Changelog

Hardening W4. The drift checks existed (gen:agent-md:check, slices:check) but were never wired to a hook — agent.md drifted across three waves before anyone noticed. pre-commit now runs gen:agent-md:check + validate:changelog (verified: a deliberately corrupted agent.md fails the commit); pre-push runs vitest before the build (the audits are structural — no audit ever caught a dead click). MCP's rahman-resources dependency had drifted to ^1.9.1 while the CLI sat at 1.12.x — published MCP installs silently served a stale catalog; bumped to ^1.13.0 and a new prepublishOnly check-peer gate fails any future publish whose range lags the sibling CLI. DX: typecheck script carries the 4GB heap bump (cold tsc OOMs default Node), allowedDevOrigins unblocks 127.0.0.1 dev browsing (the silent no-hydrate trap), dev:alt serves port 3457 for parallel sessions, and a warn-only ui-drift report (41 drifted primitives, 13 site-only, 5 template-only) runs at the tail of validate:all so the dual shadcn trees diverge by decision, not accident.

Hardening W3. The BSDL-era bidir block survived in 20 slice contracts as pure noise — syncPolicy died with BSDL, but its nested generalization payload (level / forbiddenTerms / requiredProps) still feeds check-forbidden-terms.mjs, so it was promoted to a top-level contract field instead of deleted: all 20 contracts rewritten, SliceSyncPolicy + SliceBidirContract types and validateBidir dropped from the contract DSL, validateGeneralization replaces it. The files slice was the only catalog entry without a slice.json (the parity gate silently skipped it) — authored from its contract + catalog entry, versions aligned at 0.2.1, parity now checks 63/63 with zero skips. public/brand-assets/ carried PNG+WebP twins of every banner with no code references — 10 orphans deleted (4.4MB → 1.1MB), keeping the og:image PNG, icons, and the SVGs the footer actually uses.

Hardening W2. Three site bugs: (1) RecentlyUpdatedBadge's card variant rendered a <Link> inside CatalogCard's own <Link> — invalid HTML, confirmed hydration error, and the inner anchor sat under pointer-events-none so it was unreachable anyway; the card variant now renders the bare pill. (2) Four changelog entries were future-dated (a miscomputed UTC-midnight epoch landed on Jun 8) which made badges read 'Updated today' for a day that hadn't happened — dates corrected. (3) Badge deep links pointed at /changelog#id, but the feed paginates 10/page and anchors on later pages never scroll — PAGE_SIZE moved to changelog-helpers as SSOT, getLatestUpdate now reports the entry's page, and links carry ?page=N. New gate: scripts/validation/validate-changelog.mjs (unique ids + no future dates + epoch sanity) wired into validate:changelog and slices:check so both data bugs stay fixed.

Security audit follow-up. Two public Convex mutations were anonymously abusable: touchToken took a row id (anyone could enumerate token ids and tamper lastUsedAt) and rate-limit consume took caller-supplied limit/windowMs (anyone could forge a loose window and bypass the limit, or burn a victim key's budget). Neither can become internalMutation — ConvexHttpClient callers can't reach internal functions — so both are hardened in place: touchToken now takes the bearer token VALUE and resolves it via by_token (possession = authorization, no-op on miss); consume's limits moved to an in-code per-prefix POLICY map (unknown prefix rejected) plus an optional RATE_LIMIT_SERVER_KEY env gate compared constant-time. Admin login now uses the Convex-backed limiter when a deployment is configured (replica-safe, fail-open) with the in-memory bucket as dev fallback — and success no longer resets the counter, so a correct guess can't refund an attacker's budget. Session-token trade-off (signed-not-encrypted payload) documented in admin-auth.

The os-vps de-gaudy sweep lands in the lifted slices: every raw Tailwind palette class used for STATUS meaning (bg-red-500, text-emerald-500, bg-amber-400, bg-sky-500, …) now reads the semantic tokens the site palette already defines — bg-success / bg-destructive / bg-warning / bg-info — so notification dots, toast icons, taskbar activity pips, error states, mute buttons and mask-edit banners all follow the active theme preset instead of fighting it. Intentionally colorful surfaces (app-icon gradients, file-type icon colors, avatar palettes) are untouched. Same wave adds responsive guards to the three fixed-width panels that could overflow small viewports: notification center (340px), inspector (300px) and the image-editor side panel (312px) now carry max-w clamps. Consumers on older copies: `npx rr update <slug>` — the slices assume --success/--warning/--info/--destructive tokens in globals.css (the rr init template ships them).

