diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..b8168fb1
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,148 @@
+# AGENTS.md
+
+This file provides guidance to coding agents when working with code in this repository.
+
+## Commands
+
+**Development:**
+
+- `pnpm dev` - Start development server
+- `pnpm build` - Build for production
+- `pnpm preview` - Preview production build
+
+**Implementation Guidelines:**
+
+- Before implementing any feature, read `ARCHITECTURE.md` for design decisions and `IMPLEMENTATION_PLAN.md` for the step-by-step implementation spec
+- Design decisions go in `ARCHITECTURE.md`, implementation steps go in `IMPLEMENTATION_PLAN.md`
+- New features must be specified before implementation begins — the spec should be concise but sufficient to derive the implementation from
+- If a gap in either doc is discovered during implementation, update it with a minimal but concise change before proceeding with the code
+- Do exactly what the user asks for — one step at a time
+- Do NOT think 4 steps ahead or add extra features/improvements
+- Only implement the specific change requested
+- You can suggest what the next step could be, but don't implement it
+- For anything that runs from the home route (`/`) in no-backend / Vercel mode, do NOT add top-level imports of backend-only modules like `#app/api.remote.js` or anything that pulls in `#lib/server/db.js`
+- In home-route server files, import backend-only code lazily inside the `has_backend` guard so static/Vercel deployments do not evaluate database code at module load time
+
+**Refactoring Guidelines:**
+
+- During refactors, make ONLY the minimal changes needed (e.g., renaming APIs)
+- Do NOT "improve" or restructure logic while refactoring
+- If you see something that could be improved, note it separately for a future task
+- Refactoring and improving are two separate activities - never combine them
+
+**Code Style:**
+
+- Use snake_case for all variable names, function names, and identifiers
+- This applies to JavaScript/TypeScript code, test files, and any new code written
+
+**Styling:**
+
+- Use Tailwind CSS classes whenever possible
+- Minimize custom CSS - only use it for things Tailwind can't handle (e.g., CSS custom properties like `var(--editing)`)
+- Use Tailwind's arbitrary value syntax for custom properties: `text-(--editing)`, `border-(--editing)`
+- Do not use rounded corners (keep elements rectangular)
+
+**What to NOT change (keep camelCase):**
+
+- `window.getSelection()` - native API
+- `document.activeElement` - native API
+- `navigator.clipboard` - native API
+- `addEventListener` - native API
+- `preventDefault()` - native API
+- `stopPropagation()` - native API
+- `getRangeAt()` - native API
+- Svelte event handlers: `onclick`, `onmousedown`, etc.
+- DOM properties: `innerHTML`, `textContent`, `nodeType`, etc.
+
+**Pattern**: If it's a web platform API or Svelte API, keep camelCase. If it's our custom variable/function name, use snake_case.
+
+**File Extensions:**
+
+- Files using Svelte runes (`$state`, `$derived`, `$effect`, etc.) must use `.svelte.js` or `.svelte.ts` extension
+
+**Documentation Style:**
+
+- Use sentence case for all headings in documentation (README.md, etc.)
+- Use sentence case for code comments
+- Sentence case means: capitalize only the first word and proper nouns
+- **Exception**: "Svedit" is always capitalized as it's a proper noun (the product name)
+- Examples:
+  - ✓ "Getting started" (not "Getting Started")
+  - ✓ "Why Svedit?" (not "Why svedit?") - Svedit is a proper noun
+  - ✓ "Developing Svedit" (not "Developing svedit") - Svedit is a proper noun
+  - ✓ "Document-scoped commands" (not "Document-Scoped Commands")
+  - ✓ "Create a new user" (not "Create a New User")
+  - ✓ "API reference" (not "API Reference")
+- This applies to: markdown headings, JSDoc comments, inline comments, commit messages
+
+## Architecture
+
+Svedit is a rich content editor template built with Svelte 5 that uses a graph-based data model.
+
+### Core Components
+
+**Document Model:**
+
+- `Document` - Central document class with state management, transactions, and history
+- `Tras` - Handles atomic operations on the document
+- Documents are represented as graphs of nodes with properties and references
+
+**Selection:**
+
+- Supports text, node, and property selections
+- Maps between internal selection model and DOM selection
+- Handles complex selection scenarios like backwards selections and multi-node selections
+
+**Key Components:**
+
+- `Svedit.svelte` - Main editor component with event handling and selection management
+- `NodeArrayProperty.svelte` - Renders containers that hold sequences of nodes
+- `AnnotatedTextProperty.svelte` - Handles annotated text rendering and editing
+- Node components (`Story`, `List`, etc.) - Render specific content types
+
+### Schema
+
+Content is defined through schemas that specify:
+
+- Node types and their properties
+- Property types: `string`, `integer`, `boolean`, `string_array`, `annotated_text`, `node`, `node_array`
+- Reference relationships between nodes
+- Default types for node arrays
+
+### Data Flow
+
+1. Raw document data is loaded into a Svedit `Session`
+2. Changes are made through transactions for undo/redo support
+3. Selection state is synchronized between internal model and DOM
+4. Components render content based on document state and schema definitions
+
+## Schema and Inserter
+
+When adding new properties to a node type:
+
+1. Add to schema in `src/app/document_schema.ts` (`document_schema`)
+2. Add to inserter in `src/app/session.ts` (`inserters`)
+
+## Available MCP Tools
+
+You are able to use the Svelte MCP server, where you have access to comprehensive Svelte 5 and SvelteKit documentation. Here's how to use the available tools effectively:
+
+### 1. list-sections
+
+Use this FIRST to discover all available documentation sections. Returns a structured list with titles, use_cases, and paths.
+When asked about Svelte or SvelteKit topics, ALWAYS use this tool at the start of the chat to find relevant sections.
+
+### 2. get-documentation
+
+Retrieves full documentation content for specific sections. Accepts single or multiple sections.
+After calling the list-sections tool, you MUST analyze the returned documentation sections (especially the use_cases field) and then use the get-documentation tool to fetch ALL documentation sections that are relevant for the user's task.
+
+### 3. svelte-autofixer
+
+Analyzes Svelte code and returns issues and suggestions.
+You MUST use this tool whenever writing Svelte code before sending it to the user. Keep calling it until no issues or suggestions are returned.
+
+### 4. playground-link
+
+Generates a Svelte Playground link with the provided code.
+After completing the code, ask the user if they want a playground link. Only call this tool after user confirmation and NEVER if code was written to files in their project.
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index e9751315..a2ab2e13 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -110,16 +110,13 @@ Requests whose host addresses the server itself (`localhost`, `127.0.0.1`, `::1`
 
 **Remote functions** (`$app/server`) allow server-side functions to be called directly from components via `query()` and `action()`. This replaces traditional REST endpoints for document loading and saving:
 
-- **`src/lib/api.remote.ts`** — server-side functions for document and asset operations, called directly from components. Uses `query()` for reads and `action()` for writes. Access to `locals` (e.g. for auth checks) via `getRequestEvent()`.
+- **`src/app/api.remote.ts`** — application-specific server-side functions for document and asset operations, called directly from components. Uses `query()` for reads and `action()` for writes. Access to `locals` (e.g. for auth checks) via `getRequestEvent()`.
 
