Tutorial: Changelog — July 2026

Newest entry on top.

2026-07-25 — deps (2.60.2) — merge all four pending Dependabot groups (#56, #57, #59, #60)

Closed every open Dependabot PR during the release, verified against the project's own dev gate. Dependabot regenerated the groups mid-release (#59/#60 superseded #56/#57 with newer targets), so all four were folded into dev, superset-wins. Final merged state — engine group: compromise 14.15.1→14.16.0, @playwright/test 1.61.1→1.62.0, eslint 10.6.0→10.8.0, prettier 3.9.4→3.9.6, stylelint 17.14.0→17.14.1; github-actions group: action-version pins bumped across all nine workflow files (ci, codeql, scorecard, sonar, pages, release, netlify-deploy, branch-sync, visual-baselines) — e.g. actions/checkout v7.0.1, actions/setup-node v7.0.0, actions/setup-java v5.6.0 — no code impact. Merged into dev with --no-ff and verified locally with npm install + npm test green (the project's dev gate; CI runs only on the main PR). PATCH bump 2.60.1 → 2.60.2.

2026-07-25 — docs/notes — fairyfox: adopt the hub 0.20.2 → 1.6.1 standards span

Ran the fairyfox adopting-updates flow against hub 1.6.1 (the mirror had been force-pushed and renumbered from 0.20.x). Adopted the whole span under the standing adopt-standards-by-default grant: seeded the project's first notes/reference/adoption-manifest.md (the 0.21.0 linchpin — a per- standard record where copied-only ≠ adopted and no Standards adopted ✅ is written without a backing row); added four new-standard notes — checklists-are-contracts, mandate-ledger, docker, readme; folded the material changes into planning (phase-by-default), engineering-quality (the ship contract — Scorecard ≥ 7.0 floor, tech-debt removal, PR triage), git-workflow (the pre-release manifest gate), coins (base counter mandatory), and compliance (matrix rows); and wired checklists-are-contracts / mandate-ledger / the manifest / phase-by-default into CLAUDE.md Default Workflow step 0. The README was brought to the new readme standard: a worded 📖 Documentation link near the top, an organized Get it section (Try it live / Download / Source), and a mesh footer; its badge block already carried all 20 canonical badges in order (adopted as a filing act). Browser-gated docs-site visual work — the chrome bump 2.2.1 → 2.3.0 plus the 1.4.0 subnav / on- site Notes / coins-presence requirements — is deferred as a named tracked gap in the manifest, per the runbook's "phase a mixed adoption." Notes/docs + README only — no VERSION bump. Full account: fairyfox-reports/2026-07-25-adopting-updates.md.

2026-07-19 — docs-site — fairyfox: add the coins counter to the docs chrome

The docs-site shared chrome gained the coins reading-engagement counter (a button beside the reader "Aa"), correcting an earlier miscall that filed coins as out-of-scope — it ships as part of the chrome this node already wears, and the docs site is same-origin under fairyfox.io/<key>/, so it shares the hub wallet. Verified the rest of the chrome is already current at bundle 2.2.1 (reader constants + nav match the master); coins was the sole gap. assets/docs-theme/modules/coins.js is the master coins.js vendored verbatim (the earning engine must not be reimplemented), injected after initReader() so its button sits left of "Aa"; theme/coins.css carries the button/panel/pop/read-time styles on the project tokens; notes/reference/coins.md + a compliance row document it. Same-origin with the hub, so the hub /legal/coins/ page covers the fairyfox:coins:a disclosure and no project legal page changes. Notes/docs-theme only — no VERSION bump. Verified: npm run docs, check:docs, lint/format:check.

2026-07-19 — docs — fairyfox: adopt six new mesh standards as reference notes

A fairyfox system update check refreshed the hub mirror to 0.20.2 and found six standards that postdate this node's last adoption — all already practiced here but with no first-class home in the tree. Under the hub's standing adopt-standards-by-default authorization (owner-confirmed scope: adopt all), added notes/reference/{engineering-quality,planning,research-capture,working-rhythm, self-hosted-assets,agent-tooling}.md, each mapping the hub canonical to how this project already satisfies it (working-agreements, the Default Workflow, self-hosted fonts, PowerShell/file-tools, notes-first). Wired in: a plan-before-execute step 0 in the CLAUDE.md Default Workflow, rows for all six in the compliance audit matrix, and index/folder-map entries in notes/README.md. Notes-only — no VERSION bump. Verification: check:docs (461 links), format:check, smoke all green. Process reports: notes/fairyfox-reports/2026-07-19-{check-for-updates,adopting-updates}.md.

2026-07-13 — 2.60.1 — Security: the backend could be made to run arbitrary commands

CodeQL flagged it on the release PR and it was right. /api/image/open and /api/image/reveal built a shell string around a request-derived path:

exec(`cmd /c start "" "${fp}"`);
exec(`explorer /select,"${fp}"`);

resolveOutputFile() blocks path traversal and nothing else, so an image in the output folder named x" & calc & ".png closes the quote and everything after it runs. The ImageMagick convert/resize calls had the same shape. Severity: critical (js/command-line-injection).

The fix is structural, not a better escape function — escaping is a losing game played on the attacker's board. No shell: the program and its arguments are built separately (new targets/web/backend/osCommands.js, pure and testable) and handed to execFile, which passes argv straight to the OS. A quote inside a filename is then just a quote inside a filename. detectMagick lost its shell too — nothing there needed one.

Three more from the same sweep, all real:

• Prototype pollution (js/remote-property-injection, high): mergeSidecar merged a request-supplied patch key-by-key into a plain object, so {"__proto__": {…}} mutated Object.prototype for the whole process. Those keys are now dropped.
• World-writable temp cache (js/insecure-temporary-file, high): the remote manifest was cached at a fully predictable path in os.tmpdir(), where any local account could pre-create or symlink it — and we'd write through it and then trust what we read back. Moved into the app's own directory, mode 0600.
• Check-then-use races (js/file-system-race, high ×3): existsSync + read/write/unlink. Replaced with do-it-and-handle-ENOENT/EEXIST — the check was always a lie about the future anyway.

Regression-tested (tests/regression/commandInjection.test.js, 5), and the test was proven by restoring the old cmd /c start shape and watching it go red.

"It's a local-only backend" is mitigation, not absolution: it is one --host flag from a LAN.

2026-07-12 — 2.60.0 — The verdict: 1000 prompts render in 253 ms on a phone, with flat memory

The number the whole exercise existed to produce, from the release APK on a real Android runtime:

The list virtualizes exactly as promised: 50× the rows costs no more memory (110 MB vs 112 MB) and no more render time (253 ms vs 383 ms), and the cost per prompt falls with N (94 → 28 → 24 ms). The jank is the emulator's software GPU — identical across all three rolls, which is precisely why the gate judges each roll against the same device's own baseline rather than an absolute frame budget.

2026-07-12 — 2.60.0 — …and the "defect" it first reported was my test

The on-device gate's first runs said the app missed its headline promise: 1000 prompts, no "1000 generated" inside ten minutes. For a few hours the notes said so. It was wrong, and what proved it was the instrumentation added to diagnose it:

[rap-perf] roll 1000 prompts: 13044ms (engine only)
[rap-perf] committed 1220 result rows      ← 34 ms later

The engine produced all 1000 prompts — 13.0 s on a software-rendered CI emulator, linear across 20 → 200 → 1000 — and React committed every row 34 ms later. Nothing was slow.

The bug was in the test: results accumulate across rolls (each batch is prepended, by design), so after the 20-prompt baseline the label reads "220 generated", and a test waiting for "200 generated" waits forever. It then burned a ten-minute timeout per roll and reported that as the app failing. The suite now clears the list before each roll (new clear-all testID).

Two lessons, both now in the notes:

• The test's verdict was louder than the app's evidence, and I believed the test. The [rap-perf] lines were sitting in the log the whole time. Read the instrument you built before you distrust the thing it measures.
• It retires the 2026-07-11 conclusion that FlashList's web renderer was to blame for the same symptom in the proxy. scripts/probe-mobile-list.mjs: the export renders 1000 prompts in 165 ms with 16 rows mounted in the DOM. That explanation was comfortable and false.

2026-07-12 — 2.60.0 — CI gets two tiers: fast on every push, expensive on the release path

Owner: "only use CI for things that don't take a lot of time; things that take a lot of time should be gated for release/ship/deploy only."

The android-device job compiles the Android app from source and boots an emulator — 30–45 minutes. Run on every push to dev, it made each one-line iteration a 40-minute wait (and, this session, several of them). It now runs where it actually protects something: the pull request into main, pushes to main, and workflow_dispatch. main still cannot take a build it rejects — the release PR must be green — while dev stays fast. A gate that makes iteration miserable is a gate people learn to ignore.

2026-07-12 — 2.60.0 — The harness itself (Detox on a real Android runtime)

The mobile testing mandate had one honest exception, and this closes it. The app promises 1000 prompts in a single roll with no performance loss — a claim about a phone. The react-native-web proxy could never check it: it runs FlashList's web renderer, which doesn't recycle like the native one, so any number it produces describes react-native-web. The test was kept skipped, with the measurements inline, rather than deleted (pretending) or left failing (crying wolf).

Now there's a real harness: targets/mobile/e2e/ + .detoxrc.js — Detox driving the release APK (built from the Expo-CNG native project, which stays gitignored) on an emulator; local via the rap_phone AVD, in CI via a new android-device job (KVM-accelerated Ubuntu runner).

What it asserts, and why it can't be gamed. Not "1000 prompts in under N ms" — that benchmarks whatever box CI got. It rolls 20, then 1000, on the same device in the same session, and compares: a virtualized list holds a window of rows, so 50× the data must not mean 50× the memory or a collapsed frame rate. The evidence is the platform's own accounting — dumpsys gfxinfo (janky-frame %, p50/p90/p95/p99) and dumpsys meminfo (real PSS) — not a stopwatch inside the test. Emulator noise is identical in both rolls and cancels. It also pins that the app produced all 1000 (the wait is on the literal "1000 generated", so a re-introduced cap times out rather than passing quietly) and that the app is still interactive afterwards.

Also: gradle/ndk-override.init.gradle — an opt-in escape hatch (ANDROID_NDK_VERSION) so a local build uses an NDK you already have instead of stalling for hours on a 700 MB download of the exact pinned one. No-op in CI.

2026-07-12 — 2.60.0 — De-dup, the last one: engine/dplInsertCatalog.js

The DPL insert catalog describes what engine/core/dpl/dpl.js compiles — the constructs, their syntax, their templates. That is the engine's grammar; it was never the web target's to own, and the phone's 262-line hand-port existed only because the web owned it (guarded by checkDplInserts).

The plan called this one "entangled", because the web localizes the menu's labels through react-intl while mobile inlines English — sharing the module naively would have dragged react-intl into React Native. The split that resolves it generalizes: grammar is shared, presentation is not. The engine holds ids / syntax / templates / examples / materializeTemplate; each target attaches its own label layer via buildInsertMenu({category, item}). Label keys are derived from the catalog ids, so a construct added to the grammar with no string in a target fails tests/unit/dplInsertCatalog.test.js instead of rendering undefined on a phone.

Mobile 262 → a label table; web 264 → 24. checkDplInserts deleted — six of the seven drift checks are now gone, each because the thing it guarded can no longer differ.

2026-07-12 — 2.59.1 — The local gate was a SUBSET of the CI gate (CI had been red, unseen)

gh run list on dev: CI failing since the previous session's last push — on Format check. Nine files that session wrote were never Prettier'd, and npm test ran lint but not format:check, which CI does. So the session ended "green" on a commit CI rejects. A gate you don't run is not a gate — and a local gate that is a subset of the CI gate is a lie about what green means. format:check now runs inside npm test.

Two of the nine were generated files, and that exposed a deadlock: hand-formatting them made check:registry call them STALE (it compares byte-for-byte against the generator's output), while leaving them made format:check red — two gates each demanding the other be broken. Fixed at the source: scripts/build-provider-registry.mjs runs its rendered output through Prettier before writing and before comparing. Never hand-format a generated file.

2026-07-12 — docs — The notes are the system of record (working-agreements §A0)

Owner: "look in the notes please — use them by default and grow accustomed to them by default." Written down as a hard rule, in both places an assistant actually reads: CLAUDE.md's Start Here is now an ordered session-start ritual (status.md → the latest session log → the plans//systems/ page for the area being touched), and working-agreements.md gains §A0 — notes read first, used as the default source of truth over any private/AI memory, written back in the same change. Also refreshed the CLAUDE.md notes index (it still said "there is no automated suite yet").

2026-07-12 — 2.59.0 — De-dup: the building-block catalog → engine/blockCatalog.js

The token cloud + the DPL autocomplete are engine domain: they describe the engine's own content pools, their folder categories, the virtual {#any} / {keyword} wildcards, the NSFW gate, and the naming rules. Nothing about that is a UI concern — the UI just renders what it returns. And it's a pure function of a loader, which is precisely why it could be shared: each target passes its own (runtimeLoader in the browser, metroLoader on the phone).

• targets/web/frontend/lib/promptEngine.js: 411 → 219 lines.
• targets/mobile/lib/blockCatalog.js: 218 → 33 lines (a hand-port with no drift check at all — the worst case, because nothing would have noticed the phone's palette falling behind the web's).

Replaced with a real test (tests/unit/blockCatalog.test.js, 9): the catalog's rules ({#any} leads, {salt} trails, {keyword} exists, NSFW hidden by default and additive when adult is on, expansion/ never listed), the completion flattening, and — the one a hand-port could never give you — that the phone never invents content the engine doesn't have.

Two things that test taught me, both worth keeping:

• I first asserted a byte-identical catalog across the two loaders. It failed on {#beach-merk}, and my instinct was "mobile is missing a block". It wasn't: that's the repo-root user/ overlay, a desktop-only content pool (the phone's user content is its on-device Manage overlay). The test was wrong, not the app — so I asserted the real invariant rather than weakening it until it passed.
• The comparison then failed intermittently because metroLoader carries a module-level runtime overlay and a sibling suite left one installed. Reset it in beforeAll; run the suite twice to prove it's order-stable.

Also: 43 coverage artifacts had been committed in 2.58.0 (targets/mobile/coverage/ wasn't gitignored, though the Node and web ones were). Untracked and ignored.

2026-07-12 — 2.58.0 — The mobile app was never in CI. Now it is (with press tests + coverage gates).

The biggest finding is what wasn't there. The mobile jest suite, the web⇄mobile parity gate, the capability-gating check, the no-caps check, the engine/metro parity check — none of them ran in CI. Every gate built during this campaign was enforced only on my machine, by me, when I remembered. A gate you don't run is not a gate. There is now a mobile CI job: metro parity → mobile parity (surface + gating + no-caps) → jest with a coverage gate → Codecov upload under its own flag. The check job also gained check:registry (a provider or theme added without regenerating would silently vanish from every target).

Press tests (working-agreements §B2). The Single view had 25 interactive controls and 3 presses; Gallery had 9 and 2. Render-only assertions cannot catch a dead control. Now: 122 tests (was 110), with Single's back/prev/next/delete/viewer/share/save all pressed and asserted on their real effect, and Gallery's multi-select → select-all → delete flow pressed end-to-end and asserted on the storage call — a Delete that clears the UI but never touches disk would pass any render test and lose nothing… until the user reopens the app and finds everything still there.

Two real defects fell out of writing them:

• Gallery cells had no accessible name. A screen-reader user heard "button, button, button" and could not tell one image from another, or select the right one. (axe missed it because the test device's gallery is empty — no cells to scan.) Cells are now named by the prompt that made them, and announce their selected state.
• Single's action buttons were bare glyphs (⤢ ⤴ ⤓ ✕), so a screen reader announced "⤢". Named.

Coverage gates, set as a floor just below the measured truth (58.8% stmts / 49.4% branches / 54.9% functions / 61.9% lines over all mobile source, not just the files tests happen to touch) so a real regression fails CI without flaking on churn. Raise as coverage grows.

50 visual baselines committed (5 surfaces × 5 sizes × both colour schemes), verified green on a clean re-run. They're -win32 only, so CI runs a11y + perf and visual stays a local gate until Linux baselines exist — the same convention the web suite already follows. Stated in the workflow rather than quietly skipped.

2026-07-11 — 2.57.1 — The web build was BROKEN on dev for four commits. Verify what you commit.

engine/listEditorOps.js was moved out of the web target in 2.55.0 and the old file deleted — but ManageListEditor.jsx still imported the deleted path. dev did not compile:

[UNRESOLVED_IMPORT] Could not resolve '../lib/manage/listEditorOps.js'
  in frontend/components/ManageListEditor.jsx

Four commits (2.55.0 … 2.57.0) shipped that way, and every gate I ran reported green. Of course it did: a multi-path git add silently staged 13 of the 17 files I listed, so the importer fixes stayed on disk — and npm test, the build and the parity checks all read the working tree. The committed tree, which is what CI and every other clone sees, was broken. Caught by checking out HEAD into a clean git worktree and building it: it failed on the first try.

A working tree is not evidence. New gate: npm run check:committed fails when any tracked source file still differs from HEAD, so "the suite is green" can no longer be claimed over an uncommitted fix. Recorded as working-agreements §B3a and two fix-pattern rows. (Second row earned the hard way: I'd junctioned node_modules into the throwaway worktree to skip a reinstall, and git worktree remove --force followed the junction and emptied the real one — nothing lost, it's derived, but both packages had to be reinstalled.)

Also lands the rename sweep: GitHub owner junebug12851 → 1fairyfox across every current-state file (workflows, README, CONTRIBUTING, credits, doc-site theme, sonar config, ComfyUI target, engine copyright lines). Dated history — sessions, changelog, fairyfox reports — is deliberately left intact: it records what was true on the day.

2026-07-11 — 2.57.0 — The app was capping the user. It shouldn't. Caps removed.

The owner's correction, and it's the important kind — a design principle I'd quietly inverted:

"Nowhere in my app does it limit the user… It only officially supports with no performance loss those numbers, and beyond that hope for the best. If it supports numbers that high then it'll support much higher numbers before problems increase."

1000 prompts / 100k gallery / 100k-line editor are levels the app supports without degradation — a promise about behaviour, not permission. The app never tells the user "no." The code had forgotten that in three places, and my new count field had just made it worse:

All gone. The floor stays (≥ 1, whole prompts) because that's validity, not a limit.

And the tests were defending the bug. expect(len(999)).toBe(50); // capped — an assertion that enshrines a defect as a specification and makes the fix look like a regression. That's how it survived. They now assert the opposite, and the engine backs it up: measured 1000 → 257 ms, 5000 → 869 ms, 25 000 → 3.9 s, all produced in full and linear (0.16 ms/prompt — cheaper per prompt at 25k than at 1k). Exactly as the owner said: if it does 1000, it does far more.

New fix-pattern row: a test that asserts a bug is the bug's best defender.

2026-07-11 — 2.56.0 — The shuffle control was missing on mobile (found by LOOKING)

Ran the visual harness and actually looked at the screenshots — the standing rule (working-agreements §B3) that had never been honored for the mobile app. It found, in one glance, a defect that every automated check had passed:

The Generate toolbar's 5th slot held a second building-blocks button — same icon, same setPaletteOpen(true) handler as the green FAB right below it. So mobile had a redundant control and was missing the web's SHUFFLE control entirely (drop the rotating random suggestion into the box). That's a feature loss, which the parity mandate forbids outright.

Why nothing caught it. The surface-parity marker for it was /suggestion/ — which matched the caret completion strip's suggestions array, a completely different feature that happens to share the word. A marker satisfiable by an unrelated identifier is worse than no marker: it buys false confidence. (My first fix, /ShuffleIcon/, was wrong the same way — the import line satisfies it even with the button deleted. The marker now matches the wiring: /onPress=\{useSuggestion\}/, and I proved it by deleting the feature and watching the gate go red.)

Restored to full web parity: the rotating random suggestion (re-rolls every 5s), the Try: … placeholder advertising it, and a shuffle button that appends it — locked (not error-on-press) while no suggestion exists, like every other capability-gated control. The FAB is now the one and only blocks control. Regression-tested (3 tests) and proven by re-introducing the bug (2 fail → restore → 10 pass).

And the harness itself was broken in two ways, which is why the shots went unreviewed:

• spawnSync("npx.cmd") can't exec on Windows without shell: true, so every run silently degraded to "can't capture visual parity". A broken tool must never look like a skipped step.
• It only ever captured the light scheme. Theme mode defaults to "system" (web and mobile — that's parity, not a bug) and a headless browser reports light, so the app's PRIMARY look — the dark canvas the design tokens are built around — was literally never rendered. Now both schemes are shot (--scheme=light|dark), and a pageerror listener reports a crashed render instead of quietly saving a white PNG.

That listener earned its keep immediately: my first cut of the fix put useRef(settings) above const settings = useMemo(...), a temporal-dead-zone ReferenceError that blanked the entire app — and all 108 unit tests still passed, because they mock the engine and never exercise the real declaration order. Only the screenshot saw it. Both landmines are in fix-patterns.md.

2026-07-11 — 2.55.0 — De-dup Phase E: list ops → engine, accent themes → shared

Two more mobile hand-ports promoted, and two more drift checks deleted with them (five of the seven are now gone).

listOps.js → engine/listEditorOps.js. Sort / dedupe / AI-candidate parse operate on list content, which is engine domain — "what counts as a duplicate entry" is a property of the engine's lists, not of any one UI. The web owned the file and mobile carried a byte-for-byte copy, policed by checkListOps. Both Manage editors now import the engine module; the copy, its duplicate unit test, and the check are deleted.

