# Local 0.50.1 install-name patch; not deployed

Unifies install-name metadata and sends existing same-origin browser credentials when retrieving the protected manifest. App identity/start URL/scope, Access policies, icons and reading/storage behavior are unchanged. This fixes a reproduced authenticated-manifest integration gap; it does not prove the cause of the reported iPhone name field. Frozen qualified0.50artifact remains unchanged. Physical suggested-name and Home Screen launch checks remain required; a new artifact and qualification are needed before publication. Historical notes follow.

# Local release candidate0.50.0

Frozen completed scope: selected Refined Blossom icons, bounded local custom covers, simple Option3 onboarding, explicit PDF/image/CBZ first-page cover and unambiguous declared EPUB cover. No new filler features. Qualification results/release decision are retained separately. Device/installed-icon/physicalSafari/Access-expiry and paused hosted-backup checks remain open; this is not deployment approval. Production040/GitHube962 unchanged. Historical notes follow.

# Current local candidate0.44.0

Explicit declared embedded EPUB cover selection extends qualified043. Only an unambiguous supported local image declaration is used; no spine/chapter/filename guesses, automatic replacement, remote resources or DRM bypass. Existing cover limits,atomic storage and backup9 remain. Production040 and GitHube962unchanged;no publication. Qualification evidence retained separately. Historical notes follow.

# Current local candidate0.43.0

An explicit Use first page as cover action for local PDF/images/CBZ extends qualified0.42. Page1 or the first confirmed ordered image only, no content scanning, chapter guesses, automatic replacement or network provider. Same bounded cover storage/backup9 and independent original book/progress. Production remains0.40; no publication. Qualification evidence is retained separately. Historical notes follow.

# Current local candidate 0.42.0

Custom device-local covers and the selected simple onboarding extend qualified local 0.41. Production remains protected 0.40. No publication is authorized for this candidate. See [scope, limits and backup compatibility](../docs/PWA-COVERS-0.42.0.md). Qualification results are recorded in the separately retained local release evidence; historical notes follow.

# Current local candidate0.24.0

Manual EPUB unread counts/filter0.22, real unread-count sorting0.23 and remembered category sorts0.24 extend tested local0.21. Counts derive explicit manual chapter marks, separately from saved reading progress. Fixed-page titles have no chapter count; unread sorts place them after EPUBs. Continue/Recent keep checkpoint order. All titles/Uncategorized/each category remember independent browser-local sort choices; deleted scopes prune safely and failed preference writes warn while remaining usable in memory. No library/database/backup schema or dependency change. See repository docs/PWA-CATEGORY-SORTS-0.24.0.md and final versioned evidence.

Live remains0.18.0. Deployment is held for the stated future0.30.0 target, interpreting user “0.3” as future0.30 rather than obsolete0.3.0; this request authorizes only0.22–0.24, not automatic work through0.30. No deployment/push/merge/security changes or paused hosted backup-download retry. Installation/mobile/Mac/Access-expiry and personal-publication acceptance remain untested. PR1draft/unmerged;CI skipped. Following notes are historical.

# Current local candidate0.21.0

Shelf multi-selection0.19, atomic Favorite/Unfavorite selected0.20 and category Add/Remove selected0.21 extend live0.18. Selection is temporary and visible-only; hidden titles are removed from selection when filters change. Explicit atomic metadata sets preserve media, saved reading positions, typography, bookmarks, favorites/categories and manual EPUB marks. Category Remove never deletes books or the category. Conflicts require explicit refresh/review, failures roll back, no-op sets do not write. No database/backup schema change or dependency. See repository docs/PWA-BULK-CATEGORIES-0.21.0.md and final versioned evidence.

Live remains0.18.0; no deployment/push/merge or paused hosted backup-download retry. Installation/mobile/Mac/Access-expiry and personal-publication acceptance remain untested. PR1draft/unmerged; CI skipped. Following notes are historical.

# Current local candidate0.18.0

Title details0.16, on-demand bounded EPUB chapter list0.17 and explicit EPUB chapter read/unread marks0.18 extend the verified0.15 library. Details expose fresh metadata and canonical Start/Continue; chapter names load only on request in publication spine order. Selection alone never writes. Explicit individual/bulk marks are separate from saved reading position and checkpoint status. Backup7 retains manual marks; legacy1–6 remains supported. No database migration or dependencies added. See repository docs/PWA-CHAPTER-MARKS-0.18.0.md and versioned final release evidence.

Live remains protected0.15.0. This local batch is not deployed; no remote push/merge, security changes or paused hosted backup-download retry. Installation/mobile/Mac/auth-expiry and personal-publication acceptance remain untested. PR1 draft/unmerged; CI skipped. Following release notes are historical.

