From f81832a7c87ef8d361520e5106fc28c08d33e214 Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Fri, 13 Nov 2026 09:03:05 -0500
Subject: [PATCH] File the unreleased notes under 0.1.0

v0.1.0 is re-cut on this tree, so the work listed under [Unreleased]
ships in it. Its notes move into the [0.1.0] section, which is what
the release publishes; each heading appears once.
---
 CHANGELOG.md | 136 ++++++++++++++++++++++++---------------------------
 1 file changed, 63 insertions(+), 73 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f3ad97..62b2c5e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,31 +4,9 @@ All notable changes to `ichava/icon-browser` follow [Keep a Changelog](https://k
 
 ## [Unreleased]
 
-### Changed
-
-- **`zustand` may resolve to 5.1.x (`>=5.0.15 <5.2.0`, icon-browser#147).** It was held below 5.1.0 because 5.1.0 narrows `persist.rehydrate()`'s type, which changed the published type of the old library's `useStore` and failed `check:public-api`. That check went with the library build in icon-browser#146, so the hold had no reason left. Typecheck and the 993 Vitest tests pass on 5.1.0, and `inertia-app.*` is rebuilt from a fresh `npm install --no-package-lock`, as `committed-build.yml` does.
-- **The browser UI's source lives in this repository** (react consolidation 3d). `ichava/react-icon-browser`'s `main` at `3cdbd1b` is imported as a snapshot with no history: its `src/` into `resources/js/`, its tooling and fixture catalogue into `.dev/browser/`, its fonts into `resources/assets/fonts/`, and its other root files into `.dev/imported/react-icon-browser/`; the 20 Metronic baseline paths are not imported. `npm run build:prod` builds the committed bundle from that source: `theme.css` is compiled with Tailwind and scoped to `[data-ichava-theme]` as the library build did, and `ichava.scss` no longer scans the browser's files. The browser's 875 Vitest tests (and 3 skipped) run here, 994 passing in all. TypeScript 6 and Tailwind ^4.3 match the source, and `typecheck:inertia` uses its stricter `tsconfig.base.json`.
-- **The shared Untitled UI pieces come from `@ichava/js-ui-kernel/react`**, pinned to `bc5120c` as in ichava.com: `cx`, `is-react-component`, the avatar base components, radio buttons, toggle, featured icon and `uui-theme.css`. Tabs and dropdown stay local.
-- **The Untitled UI PRO components are included as part of the product** (owner, 2026-11-12): the 12 the browser uses, in five folders [LICENSE](LICENSE) lists, each keeping its PRO header. See [Architecture](docs/architecture.md#untitled-ui-pro-components).
-
-### Deprecated
-
-- **`npm run build:lib`, `npm run sync:react-icon-browser`, `npm run check:consumers` and `resources/vendor/react-icon-browser`.** The scripts print where the work moved and exit 0; the directory is no longer rebuilt, and its `prepaint.html`, which the prepaint component still inlines, is written by `npm run build:prepaint`. The ten files whose code moved to the kernel are deprecated re-exports. Removing any of them needs the owner's yes.
-
-### Fixed
-
-- **Re-vendored `ichava/react-icon-browser` at `41b0a4b`** (react-icon-browser#214): one caret for every dropdown and popover, drawn in the panel's own colours over its edge and centred on the trigger (the header menus drew none), and the "Cookies & storage" notice moves by its grip or the arrow keys, inside the window, for the session. `inertia-app.*` rebuilt with `npm run build:prod` after a fresh `npm install --no-package-lock`, as `committed-build.yml` does. `zustand` is held at `>=5.0.15 <5.1.0`, the vendored library's own range: 5.1.0 (2026-11-06) changes the type react-icon-browser publishes for `useStore`, and a fresh build that took it would no longer match the committed bundle.
-
-- **The browser page works under a host's nonce-based CSP.** A host that sends its own policy with a per-request nonce (`script-src 'self' 'nonce-…'`, as ichava.com does) hands that nonce to Vite; the page now puts it on the loader's `<style>` and `<script>`, the frame `<style>`, the stylesheet, the module scripts and the dev-server scripts, and writes it to a `csp-nonce` meta tag for the styles React Aria injects at runtime. Before, those blocks carried no nonce and the policy blocked them. Without a host nonce, the package's `nonce` CSP mode supplies core's, as before. `Support\PageNonce` resolves which; `HostCspNonceTest` and `PrepaintTest` guard it.
-
-### Removed
+## [0.1.0] - TBD
 
