Ludarium-Public/CHANGELOG.md

# Changelog

## 0.4.19-rc.8 — populated Home height closeout

- Removes unused desktop-only bottom whitespace so the complete populated Home stays within its
  1,700 px release budget without compressing content, controls or mobile navigation space.

## 0.4.19-rc.7 — settled populated Home guard

- Keeps the fully settled five-signal production Home hero below its fixed 440 px visual budget,
  including after asynchronous playability data arrives.

## 0.4.19-rc.6 — populated Home visual closeout

- Keeps the cinematic populated Home hero within its 440 px desktop height budget by tightening
  its responsive padding and display scale without changing archive content or controls.

## 0.4.19-rc.5 — release truth and fail-closed qualification

- Makes Home, navigation badges and repair views use exact review, artwork, source, hash and
  collection-playability signals, so an incomplete archive can no longer be reported as healthy.
- Adds a bounded SQL playability summary and progressive Library/Attention loading while retaining
  the stricter evidence-bound runtime check for every actual launch.
- Refuses zero-item integrity snapshots with HTTP 409 and identifies historical empty snapshots as
  unusable legacy baselines.
- Separates Attention decisions from findings, uses action-specific verbs and adds uncapped
  server-side grouped-review paging with an honest warning for the legacy 500-group response.
- Bundles Inter and Manrope locally, fixes light-theme hero and heading contrast, removes overlapping
  generated-cover layers, improves empty Wishlist focus and extends responsive validation to 880 px.
- Adds one canonical `VERSION` identity for .NET runtime surfaces and guards the required Compose,
  Unraid, runbook and changelog copies against drift.
- Replaces generic repository guessing in Gitea Actions with Ludarium's locked .NET, nested frontend,
  controller and exact-image security gates.
- Makes production autodeploy depend on a successful full validation of the same source revision.
- Keeps SNES `.smc`, PSX `.pbp`, PSP `.iso`/`.cso` and Genesis `.gen`/`.smd`/`.bin` recognised but
  fail-closed until an exact deterministic runtime fixture qualifies each format.
- Makes an empty candidate-platform qualification request fail instead of silently re-running the
  already-qualified browser matrix.
- Opens threaded PPSSPP sessions in their required isolated top-level page instead of leaving users
  in a non-isolated embedded player that can never expose `SharedArrayBuffer`.
- Records the release contract in ADR 0067. Local exact-image security passes; isolated Unraid
  candidate backup/restore, browser and live active-scan evidence remain required before promotion.

## 0.4.19-rc.4 — Sega qualification and three faults a live archive found

- Makes accessibility-gate startup semantic and diagnosable: it now waits for Ludarium's visible
  application landmark and, after login, its page heading instead of a Home-specific CSS selector.
- Binds the candidate backup filename and restored-database assertion to the application's declared
  schema version, eliminating the final stale schema-23 release assumption.
- Makes the Home workflow height budget deterministic and diagnostic, and gives that workflow the
  same semantic application-readiness boundary as the accessibility gate.
- Recalibrates Home's total height allowance for the qualified Living Archive hero while adding
  tighter independent hero and metric-grid caps to prevent local layout regressions.
- Keeps game-drawer header titles and controls high-contrast on the Living Archive dark-glass
  header in both light and dark themes.
- Aligns every runtime, export, support, gate and Unraid release identifier with `0.4.19-rc.4`.
- Binds the candidate gate and support bundle to the application's declared schema version.
- Qualifies Genesis, Master System and Game Gear on the bundled `genesis_plus_gx` core, each proven
  by its own deterministic fixture in a browser.
- Marks a file that left the archive as missing again, instead of leaving it Present and playable.
- Reads a game's creation date from the record, so sorted and filtered library requests work.
- Lets a confirmation be answered with a pointer instead of rendering behind the surface that
  raised it.
- Stops leaving a file extension in a derived title, without splitting existing games in two.
- Finishes a cheat lookup that finds nothing.
- Keeps a resolved review readable, and repairs any an earlier version made unreadable.
- Answers an unrecognised scan mode with the modes that exist instead of an empty 400.
- Lets the browser gates run against any archive rather than one operator's, and proves bulk
  organising against a real catalogue.
- Names the stylesheet's colours, and gives the light theme the hairlines and lifts it never had.
- Lets the library filters show the option they are set to, and counts the catalog once.
- Gives a recently played game room for its name.
- Stops a critical finding with no decision beside it from reading as nothing to do.
- Says when nothing is blocked, and prints a one-sentence cause once.

## 0.4.19-rc.3 — navigation parity, bulk organising and session choices

- Gives desktop and mobile the same destinations, and surfaces Playability & naming from the
  navigation and from any game that cannot start.
- Adds selection and bulk favourite, play status, collection and tag actions to the library grid.
- Makes staying signed in an explicit choice on a trusted device instead of a per-tab default.
- Makes controller navigation discoverable in Settings and possible to switch off.
- Follows the operating system theme while the application is open.
- Gives every overlay a unique title id.

## 0.4.19-rc.2 — library query, first run and interface correctness

- Moves library sorting and filtering into the catalog query, so ordering describes the collection
  rather than the page on screen.
- Adds filtering by favourites, play status, minimum rating, collection, tag and whether a playable
  copy exists, and sorting by last played, rating and recently updated.
- Scopes `GET /releases` to named games, so browsing no longer loads every release in the catalog.
- Tells a fresh install to add a library instead of reporting that the empty archive looks good.
- Replaces every `window.confirm` with the application's own focus-trapped confirmation.
- Makes the game details one tab set with one selected tab, a real tab panel and arrow-key movement.
- Makes global search a combobox: focus stays in the input and the whole result list is reachable.
- Runs the accessibility gate in both themes, which it never did, and fails if the theme it asked
  for was not applied.
- Declares five colour and layout tokens that were used but never defined, gives the light theme its
  missing navigation colour, and guards the stylesheet so hard-coded colours cannot increase.

