## 2026-09-05 — Sandbox home/cache + sync download-storm hotfix - Fixed authenticated development sandboxes so `HOME`, npm, pip, Cargo, Corepack and XDG cache state live under the writable, quota-accounted `/workspace/.learnitive/` tree instead of relying on `/home/developer` runtime mounts. - Bumped the sandbox runtime contract to `workspace-home-v3`; an existing container is reused only when its generation/lease is valid **and** its Docker image ID matches the currently configured development image. Stale containers are reconstructed automatically from durable local project source. - Sandbox creation now fail-closes unless the numeric runtime UID/GID resolves to the `developer` user/group and both the sandbox home and npm cache are writable. Interactive Terminal shells explicitly use `--noprofile --norc`, preventing `.bash_profile`/`.bashrc` permission failures. - Added an installer smoke test that exercises the actual authenticated `/workspace` home/cache contract and verifies `npm config get cache` before staging services are activated. - Fixed project synchronization so it no longer downloads every remote file on every polling pass. Reconciliation now compares size/mtime snapshots first, downloads remote bytes only for a real remote change or two-sided conflict, refreshes post-write mtimes, deduplicates concurrent sync calls, avoids hidden-tab polling, and uses a bounded 5-second foreground cadence. - This directly fixes the observed `Dependency restore failed ... /home/developer/.bash_profile: Permission denied`, root-owned `~/.npm` EACCES errors, `groups: cannot find name for group ID ...`, `I have no name!`, and repeated `/environment/download?...` request storms. - Verification in this implementation sandbox: **366/366** dependency-free server/static tests PASS; project-runtime **10/10** PASS; capability audit **40/40** with zero blockers; frozen-lock sync, trusted runtime manifest, R12 release audit, Learnitive branding/provenance audits, Console Gateway syntax, modified TS/TSX syntax and installer shell syntax all PASS. Live Docker/npm dependency restore remains an on-staging acceptance gate. ## 2026-09-05 — React Agent compile routing fix - Fixed the AI proposal `Apply & Compile` path so non-LaTeX projects resolve their canonical project profile and build through the Universal Runtime instead of calling the legacy LaTeX compiler directly. A React/Vite project can no longer fall through to `main.tex` and report `LaTeX root file was not found: main.tex`. - Kept genuine LaTeX AI proposals on the existing LaTeX compiler path, including diagnostics and bounded repair behavior. - Made Agent project-health inspection mode-aware: generic code/web projects no longer manufacture `main.tex`/LaTeX-root or stale LaTeX compile diagnostics merely because the legacy LaTeX configuration has defaults. - Updated stale Create Project source-contract tests to follow the AI-inferred `starter.profile` rather than the previously selected fallback profile. This preserves prompt inference such as `create a react homepage` -> React + Vite. - Regression verification in the implementation sandbox: 364/364 dependency-free server/static tests PASS; project runtime 10/10 PASS; vibe-coding contract 12/12 PASS; capability audit 40/40 with zero blockers; lock sync, trusted runtime manifest, R12 release audit, brand/provenance audits and installer syntax PASS. The staging installer remains authoritative for the full pnpm/Vite build and live Docker/Agent acceptance. ## 2026-09-05 — Terminal identity + Agent code-edit + Build-with-AI UI fix - Fixed interactive development containers so the image `developer` account is built with the real staging Console service UID/GID instead of a hard-coded numeric identity. `/home/developer` is now mounted writable with that same identity, eliminating `I have no name!`, missing-group, shell-profile permission and root-owned npm-cache failures. - Added installer preflight that verifies numeric UID/GID, `developer` user/group names, `HOME=/home/developer`, home writability and the unified toolchain before service activation. - Fixed Agent `apply_patch` so ordinary text/code files such as `src/App.tsx` use generic project storage instead of the LaTeX-only source service. LaTeX retains collaboration/review-aware source mutation semantics and rollback behavior. - Simplified the AI chat header: Ask/Agent, Settings and New Chat remain; the Ollama shortcut/model controls are no longer duplicated in the top bar, and `Undo AI turn` lives in Agent activity. - Build with AI is now prompt-first: selecting it hides Popular languages, Popular frameworks and Complete catalog; the prompt infers an appropriate starter (including React/Vite for React homepage requests). - Added dependency-free regression guards for the sandbox identity/home contract, prompt-first creation UI and code-file AI mutation path. Also repaired an overly broad Ollama fail-closed source-slice test that falsely included the following cloud-credential method. - Verification available in this implementation sandbox: targeted staging/runtime tests 25/25 PASS; additional security/staging/Ollama tests 29/29 PASS; capability audit 40/40 with zero blockers; frozen-lock sync, trusted runtime manifest and full static R12 release audit PASS; modified TS/TSX files syntax-transpile PASS; installer and Console Gateway syntax PASS. Full pnpm/Vite build remains an on-server staging gate because pnpm is not cached here and registry DNS is unavailable. ## 2026-09-05 — Vibe Coding R11 staging readiness - Fixed Console Gateway readiness by aligning the staging installer on canonical `/healthz`; gateway retains `/health` as a backward-compatible alias. - Added installer regression guards for the Console health contract. - Stage externally provisioned Learnitive fonts into Vite's public directory only during browser build so absolute `/learnitive-fonts/*` URLs resolve at build time without unresolved-font warnings; staged source copies are cleaned afterwards. - Replaced non-portable `cp -a -n` with `cp -a --no-clobber`. - Verification: 363/363 broad tests, 10/10 runtime, 11/11 vibe invariants, 40/40 capability audit, all current release gates PASS. # Learnitive Vibe Coding R1 — Per-User Sandbox + Agent + Authenticated Preview/Sharing — 2026-09-05 ## 2026-09-05 — Preview origin canonical hostname correction - Corrected the dedicated untrusted application Preview origin from the staging-derived `preview.os.learnitive.com` to the canonical `preview.learnitive.com`. - Renamed the Apache Preview vhost files and updated installer TLS detection, CSP allowlists, Preview-origin tests, capability audit, and snapshot documentation to the canonical hostname. - The primary staging application remains `os.learnitive.com`; only the isolated user-application Preview origin uses `preview.learnitive.com`. - Transforms the Hotfix34 foundation toward the Replit-style Learnitive architecture without replacing traditional project creation, templates, Learn, collaboration, Git, LaTeX, or the Universal Runner. - Adds centralized project authorization with owner/editor/viewer roles and canonical `private`, `shared`, and `authenticated_public` visibility. - Adds canonical migration v36 for project members, authenticated share links/grants, per-user sandboxes, sandbox project/process state, AI checkpoints, encrypted project environment variables, and structured project audit events. - Refactors the real Docker PTY runtime to one disposable development container per authenticated user, with project working trees under `/workspace/projects/` and generation-bound credentials. - Free development sandboxes receive a 24-hour lease; Pro sandboxes receive a 7-day lease. Healthy reuse does not slide expiry. Missing/deleted containers reconstruct automatically with a new generation and fresh entitlement lifetime. - Moves project materialization/synchronization out of the Terminal UI into project-level local↔sandbox reconciliation so editor, Terminal, AI, commands, processes, and Preview share the same active server working tree while local storage remains durable. - Adds bounded sandbox commands, tracked long-running processes, logs/status/stop operations, and an authenticated HTTP Preview gateway that resolves owner sandbox/process state server-side and strips primary-app cookies/`Set-Cookie` authority. - Adds Ask/Agent AI UX, actual sandbox verification, dependency restore, bounded repair, platform AI-turn checkpoints, and `Undo AI turn` independent of Git. - Adds an additive `Build with AI` path beside conventional project creation; AI creation still creates a normal local-first project and then runs Agent against its authenticated sandbox. - Adds authenticated/revocable view/edit share links, members, authenticated-public discovery semantics, login-return share redemption, and signed authenticated collaboration grants. Anonymous project/collaboration access is no longer an architectural invariant. - Adds AES-256-GCM project secrets with server-side process/command injection, secret-name-only listing, sandbox/share rate limits, and security audit events. - Modernizes the capability/release audits so they certify the current Learnitive architecture instead of retired TeXise service paths or the discarded Markdown-specific Terminal/Track/Review/AI Review proposal. - AI provider adapters now expose a stable capabilities contract plus a streaming-compatible interface; current adapters advertise native incremental streaming/tool calling accurately as not yet implemented while retaining existing completion behavior. - Verification in the implementation environment: **345/345** supported server/static tests, **10/10** project-runtime tests, dedicated vibe-coding invariants **6/6** (included in the 345), capability audit **30/30**, frozen pnpm lock sync, trusted runtime manifest, R12 release audit, Learnitive brand audit, TeXise provenance audit, installer syntax, server/gateway syntax, and TypeScript syntax parsing for all 14 modified TS/TSX files all pass. - Environment limitation: project `node_modules` and pnpm are absent and npm DNS access is unavailable, so the production browser build cannot be executed here. Docker is also absent, so live container/PTY/process/Preview acceptance must run on staging. Vite HTTP Preview routing is implemented; HMR WebSocket proxying remains a known follow-up/acceptance limitation. # Learnitive Hotfix32 — Legacy Learn Schema Compatibility + Full Seed Graph Repair — 2026-09-04 - Fixes the authoritative Hotfix31 staging failure: `Failed to restore canonical Learn course python-fundamentals: Field 'public_id' doesn't have a default value`. - Deep-audits every Learn table for extra legacy `NOT NULL`/no-default insert blockers and safely relaxes compatible retired `public_id`/`uuid` identity columns while preserving existing values/indexes; unknown blockers fail closed. - Verifies real index definitions rather than names, preserves conflicting legacy keys and adds canonical fallback indexes when names collide. - Restores canonical unique course/module/lesson slug keys and media storage keys after explicit duplicate checks. - Upgrades seed integrity from course-only checks to the complete canonical course → module → lesson graph, including transactional missing-course restoration and interrupted graph repair. - Separates legacy compatibility repair from migration structural state so compatibility changes cannot suppress required migration data replay. - SaaS preflight now reports `learnLegacyColumnsRelaxed`, `learnSeedMissingBefore/After` and `learnSeedGraphMissingBefore/After`; successful staging requires both post-repair counts to be zero. - Verification: supported server/static suite 360/360, project-runtime 10/10, frozen lock/trusted runtime/R12/branding/installer/Apache audits all pass. - Universal templates remain unchanged; previous staging evidence already proved the template/runtime library healthy. # Learnitive Hotfix31 — Verified Repeatable Learn Seed Recovery — 2026-09-04 - Fixes the live staging state where Hotfix30 recorded Learn migration 35 but only part of the canonical course catalog persisted: LaTeX validated, then `python-fundamentals` was missing. - Restores missing canonical Learn course rows with strict inserts plus immediate and final persistence verification instead of `INSERT IGNORE`. - Rechecks and repairs missing canonical Learn courses on every SaaS startup, including databases where migration 35 is already recorded after a partial prior repair. - Preserves surviving Admin-edited canonical courses and keeps module/lesson replay scoped to courses that were actually absent. - SaaS preflight now reports `learnSeedMissingBefore` and `learnSeedMissingAfter`; staging may proceed to Learn runtime validation only when the post-repair count is zero. - Universal templates remain unchanged because live staging validated all 69/69 successfully. # R14.28.20 Build Fix 51.4 — Public Change Log CMS - Live PDF latency fix: browser Live PDF now uses the compiler's preview-safe single LuaLaTeX pass instead of an unconditional rerun/bibliography/index cycle, skips generated-artifact readback that the viewer does not consume, avoids warm remote-cache scans when no packages were downloaded, removes a duplicate source-workspace flush, and publishes new PDF bytes immediately while same-generation SyncTeX indexing completes in parallel. Manual Compile remains the full multi-pass path. The viewer status now says **Live PDF · updating…** instead of the misleading **reconciling…** label. - Pricing polish: homepage and `/pricing` Pro cards now show **Full collaborations** in bold without an asterisk; the card-level collaboration sign-in note is no longer presented as an asterisk footnote. - Adds a public `/change-log` page backed by MySQL so recent product improvements can be published without changing source. - Adds `/admin/change-log` with database-backed page heading/introduction settings plus dated Draft/Published change-event create, edit and delete workflows. - Adds Admin audit events, dashboard visibility, footer navigation, public search, SEO prerender metadata, sitemap coverage and production SEO verification for the Change log. - Seeds a small set of recent TeXise changes on first migration; administrators remain authoritative and can edit or remove them. - Fix 2 makes the activated trusted API runtime self-contained for comparison SEO by staging `compare-content.json` beside the server modules and verifying the comparison registry before systemd activation. - Fix 3 makes Ollama localhost discovery interaction-gated: passive application startup, ordinary browsing, opening the AI Assistant and opening AI Settings do not probe `localhost:11434`. Local Network Access is first requested only when the user chooses/refreshes Ollama or starts an AI request while Ollama is already the selected provider. Documentation migration 25 updates the public Ollama/AI guides accordingly. - Fix 3 eliminates prerender flashes on `/change-log`, `/compare` and `/compare/*`. Substantive prerender HTML stays in the response for SEO but is hidden by the browser before any stylesheet can paint it; React replaces it with the styled application UI. - Comparison polish reuses the homepage FAQ component, removes row-level `Source:` clutter, gives TeXise positive checks a yellow circular treatment, shows the Free project allowance as `5`, removes the workflow-priority table and shortens comparison headings/copy. - `/docs/ollama` now starts with a clearer Step 1 install section and an official yellow **Download Ollama** button linking to `https://ollama.com/download`; migration 26 upgrades only untouched canonical CMS content. - Comparison follow-up removes the duplicated “Choose TeXise/competitor” recommendation cards, removes guide Evidence/How-to-choose cards, uses normal supporting labels instead of eyebrow styling inside workflow-fit cards, and fixes the `/compare/*` back-link/category-label overlap at the shared layout level. - Legacy `/ws#route=welcome` entries now redirect immediately to the public home page `/` instead of booting the editor Welcome route; the same redirect applies to an already-running editor that navigates to the legacy welcome hash. # R14.28.20 Build Fix 51.3 — Ollama Cloud Support - Allows Ollama Cloud-backed models discovered through the user-side Ollama service when Privacy Mode is off. - Keeps verified Local Ollama available with Privacy Mode on or off and labels Local vs Ollama Cloud explicitly. - Revalidates the selected Ollama model before inference and blocks Ollama Cloud when Privacy Mode is enabled. - Extends AI Assistant, AI Settings, Automatic AI, AI Review, Paper Memory/review provenance, docs, comparison content and browser E2E coverage for Ollama Cloud. - TeXise servers still do not install, run or proxy Ollama; the browser connects directly to the user's Ollama service. # TeXise R14.28.20 Build Fix 51.2 — Texposit-style User-side Ollama Workflow - Mirrors the Texposit Ollama experience in TeXise: Ollama is installed and run only on the user's computer, the AI Assistant automatically detects `localhost:11434`, offers **Use Local Ollama**, discovers installed models, exposes a model dropdown, and uses the selected local model across supported TeXise AI workflows. - If the local Ollama service stops or becomes unreachable, TeXise automatically falls back to the last configured browser-held BYOK AI provider when one exists. Privacy Mode deliberately disables that cloud fallback and remains fail-closed. - Preserves BF51.1's local-inference privacy boundary: Ollama `remote_model` / `remote_host` entries remain blocked from Local Ollama and selected models are revalidated before manuscript context is sent. - Adds a Texposit-style Ollama handbook flow covering hardware guidance, install/run steps, common academic models, automatic detection, fallback behavior, custom `Modelfile` setup and troubleshooting. - Bumps the app-shell cache to `buildfix51-2` and adds cumulative BF51.2 source/regression enforcement. # TeXise R14.28.20 Build Fix 51.1 — Production Privacy, AI, PDF & Search Hardening - Verifies Ollama models as locally installed and blocks remote/cloud-backed models before manuscript context is sent. - Replaces finite LaTeX JSON-escape repair with generic TeX control-sequence recovery. - Adds viewer-aware R6 diagnostics, warm-up failure reporting and isolated instant-worker disposal. - Deepens `/compare` guides with canonical membership, row-level official-source provenance, sitemap freshness and substantive initial HTML. - Adds Ollama privacy documentation migration 21 and deterministic browser E2E coverage. - Hardens point-build release coherency so `buildfix51-1` service-worker identities stage correctly, updates migration regression coverage through versions 20/21, removes fixed Free-limit defaults from comparison claims and adds optional changed-URL IndexNow manifests. - Closes release-orchestration gaps by running the BF51.1 Ollama browser test in formal `e2e:release`, certifying all canonical comparison routes plus `/docs/ollama` in production SEO checks, and adding a loopback-only real Ollama smoke command (`pnpm run release:ollama-local`). ## R14.28.20 Build Fix 51 — Growth, Ollama, Comparison and Search (2026-08-28) - Added first-class Ollama local-service AI beside browser Local AI and BYOK AI, with loopback-only connection/model discovery, Privacy Mode support, no user API key and no silent cloud fallback. - Added Ollama controls to AI Settings and routed the configured local service through AI Suggest, AI Review and Paper Memory-compatible reasoning paths while preserving review-mediated source changes. - Added `/docs/ollama` and refreshed AI Overview/Paper Memory documentation for browser Local AI, Ollama and BYOK AI. - Rebuilt `/compare` around one dated, sourced competitor registry covering Overleaf, Bibby, Murfy, Octree, Papeeria, TeXposit, LyX, Authorea and TeXPage plus four comparison guides. - Hardened Bing/search discovery with explicit favicon declarations and crawler health checks, legacy `/latex-templates` redirect verification and post-health-check IndexNow notification. - Added local-only Live PDF R6 diagnostics without changing exact R5 authority, export safety or fail-closed eligibility. - Consolidated bounded LaTeX-safe structured AI output recovery for AI Review/Suggest and Paper Memory without weakening semantic/evidence validation. # R14.28.20 BF51 — Growth, Comparison Intelligence, Ollama AI & Search Hardening — 2026-08-28 - Adds first-class **Ollama** local-service AI beside browser **Local AI** and **BYOK AI**, with loopback-only host validation, `/api/version` connection testing, `/api/tags` model discovery, no user API key, Privacy Mode compatibility and no automatic cloud fallback. - Routes Ollama through the existing TeXise AI Suggest, configured AI, Review and Paper Memory-compatible workflows while keeping source changes review-mediated and cloud credentials browser-held only for BYOK AI providers. - Adds `/docs/ollama` plus updated AI Overview, Paper Memory, Automatic AI and plan documentation explaining browser Local AI vs Ollama vs BYOK AI and the required `OLLAMA_ORIGINS=https://www.texise.com` setup. - Replaces duplicated comparison registries with one evidence-backed `compare-content.json` shared by the browser, SSR SEO and sitemap. First-wave comparisons cover Overleaf, Bibby, Murfy, Octree, Papeeria, TeXposit, LyX, Authorea and TeXPage plus four `/compare` decision guides. - Hardens Bing/search recovery with an explicit root ICO declaration, crawler favicon/manifest HTTP health checks, legacy `/latex-templates` redirect verification and non-fatal IndexNow publication only after a healthy deployment and verified ownership key file. - Adds local-only R6 Instant PDF observability for eligibility, rejection reasons, warm-up/compile/publish timings, patch lifetime and worker failures without expanding fail-closed eligibility or changing exact R5/SyncTeX/export authority. - Consolidates bounded AI structured-output recovery so AI Suggest/Review and Paper Memory share LaTeX-safe JSON extraction/truncation repair while preserving semantic/citation validation and avoiding permissive execution/parsing. - Adds a cumulative BF51 source guard and regression suite while preserving the complete BF49/BF50/R6 foundation and the configurable Free project limit. # R14.28.20 Build Fix 50 — Public Site Redesign — 2026-08-25 - Rebuilds the public homepage into the concise Hero → product visual → differentiators → Power Features → TeXise vs Overleaf → Pricing → FAQ → final CTA journey while preserving the BF49 interactive workspace preview and editor recovery. - Adds first-class `/features` client/SSR/sitemap support, promotes Features in desktop/mobile navigation, and moves Use Cases into Footer → Product while preserving all existing use-case routes with calmer editorial layouts. - Consolidates Home and `/pricing` onto one three-plan model: Free `$0 forever`, Pro Lifetime `$29 one-time`, and Pro `$5 / month`; Lifetime remains the highlighted Most Popular option. - Aligns product gates with the advertised model by making Paper Memory a Pro entitlement and preserving Free collaboration joining versus Pro collaboration hosting. - Adds entitlement-aware Free PDF watermarking as a download-time export policy without modifying canonical LaTeX source, live compilation output, preview or SyncTeX; Pro receives the original clean PDF. - Adds a distinct optional `TEXISE_PRO_MONTHLY_SHOP` checkout configuration so monthly Pro can never be confused with the existing Lifetime Deal path. - Adds BF50 public-site, pricing, FAQ, SEO, use-case, entitlement and export-policy regression coverage; BF33–BF49 source guards continue to verify the preserved editor/collaboration/template/projects platform. # Unreleased - Added an explicit Automatic AI `..?` cue: when the watcher is enabled and ready in safe prose, TeXise consumes the cue and immediately reviews the preceding sentence while keeping the normal idle-trigger workflow intact. - Documented the `..?` Automatic AI cue in the homepage FAQ and `/docs/automatic-ai-suggestions`, including a highlighted Markdown callout rendered by the safe docs renderer. - Hardened Research Assistance relevance: provider queries are reduced to technical claim terms, malformed metadata dumps are rejected, and recent/seminal ranking can no longer admit zero-overlap literature candidates. - Added regression coverage for explicit Local AI triggering, disabled-mode literal cue behavior, focused literature queries/relevance filtering, safe docs blockquotes and the BF50 docs/homepage contract. - Repaired the native LaTeX Visual round-trip contract so TeXise-generated literal escapes (`\%`, `\_`, `\#`, `\&`, `\$`, braces, `\textbackslash{}`, `\textasciitilde{}`, `\textasciicircum{}`) reparse as editable prose instead of Protected LaTeX, including recovered trailing paragraphs. - Made protected Visual nodes lossless and non-empty by rendering the exact owned source bytes; complex figures keep the complete `figure` environment, every graphics target, explicit preview-failure states, extensionless/`\graphicspath` lookup and PDF/browser-renderable sibling preference. - Document Setup now displays the complete authoritative preamble source range before `\begin{document}`, preserving comments, metadata, custom commands and publisher-specific setup rather than reconstructing recognized fields. - TikZ Visual Editor insertion now uses the active LaTeX document controller revision and reprojects `tikzpicture` as an explicit `TikZ · Protected LaTeX` source-backed block instead of disappearing from Visual mode. - Isolated the Visual editor stacking context and neutralized protected-node selected-state z-index so protected LaTeX can never paint above portaled dialogs/modals. - Added a `Beta` badge beside the Visual editor tab and preserved the template catalog Quick Preview/card-height/order/grid behavior from the current Hotfix10 line. - Added first-class Admin template thumbnail upload/replace/remove for PNG, JPEG and WebP assets with byte-signature validation, managed-file cleanup, audit logging and the existing protected template-asset delivery path. - Template catalog cards now use an A4 portrait thumbnail surface and fall back to the supplied TeXise `texise-template-default-thumbnail.webp` only when no custom thumbnail is configured; Template Preview/PDF remains a separate feature. - Visual source comments and whitespace are now preserved in a lossless source-layout sidecar rather than materialized as invisible ProseMirror blocks, preventing dashed LaTeX comments from appearing as bars without disturbing document positions, Enter behavior or exact Source navigation. - Made every Visual-mode construct that TeXise cannot safely edit a deliberate Source-navigation surface: protected block boxes and inline pills are keyboard/click accessible, show an Open in Source affordance, and select the exact canonical source range when opened. - Hardened protected-source projection so comment/control-sequence-only rich regions are promoted to block boxes instead of leaking as loose LaTeX chips; complex figure boxes now stay visible while previews load/fail and keep one placeholder per graphics target. - Normalized Visual graphics path matching across nested workspaces so extensionless `\includegraphics{...}` targets can reliably resolve PDF/image siblings for lazy PDF.js thumbnails while preserving the original source. - Formalized Cloud Compile administrator test access: Admin remains subject to deployment/concurrency/engine/input/output/timeout safety limits but bypasses commercial daily/monthly allowances; the compiler UI explicitly labels Admin test access and disables Cloud selection for non-Pro users. - Hardened Visual mode with a generic fidelity firewall for arbitrary complex LaTeX: source-only document structure, page-layout, bibliography, complex tables/lists/figures and other unsupported constructs render as immutable Protected LaTeX boxes instead of destabilizing surrounding editable content. - Removed visible blank-row artifacts caused by source-only blank-line anchors; heading-owned `\label{...