Release Notes

v0.43.32026-09-16RUNNING NOW

The machine only promises a sign-in link will come back to an address the account server actually knows. Yesterday's note listed two addresses the server has not been given: the www version of this site, which serves the site in its own right rather than sending you to the short one, and preview builds. A link asked for at either of those lands on the main site instead. The machine now says so at both, rather than promising a return it cannot make, and the list of what the server knows is recorded beside the code that mirrors it.

v0.43.22026-09-15

A backup code now pays out once, here. Restoring a code adds what it carries, so that two machines can be merged without either losing anything. Nothing stopped the same code being pasted again, and again, each time adding its balance once more: a counter with no floor, in public, on the number the bank shows you. A code you have already restored here now says so and adds nothing. A different code still pays, because merging is the point. Bits remain worth nothing until the merch counter opens, and this was arithmetic that was simply wrong rather than a way in.

v0.43.12026-09-15

The site now sends the security headers it always said it had. Every page tells the browser not to guess at file types, not to hand our full addresses to other sites, never to let this site be framed inside another, and to refuse any request for a camera, microphone, location, USB device and the rest of the hardware a tool site has no business touching. There is also a content security policy: it allows only our own scripts, names exactly one other address (the account server), and permits no inline or evaluated code. For this release it reports rather than blocks, because a policy that is wrong breaks the first paint of every page. Our own tests load every page and run every file tool under it and find nothing it would block; once production agrees, it enforces. Our design notes claimed a strict policy while none was sent, and they now say exactly what is sent.

v0.43.02026-09-15

You can sign in now, and nothing on the shelf needs you to. The Bit Bank has a sign-in form: type your email, open the link it sends, and you are in. There is no password, because a password is one more thing to store, reset and lose. Signing in banks the bits you have earned here into an account and carries them, your themes and your stamps to any other machine you sign in on. The merge only ever adds: nobody loses a balance by signing in, signing in twice does not count the same bits twice, and signing out leaves your balance exactly where it was.

v0.42.32026-09-15

A vague speed check relaxed, an exact one added. The timed check on each release runs on a shared build machine whose clock drifts by more than a tenth of a second between runs of the same code, so it could only ever catch a disaster, and it now says so and sits where only a disaster crosses it. The real line moved to something that cannot drift: the number of bytes of JavaScript each page downloads before you can touch it. That count is identical on every machine, it is checked on every build of every page, and it fails the moment a page starts carrying code it does not need, which is exactly how both real slowdowns this site has had were caused. The first thing it caught was already live: every page except the desk was downloading this entire changelog before its tool could be used, about 20KB and growing by one entry per release. It now loads only on the changelog page, so a converter page downloads 86KB instead of 105KB. The homepage downloads 88KB. Neither may grow by more than five percent without the build refusing. Net, the gate got stricter and the pages got lighter.

v0.42.22026-09-15

The page-view counter is now switched on by hand, not guessed at. 0.42.1 tried to work out from our host's build settings which counters were enabled, and guessed wrong again: the host lists what it is able to serve, not what has actually been switched on, so the page-view script was still being requested at an address that returned nothing. There is no reliable way for the build to infer that toggle, so it no longer tries. Each counter runs only when it has been deliberately switched on in the project's settings, in the same step as enabling it. Until that happens, the page-view counter is absent from the site entirely rather than quietly failing.

v0.42.12026-09-12

One of the two counters was asking for a script that did not exist. Our host enables page-view counting and page-speed measurement separately, and only the second was switched on when 0.42.0 went live. The build read "counting is provisioned" as one fact instead of two, so every page requested the page-view script at an address that returned nothing, quietly, in the background. Nothing was counted that should not have been; the defect was noise, not collection. The build now reads each counter's own switch and leaves out any it finds off. The page-view half starts the moment it is enabled in the dashboard, and /privacy already describes it.

v0.42.02026-09-12

You are now counted, and here is exactly how. For the first time this site keeps a count: page views, and how fast its pages load on real devices. It uses our host's own analytics, served from our own address, so nothing is fetched from anyone else's server to do it — the build check that fails if any file points at a host that is not ours stayed green without being touched, and a second check now loads the live site and reads every request it makes. For each view it records the page, the page that sent you here, your country and city, your device type, browser and operating system, and the page's timings. It sets no cookie and keeps nothing in your browser; visitors are told apart by a hash of the request that our host computes and discards after a day. /privacy says all of this in full, in the same paragraph that used to say "we do not count you", which is no longer true and no longer says so.

