docs-shio Coverage Matrix
Purpose. Every shipped block / feature cluster in the Shio
CHANGELOG.mdmaps here to either a documentation page (with anchor) or an explicit "deliberately internal, no public page" row. A shipped user-facing subsystem with no page is an orphan (🔴) and a bug in the docs. This file is the gate authored by Block R SH479; keep it in sync when a new block ships.Legend: ✅ documented · 🧩 folded into a broader page · ⚠️ a page exists but describes a shape the product left (worse than missing: a reader is actively misled) · 🔒 deliberately internal (engineering / repo / marketing, no end-user page by design) · 🔴 orphan (missing, fix it).
Not rendered in the sidebar; this is a maintenance artifact.
Why these sections and not Turing's. Shio's primary operator is a coding agent, the curator approves, and the CDA delivers, so the matrix is grouped by who does the job, which since SH482 is also the sidebar: four hubs, each with its own landing page, and every page below files into one of them. ⚠️ is a verdict
docs-turing/COVERAGE.mddoes not need: every published Shio page predates the 2026.3 renderer, so "has a page" and "has a correct page" are different questions here.
The agent builds it
| Block / feature | Page | Status |
|---|---|---|
Block H: the agent gateway, GET /api/v2/agent/manifest (+ ?section=, the elsewhere map), the context pack /agent/context, /find, /read (fields= projection, id-free reads), the mutation vocabulary, POST /agent/batch, desired-state /agent/plan + /apply, teaching errors (RFC 9457 + fix/allowed/didYouMean/example), SH79 addresses incl. the home form post:<site>/ — and one query vocabulary every listing filters by, site, folder, subtree, type, state, locale, modifiedSince, modifiedBefore, author, modifier and q, meaning the same thing on /agent/find, shio_find, shio find and the console listing, decided by the database rather than after the rows are loaded, with an unknown one refused rather than dropped (SH1022) | agent-surface | ✅ (SH484, SH1022) |
Block X: what a curator could change — GET /agent/editable reads the fields a curator can edit off the rendered page (the same annotations the Universal Editor uses in the browser), so an agent can tell whether the page it just built is authorable or only correct. source separates "nothing is annotated" from "does not render yet". The rows name an address address like every other endpoint (SH810), and shio_digest's include=editable makes the same answer reachable from an MCP-only client — measured at 24 tokens as a parameter against 146 as a thirteenth tool (SH811) | agent-surface § What a curator could change | ✅ (SH809, SH810, SH811) |
Block Z: the P1 inventory as a worklist — shio_context takes format=agents-md, so the one rendering meant to be written to a file is reachable by the client most likely to have a file to write it to; the inventory had named that gap down to the parameter and its staleness check could not read a target that fine, so shipping the argument left the entry standing and green (SH812). And which of the nine exceptions are gaps and which are decisions is a field rather than a paragraph: the run prints 8 decided and 1 open — contentAsFiles — instead of a total that does not move when the work lands (SH813) | mcp § The tools · agent-surface § One call instead of a session | ✅ (SH812) · SH813 is a build instrument, the same verdict as the lint rows below: it changes what a contributor may leave unargued, not what a user can do |
Block H: the discovery surface's second half — startHere routing an intent to one call, the context pack's omitted report and per-post published, and teaching refusals on the two surfaces P6 had not reached (a rejected credential, an unknown post-type name) | agent-surface § One call instead of a session · § Errors are instructions | ✅ (SH601, SH608, SH553, SH621, SH622) |
What an agent can check and be told: verify's a11y group over rendered pages (SH1055); whether a page is findable, on the read and as one routing table on four surfaces (SH1063); include=fields on the event stream (SH1080); an op field an op does not take is refused rather than dropped (SH1083); shio_changes narrowed to one page by address (SH1086); a draft verify naming the rules that read published rows only and never ran on it (SH1092) | agent-surface § Closing the loop without asking anyone, § When you want to be told instead of asking, § Errors are instructions, mcp § The tools | ✅ (SH1055) |
Block H: the model's own proposal — PUT /post-type/{name}?dryRun=true costing a model change, and shio propose --from deriving a type from content that already exists | content-modeling § Asking what a model change would cost · § Modelling from content you already have | ✅ (SH523, SH525) |
Block BC: the model's rules, enforced where content is written — a field a post type declares required is checked on every publish (the console's, REST's, the agent's and a scheduled one), never on a save, reported by the publish preview and the dry run before anybody presses it, and waivable only by a person on the record (SH1009); and what a field will accept beyond presence — minLength, maxLength, a pattern with its own message, min, max, a closed list of values, item counts and an advisory recommendedLength, evaluated by the same writers and reported by verify as constraint-violated, plus unique against other posts of the type and a defaultValue a create fills in, edited per field in the post-type editor and shown under the input in the form (SH1010), and the content already stored measured against the model then reconciled with it — post-type check counts what breaks each rule and post-type migrate renames, drops and defaults, planning unless told to write (SH1018) | content-modeling § Required fields are checked when you publish | ✅ (SH1009, SH1010, SH1018) |
Block H: indexing content published before search was switched on (site.upsert data.reindex), and section fields the Universal Editor can reach on a headless front end | search-caching § Indexing what was already published · universal-editor § On your own front end | ✅ (SH413, SH638) |
Block H: MCP server host, POST /mcp (JSON-RPC 2.0, streamable HTTP), the shio_* tools, resources and prompts, the measured tools/list budget | mcp | ✅ (SH481) |
Block AV, what an MCP write carries: shio_write passes every field an op takes, so a post.publish with a when is scheduled rather than published immediately under a success message, and a conditional write, a locale and a declared URL reach the batch instead of being dropped (SH952); and those four fields — locale, translationOf, url and expect — are in the tool's schema, so an MCP client can discover them, with shio_read's digest returning the value expect takes (SH1073) | mcp § A call, and what comes back · § The tools | ✅ (SH952, SH1073) |
Block J: the Claude Code plugin (claude-plugin/) | mcp § Connecting | 🧩 (SH481) |
Block I: content as files: the shio/content/** · shio/folders/** · shio/assets/** projection, sidecars, asset bytes + fingerprints, the per-field three-way merge, movedFrom, the commit-ordered change feed /agent/changes — and every writer in that projection declaring whether it joins the base, who wins a concurrent change and how a conflict is reported, with a lint that fails the build for one that does not (SH1004), and a blocks body that projects to real Markdown and reads back as itself, its block identities carried beside it (SH1015), and a file's page rendered before it is pushed, storing nothing (shio preview <file>, SH1095) | content-as-files | ✅ (SH486, SH1004, SH1015, SH1095) |
Block I / C / Q: the shio CLI, pull, push (--content, --check, --prune, --accept), apply, verify, report, remember, context, changes, dev --content, build, init --blueprint, snapshot, audit, digest, clone, propose, convert — and patterns, which captures a section arrangement that works as a file under shio/patterns/ and applies it to another page, placeholders filled from the command line, planned before it writes (SH1040) | cli | ✅ (SH487, SH1040) |
Block J: blueprints: the package format, GET /agent/blueprints, POST /agent/blueprints/{name}/apply, the first-party blog / docs / nextjs-starter set, @viglet/shio-sections — and SH873, which gave the two section packages the navigation they had been carrying and never using: marketing-site and landing ship a curated Primary menu of MenuItems and render it with {{#menu}}, so an applied site's nav reads Home · Pricing · About instead of every page's SEO title in alphabetical order (both packages held Menu.json and MenuItem.json in their own post-types/ directory and listed neither, so nothing provisioned the types), and SH881, which swept up the third file in that position — SectionMarkup.json, carried by both and named by neither — after measuring that landing already provisions three types it writes no post of, so carrying and provisioning the whole vocabulary was the rule and one file the exception; a check now holds each package's directory against its manifest in both directions, and SH884, which gave an applied package the last thing a curator meets first: both layouts annotated every section field and none of the page's own, so a curator could edit a hero's heading and not the title of the page it sits on — title is annotated where the footer already draws it and description, which reaches only a <meta>, is declared in a hidden element (SH766's rule, which had never reached the packages) | blueprints § Applying one | ✅ (SH488) |
Block J: the package marketplace: the catalogue and its builtin-only / remote / unreachable source, shio.marketplace.*, install and uninstall over REST, shio marketplace, the shio_marketplace tool, the console page, and the administrator gate on the writes | blueprints § Where more packages come from · cli · mcp | ✅ (SH646, SH675, SH677, SH678, SH682) |
Block K: the perception loop, content lint /agent/verify (+ scoped runs, accepted findings), route/link proof, render digest /agent/render, /agent/diagnostics, the durable incident feed, visual snapshot + diff, the handoff report — and SH882, which made shio annotations ask its own question instead of asserting it: the check that says whether a page is authorable computed declared minus annotated and printed N declared field(s) are RENDERED and not editable about the result, a claim it had nothing to check (measured on a verbatim page: four reported as RENDERED, none of them anywhere in the served bytes). A field counts as drawn when its stored value appears on the page, only that gates, and a value carrying its own annotations is not an uncuratable field — so convert --annotate's own mode, which had failed this gate on every run forever, passes it — and SH883, which the first live run of that check produced: a one-token value like columns: "3" was reported as drawn because that character occurs somewhere in any page, so a value of one token now has to be a whole text node or a whole attribute value while a multi-word one may still match as a substring, and SH885, from the first end-to-end run of the whole chain against a live replica: the check counted only the post-type's fields as declared, so an --annotate page read 7 of 4 — six of its seven annotations are block fields the type stopped carrying when SH872 gave that storage back to the markup, and the CLI reader now asks the same rule the two Java readers of the model have asked since | agent-surface § Closing the loop covers verify, render and diagnostics; the incident feed, snapshot diff and handoff report are the CLI half | 🧩 (SH487 for the CLI half) |
Block AX, being told instead of asking: GET /api/v2/events holds the change feed open as Server-Sent Events, resuming exactly from Last-Event-ID and reading with the subscriber's own rights, with shio changes --follow as the command-line form (SH967); a scheduled publish that fails reports on that feed with the command that retries it, and a retry no longer publishes twice (SH969, feed half); and a form submission arrives marked as one, with the title and summary its form collected (SH970, feed half) | agent-surface § When you want to be told instead of asking | ✅ (SH967) · SH969 and SH970 are the feed halves; the dock that reports them is in The curator approves it |