Accent themes → targets/shared/theme/. The nine theme JSONs moved out of the web target, and the generator (scripts/build-provider-registry.mjs) now also emits theme/presets.generated.js — the theme DATA inlined as plain JS (a bare JSON import needs an import attribute in Node but not in Vite/Metro; inlining sidesteps the disagreement entirely). Same root cause as the providers, third time: the web discovered the themes with a Vite import.meta.glob Metro can't run, so mobile transcribed all nine accents by hand. Now both read one source — themeData.js went 82 → 24 lines and checkAccents is gone. gen-accents.mjs still emits a byte-identical accents.css (only its source path moved), and the web build dropped 698 → 690 modules as the nine JSON modules collapsed into one.

checkLocales no longer imports the mobile module (it reads the source text) — plain Node can't resolve Metro's bare shared/ alias. The parity script's header now lists exactly which copies the two surviving drift checks guard, so the next promotion is obvious.

Verified: mobile 105/105 (19 suites) · web 430 · unit 352 · surface parity 22/22 · metro parity PASS · build 690 modules · accents.css unchanged · lint 0 errors.

2026-07-11 — 2.54.0 — De-dup Phase C/D: mobile now IMPORTS the providers (the hand-port is gone)

The 892-line mobile provider hand-port (targets/mobile/lib/imageProviders.js) — which re-declared all ~40 providers and re-implemented their transports (submitPoll, localPostJson, fetchWithTimeout, a proxy shim) — is deleted. In its place: a 268-line adapter over the shared registry, with zero provider or transport logic of its own. It derives the three role lists from the same manifests the web uses, applying the web's rules verbatim (image = copy-prompt or tier: "api" + loadGenerate; text = rewrite-capable; upscale = capabilities.upscale + loadUpscale), and dispatches generate/rewrite/upscale straight into the shared provider code.

Three things had to be true first, and all three are now:

• The registry is importable under Metro (2.53.0's generated static index).
• The transport is injectable (2.53.0). Mobile calls configureMobileTransport(backendUrl) at boot and whenever the Backend URL changes: absolute base for our own /api/… (a phone has no origin), local servers called directly (RN has no CORS, so the web's /api/forward hop would wrongly demand a backend), and a fetch timeout (RN's fetch has none). Added callRewriteProxy so /api/rewrite — the last hardcoded relative fetch, in the web's lib/rewrite.js — goes through the same seam.
• The settings-schema mismatch is resolved by preloading, not by an async UI. The manifests expose settings asynchronously (loadSettings(), code-split for the web's gear). Mobile preloads every schema once at boot and resolves the async option sources (samplers/schedulers/models) into concrete arrays, so the UI stays synchronous — on a phone the bundle already ships everything, so lazy-loading buys nothing and an async gear would be strictly worse.

cleanDplOutput (DPL reply cleanup — engine-domain) moved to shared/_shared/rewriteSystem.js beside systemFor; the web re-exports it. Provider keyHint joined description/keyUrl on the manifests.

Phase D — retired the drift checks the duplication had made necessary. checkProviders, checkRewriteSystems and checkLocalSettings are deleted from scripts/mobile-parity-check.mjs: they compared mobile's copy against the web source, and you cannot drift from yourself. checkSurfaces STAYS — it asserts the mobile UI exposes every web feature (the full-parity mandate), which no amount of code-sharing guarantees. The script's header now spells out the difference so nobody re-adds them.

Replaced by a real contract test (targets/mobile/lib/__tests__/imageProviders.test.js, 17 tests): the derivation rules, labels/descriptions coming from the manifest, real schemas + resolved sampler options, serverKey derived from the provider's own URL field, the transport config, and the rewrite dispatch (browser-direct → its own API; proxied → the Backend URL). One visible behavior change, and it's a parity FIX: local providers now show the web's label ("ComfyUI"), not the mobile-only "ComfyUI (local server)" — the picker already groups Local/Online.

Test infrastructure: Jest needed moduleNameMapper for shared/* (mirroring Metro's alias) and babel-plugin-dynamic-import-node in the test env only — Jest's CJS VM throws on a native import(), which is exactly how the manifests lazy-load. Root Vitest got the matching shared alias.

Verified: mobile 110/110 (20 suites) against the REAL shared registry · web 430 · unit 352 · surface parity (Manage 22/22) · metro parity PASS · build 698 modules · lint 0 errors.

2026-07-11 — 2.53.0 — De-dup Phase B: ONE provider registry for every target

The provider pool (targets/shared/<id>/) is a drop-a-folder-in plugin pool, which needs discovery — and each runtime discovers differently: Vite has import.meta.glob, Node has fs.readdirSync, and Metro has neither (it resolves a static module graph, with no filesystem at runtime). So the same 40 provider folders had grown three registries: the Vite glob in shared/index.js, an fs-discovery re-port in the CLI (which also re-implemented applySharedSettings), and — because Metro can do neither — an 892-line hand-port in the mobile target that re-declared every provider and re-implemented the transports. Three copies of one truth, free to drift; the parity checks existed to detect that drift rather than remove it.

Replaced all three with a generated static index — targets/shared/registry.generated.js, plain import statements, the one form Vite, Node and Metro all understand (scripts/build-provider-registry.mjs; npm run registry to regenerate, npm run check:registry in npm test fails if it's stale, so drop-a-folder-in still needs no central edit). shared/index.js is now runtime-agnostic — no import.meta.glob, no import.meta.env, no node: imports — which is precisely what let the other targets import it instead of forking it. The one web-only concept, online-build gating, moved out to the web shim (lib/providers/index.js), which binds providersFor(online) to VITE_ONLINE; the SPA's zero-arg availableProviders() / getProvider() API is unchanged. The CLI's registry dropped from 145 lines to a thin async facade over the shared one (−111 lines, and its duplicate applySharedSettings is gone).

Verified on all three runtimes: local web build 697 modules, online build + SSR prerender green, prompt list providers 40 (settings fold intact through the CLI's JSON loader hook), web 419 tests, unit 352, lint 0 errors.

2026-07-10 — Mobile parity Phase 1b: Single view two-pane on tablet

The Single (image detail) view now goes two-pane on tablet (web parity): the image becomes a ~44% left column beside the metadata (prompt layers, details, keywords, derived strips) instead of a full-bleed image stacked over it; phones keep the single stacked column (the wrappers are layout-neutral there — no phone regression). Uses useResponsive().twoPane; the media/meta split is a plain flex row. This completes the per-screen tablet layouts (Generate/Manage/Single centered or two-pane; Gallery full-width grid) — no feature is hidden at any size. test:mobile 80/80, lint clean.

2026-07-10 — Mobile parity Phase 4: strict Manage surface gate ON

With the Manage port complete, the Manage surface is now in the strict parity gate — 22 markers, one per web Manage capability (two roots, folder tree, block editor DPL/Insert/Refine/Modify-Draft/Cleanup/JS/ NSFW/description/rename/delete, list Entries-Raw/Sort/Dedupe/AI-Expand/description, built-in browse + override, runtime overlay). A missing feature now fails the build (no per-feature ignores), exactly like the other surfaces. mobile:parity green (Manage: all 22 present), test:mobile 80/80, metro:parity PASS. The mobile Manage is now at feature parity with the web to the platform-allowed extent (on-device user overlay + read-only built-ins; the SFW build strips NSFW as before).

2026-07-10 — Mobile parity Phase 3h: built-in catalog browse + override

The Manage screen gains a Built-in catalog section — a searchable, read-only browser of the baked catalog (components/BuiltinBrowser.js, reading metroLoader directly). Since built-ins can't be edited in place on device, each entry offers Override: copy its source into the editable user overlay (readBlockSource for blocks, readListLines joined for lists) where it wins over the built-in, then open it in the editor — the web's "Create override". Search-gated so the 89-block/88-list catalog renders nothing until queried. New component test (virtual-mocked engine). test:mobile 80/80, parity green.

2026-07-10 — Mobile parity Phase 3g: block editor Refine + Modify/Draft (AI DPL modes)

The Manage block editor gains the web's AI DPL controls: a Refine bar (Detail / Complexity / Focus / Intensity / Variety −/+ steppers + Cleanup) and Modify (dpl-custom) / Draft (dpl-create) with a free-text input — each runs the selected Text provider on the DPL and replaces the source (busy state, markdown-fence stripping via cleanDplOutput). Ported DPL_PRIMER + DPL_TASKS (13 modes) VERBATIM into the mobile systemFor, plus a new parity-gate step (checkRewriteSystems) asserting systemFor() is byte-identical to the web rewriteSystem.js for all 17 modes — so the prompts can't drift. New tests (Refine + Draft). test:mobile 77/77, parity + metro green.

2026-07-10 — Mobile parity Phase 3f: list editor AI Expand

The Manage list editor gains AI Expand — samples up to 25 existing entries, asks the selected Text provider for 25 fresh ones in the same vein, and merges in only the net-new (via the parity-locked listOps parse/merge). Reuses the mobile rewrite provider wiring (getTextProvider + getKey + per-provider settings/backend), and systemFor("expand") now returns an EXPAND_SYSTEM ported verbatim from the web rewriteSystem.js. Handles no-provider / no-key / no-entries / only-dupes with clear status. New test (mocked provider). test:mobile 75/75, parity green.

2026-07-10 — Mobile parity Phase 3e: block editor Insert menu

The Manage block editor gains the web block editor's Insert control by reusing the existing mobile InsertMenu (the DPL-syntax bottom sheet — structure/chance/choose/repeat/flow/emphasis/code with live re-rolling examples): picking a construct appends its snippet into the DPL source. Component tests stub InsertMenu (it pulls the engine, not jest-resolvable). test:mobile 74/74.

2026-07-10 — Mobile parity Phase 3d: runtime overlay (custom content feeds generation)

The Manage overlay is now live — custom lists + block generators actually feed prompt generation, not just persist. metroLoader gained a runtime user overlay (setMetroOverlay) consulted user-wins across readListLines / listNames / readListMeta / loadBlock / blockNames / readBlockMeta (+ a readBlockSource for future override); it defaults EMPTY so metro-parity-check (which never populates it) stays identical — metro:parity still PASS (89 blocks / 88 lists / 150 seeded gens identical). New mobile lib/overlay.js reads the whole on-device overlay (nested) from storage and installs it via setMetroOverlay; App.js calls it at startup and ManageScreen after every edit, so {name} / {#name} draw from the user's own content immediately. (Platform limit: an overlay block's .js sidecar body can't execute on device — no runtime require/eval — so insert js: yields "" there; the .dpl runs.) New unit test (virtual-mocked engine); the two component tests mock the overlay away (engine isn't jest-resolvable). test:mobile 74/74.

2026-07-10 — Mobile parity Phase 3c: list editor description + Entries/Raw tabs

The mobile Manage list editor gains two more web-parity pieces: a description field (persisted to the .json sidecar via the Phase-2 readUserSidecar/writeUserSidecar) and an Entries ⇄ Raw tab pair — Raw edits the whole file as text, re-parsing back into rows on switch/save. Save now writes both the file (entries or raw) and the description sidecar. Tests cover the description load + the Raw switch. test:mobile 72/72, parity + metro green.

2026-07-10 — Mobile parity Phase 3b: Manage folder tree

The two-root Manage master is now a nested folder tree (the web Manage's tree, RN form). New components/ManageTree.js renders readUserTree output — collapsible folder nodes with entry counts + a delete action, and tap-to-open entries with a kind dot / JS badge / delete. ManageScreen feeds it readUserTree("blocks") + readUserTree("lists"); folders are created implicitly by naming an entry folder/name (sanitized per segment; storage makes the parent dirs), and folder headers delete the folder (recursive). New ManageTree component tests + updated screen tests. test:mobile 71/71, parity + metro green.

2026-07-10 — Mobile parity Phase 3a: Manage gains block/generator editing (two-root)

The mobile Manage was lists-only; it now has the web's second root — Blocks (custom DPL generators). New components/DplMiniEditor.js (a reusable line-numbered monospace DPL editor, same shape as the Generate composer's box) and components/ManageBlockEditor.js (name + rename, description, NSFW flag, DPL source, optional JS sidecar view/edit/create, save, delete) — built on the Phase-2 storage overlay. ManageScreen is now a two-root master/detail (Blocks + Lists) that creates/opens/deletes both and routes to the block or list editor. New component tests for the block editor + the block flow; test:mobile 66/66, parity + metro green. Remaining Manage layers (folder tree + folder editor, built-in browse, override/restore, Insert/Refine/ Modify-Draft, list Raw tab + AI-Expand, runtime overlay, strict gate) are tracked in notes/plans/mobile-parity.md — sequenced, not dropped.

2026-07-10 — Mobile parity Phase 2: Manage data layer + list-editor Sort/Dedupe

Foundation for the full RN Manage port. lib/storage.js gains the on-device user-content overlay (RN counterpart to web user/lists + user/blocks): user blocks CRUD (.dpl), .js/.json sidecars, nested folders (recursive walk), a readUserTree builder mirroring the web Manage tree model, and folder create/delete + entry move/rename (10 unit tests, in-memory FS). The list editor's Sort and Dedupe land via a new lib/listOps.js — a faithful port of the web listEditorOps.js (sort, dedupe, AI-candidate parse/merge) — wired into the Manage list editor with a status line. A new parity-gate step (checkListOps in mobile-parity-check.mjs) asserts the ported ops stay behaviorally identical to the web source (5/5 cases), so they can't drift. test:mobile 60/60, parity + metro gates green.

2026-07-10 — Mobile parity Phase 1a: tablet content layouts (Gallery grid + centered columns)

First slice of the responsive/tablet work (no size-based feature loss): the Gallery now fills the full width on tablet/wide with a larger cell target (was capped at 900px, leaving dead space) — phone sizing is byte-identical, so no phone regression. Reading/editing surfaces (Generate, Single, Manage) get the web's centered max-width reading column on tablet via a new components/ContentColumn.js (RN counterpart to the web's .main-col > * { max-width: 960px }), wired in App.js; the Gallery grid opts out and uses full width. ContentColumn renders its children at both phone and tablet sizes (component test guards the "same content at every size" invariant). test:mobile 46/46.

2026-07-10 — Mobile⇄web full-parity campaign: Phase 0 (audit + responsive foundation)

Kicked off the mandated push to complete mobile↔web parity (no exceptions, no size-based feature loss, gate-enforced; the SFW/NSFW split stays a build variant, not a feature drop). Combed every mobile surface against the web and wrote the authoritative gap audit + phased plan (notes/plans/mobile-parity.md; standing instruction strengthened in notes/systems/mobile.md). Phase-0 code, all green: the visual-parity harness (scripts/mobile-visual-parity.mjs) now captures the full phone→tablet size matrix (360/390/430 + tablet 834/1112) into per-size folders with a --size= filter; a new lib/responsive.js (useResponsive(), breakpoints mirroring the web tiers, two-pane + capped reading column) with unit tests lays the foundation for per-screen tablet layouts; and the jest FlashList mock now keys its empty element (kills the ManageScreen "unique key" test warning). test:mobile 44/44, parity gates green. The big items (full RN Manage port, per-screen tablet two-pane, strict Manage gate) are the following phases.

2026-07-10 — Fix the Manage tab's phone editors (right pane)

A web-vs-mobile audit of the Manage tab (code + live screenshots at 360/390/768) turned up three right-pane editor bugs on the phone layout, all fixed in one mobile-only @media (width <= 768px) block in manage-responsive.css (scoped to .workspace.manage, so desktop + the Generate composer are untouched): (1) the block editor's absolutely-pinned Modify / Draft combo overlapped the DPL code — its .cm-content top-gutter is silently overridden by CodeMirror's own padding, and the narrow pane let wrapping code run under it; on phone it now un-pins to a right-aligned row above the editor, with its popover floated to a full-width bottom sheet (reusing the mobile-sheets.css pattern) so overflow: hidden can't clip it. (2) The editor head was a nowrap row that squeezed the name field to ~21px — it now wraps, name field full-width. (3) The list tools row squeezed the entries search to ~24px — same wrap fix, search full-width. The master tree, list rows, and folder editor were already fine. Added two Playwright regression tests in tests/e2e/responsive.spec.js. CSS + test only, mobile-scoped (no desktop visual-baseline churn). PATCH.

2026-07-10 — Address CodeRabbit review across the mobile target (2.52.0)

Worked through the mobile-app review findings so the 2.52.0 PR's conversations resolve on merit:

• Stability/timeouts: a shared fetchWithTimeout (AbortController + 120s, merges any caller signal) now backs every network call in lib/imageProviders.js; lib/storage.js races remote downloadAsync against a 60s timeout so a stalled https: source can't hang saveImageSrc; lib/keys.js setKey returns a success flag and the BYOK key field warns on a failed keystore write instead of looking saved.
• Error handling: GalleryScreen surfaces a load failure with a Retry (no more infinite "loading…") and wraps deleteSelected; SingleScreen doConvert gained the busy guard + serialization its doResize/doUpscale siblings already use.
• Correctness: GenerateScreen insert-menu / block-palette tokens now target the active field (Prompt or Negative), and result-row ids use a monotonic per-click batch counter so a fixed promptSeed can't collide ids and misattribute images across rows; the "Rewriting…" status always clears on the copy/no-provider path.
• Polish: ComfyUI batch_size floor-clamped to ≥1 (parity with the WebUI path); custom list names disallow / (they wouldn't round-trip in the flat lists dir); index.js uses an explicit ./App.js import extension.

2026-07-10 — CodeRabbit review: harden mobile-parity tooling + metroLoader test

Addressed the CodeRabbit review items on the release-hardening code itself. The visual-parity dev server now guards decodeURIComponent (a malformed escape like /% no longer crashes it before the fs try blocks); build-metro-catalog.mjs derives generated .js import specifiers from the OUTPUT file's directory (so a custom --out resolves correctly) instead of a hardcoded ../data/blocks/; and tests/mobile/metroLoader.test.js tightened its known-value assertions (toBeTruthy + explicit object-or-null / never-undefined checks) so a loader regression returning undefined can't slip past not.toBeNull() / not.toThrow().

2026-07-10 — Release-harden 2.52.0: use the CodeQL-recommended path-traversal sanitizer

Follow-up to the traversal fix: containment guards (ternary, then early-return startsWith) were both logically correct but CodeQL's taint tracker still saw req.url-derived data reach statSync/ readFileSync and kept the 3 high js/path-injection alerts. Switched to the exact sanitizer form the js/path-injection help recommends — normalize() the request, strip any leading ../ / ..\ segments, then join under OUT — which CodeQL recognizes as sanitizing. Verified every traversal variant (raw, ..%2f, %2e%2e, interior ../) stays inside the served directory; normal assets resolve unchanged.

2026-07-10 — Release-harden 2.52.0: remove mobile dead code + align test assertions

Cleared the CodeQL "unused" notes and SonarCloud Reliability/Maintainability findings that blocked the 2.52.0 release PR — real cleanup, no gate-silencing. Removed 8 unused imports/variables in the mobile target (App.test.jsx top-level Text, BlockPalette.test.jsx an unused getByText destructure, GenerateScreen.test.jsx waitFor, lib/icons.js G, GenerateScreen.js ShuffleIcon, SingleScreen.js TextInput + promptText imports + the upscaleProvider theme destructure). In tests/mobile/single.test.js, aligned the three numeric detail assertions (Steps/CFG/Seed) with the string-valued Object.fromEntries map Sonar infers, and switched toBe(null)/.length).toBe() to the dedicated toBeNull/toHaveLength matchers.

2026-07-10 — Release-harden 2.52.0: earn metroLoader Node coverage (race-free)

Reverted the engine/core/metroLoader.js coverage exclusion (silencing a real gap) and instead EARNED its coverage with tests/mobile/metroLoader.test.js — exercises every accessor and proves the loader drives createEngine byte-identically to nodeLoader; metroLoader.js is now measured (~87%) rather than hidden. Only the generated, gitignored engine/core/metroCatalogData.js stays excluded (data, not logic), and it's now also excluded from Sonar analysis/coverage/duplication so the CI-built blob isn't scanned. Made the parity check deterministic by moving the catalog build + a clean-state snapshot of nodeLoader's names and parity generations into a Vitest globalSetup (tests/setup/metro-catalog.globalSetup.js), captured before any worker spawns — so it can no longer race manageFs.test.js's transient shared-FS fixtures or a concurrent-read scan miss on Windows.

2026-07-10 — Release-harden 2.52.0: fix path traversal in the mobile visual-parity server

CodeQL flagged three high-severity "uncontrolled data in a path expression" alerts in the mobile visual-parity dev server (scripts/mobile-visual-parity.mjs): req.url flowed straight into join(OUT, …) → statSync/readFileSync with no boundary check, so GET /../../etc/passwd could escape the served directory. The server now resolves each request under an absolute OUT_ROOT and rejects anything that leaves it (falling back to index.html), blocking raw and URL-encoded (..%2f, %2e%2e) traversal while normal asset paths resolve unchanged.

2026-07-10 — Mobile: full Single-view parity + first automated test layer (2.52.0)

MINOR milestone. Rounds out the mobile (Android/Expo) target to web parity on the Single view and stands up its first automated tests. See the detailed entries below; in brief: SingleScreen rebuilt to full parity with the web SingleView (nav, layered prompt/negative, inline re-roll/variation, convert/ resize/upscale, lineage + derived strips, details/raw-JSON/copy, keyword cloud), the Generate/Gallery parity gaps closed, and a jest-expo + React Native Testing Library suite (64 tests) covering every mobile screen, menu, and lib module — wired into npm test (test:mobile). targets/mobile excluded from the root ESLint + Prettier (Expo owns its own toolchain), matching targets/web.