v0.41.02026-09-11

The Print Lab is open. It had been sitting on the bench while four tools that belong inside it shipped and went live, so a visitor who found "crop an image" had no route to the thing it is part of, and the site's marquee tool read as unbuilt while four of its panels worked. It is now the hub it was always meant to be: two panels, in the order you would actually use them. ADJUST fixes the photograph — crop, rotate, straighten, flip — and works today. PRINT makes it a print-shop original, and is named rather than hidden, with no link, because it is still being built.

v0.40.32026-09-11

The gate that was not gating. Every CI run had failed for twenty-five runs straight, across eleven releases, and nothing said so. Three real faults were hiding in that red, and all of them are fixed below. The gate's definition now lives in one file that both a laptop and the build machine run, so "it passed for me" and "it passed in CI" can no longer be different claims.

v0.40.22026-09-09

Tool pages load faster again. Two features built this week each reached for the page registry from the desk — the F1 help panel and the dir joke at the command line — and each time that pulled the registry out of the landing pages' own code bundle into a second file every tool page then had to download as well. Measured against the start of the week: 49KB more JavaScript on every tool page, and 150ms slower to show the largest image. Both now read from something smaller, and the extra download is gone.

v0.40.12026-09-09

The modem noise works now. Triple-click the speaker in the taskbar and you get the dial-up handshake, the way you always could not. Three clicks is three mute toggles, so the third one was turning the sound off a fraction of a second before the handshake tried to play — it fired into a muted machine every time, and from a muted start it did not fire at all. It had never once been audible. Every rule around it was tested; nothing had checked whether a sound came out. The third click now leaves the sound on, where you started.

v0.40.02026-09-09

F1 is help, everywhere. Press it and you get help for whatever is in front of you: a tool shows you how to use it, a game shows you how to play it, and the desk opens THE MANUAL. Every window that has instructions also carries a ? next to its title. ESC puts the help away without closing the thing you were reading about.

v0.39.02026-09-09

The image bench: crop, rotate, straighten, flip. Four new tools, one engine. Trim an edge, turn a photo a quarter at a time, level a crooked scan, or mirror a picture — and the result keeps the format it arrived in, so cropping a photo does not hand you back a file six times the size.

v0.38.02026-09-09

HEIC to JPG. Your iPhone saves photos in a format most of the web cannot open. This turns one into a JPG that anything will read.

• On Safari it uses the browser's own decoder and downloads nothing extra. That is most people who have HEIC files, since it is Apple's format.
• Everywhere else it fetches a decoder — once, only when you actually open a HEIC, and from this site rather than from anyone else's.
• A burst or a Live Photo holds several frames. This takes the main picture, the one your phone shows you, and the page says so rather than quietly dropping the rest.
• Location data does not survive, same as every other tool here.

v0.37.02026-09-09

A licences page. /licenses lists every third-party component this site ships to your browser, with its version and its terms.

v0.36.02026-09-09

Four things we were not sure about, made certain.

• Fixed: two colours in phosphor mode were wrong, and nothing would have caught them. It was the one palette no automated check ever looked at — not because of the colours, but because of where it was listed. It is a real palette now, and every contrast rule that guards the other six guards it too.
• The screen saver has been watched arriving. It appears, wakes on a keypress, comes back, and stays away while a tool is working — all now proven rather than assumed.
• /tools.json reads what each tool actually accepts instead of guessing from its name. A future tool with "image" in its name was going to be handed a format list nobody chose for it.

v0.35.02026-09-09

Made the site legible to assistants, which is how most people will find a tool like this now.

• /tools.json — a plain list of what this machine can do, what it takes, what it gives back, and whether the work happens on your device. Generated from the same registry as everything else, so it cannot describe a tool that does not exist. It is not an API spec: there is no API yet, and publishing a spec for something that does not answer would be worse than publishing nothing.
• Step-by-step instructions in the page data, built from the steps already printed on the page. Assistants read this when somebody asks "how do I convert X to Y".
• robots.txt now names the assistant crawlers and welcomes them, with the reason written next to it. They were already allowed; saying so out loud means a future decision to block them has to be made on purpose.

v0.34.02026-09-09

Nine easter eggs. None of them are listed anywhere, and this changelog is the closest thing to a hint you will get.

