diff --git a/CHANGELOG.md b/CHANGELOG.md
index bff3fe3..def48b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to `ichava/core` follow [Keep a Changelog](https://keepachan
 
 ## [Unreleased]
 
+## [0.1.0] - TBD
+
+First release of `ichava/core`. The repository is published as a single commit; the 0.1.x tags cut between 2026-10-23 and 2026-10-27 (v0.1.0 to v0.1.3) are folded into this release, and their notes are kept below under *Archived history*.
+
 ### Added
 
 - **One pack model, with a simple and an advanced path** (Proposal 2). Every set now registers as a `Data\PackDefinition` through `IconRegistry::register()`, built by the fluent `Support\Pack\PackBuilder` from a `config.json` (`PackBuilder::fromDirectory()`), from code (`PackBuilder::make('vendor/package', $filesPath)`), or both. Each builder method writes a key an existing reader consumes (`prefix`, `about`, `variant`, `defaultVariant`, `categories`, `kind`, `categoryKind`, `kindRule`, `itemKind`, `themeTwin`, `alias`/`aliases`, `defaultClass`, `defaultAttributes`, `fallback`, `providedBy`, `component`, `metadata`, `withOptions`, `when`). Fluent scalars replace the file's, maps merge per key, and fluent kind rules come first. `fromDirectory()`, `package()` and `custom-icons` all delegate to it, and a golden snapshot over 31 pack directories (19 estate packs and every fixture) proves registration is unchanged. `IconRegistry::definition()`/`definitionAt()` return what a set registered with, and a pack's constants class reads it through `Support\Pack\PackConfigReader`, so it sees the builder's overrides. `docs/tools/pack-registration.md`. `tests/Feature/PackBuilderTest.php`, `RegistrationGoldenTest.php`, `JsonConfigConstantsReadsDefinitionTest.php`.
@@ -28,24 +32,22 @@ All notable changes to `ichava/core` follow [Keep a Changelog](https://keepachan
 - **`KindResolver::declaredResolution()`**, the resolver's category, pack and default rows as one entry point. `KindResolver::resolve()` ends in it, and `JsonConfigConstants::getCategoryKind()`/`getPackageKind()` now delegate to it, so a pack's constants class cannot disagree with the resolver. Same answers as before. `tests/Feature/JsonConfigKindDelegationTest.php`.
 - **A test that a pack installs by being required** (W1): a fixture `installed.json` names a pack provider in `extra.laravel.providers`, and the pack is registered and seeded with no registration call. `tests/Feature/PackDiscoveryWiringTest.php`.
 
-### Fixed
-
-- **The nightly catalogue sync updates the installation guide's pack table with the catalogue.** `bin/sync-icon-sets.php` rewrote `icon-sets.json` alone, so a count change opened a pull request that `InstallationPackTableTest` failed: #179 moved tabler to 6,287 and openmoji to 8,990 while `docs/installation.md` still said 6,257 and 8,568. After writing the catalogue, the script now sets each table row's count from it with `withPackTableCounts()`, and the workflow commits both files. Rows, order and repositories are left as written, so a set added or removed still fails the table test. `tests/Unit/SyncIconSetsDocTableTest.php` covers it (proven red by leaving the counts alone).
-- **The nightly catalogue sync no longer puts Twemoji's pre-split values back.** `bin/sync-icon-sets.php` reads each pack at its latest tag, and `icon-sets-twemoji`'s `v0.1.0` still holds OpenMoji, so #176 proposed 10,567 "Emoji Sets" over the recorded 3,435 "Twemoji". A set in `icon-sets.json` may now carry a `hold` (`tag`, `commit`, `reason`): while that tag is the latest release at that commit the sync keeps the set's snapshot, and the hold drops itself once a newer tag is cut or the tag moves. The twemoji set is held at `v0.1.0`. `tests/Unit/SyncIconSetsHoldTest.php` covers it (proven red by ignoring the commit).
-- **A pack listed with the application boots again.** `PackConfigCache` resolved the cache store when it was built, and a pack's constants class builds it while the providers are still registering, before the store exists, so every pack failed to boot with `Target class [cache] does not exist` (found running the packs against #172). The store is now resolved when it is used. Core's own pack tests registered their fixture after boot, which is why none saw it; `tests/Feature/PackBootsInProviderListTest.php` lists the fixture with the application.
-- **`InformationService::discoverPackages()` finds the installed packs.** It globbed `vendor/*/ichava-*`, which matches no pack (packs install as `vendor/ichava/icon-sets-*`), and reported `registered` through `IconRegistry::has()`, which looks up an icon, not a package, so `ichava::ichava-core.info discover` listed nothing. It now asks `Composer\InstalledVersions` for every package of type `ichava-icon-set` and reports `registered` through `IconRegistry::isRegistered()`. The signature and return shape are unchanged. A pack is identified by its composer type and nothing else (owner, 2026-11-05): the `vendor/*/ichava-*` directory glob is removed, since no pack in the estate matched it, and the `platform/ichava` scan now keeps only a directory whose composer.json declares `ichava-icon-set`, keyed by that file's `name` instead of `ichava/<directory>`. A checkout there without the type is no longer listed. `tests/Feature/InstalledPackDiscoveryTest.php`.
-- **The installation guide no longer says core is on Packagist.** Nothing in the family is (`repo.packagist.org` answers 404 for core, every pack and the four `laranail/*` packages). `docs/installation.md` step 1 is now the one place that lists the repositories an application adds, `ichava/core` included; the README and every pack link to it.
-- **The US and UM flags keep their stars.** Both draw the fifty stars as one `<marker>` repeated by `marker-mid="url(#us-a)"`, and `resources/security/svg-policy.json` did not allow `<marker>`, so the sanitiser removed it and the reference pointed at nothing. The policy now allows `<marker>` and its geometry (`refX`, `refY`, `markerWidth`, `markerHeight`, `orient`, `markerUnits`), the same bytes as ichava/icon-sets-sync#91. Scripts, `on*` handlers and external `href` on or inside a marker are still stripped, and `marker-*` still take only `none` or `url(#fragment)`. `tests/fixtures/svg/presentation-vectors.json` gains 8 attribute rows and 6 whole-document rows, which `SvgPresentationParityTest` runs through the full sanitiser.
-- **The discovery-cache tests no longer fail under `--parallel`.** The services write through `cache()->store('file')`, and Testbench points that store at one directory under `vendor/`, shared by every test and every parallel worker. Two workers searching for the same term wrote the same key, so one read the other's result against its own empty database, and a `flush()` in one worker deleted directories another was scanning (`UnexpectedValueException`). `DiscoveryCacheInvalidationTest` or `DiscoveryActionsTest` failed in 6 of 10 parallel runs; with each test owning a temporary file-cache directory, 10 of 10 pass. Test-only: no production code changed. `tests/Feature/FileCacheIsolationTest.php`.
-
-### Security
+- **An icon's subcategory, `sub`.** `IconBrowserService::getIcons()` loads each term's `parent_id`, which tells a nested category from a top-level one, and the new `Icon::$primary_subcategory` returns the nested category the icon sits in (null at the top level), reading the loaded terms when they carry `parent_id` and querying otherwise. `transformIcon()` adds `sub`, the subcategory's slug; every other key is unchanged. This is the per-icon counterpart of the `subs[]` filter. `tests/Feature/IconSubcategoryTest.php` (all 4 cases fail on the previous code).
 