Block AY, the console's surfaces declared once: every screen in the rail names the tool, endpoint or op that does the same thing, or the reason it has none from a closed vocabulary — navigation, operator-only, rest-only, chrome, accessibility, cache, preference, contract-leg and gap (SH978, SH980); the React rail, the manifest's include=surfaces, the shio://surfaces resource and shio surfaces all read that one file, so a screen cannot be added without saying what an agent calls instead (SH979); and a read, an MCP read, a batch and a publish can each carry the curator and preview URLs a handoff needs, opt-in because they cost about 26 tokens a row and the build-a-site benchmark said so (SH981) | agent-surface § Which console screen is which call · agent-surface § Handing a page to a person | ✅ (SH979, SH981) · SH978 and SH980 are the declaration and its vocabulary |
Block K, closing: state= on /agent/read so a draft can be compared with what is live, and shio diff --against published as that pair in one command | agent-surface § Reading · cli | ✅ (SH619, SH640) |
Block BA, one version grammar on every read: state=draft, published or rev:<n> on /agent/find, /agent/verify, /agent/render, /agent/editable, the preview and the delivery API, where a draft or a revision needs a preview token, with state on shio_find, shio_verify and shio_digest (SH990); scheduled= on find, include=schedule on read, shio schedule, the console's Scheduled page with its timezone stated, and the requester named on a scheduled transition's audit row (SH991); when and cancel on shio_publish, post.unpublish and shio publish (SH992); a release, the named set a launch goes live as: release.upsert/add/remove/run/archive, find?release=, state=release:<name>, include=releases on the pack, and the shio/releases/ projection (SH993), with release.rollback putting a launch back as the unit it went live as (SH994); PUBLISH as a content permission above WRITE, asked by every publish path and offered in the permissions dialog (SH995); the curator's publish with a dry run, a routes preview and a review entry of its own (SH996); and publish gates a site declares as files, evaluated on every publish path with shio gate run as the CI form (SH997), waivable by a person on the record and never by an agent, with GATE_FAILED and REVIEW_REQUESTED on the outbound edge (SH998); and include=fields on the change feed (SH989) | agent-surface § Which version a read returns | ✅ (SH990, SH991) · SH991's console page and audit detail are in content-lifecycle § Schedule a publish or an unpublish; SH989's console half is the curator row |
Block L: agent safety: the AGENT token scope + session identity, draft-by-default + the publish gate, destructive-op confirm tokens, the review queue, the folder trace/undo, attribution — which Block BB makes readable: the change feed and the Activity page carry the run and the name it gave on initialize, with by=agent/by=curator on both (SH999), and a run declares once what it is for — MCP clientInfo, X-Shio-Intent, shio --intent — which the review queue leads with — beside counts by site and, on an opened run, which of its pages look different than before it ran — and shio report quotes (SH1000); and a run is decided one change at a time — APPROVE, REJECT with a required reason, or HOLD — with the two whole-run verbs as that call over every change, `shio review list | show | decidewith a dry run, and per-entry triage in the console (**SH1001**); and the verdict read back by the credential it is about —GET /agent/review, shio://review/mine, reviewon the change row andshio review mine— with no way to decide anything from there (**SH1002**); and a correction anchored where it is about —sh_noteon a page, a field or a revision, as visible as the object it hangs on, written withnote.addand closed withnote.resolve, surfacing on include=notes, in shio notes, as a .notes.yamlGrep finds, and as a rail under the fields it is about (**SH1003**); and one reader over the audit table for both surfaces — the Activity page and/agent/changesshare a query set, a site scope and a cursor grammar, walked forward by an agent and back by a curator, withbefore/since, action, actor, subjectandsiteas filters the console mirrors into its URL,address=for one page's own history, and a history panel in the post editor (**SH1005**); and who else is on the page a curator is editing — a working mark derived from the last minute's writes, never declared and never a lock, oninclude=working`, in the terse read and as a line above the fields naming the run and what it said it was for (SH1008) |
Block M: token economy, measured , response budgets, terse mode, the build-a-site benchmark, the instance memory / conventions store /agent/memory (SH114, SH160, SH161, SH231), the AGENTS.md generator (SH115), conditional agent reads (ETag — SH116, SH159, SH232), the manifest asked for in pieces (SH174) and format=terse cutting each endpoint's purpose to its lead sentence (SH230), leaner delivery JSON (SH127), the proof a write returns (SH157, SH227, SH228), teaching refusals that stay readable (SH513), a derived furl on create (SH651) and a token ceiling on the change feed (SH723) | token-economy | ✅ (SH497) |
Block N: the realignment: one name-keyed post-type surface (the id-keyed /api/v2/post/type twin is gone, SH117), console reads on the CDA shapes, post-type rename as a move (SH163) and shio push performing it as a rename rather than a create-and-delete (SH235), a teaching 409 for a post-type content points at (SH236) | content-modeling § One name-keyed surface · rest-api § Post types · cli | ✅ (SH495, SH496) |
Block N: the Next.js starter is a blueprint rather than a second mechanism — shio init --blueprint nextjs-starter and create-shio-app emit from one source (SH119), and a package's carried files declare that they are templates (SH166) | blueprints · nextjs-starter · cli | 🧩 (SH487, SH488) |
The curator approves it
| Block / feature | Page | Status |
|---|---|---|
| Block O: the content console , the browser and its paged listing, the post form built from the post-type, copy/move with both ends authorized and free names, "select everything" across every page and not just the one on screen (SH237), the trash, a list operable by keyboard alone — arrows, Space, Shift to extend, Enter, Delete and slash to search (SH1020), publishing, unpublishing and deleting a selection in one call through the writer an agent's batch uses, planned first and reporting per item (SH1021) — and the repeatable field a curator can actually fill in — rows added, removed with undo, duplicated and reordered by drag or arrow keys (SH1012), and the lint and page digest read beside the form rather than printed to a terminal nobody had open (SH1013), and the page rendered from values nobody has saved, in the editor and on the agent surface (SH1014), and a block body edited as typed blocks rather than as markup a browser mutates (SH1015, SH1017), and every list holding its search, sort, filters and view in its own URL — in the server's words, so the link a curator sends is the query an agent runs (SH1023), and what one page of the browser costs, measured and then narrowed: child folders paged on request with a count beside them, instead of the whole set re-sent on every page of posts (SH1025), and a search that finds an agent's drafts — over the agent's own find, scoped by folder subtree, filtered to what the reader may open and saying how many it withheld (SH1027), and a command palette that answers with that content and with the verbs the surface declaration names, ranked by where you are and never able to write (SH1028), and a filter bar on the browser, search, the trash and the review queue — facets that say how many, an option for what an agent wrote, and saved views a team can share (SH1024), and a shortcuts sheet listing the keys the shell actually binds (SH1097) | content-console | ✅ (SH625, SH1012, SH1013, SH1014, SH1017, SH1020, SH1021, SH1023, SH1024, SH1025, SH1027, SH1028, SH1097) |
| Block AV, the console tells a curator what actually happened: a batch delete reports the items deleted rather than the items selected, lists what the server refused with its reasons and leaves those rows selected (SH953); a refused save shows the server's reason and fix instead of the word "Error", and marks the field the refusal is about (SH955); and the content browser's Clear Cache action is gone — it reported success for a cache the instance no longer has, and no page ever described it, so nothing needed unwriting (SH954) | content-console § When a save is refused · § Selecting more than one thing | ✅ (SH953, SH955) · SH954 is a removal with nothing documented to remove |
Block O, closing: duplicating a section stops being console-only — folder.copy names its own copy and may cross sites, and a copy carries its files' bytes rather than pointing at the original's, driven against a running instance rather than asserted from a reading (SH748) | agent-surface § Writing · content-console § Copying a folder copies its files | ✅ (SH244, SH749) |
Block E: the React console's own surfaces, dashboard, Media Library, static-file manager, webhooks UI, and the config/ pages (auth providers, exchange providers, email/SMTP, search) — and what one media listing costs, counted rather than argued: each asset's metadata parsed once instead of once per key, measured at 2400 parses down to 400 for 400 assets with the answer byte-identical (SH1029), and one page at a time on every surface — the object listing's own envelope, the category counts taken by the server, the content type stamped at upload, a cursor on shio_assets and filters that narrow the read (SH1030), and alt text as a publishing fact — an undescribed image is a verify finding, the image helper stops writing an empty alt that made the rule unreachable, and the library narrows to what needs describing (SH1031), and an asset's own metadata reaches the agent at last — asset.meta merges alt, caption and tags through the one writer rather than declaring whole state the way an upsert would, usage=true on shio_assets says where each asset is referenced and says used 0 out loud, and describing an image now writes an audit row so it reaches the change feed like every other content write (SH1032) — and the tree carries them too, at shio/asset-meta/<site>/<chain>/<name>.json, merged a key at a time so an agent describing an image and a curator captioning it never collide — which is also how shio_assets was found to refuse every listing that held an asset, a field written since SH951 and declared by nobody (SH1098) — and where is this used, which used to be a scan of every post in the site, run twice per dialog: measured at 1,000, 10,000 and 50,000 posts against a reverse index that examines four rows and costs three statements per write, so the choice was two curves rather than two numbers (SH1033), and on that index the media listing stamps a usage count on one page of rows in a single query, the card spells zero as unused, verify warns asset-unused, and shio assets prune totals the reclaimable bytes while deleting nothing (SH1034) — and replacing an asset's bytes is now a console action with a way back: the dialog says how many pages change before the file picker opens, the superseded bytes are kept as numbered versions with a Restore, and reverting captures on the way past, so undoing is itself undoable (SH1035) — and what the console itself costs to open, measured and then bounded the way the agent's responses are (SH1043), which turned out to be 7.5 MB fetched before the first row of content on every screen; the rule written to keep the GraphQL explorer out of that load was what put it there, and deleting it leaves 1.5 MB raw / 403 KB gzipped, a 79% fall, with the query explorer and the code editors arriving only on the screens that use them (SH1044), and eighteen packages the console declared and nothing used are gone with them (SH1045) — and what the console asks for, which was the other half of the wait: one read is shared by every screen that needs it instead of each fetching the same list again, a screen you navigate away from stops the request it no longer needs so a slow answer cannot land under a folder you already left (SH1046, SH1047), an unchanged read comes back empty rather than re-sending a body the browser already has (SH1048), a screen that fails now fails on its own — the rail, the header and the search stay, with a Try again that re-reads rather than a blank page (SH1049), and the dashboard stops downloading every site and every post type to count them: it asks one question and answers it with what is waiting for you — a review queue, publishes due this week, open notes, what the agent has been doing and what it said it was doing (SH1050) | administration-guide, rewritten against the React console · the Media Library is one screen with the static-file manager and is documented where a curator meets it, content-console § The Media Library | ✅ (SH623, SH1029, SH1030, SH1031, SH1032, SH1033, SH1034, SH1035, SH1043, SH1044, SH1045, SH1046, SH1047, SH1048, SH1049, SH1050, SH1098) |