• The command line learned some tricks. dir is the useful one: it prints every live tool as a DOS directory listing, generated from the real registry so it cannot go stale. whoami tells you your balance and your stamps.
• A passport. Stamps you collect without being told they exist. It appears in the Bit Bank once you have one, and it never tells you how to get the rest.
• Phosphor mode, for anyone who still remembers the code.
• A screen saver, after two minutes of nothing. It pauses when the tab is hidden and it will not start while a job is running.
• Page 06 of the manual appears at 1,000 bits. There is nothing to see before that, not even a locked door.
• The 1,000,000 BIT CLUB card, for practically nobody.
• And a small thing in the page source for anyone who looks.

v0.33.02026-09-08

Your bits now have a backup code.

• Restoring adds. It never takes anything away. Putting an old code into a machine that has since earned more keeps the bigger number. There is no way to lose a balance by pressing the wrong button.
• A mistyped code says so and changes nothing. The checksum catches every single wrong character and every pair of swapped ones.
• No 0/O and no 1/I/L anywhere in a code, because you will be reading it off a screen and typing it somewhere else.

v0.32.02026-09-04

Eight defects in the tools, found by decoding what they actually produce.

• Fixed: clicking the format you already picked broke the converter. The download button disabled itself and never came back. Recovery was choosing a different format and returning, which nobody would guess.
• Fixed: your camera's location tag was surviving into PDFs. The page promised it did not. It was true for most formats and false for JPEGs, which is what phone photos are. Now stripped, and the photo keeps its original quality.
• Fixed: a family emoji counted as eleven characters. You typed one.
• Fixed: a Japanese sentence counted as one word. Languages without spaces between words now get counted properly.
• Fixed: accented words got a capital in the middle — "naïve" became "NaïVe". And "café au lait" lost its é entirely in camelCase.
• Fixed: camelCase destroyed its own output if you pressed it twice.
• Fixed: a 33-byte image file could crash your tab. A tiny file can claim to be 40,000 pixels square; nothing was checking before it tried to open it.

v0.31.02026-09-03

Windows stay on the desk, and you can resize them.

• Fixed: a window that grew after opening ran off the bottom of the screen. Insert a file into THE SLOT and the action list appears — the window was placed while it was still empty and small, so it grew straight past the edge with its last rows unreachable. Windows are now capped to the room they actually have and scroll inside instead.
• Windows resize. Drag the grip in the bottom-right corner, the way every window in 1992 did. Arrow keys work on it too, so it is not a mouse-only control. A resize can never push a window off the desk.
• Fixed: MAKE IT A VECTOR said it was on the bench when picked from THE SLOT, despite the tool being finished and live on its own page. Same for MAKE A PDF, which had been wrong since long before the vectorizer.

v0.30.02026-09-03

PNG to SVG. Two tools, honestly labelled, because the phrase means two different things.

• TRACE TO PATHS finds the edges and writes real <path> geometry. Scales forever, opens in Figma or Illustrator as editable shapes, and usually comes out smaller than the PNG. Three settings: line art, flat colour, detailed.
• WRAP THE PIXELS puts the image inside an SVG exactly as it is. Right answer for photographs, and the tool says plainly that it will not scale and there is nothing to edit — because a traced photograph looks broken and a wrapped one looks like a cheat.
• It takes a pile of files, not one. Nobody converts a single logo.

v0.29.02026-09-01

The Start menu takes you to the pages, and there is only one arcade again.

• Fixed: two THE ARCADEs on one desk. The desk note collapses to its sponsor's mark on the right rail, and the note we were carrying was for the arcade — which already has an icon, a menu-bar link and a dock button. The note is gone. Nothing is sold yet, so nothing is on the desk.
• The Start menu now navigates. Programs and The Arcade list every tool and every game as a real link to its own page, instead of opening a window. The desk still opens windows; the Start menu is the way to the pages. Those pages have always been there — they just had no route in from the desk.
• Fixed: the ▸ was lying. Both of those rows have always shown the arrow that means "a submenu opens here", and both actually opened a single window. Programs opened THE SLOT.

v0.28.02026-08-30

Six things nobody could read, and the test that found them.