-- **Conflict floors for four Symfony components** (`composer audit`, 2026-11-05). `symfony/http-foundation`, `http-kernel`, `routing` and `yaml` below 7.4.23, or from 8.0 below 8.1.11, carry seven advisories (among them CVE-2026-118514, HEAD requests bypassing `access_control` methods, and CVE-2026-118516, host placeholders matching the start of the path; PKSA-nktx-f1n1-b4yd, YAML parse-time blow-up). `composer.json` now declares them as `conflict`, which Composer also applies when core is a dependency, so a pack or application installing core cannot resolve a vulnerable release.
-- **The CSS `url()` guard can no longer be bypassed** (S1, 2026-11-04 security audit). The guard matched the literal characters `url(`. So a CSS escape (`\75rl(`, `\000075rl(`, `u\rl(`), a comment inside the token (`u/**/rl(`), or a fetching function with no `url(` in it (`image-set(`, `-webkit-image-set(`, `image(`, `src(`, `cross-fade(`, `element(`) kept a style that made the viewer's browser fetch an attacker's URL. A new `Support\SvgCssGuard` tokenises a value as a browser does, then allow-lists it: `url()` survives only for a same-document fragment, other functions only from a short list of inert ones (colour, `var`, maths, transform, easing), and no at-rule survives. The check covers the `style` attribute, `<style>` element text, and the CSS-valued presentation attributes (`fill`, `stroke`, `filter`, `clip-path`, `mask`, `marker-*`, and others). `url(#gradient)` is unaffected. Across all 135,112 pack SVGs, no sanitised output changed. `RENDER_PIPELINE_VERSION` is now 3, so an entry cached before the fix is not served. `tests/Unit/SvgCssUrlGuardTest.php`.
-- **The sanitiser has a byte cap and an element cap** (S2). Before, a 5 MB illustration with about 374k nodes took 9.5 s to sanitise inside a request. Now `svg.max_bytes` (`ICHAVA_SVG_MAX_BYTES`, default 4,500,000) is checked before parsing, and `svg.max_elements` (`ICHAVA_SVG_MAX_ELEMENTS`, default 30,000) is checked during the walk. Either refuses the file with an `IchavaException` and logs `svg.limit_exceeded`. Both values match react-icon-browser and icon-sets-sync. The serve path now also checks the kind's `max_file_size` before reading the file, where before it read the file without checking. `tests/Unit/SvgSanitiserCapsTest.php`, `tests/Feature/SvgServedSizeCapTest.php`.
-- **Processing instructions and CDATA no longer pass through the sanitiser** (S5, S10). A processing instruction inside the root (`xml-stylesheet` names an external sheet) is stripped. A CDATA section becomes ordinary text, escaped on output, because parsers disagree about CDATA inside `<title>`: parse5 builds elements from it where Chromium does not. `tests/Unit/SvgNodeTypesTest.php`.
-- **The version check connects to the address it validated** (S8). The SSRF guard resolved the host and the HTTP client resolved it again, leaving a DNS-rebinding window. The validated addresses are now pinned with curl's `CURLOPT_RESOLVE`. `tests/Unit/UpdateCheckerDnsPinTest.php`.
-- **Every workflow's top-level token is read-only** (S9). `release.yml` granted `contents: write` to the whole workflow; it now defaults to `contents: read` and grants the write to the one job that publishes the release. The other five workflows already declared `contents: read`, or `{}` for release-please, which uses only its app token. `tests/Unit/WorkflowPermissionsTest.php` fails when a workflow has no top-level `permissions:` or grants a write there.
+- **`icon-sets.json` carries `icon_counts` per set, split into `icon` and `illustration`.** `bin/sync-icon-sets.php` classifies each committed SVG by the registry's own rule: the first directory under `files/` is the category, and a category's `kind` overrides the pack's `package.kind`, which defaults to `icon`. The counts are files, like `icon_count`, so they always add up to it. The field is optional, so `IconSetCatalogService`'s six required fields are unchanged, and the nightly sync fills it in. Closes gap k2 of the release-0.1.0 plan. `tests/Unit/SyncIconSetsKindCountsTest.php`.
+- **SVG kind, `icon` or `illustration`, end to end.** A pack declares kind in `config.json` per category (`metadata.data.categories.<slug>.kind`) with `package.kind` as the pack default and `icon` after that; `PackConfigData` parses it and `IconRegistry::fromDirectory()` records it at registration, so there is no second reader of the file. A new migration adds `ichava_icons.kind` (string, default `icon`, which is the backfill) with an index on `(kind, package)`, and a nullable `theme_variants` JSON column. `SeedIconsJob` and the file watcher both classify through a new `Support\IconClassifier` and write the kind; kind is part of change detection, so a re-seed without `--force` re-files unchanged files. New query surface: the `Enums\IconKind` enum, `Icon::scopeOfKind()`, `IconRegistry::kindFor()`/`kindOf()`, `JsonConfigConstants::getPackageKind()`/`getCategoryKind()`, a `kind` filter in `IconBrowserService::getIcons()`, a `kinds` facet in `getFilters()`, `by_kind` in `getStatistics()`, `kind` on tree nodes, and `kind`/`themes` in `transformIcon()`. Config: `kinds.default` (`ICHAVA_DEFAULT_KIND`). See `docs/kinds.md`. `tests/Feature/IconKindTest.php`.
+- **Theme twins are variants, not items.** A category declaring `"theme_variants": {"dark": "-dark"}` pairs `scene-dark.svg` with `scene.svg`: the twin is recorded on the light file's row and gets no row of its own, and a twin row seeded earlier is removed on the next seed. A suffixed file with no light sibling stays an item. `Icon::themes()`, `hasTheme()` and `themeSvgContent()` serve the twin through the same sanitising pipeline as `svg_content`, which moved verbatim into a private `processedSvg()` for that.