}` source is preserved invisibly with the heading so section titles remain clean and editable while reference anchors round-trip exactly. - Extended protected figure projection to retain every `\includegraphics` target in source order and show multi-asset previews without flattening nested/minipage layouts into an unsafe editable figure. - Visual graphics preview now resolves normal extensionless LaTeX targets against the actual project tree, prefers browser-renderable PDF/image siblings (including EPS+PDF projects), and lazy-loads PDF.js only when a PDF graphic actually needs a thumbnail; EPS-only graphics stay safely protected. - Fixed Visual-mode typing on complex LaTeX projects whose editable projection differs from protected canonical source: native transaction-local edits now use unique surrounding source context as a safe fallback rebase instead of rejecting the keystroke and rebuilding the projection, eliminating the backward-walking caret/disappearing-letter loop. - Reworked generic safe custom text environments into one editable Visual environment block with exact preserved begin/end wrappers, and coalesced source-only rich regions into proper protected LaTeX boxes; protected inline LaTeX now displays a useful source preview instead of repeated generic `LaTeX` chips. - Replaced the Admin template-category runtime Lucide module graph with build-generated static SVG sprite/index assets: the full visual browser remains searchable and paged without `dynamicIconImports`, per-tile `React.lazy()`, or a retained icon-component cache; public category cards use static per-icon SVG assets and normal site/Admin startup no longer pays for the catalog. - Generalized Source/Visual editing for arbitrary complex LaTeX projects with canonical LF/CRLF preservation, Source↔CodeMirror offset mapping, EOL-aware Visual serialization/source maps and structural mutations, conservative mixed-line-ending handling, and capability-based partial editing of safe custom text environments while unsupported structures remain exact protected LaTeX; no template/class-specific parsing rules are introduced. - Fixed the Template Category editor crash (`e.currentTarget is null`) by snapshotting field values before React state-updater callbacks; PDF.js and category-specific UI remain lazy so ordinary SaaS routes avoid template-preview/browser startup cost. - Fixed the PDF preview controls accessibility semantics for Biome: the labelled controls container now uses `role="toolbar"`, making its `aria-label` valid while preserving the same viewer layout and behavior. - Fixed the shared template PDF.js viewer for the pinned `pdfjs-dist@6.2.108` TypeScript API: rendering now supplies the required `canvas` parameter and lifecycle cleanup stays on `PDFDocumentLoadingTask.destroy()` instead of the non-existent `PDFDocumentProxy.destroy()`, restoring strict `tsgo` compatibility. - Public `/templates` discovery now hides empty categories and institutions everywhere: public taxonomy APIs only return types referenced by published templates, empty browse sections/options are suppressed, and direct empty taxonomy pages resolve as unavailable while Admin still retains full taxonomy management. - Template categories are now a first-class managed taxonomy with stable IDs, Admin CRUD/order/status controls, category dropdown assignment, and an explicit Uncategorised state for missing or unknown ZIP metadata. - Added a full searchable visual Lucide icon browser for template categories, including recent icons, safe canonical icon-name persistence, fallback rendering, and live public-card preview; managed icons/descriptions/order now drive `/templates` “What are you writing?” cards. - Replaced link/object-only PDF template previews with the existing `pdfjs-dist` stack for inline canvas rendering on template detail, Quick Preview and private Admin preview, with paging, zoom, fit-width, loading/error states and an Open PDF fallback. - Template category Assets Sync now publishes `categories.json` alongside the catalog, preserves public runtime permissions, and managed category routes feed public category SEO/sitemap generation while archived categories remain private; deployment now requires/health-checks the registry and Apache serves it with explicit no-cache revalidation. - `/admin/templates` now uses an accessible Lucide Pencil icon instead of the text Edit action; existing sortable/newest-first, create, delete/rollback and preview workflows remain intact. - Fixed `/templates` returning `Template manifest request failed (403)` after Admin template mutations: runtime Assets Sync now explicitly keeps `dist/texise-templates/` at `0755` and generated catalog JSON at `0644`, overriding the trusted API service's intentional `UMask=0027`. - Admin Templates now supports sortable Template/Tier/Status/Category/Institution/Created/Updated columns, defaults to newest-created first, provides private draft/archived previews, and supports transactional permanent single/bulk deletion with automatic catalog sync and rollback on sync failure. - Build Fix 47's installer source guard now treats the filesystem-backed template catalog and institution registry as mutable production data: it validates runtime manifest shape/safety instead of rejecting legitimate catalog additions/deletions because the live published count is no longer exactly 36. # Unreleased — Admin Create Template Workflow — 2026-08-23 - Adds a primary **Create template** workflow to `/admin/templates` with template name, generated/editable slug, Free/Pro access and a required ZIP project upload. - Reuses the canonical filesystem-first ZIP importer, applies the administrator-supplied name, and forces every new ZIP import to `draft` even when an uploaded `template.json` claims to be published. - Keeps **Bulk import ZIPs**, Assets Sync, Replace ZIP, validation, preview and metadata editing intact; successful creation selects the new draft directly in the existing Template Editor. - Adds friendly in-dialog ZIP/import errors and preserves form/file state after a failed create attempt such as a duplicate slug. - Extends ZIP staging cleanup so post-extraction metadata or entry-file validation failures cannot leak temporary staging directories, while replacement continues to preserve reviewed metadata and publication state. - Adds focused server/static regression coverage plus Playwright workflow coverage for successful creation and duplicate-slug recovery. # R14.28.20 Build Fix 49 — Hotfix10 Pagination Typecheck Correction — 2026-08-23 - Fixes the BF48 production `tsgo` failure in the All Templates pagination gap renderer under `noUncheckedIndexedAccess`. - Replaces direct subtraction from `array[index - 1]` with a nullish-safe previous-page fallback while preserving the same pagination behavior. - Adds a dedicated BF49 strict-TypeScript regression guard so the unsafe lookup cannot silently return. - Rotates installer, deployment source guard, collaboration diagnostics and service-worker app-shell cache to BF49 while preserving the complete BF48 template UX release. - Dependency-free certification includes a standalone strict TypeScript probe with `--strict --noUncheckedIndexedAccess`, plus the full historical/runtime/server/static release matrix. # R14.28.20 Build Fix 48 — Hotfix10 Template UX Reliability — 2026-08-23 - Added Admin institution logo upload, replace and remove with byte-signature validation and filesystem-portable metadata. - Added 12-per-page All Templates pagination with URL state, accessibility semantics and safe filter/page clamping. - Changed template application to fetch and validate the complete project before workspace creation; decoded payload bytes replace unreliable transfer `Content-Length` checks. - Suppressed automatic Firefox/FxiOS persistent-storage permission prompts across project storage, local AI and Paper Memory. - Bounded and searchable in-editor template selection for the expanded template catalog. - Preserved institution logos during duplicate merge and made replaced logos immediately revalidate. # R14.28.20 Build Fix 47 — Hotfix10 Navigable Academic Template Directory — 2026-08-23 - Seeds 28 clearly labelled TeXise-created demonstration templates across 10 academic institutions, bringing the working catalog to 36 published templates while explicitly stating that no institutional endorsement is implied. - Reworks `/templates` into an intent-first directory with dominant semantic search, university-first discovery, document-type categories, Recently Verified templates, restrained faceted filtering, sorting and Quick Preview. - Adds a searchable/country-grouped institution directory and richer institution pages with degree filtering, live counts, latest verification and provenance guidance. - Adds canonical `/templates/categories/{slug}` CollectionPages with server-rendered SEO, breadcrumbs and sitemap inclusion while preserving `noindex,follow` for arbitrary filtered combinations. - Extends institution metadata with aliases so common university names and abbreviations resolve naturally in catalog search. - Preserves BF46 image/PDF preview behavior, protected template delivery, filesystem-first Free/Pro administration and catalog-only public Assets Sync. - Rotates installer, deployment/source guard, collaboration diagnostics and app-shell cache to BF47 and adds dedicated template-directory regression/release coverage. # R14.28.20 Build Fix 46 — Hotfix10 Template Preview & Privacy-First Homepage Workflows — 2026-08-23 - Adds Admin template preview upload for validated PNG, JPEG, WebP and PDF files up to 20 MB, persisted inside the canonical filesystem-first template directory. - Automatically falls back to root-level `template.pdf`, then `main.pdf`, when no explicit preview is configured; clearing an uploaded preview restores the automatic fallback without deleting project output. - Distinguishes image/PDF preview media throughout the manifest and public UI: PDF previews render inline on template detail pages but are never emitted as Open Graph or sitemap images. - Updates the homepage hero to `TeXise — Privacy First Research` / `Writing Platform` and changes capability labels to exactly `Research`, `Code`, and `Document`. - Adds the new responsive `Built for Real Workflows` section immediately after Built Awesome with four TeXise-native placeholder stories and local placeholder artwork ready for final user-supplied copy/images. - Rotates installer, deployment/source guard, collaboration diagnostics and service-worker cache identity to BF46 while preserving BF45 Apache routing and BF44 trusted-runtime template isolation. - Adds dedicated BF46 preview/homepage regression coverage and extends the historical compatibility guards without rewriting prior release evidence. # R14.28.20 Build Fix 42 — Hotfix10 Production Typecheck Correction — 2026-08-23 - Fixes the five strict production `tsgo` errors exposed when BF41 was installed with the pinned dependency graph. - Uses runtime-safe Web Share feature detection instead of a truthiness check on the DOM-typed `navigator.share` function. - Narrows optional BibTeX RegExp captures into a guaranteed `string[]` before `Map` and `RegExp` use under `noUncheckedIndexedAccess`. - Updates the typed project-template test fixtures with required Hotfix10 metadata arrays and the protected `/api/templates/...` source-delivery contract. - Rotates the app-shell cache, installer/source guard and release diagnostics to BF42 while preserving the complete BF41/Hotfix10 template, SEO and Learn platform. - Dependency-free certification: BF42 current regression **20/20**, Hotfix10 focused **40/40**, historical R14.28.14–R14.28.19 **PASS**, runtime **101/101**, native server **98/98**, SaaS **44/44**, release audit **357/357**, branding/lock/workspace/barrel checks **PASS**. - The exact production pnpm/tsgo/Biome/Vite pipeline must be rerun by the deployment environment; this source packaging environment has no installed workspace dependencies. # R14.28.20 Build Fix 41 — Hotfix10 Template Platform, SEO Migration & Interactive Learning — 2026-08-23 - Preserves the filesystem-first template architecture under `texise-templates/free/` and `texise-templates/pro/` while adding a complete Admin template CMS: safe single/bulk ZIP import, rich metadata editing, institution management, Free/Pro moves, structural validation and first-class Assets Sync. - Adds academic-institution, country, degree, provenance and technical template taxonomy, stable `/templates/{slug}` canonicals, institution collection pages and explicit `/latex-templates/*` permanent migration handling without inventing missing legacy source. - Protects raw template source trees from direct HTTP access. Public metadata and preview assets remain crawlable; project files are delivered through the template API and Pro source requires server-side entitlement. - Fixes faceted `/templates` and `/blog` indexing so `noindex,follow` survives React hydration, and corrects robots/noindex policy for public application shells. - Sets the homepage H1/title to `TeXise — Local-First Overleaf Alternative LaTeX Research Editor with CLI`, removes the stale multi-competitor homepage matrix and strengthens research-workflow positioning. - Adds `Copy` / `Try in Editor` interactive Learn examples using one-time browser-local handoffs with multi-file support and no LaTeX source in URLs, plus deeper LaTeX/research guides, dedicated research use-case pages and four browser-local utility tools. - Enriches truthful template `CreativeWork` structured data, blog/article semantics, organization/social identity and page-specific OG behavior while keeping the supplied 1200×630 TeXise image as the generic fallback. - Continues the TeXise branding cleanup with TeXise Editor/TeXise Terminal product naming while retaining only genuine dependency, compiler, migration, legal/provenance and social-handle references. - Adds BF41/Hotfix10 source and platform regression guards plus dedicated SEO, migration, template-admin, branding and certification documentation. - Dependency-free working-tree certification before packaging: focused Hotfix10 suite **40/40**, current R14.28.20 **19/19**, historical R14.28.14 **22/22**, runtime hardening **101/101**, native server **98/98**, SaaS audit **44/44**, release audit **357/357**, branding/lock/workspace/barrel checks **PASS**. - The supplied source currently contains eight template packages. Historical indexed template sources that are absent from the archive are not fabricated; recover/import them before retiring their production URLs. # R14.28.20 Build Fix 40 — Hotfix9 SEO & TeXise Core Branding — 2026-08-23 - Adds server-rendered, route-specific SEO to the initial HTML response with canonical URLs, robots policy, Open Graph, Twitter cards, RSS discovery and interconnected JSON-LD for Organization, WebSite, WebPage, WebApplication/SoftwareApplication, BlogPosting, TechArticle, CreativeWork and BreadcrumbList. - Uses the TeXise 1200×630 social image for generic public pages and the actual CMS blog cover image for article Open Graph/Twitter metadata, preserving real media dimensions when known. - Adds image-aware sitemap output, `/blog/rss.xml`, real HTTP 404s for unknown public routes, noindex handling for private/faceted URLs, and native/X/LinkedIn/Facebook/Copy Link article sharing. - Strengthens homepage/PWA positioning around an online LaTeX editor for scientific research writing and removes non-critical marketing-shell font preloads. - Migrates TeXise-owned workspace/package/config/protocol/editor identifiers away from inherited project branding, including `@learnitive/*`, `@learnitive/prosemirror-editor`, `texise://app/`, TeXise desktop/mobile identity and `texise-db`. - Preserves a non-destructive migration from the historical IndexedDB name so existing local projects are not lost. - Adds a fail-closed production branding/provenance audit. Only real third-party package names, required compiler package/download endpoints, the legacy database migration key and narrow source/legal attribution are allowed to retain upstream names. - Adds `docs/HOTFIX9_SEO_AUDIT.md` and `docs/HOTFIX9_BRANDING_PROVENANCE_AUDIT.md` plus BF40 SEO/branding regression coverage. - Carries forward the Built Awesome Hotfix8 card polish: 10.25rem minimum card height, 1rem card copy, `Terminal` and `Unlimited AI` capability labels. - Focused R14.28.20 regression is **19/19 PASS**; server SEO/index tests are **12/12 PASS**. # R14.28.20 Build Fix 39 — Built Awesome Card Simplification Hotfix 7 - Renames the homepage feature heading from `Built Different` to `Built Awesome`. - Removes the `texise-why-card-visual` mini-workspace strip from every feature card and drops the now-unused visual-rendering code. - Shortens the yellow cards from the previous tall showcase format to a compact feature-card layout while retaining the first-three-visible / Show more / Show less interaction. - Changes `.texise-why-card-pin` to `background: #f5f3ed`. - Rewrites the primary and expanded feature descriptions into shorter, more direct product copy. Expanded headers use natural labels without hyphens (`Source and Visual`, `Project Files`, `Terminal and TexLab`, `PDF and SyncTeX`, and so on). - Preserves Hotfix 6 and Hotfix 5 hero behavior: Source/Visual reveal, simulated Compile and Terminal, wider rounded PDF, editor-column Terminal, body-font `@TeXiser`, exact 4% yellow hero gradient, configured Pro CTA, and mobile toolbar scrolling. - Focused BF39 regression advances to **16/16 PASS**. # R14.28.20 Build Fix 39 — Feature Showcase Hotfix 6 - Adds a `Why TeXise? / Built Different` section directly below the homepage hero using large TeXise-yellow feature cards with white mini-workspace visuals. - Shows only `Privacy First`, `Local Compilation`, and `Live Collaboration` initially; an accessible Show more/Show less caret reveals or hides nine additional TeXise capability cards. - Keeps the section entirely TeXise-specific and dependency-light: no external reference images, no Prefix/Pixi/Thetapad branding, and no new runtime service initialization. - Preserves Hotfix 5 hero layout/CTA corrections and BF39.2 interactive Source/Visual, Compile and Terminal simulations. Focused BF39 regression advances to **16/16 PASS**. # R14.28.20 Build Fix 39 — Hero Layout / CTA Hotfix 5 - Widens the simulated desktop PDF page and gives it rounded corners while preserving the existing fake compile/refresh interaction. - Confines the simulated Terminal panel to the Source/Visual editor column, so opening Terminal no longer turns the project tree or PDF area into part of the terminal surface. - Reverts the floating `@TeXiser` X CTA from Moranga to the normal TeXise body font. - Changes `.texise-home-hero-v2` to the exact requested 4% yellow top gradient. - Adds `Open Workspace` (`/projects`) and an outlined `Buy Pro $29` CTA directly beneath the hero title. The Pro link is sourced from the public `shopUrl` backed by `TEXISE_SHOP`; while runtime config is still loading/unconfigured, the visual CTA stays disabled instead of linking to the wrong destination. - BF39 focused regression advances to **15/15 PASS** while TX7.2.3 and all BF38 analytics/cookie behavior remain unchanged. # R14.28.20 Build Fix 39 — Source Reveal Masking / Copy Hotfix 4 - Makes the clipped hero Source layer fully opaque so the underlying simulated Visual editor can never bleed through LaTeX text or empty source regions. - Renames the hero eyebrow to `Local-first Overleaf alternative - LaTeX editor.` - Renames the hero description opening to `A browser-first LaTeX workspace for scientific writing.` while preserving the existing compile/collaboration/privacy sentence. - Preserves the BF39.2 auto reveal, fake compile/PDF refresh, simulated Terminal, mobile toolbar scrolling, Moranga `@TeXiser`, and glow-free hero. # R14.28.20 Build Fix 39 — Simplified Homepage Hero — 2026-08-22 ## Source/Visual Reveal + Mobile Toolbar Hotfix 3 - Replaces the homepage mock's binary Source/Visual swap with a layered Source↔Visual comparison: Visual stays mounted underneath, Source is clipped above it, and a TeXise-yellow draggable divider starts around 64% Source and automatically oscillates between roughly 22% and 78%. - The comparison handle is a real keyboard-accessible ARIA slider (`ArrowLeft`/`ArrowRight`, `Home`, `End`), supports mouse/touch/pen Pointer Events, pauses autonomous motion while dragging/hovered/focused or while the simulated Terminal is open, and disables autonomous motion for `prefers-reduced-motion`. - Existing Source/Visual toolbar controls now drive the same reveal position; Compile still performs only the 900ms simulated PDF refresh and the highlighted Terminal still opens only the simulated scientific terminal. - Makes the real mobile `.texise-editor-toolbar` horizontally scrollable with native momentum scrolling, no wrapping and non-shrinking toolbar controls while leaving desktop layout unchanged. - Changes the floating `@TeXiser` X CTA to the TeXise Moranga display font while preserving `https://x.com/texiser` and BF38 analytics behavior. - Removes the `texise-home-hero-glow` decorative background entirely; the hero retains only its subtle grid, formulas and existing yellow accents. - BF39 focused regression advances to **14/14 PASS**; static release audit remains **356/356**, SaaS audit **44/44**, server native tests **76/76**, deployment/config/template native tests **16/16**, and historical BF38–BF33/runtime contracts remain green. ## Interactive Hero Refinement Hotfix 2 - Refines the BF39 first-screen typography using the requested Prefix-style scale: adds `Local-first Overleaf alternative - LaTeX editor.` above the hero, caps the desktop headline at `3.5rem`, and increases the headline-to-workspace breathing room. - Enlarges the TeXise workspace simulation to a taller ~520–560px desktop session with 29 realistic LaTeX source lines, an expanded manuscript/PDF preview and current TeXise Source/Visual/Navigator/TexLab/AI Review/Review/Tools vocabulary. - Makes the mock intentionally interactive without initializing real editor services: Source/Visual switch local React state, Compile runs a 900ms simulated loader then fades a refreshed PDF back in, and mobile Compile temporarily switches the narrow mock to the simulated PDF output. - Highlights the Terminal control with TeXise yellow and a one-time invitation glow; clicking it opens a simulated dark local Terminal showing scientific Python output. Clicking Terminal again or the close control dismisses it. - Keeps all other mock controls decorative and accessibility-hidden, uses real buttons only for actions that work, preserves the BF39 capability `role="group"` lint fix, and extends reduced-motion handling to compile/terminal animations. - The simulation remains network/compiler/runtime isolated: no CodeMirror, PDF.js, BusyTeX, MathLive, Yjs/WebSocket, ProjectService, real Terminal, TexLab or AI worker is started. - BF39 focused regression advances to **13/13 PASS**; release audit remains **356/356**, SaaS audit **44/44**, server native tests **76/76**, deployment/config **16/16**, and historical BF38–BF33/runtime contracts remain green. ## Accessibility Lint Hotfix 1 - Fixes the production Biome `lint/a11y/useAriaPropsSupportedByRole` failure in the BF39 capability row by assigning the labelled capability container the explicit `group` role that supports `aria-label`. - Preserves the exact hero copy, wireframe, responsive layout and visual styling; only accessibility semantics and regression/source-guard coverage change. - Adds a fail-closed BF39 regression/source contract for the valid `role="group"` + `aria-label="TeXise capabilities"` combination. Focused BF39 regression is now **10/10 PASS**. - Production installer evidence confirms custom validation and strict TypeScript gates pass before Biome reaches this single BF39 accessibility diagnostic. - Rebuilt the public homepage first screen around an original TeXise composition: the exact two-line `Your Research. Your Device. / Your Privacy.` headline, a detailed static TeXise editor wireframe as the central visual, one concise local-first description, and three circular-check capabilities (`Research`, `Run Codes`, `Document in TeX`). - The wireframe reflects current TeXise concepts (project files, Source/Visual/Navigator, Compile, PDF, Terminal, TexLab, AI and Review) while remaining lightweight presentation-only markup; it does not initialize CodeMirror, PDF.js, BusyTeX, MathLive, project services, AI workers or terminal runtimes. - Added full-first-screen sizing, subtle TeXise-yellow grid/formula ambience, responsive desktop/tablet/mobile wireframe reductions, dark-theme compatibility through existing tokens and reduced-motion handling. - Removed the previous homepage hero's extra badge/CTA/capability-card clutter while leaving all lower homepage sections and the existing header `Open` action intact. - Capitalized the floating X handle to `@TeXiser` while preserving `https://x.com/texiser` and BF38 analytics/cookie behavior. - Advanced the release to `1.28.20` / R14.28.20 Build Fix 39. Collaboration remains TX7.2.3 unchanged. # R14.28.19 Build Fix 38 — Favicon, Social, Cookie & Analytics — 2026-08-22 - Replaced production favicon/PWA artwork with the supplied TeXise favicon suite while preserving TeXise manifest identity. - Added Facebook/X footer links and a public floating `@texiser` X CTA. - Added persistent Accept/Decline optional-cookie notice linked to `/privacy`. - Added Statcounter on canonical production non-admin pages regardless of optional-cookie choice; admin pages are excluded. - Provisioned optional `TEXISE_GOOGLE_TAG_ID` through `/etc/texise/texise.env`; Google Tag loads only after Accept cookies. - Updated CSP, privacy disclosure, service-worker/release guards and R14.28.19 certification contracts. - TX7.2.3 collaboration remains unchanged. # R14.28.18 Build Fix 37 — TX7.2.3 — Relay Health Hotfix 2 — 2026-08-22 - Fixes the production `/collab-live` deployment health check after BF37's signed new-room admission: the synthetic health host now mints and supplies a short-lived signed room/review-bound host grant instead of being rejected as an unsigned new-room creator. - The deployment wrapper exports the preserved root-owned `/etc/texise/texise.env` only into the collaboration live-health subprocess so `SESSION_SECRET` is available to the local signer without appearing on the command line or weakening public relay admission. Guests in the health test remain unsigned, exactly like normal shared-link joiners. - Adds fail-closed BF37 source/regression coverage for signed production relay health certification. Focused BF37 regression is now **14/14 PASS**. - Production evidence before Hotfix 2: custom validation, strict `tsgo`, mobile typecheck, `tsgo --noEmit`, Biome lint, BusyTeX provisioning, Vite production build, SaaS preflight, trusted API, Cloud Compile, TexLab Console Gateway and collaboration signaling all passed; only the stale unsigned live-relay health host timed out. ## Typecheck Hotfix 1 retained - Fixes the 16 strict `tsgo` errors exposed by the production installer after BF37 custom validation passed: the signaling-server test-only `allowUnsignedCollaborationHosts` option is now part of the checked-JavaScript config contract, all collaboration host-grant parameters have strict JSDoc types, and `server/collaboration-host-grant.mjs` is explicitly included in the root `tsconfig.json` project. - Preserves BF37 runtime behavior and security semantics unchanged: Pro/Admin-only room creation still requires a short-lived signed room/review-bound grant, while guests may join an already-authorized collaboration room. - Adds fail-closed BF37 source/regression coverage for the strict-tsgo integration so the host-grant module cannot again be imported by `server/signaling.mjs` without being listed and typed. Focused BF37 regression reached **13/13 PASS** after Typecheck Hotfix 1; Relay Health Hotfix 2 advances the focused suite to **14/14 PASS**. - Production evidence before this hotfix: custom validation passed and strict typecheck reached BF37, then failed on the 16 diagnostics above. The production rerun subsequently confirmed dependency-backed `tsgo`, Biome and Vite production build pass before exposing the live-relay health-check mismatch fixed by Hotfix 2. # R14.28.17 Build Fix 36 — TX7.2.2 Collaboration UX — Accessibility Lint Hotfix 1 — 2026-08-22 - Removes unsupported `aria-expanded` from the native `` account-menu trigger. Native `
/` already exposes expanded/collapsed disclosure state to accessibility APIs, so no custom expanded state is required. - Preserves the BF36 shared account popover behavior: authenticated Projects/Settings/Logout, anonymous Login-only, outside-click close, Escape close/focus return, and controlled `