# Current combined candidate0.15.0

Includes favorites0.12 plus remembered Grid/List0.13, checkpoint status/progress sorting0.14 and Continue/Recent reading0.15. Recent lists the latest saved position per title, not every session. Sections/status/category/favorites/search/layout compose. No data migration or backup change beyond existing compatible backup6. Conditional protected deployment follows final passing gates; live remains0.11 until separately verified. Hosted backup-download limit remains paused. See repository docs/PWA-LIBRARY-BATCH-0.15.0.md for scope and versioned release evidence. Earlier notes follow as history.

# Current local candidate: favorites0.12.0

Separate Favorite buttons and a remembered Favorites only filter compose with title search, sorting and categories. Edits preserve books and reading state. Backup6 retains favorites and existing metadata; legacy1-5 remain supported. [Scope and limits](../docs/PWA-FAVORITES-0.12.0.md). Live pilot remains0.11.0; this candidate is not deployed. Hosted0.11 backup download validation remains unverified and was not repeated. PR1 draft/unmerged; CI skipped. Historical release notes follow.

# Current local milestone:0.11.0 categories

Protected pilot serves verified0.8.0. This local candidate adds category management, multiple assignment and combined filtering with compatible backupversion5; no deployment/push/merge. See [category scope](../docs/PWA-CATEGORIES-0.11.0.md). Earlier version notes below are historical.

# Floating Sakura · PDF PWA prototype

Isolated PDF, image and CBZ browser prototype, separate from desktop 0.21.0 and the original Apple foundation. Prototype source version: 0.6.0. No Node service, SQLite runtime, native launcher, account, sync or executable extensions.

Import a PDF (20 MB / 200 pages maximum), read continuously, save position, reopen from the browser library, export a JSON backup, and validate/preview/confirm an atomic replacement restore. Library budget: 12 books / 32 MB. Backup input limit: 48 MB. Only canvas content renders; no PDF scripting, forms, annotations or link/action layer. PDF.js and worker are bundled with their licenses. The included sample is an original synthetic study.

Books/progress use IndexedDB for this browser/profile and exact site origin. The service worker caches only this app's static assets and synthetic sample. It does not cache or upload personal PDFs; there are no remote API calls. Browser storage may be evicted or cleared, and private profiles may not retain it. The retention request is optional and not guaranteed. Exported backups contain full PDFs and progress, unencrypted; confirm the download actually saved.

Progress commits are acknowledged IndexedDB transactions with stale-writer/generation checks. Unacknowledged positions remain memory-only and can be lost on abrupt termination. Visibility/pagehide saves are best-effort, not a mobile OS lifecycle guarantee. Restore validates hashes, PDF pages, record limits and locations before explicit replacement; the replacement transaction rejects a changed library revision and rolls back on abort.

Shared pieces live in `core/`; browser persistence/backup in `adapters/`; UI/orchestration in `app.js`. The reviewed generic progress coordinator and validator are copied unchanged from the desktop shared foundation. PDF worker/options, placeholder sizing and anchor logic adapt the reviewed desktop approach. The complete old reader is not migrated, and desktop/Apple sources are not replaced.

Offline service workers require HTTPS or a localhost origin. `file://` is insufficient. Development-only `tests/serve_static.py` uses the existing Python standard library to serve an allowlist of static assets on 127.0.0.1; it denies tests/profile files and uploads. This is not the denied desktop Node service or a public deployment. Keep the same port/origin and profile to retain the same library. A stable HTTPS hosting decision is still needed for a shareable/installable preview on other devices; none is selected or deployed here.

From this directory, a permitted local static preview can use:

```text
python tests/serve_static.py --port 43821
```

Then open `http://127.0.0.1:43821/` in a browser that permits it. Stop on any execution/security denial; do not change trust, origin metadata or protection settings. The prototype does not require a signed Windows executable. Browser/PWA installation availability depends on browser/platform UI and is not a store-package claim.

Actual final validation: 28 browser acceptance checks passed in headless Microsoft Edge 155.0.4283.45 on Windows, including real offline process reopen and backup/restore. See VERIFICATION.md for exact evidence and failure-injection limits. Native iOS/iPadOS/Android/macOS behavior, store packages, sync, real-user data migration and public hosting are outside this slice. Tests use only synthetic PDFs and isolated browser profiles. No user books are uploaded.


## Readiness slice 0.2.0

First-run guidance explains import limits, acknowledged saves, one online visit before offline use, exact profile/origin storage, verified backup downloads, and installation fallback. Installation is optional and does not create sync or a separate storage guarantee.