+- **Browser data from core** (wire-in plan core rows, gap review #2–#4). `IconBrowserService` has one filter path, `filteredQuery()`, behind the grid, the facets and the tree, adding `tags[]`, `keywords[]` and `subs[]` (nested categories and the variants within a category), and a `language` choice for full-text search on PostgreSQL (`FtsLanguageHelper::selectableLanguages()`, guarded by `guardLanguage()` through `validateLanguage()`). `getFilters($filters)` and `buildIconTree($filters)` take the same filters: each facet is counted over what the other filters select, and the tree over the selection; without filters both stay corpus-wide and cached. `getFilters()` gains `variants_by_package`, each pack's variants as the new `Data\VariantData` (label, description, attributes, preview icon, colour scheme, order, default) with the pack's translated `variant_descriptions` winning; the registry now loads every `*_descriptions` group into `labels`. JsonConfigConstants' variant getters read through `VariantData` and gain `getVariantData()`/`getVariantDataList()`. Packages carry `default: true` for the registry's default set and `kind`. Pack counts come from `DatabaseOperationsService::getPackageStatistics()`, and a parent category in the tree carries `total`, its subtree count from `IconTerm::getTotalIconCount()`. `SeedIconsJob` reads terms through `IconTerm::inPackage()`. `tests/Feature/BrowserDataWiringTest.php`.
+- **`Actions\UpdatePreferences`**, the one entry point for a preferences write (packages, categories, search, sorting, UI preferences, tree state), so icon-browser's REST and Inertia routes behave alike. Each section goes through its `IconPreferenceService` setter; an unknown section is ignored, an unknown sort direction falls back to `asc`, and the result is cleaned by `validate()`. `tests/Feature/UpdatePreferencesTest.php`.
+- **Status and a doctor.** `Ichava::status()` and `InformationService::status()` return `Data\StatusData` (lifecycle, registry conflicts, orphaned rows, discovery counts, last watcher scan, logging flags, last cache rebuild via a new `RecordCacheRebuild` listener, optimisation level and render fingerprint), with no absolute paths. `info status` prints it after the lifecycle block; `info doctor` checks packs, migrations, seeds, cache, the queue connection, host auth, the `ichava.admin` Gate, mounted browser routes and orphans, and exits non-zero when something required is missing. `info discover` shows each pack's layout.
+- **Watcher controls.** `watch --package=<name>` rescans one pack now (`IconWatcherService::rescanPackage()`), `watch --refresh` records every pack's fingerprint (`refreshFingerprints()`, through `updateAll()`), and `watch` prints the last scan time. A synced pack's cached `config.json` is forgotten, and `IconCacheService::clearAll()` forgets every pack's (`configs` in its result), so an edited `config.json` is no longer served stale until the TTL.
+- **Strict conflict mode.** `registry.strict_conflicts` (`ICHAVA_STRICT_CONFLICTS`, default off) throws `iconSetAlreadyRegistered`, `prefixConflict` or `bladeComponentConflict` instead of warning.
+- **Both extension interfaces have implementers.** `Support\ServiceProvider` implements `IchavaPackageInterface` through the registry (version from Composer). A new `Drivers\DirectoryIconDriver` implements `IconDriverInterface` over one directory; `SvgDriver` itself cannot, because its `render()` takes a resolved `IconData`. See `docs/tools/query-api.md`, which also documents the model and event API the plan keeps.
+- **Plug-and-play host user.** Ichava reads the host's signed-in user instead of running auth of its own. New contracts `Contracts\ResolvesUser` (default `Support\Auth\GuardUserResolver`, reading `ichava.ichava-core.auth.guard`, null for the default guard) and `Contracts\PresentsUser` (default `Support\Auth\DefaultUserPresenter`), the `Data\UserData` DTO (`id`, `name`, `avatarUrl`, `abilities`; no email, password or token, with an `auth.expose` opt-in that still refuses secrets), and `Ichava::resolveUserUsing()`, `presentUserUsing()`, `user()` and `currentUser()`. Config: `auth.guard`, `name_attribute`, `avatar_attribute`, `expose`, `abilities`. See `docs/host-user.md`. `tests/Feature/HostUserTest.php`.
+- **Gates with safe defaults.** `ichava.admin` is defined as a denial when the host has not defined it, and `ichava.manage-cache` (the ability ichava/icon-browser checks) falls back to `ichava.admin` when the host defines admin but not manage-cache. Both are defined after every provider boots, so a host's own definitions win. With neither defined by the host, `manage-cache` stays undefined, so icon-browser keeps its "not configured" message.
+- **Owner-keyed preferences contract.** `Contracts\OwnerPreferenceStore` (keyed `owner_type`/`owner_id` through `Data\PreferenceOwner`) is the contract icon-browser implements with its own table; core ships no migration for it. `PreferenceStore` now resolves to `Support\OwnerAwarePreferenceStore`, which routes a signed-in user to the bound owner store and keeps the session store for guests; with no owner store bound it delegates every call to the session store as before. On the host's `Login` event, `Listeners\MergeGuestPreferencesOnLogin` folds the guest's session preferences into the owner's store through `Actions\MergeGuestPreferences` (owner wins, lists unioned, collections unioned by id, guest cleared only after the write succeeds).
+- **Host events.** `Events\FavoriteToggled`, `Events\CollectionChanged` and `Events\PreferencesChanged` are dispatched by `IconPreferenceService`, each carrying whether the write persisted. `IconRegistry` now dispatches the registration lifecycle: `processing`, `registered`, `completed` once per deduplication window, and `failed` on every failure (it rethrows as before).
+- **Illustrations render at their own aspect and size limit.** `IconComponent`'s `lockAspectRatio` is now nullable and defaults to the icon's kind: icons still lock to a square, illustrations keep their viewBox aspect and a size preset sets only the width. An explicit value still wins. `kinds.max_file_size.<kind>` (`ICHAVA_ILLUSTRATION_MAX_FILE_SIZE`, 5 MB for illustrations) sets the file-size ceiling per kind, threaded through `SvgDriver::render()`/`load()` as a new optional trailing `$maxBytes` argument and applied by the watcher; icons keep `max_file_size`. A test pins that a multicolour illustration keeps every colour and gradient, with and without the monochrome conversion.
 