-- **The deprecated vendored build and its scripts** (owner, 2026-11-13: wire in what can be wired, otherwise remove). `resources/vendor/react-icon-browser` (254 files), `npm run build:lib`, `npm run sync:react-icon-browser` and `npm run check:consumers`, with the library-build checks behind them (`check-lib-build`, `rewrite-lib-type-paths`, `check-public-api` and its snapshot, `check-consumers` and `consumers.json`) and `vendoredLibrary.test.ts`. Nothing imported any of it. The one file still read from it moved: the prepaint component now inlines `resources/views/prepaint.html`, which `npm run build:prepaint` writes. Tailwind no longer scans the old bundle, so `inertia-app.css` loses utilities only it named (181 to 172 KB). `.dev/imported/react-icon-browser/` stays for the e2e port.
-- **The ten re-export files for the kernel's shared pieces** (`lib/utils/cx`, `is-react-component`, the avatar base components, radio buttons, toggle, featured icon, `uui-theme.css`): 40 files now import `@ichava/js-ui-kernel/react` directly, and `noDeprecations.test.ts` allows no exceptions.
-- `CreateCollection::rules()`: its two callers now use `StoreCollectionRequest`, which owns the rules (forward only).
-- **The vendored-library test reads only `vendored.json`.** The fallback to the old `VENDORED.json` name is removed (forward only, owner 2026-11-05); every consumer writes the lowercase name since #124.
-- **Payload schema 1.8.0: the `android-vd` (Android VectorDrawable XML) asset export is dropped**, by owner rule (Sim, 2026-11-04): the ichava icon ecosystem is strictly `*.svg`. `$defs/format` and `x-ichava-formats` lose `android-vd` (25 formats), `PayloadSchema::VERSION` is `1.8.0`, and `FormatRegistryTest` now fails if the id returns or if any asset export other than the SVG-carrying `css-mask`, `data-uri`, `flutter` and `swiftui` appears. 1.7.0 was never released, so no published payload named it.
-- **Payload schema 1.7.0: the `png-zip` asset export is dropped**, by owner decision (Sim, 2026-11-04). `$defs/format` and `x-ichava-formats` lose `png-zip` (26 formats), `PayloadSchema::VERSION` is `1.7.0`, and `FormatRegistryTest` now fails if the id comes back. 1.6.0 was never released, so no published payload named it.
+First release of `ichava/icon-browser`. The repository is published as a single commit; the 0.1.x tags cut between 2026-10-23 and 2026-11-02 (v0.1.0 to v0.1.1, including the release-please v0.1.1 of 2026-11-02) are folded into this release, and their notes are kept below under *Archived history*.
 
 ### Added
 
@@ -52,49 +30,6 @@ All notable changes to `ichava/icon-browser` follow [Keep a Changelog](https://k
   - The format registry: `$defs/format` and the root `x-ichava-formats` in the schema (13 formats, tab order), read in PHP by `Support\FormatRegistry`. `snippets.tabs` ids that are neither a format nor a template are dropped and logged. The PHP half of the two-way guard is `FormatRegistryTest`.
   - Tests: `KindsApiTest`, `BrowserKindsBootstrapTest`, `FormatRegistryTest`, `PayloadSchemaTest` (schema 1.4.0), and `FeaturesManifestRoutesTest` (W2: every route name the manifest can advertise, 58 of them, is mounted; floor 40).
 