## 0.4.19-rc.1 — emulation completion

- Gives every isolated native player one shared contract: one registry describes a player, and its
  routes, cookies, sessions, proxying, control and capability vocabulary follow from that
  description. Adding a player is a registry entry plus a launch resolver.
- Moves the sidecar control surface, path validation, Xwayland display resolution, process
  supervision and save-data transfer into one shared module. The hardened display resolution added
  for Eden had never reached Dolphin, which shipped with the bug that fix removed.
- Stops the running title when a player session is revoked, so a closed player cannot leave an
  emulator holding a render device and a disc image.
- Reports a native player as available only when its sidecar answers a live status probe, instead of
  trusting configuration alone until the operator clicks Play.
- Targets player hotkeys at the launched process rather than a window name, so a state hotkey cannot
  reach an emulator's own front-end window.
- Brings native save data into the Game Data Vault: Switch, GameCube and Wii save directories can be
  captured as immutable SHA-256 evidenced revisions and restored from them.
- Classifies every container format a player accepts, including `.gcm`, `.gcz`, `.wia`, `.isz`,
  `.3ds`, `.cia`, `.wud`, `.wux`, `.cdi` and `.vpk`.
- Identifies GameCube and Wii discs by their on-media magic word instead of by a folder name, and
  records a conflict when the directory disagrees.
- Identifies Sega hardware from the cartridge header, separating Mega Drive from 32X and Sega CD and
  Master System from Game Gear, and resolves every common Sega directory spelling.
- Fixes a classifier defect where `MediaType.Rom` equalling the default enum value made every ROM
  extension without a matching header signature classify as `Unknown`.
- Delivers CUE/BIN PlayStation discs and multi-disc M3U games by resolving a linked descriptor to
  every disc and track it names and streaming them to the browser player as one archive built while
  it is read.
- Scopes a native save capture to the directories that hold saves rather than to the whole emulator
  profile, which on Dolphin also carries shader caches far larger than one vault revision, and
  reports the resolved directories so a wrong path is visible before it matters.
- Gives the player both halves of the vault: a capture control and the stored restore points, with a
  capture taken while a title runs marked as such.
- Adds a `.dockerignore`, so a local image build no longer ships the working tree as build context.
- Separates container formats Ludarium can deliver from formats a fixture has proven, so an
  implemented delivery path never reports a game as playable before its qualification pass has run.
- Binds the image's EmulatorJS core retention list to the platform matrix, drops the unused
  `mupen64plus_next` core and bundles `genesis_plus_gx`.
- Adds deterministic Genesis, Master System and Game Gear fixtures and their qualification pass. The
  three platforms fail closed until that pass has completed the real bundled core.
- Gives every native player one embedded shell: delayed-load recovery, a reload control, the session
  expiry, assertive failure announcements and state controls only where the runtime exposes them.
  Recently Played can now resume a GameCube or Wii title, which it never could.
- Covers the sidecar security boundary with a stdlib-only test suite that runs in the candidate gate.

## 0.4.17-rc.1 — stable navigation and contextual wayfinding

- Replaces the expanding global platform/collection tree with a stable Play, Organize and
  Operations hierarchy that never pushes core destinations below the fold.
- Adds compact breadcrumbs for page, section, platform and detail context.
- Moves console browsing into a hardware-led, horizontally scrollable Library platform rail with
  exact counts, active state and a direct overview path.
- Replaces the six-way mobile dock with Home, Library, central Search, Wishlist and More; the
  accessible More sheet contains platform, collection, operational and advanced archive routes.
- Keeps pinned collections meaningful by ordering them first inside the Collections workspace.

## 0.4.16-rc.1 — hardened Switch runtime and premium entry experience

- Replaces the sparse administrator-token screen with a responsive, console-led welcome flow,
  clear privacy/source-safety promises, a deliberate token reveal control and mobile-first layout.
- Adds deterministic login interaction, accessibility, reflow and production-build coverage.
- Removes unused container, build, SSH, cron, mail and scripting stacks from the isolated Eden
  runtime and health-gates it before the main application becomes ready.
- Adds an in-container runtime audit and version-bound OpenVEX evidence so every inherited Critical
  scanner match is either reachable and blocking or explicitly justified from the actual runtime.
- Makes release archives preserve Unix line endings and executable bits when produced on Windows.
- Publishes Switch sessions through the dedicated HTTPS player origin and closes an Nginx Proxy
  Manager HTTP/2 POST-stream stall while retaining WebSockets on the isolated player host.
- Makes the public export workflow wait for the exact requested artifact with a bounded production-
  sized timeout instead of accepting an unrelated status message.
- Gives both Unraid containers stable DockerMan ownership, HTTPS WebUI links and the persisted SVG
  icon, groups them as one Folder View application and removes verified stopped release candidates
  plus their obsolete images without touching appdata or read-only source libraries.

## 0.4.15-rc.1 — reliable resume and self-healing runtime

- Makes every visible game detail route independent of catalog pagination and transient browser
  cache, with canonical history, reload, Back, Close, loading and recovery semantics.
- Turns Recently Played into a capability-aware one-click action: Resume only for qualified
  automatic restore, Play for another available player, and an honest Details fallback otherwise.
- Reuses one browser player across Home and Library, revokes sessions on exit/unmount and gives the
  Switch player a single-modal focus trap plus body scroll lock.
- Makes readiness a read-only PostgreSQL/schema check and makes PID 1 supervise both PostgreSQL and
  the API so database loss terminates the broken runtime and activates Docker restart policy.
- Pins the patched SSH.NET 2026.0.0 test dependency after the RC gate rejected the newly disclosed
  recursive SCP path-traversal advisory affecting 2025.1.0 and earlier.
- Gives Unraid candidate compilation and browser gates explicit CPU, memory, process and concurrency
  budgets so exhaustive validation cannot claim unbounded production-host resources.
- Keeps the Play!.js supply-chain boundary fail-closed after upstream artifact drift: both images
  now record the reviewed upstream commit and exact refreshed hashes as in-image provenance, with
  real PS2 fixture qualification still mandatory before promotion.
- Extends the live browser workflow through the new Recently Played Play/Resume action and replaces
  a fixed 80 ms controller-focus assumption with a bounded observable focus contract.
- Gives the playable Recently Played Details action a real secondary-button treatment and
  theme-aware text token, restoring WCAG AA contrast in every gated light-theme viewport.
- Replaces the security-rejected PostgreSQL 16.14/Alpine final image with a unified Ubuntu Noble
  runtime containing patched PostgreSQL 16.15 and OpenSSL 3.0, removing the reported database and
  runtime vulnerabilities without suppressions while retaining non-root API execution via `gosu`.
- Makes UTF-8 an explicit image and candidate-gate invariant, so a fresh database cannot fall back
  to SQL_ASCII and reject Unicode platform metadata during bootstrap or after restart.
- Removes EmulatorJS's hidden runtime version-check request by resolving its pinned metadata from
  the bundled same-origin file, with build-time residue checks and a real-browser assertion that
  every qualified EmulatorJS core stays entirely on the Ludarium origin.
- Makes exact-title Switch launch follow the active PixelFlux Xwayland display instead of assuming
  `:0`, with active-process discovery, a bounded newest-socket fallback and explicit early-exit
  diagnostics in the isolated Eden controller.
- Repairs libc collation-provider upgrades before the API can seed data: unversioned legacy indexes
  are rebuilt and versioned, while only semantically identical non-custom seed duplicates may be
  removed; every ambiguous or manual record fails closed for operator review.