 ### Changed
 
@@ -76,45 +78,6 @@ All notable changes to `ichava/core` follow [Keep a Changelog](https://keepachan
 - **The author and contact address is `ichava@simtabi.com`** (W-11, Sim 2026-11-03), replacing the community address `opensource@simtabi.com` wherever this repository named it. Vulnerability reports still go to `security@simtabi.com`. The test that guards the address expects `ichava@` now.
 - **The SVG policy's `_always_blocked_comment` describes the parked brand logos.** The five raster-wrapping brand logos it called "render blank" are now parked outside their pack's registered assets (OQ-018), so the comment says so. Only that underscore-prefixed comment changed; the policy is identical. The copies in icon-sets-sync and react-icon-browser are re-synced to the new digest (`950214c5828531987ecfa72f1055ab3491c3c664336eaca657cc04907400d390`).
 
-### Removed
-
-- **`IchavaServiceProvider::isIchavaQueueCommand()`**, unused since C-01 moved the runtime limits into `RuntimeLimits`. **`IconSetBuilder::$discoveredIcons` and `$initialized`**, which nothing wrote or read.
-- **Forward-only renames, with no alias left behind** (owner, 2026-11-05): `Support\IconPackServiceProvider` and `Support\ServiceProvider` (now `Providers\IconPackServiceProvider`, `Providers\PackServiceProvider`), `Actions\CountSvgFiles` (now `Support\SvgFileCounter`), `ClearDiscoveryCaches::generation()` (now `DiscoveryCacheGeneration::current()`), and `__invoke()` on four actions (now `handle()`). Every caller in the estate moves in the same sweep; each is recorded in the deprecations audit.
-- **The bare `icon` morph alias** (now `ichava-icon`; the migration moves stored rows).
-The estate is forward-only (owner, 2026-11-05: "never support legacy only forward"). Nothing has been released, so these compatibility paths go rather than stay beside their replacements.
-
-- **The top-level `variants` / `categories` / `items` / `kinds` fallback in `config.json`.** `PackConfigData` reads `metadata.data` only, the shape every pack and the scaffolder's stub ship; doctor's kind checks always name `metadata.data.…` keys. No `config.json` in the estate used the top level (43 read; the one hit was the test fixture that pinned the fallback, which now pins that the top level is ignored).
-- **The `ichava` container alias for `Ichava::class`.** The facade resolves `Ichava::class`; nothing in the estate or the demos called `app('ichava')`, `resolve('ichava')` or `make('ichava')`. Resolve `Ichava::class`, or use the facade.
-- **`IconDiscoveryService::registerPackage()`**, documented as "for testing/legacy purposes". It wrote a cache key nothing read, and had no caller.
-- **`IconPreferenceService`'s pre-taxonomy fallback.** The available categories and variants were read from `ichava_icons.category` / `variant` when `ichava_icon_terms` did not exist; core's first migration creates that table, so they are read from it alone.
-- **Moving a set between packs (`package.replaces`, D9).** It existed so that `ichava/icon-sets-emoji::openmoji-*` ids kept resolving after OpenMoji moved to `ichava/icon-sets-openmoji`. The owner removed the emoji copies (2026-11-05), so nothing declares it any more. Gone with it: `Support\PackAliases`, `PackConfigData::replaces()` and `deprecatedCategories()`, `IconRegistry::canonicalId()`, `isReplaced()` and `packAliases()`, `Ichava::canonicalId()`, `IchavaLogger::deprecation()`, the seeder's and the watcher's skip of replaced items, and doctor's `alias.deprecated_ids` and `alias.replacement_missing`. A `package.replaces` key or a category's `deprecated` marker in `config.json` is now ignored. An OpenMoji id is `ichava/icon-sets-openmoji::openmoji-color/…`.
-- `tests/Unit/NoDeprecatedSymbolsTest.php` fails if an `@deprecated` tag appears anywhere in `src/` (it asserts it read at least 100 files).
-
-## [0.1.0] - TBD
-
-First release of `ichava/core`. The repository is published as a single commit; the 0.1.x tags cut between 2026-10-23 and 2026-10-27 (v0.1.0 to v0.1.3) are folded into this release, and their notes are kept below under *Archived history*.
-
-### Added
-
-- **An icon's subcategory, `sub`.** `IconBrowserService::getIcons()` loads each term's `parent_id`, which tells a nested category from a top-level one, and the new `Icon::$primary_subcategory` returns the nested category the icon sits in (null at the top level), reading the loaded terms when they carry `parent_id` and querying otherwise. `transformIcon()` adds `sub`, the subcategory's slug; every other key is unchanged. This is the per-icon counterpart of the `subs[]` filter. `tests/Feature/IconSubcategoryTest.php` (all 4 cases fail on the previous code).
-
-- **`icon-sets.json` carries `icon_counts` per set, split into `icon` and `illustration`.** `bin/sync-icon-sets.php` classifies each committed SVG by the registry's own rule: the first directory under `files/` is the category, and a category's `kind` overrides the pack's `package.kind`, which defaults to `icon`. The counts are files, like `icon_count`, so they always add up to it. The field is optional, so `IconSetCatalogService`'s six required fields are unchanged, and the nightly sync fills it in. Closes gap k2 of the release-0.1.0 plan. `tests/Unit/SyncIconSetsKindCountsTest.php`.
-- **SVG kind, `icon` or `illustration`, end to end.** A pack declares kind in `config.json` per category (`metadata.data.categories.<slug>.kind`) with `package.kind` as the pack default and `icon` after that; `PackConfigData` parses it and `IconRegistry::fromDirectory()` records it at registration, so there is no second reader of the file. A new migration adds `ichava_icons.kind` (string, default `icon`, which is the backfill) with an index on `(kind, package)`, and a nullable `theme_variants` JSON column. `SeedIconsJob` and the file watcher both classify through a new `Support\IconClassifier` and write the kind; kind is part of change detection, so a re-seed without `--force` re-files unchanged files. New query surface: the `Enums\IconKind` enum, `Icon::scopeOfKind()`, `IconRegistry::kindFor()`/`kindOf()`, `JsonConfigConstants::getPackageKind()`/`getCategoryKind()`, a `kind` filter in `IconBrowserService::getIcons()`, a `kinds` facet in `getFilters()`, `by_kind` in `getStatistics()`, `kind` on tree nodes, and `kind`/`themes` in `transformIcon()`. Config: `kinds.default` (`ICHAVA_DEFAULT_KIND`). See `docs/kinds.md`. `tests/Feature/IconKindTest.php`.
-- **Theme twins are variants, not items.** A category declaring `"theme_variants": {"dark": "-dark"}` pairs `scene-dark.svg` with `scene.svg`: the twin is recorded on the light file's row and gets no row of its own, and a twin row seeded earlier is removed on the next seed. A suffixed file with no light sibling stays an item. `Icon::themes()`, `hasTheme()` and `themeSvgContent()` serve the twin through the same sanitising pipeline as `svg_content`, which moved verbatim into a private `processedSvg()` for that.