-### Fixed
-
-- The terms hierarchy endpoint counted icons under a hard-coded morph alias `icon`, so every count read 0 once core moved the alias to `ichava-icon`; it reads `Icon::getMorphClass()`.
-- **The icon SVG rules in `ichava.scss` are valid CSS.** 26 selectors were written with `:deep(...)`, Vue single-file-component syntax a browser does not know, so it dropped every one of those rules from the compiled stylesheet. They are now the plain descendant selectors they meant (`.icon-svg svg`, `.icon-svg.icon-colored svg path`, ...), and `public/assets/css/inertia-app.css` is rebuilt. No element in the React browser or the Blade views carries `.icon-svg`, `.icon-svg-modal` or `.icon-colored` (0 matches in `resources/js`, `resources/views`, `src` and the vendored bundle), so nothing renders differently yet. `noDeepSelectors.test.ts` fails on any `:deep(` in a stylesheet outside a `.vue` file; it failed on both files before the fix.
-- **Re-vendored `ichava/react-icon-browser` at `e60b526`** (react-icon-browser#207): the US and UM flags keep their stars. Their fifty stars are one `<marker>` repeated by `marker-mid`, and the vendored SVG policy stripped `<marker>`, so the browser drew an empty canton. The policy (sha256 `49ee43ce`, ichava/core#166) now allows `<marker>` with `refX`, `refY`, `markerWidth`, `markerHeight`, `orient` and `markerUnits`; scripts, handlers and external references stay stripped. `vendored.json` names the commit, and the committed bundle under `public/assets` is rebuilt from it.
-- **Per-route rate limits now apply (S3).** `getRateLimit()` read `rate_limiting.<bucket>`, which the shipped config always sets, so the limit each route declared (10, 30, 60, 120, 300) was never used, and Laravel's string `throttle:` shares one counter per caller across routes. The new `ichava.throttle` middleware takes the route's declared limit, lets `rate_limiting.<bucket>` only lower it, reads that per request, and counts per route. Turning `rate_limiting.enabled` on also crashed route loading (a nested array in the `cache` group's middleware, "Array to string conversion"); fixed. Behaviour change for hosts that enable the switch: `icons/filters`, `tree` and `statistics` now answer 429 after 60 requests a minute, not 300.
-- **CORS with several origins works (S4).** `Access-Control-Allow-Origin` was the comma-joined list, which a browser rejects. A single origin is sent as before; several are matched against the request's `Origin` and echoed when listed, the response varies on `Origin`, and an unlisted origin gets no header. `ICHAVA_API_CORS_ORIGINS` strings are split on commas. The docs said the default was `*`; it is `APP_URL`.
-- **`GET /icons/{id}/svg` holds an illustration to the illustration size budget.** The route selected a handful of columns without `kind`, so every file was checked against the icon budget.
-
-### Security
-
-- **No workflow grants write access at its top level.** `release.yml` declared `contents: write` for the whole workflow; it is now `contents: read` there and `contents: write` on its one job. `WorkflowPermissionsTest` fails on a top-level write grant, proved red against the old file. The seven open CodeQL `actions/missing-workflow-permissions` alerts point at `tests.yml` and `code-quality.yml` as they were on 2026-10-23; both have carried a top-level `contents: read` since 0d5aa13.
-- **`minimatch` resolves to `^11.0.1`** through an npm `overrides` entry, past GHSA-g3hv-75wg-m249 (ESLint 10 pulls 10.2.x). Development only; `npm audit` on a fresh install: 10 moderate before, 0 after. `composer audit` on a fresh resolve reports nothing.
-- **Re-vendored react-icon-browser `2db1e60` (ichava/react-icon-browser#197).** The vendored SVG sanitizer now guards CSS `url()` references, and the browser caps the size of an SVG it will process: `limits.svgMaxNodes` 30000 and `limits.svgMaxChars` 4500000 in the app's `AppConfig.limits`. `inertia-app.js` and `inertia-app.css` are rebuilt. The PHP side now passes core's `svg.max_elements` and `svg.max_bytes` as `limits`, so a host can override them (see Added); the vendored browser reads them once it is re-vendored.
-- **Every workflow declares a top-level `permissions: contents: read`** (S9), so its token no longer depends on the organisation's default. None of these jobs writes. `tests/Feature/WorkflowPermissionsTest.php` fails if a workflow loses the block.
-
-### Changed
-
-- **The version is back at 0.1.0 for the re-squash, and the vendored react-icon-browser names its v0.1.0 root.** release-please cut `v0.1.1` on 2026-11-02; the re-squash folds it in, so `.release-please-manifest.json` and `package.json` read `0.1.0` and the `[0.1.1]` section moved into `[0.1.0]`. `vendored.json` `commit` is react-icon-browser's root `054c2b3`, the tree of `1ea1d44`: re-synced from `1ea1d44`, all 249 files are byte-identical to the copy vendored at `648f92a`.
-- **The Inertia listing props are checked, not cast** (re-audit F-15): `snapshotFromProps` checks `icons`, `pagination`, `packages` and `appliedFilters` for the shapes the browser reads; a malformed prop rejects the visit.
-- **react-icon-browser vendored at `6217b2b`**: the six non-default locale catalogs load on demand (F-12), the library rows are react-aria GridLists (F-20), the window globals are declared. Page first load: 1,411,528 B (408,868 gzip) before, 1,289,667 B (380,135 gzip) after.
-- **Blade components carry this package's prefix** (forward only): `<x-ichava-icon-browser::prepaint />`, `::sri-asset`, `::ui-icons` and `::test-icons` replace the `ichava::` aliases, so a host that turns core's short prefix off (`ichava.ichava-core.components.short_prefix` null) still renders them. Docblocks show `<x-ichava-core::icon>`, core's canonical tag. `tests/ShortPrefixOff` boots a host with the short prefix off.
-- **The demo test-icons component follows core's `components.test_icons`**; `ichava.icon-browser.test_component_enabled` is gone (forward only). Core's default is on in `local` only (it was on everywhere here); `ICHAVA_TEST_COMPONENT_ENABLED` still sets it.
-- **Core's contracts, not its classes**: `UpdateStatusApiController` and `InertiaBrowserController` type-hint `Contracts\ChecksPackUpdates` and `Contracts\DatabaseOperations` (core#172); `UpdateStatusApiTest` binds the contract.
-- **Run `php artisan migrate` after updating** (`docs/installation.md`): core's `2026_11_05_000001_namespace_icon_morph_alias` moves the icon morph alias to `ichava-icon`.
-- **Middleware aliases and groups carry the package name** (re-audit F-11, forward only): `ichava-icon-browser.session`, `.security`, `.json`, `.log`, `.validate`, `.guard`, `.cache-admin`, `.admin`, `.throttle`, `.handle-inertia`, and the groups `ichava-icon-browser.api`, `.web` and `.inertia`. The bare `ichava.*` names are gone, with no forwarding alias. A host route guarded with `->middleware('ichava.admin')` changes to `ichava-icon-browser.admin`. The `ichava.admin` *ability* (a Gate) keeps its name. `HttpLayerConventionsTest` reads the router's live map.