` state. - Adds a BF36 regression/source-guard contract that rejects `aria-expanded` on ``, preventing the production Biome `lint/a11y/useAriaPropsSupportedByRole` failure from recurring. - Production installer evidence confirms BF36 custom validation and dependency-backed TypeScript/mobile typecheck pass before Biome reaches this accessibility check. # R14.28.16 Build Fix 35 — TX7.2.1 Collaborative Review Hardening — Hotfix 2 — 2026-08-22 - Preserves the complete BF35/TX7.2.1 collaborative-review hardening release. - Includes Typecheck Hotfix 1: `resolveChangeRestoringOriginal()` captures validated `change.from` / `change.to` values into immutable numeric locals before entering the Yjs transaction callback, eliminating strict `tsgo` TS18048/TS2345 closure-narrowing failures without changing runtime semantics. - Fixes the production Biome accessibility gate reported after typecheck passed: Review status and item-type filter containers now use `role="group"` before their `aria-label`, so the accessible names are attached to an ARIA role that supports them. - Adds fail-closed BF35 regression/source-guard coverage for both installer-discovered failures so neither the closure-unsafe offsets nor the unsupported bare `aria-label` form can return. - Focused BF35 regression is now **16/16 PASS** in the source-only verification environment. Production installer evidence confirms custom validation and dependency-backed typecheck passed before Biome exposed the accessibility issue; the corrected Hotfix 2 still requires the production installer to rerun Biome/build/runtime gates. # R14.28.15 Build Fix 34 — TX7.2 Collaborative Review — 2026-08-22 - Restores **collaborative Comments and Track Changes in Source mode** without changing the TX7.1 manuscript authority: CodeMirror remains bound through `y-codemirror.next` to one `Y.Text`, and the same Y.Text continues to synchronize through `y-websocket`. - Adds project-level `review-comments`, `review-changes`, and `review-events` Yjs structures beside manuscript text. Review metadata is never written into `.tex` and never uses Y.Text formatting attributes. - Stores comment/change anchors as encoded Yjs relative positions. Comment replies use nested `Y.Array` state so concurrent replies merge instead of overwriting a whole thread. - Adds first-class collaborative `insert`, `delete`, and `replace` changes with `pending`, `accepted`, `rejected`, and `conflicted` states. Accept keeps the current working Y.Text; Reject safely reverses the pending edit only when the anchored content/context still matches. - Keeps the mature local Review backend unchanged outside collaboration: local Track Changes remains projection-based, while live Track Changes records metadata around the already-applied collaborative Y.Text edit. Pre-existing local review notes are not silently published into a live room. - Keeps Track Changes as a per-collaborator preference and preserves the TX7 y-codemirror binding while Track Changes is enabled. Remote edits and review-maintenance/undo transactions cannot recursively create local suggestions. - Adds meaningful change coalescing, including selected-text replacement typing and contiguous deletions, aligned with the per-file Yjs UndoManager capture window. Undo removes the associated pending metadata and Redo restores it. - Adds bounded deletion-side context checks and explicit conflict actions (`Keep current text`, `Restore original text`, `Dismiss change`) instead of guessing when newer edits make a rejection ambiguous. - Routes AI, Paper Memory, citation, TikZ, Terminal, research and toolbar/programmatic manuscript mutations through collaboration-aware review attribution, with explicit non-tracking origins for rollback/maintenance mutations. - Removes the persistent “Visual editing is unavailable during live collaboration.” sentence from the editor surface. Visual remains disabled during a live session with the compact tooltip `Unavailable during live collaboration`. - Polishes the empty `/projects` page using Projects-specific spacing/min-height classes without changing shared SaaS empty-state layout, and retains TX7 link-driven automatic joining. - Adds BF34 source/regression guards, CRDT unit-test source, two-browser collaborative-comment and supervisor Track Changes Playwright contracts, and makes formal release-quality execution run the BF34 guard/regression before dependency-backed certification. - Fixes two stale certification contracts discovered during BF34 verification: the collaboration soak now uses the real `{ from, to, text }` edit API, and production dist release parsing accepts the current release family instead of hard-coding R14.28.14. The legacy migration regression also now includes the existing BF33 login-throttle migration. - Dependency-free verification in this extracted source tree: BF34 guard PASS and rejects pristine BF33; BF34 regression **14/14 PASS**; historical R14.28.14 regression **22/22 PASS**; runtime hardening **101/101 PASS**; release audit **351/351 PASS**; SaaS/product/security audit **43/43 PASS**; server tests **70/70 PASS**; deployment/script tests **18/18 PASS**; template/compiler requirements **13/13 PASS**; lock sync **69 importers / 1171 reachable snapshots PASS**; dependency consistency **68 packages PASS**; public barrels **67 entries PASS**; all **20** modified TS/TSX files parse/transpile; modified Node and shell syntax PASS. Full dependency-backed `tsgo`, Biome, Vitest, Vite/build, Playwright, the formal review soak and deployed relay certification remain mandatory external gates because this archive has no installed workspace dependencies and registry access is unavailable. # R14.28.14 Build Fix 33 — TX7.1 Production Security & Collaboration Lifecycle Hardening — 2026-08-22 - **BF33 live collaboration health-check hotfix:** updated `scripts/check-collaboration-live.mjs` to use the same active Yjs client IDs for the hardened file channel, request a specific source peer, and send/verify a valid TXB1 binary chunk. The previous health probe still used BF32 broadcast/raw-byte semantics and therefore timed out against the correctly hardened BF33 relay. - **Dependency-backed Biome lint follow-up:** after `tsgo` and the mobile-entry typecheck passed on the production installer, Biome reported one style-only error in the TX7 collaboration E2E spec: an interpolation-free route regular expression used a template literal. It now uses a plain string literal (`new RegExp('/join/[0-9a-f-]+$', 'iu')`), preserving identical test semantics while satisfying `lint/style/noUnusedTemplateLiteral`. - **Dependency-backed Paper Memory typecheck follow-up:** the first BF33 typecheck hotfix reduced production `tsgo` failures from 33 to four, all caused by plain `string` anchor/bibliography paths being passed to the nominal `ProjectFilePath` canonical-source helper. Each affected path is now validated with `projectFilePath(...)` before canonical Source access; the helper remains strongly typed rather than being weakened to accept arbitrary strings. The BF33 source guard now requires these conversions. - **Dependency-backed typecheck hotfix:** fixes all 33 strict `tsgo` errors exposed once the repaired frozen lock allowed the production installer to reach the real build gate. The patch removes the duplicate TikZ `parsed` declaration, supplies React 19 `useRef` initialization, declares `projectCollaboration` on all six file-structure commands that use it, restores the AI snippet `wsPath`, imports Paper Memory `ProjectFilePath`, removes stale Review commit state, passes an ArrayBuffer-backed Yjs state vector to WebCrypto, and adds complete check-JS/JSDoc typing for the hardened signaling relay. The supported `ws >=8.21.0` `maxFragments` option remains enforced through a local type augmentation because `@types/ws 8.18.1` has not yet declared it. - The BF33 source guard now certifies these dependency-backed typecheck repair invariants in addition to the existing BF32/TX7, lockfile-closure, security and collaboration-lifecycle contracts. - Removes the universal `admin/admin` bootstrap credential. Fresh installations do not create an administrator automatically; operators provision or reset `admin@texise.com` explicitly with `sudo texise-saas admin-create`, with the password read from an interactive PTY with terminal echo explicitly disabled rather than from argv or environment files. - Hardens upgrades from BF32 and earlier by detecting the exact historical `admin/admin` credential, revoking it, invalidating its sessions, and requiring explicit administrator reprovisioning. Existing administrators that already use a secure password are left unchanged. - Adds persistent database-backed administrator login throttling by IP and normalized account, periodic expired-session/throttle cleanup, and migration `bf33_admin_login_throttle` so protection survives application restarts and multi-worker deployment. - Advances direct WebSocket dependencies to `ws 8.21.3` across the root server/Console Gateway and Nodemailer to `9.0.5`, with frozen-lock and release-floor checks updated accordingly. - Repairs a duplicated-key corruption in `pnpm-lock.yaml` that could pass the old importer-only preflight but fail pnpm YAML parsing during installation. The lock preflight now rejects duplicate direct mapping keys before dependency installation, and the BF33 source guard executes that lock validator itself. - Completes the frozen lock dependency closure for the BF32 QR addition by adding the missing `@types/qrcode@1.5.6` resolution/snapshot (with `@types/node 26.2.0`) and extends the preflight to traverse every non-workspace importer plus all reachable snapshot dependencies. A missing package or snapshot now fails before pnpm installation rather than surfacing as `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY`. - Hardens `/collab-live` admission with bounded active rooms, total/per-IP sockets, per-IP new-room creation, Y.Doc state size, per-peer/per-room transfer concurrency, per-file size and per-minute transfer bandwidth limits. - Makes the binary payload channel dependent on an already-active Yjs client identity. File sockets can no longer create rooms, duplicate diagnostic client IDs are rejected, payload requests route to one source peer, chunks route only to their requester, fallback source routing removes stale preferred IDs, and abandoned requests expire instead of permanently consuming quotas. - Coalesces expensive full-Y.Doc size checks to a bounded 500 ms interval and evicts an oversized room rather than retaining a memory-heavy CRDT after disconnecting clients. - Makes Host refresh/reconnect first-class: the local reconnect descriptor persists Host/Guest role plus Host session identity, and reopening the editor reclaims the same Host identity instead of silently reconnecting as a Guest. - Replaces the fixed 50 ms Stop Collaboration delay with an explicit provider outbound-drain wait before disconnect. Explicit Stop/Leave forgets the reconnect secret and clears that collaboration persistence; an ordinary refresh preserves it for recovery. - Seals the shared project structure at Host readiness with a snapshot manifest. After sealing, project name/root/manifest and initial file/directory/binary creation cannot be changed through the normal TX7.1 collaboration API; existing supported `Y.Text` files remain the only mutable collaborative manuscript state. - Protects locally divergent same-room work before rematerialisation. Extra files/directories and same-path files changed since the last collaboration snapshot are copied into `.texise-local-recovery//...` before the authoritative shared snapshot is applied; per-room snapshot baselines and stale collaboration IndexedDB state are garbage-collected. - Removes legacy-v1 collaboration migration from every session constructor and bounds retained TX7 collaboration persistence to recent sessions instead of allowing old room databases to grow without lifecycle management. - Adds a single collaboration-aware canonical Source accessor. Source editor actions, AI proposals/context, citation workflows, TikZ insertion and Paper Memory now read active `Y.Text` during collaboration rather than relying on the animation-frame-delayed `LatexSourceService` persistence mirror. - Debounces project semantic refresh after collaborative edits while preserving explicit mirror flush before compile/leave, reducing whole-project re-index churn during concurrent typing. - Tightens the production CSP from arbitrary `wss:` destinations to the canonical TeXise WebSocket origin while retaining required HTTPS provider connectivity. - Documents the TX7/TX7.1 bearer-link trust model explicitly: anyone with a live collaboration Project link is treated as a trusted editor; the Host marker coordinates lifecycle and is not a cryptographic authorization boundary. - Adds BF33 source/release contracts for admin provisioning/revocation, persistent throttling, relay admission/targeted transfer, duplicate-client rejection, Host refresh, Stop drain, sealed structure, persistence GC, canonical-source reads, local divergence recovery, CSP and dependency security floors. Browser contracts additionally cover Host refresh/reclaim and same-path `.texise-local-recovery` recovery while preserving the exact named-cursor and formal 10,000-edit soak scenarios. - Dependency-free BF33 verification performed in the extracted source environment: BF33 guard PASS including the complete BF32/TX7 guard; duplicate-key plus reachable dependency-closure lockfile preflight PASS (1171 reachable snapshots) plus strict recursive YAML unique-key parse PASS; both the original duplicate-key lock and a missing-`@types/qrcode` closure fixture are rejected; 69 lock importers PASS; 68 workspace dependency sets PASS; 67 public barrels PASS; administrator tests 11/11 PASS; focused R14 regression 22/22 PASS; runtime hardening 101/101 PASS; release audit 350/350 PASS; SaaS static audit 43/43 PASS. Dependency-backed type/lint/unit/build/Playwright execution, the actual formal 10,000-edit browser soak, and deployed `/collab-live` certification remain external release gates because this source archive does not contain the installed workspace/browser runtime. # R14.28.14 Build Fix 32 — TX7 TeXlyre Source Collaboration Core — 2026-08-22 - Advances live collaboration to internal protocol **TX7** and deliberately narrows collaborative manuscript editing to **Source mode only**. Starting or joining collaboration forces Source mode, disables Visual editing, keeps PDF/local compilation available, and restores Visual editing only after the live session ends. - Retains the already-proven upstream Yjs primitives from BF31—`y-websocket`, `y-indexeddb`, `Y.Doc`, per-file `Y.UndoManager` and `y-codemirror.next`—but removes the competing TeXise Source cursor/selection, authorship, Follow/Open, review-CRDT and Visual collaboration machinery from the live editing path. - Adds a TeXlyre-0.10.16-derived CodeMirror binding: `CodeMirror ↔ y-codemirror.next ↔ Y.Text`. Remote selections, carets, names and colors are rendered by Yjs Awareness/y-codemirror rather than a second TeXise cursor coordinate system. - Makes collaborative `Y.Text` authoritative. Y.Text changes project one-way into `LatexSourceService` and browser project storage; normal live Source typing no longer subscribes to LatexSource mutations and writes them back into Y.Text. - Routes Source toolbar, Math/source transformations, AI edits, Paper Memory citation insertion, citation metadata insertion, TikZ text insertion and generated-manuscript insertion through the TX7 Yjs mutation gateway whenever the target is an existing collaborative Source file. - Pins the collaboration stabilization set exactly: `y-codemirror.next 0.3.5`, `y-indexeddb 9.0.12`, `y-protocols 1.0.7`, `y-websocket 3.0.0`, `yjs 13.6.30`; adds `qrcode 1.5.4` / `@types/qrcode 1.5.6` without upgrading CodeMirror core. - Replaces manual TX tokens with a **Project link** and QR code: `/join/#<256-bit-secret>`. The raw fragment secret is captured in-browser and scrubbed from the visible address bar before automatic join continues. - Preserves verified-host-before-workspace creation and same-room browser-workspace reuse. Reopening the same collaboration link reuses the local joined project instead of creating duplicates; the raw secret remains local and is never placed in SaaS cloud project metadata. - Adds stable collaborator browser identity keys for ID, display name and preferred color. Logged-in users use their account identity; first-time anonymous collaborators are asked only for a name after host/project metadata is available. - Freezes project structure for the BF32 live session. Existing `.tex`, `.ltx`, `.bib`, `.bst`, `.cls`, `.sty` and `.txt` files are collaboratively editable; file/directory create/rename/delete, binary imports, generated project artifacts and disruptive Git/tree mutations are blocked until collaboration ends. Binary and other project assets remain join-time snapshot data. - Separates Review/Track Changes from live collaboration. Track Changes is unavailable during the session; comments/review activity remain local and no review/authorship metadata is added to `.tex` or the TX7 collaboration Y.Doc. - Adds an explicit host session tombstone (`sessionStatus=stopped`) before disconnect so Stop Collaboration ends the live session for guests while preserving each guest's browser-local project. - Replaces the BF31 fail-closed source gate with `repair-buildfix32-source.mjs`, which positively verifies TX7 direct Source collaboration and fails if obsolete TX6 relative-cursor, authorship, review, Follow/Open or live file-operation machinery returns to the live path. - Adds TeXlyre 0.10.16 AGPL-3.0-or-later attribution and adapted-source notice in `THIRD_PARTY_NOTICES.md` and the collaboration binding source header. - Local BF32 verification performed in the extracted source environment: BF32 source guard PASS; 69-importer lock sync PASS; 68-package workspace dependency consistency PASS; 67 public barrels PASS; focused regression 22/22 PASS; runtime hardening 101/101 PASS; release audit 350/350 PASS; SaaS static audit 43/43 PASS; all 29 modified/untracked TS/TSX syntax checks plus Node/shell/package JSON syntax and `git diff --check` PASS. The Playwright contract includes compile under live collaboration and an actual 10,000-edit release-quality soak, but dependency-backed `tsgo`/Biome/Vitest/Playwright and production `/collab-live` execution still require an installed build/browser environment and remain release gates. # R14.28.14 Build Fix 31 — TX6 Collaboration V2 cursor stability and Visual transaction sync — 2026-08-21 - Advances live collaboration to `TX6:#` so clients using the new cursor/selection semantics cannot silently mix with TX5 absolute-position clients. - Replaces application-level absolute collaborator cursor/selection offsets with encoded Yjs `RelativePosition` anchors. Each receiver resolves those anchors against its own converged `Y.Doc`, so insertions/deletions/newlines before a collaborator no longer leave their caret over stale pre-existing text. - Keeps Source mode directly bound through `y-codemirror.next`, removes the duplicate Source authorship extension, and routes collaborative undo/redo through the per-file `Y.UndoManager` rather than single-user canonical history. - Extends canonical source mutation events with exact source splices and applies those edits directly to `Y.Text` in one transaction. Normal Source/Visual/MathLive edits no longer fall through the broad common-prefix/common-suffix replacement path that discarded unrelated CRDT item identity. - Reworks native Visual editing to emit the smallest LaTeX source splice for each ProseMirror transaction instead of replacing the complete manuscript source. - Adds a Visual collaboration bridge that captures the local Visual selection as Yjs relative positions before remote transactions, resolves it afterward, and reconciles the existing ProseMirror `EditorState` rather than recreating editor state. Remote projection uses the smallest valid ProseMirror replacement and preserves focus/scroll/selection. - Coalesces rapid remote Visual projection work to at most one animation-frame reparse while Y.Text and canonical source remain synchronous, reducing projection churn without sacrificing CRDT correctness. - Prevents ordinary concurrent Visual edits from failing solely because the global canonical revision advanced: exact local edits are rebased over a non-overlapping remote source delta and authoritative reconciliation is used only for a true overlap. - Prevents Track Changes from silently switching Source out of its live CRDT binding. Track Changes is unavailable during an active collaboration, and hosting requires pending tracked changes to be accepted/rejected first. - Rebuilds the collaboration dialog as a bounded responsive surface: long collaborator names and nested file paths truncate safely, Open/Follow actions do not shrink off-screen, the collaborator list scrolls vertically, and horizontal overflow is suppressed down to narrow mobile widths. - Adds semantic two-browser regression scenarios for the reported failure: a remote user inserts lines before another user's caret and that user must remain attached to `TARGET-LINE` in Source and `Second paragraph marker.` in Visual before typing. - Prevents Source collaboration state churn from remounting CodeMirror by removing file/document collaboration revision counters from the editor lifecycle; Yjs updates now stay inside the long-lived `y-codemirror.next` view. - Hardens Visual remote batching so a Yjs transaction touching another file cannot leave behind a stale caret bookmark that is later restored into the active file. - Routes Visual Ctrl/Cmd+Z, redo and toolbar history through the same per-file Yjs `UndoManager` used by Source. Visual history now preserves peer edits instead of restoring a single-user whole-source snapshot; two-browser E2E coverage asserts a peer edit survives the other user's Visual undo. - Corrects the production collaboration live-health probe to advertise and validate TX6 metadata consistently instead of retaining stale TX5 checks. - Adds BF31 fail-closed source/install/deploy guards, TX6 relay-health markers, TX6 compatibility tests, Collaboration V2 release contracts, and advances the PWA shell to `texise-app-shell-r14-28-14-buildfix31-v1`. - Local archive verification: source guard PASS; static release audit 350/350 PASS; focused R14.28.14 regression 22/22 PASS; runtime-hardening 101/101 PASS; TypeScript parser checks PASS for all touched TS/TSX files; 69 lockfile importers, 68 workspace dependency sets and 67 public barrels PASS; shell/Node syntax checks PASS. Dependency-backed Vitest/tsgo/Biome/Playwright execution still requires an installed dependency tree and remains a mandatory CI/installer gate. # R14.28.14 Build Fix 30 — accessible shared-project loader progress — 2026-08-21 - Fixes the production Biome `lint/a11y/useAriaPropsSupportedByRole` failure in the full-project Join loader. - Converts `.texise-project-join-progress` from a generic `div` carrying an unsupported `aria-label` into a semantic `role="progressbar"` with an accessible name plus `aria-valuemin=0`, `aria-valuemax=100`, and dynamic `aria-valuenow`. - Adds BF30 guard/regression/release coverage for the exact ARIA contract so the unsupported bare-label form cannot return. - Preserves BF29/BF28 TX5 full-project collaboration, binary transfer, immediate file/directory operations, Source collaborator labels, admin-Pro access and TikZ fixes unchanged. - Advances the PWA shell to `texise-app-shell-r14-28-14-buildfix30-v1`. # R14.28.14 Build Fix 29 — directory collaboration command dependency typing — 2026-08-21 - Fixes the production native-preview TypeScript failures in `ws-command-handlers.ts` where Create/Rename/Delete Directory handlers consumed `projectCollaboration` but the corresponding command dependency manifests did not expose that service. - Adds `projectCollaboration` to all three directory command service dependency declarations in `packages/shared/commands/src/ws-commands.ts`, preserving BF28 immediate collaborative directory propagation without unsafe casts or `any`. - Adds BF29 source-guard and focused regression coverage for the exact command dependency contracts so a partial/stale overlay is rejected before `tsgo`. - Preserves TX5 full-project collaboration, binary transfer, join loader, Source cursor names, admin-Pro access and TikZ fixes unchanged. - Advances the PWA shell to `texise-app-shell-r14-28-14-buildfix29-v1`. # R14.28.14 Build Fix 28 — TX5 full-project collaboration — 2026-08-21 - Advances collaboration to `TX5:#` and keeps the upstream `y-websocket` + `y-indexeddb` architecture. - Joining now blocks on a full-page **Loading shared project** experience until the complete authoritative project tree is materialized locally. - Extends live text CRDT synchronization beyond LaTeX to first-class code/data text files, with strict UTF-8/no-NUL classification so ambiguous binary data is never decoded destructively. - Adds a CRDT file-tree catalog and explicit create/delete/rename/mkdir/rmdir/rename-directory operation log so project structure changes propagate bidirectionally after joining. - Adds a transient room-scoped `/collab-live/?channel=files` payload channel for images, PDFs, archives and other opaque files. Payloads are chunked at 256 KiB, backpressured, SHA-256 verified, and never retained by the relay. - Host readiness is published only after its payload socket/request handler is live; Guest full-project materialization retries if the shared tree changes during loading. - File/directory mutations from the sidebar, terminal, Project Tools, AI file actions and image import feed the collaboration catalog rather than remaining local-only. - Adds production relay health certification for the transient binary channel and browser E2E coverage for full-project joining, loader behavior, code/data/binary files, live file operations and post-join image transfer. - Advances the PWA shell to `texise-app-shell-r14-28-14-buildfix28-v1` and adds a fail-closed BF28 source guard that validates the explicit installer/deployment source root, preventing a stale overlay from passing by validating the guard script's own directory. # R14.28.14 Build Fix 27 — TX4 Projects-page join workflow + Source cursor names — 2026-08-21 - Makes remote collaborator names permanently visible above their Source-mode CodeMirror carets by theming the existing `y-codemirror.next` awareness cursor label; Visual-mode collaborator labels remain unchanged. - Introduces self-contained `TX4:#` collaboration tokens and removes the separate room-password dependency from the normal collaboration workflow. Older TX tokens are rejected explicitly rather than being mapped into a different room. - Moves joining to `/projects`: **Join Project** appears immediately before **New Project** and opens a standard one-field TeXise modal with Collaboration token, Cancel and Join actions. - Adds a verified `joinNewProject()` transaction: TeXise synchronizes with the relay, verifies a live compatible Host and `projectReady`, then (and only then) creates or reuses a browser-local project. Invalid/expired/legacy tokens leave no orphan workspace. - Hosts advertise `projectName`, `projectReady` and readiness timestamp through CRDT metadata. Joined projects use the Host project name with local collision suffixing and fall back to a readable room fingerprint name. - Joined projects prefer BrowserOPFS, retain only non-secret room/protocol metadata for rejoin discovery, never persist the collaboration token/secret into project/account metadata, and reuse the same local project when joining the same room again. - Successful joins navigate through TeXise's in-app navigation service so the verified upstream `WebsocketProvider` remains alive. Optional account project-name metadata registration runs after navigation and cannot delay/break collaboration. - Simplifies the editor Collaboration dialog to Start/Share/Manage; joining and the old room-password/join form are removed from the editor. - Strengthens collaboration certification with TX4 legacy-token rejection, verify-before-create ordering, Host-name project creation, Source cursor-name visibility, ready-host production health metadata, and Projects-page browser E2E coverage. - Advances the PWA application shell to `texise-app-shell-r14-28-14-buildfix27-v1` and adds a fail-closed BF27 source guard. # R14.28.14 Build Fix 26 — strict y-indexeddb migration marker typing — 2026-08-21 - Fixes the production `tsgo` failure in collaboration persistence where `IndexeddbPersistence.set()` was passed boolean `true`, while the library API accepts only `string | number | ArrayBuffer | Date`. - Keeps `LEGACY_MIGRATION_KEY` as an internal browser-only one-time marker for importing the pre-BF25 TeXise collaboration snapshot into `y-indexeddb`; it is not a licence key, collaboration secret, password, or server credential. - Replaces the boolean marker with `LEGACY_MIGRATION_VERSION = 1` and checks the stored numeric version before importing. This makes the migration strict-TypeScript safe and versionable for future schema changes. - Adds a BF26 fail-closed installer source guard that requires the numeric migration marker and rejects the BF25 boolean source form before typecheck. - Advances the PWA application shell to `texise-app-shell-r14-28-14-buildfix26-v1` while preserving the BF25 upstream `y-websocket`, host-verification, `y-indexeddb`, authorship, admin-Pro, and TikZ fixes. # R14.28.14 Build Fix 25 — upstream y-websocket collaboration + verified host join — 2026-08-21 - Replaces BF17-BF24's handwritten browser WebSocket/Yjs transport with the upstream `y-websocket` `WebsocketProvider` architecture used by Texlyre. TeXise retains same-origin room derivation and lifecycle/status projection, while upstream code owns Sync Step 1/2, incremental updates, awareness and reconnect behavior. - Introduces versioned `TX3:#` collaboration codes and a v3 SHA-256 room derivation contract. Legacy collaboration codes are rejected explicitly instead of being silently interpreted under a different protocol generation. - Prevents false-success joins: a guest may not activate after relay sync alone. It must observe a matching CRDT host marker plus a live host awareness identity; a wrong/missing password therefore produces a clear host-not-found error instead of both users sitting alone in separate rooms marked `live`. - Replaces the manual whole-Y.Doc IndexedDB snapshot store with `y-indexeddb` `IndexeddbPersistence`, while migrating the previous `texise-collaboration-v1` snapshot once where available. - Keeps `Y.Text` as the active-room manuscript authority and preserves Source/Visual synchronization, CRDT-relative collaborator authorship, Follow, review cleanup, TikZ contrast and administrator Pro access from BF21-BF24. - Extends `/collab-live` to the standard `y-websocket` room URL form `/collab-live/` while retaining the bounded in-memory TeXise relay, same-origin checks, participant/frame limits, heartbeat and room expiry. - Rewrites the production collaboration health check to instantiate the same real `WebsocketProvider` used by the browser with BroadcastChannel disabled, certifying host verification, bidirectional incremental edits, awareness and late-join state-vector convergence through the relay. - Adds safe **Copy diagnostics** output containing only release/protocol, truncated room/state-vector fingerprints, Yjs client ID, connection/sync state, host-marker state and peer count. It excludes the share secret, password, manuscript text and full room key. - Makes solo status role-aware: hosts see `Session ready — share the code`; guests whose host disappears see `Host disconnected — waiting to reconnect`. - Browser E2E now follows `/collab-live/`, requires `TX3`, verifies mutual Host/Guest visibility, rejects a wrong password before allowing the correct password, and retains incremental Source↔Source, Source→Visual, authorship, Follow, reconnect and persistence coverage. - Adds `y-websocket 3.0.0` and `y-indexeddb 9.0.12` to the frozen workspace dependency graph, advances the PWA cache to `texise-app-shell-r14-28-14-buildfix25-v1`, and adds a BF25 installer source guard that fails closed on partial/stale overlays. # R14.28.14 Build Fix 24 — strict Yjs awareness-origin narrowing — 2026-08-21 - Fixes the two remaining native-preview TypeScript errors reported by the production installer after BF23: the Yjs awareness callback deliberately accepts `origin` as `unknown`, but was still passing that value directly to `Map>.has/get`. - Narrows the callback origin by identity against the room's actual WebSocket keys before accessing controlled awareness IDs. This preserves the `unknown` trust boundary, avoids `any`/unsafe casts, and does not change Yjs or awareness wire semantics. - Replaces the BF23 source guard with a BF24 guard that remains idempotent for stale BF21 WebSocket payload/callback shapes and additionally repairs the exact BF23 `created.clients.has/get(origin)` source shape before strict TypeScript runs. - Installer and deployment build stages both run the BF24 guard, and the install banner identifies Build Fix 24 explicitly. - Advances the PWA application-shell cache to `texise-app-shell-r14-28-14-buildfix24-v1`. # R14.28.14 Build Fix 23 — stale-overlay collaboration source guard — 2026-08-21 - Hardens upgrades after a server reproduced BF21's seven TypeScript errors while claiming to install BF22: the distributed BF22 archive was verified to contain the corrected source, proving the server source tree remained stale during extraction/overlay. - Adds `scripts/repair-buildfix23-source.mjs`, an idempotent pre-build guard that repairs the two known BF21 collaboration source shapes (`socket.send(payload)` and untyped Yjs relay callbacks) and then fails closed unless the corrected TS7-compatible forms are present. - Runs the BF23 guard immediately after source-location validation and again immediately before the normal Build Fix 11/typecheck path, so a stale overlay cannot silently enter dependency installation/build as a newer release. - Changes the installer banner to explicitly print `R14.28.14 Build Fix 23`, making it immediately visible which source tree is executing. - Advances the PWA application-shell cache to `texise-app-shell-r14-28-14-buildfix23-v1` and adds BF23 regression/release contracts for the source guard. # R14.28.14 Build Fix 22 — strict TypeScript 7 collaboration build correction — 2026-08-21 - Fixes the production native-preview TypeScript build failure in the BF21 browser collaboration provider by copying each outbound Yjs protocol frame into an explicitly `ArrayBuffer`-backed `Uint8Array` and sending its `.buffer`, avoiding the TS 7 `Uint8Array` / DOM `BufferSource` incompatibility without changing the wire protocol. - Adds explicit JSDoc types to the Yjs document-update and awareness-update callbacks in `server/signaling.mjs`, satisfying strict `checkJs`/native-preview inference while preserving the BF21 standard Yjs state-vector relay behavior. - Advances the PWA application-shell cache to `texise-app-shell-r14-28-14-buildfix22-v1` so browsers cannot retain the install-blocked BF21 collaboration bundle. - Adds focused BF22 regression and release-audit contracts for both exact production compiler failures. # R14.28.14 Build Fix 21 — collaboration convergence, admin Pro test access and TikZ contrast — 2026-08-21 - Replaces BF17's custom `/collab-live` snapshot/update protocol with the standard Yjs state-vector sync protocol (Sync Step 1/2 plus incremental updates and awareness), keeping the TeXise same-origin relay while removing the stale-client full-snapshot replacement race. - Makes each room's `Y.Text` the manuscript authority while collaboration is active. Source binds directly through `y-codemirror.next`; Visual/AI/structured mutations flow into Yjs once; collaboration-originated projections and durable filesystem mirrors are guarded from echoing stale source back into the CRDT. - Reworks collaborator-authored highlighting into Yjs relative-position provenance stored outside `.tex`, migrates legacy BF16/BF17 `texiseAuthor` formatting, and keeps Source/Visual hover attribution plus review-completion cleanup without modifying manuscript characters. - Strengthens collaboration certification with incremental Host↔Guest editing, Source→Visual propagation, awareness, reconnect and late-join convergence contracts. - Fixes TikZ Draw's dark property-dialog headings by explicitly using a light foreground only inside the dark `.properties-modal` surface. - Gives active `admin` role accounts effective Pro access across the shared entitlement service, all client Pro capability gates, Pro templates, Cloud Compile, Linux Terminal, cloud AI and AI Review. The bootstrap `admin@texise.com` account therefore needs no Payhip licence for testing. - Adds auditable administrator AI Review reservations that do not consume a paid licence quota, re-check administrator role before generation, and allow `license_id = NULL` through an idempotent compatibility migration instead of fabricating a licence. - Advances the PWA application-shell cache to `texise-app-shell-r14-28-14-buildfix21-v1`. # R14.28.14 Build Fix 20 — wide TikZ workspace and TeXise tool palette — 2026-08-21 - Fixes the production TikZ Draw modal remaining narrow on desktop because the shared `DialogContent` default `sm:max-w-sm` responsive rule overrode BF17's unprefixed large-width utility. - TikZ now explicitly overrides the responsive breakpoint with `sm:max-w-[1680px]` and adds an inline `width: 97vw; max-width: 1680px; height: 92dvh` safeguard, so generic dialog utility ordering cannot collapse the drawing workspace again. - Restyles TikZ Draw's black tool tiles into TeXise controls: inactive tools/buttons are white with black icons, the active tool and primary action use TeXise yellow (`#DA0B4E`) with black icons/text, hover uses a pale yellow surface, and the Objects header/selection styling is normalized to the surrounding TeXise UI. - Advances the PWA application-shell cache to `texise-app-shell-r14-28-14-buildfix20-v1` so an installed older shell cannot retain the narrow TikZ UI after deployment. - Adds BF20 regressions and release contracts for the exact shared-dialog breakpoint conflict and the yellow/white/black TikZ tool palette. # R14.28.14 Build Fix 19 — collaboration E2E Biome noParameterAssign correction — 2026-08-21 - Fixes the production Biome `lint/style/noParameterAssign` failure in `latex-collaboration-r9.e2e.ts` after the BF18 TypeScript fixes passed. - Keeps the original WebSocket constructor parameter immutable and routes `/collab-live` through a local `routedUrl` variable before calling `super(...)`. - Adds focused BF19 regression and release-audit contracts so the collaboration E2E cannot regress to parameter reassignment. - Preserves all BF17/BF18 TikZ Draw, `/collab-live`, authorship, Follow, toolbar-label and strict TypeScript fixes unchanged. # R14.28.14 Build Fix 18 — strict collaboration TypeScript compatibility — 2026-08-21 - Fixes the production `tsgo` failures introduced by the BF17 `/collab-live` transport under the pinned TypeScript native-preview toolchain. - Gives the `waitForSync()` unsubscribe callback an explicit optional `() => void` type so the returned status-unsubscribe function is assignable without the previous `() => undefined` inference. - Makes collaboration WebSocket binary frames return an explicit `ArrayBuffer`, avoiding `Uint8Array` / `SharedArrayBuffer` incompatibility with the DOM `WebSocket.send(BufferSource)` overload. - Normalizes Node `ws` `RawData` safely by handling fragmented `Buffer[]` messages with `Buffer.concat()` before the Buffer/ArrayBuffer branches, satisfying Node 26 typings without weakening runtime validation. - Adds dependency-free BF18 regressions and release contracts for all three strict typing fixes while preserving every BF17 TikZ Draw, live collaboration, authorship, Follow and toolbar-label feature. # R14.28.14 Build Fix 17 — TikZ Draw + reliable live collaboration — 2026-08-21 - Replaces the first TeXise TikZ node builder with the user-supplied MIT-licensed TikZ Draw editor, vendored same-origin under `/tikz-draw/` and presented in a wide 97vw × 92dvh TeXise-themed modal. The upstream drawing toolset remains available while generated TikZ and embedded images return through a constrained same-origin bridge; TeXise imports images into the browser-local project, provisions required packages/libraries and inserts canonical LaTeX through `latexSource.applyEdits(..., 'visual-structure')`. - Replaces production WebRTC-only manuscript synchronization with the TeXise-owned `/collab-live` WebSocket relay. The relay carries opaque Yjs document updates/snapshots and awareness in bounded transient memory, provides an explicit initial synchronization handshake and reconnect path, and leaves `/collab-signal` compatibility-only for older clients. - Makes collaboration connection state truthful (`connecting`, `synchronizing`, `live`, `reconnecting`, `offline`) and waits for initial convergence before reporting a joined session as live. Source editor binding uses a dedicated file-map revision so late-arriving files become bindable without recreating CodeMirror during ordinary collaborator typing. - Strengthens Google-Docs-style collaboration: per-user colors are deterministic, Source and Visual show remote selections/carets and collaborator-authored text, hover attribution reports who inserted a range, Follow tracks a peer's active file/mode, and accepted review cleanup removes only Yjs provenance while retaining LaTeX. - Renames the visible manuscript toolbar controls to **Tools**, **Track**, and **Cloud Terminal** while retaining stable internal service identifiers. - Rewrites collaboration browser certification around two independent browser contexts and the local `/collab-live` relay, covering Host→Guest and Guest→Host synchronization, authorship marks, Source/Visual presence, Follow exposure, reconnect and browser-local persistence. - Advances the PWA application-shell cache to `texise-app-shell-r14-28-14-buildfix17-v1` so the new collaboration/TikZ browser code cannot be masked by a previously installed BF16 shell. # R14.28.14 Build Fix 16 — live /ws editor routing and collaborator authorship review — 2026-08-21 - Fixes the recurrent production `Page not found` failure for editor URLs such as `/ws#route=editor&wsPath=project%3Amain.tex` even though the Build Fix 13 startup snapshot was still present. The browser entry now treats `/ws` as a live top-level application surface, restores the captured editor URL if service initialization normalizes it, observes hash/popstate plus `history.pushState`/`history.replaceState`, and switches between the editor and SaaS shells without allowing `/ws` to fall through to the SaaS 404 route. - Registers the service worker with the current `APP_BUILD_TIME` query and advances the app-shell cache generation to `texise-app-shell-r14-28-14-buildfix16-v1`, preventing an older cached shell from surviving a successful deployment and preserving stale `/ws` behavior. - Adds persistent collaboration authorship provenance without modifying canonical LaTeX source. Yjs text inserts are tagged with collaborator identity/color metadata; Source and Visual project those source ranges as per-collaborator highlights, and hover attribution identifies who inserted the text. - Expands the collaboration color palette and resolves local color collisions so concurrently active collaborators receive visually distinct authorship/presence colors whenever the palette has capacity. - Adds Review-sidebar **Accept collaborator edits** workflow. It removes only Yjs authorship metadata, leaves accepted LaTeX unchanged, is gated while tracked changes remain pending, and authorship highlights are also cleared automatically when the final pending tracked review is accepted or rejected. - Adds dependency-free BF16 release contracts for live `/ws` routing, cache-busted PWA shell activation, Source/Visual collaborator authorship projection, hover attribution, source-clean Yjs provenance and review-completion cleanup. # R14.28.14 Build Fix 15 — Learn progress ARIA/Biome production lint correction — 2026-08-21 - Fixes the production Biome `lint/a11y/useAriaPropsSupportedByRole` failure in `packages/core/app/src/saas/learn-pages.tsx`, where the Learn completion bar attached `aria-label` directly to a generic `
`. - Gives the Learn completion bar explicit `role="progressbar"` semantics with `aria-valuemin`, `aria-valuemax`, `aria-valuenow`, and `aria-valuetext`, preserving the visible browser-local completion UI while making its accessibility contract valid. - Adds a dependency-free regression that requires the progressbar role/value semantics and forbids the unsupported generic-div ARIA pattern. - Retains every Build Fix 14 feature unchanged: TikZ Visual Editor, enhanced Source/Visual collaboration presence, `/learn`, patched Console Gateway `ws 8.21.0`, favicon/PWA assets, separate Cloud/Console Docker images, and all deployment fixes. # R14.28.14 Build Fix 14 — TikZ, collaborative presence, Learn LaTeX and full product audit — 2026-08-21 - Adds a large browser-local TikZ Visual Editor to the LaTeX editor with draggable/keyboard-movable circle and rectangle nodes, labeled connectors, generated TikZ preview and an explicit **Insert TikZ** action. Insertion uses the canonical LaTeX source service, inserts at the active manuscript cursor (or before `\end{document}`), and provisions `tikz` plus `arrows.meta,positioning` only when required. - Strengthens collaboration presence across Source and Visual modes. Awareness now carries active file, editor mode, source cursor/selection and activity timestamp; Source retains Yjs/CodeMirror remote cursors while Visual projects peer-colored source-mapped selections, carets and name labels through native ProseMirror decorations. - Improves collaboration UX with live participant avatars/count in the workspace header and a collaboration panel that shows each participant's active file and Source/Visual mode, including one-click **Open** navigation to a peer's file. The local user's current file/mode is shown too. - Adds a public `/learn` training area with 12 original TeXise LaTeX guides, individual crawlable guide routes, public search/navigation/footer integration, sitemap coverage and browser-local completion progress that does not require an account. - Pins the standalone Linux Terminal Console Gateway to `ws 8.21.0`, aligning it with the root/trusted runtime and removing the older independent 8.20.1 service lock. - Adds BF14 dependency-free release contracts covering TikZ source safety, collaboration presence in both manuscript editors, Learn LaTeX local-only progress/discovery and the Console Gateway WebSocket dependency floor. - Completes a product/architecture audit and records prioritized follow-up items in `docs/TEXISE_FULL_PRODUCT_AUDIT_R14_28_14_BF14.md`. Large public/editor bundle separation remains a deliberate follow-up rather than a risky late change to the just-stabilized `/ws` bootstrap path. # R14.28.14 Build Fix 13 — preserve /ws editor deep-link intent before service startup — 2026-08-21 - Fixes production editor links such as `/ws#route=editor&wsPath=project%3Amain.tex` opening the SaaS `Page not found` shell even though the project/editor route itself was valid. - Root cause: browser entry selected `App` versus `SaasApp` only after `initializeServices()` completed. The hash router and startup recovery are constructed during that initialization, so the browser fragment could be normalized before the top-level application decision was made. - Captures the authoritative `/ws` pathname/hash immediately after synchronous PWA-launch normalization and before service initialization; either the captured or current `/ws` deep-link intent now mounts the editor application. - A truly bare `/ws` still redirects to `/projects`; public SaaS pages remain on `SaasApp`. - Adds dependency-free release/regression contracts for this boot-order invariant. # R14.28.14 Build Fix 12 — Linux Terminal scientific venv survives login-shell PATH reset — 2026-08-20 - Fixes production Linux Terminal certification where the locally built `texlive/texlive-console:pro` image contained and build-verified NumPy/SciPy/pandas/Matplotlib/SymPy under `/opt/texise-venv`, but interactive sessions still executed the base `/usr/bin/python3` and raised `ModuleNotFoundError: No module named 'numpy'`. - Root cause: Console Gateway starts sessions through `/bin/bash -lc`; the login shell reconstructs `PATH` from `/etc/profile`, overriding the Dockerfile `ENV PATH=/opt/texise-venv/bin:${PATH}` before the interactive shell is exec'd. - The console image now installs `/etc/profile.d/texise-venv.sh`, and the gateway independently re-asserts `VIRTUAL_ENV=/opt/texise-venv` plus the venv-first PATH both before and inside its generated `.bashrc`. - Bumps the locally managed Console image schema to `r14.28.14-bf12`, forcing existing BF11 images to rebuild automatically on upgrade. - Retains separate images: Cloud Compile `texlive/texlive:latest`; Linux Terminal Pro `texlive/texlive-console:pro`. # R14.28.14 Build Fix 11 — Local Pro console image build - `texlive/texlive-console:pro` is now explicitly a TeXise-local image tag. The installer builds it from the checked-in `deploy/docker/console/` context instead of trying to pull a nonexistent Docker Hub repository. - The local Pro image derives from `texlive/texlive:latest` but is independent from Cloud Compile at runtime and includes Git/GitHub CLI, Python 3 + pip/venv, pinned NumPy/SciPy/pandas/Matplotlib/SymPy, GCC/G++/make/cmake, archive/HTTP utilities and inherited TeX Live. - Image schema label `r14.28.14-bf11` prevents needless rebuilds while forcing regeneration when the TeXise image recipe changes. - Operator-supplied non-default `TEXISE_CONSOLE_IMAGE` values remain external images and may still be preloaded or pulled from authenticated registries. - Retains the separate Cloud Compile image `texlive/texlive:latest`, favicon/site-manifest integration, execution-service hardening and Apache compatibility fixes from prior build fixes. # R14.28.14 Build Fix 10 — Separate execution images + Apache examples redirect - Cloud Compile now uses `texlive/texlive:latest` exclusively through `TEXISE_CLOUD_COMPILE_IMAGE` / `COMPILE_DOCKER_IMAGE`. - Linux Terminal · Pro now uses `texlive/texlive-console:pro` exclusively through `TEXISE_CONSOLE_IMAGE`; the retired shared `TEXISE_EXECUTION_IMAGE` key is removed during upgrade migration. - Removed the temporary host-mounted `console-science` Python overlay. The dedicated Pro console image must contain and pass certification for the full scientific/Git/C++/TeX toolchain. - Docker entrypoints are explicit (`latexmk`/`synctex` for Cloud Compile and `/bin/bash` for Linux Terminal) so image ENTRYPOINT metadata cannot change TeXise execution semantics. - Added a real Apache `301 /examples -> /templates` compatibility redirect ahead of SPA fallback, fixing the production deployment health failure. # R14.28.14 Build Fix 9 — canonical Apache vhost selection after www migration - Fixes the production frontend health check returning HTTP 403 after trusted API, Cloud Compile and Linux Terminal certification had all passed. - Root cause: the installer enabled the new canonical `texise.com.conf` but did not disable Certbot's historical `texise.com-le-ssl.conf`. That legacy vhost still claimed `www.texise.com` and served `/var/www/texise.com/public_html/` instead of `/dist`; with no public source-root index it could win name-based vhost selection and return 403. - The installer now disables the conflicting legacy primary Certbot vhost while preserving its file and certificate for rollback, alongside the already-retired legacy `app.texise.com` application-serving vhosts. - Frontend health failures now emit `apache2ctl -S` and the enabled TeXise site symlinks so future vhost-selection conflicts are explicit in deployment logs. - Adds release/regression coverage requiring the primary legacy SSL vhost cleanup and Apache diagnostics. # R14.28.14 Build Fix 8 — favicon suite and resilient Linux Terminal scientific capability certification - Added the supplied production favicon/Apple/PWA icon suite and canonical `/site.webmanifest` links while retaining `/manifest.webmanifest` for compatibility. - Linux Terminal core production certification no longer rolls back TeXise solely because the operator-managed shared image is missing optional scientific Python modules. NumPy/SciPy/pandas/Matplotlib/SymPy are reported separately and can be made a strict gate with `TEXISE_CONSOLE_REQUIRE_SCIENTIFIC_STACK=1`. # R14.28.14 Build Fix 7 — Console certification PTY echo race — 2026-08-20 - Fixes Linux Terminal Pro production certification returning `404` for `cert/generated.txt` even though the terminal service, websocket, and command environment were healthy. - Root cause: the interactive PTY echoes submitted commands before executing them, and the checker embedded its success marker literally in the command text. The echoed command therefore produced a false success before `cert/generated.txt` existed. - The certification command now constructs the success marker from two fragments at execution time, so the complete marker cannot occur in echoed input. - After observing the execution-only marker, certification explicitly lists `cert/generated.txt` through the Console Gateway before downloading it and reports the gateway response body on download failure. - Adds regression coverage that forbids a literal success marker in PTY input and requires generated-file visibility verification before download. - The OVH log confirms trusted API health and private Cloud Compile health already pass; this fix is isolated to Linux Terminal production certification. # R14.28.14 Build Fix 6 — Console Gateway ws constructor compatibility — 2026-08-20 - Fixes Linux Terminal Pro production certification failing with `TypeError: WebSocket is not a constructor` under the locked `ws` 8.x CommonJS package. - Replaces dynamic ESM namespace import of `node_modules/ws/index.js` with `createRequire()` scoped to `texise-services/console-gateway/package.json`, so the certification script receives the actual CommonJS WebSocket constructor. - Keeps Build Fix 5 script-location independence: dependency resolution is still rooted at `public_html/texise-services/console-gateway` regardless of the operator shell current working directory. - Adds regression coverage that requires package-scoped `createRequire('ws')`, accepts current/alternate `ws` export shapes, and forbids the prior `await import(wsModuleUrl)` constructor path. - The OVH deployment log confirms trusted API health and private Cloud Compile health both pass; this failure occurs only inside Linux Terminal Pro certification after those services are already healthy. # R14.28.14 Build Fix 5 — Console Gateway certification source-root resolution — 2026-08-20 - Fixes Linux Terminal Pro production certification resolving `texise-services/console-gateway/node_modules/ws/index.js` relative to the operator shell current working directory. Launching the installer from `/var/www/texise.com` incorrectly produced `/var/www/texise.com/texise-services/...` instead of the canonical `/var/www/texise.com/public_html/texise-services/...`. - `scripts/check-console-gateway.mjs` now derives the repository root from `import.meta.url`, so certification is independent of the directory from which the installer or upgrade command is launched. - Adds R14.28.14 regression coverage that requires script-relative resolution and forbids the prior cwd-relative `path.resolve('texise-services/...')` form. - The OVH log confirms the trusted API (`127.0.0.1:3100`) and private Cloud Compile worker (`127.0.0.1:3001`) were both healthy before this Console certification path error; the historical `app.texise.com` vhost does not proxy port 3100 and was not the cause. # R14.28.14 Build Fix 4 — execution-service dependency/workspace deployment hardening — 2026-08-20 - Fixes the production Cloud Compile startup failure where `texise-latex-compile.service` could race `npm ci` under `Restart=always`, temporarily producing `ERR_MODULE_NOT_FOUND: express`. Existing execution services are now quiesced before their locked dependency trees are replaced. - Fixes `EACCES` for `/var/www/texise.com/public_html/texise-data/tmp/cloud-compile/jobs`: execution-service users now receive execute-only traversal through `texise-data`/`tmp` while their private Cloud Compile and Console workspaces remain individually owned and non-listable. - Adds service-account write probes during deployment so Cloud Compile/Console workspace permission errors are detected before service activation. - Verifies required service dependency markers (`express` and `node-pty`) immediately after `npm ci`. - Preserves native/executable modes inside Console Gateway `node_modules`; the previous blanket `chmod 0644` could remove `node-pty` helper executable bits. - Adds bounded startup retries for Cloud Compile and Console Gateway health endpoints to avoid false deployment failures immediately after systemd restart. - Production OVH already passed custom validation, both `tsgo` stages, Biome, Vite build, BusyTeX/font checks, SaaS/MySQL preflight and trusted API activation before exposing these service-provisioning defects. # R14.28.14 Build Fix 3 — Cloud Compile loopback deployment health check — 2026-08-20 - Fixes the post-build deployment health check that incorrectly rejected the valid private worker URL `http://127.0.0.1:3001/api/compile`. - Corrects the Bash extended regular expression from double-escaped IPv4/IPv6 literals to the same proven loopback form used by the Console Gateway health check. - Adds regression coverage so `127.0.0.1`, `localhost`, and `[::1]` Cloud Compile worker endpoints remain accepted while public/non-loopback endpoints remain rejected. - This failure occurred after production successfully passed custom validation, both `tsgo` typechecks, Biome lint, the Vite browser build, production dist staging, fonts, MySQL/SaaS preflight, and trusted API activation. # R14.28.14 Build Fix 2 — Biome Home accessibility/key cleanup — 2026-08-20 - Fixes the production Biome `lint/a11y/useAriaPropsSupportedByRole` failure by giving the TeXise workspace overview mock an explicit `role="img"` for its descriptive `aria-label`. - Fixes the production Biome `lint/suspicious/noArrayIndexKey` failure in the Home comparison table by rendering the fixed comparison columns explicitly rather than deriving React cell keys from array indices. - Production OVH had already passed `custom-validation` and both `tsgo` typecheck stages before reaching these Biome errors; this build fix targets the remaining reported lint blockers. - Re-ran repository contracts, SaaS static audits, runtime hardening, server/deployment tests, lock/dependency/barrel checks and template compiler requirements after the fix. # R14.28.14 Build Fix 1 — React 19 Linux Terminal ref typing — 2026-08-20 - Fixes the production `tsgo` failure in `linux-terminal-pro.tsx` under `@types/react` 19.2 by initializing the WebSocket and terminal-session refs with explicit nullable values and clearing them with `null`. - Audited package/server TypeScript sources for additional zero-argument generic `useRef()` calls; none remain. - Re-ran the dependency-free release contracts, hardening, SaaS and server/deployment suites after the fix. # R14.28.14 — canonical www SaaS, Cloud Compile Pro, public redesign and service consolidation — 2026-08-20 - Makes `https://www.texise.com` the canonical single origin and `/var/www/texise.com/public_html` the canonical application root, with direct HTTP/bare-domain redirects and redirect-only `app.texise.com` compatibility vhosts. - Migrates the trusted API/systemd/installer paths to the canonical tree while preserving `/var/www/app.texise.com/public_html` and legacy service trees as rollback material; active TeXise runtime defaults no longer use `/var/lib/texise*`. - Integrates the supplied `texise-latex-compile` worker as **Cloud Compile · Pro** behind the trusted `/api/compile/cloud` broker with server-authoritative Pro entitlement, quotas, bounded input/output/time/concurrency, cancellation and manuscript-safe audit data. - Hardens the private compile worker with loopback authentication, Docker-only production execution, `--network none`, read-only filesystem/source mounts, dropped capabilities, unprivileged container UID, resource/PID limits, explicit `-no-shell-escape`, abandoned-job scavenging and deterministic cleanup. - Keeps **Local Compile** browser-local, Free and default; Cloud Compile is never selected silently and discloses temporary source upload/cleanup behavior. - Rebuilds Home from the supplied TeXise reference with the complete research-workflow story, Templates, terminal/local-first sections, comparison matrix, AI/research sections, dual compile messaging, two-plan teaser, FAQ and `/projects` CTAs. - Rebuilds Pricing using only TeXise Free + Lifetime Deal (Includes Pro), preserving the configured