## 0.4.14-rc.1 — controller-first couch navigation

- Extends standard gamepad support from the isolated players to the complete Ludarium shell.
- Adds spatial D-pad and left-stick focus across responsive grids, navigation, filters and actions,
  with horizontal select changes, A to activate, B to close a modal or return Home, and Menu search.
- Keeps controller focus trapped inside active dialogs and visibly identifies the selected control.
- Suspends shell polling while browser or Switch playback owns the controller, avoiding double input.
- Runs no animation loop until a controller is actually connected and cleans up every listener,
  frame and timer on disconnect or unmount.

## 0.4.13-rc.1 — durable recently played flow

- Records successful browser and Switch launches as auditable personal play history while preserving
  manual status, favorites, notes, rating, difficulty and completion progress.
- Adds a bounded recently-played API ordered by the actual last launch time rather than UI visits.
- Adds a responsive cover-led Jump back in section on Home with relative play time, session count,
  completion progress and direct game-detail navigation.
- Makes every Home support request cancellable as one parallel batch so navigation cannot update an
  unmounted page.

## 0.4.12-rc.1 — recoverable operational UX

- Replaces permanent spinners with consistent first-load failure and retry states across Attention,
  Activity, scan history, snapshots and data-backed Settings sections.
- Keeps already loaded operational information visible when a refresh fails and shows a focused
  reconnect action instead of blanking the screen.
- Makes Activity polling cancellable and overlap-free so slow refreshes cannot accumulate or emit
  repeated unhandled failures.
- Adds visible busy states and duplicate-click protection for all-library scans, individual library
  scans and integrity snapshot creation.
- Adds deterministic regressions for failed and recovered Activity, Attention and Settings loads.

## 0.4.11-rc.1 — resilient browse and detail UX

- Debounces library search, cancels superseded requests and prevents stale cards from appearing
  under a newly selected query or platform.
- Adds explicit initial, refresh-error and retry states instead of leaving a permanent spinner or
  silently hiding a failed refresh.
- Keeps game browsing available when an optional play-capability service is down, fails Play closed
  and provides a focused readiness retry.
- Loads fourteen game-detail resources independently so one failed secondary source no longer
  empties the complete drawer; partial results remain usable with a bounded retry action.
- Prioritizes Overview, My library, Saves & states and Releases while moving six maintenance views
  behind a clear More details disclosure.
- Separates Attention's open-decision count from the number of currently shown evidence items.

## 0.4.10-rc.2 — truthful per-game Switch readiness

- Added single-game and bounded bulk Switch play-capability APIs that validate the exact title,
  runtime/controller, selected production keys and read-only source before advertising Play.
- Library cards and the page-ready count now use the per-game result instead of global Eden
  availability; ambiguous or unavailable titles show a concrete reason before launch.
- Game details use the same capability and preserve independent session-time revalidation so a
  stale or changed catalog still fails closed.
- Distinguishes a missing base game from genuine ambiguity: update/DLC-only folders now explain
  that their base XCI/NSP is required instead of incorrectly suggesting multiple matches.
- Added deterministic policy and frontend regressions for available, missing-prerequisite and
  ambiguous base-game states.

## 0.4.9-rc.1 — dormant sources and descriptor truth

- Added an explicit dormant-library control. Disabled roots preserve their catalog, cannot be
  scanned, and no longer generate false archive-health attention while their mounts are empty.
- Recognizes an exact `.bin.ecm` companion referenced by a PlayStation CUE as a present legacy
  encoded track. The bundle remains visibly `CompleteWithWarnings` until a fixture-qualified,
  app-owned conversion/playback path exists; source content is never changed.
- Corrected Home and Settings states so only active empty sources affect the archive headline.
- Added deterministic integration coverage for ECM sidecars, source immutability and dormant scan
  rejection.
- Updated the shipped .NET runtime to 10.0.11 and the build SDK to 10.0.302 after the RC security
  gate identified the fixed High-severity runtime advisory `GHSA-m93f-wj8c-rp8p` in 10.0.10.

## 0.4.8-rc.1 — platform hardware identity

- Replaced generic platform monograms with real, locally bundled hardware imagery for all sixteen
  active console, handheld and PC platforms.
- Added a reusable platform presentation model with device category, generation/era and restrained
  platform color identity.
- Reworked platform cards for stronger visual hierarchy, responsive behavior, focus states and
  reduced-motion support.
- Reused compact hardware portraits in Home collection distribution and Library navigation.
- Added asset provenance and component coverage; no runtime image-host dependency was introduced.

## 0.4.7-rc.1 — deterministic Switch title launch

- Resolves a selected Switch game to one unique read-only base XCI or NSP and launches that exact
  path through Eden's fullscreen command-line interface instead of opening Eden's library menu.
- Adds a private, separately authenticated Eden controller that rejects traversal, non-game files,
  missing files and any path outside the fixed `/games` mount.
- Adds Ludarium-native remote controls for pause/resume, Eden fullscreen and stop, alongside the
  existing shell fullscreen, connection state, reload and explicit session exit controls.
- Reports native persistent in-game saves accurately and does not present unsupported portable
  Eden savestates as a working capability.
- Fails closed when a directory contains multiple plausible base titles or catalog evidence is not
  sufficient to select one deterministically.

## 0.4.6-rc.1 — embedded Switch remote player

- Embeds the isolated Eden desktop inside a dedicated full-screen Ludarium player instead of
  sending operators to a separate application, while retaining a secure standalone fallback.
- Adds bounded, expiring Switch-player capabilities stored only as SHA-256 digests and delivered
  through an HttpOnly cookie on a separate port origin.
- Adds a certificate-pinned WebSocket/streaming reverse proxy with server-side Eden credentials;
  neither credentials nor the Ludarium administrator token enter the player frame.
- Hardens Eden's web desktop by disabling sharing, collaboration, file transfer, command execution
  and file/app sidebars, and keeps the game library strictly read-only.
- Adds a Settings readiness panel and game-specific play controls while remaining explicit that
  the operator chooses the exact title inside Eden.
- Streams the common single-ROM N64 ZIP layout directly from read-only sources without extracting
  it, while rejecting ambiguous archives, invalid N64 headers and decompression sizes above 512 MiB.
- Disables Eden clipboard and microphone bridging and permits only the screen wake lock needed by
  the embedded player.

