lgi://changelog

Changelog

Current v4.0.4.3.2

v3.10Hull Integrity

v3.10 reinforces the project's structural frame: lifecycle rules become easier to locate, architecture boundaries become harder to bypass, production flows gain explicit contracts, and operational signals become concrete enough to act on.

v3.10.5.1

27 Jul 2026

Fixed

Repository guides now point to the live migration, authentication, schema, deployment, and responsibility-layer owners, with automated reference checks covering root documents and bare file paths so those claims cannot silently drift.
Architecture documentation now states that deny-by-default applies between different zones while imports within one zone remain unrestricted.
Version 3.10's first close-audit evidence and remediation records are now part of the version history.

v3.10.4.3

26 Jul 2026

Added

Live prices now share a clear refresh signal that pulses while data is updating, then flashes and bounces when the new value arrives while respecting reduced-motion preferences.

Changed

The Phase 4 presentation punch ledger and adoption re-audit are complete, with every reported item dispositioned and the shared presentation system re-verified.
Industry-planner figures, ownership tones, blueprint imagery, disclosure controls, skill breakdowns, and related-input highlighting now present their meaning more clearly while keeping the established planner structure.
Loading routes and menus now preserve the shape of the content that is coming, the signed-in header keeps a stable hydration state, and concurrent notices remain readable in a stack.
Page scrolling now stops firmly at the document boundaries instead of rubber-banding past the top or bottom.

Fixed

Active industry jobs now choose blueprint or product artwork according to the job activity instead of falling back to monograms when EVE repeats a blueprint type as the product.

v3.10.4.2

26 Jul 2026

Added

The change log and development log now open their contents navigation in a mobile drawer that follows a swipe directly, keeps the current chapter visible, and closes after navigation.
Page settings on small screens now live in the main menu, keeping them available without crowding the header.

Changed

Page headings, labels, data values, reading surfaces, and supporting text now use shared semantic type roles, giving the application a calmer and more consistent hierarchy.
The application header now gives tools more room, keeps navigation beside the signed-in account, and retains visible separators between destinations.
Reading pages now distinguish their contents rail from the document, keep the active chapter legible as the page hydrates, and use persistent, higher-contrast scrollbars wherever content is bounded.
Responsive behavior now follows one declared breakpoint ladder across the shared shell, header, navigation, content browser, cards, and planner surfaces.

Removed

Retired the remaining temporary header and content-browser style families, along with legacy font and tracking utilities replaced by the shared presentation system.

v3.10.4.1

26 Jul 2026

Added

Shared controls now cover the remaining common interface shapes, including multi-select filter chips, compact selectors, inline number adjusters, semantic data tables, reading surfaces, and a wider status-dot vocabulary.
Automated checks now inventory every shared interface component, reject newly hand-built copies of the behavior or styling it owns, and pin each necessary native-element exception to its exact owner.

Changed

Site filters, planner controls, status displays, admin tables, reading pages, cards, notices, loading states, and repeated rows now use the shared component layer while preserving behavior and intended appearance, with the locally approved differences recorded for this release.
The sites catalogue class filters now form a balanced three-column grid, the change log restores its item markers, the server-status display keeps the navigation treatment, and active industry jobs keep their type and character icons aligned inside the table.

Removed

Retired roughly 650 lines of page-specific interface styling and the one-off interface audit script after their responsibilities moved into shared components and the standard verification gate.

v3.10.3.3

25 Jul 2026

Added

The Under the Hood dev log now publishes the shape of the codebase as a map. Every part of the project appears as both a row and a column, and a lit square marks a permission: the part on that row is allowed to build on the part in that column. An empty square between two different parts means that import is not allowed, because the rules permit nothing they do not name. Every lit square sits on one side of the diagonal, which is what it looks like when dependencies only ever point one way. The diagonal itself is a part paired with itself, which the rules never restrict. Two special cases are marked out: the single sanctioned shortcut into the shared EVE data core, and the one place where request handlers are sorted ahead of the page tree.
That map is generated from the very configuration the build already enforces, rather than drawn by hand, and a test compares the committed picture against the live rules on every run. A rule change that is not accompanied by a regenerated map fails the build instead of leaving a diagram that quietly stops being true. The full flowchart source is committed beside the rules and renders on GitHub for anyone who wants to read the raw graph.