shop/price source and adding a grouped feature matrix including Cloud Compile. - Rebuilds Docs as a CMS-driven three-column desktop shell with responsive navigation drawer, generated H2/H3 TOC, code copy controls, previous/next navigation and seeded Local/Cloud Compile documentation that does not overwrite operator-authored CMS entries. - Audits the supplied Console Gateway and Hocuspocus collaboration sources plus the production Reverb unit. Console Gateway is retained and hardened as the active **Linux Terminal · Pro** service; only the unused Hocuspocus collaboration and Laravel Reverb units are retired after successful modern health checks, with their source/unit trees preserved for rollback. - Normalizes active PWA/mobile/package/SEO/OAuth/server URLs to `www.texise.com`, bumps the app-shell cache to R14.28.14, and adds R14.28.14 hostname/Home/Pricing/Docs/Cloud regression coverage. - Final dependency-free release verification in the build sandbox: 329/329 repository contracts, 81/81 server/deployment tests (including R14.28.14 Cloud/Terminal regressions), 99/99 runtime-hardening tests, 43/43 SaaS static audits, 69 lock importers, 68-package dependency consistency, 67 public barrels, 13/13 template compiler requirements, and deployment/Node syntax PASS. The sandbox cannot reach npm (`EAI_AGAIN registry.npmjs.org`), so pinned `pnpm` custom-validation/`tsgo`/Biome/Vite gates remain mandatory installer/OVH gates and are not claimed as passed here. # R14.28.13 — public_html runtime/media + Blog upload/article completion — 2026-08-20 - Moves active TeXise runtime state, compiler/cache/temp/log data and AI Review audit state under `public_html/texise-data`, while keeping protected configuration/signing material under `/etc/texise`. Historical `/var/lib/texise*` paths remain only as explicit upgrade-migration inputs. - Moves public Blog cover media to `public_html/texise-media/blog`, serves it directly at `/texise-media/blog/*`, denies `/texise-data/*` in Apache, and prevents SPA fallback from masking missing media. - Replaces Blog cover Base64/JSON upload with authenticated multipart upload, signature/dimension/size validation, generated immutable filenames, atomic fsync+rename persistence and structured media errors. - Adds upgrade-safe migration for historical Blog media and old `/blog-media/*` CMS URLs, plus deployment write/read/served-byte health checks using the actual TeXise service user. - Renames the public capability labels to `Visual Editor` and `Local Compile`. - Rebuilds `/blog/:slug` as a wide TeXise article card with a ~2.2:1 cover, TeXise-owned cover notch, Moranga title, Inter body, JetBrains Mono code, date/tags/author metadata and responsive prose/media/table styling while keeping `/blog` listing cards distinct. - Dependency-free release verification: 166/166 Node tests, 43/43 SaaS/product/security audits, 328/328 repository contracts, 13/13 template compiler checks, 69 lock importers, 68-package dependency consistency, 67 public barrels and deployment shell syntax PASS. Dependency-backed `pnpm` typecheck/Biome/build and live Apache/MySQL/browser certification remain OVH-host gates. # Build Fix — strict React effect cleanup and Toast UI typings — 2026-08-20 - Fixes the OVH production `tsgo` failure where the shared page-modal host returned the boolean result of `Set.delete()` from a React effect cleanup; the cleanup now returns `void` as React 19 requires. - Adds a narrow local `@toast-ui/editor` 3.2.2 declaration shim because the package publishes declarations under `types/` but its `exports` map does not expose them to bundler module resolution. - Types the Toast UI image hook as `Blob | File` with the upstream optional alt-text callback contract, preserving strict `noImplicitAny`. - Extends the SaaS static audit so both production build regressions are guarded. # Brand/Home/Projects/Blog CMS completion — 2026-08-20 - Standardizes the TeXise lockup on Moranga with the exact `Tex·ise` regular-italic wordmark, preloads all eight external production fonts, and gates first render behind a bounded font-readiness check. - Rebuilds the Home hero from the supplied Prefix layout reference using TeXise-owned copy/capability cards, removes Docs from the top navigation while preserving it in the footer/search, and keeps Start Writing pointed at `/projects`. - Simplifies `/projects` to New Project + a single overflow menu for Templates, Link Folder, Import ZIP and Import from GitHub; `/projects` now shares the public Home footer, and per-project actions use TeXise page modals rather than browser-native dialogs. - Adds a full-project ZIP download button immediately after Add Folder in the editor sidebar using the existing binary-safe exporter. - Adds Prefix-derived Blog index/article/admin presentation, Toast UI authoring with usage statistics disabled, persistent validated cover media under `/var/www/app.texise.com/public_html/texise-media/blog`, and bounded/sanitized inline `data:image/png;base64,...` article images. - Product-wide native-dialog audit is clean for TeXise UI: no user-facing `alert()`, `confirm()` or `prompt()` remains; the PWA install API's `installPrompt.prompt()` is unrelated and retained. - Frozen source verification: 170/170 dependency-free Node tests, 43/43 SaaS/product/security audits, 328/328 repository contracts, 13/13 template compiler checks, 69 lock importers, 68-package dependency consistency and 67 public barrels. Three Vitest-backed server spec files remain dependency-host verification because this source-only container has no `node_modules`. # Consolidated Projects/Templates/Typography completion — 2026-08-20 - Makes `/projects` the visible writing home, keeps only deep `/ws#...` editor compatibility routes, and adds project ZIP download, browser-local GitHub import, direct root-file opening and storage-aware project deletion. - Moves physical template assets to `/texise-templates/*`, redirects `/examples` to `/templates`, and adds upgrade cleanup/health guards so legacy `templates/` directories cannot recreate the Apache 403 collision. - Removes the Markdown-only sidebar filter, fixes the project privacy-link color, and deploys the authoritative eight-font Inter/JetBrains/Moranga/STIX system from the external font source after build with signature verification. - Final dependency-free verification: 160/160 Node tests, 33/33 SaaS audits, 328/328 repository contracts, 13/13 template compiler checks, 69 lock importers, 68-package dependency consistency and 67 public barrels. Dependency-backed build/lint/browser/OVH runtime certification remains explicitly deployment-host work. # SaaS post-release completeness audit (2026-08-20) - Closed safe-settings restore, `/ws` navigation theme-control, project-registry reconciliation/offline retry, single-screen no-onboarding project creation, CMS author/tag/search metadata, admin operational-field/quota-control, contact header-injection and malformed-settings recovery gaps found by the authoritative SaaS master-plan re-audit. - Re-froze dependency-free validation at 39/39 SaaS/server tests, 12/12 template+installer tests, 99/99 current-baseline runtime-hardening tests, 22/22 SaaS static audits and 328/328 repository contracts. - Browser/dependency/MySQL/OAuth/SMTP certification remains explicitly `NOT RUNTIME-VERIFIED` where the supplied environment cannot exercise it. ## 2026-08-20 — SaaS production build/install hotfix - Fixed strict TypeScript errors in the SaaS template application shell (`Github` lucide import and NativeFS storage union narrowing). - Moved writable AI Review audit state to `/var/lib/texise` with upgrade-safe migration from the historical `/etc/texise` default. - Preserved strict `/etc/texise` ownership and permissions instead of making configuration writable to the service. ## R14.28.12 SaaS/local-first conversion pass — 2026-08-20 - Adds the optional MySQL account/CMS/support layer, Google OAuth, cloud project metadata registry, persistent account licensing/quota, filesystem-driven templates, public/CMS/admin routes, Prefix-derived TeXise design system and `/ws` visual-identity pass while preserving browser-local project files and compilation. - Adds upgrade-safe migrations/installer behavior, security hardening, template/contact/auth/license tests and authoritative validation documentation in `docs/TEXISE_SAAS_*`. - Font binaries are not redistributed by this release package; restore project-owned assets according to `FONT-ASSETS-REQUIRED.md` before a production build. ## R14.28.12 R30 — Live PDF separation and editor/UI regression repair - Separates R4 from R5: BusyTeX LuaLaTeX is certified once with a tiny TeXise-owned directlua/MEMFS/PDF document, while production Live PDF compiles the canonical project root directly without instrumentation wrappers. - Caches successful runtime certification for the dedicated Live PDF compiler lifetime, preserves manual Compile/SyncTeX isolation, and reports manuscript compile failures separately from runtime-certification failures. - Restores repeated Visual Shift+Enter by placing the synthetic caret inline after canonical `\newline{}`, keeps normal Enter materialization, and reduces Visual paragraph spacing. - Makes the desktop Large AI preset stable against stale ResizeObserver measurements, removes the Compact control and window-size animation, while keeping manual desktop resizing and mobile full-screen behavior. - Simplifies visible labels to `Comment`, `Track Changes`, and `Soft Wrap` without redundant On/Off text. ## R14.28.12 Build Fix 35 — release-contract audit migration - Updated static/runtime release guards to certify the persistent Visual live-buffer projection, budget-aware Paper Memory RAG, shared mobile research dock, and deterministic Copy/Insert AI snippet flow introduced by the Phase 1–7 stabilization work. - No production behavior was reverted to satisfy obsolete source-string assertions. ## R14.28.12 Build Fix 25 — strict OPFS streaming TypeScript compatibility - Fixed the production typecheck failure in `local-ai.worker.ts` where fetch stream chunks are typed as `Uint8Array` but OPFS `FileSystemWritableFileStream.write()` requires an `ArrayBuffer`-backed payload under `@typescript/native-preview`. - Added `opfsWriteChunk()` to pass through full `ArrayBuffer`-backed network chunks without copying, slice only subviews, and copy only non-`ArrayBuffer` backing stores such as a theoretical `SharedArrayBuffer`. - Preserved the Build Fix 24 local-model memory-pressure improvements while making the code strict DOM-library safe. ## R14.28.12 Build Fix 24 — editor/PDF UX, review cleanup and local-AI cursor actions - Swaps floating actions so AI is right-most, makes the AI panel mobile-safe, and keeps Terminal maximize/minimize/close reachable on narrow screens while hiding scientific runtime status badges there. - Removes oversized amber SyncTeX overlays, defaults to PDF-follows-editor only, and reveals the newly compiled PDF at the active source cursor. - Clears stale comment decorations/active thread state after deletion and makes Source editor horizontal padding symmetric. - Makes local AI accept `tool_calls`, uses the active cursor as the default target for equation/table insertion, auto-applies explicit local “at cursor” insertions, and adds deterministic equation/table fallbacks. - Reduces local-model download memory/UI pressure with direct OPFS chunk writes, quota preflight, throttled progress events, and a lower-memory LiteRT token budget. ## R14.28.12 Build Fix 21 - Fixes BusyTeX project-source corruption that could surface as `Missing \begin{document}` even when the editor source was valid. The TeXise worker bridge now normalizes both `{ content }` and `{ contents }` file shapes before calling `BusytexPipeline.compile()`. - Decodes textual LaTeX project files to UTF-8 strings before they enter `BusyTexRunner`, and normalizes them again at the worker boundary, matching BusyTeX's package resolver contract while preserving binary files as bytes. - Recovers the legacy `Uint8Array.toString()` comma-separated byte representation only when it decodes back into recognizable TeX source, preventing old runner generations from mounting numeric byte text as `main.tex`. - Adds a worker-side source-integrity diagnostic (`documentclass` / `begin-document`) and executable regression coverage proving the exact document text reaches the BusyTeX pipeline. - Rotates the app-shell/compiler bridge identity to Build Fix 21. ## R14.28.12 Build Fix 20 - Fixed Full / SyncTeX pdfLaTeX starting BusyTeX with no TeX Live preload. TeXise now mounts `texlive-basic.js` before pdfLaTeX initialization, restoring `texmf.cnf` and the prebuilt `pdflatex.fmt` expected by the BusyTeX pipeline. - Kept the upstream BusyTeX `--fmt /texlive/.../pdflatex.fmt` command intact; the missing format was a data-bundle bootstrap failure, not an invalid format path. - Rotated the browser app-shell/compiler bridge release identity to Build Fix 20 and added release/runtime assertions that forbid an empty pdfLaTeX preload list. ## R14.28.12 Build Fix 19 - Fixes release incoherency where a newly activated service worker could control an already-open tab that was still executing an older TeXise JavaScript bundle. - Existing same-origin tabs are navigated once when the new service worker activates, and application JavaScript/CSS uses network-first delivery with offline cache fallback. - Production activation now scans staged browser assets and refuses a dist containing the obsolete fatal BusyTeX remote-cache error path. - BusyTeX logs an explicit `buildfix19` adapter marker so support logs identify the compiler bundle actually running in the browser. ## R14.28.12 Build Fix 11 — stale-source build repair guard - Keeps the Build Fix 10 strict-TypeScript correction in `busytex-adapter.ts`. - Adds a narrow, idempotent pre-build source migration that recognizes the exact Build Fix 9 `if (!match) ... return match[1]` ABI-parser shape and rewrites it to the Build Fix 10 `parameterList` narrowing before `tsgo` runs. - Makes overlaid upgrades fail clearly if an unexpected stale parser shape is active, instead of surfacing TS2532 later in the monorepo typecheck. - No BusyTeX runtime ABI, engine, cache, editor, AI, or scientific-runtime behavior changes relative to Build Fix 10. ## R14.28.12 Build Fix 10 — strict TypeScript ABI-parser build correction - Fixes the Build Fix 9 production typecheck failure in `busytex-adapter.ts` under `noUncheckedIndexedAccess` by narrowing the optional regex capture before parsing BusyTeX compile parameters. - No BusyTeX ABI, compiler engine, cache, deployment, editor, AI, or scientific-runtime behavior changes intended relative to Build Fix 9. ## R14.28.12 Build Fix 9 — BusyTeX v1.4 runtime ABI correction - Replaces the speculative Build Fix 6 driver/verbosity swap workaround with an explicit BusyTeX v1.4 ABI contract: `bibtex, biber, makeindex, rerun, verbose, driver`. - Rejects stale v1.3-style BusyTeX pipeline/worker assets, whose missing `biber` positional slot shifts `verbose="silent"` into the `driver` argument and produces `Driver [silent] is not supported`. - Pins `busytex_pipeline.js` and `busytex_worker.js` to the known v1.4 build release (`46ebb62`) when TeXise provisions `texlyre-busytex@1.4.0`. - Bumps the persistent compiler cache ABI so an older cached runtime cannot be restored into the new release. - Adds a browser-side runtime ABI preflight before BusyTeX initialization and a clear deployment mismatch error instead of attempting a doomed compile. - Calls the pinned BusyTeX runner compile ABI directly with an explicit engine driver (`pdftex_bibtex8`, `xetex_bibtex8_dvipdfmx`, or `luahbtex_bibtex8`). - Rotates the PWA app-shell cache identity to Build Fix 9 while continuing to exclude `/compiler/` runtimes from app-shell caching. - Supersedes the root-cause assumption recorded in Build Fixes 6 and 8; Build Fix 8's `/compiler/` cache exclusion remains a valid hardening change. ## R14.28.12 Build Fix 8 — BusyTeX stale service-worker cache recovery - Historical Build Fix 8 diagnosis: attempted to address continued `Driver [silent] is not supported` failures by removing compiler assets from the PWA cache. Build Fix 9 later identified the underlying v1.4/v1.3 runtime ABI mismatch; the cache exclusion remains valid hardening. - Removes `/compiler/*` JavaScript/WASM assets from the PWA app-shell cache boundary so BusyTeX pipeline, worker and Wasm files always follow the compiler deployment's HTTP revalidation policy instead of a cache-first service-worker response. - Rotates the app-shell cache generation so an activating Build Fix 8 worker removes the older `texise-app-shell-*` cache that can contain an unpatched `busytex_pipeline.js`. - Registers the TeXise service worker with `updateViaCache: 'none'` from both startup and compiler bootstrap paths so an upgrade checks the service-worker script without reusing an HTTP-cached copy. - Keeps TeX Live package caching and the offline application shell intact; only version-sensitive `/compiler/*` runtime assets leave the app-shell cache. ## R14.28.12 Build Fix 7 — browser compiler, Visual and local-AI stabilization - Guarantees the BusyTeX 1.4 compatibility guard is present in the final `dist/` tree and rejects deployment if it is missing; removes the unsafe reversed low-level runner retry. - Revalidates static full-compiler capabilities after a transient runtime downgrade so editor/terminal compiles recover without a page restart. - Points EmbeddingGemma ONNX/WASM loading at the exact Transformers.js 3.8.1 ONNX Runtime distribution and hardens Visual focus/contenteditable recovery. - Makes Fast Preview deterministically use SwiftLaTeX even when a full BusyTeX deployment is present. - Historical Build Fix 7 compiler recovery work (superseded by Build Fix 9 for the `Driver [silent]` root cause); BusyTeX compilation now uses the explicit v1.4 Biber ABI instead of a driver/verbosity swap workaround. - Recreates the ProseMirror Visual surface only while Visual mode is active, updates the editor state before canonical-source callbacks, and explicitly restores an editable/focusable root to prevent the recurring read-only Visual regression. - Runs LiteRT-LM inference from the normal browser ESM context documented by Google while retaining OPFS model download/storage in the TeXise worker, fixing the module-worker `importScripts()` crash. - Makes EmbeddingGemma prefer the ONNX/WASM backend with explicit ORT asset resolution and a WebGPU fallback instead of failing after download with `no available backend found`. - Moves the floating TeXise AI launcher left of the Terminal launcher so the controls no longer overlap. ## R14.28.12 Build Fix 6 — BusyTeX 1.4 driver/verbosity runtime compatibility - Fixes Full / SyncTeX compilation failing with `Driver [silent] is not supported` when the BusyTeX 1.4 high-level runner and release pipeline disagree on the positional ordering of `verbose` and `driver`. - Adds a narrow, idempotent compatibility guard at the deployed `busytex_pipeline.js` boundary so both Web Worker and main-thread fallback compilation normalize only the unmistakable swapped-driver case. - Existing BusyTeX 1.4 compiler trees and persistent caches are patched in place during installation, avoiding another ~524 MB runtime download. - No Fast Preview, compiler-mode, project-source, or TeX Live package-resolution behavior changes intended. ## R14.28.12 Build Fix 5 — BusyTeX 1.3.x migration and full-profile provisioning guard - Migrates preserved TeXise-owned BusyTeX `1.3.0` and `1.3.1` defaults to `1.4.0` before browser compiler provisioning; BusyTeX 1.4 added the Biber assets required by TeXise full compiler mode. - Rejects pinned npm BusyTeX versions older than 1.4.0 before the ~524 MB compiler asset download instead of downloading an incompatible release and failing afterward. - BusyTeX provisioning failures now name the exact missing runtime asset files for actionable deployment diagnostics. - No editor/scientific-runtime/AI behavior changes intended. ## R14.28.12 Build Fix 4 - Fixed the remaining Biome 2.5 build blockers exposed after TypeScript validation: scientific-runtime parameter reassignment, untyped terminal runtime requests, control-character regex linting, and an unnecessary WASIX template literal. - No product/runtime behavior changes intended. # R14.28.12 Build Fix 3 — Biome 2.5 production lint compatibility - Fixed the production Biome 2.5 accessibility diagnostics for AI evidence groups, Paper Memory labelled groups, outline tabs, project-tool form labels, review-dialog backdrop interaction and React list keys. - Kept intentional modal/terminal autofocus and complex TeXise hook trigger patterns visible as warnings instead of build-blocking errors; all other Biome recommended/error rules remain enabled. - Increased the CI lint diagnostic ceiling to 200 so any future production lint failure reports the complete actionable set in one build. - No editor, compiler, scientific-runtime, AI permission, storage, collaboration or deployment behavior was intentionally changed. # R14.28.12 Build Fix 2 — strict TypeScript build compatibility - Fixed the 46 strict `tsgo -b` diagnostics exposed after dependency validation passed, without changing product behavior. - Added the missing `ShieldCheck` icon import and made local-model description rendering safe when the configured model id is unavailable. - Normalized bibliography picker UI state to plain strings while preserving branded project paths at storage/service boundaries. - Updated React 19 `useRef` initializers and visual-editor figure/table discriminated-union narrowing, including review-thread id validation. - Made Agent cancellation state construction total so `Record` entries cannot contain `undefined`. - Restored `ProjectScientificRuntimeService` as a configured core slot by requiring its constructor config, allowing browser runtime factory overrides to type-check. - Added explicit `ProjectEntry.kind === "file"` narrowing and missing-byte guards across AI, dataset, Agent and artifact inspection paths. - Corrected Paper Memory local-resource release to read `runtime.state.ragStatus`. - Copied streamed local-model download chunks into `ArrayBuffer`-backed typed arrays for the File System Access API and explicitly narrowed the final LiteRT message. - Removed the obsolete `PDFDocumentProxy.destroy()` call; the PDF loading task remains responsible for teardown in the existing `finally` path. - No editor, compiler, scientific-runtime, AI permission, storage, or deployment behavior was intentionally changed. # R14.28.12 Build Fix — service-core test dependency declaration - Declared `fake-indexeddb` as a test-only `devDependency` of `@learnitive/service-core`, matching the existing `fake-indexeddb/auto` import in `project-review-service.spec.ts`. - Updated the `packages/core/service-core` pnpm-lock workspace importer so `pnpm install --frozen-lockfile` remains valid. - No production/runtime functionality changed. # R14.28.12 Integrated Browser Certification and Runtime Hardening - Added a zero-download scientific runtime doctor that reports browser prerequisites, current lazy runtime state, and compatibility for Python/Pyodide, R/webR and C/C++/WASI without initializing or downloading any runtime. - Added `runtime doctor`, `runtime status --json`, and `runtime reset ` terminal commands so browser/deployment problems are diagnosable in-app and failed/aborted heavy runtimes can be recovered without reloading the TeXise workspace. - Added deterministic scientific-browser capability checks for WebAssembly, Workers, fetch/AbortController, cross-origin isolation, SharedArrayBuffer/Atomics and plot-capture support. Python reports reduced interruption capability instead of false failure when SharedArrayBuffer is absent; WASI fails preflight when its required isolation primitives are missing. - Extended the existing `scientific.environment` AI read tool with the same zero-download diagnostic report so Copilot/Agent explanations can distinguish browser/runtime limitations from analysis-code failures without granting extra execution permissions. - Hardened runtime interruption semantics so a loaded runtime that explicitly reports `interrupt: false` cannot be presented as successfully interruptible; users are directed to runtime reset/recovery instead. - Added an LRU cap of three loaded scientific runtime sessions across workspaces; only idle/error sessions are evicted, preventing repeated workspace visits from retaining unbounded heavyweight Wasm runtime memory while never disposing a running/initializing session. - Added production Playwright coverage for the zero-download doctor across the desktop release browser matrix while asserting the check leaves Python/R/WASI in `not-loaded` state. - Added an opt-in live scientific runtime certification suite (`pnpm run release:scientific-runtimes`) for connected release runners: real Pyodide execution + Matplotlib artifact generation + reset/recovery, real webR execution + R plot artifact generation + reset/recovery, and optional Wasmer/jaq + Clang/C/C++/WASI execution. - Integrated the zero-download browser test into the normal release E2E matrix and made the heavyweight external-runtime gate opt-in through `TEXISE_SCIENTIFIC_RUNTIME_LIVE=1`; release certification records whether the live scientific gate actually ran rather than claiming it unconditionally. # R14.28.11 Research Workflow Automation - Added `ProjectResearchWorkflowService` to build deterministic provenance across datasets, analysis generators, generated research artifacts and LaTeX manuscript references without asking the language model to infer relationships already known by TeXise. - Added generation-time source/input fingerprints to new scientific artifact provenance. Workflow freshness checks compare those fingerprints and Git working-tree changes so generated plots/results can be marked current, stale or unknown without model guesswork. - Added bounded workflow tracing from a dataset/source/artifact to its generated outputs and manuscript references, including local manuscript snippets around generated-artifact paths. - Added reproducible artifact reruns for Python, R and WASI-generated outputs. Reruns reuse the recorded generator/run output group, preserve runtime output allow-lists, and compare pre/post artifact hashes to identify changed versus unchanged figures/results. - Extended Terminal Agent tools with `workflow.graph`, `workflow.trace`, `workflow.changedArtifacts`, `workflow.rerunArtifact` and read-only `paperMemory.search`; all remain structured/fail-closed and retain the existing Agent capability policy. - Added `ai workflow "task"` as an Agent-mode workflow entry point and supplied bounded artifact provenance/freshness context to workflow planning so rerun/change plans can name actual generated files rather than hallucinating paths. - Added post-run Results drafting from actual completed scientific tool output and generated result artifacts. Dataset/result evidence is inspected deterministically before AI prose generation; the model is explicitly prohibited from inventing computed values or claiming operations succeeded without tool evidence. - Added a full Results-proposal review card with evidence paths, notes and complete proposed manuscript text. Applying it always creates a pending TeXise review change at the existing Results section (or creates a Results section before Discussion/Conclusion/end-document) rather than silently changing canonical LaTeX. - Kept Paper Memory evidence read-only in workflows and separated it from computed results; literature passages may contextualize interpretation only when actually retrieved locally, and no bibliography keys/citations are invented. # R14.28.10 Terminal Agent Mode - Enabled bounded Terminal AI Agent mode over the existing structured TeXise tool registry; the model never receives an unrestricted shell or generic command executor. - Added validated finite JSON research plans with at most 10 registered steps, strict per-tool argument schemas, workspace path guards, credential-free network validation and fail-closed rejection of invented tools. - Added explicit Run Plan semantics: after the user approves the displayed plan, Agent mode may automatically execute only read-local and compute-local steps. Project writes, destructive operations and every network action still require a separate exact-step approval. - Added per-step pending/running/completed/failed/skipped state, exact argument review, full proposed file-content review for generated scripts/writes, plan editing, cancellation and bounded final summaries based only on actual tool results. - Added exact scientific execution allow-lists for Agent-run Python, R, WASI and C/C++ workflows so reviewed script paths, input files and expected generated outputs remain authoritative during execution. - Preserved manuscript review boundaries: Agent plans cannot directly write LaTeX source; manuscript changes continue through TeXise review/track-change flows rather than an Agent file-write tool. - Added capability overrides for stateful finite tools: SQLite execution is treated as a local write and Git branch deletion as destructive; Git/network/toolchain/package actions retain their stricter existing policies. - Added untrusted-result framing for Agent summaries so source, terminal output, datasets, Git history and tool results remain data rather than model instructions. - Hardened Agent mutation/network schemas so direct writes cannot target `.git` internals, credential-bearing HTTP headers are