-- **Browser data from core** (wire-in plan core rows, gap review #2–#4). `IconBrowserService` has one filter path, `filteredQuery()`, behind the grid, the facets and the tree, adding `tags[]`, `keywords[]` and `subs[]` (nested categories and the variants within a category), and a `language` choice for full-text search on PostgreSQL (`FtsLanguageHelper::selectableLanguages()`, guarded by `guardLanguage()` through `validateLanguage()`). `getFilters($filters)` and `buildIconTree($filters)` take the same filters: each facet is counted over what the other filters select, and the tree over the selection; without filters both stay corpus-wide and cached. `getFilters()` gains `variants_by_package`, each pack's variants as the new `Data\VariantData` (label, description, attributes, preview icon, colour scheme, order, default) with the pack's translated `variant_descriptions` winning; the registry now loads every `*_descriptions` group into `labels`. JsonConfigConstants' variant getters read through `VariantData` and gain `getVariantData()`/`getVariantDataList()`. Packages carry `default: true` for the registry's default set and `kind`. Pack counts come from `DatabaseOperationsService::getPackageStatistics()`, and a parent category in the tree carries `total`, its subtree count from `IconTerm::getTotalIconCount()`. `SeedIconsJob` reads terms through `IconTerm::inPackage()`. `tests/Feature/BrowserDataWiringTest.php`.
-- **`Actions\UpdatePreferences`**, the one entry point for a preferences write (packages, categories, search, sorting, UI preferences, tree state), so icon-browser's REST and Inertia routes behave alike. Each section goes through its `IconPreferenceService` setter; an unknown section is ignored, an unknown sort direction falls back to `asc`, and the result is cleaned by `validate()`. `tests/Feature/UpdatePreferencesTest.php`.
-- **Status and a doctor.** `Ichava::status()` and `InformationService::status()` return `Data\StatusData` (lifecycle, registry conflicts, orphaned rows, discovery counts, last watcher scan, logging flags, last cache rebuild via a new `RecordCacheRebuild` listener, optimisation level and render fingerprint), with no absolute paths. `info status` prints it after the lifecycle block; `info doctor` checks packs, migrations, seeds, cache, the queue connection, host auth, the `ichava.admin` Gate, mounted browser routes and orphans, and exits non-zero when something required is missing. `info discover` shows each pack's layout.
-- **Watcher controls.** `watch --package=<name>` rescans one pack now (`IconWatcherService::rescanPackage()`), `watch --refresh` records every pack's fingerprint (`refreshFingerprints()`, through `updateAll()`), and `watch` prints the last scan time. A synced pack's cached `config.json` is forgotten, and `IconCacheService::clearAll()` forgets every pack's (`configs` in its result), so an edited `config.json` is no longer served stale until the TTL.
-- **Strict conflict mode.** `registry.strict_conflicts` (`ICHAVA_STRICT_CONFLICTS`, default off) throws `iconSetAlreadyRegistered`, `prefixConflict` or `bladeComponentConflict` instead of warning.
-- **Both extension interfaces have implementers.** `Support\ServiceProvider` implements `IchavaPackageInterface` through the registry (version from Composer). A new `Drivers\DirectoryIconDriver` implements `IconDriverInterface` over one directory; `SvgDriver` itself cannot, because its `render()` takes a resolved `IconData`. See `docs/tools/query-api.md`, which also documents the model and event API the plan keeps.
-- **Plug-and-play host user.** Ichava reads the host's signed-in user instead of running auth of its own. New contracts `Contracts\ResolvesUser` (default `Support\Auth\GuardUserResolver`, reading `ichava.ichava-core.auth.guard`, null for the default guard) and `Contracts\PresentsUser` (default `Support\Auth\DefaultUserPresenter`), the `Data\UserData` DTO (`id`, `name`, `avatarUrl`, `abilities`; no email, password or token, with an `auth.expose` opt-in that still refuses secrets), and `Ichava::resolveUserUsing()`, `presentUserUsing()`, `user()` and `currentUser()`. Config: `auth.guard`, `name_attribute`, `avatar_attribute`, `expose`, `abilities`. See `docs/host-user.md`. `tests/Feature/HostUserTest.php`.
-- **Gates with safe defaults.** `ichava.admin` is defined as a denial when the host has not defined it, and `ichava.manage-cache` (the ability ichava/icon-browser checks) falls back to `ichava.admin` when the host defines admin but not manage-cache. Both are defined after every provider boots, so a host's own definitions win. With neither defined by the host, `manage-cache` stays undefined, so icon-browser keeps its "not configured" message.
-- **Owner-keyed preferences contract.** `Contracts\OwnerPreferenceStore` (keyed `owner_type`/`owner_id` through `Data\PreferenceOwner`) is the contract icon-browser implements with its own table; core ships no migration for it. `PreferenceStore` now resolves to `Support\OwnerAwarePreferenceStore`, which routes a signed-in user to the bound owner store and keeps the session store for guests; with no owner store bound it delegates every call to the session store as before. On the host's `Login` event, `Listeners\MergeGuestPreferencesOnLogin` folds the guest's session preferences into the owner's store through `Actions\MergeGuestPreferences` (owner wins, lists unioned, collections unioned by id, guest cleared only after the write succeeds).
-- **Host events.** `Events\FavoriteToggled`, `Events\CollectionChanged` and `Events\PreferencesChanged` are dispatched by `IconPreferenceService`, each carrying whether the write persisted. `IconRegistry` now dispatches the registration lifecycle: `processing`, `registered`, `completed` once per deduplication window, and `failed` on every failure (it rethrows as before).
-- **Illustrations render at their own aspect and size limit.** `IconComponent`'s `lockAspectRatio` is now nullable and defaults to the icon's kind: icons still lock to a square, illustrations keep their viewBox aspect and a size preset sets only the width. An explicit value still wins. `kinds.max_file_size.<kind>` (`ICHAVA_ILLUSTRATION_MAX_FILE_SIZE`, 5 MB for illustrations) sets the file-size ceiling per kind, threaded through `SvgDriver::render()`/`load()` as a new optional trailing `$maxBytes` argument and applied by the watcher; icons keep `max_file_size`. A test pins that a multicolour illustration keeps every colour and gradient, with and without the monochrome conversion.
-
-### Changed
-
 - **Release tooling starts from 0.1.0.** `.release-please-manifest.json` reads `0.1.0` and `release-please-config.json` no longer names a `bootstrap-sha`, so after the hand-cut `v0.1.0` tag release-please proposes `0.1.1` next. `composer.json` describes the package as it ships (it named a scaffolder core no longer carries) and the README gains the Packagist badge and a quick start.
 - **Release-prep guard: every `ichava/*` constraint admits 0.1.0.** `tests/Unit/SiblingConstraintsTest.php` (the packs' copy, unchanged) fails when a constraint in `require` or `require-dev` excludes the released 0.1.0, and when it finds none to check; `composer/semver` is a direct dev dependency for it. CI's test and database jobs alias `ichava/icon-sets-package-scaffolder`'s `main` into the 0.1 line before installing, print the commit it resolved, and restore `composer.json` before the tests run, so the guard reads the committed constraints.
 