Changed

The dev log's writing format gained a marker for placing the generated map, so a document decides where the map appears instead of the page hardcoding it. Adding a new kind of dev-log content now fails to compile until it has something to render it.

v3.10.3.1

25 Jul 2026

Added

Every important request, scheduled task, and background job on the site now records what it was doing and how it turned out. Each record carries the feature and operation by name, whether it succeeded or which category of failure it hit, its stable error code, how long it took in total and how much of that was spent waiting on the database, EVE's servers, or the shared cache, whether it was retried or rate limited, and the site version it ran on. The reference code shown when something goes wrong is now the same code written down on the server, so a reported problem can be found rather than guessed at.
The operations dashboard gained a service-indicator panel: page and tool success rate, save success rate excluding requests the site correctly rejected as malformed, the slowest five per cent of the reads and writes people actually wait on, EVE service success and throttling, and the background-job backlog with anything that gave up. Each indicator names who acts when it degrades and exactly what they do, so a bad number leads somewhere instead of just being visible. An empty period reads as no data rather than as total failure.
A new register judges every piece of work the platform can run more than once — scheduled tasks, background jobs, the retry queue and its recovery, outbound alerts, and every request that changes something — and records for each what could cause it to run twice, whether that is harmless, and the specific evidence for that conclusion. Automated checks fail if the register and the live code stop agreeing. Nothing was found to be at risk of duplicating or losing work.

Changed

Adding a new request handler or scheduled task now requires naming the operation it performs; work that is not named no longer builds, and a separate check walks every request handler on the site to confirm none slipped through.
A rate-limited request is now recorded like any other outcome. Previously a request rejected for hitting its limit returned before any of this recording began, so a surface being hammered would have looked idle rather than busy.
The site's usage panel deliberately ignores these new internal records, so the visitor numbers it reports mean exactly what they did before.

v3.10.2.4

25 Jul 2026

Added

Every outside service the site depends on now carries one recorded resilience policy: the module that owns the call, its time limit, which errors it retries, how it backs off, its rate-limit behaviour, whether repeating a call is safe, what happens when the service is unreachable, and the fields it reports. A service with no programmatic call surface records that fact rather than an invented policy, and automated checks compare every declaration against the live code so a claim that stops being true fails the build.
New checks reject an outbound request made without an explicit time limit, confine each service's toolkit to the single module that owns talking to it, and pin the EVE login host to its one owner the same way the ESI host already was.

Changed

Requests to the shared cache and rate-limit store previously ran with no time limit at all and up to five silent retries. Each one now states its own limit and retry count, so an outage of that store surfaces in about two seconds and falls into the behaviour the site already had for it, instead of holding a page open toward the hosting platform's request ceiling.
Database queries over the HTTP driver now carry an explicit thirty-second ceiling, chosen high enough that no genuine query can reach it. A query that does hit it now fails immediately and visibly, instead of being mistaken for a waking database and retried into a two-minute wait.
The connection-establishment limit for the direct database clients is now stated at every place one is created and owned in a single definition, rather than silently inherited from the driver.
Search Console synchronisation now bounds both of its outbound steps: the data request, and the access-token request its library makes on its own.
Code that needs a database client only as a type now takes it from the project's own definitions instead of reaching for the driver package.
Contributor documentation and the example environment file now describe everything the shared cache store backs, rather than only rate limiting.
The release watch tool gained a mode that reports whether the merge gate would actually accept the current commit, evaluating the gate's own rule rather than a second copy of it, so the watch and the merge can no longer disagree. It also recognises when the review service has declined to review because it is rate limited, and keeps waiting instead of reporting a problem that only time can fix.

Fixed

The merge gate stopped counting a finding from the secondary code-review service as soon as any later commit landed, because it matched findings against the newest commit. That rule is right for the primary service, which moves a still-open finding forward to each new commit, and wrong for the secondary one, which leaves a finding attached to the commit it was found on. An open finding could therefore be quietly ignored once work continued past it. Findings are now cleared only by being resolved, whichever commit they sit on.
The merge gate could never be satisfied when the secondary code-review service was acting as the reviewer of record and a pull request had needed a fix. That service reviews incrementally: it does not re-review a commit it has already seen, and instead marks the original finding as addressed in the commit that fixed it. The gate only recognised a freshly filed review, so it kept reporting that the current commit was unreviewed. It now also accepts that service's own confirmation naming the exact commit, while still refusing to merge when a review was skipped or rate limited.