-**Server initialization** — `src/hooks.server.ts` exports an `init()` function (SvelteKit's `ServerInit` hook) that runs once on server startup. This is where database migration runs:
+**Server initialization** — `src/hooks.server.ts` exports an `init()` function (SvelteKit's `ServerInit` hook) that runs once on server startup. In full runtime mode it lazily imports the app migration entry point, which combines framework migrations with the project's migrations:
 
-```js
-import migrate from '#lib/server/migrate.js';
-
-export async function init() {
-	migrate();
-}
+```ts
+const { run_migrations } = await import('#app/migrations.js');
+run_migrations();
 ```
 
 The `handle` hook runs on every request and is where session validation and `event.locals` assignment happens.
diff --git a/CLAUDE.md b/CLAUDE.md
index 55c04d15..5c11c218 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,148 +1 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Commands
-
-**Development:**
-
-- `pnpm dev` - Start development server
-- `pnpm build` - Build for production
-- `pnpm preview` - Preview production build
-
-**Implementation Guidelines:**
-
-- Before implementing any feature, read `ARCHITECTURE.md` for design decisions and `IMPLEMENTATION_PLAN.md` for the step-by-step implementation spec
-- Design decisions go in `ARCHITECTURE.md`, implementation steps go in `IMPLEMENTATION_PLAN.md`
-- New features must be specified before implementation begins — the spec should be concise but sufficient to derive the implementation from
-- If a gap in either doc is discovered during implementation, update it with a minimal but concise change before proceeding with the code
-- Do exactly what the user asks for — one step at a time
-- Do NOT think 4 steps ahead or add extra features/improvements
-- Only implement the specific change requested
-- You can suggest what the next step could be, but don't implement it
-- For anything that runs from the home route (`/`) in no-backend / Vercel mode, do NOT add top-level imports of backend-only modules like `#lib/api.remote.js` or anything that pulls in `#lib/server/db.js`
-- In home-route server files, import backend-only code lazily inside the `has_backend` guard so static/Vercel deployments do not evaluate database code at module load time
-
-**Refactoring Guidelines:**
-
-- During refactors, make ONLY the minimal changes needed (e.g., renaming APIs)
-- Do NOT "improve" or restructure logic while refactoring
-- If you see something that could be improved, note it separately for a future task
-- Refactoring and improving are two separate activities - never combine them
-
-**Code Style:**
-
-- Use snake_case for all variable names, function names, and identifiers
-- This applies to JavaScript/TypeScript code, test files, and any new code written
-
-**Styling:**
-
-- Use Tailwind CSS classes whenever possible
-- Minimize custom CSS - only use it for things Tailwind can't handle (e.g., CSS custom properties like `var(--editing)`)
-- Use Tailwind's arbitrary value syntax for custom properties: `text-(--editing)`, `border-(--editing)`
-- Do not use rounded corners (keep elements rectangular)
-
-**What to NOT change (keep camelCase):**
-
-- `window.getSelection()` - native API
-- `document.activeElement` - native API
-- `navigator.clipboard` - native API
-- `addEventListener` - native API
-- `preventDefault()` - native API
-- `stopPropagation()` - native API
-- `getRangeAt()` - native API
-- Svelte event handlers: `onclick`, `onmousedown`, etc.
-- DOM properties: `innerHTML`, `textContent`, `nodeType`, etc.
-
-**Pattern**: If it's a web platform API or Svelte API, keep camelCase. If it's our custom variable/function name, use snake_case.
-
-**File Extensions:**
-
-- Files using Svelte runes (`$state`, `$derived`, `$effect`, etc.) must use `.svelte.js` or `.svelte.ts` extension
-
-**Documentation Style:**
-
-- Use sentence case for all headings in documentation (README.md, etc.)
-- Use sentence case for code comments
-- Sentence case means: capitalize only the first word and proper nouns
-- **Exception**: "Svedit" is always capitalized as it's a proper noun (the product name)
-- Examples:
-  - ✓ "Getting started" (not "Getting Started")
-  - ✓ "Why Svedit?" (not "Why svedit?") - Svedit is a proper noun
-  - ✓ "Developing Svedit" (not "Developing svedit") - Svedit is a proper noun
-  - ✓ "Document-scoped commands" (not "Document-Scoped Commands")
-  - ✓ "Create a new user" (not "Create a New User")
-  - ✓ "API reference" (not "API Reference")
-- This applies to: markdown headings, JSDoc comments, inline comments, commit messages
-
-## Architecture
-
-Svedit is a rich content editor template built with Svelte 5 that uses a graph-based data model.
-
-### Core Components
-
-**Document Model:**
-
-- `Document` - Central document class with state management, transactions, and history
-- `Tras` - Handles atomic operations on the document
-- Documents are represented as graphs of nodes with properties and references
-
-**Selection:**
-
-- Supports text, node, and property selections
-- Maps between internal selection model and DOM selection
-- Handles complex selection scenarios like backwards selections and multi-node selections
-
-**Key Components:**
-
-- `Svedit.svelte` - Main editor component with event handling and selection management
-- `NodeArrayProperty.svelte` - Renders containers that hold sequences of nodes
-- `AnnotatedTextProperty.svelte` - Handles annotated text rendering and editing
-- Node components (`Story`, `List`, etc.) - Render specific content types
-
-### Schema
-
-Content is defined through schemas that specify:
-
-- Node types and their properties
-- Property types: `string`, `integer`, `boolean`, `string_array`, `annotated_text`, `node`, `node_array`
-- Reference relationships between nodes
-- Default types for node arrays
-
-### Data Flow
-
-1. Raw document data is loaded into a Svedit `Session`
-2. Changes are made through transactions for undo/redo support
-3. Selection state is synchronized between internal model and DOM
-4. Components render content based on document state and schema definitions
-
-## Schema and Inserter
-
-When adding new properties to a node type:
-
-1. Add to schema in `src/app/document_schema.ts` (`document_schema`)
-2. Add to inserter in `src/app/session.ts` (`inserters`)
-
-## Available MCP Tools
-
-You are able to use the Svelte MCP server, where you have access to comprehensive Svelte 5 and SvelteKit documentation. Here's how to use the available tools effectively:
-
-### 1. list-sections
-
-Use this FIRST to discover all available documentation sections. Returns a structured list with titles, use_cases, and paths.
-When asked about Svelte or SvelteKit topics, ALWAYS use this tool at the start of the chat to find relevant sections.
-
-### 2. get-documentation
-
-Retrieves full documentation content for specific sections. Accepts single or multiple sections.
-After calling the list-sections tool, you MUST analyze the returned documentation sections (especially the use_cases field) and then use the get-documentation tool to fetch ALL documentation sections that are relevant for the user's task.
-
-### 3. svelte-autofixer
-
-Analyzes Svelte code and returns issues and suggestions.
-You MUST use this tool whenever writing Svelte code before sending it to the user. Keep calling it until no issues or suggestions are returned.
-
-### 4. playground-link
-
-Generates a Svelte Playground link with the provided code.
-After completing the code, ask the user if they want a playground link. Only call this tool after user confirmation and NEVER if code was written to files in their project.
+See AGENTS.md
diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
index 7a401616..5e3b1831 100644
--- a/IMPLEMENTATION_PLAN.md
+++ b/IMPLEMENTATION_PLAN.md
@@ -22,6 +22,12 @@
 - End with one clear prompt to install Editable through the existing `/manual` quickstart.
 - Keep this text-first page in code until the same content is represented in the page builder.
 
+## App/lib boundary refactor
+
+- Move `api.remote.ts` into `src/app` because it contains Editable-specific remote functions and is part of the application customization surface.
+- Keep generic document-graph operations in `src/lib/document_graph.ts` and pass the document schema from callers instead of importing the app schema there.
+- Preserve existing behavior and keep the refactor limited to imports and schema parameter plumbing.
+
 ## Retina video resolution
 
 - Cap processed video at a 1440px short side, producing up to 2560×1440 for 16:9 landscape video.
@@ -77,7 +83,7 @@ Convert the whole codebase from JS+JSDoc to TypeScript per the "Language: TypeSc
 
 1. Replace `jsconfig.json` with `tsconfig.json` (same options, `allowJs`/`checkJs` kept during transition) and point the `check` script at it.
 2. Convert the document schema to `src/app/document_schema.ts`, export `type Nodes = NodeMap<typeof document_schema>`, and add a typed `get_svedit_context()` in `src/app/svedit_context.ts` (mirrors the svedit demo app).
-3. Convert `src/lib` modules (root, `client/`, `server/`, `server/markdown/`, `server/migrations/`), translating existing JSDoc annotations to TS syntax.
+3. Convert `src/lib` modules (root, `client/`, `server/`, `server/markdown/`, and framework migrations), translating existing JSDoc annotations to TS syntax.
 4. Convert `src/routes` modules (`hooks.server`, load functions, API endpoints, `app_utils`, `commands.svelte`, `create_session`, helpers).
 5. Convert all Svelte components to `<script lang="ts">`. Node components use the typed-node pattern; internal components get explicit prop types.
 6. Convert tests to `.ts`, update the vitest include glob and `vite.config` filename, then verify `pnpm check`, `pnpm test`, `pnpm build`, and `pnpm lint` all pass.
@@ -1126,7 +1132,7 @@ Current `site_settings` table:
 
 ### 2. `get_document(document_id)` and `save_document(combined_doc)` are already page-id driven
 
-In `src/lib/api.remote.js`, `get_document` already accepts a `document_id`.  
+In `src/app/api.remote.ts`, `get_document` already accepts a `document_id`.
 This is a strong foundation for `/:page_id`.
 
 Current limitations:
@@ -1485,7 +1491,7 @@ This produces a deterministic, editor-friendly page browser:
 
 ### 1.1 Add helper functions in server/data layer
 
-Introduce helpers in `src/lib/api.remote.js` or extracted server modules for:
+Introduce helpers in `src/app/api.remote.ts` or extracted server modules for:
 
 - `get_home_page_id()`
 - `list_page_documents()`
@@ -1516,7 +1522,7 @@ Behavior:
 
 Create a page factory for `/new`, likely in:
 
-- `src/lib/new_page.js`
+- `src/app/new_page.js`
   or nearby route helper
 
 It should expose a `create_empty_doc()` helper (or equivalent) that:
@@ -1591,7 +1597,7 @@ Current behavior:
 Implemented:
 
 - `src/routes/new/+page.svelte`
-- `src/lib/new_page.js`
+- `src/app/new_page.js`
 
 Current behavior:
 
@@ -1777,17 +1783,17 @@ These constraints must be respected during implementation:
 - `src/routes/[page_id]/+page.svelte`
 - `src/routes/new/+page.svelte`
 - `src/app/components/PageEditor.svelte`
-- maybe `src/lib/new_page.js`
+- maybe `src/app/new_page.js`
 - maybe `src/lib/server/page_browser.js`
 - maybe `src/lib/server/page_summary.js`
 
 ### Updated files
 
 - `src/routes/+page.svelte`
-- `src/lib/api.remote.js`
+- `src/app/api.remote.ts`
 - `src/app/components/PagesDrawer.svelte`
 - `src/app/components/Overlays.svelte`
-- possibly `src/lib/server/migrations.js` if additional seed/settings support is needed
+- `src/app/migrations.ts` as the application migration entry point, if additional seed/settings support is needed
 
 ## Recommended implementation order
 
diff --git a/README.md b/README.md
index 62b424c0..8f7d3ce3 100644
--- a/README.md
+++ b/README.md
@@ -991,7 +991,7 @@ The app-specific Editable surface lives in `src/app`, while `src/routes` contain
 
 Keep stored content and database structure in step with changes to your site.
 
-Migration files in `src/lib/server/migrations` are discovered when SvelteKit builds the server and run automatically when it boots. Their UTC timestamp determines the normal order, and all pending migrations plus their tracking records run in one transaction: either the complete upgrade succeeds or nothing changes.
+Migration files in `src/app/migrations` are discovered when SvelteKit builds the server and run automatically when it boots. Framework migrations use the `editable` namespace and project migrations use the `custom` namespace; their UTC timestamps determine the normal order. All pending migrations plus their tracking records run in one transaction: either the complete upgrade succeeds or nothing changes.
 
 Create a project migration with:
 
@@ -1080,7 +1080,7 @@ A deployment can expose selected repository markdown files as read-only pages re
 
 ### Configuration
 
-Any markdown file in the repository can be mapped to a URL in `src/lib/content_config.ts` (server/build-only — never import it from client code). Reference the file with a `?raw` import, so Vite inlines exactly the mapped files and a missing file fails the build:
+Any markdown file in the repository can be mapped to a URL in `src/app/content_config.ts` (server/build-only — never import it from client code). Reference the file with a `?raw` import, so Vite inlines exactly the mapped files and a missing file fails the build:
 
