- Sasquatch UI/guide/FAQ were already 100% in all 24 locales; the AI reply
language directive only covered es/th/ja. SASQUATCH_LANGUAGES now maps all 24
app languages (trick names/core vocabulary stay English).
- Document the Sasquatch privacy difference: its AI calls the CVM/AI proxy
(OpenRouter), unlike the on-device translation.
- Record the Basque status: IR 9->8 and target-side tokenizer fixed; model now
emits Basque but loops on EOS/generation; remaining gap before 1.7.2.
- M2M100 418M (MIT, 617 MB q8) covers 23 app languages; Basque uses converted
Opus eu-en/en-eu q8 packs; all self-hosted under relay.skate-spots.org/models.
- Worker uses M2M100 directly and pivots Basque through English; UI targets all
languages; old pilot restriction/note removed; memory-only + guard unchanged.
- Verified en<->es, ca<->gl, hi<->en from the host. Basque packs are converted
and hosted; the final MarianTokenizer/ONNX runtime check is still pending.
- 138 tests, 24 locales, build and smoke green. SpotChat deliberately skipped.
Translations are memory-only; on logout/account switch we now clear the cache,
reject pending requests and terminate the worker (the model itself is public
and stays in the browser cache).
- @xenova/transformers 2.17.2 in a Web Worker; Opus-MT en↔es ONNX q8 packs
self-hosted on the relay VPS (/models + CORS); ONNX Runtime 1.14 WASM
self-hosted in public/ort/ (37MB) loaded from ../ort/.
- Hard network guard: only model GET/HEAD (no query) and /ort/ assets allowed.
Message text travels only via postMessage; 9 tests prove fetch is never called
with the text and every other request is blocked.
- TranslateMessage in DMs + crew chat; Settings auto-translate off by default;
memory-only translations; per-model download progress; 12 UI strings in all
24 locales.
- Both model directions verified from the hosted files; tsc, 138 tests, build
and smoke green.
- tinyld (MIT, lazy, local) + script rules + a weighted
Catalan/Galician/Basque/Spanish/Portuguese rule for the close/short cases
tinyld confuses. No network, no logs, no storage; conversation/contact prior
supported.
- Lingua with 24 languages produced a 99 MB WASM, so it was rejected as a
detector; tinyld + the gl rule covers all 24 at a fraction of the size.
- 28/28 language samples pass, including a test that fetch is never called.
- Phase 2: on-device Opus-MT (English pivot) in a worker, memory-only
translations, model packs on Blossom, sentinel/network-guard test.
- NIP-17 wraps now carry the app's ['skatespots','push'] marker on every admin
copy (including the sender), so the push service wakes the phone with the app
closed. Push test wraps 39fbbd4e…/c88c9f55… verified on the community relay.
- The weekly scan-only job DMs only when the OSV summary changes; unchanged
scans are logged, not messaged.
- auto-deploy alerts on Netlify failure and on a post-deploy production URL
health-check failure; deploy-failed/health-failed appear in ops-health and
the daily report.
- scripts/ops-report.sh builds a simple daily report (app, website, deps,
security, weekly scan); --send DMs it to the two admins from src/lib/admins.ts
via NIP-17 (scripts/send-ops-report.ts), sender = app identity.
- Delivery discovers kind-10050 inboxes + NIP-65 write relays and always
includes the community relay; OPS_DRY_RUN=1 previews without publishing.
- scripts/send-ops-alert.sh sends short alerts; wired into auto-deploy
(preflight/smoke), update-deps (full+fallback failure) and ops-health --notify.
- skatespots-ops-report.timer daily 07:00 + installer.
- Signer moved into the 0600 zsp.env; old history copies removed.
- scripts/preflight.sh: app+server tsc, eslint, i18n, vitest; installed as
.githooks/pre-push (scripts/install-hooks.sh) and run by auto-deploy before
Netlify. Failures record preflight-failed and ops-health flags them.
- update-deps.sh: if the blanket npm update fails, restore the lock and retry
patch-level packages one at a time, keeping those that pass a fast gate; the
final npm test + smoke still gates the result, otherwise revert + 3-day retry.
- release.sh/deps set SKIP_PREFLIGHT=1 (they run the full npm test themselves).
- Dependency job is now 16 days (service env + script default); a separate
weekly scan-only timer reports npm/OSV findings without changing the lockfile.
- TimeoutStartSec=30min on the deps job and 20min on the deploy job (systemd's
90s default could kill a legitimate run); both scripts resolve the newest nvm
Node instead of hardcoding v22.23.1.
- npm override pins @tanstack/query-core to $@tanstack/react-query so a blanket
npm update cannot create a second copy (the Oct 26 tsc failure).
- Failed runs keep test/smoke logs + attempted package files in failures/
(rotated, 8 kept) and a last-failure marker; reports rotate (12 kept).