v3.10.2.3

24 Jul 2026

Added

Every stored table now records the area of the codebase that owns it, the areas allowed to read or write it, the rules the database itself enforces, a statement of how its writes behave if interrupted partway, and the authorization model that protects it. These declarations are compared against the live database schema in both directions, so a schema change that skips them fails the build instead of drifting quietly.
A new source scan attributes every database write to the area of the code that makes it, and the build now fails if an area writes a table it does not own without a recorded reason for doing so.
Row-level security is now an explicit recorded decision for each category of data rather than an unwritten default, and automated checks reject switching it on anywhere a decision does not justify it.

Fixed

Two asset refreshes running at the same moment for the same character or corporation can no longer record the same holding twice, which previously could inflate the quantities the industry planner adds up. The database now rejects the duplicate outright, and the refresh that loses the race stands aside cleanly instead of leaving behind an inflated ledger, an orphaned stored response, or a misleading activity event.

Changed

The blueprint tree rebuild now states in its signature that it requires a database connection supporting transactions, which is what it has always needed at runtime.
Detecting duplicate-key database errors, and normalizing module paths, each now have one shared owner instead of separate copies in different files.
Corrected a description that claimed an asset save and its stored source response shared one database transaction; they never did on the request path, and the surrounding cleanup behaviour is now stated accurately.

v3.10.2.2

24 Jul 2026

Changed

Browser mutations now reject an explicit Origin or Referer mismatch with a standard 403 problem response, while same-origin requests and callers without provenance headers continue unchanged.
The mutation gate order and its CSRF rationale now have one documented owner, and every mutating API route is classified as using the shared pipeline, a direct gate, or a recorded exemption.

v3.10.2.1

24 Jul 2026

Added

Every first-party API endpoint now declares one contract covering its method, path, request body, query and path parameters, and each response status it can return, and callers execute that contract with the response validated at runtime.
API failures now share one typed vocabulary published as standard RFC 9457 problem responses with stable machine-readable codes.
New checks reject a route with no contract, a contract with no route, a hand-assembled same-origin URL, and a response body asserted into a type instead of validated.
Added paired adversarial-review and agent-policy-audit workflows with deterministic policy-drift coverage.
Each completed development session now leaves a validated as-built record documenting what actually shipped, the PR that carried it, and notes for the next session; records are archived with each version.

Changed

Internal calls from the live-sync backend into the app now go through the same endpoint contracts as the browser, so a response that drifts from its contract is reported instead of quietly flowing on as trusted data.
Signing out, signing in with EVE, and minting the live-sync token now use the authentication library's own typed client rather than hand-maintained copies of its request and response shapes.
Wormhole-site list filters and site detail lookups now take their parameter names and validation from the endpoint contract, so a link cannot drift from what the route accepts.
A malformed teardown request from the live-sync backend now answers with a plain rejection instead of an internal error.
The merge gate now falls back to the secondary code-review service when the primary one does not review a pull request at all, and it still requires that fallback to have reviewed the exact commit being merged. A pull request the primary service did review is decided by that service as before.
Hardened agent guidance and workflow checks so ordinary work stays outside lifecycle state and agent procedures use executable inputs and outputs.
Session contracts and plans are now treated as frozen planning prompts: divergences are captured in the as-built record instead of rewriting approved documents, and the lifecycle resolver enforces the record's shape and its seal over the finished prompts.
The typed error contract sub-version was restructured into three ordered sessions covering the full end-to-end type-safety migration, with the first session planned and the remaining two contracted.

Removed

The previous untyped API client model and its compatibility overloads are gone, leaving exactly one contract system in the codebase.

v3.10.1.2

23 Jul 2026

Added

Source code now has explicit composition, platform, transport, data, configuration, and script responsibility layers, enforced as a one-way dependency map.