 ```js
 import manual_md from '../../README.md?raw';
diff --git a/VPS_DEPLOY_SPEC.md b/VPS_DEPLOY_SPEC.md
deleted file mode 100644
index 5f5b1cd9..00000000
--- a/VPS_DEPLOY_SPEC.md
+++ /dev/null
@@ -1,113 +0,0 @@
-# VPS deploy script — specification
-
-Spec for `scripts/vps-deploy.sh`: a single local script that takes a fresh Ubuntu VPS (e.g. a DigitalOcean droplet) from zero to a running, TLS-terminated Editable site, and afterwards ships code updates to the same box. Modeled on the Writebook/ONCE installer experience, without Kamal or any registry.
-
-This file is the working spec for the feature. Once implemented and stable, fold the design decisions into `ARCHITECTURE.md` and the user-facing instructions into README → Deploy to a VPS.
-
-## Goals
-
-- One command against a fresh VPS sets up everything: `./scripts/vps-deploy.sh root@203.0.113.10 my-site.example.com`
-- The same command run again ships a code update (the script detects what's needed; no separate setup/deploy modes for the user to learn)
-- The image is built locally and streamed over ssh — the server never needs git access, pnpm, or the memory to run a Vite build
-- The only state on the server that matters is the bind-mounted data directory; the container is disposable and replaced on every deploy
-- A destroyed server is recovered by running the script against a fresh one (boot-time disaster recovery from the backup bucket already exists in `scripts/run-cloud-boot.js`)
-
-## Non-goals (v1)
-
-- Zero-downtime deploys — a few seconds of downtime while the container is replaced is accepted
-- Multiple servers, multiple apps per server, deployment locking
-- ARM servers — the Dockerfile pins the Litestream `.deb` to `linux-x86_64`, so v1 requires an amd64 VPS and builds with `--platform linux/amd64` (revisit by making the Litestream download arch-aware)
-- Provisioning the VPS itself or DNS — the user creates the droplet (with their ssh key) and points the domain's A record at it first, like the Writebook flow
-
-## Design decisions
-
-**Build locally, stream over ssh, no registry.** `docker buildx build --platform linux/amd64` with the image tagged `editable:<git short SHA>`, piped through gzip into `ssh <host> 'gunzip | docker load'`. This keeps the server free of build tooling and repo access, and needs no registry account.
-
-**Host-level Caddy, not a Caddy container.** The app already binds `127.0.0.1:3000` and the README already documents the two-line Caddyfile. Caddy is installed from its apt repo and configured with exactly that config; certificates are Caddy's problem. No compose networking, no cert volumes.
-
-**Compose stays the runtime, switched from `build:` to `image:`.** `docker-compose.yml` gains `image: 'editable:${IMAGE_TAG:-local}'` and drops `build: .` as the on-server path. Local from-source runs use `docker compose up --build` explicitly (compose builds the `image:` tag when `--build` is passed), so the local workflow documented today keeps working. The script deploys with `IMAGE_TAG=<sha> docker compose up -d --remove-orphans`; compose sees the tag change and replaces the container, leaving the `./data` bind mount untouched.
-
-**Server layout.** One site per server, so nothing needs a per-site name — the layout separates the precious from the disposable:
-
-```
-/data                    the persistent site data — the only thing worth backing
-                         up; same path as Fly's volume mount and the in-container
-                         path (bind mount /data → /data)
-/srv/editable/
-├── docker-compose.yml   uploaded by the script on every deploy
-├── .env                 created on first run, never overwritten
-└── .deploy_env          marker: IMAGE_TAG, CONTAINER_NAME, HOST_DATA_DIR
-```
-
-Everything under `/srv/editable` is recreatable by the next deploy. The container is plain `editable` — identical to a hand-managed compose setup, so both flows converge on one naming scheme. The Caddy vhost lives in `/etc/caddy/sites/editable.caddy`, imported from the main Caddyfile (which stays untouched otherwise). The compose volume line is `'${HOST_DATA_DIR:-./data}:/data'`: local and hand-managed runs keep `./data` next to the compose file, the script pins `/data` via `.deploy_env`.
-
-**Secrets.** On first run the script prompts for `ADMIN_PASSWORD` (offering a generated one), sets `ORIGIN=https://<domain>`, and writes the server's `.env`. Backup-bucket credentials (`BUCKET_NAME`, `AWS_*`) are copied from the local `.env` if present. That first-run bootstrap is the only implicit sync: afterwards the server's `.env` is authoritative and changes only through the explicit `env` command (`env` show / `env set KEY=VALUE` / `env set KEY` with hidden prompt / `env unset KEY`), which rewrites the file, recreates the container, and refreshes the Caddy vhost (so `ORIGIN` and `ALIAS_DOMAINS` take effect without a deploy) — fly-secrets style, nothing moves without being named. Secrets are never passed as command-line arguments to remote shells.
-
-**Idempotent provisioning, not a setup mode.** Every run executes the same phases; each phase checks before it acts (Docker installed? Caddy installed? Caddyfile current? `.env` present?). First run does everything; later runs fall through to the deploy phase in seconds.
-
-**Dirty builds are labeled, not versioned.** A build from a working tree with uncommitted or untracked changes is tagged `<sha>-dirty`, so the image list and rollbacks can't mistake it for the committed state. Deploying dirty again reuses the tag — commits are the rollback anchors; dirty states are ephemeral by nature.
-
-**Rollback = redeploy an old tag + existing data restore.** The script keeps the last 3 image tags on the server (older ones pruned after a successful deploy). `./scripts/vps-deploy.sh <host> <domain> --tag <sha>` starts that image instead of building. Content rollback is out of scope — that's `pnpm data:restore`, which already works against the VPS via `DEPLOY_HOST`.
-
-**Health check gates success.** After `compose up`, the script polls `127.0.0.1:3000` over ssh (curl, ~30 s budget). On failure it prints the container logs and exits non-zero; it does not auto-rollback in v1.
-
-**`.env` bridge to the data toolbox.** After a successful first deploy the script prints the exact `DEPLOY_HOST` / `RESTART_CMD` / `REMOTE_EXEC` / `HOST_DATA_DIR` block for the local `.env` (values it already knows), so `pnpm data:*` works immediately.
-
-## Script interface
-
-```
-./scripts/vps-deploy.sh <user@host> <domain>   first deploy, or explicit target (always works)
-./scripts/vps-deploy.sh                        deploy to DEPLOY_HOST         (pnpm vps:deploy)
-./scripts/vps-deploy.sh status                 running tag + rollback tags   (pnpm vps:status)
-./scripts/vps-deploy.sh logs                   follow container logs         (pnpm vps:logs)
-./scripts/vps-deploy.sh env                    show the server's env, masked (pnpm vps:env)
-./scripts/vps-deploy.sh env set KEY=VALUE …    set env vars and restart the app
