft 2020-12 implementation.
• Verify unsupported keywords are rejected or explicitly documented, never silently ignored.

10. Schema resource limits and hostile input

• Bound schema bytes, depth, field count, enum size, and reference depth.
• Bound validator compilation and validation time.
• Review recursive references and excessive composition branches.
• Review catastrophic patterns and regex denial of service.
• Review huge labels, keys, defaults, and values.
• Review prototype-sensitive and structurally awkward field names.
• Review memory and CPU amplification across many collections.

11. Configurator ownership and round trips

• Define owned, preserved, read-only, and rejected schema paths.
• Verify parse/save/parse semantic equivalence and repeated-save idempotence.
• Verify a UI edit changes only explicitly owned schema paths.
• Review property/form order and required-array order.
• Review unknown root, property, and Webstudio extension metadata.
• Review editable primitive fields that also contain enum, const, format, composition, readOnly, or custom constraints.
• Review type changes for incompatible preserved or removed keywords.
• Review rename/removal collisions with unsupported properties and requirements.
• Surface hidden preserved rules that can cause unexplained validation errors.
• Review field ordering/reordering.
• Review choosing/changing slug field, slug source, and template filename.
• Review turning newly added fields into slug or slug-source fields.

12. Required/default/unset semantics

• Review absent, empty string, false, zero, null, default, and user-cleared values for every field type.
• Define required-property versus non-empty-value behavior.
• Verify required Boolean false remains valid and understandable.
• Review optional Boolean absence versus explicit false.
• Review explicitly clearing template-backed values.
• Review JSON Schema default as annotation versus persisted entry value.
• Verify precedence among template values, schema defaults, generated slug, and user values.
• Review hidden/non-renderable required fields and template requirements.
• Verify a collection cannot be ready when every entry form must fail.

13. Schema evolution and migration

• Review add/remove optional and required fields.
• Review field rename and label-only changes.
• Review type changes and tightened/relaxed limits.
• Review enum option, default, slug field/source, template name, and additionalProperties changes.
• Verify compatible save ordering and identify impossible two-write migrations.
• Decide whether entries are rewritten and whether migration is atomic.
• Review entry changes after validation but before schema commit.
• Ensure designers see all incompatible entries or an actionable summary.

14. Template, YAML, and MDX

• Review absent/empty frontmatter and empty YAML.
• Review BOM, CRLF, final-newline, and alternate YAML delimiter behavior.
• Review duplicate keys, anchors, aliases, tags, comments, quoting, and multiline strings.
• Review Unicode and byte limits.
• Verify frontmatter and starter-body preservation.
• Review invalid MDX bodies, imports, exports, expressions, and unsafe nodes.
• Review missing, renamed, duplicate, wrong-type, and oversized templates.
• Verify template changes affect future entries only.
• Review reserved template exposure through direct asset URLs and build copying.

15. New-entry form and creation

• Verify every required field is renderable or supplied safely.
• Verify deterministic field order and correct controls/constraints.
• Compare client and authoritative server validation.
• Prevent submitted values from overwriting protected hidden fields.
• Preserve values and focus after failed creation.
• Review per-field errors, error summary, and first-error focus.
• Prevent duplicate submission and define lost-response recovery.
• Verify local sync, reload persistence, and project-switch handling.
• Review no/stale preview page, query delay, and draft-filtered entries.
• Review large forms and narrow/mobile layouts.

16. Entry editing and lifecycle

• Review body-only, frontmatter-only, and combined edits.
• Review invalid intermediate frontmatter and invalid complete MDX.
• Review slug change, filename rename, and reference consequences.
• Review delete, restore, move out, move between collections, duplicate, paste, and undo.
• Review slug reuse after delete and restore collision.
• Review edits concurrent with schema/template changes.
• Review repair of legacy invalid entries and blocked intermediate saves.
• Decide whether existing entries receive a generated settings form or raw MDX editing.