rejected, and Agent HTTP downloads are confined to research/output directories. - Kept Copilot and Assisted modes intact and deliberately omitted a fully autonomous mode. # R14.28.9 Certified Scientific WASI Utilities - Added a finite, pinned browser WASI utility catalogue on the existing Wasmer runtime: Pandoc `wasmer/pandoc@0.0.1`, jaq `jaq/jaq@0.1.3` (also exposed through a `jq` compatibility alias), and SQLite `sqlite/sqlite@0.2.2`. - Added explicit network-approved `wasix install pandoc|jaq|sqlite` commands. Utility execution never accepts arbitrary Wasmer Registry package names and never triggers hidden first-use downloads. - Added terminal `pandoc`, `jaq`, `jq`, and `sqlite3` commands mounted only on `/workspace`; terminal pipeline stdin is passed through the finite WASI tool boundary for JSON/document filters. - Added Pandoc generated report/document synchronization and SQLite database artifact classification/provenance through the shared scientific runtime collector. Existing SQLite database mutation is treated as an explicit local write and is limited to the database path selected by the user. - Extended structured Terminal AI capabilities with `scientific.installUtility` and `scientific.runUtility`; installs remain network-confirmed and utility execution remains approval-controlled for AI. - Deliberately did not expose Gnuplot in this release because no current certified browser Wasmer/WASI package was verified; TeXise continues to use Matplotlib and R/webR as the supported scientific plotting paths. # R14.28.8 C/C++ WebAssembly / WASIX - Added a browser-local `@learnitive/wasi-browser` scientific runtime backed by Wasmer WASIX, pinned to `@wasmer/sdk` 0.10.0 and loaded lazily only through an explicitly network-approved toolchain initialization. - Added an explicit `wasix install clang` network-approved toolchain step using the pinned `clang/clang@0.160000.1` registry package; `clang`/`clang++`/`wasm-run` fail before runtime initialization rather than silently causing their own first-use network fetch. - Added terminal `clang`, `clang++`, `cc`, `c++`, `wasm-run` and `wasix info` commands. C/C++ source compiles to project WebAssembly artifacts and generated `.wasm`/object/library files are synchronized through the existing scientific artifact pipeline. - Added `RuntimeExecutionRequest.mode = 'tool'` so scientific runtimes can expose finite validated tools without receiving arbitrary shell strings. Python and R explicitly reject runtime tool invocations they do not own. - Added C++ driver compatibility through Clang's g++ driver mode and kept compilation constrained to the mounted `/workspace`; compiled programs execute through the same mounted project mirror rather than host filesystem/process access. - Added fail-closed terminal and AI capability entries for C/C++ compilation and toolchain installation. AI compiler diagnostics continue to use bounded terminal stderr/source context and cannot silently compile, mutate files or download toolchains. - Added C/C++ runtime status in the terminal and retained generated-artifact overwrite/create protections for compiled programs. - Added cross-origin-isolation headers to the Apache deployment and Vite dev/preview server, allowed the pinned CDN worker origin in CSP, and extended production/deployer health checks to verify CSP/COOP/COEP required by SharedArrayBuffer-backed WASIX execution. - Added explicit runtime messaging that this is a WebAssembly/WASI research toolchain, not a native Linux compiler or unrestricted POSIX shell. # R14.28.7 Browser Git + Controlled HTTP Utilities - Added first-class `git` commands to the research terminal as a compatibility layer over the existing `ProjectGitService`; no native/Wasm Git executable or second repository filesystem was introduced. - Added terminal Git status/diff/log, init, stage/add, unstage, commit, branch create/delete, checkout/switch, merge, remote list/add/remove, clone, fetch, pull and push with existing collaboration/clean-worktree protections preserved. - Added workspace terminal Git identity via `git config user.name` / `git config user.email`, with the existing Git-panel local author settings used as a fallback so terminal and UI workflows remain compatible. - Classified Git operations by effect: read-only inspection may run directly, local repository mutations remain explicit user commands, disruptive checkout/merge/branch deletion require confirmation, and clone/fetch/pull/push are network-confirmed. - Reused the existing `ai git` copilot over deterministic status/diff context for change summaries and commit-message suggestions; AI still cannot silently stage, commit, switch branches or push. - Added `ProjectHttpService`, a bounded browser-owned HTTP boundary using `fetch()` rather than a native curl process: HTTP(S) only, no URL-embedded credentials, ambient browser credentials omitted, cancellation/timeouts, response-size limits and normal browser CORS enforcement. - Added a controlled `curl` compatibility subset supporting GET/HEAD, explicit GET/POST/PUT/PATCH/DELETE methods, request headers, literal data, explicit `--data-binary @project-file`, response headers, timeout/size limits and `-o` project downloads. - HTTP downloads written with `curl -o` are registered as canonical TeXise research artifacts with HTTP provenance and appear in the existing Results surface; large/binary responses must be saved rather than flooding the terminal transcript. - Added credential hygiene for terminal AI context: Authorization-style header values and common token query parameters are redacted from bounded execution-history records. - Extended the structured Terminal AI capability registry with Git init/stage/branch/remote mutations while retaining fail-closed policy and explicit confirmation for network actions. # R14.28.6 Scientific Plot & Results Workspace - Added persistent research-artifact cards to the browser terminal. Newly generated Python/R outputs appear immediately after a run, and the Results panel reloads the workspace artifact index across terminal sessions. - Added native inline previews for generated PDF, SVG, PNG/JPEG and text results using canonical project bytes; artifacts can also be opened in the existing asset/editor route. - Added generator and provenance links on research artifacts, including runtime, generating source file, AI-approved dataset inputs and stable per-run identifiers. - Added read-only `artifact list` and `artifact inspect ` terminal commands so provenance remains available without invoking AI. - Added deterministic CSV/TSV-to-LaTeX table generation with escaping, bounded row/column insertion and explicit truncation confirmation; computed results are formatted without asking the language model to copy numeric values. - Added “Insert into manuscript” actions for generated plots and CSV/TSV result tables. Figures use the existing source-aware image insertion logic; tables insert deterministic LaTeX at the current LaTeX cursor or configured root document. - Manuscript insertion respects TeXise Track Changes: when enabled, figure/table insertion becomes a pending review change rather than silently mutating canonical source. - Generated-artifact previews and insertion continue to use canonical TeXise storage; no separate terminal/results filesystem was introduced. # R14.28.5 Dataset Intelligence + Scientific AI - Added `ProjectDatasetService` for deterministic browser-local CSV/TSV inspection before AI reasoning: row/column counts, inferred types, missing values, exact numeric mean/std/min/max, bounded quantiles, bounded top-value summaries, sample rows and malformed-row warnings. - Added a 64 MiB default dataset-inspection ceiling because the current canonical project-storage contract still performs whole-file reads; oversized datasets fail explicitly rather than being silently loaded into AI context. - Added the read-only terminal command `dataset inspect ` for trusted schema/statistics inspection without invoking an LLM. - Changed terminal AI so referenced CSV/TSV files are summarized through `dataset.inspect` instead of being directly inserted into model context. - Added `ai analyse ` / `ai analyze ` and `ai plot ` scientific workflows. A single project dataset is selected automatically when unambiguous. - Added runtime-aware scientific planning context so Gemma/BYOK sees registered Python/Pyodide and R/webR runtimes plus package availability without initializing either runtime. - Added validated scientific proposals containing runtime choice, rationale, reproducible `analysis/*.py` or `analysis/*.R` source, deterministic run command, expected `results/`/`figures/` outputs and assumptions/limitations. - Added proposal preflight that rejects model-generated network access, host/subprocess execution, destructive file operations and project path escapes before the proposal reaches the review UI. - Added terminal review UI for generated scientific scripts with explicit `Create script` and `Create & Run` actions; no script is written and no analysis executes until the user approves it. - Added explicit AI-tool approval checks for scientific script creation and execution, continuing the policy that models never receive an unrestricted shell. - Added runtime output allow-listing for approved AI runs: only proposal-declared new `results/`/`figures/` files synchronize back to the canonical project; unexpected new files are blocked, while the existing protection against unexpected overwrites/deletions remains in force. - Successful approved runs are still executed through `ProjectTerminalService`, so stdout/stderr and exit status enter terminal history and can immediately be passed to `ai explain` for interpretation of computed results. # R14.28.4 Scientific R / webR - Added the browser-only `@learnitive/r-browser` runtime adapter, pinned to webR 0.6.0 and loaded lazily. webR owns the R WebAssembly worker/channel, so opening TeXise or the terminal does not download R. - Registered R beside Python through the existing runtime-neutral `ProjectScientificRuntimeService`; both runtimes share the same canonical `/workspace` mirror, cancellation, artifact collection and overwrite protections. - Added terminal commands `R`, `R -e ...`, `Rscript analysis.R [args...]`, `webr info` and confirmed-network `webr install ` for the TeXise-certified Wasm package catalogue. - Added Rscript-style argument support for project scripts and captured R stdout/stderr, exit status, timing, R/webR version and loaded-package metadata. - Added base R scientific packages as installed metadata and an initial externally installable catalogue documented by webR (`Matrix`, `ggplot2`, `plotly`, `jsonlite`, `cli`). External R packages are installed only as precompiled WebAssembly binaries from the configured webR repository. - Added R plotting integration: explicit PDF/PNG/SVG outputs created under `/workspace` flow through the normal research-artifact collector, while plots produced on webR's captured canvas are materialized as PNG research artifacts under `figures/`. - Added R runtime lifecycle state to the terminal header next to Python and retained lazy loading, interrupt support and browser-local workspace isolation. - Extended scientific runtime sessions with an optional package-install contract and kept package installation behind the terminal network-confirmation policy. - R-created ordinary existing project files remain protected by the R14.28.2 synchronization policy: new research outputs and known generated artifacts synchronize automatically, while unexpected source/dataset/manuscript overwrites are blocked. # R14.28.3 Scientific Python / Pyodide - Added the browser-only `@learnitive/python-browser` runtime adapter, pinned to Pyodide 314.0.4 and loaded lazily in a dedicated module Web Worker so opening TeXise or the terminal does not download Python. - Registered scientific Python through the runtime-neutral `ProjectScientificRuntimeService` rather than giving the terminal or AI a direct Pyodide handle. - Added terminal commands `python`, `python3`, `python -c ...`, script execution under `/workspace`, and `pyodide info`; unknown/non-registered commands remain fail-closed. - Added lazy import-driven package loading via Pyodide `loadPackagesFromImports()` and registered NumPy, SciPy, pandas, Matplotlib and SymPy as the initial scientific package set. - Added worker-owned `/workspace` file operations used by the existing runtime mirror/artifact collector, preserving canonical TeXise storage as the source of truth. - Added stdout/stderr capture, exit codes, timing/runtime metadata and Ctrl+C interruption. SharedArrayBuffer/SIGINT is used when cross-origin isolation is available; otherwise TeXise hard-terminates and lazily reconstructs the Python worker. - Added safe generated-output synchronization: newly created plots/results are imported into the project and known generated artifacts may be refreshed, while unexpected modifications of ordinary existing project files remain blocked. - Refactored generated research-artifact persistence into a shared core helper so the terminal may depend on the scientific runtime without a circular service dependency. - Added Python runtime lifecycle status to the terminal header (`not-loaded`, `initializing`, `running`, `ready`, etc.). - Matplotlib is intended for file-backed research figures in this worker runtime (for example `savefig('figures/result.pdf')`); generated PDF/SVG/PNG files flow through the existing research-artifact pipeline. # R14.28.2 Scientific Runtime Foundation - Added the runtime-neutral `@learnitive/scientific-runtime` domain shared by upcoming Pyodide/Python, webR/R and WASI execution rather than coupling the research terminal to one language. - Added `RuntimeWorkerManager` with lazy per-workspace runtime creation, lifecycle state, reuse, cancellation/interrupt support, crash/error isolation and disposal. Concrete Python/R adapters remain worker-backed platform concerns in later releases. - Added shared scientific execution contracts for file/code runs, stdout/stderr, timing, plots, runtime metadata and an isolated `/workspace` filesystem port. - Added `RuntimePackageRegistry` so Python and R can expose package availability/install state through one application-owned contract without pretending every PyPI/CRAN package is browser-compatible. - Added `ProjectScientificRuntimeService` as the canonical scientific execution boundary and registered it with the TeXise core service container. - Added `RuntimeWorkspaceBridge`: canonical TeXise project files are mirrored into an isolated runtime workspace before execution, `.git`/runtime noise is excluded, and current whole-file storage reads are bounded with explicit skipped-file reporting until streaming project reads are implemented. - Added `RuntimeArtifactCollector`: newly created runtime outputs are synchronized back through `ProjectTerminalService.writeGeneratedFile()` so they immediately become canonical project files and research artifacts. - Hardened output synchronization: ordinary existing project files are never silently overwritten by a runtime; known generated artifacts may be refreshed and additional overwrite paths require an explicit caller-approved allowlist. Runtime deletions are reported but not propagated automatically. - Added shared artifact classification for figures/plots, datasets, tables, reports and other outputs, including plot paths reported directly by a runtime adapter. - Extended the structured Terminal AI registry with scientific environment/stop/create-script and artifact list/inspect capabilities while retaining fail-closed permission classification. - Added regression coverage for lazy runtime reuse, rejection of unregistered runtimes, runtime file-delta detection and scientific artifact classification. - No Pyodide or webR payload is downloaded in this release; R14.28.2 deliberately establishes the common worker/workspace/artifact boundary first. # R14.28.1 Terminal AI Copilot and Capability Hardening - Hardened the browser terminal capability classifier to fail closed: unregistered commands are now `unsupported` instead of inheriting local-compute permission. - Added explicit terminal execution origins (`user` / `ai`) and a central allow/confirm/deny policy so future agent tools cannot bypass the same capability boundary used by the terminal UI. - Added a separate structured Terminal AI tool registry (`workspace.readFile`, `dataset.inspect`, `scientific.run`, Git/LaTeX/write/network capabilities) so models never receive an unrestricted `executeAnything(command)` primitive; unknown tool names fail closed. - Added bounded service-side terminal execution records (cwd, command, exit code, duration, stdout/stderr tails) for deterministic `ai explain` and `ai fix` context without persisting large transcripts. - Added `isProjectReadableTextPath()` so TeXise AI/search may safely inspect LaTeX/Markdown plus scientific code/data text such as Python, R, C/C++, shell, CSV/TSV, JSON/YAML/TOML while keeping binary files opaque. - Added direct-AI and project-search size limits so large datasets are not silently loaded into model context; later scientific dataset inspection will use bounded summaries instead. - Exposed `ProjectAiService.generateConfigured()` for app-owned copilots while preserving the existing Local Gemma worker, cloud BYOK entitlement checks and Privacy Mode. - Added `ProjectTerminalAiService`, reusing the configured TeXise AI provider and deterministic terminal/project/Git context instead of creating another model runtime or unrestricted shell agent. - Added terminal AI commands: `ai "question"`, `ai explain`, `ai explain-last`, `ai fix`, `ai suggest`, `ai plan "task"`, and `ai git "question"`. R14.28.1 remains non-mutating: AI may inspect bounded read-only context and propose steps but cannot run compute/write/network actions. - Added explicit untrusted-data boundaries around terminal output, project source, Git content and search results to defend the terminal copilot against prompt injection in project data. - Added Terminal AI Off/Copilot/Assisted UI controls, Ctrl/Cmd+I entry, AI response cards, and one-click Explain/Fix affordances on terminal errors. Agent mode is intentionally deferred until scientific runtimes and tool contracts are mature. - Prepared the next scientific-runtime work by treating `.r` as first-class research text and keeping Python/R execution behind future worker-isolated runtime services rather than the terminal parser. # R14.28.0 Research Terminal Core - Added a capability-safe browser terminal rooted at `/workspace`; commands cannot escape into host `/etc`, `/home`, or machine filesystems. - Added the shared terminal command/parser and capability classification foundation for later local AI, Pyodide and WASI runtimes. - Added local file/search commands (`pwd`, `cd`, `ls`, `cat`, `head`, `tail`, `sed`, `wc`, `find`, `grep`, `mkdir`, `touch`, `cp`, `mv`, `rm`) with pipes, redirection and semicolon-separated statements. - Routed `tex`, `pdflatex`, `xelatex` and `lualatex` through the existing TeXise browser compiler instead of creating another compiler implementation. - Terminal file writes use TeXise storage services and loaded LaTeX files use the canonical `LatexSourceService`; destructive rename/delete operations are blocked while collaboration is active. - Added generic CodeMirror editing for Python, C/C++, shell, CSV/TSV, JSON/JSONL, YAML and TOML files while keeping Markdown and LaTeX on their existing first-class editors. - Added generated-research-artifact metadata and `writeGeneratedFile()` as the future synchronization boundary for Python plots/results and WASI outputs. - Added an interactive terminal drawer with command history, Ctrl+C cancellation, destructive-command confirmation and clickable file/line output. ## R14.27.2 Review History and Local Snapshots - Adds a persistent review activity log for comments, replies, resolutions, tracked changes, AI-authored proposals and review snapshots without writing history metadata into `.tex`. - Migrates existing R14.27.0/1 review threads into an initial activity history so upgrades do not start with an empty History view. - Adds Review → History filters for author, file, event/change type and `Changes since…` baselines: Yesterday, last Git commit, last local snapshot, selected Git commit or selected date. - Reuses `NoteSnapshotService` for explicit manual snapshots and automatic checkpoints before bulk review acceptance or individual AI-review acceptance; ordinary autosave snapshot throttling remains unchanged. - Mirrors review activity to a separate Yjs `review-activity` map while collaborating, alongside but distinct from `review-threads` and canonical source `Y.Text`. - Keeps Git as clean source history: review activity remains browser-local/Yjs metadata while the History panel exposes the current Git branch/change summary as context. - Adds service and browser regression coverage for retained activity after deletion, one proposal event across continued typing, bulk/AI checkpoints and clean canonical LaTeX. ## R14.27.1 Full Dual-Mode Track Changes - Adds a shared `ReviewChange` model for insert/delete/replace proposals persisted outside canonical `.tex` alongside the existing review threads. - Adds a transient review projection so Source and Visual render the same pending changes while canonical LaTeX remains authoritative and clean. - Tracks Source typing/deletion/replacement and Visual prose/heading/list/structure edits through the same projected-edit service. - Adds semantic review presentation for equations, tables, figures and citations where source mapping is known, with source-only review cards for raw TeX that cannot be rendered safely. - Adds one shared accept/reject engine; accepting performs a single revision-aware canonical `review` mutation and rejecting leaves canonical source unchanged. - Adds inline CodeMirror and Visual change decorations, discussion threads, previous/next navigation and Source-only Visual review cards. - Adds bulk Accept/Reject selected, file-wide, author-wide and confirmed project-wide review actions. - Keeps Track Changes active across Source↔Visual switches and prevents direct canonical undo/redo from bypassing pending review state. - Converts compatible AI replace-file proposals into the same `ReviewChange` infrastructure while Track Changes is enabled. - Keeps collaboration review state in the separate Yjs `review-threads` map; no proprietary review markup is written into source. - Adds R14.27.1 service and browser regressions for Source→Visual accept, Visual→Source reject, clean canonical source and shared review identity. ## R14.27.0 Dual-Mode Comments - Adds a shared browser-local review repository for comments/suggestions/future Track Changes without writing proprietary markup into `.tex`. - Supports source-range, Source cursor/point, Visual semantic-object, document and project comments through shared `SourceAnchor` records. - Adds CodeMirror review highlights/point bubbles and Visual review projections that open the same canonical review thread. - Adds a Review sidebar with Open/Resolved/All views, current-file/mine/outdated filters, replies, edit/delete-own, resolve and reopen actions. - Persists review threads in IndexedDB using a stable workspace review identity; review metadata is outside project files and ZIPs. - Mirrors review threads to a dedicated Yjs `review-threads` map while collaboration is active, separate from canonical source `Y.Text`. - Recovers anchors conservatively and marks ambiguous comments outdated rather than silently reattaching them. - Adds a local review display name and labels the review model with author kind for future AI suggestions. - Adds R14.27.0 service and browser regressions for clean canonical LaTeX, Source/Visual parity, point comments, resolve/reopen and persistence. ## R14.26.3 Paper Memory PM9 Hardening and Final Certification - Finalizes Paper Memory PM1-PM9 as R14.26.3 without changing the local-first project/storage boundary. - Adds browser capability reporting for IndexedDB, OPFS, Workers, storage estimates and persistent-storage support, with explicit persistence requests rather than assuming browser storage cannot be evicted. - Refuses to silently reset unknown/future Paper Memory manifest schemas, preventing locally stored research libraries from being orphaned by an incompatible build. - Validates committed extractor/chunker/schema/page-provenance generations on reopen and marks incompatible indexes Re-index required while preserving the locally stored source PDF. - Adds development-only retrieval diagnostics (query, considered papers, lexical/semantic/final scores and load/embed/rank/total timings) behind DEV + `?paperMemoryDebug=1`; production UI does not expose the debugger. - Adds explicit Release AI memory to unload Paper Memory embedding tensors and shared local Gemma runtime state without deleting cached models or paper indexes. - Extends security tests for bounded untrusted evidence, fake source rejection and strict application-owned PDF page provenance. - Adds a 30-paper bounded diversity regression and PM9 browser regression for local persistence/capability status with zero implicit model/cloud requests. ## R14.26.3 PM8 Paper Memory BibTeX and Citation Integration (checkpoint) - Resolves Paper Memory papers against existing project bibliography entries by DOI, arXiv/stable ID, then normalized title + first author + year before creating anything new. - Reuses existing citation keys and deduplicates selected Paper Memory works so the same paper cannot create duplicate BibTeX entries or duplicate keys in one `\cite{...}` command. - Adds inline metadata review for incomplete local PDF metadata; TeXise refuses to fabricate title/authors/year and persists researcher-reviewed metadata only after successful bibliography/citation actions. - Reuses the existing bibliography package's safe BibTeX constructor/citation-key generator rather than formatting provider/PDF metadata in React. - Allows a target `.bib` file to be selected and creates `references.bib` when the project has no bibliography yet. - Adds Add to bibliography and Insert citations actions to PM7 citation candidates. Bibliography mutations and manuscript insertion use canonical `LatexSourceService` edits. - Inserts one undoable canonical `\cite{...