2026-07-10 - Mobile: component tests for every screen/menu + lib unit tests

Completed the mobile automated test layer to the web suite's "every module covered" bar. 64 mobile-specific tests, all green:

• Component (jest-expo + RNTL, 40 across 10 suites): App shell (tabs + ⋯ overflow), SingleScreen, GenerateScreen, GalleryScreen, ManageScreen, OverflowMenu (three-role picker / appearance / language over the real registry), InsertMenu (DPL construct drill-in + insert), BlockPalette (search + groups + chip insert), plus lib keys (secure-store) and storage (file-system index).
• Unit (root vitest, 24 across 2 files): lib/single.js (16) and lib/imageProviders.js registry / defaults / systemFor / structural invariants (8).
• Added accessibilityLabels to the remaining icon-only buttons (App ⋯) — a11y parity + test handles. jest.setup mocks safe-area (useSafeAreaInsets), status-bar, and FlashList (header + rows + empty).

2026-07-10 - Mobile: component tests extended to Generate / Gallery / Manage

Grew the jest-expo + RNTL suite from Single to every screen (20 tests, all green): GenerateScreen (composer renders, rolling fills the results feed, the gear opens the full settings sheet, live preview), GalleryScreen (header/count/search/select/refresh/composer, search filter, multi-select, empty state), ManageScreen (lists master view, create-opens-editor, open windowed editor, delete, empty state). Added accessibilityLabels to the icon-only buttons exercised (Generate, Prompt settings, Toggle live preview, Generate-here) — an a11y-parity gain with the web's aria-labels as well as test handles. The shared FlashList test mock now renders ListEmptyComponent, and the safe-area mock exports useSafeAreaInsets.

2026-07-10 - Mobile: jest-expo + RNTL test harness; component + helper tests

Stood up the mobile target's first automated test layer (it had none) to the bar of the web suite — real component tests that mount the actual RN screens (the Android code path) through the jest-expo renderer with native modules mocked:

• Harness: jest-expo preset + @testing-library/react-native + pinned react-test-renderer (19.1.0, matching React 19.1.0); jest.setup.js mocks the native leaves (expo-image, FlashList, expo-file-system/legacy, expo-image-manipulator, expo-media-library, expo-sharing, expo-clipboard, expo-secure-store, safe-area-context). Run via npm --prefix targets/mobile test, wired into root npm test as test:mobile.
• Single component tests (screens/__tests__/SingleScreen.test.jsx, 7): mounts the real screen and asserts nav/position/tools render, the layered Prompt+Negative cards render from metadata, the details table renders, the keyword cloud fires search, inline Re-roll fires the provider's generate adapter, Back invokes its callback, and the empty state shows.
• Single helper unit tests (tests/mobile/single.test.js, 16, root vitest): layer normalization (enriched + legacy), buildDetails, parseKeywords, linkChildren, sizeFromSettings, toMarkdown, searchHaystack.
• Excluded targets/mobile/** from the root ESLint (Expo has its own toolchain), matching targets/web/**.

2026-07-10 - Mobile: Single view rebuilt to full web parity; Generate/Gallery gaps closed

Comprehensive web-to-mobile comparison of the remaining surfaces (SingleView.jsx + its subcomponents, PromptComposer, Gallery), then brought the mobile app to parity:

• Single (screens/SingleScreen.js, rebuilt): prev/next nav + position, open-full viewer, share (expo-sharing) / save-to-Photos (expo-media-library) / delete overlay actions, Convert (format) + Resize (scales) + AI Upscale via expo-image-manipulator, lineage header + parent link, derived-children strips (re-rolls / variations / resizes) with in-flight placeholders, the prompt and negative each in Sent/AI/Roll/DPL layers (copyable, with inline Re-roll / Make-variation), a curated details table with raw-JSON toggle + Copy Markdown/JSON, and a clickable keyword cloud (AI rebuild + gallery search). New lib/single.js holds the pure layer/keyword/details/lineage/markdown helpers; lib/storage.js now records the full sidecar (layers, negative, seed, size, settings, lineage) so the above populates.
• Generate (screens/GenerateScreen.js): negative-prompt tab (provider-gated), inline Images/Size controls, a Wrapper modal that frames each rolled prompt via the shared engine (buildRoll parity), and per-prompt "Generate images" with inline thumbnails.
• Gallery (screens/GalleryScreen.js): compact composer atop the grid with pending placeholder tiles; keyword taps from Single land here pre-filtered.
• Mandatory gate (scripts/mobile-parity-check.mjs): added a Single surface with 24 feature markers (no per-feature ignores) alongside Header 12 / Generate 16 / Gallery 9; all green. Web + iOS Metro bundles build clean.

2026-07-09 - Mobile: automated web-parity check (ported catalogs)

Answering "how do we test parity": added scripts/mobile-parity-check.mjs (wired into npm test + npm run mobile:parity) that asserts every catalog the mobile app copies from the web still matches the web SOURCES, so drift fails CI:

• Accents — themeData.js ⇄ theme/themes/*.json (ids + swatch + dark/light tones).
• Locales — themeData.js ⇄ i18n/config.js (the real locale is a registered web locale).
• DPL insert categories — dplInserts.js ⇄ web dpl/dplInserts.js.
• Image providers — imageProviders.js ⇄ shared/*/config.js (each mobile provider is browser-direct on the web, so it can actually run without a backend; the check also reports browser-direct image providers not yet wired on mobile — currently leonardo).

To make the data importable in Node, the accent/locale DATA moved to an RN-free lib/themeData.js that theme.js re-exports. This complements the existing engine parity (metro-parity-check.mjs, proving the mobile catalog output == the Node loader) and the manual Playwright-at-390px visual comparison. Three layers now: engine/data parity (automated), ported-catalog parity (automated, new), visual/UX parity (screenshot).

2026-07-09 - Mobile: Gallery rebuilt for web parity — search, multi-select, bulk delete, metadata

Full comparison of the mobile Gallery against the web (Gallery.jsx + photo-gallery.css, read in full). The mobile gallery was a bare grid; brought it to parity:

• Header: "Photo gallery" title + live count ("N images" / "· M matches"), a keyword Search (over the prompt + provider), a Select button, and Refresh — matching g-head.
• Multi-select: a selection action bar (N selected · Select all · Clear · Delete N · Done), per-cell selection ring + ✓ badge, long-press to enter select mode, bulk delete via storage.deleteImages.
• Metadata: images now save a prompt / provider / model record in images/index.json (the mobile analog of the web's per-image .json sidecars — one index so listing stays O(1) at the 100k max). saveImageSrc writes it, listImages merges it, delete prunes it; Generate passes the prompt/provider/model. This is what makes search and the Single-view details work.
• Single view now shows the image's prompt + provider/model.
• Empty ("No images yet") + no-match ("No images match …") states.
• 100k performance: the grid is a recycling FlashList of uniform square cells, and each cell is a memoized Cell (the web's <Thumb> pattern) taking selected as a boolean — so a single selection toggle re-renders only that one cell, not every visible one, and search/select stay smooth at the 100k max. The prompt metadata is a single index.json (not 100k sidecar reads) so listing stays O(1). Verified the header + empty state via web render (phone storage is a no-op there; the populated grid + multi-select need on-device images to see).

Two web features deferred (they're coupled): the compact composer atop the gallery (generate-in-place) and its pending placeholder cells — they need the composer extracted into a shared component, which is the next step for full parity.

2026-07-09 - Mobile: overflow menu rebuilt to match the web structure (rows → sub-menus)

Owner flagged the ⋯ menu had strayed — I'd expanded every control inline with big section headers, which the web doesn't do. Rendered the REAL web overflow (the targets/web build, Playwright at 390px) and matched it: a list of compact control rows — Providers ▾, ⚙ Provider settings, 🎨 Appearance, Language ▾ — each drilling into its own sub-menu, then the project links + legal pages + version (the folded-in LinksMenu). No features lost / no regression: the provider picker + BYOK key live in the Providers sub-menu; per-provider model / size now live in Provider settings (they were missing before); mode + accent in Appearance; locale in Language. The web's NSFW row is intentionally omitted — the mobile build is all-ages (owner's earlier call). Verified against the web render; the mobile overflow now matches it row-for-row.

2026-07-09 - Mobile: Providers + API keys — BYOK image generation into the Gallery

Third of the three overflow controls, and the image-generation milestone. Only the browser-direct BYOK providers work on mobile (no backend, like the online web build), so mobile ships those:

• lib/imageProviders.js: adapters ported from targets/web/shared//code/server.js for the browser-direct image providers — OpenAI (DALL·E / gpt-image), fal.ai (FLUX/SD3.5), Stability AI, Google Gemini. Each generate({prompt,key}) calls the provider API directly → {images} (data: or https: URLs).
• lib/keys.js: per-provider API keys in the OS keystore via expo-secure-store (web-safe no-op).
• lib/storage.js saveImageSrc: saves a data: / https: / file: image into the Gallery (base64 decode / download / copy).
• OverflowMenu: an Image provider section at the top — the provider picker + a secure API-key field (+ "Get a key" link) — the web ProvidersMenu + ProviderGear.
• GenerateScreen: when a provider + key are set, Generate rolls the prompts AND generates one image per prompt via the adapter, saving each into the Gallery (live "Generating i/N…" status + errors); with no provider it stays prompts-only. App bumps the Gallery via onGenerated.
• Ported OpenAI first (owner's pick). Verified the UI + an error-free bundle via web render; actual image output needs the owner's API key + on-device network to confirm (can't be tested from here). The hosted-proxy providers (most of the ~40) need the desktop backend and are intentionally omitted; NSFW stays off the Play build. Follow-ups: Leonardo (submit-poll), per-provider model/size gear.

2026-07-09 - Mobile: Language picker in the overflow (Auto / English)

Added the Language control to the ⋯ menu, folded in above the links like the web LinksMenu. Options mirror the web's real locale set — Auto (follow device) and English — persisted alongside the theme choice. English is the only fully-authored language on both web and mobile (the web i18n config ships only English + a dev en-XA pseudo-locale, which was skipped), so this is a real, persisted preference that a future translated catalog plugs into; it doesn't change the UI language today (a note in the menu says so). Second of the three overflow controls the owner picked; Providers + API keys (the image-generation milestone) is next.

2026-07-09 - Mobile: theming — System/Dark/Light + accent picker (the web Appearance control)

Built a real mobile theming layer (the counterpart to the web ThemeProvider + tokens.css) — the first of the three overflow controls the owner asked for:

• lib/theme.js: a ThemeProvider + useTheme() hook serving the semantic token object T for the current base (System follows the OS via useColorScheme; Dark; Light) and accent. Mirrors the web's dark + light palettes and all 9 accent presets (theme/themes/*.json: mint / teal / cyan / blue / violet / magenta / pink / coral / amber). The choice persists to the app's document dir.
• Every screen/component now reads const { T } = useTheme() and builds its styles via makeStyles(T) (memoized) — required because StyleSheet.create caches at module load, so theme-dependent styles must be built per-render. Memoized rows (ResultRow / LineRow) call the hook themselves so FlashList stays smooth (the context value is stable unless the theme changes). A mode/accent change re-themes the whole app live.
• components/OverflowMenu.js: the ⋯ menu now leads with an Appearance section — the mode segmented control (System / Dark / Light, with icons) + the 9-swatch accent grid — above the links, matching the web ThemePicker folded into the overflow.
• Verified via web export + Playwright: Dark + Violet recolored the tabs, editor, tools, generate button, and FAB together. Next of the three: the Language picker, then Providers + API keys (the image-gen milestone).

2026-07-09 - Mobile: header rebuilt to match the web (real logo, accent-strong tab, functional ⋯ menu)

Read the actual web header (App.jsx topbar, title-bar.css, view-switch.css, topbar-responsive.css, and LinksMenu.jsx) and matched it:

• Brand is the real app logo (the wordmark is hidden on phones, like the web), replacing the invented pencil square.
• View-switch active tab now fills with accent-strong (not plain accent) and the switch background is the input tone — matching view-switch.css.
• The ⋯ overflow was a dead button — it now opens the controls menu (components/OverflowMenu.js): the project links (GitHub, docs, fairyfox.io), the "get it" group (desktop app, self-host), the legal pages (Privacy/Terms/Cookies → prompt.fairyfox.io/legal/*, the origin referenced in the legal HTML), and the version — the web's compact LinksMenu folded into the overflow. Opens links via Linking. The Providers / NSFW / Theme rows will slot in here as those features land on mobile.
• Added the link icons (GitHub / Book / Home / Download / Server / Shield / FileText / Cookie / ExternalLink) to lib/icons.js.

2026-07-09 - Mobile: palette sub-tabs wrap, generate bottom-aligned, FAB clears the system nav

More on-device fixes:

• Palette sub-tabs still showed no text / wrong size — the horizontal ScrollView collapsed the pills on Android even with the items in a row View. Dropped the ScrollView entirely: the folder sub-tabs are now a wrapping row (like the web nav, which also wraps), which lays out reliably and shows every folder.
• Generate button now bottom-aligns with the tool-icon row (field bar alignItems: flex-end) instead of centering between the Prompts count and the tools.
• Blocks FAB now sits above the phone's system nav buttons — its bottom offset uses the safe-area bottom inset (useSafeAreaInsets) so it clears the Android navigation bar.

2026-07-09 - Mobile: Generate polish from on-device testing (sub-tab gap, wired +, generate alignment)

On-device fixes after owner testing:

• Palette sub-tabs / completion strip showed no text (collapsed buttons) — gap on a horizontal ScrollView's contentContainerStyle doesn't apply on Android (it works under react-native-web, which is why the render missed it), so the pills piled up at x=0. Wrapped the items in a row View (where gap works) in both the palette folder sub-tabs and the DPL completion strip.
• Gutter “+” is now interactive — appends a fresh line (was decorative).
• Field bar alignment — the round generate button is now pinned to the far right, separate from the left-aligned Prompts count + tool icons (which wrap as a left cluster).

2026-07-09 - Mobile: faithful Generate rework — DPL Insert menu, live preview, real Blocks/Lists palette + completion

Did the proper pass on the Generate tab by reading the actual web source (not the screenshot). Three things were conflated before and are now correct + faithful to the web:

• Insert ▾ is the DPL syntax menu (structure/chance/choose/repeat/flow/emphasis/code): a category→constructs drill-down where each construct shows its name, description, syntax, and a live example that re-rolls every second (ported dplInserts catalog + the compact InsertMenu). It inserts a DPL snippet, NOT a building block. (lib/dplInserts.js, components/InsertMenu.js.)
• The eye is a live preview that re-rolls the current prompt every second; a click toggles it (mobile has no hover). Was a one-shot before.
• Building blocks is now the real palette (components/BlockPalette.js) — a faithful port of the web getBlocks over the metroLoader (lib/blockCatalog.js, reusing engine/nameOrder.js + engine/gatedLists.js) plus foldersOf (lib/blockCategories.js): a search box, Blocks / Lists groups with counts, an All row + folder sub-tabs (scene/subject/style/…, artist/look/…), category hints, and insertable group-pills.
• NEW: DPL completion strip — typing a {…} / {#…} token surfaces matching blocks/lists to tap-complete (the mobile form of the web editor's autocomplete; getDplCompletions ported).
• lib/engine.js centralizes the shared engine run + expandOnce (clean example expansion). Verified via web export + Playwright (Insert menu, a drilled category with live examples, Blocks + Lists palette); no page errors.

2026-07-09 - Mobile: device-test fixes (safe-area, reliable editor, real Prompts count, tap targets)

On-device testing (owner) surfaced real issues; read the REAL web composer (components/PromptComposer.jsx) for true parity, then fixed:

• Status bar no longer covers the tabs: switched to react-native-safe-area-context's SafeAreaView (react-native's is a no-op on Android) so the top bar insets below the status bar.
• Prompt editor was garbled on-device (the highlight-overlay technique) - replaced with a plain monospace input (gutter + DPL ✓/✕ + preview/gear corner). Reliable; live syntax coloring can return later as a blur-swap.
• Removed invented settings (keywords min/max, include artists, random-each-time) - they aren't on the web composer face. The web puts Prompts-per-run as an editable count in the field bar (now mirrored), and the gear opens prompt settings (minimal for now). Auto-fix / keyword-translate tools are shown disabled (they need a text provider, which the mobile SFW build doesn't have) - matching the web.
• Touch glitches ("buttons click other buttons") fixed: dropped the transparent editor overlay and the hitSlop that made neighboring toolbar buttons' tap areas overlap.

2026-07-09 - Mobile: composer + pill-nav fidelity pass (react-native-svg icons) + web⇄mobile parity rule

Second pass tightening the mobile UI to the web phone layout, and recording parity as a standing rule:

• App.js: reworked the top bar to the web's one-row header - dark brand mark (mint pencil) + the enclosed pill view-switch (active tab green-filled) + a ⋯ overflow. Replaces the stacked brand-over-scrollable-tabs bar.
• screens/GenerateScreen.js: rebuilt the composer to mirror the web PromptComposer - an Insert ▾ dropdown, a code-editor prompt box (line-number gutter 1 + + {…} syntax highlighting via a highlight layer under a transparent input, a ✓ valid indicator + eye/gear icons), a PROMPTS count, a tool toolbar (wand · tag · brackets[active] · share · shuffle) + a round green generate button, and the bottom-left green building-blocks FAB.
• lib/icons.js (new): hand-written react-native-svg line-icons matched to the web icon set (added the react-native-svg dependency; Expo Go bundles it, so no native rebuild is needed).
• Standing rule: keep the mobile UI and the web UI in parity by default (see notes/systems/mobile.md).
• Verified via expo export --platform web → Playwright at 390px (Generate/Gallery/Manage) against the web reference render; no page errors. Runs on-device via Expo Go over the tunnel.

2026-07-09 - Mobile: reworked UI to match the web app's design (tokens + top-bar nav + composer)

Corrected the mobile UI to mirror the existing responsive web app (it already has a complete phone layout; don't reinvent it):

• Design tokens (targets/mobile/lib/theme.js) mirrored from the web foundation (styles/foundation/tokens.css): mint accent (#34e2a0, dark ink), canvas #1c1c1f, panels #232328, the real text/border colors, 14px radius. Replaces the invented blue/near-black theme.
• Top-bar navigation like the web SPA (brand + horizontally-scrollable view switch Generate/Gallery/ Single/Manage) - dropped the bottom tab bar and the top-right tab-name tag.
• Home = composer (prompt + Generate) + a building-blocks bottom sheet (the palette, grouped from the engine catalog: wildcards / expansion / fragment / prompt / scene / lists - chips insert {#name} or {name}) + virtualized results (newest on top, Prompts header + count + clear-all), matching Home.jsx.
• Single stacks image-over-details; Manage stays master/detail with a back control - all re-themed.

Verified: web render at 390px (screenshotted - mint theme + top-bar nav + working blocks drawer) + Android Hermes bundle (697 modules, 3.25 MB .hbc). No VERSION bump yet.

2026-07-09 - Mobile: full 4-tab app (Generate/Gallery/Single/Manage) built to the max-load bar

Turned the mobile PoC into the real 4-tab app (an earlier wrong assumption scoped mobile to just Generate; the phone HAS storage, so Gallery/Single/Manage all apply, backed by the filesystem):

• 4-tab shell (App.js): custom bottom tab bar; panes stay mounted so state/scroll persist on switch, like the web SPA. Screens under targets/mobile/screens/.
• Generate: editable prompt + quick-pick chips + settings (prompts/keywords/artists/seed) + batch generation via the shared engine. Results in a VIRTUALIZED FlashList with memoized rows (1000-prompt max).
• Gallery: recycling FlashList + expo-image (disk-cached, downsampled thumbnails, recyclingKey) over uniform cells - the RN equivalent of the web's windowed grid (100k-image max).
• Manage: windowed 100k-line editor - UNCONTROLLED per-line inputs write to a ref (typing never re-renders the list), FlashList virtualization, responsive filter, stable per-line ids for add/delete.
• Single: one image up close (expo-image). Storage (lib/storage.js): phone-local via expo-file-system, web-safe no-op so the react-native-web verification still renders.
• Deps: @shopify/flash-list, expo-image, expo-file-system, expo-media-library, expo-secure-store, expo-clipboard. Verified: web render of all tabs (screenshotted) + Android Hermes bundle (696 modules, 3.24 MB .hbc).

Honors the supported max load (100k gallery / 1000 prompts / 100k Manage) per notes/reference/performance.md

• decisions/architecture.md. Next: image generation (reuse targets/web/shared providers + SecureStore) to fill the Gallery; wire the Manage overlay into runtime generation. No VERSION bump yet.

2026-07-09 - Mobile: runs on-device (Expo Go), pinned to SDK 54, clean engine alias (copy removed)

Got the mobile PoC running on a real Android phone (Moto G Power, Android 16) via Expo Go, and cleaned up how the app pulls in the engine:

• Pinned to Expo SDK 54 (RN 0.81.5, React 19.1.0). create-expo-app defaulted to SDK 57, which the Play/App Store Expo Go cannot run - store Expo Go is pinned to SDK 54 (Expo policy, May 2026), so the phone showed "requires a newer Expo Go." Downgrading to 54 (expo install --fix) made it run.
• Clean engine link via a Metro alias (resolver.extraNodeModules: engine -> ../../engine) + watchFolders
  • nodeModulesPaths. No copy, no symlink/junction. Replaces the junction (broke on SDK 54 Metro) and the interim copy. App imports the engine as engine/.... Verified: web bundle 235 modules + runs on-device.
• Removed scripts/link-engine.mjs; setup is now just catalog. Added web (react-native-web/react-dom) + tunnel (@expo/ngrok) deps for verification + on-device connection.

Root cause of the resolution pain: the repo root is an ESM (type:module) package, which Metro will not resolve ACROSS - so plain ../../engine relative imports never worked; the alias resolves the real path and sidesteps it. Proper fix (engine as a workspace package) logged as a follow-up. Also fixed the local emulator boot (AVD had hw.gpu.enabled=no + 2GB -> swiftshader_indirect + 4GB, boots ~47s) but headless screencap hits a host-GPU assertion on this machine, so UI verification uses the react-native-web render. No VERSION bump yet.