• Fixed: the menu bar's USER line was invisible on the two dark themes — 1.33:1 on NIGHT SHIFT. It was painting a grey from the original palette that had been written in as a fixed value before themes existed.
• Fixed: a selected desk icon's own label was unreadable on the dark themes — 2.07:1. White on blue, and the blue goes light when the room does.
• Fixed: the tray date and the Bit Bank's dismiss button sat just under the line on MACHINE ROOM, along with the claim nudge's blue lead line on two themes.
• Fixed: the desk eyebrow on GOLDEN HOUR. Its colours were fine; the paper grain over the whole page pushed it under once composited.
• MACHINE ROOM's soft ink moved two shades darker. It is the one change to that palette since v0.7, and it is there because the old value missed AA on its own chassis.
• Every route, every window, and every game — in all six themes — is now checked with a real accessibility engine rather than against a hand-written list of colour pairings. A list can only contain the pairings somebody thought of.
• The games are checked while being played. Minesweeper's numbers do not exist until you open a cell, so scanning a fresh board sees blank tiles and reports nothing — which is exactly how unreadable digits shipped.
• And the surfaces this site paints *through* something — the grain over every page, the scanlines and glow on the CRT — are measured from the actual pixels, because nothing that reads a stylesheet can see them. That pass is what caught the eyebrow.
• Fixed: the mine and the detonated square in Minesweeper, and the J, Q and K on Solitaire's court cards. Same cause as the digits — the ink was fixed but the surface underneath was still following the theme. Playing cards are now always a red suit on a white face, on every theme, because otherwise they stop being a deck of cards.
• Fixed: the small line above the headline on the desk. It was set slightly transparent, and the paper grain took it under the line.

v0.26.02026-08-28

The desk learns how to carry a sponsor without becoming one of those sites.

• The desk note. A small note in the machine's own chrome, bottom right of the field. Close it and it folds down into a mark on the rail beside TRASH; click the mark and it comes back. An ad you can dismiss but never recover is one you have to think about before closing, which is how those sites get you to leave them open.
• One note, ever. Never a column, never a carousel, and never anything on a first visit.
• If somebody paid for it, it says AD, and the label comes from the same field that makes it an ad rather than from a prop somebody could forget.
• Links out carry noreferrer, so a sponsor genuinely learns nothing about you — not as a promise, as a mechanism.
• Nothing is sold yet. Today's note is ours, points at the arcade, and carries no AD label because nobody paid for it.
• The mark is not one of the desk's thirteen icons. A sponsor cannot change the composition of the desk by existing.
• /privacy now lists an eighth stored thing — which note you have put away — and the count in that sentence is checked against the code rather than maintained by hand.

v0.25.02026-08-28

FIRST EDITION becomes the machine as issued, and type joins the palette.

• FIRST EDITION is now the default theme. Cream page, bone panels, one blue accent, and a Garamond title. Anyone already wearing another theme keeps it; nothing is reassigned.
• Every theme carries its own type. Not just colour: each one names an interface face, a display face and the weight that face actually ships. FIRST EDITION and MACHINE ROOM keep Garamond, NIGHT SHIFT and DEEP FIELD get a terminal face, SALT FLAT and GOLDEN HOUR get a grotesque. The interface face stays constant on purpose — it renders at 10px in the bars, where a character face costs legibility.
• The desk headline, the page headings and the window titles follow the theme now. The logo lockup does not, and no theme can reach it.
• Every themed face ships a fallback measured against the real font, so nothing moves when the webfont lands.
• Minesweeper was unplayable on the two dark themes. The 1-8 numbers are canonical and deliberately unthemed; the tile behind them was not, so every digit sat between 1.15:1 and 2.53:1 on NIGHT SHIFT and DEEP FIELD. The board is fixed now, the way Paintbrush's palette always was.
• The drop hint was invisible on NIGHT SHIFT — 1.09:1. Three rules were still painting the original theme's ink as a hardcoded value, so they stayed near-black after the field went dark.
• Empty solitaire slots had the same frozen ink and all but vanished on the dark themes.

v0.24.02026-08-27

The glass becomes glass, and the desk gets a little depth.