Service-worker releases use a scope-specific cache prefix. New releases precache the complete static shell with fresh requests and wait for all old app tabs/windows to close. No forced activation or automatic page reload occurs. An incomplete precache is deleted and cannot replace the active offline version. Activation removes only superseded caches owned by this scope; legacy unscoped prototype caches are deliberately retained because their ownership is ambiguous. IndexedDB is untouched by shell updates. Bump the RELEASE constant whenever runtime assets change. Publish all assets together; immutable/versioned hosting and production release procedures still need a deployment decision.

The app reports a waiting update and offers a manual update check. Save and back up, close every app tab/window, then reopen at the same address in the same profile. If no browser install prompt is offered, use its install/app menu if available or bookmark the page. Actual browser installation and OS integration remain a manual review task.

Engineering references: [service-worker lifecycle](https://web.dev/articles/service-worker-lifecycle) (waiting/activation and origin-wide cache caution). Readiness tests use a synthetic mutable localhost static fixture with isolated profiles; it is test tooling, not a product service. Run `node tests/readiness.cjs` using the same existing Playwright/browser environment as the acceptance suite.


## Delivery tooling 0.3.0

Portable synthetic checks, pinned test-only dependency metadata, and validated static packaging are described in [delivery notes](../docs/PWA-DELIVERY.md). The packaged site has no Node/Python runtime dependency. A CI workflow is prepared with a no-paid-use gate; local test success must not be presented as executed CI. No hosting is activated.


## Image collections 0.4.0 (local review)

Use Import images to select 1–200 JPEG, PNG or WebP files, totaling at most 20 MB. Review natural filename order and a title before confirming. Filenames must be unique (case-insensitive); number them to control page order. Images are decoded locally, with an 8192-pixel side, 16-million-pixel page and 200-million-pixel collection ceiling. Animated PNG/WebP and unsupported image orientations are rejected. At most three page canvases are retained. No image file is uploaded.

The same continuous reader, acknowledged progress and offline library support PDF and images. PDF records keep their existing storage/schema and chapter IDs. Image collections use an explicit format and ordered page blobs. PDF-only backups still export version 1; mixed backups use version 2 with per-image hashes and collection-order integrity. Both are validated before an atomic replacement restore; old version-1 PDF backups remain supported. Backups are unencrypted.

The new image acceptance suite uses only original generated images and isolated browser profiles. CBZ/EPUB, actual hosted authentication expiry/offline tests, mobile/Mac and OS installation remain separate gates. The 0.4.0 package has not been deployed pending review.


## CBZ import 0.5.0 (local review)

Import CBZ validates a local archive before extracting it in a terminable worker. JPEG, PNG and WebP pages are naturally sorted by full archive path, then flattened into numbered filenames in the existing image collection format. The preview shows that final order and asks for a title and confirmation. No archive is retained, uploaded or executed. Optional ComicInfo.xml (64 KB maximum) is integrity-checked and ignored; its title/ordering is not applied.

Limits: 20 MB compressed and expanded, 256 archive entries including directories/metadata, 200 image pages, 200:1 per-entry expansion ratio, and 20 seconds for worker extraction. Existing image pixel, library and backup limits still apply. UTF-8/NFC paths only; paths must be short, unambiguous and unique ignoring case. Encrypted, ZIP64, multivolume, symlink, unsupported compression/content and malformed archives reject without storing anything. STORE/DEFLATE and checked data descriptors are supported. Some otherwise valid CBZ archives fall outside these deliberate prototype limits.

The vendored JSZip 3.10.1 is reused byte-for-byte from the reviewed desktop tree under its MIT option; the license ships with the preview. Before JSZip parses, a bounded central/local-header preflight rejects unsafe paths and expansion claims. Extraction checks actual streamed lengths and CRCs; cancellation and timeout terminate the worker. Image header/native decoding validation follows before the ordinary atomic import. PDF/images keep their existing database and backup formats. See [CBZ implementation and evidence](../docs/PWA-CBZ-0.5.0.md).

0.4.0 is deployed to the protected pilot and hosted synthetic image/PDF preservation checks passed. The 0.5.0 CBZ candidate is local only, pending release review. CI remains skipped, not passed; OS installation, mobile/Mac and hosted offline/authentication expiry remain untested.


## Update transition candidate0.5.1 (not deployed)

Query strings on app-document navigation now reuse the controlling worker's canonical HTML, keeping it paired with that worker's scripts while a new version waits. Fetch requests and query-bearing assets retain their existing network behavior. Close all app tabs/windows and wait a few seconds before reopening; no forced activation, automatic reload or storage clearing is added. The existing0.4document can also initialize with the newer reader module if its CBZ import control is absent: retained titles remain usable and the page asks for normal manual reopening.