2026-07-09 - Mobile: Expo (New Architecture) scaffold + engine bundles to Hermes for Android

Built targets/mobile as an Expo SDK 57 / React Native 0.86 app (New Architecture, Hermes) and PROVED the shared engine bundles for Android: expo export --platform android -> a 2.7MB Hermes bytecode bundle (623 modules), resolving the engine, the generated static catalog, all block generators, and lodash/ compromise. Metro resolves poorly across the monorepo boundary (repo root is an ESM type:module package), so the engine is linked IN-project via a junction (targets/mobile/engine -> ../../engine, via npm run link:engine) with the engine's runtime deps (lodash, compromise) installed locally; default Metro config, all resolution stays inside the project root. PoC App.js runs the real engine through metroLoader (generate + reroll). Reproducible setup: npm run setup (link:engine + catalog), wired as prestart/preexport hooks. No VERSION bump yet (compilation proven; not yet run on a device, no full UI). Next: boot an emulator to see it run, then port the tabs.

2026-07-09 - Mobile (Android/Expo) foundation: Metro catalog generator + metroLoader, parity-proven

Started the Android target as a React Native / Expo (New Architecture) build that reuses the isomorphic engine, rather than a WebView wrapper (Tauri mobile / Capacitor) or a native rewrite. This commit is the de-risk FOUNDATION only (no Expo install yet):

• engine/core/metroLoader.js - a third isomorphic loader beside nodeLoader (fs + createRequire) and browserLoader (Vite glob). Reads a STATIC generated catalog synchronously: no glob, no fs, no dynamic require (none of which Metro supports). compileDpl bridge mirrors the browser one.
• scripts/build-metro-catalog.mjs - generates engine/core/metroCatalogData.js: static imports for every .js block generator (Metro-bundlable) + inlined .dpl/.txt/.group/.json/presets. Two tiers: full (GitHub edition, NSFW included) and sfw (all-ages Play edition - every nsfw-token block/list/group/preset physically omitted, nsfw group references stripped, plus an all-ages scrub hook for list vocabulary). NSFW gating reuses the engine's own hasNsfwToken.
• scripts/metro-parity-check.mjs - go/no-go gate: proved metroLoader drives the unchanged engine identically to nodeLoader (89 blocks + 88 lists identical built-in; 150 seeded generations byte-for- byte equal). SFW build verified to carry no adult content or references.
• npm metro:catalog + metro:parity. Generated catalog is gitignored (build artifact).

No VERSION bump - foundation only, not a shippable target yet.

2026-07-09 — Maintenance sweep: branch cleanup, status.md reconcile, + a maintenance-sweep runbook

A periodic "close the books" pass, run at the owner's request (full maintenance / clean things up). No VERSION bump — dev-dependency + docs/notes only.

• Branches. Merged Dependabot PR #43 (vitest + @vitest/coverage-v8 4.1.9→4.1.10, dev-dep patch) into dev after surfacing it, then deleted every merged feature branch — 6 local feature/* and 2 remote (gallery-composer-a11y-seo, user-overlay) — leaving only main + dev on both ends with no open PRs.
• status.md reconcile. The current-state doc had drifted from the shipped tree: version line 2.46.0→2.51.1; CLI (2.50.0) + ComfyUI (2.51.0) marked as shipped targets rather than "planned"; shipped branches no longer labeled "pending review"; build-health + open-issues tables refreshed with freshly-run numbers (lint 0 problems, unit 319, web 419) and the now-resolved lint-warning issues retired.
• New runbook. Added reference/maintenance-sweep.md — the repeatable full-sweep procedure (audit → triage → close branches → ship → reconcile docs → verify), composing the existing git-workflow / repo-hygiene / versioning standards with hard safety rules — and a fairyfox proposal report recommending the hub adopt it cross-project (proposal-only; hub untouched).
• Verified npm test + npm run check:tidy green, then shipped dev→main (a no-op release since VERSION is unchanged) and back-merged main into dev.

2026-07-09 — Fix the DPL editor's white gutter + washed-out active line in dark mode (2.51.1)

The live editor showed a bright-white line-number column and a milky blue active-line band in dark mode. Root cause: CodeMirror 6's gutter baseTheme ships both &light .cm-gutters {#f5f5f5} and a &dark variant, chosen by whether the view's theme declares { dark: true } — and our editors never did. So CM stayed in light mode and injected the light gutter (#f5f5f5), the light active-line gutter (#e2f2ff), and the milky active-line wash (rgba(204,238,255,.267)) at the SAME specificity as our .dpl-editor .cm-* CSS, beating it on source order. A plain-CSS override could never win.

• New shared theme extension (targets/web/frontend/lib/editorChrome.js): a CodeMirror EditorView.theme (StyleModule priority > baseTheme, so it wins) that sets a transparent gutter with dim recessed numbers, a brighter neutral active-line NUMBER, a whisper-subtle neutral active-line lift (4.5% of --fg), and the accent-tinted selection. Colors are the app's CSS variables, so the chrome tracks light/dark on its own (no hard-pinned dark flag).
• Wired into both editors — DplEditor.jsx (the prompt boxes) and CodeEditor.jsx (Manage's code/list editors, which had NO gutter override and showed the same white slab).
• Dropped the dead CSS in dpl-editor.css (the losing .cm-gutters/.cm-activeLine*/selection rules), leaving a comment that explains why the chrome lives in the theme now.
• Regression test tests/e2e/editor-chrome.spec.js — asserts (dark scheme) a non-light gutter surface and a neutral, untinted active-line band. Verified visually at prompt.fairyfox.io parity in dark AND light mode.

2026-07-07 — Pre-release hardening: preset-loader path-traversal fix + engine-module coverage (2.51.0)

SonarCloud (on the 2.51.0 release PR) flagged the new shared engine modules — fixed for real before shipping rather than merging a red gate:

• Security (path traversal). engine/presets.js loadPreset(name) built a file path from name, which arrives from the /api/prompt request body — so a crafted preset with ../separators could read arbitrary *.json files. It now rejects anything but a plain preset name. Regression-tested.
• Coverage. The three new modules (promptRun.js / nodeEngine.js / presets.js) weren't in the Vitest coverage allowlist, so Sonar saw 0% on them. Added them + focused unit tests (tests/unit/{promptRun,presets,nodeEngine}.test.js) → ~100% lines each; global thresholds hold.
• False positive. Suppressed S2245 (Math.random) for promptRun.js's batch-seed mint — a creative prompt seed, never security-sensitive (same as the existing rng.js / random.js suppressions).

Full gate green (419 web + the Node suite incl. the new specs).

2026-07-07 — New targets/comfyui/ target: ComfyUI prompt-engine nodes (2.51.0)

Added a ComfyUI custom-node target (targets/comfyui/) that brings the prompt engine into ComfyUI as natural-language-first STRING sources for a CLIP Text Encode. Prompt-side only — ComfyUI already owns image generation, upscaling, variations, and re-roll (its native seed widget), so the target adds just the prompt half (the DPL processor, blocks, lists, presets).

• Thin Python wrappers, no re-ported engine logic. The nodes make HTTP calls to a running app's local backend (point-at-running-app; default http://localhost:4173, auto-detects a running app on localhost:4173/5173, override via a Settings field / RANDOM_AI_PROMPT_URL). Two new backend routes power it — POST /api/prompt and GET /api/prompt/catalog — reusing the shared engine/promptRun.js, engine/nodeEngine.js, and engine/presets.js (all extracted this session so nothing is duplicated; the CLI re-exports the same modules). Dependency-free (stdlib urllib).
• Nodes: a flagship natural-language RandomAIPromptGenerator (template + seed + nsfw + preset) plus helpers PromptList / PromptBlock / DPLExpand / PromptBatch (N variations as a list) / CombinePrompts (join wired pieces) / ShowPrompt (display + pass-through). Re-roll is the native seed widget (control_after_generate); presets come from engine/data/presets (+ user/presets). Every input/output carries a tooltip + each node a description; the generator is top-level, the helpers grouped under a submenu. (An AI-rewrite node was considered and dropped — calling a third-party API mid-graph is off-paradigm for ComfyUI, and the plugin now makes zero third-party calls.)
• Frontend extension (web/randomAiPrompt.js): the single Settings URL field (drives dropdowns and generation via a persisted /random_ai_prompt/config), LIVE dropdowns from the catalog (same-origin proxy routes, avoiding CORS), the app icon + brand colours on the nodes, the ShowPrompt text display, and a status sidebar. Plus a drag-in example_workflows/ starter and an Apache-2.0 LICENSE.
• Verify: the engine/backend side is covered by tests/integration/promptApi.test.js (generate, seed reproducibility, preset apply + unknown→400, catalog); the Python + ComfyUI-runtime JS are syntax-checked and must be validated in a running ComfyUI (manual — no CI runtime). Full gate green. New deep-dive systems/comfyui.md; credits + CLAUDE.md updated; legal pages re-checked (localhost only — no third-party data flow).

2026-07-07 — Dispose of the chaos knob; extract a shared engine-owned prompt-run (2.50.1)

Removed the chaos value for good. It was a pre-DPL knob for controlling randomization (scaling the whole emphasis/editing/alternating envelope at once, with blocks meant to react to it) that predated the DPL wrapper and was never liked; it was never an engine setting (engine/settings.js never had it), and its UI control had already been unmounted on 2026-06-19. Deleted withChaos from the web facade (targets/web/frontend/lib/promptEngine.js) and the CLI, dropped the CLI --chaos flag (optionSpec.js), and swept the current-state docs (removed-pending-readd.md row deleted; status.md, cli.md, dpl-language.md, prompt-dsl.md, next-steps.md, the Home.jsx comment). Left untouched: Midjourney's own unrelated --chaos provider parameter, and the word "chaos" in the vocabulary lists / block descriptions. Default prompt output is byte-identical (withChaos was a no-op at chaos = 1); the snapshot + CLI reproducible-prompt tests confirm it.

In the same pass, extracted the duplicated seed/reroll prompt-run logic into a new engine-owned, isomorphic module engine/promptRun.js (seedFor, forEngine, and a createPromptRun(engine) factory). The web SPA facade and the CLI's promptRun.js now consume it instead of each carrying their own copy — so the seed rules live in one place, and the upcoming ComfyUI backend prompt route can reuse them rather than re-porting the logic a third time. No behavior change: 293 Node + 419 web tests, lint, and doc-link checks all green.

2026-07-07 — New targets/cli/ target: the prompt command-line tool (2.50.0)

Added a command-line build target — a traditional args-and-flags CLI (prompt, package @random-ai-prompt/cli) that generates prompts and runs them through image providers using the same engine, providers, settings, and on-disk store as the web/desktop app (parity with both the engine and the GUI, by default). No TUI/interactive mode — every capability is a subcommand with flags, a --help page, colored output (picocolors; honors NO_COLOR/FORCE_COLOR), and completion for bash, zsh, fish, and PowerShell.

• Commands: generate (default; every engine/settings.js field is a flag, plus provider/image/ rewrite knobs, --seed/--random, --nsfw, --preset, --json), list (blocks/lists/providers/presets/dialects/samplers/settings), config, keys, rewrite, upscale, and completion.
• Reuse, not fork: a Node provider registry (src/lib/providers.js) replaces the SPA's Vite-glob registry (fs-discovers shared/<id>/config.js + _shared/settings/*.js); the CLI runs the real backend (apiHandler.js) in-process on an ephemeral port with a fetch shim, so every provider's own code/generate.js runs unchanged and images save to the shared output/ folder with the same sidecar the gallery reads. An ESM resolve hook (src/lib/jsonLoader.mjs) injects type: json so the providers' bare JSON imports load under Node.
• Shared state: CLI defaults persist to their own cli namespace (never clobbering the GUI's settings.json); BYOK keys are read from both stores, so keys are shared between the CLI and the app (or supplied per-run via PROMPT_KEY_<PROVIDERID>). An api provider is only called with --images, so a plain prompt -p openai "x" never spends credits.
• Wiring/tests: root postinstall installs the CLI; npm run cli runs it; the root ESLint gate now lints targets/cli (Node ESM) and CLI unit tests live in tests/cli/cli.test.js (14 tests, in the root Vitest gate). See systems/cli.md.

2026-07-06 — Tone down the DPL editor's active-line + line-number gutter on dark (2.49.6)

Follow-up to 2.49.5: the active-line highlight was a color-mix(--accent 7%) band that read as a milky, washed-out mint slab on the dark theme, and the line numbers used full --faint with a bright --accent active number — both too loud. Reworked to be quiet and neutral: the active-line body is now a whisper-subtle color-mix(--fg 3.5%) lift (theme-adaptive, no color cast), inactive numbers are dimmed (--faint at 55% alpha) so they recede, and the active line's number is a clean neutral --muted brighten instead of the glowing accent. Verified in Chrome on the dark theme (mid-editor active line + gutter). CSS-only.

2026-07-06 — Interactive DPL editor layer: hover dials, + line actions, gutter, coloring (2.49.5)

A standardized interactivity layer added to the shared DplEditor (so every prompt box — regular / negative / gallery / Manage — gets it at once):

• Hover intensity/focus dials. Resting on a {#…} block reference floats two little speedometer dials above it (INTENSITY, FOCUS), 50 dead-center / straight-up. Dragging (or double-clicking) writes iNN% / fNN% back into that one reference; landing on exactly 50 (the default) drops the argument so the reference stays clean. New lib/dpl/dplDials.js (a plain CodeMirror ViewPlugin; the panel is position:fixed on document.body so it never clips, re-anchored on scroll + after each edit).
• + context-aware line actions. A + sits in a left gutter on the hovered/cursor line; clicking it opens a menu that adapts to context: inside the --- front matter → front-matter keys + blank-line inserts; the first line with no front matter yet → "Insert front matter"; a line with content → "Promote to…" (wrap as - / maybe / NN% chance / otherwise / [weight] / [i<NN%]); always → "Replace line with…" (every line-type template), insert blank line above/below, and "New section…" (standard Start / Auto Begin / Auto End, or a custom one). New lib/dpl/dplLineActions.js.
• Line numbers + active-line highlight. lineNumbers() + highlightActiveLine() / highlightActiveLineGutter(), themed via the --* tokens in dpl-editor.css.
• Syntax-coloring gaps closed (dplLanguage.js tokenizer): the insert js: path now colors as a ref; otherwise NN% / otherwise maybe colors the whole gate; the (NN% nothing) choice miss is part of the choice keyword; and a combined [100 i<10% f<40%] weight/condition bracket colors as one dial unit (was previously mangled).
• New localized strings live in lib/dpl/dplInteractiveMessages.js (formatted through intl and passed into the plain-CM extensions). Verified in Chrome across all four editors; full headless gate green (lint incl. stylelint, smoke, 416 web tests incl. the SSR prerender guard, web build).

2026-07-06 — Fix Manage add-menu overflowing the pane (2.49.4)

The tree's add (+) menu ("New block / New folder") opened left-to-right (left: 0) from + controls that sit near the right edge of the narrow tree pane, so the 130px menu spilled past the pane and forced a horizontal scrollbar. Right-aligned it (right: 0; left: auto) so it grows leftward and stays inside the pane. Verified in Chrome. CSS-only.

2026-07-06 — "Create override" for built-in blocks/lists + corner scrollbar fix (2.49.3)

• Create override: the block + list editors now show a Create override button for any built-in entry. It copies the entry (content + .js/.json sidecars) into the matching user-overlay root (user/blocks or user/lists) — which wins at runtime and survives app updates — then selects the new copy so you edit YOUR version; the built-in is left untouched. If an override already exists it just opens it. Backed by a new cross-root copy fs op (toRoot) in manageFs, overrideEntry in useManageTree, and a confirm dialog. Verified end-to-end in Chrome.
• Corner scrollbar fix: the Modify/Draft combo overlapped the DPL editor's vertical scrollbar — inset it (right: 1.25rem) so it always clears the scrollbar.
• Editor-freeze fix: the first attempt used scrollbar-gutter: stable on the CodeMirror scroller, which put CM into an infinite measure loop and froze the renderer when a block opened. Dropped it (CM wraps long lines inside the scrollbar already, so the text stays clear without it).
• Verified green: the full gate — check:docs + lint (incl. stylelint) + smoke + Node unit (279, incl. the new cross-root copy round-trip) + web (416, incl. overrideEntry cases) + the web build; i18n:extract synced en.json. Manually confirmed the override flow, the scrollbar clearance, and the freeze fix in the browser.

2026-07-06 — Refine bar UX overhaul: stepper combos + corner Modify/Draft (2.49.2)

Rebuilt the block refine controls after they read as "a slab of buttons overflowing with even more buttons oddly below it" (verified in Chrome this time — the fix is UX-driven).

• Stepper combos: each dimension is now ONE compact control — [ − Detail + ] — instead of two separate "Add detail" / "Trim detail" pills. Five combos (Detail, Complexity, Focus, Intensity, Variety) + a lone Cleanup pill (renamed from "Tighten") sit on one tidy, wrap-safe row. New DplRefineBar renders −/+ step buttons per dimension; the +/− aria-labels carry the old action names.
• Corner Modify/Draft: the free-text box moved out of a full-width slab into a joined Modify / Draft combo pinned to the DPL editor's top-right corner (new DplAskCorner.jsx), opening a compact popover (title + textarea + Send, ⌘/Ctrl+Enter). The editor content gets a top gutter so the first line clears the control; the popover caps at min(88vw, 360px).
• Test-infra fix: the heavier suite tipped promptEngine.integration's ensureCatalog() warmup hook (~9.3s on HEAD) past the default 10s hook timeout under parallel load — gave that beforeAll a 30s timeout (the real data-corpus glob genuinely takes >10s under load).
• Verified green: inspected in Chrome at desktop (combos tidy, corner popover clean, no clipping) + lint + smoke + the full web suite (412 tests) + the web build; i18n:extract synced en.json.

2026-07-06 — Free-text "Modify" box for block refine in Manage (2.49.1)

Added a free-text message box to the block editor's refine bar so a template can be re-processed by a typed instruction — full control alongside the quick pills. A segmented Modify / Draft new toggle sits over one input: Modify (default) sends your instruction plus the current template to the AI and applies the revised DPL; Draft new is the previous draft-from-description (now folded into the same box). Both keep the existing validate + dirty-until-Save + one-click Undo behaviour.

• New dpl-custom mode (rewriteSystem.js): its task tells the model the user message is an INSTRUCTION followed by the current template after a --- TEMPLATE --- delimiter, to apply the change and return the full revised DPL while preserving everything not asked to change. Rides on the same DPL_PRIMER as the other dpl-* modes.
• dplRefine.js: DPL_CUSTOM_MODE + buildCustomPrompt(instruction, template) (packs the two around the delimiter). DplRefineBar.jsx replaced the collapsible draft control with the always- visible Modify/Draft box; ManageBlockEditor.jsx gained handleCustom (validates both an instruction and a template exist, composes the prompt, runs dpl-custom) and a kind-driven status.
• Verified green: lint + smoke + the full web suite (409 tests) + the web build; i18n:extract synced en.json. No data-practice change, so the legal docs are untouched.

2026-07-06 — AI refine + draft-from-description for blocks in Manage (2.49.0)

Extended the Manage block editor's DPL tab with an AI refine toolbar and a draft-from-description control, so a block template can be shaped by clicking instead of hand-editing DPL. All of it rides on the existing text (rewrite) provider path — the same BYOK plumbing the list editor's "AI Expand" uses — so no new provider code was needed.

• Refine toolbar (DplRefineBar.jsx): five dimensions as more/less pill pairs — Detail (add/trim), Complexity (more/simplify), Focus (sharpen/loosen), Intensity (crank/ease), Variety (more/consistent) — plus a Tighten polish action. Each pill sends the current template through the provider with a dedicated dpl-* mode and replaces the editor content; the result is validated (issue count surfaced in the status), marked dirty (not saved until Save), and reversible via an Undo link (a manual edit supersedes the revert point).
• Draft from description: a free-text box drafts a whole starting template from a plain-English subject, using a "winning formula" system prompt (front matter → Start → subject spine → essential bullets → one of: variety → maybe/NN% garnish → [f<40%] focus fluff → [i>70%]/[i<25%] intensity variants, composable, ~10–20 lines).
• DPL-aware system prompts (rewriteSystem.js): a shared DPL_PRIMER teaches the model the DPL grammar and the intensity/focus dials so it refines as DPL (tokens, sections, gates, choices preserved) rather than flattening to prose; systemFor() now routes every dpl-* mode (primer + a per-mode task) alongside the existing keyword/expand/fix. Reused by both transports (browser-direct + the /api/rewrite proxy) since both already call systemFor.
• New: frontend/lib/dpl/dplRefine.js (action catalog + cleanDplOutput fence/quote stripper) and dplRefineMessages.js; styles/components/dpl-refine-toolbar.css. No data-practice change (refine reuses the already-disclosed text-provider flow), so the legal docs are untouched.
• Verified green: lint + smoke + the full web suite (404 tests, incl. new dplRefine, rewriteSystem, and DplRefineBar specs) + the web build; i18n:extract synced en.json.

2026-07-06 — Rename dynamic prompts → "blocks" everywhere (2.48.0)

Renamed the project's core concept from "dynamic prompt" to block across the whole codebase, so the built-in catalog matches the user-override folder (user/blocks) and the product vocabulary (the GUI already said "blocks"). One consistent name now, end to end.