-./scripts/vps-deploy.sh env set KEY            prompt for the value (hidden input)
-./scripts/vps-deploy.sh env unset KEY …        remove env vars and restart the app
-
-Options:
-  --tag <sha>     deploy an already-uploaded image tag (rollback) instead of building
-  --yes           skip confirmation prompts (except the first-run password prompt)
-```
-
-**Addressing.** `DEPLOY_HOST` in the local `.env` is the checkout's entire deployment identity — the same key the data toolbox uses, playing the role `fly.toml` plays for Fly.io. The user adds it by hand from the line the first deploy prints (deliberately not auto-written, so it stays transparent where commands are targeted). Everything else is read from the server via the `/srv/editable/.deploy_env` marker: the deploy script reads the domain from `ORIGIN` in the server's `.env`, and `data.sh` takes `REMOTE_EXEC`, `RESTART_CMD`, and `HOST_DATA_DIR` from the marker's `CONTAINER_NAME` and `HOST_DATA_DIR`. Explicit values always override, and setups without the marker (bare node, hand-managed compose) keep configuring the data toolbox explicitly. The explicit `<user@host> <domain>` form is what works before any of this exists.
-
-`<user@host>` is typically `root@<ip>` on a fresh droplet; any sudo-capable user works. ssh key access is assumed (the script never handles passwords).
-
-## Execution phases
-
-1. **Preflight (local).** Verify: git worktree present, `docker buildx` available, ssh connectivity to the host (`BatchMode=yes`), remote architecture is x86_64 (abort otherwise), domain resolves to the host's IP (warn, don't abort — DNS may still be propagating).
-2. **Provision (remote, idempotent).** Install Docker (official convenience script) and Caddy (apt repo) if missing; create 1 GB swap if total RAM < 2 GB and no swap exists; create `/data` and `/srv/editable`.
-3. **Configure (remote, idempotent).** Write `/etc/caddy/Caddyfile` (reverse_proxy block for the domain, plus any `ALIAS_DOMAINS` from the server's `.env` as additional site addresses) and reload Caddy if it changed. First run: prompt for `ADMIN_PASSWORD`, write `.env` with it plus `ORIGIN` and any local bucket credentials.
-4. **Build & upload (local → remote).** Skipped with `--tag`. Build `editable:<sha>` for linux/amd64, stream via `ssh docker load`. Upload `docker-compose.yml`.
-5. **Activate (remote).** `IMAGE_TAG=<sha> docker compose up -d --remove-orphans` in `/srv/editable` (tag passed via the `.deploy_env` file, not shell interpolation).
-6. **Verify.** Poll `127.0.0.1:3000` via ssh until healthy or timeout; on success also curl `https://<domain>` from the local machine (warn-only — TLS issuance or DNS may lag). Print logs and fail otherwise.
-7. **Cleanup & report.** Prune `editable:*` images beyond the newest 3. Print the deployed tag, the site URL, and (first run) the local `.env` block for the data commands.
-
-**Alias domains.** `ORIGIN` stays the single canonical address; `ALIAS_DOMAINS` is a comma-separated list of alternative names (`www.`, second hostnames) that Caddy should also terminate TLS for — the same relationship Apache expresses as `ServerName` plus `ServerAlias`. They are appended to the site address so Caddy requests a certificate per name, and the app's canonical-host redirect sends each to `ORIGIN` — one login and one canonical URL regardless of which domain was used. Kept separate from `ORIGIN` so each variable means one thing: the app reads `ORIGIN` for redirects and metadata and never needs to parse a list. Invalid entries fail the deploy before Caddy is reloaded; DNS must already point at the server, since Caddy verifies every name when requesting the certificate.
-
-## Repository changes
-
-1. `docker-compose.yml` — switch the service to `image: 'editable:${IMAGE_TAG:-local}'`; keep everything else (ports, env_file, bind mount) as is
-2. `scripts/vps-deploy.sh` — the script per this spec (`set -euo pipefail`; remote steps as small quoted heredoc scripts, no unvalidated interpolation into remote shells)
-3. `package.json` — `"vps:deploy": "./scripts/vps-deploy.sh"` and `"vps:env": "./scripts/vps-deploy.sh env"`
-4. `README.md` — rewrite Deploy to a VPS around the script; keep the manual compose flow as a short "doing it by hand" note
-5. `.env.example` — `DEPLOY_HOST` as the only needed key, explicit keys as hand-managed overrides
-
-## Implementation steps
-
-1. Compose switch to `image:` + verify the local `docker compose up --build` path still works
-2. Script skeleton: argument parsing, preflight, ssh helpers
-3. Provision + configure phases against a throwaway droplet
-4. Build/upload/activate/verify phases; end-to-end first deploy
-5. Second-run path (update deploy), `--tag` rollback, image pruning
-6. README rewrite + `package.json` script
-
-Each step is independently verifiable; 3–5 need a real amd64 VPS to test against.
-
-Status: implemented (compose switch, script, `vps:deploy` / `vps:env` / `vps:status` pnpm scripts, `data.sh` auto-discovery, README, `.env.example`). Verified against a real DigitalOcean droplet: first deploy (provisioning, TLS via Caddy, password prompt), update deploy (cached build, container replacement, health check, report), and the short-form `env` show and `status` commands with server-side site discovery. Real-world hardening that came out of that testing: ssh retries on transient connection drops (fresh droplets get hammered by brute-force bots, and sshd's MaxStartups randomly sheds new connections) and ssh connection multiplexing so each run plays that lottery only once. Also verified: `--tag` deploys (used to ship a compose-only fix without rebuilding) and `data.sh` against a script-managed server with only `DEPLOY_HOST` set. That testing surfaced and fixed a pre-existing bug: `docker-compose.yml` never set `DATA_DIR=/data` (fly.toml does for Fly), so compose-run containers wrote content to the ephemeral `/app/data` and every redeploy silently wiped it — now fixed in the compose file. Still untested: `env set`/`unset` and the disaster-recovery path (fresh droplet restoring from a backup bucket).
-
-## Open questions
-
-- Should the script optionally harden the box (ufw allowing 22/80/443, unattended-upgrades)? Writebook's installer does some of this. Leaning yes for ufw, no for anything beyond — but deferred until after v1 works end to end.
-- Multi-site per server was considered and decided against: the tool stays committed to one site per server, hardened and simplified, rather than growing toward a mini-PaaS. Consequence: nothing is scoped by a site name — fixed paths (`/data`, `/srv/editable`), fixed container name (`editable`), no name derivation. Anyone wanting many sites runs many cheap servers (or uses Fly.io).
diff --git a/scripts/create-migration.js b/scripts/create-migration.js
index 5c888782..378690a0 100644
--- a/scripts/create-migration.js
+++ b/scripts/create-migration.js
@@ -36,7 +36,7 @@ if (!slug) fail('Migration name must contain a letter or number.');
 