| Users, groups, roles, site properties, and SH54 content-level ACL (folder/post grants, inherited, default-allow) | administration-guide § Permissions | 🧩 |
| Block C: the curator's lifecycle tools, SH13 short-lived preview tokens + console preview, SH14 draft↔published diff + restore, SH15 scheduled publish/unpublish, SH51 audit history + Activity viewer, SH55 trash / restore (and the two refusals a restore can meet: a URL a live post took, SH243, and a title it took, SH691) — and the editor that does not lose work: the Unsaved changes cue lit from a canonical comparison against the post as loaded, the browser asked before a tab closes and the console before any in-app navigation leaves the page (SH1090), a debounced autosave of only the changed keys into the draft, and a recovery buffer offered rather than restored (SH1011) — and a stakeholder who has no login can be sent an expiring link to a draft Shio renders itself: the link is exchanged once for a cookie so the credential leaves the URL, it opens only the one site's preview and nothing else on the instance, and the banner saying it is a draft stays (SH1042) | content-lifecycle · the audit trail at administration-guide § Activity and the trash at content-console § The trash, both linked from it · content-console § Leaving with unsaved work | ✅ (SH624, SH1011, SH1042, SH1090) |
| Block AZ, what the content said before: every version that went live is kept as a numbered revision, and a rollback puts one back into the draft without publishing it (SH986, SH987); a save that would overwrite somebody else's edit shows both values instead of discarding either (SH985); and an audit row names the fields a write changed, so an approved run can still be described (SH989) | content-lifecycle § Every version that went live is kept · § When two people save the same page · § The audit trail | ✅ (SH985, SH986, SH987, SH989) |
Block P / 0: the Universal Editor: the annotated render, the sh:* bridge, the iframe states, the save-back (and the auth it always claimed, SH233) — and the editor as something a curator can stay inside: edit mode now travels with every link clicked in the preview, and the badge stops reading connected over a page that handed back no bridge (SH1036); the page announces a protocol version and the capabilities it actually has, so the console offers only affordances that page will honour and draws each field as the widget its model declares rather than as a text box (SH1037); and a section is an object rather than a set of fields — selectable, with a position, and moved, duplicated or removed from a toolbar drawn over it, each verb one rewrite of the page's own ordered list (SH1038); a curator adds a section from the page itself, choosing from the types that container accepts by their own titles and descriptions rather than by post-type names, placed above or below the selection (SH1039); and an edit can be taken back — every change carries what the field held before the typing, so Revert means before I started on this field, Discard clears them all behind a confirmation, and a refresh replays what is still pending into the reloaded page instead of counting edits that are no longer on screen (SH1041) | universal-editor | ✅ (SH489, SH1036, SH1037, SH1038, SH1039, SH1041) |
SH924: a create no longer lets a client choose the primary key. POST /api/v2/group stored a blank id verbatim, producing a row the collection endpoint lists and no path can reach; it now mints one, still honours a key you deliberately assign, and PUT /{id} writes the row its path names rather than the one in the body. Swept across all 23 POST handlers with a request body: this was the only one, the other twenty-two taking request records with no id at all | rest-api § Ids are the server's to assign | ✅ (SH924) |
Block AQ/AR, the cutover: the console a curator opens is the bento shell — SH909 (/bento is the default and every /console/** address redirects to it, query and anchor carried, history replaced so Back works), SH910 (the old shell, its sidebar, its page header and its breadcrumb bar deleted rather than left unreachable), SH926 (/bento/** is served index.html like the console path always was, so a deep link a curator pastes and a browser refresh both land on the page rather than a 404 — the whole migration had been proved on a dev server that does that for any path). What a reader has to relearn is small and specific: the address, a navigation rail carrying two areas instead of a sidebar listing every screen, the command palette that replaces the list, and a hero on each page where the header and trail used to be | content-console § Finding your way · administration-guide § Finding your way around | ✅ (SH911) |
What the cutover took away, and what came back: the tenant switcher is restored by SH934, in the console header beside the account menu, and it now appears only where there is somewhere to go - the instance is multi-tenant and you belong to more than one, which the deleted control got wrong. And SH936 restored the other one: the pending-review count is in the header beside the account menu, absent rather than zero when the queue is empty, and it links to the queue and updates as runs are approved. And SH931 closed the third: a bento URL names its tenant with ?tenant=<name>, copied from the tenant switcher itself, and opening one never switches the session — it says which tenant the link was written for, names the one you are in, and offers a switch you press, because a parameter that moved the session on open would carry a curator out of the tenant they were working in and leave a half-written draft behind. All three losses the cutover created are closed | administration-guide § Agent review · multi-tenancy § Membership | ✅ (SH911, was ⚠️) |
| Block AX, the assistant dock: the console reports how things ended in one corner instead of in toasts that leave — your own saves; a refused save with the server's explanation, a go-to-field action and the suggested correction (SH966); agent runs as they work and what they left for review, replacing the header count (SH968); scheduled publishing that failed or went live, including failures while no console was open (SH969, dock half); form submissions arriving, several at once as one report (SH970, dock half); a per-user choice of what the dock reports, where failures always arrive (SH971, kinds half); and the same dock inside the Universal Editor (SH972) | content-console § The assistant dock, universal-editor § What saving does | ✅ (SH964) |
Block AZ, comparing versions: the version dialog compares any two versions, word by word inside a field with unchanged fields folded, from a server-side diff (GET /api/v2/post-unified/{id}/diff); a page never published shows as new with its rendered outline and a preview link; a version or a single field can be restored into the draft; the review queue shows each entry's change inline, created pages included (SH988) | content-lifecycle § History: compare any two versions, agent-safety § Everything is attributed, and grouped into runs | ✅ (SH988) |
Block BB/BC, the conversation with the agent: the dock opens into a chat with the connected agent when one is active and a page is open, relayed as request notes the agent reads from shio://requests (SH1006); an answer that changed the page carries "open the change" and "approve and publish" (SH1007); a text field can ask the agent for a value and apply the answer as an unsaved edit (SH1019) | content-console § Asking the connected agent, content-console § Asking the agent for a value, mcp § Answering a curator's question | ✅ (SH1006) |
Block BD, the filter bar and the views: the content browser's filters are a filter bar over the same words its address holds, with chips, a language facet only where there is more than one, and the search behind /; search draws it with a site facet and runs on a filter alone, and the trash filters what it holds (SH1024; the review queue is still to come); and the list, grid and table views, the table sortable, virtualised and with an inline title edit guarded by the page's version (SH1026) | content-console § Filtering the list · § Three ways to look at a folder | ✅ (SH1024, SH1026) |
Addresses that move, and sites that travel: a rename keeps its old address answering with post.redirect, offered ticked in the publish dialog and listed by shio redirects, with verify's url-orphaned for the ones missed (SH1064); a move reports the published addresses it retired and created (SH1078); shio export site:<name> and what a package carries (SH1065); an import reports what arrived and what it could not bring (SH1079) | content-lifecycle § Keeping an old address answering, cli § Start something | ✅ (SH1064) |
Every door to publishing runs the same checks: approving a run, a PATCH that publishes and the delivery API's publish evaluate the required fields and the publish gate like every other publish (SH1084); every field of the post form has a name, its requirements and keyboard reach (SH1052) | content-modeling § Required fields are checked when you publish, content-console § The post form | ✅ (SH1084) |
The visible site
| Block / feature | Page | Status |
|---|---|---|
Block P: the renderer, Page → PageLayout → Region, Theme, Handlebars templates and helpers, the section vocabulary, data-shio-*, /preview/** and the /sites/** delivery grammar | website-development | ✅ (SH483) |
Block P / Q: the rest of the visible site, DTCG theme tokens, Site Scripts, the {{#image}} helper's intrinsic size + signed srcset, Redirect posts, Menu/MenuItem, post.locale + {{#translations}}, the paged/sorted {{#query}} | design-tokens · website-development § Themes and design tokens · § Third-party scripts · § Redirects · § Menus and translations · § Paging a listing | ✅ (SH483, SH420) |
Block P: form submissions — {{#form}} rendering a post type's fields, the per-site destination (POST /api/v2/site-form: folder, invited types, enabled), the FORM token scope, POST /api/v2/cda/form/{site} writing one DRAFT post, the honeypot, and the system-type refusal — and where the submissions are read: the console's Forms page with the site's form settings, submission=true on every content listing, and verify's form-destination-missing (SH1066) | website-development § Forms · content-console § Form submissions | ✅ (SH633, SH1066) |
Block P: {{#query}}'s pager — @page/@pages/@total/@hasPrev/@hasNext/@index/@last, drawing a pager once with {{#if @last}}, and a listing nested in a listing keeping its own position | website-development § Paging a listing | ✅ (SH420) |
Block P: verify's dangling-relation, and the PageLayout opt-out from site-scripts-dropped | website-development § Proving it renders · § Third-party scripts | ✅ (SH421, SH572) |
shio audit's rules: the eleven checks (overflow, contrast, zero-size, collapsed, font-fallback, request-failed, console-error, no-landmark, no-heading, the shape line, region-script) and what each means | cli § What shio audit reports — a row per rule with what fires it and what to do, plus the two always-printed lines. docs-vocabulary reads AUDIT_RULES and fails when a rule this page does not name is added | ✅ (SH652) |