}` at the revalidated SourceAnchor so the result is identical in Source and Visual modes. - Rolls back newly appended/created bibliography entries when manuscript citation insertion fails or the source anchor becomes stale. - Adds service and production E2E coverage for existing-key reuse, incomplete-metadata review, bibliography creation and canonical citation insertion. ## R14.26.3 PM7 Paper Memory Manuscript Integration (checkpoint) - Connects selected manuscript text from both Source/Code and Visual modes to one canonical `SourceAnchor`-backed Paper Memory workflow. - CodeMirror selections capture exact canonical offsets/revisions; Visual ProseMirror selections are mapped through the existing source projection to the same canonical LaTeX ranges. - Adds contextual actions for Find supporting papers, Find contradicting papers, Find citation and Explain using Paper Memory. - Re-resolves the selected `SourceAnchor` against current canonical LaTeX before retrieval and rejects stale/ambiguous selections instead of silently querying the wrong text. - Opens the existing AI shell directly on Paper Memory for contextual actions; no separate manuscript/PDF chatbot or competing editor state is introduced. - `Find citation` is retrieval-only and remains useful without generative Gemma; supporting/contradicting/explain reuse PM6 grounded local RAG. - Adds a selected-manuscript context card in Paper Memory with All/Selected paper scope while deliberately leaving bibliography mutation/citation insertion to PM8. - Adds service and production E2E coverage for canonical anchor validation plus symmetric Source and Visual selection workflows. ## R14.26.3 PM6 Paper Memory Grounded Local RAG (checkpoint) - Adds browser-local grounded Paper Memory answers on top of PM5 lexical/semantic retrieval without introducing a second AI stack. - Reuses the selected local Gemma Worker/GPU lifecycle through a local-only ProjectAiService generation API that can never fall through to cloud BYOK. - Assigns immutable in-run `[S#]` evidence IDs from TeXise-owned paper/chunk/page metadata and validates every model citation against that registry. - Keeps real PDF page numbers out of the model prompt; Gemma cites source IDs and TeXise renders page provenance from trusted application metadata. - Treats PDF text/metadata/captions as explicitly untrusted evidence so prompt-injection text inside a paper cannot become an instruction. - Adds one citation-repair pass, rejects fabricated source IDs, and refuses to present an uncited synthesis as grounded. - Handles insufficient retrieval evidence cautiously and does not load generative Gemma at all when no useful evidence was retrieved. - Adds streamed local answers, cancellation, All/Selected paper scoping and clickable paper/page source cards inside the existing Paper Memory panel. - PM7 manuscript-selection integration and PM8 BibTeX/citation insertion remain intentionally deferred to their dedicated checkpoints. ## R14.26.3 PM5 Paper Memory Hybrid Retrieval (checkpoint) - Reuses the existing browser-local EmbeddingGemma runtime for Paper Memory without coupling it to generative Gemma. - Adds explicit model download + post-PM3 embedding generation without re-extracting PDFs. - Persists compact binary Float32 vectors and a scientific-token lexical index with each atomic paper generation. - Adds lexical-only search when no embedding model is installed and hybrid lexical + semantic search when vectors are available. - Applies selected-paper filters before ranking and adds comparison-query cross-paper diversity caps. - Preserves exact scientific terms such as AdamW, beta_2/β_2, 10^-4, CLIP, ResNet-50 and ImageNet-1K. - Adds Paper Memory search UI with All/Selected scopes and page-provenant result cards. - PM6 grounded local Gemma answers are intentionally not claimed in this checkpoint. ## R14.26.3 PM3 Paper Memory Foundation (checkpoint) - Adds a dedicated `paper-memory` domain and `ProjectPaperMemoryService` instead of overloading `ProjectAiService`. - Adds a project-scoped browser-local Paper Memory identity in workspace metadata while storing PDFs/indexes outside NativeFS project folders and ordinary project ZIPs. - Stores source PDFs OPFS-first under the versioned `texise-paper-memory/v1` namespace with IndexedDB fallback, and fingerprints actual PDF bytes with SHA-256 to prevent duplicate re-indexing. - Reuses PDF.js in a dedicated index Worker to extract page text/coordinates/metadata without blocking CodeMirror or Visual mode. - Reconstructs scientific structure conservatively (headings, abstract, paragraphs, equation context, figure/table captions, theorem-like blocks and references) and chunks by semantic blocks rather than fixed character slicing. - Makes real PDF `pageStart`/`pageEnd` provenance mandatory on every searchable passage and version-tags extractor/chunker/index generations. - Detects multi-page scanned/image-only PDFs and marks them `ocr-required` instead of creating an empty ready index; local OCR remains a future capability. - Uses atomic active-index generations and cancellation/reopen recovery so an interrupted re-index cannot replace a previously valid generation. - Adds the first real Paper Memory panel for adding/opening/re-indexing/removing PDFs, granular local indexing status, duplicate warnings, cancellation, clearing and local storage reporting. - Adds pure/fake engine tests plus a browser E2E journey for local PDF persistence, duplicate detection and zero cloud/model requests. PM4 embeddings, PM5 hybrid search and PM6 grounded Gemma answers remain deliberately deferred. ## R14.26.2 Local Project RAG - Adds a pure `project-rag` domain for hybrid deterministic/lexical/EmbeddingGemma retrieval without coupling embeddings to local generation. - Extends Project Tools with trusted project-evidence retrieval that preserves exact source ranges and `SourceAnchor`s, using parser-backed symbol search and lexical scientific-token matching before semantic ranking. - Adds deterministic `search_text` and hybrid `retrieve_project_evidence` AI tools so exact refs/citations/symbols avoid embeddings while conceptual questions can use Meaning retrieval. - Adds an in-run trusted evidence registry: TeXise assigns `[S#]` IDs, treats retrieved project text as untrusted evidence, sanitizes fabricated source IDs and requires source-cited final answers after RAG retrieval. - Adds clickable AI project-evidence cards rendered from TeXise metadata; persisted anchors are conservatively re-resolved before navigation and ambiguous stale evidence is rejected. - Adds lexical fallback when EmbeddingGemma is unavailable, explicit insufficient-evidence signaling, and bounded evidence excerpts so local Gemma receives relevant passages rather than whole-project dumps. - Adds domain tests and production E2E coverage for scientific exact-token ranking, fake-source rejection, browser-local evidence rendering and zero network activity when merely reopening grounded history. ## R14.26.1 Private Project Intelligence - Adds a generation-independent `EmbeddingEngine` / `EmbeddingPlatform` abstraction backed by browser-local EmbeddingGemma retrieval embeddings. - Adds an explicit, cancelable EmbeddingGemma model install flow using a long-lived Worker with WebGPU acceleration and WASM fallback; opening Meaning search never silently downloads the runtime or model. - Reuses the existing deterministic semantic projection to index headings, prose, theorem/equation context, figures, tables, lists, source blocks and bibliography without introducing a second LaTeX parser. - Adds content-hashed incremental indexing with vector reuse by unchanged content, so ordinary source-offset shifts do not force unchanged thesis passages to re-embed. - Persists compact contiguous Float32 vectors in a project-scoped browser IndexedDB namespace keyed by stable browser workspace metadata, never in NativeFS/project files or project ZIPs. - Adds Project Tools → Meaning beside Text and Symbols, with clickable project locations, explicit model/index controls and privacy/capability state. - Pins the ONNX model revision and index schema/model metadata so model changes deliberately invalidate embeddings rather than silently mixing vector generations. - Keeps exact symbol/reference/citation searches deterministic and reserves embeddings for semantic questions such as where a concept is discussed. - Adds fake/domain regression coverage and production E2E coverage proving Meaning status inspection performs no model/runtime network fetch before explicit download. ## R14.26.0 Local AI Foundation - Makes the TeXise AI shell available to Free users across Source, Visual and PDF/full-preview workspace surfaces; cloud BYOK providers remain Pro-gated. - Adds replaceable `LocalGenerationEngine` / `LocalAiPlatform` contracts and keeps the existing review-before-apply `ProjectAiService` as the canonical AI orchestration layer. - Adds browser-local Gemma support through a long-lived Web Worker using Google LiteRT-LM, with WebGPU/OPFS capability detection and Gemma 4 E2B/E4B web model choices. - Makes model installation explicit, progressive, cancelable and OPFS-cached; partial downloads are purged and model assets are never written into project/NativeFS storage. - Separates local privacy from cloud BYOK: Privacy Mode blocks cloud document/project context, while local prompts, project context and generated responses stay in-browser. - Adds model download/remove/reload controls, cache state, auto-explain preference (off by default), and accurate model/runtime network-activity wording. - Adds the `Chat | Paper Memory` shell now, while leaving PDF ingestion/embeddings/grounded paper evidence disabled until the dedicated Paper Memory phase rather than pretending the feature exists. - Adds production E2E/static regression coverage proving the Free launcher is visible and opening AI does not silently download runtime/model assets. ## R14.25.1 Intelligent Citation and Research Assistance - Adds provider-backed research workflows for supporting, contradicting, seminal, recent, original-source and related-paper discovery, with deterministic ranking and explicit full-text verification warnings for claim relationships. - Extends the semantic citation checker with duplicate DOI/work detection, DOI metadata conflicts, unresolved keys and conservative probable-renamed-key diagnostics. - Adds an explicit, user-triggered missing-DOI lookup workflow; high-confidence matches are reviewed before the DOI is inserted through canonical bibliography source mutations. - Upgrades the browser-local literature shortlist to Candidate / Included / Excluded states with notes, tags and reasons, including migration from the R14.25.0 shortlist format. - Adds source-anchored Research Review findings to Project Tools for potential citation gaps and figure/table metadata/accessibility review without silently rewriting the manuscript. - Preserves the scientific-trust boundary: provider metadata can identify candidate literature, but TeXise does not claim that metadata alone proves support, contradiction or absence from a paper. - Adds unit, semantic-index and production E2E coverage for the research-assistance, citation-audit, DOI-review, shortlist and Research Review workflows. ## R14.25.0 Research and Bibliography Workspace - Added a provider-neutral `ReferenceProvider`/`ReferenceRecord` domain with Local bibliography, Zotero, OpenAlex, Crossref and Semantic Scholar adapters. - Added DOI → arXiv/stable ID → normalized title/first-author/year deduplication and visible metadata-conflict warnings. - Reworked the citation dialog into one research/reference workspace with Search, Suggested, My Zotero and Local bibliography tabs. - Added provider/year/author/type/open-access/DOI/sort filters, citation counts where available, target `.bib` selection, bulk add and browser-local shortlist actions. - Added canonical `.bib` entry construction/insertion with existing-key reuse; provider metadata is normalized before it reaches project source. - Zotero/API credentials stay in browser-local settings and are excluded from project files/ZIPs; external searches send only the explicit query/filters to selected providers. - Added provider normalization/unit coverage and a production E2E workflow for search → dedupe → Add & Cite → canonical bibliography update. ## R14.24.1 Certification and Performance Hardening - Records performance telemetry for real browser compiles: runtime initialization, package fetch, bibliography, engine compile, PDF-ready and total timing, plus warm-runtime and fetched-package state. - Removes SwiftLaTeX hidden self-test compilation and prevents capability/settings reads from initializing or compiling the browser runtime. - Validates and purges poisoned cached TeX packages before they can be mounted into BusyTeX or returned by the SwiftLaTeX service worker. - Adds compiler-matrix certification for pdfLaTeX Fast/Full+SyncTeX, XeLaTeX, LuaLaTeX, BibTeX/Biber, bundled packages, validated remote packages and offline cached packages. - Adds desktop WebKit/Safari-equivalent release coverage and extends mobile certification through compile → PDF → Log → editor. - Certifies PDF page/zoom/fit/output-tab retention across real recompiles without adding hidden user-path test compiles. ## R14.24.0 Professional Editor Workflows - Adds stable revision-aware `SourceAnchor` capture/recovery for search, diagnostics, future review, AI and Paper Memory integrations. - Promotes Project Tools into Text/Symbol workflows with scoped project search, regex/word/case filters, globs, grouped previews and checkpointed replace-one/selected/all operations. - Expands the semantic Navigator to Outline, Labels, References, Citations and Bibliography with unresolved/duplicate warnings and precise source navigation. - Makes compiler diagnostics first-class clickable source locations and exposes generated compile artifacts separately from authored project files. - Extends the existing command registry with Compile, current/project search, Quick File, Command Palette, Source/Visual, PDF focus and Navigator commands without redefining Cmd/Ctrl+S. - Preserves PDF page, scroll position, zoom/fit mode and PDF/Log tab per workspace across recompiles/reopen. - Extends conservative Visual table/figure inspectors with row/column movement, alignment, CSV/TSV replacement, graphics sizing/scaling/aspect/centering/placement and existing accessibility-description editing. - Adds explicit pre-bulk local recovery checkpoints and release coverage for professional editor workflows. ## R14.23.5 Project Home Cleanup - Keeps **New File** as the primary workspace-home action and places a compact vertical Project menu immediately beside it. - Moves project import, ZIP download, Storage and Project settings into the Project menu while removing permanent browser-storage telemetry from the home page. - Reuses the existing project ZIP/storage services, collaboration flush, import limits and Firefox download fallback rather than introducing a second archive path. - Adds an on-demand Project storage dialog for local-folder/browser persistence, approximate browser usage, persistent-storage requests and last ZIP backup information. - Uses concise success feedback: **Project imported** and **Project ZIP downloaded**. - Adds focused Playwright coverage for the menu, Storage dialog, settings navigation and project ZIP workflow. ## R14.23.4 Desktop Divider, Mobile Toolbar and Status Polish - Migrates the editor/PDF split preference to `texise:editor-pdf-split:v2`, ignores legacy v1 values, starts at a genuine 60/40 when v2 is absent, and persists only committed user resize/reset actions. - Keeps the existing 30–80% drag/keyboard/reset mechanics while adding real drag state, corrected editor/PDF ARIA text, a transparent ~24px hit target and an ~8px primary-tinted visual spine. - Standardizes pointer and disabled cursors through shared button/dropdown/select primitives and native button defaults. - Makes Collaborate icon-only on mobile, shortens Project Tools to Tools on mobile through translations, and adds an accessible neutral/compiling/success/failure status dot beside Log. - Adds focused Playwright regression coverage for split migration/persistence/limits, mobile labels, cursor states and compile status. ## R14.23.3 Visual Interaction Polish - Restores Bangle-style hover-first Visual block handles using coordinate probing and a stable gutter-to-handle hover corridor. - Raises figure/table metadata dialogs above Visual media overlays and adds figure placement plus label creation. - Collapses new display-math insertion UI to Inline + Equation while preserving existing display LaTeX losslessly. - Adds source-backed simple-table row/column structure controls and editable reference chips with explicit target navigation. - Adds Edge/Chromium/Firefox regression coverage for the Phase 3 interaction workflow. ## R14.23.2 Natural Visual Editing Semantics - Makes Enter in Visual paragraphs split canonical LaTeX paragraphs and keeps an empty trailing paragraph as a transient Visual caret anchor until the user types. - Makes Enter in itemize/enumerate create a new `\item`; Enter on the resulting empty item exits the list into a new Visual paragraph. - Makes Shift+Enter insert canonical `\newline` without creating a paragraph, including a transient inline caret anchor when the break is at the end of a block. - Projects both existing `\newline` and `\\` source syntax as first-class Visual hard breaks while preserving their original source spelling. - Adds unit and Edge/Chromium/Firefox browser regression coverage for paragraph/list/hard-break round trips through canonical `.tex`. ## R14.23.1 Mobile PDF Reliability - Makes PDF canvas rendering authoritative so PDF.js text-layer or text-extraction failures can never replace an otherwise valid compiled page with the fatal red render overlay. - Falls back from the native PDF.js TextLayer to TeXise's lightweight compatibility text layer; if text rendering still fails, keeps a canvas-only page with a non-blocking warning. - Adds explicit per-page canvas/text-layer status attributes for runtime diagnostics and regression testing. - Adds targeted mobile Chromium and WebKit/iPhone Playwright certification without rerunning the entire desktop editor suite on mobile. ## R14.23.0 Compiler, Biber and Package Resolver Stabilization - Upgrades the full browser compiler profile to TeXlyre BusyTeX 1.4.0 and its TeX Live 2026 package endpoint. - Uses BusyTeX high-level PdfLaTeX/XeLaTeX/LuaLaTeX APIs instead of the fragile positional runner compile API. - Enables browser-side Biber for biblatex projects and prevents SwiftLaTeX fallback for Biber workflows. - Rejects and purges HTML/empty responses masquerading as remotely fetched TeX package files; remote package cache schema is bumped. - Migrates only TeXise-owned legacy BusyTeX 1.3.1 / retired endpoint defaults in existing /etc/texise/texise.env files while preserving administrator overrides. ## R14.22.8 Release Lint Hotfix - Fix the MathLive drag-modal layout effect so symbol-panel expansion is a real dependency and the expanded modal is re-clamped after layout. - Add accessible titles to the decorative editor/PDF split-handle SVGs to satisfy the production Biome accessibility gate. - Make the mobile output reset explicitly track workspace transitions instead of using an effect-only trigger dependency. - No compiler policy, document format, or editor data-flow changes. ## R14.22.7 TypeScript Build Hotfix - Fix MathLive drag pointer handlers to use the actual button element type under React 19 / TS native-preview strict DOM typing. - Fix the browser LaTeX compile E2E setup so the PDF preview locator is declared before first use. - No runtime behavior or compiler policy changes. ## R14.22.6 File/Source Polish + Integrated Certification - Make LaTeX Source use compact `pl-2 md:pl-2` padding without changing Bangle Markdown gutters. - Add file-tree **Download source** for editable TeXise text files, preferring live canonical source snapshots over stale storage. - Add a compact compiler/mode indicator and explicit SyncTeX state metadata/tooltips. - Extend the Edge/Chromium/Firefox release matrix with the Phase 7 polish regression while retaining the existing 100-switch and integrated SyncTeX journeys. ## R14.22.5 Resizable Desktop + Mobile Workspace - Replaces the fixed editor/PDF widths with a persisted 60/40 desktop split and the supplied bidirectional middle resizer, clamped to 30–80%, keyboard adjustable, and double-click resettable. - Keeps Source/Visual and PDF components mounted while resizing or switching mobile panes so caret, history, PDF zoom/page and editor state survive layout changes. - Makes mobile LaTeX editing single-pane: compile opens output, success selects PDF, failure selects Log, and a close button returns to the existing editor instance. - Adds a mobile Preview action that reopens the last successful PDF without recompiling. - Adds release-browser coverage for desktop drag/persistence/reset/keyboard resizing and mobile editor → output → editor continuity. ## R14.22.4 Compile / PDF / Log Workflow - Top-bar Play compiles immediately; compiler configuration moved behind a Settings cog. - Removed the legacy Bangle wide-editor ChevronsRightLeft control from the top bar. - Added PDF/Log output tabs with automatic success/failure routing. - Added PDF download plus compiler-log copy/download controls while preserving the last successful PDF after failures. ## R14.22.3 MathLive UX Repair - Restores MathLive's native menu for editable equation fields while keeping preview menus hidden. - Adds a mouse/pen friendly draggable, viewport-clamped equation editor with resize re-clamping. - Collapses the Source math toolbar to one Sigma entry with Inline, Display and Equation insertion modes inside the shared MathLive editor. - Adds browser regression coverage for native menu-toggle interaction, modal dragging and equation-environment insertion. ## R14.22.2 SyncTeX Compile Modes + Source/PDF Mapping Repair - Makes **Full / SyncTeX** the default pdfLaTeX mode and routes it through BusyTeX so successful full builds can carry the PDF and SyncTeX map from the same compile. - Adds **Fast Preview** as an explicit project setting that keeps SwiftLaTeX's faster pdfLaTeX startup while clearly disabling SyncTeX. - Adds deployment capability metadata for SyncTeX and refuses silent BusyTeX -> SwiftLaTeX fallback during Full / SyncTeX compilation. - Keeps failed compiles from replacing the last successful PDF/map pair and explains why source mapping is unavailable after a Fast Preview build. - Adds release-browser coverage for Full -> Fast -> Full mode switching and stale-map rejection. ## R14.22.1 File Bookmarks + BusyTeX Runtime Repair - Completed the Bangle-to-TeXise star migration so the top-bar **Star this item** action persists arbitrary project files through the file-aware workspace path model, including LaTeX/BibTeX/style/class files and rename/move relocation. - Tightened BusyTeX provisioning and compiler capability generation around the complete version-matched module/worker/pipeline/WASM/basic/recommended asset set, with a SHA-256 deployment fingerprint. - Added deployed-origin HEAD preflight and fingerprinted runtime imports before XeLaTeX/LuaLaTeX initialization, preserving the actual runtime/asset error instead of collapsing failures into a generic unavailable message. - Aligned XeLaTeX/LuaLaTeX initialization with the Texlyre BusyTeX model by preloading the recommended TeX Live bundle; worker initialization falls back to main-thread mode only on runtime failure. - Revalidated stable BusyTeX URLs instead of caching them immutable forever, preventing JS/worker/WASM/data mixtures across compiler asset versions. - Added formal deployed-browser coverage for the complete BusyTeX asset surface, real XeLaTeX/LuaLaTeX compilation, and persistent top-bar file starring. - Kept ordinary pdfLaTeX on SwiftLaTeX and removed hidden BusyTeX self-test compilation from the user compile path so Phase 2 does not reintroduce the earlier compile-latency regression. ## R14.22.0 Visual Editor Core Repair - Replaced the frozen whole-document Visual transaction guard with a current-state source-map-safe transaction contract. - Normal ProseMirror typing/deletion is allowed in source-backed paragraphs, headings, list text, safe table cells and editable theorem bodies while protected/raw LaTeX, citations/references, figures and MathLive atoms remain immutable. - Removed isolating boundaries from editable text-bearing Visual nodes so mouse/caret/selection behavior follows normal ProseMirror editing semantics. - Added browser coverage using native mouse/keyboard typing, deletion, list/table edits, slash invocation and ProseMirror surface-stability checks. - `.tex` remains canonical; Visual edits still commit through `LatexDocumentController` exact edits. ## R14.21.8 Deployment Speed + Remaining Runtime Fixes - Fixed TeX file cloning to use the active file path rather than the Markdown-only current-note atom. - Fixed project-wide label/citation/file refactors so unopened project files are edited through ProjectStorage while loaded files stay on canonical LatexSource state. - Fixed CodeMirror wrapped-selection stability and DOM spellcheck assertions. - Fixed local CI execution under tsx by removing top-level await from the CLI entry point. - Aligned directory tests with canonical trailing-slash ProjectDirectoryPath values. - Added a persistent BusyTeX cache under `/var/cache/texise/compiler` so upgrades do not re-download/extract the 524 MB compiler runtime when the compiler version is unchanged. - Restored SwiftLaTeX as the preferred pdfLaTeX backend in full deployments; BusyTeX stays available lazily for XeLaTeX/LuaLaTeX so ordinary PDF compiles avoid the heavier BusyTeX startup. - Separated normal install/upgrade from formal release certification: deployments keep lint/type/compiler/static/build checks, while `TEXISE_DEPLOY_CERTIFY=1` or `pnpm run release:quality` runs the full unit + Edge/Chromium/Firefox certification matrix. ## R14.21.7 Full Vitest Runtime Cleanup Hotfix - Made `ProjectEntitlementService` safe to mount in Node/Vitest without browser globals while preserving online refresh behaviour in browsers. - Removed Bun from local-CI package scripts and integration-test spawning; the pinned `tsx`/Node toolchain now runs those checks. - Restored the truncated browser-entry startup test suite. - Hardened the shared Vitest `File` polyfill for string, Blob, ArrayBuffer and typed-array cloning/content reads. - Fixed CodeMirror wrapper selection preservation, duplicate Visual list canonical edits, and undefined-reference/citation compiler diagnostic codes. - Updated stale workspace/project UI tests to the current TeXise file-first terminology, real-directory storage contract and current table test IDs. - Added R14.21.7 hardening coverage so these release-test regressions cannot silently return. ## R14.21.6 Biome Release-Gate Cleanup Hotfix - Fix the first-party Biome lint failures surfaced after the TypeScript gate became clean, including stable React keys, hook dependency contracts, accessibility, parser loop assignments, project path validation, and CodeMirror search state updates. - Keep Source and Visual editor instances stable while satisfying hook analysis by using live refs/callbacks instead of adding preference/document text dependencies that would recreate editors during normal updates. - Exclude immutable generated SwiftLaTeX compiler assets from first-party linting and stop production certification from failing on source formatting/import-order concerns by using `biome lint` for the release gate; `biome check` remains available for developer formatting/organization work. - Disable the unstable nursery Tailwind class sorting rule as a production blocker; styling order does not affect runtime correctness and remains available for optional developer cleanup. ## R14.21.5 TypeScript 7 Strictness Hotfix - Fixed all 51 `tsgo` errors reported by the production R14.21.3 release gate across editor, storage, collaboration, entitlement, PDF, tests, and signaling code. - Preserved bibliography entry extensions through generic search results and enforced validated branded project paths at storage/navigation boundaries. - Updated React 19 refs, DOM/PDF cancellation handling, application error payloads, strict regexp/array indexing, and WebCrypto ArrayBuffer inputs for the pinned TypeScript native-preview compiler. - Added typed collaboration signaling coverage to the root composite project with a pinned direct `@types/ws` dependency. - Added a dependency-free R14.21.5 strictness regression gate so the reported error classes are checked before runtime certification. ## R14.21.3 Public Package Barrel Validation Hotfix - Replace wildcard exports in the LaTeX compiler/source, project assets, Git, and project storage public barrels with explicit named value/type exports while preserving the exact public package API. - Add a dependency-free public-barrel verifier and run it before dependency installation and release certification, matching the workspace `custom-validation` contract. - Prevent production installs from reaching TypeScript/Biome validation only to fail on public `export *` barrels. ## R14.21.2 Workspace Dependency Validation Hotfix - Align `@codemirror/state` on `^6.5.2` across `latex-codemirror` and `project-collaboration`; both resolve to 6.5.4 under the pinned lockfile. - Add a dependency-free workspace dependency-version verifier so custom validation drift is caught before install/build/compiler provisioning. - Run lint/type validation before downloading BusyTeX compiler assets during `release:quality`. ## R14.21.1 Frozen Lockfile Hotfix - Synchronized the `packages/js-lib/latex-codemirror` pnpm-lock importer with its new `@learnitive/latex-mathlive` and `@learnitive/latex-source` workspace dependencies so production `pnpm install --frozen-lockfile` succeeds. - Added a dependency-free package/lock importer consistency verifier and wired it into release hardening/static validation to prevent this packaging regression from recurring. - Bumped the production release identity and app-shell cache generation to distinguish the corrected archive from R14.21. ## R14.21 Production Runtime Certification & Deployment Hardening - Added a dependency-free runtime preflight and hardening test layer that runs from the source archive before dependency installation. - Removed Bun and Git-worktree requirements from the release-critical workspace validation/unit-test path; release certification is now Node 22 + pinned pnpm/Corepack based. - Hardened release/E2E pnpm child-process resolution for Corepack-backed installations and records command/startup failures precisely in `release-quality-report.json`. - Default `full` production installs/upgrades now run the complete Edge + Chromium + Firefox `release:quality` matrix before activation and require a matching `dist/release/certification.json`. - Deployment health checks now reject mismatched frontend/API/certification release identities, and `release:deployment-smoke` verifies production headers, runtime certification, all three browser projects, and pdfLaTeX/XeLaTeX/LuaLaTeX availability. - Reduced `pdflatex` deployments remain buildable but are explicitly not allowed to claim the full three-engine production-browser certification. ## R14.20 Integrated Editor Certification - Added a branded Microsoft Edge Playwright release project and made `release:quality` certify Microsoft Edge, Chromium, and Firefox together. - Added a dedicated R14.20 production-browser certification suite covering 100 complete `main.tex → chapter.tex → style.sty → refs.bib → main.tex` cycles, passive Source-caret stability, soft-wrap same-EditorView behavior, and the required Source/Visual command matrix. - Closed the remaining shared-command parity gap by adding source-backed Visual `Label` insertion through the common `LatexEditorCommand` registry and slash/left+ command model. - Kept the full-engine pdfLaTeX/XeLaTeX/LuaLaTeX, PDF.js text/search, SyncTeX, passive scroll-sync, unified MathLive, ZIP portability, and earlier integrated editor journeys inside the same release runner. - Release certification metadata is emitted only after the full production build and all three browser projects pass; the static contract audit remains explicitly non-browser validation. ## R14.19 Texlyre Editor Feature Parity - Added Texlyre-derived project-aware Source completions for citations, labels/references and project file paths while retaining TeXise's LaTeX command/environment completion. - Added Ctrl/Cmd-click Source navigation for references, citations and project file commands through TeXise navigation and explicit source-selection semantics. - Added