refac: article reads, story delete, no leaks, stored SEO status, rate limit, cleanup (%site%, article repo split, old lang repos, one default per site rule to domain)

.gitignore

@@ -29,6 +29,7 @@ CLAUDE.md
 AGENTS.md
 codex-workflow.md
 CODING_STANDARDS.md
+tools/product-videos/
 
 # Generated LLM docs
 internal/infrastructure/llmdocs/generated/*

README.md

@@ -27,7 +27,7 @@ Upgrade with `docker compose pull && docker compose up -d`. The image is `git.fl
 
 ### Updates from the browser
 
-On Linux with systemd, install v2.6.0-beta or newer manually, then follow [the browser-update setup guide](docs/deployment.md#browser-updates). It covers finding the actual database directory, installing the helper, testing a restart and troubleshooting. Other platforms use manual upgrades.
+On Linux with systemd, install the helper manually once, then follow [the browser-update setup guide](docs/deployment.md#browser-updates). It covers finding the actual database directory, installing the helper, testing a restart and troubleshooting. Other platforms use manual upgrades.
 
 ### Develop
 
@@ -43,6 +43,7 @@ task dev                # API with hot reload + Vite HMR → http://localhost:51
 
 | Doc | Contents |
 |---|---|
+| [docs/getting-started.md](docs/getting-started.md) | Set up an instance: download the binary or start Docker, fill the settings, HTTPS, first login |
 | [docs/development.md](docs/development.md) | Dev setup, how Vite and the API fit together, tests, lint, `task` commands |
 | [docs/deployment.md](docs/deployment.md) | Building release binaries, running as a service, HTTPS, backups, upgrades |
 | [docs/docker.md](docs/docker.md) | Running RenewCMS in Docker: image, Compose, data volume, backups, reverse proxy, tags, upgrades, publishing |
@@ -52,10 +53,7 @@ task dev                # API with hot reload + Vite HMR → http://localhost:51
 | [docs/performance.md](docs/performance.md) | Measured costs, such as the `?seo=` article filter |
 | [docs/api.md](docs/api.md) | API reference: authentication, API keys, routes and the activity log |
 | [docs/api/articles.md](docs/api/articles.md) | Reading articles: pagination, search, `format` and body schemas |
-| [docs/custom-content-types.md](docs/custom-content-types.md) | Custom content types: layering, phase 1 limitations and their fix path |
+| [docs/api/site-languages.md](docs/api/site-languages.md) | Site languages, first-time language setup and the public URL pattern |
+| [docs/custom-content-types.md](docs/custom-content-types.md) | Custom content types: layering and known limitations |
 | [docs/image-variants.md](docs/image-variants.md) | Image variants and their cache |
 | [docs/release-notes.md](docs/release-notes.md) | Release notes format, the published releases and how to publish one |
-
-## TODOs
-
-- Cancel button when email validation pending or expired

Taskfile.yml

@@ -79,7 +79,7 @@ tasks:
               return 1
             fi
             echo "== $IMAGE on 127.0.0.1:$PORT"
-            RENEWCMS_TEST_MYSQL_DSN="root:$PASSWORD@tcp(127.0.0.1:$PORT)/mysql" go test -tags nofrontend ./test/... -run MySQL -count=1 {{.CLI_ARGS}}
+            RENEWCMS_TEST_MYSQL_DSN="root:$PASSWORD@tcp(127.0.0.1:$PORT)/mysql" go test -tags nofrontend ./test/... -run 'MySQL|TestLocalizationPersistence' -count=1 -timeout 20m {{.CLI_ARGS}}
             RESULT=$?
             docker rm -f "$NAME" >/dev/null 2>&1
             return $RESULT
@@ -119,7 +119,7 @@ tasks:
               return 1
             fi
             echo "== $IMAGE on 127.0.0.1:$PORT"
-            RENEWCMS_TEST_POSTGRES_DSN="postgres://postgres:$PASSWORD@127.0.0.1:$PORT/postgres?sslmode=disable" go test -tags nofrontend ./test/... -run Postgres -count=1 {{.CLI_ARGS}}
+            RENEWCMS_TEST_POSTGRES_DSN="postgres://postgres:$PASSWORD@127.0.0.1:$PORT/postgres?sslmode=disable" go test -tags nofrontend ./test/... -run 'Postgres|TestLocalizationPersistence' -count=1 -timeout 20m {{.CLI_ARGS}}
             RESULT=$?
             docker rm -f "$NAME" >/dev/null 2>&1
             return $RESULT

api/dependecyInjection.go

@@ -10,6 +10,7 @@ import (
 	domainEntry "RenewCMS/internal/domain/entry"
 	domainImage "RenewCMS/internal/domain/image"
 	domainInvite "RenewCMS/internal/domain/invite"
+	domainLocalization "RenewCMS/internal/domain/localization"
 	domainMail "RenewCMS/internal/domain/mail"
 	domainPurge "RenewCMS/internal/domain/purge"
 	domainRole "RenewCMS/internal/domain/role"
@@ -45,6 +46,8 @@ import (
 type UseCases struct {
 	apiKeyAuthOnce                  sync.Once
 	apiKeyAuthMiddleware            func(http.Handler) http.Handler
+	publicReadLimitOnce             sync.Once
+	publicReadLimitMiddleware       func(http.Handler) http.Handler
 	Token                           *authtoken.Auth
 	PurgeScheduler                  *scheduler.Runner
 	ActivityCleanupScheduler        *scheduler.Runner
@@ -56,7 +59,12 @@ type UseCases struct {
 	ResolveArticleSEOUseCase        *useCases.ResolveArticleSEOUseCase
 	CheckArticleSEOUseCase          *useCases.CheckArticleSEOUseCase
 	ListSitemapUseCase              *useCases.ListSitemapUseCase
+	ResolvePublicArticleUseCase     *useCases.ResolvePublicArticleUseCase
 	DeleteArticleUseCase            *useCases.DeleteArticleUseCase
+	CreateTranslationUseCase        *useCases.CreateTranslationUseCase
+	DescribeArticleUseCase          *useCases.DescribeArticleUseCase
+	MoveStoryUseCase                *useCases.MoveStoryUseCase
+	DeleteStoryUseCase              *useCases.DeleteStoryUseCase
 	ListAuthorsUseCase              *useCases.ListAuthorsUseCase
 	CreateAuthorUseCase             *useCases.CreateAuthorUseCase
 	CreateMyAuthorUseCase           *useCases.CreateMyAuthorUseCase
@@ -69,6 +77,10 @@ type UseCases struct {
 	ListSitesUseCase                *useCases.ListSitesUseCase
 	CreateSiteUseCase               *useCases.CreateSiteUseCase
 	UpdateSiteUseCase               *useCases.UpdateSiteUseCase
+	GetSiteLanguagesUseCase         *useCases.GetSiteLanguagesUseCase
+	UpdateSiteLanguagesUseCase      *useCases.UpdateSiteLanguagesUseCase
+	GetLanguageSetupUseCase         *useCases.GetLanguageSetupUseCase
+	ApplyLanguageSetupUseCase       *useCases.ApplyLanguageSetupUseCase
 	SetDefaultSiteUseCase           *useCases.SetDefaultSiteUseCase
 	DeleteSiteUseCase               *useCases.DeleteSiteUseCase
 	CreateContentTypeUseCase        *useCases.CreateContentTypeUseCase
@@ -174,8 +186,9 @@ func (c *UseCases) RunSchedulers(ctx context.Context) {
 }
 
 type Repositories struct {
-	ArticleRepo       domainArticle.Repository
+	ArticleRepo       domainArticle.ListingRepository
 	SiteRepo          domainSite.Repository
+	LocalizationRepo  domainLocalization.Repository
 	ContentTypeRepo   domainContentType.Repository
 	EntryRepo         domainEntry.Repository
 	AuthorRepo        domainAuthor.Repository
@@ -324,6 +337,7 @@ func getRepositories(connection *database.Connection, settings config.Settings)
 	return &Repositories{
 		ArticleRepo:       persistence.NewArticleRepository(db),
 		SiteRepo:          persistence.NewSiteRepository(db),
+		LocalizationRepo:  persistence.NewLocalizationRepository(db),
 		ContentTypeRepo:   persistence.NewContentTypeRepository(db),
 		EntryRepo:         persistence.NewEntryRepository(db),
 		AuthorRepo:        persistence.NewAuthorRepository(db),
@@ -375,19 +389,26 @@ func getUseCases(repos *Repositories, imageStorage domainImage.Storage, settings
 	usageTracker := usage.NewTracker(repos.VariantUsageRepo, time.Now)
 	serveVariant := useCases.NewServeVariantUseCase(repos.VariantRepo, repos.VariantFileRepo, repos.ImageRepo, imageStorage, repos.VariantRenderer, useCases.ServeVariantLimits{MaxSourceBytes: settings.ImageVariantMaxSourceBytes, MaxSourcePixels: settings.ImageVariantMaxSourcePixels, MaxConcurrentRenders: settings.ImageVariantMaxConcurrentRenders}).WithUsageTracker(usageTracker)
 
+	moveStory := useCases.NewMoveStoryUseCase(repos.Transactor, repos.ArticleRepo, recorder)
+
 	return &UseCases{
 		PurgeScheduler:                  scheduler.NewSystemRunner(purgeScheduler, log.Default()),
 		ActivityCleanupScheduler:        scheduler.NewSystemCleanupRunner(activityCleanup, log.Default()),
 		RetentionScheduler:              scheduler.NewSystemRetentionRunner(useCases.NewEnforceRetentionUseCase(repos.UserRepo, repos.InviteRepo, repos.SessionRepo), log.Default()),
 		Token:                           authtoken.New([]byte(settings.JWTSecret), authtoken.WithRevocationStore(sessionRevocation)),
-		CreateArticleUseCase:            useCases.NewCreateArticleUseCase(repos.ArticleRepo, renderer, recorder, repos.SiteRepo, repos.AuthorRepo),
+		CreateArticleUseCase:            useCases.NewCreateArticleUseCase(repos.Transactor, renderer, recorder, repos.SiteRepo, repos.AuthorRepo),
 		GetArticleUseCase:               useCases.NewGetArticleUseCase(repos.ArticleRepo, renderer),
-		ListArticlesUseCase:             useCases.NewListArticlesUseCase(repos.ArticleRepo, renderer, repos.SiteRepo),
+		ListArticlesUseCase:             useCases.NewListArticlesUseCase(repos.ArticleRepo, renderer, repos.SiteRepo, repos.LocalizationRepo),
-		UpdateArticleUseCase:            useCases.NewUpdateArticleUseCase(repos.ArticleRepo, renderer, recorder, repos.SiteRepo, repos.AuthorRepo, repos.ImageRepo),
+		UpdateArticleUseCase:            useCases.NewUpdateArticleUseCase(repos.ArticleRepo, renderer, recorder, repos.SiteRepo, repos.AuthorRepo, repos.ImageRepo, repos.LocalizationRepo, moveStory),
 		DeleteArticleUseCase:            useCases.NewDeleteArticleUseCase(repos.ArticleRepo, recorder),
-		ResolveArticleSEOUseCase:        useCases.NewResolveArticleSEOUseCase(repos.ArticleRepo, repos.SiteRepo, repos.ImageRepo),
+		CreateTranslationUseCase:        useCases.NewCreateTranslationUseCase(repos.Transactor, repos.ArticleRepo, repos.LocalizationRepo, renderer, recorder),
-		CheckArticleSEOUseCase:          useCases.NewCheckArticleSEOUseCase(repos.ArticleRepo, repos.SiteRepo, repos.ImageRepo),
+		DescribeArticleUseCase:          useCases.NewDescribeArticleUseCase(repos.ArticleRepo, repos.LocalizationRepo),
-		ListSitemapUseCase:              useCases.NewListSitemapUseCase(repos.ArticleRepo, repos.SiteRepo),
+		MoveStoryUseCase:                moveStory,
+		DeleteStoryUseCase:              useCases.NewDeleteStoryUseCase(repos.Transactor, repos.ArticleRepo, recorder),
+		ResolveArticleSEOUseCase:        useCases.NewResolveArticleSEOUseCase(repos.ArticleRepo, repos.SiteRepo, repos.ImageRepo, repos.LocalizationRepo),
+		CheckArticleSEOUseCase:          useCases.NewCheckArticleSEOUseCase(repos.ArticleRepo, repos.SiteRepo, repos.ImageRepo, repos.LocalizationRepo),
+		ListSitemapUseCase:              useCases.NewListSitemapUseCase(repos.ArticleRepo, repos.SiteRepo, repos.LocalizationRepo),
+		ResolvePublicArticleUseCase:     useCases.NewResolvePublicArticleUseCase(repos.ArticleRepo, repos.SiteRepo, repos.LocalizationRepo, renderer),
 		ListAuthorsUseCase:              useCases.NewListAuthorsUseCase(repos.AuthorRepo, repos.UserRepo),
 		CreateAuthorUseCase:             useCases.NewCreateAuthorUseCase(repos.AuthorRepo, repos.UserRepo, repos.ImageRepo, recorder),
 		CreateMyAuthorUseCase:           useCases.NewCreateMyAuthorUseCase(repos.AuthorRepo, repos.UserRepo, recorder),
@@ -399,7 +420,11 @@ func getUseCases(repos *Repositories, imageStorage domainImage.Storage, settings
 		ListPermissionsUseCase:          useCases.NewListPermissionsUseCase(),
 		ListSitesUseCase:                useCases.NewListSitesUseCase(repos.SiteRepo),
 		CreateSiteUseCase:               useCases.NewCreateSiteUseCase(repos.SiteRepo, repos.ImageRepo, recorder),
-		UpdateSiteUseCase:               useCases.NewUpdateSiteUseCase(repos.SiteRepo, repos.ImageRepo, recorder),
+		UpdateSiteUseCase:               useCases.NewUpdateSiteUseCase(repos.SiteRepo, repos.ImageRepo, recorder, repos.ArticleRepo),
+		GetSiteLanguagesUseCase:         useCases.NewGetSiteLanguagesUseCase(repos.SiteRepo, repos.LocalizationRepo),
+		UpdateSiteLanguagesUseCase:      useCases.NewUpdateSiteLanguagesUseCase(repos.Transactor, recorder),
+		GetLanguageSetupUseCase:         useCases.NewGetLanguageSetupUseCase(repos.SiteRepo, repos.LocalizationRepo),
+		ApplyLanguageSetupUseCase:       useCases.NewApplyLanguageSetupUseCase(repos.Transactor, recorder),
 		SetDefaultSiteUseCase:           useCases.NewSetDefaultSiteUseCase(repos.SiteRepo, recorder),
 		DeleteSiteUseCase:               useCases.NewDeleteSiteUseCase(repos.SiteRepo, recorder),
 		CreateContentTypeUseCase:        useCases.NewCreateContentTypeUseCase(repos.ContentTypeRepo, repos.RoleRepo, time.Now),
@@ -528,6 +553,9 @@ func InitContainer(settings config.Settings) (*UseCases, func() error) {
 	if err := backfillImageMetadata(repos.ImageRepo, imageStorage, settings); err != nil {
 		panic("Failed to backfill image metadata: " + err.Error())
 	}
+	if err := useCases.NewRefreshArticleSEOUseCase(repos.ArticleRepo, repos.SiteRepo, repos.LocalizationRepo).RefreshStale(); err != nil {
+		panic("Failed to backfill the article SEO status: " + err.Error())
+	}
 	container := getUseCases(repos, imageStorage, settings)
 	return container, container.runUsageTracker(connection.Close)
 }

api/handlers/article/articleHandler.go

@@ -3,11 +3,11 @@ package article
 import (
 	"RenewCMS/api/pkg/access"
 	"RenewCMS/api/pkg/apperr"
+	"RenewCMS/api/pkg/articleerr"
 	validator "RenewCMS/api/pkg/validator"
 	domain "RenewCMS/internal/domain/article"
 	"RenewCMS/internal/domain/author"
-	"RenewCMS/internal/domain/image"
+	"RenewCMS/internal/domain/language"
-	"RenewCMS/internal/domain/site"
 	"RenewCMS/internal/infrastructure/useCases"
 	"encoding/json"
 	"errors"
@@ -26,25 +26,41 @@ import (
 )
 
 type Handler struct {
-	CreateUseCase *useCases.CreateArticleUseCase
+	createUseCase      *useCases.CreateArticleUseCase
-	GetUseCase    *useCases.GetArticleUseCase
+	getUseCase         *useCases.GetArticleUseCase
-	ListUseCase   *useCases.ListArticlesUseCase
+	listUseCase        *useCases.ListArticlesUseCase
-	DeleteUseCase *useCases.DeleteArticleUseCase
+	deleteUseCase      *useCases.DeleteArticleUseCase
-	UpdateUseCase *useCases.UpdateArticleUseCase
+	updateUseCase      *useCases.UpdateArticleUseCase
+	translationUseCase *useCases.CreateTranslationUseCase
+	describeUseCase    *useCases.DescribeArticleUseCase
 }
 
 type PostArticle struct {
-	Title string `json:"title" validate:"required,min=3,max=200"`
+	Title           string  `json:"title" validate:"required,min=3,max=200"`
-	Body  string `json:"body"`
+	Body            string  `json:"body"`
+	Lang            *string `json:"lang"`
+	StoryID         *uint32 `json:"story_id" validate:"omitempty,gte=1"`
+	SourceArticleID *uint32 `json:"source_article_id" validate:"omitempty,gte=1"`
+	Copy            *bool   `json:"copy"`
+	Site            *string `json:"site" validate:"omitempty,sitekey"`
 }
 
-func NewHandler(create *useCases.CreateArticleUseCase, get *useCases.GetArticleUseCase, list *useCases.ListArticlesUseCase, delete *useCases.DeleteArticleUseCase, update *useCases.UpdateArticleUseCase) *Handler {
+type PostTranslation struct {
+	Lang            string  `json:"lang" validate:"required"`
+	Title           string  `json:"title" validate:"required,min=3,max=200"`
+	SourceArticleID *uint32 `json:"source_article_id" validate:"omitempty,gte=1"`
+	Copy            *bool   `json:"copy" validate:"required"`
+}
+
+func NewHandler(create *useCases.CreateArticleUseCase, get *useCases.GetArticleUseCase, list *useCases.ListArticlesUseCase, delete *useCases.DeleteArticleUseCase, update *useCases.UpdateArticleUseCase, translation *useCases.CreateTranslationUseCase, describe *useCases.DescribeArticleUseCase) *Handler {
 	return &Handler{
-		CreateUseCase: create,
+		createUseCase:      create,
-		GetUseCase:    get,
+		getUseCase:         get,
-		ListUseCase:   list,
+		listUseCase:        list,
-		DeleteUseCase: delete,
+		deleteUseCase:      delete,
-		UpdateUseCase: update,
+		updateUseCase:      update,
+		translationUseCase: translation,
+		describeUseCase:    describe,
 	}
 }
 
@@ -59,22 +75,48 @@ type baseArticleResponse struct {
 	Authors    []author.Byline   `json:"authors"`
 	CreatedAt  time.Time         `json:"created_at"`
 	UpdatedAt  time.Time         `json:"updated_at"`
+	Lang       string            `json:"lang"`
+	StoryID    uint32            `json:"story_id"`
+	Revision   uint32            `json:"revision"`
 }
 
 type articleResponse struct {
 	baseArticleResponse
-	Slug              string   `json:"slug"`
+	Slug              string               `json:"slug"`
-	Excerpt           string   `json:"excerpt"`
+	Excerpt           string               `json:"excerpt"`
-	SEOTitle          string   `json:"seo_title"`
+	SEOTitle          string               `json:"seo_title"`
-	SEODescription    string   `json:"seo_description"`
+	SEODescription    string               `json:"seo_description"`
-	CoverImageID      *uint32  `json:"cover_image_id"`
+	CoverImageID      *uint32              `json:"cover_image_id"`
-	CoverImageAlt     string   `json:"cover_image_alt"`
+	CoverImageAlt     string               `json:"cover_image_alt"`
-	SocialTitle       string   `json:"social_title"`
+	SocialTitle       string               `json:"social_title"`
-	SocialDescription string   `json:"social_description"`
+	SocialDescription string               `json:"social_description"`
-	SocialImageID     *uint32  `json:"social_image_id"`
+	SocialImageID     *uint32              `json:"social_image_id"`
-	CanonicalURL      string   `json:"canonical_url"`
+	CanonicalURL      string               `json:"canonical_url"`
-	Noindex           bool     `json:"noindex"`
+	Noindex           bool                 `json:"noindex"`
-	SEODismissed      []string `json:"seo_dismissed"`
+	SEODismissed      []string             `json:"seo_dismissed"`
+	Capabilities      []string             `json:"capabilities"`
+	Translations      []domain.Translation `json:"translations"`
+	Source            *domain.Source       `json:"source"`
+	*editorialContext
+}
+
+type editorialContext struct {
+	SourceUnavailable  bool     `json:"source_unavailable"`
+	MissingLangs       []string `json:"missing_langs"`
+	ExcludedFromPublic bool     `json:"excluded_from_public"`
+	PartialView        bool     `json:"partial_view"`
+}
+
+func editorialContextFor(viewer access.Caller, described useCases.ArticleContext) *editorialContext {
+	if viewer.UserID == 0 {
+		return nil
+	}
+	return &editorialContext{
+		SourceUnavailable:  described.SourceUnavailable,
+		MissingLangs:       described.MissingLangs,
+		ExcludedFromPublic: described.ExcludedFromPublic,
+		PartialView:        described.PartialView,
+	}
 }
 
 type listItemResponse struct {
@@ -117,10 +159,13 @@ func toBaseResponse(article domain.Article, format domain.BodyFormat, viewer acc
 		Authors:    authors,
 		CreatedAt:  article.CreatedAt,
 		UpdatedAt:  article.UpdatedAt,
+		Lang:       article.Lang,
+		StoryID:    article.StoryID,
+		Revision:   article.EditRevision,
 	}, nil
 }
 
-func toArticleResponse(article domain.Article, format domain.BodyFormat, viewer access.Caller) (articleResponse, error) {
+func toArticleResponse(article domain.Article, format domain.BodyFormat, viewer access.Caller, described useCases.ArticleContext) (articleResponse, error) {
 	base, err := toBaseResponse(article, format, viewer)
 	if err != nil {
 		return articleResponse{}, err
@@ -143,6 +188,10 @@ func toArticleResponse(article domain.Article, format domain.BodyFormat, viewer
 		CanonicalURL:        article.CanonicalURL,
 		Noindex:             article.Noindex,
 		SEODismissed:        dismissed,
+		Capabilities:        described.Capabilities,
+		Translations:        described.Translations,
+		Source:              described.Source,
+		editorialContext:    editorialContextFor(viewer, described),
 	}, nil
 }
 
@@ -154,8 +203,8 @@ func toListItemResponse(article domain.Article, summary domain.SEOSummary, forma
 	return listItemResponse{baseArticleResponse: base, Excerpt: article.Excerpt, Slug: article.Slug, SEOStatus: summary.Status, SEOSuggestions: summary.Suggestions}, nil
 }
 
-func encodeArticle(article domain.Article, format domain.BodyFormat, viewer access.Caller) ([]byte, error) {
+func encodeArticle(article domain.Article, format domain.BodyFormat, viewer access.Caller, described useCases.ArticleContext) ([]byte, error) {
-	response, err := toArticleResponse(article, format, viewer)
+	response, err := toArticleResponse(article, format, viewer, described)
 	if err != nil {
 		return nil, err
 	}
@@ -188,25 +237,13 @@ func (h *Handler) GetArticle(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	article, err := h.GetUseCase.GetArticle(id, format, access.CallerOf(r))
+	article, err := h.getUseCase.GetArticle(id, format, access.CallerOf(r))
 	if err != nil {
-		if errors.Is(err, domain.ErrArticleNotFound) {
+		writeArticleErrorResponse(w, err)
-			http.Error(w, apperr.ArticleNotFoundErrorMessage, http.StatusNotFound)
-			return
-		}
-		http.Error(w, "Internal server error", http.StatusInternalServerError)
 		return
 	}
 
-	articleJson, err := encodeArticle(article, format, access.CallerOf(r))
+	h.writeArticle(w, r, http.StatusOK, article, format, printToStdout)
-	if err != nil {
-		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
-		return
-	}
-
-	if _, err := w.Write(articleJson); err != nil {
-		fmt.Printf("Failed to write response: %v", err)
-	}
 }
 
 func (h *Handler) PostArticle(w http.ResponseWriter, r *http.Request) {
@@ -222,28 +259,98 @@ func (h *Handler) PostArticle(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := validator.Validate.Struct(localArticle); err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeValidationError(w, err)
 		return
 	}
 
-	createdArticle, err := h.CreateUseCase.CreateArticle(r.Context(), useCases.CreateArticleCommand{
+	if localArticle.StoryID != nil {
+		if localArticle.Site != nil {
+			http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+			return
+		}
+		h.postTranslation(w, r, format, localArticle)
+		return
+	}
+	if localArticle.SourceArticleID != nil || localArticle.Copy != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+
+	lang := ""
+	if localArticle.Lang != nil {
+		lang = *localArticle.Lang
+	}
+	createdArticle, err := h.createUseCase.CreateArticle(r.Context(), useCases.CreateArticleCommand{
 		Title:  localArticle.Title,
 		Body:   localArticle.Body,
 		Format: format,
+		Lang:   lang,
+		Site:   localArticle.Site,
 		Caller: access.CallerOf(r),
 	})
 	if err != nil {
-		if errors.Is(err, domain.ErrInvalidTitle) {
-			http.Error(w, apperr.ArticleTitleErrorMessage, http.StatusBadRequest)
-			return
-		}
 		if !writeKnownArticleError(w, err) {
 			http.Error(w, "Failed to create article", http.StatusInternalServerError)
 		}
 		return
 	}
 
-	writeArticleJsonResponse(w, r, http.StatusCreated, createdArticle, format)
+	h.writeArticle(w, r, http.StatusCreated, createdArticle, format, log.Printf)
+}
+
+func (h *Handler) postTranslation(w http.ResponseWriter, r *http.Request, format domain.BodyFormat, request PostArticle) {
+	if request.Lang == nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+	h.createTranslation(w, r, useCases.CreateTranslationCommand{
+		StoryID:         *request.StoryID,
+		Lang:            *request.Lang,
+		Title:           request.Title,
+		Copy:            request.Copy,
+		SourceArticleID: request.SourceArticleID,
+		Format:          format,
+		Caller:          access.CallerOf(r),
+	})
+}
+
+func (h *Handler) PostTranslation(w http.ResponseWriter, r *http.Request) {
+	id, err := parseArticleId(r)
+	if err != nil {
+		http.Error(w, apperr.IdUint32ErrorMessage, http.StatusBadRequest)
+		return
+	}
+	format, ok := parseBodyFormat(w, r)
+	if !ok {
+		return
+	}
+	var request PostTranslation
+	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+	if err := validator.Validate.Struct(request); err != nil {
+		writeValidationError(w, err)
+		return
+	}
+	h.createTranslation(w, r, useCases.CreateTranslationCommand{
+		ArticleID:       id,
+		Lang:            request.Lang,
+		Title:           request.Title,
+		Copy:            request.Copy,
+		SourceArticleID: request.SourceArticleID,
+		Format:          format,
+		Caller:          access.CallerOf(r),
+	})
+}
+
+func (h *Handler) createTranslation(w http.ResponseWriter, r *http.Request, command useCases.CreateTranslationCommand) {
+	created, err := h.translationUseCase.CreateTranslation(r.Context(), command)
+	if err != nil {
+		writeArticleErrorResponse(w, err)
+		return
+	}
+	h.writeArticle(w, r, http.StatusCreated, created, command.Format, log.Printf)
 }
 
 func writeArticleErrorResponse(w http.ResponseWriter, err error) {
@@ -253,46 +360,15 @@ func writeArticleErrorResponse(w http.ResponseWriter, err error) {
 }
 
 func writeKnownArticleError(w http.ResponseWriter, err error) bool {
-	if access.WriteIfMissingPermission(w, err) {
+	return access.WriteIfMissingPermission(w, err) || articleerr.Write(w, err)
-		return true
-	}
-	if errors.Is(err, domain.ErrArticleNotFound) {
-		http.Error(w, apperr.ArticleNotFoundErrorMessage, http.StatusNotFound)
-		return true
-	}
-	if errors.Is(err, site.ErrSiteNotFound) {
-		http.Error(w, apperr.SiteNotFoundErrorMessage, http.StatusNotFound)
-		return true
-	}
-	if errors.Is(err, author.ErrAuthorNotFound) {
-		http.Error(w, apperr.AuthorNotFoundErrorMessage, http.StatusNotFound)
-		return true
-	}
-	if errors.Is(err, domain.ErrSlugTaken) {
-		writeSlugTaken(w, err)
-		return true
-	}
-	if errors.Is(err, domain.ErrInvalidSlug) {
-		http.Error(w, apperr.InvalidSlugErrorMessage, http.StatusBadRequest)
-		return true
-	}
-	if errors.Is(err, domain.ErrInvalidCanonicalURL) {
-		http.Error(w, apperr.InvalidURLErrorMessage, http.StatusUnprocessableEntity)
-		return true
-	}
-	if errors.Is(err, image.ErrImageNotFound) {
-		http.Error(w, apperr.ArticleImageNotFoundErrorMessage, http.StatusBadRequest)
-		return true
-	}
-	return false
 }
 
-func writeSlugTaken(w http.ResponseWriter, err error) {
+const siteField = "Site"
-	var conflict *domain.SlugTakenError
+
-	if errors.As(err, &conflict) && conflict.Suggestion != "" {
+var bodyMismatchFailures = map[string]string{
-		w.Header().Set(apperr.SlugSuggestionHeader, conflict.Suggestion)
+	"Copy":       "required",
-	}
+	"IfRevision": "min",
-	http.Error(w, apperr.ArticleSlugTakenErrorMessage, http.StatusConflict)
+	"AuthorIDs":  "unique",
 }
 
 func writeValidationError(w http.ResponseWriter, err error) {
@@ -304,12 +380,32 @@ func writeValidationError(w http.ResponseWriter, err error) {
 				return
 			}
 		}
+		for _, failure := range failures {
+			if failure.Field() == siteField {
+				http.Error(w, apperr.InvalidSiteKeyErrorMessage, http.StatusBadRequest)
+				return
+			}
+		}
+		if len(failures) > 0 && bodyMismatchFailures[failures[0].Field()] == failures[0].Tag() {
+			http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+			return
+		}
 	}
 	http.Error(w, err.Error(), http.StatusBadRequest)
 }
 
-func writeArticleJsonResponse(w http.ResponseWriter, r *http.Request, status int, article domain.Article, format domain.BodyFormat) {
+func printToStdout(format string, args ...any) {
-	articleJson, err := encodeArticle(article, format, access.CallerOf(r))
+	fmt.Printf(format, args...)
+}
+
+func (h *Handler) writeArticle(w http.ResponseWriter, r *http.Request, status int, article domain.Article, format domain.BodyFormat, reportFailure func(string, ...any)) {
+	caller := access.CallerOf(r)
+	described, err := h.describeUseCase.Describe(article, caller)
+	if err != nil {
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+	articleJson, err := encodeArticle(article, format, caller, described)
 	if err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
@@ -319,7 +415,7 @@ func writeArticleJsonResponse(w http.ResponseWriter, r *http.Request, status int
 		w.WriteHeader(status)
 	}
 	if _, err := w.Write(articleJson); err != nil {
-		log.Printf("Failed to write response: %v", err)
+		reportFailure("Failed to write response: %v", err)
 	}
 }
 
@@ -335,13 +431,13 @@ func (h *Handler) setIsOnline(w http.ResponseWriter, r *http.Request, isOnline b
 		return
 	}
 
-	updatedArticle, err := h.UpdateUseCase.UpdateIsOnline(r.Context(), id, access.CallerOf(r), isOnline, format)
+	updatedArticle, err := h.updateUseCase.UpdateIsOnline(r.Context(), id, access.CallerOf(r), isOnline, format)
 	if err != nil {
 		writeArticleErrorResponse(w, err)
 		return
 	}
 
-	writeArticleJsonResponse(w, r, http.StatusOK, updatedArticle, format)
+	h.writeArticle(w, r, http.StatusOK, updatedArticle, format, log.Printf)
 }
 
 type optionalImageID struct {
@@ -368,9 +464,11 @@ func (o optionalImageID) toNullable() domain.Nullable[uint32] {
 }
 
 type UpdateArticleBody struct {
+	Title             *string         `json:"title"`
+	IfRevision        *uint32         `json:"if_revision" validate:"omitempty,min=1"`
 	Body              *string         `json:"body"`
 	SiteID            *uint32         `json:"site_id" validate:"omitempty,gte=1"`
-	AuthorIDs         *[]uint32       `json:"author_ids" validate:"omitempty,dive,gte=1"`
+	AuthorIDs         *[]uint32       `json:"author_ids" validate:"omitempty,unique,dive,gte=1"`
 	Slug              *string         `json:"slug" validate:"omitempty,articleslug"`
 	Excerpt           *string         `json:"excerpt" validate:"omitempty,max=300"`
 	SEOTitle          *string         `json:"seo_title" validate:"omitempty,max=120"`
@@ -382,24 +480,13 @@ type UpdateArticleBody struct {
 	SocialImageID     optionalImageID `json:"social_image_id"`
 	CanonicalURL      *string         `json:"canonical_url" validate:"omitempty,max=2048"`
 	Noindex           *bool           `json:"noindex"`
-	SEODismissed      *[]string       `json:"seo_dismissed" validate:"omitempty,dive,oneof=title_long title_empty desc_short desc_long cover_alt cover_none slug_long no_au no_h body_alt short"`
+	SEODismissed      *[]string       `json:"seo_dismissed" validate:"omitempty,dive,seodismissed"`
 }
 
-var nonNullableArticleFields = []string{"body", "site_id", "author_ids", "slug", "excerpt", "seo_title", "seo_description", "cover_image_alt", "social_title", "social_description", "canonical_url", "noindex", "seo_dismissed"}
+var nonNullableArticleFields = []string{"title", "body", "site_id", "author_ids", "slug", "excerpt", "seo_title", "seo_description", "cover_image_alt", "social_title", "social_description", "canonical_url", "noindex", "seo_dismissed"}
 
 var nullableArticleFields = []string{"cover_image_id", "social_image_id"}
 
-func hasDuplicates(ids []uint32) bool {
-	seen := make(map[uint32]bool, len(ids))
-	for _, id := range ids {
-		if seen[id] {
-			return true
-		}
-		seen[id] = true
-	}
-	return false
-}
-
 func countKnownFields(fields map[string]json.RawMessage, nonNullable []string) (int, bool) {
 	known := 0
 	for name, value := range fields {
@@ -426,16 +513,13 @@ func readUpdateArticleBody(r *http.Request) (UpdateArticleBody, bool) {
 		return UpdateArticleBody{}, false
 	}
 	known, ok := countKnownFields(fields, nonNullableArticleFields)
-	if !ok || known == 0 {
+	if !ok || known == 0 || string(fields["if_revision"]) == "null" {
 		return UpdateArticleBody{}, false
 	}
 	var request UpdateArticleBody
 	if err := json.Unmarshal(raw, &request); err != nil {
 		return UpdateArticleBody{}, false
 	}
-	if request.AuthorIDs != nil && hasDuplicates(*request.AuthorIDs) {
-		return UpdateArticleBody{}, false
-	}
 	return request, true
 }
 
@@ -462,7 +546,9 @@ func (h *Handler) UpdateArticleBody(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	updatedArticle, err := h.UpdateUseCase.Update(r.Context(), id, access.CallerOf(r), useCases.UpdateArticleCommand{
+	updatedArticle, err := h.updateUseCase.Update(r.Context(), id, access.CallerOf(r), useCases.UpdateArticleCommand{
+		Title:             request.Title,
+		IfRevision:        request.IfRevision,
 		Body:              request.Body,
 		SiteID:            request.SiteID,
 		AuthorIDs:         request.AuthorIDs,
@@ -485,7 +571,7 @@ func (h *Handler) UpdateArticleBody(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	writeArticleJsonResponse(w, r, http.StatusOK, updatedArticle, format)
+	h.writeArticle(w, r, http.StatusOK, updatedArticle, format, log.Printf)
 }
 
 func (h *Handler) PublishArticle(w http.ResponseWriter, r *http.Request) {
@@ -509,6 +595,30 @@ type listQuery struct {
 	Site   *string `validate:"omitempty,min=1"`
 	SEO    string  `validate:"omitempty,oneof=ready suggestions hidden"`
 	Sort   string  `validate:"oneof=title:asc title:desc status:asc status:desc created_at:asc created_at:desc updated_at:asc updated_at:desc"`
+	Group  *string `validate:"required_if=Tab missing,omitempty,eq=story"`
+	Tab    *string `validate:"omitempty,oneof=all missing"`
+	Lang   *string `validate:"omitempty,min=1"`
+	Author *uint32 `validate:"omitempty,gte=1"`
+}
+
+const groupByStory = "story"
+
+type storyItemResponse struct {
+	listItemResponse
+	StoryUpdatedAt     time.Time            `json:"story_updated_at"`
+	StoryAuthors       []author.Byline      `json:"story_authors"`
+	Coverage           []domain.Translation `json:"coverage"`
+	MissingLangs       []string             `json:"missing_langs"`
+	ExcludedFromPublic bool                 `json:"excluded_from_public"`
+	Capabilities       []string             `json:"capabilities"`
+}
+
+type storyListResponse struct {
+	Items  []storyItemResponse `json:"items"`
+	Total  int                 `json:"total"`
+	Page   int                 `json:"page"`
+	Size   int                 `json:"size"`
+	Counts domain.StoryCounts  `json:"counts"`
 }
 
 const defaultListSort = "updated_at:desc"
@@ -562,7 +672,38 @@ func readListQuery(values url.Values) (listQuery, error) {
 	if values.Has("seo") && seoStatus == "" {
 		return listQuery{}, errors.New("empty seo")
 	}
-	return listQuery{Page: page, Size: size, Q: values.Get("q"), Status: status, Sort: sortValue, Site: siteKey, SEO: seoStatus}, nil
+	query := listQuery{Page: page, Size: size, Q: values.Get("q"), Status: status, Sort: sortValue, Site: siteKey, SEO: seoStatus}
+	if err := readLocalizedQuery(values, &query); err != nil {
+		return listQuery{}, err
+	}
+	return query, nil
+}
+
+func readLocalizedQuery(values url.Values, query *listQuery) error {
+	if values.Has("group") {
+		group := values.Get("group")
+		query.Group = &group
+	}
+	if values.Has("tab") {
+		tab := values.Get("tab")
+		query.Tab = &tab
+	}
+	if values.Has("lang") {
+		tag, err := language.Normalize(values.Get("lang"))
+		if err != nil {
+			return err
+		}
+		query.Lang = &tag
+	}
+	if values.Has("author") {
+		id, err := strconv.ParseUint(values.Get("author"), 10, 32)
+		if err != nil {
+			return err
+		}
+		authorID := uint32(id)
+		query.Author = &authorID
+	}
+	return nil
 }
 
 func (h *Handler) ListArticles(w http.ResponseWriter, r *http.Request) {
@@ -572,14 +713,21 @@ func (h *Handler) ListArticles(w http.ResponseWriter, r *http.Request) {
 	}
 
 	query, err := readListQuery(r.URL.Query())
-	if err != nil || validator.Validate.Struct(query) != nil {
+	if err != nil || validator.Validate.Struct(query) != nil || query.Group != nil && access.CallerOf(r).UserID == 0 {
 		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
 		return
 	}
 
-	page, err := h.ListUseCase.ListArticlesPage(useCases.ListArticlesCommand{
+	if stringOrEmpty(query.Group) == groupByStory {
+		h.listStories(w, r, format, query)
+		return
+	}
+
+	page, err := h.listUseCase.ListArticlesPage(useCases.ListArticlesCommand{
 		Format:  format,
 		Caller:  access.CallerOf(r),
+		Lang:    stringOrEmpty(query.Lang),
+		Author:  query.Author,
 		Page:    query.Page,
 		Size:    query.Size,
 		Q:       query.Q,
@@ -603,17 +751,67 @@ func (h *Handler) ListArticles(w http.ResponseWriter, r *http.Request) {
 		responses = append(responses, response)
 	}
 
-	articlesJson, err := json.Marshal(listResponse{Items: responses, Total: page.Total, Page: page.Page, Size: page.Size, Counts: page.Counts})
+	writeListJSON(w, listResponse{Items: responses, Total: page.Total, Page: page.Page, Size: page.Size, Counts: page.Counts})
+}
+
+func writeListJSON(w http.ResponseWriter, payload any) {
+	body, err := json.Marshal(payload)
 	if err != nil {
 		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
 		return
 	}
-
+	if _, err := w.Write(body); err != nil {
-	if _, err := w.Write(articlesJson); err != nil {
 		log.Printf("Failed to write response: %v", err)
 	}
 }
 
+func (h *Handler) listStories(w http.ResponseWriter, r *http.Request, format domain.BodyFormat, query listQuery) {
+	caller := access.CallerOf(r)
+	page, err := h.listUseCase.ListStoriesPage(useCases.ListStoriesCommand{
+		Format:  format,
+		Caller:  caller,
+		Page:    query.Page,
+		Size:    query.Size,
+		Q:       query.Q,
+		Status:  query.Status,
+		Sort:    parseSort(query.Sort),
+		SiteKey: query.Site,
+		SEO:     query.SEO,
+		Lang:    stringOrEmpty(query.Lang),
+		Tab:     stringOrEmpty(query.Tab),
+		Author:  query.Author,
+	})
+	if err != nil {
+		http.Error(w, "Failed to retrieve articles", http.StatusInternalServerError)
+		return
+	}
+	responses := make([]storyItemResponse, 0, len(page.Rows))
+	for _, row := range page.Rows {
+		item, err := toListItemResponse(row.Article, row.SEO, format, caller)
+		if err != nil {
+			http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+			return
+		}
+		responses = append(responses, storyItemResponse{
+			listItemResponse:   item,
+			StoryUpdatedAt:     row.UpdatedAt,
+			StoryAuthors:       row.Authors,
+			Coverage:           row.Coverage,
+			MissingLangs:       row.MissingLangs,
+			ExcludedFromPublic: row.ExcludedFromPublic,
+			Capabilities:       row.Capabilities,
+		})
+	}
+	writeListJSON(w, storyListResponse{Items: responses, Total: page.Total, Page: page.Page, Size: page.Size, Counts: page.Counts})
+}
+
+func stringOrEmpty(value *string) string {
+	if value == nil {
+		return ""
+	}
+	return *value
+}
+
 func (h *Handler) DeleteArticle(w http.ResponseWriter, r *http.Request) {
 	id, err := parseArticleId(r)
 	if err != nil {
@@ -621,15 +819,10 @@ func (h *Handler) DeleteArticle(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.DeleteUseCase.DeleteArticle(r.Context(), id, access.CallerOf(r)); err != nil {
+	if err := h.deleteUseCase.DeleteArticle(r.Context(), id, access.CallerOf(r)); err != nil {
-		if errors.Is(err, domain.ErrArticleNotFound) {
+		if !writeKnownArticleError(w, err) {
-			http.Error(w, apperr.ArticleNotFoundErrorMessage, http.StatusNotFound)
+			http.Error(w, apperr.DeleteArticleFailedErrorMessage, http.StatusInternalServerError)
-			return
 		}
-		if access.WriteIfMissingPermission(w, err) {
-			return
-		}
-		http.Error(w, "Failed to delete article", http.StatusInternalServerError)
 		return
 	}
 

api/handlers/article/publicHandler.go

@@ -0,0 +1,138 @@
+package article
+
+import (
+	"RenewCMS/api/pkg/apperr"
+	validator "RenewCMS/api/pkg/validator"
+	domain "RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/language"
+	"RenewCMS/internal/domain/site"
+	"RenewCMS/internal/infrastructure/useCases"
+	"encoding/json"
+	"errors"
+	"log"
+	"net/http"
+	"strconv"
+
+	"github.com/go-chi/chi/v5"
+)
+
+type PublicHandler struct {
+	resolveUseCase *useCases.ResolvePublicArticleUseCase
+}
+
+func NewPublicHandler(resolve *useCases.ResolvePublicArticleUseCase) *PublicHandler {
+	return &PublicHandler{resolveUseCase: resolve}
+}
+
+type publicLookupResponse struct {
+	articleResponse
+	Alternates []domain.Alternate `json:"alternates"`
+}
+
+type publicStoryResponse struct {
+	articleResponse
+	Alternates    []domain.Alternate `json:"alternates"`
+	RequestedLang string             `json:"requested_lang"`
+	Fallback      bool               `json:"fallback"`
+}
+
+type publicStoryQuery struct {
+	Fallback *string `validate:"omitempty,eq=default"`
+}
+
+var publicErrors = []struct {
+	cause   error
+	message string
+	status  int
+}{
+	{domain.ErrArticleNotFound, apperr.ArticleNotFoundCode, http.StatusNotFound},
+	{domain.ErrLanguageNotAvailable, apperr.LanguageNotAvailableCode, http.StatusNotFound},
+	{site.ErrSiteNotFound, apperr.SiteNotFoundCode, http.StatusNotFound},
+	{language.ErrInvalidLanguage, apperr.InvalidLanguageCode, http.StatusBadRequest},
+}
+
+func writePublicError(w http.ResponseWriter, err error) {
+	for _, known := range publicErrors {
+		if errors.Is(err, known.cause) {
+			http.Error(w, known.message, known.status)
+			return
+		}
+	}
+	http.Error(w, "Internal server error", http.StatusInternalServerError)
+}
+
+func (h *PublicHandler) Lookup(w http.ResponseWriter, r *http.Request) {
+	format, ok := parseBodyFormat(w, r)
+	if !ok {
+		return
+	}
+	found, err := h.resolveUseCase.ByLangSlug(useCases.PublicLookupQuery{
+		SiteKey: chi.URLParam(r, "key"),
+		Lang:    chi.URLParam(r, "lang"),
+		Slug:    chi.URLParam(r, "slug"),
+		Format:  format,
+	})
+	if err != nil {
+		writePublicError(w, err)
+		return
+	}
+	h.write(w, found, format, func(response articleResponse) any {
+		return publicLookupResponse{articleResponse: response, Alternates: found.Alternates}
+	})
+}
+
+func (h *PublicHandler) Story(w http.ResponseWriter, r *http.Request) {
+	storyID, err := strconv.ParseUint(chi.URLParam(r, "story_id"), 10, 32)
+	if err != nil {
+		http.Error(w, apperr.IdUint32ErrorMessage, http.StatusBadRequest)
+		return
+	}
+	format, ok := parseBodyFormat(w, r)
+	if !ok {
+		return
+	}
+	values := r.URL.Query()
+	query := publicStoryQuery{}
+	if values.Has("fallback") {
+		fallback := values.Get("fallback")
+		query.Fallback = &fallback
+	}
+	if validator.Validate.Struct(query) != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+	command := useCases.PublicStoryQuery{
+		SiteKey:         chi.URLParam(r, "key"),
+		StoryID:         uint32(storyID),
+		FallbackDefault: query.Fallback != nil,
+		Format:          format,
+	}
+	if values.Has("lang") {
+		requested := values.Get("lang")
+		command.Lang = &requested
+	}
+	found, err := h.resolveUseCase.ByStory(command)
+	if err != nil {
+		writePublicError(w, err)
+		return
+	}
+	h.write(w, found, format, func(response articleResponse) any {
+		return publicStoryResponse{articleResponse: response, Alternates: found.Alternates, RequestedLang: found.RequestedLang, Fallback: found.Fallback}
+	})
+}
+
+func (h *PublicHandler) write(w http.ResponseWriter, found useCases.PublicArticle, format domain.BodyFormat, shape func(articleResponse) any) {
+	response, err := toArticleResponse(found.Article, format, found.Viewer, found.Context)
+	if err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+	body, err := json.Marshal(shape(response))
+	if err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+	if _, err := w.Write(body); err != nil {
+		log.Printf("Failed to write response: %v", err)
+	}
+}

api/handlers/article/seoHandler.go

@@ -34,7 +34,7 @@ type CheckArticleSEOBody struct {
 	SocialImageID     optionalImageID `json:"social_image_id"`
 	CanonicalURL      *string         `json:"canonical_url" validate:"omitempty,max=2048"`
 	Noindex           *bool           `json:"noindex"`
-	SEODismissed      *[]string       `json:"seo_dismissed" validate:"omitempty,dive,oneof=title_long title_empty desc_short desc_long cover_alt cover_none slug_long no_au no_h body_alt short"`
+	SEODismissed      *[]string       `json:"seo_dismissed" validate:"omitempty,dive,seodismissed"`
 }
 
 var checkNonNullableFields = []string{"body", "slug", "excerpt", "seo_title", "seo_description", "cover_image_alt", "social_title", "social_description", "canonical_url", "noindex", "seo_dismissed"}

api/handlers/language/languageHandler.go

@@ -0,0 +1,164 @@
+package language
+
+import (
+	"RenewCMS/api/pkg/apperr"
+	validator "RenewCMS/api/pkg/validator"
+	domainLanguage "RenewCMS/internal/domain/language"
+	"RenewCMS/internal/domain/localization"
+	"RenewCMS/internal/domain/site"
+	"RenewCMS/internal/infrastructure/useCases"
+	"encoding/json"
+	"errors"
+	"log"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+)
+
+type SiteLanguagesHandler struct {
+	GetUseCase    *useCases.GetSiteLanguagesUseCase
+	UpdateUseCase *useCases.UpdateSiteLanguagesUseCase
+}
+
+func NewSiteLanguagesHandler(get *useCases.GetSiteLanguagesUseCase, update *useCases.UpdateSiteLanguagesUseCase) *SiteLanguagesHandler {
+	return &SiteLanguagesHandler{GetUseCase: get, UpdateUseCase: update}
+}
+
+type PutLanguage struct {
+	Lang         string  `json:"lang"`
+	Enabled      *bool   `json:"enabled" validate:"required"`
+	SocialLocale *string `json:"social_locale"`
+}
+
+type PutSiteLanguages struct {
+	Revision  *string       `json:"revision" validate:"required"`
+	Default   *string       `json:"default" validate:"required"`
+	Languages []PutLanguage `json:"languages" validate:"required,dive"`
+}
+
+func (p PutSiteLanguages) command(key string) useCases.UpdateSiteLanguagesCommand {
+	entries := make([]useCases.SiteLanguageEntry, 0, len(p.Languages))
+	for _, entry := range p.Languages {
+		entries = append(entries, useCases.SiteLanguageEntry{Lang: entry.Lang, Enabled: *entry.Enabled, SocialLocale: entry.SocialLocale})
+	}
+	return useCases.UpdateSiteLanguagesCommand{Key: key, Revision: *p.Revision, Default: *p.Default, Languages: entries}
+}
+
+func (h *SiteLanguagesHandler) Get(w http.ResponseWriter, r *http.Request) {
+	view, err := h.GetUseCase.Get(chi.URLParam(r, "key"))
+	if err != nil {
+		writeLocalizationError(w, err)
+		return
+	}
+	writeJSON(w, view)
+}
+
+func (h *SiteLanguagesHandler) Update(w http.ResponseWriter, r *http.Request) {
+	var request PutSiteLanguages
+	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+	if err := validator.Validate.Struct(request); err != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+	view, err := h.UpdateUseCase.Update(r.Context(), request.command(chi.URLParam(r, "key")))
+	if err != nil {
+		writeLocalizationError(w, err)
+		return
+	}
+	writeJSON(w, view)
+}
+
+type SetupHandler struct {
+	GetUseCase   *useCases.GetLanguageSetupUseCase
+	ApplyUseCase *useCases.ApplyLanguageSetupUseCase
+}
+
+func NewSetupHandler(get *useCases.GetLanguageSetupUseCase, apply *useCases.ApplyLanguageSetupUseCase) *SetupHandler {
+	return &SetupHandler{GetUseCase: get, ApplyUseCase: apply}
+}
+
+type PostSetupSite struct {
+	Key  string `json:"key" validate:"required"`
+	Lang string `json:"lang"`
+}
+
+type PostSetup struct {
+	Sites []PostSetupSite `json:"sites" validate:"required,dive"`
+}
+
+func (h *SetupHandler) Get(w http.ResponseWriter, r *http.Request) {
+	view, err := h.GetUseCase.Get()
+	if err != nil {
+		writeLocalizationError(w, err)
+		return
+	}
+	writeJSON(w, view)
+}
+
+func (h *SetupHandler) Apply(w http.ResponseWriter, r *http.Request) {
+	var request PostSetup
+	if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+	if err := validator.Validate.Struct(request); err != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+	choices := make([]localization.SetupChoice, 0, len(request.Sites))
+	for _, entry := range request.Sites {
+		choices = append(choices, localization.SetupChoice{Key: entry.Key, Lang: entry.Lang})
+	}
+	result, err := h.ApplyUseCase.Apply(r.Context(), choices)
+	if err != nil {
+		writeLocalizationError(w, err)
+		return
+	}
+	writeJSON(w, result)
+}
+
+func writeJSON(w http.ResponseWriter, value any) {
+	body, err := json.Marshal(value)
+	if err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+	if _, err := w.Write(body); err != nil {
+		log.Printf("Failed to write response: %v", err)
+	}
+}
+
+type localizationFailure struct {
+	sentinel error
+	status   int
+	body     string
+}
+
+var localizationFailures = []localizationFailure{
+	{site.ErrSiteNotFound, http.StatusNotFound, apperr.SiteNotFoundErrorMessage},
+	{localization.ErrSetupRequired, http.StatusConflict, apperr.SetupRequiredErrorMessage},
+	{localization.ErrLanguagesChanged, http.StatusConflict, apperr.LanguagesChangedErrorMessage},
+	{localization.ErrLanguageInUse, http.StatusConflict, apperr.LanguageInUseErrorMessage},
+	{localization.ErrSetupInProgress, http.StatusConflict, apperr.SetupInProgressErrorMessage},
+	{localization.ErrDefaultNotEnabled, http.StatusUnprocessableEntity, apperr.DefaultNotEnabledErrorMessage},
+	{localization.ErrNoEnabledLanguage, http.StatusUnprocessableEntity, apperr.NoEnabledLanguageErrorMessage},
+	{localization.ErrDuplicateLanguage, http.StatusUnprocessableEntity, apperr.DuplicateLanguageErrorMessage},
+	{localization.ErrInvalidSocialLocale, http.StatusUnprocessableEntity, apperr.InvalidSocialLocaleErrorMessage},
+	{localization.ErrSetupIncomplete, http.StatusUnprocessableEntity, apperr.SetupIncompleteErrorMessage},
+	{localization.ErrDuplicateSite, http.StatusUnprocessableEntity, apperr.DuplicateSiteErrorMessage},
+	{domainLanguage.ErrInvalidLanguage, http.StatusUnprocessableEntity, apperr.InvalidLanguageErrorMessage},
+	{domainLanguage.ErrUnsupportedLanguage, http.StatusUnprocessableEntity, apperr.UnsupportedLanguageErrorMessage},
+}
+
+func writeLocalizationError(w http.ResponseWriter, err error) {
+	for _, failure := range localizationFailures {
+		if errors.Is(err, failure.sentinel) {
+			http.Error(w, failure.body, failure.status)
+			return
+		}
+	}
+	http.Error(w, "Internal server error", http.StatusInternalServerError)
+}

api/handlers/media/mediaHandler.go

@@ -95,6 +95,8 @@ type usageResponse struct {
 	Title     string   `json:"title,omitempty"`
 	Published *bool    `json:"published,omitempty"`
 	Fields    []string `json:"fields"`
+	StoryID   *uint32  `json:"story_id,omitempty"`
+	Lang      *string  `json:"lang,omitempty"`
 
 	ContentTypeKey  string               `json:"content_type_key,omitempty"`
 	ContentTypeName string               `json:"content_type_name,omitempty"`
@@ -108,7 +110,7 @@ type usageFirstFieldBody struct {
 }
 
 func toUsageResponse(usage useCases.MediaUsage) usageResponse {
-	body := usageResponse{Type: usage.Type, ID: usage.ID, Title: usage.Title, Published: usage.Published, Fields: usage.Fields, ContentTypeKey: usage.ContentTypeKey, ContentTypeName: usage.ContentTypeName}
+	body := usageResponse{Type: usage.Type, ID: usage.ID, Title: usage.Title, Published: usage.Published, Fields: usage.Fields, StoryID: usage.StoryID, Lang: usage.Lang, ContentTypeKey: usage.ContentTypeKey, ContentTypeName: usage.ContentTypeName}
 	if usage.FirstField != nil {
 		body.FirstField = &usageFirstFieldBody{Key: usage.FirstField.Key, Type: string(usage.FirstField.Type), Value: usage.FirstField.Value}
 	}

api/handlers/site/siteHandler.go

@@ -71,6 +71,7 @@ type PatchSite struct {
 	SiteName             *string          `json:"site_name" validate:"omitempty,max=100"`
 	TitleTemplate        *string          `json:"title_template" validate:"omitempty,max=200"`
 	DefaultDescription   *string          `json:"default_description" validate:"omitempty,max=320"`
+	PublicURLPattern     optional[string] `json:"public_url_pattern"`
 }
 
 func (p PatchSite) toPatch() domain.Patch {
@@ -85,6 +86,7 @@ func (p PatchSite) toPatch() domain.Patch {
 		SiteName:             p.SiteName,
 		TitleTemplate:        p.TitleTemplate,
 		DefaultDescription:   p.DefaultDescription,
+		PublicURLPattern:     domain.Nullable[string]{Set: p.PublicURLPattern.Set, Value: p.PublicURLPattern.Value},
 	}
 }
 
@@ -125,6 +127,18 @@ func writeSiteError(w http.ResponseWriter, err error) {
 		http.Error(w, apperr.InvalidTitleTemplateErrorMessage, http.StatusBadRequest)
 	case errors.Is(err, domain.ErrInvalidLocale):
 		http.Error(w, apperr.InvalidLocaleErrorMessage, http.StatusBadRequest)
+	case errors.Is(err, domain.ErrInvalidPublicURLPattern):
+		http.Error(w, apperr.InvalidPublicURLPatternErrorMessage, http.StatusUnprocessableEntity)
+	case errors.Is(err, domain.ErrPublicURLScheme):
+		http.Error(w, apperr.PublicURLSchemeErrorMessage, http.StatusUnprocessableEntity)
+	case errors.Is(err, domain.ErrPublicURLHost):
+		http.Error(w, apperr.PublicURLHostErrorMessage, http.StatusUnprocessableEntity)
+	case errors.Is(err, domain.ErrPublicURLPlaceholder):
+		http.Error(w, apperr.PublicURLPlaceholderErrorMessage, http.StatusUnprocessableEntity)
+	case errors.Is(err, domain.ErrPublicURLNotEncoded):
+		http.Error(w, apperr.PublicURLNotEncodedErrorMessage, http.StatusUnprocessableEntity)
+	case errors.Is(err, domain.ErrPublicURLMissingSlug):
+		http.Error(w, apperr.PublicURLMissingSlugErrorMessage, http.StatusUnprocessableEntity)
 	case errors.Is(err, image.ErrImageNotFound):
 		http.Error(w, apperr.SiteImageNotFoundErrorMessage, http.StatusBadRequest)
 	case errors.Is(err, domain.ErrUseSetDefault):

api/handlers/site/sitemapHandler.go

@@ -37,6 +37,7 @@ type sitemapItem struct {
 	URL        string `json:"url"`
 	ModifiedAt string `json:"modified_at"`
 	Noindex    bool   `json:"noindex"`
+	Lang       string `json:"lang"`
 }
 
 func sitemapIntParam(values url.Values, name string, fallback int) (int, error) {
@@ -73,7 +74,7 @@ func (h *SitemapHandler) Sitemap(w http.ResponseWriter, r *http.Request) {
 
 	items := make([]sitemapItem, 0, len(page.Entries))
 	for _, entry := range page.Entries {
-		items = append(items, sitemapItem{URL: entry.URL, ModifiedAt: entry.ModifiedAt.UTC().Format(time.RFC3339), Noindex: entry.Noindex})
+		items = append(items, sitemapItem{URL: entry.URL, ModifiedAt: entry.ModifiedAt.UTC().Format(time.RFC3339), Noindex: entry.Noindex, Lang: entry.Lang})
 	}
 	body, err := json.Marshal(items)
 	if err != nil {

api/handlers/story/storyHandler.go

@@ -0,0 +1,88 @@
+package story
+
+import (
+	"RenewCMS/api/pkg/access"
+	"RenewCMS/api/pkg/apperr"
+	"RenewCMS/api/pkg/articleerr"
+	"RenewCMS/internal/infrastructure/useCases"
+	"encoding/json"
+	"log"
+	"net/http"
+	"strconv"
+
+	"github.com/go-chi/chi/v5"
+)
+
+type Handler struct {
+	MoveUseCase   *useCases.MoveStoryUseCase
+	DeleteUseCase *useCases.DeleteStoryUseCase
+}
+
+func NewHandler(move *useCases.MoveStoryUseCase, delete *useCases.DeleteStoryUseCase) *Handler {
+	return &Handler{MoveUseCase: move, DeleteUseCase: delete}
+}
+
+func parseStoryID(r *http.Request) (uint32, error) {
+	id, err := strconv.ParseUint(chi.URLParam(r, "story_id"), 10, 32)
+	return uint32(id), err
+}
+
+type moveRequest struct {
+	Site *string `json:"site"`
+}
+
+type moveResponse struct {
+	StoryID    uint32   `json:"story_id"`
+	Site       string   `json:"site"`
+	SiteID     uint32   `json:"site_id"`
+	ArticleIDs []uint32 `json:"article_ids"`
+}
+
+func (h *Handler) Move(w http.ResponseWriter, r *http.Request) {
+	id, err := parseStoryID(r)
+	if err != nil {
+		http.Error(w, apperr.IdUint32ErrorMessage, http.StatusBadRequest)
+		return
+	}
+	var request moveRequest
+	if err := json.NewDecoder(r.Body).Decode(&request); err != nil || request.Site == nil || *request.Site == "" {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return
+	}
+	result, err := h.MoveUseCase.MoveStory(r.Context(), useCases.MoveStoryCommand{StoryID: id, SiteKey: *request.Site, Caller: access.CallerOf(r)})
+	if err != nil {
+		writeError(w, err, apperr.MoveStoryFailedErrorMessage)
+		return
+	}
+	body, err := json.Marshal(moveResponse{StoryID: result.StoryID, Site: result.Site.Key, SiteID: result.Site.ID, ArticleIDs: result.ArticleIDs})
+	if err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+		return
+	}
+	if _, err := w.Write(body); err != nil {
+		log.Printf("Failed to write response: %v", err)
+	}
+}
+
+func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := parseStoryID(r)
+	if err != nil {
+		http.Error(w, apperr.IdUint32ErrorMessage, http.StatusBadRequest)
+		return
+	}
+	if err := h.DeleteUseCase.DeleteStory(r.Context(), useCases.DeleteStoryCommand{StoryID: id, Caller: access.CallerOf(r)}); err != nil {
+		writeError(w, err, apperr.DeleteArticleFailedErrorMessage)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func writeError(w http.ResponseWriter, err error, failure string) {
+	if access.WriteIfMissingPermission(w, err) {
+		return
+	}
+	if articleerr.Write(w, err) {
+		return
+	}
+	http.Error(w, failure, http.StatusInternalServerError)
+}

api/pkg/apperr/messages.go

@@ -63,12 +63,32 @@ const CachePurgeTargetErrorMessage = "A variant name or an image id is required
 const VariantUnknownMessage = "Unknown variant"
 const VariantUnsupportedParameterMessage = "Unsupported parameter"
 const SiteNotFoundErrorMessage = "site_not_found"
+const InvalidSiteKeyErrorMessage = "invalid_site_key"
 const SiteKeyTakenErrorMessage = "site_key_taken"
 const SiteHasArticlesErrorMessage = "site_has_articles"
 const DefaultSiteErrorMessage = "default_site"
 const SiteKeyImmutableErrorMessage = "key_immutable"
 const InvalidSiteURLErrorMessage = "invalid_site_url"
 const InvalidLocaleErrorMessage = "invalid_locale"
+const InvalidPublicURLPatternErrorMessage = "invalid_pattern"
+const PublicURLSchemeErrorMessage = "invalid_scheme"
+const PublicURLHostErrorMessage = "invalid_host"
+const PublicURLPlaceholderErrorMessage = "unknown_placeholder"
+const PublicURLNotEncodedErrorMessage = "not_encoded"
+const PublicURLMissingSlugErrorMessage = "missing_slug"
+
+const SetupRequiredErrorMessage = "setup_required"
+const LanguagesChangedErrorMessage = "languages_changed"
+const LanguageInUseErrorMessage = "language_in_use"
+const DefaultNotEnabledErrorMessage = "default_not_enabled"
+const NoEnabledLanguageErrorMessage = "no_enabled_language"
+const InvalidLanguageErrorMessage = "invalid_language"
+const UnsupportedLanguageErrorMessage = "unsupported_language"
+const DuplicateLanguageErrorMessage = "duplicate_language"
+const InvalidSocialLocaleErrorMessage = "invalid_social_locale"
+const SetupInProgressErrorMessage = "setup_in_progress"
+const SetupIncompleteErrorMessage = "setup_incomplete"
+const DuplicateSiteErrorMessage = "duplicate_site"
 const SiteImageNotFoundErrorMessage = "image_not_found"
 const UseSetDefaultErrorMessage = "use_set_default"
 const InvalidReassignErrorMessage = "invalid_reassign"
@@ -136,3 +156,26 @@ const EmailUnavailableErrorCode = "email_unavailable"
 const LastAdminErrorCode = "last_admin"
 const AccountNotDeletableErrorCode = "account_not_deletable"
 const LastRoleHeader = "X-Last-Role"
+
+const RevisionConflictErrorMessage = "revision_conflict"
+const CurrentRevisionHeader = "X-Current-Revision"
+const LanguageUnavailableErrorMessage = "language_unavailable"
+const LanguageExistsErrorMessage = "language_exists"
+const ExistingArticleHeader = "X-Existing-Article-Id"
+const LanguageNotEnabledErrorMessage = "language_not_enabled"
+const MissingLanguagesHeader = "X-Missing-Languages"
+const LanguageDisabledErrorMessage = "language_disabled"
+const SourceUnavailableErrorMessage = "source_unavailable"
+const SourceOtherStoryErrorMessage = "source_other_story"
+const SlugConflictErrorMessage = "slug_conflict"
+const ConflictingArticlesHeader = "X-Conflicting-Articles"
+const StoryMoveRequiredErrorMessage = "story_move_required"
+const StoryBusyErrorMessage = "story_busy"
+const TargetSiteDeletedErrorMessage = "target_site_deleted"
+const MoveStoryFailedErrorMessage = "Failed to move story"
+const DeleteArticleFailedErrorMessage = "Failed to delete article"
+
+const ArticleNotFoundCode = "article_not_found"
+const LanguageNotAvailableCode = "language_not_available"
+const SiteNotFoundCode = "site_not_found"
+const InvalidLanguageCode = "invalid_language"

api/pkg/articleerr/articleErr.go

@@ -0,0 +1,100 @@
+package articleerr
+
+import (
+	"RenewCMS/api/pkg/apperr"
+	domain "RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/author"
+	"RenewCMS/internal/domain/image"
+	"RenewCMS/internal/domain/language"
+	"RenewCMS/internal/domain/localization"
+	"RenewCMS/internal/domain/site"
+	"RenewCMS/internal/domain/transaction"
+	"errors"
+	"net/http"
+	"slices"
+	"strconv"
+	"strings"
+)
+
+func Write(w http.ResponseWriter, err error) bool {
+	var conflict *domain.RevisionConflictError
+	var existing *domain.LanguageExistsError
+	var notEnabled *domain.LanguageNotEnabledError
+	var addresses *domain.SlugConflictError
+	var taken *domain.SlugTakenError
+	switch {
+	case errors.As(err, &conflict):
+		w.Header().Set(apperr.CurrentRevisionHeader, strconv.FormatUint(uint64(conflict.Current), 10))
+		http.Error(w, apperr.RevisionConflictErrorMessage, http.StatusConflict)
+	case errors.As(err, &existing):
+		w.Header().Set(apperr.ExistingArticleHeader, strconv.FormatUint(uint64(existing.ArticleID), 10))
+		http.Error(w, apperr.LanguageExistsErrorMessage, http.StatusConflict)
+	case errors.As(err, &notEnabled):
+		if len(notEnabled.Missing) > 0 {
+			w.Header().Set(apperr.MissingLanguagesHeader, strings.Join(notEnabled.Missing, ","))
+		}
+		http.Error(w, apperr.LanguageNotEnabledErrorMessage, http.StatusUnprocessableEntity)
+	case errors.As(err, &addresses):
+		if len(addresses.ArticleIDs) > 0 {
+			w.Header().Set(apperr.ConflictingArticlesHeader, joinIDs(addresses.ArticleIDs))
+		}
+		http.Error(w, apperr.SlugConflictErrorMessage, http.StatusConflict)
+	case errors.Is(err, domain.ErrSlugTaken):
+		if errors.As(err, &taken) && taken.Suggestion != "" {
+			w.Header().Set(apperr.SlugSuggestionHeader, taken.Suggestion)
+		}
+		http.Error(w, apperr.ArticleSlugTakenErrorMessage, http.StatusConflict)
+	default:
+		return writeSentinel(w, err)
+	}
+	return true
+}
+
+func joinIDs(ids []uint32) string {
+	parts := make([]string, 0, len(ids))
+	for _, id := range ids {
+		parts = append(parts, strconv.FormatUint(uint64(id), 10))
+	}
+	return strings.Join(parts, ",")
+}
+
+type sentinelResponse struct {
+	cause   error
+	message string
+	status  int
+}
+
+var articleSentinels = []sentinelResponse{
+	{domain.ErrInvalidTitle, apperr.ArticleTitleErrorMessage, http.StatusBadRequest},
+	{domain.ErrArticleNotFound, apperr.ArticleNotFoundErrorMessage, http.StatusNotFound},
+	{site.ErrSiteNotFound, apperr.SiteNotFoundErrorMessage, http.StatusNotFound},
+	{author.ErrAuthorNotFound, apperr.AuthorNotFoundErrorMessage, http.StatusNotFound},
+	{domain.ErrInvalidSlug, apperr.InvalidSlugErrorMessage, http.StatusBadRequest},
+	{domain.ErrInvalidCanonicalURL, apperr.InvalidURLErrorMessage, http.StatusUnprocessableEntity},
+	{image.ErrImageNotFound, apperr.ArticleImageNotFoundErrorMessage, http.StatusBadRequest},
+}
+
+var localizationSentinels = []sentinelResponse{
+	{domain.ErrLanguageUnavailable, apperr.LanguageUnavailableErrorMessage, http.StatusConflict},
+	{domain.ErrLanguageTaken, apperr.LanguageUnavailableErrorMessage, http.StatusConflict},
+	{domain.ErrLanguageDisabled, apperr.LanguageDisabledErrorMessage, http.StatusUnprocessableEntity},
+	{domain.ErrSourceUnavailable, apperr.SourceUnavailableErrorMessage, http.StatusNotFound},
+	{domain.ErrSourceOtherStory, apperr.SourceOtherStoryErrorMessage, http.StatusUnprocessableEntity},
+	{domain.ErrInvalidTranslation, apperr.BodyErrorMessage, http.StatusBadRequest},
+	{domain.ErrStoryMoveRequired, apperr.StoryMoveRequiredErrorMessage, http.StatusConflict},
+	{localization.ErrSetupRequired, apperr.SetupRequiredErrorMessage, http.StatusConflict},
+	{language.ErrInvalidLanguage, apperr.InvalidLanguageErrorMessage, http.StatusUnprocessableEntity},
+	{language.ErrUnsupportedLanguage, apperr.UnsupportedLanguageErrorMessage, http.StatusUnprocessableEntity},
+	{transaction.ErrLockContention, apperr.StoryBusyErrorMessage, http.StatusConflict},
+	{domain.ErrTargetSiteDeleted, apperr.TargetSiteDeletedErrorMessage, http.StatusConflict},
+}
+
+func writeSentinel(w http.ResponseWriter, err error) bool {
+	for _, candidate := range slices.Concat(articleSentinels, localizationSentinels) {
+		if errors.Is(err, candidate.cause) {
+			http.Error(w, candidate.message, candidate.status)
+			return true
+		}
+	}
+	return false
+}

api/pkg/validator/validator.go

@@ -7,6 +7,7 @@ import (
 	"RenewCMS/internal/domain/site"
 	"reflect"
 	"regexp"
+	"slices"
 
 	"github.com/go-playground/validator/v10"
 )
@@ -19,6 +20,7 @@ const AuthorNameTag = "authorname"
 const AuthorSlugTag = "authorslug"
 const SocialTypeTag = "socialtype"
 const ArticleSlugTag = "articleslug"
+const SEODismissedTag = "seodismissed"
 
 var inviteEmailPattern = regexp.MustCompile(`^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$`)
 
@@ -34,6 +36,7 @@ func InitValidator() {
 	_ = Validate.RegisterValidation(AuthorSlugTag, isAuthorSlug, true)
 	_ = Validate.RegisterValidation(SocialTypeTag, isSocialType, true)
 	_ = Validate.RegisterValidation(ArticleSlugTag, isArticleSlug, true)
+	_ = Validate.RegisterValidation(SEODismissedTag, isSEODismissed)
 }
 
 func isArticleSlug(field validator.FieldLevel) bool {
@@ -44,6 +47,10 @@ func isArticleSlug(field validator.FieldLevel) bool {
 	return value == "" || article.IsValidSlug(value)
 }
 
+func isSEODismissed(field validator.FieldLevel) bool {
+	return slices.Contains(article.DismissCodes(), field.Field().String())
+}
+
 func isAbsent(field validator.FieldLevel) bool {
 	return field.Field().Kind() == reflect.Ptr && field.Field().IsNil()
 }

api/router.go

@@ -11,6 +11,7 @@ import (
 	"RenewCMS/api/handlers/entry"
 	"RenewCMS/api/handlers/frontend"
 	"RenewCMS/api/handlers/imagevariant"
+	languagehandler "RenewCMS/api/handlers/language"
 	"RenewCMS/api/handlers/llms"
 	"RenewCMS/api/handlers/media"
 	"RenewCMS/api/handlers/ownership"
@@ -19,6 +20,7 @@ import (
 	"RenewCMS/api/handlers/settings"
 	"RenewCMS/api/handlers/site"
 	"RenewCMS/api/handlers/staticimages"
+	"RenewCMS/api/handlers/story"
 	"RenewCMS/api/handlers/update"
 	"RenewCMS/api/handlers/user"
 	"RenewCMS/api/middleware"
@@ -53,6 +55,9 @@ const (
 	apiKeyMaxRequests = 120
 	apiKeyWindow      = time.Minute
 
+	publicReadMaxRequests = apiKeyMaxRequests
+	publicReadWindow      = apiKeyWindow
+
 	emailChangeMaxRequests = 5
 	emailChangeWindow      = 15 * time.Minute
 
@@ -69,6 +74,17 @@ func (c *UseCases) apiKeyAuth() func(http.Handler) http.Handler {
 	return c.apiKeyAuthMiddleware
 }
 
+func (c *UseCases) publicReadLimit(trustedProxies []string) func(http.Handler) http.Handler {
+	c.publicReadLimitOnce.Do(func() {
+		realIP := middleware.TrustedProxyRealIP(trustedProxies)
+		limiter := middleware.NewRateLimiter(publicReadMaxRequests, publicReadWindow)
+		c.publicReadLimitMiddleware = func(next http.Handler) http.Handler {
+			return realIP(limiter(next))
+		}
+	})
+	return c.publicReadLimitMiddleware
+}
+
 func (c *UseCases) require(key string) func(http.Handler) http.Handler {
 	return middleware.RequirePermission(c.GetUserUseCase, c.CheckPermissionUseCase, key)
 }
@@ -94,7 +110,7 @@ func NewArticleRouter(container *UseCases, trustedProxies []string) http.Handler
 	r.Use(container.apiKeyAuth())
 	r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies))
 
-	articleHandler := article.NewHandler(container.CreateArticleUseCase, container.GetArticleUseCase, container.ListArticlesUseCase, container.DeleteArticleUseCase, container.UpdateArticleUseCase)
+	articleHandler := article.NewHandler(container.CreateArticleUseCase, container.GetArticleUseCase, container.ListArticlesUseCase, container.DeleteArticleUseCase, container.UpdateArticleUseCase, container.CreateTranslationUseCase, container.DescribeArticleUseCase)
 
 	seoHandler := article.NewSEOHandler(container.ResolveArticleSEOUseCase, container.CheckArticleSEOUseCase)
 
@@ -109,6 +125,7 @@ func NewArticleRouter(container *UseCases, trustedProxies []string) http.Handler
 		r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
 		r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
 		r.With(container.requireArticle(role.KeyContentCreate)).Post("/", articleHandler.PostArticle)
+		r.With(container.requireArticle(role.KeyContentCreate)).Post("/{id}/translations", articleHandler.PostTranslation)
 		r.With(container.requireArticle(role.KeyContentDelete)).Delete("/{id}", articleHandler.DeleteArticle)
 		r.With(container.requireArticle(role.KeyContentUpdate)).Patch("/{id}", articleHandler.UpdateArticleBody)
 		r.With(container.requireArticle(role.KeyContentPublish)).Patch("/{id}/publish", articleHandler.PublishArticle)
@@ -118,6 +135,34 @@ func NewArticleRouter(container *UseCases, trustedProxies []string) http.Handler
 	return r
 }
 
+func NewPublicRouter(container *UseCases, trustedProxies []string) http.Handler {
+	r := chi.NewRouter()
+	r.Use(container.publicReadLimit(trustedProxies))
+
+	publicHandler := article.NewPublicHandler(container.ResolvePublicArticleUseCase)
+
+	r.Get("/site/{key}/lang/{lang}/article/{slug}", publicHandler.Lookup)
+	r.Get("/site/{key}/story/{story_id}", publicHandler.Story)
+	return r
+}
+
+func NewStoryRouter(container *UseCases, trustedProxies []string) http.Handler {
+	r := chi.NewRouter()
+	r.Use(container.apiKeyAuth())
+	r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies))
+
+	storyHandler := story.NewHandler(container.MoveStoryUseCase, container.DeleteStoryUseCase)
+
+	r.Group(func(r chi.Router) {
+		r.Use(authtoken.Authenticator)
+		r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
+		r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
+		r.With(container.requireArticle(role.KeyContentUpdate)).Post("/{story_id}/move", storyHandler.Move)
+		r.With(container.requireArticle(role.KeyContentDelete)).Delete("/{story_id}", storyHandler.Delete)
+	})
+	return r
+}
+
 func NewAuthRouter(container *UseCases, isProduction bool, rateLimit config.AuthRateLimitSettings, trustedProxies []string) http.Handler {
 	r := chi.NewRouter()
 	r.Use(authtoken.Verifier(container.Token))
@@ -295,9 +340,11 @@ func NewSiteRouter(container *UseCases, trustedProxies []string) http.Handler {
 
 	sitemapHandler := site.NewSitemapHandler(container.ListSitemapUseCase)
 
+	siteLanguagesHandler := languagehandler.NewSiteLanguagesHandler(container.GetSiteLanguagesUseCase, container.UpdateSiteLanguagesUseCase)
+
 	ownershipHandler := ownership.NewHandler(container.TransferOwnershipUseCase)
 
-	r.Get("/{key}/sitemap", sitemapHandler.Sitemap)
+	r.With(container.publicReadLimit(trustedProxies)).Get("/{key}/sitemap", sitemapHandler.Sitemap)
 	r.Group(func(r chi.Router) {
 		r.Use(authtoken.Verifier(container.Token))
 		r.Use(container.apiKeyAuth())
@@ -305,6 +352,7 @@ func NewSiteRouter(container *UseCases, trustedProxies []string) http.Handler {
 		r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
 		r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
 		r.Get("/", siteHandler.List)
+		r.Get("/{key}/languages", siteLanguagesHandler.Get)
 	})
 	r.Group(func(r chi.Router) {
 		r.Use(middleware.RequireSession)
@@ -317,12 +365,33 @@ func NewSiteRouter(container *UseCases, trustedProxies []string) http.Handler {
 		r.With(container.require(role.KeySettingsManageSites)).Post("/", siteHandler.Create)
 		r.With(container.require(role.KeySettingsManageSites)).Patch("/{id}", siteHandler.Update)
 		r.With(container.require(role.KeySettingsManageSites)).Patch("/{id}/default", siteHandler.SetDefault)
+		r.With(container.require(role.KeySettingsManageSites)).Put("/{key}/languages", siteLanguagesHandler.Update)
 		r.With(container.require(role.KeySettingsDeleteSite)).Delete("/{id}", siteHandler.Delete)
 		r.With(container.require(role.KeySystemTransferOwnership)).Post("/transfer-ownership", ownershipHandler.Transfer)
 	})
 	return r
 }
 
+func NewLanguageRouter(container *UseCases, trustedProxies []string) http.Handler {
+	r := chi.NewRouter()
+
+	setupHandler := languagehandler.NewSetupHandler(container.GetLanguageSetupUseCase, container.ApplyLanguageSetupUseCase)
+
+	r.Group(func(r chi.Router) {
+		r.Use(middleware.RequireSession)
+		r.Use(authtoken.Verifier(container.Token))
+		r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies))
+		r.Use(middleware.RequireSignedIn)
+		r.Use(authtoken.Authenticator)
+		r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
+		r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
+		r.Use(container.require(role.KeySettingsManageSites))
+		r.Get("/setup", setupHandler.Get)
+		r.Post("/setup", setupHandler.Apply)
+	})
+	return r
+}
+
 func NewRoleRouter(container *UseCases, trustedProxies []string) http.Handler {
 	r := chi.NewRouter()
 
@@ -582,10 +651,13 @@ func InitBackendRoutes(container *UseCases, settings config.Settings) *chi.Mux {
 	r.Group(func(r chi.Router) {
 		r.Use(authtoken.Verifier(container.Token))
 		r.Mount("/article", NewArticleRouter(container, settings.TrustedProxies))
+		r.Mount("/story", NewStoryRouter(container, settings.TrustedProxies))
 	})
+	r.Mount("/public", NewPublicRouter(container, settings.TrustedProxies))
 	r.Mount("/user", NewUserRouter(container, settings.IsProduction(), settings.AuthRateLimit, settings.TrustedProxies))
 	r.Mount("/settings", NewSettingsRouter(container, settings.TrustedProxies))
 	r.Mount("/site", NewSiteRouter(container, settings.TrustedProxies))
+	r.Mount("/language", NewLanguageRouter(container, settings.TrustedProxies))
 	r.Mount("/role", NewRoleRouter(container, settings.TrustedProxies))
 	r.Mount("/author", NewAuthorRouter(container, settings.TrustedProxies))
 	r.Mount("/content-type", NewContentTypeRouter(container, settings.TrustedProxies))

docs/api.md

@@ -3,15 +3,16 @@
 The full, searchable reference is the Integration page of the running app (`/integration`). It
 renders `web/src/data/apiCatalogue.ts`, which is the single source for this page. This file is for
 readers without the UI. Reading articles (pagination, `format`, body schemas) has its own page,
-[api/articles.md](api/articles.md), and API keys are covered in [api/api-keys.md](api/api-keys.md).
+[api/articles.md](api/articles.md), versions, translations, the story move and the story-grouped editorial list (`GET /v1/article/?group=story`) have [api/article-localization.md](api/article-localization.md), site languages and the one-time language setup are in [api/site-languages.md](api/site-languages.md), and API keys are covered in [api/api-keys.md](api/api-keys.md).
 
 ## Base URL
 The origin that serves the app, for example `https://cms.example`. Every path starts with `/v1`,
 for example `https://cms.example/v1/article/`.
 
 ## Authentication
-- Public routes need nothing: `GET /v1/article/`, `GET /v1/article/{id}`, `GET /v1/article/{id}/seo`
+- Public routes need nothing: `GET /v1/article/`, `GET /v1/article/{id}`, `GET /v1/article/{id}/seo`,
-  and `GET /v1/site/{key}/sitemap`. They return online articles, plus the drafts the caller's role may read
+  `GET /v1/site/{key}/sitemap`, `GET /v1/public/site/{key}/lang/{lang}/article/{slug}` and
+  `GET /v1/public/site/{key}/story/{story_id}` (the two language routes ignore any credential and never return a draft, see [api/article-localization.md](api/article-localization.md#public-language-routes)). They return online articles, plus the drafts the caller's role may read
   (see [Content permissions](#content-permissions)); any other draft answers 404 `Article not found`.
 - Everything else needs a signed-in browser session (the `jwt` cookie) or an API key:
   `Authorization: Bearer rcms_...`. Create keys at `/integration/api-keys`. A key acts as its
@@ -28,10 +29,10 @@ for example `https://cms.example/v1/article/`.
   `Authorization` header answers 403 "Cross-origin requests are not allowed." This blocks
   cross-site request forgery with the cookie; scripts on other origins must send their key.
 
-## Routes a key can call (30)
+## Routes a key can call (32)
 | Group | Routes |
 | --- | --- |
-| Articles | GET /v1/article/, GET /v1/article/{id}, GET /v1/article/{id}/seo, POST /v1/article/{id}/seo/check, POST /v1/article/, PATCH /v1/article/{id}, PATCH /v1/article/{id}/publish, PATCH /v1/article/{id}/unpublish, DELETE /v1/article/{id} |
+| Articles | GET /v1/article/, GET /v1/article/{id}, GET /v1/article/{id}/seo, POST /v1/article/{id}/seo/check, POST /v1/article/, PATCH /v1/article/{id}, PATCH /v1/article/{id}/publish, PATCH /v1/article/{id}/unpublish, DELETE /v1/article/{id}, POST /v1/article/{id}/translations, POST /v1/story/{story_id}/move |
 | Media | GET /v1/media/, GET /v1/media/{id}, POST /v1/media/, PATCH /v1/media/{id}, DELETE /v1/media/{id}, POST /v1/media/merge, GET /v1/media/{id}/usage, GET /v1/media/purge-settings (owner or admin), PATCH /v1/media/purge-settings (owner or admin), GET /v1/media/purge-preview (owner or admin), POST /v1/media/purge (owner or admin), GET /v1/media/{id}/variants (owner or admin, session only), POST /v1/media/{id}/variants (owner or admin, session only), POST /v1/media/{id}/variants/{name} (owner or admin, session only), DELETE /v1/media/{id}/variants/{name} (owner or admin, session only) |
 | Users and invites | GET /v1/user/ (`users.view`), PATCH /v1/user/me, GET /v1/user/me/export, DELETE /v1/user/me, POST /v1/user/invite (`users.invite`), DELETE /v1/user/invite/{id} (`users.invite`), POST /v1/user/invite/{id}/renew (`users.invite`), GET /v1/auth/me (with the linked `author`) |
 | Settings | GET /v1/settings |
@@ -75,14 +76,14 @@ never changes the response or the change itself.
 | `articles` | `article.create`, `article.edit`, `article.publish`, `article.unpublish`, `article.delete` |
 | `media` | `media.upload`, `media.rename`, `media.delete`, `media.merge`, `media.purge`, `media.variant_create`, `media.variant_update`, `media.variant_delete`, `media.variant_enable`, `media.variant_disable`, `media.variant_purge`, `media.variant_generate_all`, `media.variant_purge_image`, `media.variant_purge_all`, `media.variant_purge_unused` |
 | `users` | `user.register`, `user.verify`, `user.update_profile`, `user.request_email_change`, `user.resend_email_change`, `user.cancel_email_change`, `user.confirm_email_change`, `user.export_data`, `user.delete_account` (flagged `security`), `user.change_role`, `user.remove`, `user.transfer_ownership` (flagged `security`), `invite.create`, `invite.cancel`, `invite.renew`, `invite.accept` |
-| `sites` | `site.create`, `site.edit`, `site.set_default`, `site.delete` |
+| `sites` | `site.create`, `site.edit`, `site.set_default`, `site.delete`, `site.languages_edit`, `site.language_setup` |
 | `authors` | `author.create`, `author.edit`, `author.delete` |
 | `system` | `system.media_purge` (scheduled), `system.update_checked`, `system.update_downloaded`, `system.restart_requested`, `system.activity_cleanup`, `system.activity_retention_changed` |
 
 Target types: `article`, `site`, `author`, `image`, `image_variant` (id and name are the variant name), `user`, `invite`,
 `api_key` and `release` (id and name are the tag).
-Only the fields `title`, `online`, `body`, `site`, `name`, `base_url`, `default_robots`, `locale`, `default_social_image`, `slug`, `canonical_url`, `noindex`, `cover_image`, `social_image`, `excerpt`, `seo_title`, `seo_description`, `social_title`, `social_description`, `cover_image_alt`, `site_name`, `title_template`, `default_description`, `bio`, `website`, `social_links`, `avatar`, `user`, `authors`, `filename`, `display_name`, `width`, `height`, `fit`, `format` and `quality` appear in `changes` (a site key is never a change; moving an article records `site` with the site names; changing the credited authors records `authors` with the names in order; the `user` change of an author holds usernames, never an email), with the
+Only the fields `title`, `online`, `body`, `site`, `name`, `base_url`, `default_robots`, `locale`, `default_social_image`, `slug`, `canonical_url`, `noindex`, `cover_image`, `social_image`, `excerpt`, `seo_title`, `seo_description`, `social_title`, `social_description`, `cover_image_alt`, `site_name`, `title_template`, `default_description`, `public_url_pattern`, `bio`, `website`, `social_links`, `avatar`, `user`, `authors`, `filename`, `display_name`, `width`, `height`, `fit`, `format` and `quality` appear in `changes` (a site key is never a change; moving an article records `site` with the site names; changing the credited authors records `authors` with the names in order; the `user` change of an author holds usernames, never an email), with the
-kinds `text` and `body`; a body edit carries a signed character count delta and never the text; the free-text SEO fields (`excerpt`, `seo_title`, `seo_description`, `social_title`, `social_description`, `cover_image_alt`) do the same under their own field name, while `slug`, `canonical_url`, `noindex`, `cover_image`, `social_image` (image file names) and the site fields `site_name`, `title_template`, `default_description` carry `before` and `after`. `seo_dismissed` is not an edit and records nothing. A
+kinds `text` and `body`; a body edit carries a signed character count delta and never the text; the free-text SEO fields (`excerpt`, `seo_title`, `seo_description`, `social_title`, `social_description`, `cover_image_alt`) do the same under their own field name, while `slug`, `canonical_url`, `noindex`, `cover_image`, `social_image` (image file names) and the site fields `site_name`, `title_template`, `default_description`, `public_url_pattern` carry `before` and `after`. `seo_dismissed` is not an edit and records nothing. A
 change that leaves a value as it was (same body, same publish state, same file name, same display
 name) records nothing. Params: `media.merge` and `media.purge` and `system.media_purge` carry
 `merged` and `articles_updated`, plus `failed_groups` when a group failed (still outcome `success`);
@@ -145,7 +146,7 @@ session." with a key. The role is checked before the body.
 | --- | --- |
 | `GET /v1/site/` | The sites, default first and then by name, each with `article_count`. Query `q` (up to 200 characters, matched in `name`, `key` or `base_url`, ignoring case and accents, `%` and `_` literal), `page` (a whole number from 1) and `size` (5, 25, 50 or 100). Without `page` and `size` every matching site is returned; with only `page`, `size` is 25; with only `size`, `page` is 1. The body stays a JSON array (`[]` when nothing matches, never `null`) and `X-Total-Count` holds the number of matching sites before paging. A page past the end is `200 []` with the total. An invalid `page`, `size` or `q` is 400 with the body-mismatch message and no `X-Total-Count`. |
 | `POST /v1/site/` | Create. 201 with the site. `is_default: true` makes it the default. `site_name`, `title_template` and `default_description` are optional and validated like on `PATCH`. |
-| `PATCH /v1/site/{id}` | Edit `name`, `base_url`, `default_robots`, `locale`, `default_social_image_id`, `site_name`, `title_template`, `default_description`. Absent fields are untouched. `key` may only be repeated unchanged; `is_default` is refused. |
+| `PATCH /v1/site/{id}` | Edit `name`, `base_url`, `default_robots`, `locale`, `default_social_image_id`, `site_name`, `title_template`, `default_description`, `public_url_pattern` (see [api/site-languages.md](api/site-languages.md)). Absent fields are untouched. `key` may only be repeated unchanged; `is_default` is refused. |
 | `PATCH /v1/site/{id}/default` | Make the site the default, atomically. Setting the current default is a no-op. |
 | `DELETE /v1/site/{id}?reassign_to={id}` | 204. A site with articles needs `reassign_to`; the articles move and the site is deleted in one transaction. `reassign_to` is ignored when the site has no article. |
 
@@ -161,8 +162,8 @@ A site also carries `site_name` (at most 100 characters, `""` by default), `titl
 Articles carry `site_id`. A new article starts on the default site. `GET /v1/article/?site=<key>`
 keeps only the articles of that site and composes with `status`, `q`, `sort`, `size` and `page`;
 `counts` stay global, an unknown key answers 200 with no item and an empty `site=` is 400 with the
-body-mismatch message. `PATCH /v1/article/{id}` takes `body`, `site_id`, `author_ids` and the SEO
+body-mismatch message. `PATCH /v1/article/{id}` takes `title`, `body`, `site_id`, `author_ids`, the SEO
-fields below, and nothing else, such as `title`: absent fields are untouched, an empty object, an object without
+fields below and `if_revision`, and nothing else: absent fields are untouched, an empty object, an object without
 those fields, a `null` value (except on `cover_image_id` and `social_image_id`) or a malformed value is 400 with the body-mismatch message, `site_id: 0` is
 400 with the validator text and an unknown site is 404 `site_not_found`. Moving an article never
 changes `is_online`. `{"body": ""}` still sets an empty body, but `{}` and `{"body": null}` no longer do: they are 400.
@@ -173,11 +174,11 @@ RenewCMS renders no page and injects no meta tag: it returns the data a frontend
 
 | Route | Who | Purpose |
 | --- | --- | --- |
-| `GET /v1/article/{id}/seo` | public for online articles; a verified session or API key also reads the drafts its role may read | The resolved object `{ title, description, canonical_url, robots, og, twitter, image, authors, published_at, modified_at, fallbacks, json_ld }`. It never carries the body, the id or `seo_dismissed`, ignores `format`, and writes nothing. An offline article for any other caller, and a missing one, is 404 `Article not found`. |
+| `GET /v1/article/{id}/seo` | public for online articles; a verified session or API key also reads the drafts its role may read | The resolved object `{ title, description, canonical_url, robots, og, twitter, image, authors, published_at, modified_at, fallbacks, json_ld, lang, alternates }`. It never carries the body, the id or `seo_dismissed`, ignores `format`, and writes nothing. An offline article for any other caller, and a missing one, is 404 `Article not found`. |
 | `POST /v1/article/{id}/seo/check` | verified session or API key (401 without credentials, 403 unverified) | Evaluates the article without saving. The body is `{}` or any of the twelve SEO fields of `PATCH` plus `body`; each replaces the saved value for this check only. `site_id`, `author_ids`, unknown fields and `null` (except on `cover_image_id` and `social_image_id`) are 400 with the body-mismatch message. The other validation is the one of `PATCH` (`invalid_slug`, `invalid_url` as 422, `image_not_found`, validator text). Answers `{ status, suggestions, slug }` where `suggestions` is `[{ code, field, params }]` and `slug` is `{ available, suggestion }`. A taken slug is a 200 with `available: false` and the first free `<slug>-N` in `suggestion`, never a 409. |
-| `GET /v1/site/{key}/sitemap` | public | A JSON array `[{ url, modified_at, noindex }]` of the online articles of the site with that key, by id ascending. `url` is `base_url/slug` (never the canonical override). `page` (default 1) and `size` (25, 50, 100 or 500, default 100); an invalid value is 400 with the body-mismatch message. The total is in the `X-Total-Count` header. An unknown key, an id included, is 404 `site_not_found`. |
+| `GET /v1/site/{key}/sitemap` | public | A JSON array `[{ url, modified_at, noindex, lang }]` of the eligible versions (published, language enabled) of the site with that key, by id ascending. `url` is the localized address when the site has a Public URL pattern, otherwise `base_url/slug` (never the canonical override). `page` (default 1) and `size` (25, 50, 100 or 500, default 100); an invalid value is 400 with the body-mismatch message. The total is in the `X-Total-Count` header. An unknown key, an id included, is 404 `site_not_found`. |
 
-`GET /v1/article/` also takes `seo=ready|suggestions|hidden` (any other value, an empty one included, is 400 with the body-mismatch message, after the `format` check). It is applied before paging and composes with `q`, `status`, `site`, `sort`, `page` and `size`; `total` follows it and `counts` ignore it. Every item carries `seo_status` (`ready`, `suggestions` or `hidden`) and `seo_suggestions` (the number of suggestions that are not dismissed). The filter is evaluated in memory over every matching article, so its cost grows with the number of articles on the site; without it only the returned page is assessed.
+`GET /v1/article/` also takes `seo=ready|suggestions|hidden` (any other value, an empty one included, is 400 with the body-mismatch message, after the `format` check). It is applied before paging and composes with `q`, `status`, `site`, `sort`, `page` and `size`; `total` follows it and `counts` ignore it. Every item carries `seo_status` (`ready`, `suggestions` or `hidden`) and `seo_suggestions` (the number of suggestions that are not dismissed). The filter reads the status stored on each article (see [SEO status and suggestions](api/articles.md#seo-status-and-suggestions)), in SQL, before paging.
 