The F1–F20 productivity wave lands from app-shell (app.rahmanef.com), where every feature shipped behind its own e2e gate (21-check headless harness, 13 vitest suites ride along in the slice). The multiplier seam is a dynamic command registry — registerCommands(source, cmds) — that Spotlight merges at runtime; nearly every other feature self-registers its palette commands through it (shells too: switching surfaces is a command). Window manager grew: always-on-top pinning, tiling presets incl. ⅓/⅔ thirds snap zones, virtual desktops (Spaces 1–4 with per-window spaceId), window tabs (merge an app's windows into one tabbed frame), saved layouts, session profiles (windows + shell prefs as one unit), and a work-area-clamped spawn cascade (windows can no longer open off-screen). New bundled features (DEFAULT_FEATURES 5 → 10): Quick Look (Space-bar previewer registry), clipboard history (⌘⇧V overlay, pin survives clear, monotonic ids), share sheet (target registry + copy/download built-ins), shortcut cheat-sheet (⌘/, source-keyed hint registry), lock screen (privacy curtain, idle auto-lock, consumer unlock guard). Notifications gained inline actions + per-app icon badges (count pill / dot / progress ring on every shell's icons, auto-driven by unread appId toasts). Plus: cross-app drag & drop (typed payloads → per-app drop handlers), focus mode (toasts go log-only), recents, a11y-ready font/contrast seams, desktop wallpaper-layer widgets (new desktopWidgets slot region), and document.title sync ("App — Brand", manifest.titleSync opt-out). Framework stays brand-free — the one hardcoded brand string found in review (notification cards) now reads useBrand().

UX wave U8. A repo-wide grep found loading UI hand-rolled everywhere: bespoke animate-pulse divs (notion hosts), raw Loader2 spans (preview-kit, admin-login), and a one-off docs body skeleton. New loading-states slice centralizes the pattern: LoadingSkeleton composes the shadcn Skeleton primitive with seven kind presets (text / card / list / table / form / page / block, count + columns overridable), and LoadingState composes the shadcn Spinner for in-flight work (inline / block / overlay). The page kind drops straight into a route loading.tsx. The site now eats its own dog food: DocsLoadingSkeleton keeps only the docs-shell chrome strips and delegates its body to kind="page"; the notion database/notes hosts swap pulse divs for kind="block"; preview-kit chat + composer and admin-login swap Loader2 for the Spinner primitive. Per-slice skeletons (icon-picker, notion editor) stay put — slice self-containment beats DRY across slice boundaries.

UX wave U7. Three compounding bugs killed the docs-sidebar tree: (1) category branches never toggled at all — SidebarMenuButton's tooltip prop wraps the button in a Tooltip root, and CollapsibleTrigger's asChild Slot merged its onClick onto that non-DOM wrapper, silently dropping the handler; (2) section chevrons never rotated — the group/section class sat on SidebarGroupLabel, which Radix never stamps data-state on, so the group-data-[state=open] selector could not match; (3) every section defaulted to open, rendering the whole catalog as one wall. Fixes: tooltip dropped from the trigger (sidebar is always full-width — it added nothing), group classes moved to the Collapsible roots that actually carry data-state, and only the section containing the active path starts open (navigation re-opens, manual toggles stick). Also: publish gate caught template-base/contact-form-resend still on the removed "email" category — moved to integrations.

The os-vps lint sweep (55 compiler-era react-hooks warnings → 0, rules promoted to error) lands in every lifted slice so both repos are line-identical outside seams again. Pattern conversions, no blanket disables: latest-ref mirrors move into effects, effect-driven resets become request/prop-keyed derived state (window-content, file-tree, use-konva-image, favicon, omnibar, remote-view, NumBox, waveform, spotlight), dynamic icon lookups render via createElement (useMemo does NOT satisfy static-components — probed), inline components hoist to module scope, the image-editor co-locates selection+mask in one state so the mask-exit invariant is atomic, history snapshots canUndo/canRedo at mutation time, and the inspector AI thread resets via key= remount. Bonus: the appshell AppIcon drops the hard iOS-glass sheen for a macOS Ventura treatment — soft full-height luminance ramp, hairline edge ring, layered drop shadow, shadowed glyph — mirrored in the app-store icon preview + card tiles.

UX wave U6. The catalog had editors, payments and an OS shell — but no data table, no 404 page, no footer. Five foundational slices land, all pure-UI, adapter-driven where state is involved, each with variant previews + smoke coverage (registry 37 → 42): data-table (generic DataTable<TData> on TanStack Table v8 + shadcn Table — sorting, search, pagination, row selection, column visibility; density/selectable axes), empty-states (six presets 404/500/403/no-results/empty-list/first-use on the shadcn Empty primitive + ErrorPage drop-in for app/not-found.tsx + error.tsx), marketing-chrome (config-driven MarketingHeader split/centered/minimal + mobile sheet menu, MarketingFooter columns/slim — the chrome every template hand-rolled), settings-page (Profile/Preferences/Notifications/Danger-zone shell over a two-method SettingsAdapter with optimistic save), notifications-center (bell + unread badge + popover/sheet inbox over a NotificationsAdapter; enhances appshell + dashboard-shell). CLI 1.12.0 carries them plus the U2 category enum + U3 alias resolution.