Texlyre-style paste interception for project image/PDF assets, reusing TeXise's existing canonical asset import/insertion flow. - Added Texlyre SearchHighlightExtension-style external highlights alongside CodeMirror's existing search/search-replace UI. - Added live Compartment-backed line-number, font-size and spellcheck preferences; settings persist in browser storage without recreating the EditorView. - Added persistent plugin-toolbar show/hide and browser fullscreen Source editing. Existing syntax highlighting, bracket matching, folding, close brackets, search/replace, MathLive, table toolbar and soft wrap remain on the migrated Texlyre foundation. - Added R14.19 unit/browser regression coverage for project completions, link detection, same-view preference reconfiguration, persisted toolbar/settings and fullscreen lifecycle. ## R14.18 Controller-backed Visual & Unified Texlyre MathLive - Moved LaTeX Visual mode onto the R14.17 `LatexDocumentController`; Visual no longer starts an independent source load/subscription lifecycle or owns a separately synchronized document. - Added revision-guarded `applyExactEdit`/`applyExactEdits` controller contracts used by Source, Visual and MathLive, rejecting inactive or stale projections instead of overwriting a newer canonical revision. - Replaced Visual whole-source commits with minimal canonical source splices while retaining source-backed ProseMirror projections and protected Raw LaTeX islands. - Ported/adapted Texlyre's MathDetector/MathLive region semantics into one shared LaTeX math model for Source and Visual, including inline/display delimiters, equation/alignment/matrix families, row-level alignment editing and delimiter/whitespace preservation. - Added a Texlyre-derived CodeMirror MathLive hover/cursor preview adapter; Source and Visual both open the same Apply/Cancel MathLive editor and exact-source replacement service. - Kept Texlyre-compatible `contentStart`/`contentEnd`, delimiter, whitespace and replacement metadata in the shared math-region model; Source **Equation** and Visual `/equation` now both create a real `equation` environment before opening MathLive. - Expanded the shared MathLive editor with Texlyre-style searchable symbols and a local MathLive error boundary/fallback so math failures cannot blank Source or Visual. - Hardened native `/` in Visual at ProseMirror `handleTextInput`, using the same suggestion mark/state as the Bangle left `+` path. - Promoted the R14.16 command list into a universal semantic command-definition registry consumed by the Source toolbar, Visual slash/left+ aliases and Visual selection-toolbar labels; added inline/display math to Visual commands. - Added R14.18 unit/static/browser regression coverage for stale revisions, exact math row edits, shared command identities, Visual slash editability, Source↔Visual canonical propagation and 100 mode switches. ## R14.17 Atomic File Session Controller - Added a route-authoritative `LatexDocumentController` with explicit `requestedPath`, `loadingPath`, `activePath`, canonical content/revision, request IDs and status. - Removed Source editor self-loading and the source-route fallback chain that could pair a new filename with previous-file contents; loading transitions now show the requested filename until that exact canonical session activates. - Obsoletes/cancels older activation waits so out-of-order async file reads can populate the source cache but can never become the active editor after a newer route request. - Adapted Texlyre's CodeMirror `historyField` serialization/restoration, adding per-file undo history, selection/cursor and scroll restoration. History is dropped safely if the canonical revision changed while the file was inactive. - Source typing now uses native CodeMirror history while exact edits continue into `LatexSourceService`; canonical/background changes are explicitly excluded from CodeMirror history. - Source editor keys no longer include the global force-reload counter, avoiding unrelated editor reconstruction during normal project refreshes. - Added R14.17 unit and Chromium/Firefox release tests for out-of-order loads, no stale-content transitions, 100-file-switch cycling, per-file state restoration and undo-history restoration. ## R14.16 Texlyre Source Editor Migration - Replaced the TeXise Source CodeMirror foundation with a Texlyre-derived session/controller stack while keeping `.tex` canonical in `LatexSourceService`. - Ported the Texlyre plugin-toolbar interaction model with responsive grouped commands, overflow handling, selection-safe mouse behavior and contextual table controls. - Added a shared semantic LaTeX command registry for Source toolbar commands, with slash aliases ready for the R14.18 Visual unification stage. - Added persistent **Soft Wrap: On / Off** (default On) through a CodeMirror `Compartment`; toggling wrap never recreates the `EditorView` or rewrites source. - Replaced passive canonical whole-document CodeMirror replacement with minimal prefix/suffix source splices, and changed local CodeMirror typing to exact source edit transactions. - Split passive source reveal from explicit source selection so PDF scrolling can reveal source without changing/focusing the caret, while explicit navigation can still select/focus. - Preserved collaboration ownership of Yjs-bound CodeMirror sessions to avoid duplicate canonical/Y.Text application. - Preserved the safe Source MathLive Apply/Cancel workflow behind the migrated toolbar math commands. - Added R14.16 unit/browser regression gates for minimal source edits, wrap reconfiguration without view recreation, toolbar commands, reveal-vs-select semantics and passive PDF scroll caret stability. ## R14.15 Split Workspace & Scroll Sync - Lock the LaTeX editor route to the application viewport so global, Source/Visual, and PDF toolbars remain fixed while document panes scroll independently. - Replace the single-page PDF surface with a continuous virtualized PDF.js page stack that materializes only pages near the viewport. - Add Source and Visual viewport-center SyncTeX tracking so scrolling the editor moves the PDF to the corresponding compiled location. - Add reverse PDF viewport SyncTeX so scrolling the PDF reveals the corresponding source/Visual location without forcing a mode switch. - Add feedback-loop suppression and independent/bidirectional scroll-sync controls. - Add Chromium/Firefox release coverage for 10-page continuous PDF scrolling, fixed toolbars, no outer-page scrolling, and both sync directions. ## R14.14 Core Recovery - Compile the real SwiftLaTeX project root directly; SyncTeX is optional on the fallback backend instead of injecting unsupported `\synctex=1`. - Configure MathLive only after mount and contain MathLive failures inside equation previews/editors rather than the global app ErrorBoundary. - Use one Bangle suggestion engine for typed `/` and left `+`. - Make LaTeX route/file identity authoritative so switching `.tex`, `.bib` and `.sty` files updates content without refresh. - Make the official compiler profile `full`, provisioning pinned BusyTeX assets and requiring pdfLaTeX, XeLaTeX and LuaLaTeX for production certification. - Add a release-blocking R14.14 browser recovery journey for file switching, Visual prose, slash/MathLive and all three compiler engines. ## R14.13.1 Visual List Startup Hotfix - Fixes a production blank-screen startup crash caused by `visual_list` requiring a non-generatable `visual_list_item+` child in the ProseMirror schema. - Keeps parsed lists source-backed while allowing an empty schema shape (`visual_list_item*`) so ProseMirror can construct the schema safely. - Adds a static contract gate for Visual list schema generatability and bumps the application shell cache. ## R14.13 Native Bangle Visual Interactions - Ported the original Bangle suggestion mark/store/keymap into the LaTeX Visual ProseMirror surface so `/query` filters inline while focus stays in the document. - Left `+` and typed `/` share the same suggestion state; synthetic query text is excluded from canonical LaTeX edits. - Added contextual slash actions: Citation uses project BibTeX entries, Reference uses real project labels, and Equation opens MathLive immediately after insertion. - Replaced `window.prompt()` link creation with a floating Visual link editor that can edit or remove an existing `\href`. - Added Bangle-style drag auto-scroll, before/after drop indicators, and touch/pen pointer dragging while retaining semantic source-range moves. - Added Chromium/Firefox release coverage for the native Visual interactions. ## R14.12 P0 Visual Correctness - Unified Source/Visual canonical undo-redo: consecutive Visual typing groups into one history action; structural Visual operations remain distinct transactions. - Visual mode now exposes canonical Undo/Redo controls and Ctrl/Cmd+Z / Ctrl/Cmd+Shift+Z shortcuts. - Heading drag now moves semantic section/subsection subtrees rather than only the heading command, and rejects drops inside the dragged subtree. - Release terminology now distinguishes the static contract audit from executable production browser certification. ## R14.11 Bangle Visual UX - Restore the original Bangle-style left-side `+` add-block handle and adjacent drag grip inside LaTeX Visual mode. - Add a Visual `/` slash menu using the same command-menu interaction style while mapping commands to canonical LaTeX source structures. - Add source-backed block insertion for sections, lists, equations, tables, citations, references, footnotes, code blocks, raw LaTeX and page breaks. - Add drag/reorder of complete semantic block source ranges rather than serializing the ProseMirror document back to LaTeX. - Add a floating Bangle-style text-selection toolbar for bold, italic, underline, monospace and links using exact source-range wrappers. - Preserve R14.6/R14.8 source revision safety: structural Visual actions apply only when the canonical source still matches the active Visual projection. ## R14.10 Integrated Editor Release Candidate - Certifies the complete Source → Visual → MathLive → Compile → PDF → SyncTeX → reload → ZIP workflow in Chromium and Firefox. - Adds release-only Chromium ZIP → Firefox import-and-compile portability certification. - Allows whole-project ZIP import into an untouched blank-project bootstrap while preserving non-destructive overwrite protection for any user-modified project. - Updates reverse SyncTeX browser coverage to the selectable-text interaction: Alt-double-click the PDF text layer. - Emits `dist/release/certification.json` only after the frozen install, lint/type checks, unit tests, production build, audit, and both browser suites pass. ## R14.9 Usable Visual LaTeX Editor - Replace paragraph-wide Raw LaTeX fallback with mixed editable Visual content and small protected inline source islands. - Add source-backed Visual formatting for simple `\textbf`, `\textit`, `\emph`, `\underline`, `\texttt`, `\url`, and `\href` bodies while preserving their LaTeX wrappers. - Add first-class editable `itemize` and `enumerate` Visual list blocks whose `\item` markers remain canonical source structure. - Protect unsupported custom environments at environment granularity so surrounding prose remains editable. - Add real-world Visual regression coverage for mixed prose, formatting, math, lists, custom macros, and custom environments. ## R14.8 MathLive Stabilisation - Replaced inline/focusout MathLive commits inside Visual ProseMirror NodeViews with read-only equation previews and an explicit dedicated MathLive editor. - Visual equation edits now use Apply/Cancel, exact canonical source ranges, delimiter preservation, and source-revision/text guards. - Track Visual prose edits and equation edits independently so repeated math changes coexist with ordinary Visual text changes without stale-projection overwrites. - Keep structural equations containing labels/tags source-only, while still rendering a MathLive preview. - Added Apply/Cancel/stale-source/protected-equation browser release gates and Ctrl/Cmd+Enter equation Apply. ## R14.7 Compiler Recovery - Restored Texbrain-style Service Worker readiness and MEMFS fallback preload for browser pdfLaTeX. - Added bundled ls-R path resolution through a pinned TeX Live static mirror before the SwiftLaTeX package server. - Browser compiler now performs a real pdfLaTeX + amsmath + graphicx self-test before Compile is enabled. - Compile diagnostics expose runtime readiness, package-resolution mode, self-test status, and last package source. - Added real-browser compiler recovery release gates and package-resolution health checks. ## R14.6 Source/Visual Session Stability - Keep the LaTeX CodeMirror Source editor mounted while Visual mode is active; mode switching now changes visibility rather than destroying the editor. - Preserve Source document, cursor/selection, scroll and CodeMirror history across repeated Source/Visual switching. - Stop collaboration document-revision notifications from recreating the Source editor. - Keep the active Visual projection stable while its own semantic refreshes arrive, avoiding destructive Visual editor rebuilds during typing. - Add canonical-source guards to ordinary Visual edits as well as MathLive edits so stale Visual state cannot overwrite newer Source text. - Add 50-cycle Source/Visual persistence and Visual-to-Source canonical-session E2E regression coverage. ## R14.5.1 Deep-link routing hotfix - Allow direct/reloaded editor routes for TeXise text files (`.tex`, `.ltx`, `.bib`, `.sty`, `.cls`, `.bst`, `.txt`) instead of inheriting Bangle's Markdown-only route decoder. - Keep binary/non-editor files on the asset route. - Add direct `.tex` deep-link and reload regression coverage. - Bump the app-shell cache so installed/PWA clients receive the corrected router. ## R14.5 Release Quality - Added streaming project ZIP export/import paths, including direct File System Access writes and Blob-sliced imports. - Removed the public Git CORS proxy default and hardened explicit proxy URLs. - Added TeXise-owned same-origin y-webrtc signaling plus SHA-256 collaboration asset manifests. - Added coherent trusted-API runtime snapshots with paired frontend/API rollback and release-ID health verification. - Added SPDX SBOM, provenance, release identity and SHA-256 production inventories. - Enabled Chromium + Firefox Playwright release certification and an end-to-end release-quality runner. ## R14.4 Visual/PDF - Embedded source-backed MathLive fields directly inside Visual LaTeX paragraphs and display equations. - Structural math with labels/tags remains read-only and source-safe. - Added selectable PDF.js text layer, cross-page text search and visible result highlighting. - Preserved PDF text selection by moving reverse SyncTeX to Alt-double-click on text. - Added bounded selected-PDF-text context to the BYOK AI panel. - Added R14.4 Visual/PDF regression and E2E release gates. ## R14.3 Security & Trust - Removed inherited Bangle Sentry/GoatCounter telemetry and obsolete Cloudflare deployment workflows. - Pinned the installation Ed25519 entitlement verification key into the production browser build. - Added entitlement key identifiers for future key rotation metadata. - Added enforced production Content-Security-Policy headers for Apache. - Hardened BYOK/custom AI endpoints to trusted HTTPS or loopback development URLs and clarified local key storage/privacy. - Removed user-visible Bangle homepage/GitHub/Twitter/Discord/privacy links from the TeXise product surface. ## R14.2 Compiler - Bundles a 4,992-file SwiftLaTeX-compatible TeX Live core so common article/report/letter packages compile without a network fetch. - Missing SwiftLaTeX package files resolve on demand through a configurable remote endpoint and are cached in the browser; administrators can disable the remote by setting `TEXISE_TEXLIVE_REMOTE_URL=`. - Generates `/compiler/status.json` from the compiler assets actually installed on the host. The default archive truthfully exposes pdfLaTeX only; XeLaTeX/LuaLaTeX are enabled only after BusyTeX assets are provisioned. - Compile UI now shows deployment mode/package availability and disables unavailable engines instead of failing only after a user selects them. - `/etc/texise/texise.env` now controls compiler provisioning during installation/upgrade, and new compiler variables are merged into existing preserved env files without replacing administrator values. - Installer validates compiler status, TeX Live manifests and a real bundled package through Apache after deployment. - Template compiler certification checks direct document-class/package requirements before the production Vite build; Playwright coverage adds engine gating plus a package-using Research Paper compile. - Expected transient API startup retries are now silent; an error is printed only if the API never becomes healthy. ## R14.1 Project Model - TeXise now creates a real blank LaTeX project (`main.tex` plus `figures/`) for every new empty browser/OPFS/native workspace and opens `main.tex` immediately. - Primary file creation preserves the exact filename and extension. `main.tex` remains `main.tex`; Markdown is created only when `.md` is explicitly requested. - Workspace Home now lists every visible project file instead of only Markdown notes. - Sidebar New File/New File Here use the generic project-file flow and default to `untitled.tex`. - Empty directories are first-class project entries; browser IndexedDB uses a hidden internal directory marker that is neither displayed nor exported. - Starred project files are no longer limited to Markdown. - PWA shortcuts now expose New Project and New Project File instead of note-era actions. - Legacy note commands remain available internally for Markdown compatibility but are removed from the primary command palette. ## R13 deployment layout - Production source now lives directly at `/var/www/app.texise.com/public_html`. - Root `pnpm run build` preserves the native browser-entry build and stages a validated Apache production build at root `dist/`, retaining `dist.previous` for static rollback. - Apache serves only `/var/www/app.texise.com/public_html/dist`; the trusted API runs from `public_html/server`. - Removed the R12 `/opt/texise` and timestamped frontend release/symlink deployment model. - Installer/upgrade now use frozen-lockfile PNPM dependencies, rebuild in place, validate API/frontend/SPA health, and preserve `/etc/texise`. - R13 archive installer fix: repaired the PNPM 11 lockfile snapshots so `--frozen-lockfile` works from the shipped ZIP. - R13 archive build fix: production ZIP/tarball builds no longer require a `.git` directory; build metadata falls back to `archive`. - Self-hosted installer builds now explicitly set the browser app environment to `production`. - R13 runtime hotfix: corrected the LaTeX visual-table ProseMirror schema so archive builds no longer crash at startup on `visual_table_cell+`. - R13 Apache hotfix: installer disables the legacy Certbot `app.texise.com-le-ssl.conf` vhost when present and now propagates frontend health-check failures correctly. - R13 PWA hotfix: production staging now requires the 180/192/512 application icons referenced by the document and manifest. - Uninstall no longer deletes the production source tree, including with `--purge`. 1. Inside a list, `Mod-Enter` and `Mod-Shift-Enter` now add an empty item below and above the current one. They previously did nothing once the cursor was in a list. 1. Toggling a task checkbox moved from `Mod-Enter` to `Alt-Enter`, so `Mod-Enter` inserts an item consistently in every kind of list. ## 2026-08-20 — `/etc/texise` permission post-condition verification - Install/upgrade now verifies the protected `/etc/texise` owner/group/mode immediately after normalization and fails clearly if the live filesystem does not match the expected trust boundary. - Known TeXise configuration/signing files must be regular, non-symlink files and verify as `root:texise 0640`; `/etc/texise` verifies as `root:texise 0750`. - This specifically hardens upgrades from legacy installations where `entitlement-public.pem` remained `root:root 0644`. ### SaaS production Biome corrective pass — 2026-08-20 - Fixed the 31 Biome diagnostics reported by the OVH production build after TypeScript typecheck passed: explicit button types, admin search label association, centralized sanitized CMS HTML rendering, and control-character template validation. - Added a regression audit covering the exact lint classes. ## 2026-08-20 — Trusted API / MySQL bootstrap diagnostics fix - Adds staged SaaS MySQL/migration/admin preflight before trusted-runtime activation. - Adds actionable fatal diagnostics for missing DB, access denied and MySQL connectivity failures. - Adds `texise-saas status|preflight|logs` operations helper. - Health-check failure now prints the recent `texise.service` journal automatically. - Documents production use of a custom database name such as `texise_db` and least-privilege grants. - Protects the reserved `admin@texise.com` bootstrap identity from silent privilege elevation. ## 2026-08-20 — Browser font deployment ordering fix - Production install/upgrade now imports the externally supplied Moranga/STIX browser fonts **after** Vite replaces `dist`, so administrator font copies are no longer erased by the build. - The supplied `Latinotype - Moranga Regular.otf` is canonicalized to `dist/texise-fonts/Moranga-Regular.otf`, matching the CSS runtime URL. - Moranga/STIX files are validated as real sfnt/OpenType/TrueType fonts before and after deployment; an HTML SPA fallback can no longer masquerade as a font. - Production-dist validation now requires all three TeXise browser fonts before activation. - `TEXISE_FONT_SOURCE_DIR` defaults to `/var/www/app.texise.com/fonts` and is preserved/configurable in `/etc/texise/texise.env`. ## R14.28.12 — Consolidated SaaS Projects/Templates/Typography pass (2026-08-20) - Made `/projects` the visible Start Writing/application-home route while preserving deep `/ws#...` editor routing internally. - Added browser-local GitHub import, streaming project ZIP download, direct root-file opening and storage-aware project deletion. - Renamed static template assets to `/texise-templates/*`, eliminating the Apache `/templates` directory collision; `/examples` now redirects to `/templates`. - Removed Markdown-only project-tree filtering from the TeXise LaTeX sidebar and corrected project-dialog privacy text styling. - Added the authoritative eight-font deployment contract: Inter Variable, JetBrains Mono Variable, Moranga Light/Regular/Italic/Bold and STIX Two Text normal/italic, with post-build copy and served-signature validation. - Applied a second Prefix-derived application/public typography and navigation pass while preserving STIX strictly for the visual manuscript. ## 2026-09-05 — Vibe Coding R2 sandbox entitlements/storage - Added stackable sandbox entitlement units and four runtime tiers: Free 1h, Pro1 24h, Pro2 7d, Pro3 30d. - Added migration 37 (`sandbox_entitlement_tiers_and_storage_policy`). - Added configurable per-tier per-user sandbox storage policies and Environment usage/tier UI. - Added entitlement-upgrade lease/storage handling without ordinary reconnect lease sliding. - Added trusted external hard-quota helper contract plus production fail-closed switch; compatibility soft quota remains explicitly identified as non-kernel enforcement. ## 2026-09-05 — Vibe Coding R3 Agent Runtime Tools - Promoted sandbox execution from UI-only Agent verification into first-class structured Agent runtime tools: `run_command`, `run_build`, `run_tests`, `start_process`, `stop_process`, `inspect_processes`, `inspect_runtime_logs`, and `inspect_preview`. - Runtime tools are registered only while authenticated Agent mode is active; Ask mode remains non-executing. - Kept runtime actions, read tools, and source mutations in bounded separate Agent turns so runtime results can inform subsequent edits without bypassing proposal/checkpoint controls. - Persisted sandbox process start/stop state in `sandbox_processes` and reconcile runtime process status on listing. - Sandbox generation changes now mark old-generation process records stopped, preventing stale process identities from surviving environment reconstruction. - Added focused process-registry tests and expanded vibe-coding invariant coverage. - Broad server/static regression sweep: 351/351 passing. ## 2026-09-05 — Vibe Coding R4: persistent Agent state + canonical runtime settings Baseline: R3 Agent Runtime Tools / Process Registry. Implemented migration v38 with project_ai_threads, project_ai_messages, project_ai_tasks, project_ai_tool_actions and project_runtime_settings. User-visible Ask/Agent messages and bounded Agent task states are now persisted server-side; tool actions persist only safe summaries and never hidden reasoning or raw command output. Empty browser-local AI history can hydrate from project server history after refresh. Agent tasks record planning/running/waiting_for_tool/verifying/completed/failed/cancelled state and audit terminal outcomes. Project runtime settings now provide optional runtime mode, working directory, build/start/test commands and Preview port. The configured relative working directory is path-normalized server-side and propagated through the trusted Console Gateway to real one-shot commands and long-running processes. Agent build/test/start heuristics use project settings first. Project Manage UI exposes runtime settings and share-link expiry choices (none/1h/24h/7d). Verification: 351/351 broad server/static tests PASS; 10/10 project-runtime PASS; migration tests 15/15 PASS; capability audit 32/32 with 0 blockers; lock sync, trusted runtime manifest, R12 release audit, Learnitive brand audit, TeXise provenance audit, installer syntax and server/Console Gateway syntax all PASS. Remaining high-priority work: Preview HMR WebSocket proxy + dedicated-origin hardening; project-delete/runtime cleanup; active long-lived permission revocation; hard quota deployment/staging validation; resource observability/accounting; provider-native streaming/Auto routing; Community/Explore/Fork/Publish Snapshot; guarded stale CMS documentation migration; full browser/Docker/staging acceptance. ## Learnitive Vibe Coding R5 — 2026-09-05 - Added authenticated dynamic Preview HMR WebSocket proxying. - Added infrastructure-aware project runtime deletion cleanup. - Added active terminal revocation for member/share permission removal and Preview WebSocket authorization rechecks. - Bound collaboration invitations/grants to registered project authorization identities. - Preserved local-first source, one-container-per-user sandbox and AI/runtime security invariants. ### Vibe Coding R6 — observability and AI routing - Added sandbox CPU, memory, PID, uptime, storage and quota visibility. - Added native provider SSE streaming and explicit Auto model routing while preserving strict explicit Local/Ollama privacy behavior. ### Vibe Coding R7 — Publish snapshots, Explore and Fork - Added explicit authenticated publication snapshots while keeping local project source canonical. - Added signed-in Explore and fork-to-own-local-workspace flow. - Prevented public visibility without an active publication snapshot. ## 2026-09-05 — Vibe Coding R8: canonical docs + account runtime usage - Added migration v40 (`vibe_coding_canonical_docs_security_refresh`) with guarded forward fixes for obsolete anonymous-collaboration and `Send project` canonical CMS wording without replacing unrelated admin-authored content. - Canonical plan documentation now records the Free 1h / Pro1 24h / Pro2 7d / Pro3+ 30d disposable environment policy and local-first sandbox semantics. - Added migration v41 (`account_runtime_usage_ledger`) and `account_usage_daily` for low-volume account-level sandbox/Agent/command/process/storage accounting. - Added signed-in `/api/user/usage` history and a 30-day development-usage summary in account settings. - Extended the current capability audit with canonical-doc refresh and account-usage ledger invariants. - Verification on the exact R8 tree: broad server/static 354/354 PASS; runtime 10/10 PASS; capability 37/37, 0 blockers; repository TS/TSX syntax parse 207/207; lock/trusted/R12/brand/provenance/installer/server/gateway gates PASS. - Full locked browser build, real Docker/quota/Preview/PTy acceptance and staging MySQL migration remain staging-only gates because this implementation environment lacks project dependencies/Docker. ## 2026-09-05 — Vibe Coding R9: isolated Preview, Restart/Reset and browser diagnostics - Added optional dedicated Preview-origin deployment with short-lived HMAC tickets bound to authenticated viewer, project, process and sandbox generation. - Preview-origin HTTP/HMR uses a scoped Preview cookie rather than the primary Learnitive session and revalidates project authorization. - Added optional `preview.learnitive.com` Apache staging vhosts with certificate-aware installer activation and secure same-origin fallback. - Split environment lifecycle into Restart (new container generation, preserved mounted sandbox workspace) and Reset (clean disposable sandbox state, durable local source preserved/re-materialized). - Injected bounded browser diagnostics into dynamic HTML Preview and exposed recent console/runtime/resource/network failures to Agent `inspect_preview`. - Verification: 361/361 broad tests; 10/10 runtime; vibe invariants 11/11; capability 40/40; TS/TSX syntax 1012 files; lock/trusted/R12/brand/provenance/installer/server/gateway gates PASS.