 `X-Total-Count` is added to `Access-Control-Expose-Headers` next to `Link`, so a browser on an allowed origin can read it.
 
@@ -580,7 +581,7 @@ caller's role, which is read on every request (a key follows its creator's role)
 | `GET /v1/article/`, `GET /v1/article/{id}`, `GET /v1/article/{id}/seo` | public, `content.read` widens what drafts show | online articles, plus drafts when `content.read` is `all`, or the caller's own drafts when it is `own` |
 | `POST /v1/article/{id}/seo/check` | `content.read` | the article must be visible, else 404 |
 | `POST /v1/article/` | `content.create` | none; `created_by` is the caller and the article is always a draft |
-| `PATCH /v1/article/{id}` | `content.update` | `own` needs `created_by` to be the caller |
+| `PATCH /v1/article/{id}` | `content.update` | `own` needs `created_by` to be the caller, then the article must be readable by the caller, else 404 |
 | `DELETE /v1/article/{id}` | `content.delete` | same |
 | `PATCH /v1/article/{id}/publish`, `/unpublish` | `content.publish` | same; `PATCH` never changes `is_online` |
 | `GET /v1/content-type/{key}/entry`, `GET .../entry/{id}` | `content.read` for `{key}` | `own` lists only the caller's entries (total, page, size and `q` follow) and answers 404 `entry_not_found` for another's entry |

docs/api/article-localization.md

@@ -0,0 +1,387 @@
+# Article versions, translations, revisions and story move
+
+Contract for `features/article_translation_create.feature`, `features/article_edit_revision.feature` and `features/article_story_lifecycle.feature`. The SPA mocks `/v1` from this page. The article object itself is described in [articles.md](articles.md), the languages of a site in [site-languages.md](site-languages.md).
+
+## Vocabulary
+
+- A **story** groups the language versions of one article inside one site. A **version** is one article row: it has its own id, `lang`, title, slug, content, publication and `created_by`. A story holds at most one live version per language.
+- `revision` is the edit counter of a version, starting at `1`, raised by `1` per saved change (see [What raises revision](#what-raises-revision)). An internal content counter is also kept; it is never exposed on a version, only as `source.revision`.
+- A **reader** of a version is a caller who passes the existing read rule: an online version is readable by everyone, an offline one by a verified caller whose `content.read` covers it (`all`, or `own` and the caller created it).
+- **Missing means no readable version.** Everything an article read says about sibling versions (translations, source, error bodies, headers, counts) is limited to the versions the caller can read. No count, placeholder, total, header or error text ever names, counts or hints at a version the caller cannot read.
+
+## Errors
+
+Errors are plain text. The body is the code (or an existing message) followed by a line feed, and extra data travels in response headers. A refused request changes nothing.
+
+| Header | Set on | Value |
+| --- | --- | --- |
+| `X-Current-Revision` | `409 revision_conflict` | the current `revision` of the version, an integer |
+| `X-Existing-Article-Id` | `409 language_exists` | id of the readable version that already holds the language |
+| `X-Conflicting-Articles` | `409 slug_conflict` | ids of the readable versions whose address is taken at the destination, comma separated, in creation order. Absent when none of them is readable |
+| `X-Missing-Languages` | `422 language_not_enabled` on a move or on `PATCH site_id` | tags missing or disabled at the destination, comma separated, sorted, readable versions only. Absent when empty |
+| `X-Slug-Suggestion` | `409 slug_taken` | first free `<slug>-N` (existing) |
+| `X-Missing-Permission` | `403 missing_permission` | the permission key (existing) |
+
+The headers are set on those responses only. Same-origin SPA code reads them directly; cross-origin scripts do not see them (`Access-Control-Expose-Headers` is unchanged).
+
+| Status | Body | Meaning |
+| --- | --- | --- |
+| 400 | `The request cannot be processed due to a mismatch in the format of the body.` | undecodable or invalid body, missing `copy`, `copy: false` with a source, `if_revision` invalid, an unknown or empty update |
+| 400 | `The server expects the ID to be in the format of an unsigned 32-bit integer (uint32).` | invalid id in the path |
+| 400 | the validator text (for example `Key: 'PostTranslation.Title' Error:Field validation for 'Title' failed on the 'min' tag`) | `lang` or `title` missing, title shorter than 3 or longer than 200 characters on a create, `site` that is `""` or not a site key on `POST /v1/article/` |
+| 400 | `Article title must be between 3 and 200 characters.` | a `PATCH` title outside 3 to 200 runes |
+| 400 | `invalid_slug` | a `PATCH` slug that is not a slug |
+| 401 | `You must be logged in to access this resource.` | no valid session or key |
+| 403 | `missing_permission` | the caller lacks the permission (`X-Missing-Permission`); on `DELETE /v1/story/{story_id}`, a `content.delete` that is not at scope `all` |
+| 404 | `Article not found` | the version, or the story, does not exist or the caller cannot read it |
+| 404 | `source_unavailable` | the chosen source does not exist or is not readable; the same answer for both |
+| 404 | `site_not_found` | `POST /v1/story/{story_id}/move`, or `POST /v1/article/` with `site`, naming an unknown site key |
+| 409 | `revision_conflict` | `if_revision` is not the current `revision` (`X-Current-Revision`) |
+| 409 | `language_exists` | the language already has a readable version (`X-Existing-Article-Id`) |
+| 409 | `language_unavailable` | one neutral answer: the language is disabled on the site (the chosen site on `POST /v1/article/` with `site`), or its version exists but is not readable by the caller, or a concurrent request created it first |
+| 409 | `setup_required` | the version has no language yet (`lang` `""`): the site default is not confirmed (the chosen site on `POST /v1/article/` with `site`) |
+| 409 | `slug_taken` | a `PATCH` slug used by another article of the same site and language (`X-Slug-Suggestion`) |
+| 409 | `slug_conflict` | a move would put an address that already exists at the destination (`X-Conflicting-Articles`) |
+| 409 | `story_move_required` | `PATCH site_id` on a version whose story holds several versions |
+| 409 | `target_site_deleted` | `POST /v1/article/`: the target site was deleted after it was looked up and before the article was stored; nothing is stored, choose another site and retry. The SPA has no copy for it yet |
+| 409 | `story_busy` | the database could not lock the rows in time (lock timeout, deadlock or serialization failure); retry |
+| 422 | `invalid_language` | the tag is not a language tag |
+| 422 | `unsupported_language` | a valid tag outside the supported list |
+| 422 | `language_not_enabled` | the site (the chosen one on `POST /v1/article/` with `site`) has no language row for the tag (creation), or a destination site lacks or has disabled a language of the story (move, `X-Missing-Languages`) |
+| 422 | `language_disabled` | publishing an offline version whose language is disabled on its site |
+| 422 | `source_other_story` | the source belongs to another story |
+
+## Fields added to an article read
+
+Added to the article object of `GET /v1/article/{id}`, `POST`, `PATCH`, `publish`, `unpublish`, and for `revision` also to each item of `GET /v1/article/`. Every other key keeps its name, value and type.
+
+```json
+{
+  "id": 10,
+  "lang": "en",
+  "story_id": 5,
+  "revision": 3,
+  "capabilities": ["read", "edit", "publish", "delete", "create_translation"],
+  "translations": [
+    {"id": 10, "lang": "en", "title": "Renovation costs", "is_online": true, "language_enabled": true, "excluded_from_public": false, "source_article_id": null, "capabilities": ["read", "edit", "publish", "delete", "create_translation"]},
+    {"id": 13, "lang": "ar", "title": "Takalif", "is_online": true, "language_enabled": true, "excluded_from_public": false, "source_article_id": 10, "capabilities": ["read", "create_translation"]},
+    {"id": 12, "lang": "fr", "title": "Couts", "is_online": false, "language_enabled": false, "excluded_from_public": true, "source_article_id": 10, "capabilities": ["read", "edit", "publish", "delete", "create_translation"]}
+  ],
+  "source": {"article_id": 10, "revision": 4},
+  "source_unavailable": false,
+  "missing_langs": ["de"],
+  "excluded_from_public": false,
+  "partial_view": false
+}
+```
+
+- `revision` is a positive integer on every read and write, public reads included.
+- `capabilities` lists what the caller may do with this version, always in this order and always starting with `read`: `edit` (`content.update` covers it), `publish` (`content.publish`), `delete` (`content.delete`), `create_translation` (the caller holds `content.create`). An anonymous caller gets `["read"]`.
+- `translations` lists the readable versions of the story, the version being read included, with `id`, `lang`, `title`, `is_online`, `language_enabled` and their own `capabilities`. A version without language (`lang` `""`) reports `language_enabled: true`. The order is the default language of the site first, then the other tags in ascending order (`en`, `ar`, `de`, `fr`); a disabled language is still listed with `language_enabled: false`. A single-version article lists itself. An anonymous caller gets `[]`.
+- `source` is `{"article_id", "revision"}` when the version was created by copying another version and that source still exists and is readable by the caller, otherwise `null` (a version created empty, a deleted source, an unreadable source, an anonymous caller). `source.revision` is the content revision of the source at the moment of the copy.
+- `translations[].excluded_from_public` and `excluded_from_public` (the version being read) are `true` when the language keeps the version off the public language surfaces even once published: the language is disabled on the site, or the version has no language yet (`lang` `""`, the site default is not confirmed). The SPA reads this flag instead of re-deriving it from `language_enabled` and the site languages. A `false` flag says nothing about publication: drafts are off the public surfaces anyway.
+- `translations[].source_article_id` is the id of the version this entry tracks when that source is itself listed in `translations` (so readable), otherwise `null`.
+- The four keys below are sent to signed-in callers only; an anonymous read has none of them (its shape is unchanged).
+  - `source_unavailable`: see [Versions the caller cannot read](#versions-the-caller-cannot-read).
+  - `missing_langs`: the enabled languages of the site without a readable version in the story, default first then by tag, the same rule as the editorial list (`[]` when the caller cannot create, and `[]` for a story whose only versions have no language).
+  - `excluded_from_public`: the flag above, for the version being read.
+  - `partial_view`: see [Versions the caller cannot read](#versions-the-caller-cannot-read).
+
+## Versions the caller cannot read
+
+No answer reveals the existence, id, title or language of a version the caller cannot read. Where the editor needs to explain an absence, the API gives one neutral answer that is the same whether the version was deleted or is hidden from the caller, or a flag that depends on the caller's own permissions only.
+
+| Need | Answer | Same for |
+| --- | --- | --- |
+| The tracked source of a version is gone | `"source": null` and `"source_unavailable": true`. The editor shows "The source isn't available to you" and asks to choose a new source | a deleted source and a source the caller cannot read |
+| Creating from a source that is gone | `404 source_unavailable` | a deleted, unknown or unreadable source |
+| Deleting a version that others track ("Review tracking will pause") | the dialog names the entries of `translations` whose `source_article_id` is the id being deleted | trackers the caller cannot read are never listed or counted, because `translations` lists readable versions only and their `source_article_id` is never sent |
+| Telling the caller that some versions may be out of view ("Versions you can't read aren't listed or counted.") | `partial_view` | `true` whenever the caller's `content.read` is not at scope `all`, whether or not the story holds a version the caller cannot read |
+| Deleting the whole article while some versions are out of view | `DELETE /v1/story/{story_id}` needs `content.delete` at scope `all` (`403 missing_permission` otherwise, decided before anything is read), deletes every version, readable or not, and answers `204` | a story with or without hidden versions |
+| Moving or editing a story with hidden versions | `article_ids` and the `X-Missing-Languages` and `X-Conflicting-Articles` headers name readable versions only (see [Moving a story](#moving-a-story-post-v1storystory_idmove)) | |
+
+`partial_view` never depends on the stored data, so the note "Versions you can't read aren't listed or counted." shows for such a caller on every story, also when nothing is hidden. Showing it only when a hidden version exists would reveal that version.
+
+## What raises revision
+
+A `PATCH` raises `revision` by exactly `1` when it changes at least one stored value, whatever the number of fields, and not at all when it changes nothing. Publishing and unpublishing never raise it.
+
+| Changed field | `revision` | internal content revision |
+| --- | --- | --- |
+| `title`, `body`, `excerpt`, `slug`, `cover_image_alt`, `seo_title`, `seo_description`, `social_title`, `social_description` | +1 | +1 |
+| `author_ids`, `cover_image_id`, `social_image_id`, `canonical_url`, `noindex`, `seo_dismissed`, `site_id` | +1 | unchanged |
+
+Existing rows start at revision `1`. A story move raises each moved version by `1`.
+
+## Editing: `PATCH /v1/article/{id}`
+
+Verified session or API key with `content.update` on the version (`403 missing_permission` otherwise, checked first) and able to read it (`404 Article not found` otherwise, checked second), so a stale `if_revision` never reveals anything to a caller who cannot edit or read the version.
+
+- `title`: 3 to 200 runes (a 4-byte emoji counts as one). `""`, 2 and 201 runes answer `400 Article title must be between 3 and 200 characters.`; `null` answers `400` with the body-mismatch message. Editing the title never changes the slug and never changes the publication: an online version shows the new title publicly at once.
+- `slug`: changed only when sent. `""` regenerates it from the current title. There is no redirect, the old address stops resolving. Unique per site and language: the same slug in two languages of a story is allowed. A slug already used by another article of the same site and language answers `409 slug_taken` with `X-Slug-Suggestion`. Sending the current slug changes nothing.
+- `if_revision`: optional integer `>= 1`. A value that is `0`, negative, a string, a fraction or `null` answers `400` (body mismatch). `if_revision` alone is not an update (`400`). When it differs from the current `revision`, nothing is stored and the answer is `409 revision_conflict` with `X-Current-Revision`, even when the rest of the request would change nothing. The compare and the write are one atomic step: of two concurrent saves with the same `if_revision`, one answers `200` and the other `409`. Without `if_revision` the last write wins. To overwrite after a conflict, send `if_revision` equal to the `X-Current-Revision` the conflict showed; if somebody saved in between, the answer is `409` again with the newer revision.
+- `site_id` on a version whose story holds several versions the caller can read answers `409 story_move_required` and changes nothing (hidden versions are not counted, so the answer never reveals them). When the caller reads only this version of a larger story, `content.update` is required on every version of the story, readable or not (`403 missing_permission` otherwise, naming no version) and the request runs [the story move](#moving-a-story-post-v1storystory_idmove) rules: every version moves in one transaction, language and slug refusals roll everything back, and headers name readable versions only. The other fields of the same request (`title`, `author_ids`, `slug`, SEO fields) are part of that transaction: a refusal of any of them, an unknown author or an invalid SEO value included, leaves every version on its original site and every `revision` unchanged, and the edited version's `revision` rises by exactly 1 for the whole request. To move a story with several readable versions, use [the story move](#moving-a-story-post-v1storystory_idmove). On a story with one version it moves the version when its language is enabled at the destination (`422 language_not_enabled`, with `X-Missing-Languages`, otherwise); a version without language moves without a language check. The slug rule of the destination still applies (`409 slug_taken`).
+- `lang`, `story_id`, `source_article_id` and `copy` in the body are ignored.
+
+The `200` body is the full article object with the new `revision`.
+
+## Publishing
+
+`PATCH /v1/article/{id}/publish` on an offline version whose language is disabled on its site answers `422 language_disabled`. Publishing an already online version is idempotent (`200`, unchanged) even when its language is disabled; a version without language publishes as before. `unpublish` and `PATCH` stay available in a disabled language. Publishing or unpublishing one version never touches its siblings.
+
+## Creating a translation
+
+Two entry points share one implementation: the same result, errors, headers and stored data.
+
+### `POST /v1/article/{id}/translations`
+
+Verified session or API key with `content.create`; the version `{id}` must be readable by the caller.
+
+```json
+{"lang": "fr", "title": "Couts de renovation", "copy": true, "source_article_id": 11}
+```
+
+| Field | Rule |
+| --- | --- |
+| `lang` | required; normalized (`FR` is stored as `fr`) |
+| `title` | required, 3 to 200 characters |
+| `copy` | required boolean (`400` when absent) |
+| `source_article_id` | optional, only with `copy: true` (`400` with `copy: false`); default is `{id}`; must be a readable version of the same story |
+
+The new version joins the story of `{id}`, in the same site, as an offline draft created by the caller, with `revision` `1`. The slug is generated from the new title in (site, language) and gets the next free `-N` suffix when taken.
+
+- `copy: true` copies `body`, `excerpt`, `seo_title`, `seo_description`, `social_title`, `social_description`, `cover_image_id`, `cover_image_alt`, `social_image_id` and the authors from the source, and never `slug`, `canonical_url` (empty), `noindex` (false) or `seo_dismissed` (empty). No image or file row is duplicated. The source and its content revision are captured in the same transaction as the copy: the read shows `"source": {"article_id": <source>, "revision": <content revision then>}`.
+- `copy: false` starts empty: empty text, no images, `authors` is the creating user's byline, `"source": null`.
+
+Answers `201` with the created article object. Order of checks: permission, path id, body, version readable, `copy` rules, language tag, `setup_required`, source, language configuration. A story deleted in the meantime answers `404 Article not found`. Both entry points leave the stored `lang` normalized.
+
+### `POST /v1/article/` with `story_id` (deprecated)
+
+Deprecated: use `POST /v1/article/{id}/translations`. Both entry points run the same use case and keep working; new clients should not send `story_id`.
+
+```json
+{"title": "Couts", "lang": "fr", "story_id": 5, "copy": true, "source_article_id": 10}
+```
+
+`story_id` selects the story (`404 Article not found` when it has no readable version, the same answer as a missing story) and the first readable version, oldest first, plays the role of `{id}`. `lang` is then required (`400`). `source_article_id` and `copy` are only valid with `story_id` (`400` otherwise).
+
+### `POST /v1/article/` without `story_id`
+
+It creates a new story with one offline version, on the default site unless the body names a site.
+
+```json
+{"title": "Neuf", "lang": "fr", "site": "atelier"}
+```
+
+- `site` is optional: the site key. Absent or `null`, the default site is used exactly as before. A present `site` is validated like any site key (`400` with the plain-text body `invalid_site_key` for `""` or `Bad Key!`), then looked up (`404 site_not_found` for an unknown key, a plain text body, nothing stored). A site deleted after that lookup and before the article is stored answers `409 target_site_deleted` (plain text, nothing stored). Every caller who may create articles may create on every site: `content.create` is not scoped to a site, because a role grants each permission at a scope of `none`, `own` or `all` and has no per-site scope (see [Per-site permissions](#per-site-permissions)).
+- `lang` is optional. Absent, the version gets the starting language of the chosen site; present, it is normalized and must be an enabled language of the chosen site (`422 invalid_language`, `unsupported_language`, `language_not_enabled`; `409 language_unavailable` when disabled on that site; `409 setup_required` before that site's default language is confirmed). The same tag can therefore be accepted on one site and refused on another.
+- The slug is generated from the title and made free within the chosen site and language only.
+- `site` with `story_id`, `source_article_id` or `copy` answers `400` with the body mismatch message and stores nothing. `POST /v1/article/{id}/translations` has no `site` field: the translation keeps the site of its source and an unknown `site` key in its body is ignored.
+- The response is the created article object (`201`) with the same keys as before; `site_id` is the id of the chosen site. The article is offline, so it is invisible to anonymous reads and public lists, and `GET /v1/article/?site=<key>` lists it for readers.
+- `article.create` records `params.site` (the site key) on success; a refusal records one failed event with a plain reason (refusals by validation, `401` and `403` happen before the use case and record nothing).
+
+## Deleting
+
+`DELETE /v1/article/{id}` removes one version (`204`, empty body) and checks `content.delete` per version (`403 missing_permission`). Other versions and their story remain. Deleting the last version of a story removes the story. Nothing in the answer mentions a sibling. A deleted language can be created again in the same story; a language with a deleted version still counts as in use for removing the language from the site.
+
+### Deleting the whole article: `DELETE /v1/story/{story_id}`
+
+Verified session or API key with `content.delete` at scope `all` ("delete permission on every version"). Order of checks: path id (`400` with the uint32 message), `content.delete` held (`403 missing_permission`, `X-Missing-Permission: content.delete`), `content.delete` at scope `all` (`403 missing_permission`, same header; decided from the caller's role only, before any read), at least one readable version (`404 Article not found`, the same answer for an unknown story). Then every version of the story, readable or not, is deleted in one transaction under the locks of its sites, and the story row is removed: `204`, empty body.
+
+- Atomic: a failure answers `500 Failed to delete article` and removes nothing; every version stays.
+- Each version is deleted like `DELETE /v1/article/{id}` does it (slug tombstone, soft delete, credits removed), so its slug is free again and its language still counts as in use for removing the language from the site.
+- Versions that tracked a deleted version read `source_unavailable: true` afterwards.
+- Activity: one `article.delete` per deleted version, oldest first, with `params.lang` and `params.story_id`. A failure records one failed `article.delete` on the oldest readable version; `403` and `404` record nothing.
+- A caller whose `content.delete` is at scope `own` deletes versions one by one; deleting the last one removes the story.
+
+### Per-site permissions
+
+Roles grant each permission at scope `none`, `own` or `all` and have no site dimension, so `content.create`, `content.delete` and the other content permissions apply to every site. A per-site permission (for example "may create on Journal only") is not supported; it needs a site scope in the role model first.
+
+## Moving a story: `POST /v1/story/{story_id}/move`
+
+```json
+{"site": "atelier"}
+```
+
+Verified session or API key. The caller needs `content.update` on every version of the story, readable or not, and must read at least one (`404 Article not found` otherwise, also for an unknown story). `site` is the key of the destination (`400` when absent or empty, `404 site_not_found` when unknown). Answers `200`:
+
+```json
+{"story_id": 5, "site": "atelier", "site_id": 2, "article_ids": [10, 12, 11, 13]}
+```
+
+`article_ids` lists the readable versions only, oldest first. Every version moves in one transaction: `site_id` changes, slugs, languages, publication, content and authors are unchanged, `revision` of each moved version rises by 1 and its content revision does not. Moving to the current site answers `200` and changes nothing.
+
+Everything is checked inside the transaction, under the locks of both sites, and nothing moves when something fails: every language of every version (readable or not) must be enabled at the destination (`422 language_not_enabled`, `X-Missing-Languages` limited to languages of readable versions, a language disabled at the destination counts as missing, a language disabled at the source does not matter), and no address may exist at the destination in the same language (`409 slug_conflict`, `X-Conflicting-Articles` limited to readable versions). A conflict that appears between the check and the write answers `409 slug_conflict` without the header.
+
+## Editorial list by story: `GET /v1/article/?group=story`
+
+An opt-in shape of the list for a signed-in, verified caller whose role resolves. Without `group` the response keeps the flat envelope `{ items, total, page, size, counts }` of the paginated list, whose `counts` are `all`, `online`, `draft` and `suggestions`. A caller without a valid session, or with an unverified user, who sends `group` gets 400 with the body-mismatch message and nothing is read.
+
+| Parameter | Meaning |
+| --- | --- |
+| `group` | Only `story`. `group=`, any other value, or `group` from a public caller is 400. |
+| `lang` | A supported language tag, normalized like the language of a version (`fr`, `pt-br` becomes `pt-BR`). Empty, malformed or unsupported is 400. Also narrows the flat list (`items`, `total`, `counts.all`, `counts.online`, `counts.draft`). Disabled languages can be selected. |
+| `tab` | `all` (default) or `missing`. `review`, an empty value, any other value, and `missing` without `group=story` are 400. |
+| `author` | A byline id, an integer of at least 1; anything else is 400. Also narrows the flat list. |
+| `page`, `size`, `q`, `status`, `site`, `seo`, `sort` | Same values, defaults and validation as the flat list. |
+
+Only versions the caller can read count: they are titled, credited, listed in `coverage`, searched and counted. A hidden version never appears, and a story whose versions are all hidden has no row.
+
+**Rows.** With no `lang` a row is a story: `total` counts stories. With `lang` a row is the version of that language (`tab=all`), and the whole story's `coverage`, `story_authors` and `missing_langs` still ride on the row. With `tab=missing` rows are stories again: `lang=fr` lists the stories on a site that enables `fr` and that have a readable version with a language but none in `fr`; without `lang` it lists the stories that lack at least one enabled language, and a caller who cannot create (no `content.create`) gets `total` 0. A story whose readable versions all lack a language (`lang` `""`) is never listed as missing a language. A mixed story (a version without language plus at least one version with a language) is listed under Missing like any other: the version without language fills no language. A version of the story must satisfy `status`, `author`, `q` and `seo` together to make the story match; `q` ignores case and accents.
+
+**Item.** The article list item of the representative version (the one in `lang`, otherwise the site default language version, otherwise the first readable one by language tag), plus:
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `story_updated_at` | RFC 3339 | The latest `updated_at` among the readable versions of the story |
+| `story_authors` | array of bylines | The union of the bylines of the readable versions, without duplicates |
+| `coverage` | array | One entry per readable version, in the order of `translations` (default language, other enabled tags, disabled tags), with the same keys as a `translations` entry: `{ id, lang, title, is_online, language_enabled, excluded_from_public, source_article_id, capabilities }` |
+| `missing_langs` | array of tags | Enabled languages without a readable version, default first then by tag; `[]` when the caller cannot create or when no readable version has a language |
+| `excluded_from_public` | boolean | The flag of the representative version (see [Fields added to an article read](#fields-added-to-an-article-read)) |
+| `capabilities` | array | The capabilities of the representative version |
+
+**Sort.** The whitelist is the flat one. `updated_at` uses the latest readable version of the story, `created_at` the earliest, `title` and `status` the representative; with `lang` the version itself. Ties end with `story_id` descending.
+
+**Counts.** `{ all, online, draft, suggestions, missing }`. They follow `lang`, `q`, `author`, `seo` and `site` but never `status` or `tab`, and count the unit of the mode (stories, or versions of the selected language). `online` and `draft` count the units with a readable online or draft version. `missing` is the `total` the not-in view would give under the same filters (0 without `lang` for a caller who cannot create). `suggestions` is the number of stories with a readable version whose `seo_status` is `suggestions`, ignoring every parameter.
+
+`seo_status`, `seo_suggestions`, the `seo` filter and `counts.suggestions` read the stored SEO status of each version (see [SEO status and suggestions](articles.md#seo-status-and-suggestions)); no request reads the bodies of the visible versions to compute them.
+
+A repository failure at any step, counts included, answers 500 `Failed to retrieve articles`.
+
+## Mock-ready examples
+
+Statuses of the new and changed calls. Bodies are plain text unless shown as JSON; headers listed are the only extra ones.
+
+| Call | Status | Headers | Body |
+| --- | --- | --- | --- |
+| `GET /v1/article/10` (see above) | 200 | | article object with `revision`, `capabilities`, `translations`, `source` |
+| `POST /v1/article/10/translations` `{"lang":"fr","title":"Couts","copy":true}` | 201 | | article object, `lang` `"fr"`, `"is_online": false`, `"revision": 1`, `"source": {"article_id": 10, "revision": 4}` |
+| `DELETE /v1/article/12` | 204 | | empty |
+| `DELETE /v1/story/5` by the owner | 204 | | empty |
+| `DELETE /v1/story/5` by a user holding `content.delete` at `own` | 403 | `X-Missing-Permission: content.delete` | `missing_permission` |
+| `DELETE /v1/story/5` when the database fails | 500 | | `Failed to delete article` |
+| `POST /v1/story/5/move` `{"site":"atelier"}` | 200 | | `{"story_id":5,"site":"atelier","site_id":2,"article_ids":[10,12,11,13]}` |
+| `POST /v1/article/10/translations` `{"lang":"fr","title":"Couts"}` | 400 | | `The request cannot be processed due to a mismatch in the format of the body.` |
+| `PATCH /v1/article/10` `{"title":"ab"}` | 400 | | `Article title must be between 3 and 200 characters.` |
+| `POST /v1/article/10/translations` with a cookie of an anonymous client | 401 | | `You must be logged in to access this resource.` |
+| `POST /v1/story/5/move` by a user holding `content.update` at `own` | 403 | `X-Missing-Permission: content.update` | `missing_permission` |
+| `POST /v1/article/9999/translations` | 404 | | `Article not found` |
+| `POST /v1/article/10/translations` with `"source_article_id":9999` | 404 | | `source_unavailable` |
+| `POST /v1/story/5/move` `{"site":"nowhere"}` | 404 | | `site_not_found` |
+| `PATCH /v1/article/10` `{"body":"x","if_revision":3}` after somebody saved | 409 | `X-Current-Revision: 4` | `revision_conflict` |
+| `POST /v1/article/10/translations` `{"lang":"de","title":"Kosten","copy":true}` | 409 | `X-Existing-Article-Id: 11` | `language_exists` |
+| `POST /v1/article/10/translations` `{"lang":"fr","title":"Couts","copy":true}` with fr disabled, unreadable or raced | 409 | none | `language_unavailable` |
+| `POST /v1/article/30/translations` on an article without language | 409 | | `setup_required` |
+| `PATCH /v1/article/10` `{"slug":"taken-en"}` | 409 | `X-Slug-Suggestion: taken-en-2` | `slug_taken` |
+| `POST /v1/story/5/move` `{"site":"atelier"}` with an address taken at the destination | 409 | `X-Conflicting-Articles: 12` | `slug_conflict` |
+| `PATCH /v1/article/10` `{"site_id":2}` on a story with several readable versions | 409 | | `story_move_required` |
+| `POST /v1/article/10/translations` `{"lang":"pt","title":"Custos","copy":true}` with no `pt` row | 422 | | `language_not_enabled` |
+| `POST /v1/story/5/move` `{"site":"atelier"}` with no `ar` at the destination | 422 | `X-Missing-Languages: ar` | `language_not_enabled` |
+| `PATCH /v1/article/15/publish` with `es` disabled | 422 | | `language_disabled` |
+| `POST /v1/article/10/translations` `{"lang":"xx","title":"Couts","copy":true}` | 422 | | `unsupported_language` |
+| `POST /v1/article/10/translations` `{"lang":"english","title":"Couts","copy":true}` | 422 | | `invalid_language` |
+| `POST /v1/article/10/translations` with `"source_article_id":20` of another story | 422 | | `source_other_story` |
+
+## Activity
+
+No new action code. The existing events carry `params.lang` (the language of the version, omitted for a version without language): `article.create`, `article.edit`, `article.publish`, `article.unpublish`, `article.delete`. A translation creation records `article.create` on the new version with `params.lang`, `params.story_id` and `params.source_article_id` (only when copied). A story move records one `article.edit` per moved version, with a `site` change (site names before and after) and `params.lang`; moving to the current site records nothing. A refused creation or move records one failed event with a plain reason that names no version; refusals answered `404` are not recorded.
+
+## Public language routes
+
+Contract for `features/localization_public_api_and_surfaces.feature`. Both routes are open to everyone: a `jwt` cookie or an API key is ignored, so a draft is never returned, whoever asks. They sit under `/v1/public` and are read only.
+
+They are rate limited per client address together with `GET /v1/site/{key}/sitemap`: 120 requests per minute in total, the same budget an API key gets on the authenticated routes. The client address is the connection address, or `X-Real-IP` when the connection comes from one of `TRUSTED_PROXIES`. Over the budget the answer is `429` with `Retry-After` (seconds) and the body `Too many requests. Please try again later.`
+
+A version is **published** when `is_online` is true, and **eligible** when it is published and its language is enabled on the site. A disabled language stays readable on both routes; only the alternates leave it out.
+
+### Exact lookup: `GET /v1/public/site/{key}/lang/{lang}/article/{slug}`
+
+Matches the site key, the language and the slug, and nothing else. It never falls back to another language, never follows an old slug and creates no redirect.
+
+- `lang` is normalized (`FR` reads `fr`, `pt-br` reads `pt-BR`). A value that is not a language tag (`e`, `pt_BR`) is `400 invalid_language`; a valid tag with no version, or outside the supported list, is `404 article_not_found`.
+- `format` behaves as on `GET /v1/article/{id}`: `markdown` (default), `html` or `json`; anything else is `400` with `The format must be one of: markdown, html, json.`
+- An unassigned article (`lang` `""`), a draft, a soft-deleted version and a version of another site or language are all `404 article_not_found`, with the same body.
+- Answers `200` with the body of an anonymous `GET /v1/article/{id}` (same keys and values) and one more key, `alternates`.
+
+```json
+{
+  "id": 12,
+  "lang": "fr",
+  "story_id": 5,
+  "slug": "comment-nous-chiffrons-une-renovation",
+  "is_online": true,
+  "alternates": [
+    {"id": 10, "lang": "en", "story_id": 5, "slug": "how-we-price-a-bathroom-renovation", "url": "https://journal.example.com/en/how-we-price-a-bathroom-renovation"},
+    {"id": 11, "lang": "de", "story_id": 5, "slug": "so-kalkulieren-wir-eine-badsanierung", "url": "https://journal.example.com/de/so-kalkulieren-wir-eine-badsanierung"}
+  ]
+}
+```
+
+`alternates` lists the other eligible versions of the story: the served version, drafts and versions in a disabled language are left out, and nothing in the response names them. The order is the default language of the site first, then the other tags in ascending order. Each alternate has exactly `id`, `lang`, `story_id`, `slug` and `url`. `url` is the site Public URL pattern filled with the tag and the slug, or `null` when the site has no pattern. A story with one version answers `[]`.
+
+### Story resolution: `GET /v1/public/site/{key}/story/{story_id}`
+
+Resolves one story of the site, optionally with an explicit fallback to the default language. No other language is ever tried.
+
+| Query | Rule |
+| --- | --- |
+| `lang` | optional. Absent, the site default language is requested. A malformed tag is `400 invalid_language` |
+| `fallback` | optional, only the value `default`. When the requested language has no published version, serve the published default-language version instead. Any other value, an empty one included, is `400` with the body-mismatch message |
+| `format` | as on the exact lookup |
+
+The `200` body is the exact lookup body plus `requested_lang` (the language that was asked for, or the default when `lang` is absent) and `fallback` (`true` only when the default-language version replaced the requested one). `lang` is the language of the version served.
+
+| Request | Answer |
+| --- | --- |
+| `?lang=fr`, a published `fr` version exists | the `fr` version, `fallback` false |
+| `?lang=fr`, none, no `fallback` | `404 language_not_available` |
+| `?lang=fr&fallback=default`, `fr` missing or unpublished, `en` published | the `en` version, `requested_lang` `fr`, `fallback` true |
+| `?lang=fr&fallback=default`, neither published | `404 language_not_available` (a third language is never returned) |
+| `?lang=en&fallback=default`, `en` unpublished | `404 language_not_available` |
+| no `lang` | the default-language version, `requested_lang` the default |
+| no `lang`, the site has no confirmed default language | `404 language_not_available` |
+| a story of another site, an unknown story, a story with no published version | `404 language_not_available` |
+
+Changing the default language of a site changes only the requests that omit `lang`.
+
+### Errors
+
+Plain text, the body is the code followed by a line feed. `language_disabled` is not returned by these routes.
+
+| Status | Body | When |
+| --- | --- | --- |
+| 400 | `invalid_language` | `lang` is not a language tag |
+| 400 | `The request cannot be processed due to a mismatch in the format of the body.` | `fallback` is not `default` |
+| 400 | `The server expects the ID to be in the format of an unsigned 32-bit integer (uint32).` | `story_id` is not an unsigned integer |
+| 400 | `The format must be one of: markdown, html, json.` | invalid `format` |
+| 404 | `article_not_found` | exact lookup: no published version for the site, language and slug |
+| 404 | `language_not_available` | story resolution: no version can be served under the rules above |
+| 404 | `site_not_found` | unknown site key |
+| 429 | `Too many requests. Please try again later.` | more than 120 requests in a minute from one client address on the public routes and the sitemap together (`Retry-After` in seconds) |
+| 500 | `Internal server error` | a repository failure |
+
+## Resolved SEO and sitemap, language aware
+
+`GET /v1/article/{id}/seo` keeps its keys and adds `lang`, `alternates` (same shape and order as the public alternates), `og.locale_alternates` and `fallbacks.site_text_skipped`. Every other key keeps its name and type. An unassigned article (`lang` `""`) answers `lang` `""`, `alternates` `[]` and `og.locale_alternates` `[]`, with the legacy canonical and the raw site locale.
+
+**Canonical.** `canonical_url` and `og.url` are, in order: the version `canonical_url` override (`fallbacks.canonical` `canonical_url`); the site `public_url_pattern` with `{lang}` and `{slug}` filled (`pattern`); the legacy `base_url/slug` (`site`), when the site has no pattern or the article has no language. A region tag is kept as written (`/pt-BR/reforma`). `json_ld.mainEntityOfPage.@id` equals `canonical_url`. Saving a pattern changes no override and no article.
+
+**og:locale**, first match wins, never invented:
+
+1. the explicit `social_locale` of the language row;
+2. the tag already has a region (`pt-BR` gives `pt_BR`);
+3. `Site.Locale` has the same language part and a region (`en-GB` with `en` gives `en_GB`);
+4. otherwise `""`, and `og.locale_alternates` is `[]`.
+
+`og.locale_alternates` lists the social locales of the other eligible versions that resolve one, in the order of the alternates. `GET /v1/site/{key}/languages` reports rule 3 as `social_locale_state` `derived` (`not_set` when `Site.Locale` is bare such as `en`).
+
+**Fallbacks in the language of the version.** The title and description chains are unchanged except for the site text: `default_description` is treated as written in the current default language of the site, so it is used only by an unassigned article or a version in that language. For any other language the description stays empty, `fallbacks.description` is `none` and `fallbacks.site_text_skipped` is `true`. Changing the default language changes which versions may use the site text. `title_template`, `site_name` and the image chain stay shared; `cover_image_alt` stays per version.
+
+**Sitemap.** `GET /v1/site/{key}/sitemap` lists every eligible version once (published, language enabled; unassigned published articles keep their legacy entry). Each item is `{url, modified_at, noindex, lang}`; `url` is the localized address when the site has a pattern, otherwise `base_url/slug`. `X-Total-Count` counts the listed items. The route shares the rate limit of the public language routes.
+
+**SEO check and status.** `POST /v1/article/{id}/seo/check`, the stored `seo_status` of the lists and the `seo` filter apply the same language rule as the resolved description: the site `default_description` can fill the description (and so avoid `desc_short` or raise `desc_long`) only for a version in the current default language of the site or without language.
+
+## Media usage
+
+`GET /v1/media/{id}/usage` article items gain `story_id` and `lang` (`""` for an unassigned article, whose `story_id` is the stored value). There is one article item per version, ordered by id; author, site and entry items carry neither key. `used_in` on `GET /v1/media/` counts a story once, so an image used by three versions of one story is one use. An unassigned article is its own group.

docs/api/articles.md

@@ -1,8 +1,10 @@
 # Reading articles
 
+Versions, translations, `revision`, `if_revision`, capabilities and the story move: [article-localization.md](article-localization.md).
+
 Every route that returns an article accepts the optional `format` query parameter and returns the article body in that format. Articles are stored as HTML (Tiptap output). Storage and the request bodies of `POST /v1/article/` and `PATCH /v1/article/{id}` stay HTML.
 
-`PATCH /v1/article/{id}` takes `body`, `site_id`, `author_ids` (the whole ordered list of author ids, see `docs/api.md`) and the SEO fields listed below, and nothing else. The request must contain at least one of them, and `null` answers `400` except for `cover_image_id` and `social_image_id`. Behaviour change: `{}` and `{"body": null}` used to set an empty body and now answer `400`; send `{"body": ""}` to empty a body.
+`PATCH /v1/article/{id}` takes `title`, `body`, `site_id`, `author_ids` (the whole ordered list of author ids, see `docs/api.md`), the SEO fields listed below and the optional `if_revision`, and nothing else. The request must contain at least one of them (`if_revision` alone is not an update), and `null` answers `400` except for `cover_image_id` and `social_image_id`. Behaviour change: `{}` and `{"body": null}` used to set an empty body and now answer `400`; send `{"body": ""}` to empty a body.
 