The isolated regression reproduces the query-mixing path and the observed missing-control exception using immutable fixtures. It then repeats twelve controlled updates at root/subpath, checks exact PDF/image/CBZ hashes and progress, old-document fallback, offline query navigation and unrelated-cache retention. Natural close/reopen timing alone did not reproduce the exact hosted exception; that causal uncertainty is retained in [transition results](../docs/PWA-UPDATE-TRANSITION-0.5.1.md). Hosted pilot remains0.5.0; this candidate awaits review before any further upload.


## DRM-free EPUB 0.6.0 (local candidate)

Import EPUB adds a reflowable UTF-8 EPUB2/3 as one local title. Read one spine chapter at a time with previous/next and a chapter selector. Text size18/22/26/30, line spacing and serif/sans-serif settings persist per title. Progress records the chapter index and a proportional location within it; it is not an EPUB CFI or exact text anchor. Reflow restores that fraction.

The original archive is retained in IndexedDB and revalidated before opening/restoring. EPUB uses the same database version and title limits; it does not change existing PDF/image/CBZ records. Backups containing EPUB use version3 with original archive bytes, settings and chapter progress. Older version1/2 backups remain supported; PDF-only and image-only exports retain their earlier versions.

Publisher scripts, CSS, forms, external links/resources, SVG and embedded fonts are omitted or rejected. XHTML is reconstructed from an element allowlist and rendered in a sandboxed scriptless frame with network disabled. Only validated local JPEG/PNG/WebP images become data images. Fixed layout, DRM/encryption, obfuscated fonts, DTD/entities and unsupported manifest formats reject with a visible error. No DRM bypass.

Conservative bounds:20MB compressed and expanded;256 ZIP entries;100 chapters;1MB per parsed XML/XHTML resource;500k text characters per chapter/2million per title;10k nodes per chapter/50k total;depth64;100 referenced images and200 placements;8 images/16million pixels per chapter and64million referenced-image pixels per title. Worker extraction is capped at20seconds; native images retain existing size/type/dimension limits. The library remains12titles/32MB with48MB backup input.

See [EPUB scope and evidence](../docs/PWA-EPUB-0.6.0.md). This candidate includes the separate0.5.1 update fix. Neither candidate has been deployed; the protected pilot remains0.5.0. Parent/release review is required before another upload. Paper appearance options, sync, providers, CBR and additional reader features are outside this milestone.


0.7.0 local continuous-scroll candidate: gapless/separated page spacing, bounded nearby rendering and continuous scriptless EPUB chapters. Preserves original page margins and bytes; no cropping. Pending final gates and independent review; not deployed.

Page spacing offers Gapless and Separated without cropping source margins. The setting stays in this browser profile; EPUB text settings and book progress retain existing storage/backup formats. Continuous EPUB uses reserved chapter heights and at most two scriptless frames. See ../docs/PWA-CONTINUOUS-SCROLL-0.7.0.md for bounds and verification status.


0.7.1 local patch candidate removes fractional paint clipping from touching gapless slots. Geometry, source pixels, separated spacing and saved-position formats are unchanged. Pending patch review; not deployed.


## Direct page navigation0.8.0 - local candidate

PDF, images and CBZ now have Previous page, Next page and Go to page controls. Enter a whole page number within the title. Navigation checkpoints the current position before moving and acknowledges the destination; a failed save remains visible and retryable. EPUB keeps its chapter controls. No spacing/text/default preference or storage-schema migration is introduced. The candidate includes the reviewed0.7.1 gapless seam fix and remains local only. See [scope and lineage](../docs/PWA-NAVIGATION-0.8.0.md); the protected hosted pilot still serves0.7.0.


## Local 0.60 work: explicit per-title offline check

Title details now offers **Check this title**. This reads the existing local source and any declared custom cover, compares all saved byte fingerprints, and separately renders only page 1 or lays out chapter 1 (including that chapter's images). CBZ imports are stored image collections. A successful sample never means every page or chapter was rendered.

Results exist only in this open details view. Closing/reloading, leaving the window, or detecting a title/library revision change clears the result; explicit retry checks again. Nothing is saved to the book, reading progress or backup format. A snapshot does not promise future browser retention, Access validity, or provider download availability. Keep a verified backup.

This local development slice is not deployed or release-qualified. Focused test: `node tests/offline-audit.cjs`; full release-window regression/device acceptance remains separate. Frozen 0.50.1 artifacts and production 0.40 are unchanged.