17. Slug and filename identity

• Review slug source selection, same slug/source field, manual override, and visible final normalization.
• Enforce lowercase-dash identity independently of editable schema metadata.
• Review empty normalized slugs and template/schema slug defaults.
• Review diacritics, non-Latin scripts, and emoji-only sources.
• Use locale-independent case comparison and Unicode normalization.
• Review character/byte limits and case-insensitive filesystems.
• Review collisions with reserved config/template filenames.
• Review concurrent creation, stale reservations, deletion, reuse, restoration, and URL encoding.

18. Collection-root restrictions

• Review upload, external drop, internal drag, generic text creation, paste, duplicate, move, rename, and extension changes.
• Review runtime add, sync patch, import, and restore bypasses.
• Review upload tickets completed after activation.
• Review moving or renaming collection.json through metadata changes.
• Review dedicated entry creation, initialization, repair, body editing, and collection removal exceptions.
• Verify subfolder creation and arbitrary files inside subfolders remain allowed.

19. Storage, database, idempotency, and cleanup

• Review object-without-File, File-without-Asset, stale UPLOADING, and soft-deleted states.
• Review storage success/database failure and database success/storage failure.
• Review postcheck failure, object cleanup, row cleanup, and cleanup failure.
• Verify cleanup preserves the original error and cannot delete another request's asset.
• Review timeout/lost response after commit and safe retries.
• Review reservation lookup/cleanup failure and expiration.
• Review failed creation cleanup and distinguish incomplete uploads from existing entries with repairable field errors. Existing field errors do not hide entries or block publication.
• Verify orphan reclamation and project-scoped cleanup.

20. Query, build, and publication

• Verify config/template exclusion only for an identified collection.
• Verify ordinary root-level collection.json remains ordinary content.
• Review template queryability after collection removal.
• Validate actual entry frontmatter and decide complete-MDX requirements.
• Review invalid content versus transient read failure.
• Decide invalid-collection blast radius across queries, field catalog, build, and publish.
• Review direct asset IDs, document references, build copying, and public URLs for reserved-file leakage.
• Verify preview and publish use the same collection rules.

21. Cache and snapshot consistency

• Verify config, template, entries, filenames, folder movement, activation, and removal affect source revision.
• Verify immutable/revision-pinned reads under concurrent swaps.
• Verify config and template come from one logical version.
• Review revision consistency between entry reads and indexing. Queries do not require entry-schema validation.
• Review rejected-promise caching and retry after repair.
• Verify no cross-project cache collision.

22. Performance and availability

• Review sequential versus bounded parallel reads.
• Review request cancellation and repeated preview-query work.
• Review rate limits and resource-exhaustion protection.
• Review progress/cancellation and actionable limit errors.

23. Invalid-state repair

• Review repair for every config, template, forbidden-file, entry, and slug mismatch state.
• Show exact folder, file, field, and rule.
• Distinguish retryable transport errors from content errors.
• Provide missing-template creation despite normal root restrictions.
• Provide duplicate-file deletion and forbidden-file move recovery.
• Preserve raw repair when the configurator cannot parse the schema.
• Show collection health after repair.
• Prevent custom-template leakage to content editors when config cannot identify it.

24. Entry navigation

• Remove dynamic preview configuration and automatic navigation after entry creation.
• Verify entry creation leaves the selected page unchanged, with or without a slug field.

25. Accessibility and responsive behavior

• Review native form submission and required semantics beyond an asterisk.
• Review linked errors, error summary, live announcements, and busy state.
• Review focus after errors, add/remove field, key edits, confirmation transitions, and dialog close.
• Review dirty-close warning, explicit cancel/retry, and durable feedback beyond toasts.

26. Portability, compatibility, and rollback

• Review export/import, folder/project duplication, and restore ordering.
• Verify logical filenames, not storage names, define the portable contract.
• Review case-insensitive filesystem behavior.
• Review rollback after collection files already exist.
• Verify removal or rollback leaves content recoverable.
• Confirm database/migration assumptions.

27. Observability and supportability

• Review state-transition and validation diagnostics.
• Track cleanup failures and orphaned reservations.
• Make publish errors actionable without logging private content.
• Ensure client errors do not expose stack traces or sensitive internals.

28. Verification strategy

• Unit-test schema, slug, merge, serialization, and validators.
• Demonstrate each new regression test fails without its fix.
• Run affected unit suites, typechecks, lint, docs checks, E2E, fixture-impact review, and final diff review.
• Review authoritative documentation impact.