Block Q: replication, shio clone (--assets, --render, --scripts, --refresh), shio propose, shio convert, fidelity vs authorable mode, snapshot --against, the replication check group — and the block's closing round on what a replica looks like: SH831 (the theme an authorable replica is presented with takes its six colours from the captured palette, matched by the role the source uses each one in, with every unfilled one named in the run) and SH832 (an empty row in a collection draws an empty card instead of its section's own words), then SH834 (the same bridge for what is not a colour — a corner radius and a font stack come from the source too, by a rule per kind of value: a page-level statement where a group has competing roles, the most-used value where it has one, and a refusal for a scale, since a stylesheet ranks its font sizes by use and a type scale is ordered by size) and SH835 (an FAQ written as a <dl> of <dt>/<dd> pairs is read as one, rows and all — the second-commonest way the web writes an FAQ, which the classifier had no route for), and SH840 (the colour the page states outright wins its slot over one the stylesheet merely repeats more often — the repeated one falls to the muted slot rather than becoming the body copy), and then the pair that found the bridge had been carrying almost nothing across it — SH845 (a palette declared inside @layer, which is where the commonest CSS toolchain now puts one, is the source declaring its palette rather than a variant of somebody's theme, and a root is every compound in the selector list rather than one of five spellings somebody enumerated: on a real source 319 custom properties were being refused and three colour tokens ranked out of utility-class literals instead, one of them fully transparent) and SH846 (the pair the theme paints one on top of the other has a floor, so a transparent page or a text colour with no contrast against its own surface is refused with the ratio printed rather than written as a token the run counts as taken — and the source's half is what gives way, since the defaults are a pair chosen together) and SH847, which closed the block on the slot a curator sees most (the accent is read off the source's buttons: a rule that sets a background and sets its text to the page's own background colour is an element turned inside out, and that is what an accent is — it was fed only by fill/stroke/caret-color/text-decoration-color before, none of which a real call-to-action uses, so every replica shipped with the theme's built-in dark green; a band painted in the page's own text colour, such as a dark footer, is the page inverted rather than an accent and is excluded), and the round that closed the block on what a replica looks like twice over: SH848 (the accent is elected by how much colour a value holds rather than by the word a source gave it, so a shadcn-shaped palette — where accent is a near-white hover tint and the orange every button is painted with sits under brand — hands over its brand orange, and a resting fill wins over the colour the button turns on hover; and the surface floor moved onto the role, so a page at half alpha is refused where the same value stays an ordinary border), SH850 (a theme reached through a relation renders as its composed stylesheet with its tokens prepended, so on a mixed page the rules the capture lifted a declaration away from resolve again instead of arriving unstyled), SH851 (a page is read for the custom properties its own CSS uses and never declares, so verify warns and the appearance digest moves when a stylesheet loses its tokens — the loss that used to be visible only by looking at the page) and SH852 (all four pairs the theme paints one on top of the other now have a contrast floor, the button and the card included: a source whose accent is a pale yellow no longer ships a white label on it, the precedence says which half of a shared slot may give way, and a pair the floor is not allowed to fix is reported instead of being counted as two filled slots), and the round that closed the block on the two things a reader of a replica actually meets — its colours and the things in the way of them: SH853 (the Shio theme's own tokens live in a --shio- namespace, so a mixed page's two :root blocks stop overwriting each other's names and a source that reaches into the namespace anyway is reported rather than settled by which <style> came second), SH854 (a contrast pair the floor judged, failed and was not allowed to fix now reaches the palette report and names the slot the source never stated, where before a replica with unreadable cards printed two filled tokens and no warning), SH855 (the accent is elected by where a colour is used rather than by how much colour it holds — the fill of a rule that states its own foreground, then the most-referenced non-neutral, with chroma only as a tie-break — and the run names which of the four signals chose it, so a site whose every button is orange stops being replicated in a green a decoration lent it), SH856 (the contrast floor reads oklch(), oklab(), hwb() and color-mix() instead of standing down on them, which is the colour space Tailwind v4 and shadcn emit and therefore most of what a replication meets; where it still cannot convert a value it names the value rather than the space), SH857 (a repeated unit that filled no field is no longer written as a collection row, so a section stops drawing empty cards under its heading, and both propose and convert say how many they dropped) and SH858 (an overlay kept without the behaviour that dismisses it — a consent banner with Decline and Accept buttons and no script anywhere on the page — is cut out of the kept markup instead of obstructing the content for every reader, and shio clone --scripts is how a caller asks for the working one), and the round that gave a replication round a way to be finished: SH860 (shio judge answers against a written bar — a finding at or below it prints as a task for later and the round is ACCEPTED, one above it or of a kind the bar does not name holds the round; what the bar leaves out is the point, since looking like the source is deliberately not a test an authorable replica has to pass, which is what had kept the block open across six declared closes), SH861 (the README and this site say so too — the replication story ends at a verdict rather than at convert) and the two that made the numbers under it honest: SH865 (a round is judged in the mode its own pages are in, read from the plan rather than assumed, and a verdict is ACCEPTED only when every instrument that mode's bar rests on actually ran — a 12-of-12 fidelity site had been graded against the bar that excludes pixel comparison while both mode-defining instruments abstained) and SH866 (two pages of different heights are compared over the region they share and the run says which is short by how much, where any size mismatch used to answer a flat 100.00% — nothing matched, of a replica whose first screen is 93% identical), and the round that made a replica editable without giving up the source's own bytes: SH864 (annotation is orthogonal to mode — a verbatim page carrying 14 editable fields measures 2.02% different from the source against 6.76% for the authorable rebuild of the same page — and an annotated value lives in an ordinary field rather than at a byte offset the next edit would move), SH868 (shio convert --annotate stamps the mapping propose already computed onto a wholly verbatim page's own markup, so the page is the source's byte for byte and its blocks are editable; asked for rather than default, because plain fidelity is defined by having no editable field), SH870 (an edit made in the Universal Editor now shows on the page — the post's own field is substituted into the value before a template sees it, and markup with nothing to substitute is returned byte-for-byte, which is what keeps annotating free in pixels) and SH871 (the fields those annotations address no longer have to be created by hand: the run that computes them declares them, once per name, where it used to print a 92-line list of preconditions and then refuse the whole content write after uploading the assets), and the two that let a replication round be compared with the last one: SH869 (shio judge --record keeps a round as a row and --since reports what moved, with a count that rose graded by the same bar as any finding and a count that fell reported and never held) and SH867 (a page's body carries a per-kind census, so a lost stats bar reports as list items rather than as six links, and a capture taken before the census is migrated to one rather than refused or read as zero), and SH872, which closed the block by making that third mode cost the content model nothing: the annotated text stays in the markup that carries it — where it always was, since the renderer only substitutes a stored value that differs from it — so Page keeps its four fields on a site of any size instead of gaining one per captured block, and a curator's edit is declared by the markup it annotates rather than by a field somebody had to create, and SH878, which reopened the block for the half SH873 fixed one surface away: a replica's navigation is now the menu its source states — clone records <nav> entries in source order with a count of how many pages each appears on, so convert writes a Menu of MenuItems from the ones that appear on every page and the layout renders it, where before it listed every page by the <title> written for search, alphabetically (a source whose menu says Northwind & Co then About was replicated as About & contact then Northwind & Co); a capture that states no navigation still gets the page listing, which is five of the seven corpus archetypes | replication, incl. § Fidelity with editable blocks · § The theme an authorable replica is presented with · § 2. Propose · § Re-capturing without paying for it again | ✅ (SH492, SH611, SH831, SH834) |
Block F (SH25 epic): static files and image transforms: the file_source upload/serve subsystem, ?w=&h=&format=&crop= on the delivery path, the resize/crop pipeline, webp/avif negotiation, the result cache + ETag, limits and signed URLs | the author's half at website-development § Static files and images; the operator's half — the result cache and why its key is its own invalidation, the dimension/format/decode-bomb ceilings, and signed transform URLs — at search-caching § Image transforms | ✅ (SH629) |
The CDA delivers it
| Block / feature | Page | Status |
|---|---|---|
Block 0 + A: the CDA read contract /api/v2/cda/**, token scopes + per-site keys, per-environment (prod/preview) keys, rate limiting + cache headers, the real GraphQL delivery schema | content-delivery-api · graphql | ✅ |
Block A/B: @viglet/shio-client (framework-agnostic TS core), with a body delivered as typed blocks — a discriminated union, a ShBlock GraphQL union and the rendered HTML beside them (SH1016) | javascript-client | ✅ (SH1016) |
The client asks for a language and a version: @viglet/shio-client sends state on getPost, getPostByUrl, listChildren and query, and the React hooks pass it and refetch when locale or state changes (SH1081) | javascript-client § API, react-sdk | ✅ (SH1081) |
Block B: @viglet/shio-react-sdk (hooks + render components, including ShioBlocks mapping block types onto a site's own components, falling back per block) | react-sdk | ✅ (SH1016) |
Block B: create-shio-app: the Next.js starter, SSG/ISR/SSR recipes, Draft Mode preview, on-demand revalidation | nextjs-starter | ✅ |
Block B (SH11): TypeScript type generation from post-types , GET /api/v2/cda/post-type, generateShioTypes, the shio-types CLI | content-modeling § Generated TypeScript for a front end · cli | 🧩 (SH496) |
Block B (SH62 epic): post-types as code , @viglet/shio-model DSL, the CLI compile step, push --check drift guard, the console "managed by code" lock | content-modeling § Authoring in TypeScript · § Managed by code | ✅ (SH496) |
| Block C (SH12): outbound webhooks on publish/unpublish/delete, per-site subscriptions, the signed payload | webhooks — subscription, payload, HMAC verification, and the delivery guarantees (no ordering, no exactly-once, no DLQ) written down as answers rather than omissions | ✅ (SH626) |
| Block C (SH52 / SH240): content full-text search: the in-DB index, the CDA search endpoint, the console search box — and body text found on PostgreSQL too, where it had been stored as large objects no SQL could read (SH1099) | search-caching § Full-text search | ✅ (SH494, SH1099) |
Block C (SH53): content i18n , the locale axis, linked translations, CDA ?locale, the checked locale segment | content-i18n, with the URL half pointed at from website-development § Public delivery and the modelling half from content-modeling | ✅ (SH627) |
Content i18n, the second language as a decision: a site declares its languages, default and fallbacks, in the console, over REST and on site.upsert (SH1056), and the delivery API reports them (SH1123); the locale segment selects the translation and follows the fallbacks, and a declared site is addressed in its own language (SH1057), with locale on every CDA listing (SH1127) and on GraphQL (SH1129); a translation whose source moved is marked (SH1058); each browser row shows its language (SH1059); the Languages board and the coverage read show what is still to translate (SH1060, SH1131); the side-by-side translation workspace with per-field review (SH1061); and the connected agent asked for a translation from a cell, a row, a column or the workspace, the cell reading Requested until it answers (SH1062) | content-i18n § Declaring a site's languages, § Working on a translation, § Reading a locale through the CDA, § The locale segment in delivery URLs | ✅ (SH1056) |
