[mgilardi]

What changes

Example site (apps/payload-example)

• Import jobs are on, over a new sources upload collection that only a curator can read, add to, change or delete, so nobody else can fetch a source file by its address.
• The seed adds a job waiting to be run and one that failed on purpose, both over made-up files. A job doesn't run when it is made.
• Uploaded files go in a throwaway folder that is deleted when the site stops.
• New pnpm click-through: builds the site, opens a Chrome already on the machine with no window and a throwaway profile, signs in as the made-up curator and does a curator's work on all four panels. It installs nothing and fails on any request off the site apart from Payload's code editor.

Payload plugin (unreleased), three things the click-through found in the real admin that jsdom can't see:

• The panels' paragraphs and lists sat flush against each other: the panel's margin reset outranked its spacing rule. The reset now carries no weight.
• The form under a panel repeated it. The fields a panel already shows are hidden in the form (admin.hidden), still in its data, the API and the list's columns.
• The "Made-up example data" tag touched the source's title.

Docs. They said every button asks first. Running an import never did, and they now say so.

Tested

• 633 unit tests (249 in the plugin, 2 new), typecheck, build, leak check and brand check, locally.
• Smoke test: 74 checks over HTTP on the built site and on next dev (58 before).
• Click-through: 40 of 40 in headless Chrome on the built site.
• Six deliberate breaks, each failing its own check, then restored: source files readable by anyone, jobs running when made, the uploads folder not deleted, the hidden fields disabled instead, the old margin reset, and the panel no longer putting a run's result into the form. The last one first hung the script on the browser's "Leave site?" question; the script now answers it, counts it as a problem and ends.

Not tested

• The click-through is not in CI: it needs Chrome and the network for Payload's code editor.
• A screen reader, Safari, Firefox, a phone, Postgres or SQLite, a deployed site.
• Imports from a URL aren't in the example site.

No new service, no cost, nothing published. Everything runs on this machine on made-up data.

🤖 Generated with Claude Code