## 0.4.5-rc.1 — play-first library experience

- Reworks the game library around premium, responsive tiles with clearer hierarchy, stronger
  artwork presentation and direct play actions for every currently available browser or Eden title.
- Adds a bounded 50-game capability query so cards show honest live play readiness without an
  unbounded request waterfall; unsupported or absent content remains fail-closed.
- Gives the game drawer a dedicated play panel, separates playback from artwork administration,
  localizes release dates and corrects read-only messaging around explicit operator playback.
- Qualifies dark/light themes and the complete responsive surface across eight viewports with
  WCAG 2.1 AA checks and horizontal-overflow detection.

## 0.4.4-rc.2 — native N64 and isolated Switch playback

- Release-qualifies a checksum-pinned N64Wasm WebGL2 player with deterministic `.z64`,
  `.v64` and `.n64` recognition plus evidence-bound savestate restore.
- Adds an optional digest-pinned Eden remote-player profile for Switch, verified personal-key
  provisioning and a strictly read-only game-library mount.
- Preserves automatic browser savestate evidence across rescans when byte-identical content
  is rebound to a new artifact version.

## 0.4.4-rc.1 — personal firmware foundation

- Added schema-23 app-owned BIOS, firmware and key metadata with selected-version provenance, SHA-256 evidence and audited upload/delete operations.
- Added a private streaming firmware vault under persistent Ludarium appdata. Uploads are bounded per allowlisted slot and reject host executables, scripts, archives, unsafe names and unknown extensions.
- Added Settings UI for personal PSX BIOS, PS2 BIOS and Switch production/title keys with explicit configured-versus-runtime readiness.
- Added capability-scoped PSX BIOS delivery to the native browser player; the BIOS URL is emitted only for an operator-selected asset and there is no general firmware or key download endpoint.
- Release-qualified checksum-pinned PSX/`pcsx_rearmed`, PSP/`ppsspp` and PS2/Play!.js playback with original, deterministic SDK-built fixtures and real canvas, scoped Range and cancellation gates. PSX and PSP additionally prove automatic state restore; Play!.js does not expose a fixture-proven state API. Switch remains fail-closed without a browser runtime.
- Added the locally bundled, checksum-pinned official Play!.js runtime, cross-origin-isolated PS2 player and asynchronous 8 GiB bounded disc Range device. Play!.js uses its built-in HLE BIOS; personal PS2 BIOS bytes are never delivered to the player.
- Fixed hardened container startup on correctly pre-owned appdata by avoiding redundant recursive `chown` calls, and aligned both Unraid templates with Compose's read-only root, `no-new-privileges` and six-capability startup policy.
- Added bounded deterministic inventory recognition for PSX/PS2/PSP ISO9660 layouts, PSP CSO, Switch XCI and Switch NSP/PFS0 without extracting or executing source content.

## 0.4.3-rc.1 — deferred functionality closure

- Added schema-22 game-origin provenance and safe full deletion for manually created games, including dependent app-owned catalog, media, artwork and Vault records while preserving linked wishlist intent as a standalone item.
- Release-qualified SNES, GB, GBC, GBA and NDS browser play with deterministic original fixtures and real local-core canvas, scoped Range and savestate gates; N64 remains fail-closed after its legal homebrew fixture failed Mupen startup.
- Added explicit live metadata-provider credential/endpoint validation with persisted Ready, Degraded or Offline health snapshots and secret-safe responses.
- Fixed EmulatorJS startup in non-English browser locales by using the bundled `en-US` fallback without a missing locale request.
- Qualified evidence-bound automatic savestate restore for every playable core: fceumm, snes9x, gambatte, mgba and melonds.
- Disabled unused Npgsql 10 GSS negotiation for the bundled loopback PostgreSQL connection after a crash dump identified its cancellation path, and made unexpected candidate restarts a hard release failure.

## 0.4.2-rc.1 — capability honesty and safe catalog lifecycle

- Separated bundled EmulatorJS cores from release-qualified playback; only deterministic live-fixture-backed NES/fceumm is currently startable, while unverified mappings fail closed and remain visible as deferred capabilities.
- Added schema-21 provenance for scan-derived versus manual releases, with audited, optimistic-concurrency create/update/delete for manual records and immutable scanner-owned records.
- Added the complete manual release editor to game details, including origin labels and explicit destructive confirmation.
- Hardened administrator bearer-token comparison with strict parsing and fixed-time digest equality.
- Updated maintained patch-level dependencies: Npgsql 10.0.3, OpenMcdf 3.2.0, SharpCompress 0.50.4, React 19.2.8, Playwright 1.62.1 and Vite 8.2.1.
- Promoted the exact fully gated schema-21 candidate to production after source-manifest, backup/restore, security, real-core, responsive UX and accessibility validation.

## 0.4.1 — evidence-bound browser restore

- Added automatic Ludarium-owned save and savestate restore for the deterministically verified `fceumm` browser core, with no RomM runtime or external service.
- Bound every automatically restorable revision to the exact artifact UUID/version, emulator core and optional ROM SHA-256 so changed, relinked, manual, legacy and malformed data fails closed.
- Added capability-scoped integrity-checked Vault reads and player-side restore through EmulatorJS's in-memory game-manager interface before play continues.
- Added startup cleanup for interrupted uploads and database-orphaned app-owned revisions, while skipping reparse points, unrelated files and every source-library path.
- Extended the live NROM gate to capture a real savestate, cancel the session, launch a new session and prove automatic restore with no console or request failures.
- Promoted the exact fully gated candidate to production with unchanged read-only source manifests, controlled restart, backup restore and post-deployment UX/accessibility evidence.