@@ -138,6 +101,18 @@ First release of `ichava/core`. The repository is published as a single commit;
 
 ### Removed
 
+- **`IchavaServiceProvider::isIchavaQueueCommand()`**, unused since C-01 moved the runtime limits into `RuntimeLimits`. **`IconSetBuilder::$discoveredIcons` and `$initialized`**, which nothing wrote or read.
+- **Forward-only renames, with no alias left behind** (owner, 2026-11-05): `Support\IconPackServiceProvider` and `Support\ServiceProvider` (now `Providers\IconPackServiceProvider`, `Providers\PackServiceProvider`), `Actions\CountSvgFiles` (now `Support\SvgFileCounter`), `ClearDiscoveryCaches::generation()` (now `DiscoveryCacheGeneration::current()`), and `__invoke()` on four actions (now `handle()`). Every caller in the estate moves in the same sweep; each is recorded in the deprecations audit.
+- **The bare `icon` morph alias** (now `ichava-icon`; the migration moves stored rows).
+The estate is forward-only (owner, 2026-11-05: "never support legacy only forward"). Nothing has been released, so these compatibility paths go rather than stay beside their replacements.
+
+- **The top-level `variants` / `categories` / `items` / `kinds` fallback in `config.json`.** `PackConfigData` reads `metadata.data` only, the shape every pack and the scaffolder's stub ship; doctor's kind checks always name `metadata.data.…` keys. No `config.json` in the estate used the top level (43 read; the one hit was the test fixture that pinned the fallback, which now pins that the top level is ignored).
+- **The `ichava` container alias for `Ichava::class`.** The facade resolves `Ichava::class`; nothing in the estate or the demos called `app('ichava')`, `resolve('ichava')` or `make('ichava')`. Resolve `Ichava::class`, or use the facade.
+- **`IconDiscoveryService::registerPackage()`**, documented as "for testing/legacy purposes". It wrote a cache key nothing read, and had no caller.
+- **`IconPreferenceService`'s pre-taxonomy fallback.** The available categories and variants were read from `ichava_icons.category` / `variant` when `ichava_icon_terms` did not exist; core's first migration creates that table, so they are read from it alone.
+- **Moving a set between packs (`package.replaces`, D9).** It existed so that `ichava/icon-sets-emoji::openmoji-*` ids kept resolving after OpenMoji moved to `ichava/icon-sets-openmoji`. The owner removed the emoji copies (2026-11-05), so nothing declares it any more. Gone with it: `Support\PackAliases`, `PackConfigData::replaces()` and `deprecatedCategories()`, `IconRegistry::canonicalId()`, `isReplaced()` and `packAliases()`, `Ichava::canonicalId()`, `IchavaLogger::deprecation()`, the seeder's and the watcher's skip of replaced items, and doctor's `alias.deprecated_ids` and `alias.replacement_missing`. A `package.replaces` key or a category's `deprecated` marker in `config.json` is now ignored. An OpenMoji id is `ichava/icon-sets-openmoji::openmoji-color/…`.
+- `tests/Unit/NoDeprecatedSymbolsTest.php` fails if an `@deprecated` tag appears anywhere in `src/` (it asserts it read at least 100 files).
+
 - **Dead members the release-0.1.0 wire-in plan marks for removal** (each had no caller in core, icon-browser, the packs, the scaffolder or ichava.com; measured with `git grep -w` against `origin/main`): `SvgDriver::getViewBox()`/`getDimensions()` (duplicates of the stored viewbox, and `width=` matched `stroke-width`); `JsonConfigConstants::getVariantSuffix()`, `getBaseSvgPath()`, `getCategoryPaths()`, `getVariantPaths()`; `IchavaConstants::RATE_LIMIT_CACHE`, `getCacheTTL()`, `getSvgSizeLimits()`, `getPathLimits()`; `IconTerm::scopeWithIconCount()`, `getDepth()`; ten `IchavaException` constructors with no throw site (`missingMethodImplementation`, `invalidIconSetClass`, `fileOperationFailed`, `cacheFailure`, `serviceFailure`, `discoveryFailed`, `browserOperationFailed`, `httpRequestFailed`, `invalidData`, `classNotFound`); `FtsLanguageHelper::buildMultilingualQuery()`, `buildSingleLanguageQuery()`, `getAvailableLanguages()`; `PathResolver::packageRootFromProvider()`, `svgPathFromProvider()`; `DeferredIconsRegistry::getRegisteredIds()`; `ServiceProvider::ICON_ECOSYSTEM_NAME`; `IconRegistrationEvent::MODE_*`; `IconBrowserService`'s unused `$discoveryService` constructor argument; `CacheOperationsService::getManifest()` (returned absolute paths); `IconDiscoveryService::getRegisteredPackages()`, `getIconSvg()` and `renderIconSvg()` (both returned **unsanitised** SVG), `scanIconDirectory()`; `DatabaseOperationsService::ensureTablesExist()`; `IconSetBuilder::getMergedSets()`; `IconWatcherService::getWatchedDirectories()`, `clearFingerprints()`, `extractCategory()`; `IconCacheService::clearDiscovery()`, `warmUp()`, `formatSize()`, `clearAndRefresh()`, `setTtl()`, `getTtl()`, `setPrefix()`; `IconRegistry::getByIconSet()`; `ManagesAttributes::setAttributes()`, `addClass()`, `clearAttributes()`, `renderAttributes()` and `ManagesSizes::toInlineStyle()` (mutated a singleton; `IconRenderer` is the per-render API). Config keys `security.sanitize`, `svg.tag`, `svg.extensions`; translation keys `errors.log_dir_missing`, `info.dry_run_notice`.
 - **`.parked/`** and its three tests. The docs that still taught `JobProgressTracker` and `$seeder->getStatus()` now point at `SeederRunTracker` and `Bus::findBatch()`.
 - **`ConfigurationService::CACHE_TTL`**, a private constant nothing read, with the `@phpstan-ignore` comment that wrongly called it a public constant kept for outside callers. A private constant has no outside callers.
@@ -145,6 +120,14 @@ First release of `ichava/core`. The repository is published as a single commit;
 