| Block G: content portability: the exchange package format (SH68), site export → zip, site import / clone, the default bootstrap-site template | import-export (predates SH68's format and SH71's template) | 🧩 |
Run it
| Block / feature | Page | Status |
|---|---|---|
| Installation, Docker, JAR, source, databases, Linux service | installation-guide | ✅ |
Block N: first start without a person at the console — SHIO_ADMIN_PASSWORD / shio.admin.password setting the admin password at startup (SH706), the seeded admin actually carrying ROLE_ADMIN so the console stops answering 403 to its own administrator (SH681), and --server.port=8099 being honoured on the command line instead of silently coming up on 2710 (SH680) | installation-guide § Setting the admin password without the console · § Accessing the Shio Console · configuration-reference § The instance | ✅ (SH706, SH680) |
Configuration (application.properties) | configuration-reference | ✅ (SH495) |
Block F (SH22): multi-tenancy / SaaS, @TenantId isolation, provisioning, membership, quota, suspension, per-tenant file_source storage so two tenants never share bytes for one file id (SH47), a single-tenant install not advertising the tenant admin (SH46), and the per-tenant storage meter behind the plan's byte limit (SH746), moved by the storage layer itself so an upload actually changes it (SH751), with the ceiling itself now enforced on the DELTA rather than the total — one upload larger than the whole plan used to pass whenever the tenant was at zero, and a section copy creating N posts was charged for one (SH110, SH750), plus the API-call meter beside it — a flow rather than a level, so one row per tenant per UTC day per surface, with a ShBillingExporter hook for a closed day (SH45) and the same figures readable by the agent the meter counts, as shio://usage and ?include=usage (SH754) | multi-tenancy | ✅ (SH493) |
| Turing ES indexing, opt-in, reached only on publish | search-caching § Viglet Turing ES indexing | ✅ (SH494), and three changes to what reaches the index: SH912 — a push that fails is retried (shio.turing.max-attempts, default 3, with a doubling shio.turing.retry-backoff) before it is reported, so a Turing restart during a publishing session no longer leaves a page permanently unfindable until somebody reads the diagnostics feed and re-publishes by hand; the incident is recorded once at exhaustion, so a retry that works is silent. SH913 — a published PDF, Word or spreadsheet now reaches the index with its text, read by Turing's own OCR endpoint rather than parsed here, so a school publishing its rules and its fee table as attachments has documents that answer a search instead of only matching their filename; a file too large, unreadable or refused is still indexed by name, never dropped. SH914 — a post-type field can declare itself indexed with a type (indexed, turingType, optionally turingField), so a number or a boolean leaves in a field of its own and a school can filter by level, campus or tuition; before this a tuition amount reached Turing in no field at all, because a number folded into full text answers no range query. Nothing changes for a post-type that declares nothing |
| Architecture, components, request flow, deployment topologies | architecture-overview | ✅ (SH491) |
| The introduction a newcomer meets first | intro · core-concepts | ✅ (SH490) |
| The landing page | index | ✅ (SH480) |
| Developer environment, tech stack, contributing | developer-guide, rewritten: the six surfaces, the real stack, the build and test commands, and the ten design laws a contribution is judged by | ✅ (SH628 — and the stack table is now checked against this repo's build files by cli/conformance/docs-stack.conformance.mjs, so a version that drifts fails a build instead of misleading a reader) |
Developers (reference)
| Block / feature | Page | Status |
|---|---|---|
Console REST API, including the refusal a site create meets when it declares a furl a live site already answers at — kept as given rather than numbered, so the link the caller is about to send still resolves (SH744) | rest-api | ✅ (SH495) |
| Content modelling + the delivery SDK story | content-modeling · the headless/ pages | ✅ (SH496) |
Security
| Block / feature | Page | Status |
|---|---|---|
| Authentication, authorization, CSRF, CORS, HTTP firewall, password encoding | security | ✅ (SH495) |
Block AV, how uploaded files are served, and what may be uploaded at all: every asset response now carries X-Content-Type-Options: nosniff and Content-Security-Policy: default-src 'none'; sandbox, and only a short list of raster image types is served inline — an uploaded SVG or HTML file comes back as an attachment instead of a scriptable document on the console's own origin, across all three asset routes including the public /file_source/** (SH950). A delivered site is unaffected, because a browser honours the disposition on a navigation and ignores it for an <img>, a stylesheet or a script. On the way in, an upload now meets a policy: shio.upload.policy.<media-type> takes allow, deny or sanitize, HTML and JavaScript are denied with a teaching 400 naming the property that re-allows them, and an SVG is stored with its script, event handlers and foreignObject removed rather than refused, because a replicated site's logo is usually one; shio_assets flags a stored file the policy would refuse today (SH951). A file's download name is quoted rather than pasted into the header, so a quote in it cannot end the name and relatório.pdf downloads as itself (SH1071). And a rich-text field is cleaned against an allow-list on every save, from every writer — scripts, event handlers and javascript:/data: URLs go, formatting, relative links and HTML5 sections stay, layout templates are left alone — with a dry run naming what a write would strip and shio verify's html-unsafe finding published rich text stored before the cleaning existed (SH956) | security § Uploaded files and rich text | ✅ (SH950, SH951, SH956, SH1071) |
The AGENT token scope, session identity and the Universal Editor's save-back
auth (SH106, SH233) are the Block L row in The agent builds it, counted
there, not twice.
The manifest's feature keys
The manifest's features map is the one list of capabilities the product publishes to every agent,
so each key is a row here: what it says, and the page a reader finds it on. docs-coverage
(SH1069) counts the keys this table does not spell and fails when a new one arrives without a row.
The coverage column is the page's verdict and matches the cluster row above that owns the capability. It is not headed Status, so these rows are not counted as clusters by the summary below: a key is a capability, and its cluster is already a row.
| Key | What it says | Page | Coverage |
|---|---|---|---|
multiTenant | this instance serves more than one tenant | multi-tenancy | ✅ |
oidc | sign-in goes through an OpenID Connect provider | security | ✅ |
webhooks | publishes, unpublishes and deletes are sent to subscribers | webhooks | ✅ |
scheduledPublish | a publish or unpublish can be set for a time | content-lifecycle | ✅ |
previewTokens | short-lived preview keys can be minted | content-lifecycle | ✅ |
rateLimit | delivery keys are rate limited | security | 🧩 |
signedImageUrls | image transform URLs must carry a signature | search-caching § Image transforms | ✅ |
searchIndexing | publishing sends pages to a search index | search-caching | ✅ |
marketplace | the instance reads a remote package catalogue | blueprints § Where more packages come from | ✅ |
graphql | delivery answers GraphQL | graphql | ✅ |
search | content full-text search | search-caching § Full-text search | ✅ |
locales | content carries a language and linked translations | content-i18n | ✅ |
contentAcl | folder and post permissions | administration-guide § Permissions | 🧩 |
trash | deletes go to a trash they can be restored from | content-console § The trash | ✅ |
exchange | a site exports to a package and imports from one | import-export | 🧩 |
imageTransforms | ?w=&h=&format=&crop= on delivery | website-development § Static files and images | ✅ |
assetMetadata | an asset's alt, caption and tags, and asset.meta | content-console § The Media Library | ✅ |
assetUsage | where an asset is referenced | content-console § The Media Library | ✅ |
postTypesAsCode | post types authored in TypeScript | content-modeling § Authoring in TypeScript | ✅ |
serverRender | the instance renders pages itself | website-development | ✅ |
universalEditor | a rendered page is editable in place | universal-editor | ✅ |
teachingErrors | a refusal carries fix, allowed, didYouMean and example | agent-surface § Errors are instructions | ✅ |
agentContext | the context pack, one call instead of a session | agent-surface § One call instead of a session | ✅ |
terseResponses | format=terse | token-economy | ✅ |
pathAddressing | post:, folder: and site: addresses | agent-surface | ✅ |
batchWrites | POST /agent/batch and its op vocabulary | agent-surface § Writing | ✅ |
desiredState | /agent/plan and /agent/apply | agent-surface | ✅ |
mcp | the POST /mcp server and its shio_* tools | mcp | ✅ |
fieldProjection | fields= on a read | agent-surface § Reading | ✅ |
postMove | post.move | agent-surface § Writing | ✅ |
folderPrune | removing what a folder no longer declares | content-as-files | 🧩 |
folderMove | folder.move | agent-surface § Writing | ✅ |
siteUpsert | site.upsert | agent-surface § Writing | ✅ |
siteDelete | site.delete | agent-surface § Writing | ✅ |
postTypeMerge | an apply may add the fields an existing post type lacks | blueprints | 🧩 |
contentLint | /agent/verify | agent-surface § Closing the loop | ✅ |
routeCheck | route and link proof | agent-surface § Closing the loop | ✅ |
renderDigest | /agent/render | agent-surface § Closing the loop | ✅ |
diagnostics | /agent/diagnostics | agent-surface § Closing the loop | ✅ |
usageMeter | what the caller has spent | mcp | 🧩 |
durableIncidents | the incident record survives a restart | cli, the CLI half of Block K's row | 🧩 |
changeCursor | "everything since I last looked" on /agent/changes | agent-surface § When you want to be told instead of asking | ✅ |
renderFetch | ?url= may fetch a delivery URL | agent-surface § Closing the loop | 🧩 |
deliveryProof | verify proves a route from the delivery side | agent-surface § Closing the loop | 🧩 |
blueprints | appliable starting points | blueprints | ✅ |
instanceMemory | /agent/memory, the conventions store | token-economy | ✅ |
conditionalReads | ETag on agent reads | token-economy | ✅ |
agentsMd | the AGENTS.md generator | token-economy · mcp § The tools | ✅ |
manifestProjection | the manifest asked for in pieces | token-economy | ✅ |
contextCapabilities | the pack reports what this caller can do | agent-surface § One call instead of a session | 🧩 |
writeProof | the proof a write returns | token-economy | ✅ |
agentTokenScope | the AGENT token scope | agent-safety | ✅ |
publishGate | drafts by default, and the gates a site declares | agent-safety | ✅ |
confirmTokens | a destructive op needs a confirm token | agent-safety | ✅ |
reviewQueue | a curator reviews what a run changed | agent-safety | ✅ |
reviewVerdicts | a credential reads the verdicts about its own work | agent-safety | ✅ |
visualSnapshot | shio snapshot, CLI only, so false on the manifest | cli | 🧩 |
appearanceDigest | the class inventory and which classes a stylesheet styles | agent-surface | 🧩 |
pageAudit | shio audit, CLI only, so false on the manifest | cli § What shio audit reports | ✅ |
siteCapture | shio clone, CLI only, so false on the manifest | replication | ✅ |
conversionProposal | shio propose, CLI only, so false on the manifest | replication § 2. Propose | ✅ |
siteConversion | shio convert, CLI only, so false on the manifest | replication | ✅ |
contentAsFiles | content projected to files and synced both ways | content-as-files | ✅ |
Deliberately internal: no public page (not orphans)
These shipped blocks are engineering, repository, or marketing concerns with no end-user documentation surface. Listed so they're accounted for, not silently missing.