## 0.4.0 — browser play candidate

- Added the native Game Data Vault for stand-alone save and savestate management, including immutable revisions, SHA-256 evidence, metadata, bounded streaming uploads, range downloads and full-history deletion.
- Added schema-20 audited PostgreSQL persistence, retry-safe client revision IDs, optimistic concurrency, duplicate-content suppression and restart-safe history without requiring a RomM runtime or database.
- Added a responsive Saves & states workspace with evidence cards, lazy revision history, metadata editing, safe downloads and explicit app-owned/source-read-only language.
- Added executable/signature rejection, path containment, corruption detection and deterministic vault policy/filesystem/PostgreSQL/frontend regressions.
- Added a dedicated live Playwright vault gate with desktop/mobile WCAG checks and corrected light-theme composer/evidence contrast discovered by that gate.
- Kept personal vault notes and device labels out of request URLs by moving bounded upload metadata into an encoded internal header while preserving raw streamed file bodies.
- Added a native, stand-alone library experience inspired by RomM's product surface: static/smart/virtual collections, tags, personal state, game relationships, rich media/manuals, achievements, editable custom platform definitions and catalog exports.
- Added direct opt-in IGDB, MobyGames, ScreenScraper and RetroAchievements providers with bounded network reads, exact-match safeguards, provenance-bearing claims and review items for uncertain conflicts.
- Added schema-18 persistence and audited APIs for all native library data, plus app-owned content-addressed media and streaming JSON, EmulationStation and Pegasus export generation without source-library mutation.
- Added premium collection navigation and game-detail workflows for state, tags, media, relationships and achievements; provider and platform management now live in Settings.
- Added deterministic provider fixtures, unsafe-media rejection tests and a real PostgreSQL restart/scale regression covering 250,000 catalog records.
- Added self-contained, fail-closed browser play with checksum-pinned EmulatorJS 4.2.3 assets, six allowlisted cores, scoped expiring sessions and exact read-only ROM streaming; RomM is not a runtime dependency.
- Added schema-19 scan-derived game/artifact identity links, bounded expiring play sessions and redacted start/exit audit events.
- Added a responsive game-detail player with loading, unavailable, missing-core, error, fullscreen, separate-window and explicit exit states.
- Added deterministic synthetic iNES evidence plus executable, script, archive, oversized, missing, ambiguous, unavailable, arbitrary-ID and cancellation regressions.
- Replaced hanging Syft/Grype/Gitleaks Docker pulls with checksum-pinned cached release binaries and bounded the remaining pinned Playwright image pull with retries/timeouts.
- Added an original deterministic playable NROM fixture and an isolated live gate that proves scan linkage, capability authorization, Range delivery and real local fceumm startup without touching source libraries.
- Fixed ASP.NET static delivery for EmulatorJS `.data` core payloads so a missing content-type mapping cannot silently trigger the upstream CDN failsafe.
- Promoted the fully gated exact candidate image to production 0.4.0/schema 20 with read-only manifests, backup/restore, restart, DockerMan and post-promotion browser/accessibility evidence.

## [Unreleased]

- Reworked Home around the current operational state rather than an alarmist aggregate review count, with direct access to prioritized review work and supporting critical/decision context.
- Clarified desktop navigation into Workspace, Collection and Operations; the Attention badge now exposes critical work before an unhelpful high total.
- Made empty Library filter responses recoverable with a direct clear action, while retaining truthful zero-result pagination behavior.
- Turned the cover-quality queue into a visual review surface with lazy selected-cover previews, source/quality/verification evidence and resilient refresh feedback.
- Added a concise, safe grouped-work summary to Attention, direct platform collection links from Home, stronger game-detail framing and responsive/reduced-motion-safe finish work.

## 0.3.18 — catalog health and operational focus

- Expired provider snapshots now report an honest `Expired` state across the API and interface instead of appearing ready.
- Added per-library scan-freshness guidance, including empty-source protection and clear full-scan visibility.
- Attention can now prioritize recommended work, storage impact or recency; historical failed scans are separated from current operations without deleting audit evidence.
- Added direct, durable actions to refresh metadata and cover-quality candidates from catalog administration.

## 0.3.17 — integrity and operational truth

- Integrity scans now hash OnDemand libraries, making exact duplicate detection, SHA-256 manifests and snapshots operational without changing source files.
- Empty mounted roots with retained catalog records now count as attention-required and are clearly marked as historical on Home; bulk scan actions skip them safely.
- Attention now opens the actionable decision inbox by default, while unknown content remains a separate review backlog.
- Artwork candidates are content-addressed and duplicate candidate records are collapsed by the schema-17 migration; review metrics are per game rather than misleading raw candidate totals.
- Provider snapshots report refresh-due status after expiry; diagnostics include expired providers as degraded.
- Wishlist export is no longer capped at 100 records; JSON and CSV exports can be restored, store search works, acquired items no longer inflate waiting summaries, uploads/deletes handle artwork safely and binary API failures no longer masquerade as missing covers.

## [Unreleased]

- Expanded Wishlist 2.0 with lifecycle statuses, release dates, editions/regions, manual target/current prices, price-target highlighting, sorting, summary metrics, authenticated CSV export, bounded text import, standalone cover uploads and Home/Library integration.
- Added exact, ambiguity-safe scan reconciliation: a standalone wish becomes Acquired only when its title resolves to one unique catalog game; uncertain duplicates are never silently linked.
- Added optional RAWG-powered discovery with normalized platform identifiers and honest runtime capability flags. The feature is disabled without `RAWG_API_KEY`; retail price automation is explicitly unsupported rather than simulated.
- Fixed artwork candidate selection so PostgreSQL never observes a transient second selected cover, eliminating enrichment-job uniqueness conflicts and scan-queue delays.
- Fixed Wishlist reflow at 320–360 px by collapsing filters and constraining hero statistics without hiding functionality.
- Added a persistent, searchable Wishlist with local-library suggestions, standalone future titles, cover reuse, platform and priority filters, personal notes, optimistic-concurrency editing and audited removal.
- Added a dedicated premium Wishlist experience to desktop, mobile and widescreen navigation, including a responsive editorial summary, artwork cards, polished empty states and reduced-motion-safe ambient illustration.
- Added a premium visual pass across the live application shell: atmospheric depth, refined glass surfaces, luminous navigation hierarchy, artwork-first gallery elevation, restrained page and panel transitions, responsive mobile dock treatment and an explicit reduced-motion path.
- Added a production visual audit covering desktop and mobile hierarchy, real-cover presentation, widescreen density, interaction feedback and motion guardrails.
- Added a live empty-source preflight to mount verification and scanning: an unexpectedly empty remounted share can no longer reconcile an existing catalog to missing, and the UI disables that source until content is restored and safety is verified.
- Fixed Library platform deep links so sidebar and platform-card navigation immediately apply the requested platform instead of changing only the URL.
- Fixed inventory export feedback and the SHA-256 manifest request format; exports now show progress, errors, the generated filename and record count.
- Made scan history operationally useful with library names, completion timestamps, duration and retained failure details.
- Corrected the live Unraid PS4 and PS5 source mappings from temporary `/mnt/disks` directories to their durable `/mnt/user` shares while preserving read-only container destinations and retained inventory.
- Reworked the second-pass UX hierarchy for 0.3.12: truthful Attention routing, stable singular status copy, a responsive library control grid, compact mobile view labels, wider ultrawide collection canvases and explicit result context.
- Reduced operational noise by showing active and recent background work first, limiting the scan dashboard to the latest eight runs and keeping the complete scan timeline one action away.
- Added targeted workflow regressions for 1440px toolbar containment, mobile tab containment, the actionable Attention route and singular dashboard grammar.
- Pinned both Linux Lightning CSS native variants as direct optional dependencies so Ubuntu browser gates and Alpine production builds cannot intermittently omit the required platform binary.
- Reworked Attention into a truthful actionable inbox: missing/incomplete and integrity work now appears in `Needs action`, while informational unknown inventory remains available without inflating the priority flow.
- Replaced premature generated-cover fallbacks with progressive artwork skeletons, so off-screen real covers are no longer presented as missing before their bounded lazy lookup runs.
- Added route scroll restoration, scan-staleness messaging, correct singular status language, compact mobile Home composition and a clearer mobile navigation state.
- Removed duplicate mobile Settings navigation and made the desktop platform rail independently scrollable so its protected-library footer cannot overlap controls on short displays.
- Added the live 0.3.11 platform/UX audit and E2E regressions for scroll restoration and responsive Settings navigation.
- Updated the locked transitive `nanoid` dependency to 3.3.18 after its prior version became subject to a high-severity availability advisory; the frontend audit is clean again.
- Isolated candidate container naming from the fixed production DockerMan identity so release gates can run beside the single live `Ludarium` container without a name collision.
- Made candidate .NET and browser gates consume an exact `git archive` instead of copying the dirty server worktree, excluding build caches and `.env` secrets from ephemeral test workspaces.
- Made the mobile Settings regression selector exact so its label cannot be confused with the similarly named navigation landmark.
- Added an explicit accessible name to the responsive Settings selector and wait for its route paint before asserting visibility in the headless mobile workflow.
- Deduplicated deterministic health findings already represented by an actionable review group and kept resolved history free from current health summaries.