 ## Routes that honour `format`
 
@@ -42,7 +44,7 @@ Anonymous and unverified callers only see online articles, and an offline articl
 - `items` is `[]` when empty, never `null`. Each item is the article object below.
 - Items follow `sort` (default `updated_at:desc`) across the whole list before paging. `title` ignores case, `status` orders on online state (`status:asc` puts drafts first), and every ordering ends with `id` descending so pages never overlap.
 - `total` is the number of visible articles matching `q` and `status`, before paging. `page` and `size` echo the values applied.
-- `counts` ignores `q`, `status`, `site`, `seo`, `sort`, `page` and `size`, so tab counts do not move while searching. `suggestions` is the number of visible articles whose `seo_status` is `suggestions` (hidden and ready articles and dismissed codes are not counted); it equals the `total` of `?seo=suggestions` sent with no other filter by the same caller. For anonymous and unverified callers `all` equals `online` and `draft` is `0`, and `status=draft` answers `items: []` and `total: 0`.
+- `counts` ignores `q`, `status`, `site`, `seo`, `sort`, `page` and `size` (and `suggestions` also ignores `lang` and `author`), so tab counts do not move while searching. `suggestions` is the number of visible articles whose `seo_status` is `suggestions` (hidden and ready articles and dismissed codes are not counted); it equals the `total` of `?seo=suggestions` sent with no other filter by the same caller. For anonymous and unverified callers `all` equals `online` and `draft` is `0`, and `status=draft` answers `items: []` and `total: 0`.
 - Each item also carries `seo_status` and `seo_suggestions` (see [SEO status and suggestions](#seo-status-and-suggestions)). `seo` filters on the status before paging, so `total` follows it while `counts` do not.
 - A page beyond the last answers `200` with `items: []` and the real `total`.
 - An invalid `page`, `size`, `status`, `sort` or an over-long `q` answers `400` with the plain-text message `The request cannot be processed due to a mismatch in the format of the body.` An invalid `format` is reported first.
@@ -87,10 +89,14 @@ Breaking change: the default used to be HTML. Clients that need HTML must send `
   "noindex": false,
   "seo_dismissed": [],
   "created_at": "2026-03-12T09:14:00Z",
-  "updated_at": "2026-09-10T07:00:00Z"
+  "updated_at": "2026-09-10T07:00:00Z",
+  "lang": "fr-CA",
+  "story_id": 5
 }
 ```
 
+`lang` is the full BCP 47 language tag of the article (`""` while the site default language is not confirmed) and `story_id` is the story the article belongs to. Both are present on every article object (list items, reads, create and update responses, public reads) as additive keys, and every other key is unchanged. They are read-only on `PATCH`, where `lang` and `story_id` are ignored. `POST /v1/article/` takes `title`, `body`, and optionally `lang`, `site` (a site key; the default site when absent or `null`), `story_id`, `source_article_id` and `copy` only as described in [article-localization.md](article-localization.md), which also documents `revision`, `capabilities`, `translations` and `source`, the additive keys of every article read. Supported tags: `en`, `en-GB`, `en-US`, `fr`, `fr-CA`, `pt`, `pt-BR`, `es`, `de`, `ar`. Existing articles each get their own story and `lang` `""` until the site default is confirmed.
+
 `created_by` is the id of the user who created the article (`0` when it is attributed to nobody). It is present on every article object (list, read, create and update responses) only when the caller is signed in with a verified session or authenticates with an API key; the key acts as its creator. Anonymous callers, and unverified or stale sessions, get the same object without the field. The SPA reads it to decide which rows a role limited to `own` can edit, delete or publish.
 
 Every single-article read (`GET /v1/article/{id}`, `POST`, `PATCH`, `publish`, `unpublish`) carries the twelve SEO fields. Each item of `GET /v1/article/` carries `slug` and `excerpt` only, and none of the other ten.
@@ -116,7 +122,7 @@ Limits are counted in characters (runes), not bytes. Absent fields are untouched
 
 ### The slug
 
-A slug is unique per site (`site_id`, `slug`), never globally. At creation it is generated from the title: lowercase, accents folded, every run of other characters becomes one dash, dashes trimmed, cut to 100 characters without a trailing dash, and `article` when no letter or digit is left. A slug already used on the site gets `-2`, `-3`... silently, the base being truncated so the result fits 100 characters. The same rule backfills existing articles on the first start after the upgrade, in id order within each site.
+A slug is unique per site and language (`site_id`, `lang`, `slug`), never globally; unassigned articles (`lang` `""`) share the empty language, so they keep the per-site rule. At creation it is generated from the title: lowercase, accents folded, every run of other characters becomes one dash, dashes trimmed, cut to 100 characters without a trailing dash, and `article` when no letter or digit is left. A slug already used on the site gets `-2`, `-3`... silently, the base being truncated so the result fits 100 characters. The same rule backfills existing articles on the first start after the upgrade, in id order within each site.
 
 Editing a slug that another article of the target site already uses (the new site when `site_id` is sent in the same request; moving an article also re-checks its current slug there) answers `409` with the plain-text body `slug_taken`, and the response header `X-Slug-Suggestion` holds the first free `<slug>-N` from 2 on that site, fitting 100 characters. `X-Slug-Suggestion` is set on this `409` only and on no other response. A request with `slug: ""` that regenerates onto another article's slug is refused the same way and never suffixed silently. Re-sending an article's own slug is not a conflict. A refused request changes nothing.
 
@@ -126,20 +132,20 @@ Publishing, unpublishing and `noindex` never change a slug. A deleted article fr
 
 `GET /v1/article/{id}/seo` answers the data a frontend renders in its `<head>`. Online articles are public; a draft needs a verified session or API key whose role may read it (see [Content permissions](../api.md#content-permissions)) and is otherwise `404 Article not found`. The query is ignored (no `format`). Keys:
 
-`title`, `description`, `canonical_url`, `robots`, `og` (`type`, `title`, `description`, `image`, `image_alt`, `url`, `site_name`, `locale`), `twitter` (`card`, `title`, `description`, `image`, `image_alt`), `image` (`url`, `alt`, `source`), `authors` (`name`, `url`, `same_as`), `published_at`, `modified_at`, `fallbacks` and `json_ld` (a ready schema.org `Article`).
+`title`, `description`, `canonical_url`, `robots`, `og` (`type`, `title`, `description`, `image`, `image_alt`, `url`, `site_name`, `locale`, `locale_alternates`), `twitter` (`card`, `title`, `description`, `image`, `image_alt`), `image` (`url`, `alt`, `source`), `authors` (`name`, `url`, `same_as`), `published_at`, `modified_at`, `fallbacks` (`title`, `description`, `image`, `canonical`, `site_text_skipped`), `json_ld` (a ready schema.org `Article`), `lang` and `alternates`. The language rules (canonical from the Public URL pattern, `og:locale` order, site text only in the default language) are in [article-localization.md](article-localization.md#resolved-seo-and-sitemap-language-aware).
 
 The fallback chain, first non-empty wins:
 
 | Output | Chain | `fallbacks` value |
 | --- | --- | --- |
 | `title` | `seo_title`, then the article title, then the site `title_template` (`%title%`, `%site%` replaced by `site_name`, result trimmed) | `seo_title`, `title` |
-| `description` | `seo_description`, `excerpt`, the first sentence of the body (tags removed), the site `default_description` | `seo_description`, `excerpt`, `body`, `site`, `none` |
+| `description` | `seo_description`, `excerpt`, the first sentence of the body (tags removed), the site `default_description` (only for a version in the default language or without language) | `seo_description`, `excerpt`, `body`, `site`, `none` |
 | `image` | `social_image_id`, `cover_image_id` (with `cover_image_alt`), the site `default_social_image_id`; `url` is the site `base_url` plus the image path, `""` and `none` when there is none | `social`, `cover`, `site`, `none` |
-| `canonical_url` | `canonical_url`, then site `base_url` + `/` + `slug` | `canonical_url`, `site` |
+| `canonical_url` | `canonical_url`, then the site `public_url_pattern` filled with `lang` and `slug`, then site `base_url` + `/` + `slug` (no pattern, or no language) | `canonical_url`, `pattern`, `site` |
 | `robots` | `noindex, nofollow` when `noindex` is true, otherwise from the site `default_robots` (`index, follow` or `noindex, nofollow`) | none |
 | `og` and `twitter` title and description | `social_title` and `social_description`, then the resolved values | none |
 
-`og.type` is `article`, `og.locale` is the site locale (`""` when none), `twitter.card` is `summary_large_image` with an image and `summary` without. `published_at` is the creation time of an online article and `null` for a draft; `modified_at` is `updated_at`. `authors[].url` is the author website (`""` when none) and `same_as` lists the social link URLs only. `json_ld.headline` is the meta title without the site template, and `author`, `image` and `datePublished` are left out when empty.
+`og.type` is `article`, `og.locale` is the explicit social locale of the language, else the region of the tag, else the region of the site locale with the same language, else `""`; an article without language keeps the raw site locale, `twitter.card` is `summary_large_image` with an image and `summary` without. `published_at` is the creation time of an online article and `null` for a draft; `modified_at` is `updated_at`. `authors[].url` is the author website (`""` when none) and `same_as` lists the social link URLs only. `json_ld.headline` is the meta title without the site template, and `author`, `image` and `datePublished` are left out when empty.
 
 ## SEO status and suggestions
 
@@ -161,6 +167,10 @@ The fallback chain, first non-empty wins:
 
 Suggestions come in that order. Codes in `seo_dismissed` are never reported or counted. The status is `hidden` when `noindex` is true, else `suggestions` when at least one suggestion remains, else `ready`. The list items carry `seo_status` and `seo_suggestions` (the count, also for a hidden article).
 
+The resolved description uses the site `default_description` only for a version in the current default language of its site or without language, so `desc_short` and `desc_long` follow the language of the version, in the check and in the lists alike.
+
+**Stored status.** Each version stores its `seo_status` and `seo_suggestions`. Every write that can change them clears the stored value in the same statement: an edit of the version (title, body, slug, SEO fields, authors, site), a cover or social image deleted, restored or merged, a credited author deleted, a move to another site (story move or site deletion with reassignment), a language assigned by the setup, a change of the site `default_description`, and a change of the site default language. The lists recompute the cleared versions (and only those) before answering, and the server recomputes them at startup, so `seo_status`, `?seo=` and `counts.suggestions` always reflect the current data without reading every visible body per request. A value computed from data that changed in the meantime is never stored.
+
 ## Markdown output
 
 Headings, bold, italic, links, bullet and ordered lists, blockquotes, fenced code blocks, rules, images and inline code are converted. Anything else is reduced to its text. `script` and `style` content is removed, and the source HTML is never passed through; the only HTML in the output is the alignment wrapper described below. List indentation attributes are dropped. Links with a scheme other than http, https, mailto or tel are reduced to their text. Characters that markdown would read as formatting (`*`, `_`, `` ` ``, `[`, `]`, `<`, `\`) and line starts that would read as a heading, list, quote or rule (`#`, `-`, `+`, `>`, `1.`) are backslash-escaped, so plain text stays plain text. A line break becomes a backslash followed by a newline.
@@ -214,6 +224,7 @@ Example for `<h2>Plan</h2><p>Replace the <strong>old</strong> deck.</p>`:
 | --- | --- |
 | `400` | `The server expects the ID to be in the format of an unsigned 32-bit integer (uint32).` for an invalid id |
 | `400` | `The format must be one of: markdown, html, json.` for an unsupported format |
+| `400` | `invalid_site_key` for a `site` of `POST /v1/article/` that is not a valid site key |
 | `400` | `invalid_slug`, `image_not_found` or the validator text for an over-long SEO field, `cover_image_id: 0` or an unknown `seo_dismissed` code |
 | `404` | `Article not found` |
 | `409` | `slug_taken`, with the header `X-Slug-Suggestion: <first free slug>` (this response only) |

docs/api/site-languages.md

@@ -0,0 +1,145 @@
+# Site languages, language setup and public URL pattern
+
+Contract for `features/site_languages.feature`, `features/language_setup.feature` and `features/site_public_url_pattern.feature`. The SPA mocks `/v1` from this page.
+
+Errors are plain text whose body is exactly the code, with the status below. A body that cannot be decoded, or that lacks a required key, is 400 with the body-mismatch message ("The request cannot be processed due to a mismatch in the format of the body."). An anonymous caller is 401, a verified user without `settings.manage_sites` is 403 `missing_permission`. Writes need a real session; API keys are refused.
+
+An owner is a verified user holding `settings.manage_sites`. A reader is any other verified user.
+
+## Visibility exception (accepted)
+
+`version_count` and `published_count` in `GET /v1/site/{key}/languages` are site-level aggregates of every non-deleted article (soft-deleted articles are not shown but still keep their language in use) of the language, drafts and offline ones included. They are visible to every signed-in reader, whatever that reader may open. This is a deliberate exception to the per-version visibility policy of `docs/design/localization-tables.md` ("Hidden versions"), accepted for slice 2. Later slices that expose titles or links of single versions must still filter by what the caller can read.
+
+## Languages of a site
+
+The supported tags are the list of `internal/domain/language` (`en`, `en-GB`, `en-US`, `fr`, `fr-CA`, `pt`, `pt-BR`, `es`, `de`, `ar`). Tags are normalized: `pt-br` is stored as `pt-BR`.
+
+### `GET /v1/site/{key}/languages`
+
+Any verified user (session or API key). 404 `site_not_found`.
+
+```json
+{
+  "revision": "9f2c...",
+  "default": "en",
+  "needs_setup": false,
+  "languages": [
+    {"lang": "en", "enabled": true, "is_default": true, "version_count": 7, "published_count": 6, "social_locale": null, "social_locale_state": "not_set"},
+    {"lang": "fr", "enabled": true, "is_default": false, "version_count": 4, "published_count": 2, "social_locale": "fr_FR", "social_locale_state": "set"}
+  ],
+  "available": [
+    {"lang": "pt", "substitute": null},
+    {"lang": "pt-PT", "substitute": "pt"}
+  ]
+}
+```
+
+- `revision` is an opaque digest of the rows (lang, default, enabled, social_locale). Counts do not change it. Send it back on `PUT`.
+- `languages` lists the default first, then the other enabled languages by tag, then the disabled ones by tag.
+- `social_locale_state` is `set` (an explicit `social_locale`), `derived` (no explicit value and the tag has a region: the effective value is the tag with an underscore, `en-GB` gives `en_GB`) or `not_set`. `social_locale` is only the explicit value, so the client computes the derived one from the tag.
+- `available` lists the tags an owner can pick. A tag with a non-null `substitute` is not supported itself; only the broader tag is. The server refuses it with `unsupported_language`, so the client sends the substitute once the user confirms.
+- `needs_setup` is true when the site has no confirmed default language. Then `default` is `null`, `languages` is `[]` and `PUT` answers 409 `setup_required`. Sites created after the migration have no language row and need setup too.
+
+### `PUT /v1/site/{key}/languages`
+
+Owner only. The whole set is replaced in one transaction under the site lock.
+
+```json
+{
+  "revision": "9f2c...",
+  "default": "en",
+  "languages": [
+    {"lang": "en", "enabled": true, "social_locale": null},
+    {"lang": "fr", "enabled": true, "social_locale": "fr_CA"}
+  ]
+}
+```
+
+`revision`, `default`, `languages` and each `enabled` are required (400 when absent). `social_locale` is optional and `null` means none. A language left out of the list is removed. The answer is 200 with the new read shape. Sending the state that is already stored changes nothing and keeps the revision.
+
+Checks run in this order:
+
+| Order | Status | Body | When |
+| --- | --- | --- | --- |
+| 1 | 404 | `site_not_found` | unknown key |
+| 2 | 409 | `setup_required` | the site has no confirmed default (any body) |
+| 3 | 409 | `languages_changed` | `revision` is not the current one; nothing is applied |
+| 4 | 422 | `invalid_language` | a tag is not a language tag (`english`, empty) |
+| 4 | 422 | `unsupported_language` | a well formed tag that is not supported (`xx`, `pt-PT`) |
+| 4 | 422 | `duplicate_language` | the same tag twice, case ignored |
+| 4 | 422 | `invalid_social_locale` | not `ll_RR` or `lll_RR` (letters, one underscore), empty string, or the language part differs from the tag's language |
+| 5 | 422 | `no_enabled_language` | no language is enabled, `languages: []` included |
+| 6 | 422 | `default_not_enabled` | `default` is not in the list, not enabled, or not a supported tag |
+| 7 | 409 | `language_in_use` | a removed language still has an article, draft, offline, online or soft-deleted (the display count `version_count` stays non-deleted only) |
+| any | 409 | `languages_changed` | the database could not lock the site in time because another change is running (lock contention); nothing is applied, reload and retry |
+
+Entries are checked in list order for step 4. A rejected request changes nothing. Disabling a language never touches its articles, and no article changes `lang`, status or publication. A site always has exactly one default language: the rows are planned with one default and checked again before they are written. Changing the default language re-evaluates the stored SEO status of every article of the site, because the site `default_description` only counts for the default language (see [SEO status and suggestions](articles.md#seo-status-and-suggestions)). A `social_locale` is stored as `language_REGION` (`fr_fr` becomes `fr_FR`). The language part rule only compares with the tag; matching `Site.Locale` is deferred to slice 6.
+
+## First-time language setup
+
+One global setup for every site with no confirmed default language. Owner only (`GET` as well: a reader is 403).
+
+### `GET /v1/language/setup`
+
+```json
+{
+  "sites": [
+    {"key": "journal", "name": "Journal", "locale": "en", "article_count": 8, "suggestion": {"lang": "en", "substituted": false}},
+    {"key": "notes", "name": "Notes", "locale": null, "article_count": 3, "suggestion": null}
+  ],
+  "available": [{"lang": "en", "substitute": null}]
+}
+```
+
+`sites` lists the pending sites by id. `suggestion` comes from `Site.Locale` and keeps the region (`pt-BR` stays `pt-BR`); `substituted` is true when only the broader tag is supported (`fr-BE` gives `fr`). `suggestion` is `null` without a locale or without a supported language. An empty `sites` list means nothing is pending.
+
+### `POST /v1/language/setup`
+
+```json
+{"sites": [{"key": "journal", "lang": "en"}, {"key": "notes", "lang": "en"}]}
+```
+
+200 with `{"assigned": 16, "sites": [{"key": "journal", "lang": "en", "assigned": 8}]}`. `assigned` counts the articles that got a language (soft-deleted ones included). `sites` lists the sites confirmed by this call. The default language is created enabled and confirmed, the seeded unconfirmed row is replaced, and every article without a language takes the tag. Nothing is translated, linked or moved. Sites that already have a confirmed default are skipped, whatever tag is asked for, so a retry answers 200 with `assigned: 0`.
+
+| Status | Body | When |
+| --- | --- | --- |
+| 400 | body-mismatch message | no `sites` key or malformed JSON |
+| 404 | `site_not_found` | a key does not exist |
+| 409 | `setup_in_progress` | another setup holds the site locks (nothing applied) |
+| 422 | `invalid_language` / `unsupported_language` | a bad `lang`, empty included |
+| 422 | `duplicate_site` | the same key twice |
+| 422 | `setup_incomplete` | a pending site is missing from the request |
+| 500 | `Internal server error` | a write failed; everything is rolled back |
+
+All sites are applied in one transaction. Site rows are locked in ascending id order without waiting; a busy lock is `setup_in_progress`. The pending list is read again after the locks and any site that became pending in between is locked too, until the list is stable, so a site created while a setup starts is never left half handled.
+
+The 200 body also has `skipped`: the keys, sorted, of requested sites that already had a confirmed default and were left untouched (always present, `[]` when none). Their requested `lang` is ignored, never applied.
+
+```json
+{"assigned": 3, "sites": [{"key": "notes", "lang": "fr", "assigned": 3}], "skipped": ["journal"]}
+```
+
+## Lock contention
+
+Every locking path of `PUT /v1/site/{key}/languages` and `POST /v1/language/setup` runs inside the transactor. A lock that cannot be taken in time (SQLite `SQLITE_BUSY`/`SQLITE_LOCKED`, MySQL 3572 and 1205, PostgreSQL `55P03`) is recognised once, by the database driver, and reaches the use case as `transaction.ErrLockContention`. The PUT answers 409 `languages_changed` and the setup answers 409 `setup_in_progress`. Nothing is applied and a retry is safe. It is never a 500.
+
+## SQLite does not lock rows
+
+The pinned SQLite driver (`github.com/glebarez/sqlite`) drops the `FOR UPDATE` clause: the `SELECT ... FOR UPDATE [NOWAIT]` that locks a site row on MySQL and PostgreSQL is a plain read on SQLite. SQLite instead serializes writers on the whole database: a second writer waits up to the 5 s busy timeout and a transaction that read before another one committed fails with `SQLITE_BUSY` when it tries to write. Both outcomes keep the data consistent and the busy failure is answered as lock contention above. `test/localization_concurrency_test.go` pins the statuses (200 or 409, never 500) for a PUT racing a site creation and for two simultaneous setups.
+
+## Activity log
+
+Both writes are recorded in the `sites` category, once after the commit and never for a read or a no-op:
+
+| Action | Target | Changes and params |
+| --- | --- | --- |
+| `site.languages_edit` | the site | `default_language` (before, after) when the default changed, `languages` (before, after: tags sorted, `(off)` for disabled, `[social_locale]`). A PUT that changes nothing records nothing. |
+| `site.language_setup` | one event per site confirmed by the POST | `default_language` ("" to the tag), param `assigned` (articles that got the language) |
+
+A refused call is recorded as a failed event with a plain reason (for example "The languages changed since they were read."). An unknown site key is not recorded.
+
+## Public URL pattern
+
+`public_url_pattern` is a string or `null` on every site JSON (`GET /v1/site/`, `POST`, `PATCH`). It is read with the existing list and written with the existing `PATCH /v1/site/{id}` (owner). No new route. A `PATCH` without the key leaves it unchanged; `null` or `""` unsets it; surrounding spaces are trimmed.
+
+Validation, in this order, answers 422 with the code as plain text: `invalid_pattern` (more than 512 characters), `invalid_scheme` (not `https://` or `http://`), `invalid_host` (no host, for example `https:///{slug}`), `unknown_placeholder` (anything between braces other than `{lang}` and `{slug}`, or a stray brace), `not_encoded` (a space, a non-ASCII character or other character that needs URL encoding; `%XX` sequences are fine), `missing_slug` (no `{slug}`). Repeated placeholders are allowed. Saving the pattern changes no article, canonical URL or public response, and is recorded in the activity log as the `public_url_pattern` field.

docs/architecture.md

@@ -94,9 +94,11 @@ The use cases `ListAuthors`, `CreateAuthor`, `CreateMyAuthor`, `UpdateAuthor`, `
 
 `internal/domain/slug` holds the one slug rule (`Generate`, `WithSuffix`, `IsValid`: lowercase, accents folded, runs of other characters become one dash, 100 characters, a caller-chosen fallback). `internal/domain/article` uses it with the fallback `article` and holds the twelve SEO fields of `Article`, the `Update` fields for them (`Nullable` for the two image ids), `ValidateCanonicalURL`, the eleven dismiss codes and `NormalizeDismissed`, and the sentinels `ErrInvalidSlug`, `ErrSlugTaken` and `ErrInvalidCanonicalURL`. `*SlugTakenError` wraps `ErrSlugTaken` and carries the suggested free slug; the handler turns it into the `X-Slug-Suggestion` header of the 409. `author.GenerateSlug` delegates to the same package.
 
-Slugs are unique per site, enforced by the unique index `idx_articles_site_slug` on `(site_id, slug)`. The use cases decide first: `CreateArticle` generates the slug from the title and takes the first free `-N` on the default site (retrying when the repository reports a race), `UpdateArticle` re-checks the slug on the target site for an edited slug, an empty slug (regenerated from the title) and a move, and computes the suggestion as the first free `-N` from 2, fitting 100 characters. `ArticleRepository` locks the site row, checks the slug inside the transaction and re-explains a failed write as `ErrSlugTaken`. Deleting an article replaces its slug with the tombstone `#deleted-<id>` (it can never match a valid slug) before the soft delete, so the slug is free again while the unique index keeps covering soft-deleted rows.
+Slugs are unique per site and language, enforced by the unique index `idx_articles_site_slug` on `(site_id, lang, slug)` (the name is kept from the earlier `(site_id, slug)` index, which the migration replaces once, tracked by the `article_slug_index_per_language` marker). Each article belongs to a story (`stories` table) and a second unique index `idx_articles_story_lang` on `(story_id, lang)` allows one version per language per story; both indexes are created after the `article_stories` backfill marker, which gives every pre-existing article its own story. `site_languages` holds one default language per site, seeded once from `Site.Locale` as an unconfirmed suggestion (`site_language_suggestions` marker). `CreateArticle` owns the rule that a new article takes the confirmed default: it runs through `transaction.Transactor`, locks the site row (`site.Repository.LockSite`), reads the site's language rows through the `localization.Repository` port, lets `localization.ConfirmedDefaultTag` pick the confirmed default tag (or `""` while it is unconfirmed), picks the free slug for that language and calls `Create` with the resulting `Lang`, all in one transaction. `localization.Repository` is the only port for site languages; the former `language.Repository` and its `SiteLanguageRepository` adapter are gone. When the site row is gone by then (deleted after the use case looked it up), the use case answers `article.ErrTargetSiteDeleted` (`409 target_site_deleted`) instead of the lookup's `404`. `ArticleRepository.Create` only stores what it receives, checks that a given story row exists and opens the new story in the same transaction (the story rolls back with the article, `content_revision` starts at 1). `ApplyLanguageSetupUseCase` confirms a default and assigns the unassigned articles under the same site locks (taken with `NOWAIT`), so no article is left unassigned once the confirmation commits. The one-default-per-site invariant lives in the domain (`localization.Plan` builds rows with one default, `localization.RequireSingleDefault` checks it before `UpdateSiteLanguagesUseCase` writes); `LocalizationRepository.Replace` only writes the rows it receives. `article.Repository.SlugTaken` takes the language, matching the index. The use cases decide first: `CreateArticle` generates the slug from the title and takes the first free `-N` on the default site (retrying when the repository reports a race), `UpdateArticle` re-checks the slug on the target site for an edited slug, an empty slug (regenerated from the title) and a move, and computes the suggestion as the first free `-N` from 2, fitting 100 characters. `ArticleRepository` locks the site row and leaves uniqueness to the two indexes: each driver says whether an error is a unique violation (`Driver.IsUniqueViolation`: SQLite extended codes `2067` and `1555`, MySQL `1062` and `1586`, PostgreSQL `23505`, behind `database.IsUniqueViolation`), and the repository then re-reads which rule was hit and returns `ErrSlugTaken` or `ErrLanguageTaken`. `PATCH /v1/article/{id}` is one atomic edit: when it moves a story (the caller reads one version of a larger story), `UpdateArticleUseCase` depends on the `StoryMover` port and runs the move of the other versions and its own field edit in the single transaction of `MoveStoryUseCase.MoveStoryThen`, so a refusal after the move step moves nobody and changes no revision. Validation that needs no lock (authors, SEO fields, slug rules and the slug of the target site) runs before the transaction. Row locks are taken site first (ascending ids), then article rows (`ArticleRepository.Update` finds the site with a read outside its transaction, because a read inside would open the snapshot that MariaDB 11 then holds against the locked row, and re-checks the site after locking the article), in `ArticleRepository.Update`, `Create`, `Delete`, `CreateTranslation` and the story move, so a slug edit cannot deadlock a move; the move re-reads and re-locks until the set of sites of the story is stable. Publish and `UpdateBody` are targeted `UPDATE`s of their own columns (plus `updated_at`), so they never overwrite a concurrent edit and never touch the revisions. Driver lock errors (PostgreSQL `55P03`, `40P01` and `40001`, MySQL `3572`, `1205` and `1213`, MariaDB `1020` raised by its snapshot isolation) all become `transaction.ErrLockContention` (`409 story_busy`). SQLite ignores `FOR UPDATE`: there the single writer plus the compare-and-set on `edit_revision` in `writeArticleColumns` are what keep concurrent edits correct, not the row locks. Deleting an article replaces its slug with the tombstone `#deleted-<id>` (it can never match a valid slug) before the soft delete, so the slug is free again while the unique index keeps covering soft-deleted rows. `DeleteStoryUseCase` (`DELETE /v1/story/{story_id}`) refuses a caller whose `content.delete` is not at scope `all` before reading anything, locks every site of the story (re-reading until the set is stabLine truncated
 
-`database.Migrate` adds the columns with `AutoMigrate`, then runs `BackfillSiteTitleTemplates` and `BackfillArticleSlugs` (only rows with an empty slug, in id order, per site, applying the same rule and the same suffixes, with the tombstone for soft-deleted rows) and only then creates the unique index, so it is idempotent and completes a partly backfilled table. The default `title_template` is written by the backfill and the seed, not by a column default, because the SQLite migrator rebuilds the table on every start when the default contains `%` and `|`.
+The article persistence is split into ports by use: `article.Repository` (single versions and writes), `article.StoryReader` (the editorial list by story: pages, counts, versions of a page) and `article.SEOIndex` (the stored SEO status: `StaleSEO`, `StoreSEO`, `MarkSiteSEOStale`). `article.ListingRepository` joins the three for `ListArticlesUseCase`, the only use case that needs all of them; `ArticleRepository` implements every port, and `transaction.Repositories` exposes `ArticleSEO` so a transaction that changes the default language can clear the statuses of its site. The rules that compute the status stay in the use cases (they parse HTML through `golang.org/x/net/html`), so the repositories only clear and store it; see [performance.md](performance.md#the-seo-article-filter).
+
+`database.Migrate` first sets `source_revision` to `0` where an older nullable column holds `NULL` (`BackfillNullSourceRevisions`, a no-op once no `NULL` is left), so `AutoMigrate` can make it `NOT NULL`; it then adds the columns with `AutoMigrate`, then runs `BackfillSiteTitleTemplates` and `BackfillArticleSlugs` (only rows with an empty slug or a duplicate within the same site and language, in id order, per site and language, applying the same rule and the same suffixes, with the tombstone for soft-deleted rows) and only then creates the unique index, so it is idempotent and completes a partly backfilled table. The default `title_template` is written by the backfill and the seed, not by a column default, because the SQLite migrator rebuilds the table on every start when the default contains `%` and `|`.
 
 Media usage has more sources than article bodies: `Article.CoverImageID` and `SocialImageID`, `Author.AvatarID` and `Site.DefaultSocialImageID`. `ListMedia`, the purge plan and `GetMediaUsage` count an article once however many places use the image. `DeleteMedia` clears the cover and social references (`article.Repository.ClearImage`, restored with `RestoreImage` when the delete fails), `MergeMedia` repoints them (`RepointImage`) and counts an article rewritten in its body and its cover once, and `GetMediaUsage` (now built with the site and author repositories) returns articles, authors and sites with `type` and `fields`.
 

docs/custom-content-types.md

@@ -12,7 +12,7 @@ A content type is a named schema (a key, a name and 1 to 50 fields) stored as on
 
 The domain packages `internal/domain/contenttype` and `internal/domain/entry` own the rules: key, name and field validation, entry validation against a schema, the sort whitelist, the page limits and the value equality used by uniqueness. The use cases orchestrate them through the two repositories. The repositories only store and load rows. Entry counting for the "type still has entries" rule lives on the entry repository.
 
-## Known limitations of phase 1
+## Known limitations
 
 - Uniqueness and schema re-validation are O(n). Checking a unique field loads every entry of the type and compares values in Go, and updating a type with stored entries loads all of them to re-validate. This keeps the SQL portable across SQLite, MySQL/MariaDB and PostgreSQL. The path to fix it is the filterable-fields phase: project the values of unique and filterable fields into an indexed table, so uniqueness becomes an indexed lookup and re-validation can be restricted to the changed fields.
 - Unique values are checked without a transaction, so two concurrent writes of the same unique value can both succeed. A content type key is protected by a unique index, and a violation is reported as `content_type_key_taken` (409).

docs/deployment.md

@@ -45,7 +45,7 @@ Once the restart helper is installed (it writes `update-helper.json` next to `DB
 
 The owner's Restart button installs a downloaded update, or just restarts the site, without touching the server by hand. The app itself stays unprivileged: the systemd unit below keeps `ProtectSystem=strict` and only the data directory (the directory that holds `DB_FILE`) is writable. The only privileged code is a small helper, the same binary started as `renewcms apply-update` by a systemd service that runs as root.
 
-First install v2.6.0-beta or newer manually, back up the database, uploads and current binary, and confirm the app runs as an unprivileged service user. The binary and its parent directory should be controlled by root. Owners can start updates and restarts; admins have read-only update status.
+First install the helper manually, back up the database, uploads and current binary, and confirm the app runs as an unprivileged service user. The binary and its parent directory should be controlled by root. Owners can start updates and restarts; admins have read-only update status.
 
 #### Find the actual database directory
 
@@ -121,7 +121,7 @@ On the latest release you can test only a plain restart. Test installation, forc
 - **Restart is missing:** reload Settings, confirm you are owner, and inspect `GET /v1/system/update` in the browser's Network panel. For an idle owner, `can_apply: false` means the app did not detect the helper. Check that `update-helper.json` is beside the actual database and readable by the service user.
 - **Wrong helper directory:** disable the helper with the old `--data-dir`, then enable it with the correct directory and port. Do not change `DB_FILE` to compensate.
 - **Overlay does not clear:** inspect the helper journal, `update-result.json` and `update-running.json` in the actual database directory. Check localhost health on the configured port, then public health through the proxy. Do not cache `/healthz` at the proxy.
-- **Old binary panics on `--version`:** older releases may interpret it as normal startup and require server environment variables. v2.6.0-beta and newer print their version without loading configuration. A separately launched process failing this way does not stop the systemd service.
+- **Old binary panics on `--version`:** releases before v2.6.0-beta treat it as normal startup and require server environment variables. A separately launched process failing this way does not stop the systemd service.
 - **Download or verification fails:** inspect the app journal. All assets and redirects must use HTTPS on the configured feed host. The release must include the six binaries, `checksums.txt` and `checksums.txt.sig`.
 - **Update rolls back:** check the previous version and helper journal. Automatic rollback restores the binary, not the database; schema changes still require a recovery plan.
 
@@ -159,7 +159,7 @@ What is supported and what is not:
 
 #### Verification status
 
-A real v2.6.0-beta plain browser restart was confirmed on Linux/systemd on 2026-10-02: the path unit triggered the helper, a new server process started, the result was `succeeded`, and public health returned `ok`. Real signed installation, forced rollback and adversarial filesystem checks remain unverified. The manual cases are listed in [the restart QA procedure](../features/updates_restart_helper.qa.md).
+Only the plain browser restart has been confirmed on a real Linux/systemd machine. Signed installation, forced rollback and adversarial filesystem checks remain unverified; the manual cases are in [the restart QA procedure](../features/updates_restart_helper.qa.md).
 
 ## 2. Lay out the server
 

docs/design/README.md

@@ -1,156 +1,40 @@
-# RenewCMS design pass 2
+# RenewCMS design
 
-Nuxt UI v4 back-office. Tokens only, no raw hex (brand mark excepted). Light and dark. 1440×900 and 390×844. Radius 0.
+Nuxt UI v4 back-office. Tokens only, no raw hex (the brand mark excepted). Light and dark, at 1440×900 and 390×844. Radius 0. Behaviour comes from `features/`; where the two disagree, stop and ask.
 
-## Boards
+## Files
-- `RenewCMS Screens Back-office.dc.html`: every back-office screen, Settings → Media (variants, cache), and the group "States matrix: controls". Frames: `AppFrame` (shell), `DirectoryFrame` (Sites and Authors), `ActivityFrame`, `MediaFrame`, `VariantsFrame`, `IntegrationPage`, `IntegrationSearch`, `IntegrationImages`, `CodeSnippet`, `StatesMatrix`.
-- `RenewCMS Screens Auth.dc.html` (7 groups, 50 states), `RenewCMS Screens API keys.dc.html` (12 states).
-- `RenewCMS Prototype.dc.html`: updated to match (title-only New article, no body limit or counter, neutral count, pagination, link button, AppFrame's mobile drawer).
-- Unchanged: Foundations, Components, Handoff, Directions and Emails boards.
 
-## Pass 3: sites and authors (revised)
+| File | Content |
-Roles, decisions and the slice order are in `sites-authors-slices.md` (Sites and Authors) and `seo-slices.md` (SEO).
+| --- | --- |
+| `routes.md` | Routes with their auth requirement. |
+| `components.md` | Component inventory with its Nuxt UI mapping, then the full component specs. |
+| `states.md` | Every state per screen, plus the HTTP-status-to-copy table. |
+| `screens/<screen>.md` | Exact copy per state. `visual:check` takes the screen name from the file name. |
+| `foundations.md` | Tokens, spacing, type and contrast. |
+| `emails.md` | The mail templates. |
+| `decisions.md` | Product and interface decisions that are not visible in the specs: search and sharing, sites and authors, roles, account self-service and the interface defaults. |
+| `media-field.md` | Spec of the Media field type: control, states, copy, accessibility and API. |
+| `source/` | The raw export. The `.dc.html` boards are the visual reference, to open in a browser. `tokens/` and `emails/` hold the ready-to-use token and template files. |
 
-Back-office board groups: Sites, Sites: form, Sites: delete, Authors, Authors: form, Authors: delete, Editor: site and authors, Profile: author profile, Articles: sites and authors. Plus tables: decisions to confirm (13 rows, 5 marked Decided), deviations, API and errors (with the 403 rows), components, accessibility, copy per state.
+## Boards (in `source/`)
-- Roles: only creating, editing, deleting and setting the default site are owner only (no sidebar entry or Publishing card for others, 403 page on a direct link). Anyone who can edit an article can set its site and read the site list. Authors: owner and admin manage; other roles read-only, and any role can create and edit their own author (user link locked, no delete).
-- The site key is immutable: read-only with a lock in the edit form; the warning state and dialog are gone.
-- The "Author profile" card is drawn in every existing Profile frame. The "Site and authors" section shows collapsed in every existing Editor frame that has the details sidebar (39 already did; the Loading frame now shows the header with a skeleton summary). The Not found frame has no editor, and on mobile the section is inside the Details sheet. The dedicated groups keep only the feature-specific states.
-- Shared pieces (list, slide-over, delete-with-reassign dialog, slug field, media field) are defined once in `DirectoryFrame`, used by Sites and Authors. The Profile card is defined once in `AppFrame`.
-- States trimmed from 87 to 68 (Sites 9, Sites: form 7, Sites: delete 3, Authors 8, Authors: form 11, Authors: delete 6, Editor: site and authors 16, Profile: author profile 5, Articles: sites and authors 3). Dropped: in-progress and done variants (covered by the button loading pattern and the confirm state's trigger), per-error URL variants, the site picker (same picker as the avatar), manual slug override, long names (merged into Many authors), per-field duplicates. The blocked-delete dialog is one frame, "Server fallback (409)".
-- Only individual states that render a relative time or a countdown carry the "Clock-sensitive" tag (13 states, listed in states.md). No Home or Articles frame is tagged as a whole.
-- Role-restricted variants drawn: read-only Authors list and detail, hidden Sites entry, Sites 403, own-author edit.
 
-## Pass 4: custom content types
+- `RenewCMS Screens Back-office.dc.html`: every back-office screen, with the frames `AppFrame` (shell), `DirectoryFrame` (Sites and Authors), `ActivityFrame`, `MediaFrame`, `VariantsFrame`, `IntegrationPage`, `IntegrationSearch`, `IntegrationImages`, `CodeSnippet` and `StatesMatrix`.
-Board `RenewCMS Screens Schema.dc.html` (frames: `SchemaFrame`, mounted in `AppFrame`): 11 groups, 99 states. 1 Schema list 7, 2 Schema builder 19, 3 Review and delete 9, 4 Field types 7, 5 Content and entry list 12, 6 Entry editor 23, 7 Relations 5, 8 Permissions 2, 9 Export and import 3, 10 Media picker for a field 8, 11 Media library usage 4. The Media field type (pass 5) is specified in `media-field-changes.md`; the exact copy and measurements are there, and the boards are the visual reference. Plus tables: scope, routes, new components with their Nuxt UI mapping, errors to copy, needs backend (4 rows), decisions to confirm, accessibility. Specs: screens/schema.md, content.md, entry.md, schema-later.md, media.md, media-picker.md, and media-field-changes.md for the Media field type.
+- `RenewCMS Screens Auth.dc.html`: log in, register, pending, verify, accept invite, forgot and reset password, verify new email, account deleted.
-- AppFrame gains a Schema item (owner and admin) and a Content group (sidebar and mobile drawer). Nothing else in AppFrame changed.
+- `RenewCMS Screens API keys.dc.html`.
-- Backend gaps still open: built-in types and fields, display names for created_by and updated_by, a type icon, per-change entry counts.
+- `RenewCMS Screens Roles.dc.html`: the role editor, users and ownership (`RolesFrame`, data `roles-spec.js`).
-- Not done: Back-office and Prototype boards were not compared visually after the sidebar change (see Checks below).
+- `RenewCMS Screens Schema.dc.html`: custom content types, entries, relations and the Media field (`SchemaFrame`).
+- `RenewCMS Screens Account.dc.html`: change email, export your data and delete your account (`AccountCards`, copy in `account-copy.js`).
+- `RenewCMS Emails.dc.html`, `RenewCMS Foundations.dc.html`, `RenewCMS Components Primitives.dc.html`, `RenewCMS Components Product.dc.html`, `RenewCMS Handoff.dc.html`, `RenewCMS Directions.dc.html` and `RenewCMS Prototype.dc.html`.
 
-## Specs
+Every state has a desktop and a mobile frame, and the theme switch gives light and dark. States that render a relative time or a countdown are tagged clock-sensitive in `states.md` and skipped by `task visual:check`.
-routes.md · components.md · states.md · foundations.md · change-list.md · activity-spec.js · screens/*.md (24 files)
 
-## Status
+## Known gaps
-| Section | Status |
-|---|---|
-| A1 Activity export | Done: CSV only, synchronous; progress state removed; JSON proposed |
-| A2 Pagination `page`/`size` | Done in frames, routes.md, change-list.md |
-| A3 Unknown variant and unsupported parameter | Done: both 400 bodies in the Responses table |
-| A4 New tokens | Done: foundations.md table |
-| A5 screens/*.md | Done: 22 files, copy generated from the board source |
-| B1 Editor link | Done: 11 states |
-| B2 Duplicates | Done for sidebar, topbar, drawer, code block, modal geometry; see Not done |
-| B3 CodeSnippet | Done |
-| B4 Overlays | Done |
-| B5 Prototype | Done |
-| B6 Contrast and states matrix | Done for the pairs listed; matrix drawn |
-| B7 Consistency sweep | Done for the roles listed |
-| B8 Copy glossary | Done by search; not every line re-read |
-| B9 Media and picker | Badge added; Media pagination drawn (9 states); filter, sort and size not folded in |
-| B10 "proposed" labels | Only article pagination and JSON export |
 
-## State counts (Back-office board: 341 before pass 3, plus 68 for sites and authors = 413)
+- The Foundations, Components and Prototype boards do not show the account self-service pieces or every newer token.
-| Group | States |
+- Duplicate implementations that look alike are not merged in code: toasts, badges, empty states and modal shells.
-|---|---|
+- The Back-office board still shows the owner, admin and user navigation. Writer frames use the restricted `user` navigation of `AppFrame`.
-| Boot | 1 |
+- The Schema board group 8 (Permissions) is superseded by the role editor, and `/settings/permissions` redirects to `/settings/roles`.
-| Home | 10 |
-| Articles | 14 |
-| Articles: pagination | 11 |
-| New article | 5 |
-| Editor | 41 |
-| Media | 56 |
-| Media picker | 13 |
-| Integration | 8 |
-| Activity | 9 |
-| Activity: filter cards | 10 |
-| Activity: export | 15 |
-| Activity details | 6 |
-| My activity | 3 |
-| Users | 17 |
-| Settings | 25 |
-| Settings: Media cleanup | 9 |
-| Purge dialog | 8 |
-| Purge results | 2 |
-| Media duplicates entry | 2 |
-| Settings: Retention | 6 |
-| Profile | 13 |
-| Global | 4 |
-| Integration: images | 9 |
-| Settings navigation | 5 |
-| Variants list | 12 |
-| Add edit variant | 11 |
-| Media library (variants) | 6 |
-| Image detail | 8 |
-| Cache panel | 10 |
-| Editor picker | 5 |
 
-Back-office total 341 (pass 2 groups, table above) + 68 (sites and authors) + 4 (Media: used elsewhere) = 413. Auth board 50 (Log in 9, Register 6, Pending 6, Verify 6, Accept invite 10, Forgot password 6, Reset password 7). API keys board 12. Total 481 states; every one has a desktop and a mobile frame, and the theme switch gives light and dark. The matrix has 24 control rows, 5 states on desktop and 4 on mobile (no hover). screens/*.md list the states of the pass 2 groups and the 68 pass 3 states.
+## Article localization baseline (refreshed 2026-11-03)
 
-## Fixes applied (pass 2)
+Start with [localization.md](localization.md) (authority, integration rules, open decisions, third-pass decisions), then [localization-tables.md](localization-tables.md) (generated from `source/locale-spec.js`), [localization-corrections.md](localization-corrections.md) (what the corrections pass rendered and left open) and [localization-changelog.md](localization-changelog.md) (state IDs and copy changed by the third pass). States are indexed in `states.md` and `screens/localization-*.md` (8 files, 183 states in 16 groups; L6 and L9 are release 2). The Articles list pixel gate is group L7s (single-language site) and L7 (several languages), not the Back-office Articles groups. References: `source/RenewCMS Screens Localization.dc.html`, `LocaleFrame.dc.html` (drawn inside the shared `AppFrame`), `locale-spec.js` and `locale-fixtures.js`. The LocaleLive prototype was not imported, and the Prototype board does not demonstrate localization.
-1. Activity export dialog: removed the 42% progress bar, the "large export" state, the server-job copy and the "ready later" toast; added "Preparing download…" (indeterminate), "Download started", failed, nothing to export, 403; CSV only, with one proposed JSON state.
-2. Export dialog and menu copy now match the implemented endpoint (current view with filters, all with optional range).
-3. Articles pagination used `per_page`, sizes 10/25/50, default 10, 32 pages. Now `page`/`size`, 5/25/50/100, default 25, 13 pages; frames, route, URL examples and the change list updated.
-4. The Integration responses table now shows both 400 bodies, `unknown_variant` and `unsupported_parameter`.
-5. `--rc-sand` and `--rc-on-sand` (and the other `--rc-*` tokens) documented as new tokens with light and dark values and their uses.
-6. Raw colours removed from frames: crop handles and mask, tooltip, transparency checker, drag-drop text, selected-row text in MediaFrame, hex in the Prototype. Only the brand mark keeps hex.
-7. ActivityFrame, MediaFrame and VariantsFrame sidebars, topbars and (Variants) mobile drawer deleted; they render inside AppFrame. Activity now follows the sidebar order (Users, Activity, Integration, Settings).
-8. Prototype's own mobile drawer (Home, Articles, Users, Integration only) replaced by AppFrame's drawer.
-9. All code blocks on Integration (auth example, endpoint examples, error response), the base URL, the image URL builder and the one-time API key use CodeSnippet; the three older block styles are gone. CodeSnippet tabs changed from sand pills to the underline style used by tabs elsewhere.
-10. Variant form: mobile full page replaced by a 92% bottom sheet with grabber and close ×; back arrow removed.
-11. Dialog geometry unified (140 px top offset on desktop, flush bottom sheets with grabber on mobile, header 20 24 0, footer secondary left and primary right, close × 44 px on mobile). Changed: Media and Variants dialogs (mobile inset), Activity export (centered, header bar, 480 wide), API keys dialogs (border, 18 px title, 44 px buttons, 120 px offset).
-12. Current page in the paginator: border `--ui-primary` instead of sand (was 1.3:1).
-13. Page padding 24/16 everywhere (was 32 and 24); card padding 16 (was 16 and 20); section gap 16 (was 16, 20, 28); page title 20/28 (was 28/36, 24/32, 20/28); stat figure 24/32; card title 15/24; inputs 32/44 (were 40); one 13 px icon became 14; toast width 356 (was 360, 372).
-14. Copy: "Removed N …" in activity lines became "Deleted N …"; export titles and footers per the glossary.
-15. Media screen: variant count badge added to grid card, list row and mobile row, matching the Variants board.
-16. Editor toolbar on mobile was a cut-down 9-button subset; it now has the full toolbar with sideways scroll and edge fades.
-17. Editor words and characters show "0 words · 0 characters" for a new empty article (was a fallback sample count).
-
-## Defaults chosen
-- Slide-over rule: only forms with a live preview and record details; on mobile always a 92% bottom sheet.
-- Hover, active, disabled and focus tokens for the matrix (components not specified before): primary hover `--ui-text`, active `--ui-text-toned`; destructive hover opacity 0.85 and active 0.75; disabled 40% (rows 55%).
-- Article pagination: Shipped shapes: the article list body is {items, total, page, size, counts}; the media list body is an array with the total in `X-Total-Count`. Users and authors follow their own routes (see routes.md).
-- The Remove action in the link popover has no confirmation; undo restores the link.
-- The link button is disabled when an image is selected.
-- The tooltip text is "Insert link (Ctrl+K)" and "Insert link (⌘K)" on macOS.
-- Mobile toolbar scrolls sideways; no wrap, no overflow menu.
-- Selected nav items keep the sand fill plus weight 500 and `aria-current` (the fill alone is 1.3:1 in light).
-- Syntax colouring dropped from code samples (one rendering).
-- Export "Download started" offers only Close.
-- New article keeps the title counter "n / 200" (title is limited to 200); the body has no limit and no counter.
-- Page title 20/28, page padding 24/16, card padding 16 (foundations.md).
-- Activity position in the sidebar follows AppFrame.
-- The Prototype shows a toast "Not in this prototype" for sidebar items it has no screen for (Media, Activity, Settings).
-
-## Checks run
-- Opened `RenewCMS Screens Back-office.dc.html` in the preview: it loaded, 38 sections rendered, and I read the DOM of the Activity, Export, Media, Variants, Editor, Integration, Pagination, Picker, Editor picker and States matrix groups to confirm the frames render text and the sidebar. I did not read the console.
-- Computed the contrast table from token values with a script.
-- Searched frames and boards for raw hex and rgb values (only token definitions on the board roots and the brand mark remain), for exclamation marks, Remove and Delete, Update and Save, and per_page.
-- Generated screens/*.md and counted states from the board source; the counts equal the DOM counts for the Back-office board.
-
-## Not done
-- Console errors on the Auth, API keys, Prototype, Foundations and Components boards were not read by me. The delivery check covers the Back-office board; the other boards use the changed frames (AppFrame, ApiKeysPage, AuthCard, MediaFrame) and may need a look.
-- Light and dark were checked for the Back-office board by reading DOM only; I did not view the screenshots of each state at 1440 and 390, so visual regressions from the shell change (slot mode) are possible.
-- Media screen: the "With variants / Without" filter, the "Largest total size" sort and a total-size column exist only on the Variants board states; they are not folded into the Media toolbar.
-- Media picker tiles and the Editor picker were not compared field by field.
-- Duplicated implementations that look alike are not merged in code: toasts (5), badges (2), empty states (2), modal shells (4). Only their visuals were aligned.
-- Hover, active and focus-visible are drawn once in the matrix; screens do not redraw them. Hover and active tokens for destructive buttons use opacity, not a token.
-- Contrast was not computed for every hover and active background, only the pairs listed in foundations.md.
-- The glossary pass was a search for known patterns, not a line-by-line read of every string. Titles in Title Case were not searched.
-- The Components, Handoff and Foundations boards were not updated to mention the new tokens, CodeSnippet or the matrix.
-- Integration still lists "max 10000" for article bodies, as the backend does today (change-list item 11).
-- The sandbox cannot export; no files were bundled.
-
-## Pass 5: roles and permissions
-Board `RenewCMS Screens Roles.dc.html` (frame `RolesFrame`, data `roles-spec.js`): 16 groups, 96 states, all Available now (pass 6 added groups 12 to 15 and changed groups 5, 8 and 9; see change-log-roles-sync.md). Spec `screens/roles.md`; additions in components.md, states.md, routes.md, change-list.md. The Permissions grid is folded into the role editor and `/settings/permissions` is retired. Writer frames use AppFrame's existing restricted `user` navigation. Not done: AppFrame itself is unchanged, so the Back-office board still shows owner/admin/user nav; Schema board group 8 (Permissions) should be marked superseded.
-
-The Schema board group 7 (Relations) now has 4 states; the Integration page and the Activity category filter follow the roles sync (see `change-log-roles-sync.md`).
-
-## Sync notes (app sync)
-- Back-office board: +4 Media states (Used elsewhere: avatar, site, both, none). Roles board: +6 states (group 12b Remove user).
-- Pagination: articles return {items, total, page, size, counts}; media returns an array with X-Total-Count.
-- Event names follow the backend: role.create, role.edit, role.delete, role.reassign, user.change_role, user.transfer_ownership, user.remove.
-- Counts above include the Media (+4) and Roles (+6) states only. States added this round to the Editor, Articles, Sites, Authors, Profile and Schema groups are on the boards and in the screens files, and are not yet recounted here.
-
-## Pass 7: account self-service (email, export, delete)
-Board `source/RenewCMS Screens Account.dc.html` (33 states: change email 14, export 9, delete 10), Auth board groups "Verify new email" (7) and "Account deleted" (1), four email templates in `source/emails/` (previews on the Emails board). Specs: `screens/account.md`, `emails.md`, `routes.md`, `components.md`, `states.md`. Frames: `source/AccountCards.dc.html` (new; copy in `source/account-copy.js`), `AppFrame.dc.html` (Profile hooks, modal list, warning, link and disabled confirm). Every Profile frame on the other boards shows the new cards in their default state. English only.
-Decided: authored content is anonymized to "Deleted user"; email-change link 2 hours; export link 24 hours, one export per 15 minutes; direct download is the primary export flow, the emailed link is the documented alternative; the export-ready link needs a logged-in session; "last administrator" counts Owner; a change request for an address already in use answers like success; the account-deleted email goes to the address the account had.
-Not done: Foundations and Components boards and the Prototype are not updated. The 15-minute rate-limit state is clock-sensitive (frozen clock 09:41) and is skipped by `task visual:check`.

docs/design/change-list.md

@@ -1,122 +0,0 @@
-# Change list for implementation (status after pass 2; SEO round drawn; cleanup round drawn)
-
-## Cleanup round
-
-1. Editor: site and authors, "Create author" states (4 states, desktop and mobile): the mobile dialog sat under the Details sheet (z-index 50 against 55) and was hidden. It now stacks above the sheet (z-index 60), as the SEO panel does. Full-width bottom sheet with grabber, same fields, Cancel left and "Create author" right (Cancel below on mobile, as the other mobile dialogs). Frame: `DirectoryFrame.dc.html`. The four states share the fix: dialog, "for me", slug taken, failed.
-2. Integration, "6. Errors": the 403 row gets the muted note "Site SEO defaults are owner only. Article SEO fields need only the right to edit the article." The row below shifts down by the wrapped note height (two 18 px lines desktop, three mobile, plus the 2 px row gap). The old inline parenthetical with the same sentence in the 403 cause text was removed, so it isn't said twice. Frame: `IntegrationPage.dc.html`.
-3. Integration, sitemap errors: 404 now shows the body `site_not_found` in code style (was "Site not found"); 400 now shows the generic body-mismatch text used by the other routes (was "Invalid page or size.").
-4. New groups on the Back-office board: "Sites: pagination" and "Authors: pagination", 10 states each (20 states, every one desktop and mobile; light and dark by the theme switch). Back-office total 409 → 429. Same pager as Articles and Media, sizes 5, 25, 50, 100, default 25 (no difference to report). One deviation: on a single page the page-size select is hidden and only "N sites" or "N authors" remains.
-5. Specs: screens/sites.md, screens/authors.md (pager states, URL rules, out-of-range fallback), screens/integration.md, states.md (pagination states, three HTTP rows), components.md (single-page variant, no new component), routes.md (Sites pagination in the URL).
-
-**Backend assumptions to confirm.** GET /v1/site/ takes `q`, `page`, `size` and returns `X-Total-Count` (it returns every site today). GET /v1/author/ gets `page`, `size` and `X-Total-Count` (it has `q`).
-
-**Open points.**
-- Sites has no search field. The two states that need one (empty after search, search resets to page 1) draw the Authors field on Sites with "Search by name or key". Drop those states if you don't want search on Sites.
-- Stale copy found, not changed: GET /v1/article/ on Integration still shows the 400 caption "Invalid page or size." while every other route, and now the sitemap, uses the body-mismatch text. The 404 row of the Errors table still lists only the four resource messages and doesn't mention `site_not_found`. The existing Sites and Authors "Default" frames don't draw the count line. README.md state counts and the "Pagination" notes were not updated (outside this round).
-
-## SEO round: decisions (frames drawn)
-
-**Placement.** A "Search and sharing" section sits under "Site and authors" in the Editor sidebar and in the mobile Details sheet. It is collapsed by default, shows a one-line summary ("Ready", "2 suggestions" or "Hidden from search") and is remembered per browser like Site and authors. It holds only the slug, the full URL and three actions: "Edit search and sharing", "What the frontend gets" and the suggestion list. The fields and live previews open in a slide-over (desktop) or a 92% bottom sheet stacked over the Details sheet (mobile), because the 280 px sidebar is too narrow for previews and the slide-over rule already covers forms with a live preview. The API preview is a 720 px dialog (desktop) or a bottom sheet (mobile).
-
-**Principles.** RenewCMS does not render pages or inject meta tags. Every field is optional and the UI shows its fallback. No scores. Suggestions never block saving or publishing; publishing is allowed regardless. Suggestions are dismissible per article.
-
-**Fallback chain (resolved server-side, shown in the UI).**
-| Output | Order |
-|---|---|
-| title | seo_title, then article title; site title_template applied last |
-| description | seo_description, then excerpt, then first sentence of the body, then site default_description |
-| image | og_image_id, then cover_image_id, then site social image |
-| canonical | canonical_url, then site base_url + "/" + slug |
-| robots | noindex true gives "noindex, nofollow"; otherwise site default_robots |
-| og/twitter title and description | social_title, social_description, then the resolved values above |
-
-**Soft ranges (counters, never blocks).** Meta title 30–60 characters; description 70–160; slug "very long" above 75 characters. Counter turns neutral-warning (`--ui-warning`) outside the range, never red.
-
-**New article fields (PATCH /v1/article/{id}, all optional, snake_case).** `slug`, `excerpt` (max 300), `seo_title` (max 120), `seo_description` (max 320), `cover_image_id`, `cover_image_alt` (max 200; the cover is "ready" only with alt text), `social_title`, `social_description`, `social_image_id`, `canonical_url` (absolute https URL), `noindex` (boolean; only sets a flag in the API, it doesn't change visibility), `seo_dismissed` (string[] of suggestion codes). Slug: lowercase letters, numbers, hyphens; unique per site; 409 `slug_taken` with `suggestion` ("<slug>-2"); auto-generated from the title until edited.
-
-**New site fields (PATCH /v1/site/{id}, owner only).** `site_name`, `title_template` (default "%title% | %site%", must contain %title%), `default_description` (max 320), `social_image_id` (existing), `default_robots` ("index" | "noindex"; existing as robots).
-
-**New endpoints.**
-- `GET /v1/article/{id}/seo`: resolved object, public for online articles, 404 for drafts to anonymous callers. Shape: `{ title, description, canonical_url, robots, og: { type, title, description, image, image_alt, url, site_name, locale }, twitter: { card, title, description, image, image_alt }, image: { url, alt, source }, authors: [{ name, url, same_as: [] }], published_at, modified_at, fallbacks: { title, description, image, canonical }, json_ld }`. `json_ld` is a ready Article object (headline, description, image, author[] with name, url and sameAs from author profile URL and social links, datePublished, dateModified, mainEntityOfPage).
-- `GET /v1/site/{key}/sitemap?page=&size=`: published URLs only, total in `X-Total-Count`. Items: `{ url, modified_at, noindex }`. Decision: yes, shown on Integration under "Search and sharing" with a copy button; noindex articles are included with the flag so the frontend can skip them.
-- `GET /v1/article/?seo=ready|suggestions|hidden`: filter behind "Needs attention" (suggestions) with `seo_status` and `seo_suggestions` (count) added to list items.
-
-**Articles list.** Quiet indicator inside the Status cell (and under the title on mobile cards): nothing when ready, a lightbulb chip "N" for suggestions, an eye-off chip "Hidden" for noindex. Toolbar gets a "Needs attention" toggle next to search; tabs and counts are unchanged. It behaves the same on a single-site install (independent of the Site filter, which stays hidden).
-
-**Authors.** No change to the Authors screen. Profile URL (website) and social links feed `authors[].url` and `same_as`, and JSON-LD `author[].sameAs`; the API preview shows them.
-
-**Permissions.** Anyone who can edit an article edits its SEO fields. Only the owner edits site SEO defaults. 401 and 403 rows join the existing HTTP table: 403 `owner_only` on Site SEO fields, 401 on a missing session.
-
-**Left out on purpose.** Keyword scoring and focus keywords, readability scores, redirects management, schema types beyond Article, hreflang, robots.txt and sitemap rendering (RenewCMS only provides data), automatic image generation for social cards.
-
-**Open questions.**
-1. Is `slug` immutable after first publish, or can it change (and break URLs with no redirects)?
-2. Does the API return the SEO object for drafts to authenticated callers (for frontend previews)?
-3. Should noindex articles be excluded from the sitemap endpoint instead of flagged?
-4. Is title_template applied by the API (resolved title) or only returned for the frontend to apply?
-5. Backfill: generate slugs for existing articles from their titles at migration, with `-2` suffixes on conflicts?
-6. Should excerpt be exposed in the list payload as the article teaser?
-
-**Status.** Frames drawn on the Back-office board (groups: Articles: search status, Editor: search and sharing, Editor: what the frontend gets, Sites: SEO defaults), Integration page group added, specs updated. Placement rationale: the sidebar holds only the summary, address and suggestions because it is 280 px wide; previews and fields need a slide-over.
-
-
-Ordered by implementation dependency: tokens and shell first, then shared components, then screens. "Frontend only" means no backend work is needed.
-
-| # | Screen | Change | Done in design? | Needs backend (yes/no, what) | Needs new tokens or components | Frontend only |
-|---|---|---|---|---|---|---|
-| 1 | All | Add the `--rc-*` tokens (sand, on-sand, four soft grounds, overlay, two shadows) to the app CSS, light and dark (foundations.md) | Yes | No | 9 new tokens | Yes |
-| 2 | All | One sidebar, topbar and mobile drawer; Settings parent and child selected states; Activity sits between Users and Integration | Yes | No | NavItem, NavGroup | Yes |
-| 3 | All | Overlay pattern: dialog (desktop) and bottom sheet (mobile); slide-over only for the variant form and record details; footer secondary left, primary right | Yes | No | Modal wrapper rules (components.md) | Yes |
-| 4 | All | CodeSnippet is the only code block (Integration, Images, API keys, base URL, image URL) | Yes | No | CodeSnippet | Yes |
-| 5 | All | Copy glossary pass (Delete vs Remove, Save vs Update, toast phrasing) | Yes, by search; not every line re-read | No | None | Yes |
-| 6 | Settings | "Media" card with "Manage image variants" and "Cache usage" | Yes | No | MediaLinksCard | Yes |
-| 7 | Media, picker | Variant count badge on grid, list and mobile rows | Yes | No (variant counts already come with GET /v1/media?variants=) | Badge "N variants" | Yes |
-| 8 | Media | "With variants / Without" filter and "Largest total size" sort in the Media toolbar | Drawn on the Variants board only, not folded into the Media screen | No (GET /v1/media?variants=&sort=total_size exists) | None | Yes |
-| 9 | Image variants | Variant form as slide-over (desktop) and tall sheet (mobile) | Yes | No | None | Yes |
-| 10 | New article | Title only. Body removed from the modal; the editor opens straight away | Yes | Maybe: confirm `POST /v1/article/` accepts an empty `body` (it is "required" today); otherwise the frontend sends an empty string | NewArticleModal | Yes if empty body is accepted |
-| 11 | Editor | Remove the 10,000 character limit, counter, limit and over-limit states; neutral count | Yes | Yes: remove the body length validation on `POST /v1/article/` and `PATCH /v1/article/{id}` | EditorStatusBar | No |
-| 12 | Editor | Insert-link button (default, hover, active, disabled), tooltip, LinkModal, link popover and touch sheet, rendered link, toolbar scrolling at 390 px | Yes | No (editor only) | LinkModal, LinkPopover, ToolbarButton | Yes |
-| 13 | Articles | Pagination with `page` and `size` (5, 25, 50, 100; default 25), URL state, loading, error, out of range | Yes | **Yes:** `page`, `size` on `GET /v1/article/` (same convention and 400 as Activity); total in `X-Total-Count`, array body unchanged; Integration reference updated | Paginator, PageSizeSelect | No |
-| 13b | Media | Pagination under the grid and list, same Paginator and PageSizeSelect as Articles; `page` and `size` in the URL; saved size preference | Yes (9 states in the Media group) | **Yes:** `page`, `size` on `GET /v1/media/` (replaces `cursor` and `limit`); total in `X-Total-Count`, array body unchanged; Integration reference | None (reuses Paginator, PageSizeSelect) | No |
-| 14 | Activity | Failed-action and security cards as toggles, synced chip and segment | Yes | No | FilterCardToggle | Yes |
-| 15 | Activity | Export menu and dialog, CSV: current view (active filters) and all activity (no filters, optional `from`/`to`). Preparing, started, failed, nothing to export, 403 | Yes | No: `GET /v1/activity/export` is implemented (CSV, synchronous, owner and admin, same filters as the list) | ExportMenu, ExportDialog | Yes |
-| 16 | Activity | JSON export (format control CSV or JSON) | Yes, one state, labelled proposed | **Yes (proposed):** `format=json` on `GET /v1/activity/export` | Segmented format control | No |
-| 17 | Integration | Images and variants section, URL builder, response bodies `unknown_variant` and `unsupported_parameter` | Yes | No | UrlBuilder | Yes |
-| 18 | All | States matrix for controls (hover, focus-visible, active, disabled) | Yes (board "States matrix: controls") | No | None | Yes |
-| 19 | All | Contrast fixes: paginator current page border, no muted text on sand | Yes | No | None | Yes |
-| 20 | All | Spacing, type and icon sizes made consistent (foundations.md, "One value per role") | Yes in the frames listed there | No | None | Yes |
-| 21 | Settings, sidebar | Sites screen under Settings → Sites ("Publishing" group); "Publishing" card on Settings. Owner only: hidden for other roles, 403 page on a direct link. Key immutable after creation | Yes | **Yes:** `site` table, GET/POST/PATCH/DELETE /v1/site/ (writes owner only; PATCH rejects a changed key), `reassign_to`, seed from PUBLIC_URL | SitesTable, SiteForm, SlugField (locked variant), ReassignDialog | No |
-| 22 | Sidebar | Authors entry between Media and Users, all roles. Owner and admin manage; other roles read-only list and detail | Yes | **Yes:** `author` table, GET /v1/author/ (any role), POST/PATCH/DELETE (owner and admin; a user may PATCH their own linked author), POST /v1/author/me (any role) | AuthorsTable, AuthorForm, SocialLinksRepeater, MediaField | No |
-| 23 | Editor | "Site and authors" section in every Editor frame (collapsed by default): Site select (any role that can edit the article), reorderable authors, inline create (owner and admin), hint | Yes | **Yes:** `site_id`, `author_ids[]` on PATCH /v1/article/{id} | MetaSection, AuthorList, AuthorSelect, SiteSelect, CreateAuthorHint | No |
-| 24 | Articles | Authors column; Site column and filter when more than one site | Yes | **Yes:** `site` filter, `site` and `authors` in the list payload | AuthorStack | No |
-| 25 | Profile | "Author profile" card in every Profile frame, one-click create, edit own author (user link locked) | Yes | **Yes:** POST /v1/author/me | AuthorProfileCard | No |
-| 26 | Backfill | Existing articles get the default site; authors start empty | n/a | **Yes:** migration | None | No |
-
-## Roles and permissions: screens that change
-
-| Screen | Change |
-|---|---|
-| Sidebar and mobile drawer (AppFrame) | Items are listed per permission, not per fixed role. Writer sees Home, Articles, Media, Authors, Activity and Content. A Roles entry appears under Settings for people who can view roles. |
-| Settings navigation (AppFrame, done) | New "Access" group with a "Roles" item (shield icon) under Settings in the sidebar and the mobile drawer, shown to everyone except the restricted `user` role. "Permissions" is removed. |
-| /settings/permissions | Retired. 301 to /settings/roles. The grid lives in the role editor. |
-| Users (list, invite, row menu) | Role badges, Change role dialog, role picker in invite (default Writer), pending invites show the role, Transfer ownership, protected owner row. |
-| Articles list and Editor | Publish hidden for roles without it; status shows Draft with "Ask an editor to publish." Delete and Edit disabled with a reason when scope is Own and the item is someone else's. |
-| Content entry lists and editor | Same Own rules. View only mark. |
-| Settings pages | Read-only mode with banner for people who can view but not edit. Owner-only actions disabled with an Owner only tag. |
-| Schema | Hidden for roles without Schema view. Read-only for view-only roles. |
-| API keys | Info alert "Keys follow their creator's role", a Follows role column. |
-| Profile | Your role card and See what I can do. |
-| Activity and filters | New event types, role diff in the detail panel. |
-| Error and 403 copy | Two codes and the page-level state added. |
-
-Decisions to confirm:
-| # | Decision made | Alternative |
-|---|---|---|
-| 1 | Content permissions come before General permissions in the editor, because the common case (Contributor) only touches the grid. | General first, as in the brief. |
-| 2 | Writer gets Authors: view and edit own, and Activity: own. | No Authors or Activity access. |
-| 3 | A new role starts with nothing granted; presets fill the grid. | Start from a copy of Writer. |
-| 4 | Own-scope rows others created show "View only" with a lock icon, not a hidden row. | Hide other people's entries. |
-| 5 | Reset to default exists for built-in roles edited by the owner. | No reset. |
-| 6 | Activity own/all scope uses the same None / Own / All control. | Toggle plus a separate scope select. |
-| 7 | Transfer ownership takes effect at once, no email to the new owner. | The new owner must accept. |
-| 8 | A user with Roles: manage cannot edit their own role, even in a custom role. | Allow narrowing only. |

docs/design/change-log-roles-sync.md

@@ -1,119 +0,0 @@
-# Change log: roles sync (pass 6)
-
-Diff this against the code. "Old" is the previous design copy, "New" is the copy now in the design. EN is the design language; FR is in the board table "Final copy: toasts and errors, EN and FR" (screens/roles.md, same title). Every state is drawn light and dark, 1440×900 and 390×844, on `RenewCMS Screens Roles.dc.html` (data `roles-spec.js`, frame `RolesFrame.dc.html`) unless stated. Roles board: 61 → 90 states, 11 → 15 groups.
-
-## 3. Differences adopted
-
-### 3.1 Neutral wording ("they")
-| File · state | Old | New |
-|---|---|---|
-| roles-spec.js, screens/roles.md, RolesFrame · Users: Change role dialog and Change role: options blocked | Her API keys follow the new role. | Their API keys follow the new role. |
-| same · Users: Transfer ownership: confirm | You become an Admin. You can't take ownership back unless he transfers it. | You become an Admin. You can't take ownership back unless they transfer it. |
-Searched all .md, .js, .dc.html and email files for he, she, his, her, him, hers. No other occurrence.
-
-### 3.2 Event names
-| File | Old | New |
-|---|---|---|
-| routes.md, screens/roles.md (Needs backend), roles-spec.js | role.created, role.updated, role.deleted, user.role_changed, site.ownership_transferred | role.create, role.update, role.delete, role.reassign (new), user.role_change, site.ownership_transfer |
-| states.md (new section "Roles sync"), screens/activity.md (new section) | event names and sentences were not written down | table of name, sentence, failed sentence |
-Sentences themselves are unchanged ("Role Contributor created", and so on).
-
-### 3.3 Invite endpoint
-| File | Old | New |
-|---|---|---|
-| screens/roles.md group 5, roles-spec.js group 5 | POST /v1/invite | POST /v1/user/invite |
-routes.md, components.md and the other screen files never cited `/v1/invite`. IntegrationPage already said `/v1/user/invite`.
-
-## 1. Copy
-All EN and FR strings: roles board, table "Final copy: toasts and errors, EN and FR", and group 12 (toasts) and 13 (inline errors).
-| State | EN |
-|---|---|
-| Toast: role changed (group 12) | Role changed · Ines Duarte is now Content lead, and their API keys follow the new role. |
-| Toast: role edited elsewhere, 409 | Role changed elsewhere · Jonas Weber edited Contributor, so nothing was saved. Reload and try again. · Reload |
-| Toast: role deleted elsewhere | That role no longer exists · It was deleted somewhere else, so we removed it from the list. |
-| Toast: member's role changed before a change | Role not changed · Ines Duarte's role changed in the meantime, so nothing was saved. Reload and try again. · Reload |
-| Toast: target's role changed before a transfer | Ownership not transferred · Jonas Weber's role changed in the meantime, so nothing was transferred. Check it and try again. · Reload |
-| Toast: member's role changed before a removal | User not removed · Ines Duarte's role changed in the meantime, so nothing was removed. Check it and try again. · Reload |
-| Role editor: save failed (new) | Couldn't save the role · Your changes are still here. Try again in a moment. · Try again |
-| Change role: failed (new) | Couldn't change the role · Nothing was changed. Try again in a moment. |
-| Delete role: target deleted (new) | Writer no longer exists · It was deleted somewhere else. Choose another role to move the members to. |
-| Delete role: role gained members (new) | Role still has members · Intern now has 1 member. Move them to another role first. |
-| Delete role: move failed (new) | Couldn't move the members · Nothing was changed. Try again in a moment. |
-| Invite: invalid email (new) | Enter a valid email address. |
-| Invite: account exists, 409 (new) | This address already has an account. |
-| Invite: role above yours (new) | Your role can't assign a role with more power than yours. |
-| Invite: send failed (new) | Couldn't send the invite · Try again in a moment. |
-| Activity, role.reassign | Moved 3 members from Intern to Writer |
-| Activity, failed sentences | Failed to {verb} {object}; one per event in the table "Activity events: failed sentences, EN and FR" |
-| Activity filter, category names | Articles · Media · Users and invites (old: Users & invites) · Roles (new) · API keys · Authentication · System |
-Unchanged and still correct: Name required, Name already taken, Escalation blocked, Conflict banner, Permission lowered.
-
-## 2. Profile role card (group 9)
-Decision: the summary line is removed. "Assigned by Marta Alves" is removed with it, because `access.role` has no such field either. "See what I can do" stays; its summary is computed from the permission list in GET /v1/me.
-| State | Old | New |
-|---|---|---|
-| Role card: custom role | Your role · Contributor · Assigned by Marta Alves · Creates content and edits only their own. · See what I can do · Your API keys follow this role… | Your role · [Contributor badge] [Custom tag] · See what I can do · Your API keys follow this role. If your role changes, they change too. |
-| Role card: Owner (new) | none | Your role · [Owner badge] [Locked] [Built-in] · See what I can do · same key line |
-Layout, top to bottom, inside the existing card: title; one row of badges (role badge with icon, then Locked if `locked`, then Built-in or Custom from `built_in`); link row with the list-checks icon; muted key line. Gap 12, as every card.
-
-## 4. Behaviour
-### Read = Own (group 14, new, 5 states; also group 2 Role editor and group 3 preview via the same editor)
-| State | Content |
-|---|---|
-| Role editor: Read set to Own | New info alert under the grid: Read: Own · Articles show online articles plus the person's own drafts. Custom content types show only entries the person created. Status counts follow the same rule. The preview sentence for Read = Own is now type-specific: "Can read online articles and their own drafts" (Articles) and "Can read only entries they created" (custom types). Old preview text was "read only their own". |
-| Articles list: Read = Own | Junior writer: 3 online articles by others and 2 own drafts. Tabs All 5, Online 3, Draft 2. Banner: Drafts by others are hidden. |
-| Articles list: no drafts of their own | Draft tab, counts All 3, Online 3, Draft 0. You have no drafts · Drafts you create appear here. Your role can't see drafts by other people. |
-| Entry list: Read = Own | Only own entries, "3 entries", banner Entries by others aren't shown. |
-| Entry list: no entries of their own | You haven't created an event yet · Your role shows only entries you created, so other people's events aren't listed here. Use New entry to add one. |
-Decisions table row 4 now says Update and Delete set to Own keep the View only rows, Read set to Own hides them.
-
-### 409 conflicts (group 15, new, 5 states)
-| State | Where | Edits kept | Recovery |
-|---|---|---|---|
-| Stale save: banner (existing Conflict state, copy unchanged) | Banner above the form | Yes, Save off | Reload role, or Review differences |
-| Stale save: review differences (new) | Dialog over the editor | Yes | Keep my edits (reload and re-apply edits on top, Save on) or Use the saved role (drop edits) |
-| Stale save: edits kept after reload (new) | Info toast, form shows saved role plus edits | Yes | Review, then Save |
-| Change role: member's role changed (new) | Alert inside the dialog; toast if closed | Selection kept; Current mark moves | Change role again |
-| Transfer ownership: target's role changed (new) | Alert inside the dialog; toast if closed | Typed email kept; primary off | Reload member, then Transfer ownership |
-
-### Integration page (IntegrationPage.dc.html, Back-office board group Integration)
-| Item | Old | New |
-|---|---|---|
-| Authentication, API key card | …with that user's role (owner or admin). A key never has more rights than its creator. | …with that user's role as it is now. A key never has more rights than its creator. A route that needs a permission answers 403 "missing_permission" to a key whose creator's role lacks it. |
-| Errors table, 403 | "This action needs a real session.", "Only the owner can do this.", "Only owners and admins can do this." or "You must verify your account to access this resource." | "This action needs a real session.", `missing_permission` (code style, literal body), or "You must verify your account to access this resource." Note: `missing_permission` is the literal body, not a sentence. Site SEO defaults need the permission to manage sites. Article SEO fields need only the right to edit the article. |
-| Access chip on 9 routes (content types create, update, delete; built-in types list, get; media purge settings get, patch, preview, purge) | Owner or admin | Needs permission. The route description ends with Needs the permission "…". Proposed permissions: Create and edit content types; Delete content types; View content types; Delete files (purge routes). |
-| Per-route 403 line on those routes | Only owners and admins can do this. | missing_permission (code style) |
-| Content types section intro | An owner or admin creates a type… | A user whose role can create and edit content types defines a type… |
-"Owner only" chips are kept for the owner-only routes.
-
-### Relation picker (SchemaFrame, Schema board group 7, Later)
-Sample data: 25 venues per page (the design had 3 sample results, never 10), footer "Showing 25 of 62" with Load more. New state "Relation picker: loading more": skeleton rows, Loading… on a disabled button. Group 7: 3 → 4 states.
-
-## Files touched
-roles-spec.js, RolesFrame.dc.html, screens/roles.md (regenerated from the spec), routes.md, states.md, screens/activity.md, screens/integration.md, screens/schema-later.md, schema-spec.js, SchemaFrame.dc.html, IntegrationPage.dc.html, README.md.
-
-## Open items for you
-See the end of this file's companion list in the chat reply; repeated here.
-1. Relation picker: the design never had a "Load more" frame or a 10-result sample. Both were added, not updated.
-2. Activity event names: states.md and screens/activity.md did not contain event names; they only existed in roles.md, roles-spec.js and routes.md. I added the table to the first two.
-3. `user.role_changed` and `site.ownership_transferred` became `user.role_change` and `site.ownership_transfer`. Your brief said "the same present-tense pattern for the other role events". Confirm those two are included.
-4. `/v1/invite` appeared only in screens/roles.md and roles-spec.js. routes.md, components.md and the other screens already had `/v1/user/invite` or no citation.
-5. The 403 row in the design did not list "missing_permission". It listed "Only the owner can do this." and "Only owners and admins can do this.", which I removed. Check that owner-only routes now also answer `missing_permission`.
-6. Status naming: you say All / Online / Draft; the design already used Online and Draft, so no change.
-7. "Role deleted by someone else (409)": a deleted role normally answers 404. I drew 404 for the roles list and an inline 409 only where the deleted role was a reassign target. Confirm the codes.
-8. "Changing a role that changed meanwhile": I read it as the member's role having changed, not the role definition. Confirm.
-9. Profile: `access.role` has no assigned_by, so "Assigned by" was removed along with the summary. Confirm that the permission summary can be built from /v1/me.
-10. Activity categories: the filter had six categories. I added Roles and renamed "Users & invites" to "Users and invites" to match the permission group. Authors, Sites and Content types have activity in the product but no category in the filter; I did not add them.
-11. Purge routes: the catalogue has no permission for media purge. I used Delete files. Pick the real one.
-12. Not changed, but now out of date: IntegrationPage Entries intro still says "Any verified user can write entries"; screens/schema.md and the Schema frames say "Owner or admin" for Schema; states.md "Sites and authors: roles" and the 403 owner_only rows still describe fixed roles; screens/profile.md Display name copy. Say if you want these aligned.
-13. Decision 4 in "Decisions to confirm" was narrowed (Read = Own hides rows). Direct link to a hidden item answers the existing 404 page; this is proposed.
-14. French role names: built-in names (Owner, Admin, Writer) stay English in FR copy until you decide.
-15. Toast bodies use two short sentences in places; the glossary says one. Kept for clarity.
-
-## Corrections made while importing into the repo
-These were checked against the backend and applied to the repo copy of the design (the Claude Design copy still has the old values).
-1. Event names: the backend emits `role.edit` (not `role.update`), `user.change_role` (not `user.role_change`) and `user.transfer_ownership` (not `site.ownership_transfer`). The other three, `role.create`, `role.delete` and `role.reassign`, match.
-2. Media purge permissions: `GET /v1/media/purge-settings` needs "View settings", `PATCH /v1/media/purge-settings` needs "Edit general settings", and `GET /v1/media/purge-preview` and `POST /v1/media/purge` need "Delete files".
-3. Open item 7 (deleted role): the backend answers 404 for a deleted role and 409 for a stale role save, as drawn.
-4. Open item 8: "changing a role that changed meanwhile" means the member's role, as read.
-5. Event names now match the backend: role.create, role.edit, role.delete, role.reassign, user.change_role, user.transfer_ownership, user.remove. The living specs (screens/roles.md, roles-spec.js, routes.md, states.md, screens/activity.md) use these names; the history rows above keep the names as they were at the time.

docs/design/components.md

@@ -32,8 +32,9 @@ One component for every code or copyable value. Props: `tabs` (`{ k, label, code
 - **Rendered link**: `--ui-text-highlighted`, 1 px underline, 3 px offset. Hover 2 px underline. Focus 2 px `--ui-primary` outline, offset 2. Selected: `--rc-sand` fill, `--rc-on-sand` text.
 - **Toolbar at 390 px**: the full toolbar (22 buttons) does not fit. It scrolls sideways in one row, never wraps; a 24 px fade (`--ui-bg` to transparent) marks hidden content on each side. Buttons stay 40 px.
 
-## Paginator
+## Paginator (AppPaginator)
-First, previous, page numbers, next, last; "Showing 26–50 of 312"; page-size select "5 per page", "25 per page", "50 per page", "100 per page" (default 25). Mobile: previous, "Page 2 of 13", next. Hidden when there is one page. Desktop layout, one row: the summary on the left (it takes the free space), the page-size select next to it, the page controls right-aligned; Sites, Authors, Articles and Media draw it the same way. Buttons 32 px (44 px mobile), current page `--rc-sand` with `--ui-primary` border, disabled controls 40% opacity, focus ring 2 px `--ui-primary`. Page size and page live in the URL as `size` and `page`.
+Shipped as `AppPaginator`; every list board (Articles, Activity, Media, Authors, Sites, Localization list) draws this one. Desktop: summary "Showing 1–5 of 8" (flex 1), page-size select, then first, previous, numbers, next, last. 390 px: summary and select on one row, then Previous, "Page N of M", Next at 44 px. The summary and select stay when there is one page; only the buttons hide.
+First, previous, page numbers, next, last; "Showing 26–50 of 312"; page-size select "5 per page", "25 per page", "50 per page", "100 per page" (default 25). Mobile: previous, "Page 2 of 13", next. Buttons 32 px (44 px mobile), current page `--rc-sand` with `--ui-primary` border, disabled controls 40% opacity, focus ring 2 px `--ui-primary`. Page size and page live in the URL as `size` and `page`.
 
 Variant for Sites and Authors (no new component): when everything fits on one page the page-size select is hidden together with the controls and the footer shows only the count line "N sites" or "N authors" in `--ui-text-muted`. Loading dims the whole pager to 40% and disables it; the summary reads "Loading page N…". Sizes are unchanged: 5, 25, 50, 100.
 
@@ -124,7 +125,7 @@ Frames: `SchemaFrame.dc.html` (all schema, content and entry bodies; relation, p
 
 ## Media field (pass 5)
 
-Frames: `SchemaFrame.dc.html` (`MCtl`) and `MediaFrame.dc.html` (picker in field mode, usage). Full spec: `media-field-changes.md`.
+Frames: `SchemaFrame.dc.html` (`MCtl`) and `MediaFrame.dc.html` (picker in field mode, usage). Full spec: `media-field.md`.
 
 | Component | Status | Nuxt UI | Notes |
 |---|---|---|---|
@@ -168,3 +169,32 @@ Accessibility of the tri-state cell:
 | DeleteAccountDialog | New | UModal (existing destructive ConfirmDialog shell) + UInput x2 + list + UAlert info + ULink | Profile |
 | BlockedDialog | New | UModal with dismissible false, no close button; UButton primary for the next step | Profile |
 Specs: field heights 40 (44 mobile), buttons 36 (44 mobile), card padding 16, section gap 16. Colors from tokens only. Destructive confirm is disabled at 40% opacity until valid. Implemented in AccountCards.dc.html and the AppFrame modal.
+
+## Localization components (spec)
+| Component | Built from (Nuxt UI v4) | Notes |
+|---|---|---|
+| LanguageMenu | UDropdownMenu with a UButton trigger | Menu button with menu; rows carry badges and a Read only tag; no Add translation row without create permission |
+| CapabilityGate | none (logic) | Renders each action from capabilities[]; never from the role name |
+| EditorHeader | UButton, UBadge, UDropdownMenu | One row on desktop: language, badges, title, actions (title fills the remaining width). On mobile the title sits above the badges. At most one filled button. Collapse order and mobile bottom bar in the header priority table |
+| TitleInput | UInput (heading size) | Underline field, no box. Accessible name "Title (French)", no visible label; bounds 3 to 200; counter; helper under the field only while editing |
+| ActionOverflow | UDropdownMenu (desktop), UDrawer (mobile) | Disabled items carry a visible reason |
+| StatusBadge | UBadge variant soft | Publication: solid icon plus word |
+| FreshnessBadge | UBadge variant outline | Refresh icon plus word; icon-only at 1024 with aria-label |
+| SourcePane | UCard | Read-only reference with own scroll and dir/lang. Dashed outline and "Temporary reference" tag |
+| TrackedSourceBadge | UBadge variant soft color info | Distinct from the temporary reference |
+| ConflictDialog | UModal (desktop), UDrawer (mobile) | Four options; Keep my changes is the only filled button. Save over theirs is outlined in `--ui-error` with a triangle-alert icon (destructive cue, same size as the other secondary buttons) |
+| CoverageChips | UBadge variant outline | Collapse after 5 (1440) or 4 (1024, 390) with a +N chip; dashed for missing |
+| ListFilters | USelectMenu, UInput, UDrawer on mobile | Language filter groups Enabled and Disabled |
+| UnitLabel | plain text, aria-live polite | "8 articles", "4 French versions", "4 articles not in French" |
+| RowMenu | UDropdownMenu / UDrawer | Same actions on every width |
+| SocialLocaleField | UInput, UBadge | Derived, Set, Not set |
+| PublicUrlPattern | UInput, UAlert | Live preview from a real article, validation messages |
+| MoveArticlePanel | USelectMenu, UModal | Note lists readable versions only |
+
+## Localization board additions
+- Sidebar: no Languages item. Languages lives under Settings → Sites → [site]. Nothing is added to `navItems`.
+- Toast icon box: 28 × 28 px, 16 px icon, tone colour on its `-soft` ground (`--rc-success-soft`, `--rc-info-soft`, `--rc-warning-soft`, `--rc-error-soft`).
+- Slide-over panel (Search and sharing, Media detail): desktop right-aligned over `--rc-overlay`, 960 px (Media detail 420 px), full height, header 16 24, close button; 390 px: bottom sheet at 92% height. Drawn inside the AppFrame shell, never free-standing.
+- Coverage chip overflow (+N): 22 px chip; at 390 px its tap area is 44 px high.
+- Language menu rows: a disabled-language version shows a Disabled tag and the footer explains publishing is off.
+- Destructive outline button: `--ui-error` text and border on `--ui-bg`, used only for Save over theirs.

docs/design/decisions.md

@@ -0,0 +1,117 @@
+# Design decisions
+
+Product and interface decisions that outlive the design passes. Behaviour comes from `features/`; where the two disagree, stop and ask. Screen copy and states are in `screens/*.md`, `states.md` and `routes.md`.
+
+## Search and sharing (SEO)
+
+### Interface
+**Placement.** A "Search and sharing" section sits under "Site and authors" in the Editor sidebar and in the mobile Details sheet. It is collapsed by default, shows a one-line summary ("Ready", "2 suggestions" or "Hidden from search") and is remembered per browser like Site and authors. It holds only the slug, the full URL and three actions: "Edit search and sharing", "What the frontend gets" and the suggestion list. The fields and live previews open in a slide-over (desktop) or a 92% bottom sheet stacked over the Details sheet (mobile), because the 280 px sidebar is too narrow for previews and the slide-over rule already covers forms with a live preview. The API preview is a 720 px dialog (desktop) or a bottom sheet (mobile).
+
+**Principles.** RenewCMS does not render pages or inject meta tags. Every field is optional and the UI shows its fallback. No scores. Suggestions never block saving or publishing; publishing is allowed regardless. Suggestions are dismissible per article.
+
+**Fallback chain (resolved server-side, shown in the UI).**
+| Output | Order |
+|---|---|
+| title | seo_title, then article title; site title_template applied last |
+| description | seo_description, then excerpt, then first sentence of the body, then site default_description |
+| image | og_image_id, then cover_image_id, then site social image |
+| canonical | canonical_url, then site base_url + "/" + slug |
+| robots | noindex true gives "noindex, nofollow"; otherwise site default_robots |
+| og/twitter title and description | social_title, social_description, then the resolved values above |
+
+**Soft ranges (counters, never blocks).** Meta title 30–60 characters; description 70–160; slug "very long" above 75 characters. Counter turns neutral-warning (`--ui-warning`) outside the range, never red.
+
+**New article fields (PATCH /v1/article/{id}, all optional, snake_case).** `slug`, `excerpt` (max 300), `seo_title` (max 120), `seo_description` (max 320), `cover_image_id`, `cover_image_alt` (max 200; the cover is "ready" only with alt text), `social_title`, `social_description`, `social_image_id`, `canonical_url` (absolute https URL), `noindex` (boolean; only sets a flag in the API, it doesn't change visibility), `seo_dismissed` (string[] of suggestion codes). Slug: lowercase letters, numbers, hyphens; unique per site; 409 `slug_taken` with `suggestion` ("<slug>-2"); auto-generated from the title until edited.
+
+**New site fields (PATCH /v1/site/{id}, owner only).** `site_name`, `title_template` (default "%title% | %site%", must contain %title%), `default_description` (max 320), `social_image_id` (existing), `default_robots` ("index" | "noindex"; existing as robots).
+
+**New endpoints.**
+- `GET /v1/article/{id}/seo`: resolved object, public for online articles, 404 for drafts to anonymous callers. Shape: `{ title, description, canonical_url, robots, og: { type, title, description, image, image_alt, url, site_name, locale }, twitter: { card, title, description, image, image_alt }, image: { url, alt, source }, authors: [{ name, url, same_as: [] }], published_at, modified_at, fallbacks: { title, description, image, canonical }, json_ld }`. `json_ld` is a ready Article object (headline, description, image, author[] with name, url and sameAs from author profile URL and social links, datePublished, dateModified, mainEntityOfPage).
+- `GET /v1/site/{key}/sitemap?page=&size=`: published URLs only, total in `X-Total-Count`. Items: `{ url, modified_at, noindex }`. Decision: yes, shown on Integration under "Search and sharing" with a copy button; noindex articles are included with the flag so the frontend can skip them.
+- `GET /v1/article/?seo=ready|suggestions|hidden`: filter behind "Needs attention" (suggestions) with `seo_status` and `seo_suggestions` (count) added to list items.
+
+**Articles list.** Quiet indicator inside the Status cell (and under the title on mobile cards): nothing when ready, a lightbulb chip "N" for suggestions, an eye-off chip "Hidden" for noindex. Toolbar gets a "Needs attention" toggle next to search; tabs and counts are unchanged. It behaves the same on a single-site install (independent of the Site filter, which stays hidden).
+
+**Authors.** No change to the Authors screen. Profile URL (website) and social links feed `authors[].url` and `same_as`, and JSON-LD `author[].sameAs`; the API preview shows them.
+
+**Permissions.** Anyone who can edit an article edits its SEO fields. Only the owner edits site SEO defaults. 401 and 403 rows join the existing HTTP table: 403 `owner_only` on Site SEO fields, 401 on a missing session.
+
+**Left out on purpose.** Keyword scoring and focus keywords, readability scores, redirects management, schema types beyond Article, hreflang, robots.txt and sitemap rendering (RenewCMS only provides data), automatic image generation for social cards.
+
+### Decisions
+
+| # | Question | Decision |
+| --- | --- | --- |
+| 1 | Is `slug` immutable after publication? | No. It stays editable. RenewCMS does not manage redirects, so the frontend owns them. No extra warning copy is added to the design. |
+| 2 | SEO object for drafts | `GET /v1/article/{id}/seo` answers drafts to authenticated callers who can read the article, and 404 to anonymous callers. The editor preview needs it. |
+| 3 | Noindex in the sitemap | Included with `noindex: true`, as drawn. The frontend decides. |
+| 4 | Who applies `title_template` | The API. `title` in the SEO object is resolved. The raw `seo_title` and the site template stay readable on their own routes. |
+| 5 | Backfill | Migration generates a slug for every existing article from its title (same slug rule as authors), unique per site, with `-2`, `-3` suffixes. A title with no letter or digit becomes `article`, then `article-2`, `article-3`. It runs once and is idempotent. |
+| 6 | Excerpt in the list payload | Yes. Article items carry `excerpt`. |
+
+### Implicit decisions
+
+- Suggestions come from one server-side rule set. The same function feeds `seo_status` and `seo_suggestions` in the article list, the collapsed section summary, and the editor panel.
+- The editor panel's "checking" states and the "slug taken" state use one non-persisting endpoint: `POST /v1/article/{id}/seo/check`. Its body takes the same optional SEO fields as `PATCH /v1/article/{id}`, plus an optional `body` (never `site_id` or `author_ids`), and overrides the saved values for the check only. It answers `{ status, suggestions: [{ code, field, params }], slug: { available, suggestion } }`. Copy for each code lives in the SPA, with a French entry. `seo_dismissed` codes are filtered out of `suggestions` and are never counted in the list.
+- The suggestion codes are the ones the board uses: `title_long`, `title_empty`, `desc_short`, `desc_long`, `cover_alt`, `cover_none`, `slug_long`, `no_au`, `no_h`, `body_alt`, `short`.
+- Cover, social and site social images are media usages: `GET /media/{id}/usage`, `used_in`, the unused filter, merge, purge and delete protection must count them. This also closes the existing gap where author avatars and site social images are missing from `GET /media/{id}/usage`.
+- Roles: anyone who can edit an article edits its SEO fields and runs the check. Only the owner edits site SEO fields (403 "Only the owner can do this."). `GET /v1/site/{key}/sitemap` is public, like the other read routes that serve online articles. SEO edits are logged as an `articles` event; no field values or body text are stored.
+- `PATCH /v1/article/{id}` still requires at least one known field and still answers 400 on `null`. The SEO fields join `body`, `site_id` and `author_ids`.
+
+## Sites and authors
+
+### Who can do what
+
+| Action | Owner | Admin | Other roles |
+|---|---|---|---|
+| Create, edit, set default, delete a site | yes | no | no |
+| Read the site list, choose an article's site | yes | yes | yes, if they can edit the article |
+| Create, edit, delete any author | yes | yes | no |
+| Read authors, pick authors on an article | yes | yes | yes |
+| Create and edit their own linked author (`POST /v1/author/me`) | yes | yes | yes |
+| Create an author from the editor ("Create author…", "This is me") | yes | yes | no |
+
+### Decisions
+- One site per article (`site_id` on the article). No per-site publish state: `is_online` stays the global switch. API keys stay global.
+- The site key is immutable after creation. Exactly one default site exists and it cannot be deleted. Deleting a site with articles requires `reassign_to`.
+- Authors are separate from users. An optional, unique link to a user. The slug is globally unique and not tied to a site. Zero authors on an article is allowed and never blocks publishing. Deleting an author with articles requires `reassign_to` (an author id or `none`).
+- Media used as an author avatar or a site's default social image counts as media usage.
+- The default site is seeded once from `PUBLIC_URL`. That variable is the CMS's own address (email links), so the seed is only a starting value that the owner edits. The base URL must be https, except for loopback hosts.
+- Existing articles are backfilled to the default site and get no authors.
+
+## Roles and permissions
+
+Event names follow the backend: `role.create`, `role.edit`, `role.delete`, `role.reassign`, `user.change_role`, `user.transfer_ownership`, `user.remove`.
+
+### Decisions
+
+| # | Decision made | Alternative |
+|---|---|---|
+| 1 | Content permissions come before General permissions in the editor, because the common case (Contributor) only touches the grid. | General first, as in the brief. |
+| 2 | Writer gets Authors: view and edit own, and Activity: own. | No Authors or Activity access. |
+| 3 | A new role starts with nothing granted; presets fill the grid. | Start from a copy of Writer. |
+| 4 | Own-scope rows others created show "View only" with a lock icon, not a hidden row. | Hide other people's entries. |
+| 5 | Reset to default exists for built-in roles edited by the owner. | No reset. |
+| 6 | Activity own/all scope uses the same None / Own / All control. | Toggle plus a separate scope select. |
+| 7 | Transfer ownership takes effect at once, no email to the new owner. | The new owner must accept. |
+| 8 | A user with Roles: manage cannot edit their own role, even in a custom role. | Allow narrowing only. |
+
+## Account self-service
+
+Authored content is anonymized to "Deleted user". The email-change link lasts 2 hours. One export succeeds per user every 15 minutes, and a direct download is the export flow. "Last administrator" counts Owner. A change request for an address already in use answers like success. The account-deleted email goes to the address the account had.
+
+## Interface defaults
+- Slide-over rule: only forms with a live preview and record details; on mobile always a 92% bottom sheet.
+- Hover, active, disabled and focus tokens for the matrix (components not specified before): primary hover `--ui-text`, active `--ui-text-toned`; destructive hover opacity 0.85 and active 0.75; disabled 40% (rows 55%).
+- Article pagination: Shipped shapes: the article list body is {items, total, page, size, counts}; the media list body is an array with the total in `X-Total-Count`. Users and authors follow their own routes (see routes.md).
+- The Remove action in the link popover has no confirmation; undo restores the link.
+- The link button is disabled when an image is selected.
+- The tooltip text is "Insert link (Ctrl+K)" and "Insert link (⌘K)" on macOS.
+- Mobile toolbar scrolls sideways; no wrap, no overflow menu.
+- Selected nav items keep the sand fill plus weight 500 and `aria-current` (the fill alone is 1.3:1 in light).
+- Syntax colouring dropped from code samples (one rendering).
+- Export "Download started" offers only Close.
+- New article keeps the title counter "n / 200" (title is limited to 200); the body has no limit and no counter.
+- Page title 20/28, page padding 24/16, card padding 16 (foundations.md).
+- Activity position in the sidebar follows AppFrame.
+- The Prototype shows a toast "Not in this prototype" for sidebar items it has no screen for (Media, Activity, Settings).

docs/design/emails.md

@@ -23,6 +23,5 @@ Go `html/template` files built from `source/emails/verification.html` (same tabl
 | `source/emails/verify-new-email.html` | the new address | Confirm your new RenewCMS email address | `.Host`, `.Username`, `.VerificationCode`, linking to `{{.Host}}/account/email/confirm?c={{.VerificationCode}}` (expires in 2 hours, works once) |
 | `source/emails/email-change-notice.html` | the old address, at request time | Your RenewCMS email address change was requested | `.Host`, `.Username`, `.NewEmail`, linking to `{{.Host}}/profile` |
 | `source/emails/account-deleted.html` | the address the account had, sent once | Your RenewCMS account has been deleted | `.Host`, `.Username`, `.DeletedAt`; no button, generic text, no personal data |
-| `source/emails/export-ready.html` | the account address, async flow only | Your RenewCMS data export is ready | `.Host`, `.Username`, `.VerificationCode`, linking to `{{.Host}}/account/export/{{.VerificationCode}}` (expires in 24 hours, requires a logged-in session) |
 
-`export-ready.html` is only needed if the async export alternative is built. Previews are rows on `source/RenewCMS Emails.dc.html`.
+Previews are rows on `source/RenewCMS Emails.dc.html`.

docs/design/localization-changelog.md

@@ -0,0 +1,81 @@
+# Localization board changelog (pass 3)
+
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Spec: locale-spec.js. State IDs are unchanged; seven IDs moved to a different frame selector (marked "selector"). 183 states in 16 groups (was 169 after the corrections pass).
+
+Where a board and the spec disagreed, the spec won. Decisions the spec did not make are marked **Decided**. Frames were redrawn from code and not compared against the shipped app, so each **Decided** item is the thing to check first.
+
+## A. Redrawn to match the spec
+
+| ID | Expected copy and layout |
+|---|---|
+| loc.l8.saveFailPublish | Error banner above the editor: "Couldn't save French" / "Your changes are kept here. Nothing was published. Try saving again." Badge "Save failed", primary "Try saving again". Error toast: "Couldn't save French" / "Nothing was published. Your changes are kept. Try again." |
+| loc.l8.done | Info banner "This version is online. Saving updates the live page right away." Badge Published, status "Saved". Toast "French published" / "Other versions weren't changed." |
+| loc.l4.empty | Start empty selected. Source version reads "No source", help "Optional. Freshness shows No source until you pick a tracked source in the editor." |
+| loc.l4.unreadable | Alert "The source isn't available to you" / "Choose another source you can read, or start empty. Your title is kept." Source version "Choose a version", error "Choose a version you can read." Create disabled |
+| loc.l3.translation | Same fields as Add translation: kind radios (Translation selected), Article ("No French version yet."), Language ("Only enabled languages this article doesn't have yet."), Source version, "Title in French", Starting content (Start empty / Copy from English, selected). Button "Create French draft" |
+| loc.l11b.moveSlug | Alert "An address is already used on Atelier" / "An address must be unique within its language on Atelier. Change the address below, then move again. Nothing was moved." Then "Conflicting version": French, the address in mono, "Edit slug". Note "Only versions you can read are named." |
+| loc.conflict (and every dialog built from it) | "Save over theirs" is outlined in `--ui-error` with a triangle-alert icon and an error-colour title icon. Keep my changes stays the only filled button |
+| Chip row, Articles list | The stray "0" came from `m && shift && …` rendering the number 0 in the mobile tab strip. Fixed with `!!shift`. Filter chips keep `width:max-content` |
+| loc.l7.* (all list states) | Pager is AppPaginator (see components.md). Desktop: "Showing 1–5 of 8", "5 per page", first, previous, 1 2, next, last. 390: summary and select, then Previous, "Page 2 of 2", Next. +N overflow chip keeps 22 px visual height and gets a 44 px tap area at 390. The tab strip is no longer shifted by the stray character |
+
+## B. Redrawn inside the AppFrame
+
+| ID | Now |
+|---|---|
+| loc.seo.noFallback, loc.url.unset, loc.l10.noSocial | Editor in the shell, with the Search and sharing slide-over (960 px; bottom sheet 92% at 390) |
+| loc.slug.published | Edit slug dialog over the same slide-over |
+| loc.l12.seoPreview (selector v:seo x:preview), loc.l12.siteFallback (selector v:seo x:siteFallback) | Same slide-over; siteFallback shows French and Arabic versions side by side as cards |
+| loc.l10.api | Integration page: sidebar item Integration active, breadcrumb "Integration" |
+| loc.l12.media | Media page (grid, one card selected) with the 420 px image detail panel: "Used in 2 articles · 4 versions · 1 file". Bottom sheet at 390 |
+| loc.l12.menu (selector v:li x:menuLang) | Articles list, French selected, row menu open: Open French, Open another language…, Publish French, Copy API URL, Delete French version (danger). 390: bottom sheet |
+| loc.l12.apiCopy (selector v:li x:apiCopy) | Articles list with toast "API URL copied" / "/v1/article/14?lang=fr". 390: toast across the bottom with 16 px margins |
+| loc.l1.single | "Social locale" and "Derived: pt_BR" on their own line at 390. The value was previously empty and is now drawn |
+
+## C. Missing frames and copy
+
+| Item | Decision |
+|---|---|
+| Banners | save failed, publish failed and online banners as in the Copy decisions table of the board |
+| Row menu | All languages: Open <language>, Open another language…, Add translation…, Unpublish <language>, Copy API URL, Delete <language> version. Language selected: Publish or Unpublish replaces Add translation… |
+| Disabled-language picker | New state **loc.l5.menuDisabled**. Spanish row shows Draft and a Disabled tag. Footer: "Spanish is disabled on this site. Its version stays readable and editable. It can't be published until an owner re-enables Spanish." |
+| Setup done | "Languages assigned" / "16 articles now have a language. Nothing was translated, and no articles were grouped." |
+| Version count line, 390 | **Decided: shown**, on its own line under each language name ("4 versions · 2 published"). Desktop unchanged |
+| Public URL preview | **Decided: site default language.** Uses the most recently updated article that has a version in the default language. Journal: https://journal.example.com/en/how-we-price-a-bathroom-renovation. A site with no articles previews a sample address. The Valid example in the spec changed from the French address |
+| invalid_host | New state **loc.l1b.invalidHost**. Pattern https://journal..example.com/{lang}/{slug}. Message "Enter a valid host name, such as journal.example.com." Added to the 422 list |
+| site.* activity labels | Added to the Activity frame and the board table: site.language.add "Added French to Journal"; .enable "Re-enabled Spanish on Journal"; .disable "Disabled German on Journal"; .remove "Removed Italian from Journal"; .default "Made French the default language of Journal"; .social_locale "Set the social locale for French on Journal to fr_FR"; site.public_url.update "Changed the public URL pattern of Journal"; site.language.setup "Assigned languages to 16 articles on Journal, Notes and Archive"; article.move "Moved "<title>" from Journal to Atelier" |
+| Toast icon box | 28 × 28 px, 16 px icon, tone colour on its -soft ground |
+| Languages sidebar item | **Decided: none.** routes.md and components.md say so |
+| loc.l11.session | Editor behind the dialog shows the unsaved changes. Title "Your session expired" / "Log in to continue. Your title, body and search fields for this French version are kept in this browser and restored after you log in, with a notice." Button "Log in" |
+| loc.l4.gone | Deleted and unreadable sources look identical after submit (same neutral 404): "The source isn't available to you". The spec Visibility row was updated. "Source deleted" remains only in the review banner (L9) |
+| loc.l8.deleteSource | "Delete the English version?" / "English is the tracked source for versions you can read." Alert "Review tracking will pause": "French, German and Arabic track English. They stay as they are and keep their review history. Each one asks you to choose a new source." |
+| loc.l11b.moveSelectHidden | Arabic not listed or counted; "Versions you can't read aren't listed or counted." |
+| loc.l7.review | Needs review tab, "2 articles need review" (no copy change) |
+
+## D. Copy
+
+| Item | Final copy |
+|---|---|
+| Delete article (loc.l8.deleteStoryOk) | Title "Delete English, French, German and Arabic?" / "The article and all of its translations will be deleted. This can't be undone." |
+| New state loc.l8.deleteStoryFail (partial delete) | "Couldn't delete the article" / "Nothing was deleted. Every version is still there. Try again in a moment." Deleting is atomic, so there is no partial result. Same copy in screens/articles.md row 13 |
+| New state loc.l8.deleteDone | Toast "French version deleted" / ""<title>" was deleted. English and German weren't changed." Editor opens English |
+| New state loc.l8.deleteStoryDone | Toast on the list: "Article deleted" / "The article and all of its translations were deleted." |
+| New state loc.l11b.moveFail | "Couldn't move the article" / "Nothing was moved. All 4 versions are still on Journal. Try again." Buttons Cancel, Try again |
+| loc.l11.conflict2 | Alert "Their version changed again" / "Someone else saved this version again at 14:41, before your save went through. Nothing was overwritten. Your changes are still here." (was "Couldn't replace theirs") |
+| loc.l3.multi, loc.l3.sitechange | Language help "Default language for Journal." (was "Default for Journal.") |
+
+## E. Older design gaps
+
+| Item | Status |
+|---|---|
+| Old Articles board | Replaced as the list pixel gate by new group L7s (single-language site), 7 states: loc.l7s.default, draft, noResults, empty, loading, fail, menu. No language filter, coverage column or tabs. Back-office groups kept as a copy reference |
+| routes.md /articles row | Rewritten: query params, response `{ items, total, page, size, counts }` |
+| Role-picker sand card | Already uses `--rc-on-sand` for name and description in RolesFrame; no change |
+| Media detail panel, "Used elsewhere" | Panel now draws the section below the article list: "Used elsewhere" with rows "Author avatar" (/authors) and "Site default social image" (/settings/sites). The "Used in N" badge counts articles, entries, avatars and the site image. loc.l12.media shows "Used in 2" with two articles. New state **loc.l12.mediaElsewhere**: an image used only as an author avatar, badge "Used in 1", "Articles" with "No article shows it.", then "Used elsewhere" with Author avatar. Tooltip and delete-dialog copy unchanged. MediaFrame already had four used-elsewhere states (avatar, site, both, none); those stay |
+| Editor "Create author" on 390 px (dialog, for me, slug taken, failed) | The Details sheet and the dialog were both drawn, with the shell's own sheet competing. On 390 the shell sheet is now off for these states, the Details sheet is drawn once, and the dialog sits above it (z-index 70). Not checked visually |
+| Selected media-card badges | Confirmed: "Used in N" and Draft outline badges keep an opaque `--ui-bg` ground and `--ui-text-toned` text on a selected sand card: 9.7:1 light, 11.6:1 dark (needs 4.5:1). The soft badges (Duplicate, variants) now also sit on `--ui-bg` with a currentColor border when selected |
+
+## Header and counts
+Board header paragraph, README.md, states.md and localization-corrections.md now say 183 states in 16 groups.
+
+## New state IDs
+loc.l12.mediaElsewhere, loc.l5.menuDisabled, loc.l1b.invalidHost, loc.l8.deleteDone, loc.l8.deleteStoryFail, loc.l8.deleteStoryDone, loc.l11b.moveFail, loc.l7s.default, loc.l7s.draft, loc.l7s.noResults, loc.l7s.empty, loc.l7s.loading, loc.l7s.fail, loc.l7s.menu.

docs/design/localization-corrections.md

@@ -0,0 +1,53 @@
+# Localization corrections and completion report
+
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Fixtures: locale-fixtures.js. Spec: locale-spec.js. LocaleLive and the Handoff board were not touched.
+
+## State counts
+169 states in 15 groups (was 109) at the end of that pass; the third pass brought it to 183 in 16 groups (see `localization-changelog.md`). Counts at the end of the corrections pass: L1 25, L1b 9, L2 7, L3 4, L4 10, L5 25, L5b 9, L6 12 (release 2), L7 16, L8 13, L9 11 (release 2), L10 5, L11 7, L11b 8, L12 8. 33 states are also drawn at 1024. The full ID table is in states.md, and the board lists IDs, selectors and fixtures per state.
+
+IDs: 99 existing states keep their group, frame and selector. 70 are new. Ten existing states were rekeyed without changing meaning: the seven permission states moved from frame ed to perm (L5b), and the three move failures moved from L11 to L11b. Legacy IDs (loc.perm.*, loc.dup.*, loc.lang.*, loc.src.*, loc.review.changed, loc.conflict, loc.slug.published, loc.url.unset, loc.seo.noFallback) were kept as the canonical ID of the state they map to; the loc.lN.xxx alias is listed beside each. Nothing was removed without a replacement.
+
+## Sections to files and states
+| Section | Files | State IDs |
+|---|---|---|
+| 1 Permissions | LocaleFrame, locale-spec.js | loc.perm.readonly, loc.l5b.roMenu, loc.perm.editNoPublish, loc.perm.publishNoEdit, loc.perm.siblingReadOnly, loc.perm.siblingHidden, loc.perm.createNotAll, loc.l5b.noAdd, loc.l5b.withAdd, loc.l5.cleanOnline |
+| 2 Header, actions, title | LocaleFrame, AppFrame (edHeader, edMobBar slots), spec tables Editor header priority, Action matrix, Title field states | loc.l5.default, dirty, dirtyPublish, cleanOnline, onlineDirty, saving, saved, saveFail, pubFail, ovf, focus, titleEdit, titleUnsaved, invalid, titleShort, titleLong, titleSaving, failed; loc.l8.unpublishDirty |
+| 3 Conflict | LocaleFrame | loc.conflict, loc.l11.conflictRestored, reloadConfirm, conflict2, download, restored, session |
+| 4 List | LocaleFrame, fixtures view() | loc.l7.all, page2, fr, frMissing, emptyMissing, noResults, frLoading, listFail, limited, review, author, langFilter, rowMenu, filters, tabsScroll, long |
+| 5 Languages and setup | LocaleFrame, routes.md | loc.l1.* (reenableDone, reenableFail, broader, defaultFail, removeFail, stale, social, socialEdit, socialInvalid, readonly), loc.l1b.*, loc.l2.noLocale, inProgress |
+| 6 Move, delete, add translation | LocaleFrame | loc.l11b.*, loc.l8.deleteStoryOk, deleteStory, loc.l4.long, unreadable, langOff |
+| 7 Review and reference (release 2) | LocaleFrame | loc.l9.*, loc.l6.* (arRef, narrow at 1024, rtl) |
+| 8 Metadata, API, surfaces | LocaleFrame | loc.l10.*, loc.l12.* |
+| 9 Fixtures | locale-fixtures.js, board tables Fixture index and Fixture totals check | all |
+| 10 Accessibility | spec table Accessibility and interaction, board table Contrast | all |
+| 11 Docs | routes.md, states.md, components.md, README.md, screens/localization-*.md (8 files, generated from the spec) | all |
+
+## Rendered and inspected
+I rendered the frame at full size and looked at these. Everything else is specified in the spec and the board, and drawn by the same code, but I did not look at it.
+- 1440 light: ed.dirtyPublish, perm.ro, perm.p6, ed.menu, ed.titleLong, pd.unpublishDirty, pm.conflict, pm.moveSelect, fr.review, li.all, li.long, li.author, li.limited, sl.social, sl.broader, su.ready, pu.encoded, seo (default), api, sf.home, src.split.
+- 1024: ed.dirtyPublish (dark), ed.cleanOnline, src.rtl (dark), li.long, li.all.
+- 390: ed.dirtyPublish, ed.pubFail, ed.ovf, pm.conflict (all four options and the primary visible without scrolling), at.long (primary stays at the bottom), li.filters, li.long, li.rowMenu, li.page2, src.mobileSrc, sl.multi (dark), perm.ro (dark).
+- Dark: li.all 1440, ed.dirtyPublish 1024, src.rtl 1024, sl.multi 390, perm.ro 390.
+- The board's computed tables (fixture totals, state counts, contrast) were read in the browser. Every total matches the fixture. Contrast passes for every badge, chip and selected variant in light and dark. Disabled controls at 40% (2.6:1 light) are exempt.
+
+## Not completed
+- Most states were not looked at. Only the list above was rendered and inspected. 1024 frames exist for 33 states and I looked at five.
+- Icons come from an online icon service and did not load in my screenshots, so icon presence and placement were not checked visually.
+- Header widths between 1024 and 1440 were not drawn; the collapse order is specified and shown at the two ends.
+- The mobile Languages rows are taller than needed (social locale wraps onto its own line). Not tuned.
+- Nuxt UI components are named in components.md; the frames are built from the design tokens, as before.
+- Archive, Notes and Gallery appear in single states, not as full lists.
+- Setup frames still list all sites, although the route is per site (see below).
+- LocaleLive and the Handoff board still describe the old behaviour.
+
+## Documents that disagreed, and what I aligned to
+- Route: routes.md and the board said /settings/languages; the brief says /settings/sites/:key/languages. Aligned to the brief. The setup page lists every site, so :key is the site it was opened from.
+- Wording: the brief says "story" never appears in the UI, but section 1 uses "Delete story" and "You can't delete this story." I used "article" everywhere ("Delete article", "You can't delete this article."). Rule not changed; only the word.
+- Count: the brief's example "5 French versions" disagrees with the decided fixture (fr 4). Aligned to the fixture: "4 French versions".
+- routes.md still listed list params mode and needs_review and the old public route GET /v1/public/site/{key}/article/{slug}?lang=. Removed; aligned to tab and the two final public routes.
+- states.md said the frame was not yet updated for the permission states; replaced by the generated table.
+- The previous 1024 frames were a 1440 frame clipped to 1024. AppFrame now takes a width, so 1024 frames are real.
+- Section 2 asks for a "Retry publish" action; the banner and the primary both use that label.
+
+## Rules I believe are wrong
+None changed. One to watch: Save over theirs sits at equal weight with Reload theirs, as required. If both stay unfilled, a user may not see that Save over theirs is the destructive one. The explanation text carries that. Left as is.

docs/design/localization-tables.md

@@ -0,0 +1,392 @@
+# Localization board tables
+
+Generated from `source/locale-spec.js`. Read `localization.md` first: its explicit corrections supersede conflicting text below. API additions are proposals to be specified and accepted through `/slice`, not existing endpoints.
+
+## Decisions
+
+| Question | Chosen behavior | Rationale | Existing behavior affected | Backend dependency | Release |
+| --- | --- | --- | --- | --- | --- |
+| Language model | One story group, one article id per language, one version per locale | Reuses the article editor, permissions and publish flow | None for single-language sites | group_id, lang on articles; unique (group_id, lang) | Initial |
+| Default vs editing vs source | Three separate roles. Default is a site setting; editing language is the open article; source is chosen per translation | Default is not always the best source | None | source_article_id per version | Initial |
+| Locale scope | Per site, list of enabled languages plus one default | Matches site-level settings | Settings → Sites gains Languages | site_languages table | Initial |
+| Site locale field | Four distinct values: formatting locale (existing Site.Locale, still used for dates and numbers), default content language (new, seeded from the full Site.Locale and confirmed by the owner), article language (per version), social metadata locale (explicit or derived, never guessed) | Avoids silent reinterpretation | ResolveArticleSEO reads Site.Locale for social metadata (verify in repo); for localized articles it uses the article language | None | Initial |
+| Disable vs remove | Disable keeps content and published versions. Remove only at zero versions | No configuration action deletes or unpublishes | None | Count per language; 409 language_in_use | Initial |
+| Existing content | Setup assigns a language per site, in one transaction; each article becomes its own story | Metadata only; no guessed grouping | Articles gain lang | Bulk assign endpoint, atomic | Initial |
+| Titles | Editable after creation. A title change never alters an existing slug. Slug changes only through explicit Edit slug; no redirects are promised (none in the backend) | Translated titles must be revisable; URLs stay stable. Same rule on single-language sites | CHANGE: titles were immutable. Slug policy applies everywhere | Allow title in PUT; slug rules | Initial |
+| Slug uniqueness | Unique per (site, lang) | Same slug in two languages is normal | Today unique per site | Index change | Initial |
+| Language control | Dropdown beside the title; rows show version state; interface language unchanged | Compact for 2 to 20 languages | Editor heading | translations[] on GET article | Initial |
+| Switching | Opens another article id. Dirty form asks Keep editing, Discard, Save and switch | URL is the state; no lost work | None | None | Initial |
+| Add translation | Draft only; copy or start empty; images/authors reused; copied text flagged Needs review | Copying is a start, not completion | None | POST translations; 409 language_exists | Initial |
+| Source reference | Optional read-only pane; segment on mobile; no sync | Keeps the single editor default | None | Read access to source | Initial |
+| Direction | dir on editor and reference panes only | Shell stays LTR | None | Per-language dir from locale | Initial |
+| List: all languages | One row per story; title from default version, else first accessible; coverage chips | Avoids duplicates | Articles list | Grouped query, access-filtered | Initial |
+| List: language selected | One row per version; Not in French tab lists stories | Units always stated | Tabs and counts | lang, tab params | Initial |
+| Search | All languages: every accessible title. Language: that language only | Predictable | Search | Access-filtered | Initial |
+| Publishing | Per version; copy always names the language; no bulk publish | Prevents accidental scope | Publish button copy | None | Initial |
+| Deleting | Per version. Last version deletes the story. Article delete needs permission on all | Explicit scope | Delete dialog | None | Initial |
+| Freshness | Needs review when the source revision changes after the reviewed revision; Mark as reviewed records it | Reliable, not timestamp-based | None | content_revision on versions; reviewed_source_revision | Initial |
+| Revision-bumping fields | Title, body, excerpt, slug, image alt text, SEO and social text. Not authors, cover, site, publication | Only translatable content counts | None | Revision incremented in same write | Initial |
+| Site move | Moves the whole story; destination must enable every language; slug conflicts block | No splitting or merging | Site select in editor | Move endpoint, validation | Initial |
+| Hidden versions | Titles, counts, coverage, language summaries, previews, errors and deletion confirmations name only versions the user can read | No leakage | List counts, delete dialog | Filter at query level | Initial |
+| Machine translation | Not included | Out of scope | None | None | Later |
+| Cross-site stories | Not included | Out of scope | None | None | Later |
+| Bulk publish / review | Not included | No clear need | None | None | Later |
+| Slug policy | Slug generated once at creation. Changed only by Edit slug, before or after publishing. Published change warns: "Links to the old address will stop working. RenewCMS does not create redirects." | One policy, no redirect promise | Slug field | Unique (site, lang) | Initial |
+| Permission model | Capabilities per version: read, edit, publish, delete, create-translation, review. UI renders from capabilities[] on the article response, not from role names | Matches role/scope permissions | Editor, list | capabilities[]; server enforces every call | Initial |
+| Missing vs hidden | "Not in French" lists stories where French is absent or unreadable to the user. Add French translation on a story with an unreadable French returns a neutral 409 (see Visibility policy) | Discovery cannot leak existence | List | Conflict check ignores read permission; response is neutral | Initial |
+| Source-copy access | Read access to the chosen source is rechecked at submit, inside the transaction | Access can change while the dialog is open | Add translation | Neutral 403/404 | Initial |
+| Disabled languages | Versions stay readable and editable; publishing blocked until re-enabled; filter lists them under Disabled | No silent unpublishing | Site languages | enabled flag per site language | Initial |
+| Header priority | Left to right: language dropdown, publication badge, status badge (unsaved, saving, saved, failed), freshness badge, Read only tag, title input (fills the remaining width, same row on desktop), then reference button, Unpublish, Save, primary, overflow. At most one filled button. Collapse order: reference label, Unpublish to overflow, freshness to icon | The primary action is never hidden | Editor header | None | Initial |
+| Public URL pattern | Per-site owner setting with {lang} and {slug}; live preview from a real article; unset state links from "Public URL not configured" | No fabricated website URLs | Settings → Sites | public_url_pattern on site | Initial |
+| Social locale per language | Per-language owner field on Languages: Derived (from the tag), Set (typed), Not set. Format language_REGION | Never guess a region | Languages page | social_locale per site language | Initial |
+| Release split | Source reference (L6) and Freshness and review (L9) are release 2. Frames are drawn in full so they can be checked | Smaller first release | None | None | Release 2 |
+| UI wording | The UI says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing copy. Internal notes may say story | Plain language | All localization copy | None | Initial |
+| Languages in the sidebar | No sidebar item. Languages is reached only through Settings → Sites → [site] → Languages, which routes.md lists as the only languages route | One route, one entry point, per-site scope | Sidebar unchanged | None | Initial |
+| Public URL preview | The preview uses the most recently updated article that has a version in the site default language, in that language. A site without articles previews a sample address | Predictable and never fabricates a language | Public URL page | None | Initial |
+| Deleting an article | Dialog names the readable versions and states that the article and all of its translations are deleted. Failure copy: "Couldn't delete the article" with "Nothing was deleted. Every version is still there. Try again in a moment." | Delete is atomic, so there is no partial delete | Delete dialog | None | Initial |
+| Destructive cue in the conflict dialog | Keep my changes is the only filled button. Save over theirs is outlined in --ui-error with a triangle-alert icon, the same size as the other secondary buttons | Marks the destructive choice without changing the equal-weight rule | Conflict dialog | None | Initial |
+
+## Capability matrix (per version, enforced server-side)
+
+| Case | Read | Edit | Publish | Delete | Create translation | Review | UI result |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| P1 Read-only version | Yes | No | No | No | If can create on site | No | Banner "You can read this version. You can't edit it." No Save, Publish, Delete; formatting toolbar hidden; fields read-only; the reference action remains |
+| P2 Edit, no publish | Yes | Yes | No | Per scope | Per scope | If can edit | Save shown; Publish hidden; hint "Publishing needs the publish permission" |
+| P3 Publish, no edit | Yes | No | Yes | Per scope | Per scope | No | Publish/Unpublish shown, fields read-only (only if existing permissions allow publish without edit) |
+| P4 Sibling readable, not editable | Yes | No | No | No | n/a | n/a | Opens read-only; row tag "Read only" |
+| P5 Sibling not readable | No | No | No | No | n/a | n/a | Row absent; no count, no placeholder |
+| P6 Can create, not modify all | Yes | Own versions | Own | Own | Yes | Own | Delete article and Move article disabled with the reason "You can't delete this article." Delete French version stays available if allowed |
+| Owner / Admin | Yes | Yes | Yes | Yes | Yes | Yes | All readable versions; not inferred from role label alone |
+
+## Field ownership, copy and fallback
+
+| Field | Own per version | Copied on "Copy from source" | Fallback if empty |
+| --- | --- | --- | --- |
+| Title | Yes | Entered by the editor | None (required) |
+| Slug | Yes | Generated from the new title | None |
+| Body | Yes | Yes, flagged Needs review | None |
+| Excerpt | Yes | Yes | First words of body |
+| SEO title and description | Yes | Yes | Title / excerpt, then site defaults |
+| Social text | Yes | Yes | SEO text |
+| Image alt text | Yes | Yes | None |
+| Cover and inline images | Reference, files shared | Yes, no duplicate files | None |
+| Authors | Yes | Yes, editable | None |
+| Site | Shared by the story | Same | None |
+| Publication and timestamps | Yes | No | None |
+
+## API: existing vs proposed
+
+| Capability | Status | Request | Errors |
+| --- | --- | --- | --- |
+| List articles | Existing, extended | GET /v1/article/?page=&size=&q=&status=&site=&seo= (existing). Proposed: lang, tab=all\|missing\|review (same names as the URL; no separate mode or needs_review) | 400 invalid page/size (SPA never shows it) |
+| Get article | Existing, extended | GET /v1/article/{id}. Proposed fields: lang, story_id, capabilities[], translations[] (readable only), source { article_id, revision, status: tracked\|inaccessible\|deleted } | 404 for hidden or deleted |
+| Create article | Existing, extended | POST /v1/article/. Proposed: lang, story_id, source_article_id, copy (routes to translation rules) | 409 language_unavailable · 422 language_not_enabled |
+| Edit | Existing, extended | PATCH /v1/article/{id}. Proposed: if_revision for overwrite recheck | 409 revision_conflict { current_revision } |
+| Publish / unpublish | Existing | PATCH /v1/article/{id}/publish, /unpublish. Per version | 403 missing_permission · 422 language_disabled |
+| Delete | Existing | DELETE /v1/article/{id}. Last version deletes the story | 403 · 404 |
+| Add translation | Proposed | POST /v1/article/{id}/translations { lang, title, source_article_id, copy }. Path id is any readable version; source_article_id selects the copy source; source_revision captured in the transaction | 409 language_unavailable (neutral) · 404 (neutral) · 422 · 403 |
+| Mark reviewed | Proposed | POST /v1/article/{id}/review { source_article_id, source_revision, translation_revision } | 409 source_changed · translation_changed · source_replaced · 403 |
+| Change tracked source | Proposed | PATCH /v1/article/{id}/source { source_article_id\|null } | 422 source_cycle · 422 source_other_story · 403 |
+| Site languages | Proposed | GET/PUT /v1/site/{key}/languages { default, languages[{ lang, enabled }] }, atomic | 422 default_not_enabled · no_enabled_language · 409 language_in_use · 409 languages_changed |
+| Setup | Proposed | GET/POST /v1/language/setup { sites:[{ key, lang }] }, idempotent per site key; articles created during setup get the site default; retry after failure is safe. UI route /settings/sites/:key/languages/setup | 403 · 409 setup_in_progress |
+| Move story | Proposed | POST /v1/story/{story_id}/move { site }, atomic, revalidates | 409 slug_conflict · 422 language_not_enabled · 403 (neutral) |
+| Publish with unsaved edits | Client sequence | PATCH /v1/article/{id} (save) then PATCH /v1/article/{id}/publish. The second call is sent only if the first returns 200. No new endpoint | Save failure: nothing published, edits stay unsaved |
+| Public article (two requests) | Proposed | Exact: GET /v1/public/site/{key}/lang/{lang}/article/{slug}. Resolve: GET /v1/public/site/{key}/story/{story_id}?lang=&fallback=default. Existing article-ID links unchanged | See Public lookup |
+| Public URL pattern | Proposed | GET/PUT /v1/site/{key} { public_url_pattern }. Placeholders {lang}, {slug}. Owner only | 422 unknown_placeholder · invalid_scheme · invalid_host · not_encoded · missing_slug · 403 |
+| Social locale | Proposed | PUT /v1/site/{key}/languages { languages[{ lang, enabled, social_locale\|null }] } | 422 invalid_social_locale |
+
+## Accessibility and interaction
+
+| Control | Accessible name and keyboard | Focus | Announcement |
+| --- | --- | --- | --- |
+| Language control | "Language: French. Switch version". Enter or Down opens a menu; arrows move; Enter selects; Escape closes | Into the list on open; back to the control on close | Polite: "Editing French version" |
+| Title input | Accessible name "Title (French)", no visible label (the language dropdown beside it names the version); aria-describedby points to the help or error text; invalid sets aria-invalid and the message is an alert | Stays in the field; on Try again, back to the field | Polite: "Saving title", "Title saved"; errors are announced |
+| Save, Save and publish, Retry publish | Buttons named by their text including the language ("Save and publish French"); busy state sets aria-busy; Tab order: title, language, status, reference, Unpublish, Save, primary, More actions | After save, stays on the button; after a failed save, on Try saving again | Polite: "French saved"; "Saved as a draft. Publishing failed. Try publishing again." |
+| More actions menu or sheet | Menu button "More actions"; items are menuitems; disabled items use aria-disabled and show the reason as text | First enabled item on open; back to More actions on close | None |
+| Reference button | "Show source reference" or "Hide source reference", icon-only at 1024 with the same name | Moves into the pane on show; back to the button on hide | Polite: "Showing English reference" |
+| Conflict dialog and sheet | role dialog, modal; options are buttons in order Keep my changes, Download my version, Reload theirs, Save over theirs; Escape equals Keep my changes | First button (Keep my changes) on open; back to the title on close | Polite: "Download started" |
+| Move panel and dialogs | Site select is a listbox named "Site"; the note is the description of the confirm button | Into the list; back to the site select | Polite: "Moved to Atelier" |
+| Add translation dialog | Focus trapped; Escape cancels unless creating | First field; back to the control | Polite: "French draft created" |
+| Source segment (mobile) | Two-button radiogroup, arrows switch | Stays on the segment | Polite: "Showing English source" |
+| Coverage chips | aria-label per chip: "French: draft, needs review". The "+3" chip is named "3 more languages: …" | Row, not chips. Dashed chips are buttons on desktop only when the user can create | None |
+| List unit label | aria-live polite: "4 articles not in French" | None | Polite on every filter change |
+| Status without color | Publication badges are solid with an icon (Published: check, Draft: pencil). Freshness badges are outlined with a refresh icon and a word. Save status always has an icon and a word | None | None |
+| Touch targets | On mobile every button, menu row, chip button and segment is at least 44 px high; the bottom bar keeps the primary visible | None | None |
+| Reduced motion | No slide or fade transitions on popovers, sheets and the tab strip scroll when prefers-reduced-motion is set; the saving spinner becomes a static icon with the word "Saving" | None | None |
+
+## Acceptance scenarios
+
+| # | Given / When / Then |
+| --- | --- |
+| 1 | Given a single-language site, when creating an article, then no language control appears anywhere. |
+| 2 | Given French is enabled, when an editor adds a French translation with "Copy from English", then a draft is created, the editor opens it, and the badge reads Draft and Needs review. |
+| 3 | When French is published, then English publication is unchanged. |
+| 4 | When English changes title or body after review, then French shows Needs review; changing authors does not. |
+| 5 | Given dirty French, when choosing English, then a three-choice dialog appears and no work is lost. |
+| 6 | Given a writer who cannot see the German draft, then German appears nowhere in lists, counts, menus or alternates. |
+| 7 | When disabling German with 12 versions, then all 12 stay and 3 published stay online. |
+| 8 | When two editors create French at once, then the second sees "French is no longer available" with entries kept. |
+| 9 | When moving a story to a site missing a language, then the move is blocked and nothing splits. |
+| 10 | When the interface language is Arabic or French, the editing language indicator still shows the article language. |
+| 11 | Given French has unsaved edits, when the user chooses Save and publish French and the save fails, then nothing is published and the edits stay unsaved with Try saving again. |
+| 12 | Given French is missing and unpublished, when a client resolves the story with lang=fr and fallback=default and the default is published, then the response is the default language with requested_lang fr and fallback true; with the default also unpublished it is 404 language_not_available. |
+| 13 | Given a site locale pt-BR, when setup seeds the default language, then it reads Portuguese (Brazil) pt-BR and the owner confirms it before anything applies. |
+
+## Existing surfaces audit and verification
+
+| Item | Note |
+| --- | --- |
+| Home | Recent articles show the default-language title with a language code when not default. States loc.l12.home, loc.l12.homeFr |
+| Activity | Events gain the language: "Published French version of …". State loc.l12.activity |
+| Article menu | Publish and Delete labels name the language on multilingual sites. State loc.l12.menu |
+| API URL copy | Copies the version URL with ?lang=. State loc.l12.apiCopy |
+| SEO preview | Shows the localized address and canonical. State loc.l12.seoPreview |
+| Media usage | Counts a shared image once; lists versions that use it. State loc.l12.media |
+| Site text fallback | A site-level text (for example a site description) is a fallback only for articles in the same language. A French article can use the French site text; an Arabic article with no Arabic site text gets "No fallback" and the tag is left out. State loc.l12.siteFallback |
+| Verification limit | Repository files were not accessible. Statements about them are assumptions marked verify in repo. |
+| Decided | Slug policy, hidden-version disclosure, Home counting articles, and review storing the source version only (no text diff) are decided in the other tables. |
+
+## Visibility and anti-enumeration policy
+
+| Situation | User can read it | User cannot read it |
+| --- | --- | --- |
+| Duplicate translation | "French already exists for this article." Action: Open French version | "French can't be created for this article." No Open action, no title, no hint a version exists |
+| Create conflict response | 409 language_exists with article_id | 409 language_unavailable; identical body for exists-unreadable, disabled and lost race |
+| Article delete confirmation | Names readable versions: "Delete English and French?" | Unreadable versions are not named or counted. If any blocks deletion: "You can't delete this article." plus Delete this version |
+| Source unavailable | Deleted or unreadable at submit: the same neutral 404, shown as "The source isn't available to you." The review banner (L9) says "Source deleted" only for a source the user already knew about | "The source isn't available to you." |
+| Missing translation tab | Row shown; Add French translation | Same row; a 409 shows the neutral copy |
+| Counts and summaries | Readable versions only | Never included |
+
+## Public lookup and URLs
+
+| Topic | Decision |
+| --- | --- |
+| CMS API vs website | CMS API URLs (/v1/...) are never shown as website URLs. Website URLs come from a proposed per-site public_url_pattern (owner), e.g. https://example.com/{lang}/{slug}. Existing convention unverified. |
+| Pattern not configured | "Public URL not configured" with a link to site settings. No URL is fabricated. API links by article ID remain. |
+| Exact lookup | GET /v1/public/site/{key}/lang/{lang}/article/{slug}. Matches site + language + slug only (slug is unique per site and language). Missing or unpublished: 404 article_not_found. It never falls back and never tries another language's slug |
+| Resolution by story | GET /v1/public/site/{key}/story/{story_id}?lang=&fallback=default. story_id is the stable story identifier, returned on every public response and in alternates[]. No lang means the site default language. Fallback is decided only by story_id |
+| Example: requested version published | story st_01, lang=fr, French published: 200, lang fr, fallback false |
+| Example: requested missing or unpublished | lang=fr, no published French. Without fallback: 404 language_not_available. With fallback=default and a published default (en): 200, lang en, requested_lang fr, fallback true |
+| Example: default also missing or unpublished | lang=fr, fallback=default, French and the default both unavailable: 404 language_not_available. No third language is tried |
+| Example: default requested but unpublished | lang=en, English unpublished, fallback=default: 404 language_not_available |
+| Compatibility | Article-ID endpoints (GET /v1/article/{id}) and existing public URLs keep working. Setup labels existing articles with the site default language |
+| Response identity | Always lang (actual language). alternates[] lists only published, enabled-language versions |
+| Canonical | The localized page itself, unless an explicit canonical override is set |
+| Default-language change | Does not change what existing URLs return; absent or unpublished default gives 404 unless fallback is requested |
+
+## Locale semantics
+
+| Value | Meaning | Used for |
+| --- | --- | --- |
+| Site formatting locale | Existing Site.Locale | SPA dates and numbers; kept |
+| Default content language | New per-site setting. Setup seeds it from the full Site.Locale when a supported language entry matches (en-GB, pt-BR). If only the language part is supported it seeds that and says so. No locale: the owner must choose. The owner confirms or changes it explicitly; nothing applies unconfirmed | Fallback, new-article default, setup |
+| Article language | BCP 47 tag per version (en, fr, pt-BR, ar) | html lang, API lang, hreflang |
+| Social metadata locale | Resolved in order: 1) explicit social locale on the site language (set by an owner, e.g. fr: fr_FR); 2) the language tag already has a region (pt-BR gives pt_BR); 3) Site.Locale has the same language part (site en-GB and article en give en_GB); 4) otherwise none: og:locale and og:locale:alternate are omitted for that version and the editor shows Not set. No region is invented for a bare language. og:locale:alternate lists other published versions whose locale resolves by the same rules; the rest are left out | og:locale, og:locale:alternate |
+| SEO fallbacks | Empty French SEO fields fall back to French title and excerpt. English site defaults are never applied silently to a non-default language: editor shows "Empty. English site default not used." and the tag is omitted | Editor labels: "Fallback: French title", "No fallback" |
+
+## Article list modes and sample data
+
+| Mode | Units and count | Representative title | Row opens | Search | Sort |
+| --- | --- | --- | --- | --- | --- |
+| All languages | Stories | Default-language version if readable, else first readable by language code | Representative version | Any readable title | Story updated: latest readable version |
+| Language selected | Versions in that language | That version | That version | That language only | Version updated |
+| Missing language | Stories lacking it or unreadable in it | As All languages | Representative version | Titles in any readable language | Story updated |
+| Filters | Status, Author, SEO, Needs review: a story matches if any readable version matches (language mode: the version) |  |  |  |  |
+| Story Author, Updated | Union of readable authors; latest readable update |  |  |  |  |
+| Differing sites | Language filter lists the union; Missing excludes sites that do not enable the language |  |  |  |  |
+| Dataset (locale-fixtures.js) | See the Fixture index. Journal: 8 articles, 17 versions, page size 5 (page 1 shows 5, page 2 shows 3). Enabled en (default), fr, de, ar; disabled es, it. Versions: en 7 (6 published), fr 4 (2 published, 2 Needs review), de 4 (3 published), ar 1, es 1, it 0. 4 articles have no French version. Needs translation 7, Needs review 2. Every list, tab count, unit label and pager is computed from locale-fixtures.js. |  |  |  |  |
+
+## Review source and revision semantics
+
+| Topic | Decision |
+| --- | --- |
+| Record | { article_id, source_article_id, source_revision, translation_revision, reviewed_by, reviewed_at } |
+| Confirmation guard | The dialog carries the versions the user saw. If either moved, the dialog says "The English source changed while you were reviewing. Review again." or "French was changed by someone else while you were reviewing. Review again." Nothing is marked |
+| Change tracked source | Explicit action Change tracked source. Result: Needs review. Earlier reviews are kept as history |
+| Cycles | Prevented (422 source_cycle). Source must be in the same story |
+| Access loss vs deletion | Access lost: "The source isn't available to you right now." history kept, Mark reviewed disabled. Deleted: "Source deleted" with Choose a new source |
+| Source replacement | Pick another readable version of the story; freshness becomes Needs review |
+| What changed | Changed-field summary only, shown as "Changed fields: Title, Body", with the source version date and the translation version date. No text diff and no revision numbers in the UI |
+| Concurrent edits | Mark reviewed applies only to the revisions the user saw |
+
+## Title, slug and concurrent edit flows
+
+| Case | Behavior |
+| --- | --- |
+| Title editing | Inline underline input in heading style, on the same row as the language, badges and actions on desktop (no box, no visible label). States: pristine, focus, editing, unsaved, invalid ("Enter a title"), too short, too long, saving, failed (value kept). Bounds 3 to 200 characters. Accessible label "Title (French)". Editing the title never changes the slug |
+| Slug | See Slug policy. Edit slug lives in Search and sharing and in the overflow menu; its note says "Editing the title never changes the slug." |
+| Conflict | "Someone else saved this version at <time>." Choices: Keep my changes (filled; nothing sent), Download my version, Reload theirs (confirm: "This discards your unsaved changes."), Save over theirs (sends the version fetched now; a newer save gives a new conflict) Save over theirs is outlined in the error colour with a warning icon. |
+| Overwrite scope | "Replaces the title, body and search fields of this version only. Other languages are untouched." |
+| Session expiry | Draft kept locally per article (title, body, search fields) until saved or discarded. After login: "Restored unsaved changes from <time>." |
+
+## Language configuration lifecycle
+
+| Action | Rule |
+| --- | --- |
+| Disable default | Blocked: "Choose another default first." |
+| Disable last enabled | Blocked: "At least one language must stay enabled." |
+| Disable with content | Allowed; versions remain; published stay online; publishing blocked for drafts |
+| Re-enable | Row action Re-enable; no data change |
+| Remove | Only at zero versions; never the default |
+| Save error | Dialog keeps language, default and toggle values; error above the footer |
+| Story moves | Disabled-language versions count toward destination requirements |
+
+## Mobile list and prototype scope
+
+| Item | Spec |
+| --- | --- |
+| Filter sheet | Site, Language, Status, Author, SEO; Clear all and "Show N results"; active filters show as chips with "Remove filter Status: Draft" and Clear all |
+| Tabs | Scrolls with edge fade and buttons "Scroll tabs left/right"; Not in French is always reachable |
+| Pager | Same page size as desktop (5); "Page 1 of 2"; the URL keeps page and size |
+| Row actions | Identical capability on every width: see Row actions. Mobile uses the row menu button (44 px), desktop shows the same button (28 px) |
+| Prototype flows | Not part of this pass. The LocaleLive prototype was not touched |
+
+## Editor header priority
+
+| Order | Item | 1440 | 1024 | 390 |
+| --- | --- | --- | --- | --- |
+| 1 | Title input (underline, heading style; own row on mobile, shares the header row on desktop) | Full width | Full width | Full width |
+| 2 | Language dropdown | Visible | Visible | Visible, 44 px |
+| 3 | Publication badge | Visible | Visible | Visible |
+| 4 | Primary action (the only filled button) | Rightmost before More actions | Same | Fixed bottom bar, fills the width left by Save and More |
+| 5 | Status badge (Unsaved changes, Saving, Saved, Save failed) | Visible | Visible | Visible |
+| 6 | Save (secondary) | Visible | Visible | Bottom bar, next to the primary |
+| 7 | Freshness badge | Icon and word | Collapses first: icon only, name in aria-label | Wraps under the language row |
+| 8 | Read only tag | Visible | Visible | Visible |
+| 9 | Reference button | Icon and label | Collapses second: icon only | More actions sheet |
+| 10 | Unpublish (secondary) | Visible | Collapses third: More actions menu | More actions sheet |
+| 11 | More actions | Edit slug, Move article, Delete versions | Same plus Unpublish | Same plus reference and Unpublish |
+
+## Action matrix
+
+| State | Permissions | Primary (filled) | Secondary | Notes |
+| --- | --- | --- | --- | --- |
+| Clean draft | edit + publish | Publish French | Save (off) | loc.l5.default |
+| Clean draft | edit only | None | Save (off) | Hint: Publishing needs the publish permission |
+| Dirty draft | edit only | Save | None | loc.l5.dirty; "Saving keeps it as a draft." |
+| Dirty draft | edit + publish | Save and publish French | Save | loc.l5.dirtyPublish |
+| Clean online | edit + publish | None | Unpublish French, Save (off) | loc.l5.cleanOnline; "This version is online. Saving updates the live page right away." |
+| Dirty online | edit + publish | Save | Unpublish French | loc.l5.onlineDirty |
+| Saving | any | Saving… (busy) | None | loc.l5.saving |
+| Saved | any | Publish French if allowed | Save (off) | loc.l5.saved |
+| Save failed | edit | Try saving again | None | loc.l5.saveFail; nothing published |