| Block | Why no page |
|---|---|
Infra: the pnpm workspace (root package.json, pnpm-workspace.yaml, frontend-maven-plugin on pnpm) | Repository build wiring; nothing a consumer of Shio calls |
Block E: SH20 (Thymeleaf rendering removed), SH21 (the AngularJS resources/ui/ tree deleted), SH60 (legacy commerce/recaptcha widgets deprecated, not ported) | Removals of surfaces that were never documented; the replacement console is the row above |
The lints and invariant guards: SH245 (one writer per content verb), SH26 (cross-DB schema drift), SH122 (@TenantId JOINED-join), SH128 (ShFolderSite), SH136 (byte stability), SH158, SH197, SH403, SH408–SH412, SH435 (help/flags), SH458, plus ShIdeCompiledClassLintTest, ShAgentP1ConformanceTest, ShStatelessReachabilityLintTest | Build-time instruments. They change what a contributor may write, not what a user can do; agents.md and docs/agents/** are their home |
| The benchmarks and suite health: SH112 (task benchmark), SH113 (response budgets, as a test), SH164, SH198, SH239, SH246, SH440/SH445 (CLI exit paths), SH444 (root devDependencies), and Block M's measurement half — SH229 (a lint over every conditional endpoint's params), SH394 (the CLI help's three ceilings), SH396 (the build-a-site benchmark ends at a rendered page), SH597/SH683 (discovery cost scored per intent, then re-measured), SH647 (the vocabulary's cost split into keys and prose), SH673 (one constant, followed rather than copied), SH736/SH743 (a gate at its ceiling refuses instead of measuring, so both now assert headroom) | Internal measurement and CI hygiene. The user-facing half of the token work is the Block M row above, which is an orphan |
Block V, the vocabulary proved against a running instance: SH707 (the count first — which of the agent's verbs any live suite had ever called, and it was two of twelve), SH708 and SH709 (the read and write tools driven over the wire), SH711 (ten CLI verbs spawned as processes, which is the only shape that exercises argv parsing and the exit code CI reads), SH712 (the vocabulary out of order, plus a seeded permutation), SH713/SH719/SH720 (two agents and a curator writing at once, and the unique index that makes one address mean one post), SH714/SH722/SH723 (what every tool costs live, and whether it answers twice the same), SH724/SH725/SH726/SH717/SH718 (the fixtures and refusals those runs corrected), SH748 (folder.copy driven live rather than asserted from a reading), SH755 (the declared red compared against what the gates actually reported), SH756, SH757, SH759, SH760 (the coverage matrix could not ask about MCP resources at all, so it reported full coverage of three populations while a fourth sat at zero) and SH761 (the API-call meter counted nothing on every default install, which only a live run could say) and SH762 (a race test that looped for a duplicate SH719 had made unreachable, so it discarded the contention it found on the first attempt and asserted against the last) | A test tier. Every row above documents what a reader can do; this block documents whether the product really does it when a real instance is asked, which changes nothing a reader types. It earns a row rather than a silence because an absent row is indistinguishable from a forgotten one — the defect this matrix exists to make visible — and it is the largest block ever closed here with no public surface at all |
cli/conformance/ (SH448) and the shio-replication-test judging skill | A maintainer harness for judging a replication run against a live instance; the user-facing verbs it drives are the CLI + replication rows above |
Block N's internal halves: SH120 (console reads adopt CDA shapes), SH162 (SDK type mirror), SH165 (paged listing), SH167/SH234 (CSRF narrowing), SH177 (schemaJson retired) | Behaviour-preserving realignments; where one is observable it is folded into the rows above |
Block N's second half, the instruments and repo hygiene it closed on: SH541 (one licence across 195 files), SH645 (pnpm test keeps its log), SH649 (reserved_ids), SH655 (docs instruments in CI), SH656/SH657/SH660/SH666 (a lint landing before its fixes, four times), SH662/SH668 (ledger and rationale readers), SH664/SH667 (the editor drive, and --strict so a skip is a failure), SH665 (the console lint loads again) | Build-time instruments and repository hygiene, the same verdict as the lints row above: they change what a contributor may write. Two had a user-visible edge and it is recorded rather than assumed — SH541's licence is the Apache 2.0 pill on index and is now derived from package.json + LICENSE by docs-stack (SH669), and SH660's widget fix restores what content-console already describes |
Block N's third wave, where the thing that was wrong was an instrument rather than a feature: SH238 (the Universal Editor's one load-bearing fact checked in a real browser), SH659 (the docs drive publishes), SH663 (the property extractor reads Markdown tables), SH672 (a floor is classified by what it counts, so an absolute one over a corpus meant to empty is refused), SH735 (a red pnpm test log survives the green re-run), SH729 (a constraint declared only in Liquibase is invisible to a suite that runs with Liquibase off), SH731 (citing a task id in an assertion message no longer pays that task's debt — a reference is spelled see SHnnn), SH737 (a vacuity floor pinned near the count it watches, asserted as the yes/no it is), SH738 (the floor classifier could not see the Java half of the repository, which is where the floor it exists to refuse actually lived), SH739 (the block-completion checklist called the README's counts underived when a suite has derived them since SH499, and sent a sweep off to rebuild it), SH740 (SH613's code-vs-prose rule stopped at the language boundary — the JS scans now declare what they read, against one shared stripper), SH741 (the tolerated-floor list was the sixth ledger of knowingly-accepted wrongness and had never joined the registry that asserts their count, so it carried none of the staleness checks the other five get), SH742 (that declaration lint found its own population by naming convention and so could not see the three readers that scan these very pages), SH745 (the ledger and the suite can disagree in two directions and only one was read — the unread one had hidden a shipped, tested task on the backlog for blocks), SH753 (a resolver that threw on a duplicate row is deleted rather than documented, so the compiler enforces the one that tolerates — and the duplication it used to crash on is reported at boot instead of resolved in silence), SH755 (the red-suite ledger is a CLAIM and nothing compared it to what the gates answered: each gate now leaves a stamp, and both directions of disagreement fail — a red with no entry, and an entry whose gate went green), SH756 (an I/O failure carries its exception class and the platform's reason, because a FileSystemException's message is its two paths and the class was the last remaining fact), SH757 (two conformance tests were still pinning defects that had shipped, so the gate was red for the repairs rather than for the damage), SH764 (the staleness gate is about the JVM, so a documentation commit stops cancelling a conformance run over two minutes of wall clock), SH765 (the region table names the sheet that paints each region, so a replica presenting two visual languages reads in one glance), SH768 (a post-type can be declared disposable at creation and swept afterwards, so a suite stops leaving a model behind), SH769 (every standing claim that a capability is absent is signed with one sentence naming what would falsify it — the broad rule was measured at 38 mostly-true hits and rejected), SH770 (a gate stamp taken against another commit is reported as what it is rather than read as this tree's colour, in both directions), SH771 (the coverage ratchet's refusal names both repositories, because the commit it used to prescribe cannot exist), SH773 (a shipped vocabulary type whose live copy lost its references: post key is a finding rather than three readers going quiet) and SH774 (the composition banner reads the rendered page, so a replica whose kept markup is all in sections stops reporting itself as fully authorable), SH775 (the reader-facing pages say a page is usually mixed, and a gate fails when a shipped section type is named nowhere a reader looks), SH779 (the report line bounding a per-run stylesheet is asserted on the only page shape that takes two copies), SH781 (a partial ship keeps the red-suite exception its still-open task needs, because the roadmap decides and the changelog only confirms), SH782 (a regex built from a template literal cannot spell an escape the string eats — it opened at two, one of them a negative assertion passing for the wrong reason) and SH783 (the build doc says a locked jar is a running instance, and that a failed clean ran nothing at all) | Build-time instruments and their own correctness, the same verdict as the lints row above. Worth naming rather than folding in: every one of these was a case where a check was quietly wrong instead of loudly broken, which is the failure shape that leaves a green build meaning nothing. None changes what a user can do. SH739 is the one with a reader-facing edge and it points inward too — the document it corrects is .claude/skills/, read by an agent maintaining Shio rather than by anyone using it |
Block W's instrument round, twelve consecutive cases of a check being wrong in a way that reads as diligence: SH785 (a ledger reader searched for a closing bracket, found a later one, and reported 144 entries for a list of 120 — the instrument computing that same list printed 120 forty lines earlier in the same log), SH786 (so the replacement matches the bracket instead, on a mask where comment lines and quoted spans are blanked: AT_THE_WALL's reasons carry eleven pairs of parentheses inside Java strings and the count had been right because all eleven balanced), SH787 (a fixture id that is a real task id is a payment to the debt walk — six ids in four files sat 112 tasks from arriving pre-paid, so SH9000+ is reserved and asserted from both ends), SH788 (a pipeline exits with its last command's status, so the documented `… | tee |
The fixture-traits flake, provoked rather than waited for: SH778 (a file-level red with every assertion in it green, and nothing kept enough to say why — it had gone some hundred and twenty runs without recurring, and the honest cure was to stop waiting: forty full runs at --test-concurrency=16 reproduced it on the first, and the kept run names Assertion failed: !(handle->flags & UV_HANDLE_CLOSING) — libuv aborting the process, which is also why the exit instrument never fired, since an abort skips process.on("exit")) and SH780 (the diagnosis and an idempotent teardown; the cure is a measured trade left open, because dropping --test-force-exit removes the abort and costs 12.6 s on every run of the gate that runs most often) | A test fixture's teardown and the JS gate's own flags. Nothing a reader of Shio can do differs — but the method is the part worth having written down, and it lives in docs/agents/build.md: a flake that will not appear on demand is not only diagnosed by what a failing run keeps, it is summoned by repeating the suite at a concurrency the ordinary gate does not use |
Block Q's capture internals: scanPage block detection, token collision, CSS lifting, asset classification (SH424–SH432, SH449, SH452, SH455–SH456, SH461, SH465–SH477), and the round that made a mixed page composable rather than merely captured — SH763 (verbatim markup is a section type, so kept markup lands in the page's own sections list wherever it stood and no conversion writes a field the model does not declare), SH766 (a mixed page declares its own title, so a curator can edit the one field the captured <h1> was rendering for it) and SH767 (a post: address in a relation field resolves to the URL the field stores, instead of being kept verbatim and resolving to nothing) and SH772 (a page whose kept markup is all in sections still receives the source's own stylesheet, which content alone had stopped answering for), and SH777 (a relation's rows carry @index, @first and @last, so a template can put a separator between sections and not after the last, size the first one differently, or emit a page-wide fact once), and the three the block closed on — SH829 (SH765's region table names the Theme post painting each region instead of style[1]/style[2], so the column added to end a lookup stops ending in one; a sheet no post owns keeps its index, which is the difference between one somebody can edit and one nobody can), SH830 (the generated layout carries the branches the conversion's own types declare, so a replication onto an empty instance stops ending with verify warnings against the file convert wrote seconds earlier — a warning nobody can act on is what teaches a reader to stop reading warnings) and SH833 (the source corpus produces all seven section types: each of the three it was missing was a fixture that plainly meant to exercise the type and did not clear a deliberate classify bar, and a check now names any type that loses its last producer), and SH849 (the palette and the markup runs reached the report the command actually prints — three tasks' worth of assertions all passed through the one join convert does not make, so a lint now holds every parameter an export function describe*({…}) destructures to every call site that assembles a literal, found by shape rather than from a list) | Fidelity mechanics of clone/convert. The user-facing surface is the three verbs and the two modes, documented