-- **One query service for package detail** (F-08): `Support\PackageDetails` returns a `Data\PackageDetailsData` that the API's `package()` and the Inertia `PackageController::show()` both render; neither controller queries. Table names come from `Support\IconTables` (`ICONS` is core's `Icon::TABLE`; the term table and pivot are held to `IconTerm` by a test).
-- **FormRequests with `toData()` at the edge** (F-09): `RecordCommandRequest`, `RecordHistoryRequest`, `StoreCollectionRequest` and `UpdateCollectionRequest` replace the six inline rule sets, each with a `final readonly` DTO in `src/Data/`. `IchavaFormRequest` keeps the API's validation body (`success: false`, `error`, `errors`) for JSON callers and Laravel's redirect for pages.
-- **Collaborators are injected, not reached for** (F-10): `IchavaApiSecurity` takes core's `SecurityNonce` and `AuditLogger`; `CacheAdminGate` is an injectable service taking `HostUser` (its static `refusal()`/`allows()` are instance methods now); `IconResource`/`IconCollection` take `IconSnippets` through `withSnippets()`; `BrowserBootstrap` reads the locale from the `Translator`.
-- **The browser opens on every pack the host has installed** (Q42): the Inertia page's `packages` (what core registered) becomes the library's `defaults.packages`, and the re-vendored react-icon-browser names no pack.
-- **Each Inertia page is its own chunk** (F-12): `import.meta.glob` is no longer eager; chunks are content-addressed (`inertia-app-[name]-[hash].js`) since only the entry carries `?v=`, and `npm run clean` removes them.
-- **The payload schema's `$id` resolves to the file**: `https://raw.githubusercontent.com/ichava/icon-browser/main/resources/schema/icon-browser.schema.json` (it named a github.com path that answers 404). No field changes, so the version stays 1.8.0. `docs/tools/payload-schema.md` says how react-icon-browser and js-icon-components pin their copies.
-- **The vendored manifest is `resources/vendor/react-icon-browser/vendored.json`, no longer `VENDORED.json`** (owner rule: file names are lower-case slugs). `.dev/tools/sync-vendored-library.mjs` writes only the new name, and `vendoredLibrary.test.ts` reads it first, falls back to the old one until after v0.1.0, and fails if the old name returns. Re-synced from react-icon-browser `7188f57`, the commit already vendored: the manifest's bytes and every bundle file are unchanged, and `npm run build:prod` leaves `public/assets` as committed.
-- **Documentation links point at each repository's own `docs/`** (Sim, 2026-11-03: "all ichava repos have docs in their respective repos. thats by design"). Links to `opensource.simtabi.com/documentation/ichava/...` and the `opensource.simtabi.com/products/ichava/...` homepage, which answer 404 for every ichava page, now go to the matching `docs/*.md` on GitHub, or to the repository itself. Each target was checked to exist on that repository's `main`. The manifest's `homepage` and `support.docs` follow.
-- **The stylesheet is minified with Lightning CSS at Vite 8's default targets** (Chrome/Edge 111, Firefox 114, Safari 16.4, no lower than Tailwind v4's own floor), replacing the esbuild minifier and Vite 7's targets kept since the Vite 8 upgrade. `inertia-app.css` is 26.4 KB gzipped instead of 27.8 KB: duplicate Tailwind layers merge and 21 obsolete `-moz-` prefixes go. Normalized with Lightning CSS, the old and new stylesheets match rule for rule. The only differences are `calc()` expressions that esbuild folded and Lightning CSS keeps inside custom properties, which resolve to the same values. The 26 leftover `:deep()` selectors are untouched. The JavaScript bundle is unchanged.
-- **The author and contact address is `ichava@simtabi.com`** (W-11, Sim 2026-11-03), replacing the community address `opensource@simtabi.com` wherever this repository named it. Vulnerability reports still go to `security@simtabi.com`. The test that guards the address expects `ichava@` now.
-
-## [0.1.0] - TBD
-
-First release of `ichava/icon-browser`. The repository is published as a single commit; the 0.1.x tags cut between 2026-10-23 and 2026-11-02 (v0.1.0 to v0.1.1, including the release-please v0.1.1 of 2026-11-02) are folded into this release, and their notes are kept below under *Archived history*.
-
-### Added
-
 - **The Inertia browser lists the packs, opens on the default one and describes each variant.** `InertiaCatalog` gains `getCatalogMeta`, reading the page's `packages` (with `default`) and `filterOptions.variants_by_package`, and `getTreeFor`, which answers from the `tree` prop while only the categories, page or sort differ and otherwise shares the grid's listing visit. The tree prop is counted over the selection less its categories (`IconFilterRequest::treeFilters()`), as the REST tree is asked, and reloads with every listing visit. Payload schema **1.3.0** types `variants_by_package` (`variantMeta`). `InertiaCatalog.test.ts`, `InertiaCatalogMetaTest`, `PayloadSchemaTest`.
 - **A collection starts with the icons it was made from.** `POST {prefix}/collections` and `POST {prefix}/api/v1/collections` take `icon_ids` (up to 500; unknown ids are skipped) through the shared `CreateCollection` action, and the browser sends the icon or selection a collection was created from with the create, instead of creating it empty. A browser create on a partial reload stays on the browser instead of opening the collection's page. `CollectionControllerTest`, `LibraryApiTest`, `useLibrarySync.test.ts`.
 - **The shipped browser code must be fully minified.** `minifiedBundle.test.ts` fails when the vendored react-icon-browser bundle or the built page bundle names a source map, keeps a readable layout or comments other than licences and pure annotations, or leaves its names unmangled. The vendored bundle (react-icon-browser's minified build) goes from 754,215 bytes on 22,039 lines to 617,621 bytes on 25, re-vendored from react-icon-browser `0f1636f` (#188). It also fails on any `.map` file, or any file naming `sourcesContent` or `sourceMappingURL`, under the vendored library or `public/`.
@@ -121,14 +56,32 @@ First release of `ichava/icon-browser`. The repository is published as a single
 - **A `Committed build` workflow fails a pull request whose committed bundle is stale** (I-F3, XR-7). It runs `npm install --no-package-lock` and `npm run build:prod`, then fails on any difference or untracked file under `public/assets`, with a message saying to rebuild and commit. It has no path filter, so it can be a required check, and it also runs weekly on `main`. A fresh build of `main` matches the committed bundle today.
 - **A weekly `Rebuild committed bundle` workflow keeps `public/assets` current.** No lock file is committed, so a fresh install can resolve newer dependencies than the bundle was built with. Each Monday it rebuilds `main` the way `Committed build` does and, when the output differs, opens or updates one pull request from `chore/rebuild-bundle` with a Refresh Bot token, so the change runs CI like any other. `Committed build` is unchanged.
 