 const timestamp = new Date().toISOString().replace(/[-:.]/g, '');
 const id = `${timestamp}_${namespace}_${slug}`;
-const migration_dir = join(process.cwd(), 'src/lib/server/migrations');
+const migration_dir = join(process.cwd(), 'src/app/migrations');
 const path = join(migration_dir, `${id}.ts`);
 const before_property =
 	before.length > 0 ? `\n\tbefore: [${before.map((target) => `'${target}'`).join(', ')}],` : '';
diff --git a/src/app.css b/src/app.css
index 10659d15..f458d811 100644
--- a/src/app.css
+++ b/src/app.css
@@ -171,9 +171,8 @@
 	background-color: var(--background);
 }
 
-/* Scroll-triggered reveal animations
-   Comment out the block below to disable */
-.svedit-canvas[contenteditable='false'] .reveal-hidden {
+/* Comment in the block below to enable scroll-triggered reveal animations */
+/*.svedit-canvas[contenteditable='false'] .reveal-hidden {
 	opacity: 0;
 	transform: translateY(30px);
 }
@@ -184,4 +183,4 @@
 	transition:
 		opacity 0.8s cubic-bezier(0, 0, 0.2, 1),
 		transform 0.8s cubic-bezier(0, 0, 0.2, 1);
-}
+}*/
diff --git a/src/lib/api.remote.ts b/src/app/api.remote.ts
similarity index 99%
rename from src/lib/api.remote.ts
rename to src/app/api.remote.ts
index ff56da4b..3bd744f8 100644
--- a/src/lib/api.remote.ts
+++ b/src/app/api.remote.ts
@@ -14,8 +14,8 @@ import {
 	extract_page_metadata,
 	extract_site_metadata,
 	collect_page_body_node_ids
-} from '#lib/page_metadata.js';
-import type { PreviewMediaNode } from '#lib/page_metadata.js';
+} from '#app/page_metadata.js';
+import type { PreviewMediaNode } from '#app/page_metadata.js';
 import type { Attachment, DocumentNode, NodeSchema, PropertyDefinition } from 'svedit';
 import type { StatementSync } from 'node:sqlite';
 import {
@@ -139,7 +139,7 @@ function collect_node_ids(
 	nodes: Record<string, DocumentNode>,
 	exclude_roots?: Set<string>
 ): Set<string> {
-	return new Set(collect_node_ids_in_order(root_id, nodes, exclude_roots));
+	return new Set(collect_node_ids_in_order(root_id, nodes, document_schema, exclude_roots));
 }
 
 function get_referenced_asset_ids(): Set<string> {
@@ -1017,10 +1017,10 @@ export const save_document = command(save_document_input_schema, async (combined
 	const footer_root_id = page_node.footer;
 
 	const nav_node_ids = nav_root_id
-		? new Set(collect_node_ids_in_order(nav_root_id, all_nodes))
+		? new Set(collect_node_ids_in_order(nav_root_id, all_nodes, document_schema))
 		: new Set<string>();
 	const footer_node_ids = footer_root_id
-		? new Set(collect_node_ids_in_order(footer_root_id, all_nodes))
+		? new Set(collect_node_ids_in_order(footer_root_id, all_nodes, document_schema))
 		: new Set<string>();
 
 	const exclude_roots = new Set<string>();
diff --git a/src/app/components/App.svelte b/src/app/components/App.svelte
index 63cc380d..273af1bf 100644
--- a/src/app/components/App.svelte
+++ b/src/app/components/App.svelte
@@ -344,7 +344,7 @@
 			const save_start = Date.now();
 
 			const [api_module, asset_upload_module] = await Promise.all([
-				import('#lib/api.remote.js'),
+				import('#app/api.remote.js'),
 				import('#lib/client/asset_upload.js')
 			]);
 
@@ -456,7 +456,7 @@
 
 		async execute() {
 			try {
-				const api_module = await import('#lib/api.remote.js');
+				const api_module = await import('#app/api.remote.js');
 				await api_module.logout_admin();
 				editable = false;
 				page_browser.close?.();
diff --git a/src/app/components/AuthDialog.svelte b/src/app/components/AuthDialog.svelte
index 45a8bf44..f1440fe8 100644
--- a/src/app/components/AuthDialog.svelte
+++ b/src/app/components/AuthDialog.svelte
@@ -105,7 +105,7 @@
 		error = '';
 
 		try {
-			const api_module = await import('#lib/api.remote.js');
+			const api_module = await import('#app/api.remote.js');
 			const result = await api_module.login_admin({ password });
 
 			if (result && result.ok === false && 'message' in result) {
diff --git a/src/app/components/Image.svelte b/src/app/components/Image.svelte
index 0536a4b7..7f55ee69 100644
--- a/src/app/components/Image.svelte
+++ b/src/app/components/Image.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { ASSET_BASE, VARIANT_WIDTHS } from '#app/config.js';
 
-	import type { PreviewMediaNode } from '#lib/page_metadata.js';
+	import type { PreviewMediaNode } from '#app/page_metadata.js';
 
 	let { node }: { node: PreviewMediaNode } = $props();
 
diff --git a/src/app/components/LinkPreview.svelte b/src/app/components/LinkPreview.svelte
index ca13b6c3..297f3d90 100644
--- a/src/app/components/LinkPreview.svelte
+++ b/src/app/components/LinkPreview.svelte
@@ -19,7 +19,7 @@
 		if (!app.has_backend) return null;
 		if (!href) return null;
 
-		const api_module = await import('#lib/api.remote.js');
+		const api_module = await import('#app/api.remote.js');
 		return await api_module.get_internal_link_preview(href);
 	});
 
diff --git a/src/app/components/Media.svelte b/src/app/components/Media.svelte
index 46f20223..a1069cd9 100644
--- a/src/app/components/Media.svelte
+++ b/src/app/components/Media.svelte
@@ -2,7 +2,7 @@
 	import Image from './Image.svelte';
 	import Video from './Video.svelte';
 
-	import type { PreviewMediaNode } from '#lib/page_metadata.js';
+	import type { PreviewMediaNode } from '#app/page_metadata.js';
 
 	// Accepts both document media nodes (Nodes['image'] / Nodes['video']) and
 	// derived preview nodes — anything with the media display shape.
diff --git a/src/app/components/Page.svelte b/src/app/components/Page.svelte
index 7d28624e..51413222 100644
--- a/src/app/components/Page.svelte
+++ b/src/app/components/Page.svelte
@@ -6,7 +6,7 @@
 	import Nav from './Nav.svelte';
 	import Footer from './Footer.svelte';
 	import MediaProperty from './MediaProperty.svelte';
-	import { extract_page_metadata, get_social_image } from '#lib/page_metadata.js';
+	import { extract_page_metadata, get_social_image } from '#app/page_metadata.js';
 	import { TW_PAGE_PADDING_X } from '#app/tailwind_theme.js';
 
 	const svedit = get_svedit_context();
diff --git a/src/app/components/PageDeleteDialog.svelte b/src/app/components/PageDeleteDialog.svelte
index d51f9dd0..65813676 100644
--- a/src/app/components/PageDeleteDialog.svelte
+++ b/src/app/components/PageDeleteDialog.svelte
@@ -61,7 +61,7 @@
 		delete_error = '';
 
 		try {
-			const api_module = await import('#lib/api.remote.js');
+			const api_module = await import('#app/api.remote.js');
 			await api_module.delete_page({ document_id: current.document_id });
 
 			current.on_deleted?.();
diff --git a/src/app/components/PageUrlDialog.svelte b/src/app/components/PageUrlDialog.svelte
index 1f56a3e6..4a44a70a 100644
--- a/src/app/components/PageUrlDialog.svelte
+++ b/src/app/components/PageUrlDialog.svelte
@@ -54,7 +54,7 @@
 		page_url_error = '';
 
 		try {
-			const api_module = await import('#lib/api.remote.js');
+			const api_module = await import('#app/api.remote.js');
 			const result = await api_module.update_page_slug({
 				document_id: current.document_id,
 				slug: page_url_value
diff --git a/src/app/components/PagesDrawer.svelte b/src/app/components/PagesDrawer.svelte
index d2f372a0..ddc6cbc5 100644
--- a/src/app/components/PagesDrawer.svelte
+++ b/src/app/components/PagesDrawer.svelte
@@ -2,8 +2,8 @@
 	import { resolve } from '$app/paths';
 	import { page } from '$app/state';
 