• Folder + files: engine/data/dynamic-prompts/ → engine/data/blocks/; engine/core/stages/ dynamicPrompt.js → stages/block.js; engine/dynPromptManifest.js → engine/blockManifest.js (and the matching test files). The {#name} reference syntax is unchanged (it's the DPL "run a block" operator; only the concept name changed).
• Engine API + pipeline: loadDynamicPrompt→loadBlock, dynamicPromptNames→blockNames, makeDynamicPromptStage→makeBlockStage, readDynPromptMeta→readBlockMeta, dynPromptForcedPrefixDirs→blockForcedPrefixDirs, dynPromptGroupDirs→blockGroupDirs, readDynPromptGroup→readBlockGroup, isGatedDynPrompt→isGatedBlock. The pipeline stage key is now "block" (in engine.js's map, DEFAULT_ORDER, and settings.promptModules), and the setting dynamicPromptFiles: "dynamic-prompts" → blockFiles: "blocks".
• Everything downstream: the browser globs (../data/blocks/**), the Vite chunk-split regex (/data/(blocks|lists|presets)/), all GUI call sites, tests, scripts/*, and the docs (incl. the renamed notes reference/blocks.md + reference/blocks-architecture.md). The terse internal loader shorthand (dp… / dyn… locals) is left as-is to avoid colliding with the dpl/.dpl language name.
• Verified green: the headless gate (check:docs + lint + smoke + 278 engine tests + 385 web tests) and the web build (the blocks/ corpus chunk builds).

2026-07-06 — Restructure into engine/ + targets/ (2.47.0)

Reorganized the whole tree from the old src/ + gui/ split into a clean engine + build targets shape, so multiple targets (web now; CLI and more planned) can share one engine.

• src/ → engine/. The isomorphic prompt engine (core DPL engine, stages, both loaders, helpers, manifests, settings, content-safety) now lives under engine/. The engine owns its content: data/ moved to engine/data/ (lists, presets, sources, and the {#name} block generators). The Node loader resolves engine/data/ and the browser globs were repointed (../../data → ../data).
• gui/ → targets/web/ (one package). The web target keeps a single npm package but splits its concerns into folders: frontend/ (the SPA, was gui/src), backend/ (the /api server, was gui/server), and shared/ (the provider adapters used by both, was gui/providers). Vite root stays the package root; the SPA's engine imports gained one ../ and now point at engine/.
• Desktop is its own target. The Tauri shell (gui/src-tauri) became targets/web-shell/ with its own package.json (the tauri/stage/desktop:* scripts + @tauri-apps/cli moved out of the web package). Its staging (stage.mjs) and Rust shell now assemble/launch a payload that MIRRORS the new repo layout (app/engine, app/targets/web/backend/serve.js, …) so the backend's relative imports resolve at runtime. The desktop build needs a real Tauri/Rust build to verify (not run here).
• user/ overlay stays at the repo root as the universal override overlay (sibling of engine/ and targets/) — user/lists + user/blocks override engine/data/ USER-WINS.
• Wiring updated end to end: root package.json scripts (--prefix targets/web, serve → targets/web/backend/serve.js), netlify.toml (publish targets/web/dist), CI workflows, Vitest / Playwright / ESLint / Stylelint / Sonar / Codecov / jsdoc configs, scripts/*, and the doc-link checker. targets/shared/ is reserved for future cross-target code; a targets/cli/ target is next.
• Verified green: the headless gate (check:docs + lint + smoke + 278 engine tests + 385 web tests) and both web builds (local + online SSR prerender).

2026-07-06 — User content overlay: a repo-root user/ folder beside data/ (2.46.0)

Added a first-class user overlay so people can add and tweak prompt content without touching the app's built-in files. A new repo-root user/ folder (user/lists, user/blocks, user/settings) sits beside data/, and the app watches both.

• Overlay semantics. Both engine loaders now scan two roots per pool — data/lists + user/lists (lists) and data/blocks + user/blocks (blocks / "blocks") — with user-wins precedence: a user file of the same name overrides the built-in (like a settings override); a new name just adds. src/core/nodeLoader.js merges on disk; the browser side keeps names at first paint from lazy globs and loads user content from a separate code-split chunk (src/core/browserUserCatalog.js) overlaid last in initBrowserCatalog.
• Local/desktop only. The overlay is gated off the hosted online build (VITE_ONLINE): the user chunk is never imported and the user names are dropped, so the online bundle carries no user content (verified: no browserUserCatalog chunk, no seed strings in gui/dist).
• Manage tab. gui/server/manageFs.js gained user-lists / user-blocks roots; the runtime snapshot merges each onto its built-in pool (user-wins) so live generation honors the overlay, while the tree/fs-ops stay per-root so edits land in user/. The Manage tab groups "your content" (badged yours) at the top; user roots have no upstream, so ghost pills / "restore default" are suppressed (and restoreFromRepo hard-refuses user roots so a 404 can't wipe a user's file).
• Settings consolidated. The local per-namespace store moved from gui/user-settings/ to the unified user/settings/ (one "user home"), with a boot migration that folds the old folder — and the ancient flat .gui-storage.json — into the new location without clobbering current settings.
• Packaging. The desktop stage.mjs ships the user overlay's seed content (lists/blocks/README, never the per-user settings); the Tauri shell (lib.rs) seeds user/ once on first install and never clobbers it on upgrade, so a user's own content + settings survive version changes (like output/). .gitignore tracks the user/ scaffold but ignores user/settings/*.
• Tests. Overlay merge + user-wins override + restore-refusal are covered in tests/integration/manageFs.test.js; the useManageTree hook + its test learned the four roots.

2026-07-06 — Gallery composer + live placeholders, multi-select delete, a11y + SEO pass (2.45.0)

A five-part feature set across the SPA:

• Reusable PromptComposer. The composer prompt box and all its bells and whistles (DPL insert bar, Prompt/Negative switch, the CodeMirror editor with its live-status / clear / preview / gear corner cluster, and the action bar: prompts-per-run, image controls, auto-fix, keyword-translate, wrapper, share, random, generate) were extracted from Home.jsx into gui/src/components/PromptComposer.jsx. It's provider/view-agnostic — reads only settings and calls back onGenerate(text) — and exposes an imperative insert(token) (via ref) so Home's building-block palette still reaches the active editor. Home's rendered markup is unchanged (visual baselines untouched); the palette, hover tooltip, results list, and image-batch flow stay in Home.
• A narrow prompt box atop the Gallery. The Gallery view now renders a compact PromptComposer in a centered .g-composer slot above the grid — just the box, none of the surrounding chrome. The gallery header (title + search + Select/Refresh) and the selection bar share the composer's centered column width (--g-col) so the search field grows to fill it and lines up directly under the prompt box; the image grid stays full-bleed.
• Live placeholder generations. Generating from the gallery box streams placeholder cells into the top of the grid immediately; each resolves into the finished image (via the feed) as its batch lands. New isolated orchestrator gui/src/lib/gallery/generateIntoGallery.js (keeps the perf-critical useImageBatches untouched, mirrors its rewrite passes + sidecar meta shape + the per-provider concurrency limiter). App owns the galleryPending list; the feed reloads before the placeholder drops so a finished cell never flashes empty. Guards a non-image provider with a friendly error.
• Gallery multi-select + mass delete. A selection mode with per-cell checkboxes, select-all / clear, a selection toolbar, and a confirm-once mass delete (App.deleteManyItems, disk + feed).
• Accessibility. Skip-to-content link, a visually-hidden top-level <h1>, real role="tabpanel" wiring (aria-labelledby + hidden) for the view panes, role="alert" on error text, an aria-live generation status, labelled gallery search, an app-wide prefers-reduced-motion guard, and .sr-only / .skip-link utilities. axe (WCAG2 A/AA) stays clean.
• SEO / page ranking. sitemap.xml (+ robots.txt reference), enriched WebApplication JSON-LD (featureList, sameAs, screenshot, alternateName), a new FAQPage block, a keywords meta, and the landmark <h1>.

Review hardening (CodeRabbit, pre-release): bulk delete now deletes each file independently (Promise.allSettled) and rebuilds from the authoritative disk feed so a concurrent SSE refresh / gallery generation can't be clobbered by a stale snapshot, surfaces partial failures, and returns a success boolean so a cancelled confirm keeps the selection; the gallery "all selected" check is computed against the filtered items; and PromptComposer.insert uses functional state updates so rapid building-block inserts accumulate instead of overwriting.

Tests: new generateIntoGallery, GalleryMultiSelect (incl. cancel-keeps-selection), and PromptComposerInsert suites; full headless gate green (385 Vitest), gui build (local) green, Playwright a11y green. Verified the gallery visually at desktop + phone.

2026-07-06 — Auto-updating: check-and-notify banner (Phase 1) + desktop auto-install scaffold (Phase 2) (2.44.0)

First rung of the pre-3.0 updates design (plans/updates-upgrades.md), edition-aware and local/desktop-only (the hosted online build is always the latest deploy). On launch a local/desktop build asks its own backend whether a newer GitHub release exists and, if so, shows a dismissible banner with the right call to action for the detected edition — download the new installer/portable/release, or, for a git checkout, a copyable git pull --ff-only && npm install. Phase 1 (shipped): pure semver compare + a 12 h throttle + per-version dismissal stored through the app's own storage layer (new update namespace — disk locally, localStorage online, no new tracking surface) — gui/src/lib/updateCheck.js (+ useUpdateCheck.js); the banner gui/src/components/UpdateBanner.jsx (+ CSS), wired into App.jsx (SSR-safe: renders null server-side, so the online prerender is unaffected); a new backend route GET /api/update that fetches the latest release server-side (1 h cache) and detects the edition (the Tauri shell now stamps RAP_EDITION=installer|portable; else a .git dir ⇒ git; else source). The GitHub call is server-side — the browser opens no new connection (the local backend already contacts GitHub for the Manage restore manifest); the privacy page gained an "Update checks (desktop version)" section. Phase 2 (implemented, activates on the CI signing secret): the full Tauri in-app auto-installer is now fully wired — an optional updater Cargo feature (pulls tauri-plugin-updater + tauri-plugin-dialog, neither in the default build), the real signing public key committed in tauri.updater.conf.json, a Rust check-on-launch → native prompt → download/install/relaunch trigger in lib.rs (spawn_update_check, compile-verified via cargo check --features updater; the WebView is on an external localhost origin, so the update is Rust-driven, not JS), a desktop:build:updater script, and a CI updater-manifest job that aggregates each OS's .sig + artifact URLs into latest.json. All of it is key-gated — with no TAURI_SIGNING_PRIVATE_KEY secret the release pipeline is byte-for-byte unchanged (confirmed: default cargo check + cargo tree show neither updater crate). The one remaining owner step (add the secret) is in reference/desktop-updater.md. The notify UI was also restyled from a full-width strip to a dismissible bottom-right corner card (visual-checked). Verified: 12-test unit suite (gui/tests/lib/updateCheck.test.js), full npm test + web suite (375) green, local and online (prerendered) gui builds green, cargo check both with and without the feature, lint/format/i18n clean.

2026-07-05 — Adopt hub docs-site chrome + reader-menu refresh (2.43.1)

Synced the doc-site theme (assets/docs-theme/) to the fairyfox docs-site standard after the hub site was updated. Reader menu (modules/reader.js + theme/reader.css) rebuilt to the new master design — weather/time theme icon tiles (sun/sunset/moon) with an Auto toggle, a new accent-colour row (seven curated hues + a reset-to-theme swatch that recolours the --accent/--violet/--link family live), a text-size slider that scales the <html> root font-size ([15, 16.5, 18, 20, 22]px), and a panel head (title + close) and foot (hint + Reset). Prefs now live under the versioned origin-wide key fairyfox:reader:b (was fairyfox:reader), shared across every same-origin fairyfox.io site. Header/ footer brought back in sync with the hub: the primary nav is the fixed mesh-wide set Home · Projects · Games · Docs · Updates · About (added Games, dropped Downloads from the primary nav — the project's Download page stays in the subnav), and the footer's Explore column matches. The reader "Aa" button now sits at the far right past the nav. Reading defaults aligned to the hub for consistency: root 16.5px, body 1rem, line-spacing 1.65 (was 1.8), content 1rem (was 1.05rem), width 46rem. Verified: lint, doc-site build, smoke, doc-link guard all green, plus a live browser check (new key written, theme/accent/size/slider apply live, fresh-visitor defaults match the hub). Adopted under the standing adopt-standards-by-default express authorization; process report in ../fairyfox-reports/2026-07-05-adopt-docs-chrome-reader.md. Follow-up fixes (same release): (1) the Overview page no longer spills docdash file-doclet sections (e.g. data/blocks/prompt/artists.js) in past the README's License section; (2) docdash's module sidebar no longer flashes in on first load; and (3) the footer brand now uses the real Fairy Fox fox logo (.brand/.brand-logo → fox.png, same mark as the header and the hub footer) instead of a gradient "F" placeholder. The first two are fixed by setting the page-type class (ff-no-sidebar / ff-home / ff-download) on <html> via a tiny inline <head> script injected at build time (scripts/build-docs.mjs), so it runs before first paint — plus a CSS rule (html.ff-home #main > section:not(.readme){display:none}) that hides the home-page spillover with no flash. Verified on the built site in-browser (classes present at load, spillover hidden, sidebar display:none from first paint).

2026-07-05 — Pre-built distribution + desktop edition via Tauri (2.43.0)

Every edition now ships pre-built, so the docs no longer force anyone to build from source, and the hosted site is reframed as just one deployment of the online edition rather than "the" version. Added a desktop edition built with Tauri: a thin Rust shell (gui/src-tauri/) that runs the unmodified local SPA + Node /api backend as a bundled sidecar — it bundles the platform node, stages the app to a writable working copy (per-user app-data, or beside the executable for a portable build) that preserves user data across upgrades, launches serve.js on a free port with NO_OPEN=1, and points the WebView at it once it listens. No app logic is duplicated in Rust. The build (stage.mjs + tauri build, via npm run desktop:build) produces Windows .msi/NSIS .exe + a portable .zip, macOS .dmg, and Linux .AppImage/.deb. CI (release.yml): the online edition is now attached to each Release as a self-hostable …-online.zip, and a per-OS matrix builds the desktop installers on their own runners (using preinstalled Rust — no new unpinned actions), signs them with the same Sigstore flow, and uploads them to the Release. Framing: the README leads with download-or-build and its 21 badges are restored; the in-app links menu gained "Get the desktop app" + "Run it yourself". Updates / auto-upgrade are deliberately out of scope here and designed in ../plans/updates-upgrades.md for a pre-3.0 pass. New deep-dive: ../systems/desktop.md. Verified locally on Windows (MSI + NSIS build; portable runs end-to-end with the bundled node sidecar serving over HTTP); cross-OS installers are produced by CI.

2026-07-05 — Online docs: modular theme (CSS @import + ES modules), full SEO/social, WCAG AA (docs; no version bump)

Broke the doc-site theme into small, focused, browser-imported files and hardened it for search, social, and accessibility. Modular: fairyfox-docs.css is now a tiny @import entry over theme/*.css (tokens, base, layout, chrome, content, reader, download), and fairyfox-docs.js is an ES-module entry importing modules/*.js (util, chrome, sidebar, reader) — build-docs.mjs copies both trees and post-processes docdash's <script> to type="module". SEO / social: the build now injects crawler-visible <head> tags on every page — per-page description (from the first paragraph), canonical, Open Graph + Twitter Card, robots, and JSON-LD — plus sitemap.xml + robots.txt and lang="en". Accessibility (WCAG 2.1 AA): a skip link, visible focus, underlined in-text links, AA colour contrast across all tokens (darkened the light/sepia inks + faint text, fixed a prettyprint code-surface bug that showed light-on-light, gave the drawer checkbox a label), and a keyboard-operable reader menu (roles/labels, Escape, focus handling). Verified with @axe-core/playwright: 0 violations across Overview/notes/API/Download in both light and dark. Also added a Download subnav item + a themed download.html (extensible card grid; "coming soon" placeholders removed per request).

Polish pass on the doc-site reading experience. Readability: the Overview + notes pages now render in a comfortable centred reading column with gentler typography (larger base size, relaxed line-height, a touch of letter-spacing, text-wrap:pretty), and README/notes images are framed, centred, and sized to the column instead of ballooning to full width. Tutorial titles: scripts/build-docs.mjs now strips each tutorial body's duplicate leading H1 and trailing heading-anchor syntax ({#id}), and fairyfox-docs.js drops docdash's redundant Tutorial: prefix + the duplicate <h2> — one clean title per page. Softer palettes: the light theme is a gentler warm cream (no stark white, body text below full contrast) and a new sepia theme was added. Reader menu: replaced the earlier idea of a sun/moon toggle with a Kindle-style "Aa" button in the header top-right that opens a panel — Theme (Auto/Light/Sepia/Dark), Text size (A−/A+), Line spacing, Width — tuned live via --reading-* CSS vars + data-theme. Prefs persist under an origin-wide localStorage key (fairyfox:reader), so the choice is shared across every fairyfox.io site (the hub + project docs are all same-origin) — the hub and fairyfox-games repos need only read the same key to participate (owner to add, cross-repo). Verified all four themes, live text controls, and cross-page persistence via headless Playwright.

Also added a Download subnav item + a hand-authored, themed download.html page (copied into the build by build-docs.mjs) — a card grid explaining where to get it (online edition, desktop build, placeholder "coming soon" packaged installers + Android) that's easy to extend as targets ship. It links the same stylesheet + fairyfox-docs.js, so it gets the shared header/subnav/reader/footer; isApiPage() excludes it (no module sidebar) and it uses a wider .ff-download card layout.

2026-07-05 — Online docs: sidebar only on the API pages + declutter it (docs; no version bump)

Follow-up to the header/subnav rework. The docdash module sidebar no longer shows on every page — it's now confined to the code-reference (API) pages, reached via a new API subnav item (landing on global.html; not named "Docs" to avoid clashing with the hub navbar's own Docs link). The Overview home and every notes tutorial render full-width with no sidebar (fairyfox-docs.js adds an .ff-no-sidebar class on those pages; the CSS hides body > nav + the mobile hamburger and centres #main). On the API pages the sidebar itself is decluttered: removed the GitHub ↗ menu item from jsdoc.config.json (docdash.menu), and the script prunes docdash's generated Home link (Overview is home) and the Tutorials section (now in the subnav) — leaving Search → Modules/Global.

2026-07-05 — Online docs: copy the fairyfox.io header + an organized subnav, self-host the fonts (docs + tooling; no version bump)

Reworked the generated doc-site chrome to mirror the sibling fairyfox-games project, which copied the hub site-header and added a well-organized subnav. assets/docs-theme/fairyfox-docs.js now injects, on every page, a copy of the fairyfox.io .site-header (Fairy Fox brand → fairyfox.io + the hub's primary nav) and a project subnav (Overview · Project Notes · Systems · Reference · Changelog + Repository/Notes links, active item tracked by page), replacing the old sidebar-brand + breadcrumb. The header + subnav sit in one fixed .ff-top container whose measured height feeds a --ff-header-h var so docdash's sidebar/#main clear it. Ported the hub's .site-header/.subnav CSS into fairyfox-docs.css and scoped the docdash layout rules to body > nav / .ff-top .wrap (docdash's sidebar is itself <nav class="wrap">, so unscoped nav{}/.wrap{} had been capturing the injected bars). Fonts are now self-hosted — vendored the hub's Fraunces/Inter/JetBrains woff2 (from fairyfox-games, OFL-1.1) into assets/docs-theme/fonts/ and dropped the Google Fonts <link>, so the docs make no third-party request (matching the project's privacy stance). scripts/build-docs.mjs copies the fonts into the output. Verified visually at 1280/768/360.

2026-07-05 — README: use the prompt-blocks GIF as the "How to run" visual (docs; no version bump)

Swapped the third README image (the static Generate screenshot under How to run) for the animated prompt-blocks.gif walkthrough — the release-screenshot toolkit already generates and publishes it to the Pages site, so this just points the README at it.

2026-07-05 — Screenshots 512px tall + desktop Single hero in the README (docs + tooling; no version bump)

Dropped the release-screenshot capture height from 768 to 512 (STATIC_HEIGHT in scripts/screenshots/config.mjs), so every static shot is now ‹device-width›×512. Swapped the README hero from the Single-view tablet shot to the desktop one (single-desktop.png) so all four embedded screenshots are desktop-width, and bumped the images' cache-bust query to ?v=3 so GitHub refetches the new heights. Verified locally that every emitted PNG is ‹width›×512.

2026-07-05 — README rewrite + new CONTRIBUTING.md; screenshots captured at a uniform 768px height (docs + tooling; no version bump)

Rewrote README.md around a clearer structure — a "Random AI Prompt" title, an extended one-paragraph description, and What is this / Some of the features / How to run / How to build / Contributing / Credits / Links sections — with four app screenshots (embedded by their stable Pages URL) spread one-per-section instead of pooled, and the badge wall dropped. Added a new CONTRIBUTING.md documenting the fork → dev-branch → PR workflow, the npm test verification gate, and commit style.

Changed the release-screenshot toolkit so each static shot is a viewport capture at a fixed 768px height — every device keeps its native width (desktop 1025, tablet 770, phone 345) but the height is uniformly 768, so the images need no cropping. STATIC_HEIGHT (768) and STATIC_SCALE (now 1, so the native pixel height is exactly 768) in scripts/screenshots/config.mjs; the shot helper takes a viewport (not fullPage) screenshot. Verified every emitted PNG is ‹width›×768.

2026-07-04 — Fix: DPL autocomplete popup unreadable in dark mode (2.42.1)

The CodeMirror autocomplete dropdown and its info panel (block description + example) rendered light-on-light in dark mode — near-invisible. Cause: CodeMirror injects its default light tooltip theme as an UNLAYERED <style>, and our overrides live in @layer components; unlayered rules beat layered ones regardless of specificity, so CM's rgb(245,245,245) background won while our light text stayed. Fixed by forcing the surface colours with !important (background/border/text on .cm-tooltip-autocomplete, the selected row, the sticky section header, and .cm-completionInfo) so our theme wins over CM's unlayered defaults — gui/src/styles/components/generic-code-highlighting.css. Verified readable in both dark and light. Regression guard: tests/e2e/autocomplete-contrast.spec.js (dark scheme → asserts a dark info-panel surface + light text). Found while capturing the release-screenshot GIF, which shows the popup.