 ### Fixed
 
+- **The nightly catalogue sync updates the installation guide's pack table with the catalogue.** `bin/sync-icon-sets.php` rewrote `icon-sets.json` alone, so a count change opened a pull request that `InstallationPackTableTest` failed: #179 moved tabler to 6,287 and openmoji to 8,990 while `docs/installation.md` still said 6,257 and 8,568. After writing the catalogue, the script now sets each table row's count from it with `withPackTableCounts()`, and the workflow commits both files. Rows, order and repositories are left as written, so a set added or removed still fails the table test. `tests/Unit/SyncIconSetsDocTableTest.php` covers it (proven red by leaving the counts alone).
+- **The nightly catalogue sync no longer puts Twemoji's pre-split values back.** `bin/sync-icon-sets.php` reads each pack at its latest tag, and `icon-sets-twemoji`'s `v0.1.0` still holds OpenMoji, so #176 proposed 10,567 "Emoji Sets" over the recorded 3,435 "Twemoji". A set in `icon-sets.json` may now carry a `hold` (`tag`, `commit`, `reason`): while that tag is the latest release at that commit the sync keeps the set's snapshot, and the hold drops itself once a newer tag is cut or the tag moves. The twemoji set is held at `v0.1.0`. `tests/Unit/SyncIconSetsHoldTest.php` covers it (proven red by ignoring the commit).
+- **A pack listed with the application boots again.** `PackConfigCache` resolved the cache store when it was built, and a pack's constants class builds it while the providers are still registering, before the store exists, so every pack failed to boot with `Target class [cache] does not exist` (found running the packs against #172). The store is now resolved when it is used. Core's own pack tests registered their fixture after boot, which is why none saw it; `tests/Feature/PackBootsInProviderListTest.php` lists the fixture with the application.
+- **`InformationService::discoverPackages()` finds the installed packs.** It globbed `vendor/*/ichava-*`, which matches no pack (packs install as `vendor/ichava/icon-sets-*`), and reported `registered` through `IconRegistry::has()`, which looks up an icon, not a package, so `ichava::ichava-core.info discover` listed nothing. It now asks `Composer\InstalledVersions` for every package of type `ichava-icon-set` and reports `registered` through `IconRegistry::isRegistered()`. The signature and return shape are unchanged. A pack is identified by its composer type and nothing else (owner, 2026-11-05): the `vendor/*/ichava-*` directory glob is removed, since no pack in the estate matched it, and the `platform/ichava` scan now keeps only a directory whose composer.json declares `ichava-icon-set`, keyed by that file's `name` instead of `ichava/<directory>`. A checkout there without the type is no longer listed. `tests/Feature/InstalledPackDiscoveryTest.php`.
+- **The installation guide no longer says core is on Packagist.** Nothing in the family is (`repo.packagist.org` answers 404 for core, every pack and the four `laranail/*` packages). `docs/installation.md` step 1 is now the one place that lists the repositories an application adds, `ichava/core` included; the README and every pack link to it.
+- **The US and UM flags keep their stars.** Both draw the fifty stars as one `<marker>` repeated by `marker-mid="url(#us-a)"`, and `resources/security/svg-policy.json` did not allow `<marker>`, so the sanitiser removed it and the reference pointed at nothing. The policy now allows `<marker>` and its geometry (`refX`, `refY`, `markerWidth`, `markerHeight`, `orient`, `markerUnits`), the same bytes as ichava/icon-sets-sync#91. Scripts, `on*` handlers and external `href` on or inside a marker are still stripped, and `marker-*` still take only `none` or `url(#fragment)`. `tests/fixtures/svg/presentation-vectors.json` gains 8 attribute rows and 6 whole-document rows, which `SvgPresentationParityTest` runs through the full sanitiser.
+- **The discovery-cache tests no longer fail under `--parallel`.** The services write through `cache()->store('file')`, and Testbench points that store at one directory under `vendor/`, shared by every test and every parallel worker. Two workers searching for the same term wrote the same key, so one read the other's result against its own empty database, and a `flush()` in one worker deleted directories another was scanning (`UnexpectedValueException`). `DiscoveryCacheInvalidationTest` or `DiscoveryActionsTest` failed in 6 of 10 parallel runs; with each test owning a temporary file-cache directory, 10 of 10 pass. Test-only: no production code changed. `tests/Feature/FileCacheIsolationTest.php`.
+
 - **The guest-to-user preference merge on sign-in now sees the guest's preferences.** `IchavaSessionManager::put()` writes through Laravel's session, which nests a dotted key (`ichava.preferences` is held as `['ichava' => ['preferences' => ...]]`), while `all()` and `clear()` scanned the session's top-level keys for a literal `ichava.` prefix that a nested write never produces. So `all()` was always empty, `clear()` removed nothing, and `MergeGuestPreferences` folded nothing into the signed-in owner's store. Both now read and clear the nested entry, and still handle a literal top-level `ichava.<key>`. `tests/Feature/SessionGuestMergeTest.php` (4 of its 5 cases fail on the previous code).
 