-	import { get_page_browser_data } from '#lib/api.remote.js';
-	import type { PageTreeNode } from '#lib/api.remote.js';
+	import { get_page_browser_data } from '#app/api.remote.js';
+	import type { PageTreeNode } from '#app/api.remote.js';
 	import Media from './Media.svelte';
 	import { get_page_browser } from '#app/page_browser_context.svelte.js';
 	import { get_page_url_dialog } from '#app/page_url_dialog_context.svelte.js';
diff --git a/src/app/components/Toolbar.svelte b/src/app/components/Toolbar.svelte
index 87ab1118..6edd4fbb 100644
--- a/src/app/components/Toolbar.svelte
+++ b/src/app/components/Toolbar.svelte
@@ -6,7 +6,7 @@
 	import { get_page_browser } from '#app/page_browser_context.svelte.js';
 	import { get_page_url_dialog } from '#app/page_url_dialog_context.svelte.js';
 	import { get_page_delete_dialog } from '#app/page_delete_dialog_context.svelte.js';
-	import { extract_page_metadata } from '#lib/page_metadata.js';
+	import { extract_page_metadata } from '#app/page_metadata.js';
 	import { untrack } from 'svelte';
 	import { get_selection_node_ancestors } from '#app/app_utils.js';
 	import NodeNavigator from './NodeNavigator.svelte';
diff --git a/src/app/components/Video.svelte b/src/app/components/Video.svelte
index 4470644a..73ac0012 100644
--- a/src/app/components/Video.svelte
+++ b/src/app/components/Video.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { ASSET_BASE } from '#app/config.js';
 
-	import type { PreviewMediaNode } from '#lib/page_metadata.js';
+	import type { PreviewMediaNode } from '#app/page_metadata.js';
 
 	let { node, editable = false }: { node: PreviewMediaNode; editable?: boolean } = $props();
 
diff --git a/src/lib/content_config.ts b/src/app/content_config.ts
similarity index 89%
rename from src/lib/content_config.ts
rename to src/app/content_config.ts
index 94f47b0d..8f3e0e09 100644
--- a/src/lib/content_config.ts
+++ b/src/app/content_config.ts
@@ -14,8 +14,8 @@
 // - `toc` (optional): generate a table of contents from the file's headings
 //
 // With no entries, the site behaves exactly as if this feature did not exist.
-// Do not import this module (or anything under `src/lib/server/`) from client
-// code — use `#app/config.js` for universal constants instead.
+// Do not import this module from client code. Use `#app/config.js` for
+// universal constants instead.
 import readme_md from '../../README.md?raw';
 import product_md from '../../PRODUCT.md?raw';
 
diff --git a/src/app/migrations.ts b/src/app/migrations.ts
new file mode 100644
index 00000000..15c8a501
--- /dev/null
+++ b/src/app/migrations.ts
@@ -0,0 +1,15 @@
+import { build_migrations } from '#lib/server/migration_registry.js';
+import type { Migration, MigrationModule } from '#lib/server/migration_registry.js';
+import run_migration_runner from '#lib/server/migration_runner.js';
+import seed_initial_documents from './seed_initial_documents.js';
+
+const migration_modules = import.meta.glob('./migrations/*.ts', {
+	eager: true,
+	import: 'default'
+}) as Record<string, MigrationModule>;
+
+const migrations: Migration[] = build_migrations(migration_modules);
+
+export function run_migrations() {
+	run_migration_runner(migrations, seed_initial_documents);
+}
diff --git a/src/lib/server/migrations/20260803T131059242Z_editable_initial_schema.ts b/src/app/migrations/20260803T131059242Z_editable_initial_schema.ts
similarity index 100%
rename from src/lib/server/migrations/20260803T131059242Z_editable_initial_schema.ts
rename to src/app/migrations/20260803T131059242Z_editable_initial_schema.ts
diff --git a/src/lib/new_page.ts b/src/app/new_page.ts
similarity index 97%
rename from src/lib/new_page.ts
rename to src/app/new_page.ts
index af602726..d30e3136 100644
--- a/src/lib/new_page.ts
+++ b/src/app/new_page.ts
@@ -1,5 +1,5 @@
 import nanoid from '#app/nanoid.js';
-import { MEDIA_DEFAULTS } from '#app/document_schema.js';
+import { MEDIA_DEFAULTS, document_schema } from '#app/document_schema.js';
 import { clone_subtree_with_new_ids } from '#lib/document_graph.js';
 import type { Document } from 'svedit';
 
@@ -49,6 +49,7 @@ export function create_duplicate_doc(
 		source_document.document_id,
 		source_document.nodes,
 		nanoid,
+		document_schema,
 		shared_roots
 	);
 
diff --git a/src/app/page_browser_context.svelte.ts b/src/app/page_browser_context.svelte.ts
index c7bb060c..27f72ad9 100644
--- a/src/app/page_browser_context.svelte.ts
+++ b/src/app/page_browser_context.svelte.ts
@@ -1,5 +1,5 @@
 import { createContext } from 'svelte';
-import type { PageTreeNode } from '#lib/api.remote.js';
+import type { PageTreeNode } from '#app/api.remote.js';
 
 export type PageBrowser = ReturnType<typeof create_page_browser> & {
 	/** Reactive data version, installed by App.svelte (bumped on invalidation). */
diff --git a/src/lib/page_metadata.ts b/src/app/page_metadata.ts
similarity index 98%
rename from src/lib/page_metadata.ts
rename to src/app/page_metadata.ts
index a6c8e5ae..d8fcd114 100644
--- a/src/lib/page_metadata.ts
+++ b/src/app/page_metadata.ts
@@ -1,4 +1,5 @@
 import { ASSET_BASE, ASSET_ID_REGEX, VARIANT_WIDTHS_SET } from '#app/config.js';
+import { document_schema } from '#app/document_schema.js';
 import { collect_node_ids_in_order } from '#lib/document_graph.js';
 import type { Document } from 'svedit';
 
@@ -143,7 +144,7 @@ export function collect_page_body_node_ids(page_doc: Document | null | undefined
 	const seen_ids = new Set(body_node_ids);
 
 	for (const child_id of page_root.body.nodes) {
-		const subtree_ids = collect_node_ids_in_order(child_id, page_doc.nodes);
+		const subtree_ids = collect_node_ids_in_order(child_id, page_doc.nodes, document_schema);
 		for (const subtree_id of subtree_ids) {
 			if (seen_ids.has(subtree_id)) continue;
 			seen_ids.add(subtree_id);
diff --git a/src/lib/server/seed_initial_documents.ts b/src/app/seed_initial_documents.ts
similarity index 100%
rename from src/lib/server/seed_initial_documents.ts
rename to src/app/seed_initial_documents.ts
diff --git a/src/lib/server_config.ts b/src/app/server_config.ts
similarity index 100%
rename from src/lib/server_config.ts
rename to src/app/server_config.ts
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index 61b0e413..e43cf020 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -41,8 +41,8 @@ function get_canonical_redirect(url: URL): string | null {
 
 export const init: ServerInit = async () => {
 	if (!VERCEL) {
-		const { default: migrate } = await import('#lib/server/migrate.js');
-		migrate();
+		const { run_migrations } = await import('#app/migrations.js');
+		run_migrations();
 