- scripts/release.sh: notes check -> npm test -> bump -> Android build ->
zsp publish -> relay verify -> commit/push + tag.
- Deploy/deps systemd units are tracked under scripts/systemd/.
- LanguageSelector was still rendering the new SVG flag paths as text; use
<Flag> there too and give every flag a fixed 24px slot (SVG/emoji align).
- Language dropdown w-48 -> w-72 with truncate + hover titles, so
'Português (Brasil)' / 'Português (Portugal)' no longer clip.
- Settings language grid 1 column on phones / 2 on sm+.
- Header More menu w-48 -> w-64; header nav keeps its scroll, bottom nav keeps
truncation.
- :lang(hi/th/ja/ko/zh) disables uppercase/tracking-wide so Devanagari, Thai
and CJK menu labels are not letter-spaced.
- tsc, 101 tests, build and full-route smoke green.
- Full 8,703-key Hindi dictionary in src/i18n/hi (7 namespace batches),
placeholders verified, only 2% identical strings (brand/protocol names).
- Register hi in Language/LANGUAGE_LOADERS, detectLanguage (hi-IN),
LanguageToggle (🇮🇳, हिन्दी) and dateFnsI18n (hi-IN).
- Lazy-load Noto Sans Devanagari for hi via lib/localeFonts.ts (renamed from
cjkFonts.ts) and add it to the CSS font stack; other locales don't download it.
- check-i18n covers hi: 24 dictionaries / 25 codes at 100%; tsc/tests/build green.
- Map: min zoom = smallest integer zoom whose 256*2^z world covers the
viewport (no grey bands, no duplicated continents). Horizontal wrap is
restored (worldCopyJump, no longitude maxBounds) so Hawaii/Pacific are
reachable by dragging; vertical panning stays clamped.
- Flags: real SVGs for Catalonia, Basque Country, Galicia and England
(no Unicode region flags exist; English is not the UK). Portuguese now has
Brasil (pt) and Portugal (pt-PT).
- pt-PT shares the pt dictionary with a European drift for the visible chrome
(Guardar, Palavra-passe, Autocarro, Utilizador, ...).
- check-i18n covers pt-PT: 24 codes at 100%; tsc/tests/build green.
- Full dictionaries (8,703 keys each) in src/i18n/{ca,eu,gl}, 7 namespace
batches, composed with deepMerge; placeholders verified, 2-4% identical
strings are only brand/protocol names.
- Register in Language/LANGUAGE_LOADERS, detectLanguage (before es),
LanguageToggle (CA/EU/GL text badges - no Unicode region flags exist) and
dateFnsI18n (ca-ES/eu-ES/gl-ES).
- check-i18n.mjs now covers ca/eu/gl: all 23 locales at 100%, tsc/tests/build
green.
- react-router-dom/react-router 7.18.4: the app only uses the v6-compatible API
(Link/NavLink/Routes/HashRouter + hooks), so zero code changes; tsc, tests and
the full-route boot smoke all pass. Clears the open-redirect advisory.
- vitest 5.0.5 (dev): clears vitest/@vitest/mocker/tinypool criticals. Setup now
imports @testing-library/jest-dom/vitest for the new expect types.
npm audit: 8 total (0 critical, 1 high = xlsx write-only, 7 moderate = build
tooling).
- aria-label on the language dropdown trigger (flag-only) and the header
settings icon (title-only) so screen readers announce them.
- AGENTS: final security scan (audit 35->13, zod 4/nostrify 0.50, APK manifest
and CSP verified) + menu/a11y conclusions.
The dismissal was stored in localStorage, so one early ✕ suppressed the prompt
forever. Switch to sessionStorage (key skatespots:desktop-welcome-snoozed): it
reappears in a new tab/session but respects 'keep browsing' for the current one.
- Fix the real bug: the dialog clipped its bottom links (flex column + max-h
calc(100dvh-2rem), content min-h-0 flex-1 overflow-y-auto).
- One dominant action per state: 'New here' is a compact row, not a second hero.
- Plain card labels (Browser extension / Signer app / Sign in with your phone)
with tiny NIP-07/46/55 hints; protocol jargon out of the main labels.
- Bunker: input + Connect with instructions collapsed under 'Where do I get a
bunker?'; no duplicate heading/divider.
- Secret key moved to a quiet bottom link; subtitle says 'or keep browsing'.
- 8px spacing grid (px-5 gutters, space-y-4 sections, gap-2 cards, p-2.5 cards,
448px max width). New strings backfilled into all 20 locales.
Verified with headless 1280x900 + 390x844 screenshots.
Notifications now include the OSV summary. A failed run restores the lockfile
and schedules a retry in ~3 days instead of consuming the full 20-day interval.