- Consolidated the Unraid deployment into one supervised `Ludarium` container containing the application and its private PostgreSQL process, with a functional DockerMan WebUI and persisted 256px PNG icon.
- Promoted 0.3.9 to production on port 1230 with schema 14, 371 canonical visible games across 16 platform collections, 371/371 visible cover coverage and all three source roots read-only.
- Made the schema-13 data reconciliation genuinely one-shot so readiness remains fast on large inventories, and added regression coverage that preserves words such as `Legends` and `Darkness` during platform-suffix cleanup.
- Prepared 0.3.9/schema 13 to turn Attention into an actionable decision inbox while retaining unknown inventory as separately inspectable evidence.
- Expanded deterministic support-content recognition for Steam, emulator, tool, redistributable, unlocker and related non-game paths; the repeatable migration resolves matching legacy unknown reviews without touching source libraries.
- Tightened canonical title cleanup for scene, platform, region and product-code noise while preserving manual locks.
- Restricted automatically verified covers to portrait box-front proportions and made generated artwork visibly pending rather than presenting it as equivalent to real cover art.
- Replaced false-zero game-detail states and stale search states with truthful loading skeletons, added cover thumbnails to search, and improved mobile filters, Settings navigation and ultrawide Library density.

- Adopted the official .NET 10 Azure Linux 3 distroless runtime after comparative security testing; the final image has no shell/package manager and zero Grype findings at every severity.
- Stopped the isolated candidate stack after successful promotion while retaining all candidate appdata, databases and backups for rollback.
- Made candidate SBOM version naming derive from the requested image tag instead of a hardcoded development label.

- Reconciled current production evidence with historical UX documentation and added a gated post-0.3.8 optional roadmap.
- Added a dedicated bounded .NET health probe and moved the runtime experiment to an official .NET 10 distroless image, removing the shell, package manager and auxiliary network tools; the final distribution is selected by comparative candidate security gates.

- Promoted 0.3.8 to production on port 1230 with schema 12, 389 visible games, complete visible cover coverage, read-only source mounts and passing post-deployment workflow/accessibility/restart gates.

- Finalized the production identity as 0.3.8 across status, exports and support bundles, including the correct schema-12 capability report.
- Corrected the live system-status capability flag to report schema 12 after the forward migration.

- Passed the complete isolated Unraid 0.3.8-dev gate on port 1232: real PostgreSQL tests, clean Compose bootstrap, three read-only library scans, browser/axe/reflow stories, restart, backup/restore, invariant source manifest, SBOM, secret scan and zero Critical/High container findings.
- Proved the production upgrade path on an isolated copy from schema 6 to schema 12 while preserving exactly 538 games and 13,856 artifacts.
- Verified selected cached artwork for every visible candidate game (372/372); the sole raw record without artwork is deterministically hidden as non-game DLC-unlocker support content.
- Made the containerized secret gate scan the materialized source tree so linked Git worktrees cannot yield a misleading zero-commit pass.