 - **Category and variant names are searchable on PostgreSQL.** Core registers the morph alias `icon` for `Icon`, and the seeder writes it to every `termable_type`, but three readers compared that column with the class name, so no attached term ever matched. `Icon::scopeSearch()`'s PostgreSQL clause, the search-text functions the create-tables migration installs, and `IconTerm::getTotalIconCount()` (which returned 0 on every driver) now use the alias, held once as `Icon::MORPH_ALIAS` and registered in the morph map from there. A new migration, PostgreSQL only, recreates the installed functions with the alias and rebuilds `search_text` for existing icons; it honours `ICHAVA_SKIP_FTS_BACKFILL` and does nothing on SQLite, MySQL or MariaDB. The function SQL moved verbatim into an internal `Support\Database\IconSearchTextFunctions` so both migrations share it. `tests/Feature/TermSearchMorphTypeTest.php` searches by category and variant name on PostgreSQL, `tests/Unit/IconTermTotalIconCountTest.php` counts on any driver, and `tests/Unit/TermableTypeComparisonGuardTest.php` fails if a `termable_type` comparison in `src/` or `database/` uses the class name.
@@ -161,6 +144,15 @@ First release of `ichava/core`. The repository is published as a single commit;
 
 `tests/Feature/SearchResultTermsTest.php`, `tests/Feature/IconSvgAttributesTest.php` and a new case in `tests/Feature/IconsManifestWriteTest.php` cover the first four, and fail on the old code.
 
+### Security
+
+- **Conflict floors for four Symfony components** (`composer audit`, 2026-11-05). `symfony/http-foundation`, `http-kernel`, `routing` and `yaml` below 7.4.23, or from 8.0 below 8.1.11, carry seven advisories (among them CVE-2026-118514, HEAD requests bypassing `access_control` methods, and CVE-2026-118516, host placeholders matching the start of the path; PKSA-nktx-f1n1-b4yd, YAML parse-time blow-up). `composer.json` now declares them as `conflict`, which Composer also applies when core is a dependency, so a pack or application installing core cannot resolve a vulnerable release.
+- **The CSS `url()` guard can no longer be bypassed** (S1, 2026-11-04 security audit). The guard matched the literal characters `url(`. So a CSS escape (`\75rl(`, `\000075rl(`, `u\rl(`), a comment inside the token (`u/**/rl(`), or a fetching function with no `url(` in it (`image-set(`, `-webkit-image-set(`, `image(`, `src(`, `cross-fade(`, `element(`) kept a style that made the viewer's browser fetch an attacker's URL. A new `Support\SvgCssGuard` tokenises a value as a browser does, then allow-lists it: `url()` survives only for a same-document fragment, other functions only from a short list of inert ones (colour, `var`, maths, transform, easing), and no at-rule survives. The check covers the `style` attribute, `<style>` element text, and the CSS-valued presentation attributes (`fill`, `stroke`, `filter`, `clip-path`, `mask`, `marker-*`, and others). `url(#gradient)` is unaffected. Across all 135,112 pack SVGs, no sanitised output changed. `RENDER_PIPELINE_VERSION` is now 3, so an entry cached before the fix is not served. `tests/Unit/SvgCssUrlGuardTest.php`.
+- **The sanitiser has a byte cap and an element cap** (S2). Before, a 5 MB illustration with about 374k nodes took 9.5 s to sanitise inside a request. Now `svg.max_bytes` (`ICHAVA_SVG_MAX_BYTES`, default 4,500,000) is checked before parsing, and `svg.max_elements` (`ICHAVA_SVG_MAX_ELEMENTS`, default 30,000) is checked during the walk. Either refuses the file with an `IchavaException` and logs `svg.limit_exceeded`. Both values match react-icon-browser and icon-sets-sync. The serve path now also checks the kind's `max_file_size` before reading the file, where before it read the file without checking. `tests/Unit/SvgSanitiserCapsTest.php`, `tests/Feature/SvgServedSizeCapTest.php`.
+- **Processing instructions and CDATA no longer pass through the sanitiser** (S5, S10). A processing instruction inside the root (`xml-stylesheet` names an external sheet) is stripped. A CDATA section becomes ordinary text, escaped on output, because parsers disagree about CDATA inside `<title>`: parse5 builds elements from it where Chromium does not. `tests/Unit/SvgNodeTypesTest.php`.
+- **The version check connects to the address it validated** (S8). The SSRF guard resolved the host and the HTTP client resolved it again, leaving a DNS-rebinding window. The validated addresses are now pinned with curl's `CURLOPT_RESOLVE`. `tests/Unit/UpdateCheckerDnsPinTest.php`.
+- **Every workflow's top-level token is read-only** (S9). `release.yml` granted `contents: write` to the whole workflow; it now defaults to `contents: read` and grants the write to the one job that publishes the release. The other five workflows already declared `contents: read`, or `{}` for release-please, which uses only its app token. `tests/Unit/WorkflowPermissionsTest.php` fails when a workflow has no top-level `permissions:` or grants a write there.
+
 ## [Archived history]
 
 > The first sections below are the 0.1.x releases folded into 0.1.0 (v0.1.0 to v0.1.3, 2026-10-23 to 2026-10-27); their tags and GitHub releases are removed