-### Removed
+### Changed
 
-- **The Inertia `settings.search` and `settings.filters` routes** (`POST {prefix}/settings/search`, `/settings/filters`) and `SettingsController::updateSearch()`/`updateFilters()`. The browser syncs search and filters through the URL; the REST `preferences.search`/`filters` routes stay.
-- **`ApiResponseTrait::unauthorizedResponse()`, `forbiddenResponse()`, `paginatedResponse()`, `noContentResponse()`** and **`IconBrowserApiController::emptyIconResponse()`**, protected helpers with no caller (wire-in plan remove rows). A host class extending `BaseApiController` that called one would now fail.
-- **The deprecated `ichava-assets` publish tag.** Publish the built assets with `--tag=ichava::icon-browser-assets` (`IconBrowserServiceProvider::ASSETS_TAG`), which has published the same paths since 0.1.1. `IconBrowserServiceProvider::DEPRECATED_ASSETS_TAG` is gone with it.
-- **The `ichava.api.security` middleware alias.** Use `ichava.security`, which names the same `IchavaApiSecurity` middleware.
+- **`zustand` may resolve to 5.1.x (`>=5.0.15 <5.2.0`, icon-browser#147).** It was held below 5.1.0 because 5.1.0 narrows `persist.rehydrate()`'s type, which changed the published type of the old library's `useStore` and failed `check:public-api`. That check went with the library build in icon-browser#146, so the hold had no reason left. Typecheck and the 993 Vitest tests pass on 5.1.0, and `inertia-app.*` is rebuilt from a fresh `npm install --no-package-lock`, as `committed-build.yml` does.
+- **The browser UI's source lives in this repository** (react consolidation 3d). `ichava/react-icon-browser`'s `main` at `3cdbd1b` is imported as a snapshot with no history: its `src/` into `resources/js/`, its tooling and fixture catalogue into `.dev/browser/`, its fonts into `resources/assets/fonts/`, and its other root files into `.dev/imported/react-icon-browser/`; the 20 Metronic baseline paths are not imported. `npm run build:prod` builds the committed bundle from that source: `theme.css` is compiled with Tailwind and scoped to `[data-ichava-theme]` as the library build did, and `ichava.scss` no longer scans the browser's files. The browser's 875 Vitest tests (and 3 skipped) run here, 994 passing in all. TypeScript 6 and Tailwind ^4.3 match the source, and `typecheck:inertia` uses its stricter `tsconfig.base.json`.
+- **The shared Untitled UI pieces come from `@ichava/js-ui-kernel/react`**, pinned to `bc5120c` as in ichava.com: `cx`, `is-react-component`, the avatar base components, radio buttons, toggle, featured icon and `uui-theme.css`. Tabs and dropdown stay local.
+- **The Untitled UI PRO components are included as part of the product** (owner, 2026-11-12): the 12 the browser uses, in five folders [LICENSE](LICENSE) lists, each keeping its PRO header. See [Architecture](docs/architecture.md#untitled-ui-pro-components).
 