+| Publish failed after save | edit + publish | Retry publish | Save (off) | loc.l5.pubFail; "Saved as a draft. Publishing failed. Try publishing again." |
+| Unpublish with edits | publish | Unchanged | Unpublish French | loc.l8.unpublishDirty; saved version goes offline, local edits stay, nothing is saved |
+| Read-only | read | None | None | Reference button remains |
+| Publish without edit | publish | Publish French | None | Fields read-only |
+
+## Title field states
+
+| State | Look | Message | Save |
+| --- | --- | --- | --- |
+| Pristine | Heading-size text, neutral border | None | Off |
+| Focus | Primary 2px underline | "Changing the title doesn't change the address." | Off |
+| Editing | Primary border, counter n / 200 | Same note | On |
+| Unsaved | Neutral border, Unsaved changes badge | Same note | On |
+| Invalid | Error border and icon | "Enter a title" | Blocked |
+| Too short | Error border, counter | "Use at least 3 characters" | Blocked |
+| Too long | Error border, counter 203 / 200 | "Use 200 characters or fewer" | Blocked |
+| Saving | Spinner | "Saving title…" | Busy |
+| Save failed | Error border and icon | "Couldn't save the title. Your text is kept." Try again | On |
+
+## Row actions (same on every width)
+
+| Action | Shown when | Desktop | Mobile |
+| --- | --- | --- | --- |
+| Open <language> | Always, for the version the row opens | Row click and menu | Row tap and menu |
+| Open another language… | More than one readable version | Menu | Menu |
+| Add translation… | User can create and a language is missing | Menu (dashed chip button as a shortcut) | Menu |
+| Publish / Unpublish <language> | User can publish | Menu | Menu |
+| Copy API URL | Always | Menu | Menu |
+| Delete <language> version | User can delete | Menu | Menu |
+
+## Coverage chips for many languages
+
+| Width | Chips shown | Overflow | Dashed missing chips |
+| --- | --- | --- | --- |
+| 1440 | 5 | "+3" chip for 8 languages; named "3 more languages: …" | Last in order; buttons only if the user can create; hidden otherwise |
+| 1024 | 4 (narrower column) | "+4" | Same |
+| 390 | 4, under the title | "+4" | Not buttons; added from the row menu |
+| Order | Default language, other existing versions, disabled-language versions, then missing |  | Never shown for languages the user can't create |
+
+## URL state (article list)
+
+| Param | Values | Default |
+| --- | --- | --- |
+| site | Site key | First site |
+| lang | Language code; absent means all languages | all |
+| tab | all, missing, review (Published and Drafts are the status filter) | all |
+| q | Search text | empty |
+| status | online, draft | any |
+| author | Author name | any |
+| seo | attention | any |
+| page | Page number, starting at 1; filter changes reset it | 1 |
+| size | Rows per page | 5 in the fixture |
+
+## Public URL pattern validation
+
+| Case | Example | Message |
+| --- | --- | --- |
+| Valid | https://journal.example.com/{lang}/{slug} | Preview: https://journal.example.com/en/how-we-price-a-bathroom-renovation |
+| Unknown placeholder | https://journal.example.com/{language}/{slug} | Unknown placeholder {language}. Use {lang} and {slug}. |
+| Bad scheme | ftp://journal.example.com/{lang}/{slug} | Start with https:// or http://. |
+| Not encoded | https://journal.example.com/my pages/{lang}/{slug} | Remove spaces and characters that need encoding. Use letters, digits, - and _. |
+| Missing {slug} | https://journal.example.com/{lang} | Add {slug} so each article has its own address. |
+| Invalid host | https://journal..example.com/{lang}/{slug} | Enter a valid host name, such as journal.example.com. |
+| Unset |  | Public URL not configured, with a link to this setting |
+
+## Social locale per language
+
+| State | Label | Meaning |
+| --- | --- | --- |
+| Derived | Derived: pt_BR | The language tag has a region. Not editable except by setting a value |
+| Set | Set: fr_FR | An owner typed it. Format language_REGION |
+| Not set | Not set | No region available. og:locale and og:locale:alternate are left out |
+| Invalid | fr-FR | Use letters and one underscore, for example fr_FR. |
+
+## Move article
+
+| Case | Behavior |
+| --- | --- |
+| Entry point | The site select in the editor details |
+| Note | "Moves all language versions of this article." Lists readable versions; a version the user can read but not edit is tagged Read only; unreadable versions are not listed or counted |
+| Confirm | "Move to Atelier?" with the same list |
+| Failures | Language missing in the destination (disabled languages count), address conflict (names only readable conflicting versions), no permission (neutral) |
+
+## Release 2 groups
+
+| Group | Release | Why |
+| --- | --- | --- |
+| L6 Source reference | Release 2 | Drawn in full so the checker has frames |
+| L9 Freshness and review | Release 2 | Drawn in full so the checker has frames |
+
+## Copy decisions (pass 3)
+
+| Item | Final copy or rule |
+| --- | --- |
+| Editor banner: save failed | Couldn't save French. Your changes are kept here. Nothing was published. Try saving again. |
+| Editor banner: publish failed | Saved as a draft. Publishing failed. Try publishing again. (detail: Your edits are saved. Only the publishing step failed.) |
+| Editor banner: online | This version is online. Saving updates the live page right away. |
+| Row menu, all languages | Open <language>, Open another language…, Add translation…, Unpublish <language>, Copy API URL, Delete <language> version |
+| Row menu, language selected | Open <language>, Open another language…, Publish or Unpublish <language>, Copy API URL, Delete <language> version |
+| Disabled-language version in the menu | Row shows the Disabled tag. Footer: "<Language> is disabled on this site. Its version stays readable and editable. It can't be published until an owner re-enables <Language>." |
+| Setup done | Languages assigned. N articles now have a language. Nothing was translated, and no articles were grouped. |
+| Languages list on 390 px | The version count line ("4 versions · 2 published") is shown, on its own line under the language name |
+| Single-language card on 390 px | "Social locale" and "Derived: pt_BR" sit on their own line below the language |
+| Partial or failed delete | Couldn't delete the article. Nothing was deleted. Every version is still there. Try again in a moment. |
+| Version deleted toast | French version deleted. "<title>" was deleted. English and German weren't changed. |
+| Article deleted toast | Article deleted. The article and all of its translations were deleted. |
+| Move failed | Couldn't move the article. Nothing was moved. All 4 versions are still on Journal. Try again. |
+| Second conflict | Their version changed again. Someone else saved this version again at <time>, before your save went through. Nothing was overwritten. Your changes are still here. |
+| New article, language help | Default language for <site>. |
+| Invalid host | Enter a valid host name, such as journal.example.com. |
+| Toast icon box | 28 × 28 px, 16 px icon, tone colour on its -soft ground (--rc-success-soft, --rc-info-soft, --rc-warning-soft, --rc-error-soft). Body and title as in the Toast table |
+| Activity: site.language.add | Added <language> to <site> |
+| Activity: site.language.enable | Re-enabled <language> on <site> |
+| Activity: site.language.disable | Disabled <language> on <site> |
+| Activity: site.language.remove | Removed <language> from <site> |
+| Activity: site.language.default | Made <language> the default language of <site> |
+| Activity: site.language.social_locale | Set the social locale for <language> on <site> to <value> |
+| Activity: site.public_url.update | Changed the public URL pattern of <site> |
+| Activity: site.language.setup | Assigned languages to N articles on <sites> |
+| Activity: article.move | Moved "<title>" from <site> to <site> |

docs/design/localization.md

@@ -0,0 +1,125 @@
+# Article localization implementation handoff
+
+Baseline imported 2026-10-31 and refreshed 2026-11-01 (completion pass) from `.claude/design`. This is a target design, not a statement that the feature exists. The user authorized this import and reconciliation. Feature and QA acceptance still happen per slice before implementation.
+
+## Authority and imported artifacts
+
+For localization, use this document for integration rules and corrections, `localization-tables.md` (generated from `source/locale-spec.js`) for the product tables, `screens/localization-*.md` and `states.md` for the state inventory, and `localization-corrections.md` for what the last design pass rendered, inspected and left open. Use `source/LocaleFrame.dc.html` for layout and rendered copy. This document supersedes conflicting board notes and older title/slug assumptions. Existing accepted `features/` behavior remains binding until a new accepted slice explicitly changes it. Report any remaining conflict at specification time; do not silently change behavior to match a mockup.
+
+Imported sources are the Localization board, LocaleFrame, locale-spec.js, locale-fixtures.js (the single fixture set every list, count and pager derives from) and `localization-changelog.md` (state IDs and copy changed by the third pass). Since the third pass (2026-11-03), LocaleFrame draws inside the shared AppFrame, which gained optional editor-header slots and a width option; LocalizationShell is gone. Do not introduce a second application shell in production: continue using DashboardShell and existing editor components.
+
+The LocaleLive prototype was deliberately not imported. The Prototype and Handoff boards remain unchanged and do not demonstrate localization. This written handoff replaces the missing localization handoff, not the missing interactive prototype. No rendered visual parity, keyboard flow, browser console check or production test is claimed by this import.
+
+## Product model
+
+A story groups article versions within one site. Each version keeps its article ID, creator/permissions, language, title, body, slug, SEO/social fields, alt text, publication and timestamps. Enforce one version per normalized locale per story. Files are shared references, not duplicated uploads. Authors and image selections are copied independently when requested. All versions share the story's site. Site changes therefore use an atomic story move rather than moving one linked version alone.
+
+Site default, current editing language, temporary comparison reference and tracked review source are distinct. Changing `?ref=` changes only the comparison pane. It does not update the tracked source. No machine translation, cross-site grouping, bulk publishing, synced scrolling or text diff is included.
+
+Use existing ID conventions for new records unless the accepted backend slice establishes a reason to differ. Example `st_01` in mockups is illustrative; it does not mandate string IDs.
+
+## Languages and existing-content setup
+
+Owner manages `/settings/sites/:key/languages`. Editors who need language metadata can read the allowed metadata without gaining site-management access. Gate all row menus and Re-enable actions as well as Add language.
+
+At least one language is enabled and the default is enabled. Choose another default before retiring the current one. Remove only unused, non-default languages. Disable preserves content and online versions; editing remains permitted, but draft publication and new translation creation require re-enabling. Unpublish remains available under existing permissions. Existing disabled-language versions remain accessible through permitted lists and direct IDs.
+
+Preserve full supported locale tags such as `pt-BR`. If only a broader tag is supported, explain the suggested substitution and require confirmation. No locale means an explicit choice, not an inferred translation. Setup assigns a language and a separate story to each existing article; it does not guess translation links.
+
+Setup must be idempotent and atomic for its declared scope. The backend slice must define create/setup concurrency and safe retries before coding: an unassigned article must not become stranded or assigned to a different default halfway through setup. Keep stable article IDs, bodies, publication and API reads. Test migrations through the repository’s applicable persistence tests; HTTP fakes alone do not establish migration correctness.
+
+## Editing, permissions and publication
+
+Retain existing per-version read/update/publish/delete scopes and creator semantics. Translation membership grants no additional permission. Publishing and updating are separate permissions. A user allowed to update an online article can change its live content by saving, even without publish permission; this preserves the current direct-update model. This feature does not add unpublished revisions or editorial approval of updates.
+
+Use this copy for an online editable version: “This version is online. Saving updates the live page right away.” For draft writers without publish: “Saving keeps it as a draft.” Do not claim saving an online article produces a draft.
+
+Both viewports use Save and publish for a dirty offline version when update and publish are allowed. Save succeeds before publish is sent. Save failure retains dirty data and sends no publish request. If save succeeds but publishing fails, content is saved offline; offer retry publication without pretending the save failed. Recheck conflicts/permissions server-side on both operations. No transactional combined endpoint is promised. Unpublish does not discard or implicitly save local edits; explain the resulting saved/offline state and retain the draft buffer.
+
+Titles become editable for single-language and multilingual articles, using existing 3–200 character validation. Title edits never regenerate an existing slug. Explicit slug edits are permitted before or after publication. Warn: “Links to the old address will stop working. RenewCMS does not create redirects.” No redirect capability is promised.
+
+Retain title, body, search fields and base revision after failures. Reload-theirs requires discard confirmation; download local work before discarding when requested. Overwrite uses the revision shown by the conflict dialog as its expected revision; do not silently fetch a newer revision immediately before saving and thereby bypass confirmation of another writer's changes. A subsequent update must produce a fresh conflict.
+
+Local recovery is scoped to authenticated user and article ID. Do not restore another user's content after account switching. Define cleanup on successful save, explicit discard, logout and access revocation in the slice acceptance criteria. Draft recovery must not grant server access.
+
+## Visibility and list semantics
+
+Only readable versions contribute titles, author unions, timestamps, coverage, results and counts. Never include hidden siblings in public alternates or error payloads. Readable creation conflicts may link to the version; otherwise show “French can't be created for this story.” An unreadable-version conflict has no ID, title or Open action. Missing means no readable version, not proof no stored version exists. Do not advertise stronger anti-enumeration guarantees than that policy provides.
+
+Authenticated editorial all-language view counts stories, uses the readable default-language title or deterministic first readable locale, and opens that representative version. Updated is the latest readable version update; authors are the union of readable authors. Selected-language view counts versions. Missing-language view counts stories in sites enabling the target language and searches readable source titles. Other language-filtered searches match that language's titles. All-language search matches any readable title.
+
+Use `lang` and `tab=all|missing|review` consistently in SPA and editorial API requests. Omit default `tab=all`. Missing requires a selected language. Review works in the active story/version mode. Preserve `page`, `size`, `q`, `status`, `site`, `seo` and existing sort syntax. Author filter is a new capability, not shipped behavior. Reset page on filter changes. Preserve the existing page-size choices and URL normalization.
+
+For combined filters in story mode require a single readable version to satisfy the version-level predicates together; do not match an English author's version and a different French draft to fabricate a combined match. The accepted list slice specifies tab counts and their filter scope explicitly, preserving existing count behavior where possible. The union-language filter must distinguish disabled languages; missing excludes sites not enabling the selected language.
+
+Preserve public `/v1/article/` pagination, object shape and access rules. Do not silently change anonymous lists to grouped stories. Define an explicit opt-in editorial grouping contract in the accepted backend list slice; new clients must not depend on an unannounced response-type switch.
+
+## API target and compatibility
+
+Existing `/v1/article/` POST/GET, `/v1/article/{id}` GET/PATCH/DELETE and PATCH publish/unpublish remain. The SPA keeps `/article/:id/edit` and the existing new-article entry. API capability tables describe proposed extensions, not functioning endpoints. Preserve snake_case and existing validation/error conventions; accepted HTTP specs establish exact bodies and status codes. Do not copy mockup JSON errors over current plain-text contracts indiscriminately.
+
+Proposed extensions include language config/setup, article language/story metadata, translation creation, source/review tracking and atomic story moves. Use one translation-creation implementation for both UI entry points. Source must belong to the same story and be readable at submit. Copy snapshots and source revision are captured together server-side. Start-empty creates no tracked source and shows No source until explicitly linked.
+
+Slugs become unique within `(site, lang)`. Exact public lookup is `/v1/public/site/{key}/lang/{lang}/article/{slug}` and never falls back. Story resolution is `/v1/public/site/{key}/story/{story_id}?lang=fr&fallback=default`. Without a published requested version, return not-found unless fallback was explicitly requested and the default version is published. Never try an arbitrary third language. Return actual `lang`, `requested_lang` and fallback status as appropriate. A default change affects requests omitting language; existing article-ID and explicit-language reads remain stable. Remove contrary “existing URLs never change” claims for language-omitted resolution.
+
+Public alternates include eligible published versions only. Disabled published versions stay available by ID/exact read but are excluded from discovery alternates as designed. Decide noindex handling consistently with existing SEO output during the metadata slice.
+
+Website URLs are not CMS API URLs. Use existing site URL conventions where compatible; a proposed owner-configured public URL pattern enables locale-aware links. No pattern/configuration means “Public URL not configured”; do not fabricate page URLs or change legacy canonical output before a slice explicitly accepts that change. Validate placeholders, URL scheme and encoding in the backend contract.
+
+## Locale and SEO corrections
+
+Article language determines content `lang`, direction and alternate-language identity; the SPA interface locale remains user-controlled. Existing `Site.Locale` currently participates in social metadata. Do not describe it as an existing SPA formatting setting: SPA formatting uses its own i18n locale. The feature changes article social metadata resolution deliberately rather than pretending the old field had no SEO purpose.
+
+Preserve full article tags. Resolve social locale from explicit per-language configuration, a supported regional tag mapping, or a matching existing site locale; otherwise omit it and show Not set. Validate mappings instead of inventing a region. Bare languages do not imply a particular country. Respect existing canonical overrides.
+
+Local SEO fallback uses the local title/body/excerpt according to existing fallback behavior. Do not silently inject a different language's site text. If a site textual fallback is used, its language must match the article language; default-language changes do not relabel existing site text. Image defaults may still be shared, with per-version alt text. The metadata slice must specify exact fallback order and conditional copy; “Description empty, tag omitted” is not universally correct when a local body/excerpt can supply it.
+
+## Review and concurrency
+
+Store source identity, source content revision, translation revision, reviewer and review time. Review confirmation must check both revisions and that the tracked source is unchanged. Source replacement must be in the same story, readable and cycle-free. Replacing it sets Needs review. Keep past review history when the source is deleted or access is temporarily lost; do not reveal unreadable source metadata. Access loss disables review while allowing permitted translation edits.
+
+Content revision changes include title/body/excerpt/slug/alt/SEO/social text. Authors, site moves, image selection and publication do not increment the localization content revision. Use a separate edit concurrency version if needed so non-content updates still cannot be overwritten silently. Changed-field summaries must aggregate fields changed since the reviewed source revision, not merely the latest update. No text diff or immutable historical-source viewer is promised.
+
+## Visual validation and implementation gaps
+
+The board contains 16 groups and 183 states (L6 and L9 are release 2). L7s (single-language list) replaces the old Back-office Articles groups as the list's pixel-gate reference. Screen files map stable IDs to exported selectors. Markups are illustrations, not production accessible controls. Implement actual Nuxt UI input/menu/tab behavior. Retain the full existing editor toolbar; the shortened mockup toolbar does not authorize removing features.
+
+The existing visual checker must be extended to discover localization's groups, state tables and 1024px reference where needed, with scoped fixtures and API mocks. Do not claim `task visual:check` can already verify the import. No threshold increases or exceptions are authorized. Clock-sensitive skips only apply to states whose rendering actually depends on current time, not whole features containing dates.
+
+Known board limitations to settle in the relevant accepted slice: partial sample rows despite full-page totals; alternate empty-state fixtures; desktop/mobile action parity; read-only config controls; title validation bounds; source reference SEO metadata; restore/reload interactions; and state fixtures consistent across lists and editor. If matching the board would violate this handoff or an accepted scenario, document the discrepancy and obtain the workflow's explicit design decision before coding. Do not waive visual checks or silently improve the reference in a coder stage.
+
+## Recommended slice order
+
+1. Language value rules, site configuration and existing-content setup/migration contracts.
+2. Story/version storage, unique constraints and authorized translation creation.
+3. Article update/title/slug and revision conflict contracts, preserving public compatibility.
+4. Site language settings and setup SPA.
+5. Editor language navigation, translation dialog and publication scope.
+6. Editorial grouped/language/missing lists with mobile filters and pagination.
+7. Public story resolution, localized URL configuration and SEO metadata.
+8. Optional comparison pane, tracked-source review and freshness UI.
+9. Atomic story moves/deletion and integration regression coverage.
+
+Split further to keep accepted slices reviewable. Include required backend support before each SPA slice. Each slice follows specifier acceptance → coder → size-gated cleaner/architect → hardener → qa. This order is planning guidance, not acceptance of Gherkin or permission to skip a gate.
+
+## Open decisions and known design gaps (2026-11-01)
+
+Settle these during specification of the slice named, before coding.
+
+| Topic | Gap | Slice |
+| --- | --- | --- |
+| Setup route | The route is `/settings/sites/:key/languages/setup` but the page lists every site, and the proposed setup API is global. Decide one global page reached from a per-site banner, or a per-site page. | Languages and setup |
+| Visual coverage | About 45 of the original 169 states were rendered and inspected by the designer (see `localization-corrections.md`). Icons were never checked. Unseen frames may be broken; the visual check will reveal them. | All SPA slices |
+| Header widths | Editor header widths between 1024 and 1440 are specified, not drawn. The checker captures 1440, 1024 and 390 only. | Editor |
+| Mobile Languages rows | Rows are taller than needed. Tune in implementation. | Languages and setup |
+| Partial fixtures | Archive, Notes and Gallery exist only as single states. | Languages and setup |
+| Mobile list page 2 | The designer could not reproduce the overflow-chip and tab-strip issue on mobile page 2; they removed a stray character and gave the "+N" chip a 44 px tap area. Check it against the app. | Article list |
+
+## Third-pass decisions (2026-11-03)
+
+- No Languages item in the sidebar. Languages is reached from Settings → Sites → [site] → Languages, and from the setup banner.
+- Mobile list rows show the version count on its own line.
+- The Public URL pattern preview uses the site's default language (Journal previews the English address).
+- A deleted source and an unreadable source show the same message after submit: "The source isn't available to you".
+- "Save over theirs" is an error-coloured outline button with a warning icon; Keep my changes stays the only filled button.
+- "Delete article" is atomic: on failure nothing is removed and every version stays.

docs/design/media-field.md

@@ -1,4 +1,4 @@
-# Media field type: change list for implementation
+# Media field type
 
 Board: `RenewCMS Screens Schema.dc.html`. Frames changed: `SchemaFrame.dc.html`, `MediaFrame.dc.html`. Spec data: `schema-spec.js` (states) and `media-field-tables.js` (tables, appended to the board). No new tokens, no new colors, radius 0.
 
@@ -101,21 +101,3 @@ HTTP to copy (picker and field), from states.md: 400 "That request wasn't valid.
 - Focus: Use this image → Change image. Remove or Clear → Pick an image. Cancel or Esc → the opener.
 - Picker: tiles are buttons with `aria-pressed`, names "stone-steps.jpg, 310 KB, Current". "No image" has `aria-pressed`. "Use this image" uses `aria-disabled`.
 - Contrast: Current badge and selected rows use `--rc-on-sand`; hover bar 18.9 (inverted pair). 44 px targets on mobile. No hover on mobile.
-
-## 7. Conflicts to decide
-1. Row height: design is 48 px (56 px media rows, 68 px cards), not 32 px. Drawn at 48 and 68.
-2. Thumbnail position: existing form has Description last. Drawn after Description (end of form).
-3. "Used in N" counted articles. Now articles + entries.
-4. Delete title: existing in-use title kept; "Delete this image?" stays for unused images.
-5. "Clear" vs glossary "Remove".
-6. "1600 × 900 · 240 KB" (design separator) instead of "1600 x 900 - 240 KB".
-7. Review step disables Apply for the certain refusal; existing review never does.
-8. Picker button "Use this image" vs article picker "Insert image"; "Remove image" when No image is chosen is my addition.
-9. "Pick an image" also on optional empty fields.
-10. No read-only route for custom types.
-11. Two tab stops for the same picker (thumbnail and Change image).
-12. Disabled opacity: form 60%, foundations 40%.
-13. The picker frame shows a stand-in entry form, not the real editor.
-
-## 8. Not done
-README.md, states.md and the screens/*.md files are not updated with the new counts (group 2 +3, 3 +2, 4 +1, 5 +3, 6 +10, 1 +1, new groups 10 (8) and 11 (4): 32 states). Light/dark and mobile frames were checked by reading the DOM, not state by state on screen.

docs/design/routes.md

@@ -7,7 +7,7 @@
 | /settings/media/cache | Cache (admin) | none | GET /v1/image-variants/cache, POST /v1/image-variants/cache/purge {scope: all|unused|variant|image} |
 | /media | Media library | page, size, q, filter, sort, view | GET /v1/media/?page=&size=&q=&filter=&variants=&sort= (page, size; total in the `X-Total-Count` header) |
 | /media (detail) | Variants tab | none | GET /v1/media/{id}/variants, POST and DELETE /v1/media/{id}/variants/{name} |
-| /articles | Articles list | page, size, tab, q | GET /v1/article/?page=&size=&q=&status= (page, size; total in the `X-Total-Count` header; array body unchanged) |
+| /articles | Articles list | site, lang, tab, q, status, author, seo, page, size | GET /v1/article/?page=&size=&q=&status=&site=&seo= returns `{ items, total, page, size, counts }`. Proposed on top: `lang`, `tab=all\|missing\|review` (see Localization). The old array body with `X-Total-Count` no longer applies to articles; media and authors still use it |
 | /activity | Activity | q, actor, category, outcome, security, range, from, to, page, size | GET /v1/activity (page, size), GET /v1/activity/export (shipped, CSV) |
 | /integration | Integration | none | none |
 | /settings/sites | Sites (owner only; other roles get a 403 page and no sidebar entry): list, add and edit slide-over, delete with reassignment. The key is read-only after creation | none | GET/POST /v1/site/, PATCH/DELETE /v1/site/{id} (DELETE takes `reassign_to`) |
@@ -26,7 +26,7 @@
 
 ## Pagination in the URL (Articles, Media)
 `/articles?page=2&size=50` and `/media?page=7&size=50`. Parameter names follow the repo (activity already uses `page` and `size`). Allowed sizes 5, 25, 50, 100. Defaults `page=1`, `size=25`, omitted from the URL when default. Changing search, tab, filter or size resets `page` to 1. `page` above the last page redirects (replace) to the last page and shows "That page doesn't exist. Showing the last page." An invalid `size` falls back to 25.
-**API:** `GET /v1/article/` accepts `page` (default 1) and `size` (5, 25, 50, 100; default 25), as `GET /v1/activity` does. The body stays a JSON array so existing consumers keep working; the total comes back in `X-Total-Count` (the response shape is to be confirmed with the specifier). Anonymous callers only see online articles, and the total counts only those. Invalid `page` or `size` answers 400, the same as Activity.
+**API:** `GET /v1/article/` accepts `page` (default 1) and `size` (5, 25, 50, 100; default 25), as `GET /v1/activity` does. The body is `{ items, total, page, size, counts }` (`counts` feeds the tab numbers); articles no longer send `X-Total-Count`, Media and Authors still do. Anonymous callers only see online articles, and the total counts only those. Invalid `page` or `size` answers 400, the same as Activity.
 
 **Media API:** `GET /v1/media/` takes the same `page` and `size`, with the same 400 and the total in `X-Total-Count`; the array body stays. The earlier `cursor` and `limit` parameters are replaced by them.
 
@@ -81,3 +81,24 @@ Needs backend:
 | /account/email/confirm?c=CODE | Verify new email (AuthCard). States in screens/account.md | Session required; without one, inline log in (as /register/validate) | POST /v1/auth/email/confirm |
 | /profile | Gains change email, Your data, Danger zone | Any verified user | POST /v1/auth/email/change, POST /v1/auth/email/resend, DELETE /v1/auth/email/change, GET /v1/user/me/export, DELETE /v1/user/me |
 | /login?reason=account-deleted | One-time message after deletion | Public | none |
+
+## Localization (proposed; existing routes unchanged)
+Existing: /articles, /article/:id/edit, GET/POST /v1/article/, PATCH /v1/article/{id}, PATCH /v1/article/{id}/publish, PATCH /v1/article/{id}/unpublish, DELETE /v1/article/{id}.
+
+| Route | Purpose | Access |
+|---|---|---|
+| /settings/sites/:key/languages | Site languages, default, disable, re-enable, remove, social locale per language. The only languages route (no global Languages page) | Owner edits, others read |
+| /settings/sites/:key/languages/setup | First-time setup. :key is the site it was opened from; the page lists every site with unlabelled articles | Owner |
+| /settings/sites/:key/public-url | Public URL pattern (placeholders {lang}, {slug}) | Owner edits, others read |
+| /articles?site&lang&tab=all\|missing\|review&q&status&author&seo&page&size | Article list. Defaults omitted; filter changes reset page | Per article permission |
+| /article/:id/edit | Editor, one id per language version | Per version capability |
+| /article/:id/edit?ref=:sourceId | Temporary source reference (release 2). Does not change the tracked source | Read access to the reference |
+| /article/:id/edit?dialog=add-translation&lang=fr | Add translation dialog | create-translation |
+| /article/:id/edit?panel=seo | Search and sharing panel | edit |
+
+Removed: /settings/languages and /settings/languages/setup (replaced by the site-scoped routes above). The old list params `mode` and `needs_review` are gone; `tab` replaces them.
+
+Proposed API: GET /v1/article/ adds lang, tab=all|missing|review. GET /v1/article/{id} adds lang, story_id, capabilities[], translations[] (readable only), source. POST /v1/article/ adds lang, story_id, source_article_id, copy. POST /v1/article/{id}/translations. POST /v1/article/{id}/review (release 2). PATCH /v1/article/{id}/source (release 2). GET/PUT /v1/site/{key}/languages (adds social_locale per language). GET/PUT /v1/site/{key} adds public_url_pattern. GET/POST /v1/language/setup. POST /v1/story/{story_id}/move. PATCH /v1/article/{id} accepts if_revision (conflict response). Public: GET /v1/public/site/{key}/lang/{lang}/article/{slug} and GET /v1/public/site/{key}/story/{story_id}?lang=&fallback=default. The earlier GET /v1/public/site/{key}/article/{slug}?lang= is removed.
+Sidebar: there is no Languages item. Languages is reached only from Settings → Sites → [site] → Languages (and the Set article languages banner for first-time setup). The sidebar item list in components.md is unchanged.
+Field name is `lang` everywhere; the public list of other versions is `alternates`, the editor list is `translations`.
+Details: see Localization board tables (Public lookup and URLs, Visibility policy).

docs/design/screens/account.md

@@ -51,7 +51,7 @@ Contents listed in the card: Profile (Username, display name, email, role and au
 | Requested | "We're preparing your export" · "This can take a few minutes. We'll email a link to marta@renew.example when it's ready." · "Export requested"; toast "Export requested" / "Check marta@renew.example in a few minutes." |
 | Already in progress | "An export is already being prepared" · "We'll email a link to marta@renew.example when it's ready." |
 
-Recommendation: direct download; async is the documented alternative and uses the export-ready email.
+Decision: direct download. An emailed export link is out of scope.
 
 ## Delete account
 Danger zone: "Danger zone" · "Delete your account and your personal data. This can't be undone." · "Delete my account".

docs/design/screens/articles.md

@@ -1,10 +1,10 @@
 # Articles
 
-Route: `/article`, `/articles?page=2&size=50`. API: GET /v1/article/ · PATCH …/publish · PATCH …/unpublish · DELETE /v1/article/{id} · GET /v1/article/?page=&size=&q=&status= (page, size; total in the X-Total-Count header; invalid values are normalised in the URL, never shown as an error).
+Route: `/article`, `/articles?page=2&size=50`. API: GET /v1/article/ · PATCH …/publish · PATCH …/unpublish · DELETE /v1/article/{id} · GET /v1/article/?page=&size=&q=&status=&site=&seo= returns { items, total, page, size, counts } (invalid values are normalised in the URL, never shown as an error).
 
 Rows update when the server responds, not optimistically. Search, tab and sort are stored in the query string.
 
-Visual reference: `RenewCMS Screens Back-office.dc.html`, groups "Articles", "Articles: pagination". Frames: `AppFrame.dc.html` (shell, sidebar, topbar, drawer) plus the screen frame where listed in components.md.
+Visual reference and pixel gate: `RenewCMS Screens Localization.dc.html`, group L7s (single-language site) and L7 (several languages), drawn by LocaleFrame with the shipped AppPaginator. The Back-office groups "Articles" and "Articles: pagination" are superseded for the list layout; they stay as the copy reference for states the new groups do not repeat. Frames: `AppFrame.dc.html` (shell, sidebar, topbar, drawer) plus the screen frame where listed in components.md.
 
 ## Copy per state (generated from the board source, pass 2)
 
@@ -47,12 +47,12 @@ Rows update when the server responds, not optimistically. Search, tab and sort a
 | 10 | Row vanished (404) | Any row action gets a 404. | "That article no longer exists" / "It was deleted somewhere else, so we removed it from the list." |
 | 11 | Delete: confirm | Delete… from the row menu. |  |
 | 12 | Delete: in progress | DELETE in flight. The dialog can't be dismissed. |  |
-| 13 | Delete: failed | 500, a partial failure where the article is kept. The error shows inside the dialog. | "Couldn't delete the article, so it's still there. Try again in a moment." |
+| 13 | Delete: failed | 500 or network failure. Deleting is atomic, so nothing is removed and every version is still there. The error shows inside the dialog. | "Couldn't delete the article." / "Nothing was deleted. Every version is still there. Try again in a moment." |
 | 14 | Deleted | 204: the row is removed and focus moves to the next row. This is also where a delete from the editor ends up. | "Article deleted" / ""Winter checklist for timber windows" and its images are gone." |
 
 ### Articles: pagination (group "Articles: pagination", 11 states)
 
-Route: `/articles?page=2&size=50`. API: GET /v1/article/?page=&size=&q=&status= (page, size; total in the X-Total-Count header; invalid values are normalised in the URL, never shown as an error).
+Route: `/articles?page=2&size=50`. API: GET /v1/article/?page=&size=&q=&status=&site=&seo= returns { items, total, page, size, counts } (invalid values are normalised in the URL, never shown as an error).
 
 Page and page size live in the URL as page and size. Defaults (page 1, size 25) are omitted. Allowed sizes 5, 25, 50, 100. Search, tab or sort changes reset to page 1. Rows equal the page size; the frames draw at most 10 rows. The paginator hides when everything fits on one page; the summary stays. Mobile shows Previous, "Page N of M" and Next. Keyboard: Tab reaches page size, first, previous, each page, next, last; Enter or Space activates; the current page has aria-current="page"; ArrowDown opens the page-size list, Enter selects, Esc closes.
 
@@ -99,3 +99,6 @@ A quiet indicator in the Status cell on desktop and under the title on mobile ca
 | 3 | Needs attention: none | Nothing to show with the toggle on. | Nothing needs attention · Every article has a clean check. Suggestions are optional, so this is just a bonus. · Show all articles |
 
 Filter: "Needs attention" sets `?seo=suggestions` and resets `page` to 1. Tab counts do not change. Single-site installs behave the same; the Site filter stays hidden.
+
+## Localization
+Localization: modes All languages (stories), Language selected (versions), Missing language (stories); mobile filter sheet, scrollable tabs, pager; state in URL. See routes.md.

docs/design/screens/content.md

@@ -23,4 +23,4 @@ The sidebar gets a "Content" group, one item per custom type (a default icon: ty
 | 9 | Type not found | 404 content_type_not_found on /content/unknown. | Content type not found · It may have been deleted, or the address may be mistyped. · Go to Home | Available now |
 
 ## Media field (pass 5)
-Spec, states, exact copy, measurements, backend needs and accessibility: `media-field-changes.md`, section 3.5. Board groups: 5 Content and entry list.
+Spec, states, exact copy, measurements, backend needs and accessibility: `media-field.md`, section 3.5. Board groups: 5 Content and entry list.

docs/design/screens/editor.md

@@ -175,3 +175,6 @@ A read-only dialog (desktop, 720 px) or bottom sheet (mobile) with the resolved
 | 4 | Draft article | Drafts answer 404 to anonymous callers. | This article is a draft. The API returns this data only to signed-in callers until it is published. |
 | 5 | Loading | Copy is disabled. | – |
 | 6 | Error | GET failed. Nothing in the article changes. | Couldn't load the SEO data · GET /v1/article/12/seo failed. Your article is unchanged. Try again in a moment. · Try again |
+
+## Localization
+Localization: actions render from per-version capabilities (read, edit, publish, delete, create-translation, review); title is an inline input; slug changes only via Edit slug. See Localization board.

docs/design/screens/entry.md

@@ -27,4 +27,4 @@ The form is generated from the schema, one control per field in schema order. Re
 | 13 | Delete entry: confirm | Delete. | Delete this entry? · "Lime plaster workshop" will be deleted from Events. This can't be undone. · Cancel · Delete entry | Available now |
 
 ## Media field (pass 5)
-Spec, states, exact copy, measurements, backend needs and accessibility: `media-field-changes.md`, section 3.6. Board groups: 6 Entry editor.
+Spec, states, exact copy, measurements, backend needs and accessibility: `media-field.md`, section 3.6. Board groups: 6 Entry editor.

docs/design/screens/localization-conflicts-moves.md

@@ -0,0 +1,36 @@
+# Localization: conflicts and article moves
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Data: locale-fixtures.js (single fixture source), tables in locale-spec.js. UI copy says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing text.
+
+## L11 Conflicts and sessions
+Route: editor
+API: existing 401/403/404/409 patterns
+
+The conflict dialog gives four choices. Keep my changes is the only filled button; the other three are secondary and equal. "Someone else saved this version at <time>". No revision numbers. On mobile the dialog is a bottom sheet with Keep my changes first, so it needs no scrolling at 390 px.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l11.session | Session expired | Draft kept in this browser; editor behind shows the unsaved changes | LocaleFrame{s:{v:"pm",x:"session"}} | 1440, 390 | Journal |
+| loc.l11.restored | Restored after login | Editor shows "Restored unsaved changes from 14:18" | LocaleFrame{s:{v:"pm",x:"restored"}} | 1440, 390 | Journal |
+| loc.conflict | Concurrent update | Four choices, local work kept; Save over theirs outlined in error colour with a warning icon | LocaleFrame{s:{v:"pm",x:"conflict"}} | 1440, 390 | Journal |
+| loc.l11.conflictRestored | Concurrent update after session expiry | Restored changes notice above the choices | LocaleFrame{s:{v:"pm",x:"conflictRestored"}} | 1440, 390 | Journal |
+| loc.l11.reloadConfirm | Reload theirs: confirm | "This discards your unsaved changes." | LocaleFrame{s:{v:"pm",x:"reloadConfirm"}} | 1440, 390 | Journal |
+| loc.l11.conflict2 | Second conflict | Save over theirs failed again; nothing overwritten | LocaleFrame{s:{v:"pm",x:"conflict2"}} | 1440, 390 | Journal |
+| loc.l11.download | Download started | Toast; changes still in the editor | LocaleFrame{s:{v:"pm",x:"download"}} | 1440, 390 | Journal |
+
+## L11b Move article to another site
+Route: editor → site select
+API: proposed: POST /v1/story/{story_id}/move { site }
+
+Entry point is the site select in the editor details. Articles move as a whole, only when the destination enables every language they contain (disabled ones included) and the user can edit all versions. The note lists readable versions only; versions the user can't read are not listed or counted. Moves are atomic and revalidate permissions and conflicts in the transaction.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l11b.moveSelect | Site select | Note lists all four versions, one tagged Read only | LocaleFrame{s:{v:"pm",x:"moveSelect"}} | 1440, 390 | Journal |
+| loc.l11b.moveSelectHidden | Site select, hidden version | Arabic not readable: not listed or counted | LocaleFrame{s:{v:"pm",x:"moveSelectHidden"}} | 1440, 390 | Journal |
+| loc.l11b.moveConfirm | Confirm | Move to Atelier? | LocaleFrame{s:{v:"pm",x:"moveConfirm"}} | 1440, 390 | Journal |
+| loc.l11b.moveBusy | In progress | Dialog locked | LocaleFrame{s:{v:"pm",x:"moveBusy"}} | 1440, 390 | Journal |
+| loc.l11b.moveDone | Moved | Toast | LocaleFrame{s:{v:"pm",x:"moveDone"}} | 1440, 390 | Journal |
+| loc.l11b.move | Language missing in destination | Notes enables English only | LocaleFrame{s:{v:"pm",x:"move"}} | 1440, 390 | Journal, Notes |
+| loc.l11b.moveSlug | Address conflict | Names the conflicting readable version and its address; unreadable ones are never named | LocaleFrame{s:{v:"pm",x:"moveSlug"}} | 1440, 390 | Journal, Atelier |
+| loc.l11b.movePerm | No permission | Neutral | LocaleFrame{s:{v:"pm",x:"movePerm"}} | 1440, 390 | Journal |
+| loc.l11b.moveFail | Move failed | Server error, nothing moved | LocaleFrame{s:{v:"pm",x:"moveFail"}} | 1440, 390 | Journal |

docs/design/screens/localization-editor.md

@@ -0,0 +1,80 @@
+# Localization: editor header, permissions, publishing
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Data: locale-fixtures.js (single fixture source), tables in locale-spec.js. UI copy says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing text.
+
+## L5 Editor: header, actions and title
+Route: /article/{id}/edit (one id per version)
+API: proposed: GET /v1/article/{id} → translations[], capabilities[]
+
+Header priority and the action matrix are in the tables below. One filled primary button at most: Save and publish when allowed, dirty and offline; otherwise Save when dirty; otherwise Publish when clean and offline. Save stays separate and secondary. Desktop collapse order as width shrinks (1440 → 1024): reference button loses its label, Unpublish moves to the overflow menu, the freshness badge becomes icon-only. Mobile: title, language, publication and dirty badges stay at the top; Save, primary and an overflow button sit in a fixed bottom bar; reference, Unpublish, Edit slug, Move and Delete go to the overflow sheet. The language control is a menu button with a menu (not a listbox).
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l5.default | Clean draft | Open a draft you can publish; title pristine | LocaleFrame{s:{v:"ed",x:"default"}} | 1440, 1024, 390 | Journal |
+| loc.l5.dirty | Dirty draft | Can edit, can't publish: Save is primary | LocaleFrame{s:{v:"ed",x:"dirty"}} | 1440, 1024, 390 | Journal |
+| loc.l5.dirtyPublish | Dirty draft, publish allowed | Save and publish French is primary; Save secondary | LocaleFrame{s:{v:"ed",x:"dirtyPublish"}} | 1440, 1024, 390 | Journal |
+| loc.l5.cleanOnline | Clean online | Unpublish only; no primary | LocaleFrame{s:{v:"ed",x:"cleanOnline"}} | 1440, 1024, 390 | Journal |
+| loc.l5.onlineDirty | Dirty online | Save updates the live page; Unpublish stays | LocaleFrame{s:{v:"ed",x:"onlineDirty"}} | 1440, 1024, 390 | Journal |
+| loc.l5.saving | Saving | Save in flight | LocaleFrame{s:{v:"ed",x:"saving"}} | 1440, 390 | Journal |
+| loc.l5.saved | Saved | Toast | LocaleFrame{s:{v:"ed",x:"saved"}} | 1440, 390 | Journal |
+| loc.l5.saveFail | Save failed | Stays unsaved; Try saving again; nothing published | LocaleFrame{s:{v:"ed",x:"saveFail"}} | 1440, 1024, 390 | Journal |
+| loc.l5.pubFail | Publish failed after save | Saved as a draft; Retry publish; edits shown as saved | LocaleFrame{s:{v:"ed",x:"pubFail"}} | 1440, 1024, 390 | Journal |
+| loc.l5.ovf | Overflow menu | More actions (sheet on mobile) | LocaleFrame{s:{v:"ed",x:"ovf"}} | 1440, 390 | Journal |
+| loc.l5.menu | Menu: four languages | Open menu | LocaleFrame{s:{v:"ed",x:"menu"}} | 1440, 390 | Journal |
+| loc.l5.two | Menu: two languages | Two-language site | LocaleFrame{s:{v:"ed",x:"two"}} | 1440, 390 | Journal |
+| loc.l5.many | Menu: many languages | Scrolls inside the viewport, with filter | LocaleFrame{s:{v:"ed",x:"many"}} | 1440, 390 | Journal |
+| loc.l5.unsaved | Switch with unsaved changes | Choose English while dirty | LocaleFrame{s:{v:"ed",x:"unsaved"}} | 1440, 390 | Journal |
+| loc.l5.loading | Loading version | Slow switch | LocaleFrame{s:{v:"ed",x:"loading"}} | 1440, 390 | Journal |
+| loc.l5.navFail | Switch failed | Stays on current version | LocaleFrame{s:{v:"ed",x:"navFail"}} | 1440, 390 | Journal |
+| loc.l5.gone | Version unavailable | Deleted or no access (neutral) | LocaleFrame{s:{v:"ed",x:"gone"}} | 1440, 390 | Journal |
+| loc.l5.focus | Title: focus | Field focused, not changed | LocaleFrame{s:{v:"ed",x:"focus"}} | 1440, 390 | Journal |
+| loc.l5.titleEdit | Title: editing | Typing; counter shown | LocaleFrame{s:{v:"ed",x:"titleEdit"}} | 1440, 390 | Journal |
+| loc.l5.titleUnsaved | Title: unsaved | Changed, focus left | LocaleFrame{s:{v:"ed",x:"titleUnsaved"}} | 1440, 390 | Journal |
+| loc.l5.invalid | Title: invalid | Empty: "Enter a title" | LocaleFrame{s:{v:"ed",x:"invalid"}} | 1440, 390 | Journal |
+| loc.l5.titleShort | Title: too short | Under 3 characters | LocaleFrame{s:{v:"ed",x:"titleShort"}} | 1440, 390 | Journal |
+| loc.l5.titleLong | Title: too long | Over 200 characters | LocaleFrame{s:{v:"ed",x:"titleLong"}} | 1440, 390 | Journal |
+| loc.l5.titleSaving | Title: saving | Save in flight | LocaleFrame{s:{v:"ed",x:"titleSaving"}} | 1440, 390 | Journal |
+| loc.l5.failed | Title: save failed | Text kept, still unsaved, Try again | LocaleFrame{s:{v:"ed",x:"failed"}} | 1440, 390 | Journal |
+| loc.l5.menuDisabled | Language menu with a disabled language | Spanish is disabled: Disabled tag, version stays readable | LocaleFrame{s:{v:"ed",x:"menuDisabled"}} | 1440, 390 | Journal |
+
+## L5b Permission states (per version)
+Route: /article/{id}/edit
+API: capabilities[] on GET /v1/article/{id}; every PATCH/DELETE rechecked on the server
+
+Every action renders from its own capability (read, edit, publish, delete, create translation, review). See the capability matrix. Missing-translation rows appear only for users who can create; unreadable siblings are absent with no placeholder and no count. The formatting toolbar is hidden whenever edit is missing.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.perm.readonly | P1 Read-only version | Banner, read-only fields, no Save, Publish, Delete, toolbar; reference stays | LocaleFrame{s:{v:"perm",x:"ro"}} | 1440, 1024, 390 | Journal |
+| loc.l5b.roMenu | P1 menu | No Add translation row | LocaleFrame{s:{v:"perm",x:"roMenu"}} | 1440, 390 | Journal |
+| loc.perm.editNoPublish | P2 Edit, no publish | Save only; hint about the publish permission | LocaleFrame{s:{v:"perm",x:"p2"}} | 1440, 1024, 390 | Journal |
+| loc.perm.publishNoEdit | P3 Publish, no edit | Publish only; fields read-only | LocaleFrame{s:{v:"perm",x:"p3"}} | 1440, 1024, 390 | Journal |
+| loc.perm.siblingReadOnly | P4 Sibling readable, not editable | Arabic row tagged Read only | LocaleFrame{s:{v:"perm",x:"p4"}} | 1440, 390 | Journal |
+| loc.perm.siblingHidden | P5 Sibling not readable | German absent, no count, no placeholder | LocaleFrame{s:{v:"perm",x:"p5"}} | 1440, 390 | Journal |
+| loc.perm.createNotAll | P6 Can create, not modify all | Delete article and Move disabled with the reason; Delete French version available | LocaleFrame{s:{v:"perm",x:"p6"}} | 1440, 390 | Journal |
+| loc.l5b.noAdd | Menu without Add translation | No create permission; Arabic is missing but offers nothing | LocaleFrame{s:{v:"perm",x:"noAdd"}} | 1440, 390 | Journal |
+| loc.l5b.withAdd | Menu with Add translation | Same article, user may create | LocaleFrame{s:{v:"perm",x:"withAdd"}} | 1440, 390 | Journal |
+
+## L8 Publishing and deletion
+Route: same as the editor
+API: existing PATCH /v1/article/{id}/publish and /unpublish and DELETE per article id
+
+Every action names its language. No bulk publish. With unsaved edits the primary reads Save and publish and saves first; if the save fails nothing is published and the edits stay unsaved; if the save works and publishing fails the edits show as saved. Unpublish never saves: the saved version goes offline and local edits stay in the editor. Saving an online version updates the live page immediately, and the editor says so. Deletion confirmations name only readable versions.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l8.publish | Publish French | Confirm, English untouched | LocaleFrame{s:{v:"pd",x:"publish"}} | 1440, 390 | Journal |
+| loc.lang.publishDisabled | Publishing blocked: language disabled | French disabled on the site | LocaleFrame{s:{v:"pd",x:"publishDisabled"}} | 1440, 390 | Journal |
+| loc.l8.saveAndPublish | Save and publish French | Unsaved edits: saves first, then publishes | LocaleFrame{s:{v:"pd",x:"saveAndPublish"}} | 1440, 390 | Journal |
+| loc.l8.saveFailPublish | Save failed, nothing published | Error banner above the editor and an error toast; Save failed badge, primary Try saving again, edits kept, nothing published | LocaleFrame{s:{v:"pd",x:"saveFailPublish"}} | 1440, 390 | Journal |
+| loc.l8.unpublish | Unpublish French | Confirm | LocaleFrame{s:{v:"pd",x:"unpublish"}} | 1440, 390 | Journal |
+| loc.l8.unpublishDirty | Unpublish with unsaved edits | Saved version goes offline; edits kept; nothing saved | LocaleFrame{s:{v:"pd",x:"unpublishDirty"}} | 1440, 390 | Journal |
+| loc.l8.delete | Delete French version | Confirm | LocaleFrame{s:{v:"pd",x:"delete"}} | 1440, 390 | Journal |
+| loc.l8.deleteSource | Delete a source version | Names the readable versions that track the source; warns review tracking pauses | LocaleFrame{s:{v:"pd",x:"deleteSource"}} | 1440, 390 | Journal |
+| loc.l8.deleteLast | Delete the only version | Deletes the article | LocaleFrame{s:{v:"pd",x:"deleteLast"}} | 1440, 390 | Journal |
+| loc.l8.deleteStoryOk | Delete article (all readable versions) | Names readable versions only | LocaleFrame{s:{v:"pd",x:"deleteStoryOk"}} | 1440, 390 | Journal |
+| loc.l8.deleteStory | Delete article blocked | Neutral, no version named | LocaleFrame{s:{v:"pd",x:"deleteStory"}} | 1440, 390 | Journal |
+| loc.l8.done | Published | Toast "French published" and the online banner; badge Published, status Saved | LocaleFrame{s:{v:"pd",x:"done"}} | 1440, 390 | Journal |
+| loc.l8.fail | Publish failed | Toast | LocaleFrame{s:{v:"pd",x:"fail"}} | 1440, 390 | Journal |
+| loc.l8.deleteDone | French version deleted | Toast; editor opens English | LocaleFrame{s:{v:"pd",x:"deleteDone"}} | 1440, 390 | Journal |
+| loc.l8.deleteStoryFail | Delete article failed | Dialog error; nothing deleted | LocaleFrame{s:{v:"pd",x:"deleteStoryFail"}} | 1440, 390 | Journal |
+| loc.l8.deleteStoryDone | Article deleted | Toast on the Articles list | LocaleFrame{s:{v:"li",x:"deleteStoryDone"}} | 1440, 390 | Journal |

docs/design/screens/localization-list.md

@@ -0,0 +1,43 @@
+# Localization: article list and coverage
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Data: locale-fixtures.js (single fixture source), tables in locale-spec.js. UI copy says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing text.
+
+## L7 Article list and coverage
+Route: /articles?site&lang&tab=all|missing|review&q&status&author&seo&page&size
+API: proposed: lang, tab=all|missing|review on GET /v1/article/ (same names as the URL)
+
+Journal: 8 articles, 17 versions, page size 5. The list header shows the unit: "8 articles" (all languages, one row per article with its translations), "4 French versions" (language selected), "4 articles not in French" (missing tab), "7 articles need translation", "2 articles need review". Coverage chips: default language first, then other existing versions, then disabled-language versions, then dashed missing chips (only for languages the user can create). Chips collapse after 5 at 1440 and 4 at 1024 and 390, leaving a "+N" chip. Row actions are the same on every width: Open, Open another language, Add translation, Publish or Unpublish, Copy API URL, Delete version; every row has the row menu button. All state is in the URL.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l7.all | All languages, page 1 | 5 of 8 articles | LocaleFrame{s:{v:"li",x:"all"}} | 1440, 1024, 390 | Journal |
+| loc.l7.page2 | All languages, page 2 (last) | 3 of 8 articles | LocaleFrame{s:{v:"li",x:"page2"}} | 1440, 1024, 390 | Journal |
+| loc.l7.fr | French selected | 4 French versions | LocaleFrame{s:{v:"li",x:"fr"}} | 1440, 1024, 390 | Journal |
+| loc.l7.frMissing | Not in French | 4 articles not in French | LocaleFrame{s:{v:"li",x:"frMissing"}} | 1440, 1024, 390 | Journal |
+| loc.l7.emptyMissing | Nothing missing | Press: all articles translated; no summary, no pager | LocaleFrame{s:{v:"li",x:"emptyMissing"}} | 1440, 1024, 390 | Press |
+| loc.l7.noResults | No results | Search "zinc"; every count 0 | LocaleFrame{s:{v:"li",x:"noResults"}} | 1440, 1024, 390 | Journal |
+| loc.l7.frLoading | Loading | Counts shown as – | LocaleFrame{s:{v:"li",x:"frLoading"}} | 1440, 1024, 390 | Journal |
+| loc.l7.listFail | Failed | Filters kept | LocaleFrame{s:{v:"li",x:"listFail"}} | 1440, 1024, 390 | Journal |
+| loc.l7.limited | Limited access | Reads English only, can't create: no dashed chips | LocaleFrame{s:{v:"li",x:"limited"}} | 1440, 1024, 390 | Journal (limited scope) |
+| loc.l7.review | Needs review tab | 2 articles need review | LocaleFrame{s:{v:"li",x:"review"}} | 1440, 1024, 390 | Journal |
+| loc.l7.author | Author filter | Marta Alves: 3 articles, chips and Clear all | LocaleFrame{s:{v:"li",x:"author"}} | 1440, 1024, 390 | Journal |
+| loc.l7.langFilter | Language filter | Enabled and Disabled groups | LocaleFrame{s:{v:"li",x:"langFilter"}} | 1440, 1024, 390 | Journal |
+| loc.l7.rowMenu | Row menu | Same actions on desktop and mobile | LocaleFrame{s:{v:"li",x:"rowMenu"}} | 1440, 1024, 390 | Journal |
+| loc.l7.filters | Mobile filter sheet | Journal, French, Draft: 2 results | LocaleFrame{s:{v:"li",x:"filters"}} | 1440, 1024, 390 | Journal |
+| loc.l7.tabsScroll | Tabs scrolled | Not in French reachable; fade and chevrons | LocaleFrame{s:{v:"li",x:"tabsScroll"}} | 1440, 390 | Journal |
+| loc.l7.long | Eight languages, long labels, filters | Atelier: chips collapse to +3, +4, +4; Draft and SEO filters | LocaleFrame{s:{v:"li",x:"long"}} | 1440, 1024, 390 | Atelier |
+
+## L7s Article list, single-language site
+Route: /articles?site=archive&q&status&page&size
+API: GET /v1/article/?page=&size=&q=&status=&site= returns { items, total, page, size, counts }
+
+Replaces the old Articles board frames as the pixel-gate reference for the list. A site with one language has no language filter, no coverage column, no Needs translation or Needs review tabs, and its menu labels name no language. The pager is AppPaginator: summary "Showing 1–5 of 5", rows-per-page select, first, previous, page numbers, next and last (390 px: summary and select, then Previous, "Page N of M", Next). Hidden controls when everything fits on one page; the summary stays.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l7s.default | Default | Archive: 5 articles on one page, no language filter, coverage column or tabs | LocaleFrame{s:{v:"li",x:"single"}} | 1440, 390 | Archive |
+| loc.l7s.draft | Draft filter | Status: Draft | LocaleFrame{s:{v:"li",x:"singleDraft"}} | 1440, 390 | Archive |
+| loc.l7s.noResults | No results | Search "zinc" | LocaleFrame{s:{v:"li",x:"singleNoResults"}} | 1440, 390 | Archive |
+| loc.l7s.empty | Empty | Gallery: no articles | LocaleFrame{s:{v:"li",x:"singleEmpty"}} | 1440, 390 | Gallery |
+| loc.l7s.loading | Loading | Counts shown as – | LocaleFrame{s:{v:"li",x:"singleLoading"}} | 1440, 390 | Archive |
+| loc.l7s.fail | Failed | Filters kept | LocaleFrame{s:{v:"li",x:"singleFail"}} | 1440, 390 | Archive |
+| loc.l7s.menu | Row menu | Open, Unpublish, Copy API URL, Delete article: no language named | LocaleFrame{s:{v:"li",x:"singleMenu"}} | 1440, 390 | Archive |

docs/design/screens/localization-metadata-api.md

@@ -0,0 +1,16 @@
+# Localization: metadata and public API
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Data: locale-fixtures.js (single fixture source), tables in locale-spec.js. UI copy says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing text.
+
+## L10 Metadata and public API
+Route: Search and sharing panel · /integration
+API: existing slug, SEO fields; proposed alternates[], lang; exact lookup by site + lang + slug; resolution by story_id
+
+Slug is unique per (site, lang). Exact lookup is by site + language + slug and never falls back. Language resolution and fallback use the stable story_id. Website URLs come from the site's Public URL pattern; without it the panel says "Public URL not configured" and links to the setting. Canonical is the localized page itself unless an override is set. SEO labels: "Fallback: French title", "No fallback", "Empty. English site default not used."
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.seo.noFallback | Search and sharing: French | Search and sharing slide-over on the editor: localized slug, canonical, alternates, fallback labels, Edit slug | LocaleFrame{s:{v:"seo",x:""}} | 1440, 390 | Journal |
+| loc.slug.published | Edit slug | Edit slug dialog over the Search and sharing slide-over: published version warns about old links | LocaleFrame{s:{v:"seo",x:"editSlug"}} | 1440, 390 | Journal |
+| loc.url.unset | Public URL not configured | Search and sharing slide-over: no pattern, no fabricated URL | LocaleFrame{s:{v:"seo",x:"unset"}} | 1440, 390 | Journal |
+| loc.l10.noSocial | Social locale not set | Search and sharing slide-over: fr has no region and none is set, og:locale omitted | LocaleFrame{s:{v:"seo",x:"noSocial"}} | 1440, 390 | Journal |
+| loc.l10.api | Integration: languages | Integration page: exact lookup, resolve by article group, errors | LocaleFrame{s:{v:"api",x:""}} | 1440, 390 | Journal |

docs/design/screens/localization-new-article.md

@@ -0,0 +1,34 @@
+# Localization: new article and add translation
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Data: locale-fixtures.js (single fixture source), tables in locale-spec.js. UI copy says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing text.
+
+## L3 New article
+Route: /articles (New article modal)
+API: existing POST /v1/article/ + proposed lang, story_id
+
+Single-language sites show no language field. Multilingual sites show Language and a New article / Translation of an existing article choice. The translation path uses the same endpoint and rules as Add translation. The picker lists only articles the user can read; the chosen version is the source.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l3.single | Single language | Title and site only | LocaleFrame{s:{v:"na",x:"single"}} | 1440, 390 | Archive |
+| loc.l3.multi | Multilingual: new article | Language defaults to the site default | LocaleFrame{s:{v:"na",x:"multi"}} | 1440, 390 | Journal |
+| loc.l3.translation | Translation of an article | Same fields as Add translation: article, language, source version, title, starting content | LocaleFrame{s:{v:"na",x:"translation"}} | 1440, 390 | Journal |
+| loc.l3.sitechange | Site changed | Selected language not offered by the new site | LocaleFrame{s:{v:"na",x:"sitechange"}} | 1440, 390 | Journal, Notes |
+
+## L4 Add a translation
+Route: /article/{id}/edit?dialog=add-translation&lang=fr
+API: proposed: POST /v1/article/{id}/translations
+
+Always creates a draft. Source: the user picks which readable version to copy from (default: the default-language version if readable, else the first readable). The source version is captured in the same transaction as the copy. Copied text stays in the source language until edited; the version starts as Needs review. Start empty: no tracked source, so freshness shows No source. The primary action stays in the sticky footer on mobile; the body scrolls.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l4.form | Copy from source | Editor → language menu → Add translation | LocaleFrame{s:{v:"at",x:"form"}} | 1440, 390 | Journal |
+| loc.l4.empty | Start empty | Title only; Source version reads No source, Freshness will show No source | LocaleFrame{s:{v:"at",x:"empty"}} | 1440, 390 | Journal |
+| loc.l4.saving | Creating | Submit in flight | LocaleFrame{s:{v:"at",x:"saving"}} | 1440, 390 | Journal |
+| loc.dup.readable | Exists, readable | Conflict; Open offered | LocaleFrame{s:{v:"at",x:"dup"}} | 1440, 390 | Journal |
+| loc.dup.hidden | Exists, not readable | Neutral error, no Open | LocaleFrame{s:{v:"at",x:"dupHidden"}} | 1440, 390 | Journal |
+| loc.l4.fail | Failed | Server error, entries kept | LocaleFrame{s:{v:"at",x:"fail"}} | 1440, 390 | Journal |
+| loc.l4.gone | Source deleted | Deleted while the dialog was open: same neutral message as unreadable, no distinction shown | LocaleFrame{s:{v:"at",x:"gone"}} | 1440, 390 | Journal |
+| loc.l4.unreadable | Source no longer readable | Access lost between opening and submitting: same neutral message as deleted | LocaleFrame{s:{v:"at",x:"unreadable"}} | 1440, 390 | Journal |
+| loc.l4.langOff | Language disabled mid-flow | An owner disabled French while the dialog was open | LocaleFrame{s:{v:"at",x:"langOff"}} | 1440, 390 | Journal |
+| loc.l4.long | Long dialog | Long title, many authors and images; body scrolls, footer stays | LocaleFrame{s:{v:"at",x:"long"}} | 1440, 390 | Journal |

docs/design/screens/localization-review-reference.md

@@ -0,0 +1,43 @@
+# Localization: source reference and review (release 2)
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Data: locale-fixtures.js (single fixture source), tables in locale-spec.js. UI copy says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing text.
+
+## L6 Source reference (release 2) (release 2)
+Route: /article/{id}/edit?ref=:sourceId
+API: proposed: GET /v1/article/{id} (read-only fetch of the reference)
+
+Release 2. The temporary reference (?ref=, dashed outline, "Temporary reference") and the tracked review source (solid "Tracked source" badge in the review banner) are separate: changing the reference never changes the tracked source. Show source reference is in the editor header (desktop, icon-only at 1024) and the overflow sheet (mobile). Each pane scrolls independently. dir and lang go on the title and body of the editing pane and of the reference, never on the app shell.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l6.split | Side by side | Show source reference | LocaleFrame{s:{v:"src",x:"split"}} | 1440, 1024, 390 | Journal |
+| loc.l6.closed | Reference hidden | Hide source reference; button returns | LocaleFrame{s:{v:"src",x:"closed"}} | 1440, 390 | Journal |
+| loc.l6.reopen | Reopened | Scroll positions kept | LocaleFrame{s:{v:"src",x:"reopen"}} | 1440, 390 | Journal |
+| loc.l6.changeRef | Change reference | Menu; tracked source stays English | LocaleFrame{s:{v:"src",x:"changeRef"}} | 1440, 390 | Journal |
+| loc.l6.narrow | Narrow desktop (1024) | True 1024 frame | LocaleFrame{s:{v:"src",x:"narrow"}} | 1024, 390 | Journal |
+| loc.l6.long | Long content | Both panes scroll independently | LocaleFrame{s:{v:"src",x:"long"}} | 1440, 390 | Journal |
+| loc.l6.rtl | Arabic editing, English reference | dir=rtl on the Arabic title and body only | LocaleFrame{s:{v:"src",x:"rtl"}} | 1440, 390 | Journal |
+| loc.l6.arRef | French editing, Arabic reference | dir=rtl on the reference pane only | LocaleFrame{s:{v:"src",x:"arRef"}} | 1440, 390 | Journal |
+| loc.l6.mobileEdit | Mobile: editing | Segment | LocaleFrame{s:{v:"src",x:"mobileEdit"}} | 1440, 390 | Journal |
+| loc.l6.mobileSrc | Mobile: source | Segment | LocaleFrame{s:{v:"src",x:"mobileSrc"}} | 1440, 390 | Journal |
+| loc.l6.mobileClosed | Mobile: closed | Show source reference in the bottom bar or sheet | LocaleFrame{s:{v:"src",x:"mobileClosed"}} | 1440, 390 | Journal |
+| loc.l6.unavail | Reference unavailable | Deleted or unreadable | LocaleFrame{s:{v:"src",x:"unavail"}} | 1440, 390 | Journal |
+
+## L9 Freshness and review (release 2) (release 2)
+Route: editor banner · list badge
+API: proposed: POST /v1/article/{id}/review { source_article_id, source_revision, translation_revision } (internal fields; never shown)
+
+Release 2. Publication (solid badge) and freshness (outlined badge with refresh icon) are separate. Labels: No version, Draft, Needs review, Reviewed. A copied draft starts as Needs review. The dialog shows "Changed fields: Title, Body", the source version with its date and the translation version with its date. No revision numbers appear in the UI.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l9.warn | Source updated | English changed after review | LocaleFrame{s:{v:"fr",x:"warn"}} | 1440, 390 | Journal |
+| loc.l9.pub | Published, needs review | Still online | LocaleFrame{s:{v:"fr",x:"pub"}} | 1440, 390 | Journal |
+| loc.l9.review | Mark reviewed | Confirm with changed fields and dates | LocaleFrame{s:{v:"fr",x:"review"}} | 1440, 390 | Journal |
+| loc.review.changed | Source changed again | During the review | LocaleFrame{s:{v:"fr",x:"changed"}} | 1440, 390 | Journal |
+| loc.l9.changedTr | Translation changed | Saved by someone else while confirming | LocaleFrame{s:{v:"fr",x:"changedTr"}} | 1440, 390 | Journal |
+| loc.l9.replace | Choose tracked source | Cycle prevented | LocaleFrame{s:{v:"fr",x:"replace"}} | 1440, 390 | Journal |
+| loc.src.inaccessible | Source unavailable (access) | History kept | LocaleFrame{s:{v:"fr",x:"inaccessible"}} | 1440, 390 | Journal |
+| loc.src.deleted | Source deleted | Choose a new source | LocaleFrame{s:{v:"fr",x:"gone"}} | 1440, 390 | Journal |
+| loc.l9.done | Reviewed | Toast | LocaleFrame{s:{v:"fr",x:"done"}} | 1440, 390 | Journal |
+| loc.l9.fail | Review failed | Toast | LocaleFrame{s:{v:"fr",x:"fail"}} | 1440, 390 | Journal |
+| loc.l9.frReview | Published and needs review in the list | French tab, Needs review: 2 versions | LocaleFrame{s:{v:"li",x:"frReview"}} | 1440, 1024, 390 | Journal |

docs/design/screens/localization-site-languages.md

@@ -0,0 +1,71 @@
+# Localization: site languages, public URL and setup
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Data: locale-fixtures.js (single fixture source), tables in locale-spec.js. UI copy says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing text.
+
+## L1 Site languages
+Route: /settings/sites/:key/languages
+API: proposed: GET/PUT /v1/site/{key}/languages
+
+Navigation: Settings → Sites → [site] → Languages only. The site name is in the heading and breadcrumb. Site formatting locale, default content language, article language and social locale are four separate values. At least one language stays enabled and the default must be enabled: to retire the default, first Make default on another language, then Disable. Disable and Remove never delete or unpublish content. Disabled languages show a Disabled tag and a Re-enable action; their versions stay readable and editable per permission. Drafts can be published only after Re-enable ("French is disabled on this site. Re-enable it to publish."). The language filter lists them under Disabled. Social locale per language has three states: Derived (from the language code, e.g. pt-BR gives pt_BR), Set (an owner typed it, e.g. fr_FR) and Not set (og:locale left out). Only owners edit it.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l1.single | Single language | Owner opens Languages on Archive (one language, pt-BR kept) | LocaleFrame{s:{v:"sl",x:"single"}} | 1440, 390 | Archive |
+| loc.l1.multi | Multilingual | Journal: four enabled, two disabled (Spanish, Italian) | LocaleFrame{s:{v:"sl",x:"multi"}} | 1440, 1024, 390 | Journal |
+| loc.l1.loading | Loading | Request in flight | LocaleFrame{s:{v:"sl",x:"loading"}} | 1440, 390 | Journal |
+| loc.l1.error | Load failed | Network or server error | LocaleFrame{s:{v:"sl",x:"error"}} | 1440, 390 | Journal |
+| loc.l1.add | Add a language | Add language | LocaleFrame{s:{v:"sl",x:"add"}} | 1440, 390 | Journal |
+| loc.l1.saveFail | Add failed | Server error, selection kept | LocaleFrame{s:{v:"sl",x:"saveFail"}} | 1440, 390 | Journal |
+| loc.l1.adddup | Duplicate language | Already enabled | LocaleFrame{s:{v:"sl",x:"adddup"}} | 1440, 390 | Journal |
+| loc.l1.broader | Only a broader tag supported | Add Portuguese (Portugal): substitution explained, confirmation required | LocaleFrame{s:{v:"sl",x:"broader"}} | 1440, 390 | Journal |
+| loc.l1.default | Make default | Row menu | LocaleFrame{s:{v:"sl",x:"default"}} | 1440, 390 | Journal |
+| loc.l1.defaultFail | Set default failed | Server error, nothing changed | LocaleFrame{s:{v:"sl",x:"defaultFail"}} | 1440, 390 | Journal |
+| loc.l1.disable | Disable with content | Row menu → Disable German | LocaleFrame{s:{v:"sl",x:"disable"}} | 1440, 390 | Journal |
+| loc.l1.stale | Languages changed | Another owner changed them: "Languages changed. Reload." | LocaleFrame{s:{v:"sl",x:"stale"}} | 1440, 390 | Journal |
+| loc.lang.disableDefault | Disable default blocked | Disable English | LocaleFrame{s:{v:"sl",x:"disableDefault"}} | 1440, 390 | Journal |
+| loc.lang.disableLast | Disable last blocked | Only one enabled | LocaleFrame{s:{v:"sl",x:"disableLast"}} | 1440, 390 | Journal |
+| loc.l1.reenable | Re-enable | Spanish row → Re-enable | LocaleFrame{s:{v:"sl",x:"reenable"}} | 1440, 390 | Journal |
+| loc.l1.reenableDone | Re-enabled | Toast after success | LocaleFrame{s:{v:"sl",x:"reenableDone"}} | 1440, 390 | Journal |
+| loc.l1.reenableFail | Re-enable failed | Dialog error, still disabled | LocaleFrame{s:{v:"sl",x:"reenableFail"}} | 1440, 390 | Journal |
+| loc.l1.remove | Remove (no content) | Italian (0 versions) | LocaleFrame{s:{v:"sl",x:"remove"}} | 1440, 390 | Journal |
+| loc.l1.removeFail | Remove failed | Dialog error, still listed | LocaleFrame{s:{v:"sl",x:"removeFail"}} | 1440, 390 | Journal |
+| loc.l1.removeBlocked | Remove blocked | Spanish has versions | LocaleFrame{s:{v:"sl",x:"removeBlocked"}} | 1440, 390 | Journal |
+| loc.l1.readonly | Read-only view | Non-owner: list and social locale readable; no controls | LocaleFrame{s:{v:"sl",x:"readonly"}} | 1440, 390 | Journal |
+| loc.l1.saved | Saved | After Add language | LocaleFrame{s:{v:"sl",x:"saved"}} | 1440, 390 | Journal |
+| loc.l1.social | Social locale: three states | Atelier: Derived en_GB and pt_BR, Set fr_FR, Not set | LocaleFrame{s:{v:"sl",x:"social"}} | 1440, 1024, 390 | Atelier |
+| loc.l1.socialEdit | Social locale: edit | Edit on French (Set: fr_FR) | LocaleFrame{s:{v:"sl",x:"socialEdit"}} | 1440, 390 | Atelier |
+| loc.l1.socialInvalid | Social locale: invalid | fr-FR typed with a hyphen | LocaleFrame{s:{v:"sl",x:"socialInvalid"}} | 1440, 390 | Atelier |
+
+## L1b Public URL pattern (owner setting)
+Route: /settings/sites/:key/public-url
+API: proposed: GET/PUT /v1/site/{key} { public_url_pattern }
+
+Owner-only. One pattern per site, for example https://example.com/{lang}/{slug}. Supported placeholders: {lang} (language code) and {slug} (the article address in that language). {slug} is required: without it every article would share one address. The preview uses a real article of the site. When unset, article panels show "Public URL not configured" and link here. No URL is invented.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l1b.set | Set | Pattern saved, preview shown | LocaleFrame{s:{v:"pu",x:"set"}} | 1440, 390 | Journal |
+| loc.l1b.editing | Editing | Live preview follows the field | LocaleFrame{s:{v:"pu",x:"editing"}} | 1440, 390 | Journal |
+| loc.l1b.unknown | Unknown placeholder | {language} typed | LocaleFrame{s:{v:"pu",x:"unknown"}} | 1440, 390 | Journal |
+| loc.l1b.scheme | Bad scheme | ftp:// typed | LocaleFrame{s:{v:"pu",x:"scheme"}} | 1440, 390 | Journal |
+| loc.l1b.encoded | Not encoded | A space in the path | LocaleFrame{s:{v:"pu",x:"encoded"}} | 1440, 390 | Journal |
+| loc.l1b.noSlug | Missing {slug} | Pattern without {slug} | LocaleFrame{s:{v:"pu",x:"noSlug"}} | 1440, 390 | Journal |
+| loc.l1b.saved | Saved | Toast | LocaleFrame{s:{v:"pu",x:"saved"}} | 1440, 390 | Journal |
+| loc.l1b.unset | Unset | No pattern; opened from "Public URL not configured" | LocaleFrame{s:{v:"pu",x:"unset"}} | 1440, 390 | Journal |
+| loc.l1b.viewOnly | Read-only view | Non-owner: pattern readable, no controls | LocaleFrame{s:{v:"pu",x:"viewOnly"}} | 1440, 390 | Journal |
+| loc.l1b.invalidHost | Invalid host | Pattern with an empty host label | LocaleFrame{s:{v:"pu",x:"invalidHost"}} | 1440, 390 | Journal |
+
+## L2 First-time setup for existing articles
+Route: /settings/sites/:key/languages/setup
+API: proposed: GET /v1/language/setup, POST /v1/language/setup { sites:[{ key, lang }] } (lang is the full tag, e.g. pt-BR)
+
+Opened from the Languages banner of any site; :key is the site it was opened from, and the page lists every site that still has unlabelled articles. Setup assigns a language per site and applies in one transaction. It never translates, links or moves articles. Each site is seeded from its full Site.Locale when a matching language entry exists: pt-BR becomes Portuguese (Brazil). A site with no locale has no seed and the owner must choose. Nothing applies until the owner confirms every row, including a site with no articles. Retrying is safe.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l2.ready | Ready to assign | Journal (en), Notes (no locale, must choose), Archive (pt-BR kept) | LocaleFrame{s:{v:"su",x:"ready"}} | 1440, 390 | Journal, Notes, Archive |
+| loc.l2.noLocale | No-locale site | Notes only: the owner must choose | LocaleFrame{s:{v:"su",x:"noLocale"}} | 1440, 390 | Notes |
+| loc.l2.empty | Site with no articles | Gallery has no articles; en-GB kept, confirm and Save | LocaleFrame{s:{v:"su",x:"empty"}} | 1440, 390 | Gallery |
+| loc.l2.applying | Applying | Request in flight | LocaleFrame{s:{v:"su",x:"applying"}} | 1440, 390 | Journal, Notes, Archive |
+| loc.l2.inProgress | Setup already running | Another owner started it; starting again is safe | LocaleFrame{s:{v:"su",x:"inProgress"}} | 1440, 390 | Journal, Notes, Archive |
+| loc.l2.done | Done | 16 articles labelled | LocaleFrame{s:{v:"su",x:"done"}} | 1440, 390 | Journal, Notes, Archive |
+| loc.l2.fail | Failed | Nothing changed; choices kept; retry is safe | LocaleFrame{s:{v:"su",x:"fail"}} | 1440, 390 | Journal, Notes, Archive |

docs/design/screens/localization-surfaces.md

@@ -0,0 +1,20 @@
+# Localization: existing surfaces
+Board: RenewCMS Screens Localization. Frame: LocaleFrame. Data: locale-fixtures.js (single fixture source), tables in locale-spec.js. UI copy says "article", never "story". No revision numbers, IDs or HTTP status names in user-facing text.
+
+## L12 Existing surfaces
+Route: Home · Activity · Media · editor details
+API: existing; language added where it applies
+
+Single-language sites show none of this. Home counts articles, not versions.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l12.home | Home: recent articles | Default-language title; code only when not default | LocaleFrame{s:{v:"sf",x:"home"}} | 1440, 1024, 390 | Journal |
+| loc.l12.homeFr | Home: reader of French only | Titles in French with code FR | LocaleFrame{s:{v:"sf",x:"homeFr"}} | 1440, 1024, 390 | Journal |
+| loc.l12.activity | Activity | Events name the language | LocaleFrame{s:{v:"sf",x:"activity"}} | 1440, 1024, 390 | Journal |
+| loc.l12.media | Media usage | Media page with the image detail panel: shared image counted once, versions listed, "Used in 2" | LocaleFrame{s:{v:"sf",x:"media"}} | 1440, 1024, 390 | Journal |
+| loc.l12.mediaElsewhere | Media usage: used elsewhere only | Image used only as an author avatar: badge "Used in 1", "Articles" with "No article shows it.", "Used elsewhere" with Author avatar linking to /authors | LocaleFrame{s:{v:"sf",x:"mediaElsewhere"}} | 1440, 390 | Journal |
+| loc.l12.menu | Article menu labels | Articles list, French selected: row menu names the language (Publish French, Delete French version). Bottom sheet at 390 | LocaleFrame{s:{v:"li",x:"menuLang"}} | 1440, 390 | Journal |
+| loc.l12.apiCopy | API URL copy | Articles list: toast after Copy API URL with the ?lang= address. Bottom toast at 390 | LocaleFrame{s:{v:"li",x:"apiCopy"}} | 1440, 390 | Journal |
+| loc.l12.seoPreview | SEO preview | Search and sharing slide-over: localized address and canonical | LocaleFrame{s:{v:"seo",x:"preview"}} | 1440, 390 | Journal |
+| loc.l12.siteFallback | Site text fallback | Search and sharing slide-over: site text used only in its own language | LocaleFrame{s:{v:"seo",x:"siteFallback"}} | 1440, 390 | Journal |

docs/design/screens/media-picker.md

@@ -47,4 +47,4 @@ The Library tab of the picker gets a Variant select. Options are Original plus t
 | 5 | Variant disabled | Same block, different cause. Proposed copy. | "Articles" / "How we price a bathroom renovation" / "Edit article" / "Variant 'hero' is disabled." |
 
 ## Media field (pass 5)
-Spec, states, exact copy, measurements, backend needs and accessibility: `media-field-changes.md`, section 3.7. Board groups: 10 Media picker for a field.
+Spec, states, exact copy, measurements, backend needs and accessibility: `media-field.md`, section 3.7. Board groups: 10 Media picker for a field.

docs/design/screens/media.md

@@ -115,7 +115,7 @@ A secondary "Purge duplicates" button (icon merge) in the toolbar next to the so
 | 2 | Duplicates tab: offline | The button is disabled with the existing banner. |  |
 
 ## Media field (pass 5)
-Spec, states, exact copy, measurements, backend needs and accessibility: `media-field-changes.md`, section 3.8. Board groups: 11 Media library usage.
+Spec, states, exact copy, measurements, backend needs and accessibility: `media-field.md`, section 3.8. Board groups: 11 Media library usage.
 
 ## App sync (batch A)
 - Detail panel, "Used elsewhere" below the articles and entries lists: rows "Author avatar" (/authors) and "Site default social image" (/settings/sites). States: avatar only, site only, both, none (section absent). The "Used in N" badge includes these, N = articles + entries + elsewhere. "Not used in any article" appears only when N is 0; otherwise the line reads "No article shows it."

docs/design/screens/new-article.md

@@ -23,3 +23,6 @@ Recommendation: a modal. Title is the only field. The body is not asked for here
 | 3 | Submitting | Request in flight. Fields are disabled and the dialog can't be dismissed. | "Creating…" / "Choosing tiles for a small bathroom" |
 | 4 | Title rejected (400) | A server 400 that got past the browser checks. The raw error isn't shown. | "Something in the form isn't valid. Check the highlighted fields." / "Choosing tiles for a small bathroom" / "Check this title and try again." |
 | 5 | Error | 500 or network failure. | "Couldn't create the article. Your text is still here. Try again in a moment." / "Choosing tiles for a small bathroom" |
+
+## Localization
+Localization: multilingual sites show Language and New story / Translation of; same rules as POST /v1/article/{id}/translations.

docs/design/screens/schema.md

@@ -78,7 +78,7 @@ One frame per type: inspector options, the entry form control (default and open
 | 6 | Choice | type: "select" | Choice · One option from a list you define · Choices · Choose an option · Choose one of: Talk, Workshop or Meetup. · Another entry already uses this choice for Category. | Available now |
 
 ## Media field (pass 5)
-Spec, states, exact copy, measurements, backend needs and accessibility: `media-field-changes.md`, section 3.1 to 3.4. Board groups: 1 Schema list, 2 Schema builder, 3 Review, 4 Field types.
+Spec, states, exact copy, measurements, backend needs and accessibility: `media-field.md`, section 3.1 to 3.4. Board groups: 1 Schema list, 2 Schema builder, 3 Review, 4 Field types.
 
 ## Permissions (app sync)
 Three keys gate Schema: schema.view (list and read types, and the Schema sidebar entry), schema.edit (create and change types and fields), schema.delete (delete a content type). The built-in Owner and Admin roles hold all three. The app still words the 403 as "Only owners and admins can…"; the design keeps that copy until the app changes. A role with schema.view only sees the builder read-only: Save, Add field, Move and Remove are hidden.

docs/design/seo-slices.md

@@ -1,32 +0,0 @@
-# SEO: decisions and slice order
-
-Spec of record for the design is `change-list.md` (section "SEO round"), `screens/editor.md`, `screens/sites.md`, `screens/articles.md`, `screens/integration.md` and `states.md`. This file records the product decisions that settle the design's open questions, and the order of the implementation slices.
-
-## Decisions on the open questions
-
-| # | Question | Decision |
-| --- | --- | --- |
-| 1 | Is `slug` immutable after publication? | No. It stays editable. RenewCMS does not manage redirects, so the frontend owns them. No extra warning copy is added to the design. |
-| 2 | SEO object for drafts | `GET /v1/article/{id}/seo` answers drafts to authenticated callers who can read the article, and 404 to anonymous callers. The editor preview needs it. |
-| 3 | Noindex in the sitemap | Included with `noindex: true`, as drawn. The frontend decides. |
-| 4 | Who applies `title_template` | The API. `title` in the SEO object is resolved. The raw `seo_title` and the site template stay readable on their own routes. |
-| 5 | Backfill | Migration generates a slug for every existing article from its title (same slug rule as authors), unique per site, with `-2`, `-3` suffixes. A title with no letter or digit becomes `article`, then `article-2`, `article-3`. It runs once and is idempotent. |
-| 6 | Excerpt in the list payload | Yes. Article items carry `excerpt`. |
-
-## Decisions that the design leaves implicit
-
-- Suggestions come from one server-side rule set. The same function feeds `seo_status` and `seo_suggestions` in the article list, the collapsed section summary, and the editor panel.
-- The editor panel's "checking" states and the "slug taken" state use one non-persisting endpoint: `POST /v1/article/{id}/seo/check`. Its body takes the same optional SEO fields as `PATCH /v1/article/{id}`, plus an optional `body` (never `site_id` or `author_ids`), and overrides the saved values for the check only. It answers `{ status, suggestions: [{ code, field, params }], slug: { available, suggestion } }`. Copy for each code lives in the SPA, with a French entry. `seo_dismissed` codes are filtered out of `suggestions` and are never counted in the list.
-- The suggestion codes are the ones the board uses: `title_long`, `title_empty`, `desc_short`, `desc_long`, `cover_alt`, `cover_none`, `slug_long`, `no_au`, `no_h`, `body_alt`, `short`.
-- Cover, social and site social images are media usages: `GET /media/{id}/usage`, `used_in`, the unused filter, merge, purge and delete protection must count them. This also closes the existing gap where author avatars and site social images are missing from `GET /media/{id}/usage`.
-- Roles: anyone who can edit an article edits its SEO fields and runs the check. Only the owner edits site SEO fields (403 "Only the owner can do this."). `GET /v1/site/{key}/sitemap` is public, like the other read routes that serve online articles. SEO edits are logged as an `articles` event; no field values or body text are stored.
-- `PATCH /v1/article/{id}` still requires at least one known field and still answers 400 on `null`. The SEO fields join `body`, `site_id` and `author_ids`.
-
-## Slices
-
-1. **SEO data (backend).** Article and site fields, slug rule and uniqueness per site (409 plain-text `slug_taken`; the first free alternative is in the `X-Slug-Suggestion` response header), backfill, `excerpt` in reads and lists, media usage widening. No resolver yet.
-2. **SEO output (backend).** `GET /v1/article/{id}/seo` (fallback chain, title template, JSON-LD), `POST /v1/article/{id}/seo/check`, `seo_status`, `seo_suggestions` and `?seo=` on the article list, `GET /v1/site/{key}/sitemap`.
-3. **Editor (SPA).** "Search and sharing" section, slide-over and sheet, live previews, suggestions with debounced check, slug field with Auto and Reset, "What the frontend gets" dialog, draft and Save behaviour.
-4. **Sites, Articles, Integration (SPA).** Site SEO defaults, status chip and "Needs attention" filter, Integration "Search and sharing" group, French strings, catalogue.
-
-Run them in order and commit between them: 2 uses the fields of 1, 3 uses the endpoints of 2, and 3 and 4 share the article API types.

docs/design/sites-authors-slices.md

@@ -1,29 +0,0 @@
-# Sites and authors: cross-slice context
-
-The design for Sites and Authors is in `screens/sites.md`, `screens/authors.md`, the "Editor: site and authors", "Profile: author profile" and "Articles: sites and authors" sections of the editor, profile and articles docs, and the board groups listed in `README.md` (pass 3). Behaviour still comes from `features/`; where the two disagree, stop and ask.
-
-## Roles
-| Action | Owner | Admin | Other roles |
-|---|---|---|---|
-| Create, edit, set default, delete a site | yes | no | no |
-| Read the site list, choose an article's site | yes | yes | yes, if they can edit the article |
-| Create, edit, delete any author | yes | yes | no |
-| Read authors, pick authors on an article | yes | yes | yes |
-| Create and edit their own linked author (`POST /v1/author/me`) | yes | yes | yes |
-| Create an author from the editor ("Create author…", "This is me") | yes | yes | no |
-
-## Decisions already taken
-- One site per article (`site_id` on the article). No per-site publish state: `is_online` stays the global switch. API keys stay global.
-- The site key is immutable after creation. Exactly one default site exists and it cannot be deleted. Deleting a site with articles requires `reassign_to`.
-- Authors are separate from users. An optional, unique link to a user. The slug is globally unique and not tied to a site. Zero authors on an article is allowed and never blocks publishing. Deleting an author with articles requires `reassign_to` (an author id or `none`).
-- Media used as an author avatar or a site's default social image counts as media usage.
-- The default site is seeded once from `PUBLIC_URL`. That variable is the CMS's own address (email links), so the seed is only a starting value that the owner edits. The base URL must be https, except for loopback hosts.
-- Existing articles are backfilled to the default site and get no authors.
-
-## Slices, in order
-1. Sites API. 2. Authors API (independent of 1; both touch the article update route and the article response, so merge 1 first and rebase 2).
-3. Sites and Authors screens plus the shared directory pieces (`DirectoryFrame.dc.html`). Existing Editor, Articles and Profile screens are not changed here.
-4. Editor, Articles and Profile integration, which also makes every existing frame of those screens pass the visual check.
-
-## Open point for the first slice
-`PATCH /v1/article/{id}` is served by `UpdateArticleBody` and only updates the body. Extending it with `site_id` and `author_ids[]` or splitting a metadata endpoint is decided in the specifier step of slices 1 and 2.

docs/design/source/AppFrame.dc.html

@@ -148,11 +148,11 @@
 <div style="padding:{{ pad }};display:flex;flex-direction:column;gap:14px;max-width:560px"><span style="font:500 13px 'IBM Plex Mono',monospace;color:var(--ui-text-muted)">404</span><span style="font:600 24px/32px 'IBM Plex Sans',sans-serif;color:var(--ui-text-highlighted)">This article doesn't exist</span><span style="color:var(--ui-text-toned);font-size:14px;line-height:22px">It may have been deleted, or the link is wrong.</span><span data-act="nav-articles" style="align-self:flex-start;height:{{ btnH }};padding:0 12px;display:flex;align-items:center;background:var(--ui-primary);color:var(--ui-bg);font-weight:500">All articles</span></div>
 </sc-if>
 <sc-if value="{{ edFound }}">
-<div style="flex-shrink:0;background:var(--ui-bg);border-bottom:1px solid var(--ui-border);padding:{{ edHeadPad }};display:flex;flex-wrap:wrap;align-items:center;gap:{{ edHeadGap }}">
+<div style="flex-shrink:0;background:var(--ui-bg);border-bottom:1px solid var(--ui-border);padding:{{ edHeadPad }};display:flex;flex-wrap:wrap;align-items:center;gap:{{ edHeadGap }}">{{ edHeader }}<sc-if value="{{ edDefHead }}">
 <sc-if value="{{ desk }}"><span data-act="back" style="width:32px;height:32px;display:flex;align-items:center;justify-content:center;color:var(--ui-text-toned)"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:16px;height:16px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/arrow-left.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/arrow-left.svg') center / contain no-repeat"></span></span></sc-if>
 <div style="flex:1 1 {{ edTitleBasis }};min-width:0;display:flex;align-items:center;gap:10px;flex-wrap:wrap">
 <sc-if value="{{ s.ed.loading }}"><span style="width:320px;max-width:70%;height:20px;background:var(--ui-bg-accented)"></span><span style="width:60px;height:22px;background:var(--ui-bg-accented)"></span></sc-if>
-<sc-if value="{{ edReady }}"><span title="The title can't be changed after creation." style="font:600 18px/26px 'IBM Plex Sans',sans-serif;color:var(--ui-text-highlighted)">{{ edTitle }}</span><sc-if value="{{ edPending }}"><span style="height:26px;padding:0 9px;display:inline-flex;align-items:center;gap:5px;border:1px solid var(--ui-border-accented);color:var(--ui-text-muted);font-size:13px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/loader-circle.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/loader-circle.svg') center / contain no-repeat"></span>{{ s.ed.pending }}</span></sc-if><sc-if value="{{ edOnline }}"><span style="height:26px;padding:0 9px;display:inline-flex;align-items:center;gap:5px;background:var(--ui-bg-inverted);color:var(--ui-text-inverted);font-size:13px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/globe.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/globe.svg') center / contain no-repeat"></span>Online</span></sc-if><sc-if value="{{ edDraft }}"><span style="height:26px;padding:0 9px;display:inline-flex;align-items:center;gap:5px;border:1px solid var(--ui-border-accented);color:var(--ui-text-toned);font-size:13px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/pencil-line.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/pencil-line.svg') center / contain no-repeat"></span>Draft</span></sc-if></sc-if>
+<sc-if value="{{ edReady }}"></sc-if><span title="{{ edTitleTip }}" style="font:600 18px/26px 'IBM Plex Sans',sans-serif;color:var(--ui-text-highlighted);{{ edTitleCss }}">{{ edTitle }}</span><sc-if value="{{ lg }}"><span role="button" aria-haspopup="listbox" aria-expanded="{{ lg.open }}" aria-label="{{ lg.label }}" style="height:{{ lg.h }};max-width:100%;width:max-content;padding:0 8px;display:inline-flex;align-items:center;gap:6px;border:1px solid {{ lg.bd }};background:var(--ui-bg);color:var(--ui-text-highlighted);font-size:13px;font-weight:500;white-space:nowrap;flex-shrink:0"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/languages.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/languages.svg') center / contain no-repeat"></span><span>{{ lg.name }}</span><span style="flex-shrink:0;font:400 12px 'IBM Plex Mono',monospace;color:var(--ui-text-muted)">{{ lg.code }}</span><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/chevrons-up-down.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/chevrons-up-down.svg') center / contain no-repeat"></span></span><sc-if value="{{ lg.ro }}"><span style="height:26px;padding:0 9px;display:inline-flex;align-items:center;gap:5px;background:var(--ui-bg-elevated);color:var(--ui-text-toned);font-size:13px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/lock.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/lock.svg') center / contain no-repeat"></span>Read-only</span></sc-if><sc-if value="{{ lg.fresh }}"><span style="height:26px;padding:0 9px;display:inline-flex;align-items:center;gap:5px;border:1px solid var(--ui-warning);background:var(--ui-bg);color:var(--ui-warning);font-size:13px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/refresh-cw.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/refresh-cw.svg') center / contain no-repeat"></span>{{ lg.fresh }}</span></sc-if><sc-if value="{{ edPending }}"><span style="height:26px;padding:0 9px;display:inline-flex;align-items:center;gap:5px;border:1px solid var(--ui-border-accented);color:var(--ui-text-muted);font-size:13px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/loader-circle.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/loader-circle.svg') center / contain no-repeat"></span>{{ s.ed.pending }}</span></sc-if><sc-if value="{{ edOnline }}"><span style="height:26px;padding:0 9px;display:inline-flex;align-items:center;gap:5px;background:var(--ui-bg-inverted);color:var(--ui-text-inverted);font-size:13px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/globe.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/globe.svg') center / contain no-repeat"></span>Online</span></sc-if><sc-if value="{{ edDraft }}"><span style="height:26px;padding:0 9px;display:inline-flex;align-items:center;gap:5px;border:1px solid var(--ui-border-accented);color:var(--ui-text-toned);font-size:13px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/pencil-line.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/pencil-line.svg') center / contain no-repeat"></span>Draft</span></sc-if></sc-if>
 </div>
 <sc-if value="{{ edReady }}">
 <span aria-live="polite" style="display:flex;align-items:center;gap:6px;white-space:nowrap;flex-shrink:0;color:{{ save.fg }}"><span aria-hidden="true" style="display:inline-block;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/{{ save.icon }}.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/{{ save.icon }}.svg') center / contain no-repeat"></span>{{ save.t }}<sc-if value="{{ save.retry }}"><span data-act="save" style="height:24px;padding:0 8px;display:flex;align-items:center;gap:4px;border:1px solid var(--ui-border-accented);color:var(--ui-text-highlighted);font-size:12px;font-weight:500"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:12px;height:12px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/rotate-cw.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/rotate-cw.svg') center / contain no-repeat"></span>Retry</span></sc-if></span>
@@ -161,17 +161,17 @@
 <span data-act="preview" style="display:flex;align-items:center;gap:8px;white-space:nowrap;flex-shrink:0;color:var(--ui-text-toned)"><span style="width:32px;height:18px;padding:2px;display:flex;justify-content:{{ pvJust }};background:{{ pvBg }}"><span style="width:14px;height:14px;background:var(--ui-bg)"></span></span>Preview</span>
 <span data-act="save" style="height:32px;padding:0 12px;display:flex;align-items:center;gap:6px;white-space:nowrap;flex-shrink:0;border:1px solid var(--ui-border-accented);color:var(--ui-text-highlighted);font-weight:500;opacity:{{ saveOp }}"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:16px;height:16px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/save.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/save.svg') center / contain no-repeat"></span>Save</span>
 <span data-act="publish" style="height:32px;padding:0 12px;display:flex;align-items:center;gap:6px;white-space:nowrap;flex-shrink:0;font-weight:500;background:{{ pub.bg }};color:{{ pub.fg }};border:1px solid {{ pub.bd }};opacity:{{ pub.op }}"><span aria-hidden="true" style="display:inline-block;width:16px;height:16px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/{{ pub.icon }}.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/{{ pub.icon }}.svg') center / contain no-repeat"></span>{{ pub.t }}</span>
-<span data-act="overflow" role="button" aria-label="Delete article" style="height:32px;padding:0 12px;display:flex;align-items:center;gap:6px;white-space:nowrap;flex-shrink:0;font-weight:500;border:1px solid var(--ui-error);color:var(--ui-error);cursor:pointer"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:16px;height:16px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/trash-2.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/trash-2.svg') center / contain no-repeat"></span>Delete</span>
+<span data-act="overflow" role="button" aria-label="Delete article" style="height:32px;padding:0 12px;display:flex;align-items:center;gap:6px;white-space:nowrap;flex-shrink:0;font-weight:500;border:1px solid var(--ui-error);color:var(--ui-error);cursor:pointer"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:16px;height:16px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/trash-2.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/trash-2.svg') center / contain no-repeat"></span>{{ delText }}</span>
 </sc-if>
 </sc-if>
-</div>
+</sc-if></div>
-<sc-if value="{{ showToolbar }}">
+{{ edBanner }}<sc-if value="{{ showToolbar }}">
 <div role="toolbar" aria-label="Formatting" style="flex-shrink:0;padding:6px {{ tbPadX }};display:flex;align-items:center;gap:2px;border-bottom:1px solid var(--ui-border);position:relative;overflow:{{ tbOverflow }};background:var(--ui-bg)">
 <div style="display:flex;align-items:center;gap:2px;flex-shrink:0;transform:translateX({{ tbShift }})"><sc-for list="{{ toolbar }}" as="t" hint-placeholder-count="20"><sc-if value="{{ t.sep }}"><span style="width:1px;height:20px;background:var(--ui-border-accented);margin:0 6px;flex-shrink:0"></span></sc-if><sc-if value="{{ t.btn }}"><span data-act="tb-{{ t.icon }}" style="height:{{ tbBtn }};min-width:{{ tbBtn }};padding:0 6px;flex-shrink:0;display:flex;align-items:center;justify-content:center;gap:4px;position:relative;color:{{ t.fg }};opacity:{{ t.op }};outline:{{ t.ring }};outline-offset:1px;background:{{ t.bg }}"><span aria-hidden="true" style="display:inline-block;width:16px;height:16px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/{{ t.icon }}.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/{{ t.icon }}.svg') center / contain no-repeat"></span>{{ t.text }}<sc-if value="{{ t.tip }}"><span role="tooltip" style="position:absolute;top:100%;left:50%;transform:translateX(-50%);margin-top:6px;z-index:30;white-space:nowrap;padding:4px 8px;background:var(--ui-bg-inverted);color:var(--ui-text-inverted);font:400 12px/16px 'IBM Plex Sans',sans-serif">{{ t.tip }}</span></sc-if></span></sc-if></sc-for></div><sc-if value="{{ tbFadeL }}"><span style="position:absolute;left:0;top:0;bottom:0;width:24px;background:linear-gradient(to right,var(--ui-bg),transparent);pointer-events:none"></span></sc-if><sc-if value="{{ tbFadeR }}"><span style="position:absolute;right:0;top:0;bottom:0;width:32px;background:linear-gradient(to left,var(--ui-bg),transparent);pointer-events:none"></span></sc-if>
 </div>
 </sc-if>
 <div style="flex:1;min-height:0;display:flex">
-<div style="flex:1;min-width:0;display:flex;flex-direction:column;background:{{ edBg }}">
+{{ srcPane }}<div style="flex:1;min-width:0;display:flex;flex-direction:column;background:{{ edBg }}">
 <div data-act="type" style="flex:1;min-height:0;overflow:hidden;padding:{{ edPad }};font-family:'Source Serif 4',serif;color:var(--ui-text-highlighted)">
 <sc-if value="{{ s.ed.loading }}"><div style="display:flex;flex-direction:column;gap:14px;max-width:672px"><span style="height:14px;background:var(--ui-bg-accented)"></span><span style="height:14px;background:var(--ui-bg-accented);width:92%"></span><span style="height:14px;background:var(--ui-bg-accented);width:80%"></span><span style="height:22px;background:var(--ui-bg-accented);width:45%;margin-top:18px"></span><span style="height:14px;background:var(--ui-bg-accented)"></span><span style="height:14px;background:var(--ui-bg-accented);width:70%"></span></div></sc-if>
 <sc-if value="{{ edReady }}">
@@ -181,7 +181,7 @@
 <div style="font-size:{{ h2F }};line-height:1.3;font-weight:600;margin:32px 0 12px">What goes into the price</div>
 <ul style="margin:0 0 20px;padding-left:28px;list-style:square;font-size:{{ pF }};line-height:1.66"><li>Stripping out and making good</li><li>Plumbing moves, if any</li><li>Tiles, fittings and a day for silicone</li></ul>
 <sc-if value="{{ s.ed.image }}"><div style="margin:28px 0;aspect-ratio:16/9;background:var(--ui-bg-elevated);border:1px dashed var(--ui-border-accented);display:flex;align-items:center;justify-content:center;color:var(--ui-text-muted);font:400 13px 'IBM Plex Sans',sans-serif">/static/uploadedImages/3f9c…e1.jpg</div></sc-if>
-<p style="margin:0 0 20px;font-size:{{ pF }};line-height:1.66">We don't add a margin on materials you choose yourself.<sc-if value="{{ caret }}"><span style="display:inline-block;width:2px;height:1.1em;background:var(--ui-text-highlighted);vertical-align:-3px;margin-left:1px"></span></sc-if></p></sc-if><sc-if value="{{ edBody }}"><p style="margin:0 0 20px;font-size:{{ pF }};line-height:1.66">{{ edBody }}<sc-if value="{{ caret }}"><span style="display:inline-block;width:2px;height:1.1em;background:var(--ui-text-highlighted);vertical-align:-3px;margin-left:1px"></span></sc-if></p><sc-if value="{{ s.ed.image }}"><div style="margin:28px 0;aspect-ratio:16/9;background:var(--ui-bg-elevated);border:1px dashed var(--ui-border-accented);display:flex;align-items:center;justify-content:center;color:var(--ui-text-muted);font:400 13px 'IBM Plex Sans',sans-serif">/static/uploadedImages/3f9c…e1.jpg</div></sc-if></sc-if>
+<p style="margin:0 0 20px;font-size:{{ pF }};line-height:1.66">We don't add a margin on materials you choose yourself.<sc-if value="{{ caret }}"><span style="display:inline-block;width:2px;height:1.1em;background:var(--ui-text-highlighted);vertical-align:-3px;margin-left:1px"></span></sc-if></p></sc-if>{{ edBodyEl }}<sc-if value="{{ edBody }}"><p style="margin:0 0 20px;font-size:{{ pF }};line-height:1.66">{{ edBody }}<sc-if value="{{ caret }}"><span style="display:inline-block;width:2px;height:1.1em;background:var(--ui-text-highlighted);vertical-align:-3px;margin-left:1px"></span></sc-if></p><sc-if value="{{ s.ed.image }}"><div style="margin:28px 0;aspect-ratio:16/9;background:var(--ui-bg-elevated);border:1px dashed var(--ui-border-accented);display:flex;align-items:center;justify-content:center;color:var(--ui-text-muted);font:400 13px 'IBM Plex Sans',sans-serif">/static/uploadedImages/3f9c…e1.jpg</div></sc-if></sc-if>
 </div>
 </sc-if>
 </div>
@@ -195,17 +195,17 @@
 <div style="display:flex;flex-direction:column;gap:12px;padding-bottom:16px;border-bottom:1px solid var(--ui-border)"><div data-act="meta-toggle" role="button" tabindex="0" aria-expanded="{{ metaOpen }}" aria-controls="meta-body" style="display:flex;align-items:center;gap:8px;min-height:24px;color:var(--ui-text-highlighted)"><span style="display:flex;transform:rotate({{ metaRot }})"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/chevron-down.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/chevron-down.svg') center / contain no-repeat"></span></span><span style="font-weight:600;font-size:14px">Site and authors</span></div><sc-if value="{{ metaOpen }}"><div id="meta-body" style="display:flex;flex-direction:column;gap:16px">{{ edMeta }}</div></sc-if><sc-if value="{{ metaClosed }}"><span style="padding-left:22px;color:var(--ui-text-muted);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">{{ metaSummary }}</span></sc-if></div><div style="display:flex;flex-direction:column;gap:12px;padding-bottom:16px;border-bottom:1px solid var(--ui-border)"><div data-act="seo-toggle" role="button" tabindex="0" aria-expanded="{{ seoOpen }}" aria-controls="seo-body" style="display:flex;align-items:center;gap:8px;min-height:24px;color:var(--ui-text-highlighted)"><span style="display:flex;transform:rotate({{ seoRot }})"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/chevron-down.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/chevron-down.svg') center / contain no-repeat"></span></span><span style="font-weight:600;font-size:14px">Search and sharing</span></div><sc-if value="{{ seoOpen }}"><div id="seo-body" style="display:flex;flex-direction:column;gap:12px">{{ edSeo }}</div></sc-if><sc-if value="{{ seoClosed }}"><span style="padding-left:22px;color:{{ seoFg }};overflow:hidden;text-overflow:ellipsis;white-space:nowrap">{{ seoSummary }}</span></sc-if></div>
 <div style="display:grid;grid-template-columns:auto 1fr;gap:8px 12px"><span style="color:var(--ui-text-muted)">Created</span><span>12 Mar 2026, 09:14</span><span style="color:var(--ui-text-muted)">Updated</span><span>Today, 11:02</span><span style="color:var(--ui-text-muted)">ID</span><span style="font-family:'IBM Plex Mono',monospace">12</span><span style="color:var(--ui-text-muted)">Images</span><span>{{ imgCount }}</span></div>
 <div style="display:flex;flex-direction:column;gap:6px"><span style="color:var(--ui-text-muted)">Public API URL</span><span style="display:flex;align-items:center;gap:6px;padding:6px 8px;background:var(--ui-bg-elevated);font:400 12px 'IBM Plex Mono',monospace"><span style="flex:1">/v1/article/12</span><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:14px;height:14px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/copy.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/copy.svg') center / contain no-repeat"></span></span><span style="color:var(--ui-text-muted);font-size:12px;line-height:18px">{{ apiNote }}</span></div>
-<div style="display:flex;flex-direction:column;gap:4px;padding-top:12px;border-top:1px solid var(--ui-border)"><span style="color:var(--ui-text-muted)">Title</span><span style="font-size:12px;line-height:18px;color:var(--ui-text-toned)">Titles can't be changed after an article is created. To use a different title, create a new article and delete this one.</span></div>
+<div style="display:flex;flex-direction:column;gap:4px;padding-top:12px;border-top:1px solid var(--ui-border)"><span style="color:var(--ui-text-muted)">Title</span><span style="font-size:12px;line-height:18px;color:var(--ui-text-toned)">{{ edTitleNote }}</span></div>
 </sc-if>
 </div>
 </sc-if>
 </div>
-<sc-if value="{{ mob }}"><sc-if value="{{ edReady }}">
+<sc-if value="{{ mob }}">{{ edMobBar }}<sc-if value="{{ edDefMob }}"><sc-if value="{{ edReady }}">
 <div style="flex-shrink:0;padding:12px 16px;border-top:1px solid var(--ui-border);background:var(--ui-bg);display:flex;flex-direction:column;gap:8px">
 <sc-if value="{{ counter.msg }}"><span style="color:{{ counter.fg }};font-size:13px;line-height:19px">{{ counter.msg }}</span></sc-if>
 <div style="display:flex;gap:8px"><span data-act="details" style="width:44px;height:44px;display:flex;align-items:center;justify-content:center;border:1px solid var(--ui-border-accented);color:var(--ui-text-toned)"><span aria-hidden="true" style="display:inline-block;flex-shrink:0;width:18px;height:18px;background-color:currentColor;-webkit-mask:url('https://api.iconify.design/lucide/panel-right.svg') center / contain no-repeat;mask:url('https://api.iconify.design/lucide/panel-right.svg') center / contain no-repeat"></span></span><span data-act="save" style="flex:1;height:44px;padding:0 12px;white-space:nowrap;display:flex;align-items:center;justify-content:center;gap:6px;border:1px solid var(--ui-border-accented);color:var(--ui-text-highlighted);font-weight:500;font-size:15px;opacity:{{ saveOp }}">Save</span><span data-act="publish" style="flex:1 0 auto;padding:0 16px;white-space:nowrap;height:44px;display:flex;align-items:center;justify-content:center;gap:6px;font-weight:500;font-size:15px;background:{{ pub.bg }};color:{{ pub.fg }};border:1px solid {{ pub.bd }};opacity:{{ pub.op }}">{{ pub.t }}</span></div>
 </div>
-</sc-if></sc-if>
+</sc-if></sc-if></sc-if>
 </sc-if>
 </sc-if>
 
@@ -396,7 +396,7 @@ class Component extends DCLogic {
 		const k = s.kind || 'home'
 		const navItems = s.role === 'user' ? [['home', 'house', 'Home'], ['articles', 'file-text', 'Articles'], ['media', 'images', 'Media'], ['authors', 'feather', 'Authors'], ['activity', 'history', 'Activity']] : [['home', 'house', 'Home'], ['articles', 'file-text', 'Articles'], ['media', 'images', 'Media'], ['authors', 'feather', 'Authors'], ['users', 'users', 'Users'], ['schema', 'shapes', 'Schema'], ['activity', 'history', 'Activity'], ['integration', 'plug', 'Integration'], ['settings', 'settings', 'Settings']]
 		const cr0 = s.crumbs || [], setOpen = s.nav === 'settings' || !!s.sideOpen, parentOn = (key) => s.nav === key && (key !== 'settings' || cr0.length <= 1)
-		const nav = navItems.map(([key, icon, t]) => { const on = parentOn(key), open = key === 'settings' && setOpen; return { key, icon, t, bg: on ? 'var(--rc-sand)' : 'transparent', badge: key === 'settings' && !!s.navBadge, fg: on ? 'var(--rc-on-sand)' : open ? 'var(--ui-text-highlighted)' : 'var(--ui-text-toned)', fw: on || open ? 500 : 400, chev: key === 'settings' ? (open ? 'chevron-down' : 'chevron-right') : '', chevML: key === 'settings' && s.navBadge ? '8px' : 'auto', sub: open, hasSites: !s.role || s.role === 'owner', subs2: (!s.role || s.role === 'owner') ? (() => { const o = cr0[cr0.length - 1] === 'Sites'; return [{ t: 'Sites', ic: 'globe', bg: o ? 'var(--rc-sand)' : 'transparent', fg: o ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', fw: o ? 500 : 400 }] })() : [], hasAccess: s.role !== 'user', subs3: s.role === 'user' ? [] : [(() => { const o = cr0[1] === 'Roles'; return { t: 'Roles', ic: 'shield', bg: o ? 'var(--rc-sand)' : 'transparent', fg: o ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', fw: o ? 500 : 400 } })()], subs: ['Variants', 'Cache'].map(x => { const o = cr0[cr0.length - 1] === x; return { t: x, ic: x === 'Variants' ? 'layers' : 'database', bg: o ? 'var(--rc-sand)' : 'transparent', fg: o ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', fw: o ? 500 : 400 } }) } })
+		const nav = navItems.map(([key, icon, t]) => { const on = parentOn(key), open = key === 'settings' && setOpen; return { key, icon, t, bg: on ? 'var(--rc-sand)' : 'transparent', badge: key === 'settings' && !!s.navBadge, fg: on ? 'var(--rc-on-sand)' : open ? 'var(--ui-text-highlighted)' : 'var(--ui-text-toned)', fw: on || open ? 500 : 400, chev: key === 'settings' ? (open ? 'chevron-down' : 'chevron-right') : '', chevML: key === 'settings' && s.navBadge ? '8px' : 'auto', sub: open, hasSites: !s.role || s.role === 'owner', subs2: (!s.role || s.role === 'owner') ? (() => { const o = cr0[cr0.length - 1] === 'Sites'; const q = cr0[cr0.length - 1] === 'Languages'; return [{ t: 'Sites', ic: 'globe', bg: o ? 'var(--rc-sand)' : 'transparent', fg: o ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', fw: o ? 500 : 400 }, { t: 'Languages', ic: 'languages', bg: q ? 'var(--rc-sand)' : 'transparent', fg: q ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', fw: q ? 500 : 400 }] })() : [], hasAccess: s.role !== 'user', subs3: s.role === 'user' ? [] : [(() => { const o = cr0[1] === 'Roles'; return { t: 'Roles', ic: 'shield', bg: o ? 'var(--rc-sand)' : 'transparent', fg: o ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', fw: o ? 500 : 400 } })()], subs: ['Variants', 'Cache'].map(x => { const o = cr0[cr0.length - 1] === x; return { t: x, ic: x === 'Variants' ? 'layers' : 'database', bg: o ? 'var(--rc-sand)' : 'transparent', fg: o ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', fw: o ? 500 : 400 } }) } })
 		const CT = s.content || [], ctOn = s.contentOn, ctMax = 5, ctVis = CT.slice(0, Math.max(ctMax, CT.findIndex(x => x.key === ctOn) + 1)), contentRows = (m ? (s.contentOpen ? ctVis : []) : ctVis).map(x => { const on = x.key === ctOn; return { key: x.key, name: x.name, icon: x.icon || 'file-text', bg: on ? 'var(--rc-sand)' : 'transparent', fg: on ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', fw: on ? 500 : 400 } })
 		const crumbs = (s.crumbs || []).map((t, i, a) => ({ t, sep: i > 0, fg: i === a.length - 1 ? 'var(--ui-text-highlighted)' : 'var(--ui-text-muted)', fw: i === a.length - 1 ? 500 : 400 }))
 		const L = s.list || {}
@@ -541,16 +541,20 @@ class Component extends DCLogic {
 		const toolbar = toolbarDef.map(x => { if (x === '|') return { sep: true, btn: false }; const base = { sep: false, btn: true, icon: x[0], text: x[1] || '', bg: x[2] ? 'var(--ui-bg-accented)' : 'transparent', fg: 'var(--ui-text-toned)', op: '1', ring: 'none', tip: '' }; if (x[0] !== 'link') return base; return { ...base, bg: lbs === 'hover' ? 'var(--ui-bg-elevated)' : lbs === 'active' ? 'var(--rc-sand)' : 'transparent', fg: lbs === 'hover' ? 'var(--ui-text-highlighted)' : lbs === 'active' ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', op: lbs === 'disabled' ? '0.4' : '1', ring: lbs === 'focus' ? '2px solid var(--ui-primary)' : 'none', tip: lbs === 'hover' && !m ? 'Insert link (Ctrl+K)' : '' } })
 		const lkT = LK.text || 'default'
 		const lk = { on: !!LK.on, pop: !!LK.pop && !m, sheet: !!LK.pop && m, popEdit: 'transparent', style: 'color:' + (lkT === 'selected' ? 'var(--rc-on-sand)' : 'var(--ui-text-highlighted)') + ';text-decoration:underline;text-decoration-thickness:' + (lkT === 'hover' ? '2px' : '1px') + ';text-underline-offset:3px;' + (lkT === 'selected' ? 'background:var(--rc-sand);' : '') + (lkT === 'focus' ? 'outline:2px solid var(--ui-primary);outline-offset:2px;' : '') }
+		const LG = e.lang || null
+		if (LG && !e.pending && pub) pub = { ...pub, t: pub.t.replace('Save and publish', 'Save and publish ' + LG.name).replace(/^Publish$/, 'Publish ' + LG.name).replace(/^Unpublish$/, 'Unpublish ' + LG.name) }
+		const lg = LG ? { name: LG.name, code: LG.code, open: !!LG.open, ro: !!LG.ro, fresh: LG.fresh || '', bd: LG.open ? 'var(--ui-primary)' : 'var(--ui-border-accented)', h: m ? '44px' : '26px', label: 'Language: ' + LG.name + '. Switch version' } : null
 		const edReady = k === 'editor' && !e.loading && !e.notfound
 		const edTitle = e.title || 'How we price a bathroom renovation'
 		return {
+			lg, srcPane: this.props.srcPane || null, edBanner: this.props.edBanner || null, edTitleCss: LG ? 'flex:0 1 100%;min-width:0' : '', edTitleNote: LG ? 'Each language has its own title. Changing it doesn\'t change the URL; edit the slug in Search and sharing.' : "Titles can't be changed after an article is created. To use a different title, create a new article and delete this one.", edTitleTip: LG ? 'Titles can be changed. The URL only changes if you edit the slug.' : "The title can't be changed after creation.", delText: LG ? 'Delete ' + LG.name + ' version' : 'Delete',
 			lk, edSeo: this.props.edSeo || null, seoOpen: !!this.props.edSeo, seoClosed: !this.props.edSeo, seoRot: this.props.edSeo ? '0deg' : '-90deg', seoSummary: e.seoSummary || 'Ready', seoFg: /suggest/.test(e.seoSummary || '') ? 'var(--ui-warning)' : 'var(--ui-text-muted)', naOn: !!L.needs, naBg: L.needs ? 'var(--rc-sand)' : 'var(--ui-bg)', naFg: L.needs ? 'var(--rc-on-sand)' : 'var(--ui-text-toned)', naBd: L.needs ? 'var(--rc-sand)' : 'var(--ui-border-accented)', naFw: L.needs ? 500 : 400, naN: L.naState === 'pending' ? '…' : L.naState === 'fail' ? '!' : L.naState === 'absent' ? '' : String(L.needsN ?? 3), edMeta: this.props.edMeta || null, metaOpen: !!this.props.edMeta, metaClosed: !this.props.edMeta, metaRot: this.props.edMeta ? '0deg' : '-90deg', metaSummary: e.metaSummary || 'Inès Duarte', edSheet: m && !!e.sheet, pAu: (() => { const q = s.pa || {}; return { none: q.k !== 'has', has: q.k === 'has', err: !!q.err, slug: q.slug || 'marta-alves', slugNote: !!q.slug, btn: q.loading ? 'Creating…' : 'Create my author profile', icon: q.loading ? 'loader-circle' : 'feather', op: q.loading ? 0.7 : 1, uses: q.user ? 'Uses your username, marta. You can change it afterwards.' : 'Uses your display name, Marta Alves. You can change it afterwards.' } })(), showSites: !s.role || s.role === 'owner', authorsCol: L.authors !== false, multi: !!L.multi, multiDesk: !m && !!L.multi, multiMob: m && !!L.multi, gridCols: (L.authors !== false ? 'minmax(0,1fr) 104px ' : 'minmax(0,1fr) ') + (L.multi ? '130px ' : '') + '110px 150px 140px 44px', sfText: L.site || 'All sites', sfFg: L.site ? 'var(--ui-text-highlighted)' : 'var(--ui-text-muted)', sfMenu: !!L.siteMenu, sfOpts: ['All sites', 'Renew', 'Journal', 'Projects', 'Archive'].map(x => { const on = (L.site || 'All sites') === x; return { t: x, on, op: on ? 1 : 0, bg: on ? 'var(--ui-bg-elevated)' : 'transparent' } }), tbOverflow: m ? 'hidden' : 'visible', tbShift: m ? -(LK.shift || 0) + 'px' : '0px', tbFadeL: m && !!LK.shift, tbFadeR: m && !LK.end, act, cl, rt, purgeDlg, rowDir: m ? 'column' : 'row', rowAlign: m ? 'stretch' : 'flex-start', rowJust: m ? 'flex-start' : 'space-between', rowGap: m ? '12px' : '16px', setScroll: -(s.scrollY || 0) + 'px', offText: s.offText || 'You\'re offline. You can keep writing, but saving and publishing will wait until you\'re back online.', cr, s, nav, crumbs, who, ini, pf, dn, dnSave, rsNote, rsBtn,
 			langSeg: [['en','English'],['fr','Français']].map(([k,tt])=>{const on=(s.lang||'en')===k;return {act:'lang-'+k,code:k,t:tt,on,op:on?1:0}}), themeSeg: [['system','monitor','System'],['light','sun','Light'],['dark','moon','Dark']].map(([k,icon,tt])=>{const on=(s.mode||'light')===k;return {act:'theme-'+k,icon,t:tt,on,op:on?1:0}}), menuOpen: !!s.userMenu, deskMenu: !m && !!s.userMenu, mobMenu: m && !!s.userMenu, pfItemBg: 'var(--ui-bg-elevated)',
 			chipBg: s.userMenu || s.nav === 'profile' ? 'var(--rc-sand)' : 'transparent', chipFg: s.userMenu || s.nav === 'profile' ? 'var(--rc-on-sand)' : 'var(--ui-text-highlighted)',
 			isSettings: k === 'settings', isProfile: k === 'profile', pfLoading: k === 'profile' && !!pf.loading, pfReady: k === 'profile' && !pf.loading,
-			upBtnDir: m ? 'column' : 'row', upBtnAlign: m ? 'stretch' : 'flex-start', cardPad: '16px', cardPadX: m ? '16px' : '20px', inH: m ? '44px' : '40px', pfCols: m ? 'minmax(0,1fr)' : 'minmax(0,1fr) minmax(0,1.4fr)', pwDir: m ? 'column' : 'row', pwAlign: m ? 'stretch' : 'flex-end', edTitle, edBody: e.body || '', sampleBody: !e.body, tabs, rows, save, counter, pub, mFields, up, toasts, endpoints, toolbar,
+			upBtnDir: m ? 'column' : 'row', upBtnAlign: m ? 'stretch' : 'flex-start', cardPad: '16px', cardPadX: m ? '16px' : '20px', inH: m ? '44px' : '40px', pfCols: m ? 'minmax(0,1fr)' : 'minmax(0,1fr) minmax(0,1.4fr)', pwDir: m ? 'column' : 'row', pwAlign: m ? 'stretch' : 'flex-end', edTitle, edBody: e.body || '', edBodyEl: this.props.edBodyEl || null, sampleBody: !e.body && !this.props.edBodyEl, tabs, rows, save, counter, pub, mFields, up, toasts, endpoints, toolbar,
 			contentShow: CT.length > 0, contentRows, contentColl: m && !s.contentOpen, contentCount: String(CT.length), contentMore: (!m || s.contentOpen) && CT.length > ctVis.length ? 'Show all ' + CT.length : '', desk: !m, mob: m, notBoot: !s.boot,
-			fw: m ? '390px' : '1440px', fh: m ? '844px' : '900px', dir: m ? 'column' : 'row',
+			fw: m ? '390px' : (s.w ? s.w + 'px' : '1440px'), fh: m ? '844px' : (s.h ? s.h + 'px' : '900px'), dir: m ? 'column' : 'row',
 			mLead: s.mLead || 'menu',
 			navDrawer: m && !!s.drawer, integSearch: k === 'integration' && !!s.search, isSlot: !!this.props.slotBody, slotBody: this.props.slotBody || null, slotOverlays: this.props.slotOverlays || null, isBoot: !!s.boot, isHome: k === 'home' && !s.boot, isList: k === 'articles', isEditor: k === 'editor', isInteg: k === 'integration', isKeys: k === 'apikeys', isError: k === 'error', isUsers: k === 'users',
 			usRows, usError: !!US.error, usOnly: !!US.only && !US.error, usTable: !m && !US.error, usCards: m && !US.error,
@@ -577,7 +581,7 @@ class Component extends DCLogic {
 			emptyBg: L.empty && L.empty.primary ? 'var(--ui-primary)' : 'var(--ui-bg)', emptyFg: L.empty && L.empty.primary ? 'var(--ui-bg)' : 'var(--ui-text-highlighted)', emptyBd: L.empty && L.empty.primary ? 'var(--ui-primary)' : 'var(--ui-border-accented)',
 			edFound: k === 'editor' && !e.notfound, edReady, edPending: edReady && !!e.pending, edOnline: edReady && !e.pending && online, edDraft: edReady && !e.pending && !online,
 			edHeadPad: m ? '12px 16px' : '14px 24px', edHeadGap: m ? '8px 12px' : '12px', edTitleBasis: m ? '100%' : '200px',
-			showToolbar: k === 'editor' && !e.notfound && !e.preview,
+			showToolbar: k === 'editor' && !e.notfound && !e.preview && !e.readonly, edDefHead: !this.props.edHeader, edDefMob: !this.props.edMobBar, edHeader: this.props.edHeader || null, edMobBar: this.props.edMobBar || null,
 			tbPadX: m ? '8px' : '24px', tbBtn: m ? '40px' : '28px',
 			edBg: e.preview ? 'var(--ui-bg-muted)' : 'var(--ui-bg)', edPad: m ? '24px 16px' : '40px 48px', edMargin: e.preview ? '0 auto' : '0',
 			h1F: m ? '28px' : '32px', h2F: m ? '23px' : '26px', pF: m ? '17px' : '18px', caret: !e.preview,

docs/design/source/DirectoryFrame.dc.html

@@ -320,7 +320,7 @@ class Component extends DCLogic {
 		}
 		const newAuthorModal = () => {
 			const x = s.modal
-			return Shell({ z: 60, title: 'Create author', desc: 'Adds a byline for this article. You can add a bio and avatar later in Authors.', cancel: 'Cancel', confirm: x.loading ? 'Creating…' : 'Create author', loading: x.loading, close: true, cdis: !x.name },
+			return Shell({ z: 70, title: 'Create author', desc: 'Adds a byline for this article. You can add a bio and avatar later in Authors.', cancel: 'Cancel', confirm: x.loading ? 'Creating…' : 'Create author', loading: x.loading, close: true, cdis: !x.name },
 				D('display:flex;flex-direction:column;gap:16px', x.notice && Alert('error', 'circle-x', 'Couldn\'t create the author', 'The article is unchanged. Try again in a moment.'),
 					F('Name', x.name || 'e.g. Camille Roche', { val: !!x.name, focus: !x.name && !x.loading, err: x.err, dis: x.loading }),
 					Slug('Slug', { mode: x.name ? (x.err ? 'manual' : 'auto') : 'empty', value: x.slug, help: 'Generated from the name. Unique across all authors.', err: x.slugErr, suggest: x.suggest }),
@@ -427,7 +427,7 @@ class Component extends DCLogic {
 			if (s.seo && s.seo.panel) ov.push(seoPanel())
 			if (s.seo && s.seo.pick) ov.push(Picker({ title: 'Choose a cover image', desc: 'The cover for this article.', sel: 1, z: 70 }))
 			if (s.seo && s.seo.api) ov.push(apiDialog())
-			if (s.modal && m) { ov.push(Panel({ title: 'Details', z: 55, ro: true, confirm: '' }, metaUI())); edMeta = null }
+			if (s.modal && m) { ov.push(Panel({ title: 'Details', z: 55, ro: true, confirm: '' }, metaUI())); edMeta = null; if (shell && shell.ed) shell = { ...shell, ed: { ...shell.ed, sheet: false } } }
 			if (s.modal) ov.push(newAuthorModal())
 			if (s.ann) ov.push(D('position:absolute;z-index:20;' + (m ? 'left:16px;right:16px;bottom:88px' : 'left:248px;bottom:20px'), Note(s.ann)))
 		} else if (v === 'profile') {

docs/design/source/LocaleFrame.dc.html

@@ -0,0 +1,522 @@
+
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<script src="./support.js"></script>
+</head>
+<body>
+<x-dc>
+<dc-import name="AppFrame" s="{{ shell }}" mobile="{{ mob }}" slot-body="{{ main }}" slot-overlays="{{ ov }}" src-pane="{{ srcPane }}" ed-banner="{{ edBanner }}" ed-body-el="{{ edBodyEl }}" ed-header="{{ edHeader }}" ed-mob-bar="{{ edMobBar }}" hint-size="100%,100%"></dc-import>
+</x-dc>
+<script type="text/x-dc" data-dc-script data-props="{&quot;$preview&quot;:{&quot;width&quot;:1440,&quot;height&quot;:900},&quot;s&quot;:{&quot;editor&quot;:null,&quot;tsType&quot;:&quot;object&quot;},&quot;mobile&quot;:{&quot;editor&quot;:&quot;boolean&quot;,&quot;default&quot;:false,&quot;tsType&quot;:&quot;boolean&quot;}}">
+class Component extends DCLogic {
+	renderVals() {
+		const s = this.props.s || {}, m = !!this.props.mobile, v = s.v, x = s.x || ''
+		const P = t => Object.fromEntries(t.split(';').filter(q => q.trim()).map(q => { const i = q.indexOf(':'); let k = q.slice(0, i).trim(); const val = q.slice(i + 1).trim(); if (!k.startsWith('--')) { k = k.replace(/^-webkit-/, 'Webkit-').replace(/-([a-z])/g, (_, c) => c.toUpperCase()) } return [k, val] }))
+		const h = React.createElement
+		const D = (t, ...c) => h('div', { style: P(t) }, ...c)
+		const S = (t, ...c) => h('span', { style: P(t) }, ...c)
+		const A = (tag, pr, t, ...c) => h(tag, { ...pr, style: P(t) }, ...c)
+		const Ic = (n, z = 16) => S('display:inline-block;flex-shrink:0;width:' + z + 'px;height:' + z + 'px;background-color:currentColor;-webkit-mask:url(https://api.iconify.design/lucide/' + n + '.svg) center/contain no-repeat;mask:url(https://api.iconify.design/lucide/' + n + '.svg) center/contain no-repeat')
+		const HL = 'color:var(--ui-text-highlighted)', MU = 'color:var(--ui-text-muted)', TO = 'color:var(--ui-text-toned)'
+		const mono = "font-family:'IBM Plex Mono',monospace;font-size:12px"
+		const Btn = (l, k = 'secondary', o = {}) => {
+			const hh = m ? 44 : (o.sm ? 28 : 32)
+			const st = { primary: 'background:var(--ui-primary);color:var(--ui-bg)', secondary: 'background:var(--ui-bg);color:var(--ui-text-highlighted);border:1px solid var(--ui-border-accented)', ghost: 'color:var(--ui-text-toned)', danger: 'background:var(--ui-error);color:var(--ui-bg)', dangerOutline: 'background:var(--ui-bg);color:var(--ui-error);border:1px solid var(--ui-error)' }[k]
+			return A('span', { role: 'button', 'aria-label': o.al || (o.ic && !l ? o.ic : undefined), 'aria-disabled': !!o.dis || undefined, 'aria-busy': o.busy || undefined }, 'display:inline-flex;align-items:center;justify-content:center;gap:6px;height:' + hh + 'px;padding:0 ' + (o.ic && !l ? 0 : 12) + 'px;' + (o.ic && !l ? 'width:' + hh + 'px;' : '') + 'font-weight:500;white-space:nowrap;flex-shrink:0;' + st + ';' + (o.dis ? 'opacity:.4;' : '') + (o.w ? 'width:' + o.w + ';' : ''), o.busy && Ic('loader-circle', 14), o.ic && Ic(o.ic, 16), l)
+		}
+		const TN = { neutral: 'background:var(--ui-bg-elevated);color:var(--ui-text-toned)', success: 'background:var(--rc-success-soft);color:var(--ui-success)', info: 'background:var(--rc-info-soft);color:var(--ui-info)', warning: 'background:var(--rc-warning-soft);color:var(--ui-warning)', error: 'background:var(--rc-error-soft);color:var(--ui-error)' }
+		const Bd = (l, tone = 'neutral', ic) => S('display:inline-flex;align-items:center;gap:4px;height:20px;padding:0 6px;font-size:12px;font-weight:500;white-space:nowrap;flex-shrink:0;' + TN[tone], ic && Ic(ic, 12), l)
+		// freshness uses an outline so it never reads as a publication state
+		const Fr = (l, tone = 'warning', ic = 'refresh-cw') => S('display:inline-flex;align-items:center;gap:4px;height:20px;padding:0 6px;font-size:12px;font-weight:500;white-space:nowrap;flex-shrink:0;border:1px solid currentColor;background:var(--ui-bg);color:var(--ui-' + tone + ')', Ic(ic, 12), l)
+		const Pub = st => st === 'pub' ? Bd('Published', 'success', 'circle-check') : Bd('Draft', 'neutral', 'pencil')
+		const Alert = (tone, ic, title, text, act) => D('display:flex;gap:10px;padding:12px 14px;align-items:flex-start;' + TN[tone].split(';')[0] + ';color:var(--ui-text-highlighted)', S('color:var(--ui-' + (tone === 'neutral' ? 'text-toned' : tone) + ')', Ic(ic)), D('flex:1;min-width:0;display:flex;flex-direction:column;gap:2px', S('font-weight:600', title), text && S(TO + ';text-wrap:pretty', text), act && D('margin-top:8px;display:flex;gap:8px;flex-wrap:wrap', ...[].concat(act))))
+		const Fd = (label, val, o = {}) => D('display:flex;flex-direction:column;gap:6px;min-width:0', S('font-weight:500;' + HL, label, o.opt && S(MU + ';font-weight:400', ' (optional)')),
+			D('display:flex;align-items:' + (o.area ? 'flex-start' : 'center') + ';gap:8px;min-height:' + (m ? 44 : 32) + 'px;padding:' + (o.area ? 8 : 0) + 'px 10px;border:1px solid ' + (o.err ? 'var(--ui-error)' : o.focus ? 'var(--ui-primary)' : 'var(--ui-border-accented)') + ';background:' + (o.ro ? 'var(--ui-bg-elevated)' : 'var(--ui-bg)') + ';' + (o.focus ? 'outline:2px solid var(--ui-primary);outline-offset:1px;' : ''), o.pre && S(MU + ';' + mono + ';white-space:nowrap', o.pre), A('span', { dir: o.dir, lang: o.lang }, 'flex:1;min-width:0;' + (o.mono ? mono + ';' : '') + (o.val === false ? MU : HL) + ';overflow:hidden;text-overflow:ellipsis;' + (o.area ? 'white-space:normal' : 'white-space:nowrap'), val), o.sel && Ic('chevrons-up-down', 14), o.lock && Ic('lock', 14)),
+			o.err ? S('display:flex;gap:6px;color:var(--ui-error);font-size:12px;line-height:18px', Ic('circle-x', 14), o.err) : o.help && S(MU + ';font-size:12px;line-height:18px;text-wrap:pretty', o.help))
+		const Radio = (l, d, on) => D('display:flex;gap:10px;padding:10px 12px;border:1px solid ' + (on ? 'var(--ui-primary)' : 'var(--ui-border-accented)') + ';background:' + (on ? 'var(--ui-bg-elevated)' : 'var(--ui-bg)'), S('width:16px;height:16px;margin-top:2px;flex-shrink:0;border:1px solid var(--ui-border-accented);display:flex;align-items:center;justify-content:center', on && S('width:8px;height:8px;background:var(--ui-primary)')), D('display:flex;flex-direction:column;gap:2px', S('font-weight:500;' + HL, l), d && S(MU + ';font-size:12px;line-height:18px;text-wrap:pretty', d)))
+		const Dlg = (o, body, foot) => D('position:absolute;inset:0;z-index:' + (o.z || 50) + ';background:var(--rc-overlay);display:flex;align-items:' + (m ? 'flex-end' : 'flex-start') + ';justify-content:center;padding-top:' + (m ? 0 : o.top ?? 100) + 'px',
+			A('div', { role: 'dialog', 'aria-modal': 'true', 'aria-label': o.title }, 'width:' + (m ? '100%' : (o.w || 460) + 'px') + ';max-height:' + (m ? '92%' : 'calc(100% - ' + ((o.top ?? 100) + 24) + 'px)') + ';background:var(--ui-bg);box-shadow:var(--rc-shadow-modal);display:flex;flex-direction:column;' + (m ? 'border-top:1px solid var(--ui-border)' : ''),
+				m && D('display:flex;justify-content:center;padding:8px 0 0', S('width:36px;height:4px;background:var(--ui-border-accented)')),
+				D('padding:20px 24px 0;display:flex;gap:12px;align-items:flex-start', D('flex:1;display:flex;flex-direction:column;gap:4px;min-width:0', S('font:600 16px/24px \'IBM Plex Sans\',sans-serif;' + HL, o.title), o.desc && S(TO + ';text-wrap:pretty', o.desc)), Btn('', 'ghost', { ic: 'x', sm: true, al: 'Close' })),
+				D('padding:16px 24px 0;display:flex;flex-direction:column;gap:14px;overflow-y:auto;min-height:0', ...[].concat(body)),
+				D('padding:20px 24px;flex-shrink:0;flex-wrap:wrap;display:flex;gap:8px;' + (m ? 'flex-direction:column-reverse' : 'justify-content:flex-end'), ...[].concat(foot))))
+		const Toast = (tone, ic, t, d) => D('position:absolute;z-index:80;' + (m ? 'left:16px;right:16px;bottom:16px' : 'right:24px;bottom:24px;width:356px') + ';background:var(--ui-bg);border:1px solid var(--ui-border);box-shadow:var(--rc-shadow-pop);padding:12px;display:flex;gap:10px', S('width:28px;height:28px;display:flex;align-items:center;justify-content:center;flex-shrink:0;color:var(--ui-' + tone + ');' + TN[tone].split(';')[0], Ic(ic)), D('display:flex;flex-direction:column;gap:2px', S('font-weight:600;' + HL, t), d && S(TO, d)))
+		const Sk = n => D('display:flex;flex-direction:column;gap:10px', ...Array.from({ length: n }, (_, i) => D('height:' + (m ? 56 : 44) + 'px;background:var(--ui-bg-elevated);opacity:' + (1 - i * .12))))
+		const Page = (title, sub, act, ...c) => D('flex:1;min-height:0;overflow:auto;display:flex;flex-direction:column;gap:16px;padding:' + (m ? '16px 16px 88px' : '24px') + ';position:relative', D('display:flex;gap:12px;align-items:flex-start;' + (m ? 'flex-direction:column' : ''), D('flex:1;min-width:0;display:flex;flex-direction:column;gap:2px', S('font:600 20px/28px \'IBM Plex Sans\',sans-serif;' + HL, title), sub && S(TO + ';text-wrap:pretty', sub)), act), ...c)
+		const Card = (...c) => D('flex-shrink:0;background:var(--ui-bg);border:1px solid var(--ui-border);padding:16px;display:flex;flex-direction:column;gap:12px', ...c)
+		const ROW = 'display:flex;align-items:center;gap:12px;border-top:1px solid var(--ui-border);padding:10px 16px;min-height:' + (m ? 56 : 48) + 'px'
+		const Av = i => S('width:26px;height:26px;flex-shrink:0;background:var(--rc-sand);color:var(--rc-on-sand);display:flex;align-items:center;justify-content:center;font:600 11px \'IBM Plex Sans\',sans-serif', i)
+		let srcPane = null, edBanner = null, edBodyEl = null, edHeader = null, edMobBar = null
+		let main = null, shell = { kind: 'slot', display: 'Marta Alves', role: s.role }, ov = []
+		// ---- data
+		const FX = window.LOCFX, S1 = FX.STORIES[0], S5 = FX.STORIES[4]
+		const LV = (k, n, c, st) => ({ n, c, lang: k, dir: FX.DIR[k] || 'ltr', t: k === 'en' ? (st || S1).title : (st || S1).tr[k], p: FX.P[k] })
+		const EN = LV('en', 'English', 'EN'), FR = LV('fr', 'French', 'FR'), AR = LV('ar', 'Arabic', 'AR'), DE = LV('de', 'German', 'DE')
+		const CAPS = { full: { e: 1, p: 1, d: 1, c: 1, rv: 1 }, ro: {}, p2: { e: 1, d: 1, c: 1, rv: 1 }, p3: { p: 1 }, p6: { e: 1, p: 1, d: 1, c: 1, rv: 1, part: 1 } }
+		// ---- language menu (menu button + menu; rows are single menu items, no nested controls)
+		const LangBtn = (cur, o = {}) => A('span', { role: 'button', 'aria-haspopup': 'menu', 'aria-expanded': !!o.open, 'aria-label': 'Language: ' + cur + '. Switch version' }, 'display:inline-flex;align-items:center;gap:8px;height:' + (m ? 44 : 32) + 'px;padding:0 10px;border:1px solid ' + (o.open ? 'var(--ui-primary)' : 'var(--ui-border-accented)') + ';background:var(--ui-bg);color:var(--ui-text-highlighted);font-weight:500;flex-shrink:0;max-width:260px;width:max-content', Ic('languages'), S('white-space:nowrap', cur), o.code && S(mono + ';flex-shrink:0;' + MU, o.code), Ic('chevrons-up-down', 14))
+		const Tag = (l, ic) => S('display:inline-flex;align-items:center;gap:4px;font-size:12px;' + MU, ic && Ic(ic, 12), l)
+		const LRow = r => { const cur = r.cur, add = r.add
+			return A('div', { role: 'menuitem', 'aria-current': cur || undefined, tabIndex: -1 }, 'display:flex;align-items:center;gap:10px;min-height:' + (m ? 52 : 40) + 'px;padding:6px 12px;' + (cur ? 'background:var(--rc-sand);color:var(--rc-on-sand)' : add ? 'color:var(--ui-text-toned)' : ''), S('width:16px', cur && Ic('check')), D('flex:1;min-width:0;display:flex;flex-direction:column', S('overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-weight:' + (cur ? 600 : 500), r.n), S(mono + (cur ? '' : ';' + MU), r.c)),
+				add ? S('display:inline-flex;align-items:center;gap:4px;font-weight:500', Ic('plus', 14), 'Add translation') : D('display:flex;gap:4px;flex-wrap:wrap;justify-content:flex-end', r.tag && Tag(r.tag, r.tagIc), Pub(r.st), r.fr && Fr('Needs review'), r.dis && Bd('Disabled', 'neutral', 'eye-off'))) }
+		const LangPop = (rows, o = {}) => D('position:absolute;z-index:40;' + (m ? 'left:0;right:0;bottom:0;max-height:70%;border-top:1px solid var(--ui-border)' : 'left:' + (o.left ?? 292) + 'px;top:' + (o.top ?? 150) + 'px;width:400px;max-height:' + (o.max ?? 420) + 'px;border:1px solid var(--ui-border)') + ';background:var(--ui-bg);box-shadow:var(--rc-shadow-pop);display:flex;flex-direction:column',
+			m && D('display:flex;justify-content:center;padding:8px 0 0;flex-shrink:0', S('width:36px;height:4px;background:var(--ui-border-accented)')),
+			D('padding:10px 12px 6px;display:flex;flex-direction:column;gap:6px;flex-shrink:0', S('font-size:11px;font-weight:600;letter-spacing:.04em;text-transform:uppercase;' + MU, 'Versions you can open'), o.find && Fd('', 'Find a language', { val: false })),
+			A('div', { role: 'menu', 'aria-label': 'Versions of this article' }, 'display:flex;flex-direction:column;overflow-y:auto;min-height:0', ...rows.map(LRow)),
+			D('padding:10px 12px;border-top:1px solid var(--ui-border);display:flex;gap:8px;flex-shrink:0;' + MU + ';font-size:12px;line-height:18px', Ic('info', 14), o.note || 'Switching opens that version. The interface language stays the same.'))
+		const MENUS = {
+			all: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }, { n: 'German', c: 'DE', st: 'pub' }, { n: 'Arabic', c: 'AR', st: 'draft', fr: 1 }],
+			two: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }],
+			many: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'English (United Kingdom)', c: 'EN-GB', st: 'draft' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }, { n: 'German', c: 'DE', st: 'pub' }, { n: 'Italian', c: 'IT', st: 'draft' }, { n: 'Japanese', c: 'JA', st: 'pub' }, { n: 'Portuguese (Brazil)', c: 'PT-BR', add: 1 }, { n: 'Spanish', c: 'ES', add: 1 }, { n: 'Chinese (Simplified)', c: 'ZH-HANS', add: 1 }, { n: 'Arabic', c: 'AR', add: 1 }, { n: 'Dutch', c: 'NL', add: 1 }, { n: 'Polish', c: 'PL', add: 1 }],
+			ro: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }, { n: 'German', c: 'DE', st: 'pub' }],
+			dis: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }, { n: 'Spanish', c: 'ES', st: 'draft', dis: 1 }],
+			p4: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }, { n: 'German', c: 'DE', st: 'pub' }, { n: 'Arabic', c: 'AR', st: 'draft', fr: 1, tag: 'Read only', tagIc: 'lock' }],
+			p5: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }, { n: 'German', c: 'DE', st: 'pub' }],
+			noAdd: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }, { n: 'German', c: 'DE', st: 'pub' }],
+			withAdd: [{ n: 'English', c: 'EN', st: 'pub' }, { n: 'French', c: 'FR', st: 'draft', fr: 1, cur: 1 }, { n: 'German', c: 'DE', st: 'pub' }, { n: 'Arabic', c: 'AR', add: 1 }]
+		}
+		// ---- editor pieces
+		const nr = !!s.narrow && !m
+		const J = FX.SITES.journal, LNm = FX.LANG_NAMES
+		const Body = (L, o = {}) => A('div', { dir: L.dir, lang: L.lang, role: 'textbox', 'aria-multiline': 'true', 'aria-readonly': o.ro || undefined, 'aria-label': (o.label || 'Body') + ' (' + L.n + ')', tabIndex: 0 }, 'display:flex;flex-direction:column;gap:12px;padding:16px;border:1px solid var(--ui-border);background:' + (o.ro ? 'var(--ui-bg-muted)' : 'var(--ui-bg)') + ';flex:1;min-height:0;overflow:auto;font:400 ' + (L.dir === 'rtl' ? '17px/30px' : '15px/26px') + ' \'Source Serif 4\',serif;color:var(--ui-text)', ...(o.long ? L.p.concat(L.p, L.p) : L.p).map(t => S('text-wrap:pretty', t)))
+		const LONGT = 'Comment nous chiffrons une rénovation de salle de bain, poste par poste, avec les coûts cachés derrière les carreaux, sous la baignoire et autour des canalisations anciennes, expliqués avant la commande du premier carreau et de la première vanne'
+		const TitleIn = (L, o) => {
+			const st = o.tst || 'pristine', cap = o.cap, lab = 'Title (' + L.n + ')'
+			if (!cap.e) return D('display:flex;flex-direction:column;gap:2px', D('display:flex;align-items:center;gap:8px;min-height:' + (m ? 44 : 36) + 'px', A('div', { dir: L.dir, lang: L.lang, role: 'textbox', 'aria-readonly': 'true', 'aria-label': lab, tabIndex: 0 }, 'flex:1;min-width:0;font:600 ' + (m ? 18 : 20) + 'px/28px \'IBM Plex Sans\',sans-serif;' + HL, L.t), Ic('lock', 14)))
+			const val = { invalid: '', short: 'Sa', long: LONGT.slice(0, 203), edit: L.t + ' en 2026', unsaved: L.t + ' en 2026' }[st] ?? (o.titleVal ?? L.t)
+			const err = ['invalid', 'short', 'long', 'failed'].includes(st), on = ['focus', 'edit'].includes(st), cnt = ['focus', 'edit', 'short', 'long'].includes(st)
+			const msg = { invalid: 'Enter a title', short: 'Use at least 3 characters', long: 'Use 200 characters or fewer' }[st]
+			return D('display:flex;flex-direction:column;gap:2px',
+				D('display:flex;align-items:center;gap:8px;min-height:' + (m ? 44 : 40) + 'px;padding:2px 4px;border:0;border-bottom:' + (on || err ? 2 : 1) + 'px solid ' + (err ? 'var(--ui-error)' : on ? 'var(--ui-primary)' : 'var(--ui-border-accented)') + ';background:' + (on ? 'var(--ui-bg)' : 'transparent') + ';' + (st === 'focus' ? 'box-shadow:0 2px 0 0 var(--ui-primary)' : ''),
+					A('div', { dir: L.dir, lang: L.lang, role: 'textbox', 'aria-label': lab, 'aria-invalid': err || undefined, 'aria-describedby': 'title-help', tabIndex: 0 }, 'flex:1;min-width:0;font:600 ' + (m ? 18 : 20) + 'px/28px \'IBM Plex Sans\',sans-serif;' + (st === 'invalid' ? MU : HL) + ';text-wrap:pretty;' + (m ? '' : 'overflow:hidden;text-overflow:ellipsis;white-space:nowrap'), st === 'invalid' ? 'Title' : val),
+					cnt && S(mono + ';flex-shrink:0;color:' + (err ? 'var(--ui-error)' : 'var(--ui-text-muted)'), val.length + ' / 200'), st === 'saving' ? Ic('loader-circle', 14) : st === 'failed' ? Ic('circle-x', 14) : Ic('pencil', 14)),
+				A('div', { id: 'title-help', role: err ? 'alert' : undefined }, 'display:flex;gap:8px;align-items:center;flex-wrap:wrap;padding:0 4px;font-size:12px;line-height:18px;' + (err ? 'color:var(--ui-error)' : MU),
+					err && Ic('circle-x', 14), msg || (st === 'failed' ? 'Couldn\'t save the title. Your text is kept.' : st === 'saving' ? 'Saving title…' : (on || st === 'unsaved') ? 'Changing the title doesn\'t change the address.' : null), st === 'failed' && Btn('Try again', 'secondary', { sm: true })))
+		}
+		const Acts = (L, o) => {
+			const cap = o.cap, on = o.pub === 'pub', d = !!o.dirty || !!o.saveFail, a = { prim: null, sec: [], un: null }
+			if (o.pubFail) a.prim = { l: 'Retry publish', ic: 'rotate-cw' }
+			else if (o.saving) a.prim = { l: 'Saving…', busy: 1, dis: 1 }
+			else if (cap.e && d && cap.p && !on && !o.saveFail) a.prim = { l: 'Save and publish ' + L.n, dis: !!o.saveBlock }
+			else if (cap.e && d) a.prim = { l: o.saveFail ? 'Try saving again' : 'Save', dis: !!o.saveBlock }
+			else if (cap.p && !on && !o.pubDis) a.prim = { l: 'Publish ' + L.n }
+			const plain = a.prim && (a.prim.busy || a.prim.l === 'Save' || a.prim.l === 'Try saving again')
+			if (cap.e && !plain) a.sec.push({ l: 'Save', dis: !d })
+			if (cap.p && on && !o.saving) a.un = { l: 'Unpublish ' + L.n }
+			if (o.pubDis) a.prim = { l: 'Publish ' + L.n, dis: 1 }
+			return a
+		}
+		const OvItems = (L, o, k = {}) => {
+			const cap = o.cap, a = Acts(L, o), it = []
+			if (m && !k.skipRef) it.push({ l: o.src ? 'Hide source reference' : 'Show source reference', ic: 'columns-2' })
+			if (a.un && (m || nr)) it.push({ l: a.un.l, ic: 'eye-off' })
+			if (cap.e) it.push({ l: 'Edit slug', ic: 'link', why: 'Editing the title never changes the slug.' })
+			if (cap.e) it.push(cap.part ? { l: 'Move article', ic: 'arrow-right-left', dis: 1, why: 'You can\'t move this article.' } : { l: 'Move article', ic: 'arrow-right-left' })
+			if (cap.d) it.push({ l: 'Delete ' + L.n + ' version', ic: 'trash-2', danger: 1 })
+			if (cap.d) it.push(cap.part ? { l: 'Delete article', ic: 'trash-2', dis: 1, why: 'You can\'t delete this article.' } : { l: 'Delete article', ic: 'trash-2', danger: 1 })
+			return it
+		}
+		const OvMenu = (items, top0) => D('position:absolute;z-index:45;' + (m ? 'left:0;right:0;bottom:0;border-top:1px solid var(--ui-border)' : 'right:24px;top:' + (top0 ?? (nr ? 150 : 140)) + 'px;width:320px;border:1px solid var(--ui-border)') + ';background:var(--ui-bg);box-shadow:var(--rc-shadow-pop);display:flex;flex-direction:column',
+			m && D('display:flex;justify-content:center;padding:8px 0 0', S('width:36px;height:4px;background:var(--ui-border-accented)')),
+			A('div', { role: 'menu', 'aria-label': 'More actions' }, 'display:flex;flex-direction:column;padding:4px 0', ...items.map(i => A('div', { role: 'menuitem', 'aria-disabled': i.dis || undefined, tabIndex: -1 }, 'flex-shrink:0;display:flex;align-items:center;gap:10px;min-height:' + (m ? 52 : 40) + 'px;padding:8px 12px;' + (i.dis ? 'opacity:.6;' : '') + (i.danger ? 'color:var(--ui-error)' : HL), Ic(i.ic, 16), D('display:flex;flex-direction:column;gap:2px', S('font-weight:500', i.l), i.why && S(MU + ';font-size:12px;font-weight:400;line-height:16px', i.why))))))
+		const Hdr = (L, o) => {
+			const cap = o.cap, a = Acts(L, o), items = OvItems(L, o, { skipRef: m && !a.prim && !a.sec.length && !a.un })
+			const refL = o.src ? 'Hide source reference' : 'Show source reference'
+			const pb = x2 => x2 && Btn(x2.l, 'primary', { busy: x2.busy, dis: x2.dis, ic: x2.ic })
+			const status = o.saving ? Bd('Saving…', 'neutral', 'loader-circle') : o.saveFail ? Bd('Save failed', 'error', 'circle-x') : o.pubFail || o.saved ? Bd('Saved', 'success', 'check') : (o.dirty || o.tst === 'unsaved') ? Bd('Unsaved changes', 'neutral', 'circle-dot') : null
+			const fresh = o.fresh && (nr ? A('span', { 'aria-label': o.fresh, title: o.fresh }, 'display:inline-flex;align-items:center;justify-content:center;width:24px;height:20px;flex-shrink:0;border:1px solid currentColor;background:var(--ui-bg);color:var(--ui-warning)', Ic('refresh-cw', 12)) : Fr(o.fresh))
+			const left = D('flex:1 1 auto;min-width:0;display:flex;align-items:center;gap:8px;flex-wrap:wrap', LangBtn(L.n, { code: L.c, open: !!o.open }), Pub(o.pub), status, fresh, !cap.e && Bd('Read only', 'neutral', 'lock'))
+			const right = !m && D('display:flex;align-items:center;gap:8px;flex-shrink:0;margin-left:auto;height:40px', Btn(nr ? '' : refL, 'secondary', { ic: 'columns-2', al: refL }), a.un && !nr && Btn(a.un.l), ...a.sec.map(x2 => Btn(x2.l, 'secondary', { dis: x2.dis })), pb(a.prim), items.length ? Btn('', 'secondary', { ic: 'ellipsis', al: 'More actions' }) : null)
+			if (!m) return D('flex:1 1 100%;min-width:0;display:flex;align-items:flex-start;gap:12px;flex-wrap:' + (nr ? 'wrap' : 'nowrap'), D('height:40px;display:flex;align-items:center;' + MU, Ic('arrow-left', 16)), D('display:flex;align-items:center;gap:8px;height:40px;flex-shrink:0;flex-wrap:nowrap', ...[LangBtn(L.n, { code: L.c, open: !!o.open }), Pub(o.pub), status, fresh, !cap.e && Bd('Read only', 'neutral', 'lock')].filter(Boolean)), D('flex:1 1 ' + (nr ? '100%' : '240px') + ';min-width:0;order:' + (nr ? 3 : 0), TitleIn(L, o)), right)
+			return D('flex:1 1 100%;min-width:0;display:flex;flex-direction:column;gap:10px', D('display:flex;align-items:flex-start;gap:8px', !m && D('height:60px;display:flex;align-items:flex-end;' + MU, Ic('arrow-left', 16)), D('flex:1;min-width:0', TitleIn(L, o))), D('display:flex;align-items:center;gap:12px;flex-wrap:wrap', left, right))
+		}
+		const MBar = (L, o) => {
+			if (!m) return null
+			const a = Acts(L, o), items = OvItems(L, o, { skipRef: !a.prim && !a.sec.length && !a.un }), bs = []
+			if (a.prim) bs.push(D('flex:1 1 0;min-width:0;display:flex', Btn(a.prim.l, 'primary', { w: '100%', busy: a.prim.busy, dis: a.prim.dis, ic: a.prim.ic })))
+			a.sec.forEach(x2 => bs.push(Btn(x2.l, 'secondary', { dis: x2.dis })))
+			if (!a.prim && !a.sec.length) bs.push(D('flex:1 1 0;display:flex', Btn(a.un ? a.un.l : (o.src ? 'Hide source reference' : 'Show source reference'), 'secondary', { w: '100%', ic: a.un ? 'eye-off' : 'columns-2' })))
+			if (items.length) bs.push(Btn('', 'secondary', { ic: 'ellipsis', al: 'More actions' }))
+			return D('flex-shrink:0;background:var(--ui-bg);border-top:1px solid var(--ui-border);padding:12px 16px;display:flex;gap:8px;align-items:center', ...bs)
+		}
+		const Seg = (on, L, S0) => A('div', { role: 'radiogroup', 'aria-label': 'Show' }, 'display:flex;border:1px solid var(--ui-border-accented);flex-shrink:0', ...['Source (' + S0.n + ')', 'Edit (' + L.n + ')'].map((t, i) => A('span', { role: 'radio', 'aria-checked': (on ? i === 0 : i === 1) }, 'flex:1;height:44px;display:flex;align-items:center;justify-content:center;font-weight:500;background:' + ((on ? i === 0 : i === 1) ? 'var(--ui-primary)' : 'var(--ui-bg)') + ';color:' + ((on ? i === 0 : i === 1) ? 'var(--ui-bg)' : 'var(--ui-text-toned)'), t)))
+		const TempRef = S('white-space:nowrap;display:inline-flex;align-items:center;gap:4px;height:20px;padding:0 6px;font-size:12px;font-weight:500;border:1px dashed var(--ui-border-accented);color:var(--ui-text-toned);background:var(--ui-bg)', Ic('book-open', 12), 'Temporary reference')
+		const Tracked = S0n => Bd('Tracked source: ' + S0n, 'info', 'link')
+		const Src = (S0, o = {}) => D('flex:1;min-width:0;min-height:0;display:flex;flex-direction:column;gap:10px',
+			D('flex-shrink:0;display:flex;flex-direction:column;gap:8px;padding:8px 12px;border:1px dashed var(--ui-border-accented);background:var(--ui-bg)', D('display:flex;align-items:center;gap:8px;flex-wrap:wrap', TempRef, S('font-weight:600;' + HL, S0.n), S(mono + ';' + MU, S0.c), Pub('pub')), D('display:flex;align-items:center;gap:8px', S('white-space:nowrap;display:inline-flex;gap:4px;' + MU + ';font-size:12px', Ic('lock', 14), 'Read only'), D('flex:1'), Btn('Change reference', 'secondary', { sm: true }))),
+			S('flex-shrink:0;' + MU + ';font-size:12px;line-height:18px', 'For comparing only. Review is tracked against English. Changing the reference doesn\'t change the tracked source.'),
+			o.gone ? Alert('warning', 'triangle-alert', 'This reference isn\'t available', 'It was deleted or you can no longer read it. Your version isn\'t affected.', Btn('Choose another reference', 'secondary', { sm: true })) : [
+				A('div', { dir: S0.dir, lang: S0.lang, role: 'heading', 'aria-level': '2', tabIndex: 0 }, 'font:600 16px/24px \'IBM Plex Sans\',sans-serif;' + HL, S0.t),
+				Body(S0, { ro: true, label: 'Reference', long: o.long })])
+		// ---- site shells
+		const setS = { nav: 'settings', crumbs: ['Settings', 'Sites', 'Journal', 'Languages'], mTitle: 'Journal · Languages', mLead: 'arrow-left' }
+		const edS = { nav: 'articles', crumbs: ['Articles', 'Editor'], mTitle: 'Editor', mLead: 'arrow-left' }
+		const liS = { nav: 'articles', crumbs: ['Articles'], mTitle: 'Articles' }
+		// ---- site languages
+		const SOC = (site, code) => { const q = (FX.SOCIAL[site] || {})[code] || ['none']; return q[0] === 'derived' ? 'Derived: ' + q[1] : q[0] === 'set' ? 'Set: ' + q[1] : 'Not set' }
+		const SiteRows = (siteKey, ro) => { const si = FX.SITES[siteKey], all = si.langs.map(k => [k, 1]).concat(si.disabled.map(k => [k, 0])); return all.map(([k, en]) => { const c = FX.count(k, si.stories), def = k === si.def, soc = SOC(siteKey, k)
+			return D(ROW + ';flex-wrap:wrap;opacity:' + (en ? 1 : .85), D('flex:1 1 160px;min-width:0;display:flex;flex-direction:column', S('font-weight:500;' + HL + ';overflow:hidden;text-overflow:ellipsis;white-space:nowrap', LNm[k] || k), S(mono + ';' + MU, k)),
+				def ? Bd('Default', 'info', 'star') : !en ? Bd('Disabled', 'neutral', 'eye-off') : null, S((m ? 'flex:1 1 100%;font-size:12px;' : 'width:170px;') + MU, FX.pl(c[0], 'version') + ' · ' + c[1] + ' published'),
+				D('display:flex;align-items:center;gap:6px;' + (m ? 'flex:1 1 100%' : 'width:270px;white-space:nowrap'), S('font-size:12px;white-space:nowrap;' + MU, 'Social locale'), S(mono + ';' + (soc === 'Not set' ? MU : HL), soc), !ro && Btn('Edit', 'ghost', { sm: true, al: 'Edit social locale for ' + (LNm[k] || k) })),
+				!ro && !en ? Btn('Re-enable', 'secondary', { sm: true }) : null, !ro && Btn('', 'ghost', { ic: 'ellipsis', sm: true, al: 'Actions for ' + (LNm[k] || k) })) }) }
+		const slPage = () => {
+			const ro = x === 'readonly', single = x === 'single', skey = single ? 'archive' : x === 'social' || x === 'socialEdit' || x === 'socialInvalid' ? 'atelier' : 'journal', site = FX.SITES[skey].name, T = 'Languages', SUB = 'Content languages for ' + site + '. Each article version is written in one language.'
+			if (x === 'loading') return Page(T, SUB, null, Sk(4))
+			if (x === 'error') return Page(T, SUB, null, Alert('error', 'circle-x', 'Couldn\'t load languages', 'Check your connection and try again.', Btn('Try again', 'secondary', { sm: true })))
+			const banner = x === 'disableDefault' ? Alert('warning', 'triangle-alert', 'English is the default', 'Choose another default first, then disable English.') : x === 'disableLast' ? Alert('warning', 'triangle-alert', 'At least one language must stay enabled', 'Journal needs a language for new articles.') : x === 'defaultFail' ? Alert('error', 'circle-x', 'Couldn\'t change the default language', 'Nothing changed. English is still the default. Try again.', Btn('Try again', 'secondary', { sm: true })) : x === 'removeFail' ? Alert('error', 'circle-x', 'Couldn\'t remove Italian', 'Nothing changed. Italian is still listed. Try again.', Btn('Try again', 'secondary', { sm: true })) : x === 'stale' ? Alert('error', 'circle-x', 'Languages changed. Reload.', 'Another owner changed the languages for Journal while this page was open. Reload to see the current list. Your change wasn\'t applied.', Btn('Reload', 'secondary', { sm: true })) : null
+			return Page(T, SUB, !ro && Btn('Add language', 'primary', { ic: 'plus' }),
+				ro && Alert('neutral', 'lock', 'Only owners can change languages', 'You can see which languages are enabled, their social locale and how many versions each has. Ask an owner to change them.'), banner,
+				single ? Card(S('font-weight:600;' + HL, 'Archive uses one language'), S(TO, 'New articles are written in Portuguese (Brazil). Add a language to write translations and publish them separately.'), D('display:flex;gap:10px;align-items:center;flex-wrap:wrap', Bd('Default', 'info', 'star'), S('font-weight:500;' + HL, 'Portuguese (Brazil)'), S(mono + ';' + MU, 'pt-BR'), D('display:flex;gap:6px;align-items:center;' + (m ? 'flex:1 1 100%' : ''), S(MU + ';font-size:12px', 'Social locale'), S(mono + ';' + HL, 'Derived: pt_BR'))))
+				: D('background:var(--ui-bg);border:1px solid var(--ui-border)', D('padding:8px 16px;background:var(--ui-bg-elevated);' + MU + ';font-weight:500', 'Language'), ...SiteRows(skey, ro)),
+				single && Alert('info', 'info', 'Regional language kept: pt-BR', 'Setup kept the full site locale, so the default content language is Portuguese (Brazil), not plain Portuguese. The site locale still formats dates and numbers. Social locale: Derived: pt_BR, taken from the language code.'),
+				!single && !ro && S(MU + ';font-size:12px;text-wrap:pretty', 'Disabling a language keeps its versions readable and editable, and published ones stay online. Drafts can be published again after you re-enable it. Social locale: Derived comes from the language code, Set is chosen by an owner, Not set leaves og:locale out.'))
+		}
+		const slOv = () => {
+			const addBody = (err) => [err && Alert('error', 'circle-x', 'Couldn\'t save languages', 'Nothing changed. Your selection is kept. Try again.'), Fd('Language', 'Portuguese (Brazil)', { sel: true, focus: !err }), Fd('Language code', 'pt-BR', { mono: true, ro: true, lock: true, help: 'Used in the API and in page language metadata.' }), Fd('Social locale', 'Derived: pt_BR', { mono: true, ro: true, lock: true, help: 'Taken from the language code. For a code without a region, such as fr, an owner sets one or leaves it empty and og:locale is left out.' })]
+			const soc = (val, err, name, code) => Dlg({ title: 'Social locale for ' + name, desc: 'Used for og:locale on ' + name + ' pages. Leave it empty to omit the tag.' }, [Fd('Social locale', val, { mono: true, focus: !err, err, help: err ? null : 'Format: language_REGION, for example ' + code + '. Letters only, one underscore.' }), code === 'pt_BR' && Alert('info', 'info', 'Derived from the language code', 'pt-BR gives pt_BR. Setting a value replaces the derived one.')], [Btn('Cancel'), Btn('Save social locale', 'primary', { dis: !!err })])
+			const dlgs = {
+				add: () => Dlg({ title: 'Add a language', desc: 'Choose a language for Journal. Regional variants such as English (United Kingdom) are separate entries.' }, addBody(), [Btn('Cancel'), Btn('Add language', 'primary')]),
+				saveFail: () => Dlg({ title: 'Add a language', desc: 'Choose a language for Journal.' }, addBody(true), [Btn('Cancel'), Btn('Try again', 'primary')]),
+				adddup: () => Dlg({ title: 'Add a language', desc: 'Choose a language for Journal.' }, [Fd('Language', 'French', { sel: true, err: 'French is already enabled for Journal.' })], [Btn('Cancel'), Btn('Add language', 'primary', { dis: true })]),
+				broader: () => Dlg({ title: 'Add a language', desc: 'Choose a language for Journal.' }, [Fd('Language', 'Portuguese (Portugal)', { sel: true }), Alert('warning', 'triangle-alert', 'Portuguese (Portugal) isn\'t available', 'Only the broader language Portuguese (pt) is supported. Pages and the API will say pt, not pt-PT. Articles written in this language can\'t be told apart from other Portuguese.'), D('display:flex;gap:10px;align-items:center;min-height:' + (m ? 44 : 24) + 'px', S('width:16px;height:16px;border:1px solid var(--ui-primary);background:var(--ui-primary);color:var(--ui-bg);display:flex;align-items:center;justify-content:center', Ic('check', 12)), S('font-weight:500;' + HL, 'Add Portuguese (pt) instead'))], [Btn('Cancel'), Btn('Add Portuguese', 'primary')]),
+				default: () => Dlg({ title: 'Make French the default language?', desc: 'New articles start in the default language, and it is the first choice for each article\'s title in the list.' }, [Alert('info', 'info', 'No content changes', 'Existing versions keep their language, status and links. Public requests that name no language will resolve French where a published French version exists, and return not found where one doesn\'t. Requests that name a language aren\'t affected.')], [Btn('Cancel'), Btn('Make French default', 'primary')]),
+				defaultFail: () => Dlg({ title: 'Make French the default language?', desc: 'New articles start in the default language.' }, [Alert('error', 'circle-x', 'Couldn\'t change the default language', 'Nothing changed. Try again.')], [Btn('Cancel'), Btn('Try again', 'primary')]),