2026-07-04 — Automated release screenshots + GIF walkthroughs (tooling; no version bump)

A new scripts/screenshots/ toolkit that captures always-current app imagery on every release and publishes it to the GitHub Pages site — not committed to the repo — so the README can reference it by stable Pages URL (https://fairyfox.io/random-ai-prompt/screenshots/…).

• Capture (capture.mjs). Builds the local edition, serves gui/dist on a throwaway static server, drives it with Playwright, and emits per-screen PNGs at three viewports — desktop 1025×768 (one past the 1024 tablet cap → full desktop UI), min-tablet 769, min-phone 345 — for Generate + the building-block palette, Gallery, Single, and Manage, plus an index.json manifest and a browsable index.html. Statics are 2× (retina).
• Seeded backends (seed.mjs). The local-only screens (Gallery/Single/Manage) have no filesystem backend on a static host, so the /api/* calls are Playwright-route-mocked with representative sample data (gradient placeholder thumbnails synthesized via pngjs, a sample content tree + DPL). No real user content ships.
• GIF walkthroughs (gifs.mjs + scenarios/). A registry of authored scenarios (the "manually say what each GIF is" surface). First one: typing {#prompt/simple-random}, {#futuristic}, {#glow}, {#neon}, {#city} into the prompt box, one char/frame, 5s. Frames are encoded with gifenc using inter-frame differencing (only changed pixels stored; the rest transparent, revealing the retained previous frame) so a full 1025×768 clip is ~220 KB, not multiple MB. A reusable synthetic-cursor overlay (cursor.mjs) is in place for future mouse-movement GIFs (Playwright screenshots don't include the OS pointer).
• Pages wiring. pages.yml installs Chromium and runs the capture into docs/jsdoc/screenshots right before the artifact upload, so the set refreshes on every push to main.

Pure-JS encoding (no ffmpeg) so it runs identically on Windows + the Linux runner. New dev deps: gifenc, pngjs. Tooling/CI only — no app-code or data-practice change, so no VERSION bump and the legal docs are unaffected.

2026-07-04 — Large-scale performance: virtualized gallery, bounded results, per-provider concurrency + a perf suite (2.42.0)

Made the app stay seamless at its officially supported maximum simultaneous load — a 100k-image gallery + 1000 prompts / ~10k images + a 100k-line Manage file, all at once — and added a profiling + Playwright perf suite that guards it.

• Virtualized the photo gallery. Gallery.jsx rendered every feed item (filtered.map) — 100k <img> cells would hang the tab. It's now a windowed uniform responsive grid (only viewport + overscan cells in the DOM, a full-height spacer keeps the scrollbar honest) via the new pure, unit-tested gui/src/lib/virtual/windowRange.js. Bounded DOM at any item count; search/captions/hover actions/lazy fade-in preserved. (Trade-off: uniform square cells instead of the old wide/tall masonry spans — required for exact row-windowing at scale.)
• Bounded the 1000-prompt results list. content-visibility: auto on .prompt-result (offscreen rows skip layout/paint/image decode) + a memoized PromptResult (unchanged rows keep object identity across setPrompts, so one image landing re-renders one row, not 1000). All prompts "roll out at once" yet scroll stays smooth and the mounted list is cheap across tab switches.
• Placeholder-first, chunked, per-provider image generation. useImageBatches.makeBatch now adds the busy placeholder batch synchronously for every prompt, then runs the real generate+ingest behind a concurrency limiter — so 1000 prompts × 10 images shows placeholders instantly and streams in a bounded few at a time instead of firing 10k requests. Rewrite (auto-fix/keyword) calls go through a separate limiter sized to the text provider.
• New shared-settings system (gui/providers/_shared/settings/). The limits are a per-provider "Batch chunk size" — the first shared provider setting: declared once, auto-discovered (globbed) like providers/blocks, and folded into every generating provider's schema (applySharedSettings) so it shows in each provider's gear and flows through flattenForProvider. Metadata-derived defaults (local engine → 6, hosted API → 3 to respect rate limits + the browser's per-host cap, submit-poll → 4), overridable per provider. Applies to image, text, and upscale providers independently. This is why switching image provider (ComfyUI → OpenAI) carries its own sensible limit and the online build's browser-direct providers stay gentle.
• Manage 100k-line list + hot-reload. The list editor was already windowed; the perf suite now proves it stays bounded/smooth at 100k lines, that filtering 100k entries and entry↔raw (CodeMirror) switching are responsive, and that adding/modifying a huge file on disk hot-reloads (real fs.watch SSE) without freezing.
• Perf suite + profiler. tests/perf/ (Playwright, run against the real release server via playwright.perf.config.js): gallery-100k, generate-1000, manage-100k, hot-reload, and a combined max-load spec — asserting bounded DOM, heap ceilings, tab-switch + round-trip scroll budgets (robust, generous budgets so a loaded CI runner won't false-fail). npm run test:perf:scenarios (wired into test:all + a CI job); npm run profile (scripts/profile-scenarios.mjs) captures DevTools traces + Performance metrics + frame stats to perf-profile/. New unit tests: windowRange, sharedSettings, and extended useImageBatches (instant placeholders + concurrency cap).

2026-07-04 — Seed follow-up: preview independence, seed-logic extraction, coverage + zero Sonar debt (2.41.3)

Hardening pass on the 2.41.2 seed work so the required quality gates (SonarCloud coverage + zero tech debt, CodeRabbit) are clean:

• Previews are now seed-independent (bug fix). The live-preview eye, the building-block hover examples, the DPL editor/insert-bar examples, and the cycling suggestion expand through expandPrompt, which had begun honouring the seed — so a pinned prompt froze every preview onto one example. expandPrompt now reverts to its historical always-random behaviour (a throwaway preview seed that re-rolls each call, never reading or writing the user's promptSeed), so every preview caller is unchanged and no longer freezes. The one seed-honouring caller — the real negative-prompt roll in useImageBatches — moves to the new expandPromptSeeded, so a pinned roll reproduces the negative too. (An earlier attempt added a separate previewPrompt and edited five components; that was reverted in favour of this smaller, behaviour-identical split.)
• Seed-roll logic extracted to pure, unit-tested helpers. gui/src/lib/home/seed.js (pickRollSeed / forkRollSeed / shouldReflectSeed) and gui/src/lib/home/buildRoll.js (the whole roll assembly — wrapper framing, per-prompt seed forking, Auto-Begin/End folding, count clamping) replace the inline logic in Home's buildPrompts, matching the existing lib/home/* pattern; the component keeps only the React state updates. Both are fully unit-tested. Removed the now-unused newRollSeed facade export (dead code).
• Zero SonarCloud tech debt. Fixed all 6 outstanding code smells (pre-existing, unrelated to the seed work): nameOrder.js negated condition (S7735); three String.raw regex strings + one nested ternary + one String#endsWith in dpl/parser.js (S7780 ×3, S3358, S6557). Behaviour preserved (DPL contract/snapshot suites green). Zero bugs, vulnerabilities, and security hotspots confirmed.
• Tests. New unit suites: homeSeed (roll-seed helpers), buildRoll (roll assembly: fork seeds, framing, folding, count clamping), random (the ambient-RNG accessors + install/restore), SettingsSeed (the Random toggle, read-only-when-random box, free-text entry, contextual hint), plus facade tests that expandPrompt re-rolls under a pin (and doesn't mutate settings) while expandPromptSeeded reproduces. Node 270 + web 342 green; lint + smoke + doc-links green.

2026-07-04 — Fix: "random" reroll was frozen + add an explicit Random-seed control (2.41.2)

Re-rolling kept returning the same prompt. Two independent bugs, both surfaced by the async/ deterministic engine overhaul:

1. Seed conflation. The GUI's default image-provider seed is -1 (a Stable-Diffusion "pick a random seed" sentinel). After the overhaul the engine's hasSeed treated any present seed — including that -1 — as an explicit prompt seed, so every generation ran createRng(-1) and produced the identical prompt. The prompt engine's seed and the image seed are different concepts and were never meant to share a field.
2. Leftover list-stage state. src/core/stages/list.js held its emphasis/editing/alternating func-rotation bag (promptFuncsTmp) as closure state that was not reset per generation. Because the SPA engine is a module singleton (reused across every roll), residue from the previous roll changed the next roll's shuffle/pick order — so even a pinned seed failed to reproduce once emphasis fired. The Node tests missed it by building a fresh engine per call (bag always already empty).

Fixes + the new feature (per the owner's design — no magic seed values):

• List stage now resets promptFuncsTmp at the start of every generation → a seeded run is fully reproducible while still rotating funcs within one prompt.
• Prompt seed is its own field. The GUI facade (gui/src/lib/promptEngine.js) sources the engine seed only from a dedicated promptSeed, never the image seed, and random-vs-pinned is driven by an explicit randomSeed boolean — so any integer (0, negatives) and free text (letters/spaces/emoji, hashed by the RNG's cyrb128) are valid seeds. Reverted a short-lived -1 special-case in the engine; hasSeed is a plain presence check again.
• Gear UI (Settings.jsx). New Seed group: a Random seed toggle + a seed box. Random on → a fresh seed each roll, written back into the (greyed, read-only) box so it's visible/copyable; Random off → the box un-greys for a manual free-text seed that pins the prompt. Each roll forks one base seed as base#i per prompt (reproducible batch); the used seed is reflected back for display.
• RNG hardening (src/helpers/random.js). The ambient generator now lives on a global Symbol.for slot instead of module-level state, so a duplicated copy of the module (SPA corpus code-split) can't silently un-seed part of the pipeline. Defensive; the reproducibility bug itself was the list-stage state.
• Tests. Engine regression (reused-engine reproducibility with emphasis on; any integer seed honoured, no seed rerolls) + GUI facade regression (random-on rerolls, random-off pins through emphasis, forced fork seed, negative/zero seeds, free-text seeds). Full suites green (Node 263, web 321); lint + smoke green; verified live in the browser at desktop width (toggle greys/un-greys, free-text accepted, used seed shown after a roll).

2026-07-04 — Fix: mobile composer settings-gear backdrop painted over its own menu (2.41.1)

On phone/tablet (<=1024px), tapping the prompt-settings gear in the composer's top-right corner showed the dark backdrop on top of the settings menu — you couldn't scroll or tap it. Cause: the shared .gear-pop-scrim gets the dark full-screen backdrop (z-90) on mobile, but the bottom-sheet rule that lifts a popover above it only listed the provider gear (.provider-gear .gear-pop.provider-gear-pop). The composer's plain .gear-pop stayed at its desktop z-index (42), so the scrim covered it; .composer-corner (z-index:2) also trapped the fixed scrim+sheet in its stacking context. Fix: add .prompt-settings-gear .gear-pop to the mobile bottom-sheet + scroll rules (z-91, above the scrim), and set .composer-corner z-index:auto at <=1024px so the fixed backdrop + sheet escape to the root context (over the FAB). Added a regression guard in tests/e2e/responsive.spec.js (hit-tests that the menu body is the top element and only the area outside the sheet is the scrim; proven to fail pre-fix, pass post-fix). Verified live at 455px (computed z-order + elementFromPoint + screenshot); eslint + stylelint + prettier green.

2026-07-03 — Bump Vite 8.1.2 → 8.1.3 (gui lockfile)

Routine in-range patch of the SPA's build tool (the only outdated dependency across root + gui). Lockfile only — package.json already allows ^8. Verified: gui build clean (676 modules), 313 SPA tests + 21 E2E green. No version bump (dev tooling).

2026-07-03 — Modernize release signing to cosign 3.x bundles (CI-only)

Followed up the emergency v2.4.1 pin by moving the release signing onto cosign 3.x properly instead of staying on the old line. sign-blob now emits a self-contained Sigstore bundle per asset via --bundle, attached to the release as <asset>.sigstore.json — a name OpenSSF Scorecard's Signed-Releases check recognizes (it matches .sig / .sigstore / .sigstore.json / .intoto.jsonl), so the Signed-Releases score is preserved while dropping the separate .sig + .pem pair. Pinned cosign-release: v3.1.1 (reproducible — a floating latest is what broke us). Verify command updated to cosign verify-blob --bundle <asset>.sigstore.json …; docs in reference/deployment.md updated. Validated the keyless signing end-to-end in CI via a throwaway dry-run before merging. CI-only — no version bump.

2026-07-03 — Fix release signing (pin cosign 2.x) so v2.41.0 can publish (CI-only)

The v2.41.0 push to main cut the merge, but the Release workflow failed at the keyless-cosign signing step. The cosign-installer was installing cosign 3.x, which makes the new bundle format the default and drops the classic detached outputs — --output-signature / --output-certificate error with "must provide --new-bundle-format or --bundle …" (a first attempt to pass --new-bundle-format=false also failed). Because signing runs before "Publish GitHub Release", no v2.41.0 tag/Release was created. Fixed by pinning cosign-release: v2.4.1 in the installer step (2.x keeps the <f>.sig / <f>.pem assets the verify instructions + any consumers expect). TODO: migrate to --bundle to adopt cosign 3.x. Merging this to main re-triggers the (still tag-absent) release, publishing v2.41.0. CI-only — no version bump.

2026-07-02 — Tablet tier: split-screen layouts + compact chrome (769–1024px) (2.41.0)

Tablets (iPad Air 820, Zenbook 853, Surface 912, iPad Pro 1024) were falling into full desktop mode, where the header controls ran off the right edge and the Generate button clipped — cramped and whacky. Introduced a proper tablet tier by splitting the responsive system into two boundaries:

• Compact CHROME at <=1024px (phones + tablets): the header's secondary controls fold behind the ⋯ overflow menu, the DPL insert bar collapses to a single "Insert" button, the links fold inline, the Size control tucks behind its cog, and the composer's action bar wraps so Generate never clips. Driven by widening useCompact() (768→1024) and moving the header-overflow / field-bar / cm-tab / submenu-sheet media queries to <=1024px.
• Layout-collapse stays at <=768px (phones only, CSS): the two-pane Generate (building-block palette) and Manage (tree + editor) workspaces keep their split screen on tablets instead of collapsing to a drawer / master-detail. Tablets also keep the wordmark, full-size tabs, and the footer (phones drop them).

Net: tablets get the roomy two-pane split with phone-style, non-clipping chrome — more than a phone, but not the full desktop. Full desktop resumes unchanged at >=1025px (verified the overflow toggle is hidden at 1025 and 1280, header inline). Added three tablet E2E specs (header collapses + wordmark kept; Generate palette stays a split pane; Manage stays two-pane). Verified with 820/1024 screenshots of Generate + Manage. Full gate green (check:docs, lint, smoke, 260 unit + 313 SPA + 21 E2E).

2026-07-02 — Fix: overlay actions escaping to the page header on phone (2.40.33)

The new single-image overlay actions were landing at the viewport's top-right — over the page header — on phones, all the time. Root cause: a second stylesheet (gallery-single-image-derived.css) pinned .g-single-img { position: static } at <=720px, overriding the relative in gallery-single-image-page.css (<=768px), so the image box wasn't a containing block and the absolute overlay anchored to the viewport. Changed that rule to relative (still drops the desktop sticky). Verified the overlay's offsetParent is now the image box; updated the phone single-view E2E to assert relative

• that the overlay anchors to the image. lint + E2E green.

2026-07-02 — Single-image overlay actions are always visible (2.40.32)

Follow-up to 2.40.31: the overlay inherited the thumbnails' hover-to-reveal (opacity 0), so on the single focal image the buttons read as missing until you happened to hover. They're now always visible (opacity 0.85, lifting to 1 on hover), with a z-index so they sit above the image link. Verified without hovering.

2026-07-02 — Single view: image actions move onto the image as an overlay (2.40.31)

Decluttered the Single-image action row. Open / Reveal / Delete now overlay the top-right of the image (reusing the gallery thumbnails' .img-actions dark glyph pills — ↗ open, ⌖ reveal, ✕ delete), plus a Download (⤓) as an extra the thumbnails don't have. They're gone from the button row below the image, which now holds only Convert & download and Resize. The overlay reveals on hover (and stays visible on touch via the existing pointer:coarse rule); .g-single-img is now relative on compact so the absolute overlay anchors to it. Open/Reveal/Delete still require the local file; Download works from the served path. Verified via screenshots; full gate green (lint, 260 unit + 313 SPA + 18 E2E).

2026-07-02 — Compact: Prompt/Negative switch matches the Insert button height (2.40.30)

On a phone the single "Insert" button is a 36px tap target while the Prompt | Negative segmented switch (shown when a negative-capable image provider is selected) was only ~27px — visibly mismatched side by side. Bumped the compact .cm-tab to a 30px min-height (→ ~36px control) so the two line up. Desktop is unchanged (they were already within ~2px there). Measured before/after; lint + E2E green.

2026-07-02 — Single view: Delete no longer orphaned on the actions row (2.40.29)

The Delete button carried margin-left:auto, pushing it to the far edge of the actions row. In the narrow metadata column the row wraps, so Delete kept landing alone on the second row with a big gap before it. Dropped the auto margin so it flows inline right after the other actions — its red styling still sets it apart. Desktop single-row layout is unaffected (it just sits after Resize instead of far-right). Verified via screenshot; lint + E2E green.

2026-07-02 — Single-view button tidy: locked Keywords AI, compact Resize, Details copy menu (2.40.28)

Three Single-tab polish items from the owner's review. (1) Keywords "Rebuild with AI" locks, doesn't vanish. It used to render only when a Text provider was selected; now it stays visible but disabled (with a "pick a Text provider" hint) whenever the image is rebuildable — matching the composer's wand/tag pattern. (2) Resize control no longer clunky. The .g-resize <select> was missing the shared button styling and sized its closed box to its widest hidden option ("AI Upscale — "), so it ballooned; it now gets the same border/padding as the others and a max-width cap so it reads as a compact "Resize…" (Convert is left uncapped — its own placeholder is its widest text). (3) Details copy actions → 3-dots menu. "Copy as JSON" wrapped to a second line in the cramped header; the Markdown/JSON copy buttons now live behind a right-aligned kebab (⋮) on the Details header, with View Raw beside it. Applies on desktop + mobile. Verified via screenshots; full gate green (lint, 260 unit + 313 SPA + 18 E2E).

2026-07-02 — Narrow phones: Size tucks behind a cog (2.40.27)

Follow-up to the 2.40.26 wrap fix, per the owner's preference: on compact widths the prompt-box tools row keeps Prompts (and Images, when present) inline, but the wider Size control now tucks behind a small cog button that opens a little popover holding the same Size control the desktop shows inline. Prompts-only and Prompts+Images rows are untouched; only providers that expose a size/ratio (or W×H) get the cog. Driven by the shared useCompact() hook in InlineImageControls; desktop renders Size inline, unchanged. The cog is a 34px tap target and its popover opens upward, right-aligned. (The row's flex-wrap from 2.40.26 stays as a harmless fallback.) Full gate green (lint, 260 unit + 313 SPA + 18 E2E).

2026-07-02 — Prompt-box tools row wraps on very narrow phones (2.40.26)

On a 375px screen (iPhone SE) with an image provider selected, the Prompts / Images / Size (W×H) cluster at the bottom of the prompt box was ~318px wide inside a ~302px field, so it overflowed the box's right edge and clipped. The compact .prompt-tools row now flex-wraps (with a small row-gap, min-width:0, max-width:100%), so the Size group drops onto its own line and everything stays inside the box. Measured before/after at 375px (overflow gone). Compact-only; desktop unchanged.

2026-07-02 — Mobile menu scrolls instead of clipping off the bottom (2.40.25)

Folding the links in made the phone overflow menu taller than a short screen, so its bottom (Cookies + version) clipped off. The mobile .topbar-controls now caps at calc(100dvh - 72px) with overflow-y: auto + overscroll-behavior: contain and a safe-area-aware bottom padding, so the whole menu scrolls within the viewport. Verified on a 390×620 phone (scrolled to the version). Desktop unchanged.

2026-07-02 — Mobile menu: Language moves up under Appearance (2.40.24)

Small ordering tweak in the phone overflow menu: the Language picker now sits directly below the Appearance control — grouping it with the other settings (Providers / Provider settings / NSFW / Appearance / Language) — with the project links, legal pages, and version below it. Compact-branch only; desktop links dropdown unchanged. Lint clean; E2E green.

2026-07-02 — Mobile links fold into the overflow menu; app version in the footer (2.40.23)

Two header/footer polish items. (1) Links inline on mobile. On a phone the header overflow ("⋯") menu had a "Links" row that opened another separate bottom sheet — a nested panel that read as a stray, differently-shaped surface. The links now fold directly into the overflow menu as inline rows (project links → legal pages → language picker), so one tap of "⋯" shows everything in a single coherent panel — no nested trigger, no second sheet. Driven by a new shared, hydration-safe useCompact() hook (extracted from DplInsertBar, which now imports it): desktop still renders the icon-button dropdown unchanged; only the compact (<=768px) branch inlines. Removed the now-dead mobile .links-pop / .links-scrim sheet rules. (2) App version on show. The canonical version (repo-root package.json, in lock-step with VERSION) is baked in at build time via a Vite define (__APP_VERSION__, with a typeof fallback to "dev" under Vitest) and shown as v2.40.23 — pinned faint to the right of the desktop footer, and at the foot of the mobile inline links menu (the footer is hidden on phones). Desktop layout otherwise unchanged. Updated the phone top-bar E2E (asserts the inline links, not the old trigger) and the PromptResult clear-button test (matches the icon button's descriptive aria-label). Full gate green (lint, 260 unit + 313 SPA + 18 E2E).