-### Changed
+
+- **The version is back at 0.1.0 for the re-squash, and the vendored react-icon-browser names its v0.1.0 root.** release-please cut `v0.1.1` on 2026-11-02; the re-squash folds it in, so `.release-please-manifest.json` and `package.json` read `0.1.0` and the `[0.1.1]` section moved into `[0.1.0]`. `vendored.json` `commit` is react-icon-browser's root `054c2b3`, the tree of `1ea1d44`: re-synced from `1ea1d44`, all 249 files are byte-identical to the copy vendored at `648f92a`.
+- **The Inertia listing props are checked, not cast** (re-audit F-15): `snapshotFromProps` checks `icons`, `pagination`, `packages` and `appliedFilters` for the shapes the browser reads; a malformed prop rejects the visit.
+- **react-icon-browser vendored at `6217b2b`**: the six non-default locale catalogs load on demand (F-12), the library rows are react-aria GridLists (F-20), the window globals are declared. Page first load: 1,411,528 B (408,868 gzip) before, 1,289,667 B (380,135 gzip) after.
+- **Blade components carry this package's prefix** (forward only): `<x-ichava-icon-browser::prepaint />`, `::sri-asset`, `::ui-icons` and `::test-icons` replace the `ichava::` aliases, so a host that turns core's short prefix off (`ichava.ichava-core.components.short_prefix` null) still renders them. Docblocks show `<x-ichava-core::icon>`, core's canonical tag. `tests/ShortPrefixOff` boots a host with the short prefix off.
+- **The demo test-icons component follows core's `components.test_icons`**; `ichava.icon-browser.test_component_enabled` is gone (forward only). Core's default is on in `local` only (it was on everywhere here); `ICHAVA_TEST_COMPONENT_ENABLED` still sets it.
+- **Core's contracts, not its classes**: `UpdateStatusApiController` and `InertiaBrowserController` type-hint `Contracts\ChecksPackUpdates` and `Contracts\DatabaseOperations` (core#172); `UpdateStatusApiTest` binds the contract.
+- **Run `php artisan migrate` after updating** (`docs/installation.md`): core's `2026_11_05_000001_namespace_icon_morph_alias` moves the icon morph alias to `ichava-icon`.
+- **Middleware aliases and groups carry the package name** (re-audit F-11, forward only): `ichava-icon-browser.session`, `.security`, `.json`, `.log`, `.validate`, `.guard`, `.cache-admin`, `.admin`, `.throttle`, `.handle-inertia`, and the groups `ichava-icon-browser.api`, `.web` and `.inertia`. The bare `ichava.*` names are gone, with no forwarding alias. A host route guarded with `->middleware('ichava.admin')` changes to `ichava-icon-browser.admin`. The `ichava.admin` *ability* (a Gate) keeps its name. `HttpLayerConventionsTest` reads the router's live map.
+- **One query service for package detail** (F-08): `Support\PackageDetails` returns a `Data\PackageDetailsData` that the API's `package()` and the Inertia `PackageController::show()` both render; neither controller queries. Table names come from `Support\IconTables` (`ICONS` is core's `Icon::TABLE`; the term table and pivot are held to `IconTerm` by a test).
+- **FormRequests with `toData()` at the edge** (F-09): `RecordCommandRequest`, `RecordHistoryRequest`, `StoreCollectionRequest` and `UpdateCollectionRequest` replace the six inline rule sets, each with a `final readonly` DTO in `src/Data/`. `IchavaFormRequest` keeps the API's validation body (`success: false`, `error`, `errors`) for JSON callers and Laravel's redirect for pages.
+- **Collaborators are injected, not reached for** (F-10): `IchavaApiSecurity` takes core's `SecurityNonce` and `AuditLogger`; `CacheAdminGate` is an injectable service taking `HostUser` (its static `refusal()`/`allows()` are instance methods now); `IconResource`/`IconCollection` take `IconSnippets` through `withSnippets()`; `BrowserBootstrap` reads the locale from the `Translator`.
+- **The browser opens on every pack the host has installed** (Q42): the Inertia page's `packages` (what core registered) becomes the library's `defaults.packages`, and the re-vendored react-icon-browser names no pack.
+- **Each Inertia page is its own chunk** (F-12): `import.meta.glob` is no longer eager; chunks are content-addressed (`inertia-app-[name]-[hash].js`) since only the entry carries `?v=`, and `npm run clean` removes them.
+- **The payload schema's `$id` resolves to the file**: `https://raw.githubusercontent.com/ichava/icon-browser/main/resources/schema/icon-browser.schema.json` (it named a github.com path that answers 404). No field changes, so the version stays 1.8.0. `docs/tools/payload-schema.md` says how react-icon-browser and js-icon-components pin their copies.
+- **The vendored manifest is `resources/vendor/react-icon-browser/vendored.json`, no longer `VENDORED.json`** (owner rule: file names are lower-case slugs). `.dev/tools/sync-vendored-library.mjs` writes only the new name, and `vendoredLibrary.test.ts` reads it first, falls back to the old one until after v0.1.0, and fails if the old name returns. Re-synced from react-icon-browser `7188f57`, the commit already vendored: the manifest's bytes and every bundle file are unchanged, and `npm run build:prod` leaves `public/assets` as committed.
+- **Documentation links point at each repository's own `docs/`** (Sim, 2026-11-03: "all ichava repos have docs in their respective repos. thats by design"). Links to `opensource.simtabi.com/documentation/ichava/...` and the `opensource.simtabi.com/products/ichava/...` homepage, which answer 404 for every ichava page, now go to the matching `docs/*.md` on GitHub, or to the repository itself. Each target was checked to exist on that repository's `main`. The manifest's `homepage` and `support.docs` follow.
+- **The stylesheet is minified with Lightning CSS at Vite 8's default targets** (Chrome/Edge 111, Firefox 114, Safari 16.4, no lower than Tailwind v4's own floor), replacing the esbuild minifier and Vite 7's targets kept since the Vite 8 upgrade. `inertia-app.css` is 26.4 KB gzipped instead of 27.8 KB: duplicate Tailwind layers merge and 21 obsolete `-moz-` prefixes go. Normalized with Lightning CSS, the old and new stylesheets match rule for rule. The only differences are `calc()` expressions that esbuild folded and Lightning CSS keeps inside custom properties, which resolve to the same values. The 26 leftover `:deep()` selectors are untouched. The JavaScript bundle is unchanged.
+- **The author and contact address is `ichava@simtabi.com`** (W-11, Sim 2026-11-03), replacing the community address `opensource@simtabi.com` wherever this repository named it. Vulnerability reports still go to `security@simtabi.com`. The test that guards the address expects `ichava@` now.
 
 - **`@untitledui/icons` is no longer a dependency.** Its only use was the heart on the icon page's favourite toggle, now an inline `HeartIcon` component. The browser itself comes from the vendored react-icon-browser library, which carries its own icons. `inertia-app.js` and `inertia-app.css` are rebuilt.
 - Re-vendored `@ichava/react-icon-browser` at `a9c247d`: its SVG policy copy now says the raster-wrapping brand logos are parked rather than shipped blank (a comment-only change; the policy is identical).
@@ -155,8 +108,38 @@ First release of `ichava/icon-browser`. The repository is published as a single
 - The vendored react-icon-browser `LICENSE` no longer says the repository it ships in must remain private, since this repository is public. It still states the build is proprietary, that it contains Untitled UI React PRO components used under the Untitled UI licence, and that it may not be redistributed outside Ichava products. A test fails if a re-sync brings the old clause back.
 - `public/assets/js/inertia-app.js` is rebuilt so it matches a fresh `npm run build:prod` (three minifier-only differences); a second clean build is byte-identical.
 