+				disable: () => Dlg({ title: 'Disable German?', desc: 'German is used by 4 versions: 1 draft and 3 published.' }, [Alert('warning', 'triangle-alert', 'Nothing is deleted or unpublished', 'The 3 published German versions stay online. All 4 versions stay readable and editable. The draft can\'t be published until you re-enable German. Nobody can create new German versions.')], [Btn('Cancel'), Btn('Disable German', 'primary')]),
+				stale: () => Dlg({ title: 'Disable German?', desc: 'German is used by 4 versions.' }, [Alert('error', 'circle-x', 'Languages changed. Reload.', 'Your change wasn\'t applied.')], [Btn('Cancel'), Btn('Reload', 'primary')]),
+				reenable: () => Dlg({ title: 'Re-enable Spanish?', desc: 'Writers can create Spanish versions again. The 1 existing Spanish version stays as it is. Nothing else changes.' }, [], [Btn('Cancel'), Btn('Re-enable Spanish', 'primary')]),
+				reenableFail: () => Dlg({ title: 'Re-enable Spanish?', desc: 'Writers can create Spanish versions again.' }, [Alert('error', 'circle-x', 'Couldn\'t re-enable Spanish', 'Nothing changed. Spanish is still disabled. Try again.')], [Btn('Cancel'), Btn('Try again', 'primary')]),
+				remove: () => Dlg({ title: 'Remove Italian?', desc: 'No article uses Italian. You can add it again later.' }, [], [Btn('Cancel'), Btn('Remove Italian', 'danger')]),
+				removeFail: () => Dlg({ title: 'Remove Italian?', desc: 'No article uses Italian.' }, [Alert('error', 'circle-x', 'Couldn\'t remove Italian', 'Nothing changed. Italian is still listed. Try again.')], [Btn('Cancel'), Btn('Try again', 'danger')]),
+				removeBlocked: () => Dlg({ title: 'Spanish can\'t be removed', desc: 'Spanish is used by 1 version. Disable the language to keep it, or delete it first.' }, [], [Btn('Close'), Btn('Disable Spanish', 'primary')]),
+				socialEdit: () => soc('fr_FR', null, 'French', 'fr_FR'),
+				socialInvalid: () => soc('fr-FR', 'Use letters and one underscore, for example fr_FR.', 'French', 'fr_FR')
+			}
+			if (x === 'saved') return [Toast('success', 'circle-check', 'French added', 'Writers can now create French versions.')]
+			if (x === 'reenableDone') return [Toast('success', 'circle-check', 'Spanish re-enabled', 'Writers can create Spanish versions again. Drafts can be published.')]
+			return dlgs[x] ? dlgs[x]() : null
+		}
+		// ---- public URL pattern
+		const puPage = () => {
+			const bad = { unknown: ['https://journal.example.com/{language}/{slug}', 'Unknown placeholder {language}. Use {lang} and {slug}.'], scheme: ['ftp://journal.example.com/{lang}/{slug}', 'Start with https:// or http://.'], encoded: ['https://journal.example.com/my pages/{lang}/{slug}', 'Remove spaces and characters that need encoding. Use letters, digits, - and _.'], invalidHost: ['https://journal..example.com/{lang}/{slug}', 'Enter a valid host name, such as journal.example.com.'], noSlug: ['https://journal.example.com/{lang}', 'Add {slug} so each article has its own address.'] }[x]
+			const ro = x === 'viewOnly', unset = x === 'unset', val = bad ? bad[0] : unset ? '' : x === 'editing' ? 'https://journal.example.com/{lang}/articles/{slug}' : 'https://journal.example.com/{lang}/{slug}'
+			const prev = bad ? null : unset ? null : x === 'editing' ? 'https://journal.example.com/en/articles/how-we-price-a-bathroom-renovation' : 'https://journal.example.com/en/how-we-price-a-bathroom-renovation'
+			return Page('Public URL', 'Where Journal articles appear on your website. Used for canonical and alternate links.', null,
+				ro && Alert('neutral', 'lock', 'Only owners can change this', 'You can read the pattern. Ask an owner to change it.'),
+				unset && Alert('info', 'info', 'Public URL not configured', 'Page, canonical and alternate addresses stay hidden until you add a pattern. Links by article ID still work.'),
+				Card(Fd('Public URL pattern', val || 'https://example.com/{lang}/{slug}', { mono: true, val: !!val, ro, focus: !!bad || x === 'editing', err: bad && bad[1], help: bad ? null : 'Placeholders: {lang} is the language code, such as fr or pt-BR. {slug} is the article address in that language.' }),
+					prev && D('display:flex;flex-direction:column;gap:4px', S('font-size:12px;' + MU, 'Preview with "How we price a bathroom renovation" in English, the default language'), S(mono + ';' + HL + ';overflow-wrap:anywhere', prev), S('font-size:12px;' + MU, 'The preview uses the most recently updated article that has a version in the default language.')),
+					!ro && D('display:flex;gap:8px', Btn('Save', 'primary', { dis: !!bad || unset }), Btn('Cancel'))))
+		}
+		// ---- setup
+		const SUV = FX.SETUP, SUN = SUV.reduce((a, r) => a + r.n, 0)
+		const suVal = (r, chosen) => r.name ? r.name + ' · ' + r.tag : chosen ? 'English · en' : 'Choose a language'
+		const suBody = () => {
+			if (x === 'empty') return Page('Languages', 'Content languages for Gallery.', null, Card(S('font-weight:600;' + HL, 'Confirm the default language'), S(TO, 'Gallery has no articles yet. New articles will be written in this language.'), Fd('Default content language', 'English (United Kingdom) · en-GB', { sel: true, help: 'Seeded from site locale en-GB. The full locale is kept. Confirm or change it.' }), D('display:flex', Btn('Save', 'primary'))))
+			const done = x === 'done', busy = x === 'applying', fail = x === 'fail', prog = x === 'inProgress', nol = x === 'noLocale', chosen = x !== 'ready' && !nol, rowsSrc = nol ? SUV.filter(r => !r.name) : SUV, N = rowsSrc.reduce((a, r) => a + r.n, 0)
+			return Page('Set article languages', 'Existing articles don\'t have a language yet. Confirm or change the language for each site.', null,
+				done ? Alert('success', 'circle-check', 'Languages assigned', SUN + ' articles now have a language. Nothing was translated, and no articles were grouped.', Btn('Open Articles', 'secondary', { sm: true })) :
+				fail ? Alert('error', 'circle-x', 'Nothing was changed', 'The update failed, so no article has a language yet. Your choices are kept. Try again. Running it twice is safe.', Btn('Try again', 'secondary', { sm: true })) :
+				prog ? Alert('info', 'loader-circle', 'Setup is already running', 'Another owner started it. Languages appear here when it finishes. Articles created meanwhile get each site\'s default language. Starting it again is safe: sites that already have a language are skipped.', Btn('Check again', 'secondary', { sm: true })) :
+				busy ? Alert('info', 'loader-circle', 'Assigning languages', 'Articles created while this runs get the site\'s default language.') :
+				nol ? Alert('error', 'circle-x', 'Choose a language for Notes', 'Notes has no site locale, so there is nothing to start from. Choose the language its articles are written in.') :
+				Alert('info', 'info', 'This labels articles. It doesn\'t translate them.', 'Each existing article becomes the only version of its own article group. Each site\'s language starts from its locale with the region kept: pt-BR stays Portuguese (Brazil). Nothing is applied until you confirm.'),
+				D('background:var(--ui-bg);border:1px solid var(--ui-border)', ...rowsSrc.map(r => D(ROW + ';' + (m ? 'flex-wrap:wrap' : ''), D('flex:1;min-width:140px;display:flex;flex-direction:column', S('font-weight:600;' + HL, r.site), S(MU + ';font-size:12px', r.n + ' articles · ' + r.note)), D('width:' + (m ? '100%' : '300px'), Fd('', suVal(r, chosen), { sel: !done && !prog, val: !!(r.name || chosen), err: nol && !r.name ? 'Required before you can apply.' : null, ro: prog, help: done || nol ? null : r.name ? 'Seeded from site locale ' + r.locale + '. Confirm or change.' : chosen ? null : 'Required before you can apply.' }))))),
+				!done && D('display:flex;gap:8px;align-items:center;flex-wrap:wrap', Btn(busy ? 'Assigning…' : 'Confirm and assign to ' + N + ' articles', 'primary', { busy, dis: busy || prog || x === 'ready' || nol }), S(MU + ';font-size:12px', 'Counts are articles in ' + rowsSrc.length + (rowsSrc.length === 1 ? ' site.' : ' sites.'))))
+		}
+		// ---- article list
+		const LN = LNm
+		const Pager = (V) => {
+			const pb = m ? 44 : 32
+			const edge = (n, al, dis) => A('span', { role: 'button', 'aria-label': al, 'aria-disabled': dis || undefined }, 'width:' + pb + 'px;height:' + pb + 'px;display:flex;align-items:center;justify-content:center;border:1px solid var(--ui-border-accented);background:var(--ui-bg);color:var(--ui-text-highlighted);opacity:' + (dis ? 0.4 : 1), Ic(n))
+			const first = V.page === 1, last = V.page === V.pages
+			const set = new Set([1, V.pages, V.page - 1, V.page, V.page + 1].filter(n => n >= 1 && n <= V.pages))
+			const arr = V.pages <= 7 ? Array.from({ length: V.pages }, (_, i) => i + 1) : [...set].sort((p, q) => p - q)
+			const nums = []
+			arr.forEach((n, i) => { if (i && n - arr[i - 1] > 1) nums.push(S('min-width:' + pb + 'px;height:' + pb + 'px;display:flex;align-items:center;justify-content:center;' + MU, '…')); const cur = n === V.page; nums.push(A('span', { role: 'button', 'aria-label': 'Page ' + n, 'aria-current': cur ? 'page' : undefined }, 'min-width:' + pb + 'px;height:' + pb + 'px;padding:0 6px;display:flex;align-items:center;justify-content:center;border:1px solid ' + (cur ? 'var(--ui-primary)' : 'var(--ui-border-accented)') + ';background:' + (cur ? 'var(--rc-sand)' : 'var(--ui-bg)') + ';color:' + (cur ? 'var(--rc-on-sand)' : 'var(--ui-text-highlighted)') + ';font-weight:' + (cur ? 600 : 400), String(n))) })
+			const summary = A('span', { 'aria-live': 'polite' }, (m ? 'flex:0 1 auto;' : 'flex:1;') + MU, 'Showing ' + V.from + '–' + V.to + ' of ' + V.total)
+			const size = A('span', { role: 'combobox', 'aria-label': 'Rows per page', 'aria-expanded': false }, 'height:' + pb + 'px;padding:0 8px 0 12px;display:flex;align-items:center;gap:8px;border:1px solid var(--ui-border-accented);background:var(--ui-bg);flex-shrink:0;' + HL, V.size + ' per page', Ic('chevron-down', 14))
+			if (!m) return D('flex-shrink:0;display:flex;align-items:center;gap:16px;padding:12px 0 0', summary, size, V.pages > 1 && A('nav', { 'aria-label': 'Pagination' }, 'display:flex;align-items:center;gap:4px;justify-content:flex-end', edge('chevrons-left', 'First page', first), edge('chevron-left', 'Previous page', first), ...nums, edge('chevron-right', 'Next page', last), edge('chevrons-right', 'Last page', last)))
+			const mb = (lab, ico, al, dis, right) => A('span', { role: 'button', 'aria-label': al, 'aria-disabled': dis || undefined }, 'flex:1;height:44px;display:flex;align-items:center;justify-content:center;gap:6px;border:1px solid var(--ui-border-accented);background:var(--ui-bg);color:var(--ui-text-highlighted);font-weight:500;opacity:' + (dis ? 0.4 : 1), !right && Ic(ico), lab, right && Ic(ico))
+			return D('flex-shrink:0;display:flex;flex-direction:column;gap:12px;padding:12px 0 16px', D('display:flex;align-items:center;gap:12px;flex-wrap:wrap;justify-content:space-between', summary, size), V.pages > 1 && A('nav', { 'aria-label': 'Pagination' }, 'display:flex;align-items:center;gap:8px', mb('Previous', 'chevron-left', 'Previous page', first), S('flex:0 0 auto;padding:0 4px;white-space:nowrap;font-weight:500;' + HL, 'Page ' + V.page + ' of ' + V.pages), mb('Next', 'chevron-right', 'Next page', last, true)))
+		}
+		const Chip = l => D('white-space:nowrap;width:max-content;flex-shrink:0;display:inline-flex;align-items:center;gap:6px;height:' + (m ? 36 : 24) + 'px;padding:0 8px;border:1px solid var(--ui-border-accented);background:var(--ui-bg);' + HL + ';font-size:12px', l, A('span', { role: 'button', 'aria-label': 'Remove filter ' + l }, 'display:inline-flex', Ic('x', 14)))
+		const ChipC = (c, k) => A('span', { 'aria-label': (LN[c.k] || c.k) + ': ' + (c.st === 'pub' ? 'published' : c.st === 'draft' ? 'draft' : 'no version') + (c.nr ? ', needs review' : '') + (c.off ? ', language disabled' : '') }, 'white-space:nowrap;display:inline-flex;align-items:center;gap:4px;height:22px;padding:0 6px;font:500 12px \'IBM Plex Mono\',monospace;' + (c.st ? 'border:1px solid var(--ui-border-accented);' + HL : 'border:1px dashed var(--ui-border-accented);' + MU) + (c.off ? ';opacity:.75' : ''), c.k.toUpperCase(), c.st === 'pub' ? Ic('circle-check', 12) : c.st === 'draft' ? Ic('pencil', 12) : Ic('plus', 12), !!c.nr && Ic('refresh-cw', 12))
+		const Cov = (cs) => { const Lc = m || nr ? 4 : 5, vis = cs.slice(0, Lc), more = cs.slice(Lc); return D('display:flex;gap:6px;align-items:center;flex-wrap:' + (m ? 'wrap' : 'nowrap'), ...vis.map(ChipC), more.length ? (m ? (x0 => D('display:inline-flex;align-items:center;height:44px;margin:-11px 0', x0)) : (x0 => x0))(A('span', { role: 'button', 'aria-label': more.length + ' more languages: ' + more.map(c => LN[c.k] || c.k).join(', ') }, 'display:inline-flex;align-items:center;height:22px;padding:0 6px;font:500 12px \'IBM Plex Mono\',monospace;background:var(--ui-bg-elevated);' + HL, '+' + more.length)) : null) }
+		const covW = m ? '' : (nr ? 'width:330px;' : 'width:430px;')
+		const RowMenuBtn = () => Btn('', 'ghost', { ic: 'ellipsis', sm: true, al: 'Row actions' })
+		const liPage = () => {
+			const C = { page2: { page: 2 }, fr: { lang: 'fr' }, frMissing: { lang: 'fr', tab: 'missing' }, emptyMissing: { site: 'press', lang: 'fr', tab: 'missing' }, noResults: { q: 'zinc' }, frLoading: { lang: 'fr', load: 1 }, listFail: { fail: 1 }, limited: { lim: 1 }, filters: { lang: 'fr', status: 'draft' }, tabsScroll: { lang: 'fr', tab: 'missing', shift: 1 }, long: { site: 'atelier', status: 'draft', seo: 1 }, author: { author: 'Marta Alves' }, review: { tab: 'review' }, frReview: { lang: 'fr', tab: 'review' }, langFilter: { menu: 1 }, rowMenu: { row: 1 }, menuLang: { lang: 'fr' }, apiCopy: { lang: 'fr' }, single: { site: 'archive' }, singleNoResults: { site: 'archive', q: 'zinc' }, singleLoading: { site: 'archive', load: 1 }, singleFail: { site: 'archive', fail: 1 }, singleEmpty: { site: 'gallery' }, singleMenu: { site: 'archive' }, singleDraft: { site: 'archive', status: 'draft' }, ...(x === 'home' ? {} : {}) }[x] || {}
+			const site = FX.SITES[C.site || 'journal'], lim = !!C.lim, single = site.langs.length <= 1
+			const V = FX.view({ site, lang: C.lang, tab: C.tab, status: C.status, author: C.author, seo: C.seo, q: C.q, page: C.page, read: lim ? ['en'] : null, create: lim ? [] : null, scope: lim ? (s0 => ['Camille Roche', 'Luis Ferrer'].includes(s0.by)) : null })
+			const tabs = (C.load || C.fail) ? V.tabs.map(q => [q[0], '–', q[2]]) : V.tabs, tabOn = Math.max(0, V.tabs.findIndex(q => q[2] === V.tab))
+			const act = [C.status && 'Status: Draft', C.author && 'Author: ' + C.author, C.seo && 'SEO: Needs attention'].filter(Boolean)
+			const chips = act.length ? ['Site: ' + site.name].concat(C.lang ? ['Language: ' + LN[C.lang]] : [], act) : []
+			const nF = chips.length
+			const filt = () => D('display:flex;gap:8px;flex-wrap:wrap;align-items:center', D('flex:1;min-width:' + (m ? '0' : '200px'), Fd('', C.q ? C.q : C.lang ? 'Search ' + LN[C.lang] + ' titles' : 'Search titles in every language', { val: !!C.q })),
+				m ? Btn('Filters' + (nF ? ' · ' + nF : ''), 'secondary', { ic: 'sliders-horizontal', al: nF ? 'Filters, ' + nF + ' active' : 'Filters' }) : [Fd('', site.name, { sel: true }), single ? null : Fd('', C.lang ? LN[C.lang] : 'All languages', { sel: true }), Fd('', C.status ? 'Draft' : 'Any status', { sel: true }), Fd('', C.author || 'Any author', { sel: true, focus: x === 'author' }), Fd('', C.seo ? 'Needs attention' : 'Any SEO state', { sel: true })].filter(Boolean).map(e => D('flex:0 0 auto;width:' + (nr ? 128 : 150) + 'px', e)))
+			const chipRow = chips.length ? D('display:flex;gap:6px;flex-wrap:wrap;align-items:center', ...chips.map(Chip), Btn('Clear all', 'ghost', { sm: !m })) : null
+			const shift = C.shift ? -96 : 0
+			const tabRow = D('position:relative;border-bottom:1px solid var(--ui-border);display:flex;align-items:center;gap:4px', m && Btn('', 'ghost', { ic: 'chevron-left', sm: true, al: 'Scroll tabs left', dis: !shift }),
+				A('div', { role: 'tablist', 'aria-label': 'Article views' }, 'flex:1;min-width:0;overflow:hidden;display:flex;position:relative', D('display:flex;gap:' + (m ? 16 : 24) + 'px;flex-shrink:0;transform:translateX(' + (m ? shift : 0) + 'px)', ...tabs.map((q, i) => A('div', { role: 'tab', 'aria-selected': i === tabOn }, 'padding:' + (m ? '12px 0' : '8px 0') + ';white-space:nowrap;font-weight:' + (i === tabOn ? 600 : 500) + ';color:' + (i === tabOn ? 'var(--ui-text-highlighted)' : 'var(--ui-text-toned)') + ';border-bottom:2px solid ' + (i === tabOn ? 'var(--ui-primary)' : 'transparent'), q[0] + ' ', S(MU + ';font-weight:400', q[1])))), m && D('position:absolute;right:0;top:0;bottom:0;width:28px;background:linear-gradient(90deg,transparent,var(--ui-bg))'), m && !!shift && D('position:absolute;left:0;top:0;bottom:0;width:28px;background:linear-gradient(270deg,transparent,var(--ui-bg))')), m && Btn('', 'ghost', { ic: 'chevron-right', sm: true, al: 'Scroll tabs right' }))
+			const card = 'background:var(--ui-bg);border:1px solid var(--ui-border)', hd = !m && D('display:flex;gap:12px;padding:8px 16px;background:var(--ui-bg-elevated);' + MU + ';font-weight:500', S('flex:1', 'Article'), S(covW + 'flex-shrink:0', 'Languages'), S('width:110px', 'Author'), S('width:80px', 'Updated'), S('width:28px'))
+			const hdS = !m && D('display:flex;gap:12px;padding:8px 16px;background:var(--ui-bg-elevated);' + MU + ';font-weight:500', S('flex:1', 'Article'), S('width:110px', 'Status'), S('width:110px', 'Author'), S('width:80px', 'Updated'), S('width:28px'))
+			const SingleRow = (r) => D(ROW + ';' + (m ? 'flex-wrap:wrap;gap:6px 12px' : ''), D('flex:1 1 ' + (m ? '70%' : '0') + ';min-width:0;display:flex;flex-direction:column;gap:2px', A('span', { lang: r.rep }, HL + ';font-weight:500;overflow:hidden;text-overflow:ellipsis;white-space:nowrap', FX.tt(r.s, r.rep)), m && S(MU + ';font-size:12px', r.s.by + ' · ' + r.s.upd)), D((m ? 'order:3' : 'width:110px'), Pub(r.s.v[r.rep][0])), !m && [S(MU + ';width:110px', r.s.by), S(MU + ';width:80px', r.s.upd)], D(m ? 'order:1' : '', RowMenuBtn()))
+			const creat = lim ? [] : site.langs
+			const StoryRow = (r) => { const s0 = r.s, cs = FX.chips(s0, site, creat), t = FX.tt(s0, r.rep)
+				return D(ROW + ';' + (m ? 'flex-wrap:wrap;gap:6px 12px' : ''), D('flex:1 1 ' + (m ? '70%' : '0') + ';min-width:0;display:flex;flex-direction:column;gap:2px', A('span', { lang: r.rep }, HL + ';font-weight:500;overflow:hidden;text-overflow:ellipsis;white-space:nowrap', t), r.rep !== site.def && S(MU + ';font-size:12px', 'Shown in ' + (LN[r.rep] || r.rep) + (site.disabled.includes(r.rep) ? ' · language disabled' : ''))), m && D('order:2;flex:1 1 100%', Cov(cs)), !m && D(covW + 'flex-shrink:0', Cov(cs)), m ? S('order:3;' + MU + ';font-size:12px;flex:1', s0.by + ' · ' + s0.upd) : [S(MU + ';width:110px', s0.by), S(MU + ';width:80px', s0.upd)], D(m ? 'order:1' : '', RowMenuBtn())) }
+			const VerRow = (r) => { const q = r.s.v[C.lang]; return D(ROW + ';' + (m ? 'flex-wrap:wrap' : ''), D('flex:1 1 ' + (m ? '70%' : '0') + ';min-width:0;display:flex;flex-direction:column;gap:2px', A('span', { lang: C.lang }, HL + ';font-weight:500;overflow:hidden;text-overflow:ellipsis;white-space:nowrap', FX.tt(r.s, C.lang)), m && S(MU + ';font-size:12px', r.s.by + ' · ' + r.s.upd)), D('display:flex;gap:6px', Pub(q[0]), q[1] ? Fr('Needs review') : null), !m && [S(MU + ';width:110px;margin-left:12px', r.s.by), S(MU + ';width:80px', r.s.upd)], RowMenuBtn()) }
+			const MissRow = (r) => D(ROW + ';' + (m ? 'flex-wrap:wrap' : ''), D('flex:1 1 0;min-width:0;display:flex;flex-direction:column;gap:2px', S(HL + ';font-weight:500;overflow:hidden;text-overflow:ellipsis;white-space:nowrap', FX.tt(r.s, r.rep)), S(MU + ';font-size:12px', 'Opens ' + LN[r.rep] + ' · ' + (r.s.v[r.rep][0] === 'pub' ? 'published' : 'draft') + (site.disabled.includes(r.rep) ? ' · language disabled' : ''))), Btn(m ? '' : 'Add ' + LN[C.lang] + ' translation', 'secondary', { sm: true, ic: 'plus', al: 'Add ' + LN[C.lang] + ' translation to ' + FX.tt(r.s, r.rep) }), RowMenuBtn())
+			let body
+			if (C.fail) body = Alert('error', 'circle-x', 'Couldn\'t load articles', 'Your filters and page are kept. Try again.', Btn('Try again', 'secondary', { sm: true }))
+			else if (C.load) body = Sk(5)
+			else if (!V.total && C.lang && V.tab === 'missing') body = D('padding:48px 16px;display:flex;flex-direction:column;align-items:center;gap:8px;text-align:center;' + card, Ic('circle-check', 28), S('font-weight:600;' + HL, 'Every article you can see has a ' + LN[C.lang] + ' version'), S(TO + ';max-width:360px', 'Articles without a ' + LN[C.lang] + ' version will appear here.'))
+			else if (!V.total && single && !C.q) body = D('padding:48px 16px;display:flex;flex-direction:column;align-items:center;gap:8px;text-align:center;' + card, Ic('file-text', 28), S('font-weight:600;' + HL, 'No articles yet'), S(TO + ';max-width:360px', 'Write your first one. It stays a draft until you publish it.'), Btn('New article', 'primary', { ic: 'plus' }))
+			else if (!V.total) body = D('padding:48px 16px;display:flex;flex-direction:column;align-items:center;gap:8px;text-align:center;' + card, Ic('search', 28), S('font-weight:600;' + HL, 'No articles match "' + (C.q || '') + '"'), S(TO, 'Search covers titles in every language you can read.'), Btn('Clear search', 'secondary', { sm: true }))
+			else body = D(card + ';min-height:0;overflow:auto;flex:0 1 auto', C.lang && V.tab === 'missing' ? null : (C.lang ? null : single ? hdS : hd), ...V.rows.map(C.lang ? (V.tab === 'missing' ? MissRow : VerRow) : single ? SingleRow : StoryRow))
+			const unit = C.fail || C.load ? '' : V.unit
+			return D('flex:1;min-height:0;overflow:hidden;display:flex;flex-direction:column;gap:' + (m ? 12 : 16) + 'px;padding:' + (m ? '16px' : '24px') + ';position:relative', D('display:flex;align-items:baseline;gap:12px', S('font:600 20px/28px \'IBM Plex Sans\',sans-serif;' + HL, 'Articles'), A('span', { 'aria-live': 'polite' }, 'flex:1;' + MU + ';font-weight:500', unit), Btn(m ? '' : 'New article', 'primary', { ic: 'plus', al: 'New article' })),
+				lim && Alert('neutral', 'lock', 'Showing only what you can read', 'Languages, counts and missing-translation results reflect the versions you have permission to see. You can\'t create translations on this site.'), filt(), chipRow, single ? null : tabRow, body, (V.total && !C.fail && !C.load) ? Pager(V) : null)
+		}
+		const sheet = (o) => D('position:absolute;inset:0;z-index:50;background:var(--rc-overlay);display:flex;align-items:' + (m ? 'flex-end' : 'center') + ';justify-content:center', A('div', { role: 'dialog', 'aria-modal': 'true', 'aria-label': 'Filters' }, 'width:100%;max-width:' + (m ? '100%' : '420px') + ';max-height:92%;background:var(--ui-bg);display:flex;flex-direction:column', D('display:flex;justify-content:center;padding:8px 0 0', S('width:36px;height:4px;background:var(--ui-border-accented)')),
+			D('padding:16px 16px 0;display:flex;align-items:center', S('flex:1;font:600 16px/24px \'IBM Plex Sans\',sans-serif;' + HL, 'Filters'), Btn('', 'ghost', { ic: 'x', al: 'Close filters' })),
+			D('padding:16px;display:flex;flex-direction:column;gap:14px;overflow-y:auto;min-height:0', Fd('Site', 'Journal', { sel: true }), Fd('Language', o.lang || 'All languages', { sel: true }), Fd('Status', o.status || 'Any status', { sel: true }), Fd('Author', o.author || 'Any author', { sel: true, focus: !!o.author }), Fd('SEO', 'Any SEO state', { sel: true })),
+			D('padding:12px 16px;border-top:1px solid var(--ui-border);display:flex;gap:8px', Btn('Clear all', 'secondary'), D('flex:1;display:flex', Btn('Show ' + o.n + ' results', 'primary', { w: '100%' })))))
+		const listOv = () => {
+			const V1 = FX.view({ site: J, lang: 'fr', status: 'draft' }), V2 = FX.view({ site: J, author: 'Marta Alves' })
+			if (x === 'filters' && m) return [sheet({ lang: 'French', status: 'Draft', n: V1.total })]
+			if (x === 'author' && m) return [sheet({ author: 'Marta Alves', n: V2.total })]
+			if (x === 'author') return [D('position:absolute;z-index:40;left:' + (nr ? 500 : 1018) + 'px;top:170px;width:240px;background:var(--ui-bg);border:1px solid var(--ui-border);box-shadow:var(--rc-shadow-pop)', A('div', { role: 'listbox', 'aria-label': 'Author' }, 'display:flex;flex-direction:column;padding:4px 0', ...[['Any author', J.stories.length]].concat(FX.AUTHORS).map((a, i) => A('div', { role: 'option', 'aria-selected': a[0] === 'Marta Alves' }, 'display:flex;align-items:center;gap:8px;min-height:36px;padding:6px 12px;' + (a[0] === 'Marta Alves' ? 'background:var(--rc-sand);color:var(--rc-on-sand);font-weight:600' : HL), S('width:16px', a[0] === 'Marta Alves' && Ic('check')), S('flex:1', a[0]), S(mono + ';' + (a[0] === 'Marta Alves' ? '' : MU), a[1])))))]
+			const langRows = (grp) => (grp ? J.disabled : J.langs).map(k => D('display:flex;align-items:center;gap:8px;min-height:' + (m ? 48 : 36) + 'px;padding:6px 12px;' + (grp ? MU : HL), S('width:16px'), S('flex:1', LN[k]), S(mono + ';' + MU, FX.count(k, J.stories)[0] + ' versions')))
+			if (x === 'langFilter') return [D('position:absolute;z-index:40;' + (m ? 'left:0;right:0;bottom:0;border-top:1px solid var(--ui-border)' : 'left:' + (nr ? 330 : 792) + 'px;top:170px;width:280px;border:1px solid var(--ui-border)') + ';background:var(--ui-bg);box-shadow:var(--rc-shadow-pop);display:flex;flex-direction:column;max-height:70%', A('div', { role: 'listbox', 'aria-label': 'Language' }, 'display:flex;flex-direction:column;overflow-y:auto;padding:4px 0', D('padding:4px 12px;font-size:11px;font-weight:600;letter-spacing:.04em;text-transform:uppercase;' + MU, 'Enabled'), D('display:flex;align-items:center;min-height:' + (m ? 48 : 36) + 'px;padding:6px 12px;' + HL, S('width:16px'), 'All languages'), ...langRows(0), D('padding:8px 12px 4px;border-top:1px solid var(--ui-border);font-size:11px;font-weight:600;letter-spacing:.04em;text-transform:uppercase;' + MU, 'Disabled'), ...langRows(1), D('padding:6px 12px 8px;font-size:12px;' + MU, 'Disabled languages keep their versions. They can\'t get new ones.')))]
+			if (x === 'singleMenu') return [OvMenu([{ l: 'Open', ic: 'file-pen' }, { l: 'Unpublish', ic: 'eye-off' }, { l: 'Copy API URL', ic: 'copy' }, { l: 'Delete article', ic: 'trash-2', danger: 1 }], 272)]
+			if (x === 'menuLang') return [OvMenu([{ l: 'Open French', ic: 'file-pen' }, { l: 'Open another language…', ic: 'languages' }, { l: 'Publish French', ic: 'globe' }, { l: 'Copy API URL', ic: 'copy' }, { l: 'Delete French version', ic: 'trash-2', danger: 1 }], 272)]
+			if (x === 'apiCopy') return [Toast('success', 'circle-check', 'API URL copied', '/v1/article/14?lang=fr')]
+			if (x === 'deleteStoryDone') return [Toast('success', 'circle-check', 'Article deleted', 'The article and all of its translations were deleted.')]
+			if (x === 'rowMenu') return [OvMenu([{ l: 'Open English', ic: 'file-pen' }, { l: 'Open another language…', ic: 'languages' }, { l: 'Add translation…', ic: 'plus' }, { l: 'Unpublish English', ic: 'eye-off' }, { l: 'Copy API URL', ic: 'copy' }, { l: 'Delete English version', ic: 'trash-2', danger: 1 }])]
+			return []
+		}
+		// ---- new article
+		const naOv = () => {
+			const multi = x !== 'single'
+			return Dlg({ title: 'New article', desc: x === 'translation' ? 'Create a translation of an article you can read.' : 'Give the article a title. You can write the rest in the editor.' }, [
+				x === 'translation' ? [D('display:flex;flex-direction:column;gap:8px', Radio('New article', 'Starts an article in this language.', false), Radio('Translation of an existing article', 'Uses the same rules as Add translation.', true)), Fd('Article', 'Roof inspection checklist', { sel: true, help: 'No French version yet.' }), Fd('Language', 'French', { sel: true, help: 'Only enabled languages this article doesn\'t have yet.' }), Fd('Source version', 'English · published', { sel: true, help: 'You choose which version to copy from. It is also the source tracked for review.' }), Fd('Title in French', 'Liste de contrôle pour l\'inspection de la toiture', { focus: true, lang: 'fr' }), D('display:flex;flex-direction:column;gap:8px', S('font-weight:500;' + HL, 'Starting content'), Radio('Start empty', 'Only the title. Freshness shows No source.', false), Radio('Copy from English', 'Copies body, excerpt, search and social text, image alternative text and authors. The version starts as Needs review.', true))] :
+				[Fd('Title', x === 'sitechange' ? 'Spring newsletter' : 'Title', { val: x === 'sitechange', focus: x !== 'sitechange', help: '0 / 200' }), Fd('Site', x === 'sitechange' ? 'Notes' : x === 'single' ? 'Archive' : 'Journal', { sel: true }),
+				multi && Fd('Language', 'English', { sel: true, help: x === 'sitechange' ? 'Notes only offers English, so the language was reset from French.' : 'Default language for Journal.' }),
+				multi && D('display:flex;flex-direction:column;gap:8px', Radio('New article', 'Starts an article in this language.', true), Radio('Translation of an existing article', 'Uses the same rules as Add translation.', false))]
+			], [Btn('Cancel'), Btn(x === 'translation' ? 'Create French draft' : 'Create article', 'primary')])
+		}
+		// ---- add translation
+		const FRT = S1.tr.fr, FRT5 = 'Liste de contrôle pour l\'inspection de la toiture'
+		const LS = st => LV('en', 'English', 'EN', st)
+		const atOv = () => {
+			const empty = x === 'empty', long = x === 'long', dupCase = x === 'dup' || x === 'dupHidden', st = dupCase ? S1 : S5, ft = dupCase ? FRT : FRT5
+			const dis = ['gone', 'unreadable', 'langOff', 'dup', 'dupHidden', 'saving'].includes(x)
+			const f = [Fd('Language', 'French', { sel: true, ro: x === 'langOff', err: x === 'langOff' ? 'French was disabled on this site.' : null }), Fd('Source version', empty ? 'No source' : (x === 'unreadable' || x === 'gone') ? 'Choose a version' : 'English · published', { sel: true, val: !empty && x !== 'unreadable' && x !== 'gone', err: (x === 'unreadable' || x === 'gone') ? 'Choose a version you can read.' : null, help: (x === 'unreadable' || x === 'gone') ? null : empty ? 'Optional. Freshness shows No source until you pick a tracked source in the editor.' : 'You choose which version to copy from. It is also the source tracked for review. Access is checked again when you create the draft.' }), Fd('Title in French', long ? ft + ' avec les coûts cachés derrière les carreaux, sous la baignoire et autour des canalisations anciennes' : ft, { focus: x === 'form', lang: 'fr', help: 'Copying text is a starting point: it stays in English until you translate it.' }),
+				D('display:flex;flex-direction:column;gap:8px', S('font-weight:500;' + HL, 'Starting content'), Radio('Start empty', 'Only the title. Freshness shows No source until you pick a tracked source.', empty), Radio('Copy from English', 'Copies body, excerpt, search and social text, image alternative text and authors. Images are reused, files aren\'t duplicated. The version starts as Needs review.', !empty))]
+			if (long) f.push(Alert('neutral', 'info', 'Authors', 'Marta Alves, Camille Roche, Luis Ferrer, Ana Pereira, Jonas Weber and 4 more will be copied. You can change them in the editor.'), Alert('neutral', 'info', 'Images', 'Cover image and 7 inline images are reused. Alternative text is copied and stays in English until you translate it.'))
+			const T = 'Add a translation'
+			if (x === 'dup') return Dlg({ title: T }, [Alert('error', 'circle-x', 'French already exists for this article', 'Open it to continue. Your entries are kept here.', Btn('Open French version', 'secondary', { sm: true })), ...f], [Btn('Cancel'), Btn('Create French draft', 'primary', { dis: true })])
+			if (x === 'dupHidden') return Dlg({ title: T }, [Alert('error', 'circle-x', 'French can\'t be created for this article', 'Try a different language, or ask an owner. Your entries are kept.'), ...f], [Btn('Cancel'), Btn('Create French draft', 'primary', { dis: true })])
+			if (x === 'fail') return Dlg({ title: T }, [Alert('error', 'circle-x', 'Couldn\'t create the translation', 'Your entries are kept. Try again.'), ...f], [Btn('Cancel'), Btn('Try again', 'primary')])
+			if (x === 'gone') return Dlg({ title: T }, [Alert('warning', 'triangle-alert', 'The source isn\'t available to you', 'Choose another source you can read, or start empty. Your title is kept.'), ...f.slice(0, 1), f[1], f[2]], [Btn('Cancel'), Btn('Create French draft', 'primary', { dis: true })])
+			if (x === 'unreadable') return Dlg({ title: T }, [Alert('warning', 'triangle-alert', 'The source isn\'t available to you', 'Choose another source you can read, or start empty. Your title is kept.'), ...f.slice(0, 1), f[1], f[2]], [Btn('Cancel'), Btn('Create French draft', 'primary', { dis: true })])
+			if (x === 'langOff') return Dlg({ title: T }, [Alert('warning', 'triangle-alert', 'French was disabled', 'French was disabled on this site while you were filling this in. Ask an owner to re-enable it, or choose another language. Your entries are kept.'), ...f], [Btn('Cancel'), Btn('Create French draft', 'primary', { dis: true })])
+			if (x === 'saving') return Dlg({ title: T }, f, [Btn('Cancel', 'secondary', { dis: true }), Btn('Creating…', 'primary', { busy: true })])
+			return Dlg({ title: T, desc: 'Creates a French draft of "' + st.title + '". It isn\'t published.', top: long ? 24 : 60 }, f, [Btn('Cancel'), Btn('Create French draft', 'primary')])
+		}
+		// ---- publish / delete
+		const pdOv = () => ({
+			publish: () => Dlg({ title: 'Publish French?', desc: 'Only the French version goes online. English and German aren\'t affected.' }, [], [Btn('Cancel'), Btn('Publish French', 'primary')]),
+			publishDisabled: () => [],
+			unpublish: () => Dlg({ title: 'Unpublish French?', desc: 'The French version goes back to draft and stops being public. English stays online.' }, [], [Btn('Cancel'), Btn('Unpublish French', 'primary')]),
+			unpublishDirty: () => Dlg({ title: 'Unpublish French?', desc: 'The saved French version goes offline and becomes a draft. English stays online.' }, [Alert('neutral', 'info', 'Your edits stay in the editor', 'Your unsaved changes are kept here. Nothing is saved when you unpublish. Save them yourself when you are ready.')], [Btn('Cancel'), Btn('Unpublish French', 'primary')]),
+			delete: () => Dlg({ title: 'Delete the French version?', desc: '"' + FRT + '" will be deleted. Other versions stay.' }, [], [Btn('Cancel'), Btn('Delete French version', 'danger')]),
+			deleteSource: () => Dlg({ title: 'Delete the English version?', desc: 'English is the tracked source for versions you can read.' }, [Alert('warning', 'triangle-alert', 'Review tracking will pause', 'French, German and Arabic track English. They stay as they are and keep their review history. Each one asks you to choose a new source.')], [Btn('Cancel'), Btn('Delete English version', 'danger')]),
+			deleteStoryOk: () => Dlg({ title: 'Delete English, French, German and Arabic?', desc: 'The article and all of its translations will be deleted. This can\'t be undone.' }, [], [Btn('Cancel'), Btn('Delete article', 'danger')]),
+			deleteLast: () => Dlg({ title: 'Delete the only version?', desc: 'English is the only version of this article. Deleting it deletes the article.' }, [], [Btn('Cancel'), Btn('Delete article', 'danger')]),
+			saveAndPublish: () => Dlg({ title: 'Save and publish French?', desc: 'Your unsaved changes to the French version are saved first, then only the French version goes online. English and German aren\'t affected.' }, [], [Btn('Cancel'), Btn('Save and publish French', 'primary')]),
+			saveFailPublish: () => [Toast('error', 'circle-x', 'Couldn\'t save French', 'Nothing was published. Your changes are kept. Try again.')],
+			deleteStory: () => Dlg({ title: 'You can\'t delete this article', desc: 'Deleting an article needs delete permission on every version. You can still delete the version you are editing.' }, [], [Btn('Close'), Btn('Delete French version', 'danger')]),
+			fail: () => [Toast('error', 'circle-x', 'Couldn\'t publish French', 'Nothing changed. Try again.')],
+			done: () => [Toast('success', 'circle-check', 'French published', 'Other versions weren\'t changed.')],
+			deleteDone: () => [Toast('success', 'circle-check', 'French version deleted', '"' + FRT + '" was deleted. English and German weren\'t changed.')],
+			deleteStoryFail: () => Dlg({ title: 'Delete English, French, German and Arabic?', desc: 'The article and all of its translations will be deleted. This can\'t be undone.' }, [Alert('error', 'circle-x', 'Couldn\'t delete the article', 'Nothing was deleted. Every version is still there. Try again in a moment.')], [Btn('Cancel'), Btn('Try again', 'danger')])
+		}[x]?.())
+		// ---- freshness and review (release 2)
+		const frOv = () => ({
+			review: () => Dlg({ title: 'Mark French as reviewed?', desc: 'This records that the French version matches the English source. It doesn\'t change publication.' }, [Alert('neutral', 'info', 'Changed fields: Title, Body', 'Authors and the cover image don\'t count.'), D('display:grid;grid-template-columns:auto 1fr;gap:6px 16px;font-size:13px', S(MU, 'Source'), S(HL, 'English version saved 14 Oct 2026, 09:12'), S(MU, 'Translation'), S(HL, 'French version saved 15 Oct 2026, 16:40'))], [Btn('Cancel'), Btn('Mark as reviewed', 'primary')]),
+			changed: () => Dlg({ title: 'Review not recorded' }, [Alert('warning', 'triangle-alert', 'The English source changed while you were reviewing. Review again.', 'English was saved again at 14 Oct 2026, 11:20. Check the latest changes first. Nothing was marked.')], [Btn('Cancel'), Btn('Show source reference', 'secondary'), Btn('Review again', 'primary')]),
+			changedTr: () => Dlg({ title: 'Review not recorded' }, [Alert('warning', 'triangle-alert', 'French was changed by someone else while you were reviewing. Review again.', 'Someone saved the French version at 15 Oct 2026, 16:52. Nothing was marked.')], [Btn('Cancel'), Btn('Reload French', 'primary')]),
+			replace: () => Dlg({ title: 'Choose a tracked source', desc: 'Pick a version of this article you can read. French will show Needs review until you review it against the new source.' }, [Radio('English', 'Published', false), Radio('German', 'Published', true), Alert('error', 'circle-x', 'German can\'t be the source', 'German already tracks French as its source. A source can\'t track back to this version.')], [Btn('Cancel'), Btn('Use German as source', 'primary', { dis: true })]),
+			done: () => [Toast('success', 'circle-check', 'French marked as reviewed', 'Reviewed against the English version saved 14 Oct 2026.')],
+			fail: () => [Toast('error', 'circle-x', 'Couldn\'t mark as reviewed', 'Nothing was recorded. Try again.')]
+		}[x]?.())
+		// ---- conflicts, moves, permissions
+		const CfOpt = (t, d, b, k = 'secondary', top, ic) => D((top ? '' : 'border-top:1px solid var(--ui-border);padding-top:14px;') + 'display:flex;' + (m ? 'flex-direction:column;gap:8px' : 'align-items:center;gap:16px'), D('flex:1;min-width:0;display:flex;flex-direction:column;gap:2px', D('display:flex;align-items:center;gap:6px', ic && S('color:var(--ui-error)', Ic(ic)), S('font-weight:600;' + HL, t)), S(MU + ';font-size:13px;line-height:19px;text-wrap:pretty', d)), D((m ? '' : 'width:200px;flex-shrink:0;') + 'display:flex', Btn(b, k, { w: '100%', ic })))
+		const Cf = (o) => Dlg({ title: o.title || 'Someone else saved this version', desc: o.desc || 'Someone else saved this version at ' + (o.t || '14:32') + '. Your changes aren\'t saved. They stay here until you choose.', w: 560, top: 60 }, [o.alert, CfOpt('Keep my changes', 'Nothing is sent. Your changes stay in the editor.', 'Keep my changes', 'primary', 1), ...(o.rc ? [CfOpt('Reload theirs', 'This discards your unsaved changes.', 'Reload and discard my changes')] : [CfOpt('Download my version', 'Saves your title and body as a text file. Nothing is sent.', 'Download my version'), CfOpt('Reload theirs', 'Shows their version. You confirm first.', 'Reload theirs'), CfOpt('Save over theirs', 'Replaces the title, body and search fields of this version only. Other languages are untouched.', 'Save over theirs', 'dangerOutline', 0, 'triangle-alert')])], [])
+		const VList = [['English', 'Published'], ['French', 'Draft'], ['German', 'Published'], ['Arabic', 'Draft · Read only']]
+		const moveNote = (hidden) => D('display:flex;flex-direction:column;gap:6px', S('font-weight:500;' + HL, 'Moves all language versions of this article.'), ...VList.filter(r => !(hidden && r[0] === 'Arabic')).map(r => S(TO, r[0] + ' · ' + r[1])), hidden && S(MU + ';font-size:12px', 'Versions you can\'t read aren\'t listed or counted.'))
+		const mvPanel = (hidden) => D('position:absolute;z-index:40;' + (m ? 'left:0;right:0;bottom:0;border-top:1px solid var(--ui-border)' : 'right:24px;top:215px;width:340px;border:1px solid var(--ui-border)') + ';background:var(--ui-bg);box-shadow:var(--rc-shadow-pop);padding:16px;display:flex;flex-direction:column;gap:12px', S('font-weight:600;' + HL, 'Site'), D('display:flex;flex-direction:column;gap:0;border:1px solid var(--ui-border)', ...['Journal', 'Atelier', 'Archive', 'Notes'].map(k => D('display:flex;align-items:center;gap:8px;min-height:' + (m ? 48 : 36) + 'px;padding:6px 12px;' + (k === 'Journal' ? 'background:var(--rc-sand);color:var(--rc-on-sand);font-weight:600' : HL), S('width:16px', k === 'Journal' && Ic('check')), k))), moveNote(hidden), D('display:flex;gap:8px', Btn('Cancel'), D('flex:1;display:flex', Btn('Move article…', 'primary', { w: '100%' }))))
+		const mvDlg = (kind) => {
+			const base = { desc: 'This moves every version together. Nothing is split.' }
+			return {
+				moveConfirm: () => Dlg({ title: 'Move to Atelier?', ...base }, [moveNote(false), Alert('neutral', 'info', 'Addresses and links', 'Each version keeps its address. Links from the old site to it will stop working. RenewCMS does not create redirects.')], [Btn('Cancel'), Btn('Move article', 'primary')]),
+				moveBusy: () => Dlg({ title: 'Moving to Atelier…', desc: 'All 4 versions move together. Keep this page open.' }, [Alert('info', 'loader-circle', 'Moving', 'This takes a few seconds.')], [Btn('Cancel', 'secondary', { dis: true }), Btn('Moving…', 'primary', { busy: true })]),
+				move: () => Dlg({ title: 'Move to Notes?', ...base }, [Alert('warning', 'triangle-alert', 'Notes doesn\'t enable every language in this article', 'Notes enables English only. Enable French, German and Arabic on Notes first. Languages disabled on Journal count too. Nothing was moved.')], [Btn('Cancel'), Btn('Move article', 'primary', { dis: true })]),
+				moveSlug: () => Dlg({ title: 'Move to Atelier?', ...base }, [Alert('error', 'circle-x', 'An address is already used on Atelier', 'An address must be unique within its language on Atelier. Change the address below, then move again. Nothing was moved.'), D('display:flex;flex-direction:column;gap:6px', S('font-weight:500;' + HL, 'Conflicting version'), D('display:flex;align-items:center;gap:10px;flex-wrap:wrap;padding:10px 12px;border:1px solid var(--ui-border)', S('font-weight:500;' + HL, 'French'), S(mono + ';' + TO + ';flex:1 1 160px;min-width:0;overflow-wrap:anywhere', 'comment-nous-chiffrons-une-renovation'), Btn('Edit slug', 'secondary', { sm: true })), S(MU + ';font-size:12px;line-height:18px', 'Only versions you can read are named.'))], [Btn('Cancel'), Btn('Move article', 'primary', { dis: true })]),
+				moveFail: () => Dlg({ title: 'Move to Atelier?', ...base }, [Alert('error', 'circle-x', 'Couldn\'t move the article', 'Nothing was moved. All 4 versions are still on Journal. Try again.')], [Btn('Cancel'), Btn('Try again', 'primary')]),
+				movePerm: () => Dlg({ title: 'You can\'t move this article' }, [Alert('error', 'circle-x', 'Moving needs edit permission on every version', 'Ask an owner to move it. Nothing was changed.')], [Btn('Close')]),
+				moveDone: () => [Toast('success', 'circle-check', 'Moved to Atelier', 'All 4 versions moved together.')]
+			}[kind]
+		}
+		const pmOv = () => {
+			const mv = mvDlg(x)
+			if (mv) return mv()
+			if (x === 'moveSelect' || x === 'moveSelectHidden') return [mvPanel(x === 'moveSelectHidden')]
+			const dl = { session: () => Dlg({ title: 'Your session expired', desc: 'Log in to continue. Your title, body and search fields for this French version are kept in this browser and restored after you log in, with a notice.' }, [], [Btn('Log in', 'primary')]),
+				conflict: () => Cf({}),
+				conflictRestored: () => Cf({ alert: Alert('info', 'info', 'Restored unsaved changes from 14:18', 'Your session ended. These changes were kept in this browser.') }),
+				reloadConfirm: () => Cf({ title: 'Reload theirs?', desc: 'This discards your unsaved changes.', rc: 1 }),
+				conflict2: () => Cf({ t: '14:41', alert: Alert('error', 'circle-x', 'Their version changed again', 'Someone else saved this version again at 14:41, before your save went through. Nothing was overwritten. Your changes are still here.') }),
+				download: () => [Cf({}), Toast('success', 'circle-check', 'Download started', 'Your French title and body are saved as a text file. Your changes are still in the editor.')],
+				restored: () => [] }
+			return dl[x]?.()
+		}
+		// ---- existing surfaces
+		const sfPage = () => {
+			const mk2 = (t, d, ...c) => Card(S('font-weight:600;' + HL, t), d && S(TO, d), ...c)
+			const RowS = (a, b, c) => D(ROW + ';padding-left:0;padding-right:0', D('flex:1;min-width:0;display:flex;flex-direction:column;gap:2px', S(HL + ';font-weight:500', a), b && S(MU + ';font-size:12px', b)), c)
+			if (x === 'home' || x === 'homeFr') { const fr = x === 'homeFr', V = FX.view({ site: J, read: fr ? ['fr'] : null }); return Page('Home', fr ? 'You can read French versions only.' : 'Welcome back, Marta.', null, mk2('Recently updated', null, ...V.rows.slice(0, 5).map(r => RowS(FX.tt(r.s, r.rep), r.s.by + ' · ' + r.s.upd, r.rep !== J.def ? S(mono + ';border:1px solid var(--ui-border-accented);padding:0 6px;' + HL, r.rep.toUpperCase()) : null))), S(MU + ';font-size:12px', 'Each article appears once, with its default-language title. A language code shows only when the title isn\'t in the default language.')) }
+			if (x === 'activity') return Page('Activity', 'Recent changes in Journal and Archive.', null, mk2('Today and this week', null, ...[['Marta Alves', 'Added French to Journal', 'Just now'], ['Marta Alves', 'Made French the default language of Journal', '20 min ago'], ['Marta Alves', 'Changed the public URL pattern of Journal', '1 h ago'], ['Camille Roche', 'Published French version of "Guide de l\'enduit à la chaux"', '2 h ago'], ['Luis Ferrer', 'Published French version of "Liste d\'hiver pour les fenêtres en bois"', 'Yesterday'], ['Marta Alves', 'Published German version of "So kalkulieren wir eine Badsanierung"', '3 days ago'], ['Luis Ferrer', 'Created German version of "Checkliste für die Dachprüfung"', '14 Oct'], ['Camille Roche', 'Published "Guia de cal e areia"', '14 Oct']].map(r => RowS(r[1], r[0] + ' · ' + r[2]))), S(MU + ';font-size:12px', 'Site settings events name the site and the language. The last event is on Archive, which uses one language, so it names none.'))
+			if (x === 'media' || x === 'mediaElsewhere') return Page('Media', 'Images and files for every site.', Btn('Upload', 'primary', { ic: 'upload' }), D('display:grid;grid-template-columns:repeat(auto-fill,minmax(' + (m ? 140 : 180) + 'px,1fr));gap:12px', ...['bathroom-plan.jpg', 'window-frame.jpg', 'lime-plaster.jpg', 'roof-detail.jpg', 'floorboards.jpg', 'tile-samples.jpg'].map((n, i) => D('display:flex;flex-direction:column;gap:6px;padding:8px;background:var(--ui-bg);border:1px solid ' + (i === (x === 'mediaElsewhere' ? 1 : 0) ? 'var(--ui-primary)' : 'var(--ui-border)') + ';' + (i === (x === 'mediaElsewhere' ? 1 : 0) ? 'background:var(--rc-sand);color:var(--rc-on-sand)' : ''), D('height:' + (m ? 80 : 110) + 'px;border:1px dashed var(--ui-border-accented);display:flex;align-items:center;justify-content:center;font:12px \'IBM Plex Mono\',monospace;' + (i === (x === 'mediaElsewhere' ? 1 : 0) ? '' : MU), 'image'), S('font-weight:500;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;' + (i === (x === 'mediaElsewhere' ? 1 : 0) ? '' : HL), n)))))
+			return null
+		}
+		const PanelShell = (title, sub, body, o = {}) => D('position:absolute;inset:0;z-index:50;background:var(--rc-overlay);display:flex;justify-content:' + (m ? 'center' : 'flex-end') + ';align-items:' + (m ? 'flex-end' : 'stretch'),
+			A('div', { role: 'dialog', 'aria-modal': 'true', 'aria-label': title }, 'width:' + (m ? '100%' : 'min(' + (o.w || 960) + 'px,100%)') + ';' + (m ? 'height:92%;border-top:1px solid var(--ui-border)' : 'height:100%;border-left:1px solid var(--ui-border)') + ';background:var(--ui-bg);box-shadow:var(--rc-shadow-modal);display:flex;flex-direction:column',
+				m && D('display:flex;justify-content:center;padding:8px 0 0;flex-shrink:0', S('width:36px;height:4px;background:var(--ui-border-accented)')),
+				D('padding:' + (m ? '12px 16px' : '16px 24px') + ';border-bottom:1px solid var(--ui-border);display:flex;gap:12px;align-items:flex-start;flex-shrink:0', D('flex:1;min-width:0;display:flex;flex-direction:column;gap:2px', S('font:600 16px/24px \'IBM Plex Sans\',sans-serif;' + HL, title), sub && S(TO + ';text-wrap:pretty', sub)), Btn('', 'ghost', { ic: 'x', sm: true, al: 'Close' })),
+				D('flex:1;min-height:0;overflow-y:auto;padding:' + (m ? '16px' : '16px 24px') + ';display:flex;flex-direction:column;gap:16px', ...body)))
+		const seoPanel = () => {
+			const unset = x === 'unset', slugD = x === 'editSlug'
+			const rows = [['Page title', FRT + ' | Journal', 'Fallback: French title', 1], ['Description', 'Empty', 'No fallback. Empty. English site default not used. The tag is left out.', 0], ['Image alternative text', 'Un plan de salle de bain avec les mesures', 'Written per language.', 1]]
+			let body
+			if (x === 'preview') body = [Card(S('font-weight:600;' + HL, 'How it can appear in search'), D('display:flex;flex-direction:column;gap:2px;padding:12px;background:var(--ui-bg-elevated)', S(mono + ';' + MU + ';overflow-wrap:anywhere', 'journal.example.com › fr › comment-nous-chiffrons-une-renovation'), S('font:600 16px/24px \'IBM Plex Sans\',sans-serif;' + HL, FRT + ' | Journal'), S(TO, 'La plupart des devis échouent parce qu\'ils cachent les trois mêmes coûts.')), S(MU + ';font-size:12px', 'Shows the localized address and canonical. Description: Fallback: French excerpt.'))]
+			else if (x === 'siteFallback') body = [S(TO, 'Site-level text is used as a fallback only in its own language.'), ...[['French version', 'Description', 'Fallback: French site description', 'Used: "Rénovation et conseils pour la maison" (site text in French)', 1], ['Arabic version', 'Description', 'No fallback', 'Empty. English site default not used.', 0]].map(r => Card(S('font-weight:600;' + HL, r[0]), Fd(r[1], 'Empty', { val: false, help: r[2] + '. ' + r[3] }), r[4] ? Bd('Uses French site text', 'info', 'languages') : Bd('Tag left out', 'neutral', 'minus')))]
+			else body = [unset ? Alert('info', 'info', 'Public URL not configured', 'Add a public URL pattern for Journal to show page and canonical addresses. API links by article ID still work.', Btn('Open Public URL settings', 'secondary', { sm: true })) : Card(D('display:flex;gap:8px;align-items:center;flex-wrap:wrap', Bd('Canonical', 'neutral', 'link'), S(mono + ';' + HL + ';overflow-wrap:anywhere', 'https://journal.example.com/fr/comment-nous-chiffrons-une-renovation')), S(MU + ';font-size:12px', 'Built from the Public URL pattern https://journal.example.com/{lang}/{slug}. Each language points to itself unless you set a canonical override.')),
+				!unset && Card(S('font-weight:600;' + HL, 'Alternate languages'), S(TO, 'Published versions in enabled languages only.'), D('display:flex;gap:10px;align-items:center', S(mono, 'EN'), S('flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;' + TO, 'https://journal.example.com/en/how-we-price-a-bathroom-renovation'), Bd('Published', 'success', 'circle-check')), D('display:flex;gap:10px;align-items:center', S(mono, 'DE'), S('flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;' + TO, 'https://journal.example.com/de/so-kalkulieren-wir-eine-badsanierung'), Bd('Published', 'success', 'circle-check')), S(MU + ';font-size:12px', 'Drafts and the disabled Spanish language are left out.')),
+				Card(S('font-weight:600;' + HL, 'Social locale'), D('display:flex;gap:8px;align-items:center;flex-wrap:wrap', Bd('og:locale', 'neutral', 'share-2'), x === 'noSocial' ? S(MU, 'Social locale not set') : S(mono + ';' + HL, 'Set: fr_FR')), S(MU + ';font-size:12px;line-height:18px;text-wrap:pretty', x === 'noSocial' ? 'French has no region in its code and no social locale is set for it, so og:locale and og:locale:alternate are left out. An owner can set one in Journal languages.' : 'Set by an owner for French in Journal languages. A region is never guessed from the language.')),
+				Card(Fd('Address (slug)', 'comment-nous-chiffrons-une-renovation', { mono: true, ro: true, lock: true, help: 'Unique within Journal and French. Editing the title never changes the address.' }), D('display:flex;flex-direction:column;gap:6px;align-items:flex-start', Btn('Edit slug', 'secondary', { ic: 'pencil' }), S(MU + ';font-size:12px;line-height:18px', 'Editing the title never changes the slug. Only Edit slug does.'), S(HL + ';font-size:12px;line-height:18px', 'Links to the old address will stop working. RenewCMS does not create redirects.'))),
+				...rows.map(r => Fd(r[0], r[1], { help: r[2], val: r[3] === 1 }))].filter(Boolean)
+			const p = PanelShell('Search and sharing · French', 'Applies only to the French version. Page language: fr.', body)
+			return slugD ? [p, Dlg({ z: 60, title: 'Edit slug for the French version', desc: 'The address changes for French only.' }, [Fd('Address (slug)', 'comment-nous-calculons-une-renovation', { mono: true, focus: true }), Alert('warning', 'triangle-alert', 'This version is published', 'Links to the old address will stop working. RenewCMS does not create redirects.'), S(MU + ';font-size:12px', 'Editing the title never changes the slug.')], [Btn('Cancel'), Btn('Change address', 'primary')])] : [p]
+		}
+		const mediaPanel = () => {
+			const el = x === 'mediaElsewhere'
+			const UR = (t, b2, link) => D('border-top:1px solid var(--ui-border);padding:10px 0;display:flex;align-items:center;gap:8px;min-height:' + (m ? 48 : 40) + 'px', D('flex:1;min-width:0;display:flex;flex-direction:column;gap:2px', S('font-weight:500;text-decoration:underline;text-underline-offset:3px;' + HL, t), b2 && S(MU + ';font-size:12px', b2)), link && S(mono + ';' + MU, link), Ic('arrow-up-right', 14))
+			const SH = t => S('font:600 14px/22px \'IBM Plex Sans\',sans-serif;' + HL, t)
+			const body = [D('height:160px;flex-shrink:0;border:1px dashed var(--ui-border-accented);display:flex;align-items:center;justify-content:center;' + MU + ';font:12px \'IBM Plex Mono\',monospace', 'image preview'), D('display:flex', Bd(el ? 'Used in 1' : 'Used in 2', 'neutral'))]
+			if (el) body.push(D('display:flex;flex-direction:column;gap:6px', SH('Articles'), S(MU, 'No article shows it.')), D('display:flex;flex-direction:column;gap:6px', SH('Used elsewhere'), D('border-bottom:1px solid var(--ui-border)', UR('Author avatar', null, '/authors'))))
+			else body.push(S('font-weight:500;' + HL, 'Used in 2 articles · 4 versions · 1 file'), S(MU + ';font-size:12px', 'A shared image is one file. It is counted once per article, and the versions that use it are listed.'), D('display:flex;flex-direction:column', UR('How we price a bathroom renovation', 'English, French, German'), UR('A guide to lime plaster', 'English')))
+			return PanelShell(el ? 'window-frame.jpg' : 'bathroom-plan.jpg', 'Image details', body, { w: 420 })
+		}
+		const apiPage = () => Page('Integration · Languages', 'Proposed. Not available in the current API.', null, Alert('warning', 'triangle-alert', 'Proposed capability', 'These requests don\'t exist yet. Existing article-ID requests are unchanged.'),
+			Card(S('font-weight:600;' + HL, '1. Exact lookup: site + language + slug'), S(mono + ';' + HL + ';overflow-wrap:anywhere', 'GET /v1/public/site/{key}/lang/{lang}/article/{slug}'), S(TO, 'Matches the published version with that slug in that language, or returns article_not_found. It never falls back, because a slug belongs to one language.'), S(mono + ';' + MU + ';overflow-wrap:anywhere', '{ "story_id": "st_01", "lang": "fr", "slug": "…", "alternates": [{ "lang": "en", "slug": "…" }] }')),
+			Card(S('font-weight:600;' + HL, '2. Resolve by article group, with fallback'), S(mono + ';' + HL + ';overflow-wrap:anywhere', 'GET /v1/public/site/{key}/story/{story_id}?lang=fr&fallback=default'), S(TO, 'Use story_id from any response or from alternates[]. French published: lang "fr". French missing or unpublished with fallback=default: the published default, with "lang": "en", "requested_lang": "fr", "fallback": true. Without fallback=default, a missing French is language_not_available. No other language is tried, and drafts are never returned.')),
+			Card(S('font-weight:600;' + HL, '3. Errors'), S(mono + ';' + HL, 'article_not_found · language_not_available · language_disabled'), S(TO, 'article_not_found: no published version has that slug in that language. language_not_available: the requested language and the allowed fallback are both unavailable. language_disabled: publishing in a disabled language.')),
+			Card(S('font-weight:600;' + HL, 'Existing, unchanged'), S(mono + ';' + HL, 'GET /v1/article/{id}'), S(mono + ';' + HL, 'PATCH /v1/article/{id}/publish'), S(mono + ';' + HL, 'Editor: /article/{id}/edit'), S(TO, 'Each article ID is one language version. Article-ID links keep working.')))
+		// ---- compose
+				if (v === 'sl') { Object.assign(shell, setS, x === 'single' ? { crumbs: ['Settings', 'Sites', 'Archive', 'Languages'], mTitle: 'Archive · Languages' } : x === 'social' || x === 'socialEdit' || x === 'socialInvalid' ? { crumbs: ['Settings', 'Sites', 'Atelier', 'Languages'], mTitle: 'Atelier · Languages' } : {}); main = D('flex:1;min-height:0;display:flex;flex-direction:column;position:relative', slPage()); ov = [].concat(slOv() || []) }
+		else if (v === 'pu') { Object.assign(shell, setS, { crumbs: ['Settings', 'Sites', 'Journal', 'Public URL'], mTitle: 'Journal · Public URL' }); main = D('flex:1;min-height:0;display:flex;flex-direction:column;position:relative', puPage()); if (x === 'saved') ov = [Toast('success', 'circle-check', 'Public URL saved', 'Journal pages now use this pattern.')] }
+		else if (v === 'su') { Object.assign(shell, setS, { crumbs: ['Settings', 'Sites', 'Journal', 'Languages', 'Setup'], mTitle: 'Set article languages' }); main = D('flex:1;min-height:0;display:flex;flex-direction:column', suBody()) }
+		else if (v === 'li') { Object.assign(shell, liS); main = D('flex:1;min-height:0;display:flex;flex-direction:column;position:relative', liPage()); ov = listOv() }
+		else if (v === 'na') { Object.assign(shell, liS); main = D('flex:1;min-height:0;display:flex;flex-direction:column;position:relative', liPage()); ov = [naOv()] }
+		else if (v === 'sf') { Object.assign(shell, { nav: x === 'home' || x === 'homeFr' ? 'home' : x === 'activity' ? 'activity' : x === 'media' || x === 'mediaElsewhere' ? 'media' : 'articles', crumbs: [x === 'home' || x === 'homeFr' ? 'Home' : x === 'activity' ? 'Activity' : x === 'media' || x === 'mediaElsewhere' ? 'Media' : 'Articles'], mTitle: 'Journal' }); main = D('flex:1;min-height:0;display:flex;flex-direction:column;position:relative', sfPage()); if (x === 'media' || x === 'mediaElsewhere') ov = [mediaPanel()] }
+		else if (v === 'api') {
+			Object.assign(shell, { nav: 'integration', crumbs: ['Integration'], mTitle: 'Integration', mLead: 'menu' })
+			main = D('flex:1;min-height:0;display:flex;flex-direction:column;position:relative', apiPage())
+		} else {
+			Object.assign(shell, edS)
+			const rtl = x === 'rtl', en = x === 'navFail' || (v === 'pd' && x === 'deleteDone') || (v === 'ed' && ['cleanOnline', 'onlineDirty', 'unpublishDirty'].includes(x))
+			let L = rtl ? AR : FR
+			const o = { cap: CAPS.full, pub: 'draft' }
+			const bn = []
+			let ovl = []
+			const pop = (rows, q = {}) => ovl.push(LangPop(rows, { left: 248, top: 176, ...q }))
+			const lifeOnline = 'This version is online. Saving updates the live page right away.'
+			if (v === 'ed') {
+				if (x === 'menu') { o.open = 1; pop(MENUS.all) } else if (x === 'two') { o.open = 1; pop(MENUS.two) } else if (x === 'many') { o.open = 1; pop(MENUS.many, { find: 1, max: 520 }) } else if (x === 'menuDisabled') { o.open = 1; pop(MENUS.dis, { note: 'Spanish is disabled on this site. Its version stays readable and editable. It can\'t be published until an owner re-enables Spanish.' }) }
+				else if (x === 'dirty') { o.dirty = 1; o.cap = CAPS.p2 }
+				else if (x === 'dirtyPublish') o.dirty = 1
+				else if (x === 'cleanOnline') { o.pub = 'pub'; bn.push(Alert('neutral', 'info', lifeOnline)) }
+				else if (x === 'onlineDirty') { o.dirty = 1; o.pub = 'pub'; bn.push(Alert('neutral', 'info', lifeOnline)) }
+				else if (x === 'saveFail') { o.dirty = 1; o.saveFail = 1; bn.push(Alert('error', 'circle-x', 'Couldn\'t save French', 'Your changes are kept here. Nothing was published. Try saving again.')) }
+				else if (x === 'pubFail') { o.pubFail = 1; bn.push(Alert('error', 'circle-x', 'Saved as a draft. Publishing failed. Try publishing again.', 'Your edits are saved. Only the publishing step failed.', Btn('Retry publish', 'secondary', { sm: true }))) }
+				else if (x === 'unsaved') { o.dirty = 1; ovl.push(Dlg({ title: 'Leave without saving?', desc: 'Your changes to the French version aren\'t saved.' }, [], [Btn('Keep editing'), Btn('Discard and open English', 'danger'), Btn('Save and open English', 'primary')])) }
+				else if (x === 'saving') { o.dirty = 1; o.saving = 1 }
+				else if (x === 'saved') { o.saved = 1; ovl.push(Toast('success', 'circle-check', 'French saved', 'English wasn\'t changed.')) }
+				else if (x === 'ovf') { o.dirty = 1; ovl.push(OvMenu(OvItems(L, { ...o }))) }
+				else if (['focus', 'titleEdit', 'titleUnsaved', 'invalid', 'titleShort', 'titleLong', 'titleSaving', 'failed'].includes(x)) { o.tst = { titleEdit: 'edit', titleUnsaved: 'unsaved', titleShort: 'short', titleLong: 'long', titleSaving: 'saving' }[x] || x; o.dirty = !['focus', 'saving', 'failed'].includes(o.tst) || o.tst === 'failed'; if (o.tst === 'failed') o.saveFail = 1; if (['invalid', 'short', 'long'].includes(o.tst)) o.saveBlock = 1; if (o.tst === 'saving') { o.saving = 1; o.dirty = 1 } }
+				else if (x === 'loading') o.loading = 1
+				else if (x === 'gone') { main = Page('This version isn\'t available', 'It may have been deleted, or you may not have access.', null, Btn('Back to Articles', 'secondary')) }
+				else if (x === 'navFail') ovl.push(Toast('error', 'circle-x', 'Couldn\'t open the French version', 'You\'re still editing English. Try again.'))
+			}
+			else if (v === 'pm') {
+				if (x === 'restored') { o.dirty = 1; bn.push(Alert('info', 'info', 'Restored unsaved changes from 14:18', 'You logged in again. Your French title and body were kept in this browser.')) }
+				else if (x === 'session' || x === 'conflict' || x === 'conflict2' || x === 'download' || x === 'conflictRestored' || x === 'reloadConfirm') o.dirty = 1
+				else if (x.startsWith('move') && x !== 'moveSelect' && x !== 'moveSelectHidden') { o.cap = { ...CAPS.full } }
+			}
+			else if (v === 'src') {
+				o.src = x !== 'closed' && x !== 'mobileClosed'; o.narrow = x === 'narrow'; o.long = x === 'long'; o.srcMob = x === 'mobileSrc' || (x === 'unavail' && m); o.gone = x === 'unavail'
+				if (x === 'rtl') { o.S0 = EN }
+				if (x === 'arRef') o.S0 = AR
+				if (x === 'reopen') ovl.push(Toast('info', 'info', 'Reference: English', 'Restored. Your place in both panes is kept.'))
+				if (x === 'changeRef') ovl.push(D('position:absolute;z-index:40;' + (m ? 'left:0;right:0;bottom:0' : 'left:260px;top:220px;width:340px') + ';background:var(--ui-bg);border:1px solid var(--ui-border);box-shadow:var(--rc-shadow-pop);display:flex;flex-direction:column', A('div', { role: 'menu', 'aria-label': 'Reference version' }, 'display:flex;flex-direction:column', LRow({ n: 'English', c: 'EN', st: 'pub', cur: 1 }), LRow({ n: 'German', c: 'DE', st: 'pub' })), D('padding:10px 12px;border-top:1px solid var(--ui-border);' + MU + ';font-size:12px;line-height:18px', 'This only changes what you compare against. The tracked source for review stays English. Use Change tracked source in the review banner to change that.')))
+			} else if (v === 'fr') {
+				o.fresh = 'Needs review'
+				const buttons = [Btn('Show source reference', 'secondary', { sm: true }), Btn('Mark as reviewed', 'primary', { sm: true }), Btn('Change tracked source', 'ghost', { sm: true })]
+				if (x === 'gone') { o.fresh = 'No source'; bn.push(Alert('neutral', 'info', 'Source deleted', 'The tracked English version was deleted. Review history is kept. Choose a new source to track changes again.', Btn('Choose a new source', 'secondary', { sm: true }))) }
+				else if (x === 'inaccessible') { o.fresh = 'Source unavailable'; bn.push(Alert('warning', 'lock', 'The source isn\'t available to you right now', 'It may be restricted. Review history is kept. Mark as reviewed is off until you can read it again.', Btn('Choose a new source', 'ghost', { sm: true }))) }
+				else { if (x === 'pub') o.pub = 'pub'; bn.push(D('display:flex;flex-direction:column;gap:8px', D('display:flex;gap:8px;align-items:center', Tracked('English')), Alert('warning', 'triangle-alert', 'English changed after French was reviewed', 'Changed fields: Title, Body. English was saved 14 Oct 2026, 09:12. French was last reviewed 12 Oct 2026.' + (x === 'pub' ? ' French is still published. Reviewing doesn\'t change publication.' : ''), buttons))) }
+				ovl = ovl.concat(frOv() || [])
+			} else if (v === 'pd') { o.pub = ['unpublish', 'unpublishDirty', 'done', 'deleteSource', 'deleteLast', 'deleteStoryOk', 'deleteStoryFail', 'deleteDone', 'deleteStory'].includes(x) ? 'pub' : 'draft'; if (['saveAndPublish', 'saveFailPublish', 'unpublishDirty'].includes(x)) o.dirty = 1; if (x === 'saveFailPublish') { o.saveFail = 1; bn.push(Alert('error', 'circle-x', 'Couldn\'t save French', 'Your changes are kept here. Nothing was published. Try saving again.')) } if (x === 'done') { o.saved = 1; bn.push(Alert('neutral', 'info', lifeOnline)) } if (x === 'publishDisabled') { o.pubDis = 1; bn.push(Alert('warning', 'triangle-alert', 'French is disabled on this site. Re-enable it to publish.', 'You can still edit and save this version. Ask an owner to re-enable French.')) } ovl = ovl.concat(pdOv() || []) }
+			else if (v === 'at') { o.pub = 'pub'; L = LS(x === 'dup' || x === 'dupHidden' ? S1 : S5); ovl = ovl.concat(atOv()) }
+			else if (v === 'seo') ovl = ovl.concat(seoPanel())
+			if (v === 'pm') ovl = ovl.concat(pmOv() || [])
+			if (v === 'perm') {
+				const cp = { ro: CAPS.ro, roMenu: CAPS.ro, p2: CAPS.p2, p3: CAPS.p3, p4: CAPS.full, p5: CAPS.full, p6: CAPS.p6, noAdd: CAPS.full, withAdd: CAPS.full }[x] || CAPS.full
+				o.cap = cp
+				if (x === 'noAdd' || x === 'withAdd') L = LV('fr', 'French', 'FR', FX.STORIES[1])
+				if (x === 'ro' || x === 'roMenu') bn.push(Alert('neutral', 'lock', 'You can read this version. You can\'t edit it.', 'The source reference and the versions you can read stay available.'))
+				if (x === 'p2') bn.push(Alert('neutral', 'info', 'Publishing needs the publish permission', 'Saving keeps it as a draft.'))
+				if (x === 'p3') bn.push(Alert('neutral', 'lock', 'You can publish this version but not edit it', 'Fields are read-only. Publish stays available.'))
+				if (x === 'roMenu') { o.open = 1; pop(MENUS.ro) }
+				if (x === 'p4') { o.open = 1; pop(MENUS.p4) }
+				if (x === 'p5') { o.open = 1; pop(MENUS.p5) }
+				if (x === 'noAdd') { o.open = 1; pop(MENUS.noAdd) }
+				if (x === 'withAdd') { o.open = 1; pop(MENUS.withAdd) }
+				if (x === 'p6') ovl.push(OvMenu(OvItems(L, o)))
+			}
+			ov = ovl
+			if (!main) {
+				const cap = o.cap, S0 = o.S0 || EN
+				if (en) { L = EN }
+				if (m && o.src) bn.push(Seg(!!o.srcMob, L, S0))
+				if (o.src && (!m || o.srcMob)) srcPane = D((m ? 'flex:1 0 100%;padding:16px' : 'width:' + (o.narrow || nr ? '42%' : '50%') + ';padding:24px') + ';flex-shrink:0;min-width:0;border-right:1px solid var(--ui-border);overflow:hidden;display:flex;flex-direction:column;background:var(--ui-bg-muted)', Src(S0, o))
+				if (bn.length) edBanner = D('flex-shrink:0;display:flex;flex-direction:column;gap:8px;padding:12px ' + (m ? 16 : 24) + 'px;border-bottom:1px solid var(--ui-border)', ...bn)
+				const ps = o.long ? L.p.concat(L.p, L.p) : L.p
+				edBodyEl = A('div', { dir: L.dir, lang: L.lang, 'aria-readonly': !cap.e || undefined }, !cap.e ? 'color:var(--ui-text-toned)' : '', ...ps.map(q => A('p', { dir: L.dir }, 'margin:0 0 20px;font-size:' + (m ? 17 : 18) + 'px;line-height:1.66', q)))
+				const sv = o.saving ? 'saving' : o.saveFail ? 'error' : o.dirty ? 'dirty' : 'clean'
+				edHeader = Hdr(L, o); edMobBar = MBar(L, o)
+				Object.assign(shell, { kind: 'editor', crumbs: ['Articles', L.t], mTitle: 'Edit article', mLead: 'arrow-left', ...(nr ? { w: 1024, h: 768 } : {}), ed: { readonly: !cap.e, status: o.pub === 'pub' ? 'online' : 'draft', save: sv, title: L.t, loading: !!o.loading, len: 3200, seoSummary: v === 'ed' ? '1 suggestion' : 'Ready', lang: { name: L.n, code: L.c, open: !!o.open, ro: !cap.e, fresh: o.fresh || '' } } })
+			}
+		}
+		if (nr && shell.kind !== 'editor') Object.assign(shell, { w: 1024, h: 768 })
+		return { srcPane, edBanner, edBodyEl, edHeader, edMobBar, shell, mob: m, main, ov: ov.length ? D('position:absolute;inset:0;pointer-events:none', ...ov.map(e => D('pointer-events:none', e))) : null }
+	}
+}
+</script>
+</body>
+</html>

docs/design/source/MediaFrame.dc.html

@@ -30,8 +30,8 @@ class Component extends DCLogic {
 		const mark = h('svg', { width: 28, height: 28, viewBox: '0 0 16 16', shapeRendering: 'crispEdges' }, h('rect', { width: 16, height: 16, fill: '#111' }), h('path', { fill: '#fff', fillRule: 'evenodd', d: 'M4 3h6v1h1v1h1v3h-1v1h-1v1h1v1h1v2h-2v-2h-1v-1H6v3H4zm2 2v3h4V5z' }))
 		const Th = (im, t = '', z = 24) => D('position:relative;overflow:hidden;display:flex;align-items:center;justify-content:center;color:var(--ui-text-muted);background:' + (im.alpha ? CHECK : 'repeating-linear-gradient(135deg, var(--ui-border) 0 1px, transparent 1px 12px), ' + TONES[im.tone % 4]) + ';' + t, im.svg ? mark : I('image', z, 'opacity:0.55'))
 		const BADGE = { unused: ['background:var(--rc-warning-soft);color:var(--ui-warning)', 'unlink'], dup: ['background:var(--rc-info-soft);color:var(--ui-info)', 'copy'], used: ['border:1px solid var(--ui-border-accented);background:var(--ui-bg);color:var(--ui-text-toned)'], on: ['background:var(--ui-bg-inverted);color:var(--ui-text-inverted)', 'globe'], draft: ['border:1px solid var(--ui-border-accented);background:var(--ui-bg);color:var(--ui-text-toned)', 'pencil-line'], vars: ['background:var(--rc-info-soft);color:var(--ui-info)', 'layers'] }
-		const varsBadge = im => im.vc > 0 && Bd(im.vc + (im.vc === 1 ? ' variant' : ' variants'), 'vars')
+		const varsBadge = (im, on) => im.vc > 0 && Bd(im.vc + (im.vc === 1 ? ' variant' : ' variants'), 'vars', 20, on)
-		const Bd = (t, k, sz = 20) => S('height:' + sz + 'px;padding:0 6px;display:inline-flex;align-items:center;gap:4px;font-size:12px;font-weight:500;white-space:nowrap;' + BADGE[k][0], BADGE[k][1] && I(BADGE[k][1], 12), t)
+		const Bd = (t, k, sz = 20, on) => S('height:' + sz + 'px;padding:0 6px;display:inline-flex;align-items:center;gap:4px;font-size:12px;font-weight:500;white-space:nowrap;' + BADGE[k][0] + (on && k !== 'used' && k !== 'draft' ? ';background:var(--ui-bg);border:1px solid currentColor' : ''), BADGE[k][1] && I(BADGE[k][1], 12), t)
 		const Cb = (on, z = 20, ind) => S('width:' + z + 'px;height:' + z + 'px;flex-shrink:0;display:flex;align-items:center;justify-content:center;border:1px solid ' + (on || ind ? 'var(--ui-primary)' : 'var(--ui-border-accented)') + ';background:' + (on || ind ? 'var(--ui-primary)' : 'var(--ui-bg)') + ';color:var(--ui-bg)', (on || ind) && I(ind ? 'minus' : 'check', z - 6))
 		const Alert = (tone, icon, title, text, action, actionEl) => D('display:flex;gap:10px;padding:12px 14px;background:var(--rc-' + tone + '-soft);color:var(--ui-' + tone + ')', S('display:flex;padding-top:2px', I(icon)), D('flex:1;display:flex;flex-direction:column;gap:8px', D('display:flex;flex-direction:column;gap:2px', S('font-weight:600', title), S('color:var(--ui-text-toned)', text)), action && B(action, { icon: 'rotate-cw', h: m ? 44 : 28, fs: 12, z: 14, ...(actionEl || {}) })))
 		const Empty = (icon, title, text, action, primary, pad = 56) => D('background:var(--ui-bg);border:1px solid var(--ui-border);padding:' + pad + 'px 24px;display:flex;flex-direction:column;align-items:center;gap:12px;text-align:center', S('width:44px;height:44px;display:flex;align-items:center;justify-content:center;background:var(--ui-bg-elevated);color:var(--ui-text-toned)', I(icon, 20)), S('font-weight:600;font-size:15px;color:var(--ui-text-highlighted)', title), S('color:var(--ui-text-muted);max-width:320px', text), action && B(action, { k: primary ? 'primary' : 'outline', icon: primary ? 'upload' : null, px: 16 }))
@@ -74,7 +74,7 @@ class Component extends DCLogic {
 				Th(im, 'aspect-ratio:4/3;border-bottom:1px solid ' + (on ? 'var(--ui-primary)' : 'var(--ui-border)')),
 				showCb && S('position:absolute;top:0;left:0;width:' + (m ? 44 : 36) + 'px;height:' + (m ? 44 : 36) + 'px;display:flex;align-items:center;justify-content:center', Cb(on, m ? 22 : 20)),
 				D('padding:10px 12px;display:flex;flex-direction:column;gap:6px;min-width:0', D('display:flex;flex-direction:column;gap:2px;min-width:0', S('font-weight:500;color:' + (on ? 'var(--rc-on-sand)' : 'var(--ui-text-highlighted)') + ';overflow:hidden;text-overflow:ellipsis;white-space:nowrap', im.n), S('font-size:12px;color:' + (on ? 'var(--rc-on-sand)' : 'var(--ui-text-muted)') + ';white-space:nowrap;overflow:hidden;text-overflow:ellipsis', im.sz + ' · ' + im.dim)),
-					D('display:flex;flex-wrap:wrap;gap:4px', im.dup && Bd('Duplicate', 'dup'), usedBadge(im), varsBadge(im))))
+					D('display:flex;flex-wrap:wrap;gap:4px', im.dup && Bd('Duplicate', 'dup', 20, on), usedBadge(im, on), varsBadge(im, on))))
 		}
 		const Grid = () => D('display:grid;grid-template-columns:repeat(' + (m ? 2 : 5) + ',minmax(0,1fr));gap:' + (m ? 10 : 16) + 'px', ...imgs.map(Card))
 		const Skel = () => D('display:grid;grid-template-columns:repeat(' + (m ? 2 : 5) + ',minmax(0,1fr));gap:' + (m ? 10 : 16) + 'px', ...Array.from({ length: m ? 6 : 10 }, () => D('background:var(--ui-bg);border:1px solid var(--ui-border)', S('display:block;aspect-ratio:4/3;background:var(--ui-bg-accented)'), D('padding:10px 12px;display:flex;flex-direction:column;gap:8px', S('display:block;width:70%;height:13px;background:var(--ui-bg-accented)'), S('display:block;width:45%;height:11px;background:var(--ui-bg-accented)'), S('display:block;width:60px;height:20px;background:var(--ui-bg-accented)')))))
@@ -86,7 +86,7 @@ class Component extends DCLogic {
 				const on = sel.includes(im.id), hov = s.hover === im.id
 				return D('display:grid;grid-template-columns:' + cols + ';height:56px;align-items:center;padding:0 12px 0 0;border-top:1px solid var(--ui-border);background:' + (on ? 'var(--rc-sand)' : hov ? 'var(--ui-bg-elevated)' : 'var(--ui-bg)') + ';color:' + (on ? 'var(--rc-on-sand)' : 'var(--ui-text-muted)'),
 					S('display:flex;justify-content:center', Cb(on, 18)),
-					D('display:flex;align-items:center;gap:12px;min-width:0;padding-right:12px', Th(im, 'width:40px;height:40px;flex-shrink:0;border:1px solid var(--ui-border)', 16), S('font-weight:500;color:' + (on ? 'var(--rc-on-sand)' : 'var(--ui-text-highlighted)') + ';overflow:hidden;text-overflow:ellipsis;white-space:nowrap', im.n), im.dup && Bd('Duplicate', 'dup'), varsBadge(im)),
+					D('display:flex;align-items:center;gap:12px;min-width:0;padding-right:12px', Th(im, 'width:40px;height:40px;flex-shrink:0;border:1px solid var(--ui-border)', 16), S('font-weight:500;color:' + (on ? 'var(--rc-on-sand)' : 'var(--ui-text-highlighted)') + ';overflow:hidden;text-overflow:ellipsis;white-space:nowrap', im.n), im.dup && Bd('Duplicate', 'dup', 20, on), varsBadge(im, on)),
 					S('', im.dim), S('', im.sz), S('', im.ty), S('', usedLink(im)), S('overflow:hidden;text-overflow:ellipsis;white-space:nowrap;padding-right:8px', im.by), S('', im.d))
 			}))
 		}
@@ -95,7 +95,7 @@ class Component extends DCLogic {
 			return D('display:flex;align-items:center;gap:0;min-height:80px;padding:8px 12px 8px 0;border-bottom:1px solid var(--ui-border);background:' + (on ? 'var(--rc-sand)' : 'var(--ui-bg)') + ';color:' + (on ? 'var(--rc-on-sand)' : 'var(--ui-text-muted)'),
 				S('width:44px;height:44px;flex-shrink:0;display:flex;align-items:center;justify-content:center', Cb(on, 22)),
 				Th(im, 'width:56px;height:56px;flex-shrink:0;border:1px solid var(--ui-border)', 20),
-				D('flex:1;min-width:0;display:flex;flex-direction:column;gap:3px;padding-left:12px', S('font-weight:500;font-size:15px;color:' + (on ? 'var(--rc-on-sand)' : 'var(--ui-text-highlighted)') + ';overflow:hidden;text-overflow:ellipsis;white-space:nowrap', im.n), S('font-size:12px', im.sz + ' · ' + im.dim + ' · ' + im.ty), D('display:flex;flex-wrap:wrap;gap:4px;align-items:center;font-size:12px', im.dup && Bd('Duplicate', 'dup'), usedBadge(im), varsBadge(im), S('', im.by + ' · ' + im.d))),
+				D('flex:1;min-width:0;display:flex;flex-direction:column;gap:3px;padding-left:12px', S('font-weight:500;font-size:15px;color:' + (on ? 'var(--rc-on-sand)' : 'var(--ui-text-highlighted)') + ';overflow:hidden;text-overflow:ellipsis;white-space:nowrap', im.n), S('font-size:12px', im.sz + ' · ' + im.dim + ' · ' + im.ty), D('display:flex;flex-wrap:wrap;gap:4px;align-items:center;font-size:12px', im.dup && Bd('Duplicate', 'dup', 20, on), usedBadge(im, on), varsBadge(im, on), S('', im.by + ' · ' + im.d))),
 				I('chevron-right', 16, 'margin-left:8px'))
 		}))
 

docs/design/source/RenewCMS Emails.dc.html

@@ -38,7 +38,7 @@ class Component extends DCLogic {
 		fetch('emails/verification.html').then(x => x.text()).then(v => this.setState({ v }))
 		fetch('emails/password-reset.html').then(x => x.text()).then(r => this.setState({ r }))
 		fetch('emails/invitation.html').then(x => x.text()).then(i => this.setState({ i }))
-		;['verify-new-email','email-change-notice','account-deleted','export-ready'].forEach(n => fetch('emails/' + n + '.html').then(x => x.text()).then(t => this.setState({ ['x_' + n]: t })))
+		;['verify-new-email','email-change-notice','account-deleted'].forEach(n => fetch('emails/' + n + '.html').then(x => x.text()).then(t => this.setState({ ['x_' + n]: t })))
 	}
 	fill(t) {
 		return t.split('{{.InvitedBy}}').join('marta').split('{{.Email}} It').join('lea.martin@renew.example. It').split('sent to {{.Email}}').join('sent to lea.martin@renew.example').split('{{.Username}}').join('marta').split('{{.NewEmail}}').join('marta.alves@atelier-renew.example').split('{{.DeletedAt}}').join('29 Oct 2026').split('{{.Host}}').join('https://cms.renew.example').split('{{.VerificationCode}}').join('7f3c9a2e4b1d').split('{{.Email}}').join('marta%40renew.example').replace('uses marta%40renew.example', 'uses marta@renew.example')
@@ -57,7 +57,6 @@ class Component extends DCLogic {
 			{ title: 'Verify new email', vars: '{{.Host}} · {{.Username}} · {{.VerificationCode}} → /account/email/confirm?c=', frames: this.frames(this.state['x_verify-new-email']) },
 			{ title: 'Email change notice (to the old address)', vars: '{{.Host}} · {{.Username}} · {{.NewEmail}}', frames: this.frames(this.state['x_email-change-notice']) },
 			{ title: 'Account deleted', vars: '{{.Host}} · {{.Username}} · {{.DeletedAt}}', frames: this.frames(this.state['x_account-deleted']) },
-			{ title: 'Export ready (alternative flow)', vars: '{{.Host}} · {{.Username}} · {{.VerificationCode}} → /account/export/', frames: this.frames(this.state['x_export-ready']) }
 		] }
 	}
 }

docs/design/source/RenewCMS Screens Back-office.dc.html

@@ -229,6 +229,8 @@ class Component extends DCLogic {
 			{ label: 'Editor', title: 'Editor', route: '/article/:id/edit', api: 'GET /v1/article/{id} · PATCH /v1/article/{id} · PATCH …/publish|unpublish · POST …/image · DELETE', note: 'On mobile, Save and Publish sit in a sticky bottom bar and the details panel opens as a slideover. A session expiry mid-edit keeps the draft in sessionStorage and goes to /login?redirect=/article/12/edit. After logging in, the editor restores the draft and shows "Unsaved changes".', states: [
 				E({ loading: true }, { name: 'Loading', trigger: 'GET in flight. Skeletons for the title, content and details.' }),
 				E({}, { name: 'Saved', trigger: 'Just opened or just saved. Save is disabled.' }),
+				E({ title: 'Comment nous chiffrons une rénovation de salle de bain', lang: { name: 'French', code: 'FR' } }, { name: 'Multilingual site: French draft', trigger: 'Sites with more than one language show the language control after the status badge. Publish, Unpublish and Delete name the language. Single-language sites are unchanged. Menu, source reference and review states: Localization board.' }),
+				E({ status: 'online', title: 'Comment nous chiffrons une rénovation de salle de bain', lang: { name: 'French', code: 'FR', fresh: 'Needs review' } }, { name: 'Multilingual site: published, needs review', trigger: 'Publication (Online) and freshness (outlined Needs review) are separate badges.' }),
 				E({ save: 'dirty' }, { name: 'Unsaved changes', trigger: 'Any edit. Publish becomes "Save and publish". Leaving asks for confirmation.' }),
 				E({ save: 'saving' }, { name: 'Saving', trigger: 'Save, or Ctrl/⌘ S.' }),
 				E({ save: 'error' }, { name: 'Save failed', trigger: '500 or network failure. The changes are kept and Retry resends them.' }),

docs/design/source/RenewCMS Screens Localization.dc.html

@@ -0,0 +1,106 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<script src="./support.js"></script>
+</head>
+<body>
+<x-dc>
+<helmet>
+<script src="./locale-fixtures.js"></script>
+<script src="./locale-spec.js"></script>
+<meta name="design_doc_mode" content="canvas">
+<link rel="icon" href="brand/favicon.svg">
+<link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&family=Source+Serif+4:ital,opsz,wght@0,8..60,400;0,8..60,600;1,8..60,400&display=swap" rel="stylesheet">
+<style>body{margin:0;font-family:'IBM Plex Sans',sans-serif;font-size:13px;line-height:20px}*{box-sizing:border-box}a{color:inherit;text-underline-offset:3px}a:hover{opacity:.8}code{font-family:'IBM Plex Mono',monospace;font-size:12px}</style>
+</helmet>
+<div ref="{{ rootRef }}" data-screen-label="Back-office screens" style="--ui-bg:#ffffff;--ui-bg-muted:#fafafa;--ui-bg-elevated:#f3f2f0;--ui-bg-accented:#e6e4e0;--ui-bg-inverted:#111111;--ui-text-dimmed:#999999;--ui-text-muted:#666666;--ui-text-toned:#444444;--ui-text:#222222;--ui-text-highlighted:#111111;--ui-text-inverted:#ffffff;--ui-border:#e6e4e0;--ui-border-muted:#f3f2f0;--ui-border-accented:#8a8783;--ui-primary:#111111;--ui-secondary:#635643;--ui-success:#315b33;--ui-info:#34536d;--ui-warning:#6c4700;--ui-error:#882c21;--rc-sand:#e8dfd1;--rc-on-sand:#111111;--rc-success-soft:#eaefea;--rc-info-soft:#ebeef0;--rc-warning-soft:#f0ede6;--rc-error-soft:#f3eae9;--rc-overlay:rgb(10 10 10 / 0.4);--rc-shadow-pop:0 4px 16px rgb(17 17 17 / 0.08), 0 1px 2px rgb(17 17 17 / 0.06);--rc-shadow-modal:0 16px 48px rgb(17 17 17 / 0.18);--rc-canvas:#ecebe8;background:var(--rc-canvas);color:var(--ui-text);padding:64px;display:flex;flex-direction:column;gap:72px;width:max-content;min-width:100%">
+
+<div style="display:flex;align-items:flex-end;gap:32px;max-width:1400px">
+<div style="flex:1;display:flex;flex-direction:column;gap:10px">
+<h1 style="margin:0;font:600 36px/44px 'IBM Plex Sans',sans-serif;letter-spacing:-0.02em;color:var(--ui-text-highlighted)">Screens: article localization</h1>
+<p style="margin:0;max-width:880px;font-size:16px;line-height:26px;color:var(--ui-text-toned);text-wrap:pretty">One story, several language versions. Proposed feature: every API change is labelled as proposed. 1440 px at 50%, 1024 px at 50% for layout-dependent states, 390 px at 75%. The theme switch shows every state in dark mode. Each state shows its ID and fixture. 183 states in 16 groups. L7s is the pixel-gate reference for a single-language article list. Groups L6 and L9 are release 2. Repository code was unavailable, so existing behaviour comes from the design project only.</p>
+</div>
+<div role="radiogroup" aria-label="Theme" style="display:flex;border:1px solid var(--ui-border-accented);background:var(--ui-bg)">
+<sc-for list="{{ modes }}" as="m" hint-placeholder-count="3">
+<button role="radio" aria-checked="{{ m.on }}" onClick="{{ m.pick }}" style="all:unset;cursor:pointer;height:36px;padding:0 14px;display:flex;align-items:center;font-weight:500;font-size:14px;background:{{ m.bg }};color:{{ m.fg }}" style-focus-visible="outline:2px solid var(--ui-primary);outline-offset:2px">{{ m.label }}</button>
+</sc-for>
+</div>
+</div>
+
+<sc-for list="{{ groups }}" as="g" hint-placeholder-count="7">
+<section data-screen-label="{{ g.label }}" style="display:flex;flex-direction:column;gap:28px">
+<div style="display:flex;flex-direction:column;gap:6px;max-width:1100px">
+<h2 style="margin:0;font:600 28px/36px 'IBM Plex Sans',sans-serif;color:var(--ui-text-highlighted)">{{ g.title }}</h2>
+<div style="display:flex;gap:16px;flex-wrap:wrap;font:400 14px/22px 'IBM Plex Mono',monospace;color:var(--ui-text-toned)"><span>{{ g.route }}</span><span style="color:var(--ui-text-muted)">{{ g.api }}</span><span style="color:var(--ui-text-muted)">{{ g.count }}{{ g.rel }}</span></div>
+<sc-if value="{{ g.note }}"><p style="margin:4px 0 0;font-size:15px;line-height:24px;color:var(--ui-text-toned);text-wrap:pretty">{{ g.note }}</p></sc-if>
+</div>
+<div style="display:flex;flex-wrap:wrap;gap:40px;align-items:flex-start">
+<sc-for list="{{ g.states }}" as="st" hint-placeholder-count="4">
+<div style="display:flex;flex-direction:column;gap:12px">
+<div style="display:flex;flex-direction:column;gap:2px;max-width:1040px"><span style="font:600 16px/24px 'IBM Plex Sans',sans-serif;color:var(--ui-text-highlighted)">{{ st.name }}</span><span style="font-size:13px;color:var(--ui-text-muted)">{{ st.trigger }}</span><span style="font:400 12px/18px 'IBM Plex Mono',monospace;color:var(--ui-text-muted)">{{ st.id }} · frame {{ st.sel }} · fixture {{ st.fx }}</span></div>
+<div style="display:flex;gap:24px;align-items:flex-start">
+<div style="width:{{ st.dw }};height:{{ st.dh }};overflow:hidden;border:1px solid var(--ui-border);flex-shrink:0"><div style="width:{{ st.fw }};height:{{ st.fh }};zoom:{{ st.z }}"><dc-import name="LocaleFrame" s="{{ st.s }}" mobile="{{ false }}" hint-size="1440px,900px"></dc-import></div></div>
+<sc-if value="{{ st.tri }}"><div style="width:512px;height:384px;overflow:hidden;border:1px solid var(--ui-border);flex-shrink:0"><div style="width:1024px;height:768px;zoom:0.5"><dc-import name="LocaleFrame" s="{{ st.s2 }}" mobile="{{ false }}" hint-size="1024px,768px"></dc-import></div></div></sc-if>
+<div style="width:293px;height:633px;overflow:hidden;border:1px solid var(--ui-border);flex-shrink:0"><div style="width:390px;height:844px;zoom:0.75"><dc-import name="LocaleFrame" s="{{ st.s }}" mobile="{{ true }}" hint-size="390px,844px"></dc-import></div></div>
+</div>
+</div>
+</sc-for>
+</div>
+
+</section>
+</sc-for>
+<sc-for list="{{ tables }}" as="t" hint-placeholder-count="3"><section style="display:flex;flex-direction:column;gap:10px;max-width:1400px"><h2 style="margin:0;font:600 28px/36px 'IBM Plex Sans',sans-serif;color:var(--ui-text-highlighted)">{{ t.title }}</h2><div style="background:var(--ui-bg);border:1px solid var(--ui-border)"><div style="display:grid;grid-template-columns:{{ t.w }};gap:16px;padding:8px 12px;background:var(--ui-bg-elevated);color:var(--ui-text-muted);font-weight:500"><sc-for list="{{ t.cols }}" as="c" hint-placeholder-count="3"><span>{{ c }}</span></sc-for></div><sc-for list="{{ t.rows }}" as="r" hint-placeholder-count="3"><div style="display:grid;grid-template-columns:{{ t.w }};gap:16px;padding:10px 12px;border-top:1px solid var(--ui-border);line-height:20px"><sc-for list="{{ r }}" as="c" hint-placeholder-count="3"><span style="color:var(--ui-text-highlighted);text-wrap:pretty;min-width:0">{{ c }}</span></sc-for></div></sc-for></div></section></sc-for>
+
+</div>
+</x-dc>
+<script type="text/x-dc" data-dc-script data-props="{&quot;theme&quot;:{&quot;editor&quot;:&quot;enum&quot;,&quot;options&quot;:[&quot;system&quot;,&quot;light&quot;,&quot;dark&quot;],&quot;default&quot;:&quot;system&quot;,&quot;tsType&quot;:&quot;'system' | 'light' | 'dark'&quot;}}">
+class Component extends DCLogic {
+	state = { mode: this.props.theme ?? 'light' }
+	rootRef = React.createRef()
+	light = { '--ui-bg': '#ffffff', '--ui-bg-muted': '#fafafa', '--ui-bg-elevated': '#f3f2f0', '--ui-bg-accented': '#e6e4e0', '--ui-bg-inverted': '#111111', '--ui-text-dimmed': '#999999', '--ui-text-muted': '#666666', '--ui-text-toned': '#444444', '--ui-text': '#222222', '--ui-text-highlighted': '#111111', '--ui-text-inverted': '#ffffff', '--ui-border': '#e6e4e0', '--ui-border-muted': '#f3f2f0', '--ui-border-accented': '#8a8783', '--ui-primary': '#111111', '--ui-secondary': '#635643', '--ui-success': '#315b33', '--ui-info': '#34536d', '--ui-warning': '#6c4700', '--ui-error': '#882c21', '--rc-sand': '#e8dfd1', '--rc-on-sand': '#111111', '--rc-success-soft': '#eaefea', '--rc-info-soft': '#ebeef0', '--rc-warning-soft': '#f0ede6', '--rc-error-soft': '#f3eae9', '--rc-overlay': 'rgb(10 10 10 / 0.4)', '--rc-shadow-pop': '0 4px 16px rgb(17 17 17 / 0.08), 0 1px 2px rgb(17 17 17 / 0.06)', '--rc-shadow-modal': '0 16px 48px rgb(17 17 17 / 0.18)', '--rc-canvas': '#ecebe8' }
+	dark = { '--ui-bg': '#111111', '--ui-bg-muted': '#0a0a0a', '--ui-bg-elevated': '#1a1a1a', '--ui-bg-accented': '#222222', '--ui-bg-inverted': '#fafafa', '--ui-text-dimmed': '#666666', '--ui-text-muted': '#999999', '--ui-text-toned': '#cfccc7', '--ui-text': '#e6e4e0', '--ui-text-highlighted': '#fafafa', '--ui-text-inverted': '#111111', '--ui-border': '#333333', '--ui-border-muted': '#222222', '--ui-border-accented': '#666666', '--ui-primary': '#fafafa', '--ui-secondary': '#d4c5b0', '--ui-success': '#a3caa3', '--ui-info': '#a5c2db', '--ui-warning': '#dfb67d', '--ui-error': '#fba394', '--rc-sand': '#d4c5b0', '--rc-on-sand': '#111111', '--rc-success-soft': '#1f241f', '--rc-info-soft': '#202428', '--rc-warning-soft': '#2a251e', '--rc-error-soft': '#2c201f', '--rc-overlay': 'rgb(0 0 0 / 0.6)', '--rc-shadow-pop': '0 4px 16px rgb(0 0 0 / 0.5)', '--rc-shadow-modal': '0 16px 48px rgb(0 0 0 / 0.6)', '--rc-canvas': '#1c1c1c' }
+	resolved() {
+		if (this.state.mode === 'system') return window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light'
+		return this.state.mode
+	}
+	apply() {
+		const el = this.rootRef.current
+		if (!el) return
+		const vars = this.resolved() === 'dark' ? this.dark : this.light
+		for (const k in vars) el.style.setProperty(k, vars[k])
+		document.body.style.background = vars['--rc-canvas']
+	}
+	componentDidMount() { this.apply() }
+	componentDidUpdate(p) {
+		if (p.theme !== this.props.theme && this.props.theme) this.setState({ mode: this.props.theme })
+		this.apply()
+	}
+	groups() { return window.LOC.groups.map(g => ({ ...g, count: g.states.length + ' states · ', rel: g.release === 2 ? 'Release 2' : 'Release 1', label: g.id + ' ' + g.title, states: g.states.map(a => { const nar = a[4] === 'narrow', tri = a[4] === 'tri'; return { name: a[0], trigger: a[1], id: a[5], fx: a[6], sel: 'LocaleFrame{v:' + a[2] + ',x:' + (a[3] || "''") + '}', tri, dw: nar ? '717px' : '720px', dh: nar ? '538px' : '450px', fw: nar ? '1024px' : '1440px', fh: nar ? '768px' : '900px', z: nar ? 0.7 : 0.5, s: { v: a[2], x: a[3], narrow: nar }, s2: { v: a[2], x: a[3], narrow: true } } }) })) }
+	ratio(a, b2) { const h = c => { c = c.replace('#', ''); return [0, 2, 4].map(i => parseInt(c.slice(i, i + 2), 16)) }, L = rgb => { const f = v => { v /= 255; return v <= 0.03928 ? v / 12.92 : Math.pow((v + 0.055) / 1.055, 2.4) }; return 0.2126 * f(rgb[0]) + 0.7152 * f(rgb[1]) + 0.0722 * f(rgb[2]) }, x = L(h(a)), y = L(h(b2)); return (Math.max(x, y) + 0.05) / (Math.min(x, y) + 0.05) }
+	mix(fg, bg, p) { const h = c => [1, 3, 5].map(i => parseInt(c.slice(i, i + 2), 16)), f = h(fg), g = h(bg); return '#' + f.map((v, i) => Math.round(v * p + g[i] * (1 - p)).toString(16).padStart(2, '0')).join('') }
+	computed() {
+		const FX = window.LOCFX, LOC = window.LOC, J = FX.SITES.journal
+		const jv = FX.view({ site: J }), p2 = FX.view({ site: J, page: 2 }), fr = FX.view({ site: J, lang: 'fr' }), frm = FX.view({ site: J, lang: 'fr', tab: 'missing' }), rv = FX.view({ site: J, tab: 'review' }), au = FX.view({ site: J, author: 'Marta Alves' })
+		const cnt = k => FX.count(k, J.stories), ver = J.stories.reduce((a, s) => a + Object.keys(s.v).length, 0), eq = (a, b2) => a === b2 ? 'Matches' : 'MISMATCH'
+		const checks = [['Articles', 8, J.stories.length], ['Versions', 17, ver], ['Page size', 5, jv.size], ['Page 1 rows', 5, jv.rows.length], ['Page 2 rows', 3, p2.rows.length], ['Pages', 2, jv.pages], ['en versions / published', '7 / 6', cnt('en').join(' / ')], ['fr versions / published', '4 / 2', cnt('fr').join(' / ')], ['fr needing review', 2, fr.tabs[3][1]], ['de versions / published', '4 / 3', cnt('de').join(' / ')], ['ar versions', 1, cnt('ar')[0]], ['es versions', 1, cnt('es')[0]], ['it versions', 0, cnt('it')[0]], ['Articles without French', 4, frm.total], ['Needs translation tab', 7, jv.tabs[1][1]], ['Needs review tab', 2, rv.total], ['Author Marta Alves', 3, au.total], ['Setup articles (Journal + Notes + Archive)', 16, FX.SETUP.reduce((a, r) => a + r.n, 0)], ['Press: not in French', 0, FX.view({ site: FX.SITES.press, lang: 'fr', tab: 'missing' }).total]]
+		const checkRows = checks.map(c => [c[0], String(c[1]), String(c[2]), eq(String(c[1]), String(c[2]))])
+		const byFx = {}; LOC.groups.forEach(g => g.states.forEach(a => { (byFx[a[6]] = byFx[a[6]] || []).push(a[5]) }))
+		const fxRows = Object.entries(byFx).map(([k, v]) => [k, FX.FIXTURE_NOTES[k.split(',')[0].replace(' (limited scope)', '').trim()] || '', v.length + ' states', v.length > 12 ? v.slice(0, 8).join(', ') + ' and ' + (v.length - 8) + ' more (every state not listed under another fixture)' : v.join(', ')])
+		const cl = ['--ui-success', '--rc-success-soft'], ct = (m2) => { const t = m2 === 'dark' ? this.dark : this.light; const pr = [['Published badge', t['--ui-success'], t['--rc-success-soft'], 4.5], ['Info badge (Default, Tracked source)', t['--ui-info'], t['--rc-info-soft'], 4.5], ['Warning badge', t['--ui-warning'], t['--rc-warning-soft'], 4.5], ['Error badge', t['--ui-error'], t['--rc-error-soft'], 4.5], ['Neutral badge (Draft, Read only)', t['--ui-text-toned'], t['--ui-bg-elevated'], 4.5], ['Freshness badge (outlined)', t['--ui-warning'], t['--ui-bg'], 4.5], ['Selected row and menu item', t['--rc-on-sand'], t['--rc-sand'], 4.5], ['Coverage chip', t['--ui-text-highlighted'], t['--ui-bg'], 4.5], ['Dashed missing chip text', t['--ui-text-muted'], t['--ui-bg'], 4.5], ['Disabled-language chip (75%)', this.mix(t['--ui-text-highlighted'], t['--ui-bg'], .75), t['--ui-bg'], 4.5], ['Primary button', t['--ui-bg'], t['--ui-primary'], 4.5], ['Disabled menu item (60%, exempt)', this.mix(t['--ui-text-highlighted'], t['--ui-bg'], .6), t['--ui-bg'], 4.5], ['Disabled button (40%, exempt)', this.mix(t['--ui-text-highlighted'], t['--ui-bg'], .4), t['--ui-bg'], 4.5], ['Dashed and input borders (non-text)', t['--ui-border-accented'], t['--ui-bg'], 3]]; return pr.map(r => [r[0], this.ratio(r[1], r[2]).toFixed(2), r[3]]) }
+		const L = ct('light'), D = ct('dark'), conRows = L.map((r, i) => [r[0], r[1], D[i][1], r[2] + ':1', (+r[1] >= r[2] && +D[i][1] >= r[2]) ? 'Pass' : (/exempt/.test(r[0]) ? 'Exempt (disabled)' : 'FAIL')])
+		const cntRows = LOC.groups.map(g => [g.id + ' ' + g.title, String(g.states.length), String(g.states.filter(a => a[4] === 'tri').length), g.release === 2 ? 'Release 2' : 'Release 1']).concat([['Total', String(LOC.groups.reduce((a, g) => a + g.states.length, 0)), String(LOC.groups.reduce((a, g) => a + g.states.filter(a2 => a2[4] === 'tri').length, 0)), '']])
+		return [{ title: 'Fixture index', cols: ['Fixture', 'Contents', 'Used by', 'State IDs'], w: '1.2fr 2fr .8fr 3fr', rows: fxRows }, { title: 'Fixture totals check (computed from locale-fixtures.js now)', cols: ['Figure', 'Decided', 'Computed', 'Result'], w: '2fr 1fr 1fr 1fr', rows: checkRows }, { title: 'State counts per group', cols: ['Group', 'States', 'Also at 1024', 'Release'], w: '3fr 1fr 1fr 1fr', rows: cntRows }, { title: 'Contrast of badges, chips and variants (computed from the tokens)', cols: ['Element', 'Light', 'Dark', 'Needs', 'Result'], w: '3fr 1fr 1fr 1fr 1.4fr', rows: conRows }]
+	}
+	renderVals() {
+		const modes = [['system', 'System'], ['light', 'Light'], ['dark', 'Dark']].map(([k, label]) => {
+			const on = this.state.mode === k
+			return { label, on, bg: on ? 'var(--ui-primary)' : 'transparent', fg: on ? 'var(--ui-bg)' : 'var(--ui-text-toned)', pick: () => this.setState({ mode: k }) }
+		})
+		return { rootRef: this.rootRef, modes, groups: this.groups(), tables: window.LOC.tables.concat(this.computed()) }
+	}
+}
+</script>
+</body>
+</html>

docs/design/source/emails/export-ready.html

@@ -1,72 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
-<head>
-	<meta charset="utf-8">
-	<meta name="viewport" content="width=device-width, initial-scale=1">
-	<meta name="color-scheme" content="light dark">
-	<meta name="supported-color-schemes" content="light dark">
-	<title>Your data export is ready</title>
-	<style>
-		body { margin: 0; padding: 0; width: 100%; -webkit-text-size-adjust: 100%; }
-		table { border-collapse: collapse; }
-		a { color: #111111; }
-		@media (max-width: 620px) {
-			.rc-card { padding: 28px 20px !important; }
-			.rc-btn a { display: block !important; }
-		}
-		@media (prefers-color-scheme: dark) {
-			.rc-bg { background-color: #0a0a0a !important; }
-			.rc-card { background-color: #111111 !important; border-color: #333333 !important; }
-			.rc-h1, .rc-word { color: #fafafa !important; }
-			.rc-text { color: #e6e4e0 !important; }
-			.rc-muted { color: #999999 !important; }
-			.rc-mark { border: 1px solid #444444 !important; }
-			.rc-btn td { background-color: #fafafa !important; }
-			.rc-btn a { background-color: #fafafa !important; color: #111111 !important; border-color: #fafafa !important; }
-			.rc-url { color: #e6e4e0 !important; background-color: #1a1a1a !important; }
-			.rc-rule { border-color: #333333 !important; }
-		}
-	</style>
-</head>
-<body class="rc-bg" style="margin:0;padding:0;background-color:#fafafa;">
-	<div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent;">Your RenewCMS data export is ready to download. The link expires in 24 hours.</div>
-	<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" class="rc-bg" style="background-color:#fafafa;">
-		<tr>
-			<td align="center" style="padding:40px 12px;">
-				<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="max-width:600px;">
-					<tr>
-						<td style="padding:0 0 20px 0;">
-							<table role="presentation" cellpadding="0" cellspacing="0" border="0">
-								<tr>
-									<td class="rc-mark" width="32" height="32" align="center" valign="middle" bgcolor="#111111" style="width:32px;height:32px;background-color:#111111;color:#ffffff;font-family:Arial,Helvetica,sans-serif;font-size:19px;font-weight:bold;line-height:32px;">R</td>
-									<td class="rc-word" style="padding-left:10px;font-family:'IBM Plex Sans',Arial,Helvetica,sans-serif;font-size:17px;font-weight:600;color:#111111;">RenewCMS</td>
-								</tr>
-							</table>
-						</td>
-					</tr>
-					<tr>
-						<td class="rc-card" style="background-color:#ffffff;border:1px solid #e6e4e0;padding:40px;font-family:'IBM Plex Sans',Arial,Helvetica,sans-serif;">
-							<h1 class="rc-h1" style="margin:0 0 16px 0;font-size:24px;line-height:32px;font-weight:600;color:#111111;">Your data export is ready</h1>
-							<p class="rc-text" style="margin:0 0 28px 0;font-size:16px;line-height:26px;color:#222222;">The export you requested for the RenewCMS account {{.Username}} at {{.Host}} is ready. It contains your profile, authored content, uploaded media references and account activity. You need to be logged in to download it.</p>
-							<table role="presentation" cellpadding="0" cellspacing="0" border="0" class="rc-btn">
-								<tr>
-									<td bgcolor="#111111" style="background-color:#111111;">
-										<a href="{{.Host}}/account/export/{{.VerificationCode}}" target="_blank" style="display:inline-block;padding:14px 24px;border:1px solid #111111;background-color:#111111;color:#ffffff;font-family:'IBM Plex Sans',Arial,Helvetica,sans-serif;font-size:16px;font-weight:600;line-height:20px;text-decoration:none;text-align:center;">Download my data</a>
-									</td>
-								</tr>
-							</table>
-							<p class="rc-muted" style="margin:16px 0 0 0;font-size:14px;line-height:22px;color:#666666;">This link expires in 24 hours and only works while you are logged in.</p>
-							<p class="rc-muted" style="margin:28px 0 8px 0;font-size:14px;line-height:22px;color:#666666;">If the button doesn't work, copy this address into your browser:</p>
-							<p class="rc-url" style="margin:0;padding:10px 12px;background-color:#f3f2f0;font-family:'IBM Plex Mono',Menlo,Consolas,monospace;font-size:13px;line-height:20px;color:#222222;word-break:break-all;">{{.Host}}/account/export/{{.VerificationCode}}</p>
-							<p class="rc-text rc-rule" style="margin:28px 0 0 0;padding-top:20px;border-top:1px solid #e6e4e0;font-size:14px;line-height:22px;color:#222222;">If you didn't request this export, log in and change your password.</p>
-						</td>
-					</tr>
-					<tr>
-						<td class="rc-muted" style="padding:20px 0 0 0;font-family:'IBM Plex Sans',Arial,Helvetica,sans-serif;font-size:12px;line-height:18px;color:#666666;">RenewCMS · {{.Host}}</td>
-					</tr>
-				</table>
-			</td>
-		</tr>
-	</table>
-</body>
-</html>

docs/design/source/locale-fixtures.js

@@ -0,0 +1,101 @@
+// Shared localization fixtures. One source for the Localization board (LocaleFrame), the Prototype (LocaleLive) and the Handoff.
+// Dataset "Journal": 8 stories, 17 versions. Every count shown anywhere is derived from STORIES or LANGS.
+// Separate fixtures (marked): PRESS (all stories translated, for the nothing-missing state), JOURNAL_PRE_FR (prototype start: French not enabled yet).
+(function () {
+	const P = {
+		en: ['Most quotes fail because they hide the same three costs. Here is how we itemise them before the first tile is ordered.', 'Start with the room, not the catalogue. Measure the walls, note where the pipes run and photograph the existing fixtures.', 'Next, separate what is fixed from what is chosen. Plumbing and waterproofing are fixed. Tiles and taps are chosen.', 'Price the fixed items first and ask for a written range. A range with a stated assumption is more useful than a single figure.', 'Allow ten percent for what the walls reveal. Old bathrooms almost always hide one surprise behind the tiles.', 'Check the floor falls toward the drain before any membrane goes down. Correcting a fall after tiling means lifting everything.', 'Choose the tiles after the layout is drawn. A tile that needs many cuts costs more in labour than it saves in material.', 'Ask the tiler to confirm the adhesive and grout for the wet area in writing, and keep the data sheets with the quote.', 'Agree who protects the hallway floor and who removes the old bath. These small jobs are the ones that start disputes.', 'Finally, agree the order of work with the tiler and the plumber before anything is ordered.'],
+		fr: ['La plupart des devis échouent parce qu\'ils cachent les trois mêmes coûts. Voici comment nous les détaillons avant de commander le premier carreau.', 'Commencez par la pièce, pas par le catalogue. Mesurez les murs, repérez le passage des canalisations et photographiez les équipements existants.', 'Séparez ensuite ce qui est fixe de ce qui est choisi. La plomberie et l\'étanchéité sont fixes. Les carreaux et la robinetterie sont choisis.', 'Chiffrez d\'abord les postes fixes et demandez une fourchette écrite.'],
+		de: ['Die meisten Angebote scheitern, weil sie dieselben drei Kosten verschweigen. So listen wir sie auf, bevor die erste Fliese bestellt wird.', 'Beginnen Sie mit dem Raum, nicht mit dem Katalog. Messen Sie die Wände und halten Sie fest, wo die Rohre verlaufen.'],
+		ar: ['تفشل معظم عروض الأسعار لأنها تُخفي التكاليف الثلاثة نفسها. إليك كيف نفصّلها قبل طلب أول بلاطة.', 'ابدأ بالغرفة لا بالكتالوج. قِس الجدران، وحدّد مسار الأنابيب، وصوّر التركيبات الحالية.', 'افصل بعد ذلك ما هو ثابت عمّا هو مختار. السباكة والعزل ثابتان، أما البلاط والصنابير فمختارة.']
+	}
+	const LANG_NAMES = { en: 'English', fr: 'French', de: 'German', ar: 'Arabic', es: 'Spanish', it: 'Italian', 'pt-BR': 'Portuguese (Brazil)', 'en-GB': 'English (United Kingdom)' }
+	const DIR = { ar: 'rtl' }
+	// v: lang -> [status, needsReview, revision]
+	const mk = (id, title, v, tr, by, upd) => ({ id, title, v, tr: tr || {}, by, upd })
+	const STORIES = [
+		mk('s1', 'How we price a bathroom renovation', { en: ['pub', 0, 8], fr: ['draft', 1, 5], de: ['pub', 0, 3], ar: ['draft', 1, 2] }, { fr: 'Comment nous chiffrons une rénovation de salle de bain', de: 'So kalkulieren wir eine Badsanierung', ar: 'كيف نسعّر تجديد الحمّام' }, 'Marta Alves', '2 h ago'),
+		mk('s2', 'A guide to lime plaster', { en: ['pub', 0, 4], fr: ['pub', 0, 4], de: ['pub', 0, 2] }, { fr: 'Guide de l\'enduit à la chaux', de: 'Ein Leitfaden zu Kalkputz' }, 'Camille Roche', 'Yesterday'),
+		mk('s3', 'Winter checklist for timber windows', { en: ['pub', 0, 6], fr: ['pub', 1, 3] }, { fr: 'Liste d\'hiver pour les fenêtres en bois' }, 'Luis Ferrer', '3 days ago'),
+		mk('s4', 'Spring newsletter', { en: ['draft', 0, 1] }, {}, 'Marta Alves', '3 days ago'),
+		mk('s5', 'Roof inspection checklist', { en: ['pub', 0, 3], de: ['draft', 0, 1] }, { de: 'Checkliste für die Dachprüfung' }, 'Luis Ferrer', '14 Oct'),
+		mk('s6', 'Why we reuse original floorboards', { en: ['pub', 0, 2], fr: ['draft', 0, 1] }, { fr: 'Pourquoi nous réutilisons les lames de parquet d\'origine' }, 'Camille Roche', '13 Oct'),
+		mk('s7', 'Our first passive-house retrofit', { en: ['pub', 0, 5], de: ['pub', 0, 2] }, { de: 'Unsere erste Passivhaus-Sanierung' }, 'Marta Alves', '12 Oct'),
+		mk('s8', 'Cómo elegir un contratista', { es: ['pub', 0, 2] }, {}, 'Luis Ferrer', '10 Oct')
+	]
+	const ENABLED = ['en', 'fr', 'de', 'ar']
+	const LANGS = [
+		{ name: 'English', code: 'en', def: true, enabled: true, social: 'Not set' },
+		{ name: 'French', code: 'fr', enabled: true, social: 'fr_FR' },
+		{ name: 'German', code: 'de', enabled: true, social: 'Not set' },
+		{ name: 'Arabic', code: 'ar', enabled: true, social: 'Not set' },
+		{ name: 'Spanish', code: 'es', enabled: false, social: 'Not set' },
+		{ name: 'Italian', code: 'it', enabled: false, social: 'Not set' }
+	]
+	const count = (code, stories) => { let n = 0, pub = 0; stories.forEach(s => { const x = s.v[code]; if (x) { n++; if (x[0] === 'pub') pub++ } }); return [n, pub] }
+	const PRESS = [
+		mk('p1', 'Opening hours over the holidays', { en: ['pub', 0, 2], fr: ['pub', 0, 2] }, { fr: 'Horaires pendant les fêtes' }, 'Marta Alves', 'Yesterday'),
+		mk('p2', 'Meet the new site manager', { en: ['pub', 0, 3], fr: ['draft', 1, 1] }, { fr: 'Rencontrez la nouvelle cheffe de chantier' }, 'Luis Ferrer', '3 days ago'),
+		mk('p3', 'Annual report', { en: ['draft', 0, 1], fr: ['pub', 0, 1] }, { fr: 'Rapport annuel' }, 'Marta Alves', '14 Oct')
+	]
+	// Prototype start: French is not enabled, so no French versions exist yet.
+	const preFr = () => STORIES.map(s => { const v = { ...s.v }; delete v.fr; const tr = { ...s.tr }; delete tr.fr; return { ...s, v, tr } })
+	// Setup fixture (before languages exist): articles per site, site locale as stored, the language entry it maps to.
+	const SETUP = [
+		{ site: 'Journal', n: 8, locale: 'en', tag: 'en', name: 'English', note: 'Site locale en' },
+		{ site: 'Notes', n: 3, locale: null, tag: null, name: null, note: 'No site locale' },
+		{ site: 'Archive', n: 5, locale: 'pt-BR', tag: 'pt-BR', name: 'Portuguese (Brazil)', note: 'Site locale pt-BR' }
+	]
+
+	STORIES[3].seo = 1; STORIES[4].seo = 1
+	Object.assign(LANG_NAMES, { 'zh-Hans': 'Chinese (Simplified)', ja: 'Japanese' })
+	const ATELIER = [
+		mk('a1', 'A complete guide to renovating a ground-floor kitchen and bathroom in a listed building, with every cost itemised for owners and tenants', { en: ['pub', 0, 4], 'en-GB': ['draft', 0, 1], fr: ['draft', 1, 2], de: ['pub', 0, 2], 'pt-BR': ['draft', 0, 1], 'zh-Hans': ['pub', 0, 2], ja: ['pub', 0, 2], ar: ['draft', 0, 1] }, {}, 'Marta Alves', '2 h ago'),
+		mk('a2', 'Heat pumps for stone farmhouses', { en: ['pub', 0, 2], 'en-GB': ['pub', 0, 1], fr: ['draft', 0, 1], de: ['pub', 0, 1], ja: ['draft', 0, 1] }, {}, 'Luis Ferrer', 'Yesterday'),
+		mk('a3', 'Sourcing reclaimed oak beams', { en: ['draft', 0, 1], 'en-GB': ['draft', 0, 1] }, {}, 'Camille Roche', '14 Oct')
+	]
+	ATELIER[0].seo = 1; ATELIER[2].seo = 1
+	const ARCHIVE = [['Como restaurar azulejos antigos', 'pub', 'Marta Alves', '3 days ago'], ['Guia de cal e areia', 'pub', 'Camille Roche', '14 Oct'], ['Pintura para fachadas húmidas', 'draft', 'Luis Ferrer', '13 Oct'], ['Orçamento de uma reabilitação', 'pub', 'Marta Alves', '12 Oct'], ['Telhados de telha cerâmica', 'pub', 'Camille Roche', '10 Oct']].map((r, i) => mk('r' + (i + 1), r[0], { 'pt-BR': [r[1], 0, 1] }, {}, r[2], r[3]))
+	const NOTES = [['Site visit notes', 'Luis Ferrer', '3 days ago'], ['Supplier call summary', 'Marta Alves', '14 Oct'], ['Tile samples list', 'Camille Roche', '10 Oct']].map((r, i) => mk('n' + (i + 1), r[0], {}, {}, r[1], r[2]))
+	const SITES = {
+		journal: { name: 'Journal', stories: STORIES, langs: ['en', 'fr', 'de', 'ar'], disabled: ['es', 'it'], def: 'en', size: 5, locale: 'en' },
+		press: { name: 'Press', stories: PRESS, langs: ['en', 'fr'], disabled: [], def: 'en', size: 5, locale: 'en' },
+		atelier: { name: 'Atelier', stories: ATELIER, langs: ['en', 'en-GB', 'fr', 'de', 'pt-BR', 'zh-Hans', 'ja', 'ar'], disabled: [], def: 'en', size: 5, locale: 'en' },
+		archive: { name: 'Archive', stories: ARCHIVE, langs: ['pt-BR'], disabled: [], def: 'pt-BR', size: 5, locale: 'pt-BR' },
+		notes: { name: 'Notes', stories: NOTES, langs: [], disabled: [], def: null, size: 5, locale: null },
+		gallery: { name: 'Gallery', stories: [], langs: ['en-GB'], disabled: [], def: 'en-GB', size: 5, locale: 'en-GB' }
+	}
+	const pl = (n, w) => n + ' ' + w + (n === 1 ? '' : 's')
+	const tt = (s, k) => s.tr[k] || s.title
+	const repKey = (s, def) => s.v[def] ? def : Object.keys(s.v).sort()[0]
+	const view = o => {
+		const site = o.site, en = site.langs, lang = o.lang || null, create = o.create || en, st = o.status, au = o.author, q = (o.q || '').toLowerCase(), seo = o.seo, size = o.size || site.size
+		const ss = site.stories.map(s => { const v = {}; Object.keys(s.v).forEach(k => { if (!o.read || o.read.includes(k)) v[k] = s.v[k] }); return { ...s, v } }).filter(s => Object.keys(s.v).length && (!o.scope || o.scope(s)))
+		const pass = (s, vs, ks) => (!st || vs.some(x => x[0] === st)) && (!au || s.by === au) && (!seo || s.seo) && (!q || ks.some(k => tt(s, k).toLowerCase().includes(q)))
+		const all = s => pass(s, Object.values(s.v), Object.keys(s.v))
+		let tabs, rowsBy, LN = lang ? LANG_NAMES[lang] : ''
+		if (lang) {
+			const inL = ss.filter(s => s.v[lang] && pass(s, [s.v[lang]], [lang])), miss = ss.filter(s => !s.v[lang] && all(s))
+			rowsBy = { all: inL, pub: inL.filter(s => s.v[lang][0] === 'pub'), draft: inL.filter(s => s.v[lang][0] === 'draft'), review: inL.filter(s => s.v[lang][1]), missing: miss }
+			tabs = [['All', 'all'], ['Published', 'pub'], ['Drafts', 'draft'], ['Needs review', 'review'], ['Not in ' + LN, 'missing']]
+		} else {
+			const b = ss.filter(all)
+			rowsBy = { all: b, missing: b.filter(s => create.some(k => en.includes(k) && !s.v[k])), review: b.filter(s => Object.values(s.v).some(x => x[1])) }
+			tabs = [['All articles', 'all'], ['Needs translation', 'missing'], ['Needs review', 'review']]
+		}
+		const tab = o.tab || 'all', rows = rowsBy[tab], total = rows.length, pages = Math.max(1, Math.ceil(total / size)), page = Math.min(o.page || 1, pages), from = total ? (page - 1) * size + 1 : 0, to = Math.min(total, page * size)
+		const unit = lang ? ({ all: pl(total, LN + ' version'), pub: 'published ' + LN + ' version' + (total === 1 ? '' : 's'), draft: pl(total, LN + ' draft'), review: pl(total, LN + ' version') + ' ' + (total === 1 ? 'needs' : 'need') + ' review', missing: pl(total, 'article') + ' not in ' + LN })[tab] : ({ all: pl(total, 'article'), missing: pl(total, 'article') + ' ' + (total === 1 ? 'needs' : 'need') + ' translation', review: pl(total, 'article') + ' ' + (total === 1 ? 'needs' : 'need') + ' review' })[tab]
+		return { tabs: tabs.map(t => [t[0], rowsBy[t[1]].length, t[1]]), tab, total, pages, page, size, from, to, unit, rows: rows.slice((page - 1) * size, page * size).map(s => ({ s, rep: repKey(s, site.def) })) }
+	}
+	const chips = (s, site, create) => {
+		const en = site.langs, out = [], has = k => !!s.v[k]
+		const order = [site.def].concat(en.filter(k => k !== site.def))
+		order.forEach(k => { if (has(k)) out.push({ k, st: s.v[k][0], nr: s.v[k][1] }) })
+		Object.keys(s.v).filter(k => !en.includes(k)).forEach(k => out.push({ k, st: s.v[k][0], nr: s.v[k][1], off: 1 }))
+		order.forEach(k => { if (!has(k) && (create || en).includes(k)) out.push({ k, st: null }) })
+		return out
+	}
+	const SOCIAL = { journal: { en: ['none'], fr: ['set', 'fr_FR'], de: ['none'], ar: ['none'], es: ['none'], it: ['none'] }, atelier: { en: ['none'], 'en-GB': ['derived', 'en_GB'], fr: ['set', 'fr_FR'], de: ['none'], 'pt-BR': ['derived', 'pt_BR'], 'zh-Hans': ['none'], ja: ['none'], ar: ['none'] } }
+	const AUTHORS = Object.entries(STORIES.reduce((a, s) => (a[s.by] = (a[s.by] || 0) + 1, a), {}))
+	const FIXTURE_NOTES = { Journal: '8 articles, 17 versions, page size 5; en (default), fr, de, ar enabled; es, it disabled', Press: '3 articles, en + fr, all translated', Atelier: '3 articles, 8 languages, long labels', Archive: '5 articles, one language (pt-BR kept)', Notes: '3 articles, no site locale', Gallery: 'No articles, site locale en-GB' }
+	window.LOCFX = { P, STORIES, PRESS, ATELIER, ARCHIVE, NOTES, SITES, ENABLED, LANGS, LANG_NAMES, DIR, SETUP, preFr, count, view, chips, pl, tt, repKey, SOCIAL, AUTHORS, FIXTURE_NOTES, TOTALS: { stories: 8, versions: 17 } }
+})()

docs/design/states.md

@@ -108,7 +108,7 @@ Schema changes with entries: Save opens the review ("Add 2 fields, change 1, rem
 Entry rules, 422 except unique (409): required, type, min, max, options, unique, unknown_field. Messages are per type and drawn in the field-type gallery (group "Field types").
 
 ## Media field (pass 5)
-Copy and states are in `media-field-changes.md` (sections 2 to 6). Entry rules for a media field: required 422 "Pick an image for Thumbnail."; type 422 "Thumbnail must be an image from the library."; min, max, options and unique do not apply. A required media field added to a type with entries is refused client side in the review ("Can't be applied") and by the server as 409 schema_incompatible. Image deleted while entries use it: the control shows "This image is no longer in the library"; saving is refused only when the field is required. HTTP statuses for the picker and the field use the table above (400, 401, 403, 404, 409, 413, 429, 500, network).
+Copy and states are in `media-field.md` (sections 2 to 6). Entry rules for a media field: required 422 "Pick an image for Thumbnail."; type 422 "Thumbnail must be an image from the library."; min, max, options and unique do not apply. A required media field added to a type with entries is refused client side in the review ("Can't be applied") and by the server as 409 schema_incompatible. Image deleted while entries use it: the control shows "This image is no longer in the library"; saving is refused only when the field is required. HTTP statuses for the picker and the field use the table above (400, 401, 403, 404, 409, 413, 429, 500, network).
 
 ## Roles and permissions
 
@@ -187,3 +187,369 @@ States and copy in screens/account.md. Board: RenewCMS Screens Account.dc.html (
 | 500, network | existing 500 copy, or "Couldn't delete your account. Nothing was deleted. Try again in a moment." |
 | 409 last_admin | "You can't delete your account yet" (non-dismissable dialog) |
 | 409 email_unavailable | Landing only: "We couldn't change your email address" (same for in use and rejected) |
+
+## Localization state IDs (groups L1-L12 on the Localization board; source of truth: locale-spec.js)
+Every state has a stable ID, a frame selector and a fixture. Legacy IDs from the first pass keep their names and are the canonical ID of the state they map to; the loc.lN.xxx alias is listed below.
+
+Total: 183 states in 16 groups (was 109 in the first pass, 169 after the corrections pass). L7s (single-language list) and 13 other states were added in pass 3; see localization-changelog.md.
+
+## L1 Site languages
+Route: /settings/sites/:key/languages
+API: proposed: GET/PUT /v1/site/{key}/languages
+
+Navigation: Settings → Sites → [site] → Languages only. The site name is in the heading and breadcrumb. Site formatting locale, default content language, article language and social locale are four separate values. At least one language stays enabled and the default must be enabled: to retire the default, first Make default on another language, then Disable. Disable and Remove never delete or unpublish content. Disabled languages show a Disabled tag and a Re-enable action; their versions stay readable and editable per permission. Drafts can be published only after Re-enable ("French is disabled on this site. Re-enable it to publish."). The language filter lists them under Disabled. Social locale per language has three states: Derived (from the language code, e.g. pt-BR gives pt_BR), Set (an owner typed it, e.g. fr_FR) and Not set (og:locale left out). Only owners edit it.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l1.single | Single language | Owner opens Languages on Archive (one language, pt-BR kept) | LocaleFrame{s:{v:"sl",x:"single"}} | 1440, 390 | Archive |
+| loc.l1.multi | Multilingual | Journal: four enabled, two disabled (Spanish, Italian) | LocaleFrame{s:{v:"sl",x:"multi"}} | 1440, 1024, 390 | Journal |
+| loc.l1.loading | Loading | Request in flight | LocaleFrame{s:{v:"sl",x:"loading"}} | 1440, 390 | Journal |
+| loc.l1.error | Load failed | Network or server error | LocaleFrame{s:{v:"sl",x:"error"}} | 1440, 390 | Journal |
+| loc.l1.add | Add a language | Add language | LocaleFrame{s:{v:"sl",x:"add"}} | 1440, 390 | Journal |
+| loc.l1.saveFail | Add failed | Server error, selection kept | LocaleFrame{s:{v:"sl",x:"saveFail"}} | 1440, 390 | Journal |
+| loc.l1.adddup | Duplicate language | Already enabled | LocaleFrame{s:{v:"sl",x:"adddup"}} | 1440, 390 | Journal |
+| loc.l1.broader | Only a broader tag supported | Add Portuguese (Portugal): substitution explained, confirmation required | LocaleFrame{s:{v:"sl",x:"broader"}} | 1440, 390 | Journal |
+| loc.l1.default | Make default | Row menu | LocaleFrame{s:{v:"sl",x:"default"}} | 1440, 390 | Journal |
+| loc.l1.defaultFail | Set default failed | Server error, nothing changed | LocaleFrame{s:{v:"sl",x:"defaultFail"}} | 1440, 390 | Journal |
+| loc.l1.disable | Disable with content | Row menu → Disable German | LocaleFrame{s:{v:"sl",x:"disable"}} | 1440, 390 | Journal |
+| loc.l1.stale | Languages changed | Another owner changed them: "Languages changed. Reload." | LocaleFrame{s:{v:"sl",x:"stale"}} | 1440, 390 | Journal |
+| loc.lang.disableDefault | Disable default blocked | Disable English | LocaleFrame{s:{v:"sl",x:"disableDefault"}} | 1440, 390 | Journal |
+| loc.lang.disableLast | Disable last blocked | Only one enabled | LocaleFrame{s:{v:"sl",x:"disableLast"}} | 1440, 390 | Journal |
+| loc.l1.reenable | Re-enable | Spanish row → Re-enable | LocaleFrame{s:{v:"sl",x:"reenable"}} | 1440, 390 | Journal |
+| loc.l1.reenableDone | Re-enabled | Toast after success | LocaleFrame{s:{v:"sl",x:"reenableDone"}} | 1440, 390 | Journal |
+| loc.l1.reenableFail | Re-enable failed | Dialog error, still disabled | LocaleFrame{s:{v:"sl",x:"reenableFail"}} | 1440, 390 | Journal |
+| loc.l1.remove | Remove (no content) | Italian (0 versions) | LocaleFrame{s:{v:"sl",x:"remove"}} | 1440, 390 | Journal |
+| loc.l1.removeFail | Remove failed | Dialog error, still listed | LocaleFrame{s:{v:"sl",x:"removeFail"}} | 1440, 390 | Journal |
+| loc.l1.removeBlocked | Remove blocked | Spanish has versions | LocaleFrame{s:{v:"sl",x:"removeBlocked"}} | 1440, 390 | Journal |
+| loc.l1.readonly | Read-only view | Non-owner: list and social locale readable; no controls | LocaleFrame{s:{v:"sl",x:"readonly"}} | 1440, 390 | Journal |
+| loc.l1.saved | Saved | After Add language | LocaleFrame{s:{v:"sl",x:"saved"}} | 1440, 390 | Journal |
+| loc.l1.social | Social locale: three states | Atelier: Derived en_GB and pt_BR, Set fr_FR, Not set | LocaleFrame{s:{v:"sl",x:"social"}} | 1440, 1024, 390 | Atelier |
+| loc.l1.socialEdit | Social locale: edit | Edit on French (Set: fr_FR) | LocaleFrame{s:{v:"sl",x:"socialEdit"}} | 1440, 390 | Atelier |
+| loc.l1.socialInvalid | Social locale: invalid | fr-FR typed with a hyphen | LocaleFrame{s:{v:"sl",x:"socialInvalid"}} | 1440, 390 | Atelier |
+
+## L1b Public URL pattern (owner setting)
+Route: /settings/sites/:key/public-url
+API: proposed: GET/PUT /v1/site/{key} { public_url_pattern }
+
+Owner-only. One pattern per site, for example https://example.com/{lang}/{slug}. Supported placeholders: {lang} (language code) and {slug} (the article address in that language). {slug} is required: without it every article would share one address. The preview uses a real article of the site. When unset, article panels show "Public URL not configured" and link here. No URL is invented.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l1b.set | Set | Pattern saved, preview shown | LocaleFrame{s:{v:"pu",x:"set"}} | 1440, 390 | Journal |
+| loc.l1b.editing | Editing | Live preview follows the field | LocaleFrame{s:{v:"pu",x:"editing"}} | 1440, 390 | Journal |
+| loc.l1b.unknown | Unknown placeholder | {language} typed | LocaleFrame{s:{v:"pu",x:"unknown"}} | 1440, 390 | Journal |
+| loc.l1b.scheme | Bad scheme | ftp:// typed | LocaleFrame{s:{v:"pu",x:"scheme"}} | 1440, 390 | Journal |
+| loc.l1b.encoded | Not encoded | A space in the path | LocaleFrame{s:{v:"pu",x:"encoded"}} | 1440, 390 | Journal |
+| loc.l1b.noSlug | Missing {slug} | Pattern without {slug} | LocaleFrame{s:{v:"pu",x:"noSlug"}} | 1440, 390 | Journal |
+| loc.l1b.saved | Saved | Toast | LocaleFrame{s:{v:"pu",x:"saved"}} | 1440, 390 | Journal |
+| loc.l1b.unset | Unset | No pattern; opened from "Public URL not configured" | LocaleFrame{s:{v:"pu",x:"unset"}} | 1440, 390 | Journal |
+| loc.l1b.viewOnly | Read-only view | Non-owner: pattern readable, no controls | LocaleFrame{s:{v:"pu",x:"viewOnly"}} | 1440, 390 | Journal |
+| loc.l1b.invalidHost | Invalid host | Pattern with an empty host label | LocaleFrame{s:{v:"pu",x:"invalidHost"}} | 1440, 390 | Journal |
+
+## L2 First-time setup for existing articles
+Route: /settings/sites/:key/languages/setup
+API: proposed: GET /v1/language/setup, POST /v1/language/setup { sites:[{ key, lang }] } (lang is the full tag, e.g. pt-BR)
+
+Opened from the Languages banner of any site; :key is the site it was opened from, and the page lists every site that still has unlabelled articles. Setup assigns a language per site and applies in one transaction. It never translates, links or moves articles. Each site is seeded from its full Site.Locale when a matching language entry exists: pt-BR becomes Portuguese (Brazil). A site with no locale has no seed and the owner must choose. Nothing applies until the owner confirms every row, including a site with no articles. Retrying is safe.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l2.ready | Ready to assign | Journal (en), Notes (no locale, must choose), Archive (pt-BR kept) | LocaleFrame{s:{v:"su",x:"ready"}} | 1440, 390 | Journal, Notes, Archive |
+| loc.l2.noLocale | No-locale site | Notes only: the owner must choose | LocaleFrame{s:{v:"su",x:"noLocale"}} | 1440, 390 | Notes |
+| loc.l2.empty | Site with no articles | Gallery has no articles; en-GB kept, confirm and Save | LocaleFrame{s:{v:"su",x:"empty"}} | 1440, 390 | Gallery |
+| loc.l2.applying | Applying | Request in flight | LocaleFrame{s:{v:"su",x:"applying"}} | 1440, 390 | Journal, Notes, Archive |
+| loc.l2.inProgress | Setup already running | Another owner started it; starting again is safe | LocaleFrame{s:{v:"su",x:"inProgress"}} | 1440, 390 | Journal, Notes, Archive |
+| loc.l2.done | Done | 16 articles labelled | LocaleFrame{s:{v:"su",x:"done"}} | 1440, 390 | Journal, Notes, Archive |
+| loc.l2.fail | Failed | Nothing changed; choices kept; retry is safe | LocaleFrame{s:{v:"su",x:"fail"}} | 1440, 390 | Journal, Notes, Archive |
+
+## L3 New article
+Route: /articles (New article modal)
+API: existing POST /v1/article/ + proposed lang, story_id
+
+Single-language sites show no language field. Multilingual sites show Language and a New article / Translation of an existing article choice. The translation path uses the same endpoint and rules as Add translation. The picker lists only articles the user can read; the chosen version is the source.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l3.single | Single language | Title and site only | LocaleFrame{s:{v:"na",x:"single"}} | 1440, 390 | Archive |
+| loc.l3.multi | Multilingual: new article | Language defaults to the site default | LocaleFrame{s:{v:"na",x:"multi"}} | 1440, 390 | Journal |
+| loc.l3.translation | Translation of an article | Same fields as Add translation: article, language, source version, title, starting content | LocaleFrame{s:{v:"na",x:"translation"}} | 1440, 390 | Journal |
+| loc.l3.sitechange | Site changed | Selected language not offered by the new site | LocaleFrame{s:{v:"na",x:"sitechange"}} | 1440, 390 | Journal, Notes |
+
+## L4 Add a translation
+Route: /article/{id}/edit?dialog=add-translation&lang=fr
+API: proposed: POST /v1/article/{id}/translations
+
+Always creates a draft. Source: the user picks which readable version to copy from (default: the default-language version if readable, else the first readable). The source version is captured in the same transaction as the copy. Copied text stays in the source language until edited; the version starts as Needs review. Start empty: no tracked source, so freshness shows No source. The primary action stays in the sticky footer on mobile; the body scrolls.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l4.form | Copy from source | Editor → language menu → Add translation | LocaleFrame{s:{v:"at",x:"form"}} | 1440, 390 | Journal |
+| loc.l4.empty | Start empty | Title only; Source version reads No source, Freshness will show No source | LocaleFrame{s:{v:"at",x:"empty"}} | 1440, 390 | Journal |
+| loc.l4.saving | Creating | Submit in flight | LocaleFrame{s:{v:"at",x:"saving"}} | 1440, 390 | Journal |
+| loc.dup.readable | Exists, readable | Conflict; Open offered | LocaleFrame{s:{v:"at",x:"dup"}} | 1440, 390 | Journal |
+| loc.dup.hidden | Exists, not readable | Neutral error, no Open | LocaleFrame{s:{v:"at",x:"dupHidden"}} | 1440, 390 | Journal |
+| loc.l4.fail | Failed | Server error, entries kept | LocaleFrame{s:{v:"at",x:"fail"}} | 1440, 390 | Journal |
+| loc.l4.gone | Source deleted | Deleted while the dialog was open: same neutral message as unreadable, no distinction shown | LocaleFrame{s:{v:"at",x:"gone"}} | 1440, 390 | Journal |
+| loc.l4.unreadable | Source no longer readable | Access lost between opening and submitting: same neutral message as deleted | LocaleFrame{s:{v:"at",x:"unreadable"}} | 1440, 390 | Journal |
+| loc.l4.langOff | Language disabled mid-flow | An owner disabled French while the dialog was open | LocaleFrame{s:{v:"at",x:"langOff"}} | 1440, 390 | Journal |
+| loc.l4.long | Long dialog | Long title, many authors and images; body scrolls, footer stays | LocaleFrame{s:{v:"at",x:"long"}} | 1440, 390 | Journal |
+
+## L5 Editor: header, actions and title
+Route: /article/{id}/edit (one id per version)
+API: proposed: GET /v1/article/{id} → translations[], capabilities[]
+
+Header priority and the action matrix are in the tables below. One filled primary button at most: Save and publish when allowed, dirty and offline; otherwise Save when dirty; otherwise Publish when clean and offline. Save stays separate and secondary. Desktop collapse order as width shrinks (1440 → 1024): reference button loses its label, Unpublish moves to the overflow menu, the freshness badge becomes icon-only. Mobile: title, language, publication and dirty badges stay at the top; Save, primary and an overflow button sit in a fixed bottom bar; reference, Unpublish, Edit slug, Move and Delete go to the overflow sheet. The language control is a menu button with a menu (not a listbox).
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l5.default | Clean draft | Open a draft you can publish; title pristine | LocaleFrame{s:{v:"ed",x:"default"}} | 1440, 1024, 390 | Journal |
+| loc.l5.dirty | Dirty draft | Can edit, can't publish: Save is primary | LocaleFrame{s:{v:"ed",x:"dirty"}} | 1440, 1024, 390 | Journal |
+| loc.l5.dirtyPublish | Dirty draft, publish allowed | Save and publish French is primary; Save secondary | LocaleFrame{s:{v:"ed",x:"dirtyPublish"}} | 1440, 1024, 390 | Journal |
+| loc.l5.cleanOnline | Clean online | Unpublish only; no primary | LocaleFrame{s:{v:"ed",x:"cleanOnline"}} | 1440, 1024, 390 | Journal |
+| loc.l5.onlineDirty | Dirty online | Save updates the live page; Unpublish stays | LocaleFrame{s:{v:"ed",x:"onlineDirty"}} | 1440, 1024, 390 | Journal |
+| loc.l5.saving | Saving | Save in flight | LocaleFrame{s:{v:"ed",x:"saving"}} | 1440, 390 | Journal |
+| loc.l5.saved | Saved | Toast | LocaleFrame{s:{v:"ed",x:"saved"}} | 1440, 390 | Journal |
+| loc.l5.saveFail | Save failed | Stays unsaved; Try saving again; nothing published | LocaleFrame{s:{v:"ed",x:"saveFail"}} | 1440, 1024, 390 | Journal |
+| loc.l5.pubFail | Publish failed after save | Saved as a draft; Retry publish; edits shown as saved | LocaleFrame{s:{v:"ed",x:"pubFail"}} | 1440, 1024, 390 | Journal |
+| loc.l5.ovf | Overflow menu | More actions (sheet on mobile) | LocaleFrame{s:{v:"ed",x:"ovf"}} | 1440, 390 | Journal |
+| loc.l5.menu | Menu: four languages | Open menu | LocaleFrame{s:{v:"ed",x:"menu"}} | 1440, 390 | Journal |
+| loc.l5.two | Menu: two languages | Two-language site | LocaleFrame{s:{v:"ed",x:"two"}} | 1440, 390 | Journal |
+| loc.l5.many | Menu: many languages | Scrolls inside the viewport, with filter | LocaleFrame{s:{v:"ed",x:"many"}} | 1440, 390 | Journal |
+| loc.l5.unsaved | Switch with unsaved changes | Choose English while dirty | LocaleFrame{s:{v:"ed",x:"unsaved"}} | 1440, 390 | Journal |
+| loc.l5.loading | Loading version | Slow switch | LocaleFrame{s:{v:"ed",x:"loading"}} | 1440, 390 | Journal |
+| loc.l5.navFail | Switch failed | Stays on current version | LocaleFrame{s:{v:"ed",x:"navFail"}} | 1440, 390 | Journal |
+| loc.l5.gone | Version unavailable | Deleted or no access (neutral) | LocaleFrame{s:{v:"ed",x:"gone"}} | 1440, 390 | Journal |
+| loc.l5.focus | Title: focus | Field focused, not changed | LocaleFrame{s:{v:"ed",x:"focus"}} | 1440, 390 | Journal |
+| loc.l5.titleEdit | Title: editing | Typing; counter shown | LocaleFrame{s:{v:"ed",x:"titleEdit"}} | 1440, 390 | Journal |
+| loc.l5.titleUnsaved | Title: unsaved | Changed, focus left | LocaleFrame{s:{v:"ed",x:"titleUnsaved"}} | 1440, 390 | Journal |
+| loc.l5.invalid | Title: invalid | Empty: "Enter a title" | LocaleFrame{s:{v:"ed",x:"invalid"}} | 1440, 390 | Journal |
+| loc.l5.titleShort | Title: too short | Under 3 characters | LocaleFrame{s:{v:"ed",x:"titleShort"}} | 1440, 390 | Journal |
+| loc.l5.titleLong | Title: too long | Over 200 characters | LocaleFrame{s:{v:"ed",x:"titleLong"}} | 1440, 390 | Journal |
+| loc.l5.titleSaving | Title: saving | Save in flight | LocaleFrame{s:{v:"ed",x:"titleSaving"}} | 1440, 390 | Journal |
+| loc.l5.failed | Title: save failed | Text kept, still unsaved, Try again | LocaleFrame{s:{v:"ed",x:"failed"}} | 1440, 390 | Journal |
+| loc.l5.menuDisabled | Language menu with a disabled language | Spanish is disabled: Disabled tag, version stays readable | LocaleFrame{s:{v:"ed",x:"menuDisabled"}} | 1440, 390 | Journal |
+
+## L5b Permission states (per version)
+Route: /article/{id}/edit
+API: capabilities[] on GET /v1/article/{id}; every PATCH/DELETE rechecked on the server
+
+Every action renders from its own capability (read, edit, publish, delete, create translation, review). See the capability matrix. Missing-translation rows appear only for users who can create; unreadable siblings are absent with no placeholder and no count. The formatting toolbar is hidden whenever edit is missing.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.perm.readonly | P1 Read-only version | Banner, read-only fields, no Save, Publish, Delete, toolbar; reference stays | LocaleFrame{s:{v:"perm",x:"ro"}} | 1440, 1024, 390 | Journal |
+| loc.l5b.roMenu | P1 menu | No Add translation row | LocaleFrame{s:{v:"perm",x:"roMenu"}} | 1440, 390 | Journal |
+| loc.perm.editNoPublish | P2 Edit, no publish | Save only; hint about the publish permission | LocaleFrame{s:{v:"perm",x:"p2"}} | 1440, 1024, 390 | Journal |
+| loc.perm.publishNoEdit | P3 Publish, no edit | Publish only; fields read-only | LocaleFrame{s:{v:"perm",x:"p3"}} | 1440, 1024, 390 | Journal |
+| loc.perm.siblingReadOnly | P4 Sibling readable, not editable | Arabic row tagged Read only | LocaleFrame{s:{v:"perm",x:"p4"}} | 1440, 390 | Journal |
+| loc.perm.siblingHidden | P5 Sibling not readable | German absent, no count, no placeholder | LocaleFrame{s:{v:"perm",x:"p5"}} | 1440, 390 | Journal |
+| loc.perm.createNotAll | P6 Can create, not modify all | Delete article and Move disabled with the reason; Delete French version available | LocaleFrame{s:{v:"perm",x:"p6"}} | 1440, 390 | Journal |
+| loc.l5b.noAdd | Menu without Add translation | No create permission; Arabic is missing but offers nothing | LocaleFrame{s:{v:"perm",x:"noAdd"}} | 1440, 390 | Journal |
+| loc.l5b.withAdd | Menu with Add translation | Same article, user may create | LocaleFrame{s:{v:"perm",x:"withAdd"}} | 1440, 390 | Journal |
+
+## L6 Source reference (release 2) (release 2)
+Route: /article/{id}/edit?ref=:sourceId
+API: proposed: GET /v1/article/{id} (read-only fetch of the reference)
+
+Release 2. The temporary reference (?ref=, dashed outline, "Temporary reference") and the tracked review source (solid "Tracked source" badge in the review banner) are separate: changing the reference never changes the tracked source. Show source reference is in the editor header (desktop, icon-only at 1024) and the overflow sheet (mobile). Each pane scrolls independently. dir and lang go on the title and body of the editing pane and of the reference, never on the app shell.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l6.split | Side by side | Show source reference | LocaleFrame{s:{v:"src",x:"split"}} | 1440, 1024, 390 | Journal |
+| loc.l6.closed | Reference hidden | Hide source reference; button returns | LocaleFrame{s:{v:"src",x:"closed"}} | 1440, 390 | Journal |
+| loc.l6.reopen | Reopened | Scroll positions kept | LocaleFrame{s:{v:"src",x:"reopen"}} | 1440, 390 | Journal |
+| loc.l6.changeRef | Change reference | Menu; tracked source stays English | LocaleFrame{s:{v:"src",x:"changeRef"}} | 1440, 390 | Journal |
+| loc.l6.narrow | Narrow desktop (1024) | True 1024 frame | LocaleFrame{s:{v:"src",x:"narrow"}} | 1024, 390 | Journal |
+| loc.l6.long | Long content | Both panes scroll independently | LocaleFrame{s:{v:"src",x:"long"}} | 1440, 390 | Journal |
+| loc.l6.rtl | Arabic editing, English reference | dir=rtl on the Arabic title and body only | LocaleFrame{s:{v:"src",x:"rtl"}} | 1440, 390 | Journal |
+| loc.l6.arRef | French editing, Arabic reference | dir=rtl on the reference pane only | LocaleFrame{s:{v:"src",x:"arRef"}} | 1440, 390 | Journal |
+| loc.l6.mobileEdit | Mobile: editing | Segment | LocaleFrame{s:{v:"src",x:"mobileEdit"}} | 1440, 390 | Journal |
+| loc.l6.mobileSrc | Mobile: source | Segment | LocaleFrame{s:{v:"src",x:"mobileSrc"}} | 1440, 390 | Journal |
+| loc.l6.mobileClosed | Mobile: closed | Show source reference in the bottom bar or sheet | LocaleFrame{s:{v:"src",x:"mobileClosed"}} | 1440, 390 | Journal |
+| loc.l6.unavail | Reference unavailable | Deleted or unreadable | LocaleFrame{s:{v:"src",x:"unavail"}} | 1440, 390 | Journal |
+
+## L7 Article list and coverage
+Route: /articles?site&lang&tab=all|missing|review&q&status&author&seo&page&size
+API: proposed: lang, tab=all|missing|review on GET /v1/article/ (same names as the URL)
+
+Journal: 8 articles, 17 versions, page size 5. The list header shows the unit: "8 articles" (all languages, one row per article with its translations), "4 French versions" (language selected), "4 articles not in French" (missing tab), "7 articles need translation", "2 articles need review". Coverage chips: default language first, then other existing versions, then disabled-language versions, then dashed missing chips (only for languages the user can create). Chips collapse after 5 at 1440 and 4 at 1024 and 390, leaving a "+N" chip. Row actions are the same on every width: Open, Open another language, Add translation, Publish or Unpublish, Copy API URL, Delete version; every row has the row menu button. All state is in the URL.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l7.all | All languages, page 1 | 5 of 8 articles | LocaleFrame{s:{v:"li",x:"all"}} | 1440, 1024, 390 | Journal |
+| loc.l7.page2 | All languages, page 2 (last) | 3 of 8 articles | LocaleFrame{s:{v:"li",x:"page2"}} | 1440, 1024, 390 | Journal |
+| loc.l7.fr | French selected | 4 French versions | LocaleFrame{s:{v:"li",x:"fr"}} | 1440, 1024, 390 | Journal |
+| loc.l7.frMissing | Not in French | 4 articles not in French | LocaleFrame{s:{v:"li",x:"frMissing"}} | 1440, 1024, 390 | Journal |
+| loc.l7.emptyMissing | Nothing missing | Press: all articles translated; no summary, no pager | LocaleFrame{s:{v:"li",x:"emptyMissing"}} | 1440, 1024, 390 | Press |
+| loc.l7.noResults | No results | Search "zinc"; every count 0 | LocaleFrame{s:{v:"li",x:"noResults"}} | 1440, 1024, 390 | Journal |
+| loc.l7.frLoading | Loading | Counts shown as – | LocaleFrame{s:{v:"li",x:"frLoading"}} | 1440, 1024, 390 | Journal |
+| loc.l7.listFail | Failed | Filters kept | LocaleFrame{s:{v:"li",x:"listFail"}} | 1440, 1024, 390 | Journal |
+| loc.l7.limited | Limited access | Reads English only, can't create: no dashed chips | LocaleFrame{s:{v:"li",x:"limited"}} | 1440, 1024, 390 | Journal (limited scope) |
+| loc.l7.review | Needs review tab | 2 articles need review | LocaleFrame{s:{v:"li",x:"review"}} | 1440, 1024, 390 | Journal |
+| loc.l7.author | Author filter | Marta Alves: 3 articles, chips and Clear all | LocaleFrame{s:{v:"li",x:"author"}} | 1440, 1024, 390 | Journal |
+| loc.l7.langFilter | Language filter | Enabled and Disabled groups | LocaleFrame{s:{v:"li",x:"langFilter"}} | 1440, 1024, 390 | Journal |
+| loc.l7.rowMenu | Row menu | Same actions on desktop and mobile | LocaleFrame{s:{v:"li",x:"rowMenu"}} | 1440, 1024, 390 | Journal |
+| loc.l7.filters | Mobile filter sheet | Journal, French, Draft: 2 results | LocaleFrame{s:{v:"li",x:"filters"}} | 1440, 1024, 390 | Journal |
+| loc.l7.tabsScroll | Tabs scrolled | Not in French reachable; fade and chevrons | LocaleFrame{s:{v:"li",x:"tabsScroll"}} | 1440, 390 | Journal |
+| loc.l7.long | Eight languages, long labels, filters | Atelier: chips collapse to +3, +4, +4; Draft and SEO filters | LocaleFrame{s:{v:"li",x:"long"}} | 1440, 1024, 390 | Atelier |
+
+## L7s Article list, single-language site
+Route: /articles?site=archive&q&status&page&size
+API: GET /v1/article/?page=&size=&q=&status=&site= returns { items, total, page, size, counts }
+
+Replaces the old Articles board frames as the pixel-gate reference for the list. A site with one language has no language filter, no coverage column, no Needs translation or Needs review tabs, and its menu labels name no language. The pager is AppPaginator: summary "Showing 1–5 of 5", rows-per-page select, first, previous, page numbers, next and last (390 px: summary and select, then Previous, "Page N of M", Next). Hidden controls when everything fits on one page; the summary stays.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l7s.default | Default | Archive: 5 articles on one page, no language filter, coverage column or tabs | LocaleFrame{s:{v:"li",x:"single"}} | 1440, 390 | Archive |
+| loc.l7s.draft | Draft filter | Status: Draft | LocaleFrame{s:{v:"li",x:"singleDraft"}} | 1440, 390 | Archive |
+| loc.l7s.noResults | No results | Search "zinc" | LocaleFrame{s:{v:"li",x:"singleNoResults"}} | 1440, 390 | Archive |
+| loc.l7s.empty | Empty | Gallery: no articles | LocaleFrame{s:{v:"li",x:"singleEmpty"}} | 1440, 390 | Gallery |
+| loc.l7s.loading | Loading | Counts shown as – | LocaleFrame{s:{v:"li",x:"singleLoading"}} | 1440, 390 | Archive |
+| loc.l7s.fail | Failed | Filters kept | LocaleFrame{s:{v:"li",x:"singleFail"}} | 1440, 390 | Archive |
+| loc.l7s.menu | Row menu | Open, Unpublish, Copy API URL, Delete article: no language named | LocaleFrame{s:{v:"li",x:"singleMenu"}} | 1440, 390 | Archive |
+
+## L8 Publishing and deletion
+Route: same as the editor
+API: existing PATCH /v1/article/{id}/publish and /unpublish and DELETE per article id
+
+Every action names its language. No bulk publish. With unsaved edits the primary reads Save and publish and saves first; if the save fails nothing is published and the edits stay unsaved; if the save works and publishing fails the edits show as saved. Unpublish never saves: the saved version goes offline and local edits stay in the editor. Saving an online version updates the live page immediately, and the editor says so. Deletion confirmations name only readable versions.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l8.publish | Publish French | Confirm, English untouched | LocaleFrame{s:{v:"pd",x:"publish"}} | 1440, 390 | Journal |
+| loc.lang.publishDisabled | Publishing blocked: language disabled | French disabled on the site | LocaleFrame{s:{v:"pd",x:"publishDisabled"}} | 1440, 390 | Journal |
+| loc.l8.saveAndPublish | Save and publish French | Unsaved edits: saves first, then publishes | LocaleFrame{s:{v:"pd",x:"saveAndPublish"}} | 1440, 390 | Journal |
+| loc.l8.saveFailPublish | Save failed, nothing published | Error banner above the editor and an error toast; Save failed badge, primary Try saving again, edits kept, nothing published | LocaleFrame{s:{v:"pd",x:"saveFailPublish"}} | 1440, 390 | Journal |
+| loc.l8.unpublish | Unpublish French | Confirm | LocaleFrame{s:{v:"pd",x:"unpublish"}} | 1440, 390 | Journal |
+| loc.l8.unpublishDirty | Unpublish with unsaved edits | Saved version goes offline; edits kept; nothing saved | LocaleFrame{s:{v:"pd",x:"unpublishDirty"}} | 1440, 390 | Journal |
+| loc.l8.delete | Delete French version | Confirm | LocaleFrame{s:{v:"pd",x:"delete"}} | 1440, 390 | Journal |
+| loc.l8.deleteSource | Delete a source version | Names the readable versions that track the source; warns review tracking pauses | LocaleFrame{s:{v:"pd",x:"deleteSource"}} | 1440, 390 | Journal |
+| loc.l8.deleteLast | Delete the only version | Deletes the article | LocaleFrame{s:{v:"pd",x:"deleteLast"}} | 1440, 390 | Journal |
+| loc.l8.deleteStoryOk | Delete article (all readable versions) | Names readable versions only | LocaleFrame{s:{v:"pd",x:"deleteStoryOk"}} | 1440, 390 | Journal |
+| loc.l8.deleteStory | Delete article blocked | Neutral, no version named | LocaleFrame{s:{v:"pd",x:"deleteStory"}} | 1440, 390 | Journal |
+| loc.l8.done | Published | Toast "French published" and the online banner; badge Published, status Saved | LocaleFrame{s:{v:"pd",x:"done"}} | 1440, 390 | Journal |
+| loc.l8.fail | Publish failed | Toast | LocaleFrame{s:{v:"pd",x:"fail"}} | 1440, 390 | Journal |
+| loc.l8.deleteDone | French version deleted | Toast; editor opens English | LocaleFrame{s:{v:"pd",x:"deleteDone"}} | 1440, 390 | Journal |
+| loc.l8.deleteStoryFail | Delete article failed | Dialog error; nothing deleted | LocaleFrame{s:{v:"pd",x:"deleteStoryFail"}} | 1440, 390 | Journal |
+| loc.l8.deleteStoryDone | Article deleted | Toast on the Articles list | LocaleFrame{s:{v:"li",x:"deleteStoryDone"}} | 1440, 390 | Journal |
+
+## L9 Freshness and review (release 2) (release 2)
+Route: editor banner · list badge
+API: proposed: POST /v1/article/{id}/review { source_article_id, source_revision, translation_revision } (internal fields; never shown)
+
+Release 2. Publication (solid badge) and freshness (outlined badge with refresh icon) are separate. Labels: No version, Draft, Needs review, Reviewed. A copied draft starts as Needs review. The dialog shows "Changed fields: Title, Body", the source version with its date and the translation version with its date. No revision numbers appear in the UI.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l9.warn | Source updated | English changed after review | LocaleFrame{s:{v:"fr",x:"warn"}} | 1440, 390 | Journal |
+| loc.l9.pub | Published, needs review | Still online | LocaleFrame{s:{v:"fr",x:"pub"}} | 1440, 390 | Journal |
+| loc.l9.review | Mark reviewed | Confirm with changed fields and dates | LocaleFrame{s:{v:"fr",x:"review"}} | 1440, 390 | Journal |
+| loc.review.changed | Source changed again | During the review | LocaleFrame{s:{v:"fr",x:"changed"}} | 1440, 390 | Journal |
+| loc.l9.changedTr | Translation changed | Saved by someone else while confirming | LocaleFrame{s:{v:"fr",x:"changedTr"}} | 1440, 390 | Journal |
+| loc.l9.replace | Choose tracked source | Cycle prevented | LocaleFrame{s:{v:"fr",x:"replace"}} | 1440, 390 | Journal |
+| loc.src.inaccessible | Source unavailable (access) | History kept | LocaleFrame{s:{v:"fr",x:"inaccessible"}} | 1440, 390 | Journal |
+| loc.src.deleted | Source deleted | Choose a new source | LocaleFrame{s:{v:"fr",x:"gone"}} | 1440, 390 | Journal |
+| loc.l9.done | Reviewed | Toast | LocaleFrame{s:{v:"fr",x:"done"}} | 1440, 390 | Journal |
+| loc.l9.fail | Review failed | Toast | LocaleFrame{s:{v:"fr",x:"fail"}} | 1440, 390 | Journal |
+| loc.l9.frReview | Published and needs review in the list | French tab, Needs review: 2 versions | LocaleFrame{s:{v:"li",x:"frReview"}} | 1440, 1024, 390 | Journal |
+
+## L10 Metadata and public API
+Route: Search and sharing panel · /integration
+API: existing slug, SEO fields; proposed alternates[], lang; exact lookup by site + lang + slug; resolution by story_id
+
+Slug is unique per (site, lang). Exact lookup is by site + language + slug and never falls back. Language resolution and fallback use the stable story_id. Website URLs come from the site's Public URL pattern; without it the panel says "Public URL not configured" and links to the setting. Canonical is the localized page itself unless an override is set. SEO labels: "Fallback: French title", "No fallback", "Empty. English site default not used."
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.seo.noFallback | Search and sharing: French | Search and sharing slide-over on the editor: localized slug, canonical, alternates, fallback labels, Edit slug | LocaleFrame{s:{v:"seo",x:""}} | 1440, 390 | Journal |
+| loc.slug.published | Edit slug | Edit slug dialog over the Search and sharing slide-over: published version warns about old links | LocaleFrame{s:{v:"seo",x:"editSlug"}} | 1440, 390 | Journal |
+| loc.url.unset | Public URL not configured | Search and sharing slide-over: no pattern, no fabricated URL | LocaleFrame{s:{v:"seo",x:"unset"}} | 1440, 390 | Journal |
+| loc.l10.noSocial | Social locale not set | Search and sharing slide-over: fr has no region and none is set, og:locale omitted | LocaleFrame{s:{v:"seo",x:"noSocial"}} | 1440, 390 | Journal |
+| loc.l10.api | Integration: languages | Integration page: exact lookup, resolve by article group, errors | LocaleFrame{s:{v:"api",x:""}} | 1440, 390 | Journal |
+
+## L11 Conflicts and sessions
+Route: editor
+API: existing 401/403/404/409 patterns
+
+The conflict dialog gives four choices. Keep my changes is the only filled button; the other three are secondary and equal. "Someone else saved this version at <time>". No revision numbers. On mobile the dialog is a bottom sheet with Keep my changes first, so it needs no scrolling at 390 px.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l11.session | Session expired | Draft kept in this browser; editor behind shows the unsaved changes | LocaleFrame{s:{v:"pm",x:"session"}} | 1440, 390 | Journal |
+| loc.l11.restored | Restored after login | Editor shows "Restored unsaved changes from 14:18" | LocaleFrame{s:{v:"pm",x:"restored"}} | 1440, 390 | Journal |
+| loc.conflict | Concurrent update | Four choices, local work kept; Save over theirs outlined in error colour with a warning icon | LocaleFrame{s:{v:"pm",x:"conflict"}} | 1440, 390 | Journal |
+| loc.l11.conflictRestored | Concurrent update after session expiry | Restored changes notice above the choices | LocaleFrame{s:{v:"pm",x:"conflictRestored"}} | 1440, 390 | Journal |
+| loc.l11.reloadConfirm | Reload theirs: confirm | "This discards your unsaved changes." | LocaleFrame{s:{v:"pm",x:"reloadConfirm"}} | 1440, 390 | Journal |
+| loc.l11.conflict2 | Second conflict | Save over theirs failed again; nothing overwritten | LocaleFrame{s:{v:"pm",x:"conflict2"}} | 1440, 390 | Journal |
+| loc.l11.download | Download started | Toast; changes still in the editor | LocaleFrame{s:{v:"pm",x:"download"}} | 1440, 390 | Journal |
+
+## L11b Move article to another site
+Route: editor → site select
+API: proposed: POST /v1/story/{story_id}/move { site }
+
+Entry point is the site select in the editor details. Articles move as a whole, only when the destination enables every language they contain (disabled ones included) and the user can edit all versions. The note lists readable versions only; versions the user can't read are not listed or counted. Moves are atomic and revalidate permissions and conflicts in the transaction.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l11b.moveSelect | Site select | Note lists all four versions, one tagged Read only | LocaleFrame{s:{v:"pm",x:"moveSelect"}} | 1440, 390 | Journal |
+| loc.l11b.moveSelectHidden | Site select, hidden version | Arabic not readable: not listed or counted | LocaleFrame{s:{v:"pm",x:"moveSelectHidden"}} | 1440, 390 | Journal |
+| loc.l11b.moveConfirm | Confirm | Move to Atelier? | LocaleFrame{s:{v:"pm",x:"moveConfirm"}} | 1440, 390 | Journal |
+| loc.l11b.moveBusy | In progress | Dialog locked | LocaleFrame{s:{v:"pm",x:"moveBusy"}} | 1440, 390 | Journal |
+| loc.l11b.moveDone | Moved | Toast | LocaleFrame{s:{v:"pm",x:"moveDone"}} | 1440, 390 | Journal |
+| loc.l11b.move | Language missing in destination | Notes enables English only | LocaleFrame{s:{v:"pm",x:"move"}} | 1440, 390 | Journal, Notes |
+| loc.l11b.moveSlug | Address conflict | Names the conflicting readable version and its address; unreadable ones are never named | LocaleFrame{s:{v:"pm",x:"moveSlug"}} | 1440, 390 | Journal, Atelier |
+| loc.l11b.movePerm | No permission | Neutral | LocaleFrame{s:{v:"pm",x:"movePerm"}} | 1440, 390 | Journal |
+| loc.l11b.moveFail | Move failed | Server error, nothing moved | LocaleFrame{s:{v:"pm",x:"moveFail"}} | 1440, 390 | Journal |
+
+## L12 Existing surfaces
+Route: Home · Activity · Media · editor details
+API: existing; language added where it applies
+
+Single-language sites show none of this. Home counts articles, not versions.
+
+| ID | State | Trigger | Selector | Sizes | Fixture |
+|---|---|---|---|---|---|
+| loc.l12.home | Home: recent articles | Default-language title; code only when not default | LocaleFrame{s:{v:"sf",x:"home"}} | 1440, 1024, 390 | Journal |
+| loc.l12.homeFr | Home: reader of French only | Titles in French with code FR | LocaleFrame{s:{v:"sf",x:"homeFr"}} | 1440, 1024, 390 | Journal |
+| loc.l12.activity | Activity | Events name the language | LocaleFrame{s:{v:"sf",x:"activity"}} | 1440, 1024, 390 | Journal |
+| loc.l12.media | Media usage | Media page with the image detail panel: shared image counted once, versions listed, "Used in 2" | LocaleFrame{s:{v:"sf",x:"media"}} | 1440, 1024, 390 | Journal |
+| loc.l12.mediaElsewhere | Media usage: used elsewhere only | Image used only as an author avatar: badge "Used in 1", "Articles" with "No article shows it.", "Used elsewhere" with Author avatar linking to /authors | LocaleFrame{s:{v:"sf",x:"mediaElsewhere"}} | 1440, 390 | Journal |
+| loc.l12.menu | Article menu labels | Articles list, French selected: row menu names the language (Publish French, Delete French version). Bottom sheet at 390 | LocaleFrame{s:{v:"li",x:"menuLang"}} | 1440, 390 | Journal |
+| loc.l12.apiCopy | API URL copy | Articles list: toast after Copy API URL with the ?lang= address. Bottom toast at 390 | LocaleFrame{s:{v:"li",x:"apiCopy"}} | 1440, 390 | Journal |
+| loc.l12.seoPreview | SEO preview | Search and sharing slide-over: localized address and canonical | LocaleFrame{s:{v:"seo",x:"preview"}} | 1440, 390 | Journal |
+| loc.l12.siteFallback | Site text fallback | Search and sharing slide-over: site text used only in its own language | LocaleFrame{s:{v:"seo",x:"siteFallback"}} | 1440, 390 | Journal |
+
+### Legacy IDs kept
+| Canonical ID | Alias |
+|---|---|
+| loc.lang.disableDefault | loc.l1.disableDefault |
+| loc.lang.disableLast | loc.l1.disableLast |
+| loc.dup.readable | loc.l4.dup |
+| loc.dup.hidden | loc.l4.dupHidden |
+| loc.perm.readonly | loc.l5b.ro |
+| loc.perm.editNoPublish | loc.l5b.p2 |
+| loc.perm.publishNoEdit | loc.l5b.p3 |
+| loc.perm.siblingReadOnly | loc.l5b.p4 |
+| loc.perm.siblingHidden | loc.l5b.p5 |
+| loc.perm.createNotAll | loc.l5b.p6 |
+| loc.lang.publishDisabled | loc.l8.publishDisabled |
+| loc.review.changed | loc.l9.changed |
+| loc.src.inaccessible | loc.l9.inaccessible |
+| loc.src.deleted | loc.l9.gone |
+| loc.seo.noFallback | loc.l10.default |
+| loc.slug.published | loc.l10.editSlug |
+| loc.url.unset | loc.l10.unset |
+| loc.conflict | loc.l11.conflict |
+
+### Added in the third localization pass
+New: L5:ed:menuDisabled, L1b:pu:invalidHost, L8:pd:deleteDone, L8:pd:deleteStoryFail, L8:li:deleteStoryDone, L11b:pm:moveFail, L12:sf:mediaElsewhere, L7s:li (default, draft, noResults, empty, loading, fail, menu). Moved selector, same ID: loc.l12.menu, loc.l12.apiCopy, loc.l12.seoPreview, loc.l12.siteFallback.
+
+### Changes against the previous 109
+Added (70): L1:sl:broader, L1:sl:defaultFail, L1:sl:stale, L1:sl:reenableDone, L1:sl:reenableFail, L1:sl:removeFail, L1:sl:social, L1:sl:socialEdit, L1:sl:socialInvalid, L1b:pu:set, L1b:pu:editing, L1b:pu:unknown, L1b:pu:scheme, L1b:pu:encoded, L1b:pu:noSlug, L1b:pu:saved, L1b:pu:unset, L1b:pu:viewOnly, L2:su:noLocale, L2:su:inProgress, L4:at:unreadable, L4:at:langOff, L5:ed:cleanOnline, L5:ed:pubFail, L5:ed:ovf, L5:ed:titleEdit, L5:ed:titleUnsaved, L5:ed:titleShort, L5:ed:titleLong, L5b:perm:ro, L5b:perm:roMenu, L5b:perm:p2, L5b:perm:p3, L5b:perm:p4, L5b:perm:p5, L5b:perm:p6, L5b:perm:noAdd, L5b:perm:withAdd, L6:src:arRef, L7:li:page2, L7:li:review, L7:li:author, L7:li:langFilter, L7:li:rowMenu, L8:pd:publishDisabled, L8:pd:unpublishDirty, L8:pd:deleteStoryOk, L9:li:frReview, L10:seo:editSlug, L11:pm:restored, L11:pm:conflictRestored, L11:pm:reloadConfirm, L11:pm:conflict2, L11:pm:download, L11b:pm:moveSelect, L11b:pm:moveSelectHidden, L11b:pm:moveConfirm, L11b:pm:moveBusy, L11b:pm:moveDone, L11b:pm:move, L11b:pm:moveSlug, L11b:pm:movePerm, L12:sf:home, L12:sf:homeFr, L12:sf:activity, L12:sf:media, L12:sf:menu, L12:sf:apiCopy, L12:sf:seoPreview, L12:sf:siteFallback
+
+Changed (rekeyed to a new group or frame, same meaning): L5b|ed|ro, L5b|ed|roMenu, L5b|ed|p2, L5b|ed|p3, L5b|ed|p4, L5b|ed|p5, L5b|ed|p6, L11|pm|move, L11|pm|moveSlug, L11|pm|movePerm
+
+Removed without replacement: none.
+
+Kept unchanged: 99.

docs/development.md

@@ -75,7 +75,7 @@ task clean           # remove bin/, tmp/ and the built SPA
 - A few tests open a real SQLite file in a temporary directory (the chunked id lookups, the slug backfill and the `?seo=` measurement). They never touch the real database.
 - The tests that need a real MySQL, MariaDB or PostgreSQL server skip themselves when `RENEWCMS_TEST_MYSQL_DSN` or `RENEWCMS_TEST_POSTGRES_DSN` is unset. No CI exists, so run them by hand before a release that touches the repositories:
   - `task test:mysql` runs `mysql:8.4` then `mariadb:11` in Docker, and `task test:postgres` runs `postgres:16` then `postgres:17`. Docker is required; the tasks start and remove the containers. Extra arguments go after `--`, for example `task test:postgres -- -run Postgres.*Chunked -v`.
-  - To use your own server on a scratch database: `RENEWCMS_TEST_MYSQL_DSN='user:pass@tcp(host:3306)/db' go test -tags nofrontend ./test/... -run MySQL -count=1`, or `RENEWCMS_TEST_POSTGRES_DSN='postgres://user:pass@host:5432/db?sslmode=disable' go test -tags nofrontend ./test/... -run Postgres -count=1`.
+  - To use your own server on a scratch database: `RENEWCMS_TEST_MYSQL_DSN='user:pass@tcp(host:3306)/db' go test -tags nofrontend ./test/... -run 'MySQL|TestLocalizationPersistence' -count=1`, or `RENEWCMS_TEST_POSTGRES_DSN='postgres://user:pass@host:5432/db?sslmode=disable' go test -tags nofrontend ./test/... -run 'Postgres|TestLocalizationPersistence' -count=1`. `TestLocalizationPersistence` runs one subtest per backend (`sqlite/…`, `mysql/…`, `postgres/…`), so it is part of both runs.
   - `TestMySQLChunkedLookups` and `TestPostgresChunkedLookups` check that the batched `IN` lookups of the article repository (500 ids per batch) return the same rows as SQLite.
 
 ## Visual check against the design

docs/docker.md

@@ -21,7 +21,7 @@ Requirements: Docker with Compose v2. [task](https://taskfile.dev) is optional f
    docker compose up -d
    ```
 
-   `docker-compose.yml` uses `image: ${RENEWCMS_IMAGE:-git.floriansylvain.fr/fsylvain/renewcms:beta}`. The default tag is `beta` because `latest` does not exist until the first stable release (the default changes to `latest` then). Set `RENEWCMS_IMAGE` in your shell or in a `.env` file next to the compose file to pin another tag, for example `RENEWCMS_IMAGE=git.floriansylvain.fr/fsylvain/renewcms:v3.2.1-beta`.
+   `docker-compose.yml` uses `image: ${RENEWCMS_IMAGE:-git.floriansylvain.fr/fsylvain/renewcms:beta}`. The default tag is `beta` because `latest` does not exist until the first stable release (the default changes to `latest` then). Set `RENEWCMS_IMAGE` in your shell or in a `.env` file next to the compose file to pin another tag, for example `RENEWCMS_IMAGE=git.floriansylvain.fr/fsylvain/renewcms:v3.7.0-beta`.
 
    To build from the local sources instead, see [Building from source](#building-from-source).
 
@@ -50,7 +50,7 @@ docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build
 | Release | Tags pushed |
 |---|---|
 | `vX.Y.Z` (stable) | `vX.Y.Z`, `X.Y.Z`, `X.Y`, `latest` |
-| `vX.Y.Z-<pre>` (for example `v3.2.1-beta`, `v3.2.1-rc.1`) | `vX.Y.Z-<pre>`, `X.Y.Z-<pre>`, and the moving tag `<pre-name>` (`beta`, `rc`) |
+| `vX.Y.Z-<pre>` (for example `v3.7.0-beta`, `v3.7.0-rc.1`) | `vX.Y.Z-<pre>`, `X.Y.Z-<pre>`, and the moving tag `<pre-name>` (`beta`, `rc`) |
 
 A pre-release never moves `latest`. Images are published for `linux/amd64` and `linux/arm64`. `renewcms --version` in the image prints the exact release tag. Images are not signed; the Ed25519 key signs the release binaries only.
 
@@ -198,7 +198,7 @@ Publishing is a manual, maintainer-run task, like `task release`. There is no CI
 1. Tag the release and keep the work tree clean:
 
    ```sh
-   git tag v3.2.1-beta
+   git tag v3.7.0-beta
    ```
 
 2. Log in once to the registry. The task never reads or stores credentials:
@@ -226,7 +226,7 @@ Publishing is a manual, maintainer-run task, like `task release`. There is no CI
 