2026-07-02 — Manage editor: compact name/Save, cleaner Back button (2.40.22)

Manage folder/entry editor polish. The name field (.mg-name-input) was a 1.1rem display-font box and the Save button a full-size .primary — both oversized and mis-matched in height (same on desktop). Trimmed the name field to 0.95rem with tighter padding + a sane flex-basis, and gave the editor-head Save a compact size so the two line up. The mobile master/detail "Back to list" button is now a proper app button — an accent-tinted pill with a real chevron icon (new ChevronLeftIcon) that hugs its label (added width:auto to beat the .main-col > * full-width rule) instead of a plain full-width bordered pill. Verified with screenshots (desktop head + mobile pane). Full gate green (unit + 18 e2e).

2026-07-02 — Single view: drop DPL vary, fix Download-PNG alignment, smaller mobile controls (2.40.21)

Four single-image-view fixes. (1) Removed the "vary" action from the DPL SOURCE row (both editions) — re-roll stays there; "make variation" remains on the Sent / AI layers. (2) UI bug fix: the "Download PNG" text sat too high — it's an <a>, so its text was baseline-aligned inside the padding box instead of centered like the neighbouring buttons; gave .g-action-link display:inline-flex; align-items:center (fixes desktop + mobile). (3) Smaller action row on mobile (≤768) — open/reveal/download/convert/ resize/delete get tighter padding + font. (4) Smaller Back + prev/next on mobile — they were bumped to 44px by the touch rule; removed the single-view controls from that bump and set compact sizes at ≤768. Verified by route-mocking /api/feed and screenshotting the Single view on desktop + mobile. Full gate green (unit + 18 Playwright).

2026-07-02 — Results list: icon clears, icon-only "More images", stacked prompt on mobile (2.40.20)

Four tweaks to the generated-prompt results. Both editions: the per-prompt clear (.copy-mini) and the header Clear all are now flat trash-icon buttons (new shared TrashIcon; muted → red on hover) with aria-labels, instead of text links. Non-desktop only (≤768px): the "More images" / "Generate images" button is icon-only (its label is wrapped in .gen-btn-label, hidden on mobile), and each result row stacks — the number (+ its action buttons) on top, the prompt text/DPL full-width below (.prompt-line wraps; .prompt-main gets flex-basis:100% + order). Desktop keeps the "More images" label and the side-by-side number/text layout. Verified by generating a prompt and screenshotting the results card on desktop + mobile. Full gate green (unit + 18 Playwright).

2026-07-02 — Composer buttons: comfortable 40px tap target on touch (2.40.19)

The composer action buttons had gone to a flat 34px everywhere, which is a bit tight for a touchscreen (below the ~44px comfortable standard). Kept the compact 34px on desktop (mouse is precise) but gave .field-act a 40px min tap target on coarse pointers — comfortable without the clunky feel of a full 44 that the segmented tabs had. Touch-only (@media (pointer: coarse)), so desktop is unchanged (measured 34px desktop / 40px touch). Playwright (18) green.

2026-07-02 — Composer/palette density: bigger chip cloud, smaller tools + buttons (2.40.18)

Three density tweaks, all base rules so they apply on both desktop and mobile: (1) the building-block chip (pill) cloud now takes ~half the palette — dropped the category list's cap (.cat-tabs max-height 50%→40%), so the chip area went from ~37% to ~49% (desktop) / ~46% (mobile) and shows many more chips. (2) The PROMPTS / IMAGES / SIZE tools read smaller — label .field-count-label 0.68→0.62 rem and the value inputs (count / size text / W×H) set to 0.82rem (were ~1rem). (3) The composer's action buttons (.field-act) shrank 38→34px and are no longer bumped to 44px on touch, so they're the same compact size everywhere. Verified by measuring (chip 49%/46%, buttons 34px) + screenshots on desktop and mobile. Full gate green — the sidebar/full-page visual baselines still pass.

2026-07-02 — Composer: prompt text sits below + left-aligned with the validity icon (2.40.17)

The prompt box typed the first line indented 1.8rem so it cleared the top-left validity ✓ — which put the text awkwardly to the right of and level with the icon, with a lopsided margin. Now the editor reserves top padding so the text starts below the icon, the first-line indent is removed so every line left-aligns, and the icon's column is aligned to the text (icon left 360 ≈ text left 361; text top 172 sits under the icon bottom 167). Applies on both desktop and mobile (a deliberate fix the user asked for on both) — padding top 0.95rem→2.2rem (2.1rem compact), text-indent→0, and .composer-corner-left left-aligned with a left-justified glyph. Verified by measuring the icon vs text rects + screenshots (desktop + mobile, typed + placeholder). Full gate green (visual regression still passes — the prompt box is masked in the full-page shot).

2026-07-02 — Mobile: secondary composer actions left, Generate alone on the right (2.40.16)

Refinement of the previous fix: the wrapped action row bunched ALL buttons on the right. Now only the primary Generate button is pushed right (.field-act.primary { margin-left: auto }) while the secondary actions (wand / tag / wrapper / share / shuffle) stay left-aligned, and the count/size tools take their own row above (.prompt-tools { flex-basis: 100% }). So Generate sits alone in the bottom- right corner. Scoped to ≤768 — desktop unchanged (visual regression passes). Verified by screenshot.

2026-07-02 — Mobile: Generate button back in the bottom-right corner (2.40.15)

When the composer's field-bar wraps on a phone (once a provider adds Images/Size controls), the action buttons had dropped to a left-aligned second row, so the primary Generate button wasn't in the corner. Now the wrapped action row is right-aligned (justify-content: flex-end + the tools take margin-right: auto, replacing the flex spacer), so Generate sits in the bottom-right exactly like desktop. Verified by measuring Generate's right edge against the card's, plus screenshots at phone + desktop. Scoped to ≤768 — desktop's single-row field-bar is unchanged (visual regression confirms). Playwright (18) green.

2026-07-02 — Mobile: provider list expands inline in the sheet (no clip/double-shadow) (2.40.14)

Follow-up to the bottom-sheet work: inside the Providers sheet, tapping a picker (Image/Text/Upscaler) opened its grouped provider list as a floating desktop dropdown that ran off the bottom of the screen and stacked two dim layers — a nested dropdown inside a sheet can't fit. Now, on mobile, that list (.pm-pop .provider-picker .ps-pop) renders inline: position: static, full-width, stacked below its trigger, so it flows within the sheet (which already scrolls) and can't clip; its own redundant scrim is hidden and the heavy shadow dropped (it's inline, not floating). Verified the list's bottom is within the viewport (was 475px below) and re-screenshotted the LOCAL/ONLINE groups reading cleanly. This one I'd missed by not opening the third-level list in my earlier self-review — now part of the check. Desktop untouched (all ≤768). npm test + Playwright (18) green.

2026-07-02 — Mobile: header submenus become full-width bottom sheets (2.40.13)

Tapping a row in the mobile overflow menu used to open that control's desktop dropdown — a small, differently-shaped panel floating in mid-air (and the Providers one was a broken 2-column desktop grid with a big empty key column + wrapped text). At ≤768px all four submenus (Providers / Provider settings / Appearance / Links) now render as one consistent thing: a full-width bottom sheet over a full dimming backdrop, scrollable, pinned to the bottom — so each reads as part of the mobile menu. New mobile-sheets.css (scoped to each control's wrapper so it out-specifies the base positioning, e.g. .provider-gear .gear-pop.provider-gear-pop{right:0}); the Providers .pm-row grid stacks to one column (picker over key field). Raised the overflow menu's stacking context (.topbar-controls z-index 42→90 at ≤768) so the sheets — fixed children that can't escape their ancestor's stacking context — paint over the Home FAB instead of under it. Desktop is untouched (everything is inside the ≤768 query; verified the header dropdowns are unchanged). Self-reviewed each sheet from screenshots (fixed the right-anchored gear panel and the FAB bleed-through). Verified: npm test + Playwright (18, desktop visual unchanged).

2026-07-02 — Mobile: the "⋯" menu is now a proper labeled list (2.40.12)

The overflow menu was a pile of bare, centered, icon-only buttons (gear / palette / hamburger) mixed with two labeled controls — disjointed and ragged. Rebuilt it as a clean labeled list: each control is a full-width row with a leading icon, a text label, and its value / switch / caret, all left-aligned into a consistent column (Providers · Provider settings · NSFW · Appearance · Links). The three icon-only triggers got an injected .ctl-label (Provider settings / Appearance / Links) that is hidden on desktop (.ctl-label { display:none }), so the inline desktop triggers stay icon-only and desktop is unchanged. All the row styling is scoped under .topbar-controls inside the ≤768 query. Tapping a row still opens that control's popover (verified). Self-reviewed from screenshots (spotted + fixed the center-aligned icon rows and mis-aligned labels). Regression-locked in responsive.spec.js (labels visible in the menu, hidden on desktop). Verified: npm test + Playwright (18, desktop visual unchanged).

2026-07-02 — Responsive: desktop Insert row restored + mobile/tablet control sizing (2.40.11)

Keeps the desktop unchanged while sizing controls right for touch. The DPL Insert control now has two width-chosen presentations: the original row of per-category buttons on desktop (>768px) — restored exactly, so full-size desktop looks like before — and the single Insert ▾ button + drill-down menu only on compact (≤768px). The switch is a hydration-safe matchMedia hook (useCompact): both the server and the client's first render draw the desktop row (no mismatch, no desktop flash), then compact settles in post-hydration. Restored the .dpl-insert-lead / .dpl-ins-pop-right styles the row needs. Mobile/ tablet sizing (all gated to ≤768, desktop untouched): view-switch tabs bumped from ~23px to a ~34px tap target (comfortable, not the clunky 44px), the compact Insert button to ~36px, and the composer prompt font trimmed 1.05rem→0.92rem with a small right gutter so it no longer runs under the eye/gear icons. Verified on a touch-emulated device (measured 34/36px, font 0.92rem) + desktop (row back: lead + 7 category buttons, no single button) + npm test (260) + Playwright (18, incl. visual regression — desktop matches).

2026-07-02 — DPL Insert toolbar → a single "Insert" button + menu (2.40.10)

Collapsed the composer's DPL insert toolbar from a full row of per-category buttons (Structure, Chance, Choose, Repeat, Flow & calls, Emphasis, Code — which wrapped onto 2–3 rows on narrow screens) into a single Insert ▾ button that opens a menu. The menu lists the categories (each with its one-line hint), and picking one drills into that category's constructs — name, description, literal syntax, and a live re-rolling example — with a "‹ Back" row to return; picking a construct still drops its snippet at the cursor. Escape backs out a level then closes; a tap-away scrim closes it. Same behavior on desktop and mobile (one clear action instead of a button row). Reused the existing popover/item styling; removed the now-dead .dpl-insert-lead / .dpl-ins-pop-right rules. Verified with screenshots (phone + desktop, both menu levels) + the full gate (npm test) and Playwright suite (18, desktop visual baselines unchanged).

2026-07-02 — Responsive UI: mobile polish — icon FAB, working scrim, no button overflow (2.40.9)

Follow-up fixes from a second visual review. (1) The tap-away scrim never worked — its wide-screen display:none default was never overridden inside the ≤768 block (only position/opacity were), so the scrim was display:none: invisible AND catching no clicks, so clicking off didn't close the drawer. Caught by looking (the background wasn't dimmed) + a runtime probe (elementFromPoint returned the composer, computed display:none). Fixed; added a regression test that taps the scrim to close. (2) "Building blocks" is now a small icon-only FAB in the bottom-left corner (was a wide inline pill); the privacy footer is hidden at ≤768 so the FAB has clean space (same info remains on the legal pages via the links menu). (3) Composer action buttons no longer overflow on narrow screens — the field-bar wraps the action row below the tools (flex-wrap + a full-basis spacer) once a provider adds its Images/Size controls. Verified with headless screenshots at 360/390/768/1280 and the full gate (npm test 260+313) + Playwright suite (18, incl. visual regression — desktop unchanged).

2026-07-02 — Responsive UI: mobile-layout rework after visual review (2.40.8)

A real-device review of the phases-1–6 result exposed problems the functional Playwright tests missed (they checked behavior, not appearance): the four view tabs overflowed and "Manage" was clipped; the overflow menu crammed controls onto wrapped rows; the "Building blocks" FAB floated over the footer; and on tablet the entire building-block cloud stacked on top of the composer, burying it. Reworked the approach: retired the generic ≤860px stack (responsive.css deleted) so Home is now two-pane above 768px and an off-canvas drawer at ≤768 (never a giant stacked cloud), with the composer full-width (grid-template-columns:1fr) and an inline "Building blocks" trigger (was a floating FAB, hence the footer overlap). The header now collapses to the ⋯ menu only at ≤768, the menu is a vertical list (one control per row, not wrapped), and the view tabs are tightened so all four fit at 360px without clipping. Manage master/detail and the Single-view stack were aligned to the same 768 breakpoint (each forcing the visible pane full-width). Dropped the clunky 44px min-height from the segmented view tabs. Verified by looking — headless screenshots at 360/390/768/1280 — plus the full gate (npm test 260+313) and the whole Playwright suite (18 specs incl. visual regression: desktop still pixel-identical).

2026-07-02 — Responsive UI, Phase 5: touch ergonomics (2.40.7)

New touch.css, guarded by input-capability media queries (hover/pointer) rather than width, so it targets touch devices and leaves the desktop/mouse rendering (and the visual-regression baselines) untouched. @media (hover: none) keeps the hover-revealed action buttons permanently visible — the Manage entry delete/restore (.mg-pill-act), per-image actions (.img-actions), list-row delete (.mg-row-del), and custom-theme delete (.theme-swatch-del) all faded in on :hover, so on a touchscreen they were invisible AND untappable. @media (pointer: coarse) gives the primary controls (view-switch tabs, composer actions, single-view nav/actions, header triggers, Manage refresh/back…) a ≥44px tap target per WCAG 2.5.5. Verified by a touch-emulated (isMobile) responsive.spec.js case (hover-only action computes opacity:1; .vs-tab measures ≥44px). Desktop unchanged.

2026-07-02 — Responsive UI, Phase 4c: Manage master/detail on phone (+ drawer scope fix) (2.40.6)

The Manage tab's two-pane tree+editor becomes a master/detail on phones (≤640px): with nothing selected the tree fills the screen; selecting an entry or folder (React selected → the new .workspace.manage.detail-open class) shows the editor with a phone-only "‹ Back to list" button. Desktop/tablet are unchanged — both panes side by side, Back hidden. Also fixed a Phase-4a regression: the Home palette drawer's base .sidebar rule (at ≤640px) was un-scoped, so it also matched Manage's .mg-sidebar and would have parked the Manage tree off-canvas with no way to open it. Scoped every Home drawer rule to .workspace.home (Home's workspace now carries a home class); Manage gets its own master/detail treatment instead. All views are now responsive. New responsive.spec.js cases mock the /api/manage/* backend and verify phone master→detail→back, that the tree is not a stray drawer, and the desktop both-panes layout. Touches Home.jsx, Manage.jsx, home-drawer.css, and the new manage-responsive.css. First paint unaffected (prerender.test.js passes); visual baselines match.

2026-07-02 — Responsive UI, Phase 4b: Single view stacks image over metadata (2.40.5)

On phones/tablets (≤860px) the single-image view's two-column grid (.g-single-body, image left + metadata right) collapses to one column: image on top (un-stuck from its position: sticky and capped at 60vh so it can't fill the screen), details/prompt/keyword cards below. CSS-only, width-driven — no JS/first-paint impact, every action and card preserved (they just re-flow). A sticky bottom action bar was considered and deferred as optional polish. Verified by new responsive.spec.js cases that route-mock /api/feed to populate the view (desktop = 2 column tracks; phone = 1 track + position: static). Desktop unchanged; home visual baselines still match.

2026-07-02 — Responsive UI, Phase 4a: Home building-block palette → phone drawer (2.40.4)

On phones (≤640px) the building-block palette is now an off-canvas left drawer instead of a tall stacked panel, so the composer owns the full width and every block is one tap away — no feature lost. A floating "Building blocks" trigger (new BlocksIcon) opens it; the drawer slides in over a scrim and dismisses via an in-drawer ✕, a scrim tap, or Escape. Open state is React (.workspace.palette-open, flipped on tap post-hydration); the drawer's existence is width-driven CSS, so the online prerender/hydrate first paint is unaffected (prerender.test.js passes). The full-height drawer restores the proper vertical palette layout (undoing the 641–860 tablet-stack tweaks), and prefers-reduced-motion disables the slide. Accessible: aria-controls/aria-expanded on the trigger + a labelled close button. Desktop + tablet are unchanged (the drawer affordances are display:none above 640px; the visual- regression baselines still match). New tests/e2e/responsive.spec.js cases cover desktop-inline vs. phone off-canvas → open → Escape → ✕. Touches Home.jsx, BlockPalette.jsx, icons.jsx, and the new home-drawer.css.

2026-07-02 — Responsive UI, Phase 3: responsive top bar (control-pile overflow) (2.40.3)

First user-visible responsive behavior. The secondary header controls (Providers, provider gear, NSFW, theme, links) now collapse behind a single ⋯ overflow button on narrow screens. Wrapped them in .topbar-overflow: display:contents on wide screens so the inline layout is byte-identical to before (the visual-regression baselines still match), and at ≤820px they collapse into an anchored dropdown panel opened by the toggle (new MoreIcon). The controls render once either way — no duplicated component state and no duplicated position: fixed popovers. Open state is the toggle's [aria-expanded], flipped on click post-hydration, with panel visibility otherwise width-driven, so first paint stays SSR-safe (the online prerender/hydrate is unaffected — prerender.test.js passes). Dismisses on Escape and outside pointerdown. At ≤640px the wordmark drops (logo stays) and the view switch scrolls horizontally instead of overflowing the bar. Accessible: aria-haspopup / -expanded / -controls + label; axe reports no serious/critical violations. Added tests/e2e/responsive.spec.js (a functional viewport matrix — desktop inline / phone collapse+open+dismiss+no-overflow / tablet collapsed) verified in a real browser alongside the existing visual + a11y suites. Desktop rendering unchanged.

2026-07-02 — Responsive UI, Phase 2: adopt the layout cascade layer (2.40.2)

Gave the long-declared-but-empty layout cascade layer real content. Moved the app frame + top-level view/grid skeleton — .app (app-frame.css) and main / .view-pane / .workspace / .sidebar / .main-col (workspace.css) — from components into a new gui/src/styles/layout/ at layer(layout), and rewired index.css. Verified no other component selector targets these, so precedence is preserved and desktop rendering is byte-identical; the Home responsive stack (responsive.css) deliberately stays in components because its overrides target component-internal selectors (.cat-tabs, .composer, …) that must win. Safety finding recorded in the plan: container-type implies contain: layout, which would reparent the position: fixed popovers rendered inside Home's pane (hover tip, DPL insert toolbar, gear popover) — so container contexts will go on leaf wrappers in later phases, never on .view-pane. Pure CSS-structure refactor; no behavior/visual change. Verified with a full gui build (CSS @import graph resolves) + the headless gate (313 tests).

2026-07-02 — Responsive UI, Phase 1: fluid token foundation (2.40.1)

First slice of the mobile/tablet responsive effort (blueprint in notes/plans/responsive.md; item 10 in next-steps.md). Added a fluid type scale (--fs-xs…--fs-2xl, clamp()-based), a fixed spacing step scale (--space-0…--space-12), and two fluid layout gutters (--gutter, --gutter-tight) to foundation/tokens.css, plus the documented breakpoint conventions (phone ≤640 / tablet / desktop ≥1025). Every clamp's max equals today's desktop value, so wide viewports are pixel-unchanged. Applied two real, desktop-neutral fixes: .app height 100vh → 100dvh (with a vh fallback) so mobile browser chrome no longer hides content, and wired --gutter / --gutter-tight into the top-bar and .main-col padding so insets tighten on narrow screens while staying identical on desktop. Foundation only — nothing else consumes the new scales yet; components adopt them in later phases. No data-flow / legal-doc impact.

2026-07-02 — Repo-hygiene guardrails against drift, litter, and uncommitted files (no version bump)

Added mechanical defenses so the problems cleaned up this session can't silently return. scripts/check-links.mjs (npm run check:docs) fails on any broken relative Markdown link — so a doc that still points at a renamed/removed file turns CI red; it's wired into npm test and the CI check job. scripts/check-tidy.mjs (npm run check:tidy) fails on untracked non-ignored files — the guard that would have caught the uncommitted fairyfox reports (run before finishing a session). Enabled the GitHub delete_branch_on_merge repo setting so merged PR branches stop lingering (that setting was false, which is why branches littered). Documented the whole system in the new notes/reference/repo-hygiene.md and codified the rules (commit everything, sweep docs on rename/remove, delete spent branches) as standing instructions in CLAUDE.md. Also added a deletion-only branch protection on dev so delete_branch_on_merge can't auto-delete the work branch on a dev → main merge (it blocks deletion + force-push only; direct pushes are unchanged), and wrote a fairyfox roundup report proposing these systems as hub standards. Tooling/CI/docs only — no version bump.

2026-07-02 — Flatten the repo: remove engine-v1-2, engine-v3 → root, consolidate stages (2.40.0)

Undid the engine-vN split so there is one project again. Removed the frozen engine-v1-2/ snapshot (recoverable from git history + the assets/references/ reference clone; clears its 10 known dependency vulns). Flattened engine-v3/'s contents up to the repo root — src/, data/, gui/, scripts/, tests/ and the tooling configs now live at the top level (renames preserve history), with every hardcoded engine-v3/ path rewritten across the CI workflows, Netlify, JSDoc, Sonar, Codecov, CodeRabbit, Dependabot, .gitignore, build-docs.mjs, and the manage-API restore URL. Consolidated the two live pipeline stages (cleanup.js, prompt-salt.js) from the "legacy" src/prompt-modules/ into src/core/stages/ with the other stages, and removed the dead promptModuleFiles setting. Notes, README, and CLAUDE.md updated to the flat layout. Verified: smoke, gui build, lint, format, Node (260) + SPA (313) suites all green.