as one row — and the three SH76x entries change what a curator can do with a replica, which the replication page states as the mixed→authorable path rather than as mechanics. The three closing ids are the same verdict one level along: SH829 is the agent's digest, SH830 and SH833 are the conversion's own instruments, and the thing a reader can now do differently is SH831's, recorded on the visible-site row. And the round that closed the block twice more, every one of it an instrument about its own honesty: SH837 (the half of a template-lint fix that shipped with no assertion distinguishing it from its absence — a guarded page field reaching the error, which reverting the fix downgrades to a warning rather than removing, so only the severity says which branch the reference took), SH838 (an archetype states its own type size, so all three of the theme bridge's admission bars are cleared by a real capture, and a rule that loses its last one is named by the run — the shape of SH833's types check applied to rules) and SH839 (a value that is nothing but a var() is refused as an extracted token: Theme.TOKENS was carrying a field whose value is a pointer and which edits into nothing, admitted by an exemption whose own comment claimed a measured cost of zero — the measurement filtered for values holding no var(, right for a length group and wrong for the one it admitted, and the comment now carries the figure a run produces), and SH879, which asked that question of the source rather than of this repository's own mechanisms: SH873 and SH878 were both found by a person building a site, and neither could have been caught, because measured by capture over all seven archetypes two state any navigation, one yields an entry site-wide enough to become a menu, and none carried a title of the Page — Brand shape both defects were about — a named list watches all three, theme-heavy now states the missing one, and the run prints that site-wide navigation has exactly one producer, which is the number a fixture edit could take to zero — and SH880, which asked the same question of the render: the generated layout's menu branch had never been rendered anywhere (the seeded replica carries no Menu, so the assertion that proved the nav worked read page titles out of the fallback), and giving it a fixture found a live defect in the commit before it, the layout shipping ${MENU_TITLE} uninterpolated because the JVM slices that literal out of the CLI's bytes |
| Block P's engine internals: the template graph, the render cache, the section registry | Renderer architecture (docs/agents/renderer.md); the authorable vocabulary is the user-facing half |
| SH984: every wait in the console's own tests is probed against the design system, or declared unprobeable with a reason | A test instrument over the console's test suite; it changes what a contributor may write, not what a curator or a caller can do |
| Block R: this documentation round: the coverage gate (SH479), the four sidebar hubs (SH482), the pages the rest of the block files into them, and the two instruments that execute their examples (SH499) | Meta: it produced the pages in this very matrix. The hubs are navigation, so they change no verdict below; they are where a 🔴 becomes a page. SH499 closed the block by making these pages checkable: cli/conformance/docs-vocabulary.conformance.mjs holds every shio verb, REST path, shio_* tool and shio.* key written here against what the product declares, and docs-examples.conformance.mjs issues the read-only requests against a running instance — so a renamed verb or a moved endpoint fails a Shio build instead of misleading a reader here |
| Blocks T and U, the documentation's own instruments and upkeep: SH674 (the extractor's fence regex had stopped matching, so the pages published unchecked), SH697 (the tool table read on SH663's narrow rule, with the stated count derived), SH698 (a conformance teardown that names the server, the deadline and the open sockets instead of hanging), SH700 (the gate reads the docs repo at origin, not a local working copy), SH715 (the redirect plugin, so a moved hub does not break a published link), SH747 (a ratchet: the count of shipped ids this matrix does not name may fall and may not rise), SH752 (a block heading standing over no open task fails the run, so a block that empties is closed rather than left as a heading nobody removes), SH758 (this matrix lives in another repository from the ships it tracks, so a mirror of the ids it names is generated into the Shio tree and the gate there reports, minutes after a ship, what has not been named yet — the ratchet stays the enforcement and only the moment of discovery moves), SH759 (a window closing is a fact about time, so the session guard takes a Clock and its test moves an hour rather than setting the window to a nanosecond and hoping the machine's clock ticked between two adjacent reads) | Instruments over this very matrix and the pages around it. They change what a contributor may publish, not what a reader can do — the pages themselves are the rows above |
Block S: the public site at shio.viglet.org (SH530 and the Block S backlog), its shio-site/ app, prerender and Pages deploy — and SH925, which turned the AI-writing checklist on the site's own prose into a lint and made five of the counts it publishes read back from the surface each describes, so a number on the marketing page cannot drift from the thing it counts SH929 removed the em dash from the site's published prose in all four of its spellings, the lint that had exempted it now refusing every one a reader could be handed, and SH930 closed the block by deciding how far that rule reaches: of the sixteen em dashes in the marketplace tree the site republishes but does not own, the six that are blueprint sample content were rewritten, because they become a page the user publishes, while the ten that are field help stay with the 38 of the same kind in the console's own bundles. The rule follows the prose to its reader rather than to a module. | Marketing, and it is the entrance to this documentation rather than part of it. Every claim it makes is a page here or in docs/agents/**, so a row of its own would duplicate a verdict already recorded above; what it owes those pages is a correct link, not coverage |
Block AQ/AS instruments, three build-time readers with no user-facing surface: SH886 (a census of how much console chrome the console still renders — 43 pages, 0 on the shared bento layer — held as a named list rather than a ceiling, so one migrated page cannot pay for the next; two of the three figures the plan opened with turned out to be wrong, having been grepped once by hand and never recomputed), SH896 (a digest of each console surface — its era, the chrome it composes in source order, and the classes carrying the frosted panel — so --against a saved survey proves a migrated page by command instead of by somebody looking; it reads source rather than rendering, because the instance runs no browser), SH895 (copy-ds.cmd forwards to the design system's own use:local, which resolves the consumer and the install path instead of hardcoding a checkout that had moved two versions earlier), SH928 (the JSX scanner six of those readers share was dropping any container whose children self-close under the same tag — 48 of App.tsx's 50 routes and neither route tree — so a lint asking about a tree passed by never seeing one), SH919 (the design system's duplicate gate dropped its first positional root on any run without --manifest, so naming a directory scanned a different one; fixed upstream in VDS78, and the consumer passes src the ordinary way now with an assertion that points the gate at an empty directory — the one arrangement this package can tell a read root from a fallback), SH937 (three roadmap lines were waiting on a design-system release and only one could notice when its wait ended; the waits are a named list with a probe each, and on its first release it failed three times in one run and correctly left the third alone), SH923 (the bento layer had no frosted panel without a heading, so four surfaces silently rendered console cards; VDS79 exports BentoPanel and the copied classes are gone), SH932 (three components named Adaptive* are PageHero, Panel and EmptyState — two had no chrome branch left, and the third branches on inside-versus-outside the shell rather than on an era, which is permanent), SH927 (the explorer's Monaco workers fall back to the main thread under the Vite dev server, so console:check was permanently red on two probes for anybody running it the documented way; six fixes were refuted by measurement — including framing the GraphiQL that Spring serves, which loads twenty resources from a CDN with no local fallback — so the fallback is now a named exemption scoped to the dev server, still a failure against the jar, that expires by failing the day the workers start), SH935 (the two route fields on a nav entry stay: Shio's are collapsed behind a one-line helper already, and Turing's 31 entries hold different values in them and read a missing bentoRoute as an unmigrated surface) | Contributor instruments and a developer script; none changes what a curator or a reader can do |
Block AT, what the Turing round left behind: SH916 (six org.apache.tika declarations nothing imported, removed with the 23 compile-scope artifacts they carried — pdfbox's seven and the four BouncyCastle jars pdfbox pulls for encrypted PDFs; a CVE in any of them was a CVE triaged against code that never ran, and a lint now fails the next such declaration on the day it is added), SH917 (the silent-catch inventory counts decisions rather than catch blocks: a method declaring one-decision: counts once however many catches implement it, because the figure had been pricing duplication — collapsing three identical numeric parsers into one helper had moved it by two while changing nothing about the program), SH939 (ShUtils.isJSONValid had no callers and was the only thing importing org.json, whose declaration claimed it "previously came transitively via the now-removed turing-java-sdk" — the sdk is not removed and still brings the library, so deleting the declaration downgraded it rather than dropping it, and it is a dependencyManagement pin now; the second org.json.JSONObject on the test classpath, a 2013 Android stub jsonassert carries, is excluded, and a lint fails on a class two jars supply instead of Spring Boot advising it on every boot) | Build hygiene and a contributor instrument; neither changes what a curator or a reader can do |
Block AQ, the console adopting the shared bento layer — the groundwork, none of which changes a curator's screen yet: SH915 (the /bento subpath resolves from an installed 2026.3.4 rather than the 2026.3.2 npm had, asserted as does it resolve instead of as a version, because a caret that permits the old one makes a fresh lockfile fail where the developer's machine passes), SH887 (the layer installed, and one harness page composing 23 of its 35 runtime exports — looking at it is what found the three assumptions the extraction had carried over from the one product that had used it), SH890 (Shio's orange becomes four --vg-accent-* tokens on :root and everything derives; the 17 files still spelling it as a Tailwind hue are held by name), SH892 (the post, post-type and site editors wrap their sections in the chrome adapter, so the console's three heaviest forms are written once instead of forked by a parallel route — console stays the default, so nothing moved on screen), SH894 (the design system's duplicate gate runs in Shio's own suite; its first run found a dead forked component and a 91-line dialog that had drifted behind the shared one on eighteen pages), SH888 (the parallel bento route tree and its shell, beside the console one so every slice of the migration is independently reversible) | Engineering groundwork for the cutover. The census that scoped it opened at 43 pages, 0 on bento and closed at 23 pages, 0 on console chrome (SH910); the curator-facing result is the Block AQ/AR, the cutover row under The curator approves it, documented by SH911 |
Block AQ: SH918, the console's boot splash and its app no longer disagree about the theme — the splash read prefers-color-scheme while the app hard-coded dark, so a first visit from a light-preference machine left <html> dark over a near-white <body> for the session | A defect no curator ever saw: every console page paints its own ground over the viewport, and it became visible only on a page mounted outside the shell. Nothing to tell a reader about |
Block AQ, the console's bento groundwork continued — none of it visible to a curator at the time it shipped: SH889 (Shio's seventeen surfaces declared once, so the nav rail and the command palette read one array instead of two that disagree within a release; the descriptions feed the palette's search, measured — typing restorable finds Trash), SH891 (measured rather than swept: the bento layer calls 54 i18n keys and 53 already resolved in both languages, so the work was one key — home.title, the rail's Home button, which had been rendering the English word in a Portuguese console — plus a reader that resolves all 54 through a real i18next so the next design-system release cannot add a string this console fails to translate), SH893 (three accessibility rules gated here rather than remembered; the first measurement said 3 unnamed icon-only controls and the real number was 34, because a regex tag matcher ends at the > inside an arrow-function prop), SH897 (the one script that opens a real page now opens a bento one, reading the frost off computed style — its first version passed with the stylesheet deleted), SH920 (one user provider instead of two competing contexts, so one mount answers both hooks from one fetch) | Engineering groundwork for the cutover. The curator's screen did change, with SH909; what a reader has to relearn is the Block AQ/AR, the cutover row under The curator approves it, documented by SH911 |