Changed

Cross-slice workflows and app-shell composition now sit above reusable slices, while shared authentication, ESI, search, purge, page-settings, and owner-sync capabilities sit below them.
Dependency cycles now fail verification, and client code is mechanically blocked from importing server-only roots.
The internal codegraph orientation reminder now fires once per session instead of repeating on every source-file read.
The merge gate no longer counts a resolved code-review comment that has gone outdated, so a fixed finding stops blocking an otherwise-clean merge.
The automated code-review loop now waits for every review bot and check to finish before batching fixes into a single push, so a new fix no longer cancels a review already in progress.

v3.10.1.1

23 Jul 2026

Added

A single architecture map now records what every source zone owns, which dependencies it may use, and which responsibilities it must not absorb.

Changed

Fallow now classifies every production source area under an explicit dependency rule and rejects newly introduced source files that have no named architectural owner.
Agent workflow guides and runtime skills now use consistent agent-facing instructions and readable chat result formats.

v3.10.0.4

22 Jul 2026

Changed

Agent workflows now have one canonical executable procedure each, while Claude Code and Codex skills contain only their runtime-specific invocation and return mechanics.
Version planning now minimizes sessions, branches, and pull requests before contracts are written, and approved session bundles remain intact unless a recorded hard split trigger fires.
Session contracts now declare their execution profile, delivery unit, roadmap coverage, internal phases, and split triggers, with resolver and drift checks enforcing those boundaries.
Development work is now two independent tracks: ordinary changes ship directly from a request without consulting the lifecycle resolver, while planned version work runs only through start-session on a deterministic per-sub-version branch.
Ordinary out-of-band changes now record a hidden pending changelog note that a later planned release folds into its public version entry, so routine fixes stay out of version accounting until they are published.

Removed

Superseded planning, design, audit, primitive-ledger, and Phase Zero contract documents were retired after their live responsibilities moved to canonical owners.
The rider one-off branch workflow was retired; no branch name carries any special lifecycle meaning, and the resolver only answers what the next planned action is rather than gating ordinary work.

v3.10.0.3

21 Jul 2026

Changed

Close-out now runs from one canonical procedure, including one coverage-backed definition-of-done checkpoint after the finalized diff and workflow checks.
Claude Code and Codex use thin runtime adapters that retain only native task-list and background-process mechanics.

Removed

Three superseded close-out documents were retired after their live guidance moved to the canonical procedure.

v3.10.0.2

21 Jul 2026

Added

Canonical forms now define the required structure for session contracts, approved plans, health metrics, and changelog entries.
Package installation now holds newly published releases for seven days, reducing exposure to compromised supply-chain updates.
Small one-off changes can now ride a dedicated rider branch that the lifecycle resolver steps aside for, so routine fixes stay out of version accounting and merge on their own schedule.
The resolver now names the branch for the next action and treats the moment a new master version opens as a normal transient rather than a release-consistency failure.

Changed

The lifecycle resolver now validates contracts and plans from their canonical forms and requires release consistency before dispatch.
The code-health baseline now contains only frozen version-start and current measured values, with automated checks rejecting prose, unregistered metrics, and edits to the frozen anchor.
Update-watch reports now use linked, escaped tables with installed and patched versions, dependency scope, and a collector-owned issue body shared by both agent runtimes.
Skill freshness is now tracked by a per-skill ledger tied to the exact policy documents each skill depends on, so a policy change flags only the skills it actually affects instead of every skill at once.
The feature branch for the next unit of work is now opened at the start of that work rather than at the end of the previous session.
Codegraph 1.4.1 now owns graph-first repository exploration, synchronized indexing, and guard hooks in both agent runtimes, replacing the previous graph tooling without changing application behavior.

Fixed

Patched overrides remove four transitive development-tool advisories, and the installed archive-library types now match the library's current major version.

Removed

Redundant lifecycle and session-planning narratives were retired after their enforceable rules moved into the resolver and canonical forms.
The rule that forced every Claude helper agent to run as a headless external worker was removed, so Claude again coordinates its own helper agents directly.

v3.10.0.1

20 Jul 2026

Added

Document-reference checker coverage now proves that lifecycle records may cite archived or planned paths without weakening warnings or checks for active guidance.

Changed

Lifecycle records now rely on their purpose-built validators instead of generic repository-path policing, while ordinary guides and agent instructions remain fully checked.
Claude subagent guidance now leads with proactive task-scoped delegation while retaining headless GPT-5.6 Sol workers as the required execution mechanism.

Fixed

Agent workflow catalogs, Convex cost guidance, lint messages, local worktree declarations, and release identity now match the repository's shipped behavior and current structure.