Persistence and recovery

No database migration is needed. Folders remain ordinary database rows; their direct collection.json activates collection behavior. This PR adds no table, column, index, RPC, folder type, or backfill.

• Setup writes the template first and collection.json last. Interrupted setup leaves an ordinary folder and can be retried.
• Existing immutable File revisions, conditional Asset updates, and upload reservations provide conflict detection and retry-safe entry creation.
• Settings saves validate the intended template and schema together, then write only the files that changed. Existing entry field errors stay repairable and do not block unrelated saves, queries, or publication. New entry creation remains strict.
• Invalid or interrupted collections remain visible and repairable. Configuration/template structure errors remain distinct from entry-field errors; entry-field errors do not invalidate the entire collection.
• Public/service publication excludes configuration and template files. Authenticated CLI exports retain them for lossless import.

Review findings

The implementation review is complete. Confirmed defects were fixed and the following tradeoffs remain explicit.

Fixed

• Enforced collection structure and permissions across REST, runtime patches, import, query, and publication, while keeping existing entry-field errors non-blocking for queries and publication.
• Preserved Undo/Redo, including restoring shared File revisions in cloned projects.
• Rejected forged shared-file metadata while preserving metadata edits on legacy files with null uploader provenance.
• Added retry and recovery behavior for setup, settings saves, lost responses, and transient reads.
• Moved collection setup into one retry-safe server operation and kept the local Builder update as one Undoable transaction.
• Centralized collection inspection and limited schemas to the flat fields the configurator can represent. Opening a collection still reads its entries in the background to report field errors.
• Guarded stale dialogs and deferred saves against permission changes, protected files, project switches, and replaced revisions.
• Kept Asset settings open while choosing nested folders; the existing browser regression fails before the fix and passes afterward.
• Preserved required Boolean false values, field-level errors, dirty-close prompts, and inline Markdown editing.
• Separated authenticated portable exports from public runtime assets.
• Updated the authoritative Content Engine guide.

Known tradeoffs

• A failure after template content saves but before configuration saves can temporarily leave an invalid collection. Retrying the settings save completes it; otherwise the visible files allow repair. The template/config rename endpoint remains retry-safe and rolls back a rename when its config write fails.
• Cloned-project Undo can retain an unused prior File revision. Separate read-then-delete cleanup could race with another restore, so this path retains the revision.
• Build/asset persistence and import already use multiple calls. This PR validates before writes and provides retry/conflict handling; it does not provide a transaction spanning every resource or a global collection lock.
• Opening a collection loads its configuration and template through shared Builder discovery, then checks entry frontmatter in the background for field errors. Unchanged configuration/template content is reused across controls and entry edits. Frontmatter checks still require entry reads; ordinary folder browsing does not discover every collection’s file content.

Latest unstaged-change review — 2026-09-07

• Review collection settings, validation, autosave/error recovery, entry creation, reserved-file actions, and conversion flows.
• Review shared labels, list keyboard handling, dialog focus/Escape, buttons, and panel spacing migrations.
• Fix Enter/Space list activation lost when arrow navigation replaced the existing press handler.
• Recognize historical generated ASCII/Unicode slug patterns, use the bundled Unicode slug schema, and save a locally resolved $ref without changing existing filenames.
• Prevent duplicate slugless entries after a lost response: New entry sends a stable UUID per attempt, reused by the repository's existing filename/content retry checks. No database migration. Callers omitting the optional requestId retain the previous behavior.
• Preserve Content Block template validation independently of page HTML placement, without accepting invalid rendered nesting.
• Demonstrate the new review regressions fail without their fixes and pass afterward.
• Review authoritative documentation and update legacy slug behavior.
• Run fixtures and inspect generated changes: none.
• Deferred manual verification: Storybook screenshots were not authorized for this pass.
• Historical evaluation status: not run in this pass; superseded by the final verification section above.