Block AQ: SH921, GET /api/v2/post-unified/{id} answers a 404 that says which of the two it is — the post exists in other states (with allowed, didYouMean and a fix naming the working URL), or no post carries the id at all (pointing at /agent/resolve, /staticfile/{id} and /folder/{id}) | An error-body improvement on a console endpoint. P6's rule that every 4xx teaches is documented at agent-surface § Errors are instructions; this is that rule applied where it had not been |
Block AR, the first console surfaces that actually change under the bento shell — all at /bento/**, a parallel route tree beside the console's own, so nothing a curator reaches by their usual URL has moved yet: SH898 (the home page, the first migrated surface — its six action badges lose the hardcoded hues they spelled out and read the shared tones), SH899 (the four site pages, where a run found the defect nothing else could: the page rendered perfectly and its Save button issued no request, because the shell's submit targets a form id the render prop never declared), SH900 (the 965-line content browser migrates by adapter rather than by copy — only four of those lines were chrome, and a fork would have meant every later fix twice), SH901 (the post editor and the post-create form, the heaviest forms in the product, through an adapter spanning a 1:2 mapping: in bento the save-bar morph is one component, in the console it is a header plus a sticky bar with no relationship between them), SH902 (the three post-type pages, and the finding that mattered more than the migration — a section card with no header silently renders a console card in both eras, which four of Shio's panels were doing under the frosted shell, three of them introduced one task earlier), SH922 (nothing interactive nested inside anything else interactive; 169 instances, none of which a type checker or a browser complains about, and every one a control a keyboard reaches twice or not at all), SH903 (search, the trash and the file list say their own "nothing here" through one shared block — and the lint written before the fixes found that block hand-rolled in thirteen files where the design had named two; search also gained the state it opens in, since "no results" on a page nobody has searched reports a failure that did not happen), SH904 (groups and roles take the entity shell through one shared page; the user editor deliberately does not, because a user's identity is a login key and a hero that inline-edits a title would rename it on blur — and a create call that sent an empty id stored a group nothing could address or delete), SH905 (the eleven infrastructure pages split where the data splits: five lists become configuration on one shared component, six editors keep their bodies under the adapter, and a route param that does not match what its component reads becomes a lint after two of them rendered blank pages with no error), SH906 (the review queue — the curator's half of the agent-native design — is bento, the audit log keeps its readable column instead of becoming a mosaic, and every marketplace tile becomes a real button after the whole catalogue turned out to be reachable by pointer only), SH907 (the visual editor routes outside the bento shell rather than fighting it with a taller container: h-screen under a 64px sticky header put the preview 48px below the fold, and a surface that owns the viewport has no chrome to migrate), SH908 (the last two surfaces — the GraphQL explorer and the page nobody navigates to on purpose, which during a cutover is where a stale bookmark lands; console chrome outside the console shell turns out to throw rather than look wrong, and the lint that says so found a bento page already rendering blank) | Console appearance under a route tree that became the default in SH909. Each surface here is engineering detail; what a reader meets is the Block AQ/AR, the cutover row under The curator approves it. SH911 rewrote the walkthroughs and found there were no console screenshots to retake, the published Shio pages carrying only SVG diagrams |
| Block AW, one chrome in the console's own source — nothing a curator can see changes, because every surface already rendered the bento look; what changes is what a contributor reads and what an instrument can see: SH957 (the vocabulary of a two-look console counted per file, 89 source lines and 81 in tests where a hand count had said 108 and 180, each removal lowering its own line), SH958 (one section provider above the router instead of twenty-two per-route wrappers, so a route added without one no longer renders the other look), SH959 (the other branch of the empty state, the 404 page and the media tile deleted, so login, setup and the 404 outside the shell render the same forms as every page inside it), SH960 (the page digest loses an era field that labelled 33 of 45 surfaces with the retired look, and learns the components pages actually compose, so 1 surface instead of 33 digests nothing), SH961 (the pages move into one tree by domain — content, admin, editor, system — instead of two trees named after the era each page came from), SH962 (comments and the console area doc say what the code does now; the census reaches the design system's own switch and nothing else) | Contributor-facing. The console the curator uses is documented at content-console and administration-guide, neither of which describes a second look; docs/agents/console-ui.md in the Shio repository is where the one-chrome console is recorded |
Block AU, the design system's consumer contract — how this repository stays a well-behaved consumer of @viglet/viglet-design-system, none of which a curator or an agent driving an instance can see: SH940 (the floor raised to 2026.3.10, the first release carrying the page-reference bins, their docs payload and the assistant exports — a bin is not in exports, so the reader checks the manifest and the files instead of resolving), SH941 (the bento authoring contract, its boundary document and nine artboards vendored into .claude/skills/viglet-ds-pages/ and docs/design/, where a session and a person both trip over them, rather than living in a repository nobody browses), SH942 (drift in those thirteen surfaces fails pnpm test and names the file — broken on purpose, with each kind of drift planted in a throwaway root, and canvas.json compared as parsed JSON so reindenting it is not a build failure), SH945 (the five surfaces this round invents drawn before their layout gets decided in review — revision history, the translation workspace, release bundles, the agent inbox and the asset browser — each stating what it decides, with the rejected direction kept as its own artboard), SH949 (this repository enables the shio@openviglet marketplace it publishes, so a breakage in the four plugin skills arrives as a session here behaving oddly rather than as somebody else's report; the two skill sets are split by whether a session drives an instance or changes this source tree, and a shared name fails the build) | Contributor-facing. The contract is authored in the design system and vendored here; agents.md, docs/agents/console-ui.md and the vendored skill are its home, and the artboards open from the file tree |
| SH947, SH965: the console's own test run enforces the design system's page rules, and requires every console write to report how it ended on both paths, with the gaps it found held as a named list | Instruments over the console's source; they change what a contributor may write, not what a curator or a caller can do |
| SH943, SH946, SH963, SH1088: the console as a consumer of the design system: its register of entries, the shell that owns the reading column, the chrome switch removed, and the 2026.3.12 upgrade | How the console is built; a curator sees the same screens laid out once instead of per page |
| SH1067, SH1068, SH1070, SH1072, SH1074, SH1089, SH1093, SH1075, SH1077, SH1085, SH1087, SH1141, SH1100: the census classifying site conversion, the docs gate's vocabulary, a corrected Spring Boot version, the docs matrix brought up to the recent ships, the ARIA and console lints, the change stream's read cost, locale-independent casing, the Activity page's delivery check, a benchmark counting authoring through the content files against the API, a lint failing a changeset that names a table no changeset created, and two Windows flakes made to say which half broke, and two pre-unified reference tables nothing could write, dropped | Instruments, measurements and corrections over the repository; none changes what a curator or a caller does |
Orphans
Of 74 clusters, none is undocumented: no 🔴 orphan and no ⚠️ page. 74 are covered (68 ✅, 6 🧩).
This sentence is derived, and a check fails when it drifts (SH653). Every figure in it used to be typed, and it drifted in the direction that hides work: the
shio auditrow was 🔴 in the tables from the day this file shipped and absent from this count for just as long, so the one number anybody scans said the product was better documented than it was. A cluster is one table row — the unit that already carries its own verdict. The alternative, one row per block label, comes to 33 and would need an aggregation rule nobody has written, sinceBlock Hspans five rows andBlock Ktwo with different verdicts. Neither reproduced the 42 this summary used to claim.cli/conformance/docs-coverage.conformance.mjsrecomputes it from the tables above and prints the sentence to write when the two disagree.
Block T is the block that closes these. It exists because the list below is what Block R's own audit found and no Block R task named — the curator's half. Each task in it flips exactly one row, and this count moves with it.
Block R took this from 33 wrong of 40 to 7. What is left is what the block's own tasks never named, which is the finding the matrix existed to produce:
- 0 🔴, none now live:
the content console itself (Block O)— closed by SH625, content-console ·the console's own curator surfaces (Block E: dashboard, Media Library, static-file manager, webhooks UI, the— closed by SH623, which rewrote administration-guide against the React console ·config/pages)the curator's lifecycle tools (SH13–SH15, SH51, SH55: preview tokens, version diff and restore, scheduled publish, the activity view)— closed by SH624, content-lifecycle ·outbound webhooks (SH12)— closed by SH626, webhooks ·content i18n (SH53)— closed by SH627, content-i18n ·shio audit's eleven rules, which the table listed as an orphan since this file shipped and this summary did not countshio auditreports, which landed the instrument with the prose:docs-vocabularyreadsAUDIT_RULESand fails on a rule this page does not name, which is the direction none of the other checks ask. - 0 ⚠️:
the developer guide still lists Elasticsearch 9.3.3 in its stack and names no agent surface or CLI— closed by SH628, which rewrote it and landed the instrument first:cli/conformance/docs-stack.conformance.mjsderives every stated Java / Spring Boot / Node / pnpm version from this repo's build files and refuses a retired dependency presented as part of the stack. Also unclosed: the transform cache, the dimension and format limits and the signed-URL configuration are the operational half of the SH25 image epic, folded into the render page but not documented as operations.— closed by SH629. This entry is why the block exists in the shape it does: the row scored 🧩 rather than 🔴, and a partially-covered row does not read as an orphan in a scan.
Every item above is worth a task. Four of them are curator-facing, which is the half this block reached last: the agent's surface is now the best-documented part of the product and the console is the least.
This file lands red on purpose: it is the audit that scopes Block R, and the count above is the number the block is measured by. When a new block ships, add its row here, and if it is user-facing without a page, that 🔴 is a defect to fix before the block is considered done.
Block R is complete, and what it left
Block R's last task shipped on 2026-08-09 and the block is withdrawn from Shio's roadmap. It ends at 6 wrong of 40, from 33 — and the six are the finding, not the remainder of the work: every one is a cluster no Block R task ever named, which is why they survived a block that fixed twenty-seven others. They are now filed as Shio tasks of their own rather than left in this file's prose, because a gap recorded only in an audit is one nobody is assigned.
One thing changed about how these pages are maintained, and it is the reason the block could be called done. Until SH499 nothing here was ever executed, which is precisely how the pre-2026.3 pages came to describe a product that had moved: written once, never compared. Two instruments now compare them on every Shio conformance run — the names (verbs, routes, tool names, configuration keys, read from the product's own declarations) and the requests (the read-only invocations, issued against a live instance). A count comes with them: 57 executable blocks over 18 pages, 65 assertable subjects.
So the rule for the next round is stronger than "add a row". A page that publishes a command, an endpoint or a configuration key is now making a claim a build can falsify. Write the example so it can be run.