+### Deprecated
+
+- **`npm run build:lib`, `npm run sync:react-icon-browser`, `npm run check:consumers` and `resources/vendor/react-icon-browser`.** The scripts print where the work moved and exit 0; the directory is no longer rebuilt, and its `prepaint.html`, which the prepaint component still inlines, is written by `npm run build:prepaint`. The ten files whose code moved to the kernel are deprecated re-exports. Removing any of them needs the owner's yes.
+
+### Removed
+
+- **The deprecated vendored build and its scripts** (owner, 2026-11-13: wire in what can be wired, otherwise remove). `resources/vendor/react-icon-browser` (254 files), `npm run build:lib`, `npm run sync:react-icon-browser` and `npm run check:consumers`, with the library-build checks behind them (`check-lib-build`, `rewrite-lib-type-paths`, `check-public-api` and its snapshot, `check-consumers` and `consumers.json`) and `vendoredLibrary.test.ts`. Nothing imported any of it. The one file still read from it moved: the prepaint component now inlines `resources/views/prepaint.html`, which `npm run build:prepaint` writes. Tailwind no longer scans the old bundle, so `inertia-app.css` loses utilities only it named (181 to 172 KB). `.dev/imported/react-icon-browser/` stays for the e2e port.
+- **The ten re-export files for the kernel's shared pieces** (`lib/utils/cx`, `is-react-component`, the avatar base components, radio buttons, toggle, featured icon, `uui-theme.css`): 40 files now import `@ichava/js-ui-kernel/react` directly, and `noDeprecations.test.ts` allows no exceptions.
+- `CreateCollection::rules()`: its two callers now use `StoreCollectionRequest`, which owns the rules (forward only).
+- **The vendored-library test reads only `vendored.json`.** The fallback to the old `VENDORED.json` name is removed (forward only, owner 2026-11-05); every consumer writes the lowercase name since #124.
+- **Payload schema 1.8.0: the `android-vd` (Android VectorDrawable XML) asset export is dropped**, by owner rule (Sim, 2026-11-04): the ichava icon ecosystem is strictly `*.svg`. `$defs/format` and `x-ichava-formats` lose `android-vd` (25 formats), `PayloadSchema::VERSION` is `1.8.0`, and `FormatRegistryTest` now fails if the id returns or if any asset export other than the SVG-carrying `css-mask`, `data-uri`, `flutter` and `swiftui` appears. 1.7.0 was never released, so no published payload named it.
+- **Payload schema 1.7.0: the `png-zip` asset export is dropped**, by owner decision (Sim, 2026-11-04). `$defs/format` and `x-ichava-formats` lose `png-zip` (26 formats), `PayloadSchema::VERSION` is `1.7.0`, and `FormatRegistryTest` now fails if the id comes back. 1.6.0 was never released, so no published payload named it.
+
+- **The Inertia `settings.search` and `settings.filters` routes** (`POST {prefix}/settings/search`, `/settings/filters`) and `SettingsController::updateSearch()`/`updateFilters()`. The browser syncs search and filters through the URL; the REST `preferences.search`/`filters` routes stay.
+- **`ApiResponseTrait::unauthorizedResponse()`, `forbiddenResponse()`, `paginatedResponse()`, `noContentResponse()`** and **`IconBrowserApiController::emptyIconResponse()`**, protected helpers with no caller (wire-in plan remove rows). A host class extending `BaseApiController` that called one would now fail.
+- **The deprecated `ichava-assets` publish tag.** Publish the built assets with `--tag=ichava::icon-browser-assets` (`IconBrowserServiceProvider::ASSETS_TAG`), which has published the same paths since 0.1.1. `IconBrowserServiceProvider::DEPRECATED_ASSETS_TAG` is gone with it.
+- **The `ichava.api.security` middleware alias.** Use `ichava.security`, which names the same `IchavaApiSecurity` middleware.
+
 ### Fixed
 
+- **Re-vendored `ichava/react-icon-browser` at `41b0a4b`** (react-icon-browser#214): one caret for every dropdown and popover, drawn in the panel's own colours over its edge and centred on the trigger (the header menus drew none), and the "Cookies & storage" notice moves by its grip or the arrow keys, inside the window, for the session. `inertia-app.*` rebuilt with `npm run build:prod` after a fresh `npm install --no-package-lock`, as `committed-build.yml` does. `zustand` is held at `>=5.0.15 <5.1.0`, the vendored library's own range: 5.1.0 (2026-11-06) changes the type react-icon-browser publishes for `useStore`, and a fresh build that took it would no longer match the committed bundle.
+
+- **The browser page works under a host's nonce-based CSP.** A host that sends its own policy with a per-request nonce (`script-src 'self' 'nonce-…'`, as ichava.com does) hands that nonce to Vite; the page now puts it on the loader's `<style>` and `<script>`, the frame `<style>`, the stylesheet, the module scripts and the dev-server scripts, and writes it to a `csp-nonce` meta tag for the styles React Aria injects at runtime. Before, those blocks carried no nonce and the policy blocked them. Without a host nonce, the package's `nonce` CSP mode supplies core's, as before. `Support\PageNonce` resolves which; `HostCspNonceTest` and `PrepaintTest` guard it.
+
+
+- The terms hierarchy endpoint counted icons under a hard-coded morph alias `icon`, so every count read 0 once core moved the alias to `ichava-icon`; it reads `Icon::getMorphClass()`.
+- **The icon SVG rules in `ichava.scss` are valid CSS.** 26 selectors were written with `:deep(...)`, Vue single-file-component syntax a browser does not know, so it dropped every one of those rules from the compiled stylesheet. They are now the plain descendant selectors they meant (`.icon-svg svg`, `.icon-svg.icon-colored svg path`, ...), and `public/assets/css/inertia-app.css` is rebuilt. No element in the React browser or the Blade views carries `.icon-svg`, `.icon-svg-modal` or `.icon-colored` (0 matches in `resources/js`, `resources/views`, `src` and the vendored bundle), so nothing renders differently yet. `noDeepSelectors.test.ts` fails on any `:deep(` in a stylesheet outside a `.vue` file; it failed on both files before the fix.
+- **Re-vendored `ichava/react-icon-browser` at `e60b526`** (react-icon-browser#207): the US and UM flags keep their stars. Their fifty stars are one `<marker>` repeated by `marker-mid`, and the vendored SVG policy stripped `<marker>`, so the browser drew an empty canton. The policy (sha256 `49ee43ce`, ichava/core#166) now allows `<marker>` with `refX`, `refY`, `markerWidth`, `markerHeight`, `orient` and `markerUnits`; scripts, handlers and external references stay stripped. `vendored.json` names the commit, and the committed bundle under `public/assets` is rebuilt from it.
+- **Per-route rate limits now apply (S3).** `getRateLimit()` read `rate_limiting.<bucket>`, which the shipped config always sets, so the limit each route declared (10, 30, 60, 120, 300) was never used, and Laravel's string `throttle:` shares one counter per caller across routes. The new `ichava.throttle` middleware takes the route's declared limit, lets `rate_limiting.<bucket>` only lower it, reads that per request, and counts per route. Turning `rate_limiting.enabled` on also crashed route loading (a nested array in the `cache` group's middleware, "Array to string conversion"); fixed. Behaviour change for hosts that enable the switch: `icons/filters`, `tree` and `statistics` now answer 429 after 60 requests a minute, not 300.
+- **CORS with several origins works (S4).** `Access-Control-Allow-Origin` was the comma-joined list, which a browser rejects. A single origin is sent as before; several are matched against the request's `Origin` and echoed when listed, the response varies on `Origin`, and an unlisted origin gets no header. `ICHAVA_API_CORS_ORIGINS` strings are split on commas. The docs said the default was `*`; it is `APP_URL`.
+- **`GET /icons/{id}/svg` holds an illustration to the illustration size budget.** The route selected a handful of columns without `kind`, so every file was checked against the icon budget.
+
 - **A guest's session preferences merge into the user's on sign-in.** Core's `IchavaSessionManager::all()` and `clear()` looked for flat `ichava.*` session keys while `put()` nests them, so the merge read an empty guest store; core `main` reads the nested entry now. The case `OwnerPreferenceStoreTest` skipped for it runs and passes.
 