Verification

Local checks for commit 2b81956:

• Builder app: 1,739 tests; Builder core: 1,150 tests. After the final fixes, entry/settings tests and shared asset REST checks also passed, including the added stable-retry test.
• Content Engine: 535 tests.
• Asset Uploader: 279 tests.
• Design system: 249 tests.
• Project Build: 2,392 tests.
• All five affected package typechecks, changed-file lint/formatting, package boundaries, and Content Engine documentation tests passed.
• Complete fixture link/sync/build pipeline passed with no tracked fixture changes.
• Staged diff and credential-pattern checks passed. No database schema, migration, or generated database type changes. The lockfile includes the collection validator and filename matcher dependencies.
• CI for this commit is pending. Builder E2E, manual screen-reader/mobile checks, Storybook screenshots, and agent evaluations were not run in this pass.

MDX editing review — commit c3702a7

• Review all 36 local changed files: MDX parsing/materialization, template enforcement, mutation commits, persistence, Assets refresh, Navigator, source binding, editor diagnostics, dialogs, and query menus.
• Validate new custom components at the shared Builder mutation commit before applying tree changes. Cover move, reparent, paste, nested paste, duplicate, and batched operations; preserve unchanged authored content.
• Match template names and component structure, including renamed templates, instead of accepting any component type found in Templates.
• Remove the registered-component fallback from MDX materialization and completion; report untemplated JSX in the editor.
• Preserve unresolved JSX until its placeholder is deleted, then persist its removal without clearing the Assets resource during refresh.
• Keep custom designer content outside the MDX body; omit the extra body for fresh unconnected Content Blocks.
• Resolve Navigator's MDX-file action from the active content root for dynamic sources.
• Fix the first dialog drag jump while honoring subsequent explicit size changes; contain long query menus and prevent editor Backspace from deleting instances.
• Demonstrate new review regression failures before the fixes and passing results afterward.
• Review and update authoritative Content Block documentation.
• Run the complete fixture pipeline; no generated fixture changes.
• Historical evaluation status: deferred in this pass; superseded by the final verification section above.
• Historical verification limits: no Storybook screenshots, Builder E2E, or manual accessibility checks in this pass. See the final verification section for the current E2E result; manual checks remain deferred.

Latest verification

• Builder affected suites: 624 tests passed.
• Project Build full suite: 2,394 tests passed.
• Design system full suite: 250 tests passed.
• Query Builder React full suite: 14 tests passed.
• Component Registry full suite: 7 tests passed.
• All five affected package typechecks, repository lint, changed-source formatting, staged diff checks, and credential-pattern scan passed.
• Fixture link/sync/build passed without generated changes. No database migration.
• CI for this commit has not yet been verified.

The new mutation-commit check covers Builder operations affecting loaded external content roots. It is not a claim that every remote API mutation is now guarded by this client-side check.

Closes #6316

Local-change review — 2026-09-08

• Review all 47 changed files and trace collection setup, filename filters, public metadata/upload APIs, sync patches, Content-mode write targets, local folder persistence, and MCP downloads.
• Fix ignored MDX files being renamed into entries through the metadata API. Selected filenames require New entry.
• Fix supporting-asset moves/renames being blocked by unrelated invalid entries. Configuration/template checks still run. The later entry-repair work also removed entry-field validation as a blocker for unrelated writes and publication.
• Validate frontmatter directly with Ajv, resolve the bundled slug $ref without network fetching, preserve the flat schema contract, and avoid retaining old validator instances.
• Verify Unicode generation, legacy-pattern upgrades, sibling constraints, field error paths, optional binding paths, referenced-file permissions, and independent queued edits.
• Review authoritative documentation, correct contradictory referenced-write guidance, and regenerate CLI/MCP documentation.
• Demonstrate new review regression failures with the fixes disabled, then restore and pass them.
• Pass Content Engine (553), asset uploader (284), SDK (570), project-build (2,394), MCP command (61), and collection/Content-mode browser tests (279), plus expression tests and documentation checks.
• Pass seven affected package typechecks, repository lint, formatting, package boundaries, and fixture link/sync/build. No generated fixture changes or database migration.
• Historical evaluation status: deferred in this pass; the user subsequently authorized the full suite. See the final verification section above.
• Historical verification limits: no Builder E2E or manual visual/accessibility checks in this pass. See the final verification section for the current E2E result; manual checks remain deferred.