- Added a gated post-0.3.7 improvement roadmap covering catalog consistency, review-noise reduction, artwork quality, offline metadata, premium navigation, operations and full-story release hardening.
- Centralized visible-game filtering across dashboard, search and platform totals; status now distinguishes excluded support titles and full/incremental scan recency.
- Added deterministic platform-suffix and possessive cleanup while retaining manual title locks and source evidence.
- Added server-side review grouping plus exact-scope transactional bulk resolution and audited undo.
- Added persistent artwork quality evidence, deterministic portrait scoring and an artwork review query.
- Replaced synchronous full-catalog artwork enrichment with leased PostgreSQL jobs, durable progress and bounded retry.
- Simplified platform navigation, removed the duplicated Library platform strip, added semantic active states and persisted Library layout preference.
- Added rich-metadata claim endpoints and semantic Overview, Releases, Files & Integrity, Artwork and Provenance game-detail tabs.
- Added bounded LaunchBox metadata snapshots, durable metadata-enrichment jobs, provider freshness/health reporting and last-known-good offline imports without overriding manual claims.
- Added Vitest/Testing Library infrastructure, split API rate limits with correct 429 responses, reduced routine artwork log noise and restored favicon compatibility.
- Added actionable Attention filters for cause/path, library, platform, severity and age; library settings now show latest scan health and Activity names metadata jobs in operator language.
- Added a bounded operational metrics endpoint and Settings pulse for job queue depth, scan throughput, review backlog, artwork quality and provider failures.
- Preserved each downloaded/uploaded artwork version in app-owned storage and added game-scoped candidate listing plus conflict-safe manual cover selection in the Artwork detail tab.
- Added persistent card density, removable active-filter chips, reset controls, a collapsible mobile filter sheet and contextual Library actions; expanded frontend preference and browser-flow coverage.
- Added exact-scope bulk defer with audit/undo and removed raw finding diagnostics from support bundles by construction.
- Consolidated `STATUS.md` around current 0.3.8-dev evidence so historical release claims cannot be mistaken for candidate validation.
- Extracted and tested read/mutation/expensive-job rate-limit profiles, including metadata enrichment, while retaining runtime `429` and `Retry-After` behavior.
- Changed artwork enrichment to continue across providers when a candidate is below the verified portrait threshold, preserve each candidate and deterministically select the best non-rejected result; successful reconciliation now queues idempotent artwork and metadata jobs automatically.
- Added durable per-scan new/changed/moved/deleted counters, set-based missing reconciliation for large libraries and operator-readable job duration/running state in Activity.
- Added schema 11 game-to-library ownership links and a bounded library-health aggregate for artifact/game counts, detected topology and last full/quick scans in Settings.
- Parameterized Compose image/appdata isolation and added a fail-closed Unraid candidate gate covering schema, health, read-only mounts, source manifests, Playwright/axe, restart, dump/restore, SBOM, secret and vulnerability scans.
- Added responsive in-context editing for all rich game metadata fields, with durable manual locks, conflict visibility, save feedback and provider-refresh protection explained at the point of use.
- Added schema 12 persistent artifact overrides and exact-scope Attention actions for support classification, platform acceptance and bounded folder exclusions, including rescan survival, evidence, audit and complete artifact/library/rule undo.
- Replaced filename-only exclusion matching with bounded relative `*`, `**` and `?` glob semantics and regression coverage.
- Expanded the candidate browser gate with locked metadata editing/provenance, bulk-classification undo, horizontal-overflow assertions at 320/360/390/430/1280/1440/1920/3440 widths and a 200% zoom check.
- Made the isolated candidate gate run locked .NET restore/format/build/tests with PostgreSQL Testcontainers enabled and frontend unit/build/audit before browser, restart, restore and security evidence.
- Fixed clean non-root appdata ownership and removed the fixed shared Compose network name so candidate and production projects receive isolated networks.
- Made a clean candidate self-bootstrap and verify all three configured roots, complete bounded quick scans before browser gates, and use the empirically detected `/mnt/disks/PS5-Games` archive instead of the empty nominal share.

### Complete verified cover catalog 0.3.7

- Added a bounded, cached and streaming LaunchBox metadata provider without requiring an API key; catalog ZIP size, XML entry size and compression ratio are constrained and source archives are never extracted.
- Added platform-aware exact and conservative fuzzy matching plus deterministic aliases for scene names, edition labels, Roman numerals and common abbreviated titles.
- Excluded Steam launcher, Frosty Mod Tool and DLC-unlocker roots from the visible game catalog while preserving their scan evidence as non-game support content.
- Reached verified live artwork coverage for all 389 active game titles: 533 stored game records processed, 533 covers available, zero unmatched and zero failed.

### Platform collection rail and Nintendo covers 0.3.6

- Replaced the abbreviated Collections submenu with a complete, scrollable collection rail containing all platforms, platform-family badges, file and game counts, selected states and an explicit all-games entry.
- Added high-confidence artwork matching against Nintendo's official European product catalog, including verified Switch packshots.
- Improved lookup normalization for scene-style region, platform and release-group suffixes and added conservative fuzzy fallback within platform-specific Libretro catalogs.
- Increased proven cover coverage on the live dataset candidate from 262 to 328 of 394 visible games without substituting uncertain artwork.

### Premium widescreen library and verified cover enrichment 0.3.5

- Expanded the desktop canvas to 2180 px with a polished 278 px collection rail and an eight-card ultrawide library grid.
- Refined the desktop platform hierarchy, active states, archive safety indicator, mobile bottom navigation and responsive filter layout.
- Added bounded, cancellable and serialized cover enrichment from official Libretro thumbnail catalogs and exact or high-confidence Steam Store matches.
- Persisted artwork source provenance and exposed it in the game drawer; uploaded and read-only library sidecar covers remain authoritative.
- Added an authenticated `Find covers` workflow while retaining deterministic generated artwork whenever external catalogs are unavailable or cannot be matched safely.
- Verified desktop at 2560×1080 and mobile at 390×844 without page overflow, plus production workflow and WCAG A/AA gates.

### Archive experience and managed artwork 0.3.4

- Reworked the application shell, Home, Library, cards, drawers, scan states and empty states with the supplied Stitch Archive Intelligence visual language.
- Added a bounded app-owned artwork store with validated JPEG, PNG and WebP uploads; source libraries remain read-only.
- Added a deterministic artwork cascade: uploaded cover, library sidecar, then a platform-specific generated cover, so every game remains visually identifiable offline.
- Added lazy artwork loading and bounded card rendering for large collections.
- Reduced desktop navigation noise by showing platform shortcuts only inside Library and retained complete platform browsing in the Library topology.
- Added animated archive, scan and empty-state illustrations with reduced-motion fallbacks.
- Corrected mobile filter overflow and completed light-theme WCAG contrast coverage.
- Expanded integration and browser gates for artwork persistence, mobile platform navigation and production UI workflows.

### Library intelligence 0.3.3

- Added live platform subnavigation beneath Library in the desktop navigation rail, including real game counts and selected state.
- Added deterministic non-game content policy for tool, emulator, BIOS, firmware, cache, save, runtime and console-support directories. These records remain auditable as ignored support files but no longer inflate Unknown or Attention.
- Added canonical title derivation for region/revision tags, repack markers, scene-release suffixes, disc suffixes and dot/underscore filename notation while preserving manual title locks.
- Added bounded authenticated delivery of matching local sidecar artwork from read-only libraries, with abstract offline placeholders when no proven artwork exists.
- Automatically resolves obsolete Unknown reviews when the corresponding artifact is deterministically classified as non-game support content.

### Platform navigation and Stitch integration 0.3.2

- Added complete server-side platform filtering before game count, ordering and pagination.
- Added an always-visible platform navigator to Games and a richer, data-backed platform overview that opens filtered collections directly.
- Integrated Stitch's Archive Intelligence tokens, tonal surfaces, typography hierarchy, circular platform motifs and compact mobile collection patterns without importing fictional features or copyrighted artwork.
- Corrected the inventory export application version, which had remained at 0.1.0, and aligned API, support bundles, exports and deployment image on 0.3.2.
- Added PostgreSQL regression coverage for positive and empty platform filters and expanded desktop/mobile browser journeys for platform navigation.