2026-07-02 — Activate release signing + branch-protection scan token (2.39.1)

Follow-up to 2.39.0, cutting a release so the new signing actually runs. After 2.39.0 the badge moved 4.2 → 6.2; a direct scorecard run (v5.5.0, admin token) gave the real per-check picture and showed two things the first pass didn't fully land:

• Signed-Releases — the attest-build-provenance attestation (attestations API) is not what Scorecard's check reads; it scans release assets for signature files. Added keyless cosign sign-blob to release.yml, attaching .sig + .pem per asset (the attestation stays too). This 2.39.1 release is the first to carry them.
• Branch-Protection — actually 4/10 with an admin token (the badge reads 0 because Scorecard's default token can't read protection). scorecard.yml now passes repo_token: ${{ secrets.SCORECARD_TOKEN || github.token }}; set a repo-admin-read PAT as SCORECARD_TOKEN to surface the 4 on the badge. Falls back to the default token if unset.

Vulnerabilities stays 0 until the frozen engine-v1-2/ (its 10 known vulns) is removed — planned.

2026-07-02 — Harden the supply chain: raise the OpenSSF Scorecard from 4.2 (2.39.0)

The README OpenSSF Scorecard badge read 4.2. That number is computed by OpenSSF's scanner from the repo's real security posture, so this was a hardening pass, not a badge edit. Addressed every fixable high-weight check:

• Token-Permissions (0→). Added top-level least-privilege permissions: contents: read to ci.yml, codeql.yml, sonar.yml, visual-baselines.yml; moved release.yml's contents: write (and the new id-token/attestations: write) down to the release job scope.
• Pinned-Dependencies (0→). Pinned all 33 GitHub Action refs across every workflow to full commit SHAs (with # vX comments); Dependabot's github-actions ecosystem keeps them current.
• Signed-Releases (0→). release.yml now attests SLSA build provenance for each release asset via actions/attest-build-provenance (keyless Sigstore). Goes green from the next release.
• Branch-Protection (0→). main is now branch-protected: PR-required (0 approvals so the solo owner self-merges), strict status checks (Lint, format, smoke & unit tests + Build & unit-test the SPA), enforce-admins, force-push/deletion blocked, linear history off (so --no-ff release merges are allowed). This moves the release path onto a PR — CLAUDE.md + git-workflow.md updated to match.
• Security-Policy (0→). Added root SECURITY.md (private reporting → fairy@fairyfox.io).
• Vulnerabilities (0→). The 18 OSV hits were all dev-only (@lhci/cli's tmp/inquirer/uuid chain). Added engine-v3/package.json overrides forcing tmp@^0.2.7 + uuid@^11.1.1 — npm audit is now 0. Production dependencies were already clean.
• Code-Review stays 0 by design — it requires an approved PR review and GitHub forbids self-approval, so a one-person repo can't satisfy it. That's the realistic score ceiling (~8) for a solo project.

A cross-project proposal to standardize this hardening across all fairyfox nodes is in notes/fairyfox-reports/2026-07-02-propose-scorecard-hardening.md (for the owner to carry to the hub). Note: the badge only refreshes when the scorecard workflow re-runs (weekly cron or a main push).

2026-07-01 — Fix the failing SonarCloud quality gate (new-code coverage + duplication)

The README quality-gate badge went red after the 2.38.1 sweep. The gate itself (queried on the SonarCloud side — the CI workflow only uploads) was in ERROR on two new-code conditions: new coverage 54.8% (threshold ≥80%) and new duplicated-lines 3.6% (threshold ≤3%). The rating conditions all passed. Root cause was a measurement gap, not missing tests:

• Coverage. The refactor that split listManifest.js into listTags.js / nameOrder.js / listResolve.js never added the two logic modules to the Vitest coverage.include list, so their (well-tested, via the barrel) lines never landed in lcov.info and Sonar counted all of them uncovered — 41 lines (listResolve) + 29 (nameOrder). And browserCatalogData.js (59 uncovered lines) is pure Vite import.meta.glob wiring that can't run under Node, but only its sibling browserLoader.js was in sonar.coverage.exclusions.
• Duplication. All 25 new duplicated lines were in those two browser-glob modules (browserCatalogData 16 + browserLoader 9) — mechanical, deliberately-parallel Object.entries transform loops, not refactorable debt.

Fix (config only): added listTags/nameOrder/listResolve to vitest.config.js coverage.include; added browserCatalogData.js to sonar.coverage.exclusions (matching the browserLoader precedent) and added sonar.cpd.exclusions for both browser-glob files. Local coverage now measures the split modules (listResolve 83.8%, nameOrder 98%, listTags 100%), projecting new-code coverage to ~88% and new duplication to 0%. npm test green (260 Node + 313 web). No JS touched → no version bump.

2026-07-01 — Resolve the last SonarCloud bug + 2 vulnerabilities (analysis config)

Cleared the remaining non-tech-debt SonarCloud issues — 1 bug, 2 vulnerabilities — as documented, version-controlled suppressions in sonar-project.properties (this project centralizes Sonar config there and uses no inline NOSONAR). All three are confirmed false positives for this context:

• S2245 ×2 (PRNG not crypto-safe) on core/rng.js + helpers/random.js: the engine's randomness generates creative prompts, not security material. randomSeed() uses crypto.getRandomValues when available; Math.random is the deliberate unseeded/ambient source (the seeded, reproducible path is the Rng class, and the test suite swaps Math.random), so it is required here.
• S4158 (empty collection) on gatedLists.js: gatedBlocks is an intentionally-empty, exported + tested extension point; the automatic nsfw-token rule covers every case today.

No code change → no version bump (analysis-config only). With the 2.38.1 sweep this takes the SonarCloud board to a clean 0 across bugs, vulnerabilities, and code smells. (Kept the gatedBlocks escape hatch rather than deleting it — surfaced removal as an option to the owner.)

2026-07-01 — Tech-debt sweep: clear all 70 SonarCloud code smells (2.38.1)

Drove the SonarQube Cloud technical-debt ratio to ~0% (was 0.8%, already rating A) by resolving all 70 open code smells across the active engine — a behavior-preserving cleanup, verified by the full test suite (313 tests) staying green throughout.

• ~56 mechanical modernizations: | 0 → Math.trunc() (rng.js — proven output-identical since every consumer re-normalizes with >>> 0), optional chaining, Object.hasOwn, replaceAll, Number.parseInt/parseFloat, String.raw, startsWith/endsWith, .at(-1), codePointAt, Math.min, un-nested ternaries, boolean-literal comparisons, for…of, named default exports, hoisting closure-free helpers to module scope, and removing a dead allBlocks collection.
• 7 ReDoS regex rewrites (S8786, super-linear backtracking) in parser.js, emphasis.js, list.js — the emphasis bracket-run patterns use an atomic-group emulation (?=(\(+))\1 (JS has no native atomic groups) to stop the + from backtracking; brace/key patterns use tempered character classes; the heading-weight strip switched to indexOf. All linear now, captures unchanged.
• 7 cognitive-complexity refactors (S3776) — parseNode, renderNodes/renderNode, block run, resolveListLines (54!), compareNames, computeButtonNames — each split into focused helpers, all now ≤15.

Verified rule-by-rule against eslint-plugin-sonarjs (same SonarJS rule implementations) since SonarCloud only scans dev/main. Reliability note: the ReDoS fixes also close a real quadratic- runtime class in the DPL parser/list stages. PATCH bump — no behavior or API change.

2026-07-01 — Online build now prerenders (static HTML + hydration) (2.38.0)

The deployed (online) build now prerenders its first paint to static HTML at build time, then the browser hydrates it — so the building-block palette (the Largest Contentful Paint) is painted from HTML before any JS runs. Profiling the previous build showed the LCP was 92% render delay: it was purely the cost of client-rendering the palette with React + react-intl on throttled mobile, unmoved by bundling tricks. Prerendering removes that. On mobile Lighthouse the online build goes from Performance ~66 → ~83 (Lantern/simulate) / ~87 (DevTools throttling); LCP 5.6 s → ~3.2 s (simulate) / ~2.4 s (DevTools); FCP/Speed-Index ~3.5 s → ~2.9 s; Accessibility/Best-Practices/SEO stay 100.

How it works (online-only; the local build is unchanged): gui/scripts/build.mjs runs the normal client build, then an SSR build of src/entry-server.jsx, calls its renderToString to produce the shell + palette markup, and injects it into #root in dist/index.html; main.jsx hydrates when #root is populated (else mounts fresh, as local does). renderToString (not a headless snapshot) is what makes hydration clean: effects don't run, so the CodeMirror composer renders as its empty host <div> — exactly the client's first render — and the app boots the default-settings shell online (App.jsx), which the client's first render also produces, so server and client match. Saved settings then settle in after hydration via a two-pass store (cache.onHydrated + guarded useSettings / useUserThemes): the first paint never persists the transient defaults, so a returning visitor's settings are never wiped. Verified with Playwright: zero hydration warnings/errors for both first- time and returning visitors, and a returning visitor's saved settings survive intact. A new Node-env guard test (tests/prerender.test.js) renders the app with no DOM present, so any browser API used in the initial render path fails in CI rather than in a deploy. Also reverted the 2.37.1 lazy-Home (the palette must be in the prerendered/hydrated tree). No change to data practices (the prerendered HTML is build-time defaults, served from the same host — legal pages unaffected). 313 tests green; both editions build; smoke OK. MINOR.

2026-07-01 — Web perf: prompt corpus off the first-paint path (2.37.1)

Cut the online build's Lighthouse Performance bottleneck. The ~430 KB bundled prompt corpus was a static dependency of the entry chunk, so first paint blocked on downloading the whole thing. Now the corpus is code-split into its own chunk (src/core/browserCatalogData.js) fetched at runtime via a single explicit import() after first paint, and the building-block palette renders from the import.meta.glob keys (just path strings in the entry — free) so the chips appear immediately instead of waiting on the corpus. browserLoader.js now serves names/structure synchronously from those keys and fills the content maps (words, generators, .dpl text, presets, sidecars) when initBrowserCatalog() resolves; the engine facade exposes ensureCatalog(), which the SPA calls from a mount effect (deferred to idle) and tests await. Also: removed the only lodash import (a dead _.startCase helper) — the 26 KB lodash chunk is gone from the bundle; lazy-loaded the Home view so the shell paints before the Generate pane; added a modulePreload filter so the corpus chunk isn't preloaded. Net on mobile/simulate: entry critical JS ~285 KB → ~124 KB gz, FCP/Speed-Index 5.1 s → ~3.4 s, CLS 0.25 → ~0.02–0.14, Performance 54 → ~66–72; Accessibility/Best-Practices/SEO stay 100. LCP stays ~5.6 s (pure render-delay in Lantern's model — unmoved by entry size, fonts, or lazy-loading). 312 SPA + Node tests green, both editions build, smoke OK. PATCH.

2026-07-01 — Custom themes: import & export theme files (2.37.0)

The theming system is now open-ended. You can import a theme file (the same small JSON a system theme uses) to add a brand-new theme or override a built-in one, and export the current theme to share it. Imported themes appear in the picker alongside the built-ins (with a hover × to remove) and apply live via an adopted stylesheet. Import is strictly validated (known fields + hex colours only — no arbitrary CSS), and imported themes are stored on your device like the rest of your settings (the privacy page's stored-data list + date were updated accordingly). Built on themeFile.js / userThemeStore.js / runtimeAccents.js. 312 SPA tests + visual regression green. This completes the CSS overhaul + theming work (Phases 0–7). MINOR.

2026-07-01 — CSS overhaul Phase 6: system themes as a folder of files (2.36.1)

Restructured the built-in accents from a hardcoded array into gui/src/theme/themes/*.json — one file per theme (the file is the theme), ordered by an NN- filename prefix. Two isomorphic loaders read that folder: presets.js via Vite import.meta.glob (app + tests), scripts/gen-accents.mjs via fs (build-time accents.css). Regenerated CSS is byte-identical bar its header comment, so nothing renders differently. Sets up user themes (Phase 7) merging over the folder at runtime. 302 SPA tests + visual regression 3/3 green. PATCH.

2026-07-01 — Theme picker: choose light/dark + accent (2.36.0)

The theming feature is now usable. A new Appearance button in the top bar opens a popover to pick the base — System (follow the OS), Dark, or Light — and an accent colour from a 9-swatch grid (Mint, Teal, Cyan, Blue, Violet, Magenta, Pink, Coral, Amber). Choices apply instantly and persist on your device; System auto-switches light/dark with the OS. Built on the Phase 3–4 theme engine (ThemePicker.jsx + useTheme). Everything stays local — no accounts, no new data collected. Verified: full test suite + visual regression green. MINOR.

2026-07-01 — CSS overhaul Phase 4: accent presets (2.35.9)

Added 9 accent presets (Mint default, Teal, Cyan, Blue, Violet, Magenta, Pink, Coral, Amber). Single source of truth gui/src/theme/presets.js drives a committed generator (npm run gen:accents → styles/foundation/accents.css): [data-accent] sets bright neon on dark, [data-theme=light][data-accent] soft pastel on light, with --accent-strong derived via color-mix. A contrast unit test asserts WCAG AA for all 9×2 pairs (ink-on-accent ≥4.5, dark accent-on-canvas ≥3.0 — 18 checks). applyTheme/ ThemeProvider/App now manage the accent (data-accent on <html>). No picker UI yet, so the default (mint) is unchanged. lint + 297 SPA tests + visual regression 3/3 green. PATCH.

2026-07-01 — CSS overhaul Phase 3: theme engine (2.35.8)

Added the theming foundation: gui/src/theme/ (config + applyTheme + ThemeProvider/useTheme). The chosen base mode (system | dark | light) is applied to <html data-theme>; system follows the OS live via a matchMedia listener. Light styles moved from @media (prefers-color-scheme: light) to :root[data-theme="light"] so an explicit choice can override the OS, with a tiny inline boot script in index.html setting data-theme before first paint (no FOUC). settings gains themeMode (default system) + accent (default mint); App.jsx wraps in ThemeProvider. No picker UI yet — default System+mint is behaviourally identical to before. Theme prefs stay on-device (no legal change). 8 new tests; lint + 279 SPA tests + visual regression 3/3 green. PATCH.

2026-07-01 — CSS overhaul Phase 2b: cascade layers + cleanup (2.35.7)

Assigned every CSS module to a cascade layer via index.css @import ... layer(...) (foundation → tokens/base, components → components) — no rule edits, cascade preserved (the foundation is low-specificity and already lost to component class rules). A hacky-CSS audit found the code already clean (only 3 !important, no deep selectors, no transition: all); the one real hack — the gallery delete button's 3 !important on hardcoded red hexes — was replaced with --danger-* tokens and rescoped to .g-actions button.g-danger so it wins without !important (behaviour-exact). Verified full npm test green + visual regression 3/3. PATCH.

2026-07-01 — CSS overhaul Phase 2: split the monolith (2.35.6)

Split gui/src/styles.css (~5,360 lines — the sole cause of CodeFactor's F, which was pure file size) into a gui/src/styles/ tree of 55 focused module files (foundation/ + components/) assembled by styles/index.css via @import. The split was done by a one-shot script that cut at the section banners and refused to write unless the reassembled output was byte-for-byte identical to the original, so no rule could be dropped or reordered; the two oversized slices were sub-split at internal group comments (largest module is now 380 lines). Rules remain unlayered for now — the cascade is unchanged and rendering is identical (main.jsx imports ./styles/index.css). Retires the CodeFactor F once merged to main. Verified: full npm test green + visual regression 3/3. PATCH.

2026-07-01 — CSS overhaul Phase 1: two-tier tokens (2.35.5)

Restructured the styles.css :root custom properties into a primitive tier (--p-*: the mint accent ramp, the dark/light neutral palettes, the dark/light DPL syntax palettes, shared scales) and a semantic tier (the --accent/--bg/--fg/--dpl-*/… roles components use, now mapped onto the primitives). No component CSS changed and every computed value is identical, so rendering is unchanged; the only color-math change is --accent-soft, now derived via color-mix(in srgb, var(--accent) 14%, transparent) instead of repeating the accent's literal RGB. Foundation for the file split (Phase 2) and the oklch accent ramp (Phase 4). Verified stylelint clean + visual regression 3/3 (pixel-identical). PATCH.

2026-07-01 — CSS overhaul Phase 0: guardrails (2.35.4)

Kicks off the CSS overhaul + theming framework (plan: notes/plans/css-overhaul.md). Phase 0 lays guardrails only — no visual change. Added .browserslistrc pinning the support target for the modern CSS the theming work relies on (cascade layers, oklch(), color-mix(), adoptedStyleSheets), with documented fallbacks. Declared the @layer order at the top of styles.css as an inert scaffold (rules stay unlayered until the Phase 2 split, so the cascade and rendering are unchanged). Verified stylelint clean, SPA build green, and the Playwright visual-regression baseline 3/3 passing. PATCH.

2026-07-01 — Stabilize the coverage badge on the engine flag (infra)

The README coverage badge flapped between ~93% and ~48%. Cause: CI uploads two independent Codecov reports — node (the engine, src/core/**, ~93%) and gui (the whole SPA src/**, ~48% because Vitest only unit-covers src/lib while the components are exercised by the un-uploaded Playwright e2e/a11y suite) — and with no codecov.yml the unflagged repo badge sampled whichever upload Codecov had merged last. Fixed both ends: pointed the badge at flag=node (relabelled "engine coverage" — the honest, deterministic number), and added a codecov.yml with after_n_builds: 2 (wait for both uploads before reporting) + flag_management carryforward: true (reuse a flag's last coverage when a suite didn't re-run). Statuses set informational so a dip never blocks CI. No code change, no version bump.

2026-07-01 — Kill CRLF working-tree noise with .gitattributes (infra)

Added a repo-root .gitattributes (* text=auto eol=lf, .bat/.cmd kept eol=crlf, explicit binary for images/fonts/etc.) and renormalized the working tree to LF. Root cause: no .gitattributes

• core.autocrlf=true on Windows meant blobs were already LF but the working tree was checked out CRLF, so Prettier (endOfLine: lf) flagged ~178 files on every local format:check — pure noise, no real formatting problem. eol=lf now forces LF in the working tree on every platform, so the noise is gone at the source (fresh clones and CI unaffected — they were already LF). No version bump (infra only). Binary assets verified untouched. Recommended up to the fairyfox system as a shared standard so every project can stop the same noise — see notes/fairyfox-reports/2026-07-01-gitattributes-eol-standard.md.

2026-07-01 — Add a stylelint CSS-lint gate + clear all lint issues (2.35.3)

Stood up a proper stylelint gate for the SPA CSS and drove styles.css from a CodeFactor F (the single file dragging the repo's "code quality" badge to A-) to clean. Added stylelint + stylelint-config-standard as devDeps and a documented stylelint.config.mjs (base = stylelint-config-standard, with four deliberate, commented relaxations: no-descending-specificity and no-duplicate-selectors off — the sheet is intentionally organized by feature/section and reordering/merging risks cascade regressions against the committed visual baselines; property-no-vendor-prefix off — the -webkit-/-moz-appearance prefixes are functionally required to hide the native number-input spinners; selector-class-pattern widened to allow the camelCase segments in CodeMirror's own .cm-* class names). Wired lint:css/lint:css:fix into npm run lint, so the gate runs in npm test and CI.

Fixes: stylelint --fix cleared ~709 mechanical issues (blank-line-before rules, modern rgb()/hex/alpha notation, redundant longhand); migrated the 9 deprecated word-break: break-word → overflow-wrap: break-word; and separately cleared all 20 pre-existing ESLint warnings (redundant regex-class escapes, unused callback args/params _-prefixed per the config's own rule, dead = null/= "" initializers) across data/, scripts/, src/core/nodeLoader.js, and the two active src/prompt-modules/ stages. All changes are behavior-preserving. Verified green: npm run lint (0 errors, 0 warnings), smoke, SPA build, test:unit (260), test:web (271); Prettier confirms no formatter conflict on the reformatted CSS.

2026-07-01 — Full dependency upgrade to latest (2.35.2)

Bumped every dependency to its latest across engine-v3 and gui, including the majors: react-intl 7 → 10, eslint 9 → 10 (gui; the engine was already on 10), eslint-plugin-formatjs 5 → 6, babel-plugin-formatjs 10 → 11, plus vite 8.0 → 8.1, prettier → 3.9, playwright, @formatjs/cli, @vitejs/plugin-react, @codemirror/view, globals, and the rest.

Verified the entire suite locally (nothing left for CI to catch first): npm test (lint + smoke + 271 Node/web tests), format:check, the SPA build, lint:i18n, i18n:check (formatjs 11 kept the same message IDs — en.json unchanged), test:e2e (E2E + visual-regression + accessibility, 8/8), and test:perf (bundle 790 KB / 900 KB budget). Zero breakage — the only code change the majors required was a one-line Prettier-3.9 reformat in src/nameOrder.js.

Also pointed Dependabot at dev (grouped, weekly) so its update PRs match the dev→main flow, and the six earlier main-targeted PRs are superseded by this upgrade. Policy adopted by the owner and filed for the fairyfox hub: upgrade aggressively — fixing an upgrade beats deferring it (a good test suite is what makes a major bump a non-event). See notes/fairyfox-reports/. PATCH bump (the shipped bundle changed via react-intl/vite; no feature).