 		const { warn_about_shadowed_pages } = await import('#lib/server/markdown/shadowed.js');
 		warn_about_shadowed_pages();
diff --git a/src/lib/document_graph.test.ts b/src/lib/document_graph.test.ts
index f4aa2aa3..6821073f 100644
--- a/src/lib/document_graph.test.ts
+++ b/src/lib/document_graph.test.ts
@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+import { document_schema } from '#app/document_schema.js';
 import { clone_subtree_with_new_ids } from './document_graph.js';
 
 function make_id_generator() {
@@ -46,7 +47,7 @@ const shared_roots = new Set(['nav_doc', 'footer_doc']);
 describe('clone_subtree_with_new_ids', () => {
 	it('gives every copied node a fresh id', () => {
 		const nodes = make_page_nodes();
-		const result = clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), shared_roots);
+		const result = clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), document_schema, shared_roots);
 
 		const source_ids = Object.keys(nodes);
 		const cloned_ids = Object.keys(result.nodes);
@@ -63,7 +64,7 @@ describe('clone_subtree_with_new_ids', () => {
 
 	it('rewrites node and node_array references to the copies', () => {
 		const nodes = make_page_nodes();
-		const result = clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), shared_roots);
+		const result = clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), document_schema, shared_roots);
 
 		const page = result.nodes[result.root_id] as any;
 		const prose_id = page.body.nodes[0];
@@ -76,7 +77,7 @@ describe('clone_subtree_with_new_ids', () => {
 
 	it('rewrites mark references inside annotated text', () => {
 		const nodes = make_page_nodes();
-		const result = clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), shared_roots);
+		const result = clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), document_schema, shared_roots);
 
 		const page = result.nodes[result.root_id] as any;
 		const prose = result.nodes[page.body.nodes[0]] as any;
@@ -90,7 +91,7 @@ describe('clone_subtree_with_new_ids', () => {
 
 	it('leaves excluded shared roots pointing at their own documents', () => {
 		const nodes = make_page_nodes();
-		const result = clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), shared_roots);
+		const result = clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), document_schema, shared_roots);
 
 		const page = result.nodes[result.root_id] as any;
 		expect(page.nav).toBe('nav_doc');
@@ -102,7 +103,7 @@ describe('clone_subtree_with_new_ids', () => {
 	it('leaves the source document untouched', () => {
 		const nodes = make_page_nodes();
 		const before = structuredClone(nodes);
-		clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), shared_roots);
+		clone_subtree_with_new_ids('page_1', nodes, make_id_generator(), document_schema, shared_roots);
 		expect(nodes).toEqual(before);
 	});
 });
diff --git a/src/lib/document_graph.ts b/src/lib/document_graph.ts
index ae53d581..8d66573a 100644
--- a/src/lib/document_graph.ts
+++ b/src/lib/document_graph.ts
@@ -1,4 +1,3 @@
-import { document_schema } from '#app/document_schema.js';
 import type { Attachment, DocumentNode, NodeSchema, PropertyDefinition } from 'svedit';
 
 function get_attached_ranges(
@@ -20,9 +19,10 @@ export function clone_subtree_with_new_ids(
 	root_id: string,
 	nodes: Record<string, DocumentNode>,
 	generate_id: () => string,
+	schema: Record<string, NodeSchema>,
 	exclude_roots?: Set<string>
 ): { root_id: string; nodes: Record<string, DocumentNode> } {
-	const source_ids = collect_node_ids_in_order(root_id, nodes, exclude_roots);
+	const source_ids = collect_node_ids_in_order(root_id, nodes, schema, exclude_roots);
 
 	const id_map = new Map<string, string>();
 	for (const id of source_ids) {
@@ -36,7 +36,7 @@ export function clone_subtree_with_new_ids(
 		const node = structuredClone(nodes[source_id]);
 		node.id = new_id;
 
-		const type_schema: NodeSchema | undefined = document_schema[node.type];
+		const type_schema: NodeSchema | undefined = schema[node.type];
 
 		for (const [prop_name, prop_def] of Object.entries<PropertyDefinition>(
 			type_schema?.properties ?? {}
@@ -78,6 +78,7 @@ function remap_attached_ranges(
 export function collect_node_ids_in_order(
 	root_id: string,
 	nodes: Record<string, DocumentNode>,
+	schema: Record<string, NodeSchema>,
 	exclude_roots?: Set<string>
 ): string[] {
 	const collected: string[] = [];
@@ -95,7 +96,7 @@ export function collect_node_ids_in_order(
 		const node = nodes[id];
 		if (!node) continue;
 
-		const type_schema: NodeSchema | undefined = document_schema[node.type];
+		const type_schema: NodeSchema | undefined = schema[node.type];
 		if (!type_schema) continue;
 
 		const next_ids: string[] = [];
diff --git a/src/lib/server/asset_storage.ts b/src/lib/server/asset_storage.ts
index e770e3ec..d7a4b5f7 100644
--- a/src/lib/server/asset_storage.ts
+++ b/src/lib/server/asset_storage.ts
@@ -7,7 +7,7 @@ import { pipeline } from 'node:stream/promises';
 import { Readable, Transform } from 'node:stream';
 import { mkdirSync } from 'node:fs';
 import { ASSET_ID_REGEX } from '#app/config.js';
-import { ASSET_GRACE_PERIOD_DAYS, ASSET_PATH } from '#lib/server_config.js';
+import { ASSET_GRACE_PERIOD_DAYS, ASSET_PATH } from '#app/server_config.js';
 import { mirror_file } from './s3.js';
 
 // Ensure the asset directory exists on module load
diff --git a/src/lib/server/db.ts b/src/lib/server/db.ts
index 9d57449c..f604fbdf 100644
--- a/src/lib/server/db.ts
+++ b/src/lib/server/db.ts
@@ -1,6 +1,6 @@
 import { DatabaseSync } from 'node:sqlite';
 import { mkdirSync } from 'node:fs';
-import { DATA_DIR, DB_PATH } from '#lib/server_config.js';
+import { DATA_DIR, DB_PATH } from '#app/server_config.js';
 
 // Ensure the data directory exists
 mkdirSync(DATA_DIR, { recursive: true });
diff --git a/src/lib/server/markdown/registry.test.ts b/src/lib/server/markdown/registry.test.ts
index c42afb91..982b1337 100644
--- a/src/lib/server/markdown/registry.test.ts
+++ b/src/lib/server/markdown/registry.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { MARKDOWN_SOURCES } from '#lib/content_config.js';
+import { MARKDOWN_SOURCES } from '#app/content_config.js';
 import { build_registry, get_markdown_page, is_reserved_markdown_slug } from './registry.js';
 
 describe('build_registry', () => {
diff --git a/src/lib/server/markdown/registry.ts b/src/lib/server/markdown/registry.ts
index 6cdd32a2..144cbc82 100644
--- a/src/lib/server/markdown/registry.ts
+++ b/src/lib/server/markdown/registry.ts
@@ -1,11 +1,11 @@
 // Pathname lookup for configured markdown pages.
 //
 // Files are referenced through explicit `?raw` imports in
-// `src/lib/content_config.js`, so Vite inlines exactly the mapped files into
+// `src/app/content_config.js`, so Vite inlines exactly the mapped files into
 // the server bundle, rebuilds on edits in development, and fails the build
 // when a referenced file is missing.
 