### UX simplification 0.3.1

- Replaced thirteen architecture-oriented destinations with Home, Library, Attention, Activity and Settings.
- Rebuilt Home as a compact operational dashboard with one scan action and four primary metrics.
- Made Games the default collection view and integrated Platforms, Windows installers and Advanced Files into Library.
- Added deterministic local placeholder covers, browse filters, layouts, focused creation and game/file drawers with collapsed technical evidence.
- Unified review and health signals into one prioritized Attention inbox; unified scans, history, snapshots and exports under Activity.
- Moved identification catalogs into sectioned Settings and added a focused library wizard with advanced policies hidden by default.
- Added real grouped global search for games, platforms, files, paths and explicit hashes with Ctrl/Cmd+K and direct detail navigation.
- Split the former 64 KB frontend entry point into feature-oriented app, API, component and workspace modules.
- Fixed persisted integrity-snapshot JSON deserialization and added a deterministic regression test.
- Replaced the old route-count browser tests with five-destination desktop/mobile journeys, overlay focus, screenshots and accessibility checks.

### Completion pass

- Added bounded MSI database-table inspection for product properties, media ranges, file relationships and embedded/external cabinets without extraction or installer APIs.
- Added deterministic SNES/NDS recognition and richer ROM header provenance for Nintendo and Sega cartridge families.
- Added persisted operational settings, schema 6 optimistic concurrency, bounded retention/workflow controls and a bounded PostgreSQL pool.
- Added dark/light/system appearance, reusable animated archive illustrations and responsive reduced-motion behavior.
- Expanded the operational Settings workspace with analyzer capabilities, privacy guarantees and server preferences.
- Added correlation-scoped structured HTTP completion logs without credential/header logging.
- Corrected the application/schema capability surfaces to version 0.3.0/schema 6.
- Verified an isolated restored candidate stack, PostgreSQL 16.14 container gates, desktop/mobile Playwright, axe, source immutability, Gitleaks, CycloneDX and Grype gates.

- Added PostgreSQL 16.14 Testcontainers coverage for repeatable migrations, persisted evidence, restart survival, idempotent scans, audited review undo and optimistic concurrency.
- Added a 250,000-artifact PostgreSQL search gate and a trigram index for bounded contains-search query plans.
- Replaced unsupported Npgsql multi-statement mutations with explicit atomic transactions.
- Added bounded PE version-resource and MSI SummaryInformation inspection without invoking executable code, COM or Windows Installer.
- Added server-side game search/pagination and operational release creation to the game detail workspace.
- Added editable per-root hash, archive-inspection and concurrency policies plus complete new-root recursion controls.
- Added bounded static 7z header enumeration with member/path/size/ratio limits and deterministic synthetic tests; no member is extracted.
- Added reproducible Gitleaks, Syft and Grype gates with pinned scanner image digests and retained JSON/CycloneDX evidence.
- Added desktop/mobile Playwright workflow coverage for metrics, search, review filters, keyboard navigation and responsive overflow.
- Added deterministic 10,000 and 100,000 item classifier scale gates with time and allocation ceilings.

### Product-audit remediation

- Replaced the hardcoded archive confidence score with persisted-data metrics.
- Added artifact evidence details, exact-duplicate relationships and archive/bundle context.
- Added operational Storage, Library Health and Windows Archive views.
- Added artifact pagination and bounded searchable game browsing for large collections.
- Added review deferral, scan pause/resume/cancel/retry controls and real progress calculation.
- Added direct root verification, quick/deep scan actions and enable/disable management.
- Improved mobile data density, keyboard artifact inspection and responsive detail layouts.

### Added

- Phase 0–2 production-oriented vertical slice: domain model, PostgreSQL schema, safe scanning, streamed hashes, evidence-backed classification, exact duplicate query, durable scan records and responsive web application.
- CUE/M3U bundle validation foundation, review/audit endpoints, capability reporting, inventory exports and synthetic fixtures.
- Non-root container build, hardened Compose stack, Unraid template and operational runbook.
- Rescan-stable CUE/M3U and Windows installer bundles, static PE inspection and additional ROM signatures.
- Streaming Logiqx catalog import, explained exact-hash matching, immutable snapshots, comparison and complete checksum manifests.
- Operational Catalog Sources and Snapshots & Exports screens backed by PostgreSQL APIs.
- Manual games and releases with append-only locked claims, optimistic concurrency, audited review resolutions and compensating undo.
- Stable health-rule findings and sanitized, path-redacted support bundles exposed through the API and UI.
- Bounded ZIP central-directory inspection with persisted virtual members and no archive extraction.
- Bounded-memory JSON, CSV and SHA256SUMS exports with format version headers, escaping and cancellation cleanup.
- Configurable host port defaulting to 1230 and a pinned PostgreSQL 16.14 deployment baseline for verified Unraid compatibility.
- Local administrator-token login with tab-scoped credential storage, explicit sign-out and a publicly loadable application shell.
- Three independent deployment roots for the general Games collection and dedicated PS4/PS5 mounts.
- Evidence-backed platform inference for PC, Nintendo and PlayStation directory taxonomies, including dedicated PS4/PS5 roots.
- Configurable non-root runtime UID/GID for read-only libraries with owner-only directory permissions.
- Honest directory-versus-extension conflict handling prevents multipart volumes from being mislabeled as another platform.
- Idempotent scan-to-game materialization with directory provenance, real platform aggregates and an accessible mobile navigation drawer.

### Security

- Alpine production images include the Kerberos/GSS runtime required for stable PostgreSQL connections; Linux read-only verification uses managed mount metadata without unsafe native structs.
- Source filesystem interface exposes read operations only and rejects descriptor path traversal.
- Scanned content is never launched; source mounts are read-only in deployment definitions.
- Support bundles omit library paths, raw scan errors, credentials and source content.
- Production startup fails closed when the PostgreSQL connection string is absent instead of silently targeting localhost.
- Upgraded the vulnerable transitive `Microsoft.OpenApi` 2.0.0 dependency to 2.11.0; current NuGet and npm audits report no known vulnerable packages.

### Known limitations

- See `STATUS.md`; intentional unsupported capabilities are reported explicitly. The gated 0.3.0 candidate is awaiting only the controlled live replacement and post-deployment validation.