 - **Cache statistics need the cache-admin ability and name no server paths.** `GET {prefix}/api/cache/stats` had a rate limit and no authorization, and its payload listed every watched icon directory as an absolute server path; the Inertia stats page passed the same payload to every visitor as `cacheStats`. The API route now sits behind `ichava.cache-admin`, the same fail-closed check as the cache write routes (ability `security.cache_admin.ability`, default `ichava.manage-cache`), and the stats page fills `cacheStats` only for a request that passes it, leaving it empty otherwise; the page and its health flag stay public. Both name directories relative to the application root and drop any outside it. The decision moved verbatim from `AuthorizeCacheAdmin` into an internal `Support\CacheAdminGate`, which the middleware calls. **Breaking for callers of the stats endpoint without the ability**, which now get 403. `tests/Feature/CacheStatsExposureTest.php` covers both routes.
@@ -165,6 +148,13 @@ First release of `ichava/icon-browser`. The repository is published as a single
 - Vendored `@ichava/react-icon-browser` 0.1.3 (`85d9dbd`): the browser renders in Geist again (since 0.1.1 it fell back to the system font), tooltips show their shortcut on one line with no leftover bubble, a tile's copy action reads "Copy Raw SVG" and its permalink keeps the host URL, related icons are ranked by shared words and pack, selects align to their trigger, and Arabic layout reaches selects, menus and sliders.
 - Vendored `@ichava/react-icon-browser` 0.1.2 (`733f5ba`): selected collection chips, the favourite button and active icon buttons now draw their label in a colour that meets WCAG AA contrast on the accent tint. It measured 2.78:1 in dark mode before.
 
+### Security
+
+- **No workflow grants write access at its top level.** `release.yml` declared `contents: write` for the whole workflow; it is now `contents: read` there and `contents: write` on its one job. `WorkflowPermissionsTest` fails on a top-level write grant, proved red against the old file. The seven open CodeQL `actions/missing-workflow-permissions` alerts point at `tests.yml` and `code-quality.yml` as they were on 2026-10-23; both have carried a top-level `contents: read` since 0d5aa13.
+- **`minimatch` resolves to `^11.0.1`** through an npm `overrides` entry, past GHSA-g3hv-75wg-m249 (ESLint 10 pulls 10.2.x). Development only; `npm audit` on a fresh install: 10 moderate before, 0 after. `composer audit` on a fresh resolve reports nothing.
+- **Re-vendored react-icon-browser `2db1e60` (ichava/react-icon-browser#197).** The vendored SVG sanitizer now guards CSS `url()` references, and the browser caps the size of an SVG it will process: `limits.svgMaxNodes` 30000 and `limits.svgMaxChars` 4500000 in the app's `AppConfig.limits`. `inertia-app.js` and `inertia-app.css` are rebuilt. The PHP side now passes core's `svg.max_elements` and `svg.max_bytes` as `limits`, so a host can override them (see Added); the vendored browser reads them once it is re-vendored.
+- **Every workflow declares a top-level `permissions: contents: read`** (S9), so its token no longer depends on the organisation's default. None of these jobs writes. `tests/Feature/WorkflowPermissionsTest.php` fails if a workflow loses the block.
+
 ## [Archived history]
 
 > The first two sections below are the 0.1.x releases cut from 2026-10-23 to 2026-10-28 and folded into