 ```sh
 task docker:publish -- --dry-run
-task docker:publish VERSION=v3.2.1-rc.1 -- --dry-run
+task docker:publish VERSION=v3.7.0-rc.1 -- --dry-run
 ```
 
 The dry run builds for the host platform only, loads the image into the local Docker, pushes nothing and needs no login. It prints the tags a real run would push. A `VERSION` override is accepted only with `--dry-run`, and a dirty tree is allowed there. Remove the loaded images afterwards with `docker rmi`.

docs/getting-started.md

@@ -0,0 +1,184 @@
+# Getting started
+
+Get a RenewCMS site running in about ten minutes. You need no Go, Node or Bun: RenewCMS is one ready-made program, or one Docker image.
+
+Pick one way to run it:
+
+- [Option A: Docker](#option-a-docker), the shortest path on any machine with Docker.
+- [Option B: the binary with systemd](#option-b-binary-and-systemd), for a Linux server.
+
+Both need the same few settings, listed first.
+
+## What you need
+
+- A server or computer. Linux, macOS and Windows are supported, on amd64 or arm64.
+- The public address of your site, such as `https://cms.example.com`. This is `PUBLIC_URL`.
+- An SMTP account for the emails RenewCMS sends (account verification, invitations). Your mail provider gives you the host, port, login and password.
+- A domain name and HTTPS for a real site (see [Put HTTPS in front](#put-https-in-front)). For a quick trial on your own computer, `http://localhost:8080` is enough.
+
+## The settings
+
+Four groups of settings are required. Everything else has a sensible default.
+
+| Setting | Example | Meaning |
+|---|---|---|
+| `PUBLIC_URL` | `https://cms.example.com` | Address visitors use to reach the site. |
+| `JWT_SECRET` | output of `openssl rand -hex 32` | Long random secret that signs logins. Keep it private and never change it casually: changing it signs everyone out. |
+| `SMTP_HOST`, `SMTP_PORT` | `smtp.example.com`, `465` | Your mail server. |
+| `SMTP_LOGIN`, `SMTP_PASSWORD`, `SMTP_SENDER` | `noreply@example.com`, `…`, `noreply@example.com` | Mail account and the From address. |
+
+The server stops at startup and names the missing setting if one is absent. Every available setting is documented in [configuration.md](configuration.md).
+
+## Option A: Docker
+
+Requires Docker with Compose v2.
+
+1. Create a folder and download the two files:
+
+   ```sh
+   mkdir renewcms && cd renewcms
+   curl -fsSLO https://git.floriansylvain.fr/fsylvain/RenewCMS/raw/branch/main/docker-compose.yml
+   curl -fsSL https://git.floriansylvain.fr/fsylvain/RenewCMS/raw/branch/main/docker.env.example -o docker.env
+   ```
+
+2. Edit `docker.env` and set `PUBLIC_URL`, the `SMTP_*` values and `JWT_SECRET`. Generate the secret with:
+
+   ```sh
+   openssl rand -hex 32
+   ```
+
+   For a trial on your own computer over plain HTTP, also set `ENVIRONMENT=development` and `PUBLIC_URL=http://localhost:8080`. Without this, browsers refuse the login cookie over `http://`. Use `production` (the default) only behind HTTPS.
+
+3. Start it:
+
+   ```sh
+   docker compose up -d
+   ```
+
+4. Check it: `curl http://localhost:8080/healthz` answers `ok`. Open `http://localhost:8080` in your browser.
+
+Your data (database and uploaded images) lives in the `renewcms-data` volume, so it survives restarts and upgrades. To upgrade later:
+
+```sh
+docker compose pull && docker compose up -d
+```
+
+More in [docker.md](docker.md): pinning a version, MySQL or PostgreSQL, backups.
+
+## Option B: binary and systemd
+
+This is for a Linux server with systemd. On macOS, or on Windows, you can run the same binary from a terminal after setting the same variables.
+
+### 1. Download
+
+Open the [releases page](https://git.floriansylvain.fr/fsylvain/RenewCMS/releases) and pick the file for your platform. The names look like `renewcms_<version>_<os>_<arch>`:
+
+| Platform | File ends with |
+|---|---|
+| Linux, Intel or AMD | `_linux_amd64` |
+| Linux, ARM (Raspberry Pi 4/5, ARM servers) | `_linux_arm64` |
+| macOS, Intel | `_darwin_amd64` |
+| macOS, Apple Silicon | `_darwin_arm64` |
+| Windows | `_windows_amd64.exe` or `_windows_arm64.exe` |
+
+Download and install it, replacing `v3.7.2-beta` with the version you want and `linux_amd64` with your platform:
+
+```sh
+curl -fsSL -o renewcms https://git.floriansylvain.fr/fsylvain/RenewCMS/releases/download/v3.7.2-beta/renewcms_v3.7.2-beta_linux_amd64
+sudo install -D -m 755 renewcms /opt/renewcms/renewcms
+/opt/renewcms/renewcms --version
+```
+
+### 2. Create a service user and folders
+
+```sh
+sudo useradd --system --home /var/lib/renewcms --shell /usr/sbin/nologin renewcms
+sudo install -d -o renewcms -g renewcms /var/lib/renewcms
+sudo install -D -m 600 /dev/null /etc/renewcms/renewcms.env
+```
+
+### 3. Fill the settings
+
+Open `/etc/renewcms/renewcms.env` with your editor (`sudo nano /etc/renewcms/renewcms.env`) and paste:
+
+```sh
+ENVIRONMENT=production
+PUBLIC_URL=https://cms.example.com
+PORT=8080
+DB_FILE=/var/lib/renewcms/renewcms.db
+UPLOAD_DIR=/var/lib/renewcms/uploads
+JWT_SECRET=paste-the-output-of-openssl-rand-hex-32
+SMTP_HOST=smtp.example.com
+SMTP_PORT=465
+SMTP_LOGIN=noreply@example.com
+SMTP_PASSWORD=your-smtp-password
+SMTP_SENDER=noreply@example.com
+```
+
+### 4. Create the service
+
+Create `/etc/systemd/system/renewcms.service`:
+
+```ini
+[Unit]
+Description=RenewCMS
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=renewcms
+Group=renewcms
+WorkingDirectory=/var/lib/renewcms
+EnvironmentFile=/etc/renewcms/renewcms.env
+ExecStart=/opt/renewcms/renewcms
+Restart=on-failure
+TimeoutStopSec=15
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ReadWritePaths=/var/lib/renewcms
+
+[Install]
+WantedBy=multi-user.target
+```
+
+### 5. Start it
+
+```sh
+sudo systemctl daemon-reload
+sudo systemctl enable --now renewcms
+curl -fsS http://localhost:8080/healthz
+```
+
+`ok` means it is running. If not, read the logs with `journalctl -u renewcms -n 50`: a missing setting is named there.
+
+To upgrade, download the new file, then `sudo install -m 755 renewcms /opt/renewcms/renewcms && sudo systemctl restart renewcms`. The database is migrated automatically at startup. Back up `/var/lib/renewcms` first. Optionally, [browser updates](deployment.md#browser-updates) let the owner upgrade from the Settings page.
+
+## Put HTTPS in front
+
+In production the login cookie is `Secure`, so the site must be served over HTTPS. Keep RenewCMS on `localhost:8080` and let a reverse proxy handle the certificate. With [Caddy](https://caddyserver.com), certificates are automatic. In `/etc/caddy/Caddyfile`:
+
+```caddyfile
+cms.example.com {
+	reverse_proxy localhost:8080 {
+		header_up X-Real-IP {remote_host}
+	}
+}
+```
+
+Then `sudo systemctl reload caddy`. Point your domain's DNS at the server first. For nginx, and for the proxy-related settings (`TRUSTED_PROXIES`), see [deployment.md](deployment.md#4-put-https-in-front).
+
+## First login
+
+1. Open your `PUBLIC_URL` in a browser.
+2. Create your account. The first account created becomes the **Owner** of the site.
+3. Confirm your email with the message RenewCMS sends. If it never arrives, check the `SMTP_*` settings and the logs.
+4. From there, invite teammates and start writing.
+
+## Where to go next
+
+- [configuration.md](configuration.md): every setting, including MySQL, PostgreSQL and S3 storage.
+- [docker.md](docker.md): Docker details, backups and versions.
+- [deployment.md](deployment.md): browser updates, reverse proxy variants, backups.
+- [api.md](api.md): reading your content from your own website.

docs/llm/gotchas.md

@@ -58,11 +58,17 @@ Sleep for `Retry-After` seconds, then retry once. Do not retry in a tight loop.
 
 ## Writes
 
-- A title cannot be changed after creation. Create a new article instead.
+- A title can be changed with `PATCH /v1/article/{id}` (3 to 200 characters); the slug is not regenerated. Send `if_revision` to refuse overwriting a newer save (`409 revision_conflict`).
-- `PATCH /v1/article/{id}` accepts `body`, `site_id`, `author_ids` and the SEO fields only. `{}` and `null` values answer `400`, except `cover_image_id` and `social_image_id`, where `null` removes the image.
+- `PATCH /v1/article/{id}` accepts `title`, `body`, `site_id`, `author_ids`, `if_revision` and the SEO fields only. `{}` and `null` values answer `400`, except `cover_image_id` and `social_image_id`, where `null` removes the image.
 - Request bodies are HTML even though responses default to markdown. Send `<p>` and `<h2>`, not markdown syntax, or it is stored literally.
 - Ids in paths are unsigned integers. Anything else answers `400`.
 
 ## Permissions follow the key's creator
 
 A key acts as the user who made it. A key made by a user who is neither owner nor admin cannot do what only owners and admins can, and it answers `403 Only owners and admins can do this.` Check `GET /v1/auth/me` to read the role of the key.
+
+## Languages
+
+- Every article version has a `lang` and a `story_id`; the versions of one article share the `story_id`. List with `lang=fr` to filter a language, and the MCP `list_articles` tool takes `lang`.
+- `GET /v1/public/site/{key}/lang/{lang}/article/{slug}` and `GET /v1/public/site/{key}/story/{story_id}` return only published versions, with `alternates`. Fallback is never silent: ask for it with `fallback=default`, and only the default language is tried.
+- `GET /v1/article/{id}/seo` adds `lang`, `alternates`, `og.locale_alternates` and `fallbacks.site_text_skipped`. The canonical follows the site Public URL pattern unless the version overrides it.

docs/llm/recipe-articles.md

@@ -10,7 +10,7 @@ export RENEWCMS_API_KEY=rcms_...
 
 ## 1. Create a draft
 
-Titles are 3 to 200 characters and cannot be changed later. The request body is HTML; the response body is markdown unless you pass `?format=html` or `?format=json`.
+Titles are 3 to 200 characters and can be edited later with `PATCH`. The request body is HTML; the response body is markdown unless you pass `?format=html` or `?format=json`.
 