-import { MARKDOWN_SOURCES } from '#lib/content_config.js';
+import { MARKDOWN_SOURCES } from '#app/content_config.js';
 import { validate_markdown_sources } from './config.js';
 import type { MarkdownSource } from './config.js';
 
diff --git a/src/lib/server/migration_plan.ts b/src/lib/server/migration_plan.ts
index 78a1ac38..fd7c9b51 100644
--- a/src/lib/server/migration_plan.ts
+++ b/src/lib/server/migration_plan.ts
@@ -1,4 +1,4 @@
-import type { Migration } from './migrations.js';
+import type { Migration } from './migration_registry.js';
 
 /**
  * Order pending migrations by timestamp, with narrowly scoped `before`
diff --git a/src/lib/server/migration_registry.ts b/src/lib/server/migration_registry.ts
new file mode 100644
index 00000000..45193669
--- /dev/null
+++ b/src/lib/server/migration_registry.ts
@@ -0,0 +1,38 @@
+import type { MigrationHelpers } from './migration_helpers.js';
+
+const MIGRATION_FILENAME_PATTERN = /^\d{8}T\d{9}Z_[a-z][a-z0-9-]*_[a-z0-9]+(?:_[a-z0-9]+)*\.ts$/;
+
+export type MigrationModule = {
+	before?: string[];
+	up: (context: { db: any } & MigrationHelpers) => unknown;
+};
+export type Migration = MigrationModule & { id: string };
+
+export function build_migrations(
+	migration_modules: Record<string, MigrationModule>
+): Migration[] {
+	// Sorting the paths gives timestamp order without a central registry that
+	// project migrations must edit.
+	return Object.entries(migration_modules)
+		.sort(([left], [right]) => left.localeCompare(right))
+		.map(([path, migration]) => {
+			const filename = path.split('/').at(-1) ?? '';
+			if (!MIGRATION_FILENAME_PATTERN.test(filename)) {
+				throw new Error(`Invalid migration filename "${filename}".`);
+			}
+
+			if (!migration || typeof migration !== 'object') {
+				throw new Error(`Migration "${filename}" must have a default object export.`);
+			}
+			const unknown_keys = Object.keys(migration).filter(
+				(key) => !['before', 'up'].includes(key)
+			);
+			if (unknown_keys.length > 0) {
+				throw new Error(
+					`Migration "${filename}" has unknown export properties: ${unknown_keys.join(', ')}.`
+				);
+			}
+
+			return { id: filename.slice(0, -'.ts'.length), ...migration };
+		});
+}
diff --git a/src/lib/server/migrate.ts b/src/lib/server/migration_runner.ts
similarity index 90%
rename from src/lib/server/migrate.ts
rename to src/lib/server/migration_runner.ts
index bec98564..f2e37ba7 100644
--- a/src/lib/server/migrate.ts
+++ b/src/lib/server/migration_runner.ts
@@ -1,11 +1,15 @@
-import migrations from './migrations.js';
+import type { Migration } from './migration_registry.js';
 import db, { with_transaction } from './db.js';
 import { plan_pending_migrations } from './migration_plan.js';
 import { create_migration_helpers } from './migration_helpers.js';
-import seed_initial_documents from './seed_initial_documents.js';
 
-export default function migrate() {
-	// Invariants — fail before running anything.
+type SeedInitialDocuments = (context: { db: any }) => unknown;
+
+export default function migrate(
+	migrations: Migration[],
+	seed_initial_documents: SeedInitialDocuments
+) {
+	// Invariants — fail before running.
 	const migration_ids = migrations.map((migration) => migration.id);
 	if (migration_ids.some((id) => typeof id !== 'string' || id.length === 0)) {
 		throw new Error('Every migration must have a non-empty string id.');
diff --git a/src/lib/server/migrations.ts b/src/lib/server/migrations.ts
deleted file mode 100644
index e775b237..00000000
--- a/src/lib/server/migrations.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import type { MigrationHelpers } from './migration_helpers.js';
-
-const MIGRATION_FILENAME_PATTERN = /^\d{8}T\d{9}Z_[a-z][a-z0-9-]*_[a-z0-9]+(?:_[a-z0-9]+)*\.ts$/;
-
-type MigrationModule = {
-	before?: string[];
-	up: (context: { db: any } & MigrationHelpers) => unknown;
-};
-export type Migration = MigrationModule & { id: string };
-
-const migration_modules = import.meta.glob('./migrations/*.ts', {
-	eager: true,
-	import: 'default'
-}) as Record<string, MigrationModule>;
-
-// Vite resolves this literal glob at build time. Sorting the paths gives
-// timestamp order without a central registry that custom migrations must edit.
-export default Object.entries(migration_modules)
-	.sort(([left], [right]) => left.localeCompare(right))
-	.map(([path, migration]) => {
-		const filename = path.split('/').at(-1) ?? '';
-		if (!MIGRATION_FILENAME_PATTERN.test(filename)) {
-			throw new Error(`Invalid migration filename "${filename}".`);
-		}
-
-		if (!migration || typeof migration !== 'object') {
-			throw new Error(`Migration "${filename}" must have a default object export.`);
-		}
-		const unknown_keys = Object.keys(migration).filter((key) => !['before', 'up'].includes(key));
-		if (unknown_keys.length > 0) {
-			throw new Error(
-				`Migration "${filename}" has unknown export properties: ${unknown_keys.join(', ')}.`
-			);
-		}
-
-		return { id: filename.slice(0, -'.ts'.length), ...migration };
-	});
diff --git a/src/routes/+layout.server.ts b/src/routes/+layout.server.ts
index 665c4c19..fd9b46be 100644
--- a/src/routes/+layout.server.ts
+++ b/src/routes/+layout.server.ts
@@ -1,6 +1,6 @@
 import { ORIGIN, VERCEL } from '$app/env/private';
 import { default_site_document } from '#app/default_site.js';
-import { extract_site_metadata } from '#lib/page_metadata.js';
+import { extract_site_metadata } from '#app/page_metadata.js';
 import type { LayoutServerLoad } from './$types';
 
 // Static hosts resolve directory indexes reliably, while Node deployments keep
@@ -15,7 +15,7 @@ export const load: LayoutServerLoad = async ({ locals, depends }) => {
 
 	let site_metadata;
 	if (has_backend) {
-		const { get_site_metadata } = await import('#lib/api.remote.js');
+		const { get_site_metadata } = await import('#app/api.remote.js');
 		site_metadata = await get_site_metadata();
 	} else {
 		site_metadata = extract_site_metadata(default_site_document);
diff --git a/src/routes/+page.server.ts b/src/routes/+page.server.ts
index a6d310be..b3b0aa12 100644
--- a/src/routes/+page.server.ts
+++ b/src/routes/+page.server.ts
@@ -17,6 +17,6 @@ export const load: PageServerLoad = async () => {
 		};
 	}
 
-	const { get_home_document } = await import('#lib/api.remote.js');
+	const { get_home_document } = await import('#app/api.remote.js');
 	return await get_home_document();
 };
diff --git a/src/routes/[page_id]/+page.server.ts b/src/routes/[page_id]/+page.server.ts
index b493118e..61dc5488 100644
--- a/src/routes/[page_id]/+page.server.ts
+++ b/src/routes/[page_id]/+page.server.ts
@@ -45,7 +45,7 @@ export const load: PageServerLoad = async ({ params }) => {
 	}
 
 	try {
-		const { get_document } = await import('#lib/api.remote.js');
+		const { get_document } = await import('#app/api.remote.js');
 		const result = await get_document(params.page_id);
 
 		if (result.redirect_to_slug) {
@@ -74,6 +74,6 @@ async function get_shared_site_documents() {
 		const { default_nav_document, default_footer_document } = await import('#app/default_site.js');
 		return { nav_document: default_nav_document, footer_document: default_footer_document };
 	}
-	const { get_shared_documents } = await import('#lib/api.remote.js');
+	const { get_shared_documents } = await import('#app/api.remote.js');
 	return await get_shared_documents();
 }
diff --git a/src/routes/new/+page.server.ts b/src/routes/new/+page.server.ts
index 3b0d55c7..5b556934 100644
--- a/src/routes/new/+page.server.ts
+++ b/src/routes/new/+page.server.ts
@@ -15,7 +15,7 @@ export const load: PageServerLoad = async ({ locals, url }) => {
 		throw redirect(303, '/');
 	}
 
-	const api_module = await import('#lib/api.remote.js');
+	const api_module = await import('#app/api.remote.js');
 	const shared_documents = await api_module.get_shared_documents();
 
 	// `?from=<slug>` starts the new page as a copy of an existing one.
diff --git a/src/routes/new/+page.svelte b/src/routes/new/+page.svelte
index 1254a927..1727d7cd 100644
--- a/src/routes/new/+page.svelte
+++ b/src/routes/new/+page.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import App from '#app/components/App.svelte';
-	import { create_duplicate_doc, create_empty_doc } from '#lib/new_page.js';
+	import { create_duplicate_doc, create_empty_doc } from '#app/new_page.js';
 
 	const props = $props();
 	const data = $derived({