 ```sh
 curl -X POST "{{BASE_URL}}/v1/article/" \
@@ -25,7 +25,7 @@ Status `201`:
 {"id":1,"title":"How we price a bathroom renovation","body":"A bathroom renovation is priced by room size, plumbing changes and finish level.","body_format":"markdown","is_online":false,"site_id":1,"authors":[],"created_at":"2026-10-23T01:11:16.767761797+02:00","updated_at":"2026-10-23T01:11:16.767761797+02:00","slug":"how-we-price-a-bathroom-renovation","excerpt":"","seo_title":"","seo_description":"","cover_image_id":null,"cover_image_alt":"","social_title":"","social_description":"","social_image_id":null,"canonical_url":"","noindex":false,"seo_dismissed":[]}
 ```
 
-The article starts offline (`is_online: false`) on the default site.
+The article starts offline (`is_online: false`) on the default site. To create it on another site, add `"site":"<site key>"` to the body (and optionally `"lang":"fr"`, an enabled language of that site); an unknown key answers `404 site_not_found`, and a language the chosen site does not enable answers `422 language_not_enabled`.
 
 ## 2. Replace the body, move it to a site, set the excerpt
 
@@ -79,3 +79,14 @@ curl "{{BASE_URL}}/v1/article/1?format=markdown"
 ```
 
 Before step 4 this answers `404` with the text `Article not found`, because anonymous callers only see online articles.
+
+## Read a language version (public)
+
+Two public routes, no credential needed (a cookie or key is ignored and a draft is never returned):
+
+```
+GET /v1/public/site/journal/lang/fr/article/comment-nous-chiffrons-une-renovation
+GET /v1/public/site/journal/story/5?lang=fr&fallback=default
+```
+
+The first matches site, language and slug exactly and never falls back (`404 article_not_found`). The second resolves a story: without `lang` it asks for the site default language, and `fallback=default` serves the default-language version when the requested one is not published (`fallback: true`, `requested_lang` keeps the asked language); otherwise `404 language_not_available`. Both answer the article object plus `alternates`, the other published versions of the story in enabled languages (`id`, `lang`, `story_id`, `slug`, `url`; `url` is `null` when the site has no Public URL pattern), default language first, then by tag. An invalid `lang` is `400 invalid_language`.

docs/llms.md

@@ -20,3 +20,7 @@ All of them are public. `{{VERSION}}` and `{{BASE_URL}}` in the sources are repl
 - Recipes in `docs/llm/` hold real responses. Re-capture them when a response shape changes.
 
 `TestRouterRoutesAreInTheCatalogue` fails when a route of `api/router.go` is missing from the catalogue. Routes still undocumented are listed in `routesNotYetInTheCatalogue` in `test/api_catalogue_drift_test.go`; remove an entry once the route is documented.
+
+## Languages in the generated output
+
+The article object carries `lang` and `story_id`, and the public language routes `GET /v1/public/site/{key}/lang/{lang}/article/{slug}` and `GET /v1/public/site/{key}/story/{story_id}` return `alternates` and, for the second, `requested_lang` and `fallback`. They are described in `docs/api/article-localization.md`, in the catalogue and in the recipes, so `/llms-full.txt` and `/openapi.json` include them after `task build:llms`.

docs/mcp.md

@@ -32,6 +32,10 @@ They belong to the MCP binary only and are not server variables.
 
 Routes that need a browser session, such as creating a site, are not exposed. API errors come back as tool errors with the status and the plain-text message.
 
+## Why it calls the HTTP API
+
+`renewcms-mcp` runs on the machine of the person using the model (Claude Desktop, Cursor), usually not on the server, and talks to a remote instance. Calling the use cases directly would need the database, the storage and the secrets of the instance in that process, and would skip what the HTTP layer enforces for every client: API-key authentication and its rate limit, the role permissions checked by the router middleware, the activity context, validation of the request bodies and the plain-text error contract. Going through the published routes keeps the model inside the same limits as any API key and keeps one contract to test. It uses the authenticated routes (`/v1/article`, `/v1/media`, `/v1/site`), not the public `/v1/public` routes, so drafts stay reachable for the key's user. Running it in-process with the server is not supported.
+
 ## Resources and prompts
 
 The resource `renewcms://docs/llms-full.txt` is the instance's own [`/llms-full.txt`](llms.md), so the model reads the documentation of the exact version it talks to. The prompt `write_and_publish_article` drafts, checks the SEO and asks before publishing.

docs/performance.md

@@ -2,20 +2,18 @@
 
 ## The `?seo=` article filter
 
-`GET /v1/article/` assesses the SEO status of articles in memory, because the status depends on the body, the site template and the authors. Every request assesses every visible article once, to fill `counts.suggestions`, and `?seo=` reuses that assessment to filter before paging. The cost therefore grows with the number of articles, not with the page size.
+The SEO status of an article depends on its body, its fields, its authors, its site (`default_description`) and the site default language. It is computed by `RefreshArticleSEOUseCase` and stored on the article (`seo_status`, `seo_suggestions`). Every repository write to one of those inputs clears the stored status and raises `seo_version` in the same `UPDATE` (`withStaleSEO`); site-level changes (default description, default language) clear the whole site through `article.SEOIndex.MarkSiteSEOStale`. Before answering, `GET /v1/article/` recomputes the cleared articles only, in batches of 500, reading their bodies once; `StoreSEO` writes a status only while `seo_version` is still the one it read, so a concurrent edit is never overwritten by an older assessment; the site and its languages are read after each batch of stale rows, never cached across batches, so a site-level change that commits during a refresh is either seen or makes the store miss. The server recomputes everything that is cleared at startup (the backfill of existing rows after the upgrade). `?seo=` and `counts.suggestions` are then plain SQL conditions on `seo_status`, so the cost of a list no longer grows with the number of visible bodies.
 
-Measured by `TestSeoFilterPerformance` in `test/seo_filter_performance_test.go` (skipped with `-short`): 5,000 articles of about 5 KB each in one site, on a SQLite file in a temporary directory, every article with suggestions, `?seo=suggestions&size=25`, slowest of 3 runs:
+`TestSeoFilterPerformance` in `test/seo_filter_performance_test.go` (skipped with `-short`) measures 5,000 articles of about 5 KB each in one site on a temporary SQLite file, every article with suggestions, slowest of 3 runs after the startup backfill:
-
-| Version | Time |
-| --- | --- |
-| `counts.suggestions` added, assessment done twice | about 430 ms |
-| assessment shared between the counts and the filter | about 270 ms |
-
-The target is 300 ms for 5,000 articles. The test also measures the default list (`GET /v1/article/` with no `?seo=`), which pays the same assessment for `counts.suggestions`. Latest run on the development machine, slowest of 3 runs:
 
 | Request | Time |
 | --- | --- |
-| `?seo=suggestions&size=25` | 315 to 338 ms |
+| startup backfill of the 5,000 articles (once) | 270 ms |
-| default page, no `?seo=` | 307 to 329 ms |
+| `?seo=suggestions&size=25` | 24 ms |
+| default page, no `?seo=` | 23 ms |
 
-Both are slightly above the 300 ms target on this machine (they were about 270 ms in the earlier measurement), so the target is logged by the test but not enforced; no cache or index was added. Re-run the test with `go test -tags nofrontend ./test/... -run TestSeoFilterPerformance -v -count=1` after a change to the assessment rules or the article repository. The time depends on the machine; the test only fails above 500 ms.
+The target is 300 ms for 5,000 articles; the test fails above 500 ms. Re-run it with `go test -tags nofrontend ./test/... -run TestSeoFilterPerformance -v -count=1` after a change to the assessment rules or the article repository.
+
+## The `?seo=` filter of the grouped list
+
+`GET /v1/article/?group=story` filters on the stored status in SQL (`q.seo_status = ?` among the conditions of the qualifying versions) and counts `suggestions` with `COUNT(DISTINCT story_id)` over the readable versions, so no id list is built for the SEO filter. With `q`, the title search still runs once per request through `article.StoryReader.FindTitleMatches` (accent folding happens in Go) and its matches are handed to the repository as `StoryFilters.VersionIDs`. That set can be larger than any bind-parameter limit (SQLite accepts 32,766 parameters), so it never becomes an `IN (?, …)` list: the repository reads the qualifying `(story_id, id)` pairs and the ordered story rows with id-only projections and keeps the members of the set in memory before paging. `ListByStories` reads the versions of the page without their bodies and only those the caller may read; `ListVersions` reads the bodies of the page's representatives only. `TestArticleStoryListSEOFilterAtScaleSQLite` covers 40,001 versions: the backfill assesses each of them once, and the list requests that follow read no stale version and no page of bodies.

docs/release-notes.md

@@ -49,3 +49,5 @@ Each body lives in `docs/releases/<tag>.md`. Publish with `tea releases create -
 | `v3.5.3-beta` | OpenAPI response schemas |
 | `v3.6.0-beta` | Roles and permissions |
 | `v3.7.0-beta` | Account self-service |
+| `v3.7.1-beta` | Author and role dialog fixes |
+| `v3.7.2-beta` | Role picker alignment fix |

docs/releases/v3.7.1-beta.md

@@ -0,0 +1,15 @@
+This release fixes three small interface problems in the author and role screens.
+
+## Improvements and fixes
+
+- Users can edit their own author from the author list page.
+- The create author button in the article editor now has the same height as the controls next to it.
+- The selected role card in the Change role dialog now uses dark text, so its name, description and Current marker are readable on the sand background.
+
+## Under the hood
+
+- Design change logs are consolidated into `docs/design/decisions.md`, and stale docs are refreshed.
+
+## Upgrading
+
+- Replace the binary, or pull the new image. No schema migration and no new environment variable.

docs/releases/v3.7.2-beta.md

@@ -0,0 +1,9 @@
+This release fixes the alignment of the role cards in the Change role dialog.
+
+## Improvements and fixes
+
+- The items in the role picker are now vertically centered.
+
+## Upgrading
+
+- Replace the binary, or pull the new image. No schema migration and no new environment variable.

features/article_edit_revision.feature

@@ -0,0 +1,183 @@
+Feature: Edit title and slug, and protect overwrites with a revision
+  A title can be edited at any time (3 to 200 runes). Editing the title never changes the slug. The slug changes only when sent explicitly, before or after publication, with no redirect. Every article read carries a "revision"; a PATCH may send "if_revision" so a stale editor cannot overwrite silently.
+
+  Background:
+    Given error responses are plain text (a snake_case code or an existing apperr message)
+    And a "writer" holds content.update and content.read at scope all
+    And article 10 (site 1, lang en, story 5, online, title "Renovation costs", slug "renovation-costs", authors [Camille]) has revision 3 and content_revision 4
+    And article 12 (site 1, lang fr, story 5, offline, slug "couts") exists
+
+  Scenario Outline: Title boundaries on PATCH, counted in runes
+    Given a valid jwt cookie for a writer
+    When the client sends PATCH /v1/article/10 with {"title": <title>}
+    Then the response status is <status>
+    And <effect>
+
+    Examples:
+      | title                                      | status | effect                                          |
+      | 2 ASCII characters                         | 400    | the body is apperr.ArticleTitleErrorMessage, nothing changed |
+      | 3 ASCII characters                         | 200    | the title is stored                             |
+      | 200 ASCII characters                       | 200    | the title is stored                             |
+      | 201 ASCII characters                       | 400    | the title is unchanged                          |
+      | 200 repetitions of the 4-byte rune "😀"     | 200    | the title is stored (200 runes, 800 bytes)      |
+      | ""                                         | 400    | the body is apperr.ArticleTitleErrorMessage, nothing changed |
+      | null                                       | 400    | the body is apperr.BodyErrorMessage             |
+
+  Scenario: Editing the title never changes the slug
+    Given a valid jwt cookie for a writer
+    When the client sends PATCH /v1/article/10 with {"title":"New title"}
+    Then the response status is 200
+    And the slug is still "renovation-costs"
+    And the article is still online
+
+  Scenario: Title and body in one request
+    Given a valid jwt cookie for a writer
+    When the client sends PATCH /v1/article/10 with {"title":"New title","body":"<p>x</p>"}
+    Then both are stored in one write
+    And revision rises by exactly 1
+
+  Scenario: The title is editable on a single-language site
+    Given site "archive" has a single language
+    When a writer sends PATCH on an archive article with {"title":"New title"}
+    Then the response status is 200
+    And the slug is unchanged
+
+  Scenario Outline: Explicit slug edits
+    Given a valid jwt cookie for a writer
+    When the client sends PATCH with <request>
+    Then the response status is <status>
+    And <effect>
+
+    Examples:
+      | request                                                                   | status | effect                                                                                  |
+      | /v1/article/10 {"slug":"new-address"} (online)                            | 200    | still online, no redirect row, the old slug reads as not found publicly                 |
+      | /v1/article/12 {"slug":"new-address"} (offline)                           | 200    | the slug is stored                                                                      |
+      | /v1/article/10 {"slug":"renovation-costs"} (same as current)              | 200    | nothing changes, revision unchanged                                                     |
+      | /v1/article/10 {"slug":"Not A Slug"}                                      | 400    | the body is apperr.InvalidSlugErrorMessage                                              |
+      | /v1/article/10 {"slug":"couts"} (used by another language of the same story) | 200 | the slug is stored                                                                      |
+      | /v1/article/10 {"slug":"taken-en"} (used by another en article of site 1) | 409    | the body is "slug_taken" with the header X-Slug-Suggestion                              |
+      | /v1/article/10 {"slug":""}                                                | 200    | the slug is regenerated from the current title                                          |
+
+  Scenario: The same slug in two languages is not a conflict
+    Given a valid jwt cookie for a writer
+    When the client sends PATCH /v1/article/10 with {"slug":"couts"}
+    Then the response status is 200
+    And article 10 (en) and article 12 (fr) both hold the slug "couts"
+
+  Scenario: Revision is exposed on every article read and write
+    Given a valid jwt cookie for a writer
+    When the client calls GET /v1/article/10, the list, POST, PATCH, publish and unpublish
+    Then each response carries "revision" as a positive integer
+    And every pre-existing key is unchanged in name, value and type
+
+  Scenario Outline: What raises revision and content_revision
+    Given a valid jwt cookie for a writer
+    When the client sends PATCH /v1/article/10 changing only <field>
+    Then revision rises by 1
+    And content_revision <content_effect>
+
+    Examples:
+      | field                  | content_effect        |
+      | title                  | rises by 1            |
+      | body                   | rises by 1            |
+      | excerpt                | rises by 1            |
+      | slug                   | rises by 1            |
+      | cover_image_alt        | rises by 1            |
+      | seo_title              | rises by 1            |
+      | seo_description        | rises by 1            |
+      | social_title           | rises by 1            |
+      | social_description    | rises by 1            |
+      | author_ids             | is unchanged          |
+      | cover_image_id         | is unchanged          |
+      | social_image_id        | is unchanged          |
+      | site_id (single-version story) | is unchanged  |
+      | canonical_url          | is unchanged          |
+      | noindex                | is unchanged          |
+      | seo_dismissed          | is unchanged          |
+
+  Scenario: Several content fields in one PATCH raise each counter once
+    When a writer sends PATCH /v1/article/10 changing title, body and excerpt
+    Then revision rises by 1 and content_revision rises by 1
+
+  Scenario: A PATCH that changes nothing leaves both counters alone
+    When a writer sends PATCH /v1/article/10 with the current values
+    Then the response status is 200
+    And revision and content_revision are unchanged
+
+  Scenario: Publishing and unpublishing do not touch revisions
+    When article 12 is published and then unpublished
+    Then its revision and content_revision are unchanged
+
+  Scenario: if_revision matches
+    When a writer sends PATCH /v1/article/10 with {"body":"x","if_revision":3}
+    Then the response status is 200
+    And the response revision is 4
+
+  Scenario: if_revision is stale
+    Given another writer already saved article 10, so its revision is 4
+    When a writer sends PATCH /v1/article/10 with {"body":"x","if_revision":3}
+    Then the response status is 409 and the body is "revision_conflict"
+    And the header X-Current-Revision is 4
+    And nothing is stored
+    And no successful "article.edit" activity event is recorded
+
+  Scenario: A stale if_revision wins over a no-op PATCH
+    Given article 10 has revision 4
+    When a writer sends PATCH /v1/article/10 with the current values and "if_revision":3
+    Then the response status is 409 and the body is "revision_conflict"
+
+  Scenario: Overwrite uses the revision the conflict dialog showed
+    Given the conflict dialog showed revision 4
+    When a writer sends PATCH /v1/article/10 with "if_revision":4
+    Then the response status is 200 and revision is 5
+    When another writer saved in between
+    Then the response is 409 "revision_conflict" with the then-current X-Current-Revision
+    And nothing is overwritten
+
+  Scenario: Concurrent saves with the same if_revision
+    When two PATCH requests with the same if_revision run at the same time
+    Then exactly one answers 200 and the other 409
+    And the compare and the write are one atomic step
+
+  Scenario: Without if_revision the last write wins
+    When a writer sends PATCH /v1/article/10 with {"body":"x"}
+    Then the response status is 200
+    And revision still rises by 1
+
+  Scenario Outline: Invalid if_revision
+    When a writer sends PATCH /v1/article/10 with {"body":"x","if_revision":<value>}
+    Then the response status is 400 and the body is apperr.BodyErrorMessage
+
+    Examples:
+      | value |
+      | 0     |
+      | -1    |
+      | "3"   |
+      | 1.5   |
+      | null  |
+
+  Scenario: if_revision alone is not an update
+    When a writer sends PATCH /v1/article/10 with {"if_revision":3}
+    Then the response status is 400 and the body is apperr.BodyErrorMessage
+
+  Scenario: Other languages are untouched by an overwrite
+    When a writer overwrites article 10 with a matching if_revision
+    Then article 12 keeps its content, its revision and its publication
+
+  Scenario: Permissions are unchanged
+    Then a caller without content.update gets 403 "missing_permission"
+    And a caller who cannot read the article gets 404 "Article not found"
+    And an anonymous caller gets 401
+    And a stale if_revision never reveals current content to a caller lacking permission because permission is checked first
+
+  Scenario: Editing an online article without content.publish changes the live page right away
+    Given a user holds content.update but not content.publish
+    When the user sends PATCH /v1/article/10 with {"title":"New title"}
+    Then the response status is 200
+    And a public read shows the new title
+
+  Scenario: Title and slug edits are recorded
+    When a writer edits the title and the slug of article 10
+    Then one "article.edit" event is recorded
+    And its changes include the title and the slug
+    And its params hold lang "en"

features/article_edit_revision.qa.md

@@ -0,0 +1,23 @@
+# QA: Edit title and slug, revision protection (backend)
+
+Backend only. Go tests in test/, black-box. No design states.
+
+## Automated, no server (task test)
+1. UpdateArticle use case over fakes and a fake Transactor, table-driven over title boundaries, explicit slug edits and revision-raising fields. Assert article.ErrInvalidTitle, ErrInvalidSlug, ErrSlugTaken and the new revision-conflict sentinel with errors.Is. The revision compare-and-set and the write run in the same transaction. content_revision rises only for the listed fields.
+2. HTTP via NewHandler, a chi router mirroring api/router.go, validator.InitValidator(), httptest and a jwt cookie. A PATCH with "title" present but empty must be 400 (guard against omitempty on a *string skipping validation). Assert body strings, X-Current-Revision, X-Slug-Suggestion, and "revision" in the read, list, POST, PATCH, publish and unpublish JSON, with old keys unchanged.
+3. Two goroutines with the same if_revision: exactly one answers 200.
+4. Regression: article_title_rules, article_publishing, SEO and pagination tests stay untouched, except the updated pair text.
+
+## Automated, SQLite file (task test)
+5. The migration adds edit_revision with default 1 for existing rows; a second Migrate changes nothing.
+6. The compare-and-set is one UPDATE ... WHERE edit_revision = ? (or equivalent). With concurrent writers, one wins.
+
+## Automated, real databases (task test:mysql, task test:postgres)
+7. Repeat 5-6 on MySQL 8.4, MariaDB 11 and PostgreSQL. Record NOT RUN if the daemon is down, or use the podman shim (see memory).
+
+## Build and lint
+8. task test, task lint:go and CGO_ENABLED=0 go build -tags nofrontend ./... pass. No comments in the added Go files. task mutate scoped via MUTATE_FILES to the revision and title code.
+9. docs/api/articles.md gains title, slug, revision, if_revision and X-Current-Revision.
+
+## Manual
+None.

features/article_list_localization.feature

@@ -0,0 +1,404 @@
+Feature: Editorial article list by story and language
+  A signed-in editor lists the articles of the back-office either as one row per story (all languages), or per language, with coverage, a "not in this language" view, an author filter and counts. The grouped response is an explicit opt-in on the same endpoint (group=story). Without it, GET /v1/article/ keeps exactly the flat envelope of features/articles_pagination_api.feature. Only versions the caller can read contribute titles, authors, timestamps, coverage, results and counts.
+
+  Background:
+    Given the storage, translation and lifecycle rules of features/article_localization_storage.feature, features/article_translation_create.feature and features/article_story_lifecycle.feature apply
+    And error responses are plain text, and a malformed query answers 400 with apperr.BodyErrorMessage, validated with validate tags through validator.Validate.Struct
+    And site "journal" has enabled languages en (default), fr, de, ar and disabled languages es, it
+    And the "Journal" dataset holds 8 stories and 17 versions (article id, lang, state, updated_at, byline):
+      | story | article ids and versions                                                  | byline        | updated_at of the latest version |
+      | 1     | 101 en online, 102 fr draft, 103 de online, 104 ar draft                   | Marta Alves   | 2026-10-30 10:00 |
+      | 2     | 201 en online, 202 fr online, 203 de online                                | Camille Roche | 2026-10-29 09:00 |
+      | 3     | 301 en online, 302 fr online                                               | Luis Ferrer   | 2026-10-28 09:00 |
+      | 4     | 401 en draft                                                               | Marta Alves   | 2026-10-27 09:00 |
+      | 5     | 501 en online, 502 de draft                                                | Luis Ferrer   | 2026-10-14 09:00 |
+      | 6     | 601 en online, 602 fr draft                                                | Camille Roche | 2026-10-13 09:00 |
+      | 7     | 701 en online, 702 de online                                               | Marta Alves   | 2026-10-12 09:00 |
+      | 8     | 801 es online                                                              | Luis Ferrer   | 2026-10-10 09:00 |
+    And an "owner" holds every content permission at scope all
+    And a "reader" holds content.read at scope all only: drafts of other users are hidden and no create_translation capability is held
+    And a "restricted writer" holds content.create and content.read at scope own
+    And a caller is "editorial" when the jwt cookie carries a user_id claim of a verified user whose role is resolved; every other caller is "public"
+    And the new query parameters are: group (only "story"), lang (a supported language tag, normalized as in features/article_localization_storage.feature), tab (all, missing; review is reserved for features/ of release 2 and answers 400 until then), author (a byline id, integer >= 1)
+    And the existing parameters page, size, q, status, site, seo and sort keep their meaning, defaults and validation; filter changes are the client's job to page-reset
+    And a visible version is one the caller may read under the scopes of features/roles_permissions_content_scope.feature; a hidden version is never counted, titled, named in coverage, in missing_langs or in an error
+    And the repository query is portable across SQLite, MySQL 8.4, MariaDB 11 and PostgreSQL: no dialect-only construct, request text never reaches the SQL, and the access filter is applied inside the query, not after paging
+
+  Rule: Public lists are unchanged
+
+    Scenario: A bare request is still the flat envelope
+      Given the "Journal" dataset and an owner session
+      When the client sends GET /v1/article/
+      Then the body keys are exactly items, total, page, size and counts, and each item is the article object of the version, as before this slice
+      And total is 17 versions' worth of visible articles, not 8
+
+    Scenario: lang, tab and group are not read unless asked
+      Given the "Journal" dataset
+      When a public client sends GET /v1/article/?size=5
+      Then the body is identical to what it was before this slice, with lang and story_id on each item as defined in features/article_localization_storage.feature
+
+    Scenario Outline: group=story needs an editorial caller
+      Given the "Journal" dataset
+      When <caller> sends GET /v1/article/?group=story
+      Then the response status is 400 and the body is "The request cannot be processed due to a mismatch in the format of the body."
+      And the repository was not called
+
+      Examples:
+        | caller                                       |
+        | a client without a jwt cookie                |
+        | a client with a malformed or expired cookie  |
+        | a client whose user is not verified          |
+
+    Scenario Outline: Invalid new parameters answer 400
+      Given an owner session
+      When the client sends GET /v1/article/?<query>
+      Then the response status is 400 and the body is "The request cannot be processed due to a mismatch in the format of the body."
+      And the repository was not called
+
+      Examples:
+        | query                                  |
+        | group=stories                          |
+        | group=                                 |
+        | group=story&tab=review                 |
+        | group=story&tab=published              |
+        | group=story&tab=                       |
+        | tab=missing                            |
+        | group=story&lang=english               |
+        | group=story&lang=xx                    |
+        | group=story&lang=                      |
+        | group=story&author=0                   |
+        | group=story&author=abc                 |
+        | group=story&author=                    |
+        | author=-1                              |
+
+  Rule: Grouped rows, one per story
+
+    Scenario: All languages, page 1
+      Given the "Journal" dataset and an owner session
+      When the client sends GET /v1/article/?group=story&size=5
+      Then the response status is 200 and total is 8, page 1, size 5
+      And the story_id of the items are 1, 2, 3, 4, 5 in that order
+      And counts.all is 8
+
+    Scenario: All languages, page 2 is the last
+      When the owner sends GET /v1/article/?group=story&size=5&page=2
+      Then the story_id of the items are 6, 7, 8 and total is 8
+
+    Scenario: A page beyond the last is empty with the real total
+      When the owner sends GET /v1/article/?group=story&size=5&page=99
+      Then items is [] and total is 8 and counts.all is 8
+
+    Scenario: A grouped row describes the representative version and the story
+      When the owner sends GET /v1/article/?group=story
+      Then the item of story 1 carries the fields of article 101 (id 101, lang "en", title, slug, is_online, site_id, story_id 1 and the other list fields of the flat item)
+      And it adds story_updated_at "2026-10-30T10:00:00Z", story_authors (the union of the bylines of the readable versions, without duplicates) and capabilities of article 101
+      And it adds coverage and missing_langs
+
+    Scenario Outline: The representative is the default-language version, else the first readable by language code
+      Given the "Journal" dataset and an owner session
+      When the client sends GET /v1/article/?group=story
+      Then the representative id of story <story> is <id> and its lang is "<lang>"
+
+      Examples:
+        | story | id  | lang |
+        | 1     | 101 | en   |
+        | 4     | 401 | en   |
+        | 8     | 801 | es   |
+
+    Scenario: The representative falls back when the default version is unreadable
+      Given story 5 holds a draft en article created by another user
+      When a restricted writer sends GET /v1/article/?group=story
+      Then the representative of story 5 is the first readable version by language code, never the hidden one
+      And no field of the row names the hidden one
+
+    Scenario: story_updated_at is the latest readable version update
+      Given article 102 (fr draft of story 1, creator another user) was updated at 2026-11-01 08:00 and is hidden from the caller
+      When a restricted writer or a reader sends GET /v1/article/?group=story
+      Then story 1's story_updated_at ignores article 102
+      When the owner sends the same request
+      Then story 1's story_updated_at is "2026-11-01T08:00:00Z"
+
+    Scenario Outline: Coverage lists readable versions in the chip order, then the languages that can be created
+      Given the "Journal" dataset and an owner session
+      When the client sends GET /v1/article/?group=story
+      Then the coverage of story <story> is <coverage>
+      And each entry has id, lang, title, is_online, language_enabled, excluded_from_public, source_article_id and capabilities, like an entry of "translations" in features/article_story_lifecycle.feature
+      And each row has excluded_from_public, the flag of its representative version
+      And missing_langs of story <story> is <missing>
+
+      Examples:
+        | story | coverage                                        | missing        |
+        | 1     | en, ar, de, fr                                   | []             |
+        | 3     | en, fr                                           | ["ar","de"]    |
+        | 4     | en                                               | ["ar","de","fr"] |
+        | 8     | es (language_enabled false)                      | ["en","ar","de","fr"] |
+
+    Scenario: Coverage order is default, other enabled by tag, disabled by tag; missing is listed by the same rule
+      Given story 8 gains a readable it version, and story 8's default en version does not exist
+      Then the coverage of story 8 is es then it, both with language_enabled false
+      And missing_langs starts with the default language en
+
+    Scenario: A caller who cannot create gets no missing_langs
+      When a reader sends GET /v1/article/?group=story
+      Then missing_langs is [] on every row
+      And the coverage lists only the readable versions of each story
+
+    Scenario: The row of a story whose versions are all hidden does not exist
+      Given story 4's only version is a draft of another user
+      When a restricted writer sends GET /v1/article/?group=story
+      Then story 4 is in no item, in total or in counts
+      And total is the same as if article 401 did not exist
+
+    Scenario: Hidden versions leave no trace
+      Given the "Journal" dataset and a restricted writer who cannot read the drafts 102, 104, 401, 502 and 602
+      When the restricted writer sends GET /v1/article/?group=story&size=100
+      Then the items, total, counts and every coverage and missing_langs equal those of a database in which those articles do not exist
+      And no response field or header names them
+
+    Scenario: Unassigned articles are their own story with an empty language
+      Given article 30 has lang "" and its own story
+      When the owner sends GET /v1/article/?group=story
+      Then its row has lang "", coverage with its single version, and missing_langs []
+      And it never appears in the "not in" view of any language
+
+    Scenario: A mixed story is listed under Missing
+      Given story 31 holds article 31 (lang "") and article 32 (en), and story 33 holds article 33 (lang "") and article 34 (fr)
+      When the owner sends GET /v1/article/?group=story&tab=missing
+      Then stories 31 and 33 are listed, with the enabled languages they lack in missing_langs
+      And the version without language fills no language
+      And a story whose readable versions all lack a language is never listed
+
+  Rule: Language selected means one row per version of that language
+
+    Scenario: French selected
+      When the owner sends GET /v1/article/?group=story&lang=fr&size=5
+      Then total is 4 and the story_id of the items are 1, 2, 3, 6
+      And each representative is the fr version: ids 102, 202, 302, 602
+      And each row still carries the whole story's coverage and story_authors
+
+    Scenario: The row opens the selected version and sorts by its update
+      Given the fr versions have the updated_at values 2026-10-30, 2026-10-29, 2026-10-28 and 2026-10-13
+      When the owner sends GET /v1/article/?group=story&lang=fr
+      Then the order is stories 1, 2, 3, 6
+
+    Scenario: Disabled languages can be selected
+      When the owner sends GET /v1/article/?group=story&lang=es
+      Then total is 1 and the item is story 8, representative 801 and its coverage entry has language_enabled false
+
+    Scenario: A language nobody has gives an empty list
+      When the owner sends GET /v1/article/?group=story&lang=it
+      Then items is [] and total is 0
+
+    Scenario: lang also narrows the flat list
+      When the owner sends GET /v1/article/?lang=fr
+      Then the flat envelope holds the 4 fr articles, total is 4 and no item has another lang
+      And counts.all, counts.online and counts.draft count the fr versions only and still ignore q and status
+
+  Rule: The not-in view lists stories without a readable version
+
+    Scenario: Not in French
+      When the owner sends GET /v1/article/?group=story&lang=fr&tab=missing&size=5
+      Then total is 4 and the story_id of the items are 4, 5, 7, 8
+      And each representative is as in the all-languages view (401, 501, 701, 801)
+      And missing_langs of each row contains "fr"
+
+    Scenario: Needs translation, no language selected
+      When the owner sends GET /v1/article/?group=story&tab=missing&size=5
+      Then total is 7 and the stories are 2, 3, 4, 5, 6, 7, 8 (story 1 has every enabled language)
+
+    Scenario: Missing means no readable version, not no stored version
+      Given a hidden fr draft exists on story 4
+      When a restricted writer sends GET /v1/article/?group=story&lang=fr&tab=missing
+      Then story 4 is listed as not in French
+      And nothing in the response tells whether a fr version exists
+
+    Scenario: Sites that do not enable the language are excluded
+      Given site "atelier" enables en, en-GB and fr only, with one story that has en and fr versions only
+      When the owner sends GET /v1/article/?group=story&lang=de&tab=missing
+      Then no atelier story is listed
+      When the owner sends GET /v1/article/?group=story&lang=es&tab=missing
+      Then no story is listed, because es is disabled on journal
+
+    Scenario: Needs translation counts only languages the caller can create
+      When a reader sends GET /v1/article/?group=story&tab=missing
+      Then total is 0 and items is []
+      And a reader's lang=fr tab=missing still lists the stories without a readable fr version
+
+    Scenario: Nothing missing
+      Given site "press" with 3 stories, each with en and fr versions, and enabled languages en, fr
+      When the owner sends GET /v1/article/?group=story&tab=missing&site=press
+      Then items is [], total is 0 and counts.missing is 0
+
+  Rule: Filters apply to one readable version together
+
+    Scenario: Status matches a readable version of the story
+      When the owner sends GET /v1/article/?group=story&status=draft
+      Then the stories are 1, 4, 5, 6 and total is 4
+
+    Scenario: Combined filters need a single readable version to satisfy them together
+      Given story 1 holds article 101 (en, online, byline Marta Alves) and article 102 (fr, draft, byline Camille Roche)
+      When the owner sends GET /v1/article/?group=story&status=draft&author=<id of Marta Alves>
+      Then story 1 is not listed, because no single version is both a draft and by Marta Alves
+      When the owner sends GET /v1/article/?group=story&status=online&author=<id of Marta Alves>
+      Then story 1 is listed
+      When the owner sends GET /v1/article/?group=story&status=draft&author=<id of Camille Roche>
+      Then story 1 is listed
+
+    Scenario: story_authors is the union even when the filter matched one version
+      Given the same story 1
+      When the owner sends GET /v1/article/?group=story&author=<id of Camille Roche>
+      Then story 1 is listed and its story_authors holds Marta Alves and Camille Roche
+
+    Scenario: Search matches any readable title of the story
+      Given article 102 is titled "Comment nous chiffrons une rénovation" and article 101 "How we price a bathroom renovation"
+      When the owner sends GET /v1/article/?group=story&q=RENOVATION
+      Then story 1 is listed with the title of its representative (101)
+      And the search ignores case and accents like features/articles_pagination_api.feature
+      When the owner sends GET /v1/article/?group=story&lang=fr&q=chiffrons
+      Then story 1 is listed with article 102 as representative
+      When the owner sends GET /v1/article/?group=story&lang=en&q=chiffrons
+      Then items is []
+
+    Scenario: Search in the not-in view matches readable source titles
+      When the owner sends GET /v1/article/?group=story&lang=fr&tab=missing&q=Spring
+      Then story 4 is listed
+
+    Scenario: Author in language mode
+      When the owner sends GET /v1/article/?group=story&lang=fr&author=<id of Camille Roche>
+      Then the stories are 2 and 6 (the fr version's own byline decides)
+
+    Scenario: Site filter
+      When the owner sends GET /v1/article/?group=story&site=press
+      Then only press stories are listed, and an unknown site key gives items [] and total 0 as for the flat list
+
+    Scenario: SEO filter on one version
+      Given article 502 has suggestions and article 501 has none
+      When the owner sends GET /v1/article/?group=story&seo=suggestions
+      Then story 5 is listed once, with its own representative 501
+
+    Scenario: The SEO status is stored, not recomputed from every body
+      Given 40,001 versions whose SEO status was computed once
+      When the owner requests any page of ?group=story&seo=suggestions, with or without q
+      Then the status filter and counts.suggestions are evaluated in SQL on the stored status
+      And no body of a visible version is read except the representatives of the page
+
+    Scenario: All filters combine with paging and stay stable
+      Given 12 stories match
+      When the owner requests pages 1, 2 and 3 of ?group=story&size=5 with the same filters
+      Then the pages hold 5, 5 and 2 stories with no repeat, and total is 12 on each
+
+  Rule: Sort applies to the whole list at story level
+
+    Scenario Outline: Sort orders stories, not the page
+      Given the "Journal" dataset and an owner session
+      When the client sends GET /v1/article/?group=story&sort=<sort>&size=100
+      Then the story order is <order>
+
+      Examples:
+        | sort            | order                          |
+        | updated_at:desc | 1,2,3,4,5,6,7,8               |
+        | updated_at:asc  | 8,7,6,5,4,3,2,1               |
+        | title:asc       | by representative title, then story_id descending |
+        | title:desc      | by representative title descending, then story_id descending |
+        | status:asc      | drafts first by representative is_online, then story_id descending |
+        | created_at:asc  | by the earliest created_at among readable versions |
+
+    Scenario: Ties end with story_id descending
+      Given two stories with the same latest update
+      Then the one with the higher story_id comes first on every page
+
+  Rule: Counts
+
+    Background:
+      Given the grouped body is {"items","total","page","size","counts"}
+      And counts holds all, online, draft, suggestions and missing, in snake_case
+      And in grouped mode the counts respect lang, q, author, seo and site but never status or tab, so the tab counts stay comparable; they count the unit of the mode (stories, or versions of the selected language)
+      And online and draft count units with a readable online or draft version (the selected version in language mode)
+      And missing counts the units the "not in" view would list under the same lang, q, author, seo and site
+      And suggestions keeps its meaning (units with a readable version whose seo_status is suggestions, ignoring every other parameter)
+      And the flat list counts are unchanged
+
+    Scenario: Counts of the Journal dataset, all languages
+      When the owner sends GET /v1/article/?group=story
+      Then counts is {"all": 8, "online": 7, "draft": 4, "suggestions": 0, "missing": 7}
+
+    Scenario: Counts of the Journal dataset, French
+      When the owner sends GET /v1/article/?group=story&lang=fr
+      Then counts.all is 4, counts.online is 2, counts.draft is 2 and counts.missing is 4
+
+    Scenario: Counts follow the search
+      When the owner sends GET /v1/article/?group=story&q=zinc
+      Then items is [], total is 0 and counts is {"all": 0, "online": 0, "draft": 0, "suggestions": 0, "missing": 0}
+      And suggestions is the only count that ignores q
+
+    Scenario: Counts follow the author filter
+      When the owner sends GET /v1/article/?group=story&author=<id of Marta Alves>
+      Then total is 3, the stories are 1, 4, 7 and counts.all is 3
+
+    Scenario: Counts do not move with status or tab
+      When the owner sends GET /v1/article/?group=story&lang=fr&status=draft&tab=missing
+      Then counts.all is 4, counts.online is 2 and counts.draft is 2, the same as without status and tab
+
+    Scenario: A reader's counts cover readable versions only
+      When a reader sends GET /v1/article/?group=story
+      Then counts.draft is 0 and counts.all equals the number of stories with an online version
+
+    Scenario: Total versus counts
+      When the owner sends GET /v1/article/?group=story&tab=missing
+      Then total is counts.missing and total is 7
+
+  Rule: Failure
+
+    Scenario: Repository failure answers 500
+      Given the repository fails on its next call
+      When the owner sends GET /v1/article/?group=story
+      Then the status is 500 and the body is "Failed to retrieve articles"
+
+    Scenario: A failure while counting fails the request
+      Given the repository fails while the counts are evaluated
+      Then the status is 500 and the body is "Failed to retrieve articles"
+
+  Rule: Persistence portability
+
+    Scenario: The grouped, access-filtered query passes the same cases on every database
+      Given the "Journal" dataset, a hidden-version dataset and the cases above (all languages, lang, tab=missing, status+author together, q with accents, sort whitelist, paging, counts)
+      Then they pass on SQLite, MySQL 8.4, MariaDB 11 and PostgreSQL with identical ids, totals and counts
+      And the result does not depend on the database collation for the id sets
+      And no raw SQL uses a dialect-only construct
+
+  Rule: The SPA, editorial list screen
+
+    Background:
+      Given /article keeps its route and URL conventions of features/articles_pagination_screen.feature, and the screen follows docs/design/screens/localization-list.md group L7
+      And ArticlesPage always sends group=story; the URL carries site, lang, tab (omitted when all), q, status, author, seo, page and size, defaults omitted, and any filter change drops page
+      And an invalid value in the URL falls back to its default and is replaced in the URL
+      And the unit label (UnitLabel, aria-live polite) states the unit: "8 articles", "4 French versions", "4 articles not in French", "7 articles need translation"
+      And the tab "Needs review" is not rendered (it ships with release 2); loc.l7.review is not part of this slice
+      And the tabs: with no language "All articles" and "Needs translation"; with a language "All", "Published" (status=online), "Drafts" (status=draft) and "Not in {Language}", each with its count from counts
+      And the row menu on every width lists Open {language}, Open another language, Add translation, Publish or Unpublish {language}, Copy API URL, Delete {language} version, each shown when its capability or condition holds (docs/design/localization-tables.md "Row actions"), and every row has the menu button
+      And coverage chips follow docs/design/localization-tables.md "Coverage chips for many languages": 5 shown at 1440 and 4 at 1024 and 390, then "+N" named "N more languages: ..."; dashed chips only for missing_langs and buttons on desktop only
+      And below md the filters open a sheet (Site, Language, Status, Author, SEO, Clear all, "Show N results") and the tabs scroll with an edge fade and "Scroll tabs left/right" buttons that keep Not in {Language} reachable
+      And copy comes from the design; no revision number, id or HTTP status name is shown
+
+    Scenario Outline: The design states of group L7 are rendered from the matching response
+      Given the Journal dataset (and Press, Atelier or the limited reader where the state names it) mocked on GET /v1/article/ as above
+      When the user opens <route>
+      Then the screen shows state <state> as drawn: <visible>
+
+      Examples:
+        | state                | route                                           | visible                                                                                         |
+        | loc.l7.all           | /article                                        | 5 of 8 rows, unit "8 articles", tabs "All articles" "Needs translation", pager page 1 of 2         |
+        | loc.l7.page2         | /article?page=2                                 | 3 of 8 rows, pager page 2 of 2                                                                    |
+        | loc.l7.fr            | /article?lang=fr                                | unit "4 French versions", tabs All, Published, Drafts, Not in French                              |
+        | loc.l7.frMissing     | /article?lang=fr&tab=missing                    | unit "4 articles not in French"                                                                    |
+        | loc.l7.emptyMissing  | /article?tab=missing&site=press                 | no summary, no pager, the nothing-missing empty state                                              |
+        | loc.l7.noResults     | /article?q=zinc                                 | no-results empty state, every count 0                                                              |
+        | loc.l7.frLoading     | /article?lang=fr (request pending)              | counts shown as "–", skeleton rows, aria-busy                                                      |
+        | loc.l7.listFail      | /article?lang=fr (request fails)                | failure state with the filters kept and a retry                                                    |
+        | loc.l7.limited       | /article as a reader without create             | no dashed chips, no Add translation item                                                           |
+        | loc.l7.author        | /article?author=<Marta Alves id>                | 3 articles, filter chip and "Clear all"                                                            |
+        | loc.l7.langFilter    | language filter opened                           | Enabled and Disabled groups                                                                        |
+        | loc.l7.rowMenu       | a row menu opened                                | the same actions on desktop and mobile                                                             |
+        | loc.l7.filters       | /article?lang=fr&status=draft at 390             | filter sheet with Journal, French, Draft: "Show 2 results"                                         |
+        | loc.l7.tabsScroll    | tabs scrolled (1440, 390)                        | Not in French reachable; fade and chevrons                                                         |
+        | loc.l7.long          | /article?site=atelier (8 languages)              | chips collapse to +3, +4, +4; Draft and SEO filters                                                |

features/article_list_localization.qa.md

@@ -0,0 +1,43 @@
+# QA: Editorial article list by story and language
+
+Order of work is part of the procedure: the repository query and its real-database tests come first (items 1 to 4), then the use case and the HTTP contract (5 to 8), then the SPA (9 onward). Backend items are Go tests in `test/`, black-box.
+
+## Automated, repository (SQLite file, task test)
+
+1. Seed the "Journal" dataset (8 stories, 17 versions, bylines, updated_at as in the feature) and the "hidden-version" variant through the real `ArticleRepository` on a temp SQLite file with `database.Migrate`. Drive the new grouped query through `article.Repository` with the new filter fields (group, lang, tab, author) and assert, table-driven over the feature's Examples: story ids per page, `total`, representative per story, coverage order, `missing_langs`, `story_updated_at`, `story_authors`, counts.
+2. Access filter inside the query: for a caller with scope `own`, `all`-online and `online only`, assert the hidden-version dataset yields the same ids, totals and counts as a database where the hidden articles do not exist. Also check page boundaries (a hidden version must not shift a page: 5 per page of readable stories).
+3. Filter semantics: the "single readable version satisfies all version-level filters" cases (status+author, status+q, author+seo), the "story_authors is the union" case, the "missing" cases (no readable version, site not enabling the language, disabled language, unassigned-only stories never listed, mixed stories listed: TestArticleListLocalization* "Missing membership and counts agree with the missing_langs of the rows") and accent-insensitive q in grouped, language and not-in modes.
+3b. Stored SEO status: TestArticleStoryListSEOFilterAtScaleSQLite runs the startup backfill once over 40,001 versions, then asserts per request zero stale versions read, zero FindPage calls and one title search with q. TestArticleSEOIndex* (SQLite, MySQL, PostgreSQL) asserts that each write path clears the stored status and the refresh recomputes it, that a status computed before a concurrent write is not stored, and that the site description counts for the default language only and follows a default change.
+4. Sort whitelist and stability: each sort of the feature, ties by story_id descending, no overlap or gap between pages 1 to 3 on a 12-story set.
+
+## Automated, real databases (task test:mysql, task test:postgres)
+
+Repeat items 1 to 4 against MySQL 8.4, MariaDB 11 and PostgreSQL. Compare ids, totals and counts with SQLite, not only pass/fail. Also assert no query returns a different id set under a different collation (title sort aside). Record NOT RUN with the reason if the daemon is down, or use the podman shim (see memory). Inspect the executed SQL once (GORM debug) to confirm no dialect-only construct, no per-row query for coverage (coverage and authors are loaded in a bounded number of queries per page), and that request text is never concatenated.
+
+## Automated, use case (task test)
+
+5. `ListArticlesUseCase` over fakes: grouped command, role grants for owner, reader and restricted writer, fake `site` and `localization` repositories. Assert representative choice, `missing_langs` only when `create_translation` is held, the counts rules, and that a hidden version never reaches the result. Assert sentinel errors with `errors.Is`. Existing use case tests stay green.
+
+## Automated, HTTP (task test)
+
+6. `article.NewHandler(...)` over the real use cases and fakes, a fresh `chi.NewRouter()` mirroring `NewArticleRouter` in `api/router.go` (GET / under `jwtauth.Verifier` only), `validator.InitValidator()` first, `httptest`, jwt cookies signed with a test `jwtauth.New("HS256", ...)` secret (owner, reader, restricted writer, unverified user, expired, none).
+7. "Public lists are unchanged": bare request and a public request keep the flat keys exactly (compare the key set and values with a golden produced before the slice); `lang=fr` and `author` narrow the flat list; `group=story` for the three public callers and every invalid query in the Examples answer 400 with `apperr.BodyErrorMessage` and the fake repository records no call.
+8. Grouped response shape: decode and assert `items[]` keys (flat item keys plus `story_updated_at`, `story_authors`, `coverage`, `missing_langs`, `excluded_from_public`, `capabilities`; coverage entries carry `excluded_from_public` and `source_article_id`), `total`, `page`, `size`, `counts` keys (all, online, draft, suggestions, missing), `items` `[]` not null, snake_case, errors plain text. Repository failure and count failure answer 500 "Failed to retrieve articles". Docs: `docs/` gains the grouped contract (parameters, shape, counts, errors) so the SPA mocks `/v1` from it.
+
+## Automated, SPA (Vitest + Vue Test Utils, task test:web)
+
+9. Mock `GET /v1/article/` per state with the Journal responses of the feature (and Press, Atelier and the reader). One test per design state of group L7 except `loc.l7.review`: `loc.l7.all`, `page2`, `fr`, `frMissing`, `emptyMissing`, `noResults`, `frLoading`, `listFail`, `limited`, `author`, `langFilter`, `rowMenu`, `filters`, `tabsScroll`, `long`. Assert: the request query (`group=story`, lang, tab, author, page, size; defaults omitted), the URL after a successful response, the unit label text, the tab labels and counts, "–" counts while loading, the retained filters on failure, the chip order and collapse (+N, accessible names), dashed chips only from `missing_langs`, and the identical row menu items at mobile and desktop widths.
+10. URL state: invalid `lang`, `tab=review`, `author=abc`, `page=abc` fall back and are replaced; every filter change drops `page`; the tab and filter chips match the URL; "Clear all" empties all filters.
+11. Regression of the amended screens: `ArticlesPage` still passes the sort, pagination, row action, delete and toast cases of `articles_list` and `articles_pagination_screen`, now on grouped rows.
+
+## Visual (task visual:check -- localization-list or the L7 group)
+
+Compare each state with its board frame at desktop (1440), 1024 where the board draws it, and mobile (390), light and dark. The gate is hard: every capture within 10 %. Mock `/v1` from `web/visual/states.ts` with the board's own data (`docs/design/source/locale-fixtures.js`: Journal 8 stories, 17 versions, page size 5; Press; Atelier; the limited scope). Titles, bylines (Marta Alves, Camille Roche, Luis Ferrer) and the language names come from the fixture. All states use relative text ("2 h ago", "Yesterday", "3 days ago"): list them as `skip: clock-sensitive` only if the SPA renders them from the current time; otherwise freeze nothing and use the board's absolute dates. `loc.l7.review` is out of scope (release 2). `loc.l7.tabsScroll` is captured at 1440 and 390 only.
+
+## Manual
+
+- Keyboard and focus: tab order through search, filters, tabs (arrow keys), rows, row menu (Enter or Down opens, Esc returns to the button), chips, pager; focus ring on the dashed chip buttons; the filter sheet traps focus and returns it to its trigger.
+- Screen reader: the unit label announces politely on every filter change; chips announce "French: draft" and "3 more languages: ...".
+- Hover and motion: tab fade and chevrons, skeleton pulse, sheet open and close, reduced motion.
+- Real databases through a running server: open the list against a real SQLite file with several languages, a restricted account, and the same data on MySQL and PostgreSQL; compare counts with the Languages page.
+- Real SMTP: not applicable.

features/article_localization_storage.feature

@@ -0,0 +1,152 @@
+Feature: Article language, story and per-site language storage
+  Articles gain a full BCP 47 language tag, a story they belong to and a
+  content revision. Each site gets a language table with one default. Existing
+  articles keep their ids, bodies, publication and public API. They are
+  migrated without a guessed language: each gets its own story and an
+  unassigned language until the owner confirms the site default.
+
+  Background:
+    Given the supported languages are "en", "en-GB", "en-US", "fr", "fr-CA", "pt", "pt-BR", "es", "de", "ar"
+    And a language tag keeps its region, "pt-BR" is never reduced to "pt"
+    And the domain package internal/domain/language imports only the stdlib
+    And persistence is portable across SQLite, MySQL and PostgreSQL
+
+  Scenario Outline: Language tag normalization
+    When the tag "<input>" is normalized
+    Then the result is "<result>"
+
+    Examples:
+      | input   | result                 |
+      | en      | en                     |
+      | EN      | en                     |
+      | pt-br   | pt-BR                  |
+      | PT_BR   | ErrInvalidLanguage     |
+      | fr-ca   | fr-CA                  |
+      |  fr     | fr                     |
+      | e       | ErrInvalidLanguage     |
+      | english | ErrInvalidLanguage     |
+      | en-ZZZZ | ErrInvalidLanguage     |
+      |         | ErrInvalidLanguage     |
+      | xx      | ErrUnsupportedLanguage |
+
+  Scenario Outline: Suggestion for a site's default language from Site.Locale
+    Given a site whose Locale is "<locale>"
+    When the default language suggestion is computed
+    Then the suggestion is "<suggested>" and the substitution flag is <substituted>
+
+    Examples:
+      | locale | suggested | substituted |
+      | pt-BR  | pt-BR     | false       |
+      | en-GB  | en-GB     | false       |
+      | fr-BE  | fr        | true        |
+      | fr     | fr        | false       |
+      | xx-YY  | none      | false       |
+      | null   | none      | false       |
+
+  Scenario: Migration of an existing site and its articles
+    Given a database created before this change with site "default" (Locale "fr-CA") and articles 1, 2 and 3 in it, article 3 online
+    When database.Migrate runs
+    Then every article keeps its id, title, body, slug, is_online and timestamps
+    And each article has lang "" and its own distinct story_id
+    And each article has content_revision 1
+    And site "default" has one site_languages row "fr-CA" with is_default true, enabled true and confirmed false
+    And the migration marker for the article story backfill is recorded
+
+  Scenario: Site without a usable locale gets no suggestion row
+    Given a site with Locale null
+    When database.Migrate runs
+    Then the site has no site_languages row
+
+  Scenario: Migration runs twice
+    Given a migrated database
+    When database.Migrate runs again
+    Then no story is created or changed, no article changes and no site_languages row changes
+    And the schema is identical
+
+  Scenario: Migration is atomic
+    Given a database with 3 existing articles
+    And the backfill write fails while handling the second article
+    When database.Migrate runs
+    Then no article has a story_id and the marker is not recorded
+    And the next Migrate completes the whole backfill
+
+  Scenario: Soft-deleted articles are migrated
+    Given an article that is soft-deleted before the change
+    When database.Migrate runs
+    Then it has its own story_id and its tombstone slug is unchanged
+
+  Scenario: Slug is unique per site and language
+    Given site 1 holds an article with slug "bonjour" in language "fr"
+    When another article is created in site 1, language "fr", slug "bonjour"
+    Then the write fails with a unique violation mapped to ErrSlugTaken
+    When an article with slug "bonjour" is created in site 1, language "en"
+    Then it is stored
+    When an article with slug "bonjour" is created in site 2, language "fr"
+    Then it is stored
+
+  Scenario: Existing unassigned articles keep the current per-site slug rule
+    Given two unassigned articles in site 1
+    When the second is written with the first one's slug
+    Then ErrSlugTaken is returned
+
+  Scenario: One version per language in a story
+    Given story 7 holds an article in language "fr"
+    When a second article is stored in story 7, language "fr"
+    Then the write fails with a unique violation
+    When an article is stored in story 7, language "en"
+    Then it is stored
+
+  Scenario: Unassigned articles never collide on language
+    Given 3 articles each with lang "" and their own story
+    Then all 3 are stored
+
+  Scenario: Creating an article before the default is confirmed
+    Given site "default" has an unconfirmed suggestion "fr-CA"
+    When a user creates an article with title "Bonjour le monde"
+    Then the article has lang ""
+    And it has a new story_id and content_revision 1
+
+  Scenario: Creating an article after the default is confirmed
+    Given site "default" has a confirmed default "fr-CA"
+    When a user creates an article with title "Bonjour le monde"
+    Then the article has lang "fr-CA"
+    And it has a new story_id distinct from every other article
+
+  Scenario: Create racing a confirmation never strands an article
+    Given site "default" has unassigned articles
+    When the default is confirmed and assigned to unassigned articles in one transaction while articles are created concurrently
+    Then every article of the site ends with the confirmed default
+    And no article has a different language than the confirmed default
+
+  Scenario: Assigning a language is idempotent
+    Given a site whose unassigned articles were assigned "fr-CA"
+    When the assignment runs again
+    Then no article changes
+
+  Scenario Outline: Article reads expose lang and story_id
+    Given article 12 with lang "<lang>" in story 5
+    When it is read through "<read>"
+    Then the JSON contains "lang": "<lang>" and "story_id": 5
+    And every key present before this change is present with an unchanged value and type
+
+    Examples:
+      | lang  | read                                     |
+      | fr-CA | GET /v1/article/12 with a valid jwt      |
+      |       | GET /v1/article/12 with a valid jwt      |
+      | fr-CA | GET /v1/article/ list item               |
+      | fr-CA | public article read of an online article |
+
+  Scenario: PATCH ignores lang and story_id
+    When PATCH /v1/article/{id} carries "lang" or "story_id"
+    Then the fields are ignored and the stored values are unchanged
+    And POST /v1/article/ honours lang, story_id, source_article_id and copy only as defined in features/article_translation_create.feature
+    And a POST without them behaves as before
+
+  Scenario: Existing behaviour is unchanged
+    Then the existing article, pagination, publishing and SEO tests pass without edits
+    And offline articles still read as not found publicly
+
+  Scenario: Persistence portability
+    Given the repository contract cases above
+    Then they pass on SQLite, MySQL 8.4, MariaDB 11 and PostgreSQL
+    And no raw SQL uses a dialect-only construct

features/article_localization_storage.qa.md

@@ -0,0 +1,28 @@
+# QA: Article localization storage (backend)
+
+Backend only. Go tests in test/, black-box. No design states. No new endpoints.
+
+## Automated, no server (task test)
+1. Language domain: table-driven over "Language tag normalization" and "Suggestion for a site's default language". Assert the sentinel errors with errors.Is.
+2. Use case: with fake repositories, run "Creating an article before the default is confirmed" and "after the default is confirmed". Assert that CreateArticle runs inside the Transactor, that it locks the site row (site.Repository.LockSite) and then reads the starting language through the localization port (localization.Repository.Rows, localization.ConfirmedDefaultTag) and passes it to Create as Lang, and that the story is created by the article repository inside the same transaction. The former language.Repository, its SiteLanguageRepository adapter and the unwired ConfirmDefaultLanguageUseCase are retired; the confirmation tests drive ApplyLanguageSetupUseCase. Existing create tests stay green.
+3. HTTP: NewHandler over use cases with in-memory fakes, a fresh chi.NewRouter mirroring api/router.go, validator.InitValidator(), httptest. Cover "Article reads expose lang and story_id" for GET /v1/article/{id} with a jwt cookie signed by JWT_SECRET (the test secret), the list GET /v1/article/, and the public read of an online article. Assert that old keys are unchanged, that lang and story_id are the added keys, and that "lang" or "story_id" in a PATCH body is ignored. POST /v1/article/ honours lang, story_id, source_article_id and copy only as defined in features/article_translation_create.feature, and a POST without them behaves as before. Errors stay plain text.
+4. Regression: run the full existing article, pagination, publishing and SEO tests untouched.
+
+## Automated, SQLite file (task test)
+5. Fixture: a pre-change database built with the old models, holding a site with Locale "fr-CA", 3 articles (1 online, 1 soft-deleted) and article authors. Run Migrate and check the "Migration of an existing site" scenario. Check ids, bodies and slugs are unchanged, distinct story_ids, content_revision 1, the confirmed=false suggestion row, and the marker row.
+6. Migrate twice: nothing changes. Compare sqlite_master and a hash of all rows.
+7. Atomicity: inject a failing write (a wrapped *gorm.DB callback that errors on the second update). Assert no story_id is set and the marker is absent, then re-run successfully.
+8. Unique indexes: (story_id, lang) and (site_id, lang, slug) reject duplicates, and lang "" rows with different stories coexist. The old (site_id, slug) index definition is replaced by (site_id, lang, slug) under the same name idx_articles_site_slug, kept so existing tests keep passing.
+9. Concurrency: N goroutines create articles while the confirm-and-assign transaction runs. Assert the final state of "Create racing a confirmation". On SQLite the repository sets busy_timeout only (no WAL), so the test retries SQLITE_BUSY, counts the retries and asserts a bound.
+
+## Automated, real databases (task test:mysql, task test:postgres)
+10. Repeat 5-9 on MySQL 8.4, MariaDB 11 and PostgreSQL. Compare the unique indexes through information_schema or pg_indexes. Record NOT RUN if the daemon is down, or use the podman shim (see memory).
+11. On MySQL and MariaDB, check the index key lengths (utf8mb4): lang size is at most 35 and the slug index is within limits.
+
+## Build and lint
+12. task test, task lint:go, and CGO_ENABLED=0 go build -tags nofrontend ./... pass.
+13. docs/ gains the new article fields in the HTTP contract (lang, story_id) for the SPA slices.
+14. task mutate scoped to the new use case code with MUTATE_FILES. No comments in the added Go files.
+
+## Manual
+15. Back up a real database copy with article rows, start the new binary on it, check the articles list and one public read in a browser (no shape change), and restart to check the migration does not run twice.

features/article_publishing.feature

@@ -1,6 +1,8 @@
 Feature: An authenticated user can publish and unpublish an article
   Superseded in part by roles_permissions_content_scope: the article routes are gated by the content.* permissions of the caller's role (content.create, content.update, content.delete and content.publish; a refusal is 403 "missing_permission" with the header X-Missing-Permission), and content.read decides which drafts show: every draft at all, only the caller's own drafts at own, none otherwise. A draft the caller may not read answers 404 "Article not found", and a role that cannot be resolved is treated as holding no permission.
 
+  Extended by article_story_lifecycle: publishing a version in a disabled language answers 422 language_disabled.
+
   As an authenticated RenewCMS user managing the CMS
   I want to flip an article's is_online flag from an HTTP endpoint
   So that a draft can be published to the public site and a published article can be
@@ -25,6 +27,7 @@ Feature: An authenticated user can publish and unpublish an article
     And an id absent from the article repository answers 404 with body
       apperr.ArticleNotFoundErrorMessage, backed by errors.Is(err, article.ErrArticleNotFound),
       the same as DeleteArticle already does per features/write_not_found_errors.feature
+    And publishing and unpublishing act on one article id, one language version; sibling versions are untouched
     And GET /v1/article/ with no jwt cookie only returns online articles, per
       features/public_article_listing.feature; this slice does not change that behavior,
       only feeds it
@@ -93,6 +96,32 @@ Feature: An authenticated user can publish and unpublish an article
       | publish    |
       | unpublish  |
 
+  Scenario: Publishing a draft in a disabled language is refused
+    Given a valid jwt cookie for a user holding content.publish
+    And article 15 is offline in language "es", which is disabled on its site
+    When the client sends PATCH /v1/article/15/publish with that cookie
+    Then the response status is 422
+    And the response body is the text "language_disabled"
+    And article 15 stays offline
+
+  Scenario: An online version in a disabled language can still be unpublished, and publish is idempotent
+    Given a valid jwt cookie for a user holding content.publish
+    And article 16 is online in language "es", which is disabled on its site
+    When the client sends PATCH /v1/article/16/unpublish with that cookie
+    Then the response status is 200
+    And the response body is the article with id 16 and "is_online": false
+    When article 16 is online again and the client sends PATCH /v1/article/16/publish with that cookie
+    Then the response status is 200
+    And the response body is the article with id 16 and "is_online": true
+
+  Scenario: Publishing one language leaves the other versions alone
+    Given a valid jwt cookie for a user holding content.publish
+    And story 5 holds article 10 (en, online) and article 12 (fr, offline)
+    When the client sends PATCH /v1/article/12/publish with that cookie
+    Then the response status is 200
+    And article 12 is online
+    And the publication and updated_at of article 10 are unchanged
+
   Scenario: Publishing an article makes it appear in the public online-only list
     Given a valid jwt cookie for a user with id 1
     And the article repository contains an offline article titled "Draft: Kitchen Remodel" with id 2

features/article_publishing.qa.md

@@ -50,6 +50,15 @@ Package: `test` (black-box, extending `article_test.go`).
     the valid cookie (assert `200`), then call `GET /v1/article/` with no cookie and assert the
     decoded JSON array does not contain an element with id `1`.
 
+17. Disabled language: add a fake language repo row for "es" with enabled false and seed offline
+    article 15 in lang "es". `PATCH /v1/article/15/publish` -> status `422`, body
+    `"language_disabled\n"`, article stays offline, no `UpdateIsOnline` call recorded on the fake.
+18. Seed online article 16 in lang "es" (disabled). `PATCH /v1/article/16/unpublish` -> `200`,
+    `is_online == false`. Re-seed it online, `PATCH /v1/article/16/publish` -> `200`,
+    `is_online == true`.
+19. Siblings: seed story 5 with article 10 (en, online) and article 12 (fr, offline).
+    `PATCH /v1/article/12/publish` -> `200`; article 10's `IsOnline` and `UpdatedAt` are unchanged.
+
 ## Manual verification (not exercised by the Go test)
 - SPA-visible behaviour: confirm the back-office article editor exposes a publish/unpublish
   control that calls the new endpoints and updates the visible online/offline state, against the

features/article_story_lifecycle.feature

@@ -0,0 +1,333 @@
+Feature: Capabilities, translations, publish rules, delete and story move
+  An article read tells the editor what the caller may do with the version and which readable sibling versions exist. Publishing respects disabled languages. Deleting the last version removes its story, and a whole article can be deleted at once, atomically. A story moves to another site as a whole, atomically, never split. Nothing reveals a version the caller cannot read.
+
+  Background:
+    Given error responses are plain text, with extra data in headers
+    And site "journal" (id 1) has enabled languages en (default), fr, de, ar and disabled language es
+    And site "atelier" (id 2) has enabled languages en (default), fr, de
+    And story 5 in journal holds article 10 (en, online, created_by 1, slug renovation-costs), 12 (fr, offline, 1, couts), 11 (de, offline, 2, kosten) and 13 (ar, online, 3, takalif)
+    And "owner" holds every content permission at scope all
+    And "writer1" (user 1) holds content.create, content.read, content.update, content.publish and content.delete at scope own, and content.read at scope all for online articles only
+    And "reader" holds content.read at scope all only
+    And "restricted" holds content.create at scope all and content.read at scope own
+    And "deleter" holds content.delete at scope all and content.read at scope own
+
+  Scenario: Capabilities of the owner
+    When the owner sends GET /v1/article/12
+    Then "capabilities" is ["read","edit","publish","delete","create_translation"]
+
+  Scenario Outline: Capabilities per caller and version
+    When <caller> sends GET /v1/article/<id>
+    Then "capabilities" is <capabilities>
+
+    Examples:
+      | caller                                          | id | capabilities                                          |
+      | writer1                                         | 12 | ["read","edit","publish","delete","create_translation"] |
+      | writer1                                         | 11 | ["read","create_translation"]                         |
+      | reader                                          | 10 | ["read"]                                              |
+      | a user with content.update and content.read all | 12 | ["read","edit"]                                       |
+      | a user with content.publish and content.read all | 12 | ["read","publish"]                                  |
+      | anonymous                                       | 10 | ["read"]                                              |
+
+  Scenario: Translations list readable versions only
+    When writer1 sends GET /v1/article/10
+    Then "translations" has entries for 10, 12 and 13 and none for 11
+    And each entry has id, lang, title, is_online, language_enabled, excluded_from_public, source_article_id and capabilities
+    And no entry, count, placeholder or total names the hidden version
+
+  Scenario: Translations are ordered default language first, then by tag
+    When the owner sends GET /v1/article/12
+    Then the translations are ordered en, ar, de, fr
+    And the version being read is included
+
+  Scenario: Disabled languages are marked
+    Given language "fr" is disabled on journal
+    When the owner sends GET /v1/article/10
+    Then the fr entry has "language_enabled": false and is still listed
+
+  Scenario: A single-version article lists itself
+    Given article 20 is alone in story 8
+    When the owner sends GET /v1/article/20
+    Then "translations" has one entry, article 20 itself
+
+  Scenario: Anonymous reads expose nothing about siblings
+    When an anonymous client sends GET /v1/article/10
+    Then "translations" is []
+    And "capabilities" is ["read"]
+    And the response has no "missing_langs", "excluded_from_public", "source_unavailable" or "partial_view"
+    And the public shape is otherwise unchanged
+
+  Scenario: The source on the read
+    Given article 14 was created from article 10 at content_revision 4
+    When the owner sends GET /v1/article/14
+    Then "source" is {"article_id":10,"revision":4}
+    When article 10 is deleted or unreadable to the reader
+    Then "source" is null
+    And a version created empty has "source": null
+
+  Scenario Outline: Missing languages are the enabled languages without a readable version
+    When <caller> sends GET /v1/article/10
+    Then "missing_langs" is <missing>
+
+    Examples:
+      | caller     | missing     |
+      | owner      | []          |
+      | restricted | ["de","fr"] |
+      | reader     | []          |
+
+  Scenario: A version in a disabled language or without language is left out of public surfaces
+    Given article 14 (es, offline, created by restricted) is in story 5 and es is disabled on journal
+    And article 30 has lang "" and its own story
+    When the owner sends GET /v1/article/14
+    Then "excluded_from_public" is true
+    And the translations entry of 14 has "excluded_from_public": true and the entry of 10 has false
+    And GET /v1/article/30 has "excluded_from_public": true
+    And GET /v1/article/10 has "excluded_from_public": false
+
+  Scenario: A deleted source and an unreadable source read the same
+    Given article 14 tracks article 12 at content revision 2
+    When the owner sends GET /v1/article/14
+    Then "source" is {"article_id":12,"revision":2} and "source_unavailable" is false
+    When the restricted user, who cannot read 12, sends GET /v1/article/14
+    Then "source" is null and "source_unavailable" is true
+    When article 12 is deleted and the owner sends GET /v1/article/14
+    Then "source" is null and "source_unavailable" is true
+
+  Scenario: Translations name the source they track only when it is readable
+    Given article 14 tracks article 12
+    When the owner sends GET /v1/article/10
+    Then the translations entry of 14 has "source_article_id": 12 and the entry of 10 has null
+    When the restricted user sends GET /v1/article/14
+    Then the translations entry of 14 has "source_article_id": null
+
+  Scenario: Partial view follows the read scope of the caller only
+    When the owner sends GET /v1/article/10
+    Then "partial_view" is false
+    When the restricted user sends GET /v1/article/13
+    Then "partial_view" is true, whether or not the story holds a version the restricted user cannot read
+
+  Scenario Outline: Publishing respects the language configuration
+    Given a valid jwt cookie for a user holding content.publish
+    When the client sends PATCH /v1/article/<id>/publish
+    Then the response status is <status>
+    And <effect>
+
+    Examples:
+      | id | situation                                   | status | effect                        |
+      | 12 | fr enabled                                  | 200    | "is_online": true             |
+      | 15 | es disabled, offline version                | 422    | the body is "language_disabled" |
+      | 16 | es disabled, already online                 | 200    | unchanged, "is_online": true  |
+      | 30 | unassigned lang ""                          | 200    | "is_online": true             |
+
+  Scenario: Unpublish and edit stay available in a disabled language
+    Given fr is disabled on journal and article 12 is online
+    When the owner sends PATCH /v1/article/12/unpublish
+    Then the response status is 200
+    When the owner sends PATCH /v1/article/12 with {"body":"x"}
+    Then the response status is 200
+
+  Scenario: Publishing one version leaves the others alone
+    When the owner publishes article 12
+    Then articles 10, 11 and 13 keep their publication and updated_at
+
+  Scenario: Re-enabling a language allows publishing again
+    Given es is re-enabled on journal
+    When the owner sends PATCH /v1/article/15/publish
+    Then the response status is 200
+
+  Scenario Outline: Existing publish errors are unchanged
+    When <request>
+    Then the response status is <status>
+    And the response body is <message>
+
+    Examples:
+      | request                                                  | status | message                     |
+      | the owner publishes article 9999                         | 404    | Article not found           |
+      | the owner publishes article "abc"                        | 400    | apperr.IdUint32ErrorMessage |
+      | an anonymous client publishes article 12                 | 401    | Unauthorized                |
+      | the reader publishes article 12                          | 403    | missing_permission          |
+
+  Scenario: Deleting one version keeps the story
+    When the owner sends DELETE /v1/article/12
+    Then the response status is 204
+    And articles 10, 11 and 13 and story 5 remain
+    And the translations no longer list fr
+
+  Scenario: A deleted language can be created again
+    Given article 12 (fr) was deleted
+    When the owner sends POST /v1/article/10/translations with lang "fr"
+    Then the response status is 201
+    And fr of journal still counts as in use while a deleted fr version exists, per features/site_languages.feature
+
+  Scenario: Deleting the last version removes the story
+    Given story 8 holds only article 20
+    When the owner sends DELETE /v1/article/20
+    Then the response status is 204 and story 8 is gone
+    And creating a translation from story 8 answers 404 "Article not found"
+
+  Scenario: Deleting the last of several versions
+    When the owner deletes 10, 11, 12 and 13 one after another
+    Then story 5 exists after each of the first three deletions
+    And story 5 is gone after the fourth
+
+  Scenario: Delete is checked per version
+    When writer1 sends DELETE /v1/article/11
+    Then the response status is 403 and the body is "missing_permission"
+    And article 11 remains
+
+  Scenario: A story with a hidden version
+    Given writer1 deletes the last version it can see while an unreadable version remains
+    Then the story remains
+    And nothing in the response mentions the other version
+
+  Scenario: Deleting an article removes every version and the article
+    When the owner sends DELETE /v1/story/5
+    Then the response status is 204 with an empty body
+    And articles 10, 11, 12 and 13 and story 5 are gone
+    And one article.delete event per version is recorded with params.lang and params.story_id 5
+
+  Scenario: Versions the caller cannot read are deleted with the article
+    When the deleter, who reads 10 and 13 only, sends DELETE /v1/story/5
+    Then the response status is 204
+    And articles 11 and 12 are deleted too
+
+  Scenario: Deleting an article needs delete permission on every version
+    When writer1, whose content.delete is at scope own, sends DELETE /v1/story/5
+    Then the response status is 403, the body is "missing_permission" and X-Missing-Permission is "content.delete"
+    And every version remains
+    And the answer is the same whether or not the story holds a version writer1 cannot read
+
+  Scenario: A failed delete removes nothing
+    Given the database fails while the versions are deleted
+    When the owner sends DELETE /v1/story/5
+    Then the response status is 500 and the body is "Failed to delete article"
+    And every version and story 5 remain
+
+  Scenario: An unknown or unreadable article answers the same not found
+    When the owner sends DELETE /v1/story/9999
+    Then the response status is 404 and the body is "Article not found"
+    When the deleter sends DELETE /v1/story/77, whose only version is a draft by another user
+    Then the response status is 404 and the body is "Article not found"
+    And that version remains
+
+  Scenario: An invalid id is refused
+    When the owner sends DELETE /v1/story/abc
+    Then the response status is 400 with the uint32 id message
+
+  Scenario: Move a story
+    When the owner sends POST /v1/story/5/move with {"site":"atelier"}
+    Then the response status is 200
+    And the body is {"story_id":5,"site":"atelier","site_id":2,"article_ids":[10,12,11,13]}
+    And all four articles have site_id 2
+    And their slugs, lang, publication, content and authors are unchanged
+    And each moved version's revision rises by 1 and content_revision is unchanged
+
+  Scenario: A move requires every language to be enabled at the destination
+    Given atelier has no "ar" language
+    When the owner sends POST /v1/story/5/move with {"site":"atelier"}
+    Then the response status is 422 and the body is "language_not_enabled"
+    And the header X-Missing-Languages is "ar", readable versions only
+    And nothing is moved
+
+  Scenario: A language disabled at the destination counts as missing
+    Given de is listed but disabled on atelier
+    When the owner moves story 5 to atelier
+    Then the response status is 422
+    And X-Missing-Languages includes "de"
+
+  Scenario: A language disabled at the source still needs the destination
+    Given fr is disabled on journal and enabled on atelier
+    When the owner moves story 5 to atelier
+    Then the move succeeds
+    Given fr is disabled on journal and missing on atelier
+    When the owner moves story 5 to atelier
+    Then the response status is 422 and the body is "language_not_enabled"
+    And X-Missing-Languages is "fr"
+
+  Scenario: Address conflict at the destination
+    Given atelier has an fr article with slug "couts" and an ar article with slug "takalif"
+    And the caller can read 10, 11 and 12 but not 13
+    When the caller moves story 5 to atelier
+    Then the response status is 409 and the body is "slug_conflict"
+    And the header X-Conflicting-Articles is 12
+    And article 13 is neither named nor counted
+    And nothing is moved
+
+  Scenario: Every conflict of the story is checked
+    Given two versions of the story conflict at the destination
+    When a caller who can read both moves the story
+    Then no version moves
+    And both readable conflicting versions are named in X-Conflicting-Articles
+
+  Scenario Outline: A move needs update permission on every version, readable or not
+    When <caller> sends POST /v1/story/5/move with {"site":"atelier"}
+    Then the response status is <status>
+    And the response body is <message>
+    And no version is moved
+
+    Examples:
+      | caller                                  | status | message             |
+      | an anonymous client                     | 401    | Unauthorized        |
+      | writer1                                 | 403    | missing_permission  |
+      | a user without content.update           | 403    | missing_permission  |
+      | a user who can read no version          | 404    | Article not found   |
+
+  Scenario: Hidden versions never leak through the move
+    Given the caller cannot read some versions of story 5
+    Then a 403 body and headers, a 422 X-Missing-Languages and a 409 X-Conflicting-Articles name only readable versions
+    And a 200 article_ids lists only readable versions
+
+  Scenario Outline: Move validation
+    When the owner sends <request>
+    Then the response status is <status>
+    And the response body is <message>
+
+    Examples:
+      | request                                        | status | message                     |
+      | POST /v1/story/5/move with {"site":"nowhere"}  | 404    | site_not_found              |
+      | POST /v1/story/5/move with {}                  | 400    | apperr.BodyErrorMessage     |
+      | POST /v1/story/5/move with malformed JSON      | 400    | apperr.BodyErrorMessage     |
+      | POST /v1/story/9999/move with {"site":"atelier"} | 404  | Article not found           |
+      | POST /v1/story/abc/move with {"site":"atelier"} | 400   | apperr.IdUint32ErrorMessage |
+
+  Scenario: Moving to the current site
+    When the owner sends POST /v1/story/5/move with {"site":"journal"}
+    Then the response status is 200
+    And nothing changes
+    And no activity event is recorded
+
+  Scenario: The move is atomic and revalidated inside the transaction
+    When a version is edited, a language is disabled at the destination, or an address is taken between the pre-check and the write
+    Then the move is refused with the matching error and no version moves
+    When a write fails on the third version
+    Then the first two are rolled back
+
+  Scenario: PATCH site_id cannot split a story
+    When the owner sends PATCH /v1/article/10 with {"site_id":2}
+    Then the response status is 409 and the body is "story_move_required"
+    And nothing is changed
+
+  Scenario: PATCH site_id counts readable versions only
+    Given a story holds three versions and a caller reads only one of them
+    When that caller sends PATCH site_id on the readable version
+    Then content.update is required on every version of the story, readable or not, and the whole story moves under the story move rules
+    And every version, hidden ones included, ends up on the destination site in one transaction
+    And a language, address or slug refusal rolls everything back and names readable versions only
+    And a caller lacking update on any version gets 403 "missing_permission" with nothing naming a hidden version
+    And a caller who reads two versions gets 409 "story_move_required"
+
+  Scenario: PATCH site_id on a single-version story applies the move rules
+    Given story 8 holds only article 20 in lang "fr"
+    When the owner sends PATCH /v1/article/20 with {"site_id":2}
+    Then the article moves when fr is enabled at atelier
+    And otherwise the response is 422 "language_not_enabled"
+    And an unassigned article (lang "") moves without a language check
+
+  Scenario: Activity events carry the language
+    Then publish, unpublish, edit and delete events hold params lang, omitted for an unassigned article
+    And a move records one "article.edit" event per moved version with the site change and lang
+    And a refused move records one failed event with a plain reason naming no hidden version
+
+  Scenario: Persistence portability
+    Given the story delete rule, the (story_id, lang) re-creation after a delete and the atomic move with a unique (site_id, lang, slug) conflict
+    Then they pass on SQLite, MySQL 8.4, MariaDB 11 and PostgreSQL

features/article_story_lifecycle.qa.md

@@ -0,0 +1,27 @@
+# QA: Capabilities, translations, publish rules, delete and story move (backend)
+
+Backend only. Go tests in test/, black-box. No design states.
+
+## Automated, no server (task test)
+1. Use cases over fakes (article, site, language, localization, role grants) and a fake Transactor: the capabilities and translations mapping, the publish rule, deleting the last version and MoveStory. Table-driven over every Examples table; assert the sentinels with errors.Is. MoveStory runs the permission check, the language check, the slug check and all writes inside one Transactor.Run, and a failing write rolls back all fake rows.
+2. HTTP via the article NewHandler and the new story handler, a chi router mirroring api/router.go (/article and /story mounts, authtoken group), validator.InitValidator(), httptest and jwt cookies for owner, writer1, reader and none. Assert exact bodies and the headers X-Existing-Article-Id (absent where not allowed), X-Current-Revision, X-Conflicting-Articles and X-Missing-Languages. Hidden versions appear in no body, header or count.
+3. Anonymous reads: the key set is the slice 1 set plus revision, capabilities, translations and source. Signed-in reads add missing_langs, excluded_from_public, source_unavailable and partial_view (TestArticleEditorialContextHTTP; TestArticleCreatedByHttp compares the two shapes).
+3b. Whole-article delete: TestStoryDeleteHTTP covers every scenario of the "Deleting a whole article" rule over the story world (fake transactor with rollback, DeleteStory failure injected through the fail switch).
+4. Activity: a fake recorder receives params.lang on publish, unpublish, edit, delete and per-version move events.
+5. Regression: the article_publishing and article_title_rules tests pass with the updated pair text.
+
+## Automated, SQLite file (task test)
+6. Deleting the last version removes the story row, deleting one keeps it. Re-creating fr after deleting fr works. The site_languages in-use count still includes a deleted fr version (slice 2 TestLanguageInUseCountsSoftDeletedVersions stays green).
+6b. DeleteStory: TestArticleSEOIndex* "Deleting an article removes every version and the article row" (live versions 0, story row gone, slugs free, a second call is not found), on SQLite and on the real databases.
+7. Move: all site_id values change together. A unique (site_id, lang, slug) violation at the destination rolls back every row. An injected write failure on the third row leaves all rows unchanged.
+8. PATCH site_id counts readable versions only: with one readable version in a multi-version story it runs the full story move (every version, hidden ones too, moves in one transaction; language and slug refusals roll back and name readable versions only), which needs content.update on every version (403 missing_permission otherwise); with two readable versions it is 409 story_move_required.
+
+## Automated, real databases (task test:mysql, task test:postgres)
+8. Repeat 6-7 on MySQL 8.4, MariaDB 11 and PostgreSQL. Record NOT RUN if the daemon is down, or use the podman shim (see memory).
+
+## Build and lint
+9. task test, task lint:go and CGO_ENABLED=0 go build -tags nofrontend ./... pass. No comments in the added Go files. The architect checks api/router.go and api/dependecyInjection.go.
+10. task mutate scoped via MUTATE_FILES to the new use cases.
+
+## Manual
+None.

features/article_title_rules.feature

@@ -1,4 +1,5 @@
 Feature: The article title rule is the same in the request and the domain
+  Superseded in part by article_edit_revision: titles are editable.
   Superseded in part by roles_permissions_content_scope: the article routes are gated by the content.* permissions of the caller's role (content.create, content.update, content.delete and content.publish; a refusal is 403 "missing_permission" with the header X-Missing-Permission), and content.read decides which drafts show: every draft at all, only the caller's own drafts at own, none otherwise. A draft the caller may not read answers 404 "Article not found", and a role that cannot be resolved is treated as holding no permission.
 
   As the maintainer of RenewCMS
@@ -26,9 +27,7 @@ Feature: The article title rule is the same in the request and the domain
       500 with body "Failed to create article"
     And POST /v1/article/ sits behind the jwtauth Verifier and Authenticator group and
       requires a valid jwt cookie
-    And UpdateArticleUseCase exposes only UpdateBody, AddImage and UpdateIsOnline; no
+    And PATCH /v1/article/{id} accepts `title` with the same 3-200 rune rule, rejected as 400 with apperr.ArticleTitleErrorMessage (see features/article_edit_revision.feature)
-      route or use case updates an article's title after creation, so this feature only
-      concerns article creation
 
   Scenario Outline: CreateArticle now measures title length in runes, not bytes
     Given an empty article repository fake
@@ -76,6 +75,34 @@ Feature: The article title rule is the same in the request and the domain
     And the response body is the text apperr.ArticleTitleErrorMessage
     And the response body is not "Failed to create article"
 
+  Scenario Outline: PATCH /v1/article/{id} enforces the same 3-200 rune boundary
+    Given a valid jwt cookie for a user holding content.update
+    And the article repository contains an article with id 1
+    When the client sends PATCH /v1/article/1 with that cookie and a title of <length> ASCII characters
+    Then the response status is <status>
+    And <storage_effect>
+
+    Examples:
+      | length | status | storage_effect        |
+      | 2      | 400    | the title is unchanged |
+      | 3      | 200    | the title is stored    |
+      | 200    | 200    | the title is stored    |
+      | 201    | 400    | the title is unchanged |
+
+  Scenario: A domain title rejection on update is a 400, not a 500
+    Given a valid jwt cookie for a user holding content.update
+    And the article repository fake is configured so its next Update call returns article.ErrInvalidTitle
+    When the client sends PATCH /v1/article/1 with that cookie and title "Valid Title"
+    Then the response status is 400
+    And the response body is the text apperr.ArticleTitleErrorMessage
+
+  Scenario: Editing the title does not change the slug
+    Given a valid jwt cookie for a user holding content.update
+    And the article with id 1 has slug "backyard-renovation-update"
+    When the client sends PATCH /v1/article/1 with that cookie and title "A brand new title"
+    Then the response status is 200
+    And the slug is still "backyard-renovation-update"
+
   Scenario: A non-title repository failure during creation still answers 500
     Given a valid jwt cookie for a user with id 1
     And the article repository fake is configured to fail on its next Create call with

features/article_title_rules.qa.md

@@ -73,6 +73,15 @@ Package: `test` (black-box, alongside `article_test.go` / `use_case_baseline_tes
     article\n"` -- regression proof a non-title failure still answers 500.
 14. `POST /v1/article/` with no jwt cookie -> status `401` (regression: the route is
     still gated).
+15. `PATCH /v1/article/1` with a cookie of a user holding content.update and a title of
+    2 / 3 / 200 / 201 ASCII characters -> `400` unchanged / `200` stored / `200` stored /
+    `400` unchanged. Body `apperr.ArticleTitleErrorMessage + "\n"` on the 400s.
+16. `PATCH /v1/article/1` with `"title": ""` (present but empty) -> `400`, title unchanged
+    (guard against `omitempty` on a `*string` skipping validation).
+17. Configure the fake repo so its next `Update` returns `article.ErrInvalidTitle`.
+    `PATCH /v1/article/1` with title "Valid Title" -> `400`, body
+    `apperr.ArticleTitleErrorMessage + "\n"`.
+18. `PATCH /v1/article/1` with only a new title -> `200`, slug unchanged.
 
 ## Manual verification (not exercised by the Go test)
 - None. This slice has no SPA-visible behaviour and no SMTP involvement.

features/article_translation_create.feature

@@ -0,0 +1,191 @@
+Feature: Create a translation of an article version
+  A user who can create articles adds a version of an existing article in another language. The version joins the story of the version it is created from, in the same site, as an offline draft. Two entry points share one implementation: POST /v1/article/{id}/translations and POST /v1/article/ with story_id. The story_id entry point is deprecated: it keeps working with the same results, and new clients use POST /v1/article/{id}/translations. Hidden versions are never named, counted or hinted at.
+
+  Background:
+    Given the language rules of features/article_localization_storage.feature apply
+    And error responses are plain text whose body is the snake_case code, with extra data in response headers
+    And a "writer" is a verified user with content.create, content.update and content.read at scope all
+    And a "restricted writer" holds content.create and content.read at scope own
+    And site "journal" (id 1) has enabled languages en (default), fr, de, ar and disabled language es
+    And story 5 in "journal" holds article 10 (lang en, online, created by user 1, title "Renovation costs") and article 11 (lang de, offline, created by user 2)
+    And article 10 has body, excerpt, seo_title, seo_description, social_title, social_description, cover_image_id 3, cover_image_alt, social_image_id 4, canonical_url, noindex true, authors [Camille] and content_revision 4
+
+  Scenario: Copy from the source version
+    Given a valid jwt cookie for a writer
+    When the client sends POST /v1/article/10/translations with {"lang":"fr","title":"Couts de renovation","copy":true}
+    Then the response status is 201 and the body is the created article JSON
+    And it has a new id, lang "fr", story_id 5, site_id 1, is_online false and the given title
+    And body, excerpt, seo_title, seo_description, social_title, social_description, cover_image_id, cover_image_alt, social_image_id and authors equal article 10's
+    And the slug is generated from the new title, not copied
+    And canonical_url is empty, noindex is false and seo_dismissed is empty
+    And created_by is the caller and revision is 1
+    And the source is article 10 with source_revision 4, captured in the same transaction as the copy
+    And articles 10 and 11 are unchanged
+    And no file or image row is duplicated
+
+  Scenario: Copy from a chosen source
+    Given a valid jwt cookie for a writer
+    When the client sends POST /v1/article/10/translations with {"lang":"fr","title":"Kosten","copy":true,"source_article_id":11}
+    Then the response status is 201
+    And the content is copied from article 11
+    And the source is article 11 with its content_revision at that moment
+
+  Scenario: Start empty
+    Given a valid jwt cookie for a writer
+    When the client sends POST /v1/article/10/translations with {"lang":"fr","title":"Couts de renovation","copy":false}
+    Then the response status is 201
+    And body, excerpt, SEO and social text are empty
+    And there is no cover image and no social image
+    And authors is the creating user's byline
+    And there is no source and GET shows "source": null
+
+  Scenario Outline: Request validation
+    Given a valid jwt cookie for a writer
+    When the client sends POST /v1/article/10/translations with <body>
+    Then the response status is <status>
+    And the response body is <message>
+    And nothing is stored
+
+    Examples:
+      | body                                                   | status | message                          |
+      | {"title":"Couts","copy":true}                          | 400    | the validate tag error text      |
+      | {"lang":"fr","copy":true}                              | 400    | the validate tag error text      |
+      | {"lang":"fr","title":"ab","copy":true}                 | 400    | the validate tag error text      |
+      | {"lang":"fr","title":"<201 characters>","copy":true}   | 400    | the validate tag error text      |
+      | {"lang":"fr","title":"Couts"}                          | 400    | apperr.BodyErrorMessage          |
+      | {"lang":"fr","title":"Couts","copy":false,"source_article_id":10} | 400 | apperr.BodyErrorMessage      |
+      | {"lang":"fr",                                          | 400    | apperr.BodyErrorMessage          |
+      | {"lang":"english","title":"Couts","copy":true}         | 422    | invalid_language                 |
+      | {"lang":"xx","title":"Couts","copy":true}              | 422    | unsupported_language             |
+      | {"lang":"ja-JP","title":"Couts","copy":true}           | 422    | unsupported_language             |
+
+  Scenario: The language tag is normalized
+    Given a valid jwt cookie for a writer
+    When the client sends POST /v1/article/10/translations with {"lang":"FR","title":"Couts","copy":true}
+    Then the response status is 201
+    And the stored lang is "fr"
+
+  Scenario: Language not configured on the site
+    Given site "journal" has no language row for "pt"
+    When a writer sends POST /v1/article/10/translations with {"lang":"pt","title":"Custos","copy":true}
+    Then the response status is 422 and the body is "language_not_enabled"
+    And nothing is stored
+
+  Scenario Outline: One neutral answer when the language cannot be used
+    Given a valid jwt cookie for the caller
+    And <situation>
+    When the caller sends POST /v1/article/10/translations with {"lang":"fr","title":"Couts","copy":true}
+    Then the response status is 409 and the body is "language_unavailable"
+    And there is no X-Existing-Article-Id header
+    And the body and the header set are identical across the three situations
+    And nothing is stored
+
+    Examples:
+      | situation                                                                                       |
+      | an fr version exists but is unreadable to the restricted writer (draft of another user)          |
+      | fr is disabled on the site                                                                       |
+      | a concurrent request created fr first (unique violation on (story_id, lang))                     |
+
+  Scenario: The language already exists and is readable
+    Given a valid jwt cookie for a writer
+    When the client sends POST /v1/article/10/translations with {"lang":"de","title":"Kosten","copy":true}
+    Then the response status is 409 and the body is "language_exists"
+    And the header X-Existing-Article-Id is 11
+    And nothing is stored
+    When the client sends the same request with "lang":"en"
+    Then the response status is 409 and the body is "language_exists"
+    And the header X-Existing-Article-Id is 10
+
+  Scenario: Two concurrent requests for the same language
+    Given a valid jwt cookie for a writer
+    When two requests for lang "fr" on story 5 run at the same time
+    Then exactly one answers 201
+    And the other answers 409 "language_unavailable" and stores nothing
+    And story 5 holds exactly one fr version
+
+  Scenario Outline: The path version and the source must be readable
+    When the caller sends <request>
+    Then the response status is <status>
+    And the response body is <message>
+    And nothing is stored
+
+    Examples:
+      | request                                                                                   | status | message                       |
+      | anonymous POST /v1/article/10/translations                                                | 401    | Unauthorized                  |
+      | reader without content.create POST /v1/article/10/translations                            | 403    | missing_permission            |
+      | writer POST /v1/article/9999/translations                                                 | 404    | Article not found             |
+      | restricted writer POST /v1/article/11/translations                                        | 404    | Article not found             |
+      | writer POST /v1/article/abc/translations                                                  | 400    | apperr.IdUint32ErrorMessage   |
+      | writer POST /v1/article/10/translations with source_article_id 9999                       | 404    | source_unavailable            |
+      | restricted writer POST /v1/article/10/translations with source_article_id 11              | 404    | source_unavailable            |
+      | writer POST /v1/article/10/translations with source_article_id 20 (other story)           | 422    | source_other_story            |
+
+  Scenario: Access to the source is rechecked at submit
+    Given a writer opened the translation dialog with source article 11
+    And article 11 was deleted after the dialog opened
+    When the writer submits POST /v1/article/10/translations with source_article_id 11
+    Then the response status is 404 and the body is "source_unavailable", the same as for an unreadable source
+    And nothing is stored
+
+  Scenario: Unassigned articles cannot be translated yet
+    Given article 30 has lang ""
+    When a writer sends POST /v1/article/30/translations with {"lang":"fr","title":"Couts","copy":true}
+    Then the response status is 409 and the body is "setup_required"
+    And nothing is stored
+
+  Scenario: The slug of the new version is free within site and language
+    Given site "journal" already has an fr article with slug "couts-de-renovation"
+    When a writer creates an fr translation titled "Couts de renovation"
+    Then the new slug is the next free suffixed slug in (site 1, fr)
+    When a writer creates a translation with the same title in a language with no clash
+    Then the slug is the plain slug
+
+  Scenario: Entry point 2 behaves exactly like entry point 1
+    Given a valid jwt cookie for a writer
+    When the client sends POST /v1/article/ with {"title":"Couts","lang":"fr","story_id":5,"source_article_id":10,"copy":true}
+    Then the response status is 201
+    And the result, errors, headers and stored data are exactly those of POST /v1/article/10/translations with the same lang, title and source
+    And the same use case runs for both
+
+  Scenario Outline: POST /v1/article/ is unchanged when it is not a translation (it creates in the default site when no site is given; a "site" key names the target site, see localization_translation_flows)
+    Given a valid jwt cookie for a writer
+    When the client sends POST /v1/article/ with <body>
+    Then the response status is <status>
+    And <effect>
+
+    Examples:
+      | body                                  | status | effect                                                       |
+      | {"title":"Plain","body":"x"}          | 201    | a new story is created, lang is the site's starting language as before |
+      | {"title":"Neuf","lang":"fr"}          | 201    | a new story is created in fr                                 |
+      | {"title":"Neuf","lang":"pt"}          | 422    | the body is "language_not_enabled"                           |
+      | {"title":"Neuf","lang":"es"}          | 409    | the body is "language_unavailable" (disabled)                |
+      | {"title":"Neuf","story_id":5}         | 400    | the body is apperr.BodyErrorMessage                          |
+      | {"title":"Neuf","lang":"fr","story_id":999} | 404 | the body is "Article not found"                          |
+      | {"title":"Neuf","copy":true}          | 400    | the body is apperr.BodyErrorMessage                          |
+      | {"title":"Neuf","lang":"fr","story_id":5,"site":"atelier"} | 400 | the body is apperr.BodyErrorMessage (a site with a translation is refused) |
+      | {"title":"Neuf","lang":"fr","site":"atelier"} | 201 | a new story is created in fr on site atelier |
+
+  Scenario: PATCH still ignores lang, story_id and source fields
+    Given a valid jwt cookie for a writer
+    When the client sends PATCH /v1/article/10 with {"body":"x","lang":"fr","story_id":9}
+    Then the response status is 200
+    And lang and story_id are unchanged
+
+  Scenario: Activity records the creation
+    Given a valid jwt cookie for a writer
+    When a translation is created
+    Then one "article.create" event (articles category) targets the new article
+    And its params hold lang "fr", story_id 5 and source_article_id 10
+    When a creation is refused
+    Then one failed event is recorded with a plain reason
+    And nothing in it names a hidden version
+
+  Scenario: A new version does not appear publicly
+    Given a translation was created
+    When a client sends GET /v1/article/{new id} without a jwt cookie
+    Then the response status is 404 and the body is "Article not found"
+    And the public list is unchanged
+
+  Scenario: Persistence portability
+    Given the unique (story_id, lang) violation, the free-slug retry and the concurrent create
+    Then they pass on SQLite, MySQL 8.4, MariaDB 11 and PostgreSQL

features/article_translation_create.qa.md

@@ -0,0 +1,30 @@
+# QA: Create a translation (backend)
+
+Backend only. Go tests in test/, black-box. No design states.
+
+## Automated, no server (task test)
+1. CreateTranslation use case over in-memory fakes (article, site, language, author and image repositories, a fake Transactor; unique type names). Table-driven over "Copy from the source version", "Start empty", "Request validation" and "One neutral answer". Assert the sentinels with errors.Is (language exists, language unavailable, language not enabled, source unavailable, source other story, setup required). The read check, the source recheck, the language check, the free-slug search, the insert and the source_revision capture run inside one Transactor.Run, and the copy and source_revision come from the same read.
+2. Both endpoints reach the same use case: a spy asserts one call per request with identical arguments.
+3. HTTP: NewHandler over use cases, a fresh chi router mirroring api/router.go (POST /{id}/translations and POST / inside the authtoken group, requireArticle(content.create)), validator.InitValidator(), httptest and a jwt cookie. Cover every Examples row: status, exact plain-text body, presence or absence of X-Existing-Article-Id. The three neutral situations are byte-identical in body and header set.
+4. Race: two goroutines request the same language, one wins, the other gets language_unavailable.
+5. Activity: a fake audit recorder receives article.create with params lang, story_id and source_article_id. Failure events contain no hidden-version data.
+6. Regression: the existing POST /v1/article tests stay untouched, except the amended slice 1 scenario.
+
+## Automated, SQLite file (task test)
+7. Repository: the unique (story_id, lang) violation maps to the language-unavailable sentinel; the slug retry works within (site, lang); source_article_id and source_revision round-trip; the migration adds them without changing existing rows; a second Migrate changes nothing.
+8. Concurrency: N goroutines create fr for one story, exactly one succeeds, busy retries are bounded.
+
+## Automated, real databases (task test:mysql, task test:postgres)
+9. Repeat 7-8 on MySQL 8.4, MariaDB 11 and PostgreSQL. Record NOT RUN if the daemon is down, or use the podman shim (see memory).
+
+## Build and lint
+10. task test, task lint:go and CGO_ENABLED=0 go build -tags nofrontend ./... pass. No comments in the added Go files.
+11. docs/api documents the endpoint, bodies, codes and headers.
+12. task mutate scoped with MUTATE_FILES to the new use case.
+
+## Manual
+None.
+
+## Amended by localization_translation_flows
+
+The wording of features/article_translation_create.feature that this slice supersedes is amended in place (PATCH bodies carry if_revision, the Add translation destination, the site key of POST /v1/article/). The Delete dialog of single-language sites keeps its present copy.

features/articles_list.feature

@@ -1,4 +1,5 @@
 Feature: Articles list screen
+  Superseded in part by article_list_localization: the call is GET /v1/article/?group=story&... and rows are story rows. The row anatomy gains the coverage chips (first) and the "Authors" union. The row menu items and order are Open {language}, Open another language, Add translation, Publish or Unpublish {language}, Copy API URL, Delete {language} version (docs/design/localization-tables.md "Row actions"), each shown by its capability, replacing "Edit, Publish or Unpublish, Copy API URL, Delete…" for rows with those capabilities; the Delete… confirmation copy is unchanged here (slice 5). The Add translation item navigates to /article/{id}/edit?dialog=add-translation, plus &lang=<tag> when exactly one language is missing (localization_translation_flows). The tabs "All / Online / Drafts" become the two modes of the new feature: "All articles" and "Needs translation" with no language; "All", "Published", "Drafts" and "Not in {Language}" with one. The 6-article fixture is replaced by the Journal dataset for the grouped scenarios; rows with no lang assigned keep today's scenarios with empty coverage. "Copy API URL" still copies {origin}/v1/article/{id} of the version the row menu acts on.
   Superseded in part by roles_permissions_content_scope: the article routes are gated by the content.* permissions of the caller's role (content.create, content.update, content.delete and content.publish; a refusal is 403 "missing_permission" with the header X-Missing-Permission), and content.read decides which drafts show: every draft at all, only the caller's own drafts at own, none otherwise. A draft the caller may not read answers 404 "Article not found", and a role that cannot be resolved is treated as holding no permission.
 
   As a verified RenewCMS owner

features/articles_list.qa.md

@@ -2,6 +2,8 @@
 
 > Superseded in part by roles_permissions_content_scope: the article routes are gated by the content.* permissions of the caller's role (content.create, content.update, content.delete and content.publish; a refusal is 403 "missing_permission" with the header X-Missing-Permission), and content.read decides which drafts show: every draft at all, only the caller's own drafts at own, none otherwise. A draft the caller may not read answers 404 "Article not found", and a role that cannot be resolved is treated as holding no permission.
 
+> Superseded in part by article_list_localization: references to the flat list become the grouped request (GET /v1/article/?group=story&...) on story rows; the Go and Vitest cases are items 6 to 11 of features/article_list_localization.qa.md. The manual items below are kept.
+
 ## Implementation note for coder (informational, not a QA assertion)
 
 `internal/infrastructure/persistence/repositories/articleRepository.go`'s `FindByFilters` gains
@@ -176,3 +178,7 @@ file).
   a running app, since Vitest only asserts `useToast().add` was called with the right arguments.
 - **Real clipboard write on a live app** — confirm `navigator.clipboard.writeText` actually places
   the URL on the system clipboard in a real browser, since Vitest only mocks the clipboard API.
+
+## Amended by localization_translation_flows
+
+The wording of features/articles_list.feature that this slice supersedes is amended in place (PATCH bodies carry if_revision, the Add translation destination, the site key of POST /v1/article/). The Delete dialog of single-language sites keeps its present copy.

features/articles_pagination_api.feature

@@ -1,4 +1,5 @@
 Feature: Paginated article listing
+  Superseded in part by article_list_localization: the flat envelope below is unchanged, and the optional parameters lang and author are added to it (see the Background); the story-grouped shape is a separate opt-in.
   Superseded in part by roles_permissions_content_scope: the article routes are gated by the content.* permissions of the caller's role (content.create, content.update, content.delete and content.publish; a refusal is 403 "missing_permission" with the header X-Missing-Permission), and content.read decides which drafts show: every draft at all, only the caller's own drafts at own, none otherwise. A draft the caller may not read answers 404 "Article not found", and a role that cannot be resolved is treated as holding no permission.
 
   As an API consumer or the RenewCMS back-office
@@ -15,6 +16,10 @@ Feature: Paginated article listing
     And q (optional, max 200 characters; case-insensitive, accent-insensitive, matches anywhere in the title) and status (optional, online or draft) filter the items
     And total is the number of visible articles matching q and status, before paging; page and size echo the values applied
     And counts ignores q and status, so the tab counts do not move while the user searches; it respects visibility: for a public caller all equals online and draft is 0
+    And this counts statement is true for the flat shape and is explicitly NOT true for the grouped shape, where counts follow lang, q, author, seo and site (features/article_list_localization.feature)
+    And the flat counts.suggestions rule is unchanged
+    And the flat envelope above is unchanged; a client opts in to the story-grouped editorial shape with group=story (features/article_list_localization.feature); public and unverified callers cannot
+    And lang (flat: narrows items, total and counts.all, counts.online and counts.draft to that language) and author (a byline id, flat: narrows by byline) are additive, optional, validated parameters; an invalid value answers 400 with apperr.BodyErrorMessage
     And status=draft requested by a public caller matches nothing: items [], total 0
     And sort (optional) is one of title:asc, title:desc, status:asc, status:desc, created_at:asc, created_at:desc, updated_at:asc, updated_at:desc; the default is updated_at:desc; status orders by is_online (asc puts drafts first); every ordering ends with id descending as the tie-break, so pages are stable and never overlap
     And sort is mapped to a column and direction through a fixed whitelist in the repository, so request text never reaches the SQL; the same ordering applies on the search path (q) before slicing
@@ -176,6 +181,14 @@ Feature: Paginated article listing
       | sort=updated_at           |
       | sort=title:asc;DROP TABLE |
       | sort=TITLE:ASC            |
+      | lang=english              |
+      | lang=xx                   |
+      | lang=                     |
+      | author=0                  |
+      | author=abc                |
+      | author=                   |
+      | group=stories             |
+      | tab=missing               |
 
   Scenario: Invalid format is reported first
     When a client sends GET /v1/article/?page=0&format=pdf

features/articles_pagination_api.qa.md

@@ -2,6 +2,8 @@
 
 > Superseded in part by roles_permissions_content_scope: the article routes are gated by the content.* permissions of the caller's role (content.create, content.update, content.delete and content.publish; a refusal is 403 "missing_permission" with the header X-Missing-Permission), and content.read decides which drafts show: every draft at all, only the caller's own drafts at own, none otherwise. A draft the caller may not read answers 404 "Article not found", and a role that cannot be resolved is treated as holding no permission.
 
+> Superseded in part by article_list_localization: the flat envelope tested here is unchanged; the additive lang and author parameters, their 400 rows and the grouped request (group=story) are covered by items 6 to 11 of features/article_list_localization.qa.md. The manual items below are kept.
+
 ## HTTP-level (Go, `test/`, `task test`)
 
 Build `article.NewHandler(...)` over the real `ListArticlesUseCase` and a fake `article.Repository` (extend `mockArticleRepo` in `test/article_test.go`, keeping type names unique across files). The fake implements the interface contract: paging (Page/Size 0 = unpaged), q/status filtering, ordering updated_at DESC then id DESC, total, and the visibility counts. Mount on a fresh `chi.NewRouter()` mirroring `NewArticleRouter` in `api/router.go` (GET / under `jwtauth.Verifier` only, test `jwtauth.New("HS256", ...)`). Call `validator.InitValidator()`. Use a user fake for the verified, unverified and missing cases, as in `test/public_article_listing_test.go`. No live server, no SQLite file.

features/articles_pagination_screen.feature

@@ -1,4 +1,5 @@
 Feature: Articles list pagination
+  Superseded in part by article_list_localization: the request is GET /v1/article/?group=story&format=html&...; page, size, q, status, sort, lang, tab, author, site and seo live in the URL; items are story rows (representative version plus coverage) and total is the unit total (stories, or versions of the selected language). The tab counts follow lang, q, author, seo and site (never status or tab) instead of staying fixed while searching (deliberate behavior change); "No results" shows every count at 0 (board loc.l7.noResults). A change of lang, tab or author, like any filter, drops page. The summary "Showing {from}–{to} of {total}" is unchanged and the UnitLabel sits above it. Scenarios 4, 6 and 7 keep their wording with story rows and the grouped request.
 
   As a verified RenewCMS user with many articles
   I want the Articles list split into pages with a page-size menu, server-side search and tabs, and shareable URLs
@@ -91,15 +92,15 @@ Feature: Articles list pagination
     When the user types "plaster" in the search field and the debounce elapses
     Then GET ...&q=plaster&page=1 is sent
     And on success the URL is /article?q=plaster (page omitted)
-    And the tab counts are unchanged
+    And the tab counts follow the new search (lang, q, author, seo and site; never status or tab)
-    And the same reset happens for a tab change, a sort change and a page-size change
+    And the same reset happens for a tab change, a sort change, a page-size change, and a lang, author, site or seo change
 
   Scenario: 9 Empty after search
-    Given GET ...&q=tiles resolves 200 with items [], total 0 and counts {all 6, online 4, draft 2}
+    Given GET ...&q=tiles resolves 200 with items [], total 0 and counts {all 0, online 0, draft 0, suggestions 0, missing 0}
     When the user searches "tiles"
     Then the paginator and the summary are hidden
     And the no-results state shows "No articles match "tiles"", "Check the spelling, or search for a shorter part of the title." and "Clear search"
-    And the tabs still read "All 6" "Online 4" "Drafts 2"
+    And every tab count reads 0 (board loc.l7.noResults), because counts follow the search
 
   Scenario Outline: 10 Page size menu
     Given the user is on /article?page=3
@@ -130,7 +131,7 @@ Feature: Articles list pagination
     Given the Default list has loaded and the user is on /article?page=3
     When the user selects the "Drafts" tab
     Then GET ...&status=draft&page=1 is sent and, on success, the URL is /article?status=draft
-    And the tab counts are unchanged
+    And the tab counts are unchanged, because counts never follow status or tab
 
   Scenario Outline: Sort header, server-side, resets to page 1
     Given the user is on /article?page=7

features/articles_pagination_screen.qa.md

@@ -1,5 +1,7 @@
 # QA: Articles list pagination (SPA)
 
+> Superseded in part by article_list_localization: the mocked request is the grouped one (GET /v1/article/?group=story&format=html&...) on story rows, tab counts follow lang, q, author, seo and site, and the lang, tab, author, site and seo reset cases are covered by items 9 to 11 of features/article_list_localization.qa.md. The manual items below are kept.
+
 ## Automated (Vitest + Vue Test Utils, `task test:web`)
 
 Mock `useApi` for `GET /v1/article/?format=html&...` (the route key includes the query) per case. Mount ArticlesPage inside DashboardShell with a verified session and a test router at /article, as in features/articles_list.qa.md. The fixture is 312 articles at 25 per page, built by a helper, with counts {all, online, draft}. No system date freezing.

features/authors_backend.feature

@@ -6,7 +6,7 @@ Feature: Authors backend, public bylines that articles credit in order
   So that readers see who wrote an article, whether or not the writer has an account
 
   Background:
-    Given the spec of record is docs/design/screens/authors.md, docs/design/screens/editor.md (site and authors), docs/design/screens/profile.md, docs/design/states.md (author rows), docs/design/routes.md and docs/design/sites-authors-slices.md
+    Given the spec of record is docs/design/screens/authors.md, docs/design/screens/editor.md (site and authors), docs/design/screens/profile.md, docs/design/states.md (author rows), docs/design/routes.md and docs/design/decisions.md
     And this slice is backend only: no SPA, no change to docs/design
     And an Author has id (uint32), name, slug, bio, avatar_id (nullable media id), website (nullable), social_links, user_id (nullable and unique), is_linked and article_count, in snake_case JSON
     And an article has zero or more authors in a stored order through an ordered article_authors join; the first is the primary byline

features/editor_core.feature

@@ -15,8 +15,10 @@ Feature: Editor screen — load, edit and save an article's body
       /article (mobile top bar title "Edit article" instead), an ArticleStatusBadge size "md"
       reflecting article.is_online ("Draft" or "Online"), a SaveStatus span, a Save button,
       and a PublishControl button, per docs/design/components.md
-    And the article's title is never editable after creation, per
+    And the title is an editable field labelled "Title" ("Title (French)" when the site has more
-      features/article_title_rules.feature; only the body is edited here
+      than one enabled language), per features/localization_editor_navigation.feature, which
+      supersedes features/article_title_rules.feature's "never editable"; the body is edited in
+      ArticleEditor
     And the body is edited in ArticleEditor (modelValue bound to the fetched HTML body); any
       change moves useArticleDraft's state from "clean" to "dirty", and PublishControl's label
       switches from "Publish" (or "Unpublish", if online) to "Save and publish" while dirty and
@@ -25,24 +27,28 @@ Feature: Editor screen — load, edit and save an article's body
     And Save is enabled only when useArticleDraft's state is "dirty", the request is not already
       in flight, and the app is not offline, whatever the body's length; it is disabled in every
       other case
-    And Save (a click, or Ctrl/⌘ S) sends PATCH /v1/article/{id} with JSON {"body": "..."},
+    And Save (a click, or Ctrl/⌘ S) sends PATCH /v1/article/{id} with JSON {"body": "...", "if_revision": <the loaded revision>},
       the same contract features/edit_article_body.feature already gives the API: 200 with the
       updated article.Article (any body length, including empty), 404 for an id absent from
       the repository, 401 with no valid session
     And a successful save (200) sets useArticleDraft's state to "saved" and records the save
       time; SaveStatus shows "Saved at {HH:MM}" for the first hour and "Saved {n} min ago" after
       an hour has passed, per docs/design/components.md
+    And the Save button reads "Save" for every caller allowed to edit; the "Save draft" label of
+      callers who cannot publish no longer exists
     And a 500 response or a request that never reaches the server sets useArticleDraft's state
-      to "error"; SaveStatus shows "Save failed" with an inline Retry button (UButton size="xs"
+      to "error"; SaveStatus shows "Save failed" and the header's primary button reads "Try saving
-      variant="outline"); the edited body is kept exactly as typed, both in the editor and for
+      again", per features/localization_editor_navigation.feature (the inline Retry button of
-      the next Retry
+      SaveStatus is no longer rendered in the editor); the edited body is kept exactly as typed,
+      both in the editor and for the next retry
     And a 404 response to a save (the article was deleted elsewhere) does not use the "error"
       SaveStatus; it shows a toast "That article no longer exists.", per docs/design/states.md's
       HTTP-status-to-copy table
     And a 401 response to a save is handled by useApi's global handling
       (features/api_client_global_error_handling.feature): before the redirect, useArticleDraft
-      mirrors the current dirty body to sessionStorage keyed by the article's id, so it survives
+      mirrors the current dirty title, body and search fields to sessionStorage keyed by the user
-      the redirect to /login?redirect=/article/{id}/edit&reason=expired
+      id and the article id, with the time of the mirror, so it survives the redirect to
+      /login?redirect=/article/{id}/edit&reason=expired
     And EditorStatusBar shows a neutral "{words} words · {characters} characters" count with
       en-US thousands separators (e.g. "1,204 words · 7,318 characters", "0 words · 0 characters"
       for an empty body); characters is the body's HTML string length, words are the
@@ -65,10 +71,11 @@ Feature: Editor screen — load, edit and save an article's body
       proceeds with the navigation, discarding the edit; "Keep editing" closes the dialog and
       keeps the user on the editor with the edit intact; navigating away while "clean" or
       "saved" never opens this dialog
-    And an id absent from the repository (GET resolves 404) replaces the entire editor with an
+    And an id absent from the repository (GET resolves 404) replaces the entire editor with the
-      error state: title "This article doesn't exist.", and a single action "All articles"
+      Version unavailable state: title "This version isn't available", text "It may have been
-      navigating to /article; no breadcrumb-title, SaveStatus, Save, PublishControl or
+      deleted, or you may not have access.", and a single action "Back to Articles" navigating
-      ArticleEditor renders in this state
+      to /article; no header, SaveStatus, Save, PublishControl or ArticleEditor renders in this
+      state
     And skeleton placeholders (for the title, content and details) replace the editor's content
       only after 150 ms of GET /v1/article/{id} being unresolved, so a fast response never
       flashes a skeleton, per the Skeleton component spec
@@ -111,14 +118,14 @@ Feature: Editor screen — load, edit and save an article's body
   Scenario: Saving — Save sends the PATCH and disables itself while in flight
     Given the user is on /article/12/edit with unsaved changes to the body
     When the user activates Save
-    Then PATCH /v1/article/12 is sent with JSON {"body": "<the edited body>"}
+    Then PATCH /v1/article/12 is sent with JSON {"body": "<the edited body>", "if_revision": <the loaded revision>}
     And SaveStatus reads "Saving…"
     And the Save button is disabled
 
   Scenario: Ctrl/⌘ S saves the same way as clicking Save
     Given the user is on /article/12/edit with unsaved changes to the body
     When the user presses Ctrl+S (or ⌘+S)
-    Then PATCH /v1/article/12 is sent with JSON {"body": "<the edited body>"}
+    Then PATCH /v1/article/12 is sent with JSON {"body": "<the edited body>", "if_revision": <the loaded revision>}
     And SaveStatus reads "Saving…"
 
   Scenario: A successful save returns to the Saved state with the new time
@@ -132,12 +139,12 @@ Feature: Editor screen — load, edit and save an article's body
     When more than an hour has passed with no further edit or save
     Then SaveStatus reads "Saved {n} min ago" instead of "Saved at 11:02"
 
-  Scenario Outline: Save failed — a 500 or a network failure keeps the changes and offers Retry
+  Scenario Outline: Save failed — a 500 or a network failure keeps the changes and offers Try saving again
     Given the user is on /article/12/edit with unsaved changes to the body "Revised opening
       paragraph."
     When the user activates Save
     And PATCH /v1/article/12 <failure>
-    Then SaveStatus reads "Save failed" with a Retry button
+    Then SaveStatus reads "Save failed" and the primary button reads "Try saving again"
     And the editor still shows the body "Revised opening paragraph."
     And no navigation occurs
 
@@ -149,8 +156,8 @@ Feature: Editor screen — load, edit and save an article's body
   Scenario: Retry resends the same body and can recover
     Given the user is on /article/12/edit in the Save failed state, with unsaved body "Revised
       opening paragraph." and PATCH /v1/article/12 having failed with a 500
-    When the user activates Retry
+    When the user activates "Try saving again"
-    Then PATCH /v1/article/12 is sent again with JSON {"body": "Revised opening paragraph."}
+    Then PATCH /v1/article/12 is sent again with JSON {"body": "Revised opening paragraph.", "if_revision": <the loaded revision>}
     When it resolves 200 with the updated article
     Then SaveStatus reads "Saved at {current time}"
 
@@ -214,7 +221,7 @@ Feature: Editor screen — load, edit and save an article's body
     When the user activates Save
     And PATCH /v1/article/12 resolves 401
     Then the body "Paragraph added just before the session expired." is mirrored to
-      sessionStorage keyed by article id 12
+      sessionStorage keyed by user id and article id 12
     And the app navigates to /login?redirect=/article/12/edit&reason=expired
     When the user logs in again and is returned to /article/12/edit
     And GET /v1/article/12 resolves 200 with the last-saved body (without that paragraph)
@@ -225,8 +232,8 @@ Feature: Editor screen — load, edit and save an article's body
   Scenario: An unknown or deleted article id replaces the editor with an error state
     Given GET /v1/article/9999 resolves 404
     When the user navigates to /article/9999/edit
-    Then the editor shows a single error state: title "This article doesn't exist." and one
+    Then the editor shows a single Version unavailable state: title "This version isn't
-      action "All articles"
+      available" and one action "Back to Articles"
-    And no breadcrumb-title, SaveStatus, Save, PublishControl or ArticleEditor renders
+    And no header, SaveStatus, Save, PublishControl or ArticleEditor renders
-    When the user activates "All articles"
+    When the user activates "Back to Articles"
     Then the app navigates to /article

features/editor_core.qa.md

@@ -4,16 +4,15 @@
 
 `docs/design/components.md`'s `ErrorView` only documents two fixed copies (`kind: 'not-found'` →
 "Page not found" / Home, and `kind: 'error'` → the generic retry copy). The editor's own 404-on-
-load state needs different copy ("This article doesn't exist." / "All articles" → /article),
+load state shows the Version unavailable copy ("This version isn't available" / "Back to
-per `docs/design/states.md`'s HTTP-status-to-copy table. Either widen `ErrorView` with an optional
+Articles" → /article), per `features/localization_editor_navigation.feature`, which supersedes the
-title/description/action override, or add a third `kind`; this is a same-layer prop widening, not
+original "This article doesn't exist." copy; it is rendered by `EditorVersionGone`.
-a new component, so it doesn't need its own slice.
 
 Known limitation, not a bug to silently fix: per `features/public_article_read.feature`,
 `GET /v1/article/{id}` falls back to public online-only visibility on a malformed/expired jwt
 (no 401). So if a session is already stale when the owner opens an *offline* article, the GET
 answers 404 exactly like a truly deleted article — the editor cannot tell the two apart from this
-response alone, and correctly shows the "This article doesn't exist." state.
+response alone, and correctly shows the "This version isn't available" state.
 
 ## Automated (Vitest + Vue Test Utils, `task test:web`)
 
@@ -46,9 +45,9 @@ Fixture article (reused across cases unless a scenario overrides a field): id 12
 6. **Relative save time after an hour** — after a 200 save at 11:02, advance the fake clock past
    one hour with no further edit; assert SaveStatus switches to "Saved {n} min ago".
 7. **Save failed, Examples-driven** — (a) `PATCH` resolves 500, (b) `PATCH` rejects (network);
-   in each, assert SaveStatus "Save failed" with a visible Retry button, and the editor still
+   in each, assert SaveStatus "Save failed" with the primary button "Try saving again", and the editor still
    shows the typed body.
-8. **Retry recovers** — from Save failed (500), click Retry; assert `PATCH` is called again with
+8. **Retry recovers** — from Save failed (500), click "Try saving again"; assert `PATCH` is called again with
    the same body; resolve 200; assert SaveStatus "Saved at {time}".
 9. **404 on save shows a toast, not the error SaveStatus** — from Unsaved changes, save; resolve
    `PATCH` 404; assert a toast "That article no longer exists." appears and SaveStatus never
@@ -74,15 +73,17 @@ Fixture article (reused across cases unless a scenario overrides a field): id 12
     assert the router navigates to `/article` with no ConfirmDialog ever rendered.
 17. **Session expiry mid-save mirrors and restores the draft** — from Unsaved changes with body
     "Paragraph added just before the session expired.", save; resolve `PATCH` 401; assert
-    `sessionStorage` holds that body keyed by article id 12, and the router navigates to
+    `sessionStorage` holds that body keyed by user id and article id 12 (key
+    `renewcms:article-draft:{userId}:12`, a JSON object with title, body, search fields and the
+    mirror time), and the router navigates to
     `/login?redirect=/article/12/edit&reason=expired`. Then, simulating the return trip, mount
     EditorPage again at `/article/12/edit` with `GET /v1/article/12` resolving 200 with a body
     that lacks that paragraph; assert the rendered body is the restored sessionStorage draft
     (with the paragraph) and SaveStatus reads "Unsaved changes".
 18. **Not found on load** — mock `GET /v1/article/9999` resolving 404; mount at
-    `/article/9999/edit`; assert only the error state renders (title "This article doesn't
+    `/article/9999/edit`; assert only the Version unavailable state renders (title "This version
-    exist.", action "All articles"), with no breadcrumb-title/SaveStatus/Save/PublishControl/
+    isn't available", action "Back to Articles"), with no header/SaveStatus/Save/PublishControl/
-    ArticleEditor; click "All articles"; assert the router navigates to `/article`.
+    ArticleEditor; click "Back to Articles"; assert the router navigates to `/article`.
 
 ## Visual (manual verification — desktop and mobile, light and dark)
 
@@ -98,7 +99,7 @@ reusing the sample data below and a fixed `now` of "2026-09-26T11:02:00Z" (updat
       "N words · 4,318 characters", details panel (Created/Updated/ID/Images/Public API URL).
 - [ ] Unsaved changes: "Unsaved changes" SaveStatus, enabled Save, "Save and publish".
 - [ ] Saving: "Saving…" SaveStatus, disabled Save.
-- [ ] Save failed: "Save failed" with Retry, per the SaveStatus error spec.
+- [ ] Save failed: "Save failed" with the "Try saving again" primary, per the SaveStatus error spec.
 - [ ] Very long article: count "19,845 words · 120,000 characters", neutral, Save/Publish enabled.
 - [ ] Preview: read-only rendered title and body in the content scale, toolbar hidden.
 - [ ] Offline: SaveStatus shows the wifi-off icon and reads "Waiting for connection", disabled
@@ -124,3 +125,7 @@ reusing the sample data below and a fixed `now` of "2026-09-26T11:02:00Z" (updat
 - **Real `beforeunload` prompt** — Vitest can assert `onBeforeRouteLeave`'s ConfirmDialog, but a
   real browser tab-close prompt (native `beforeunload`) needs manual confirmation, since jsdom
   doesn't model it.
+
+## Amended by localization_translation_flows
+
+The wording of features/editor_core.feature that this slice supersedes is amended in place (PATCH bodies carry if_revision, the Add translation destination, the site key of POST /v1/article/). The Delete dialog of single-language sites keeps its present copy.

features/editor_seo.feature

@@ -6,7 +6,7 @@ Feature: Editor: search and sharing, suggestions and "What the frontend gets"
 
   Background:
     Given the screen is EditorView (/article/:id/edit) inside DashboardShell, per docs/design/routes.md
-    And the visual spec of record is docs/design/screens/editor.md (groups "Editor: search and sharing" with 24 states and "Editor: what the frontend gets" with 6 states), docs/design/seo-slices.md, docs/design/components.md (SearchSharingSection, SeoPanel, SoftCounter, SearchPreview, SocialCardPreview, SuggestionList, ApiPreviewDialog, SlugField, MediaField) and docs/design/states.md ("SEO round"). Exact copy is read from those files and is not repeated here unless a scenario needs it
+    And the visual spec of record is docs/design/screens/editor.md (groups "Editor: search and sharing" with 24 states and "Editor: what the frontend gets" with 6 states), docs/design/decisions.md, docs/design/components.md (SearchSharingSection, SeoPanel, SoftCounter, SearchPreview, SocialCardPreview, SuggestionList, ApiPreviewDialog, SlugField, MediaField) and docs/design/states.md ("SEO round"). Exact copy is read from those files and is not repeated here unless a scenario needs it
     And the board frames of docs/design/source/RenewCMS Screens Back-office.dc.html, AppFrame.dc.html and DirectoryFrame.dc.html are the layout tiebreaker
     And this slice is SPA only and reuses the API of features/seo_data_backend.feature and features/seo_output_backend.feature without change
     And the SPA calls, with relative URLs through useApi only: GET /v1/article/{id} and PATCH /v1/article/{id} (SEO fields slug, excerpt, seo_title, seo_description, cover_image_id, cover_image_alt, social_title, social_description, social_image_id, canonical_url, noindex), POST /v1/article/{id}/seo/check, GET /v1/article/{id}/seo, GET /v1/site/ and the media routes of the shared picker