• The CRT surfaces — the SYSTEM plate's screen and the command line — read as tubes now: a slight curve, scanlines, a phosphor bloom from the middle, a vignette at the edges and a highlight that moves. All of it CSS, all of it from theme tokens, so the glass is dark in every theme for the same reason rather than by coincidence.
• The SYSTEM plate tilts a few degrees toward your pointer, like an object on a desk catching the light. It follows from across the screen rather than snapping when you arrive, because the snap is the thing that reads as cheap.
• None of it fetches anything: no image, no shader, no library. Asserted.
• It cannot move anything on the page — transforms only, on the page that owns the layout-shift history. Desk CLS is 0.0006, unchanged.
• Off entirely for reduced motion, and off for touch, where there is no pointer to follow.

v0.23.02026-08-27

The homepage gets 43% lighter, the arcade closes, and the first design comes back as a theme.

• Route-level code splitting. The client router imported the whole page registry, so every homepage visitor downloaded every word of copy on the site plus six game engines and nine tool windows. The entry bundle goes from 123KB to 70KB and the homepage's largest paint from 2570ms to 2273ms. A tool page fetches three chunks where it briefly fetched fourteen.
• Hydration was failing on every single page load and nobody knew: React was discarding the prerendered markup and rebuilding the whole page. Three causes, all things a server cannot know — the tray clock, the bit balance, and the boot splash. All three now arrive a frame later instead of breaking the page. The build fails if it ever regresses.
• PAINTBRUSH.EXE, the last arcade machine, and with it the arcade is closed: six machines, none on the bench. Fourteen tools, the sixteen-colour period palette, undo that keeps pixels rather than replaying strokes, and a PNG export that carries no metadata at all.
• WORDART, inside Paintbrush, because it is 1992 and it had to happen. Eight styles, two of them set in real blackletter.
• Jacquarda Bastarda 9 joins the type stack for documents only — stamps, seals, and Napkin Contracts when it exists. A test stops it ever reaching the interface.
• FIRST EDITION: the original DS-1992 palette, cream page and ink line-work, rebuilt as a theme you can switch to. Six themes now.
• Every theme record can carry a credit and an expiry, so a guest or brand-designed theme has somewhere to live. Three rules are enforced in code: never the default, always visibly attributed, and no exemption from the contrast contract.
• Exported files keep their own names. holiday.jpg comes back as holiday-resized-800px-the1992com.jpg from every tool, instead of six tools inventing six different names, and running a file through twice does not stack the suffix.
• The speed budget re-baselines twice, both for the same reason and both recorded: the split costs a tool page 167ms and gains the homepage 296ms. The real fix is critical CSS — inlining the whole stylesheet was tried and is measurably worse.

v0.22.02026-08-25

The legal surface, and a check that keeps its best sentence true.

• /privacy, /terms and /legal all returned 404 on a public site. All three are live now, prerendered, in the sitemap and linked from the footer, written in the manual's voice rather than boilerplate.
• No cookie banner. This site sets no cookies, loads no analytics and references no host but its own — verified on production before the page claimed it. Putting up a consent dialog for a site with nothing to consent to would only teach people to click through them.
• The privacy page names all seven things kept in your browser rather than saying "certain information", and scopes what leaves your machine per shelf. It never makes the site-wide absolute the messaging law forbids, which is the sentence a privacy policy is most likely to get wrong.
• A build check fails if any file in dist references a third-party host, and its failure message explains that the privacy claim depends on it. Verified by injecting an analytics snippet, which it caught.
• A second check reads every storage key the code actually writes and fails if the policy does not describe it. Adding an undocumented key breaks the build until the page is updated. It found a real blind spot on the way in: the claim-nudge dismissal is written as an inline literal rather than a named constant, so a constants-only sweep missed exactly the drift it exists to catch.
• The terms are under a thousand words and write no speculative clause about a service that does not exist. Upload retention, deletion, takedown and payment terms arrive with the Power Shelf, because none of them govern anything until files reach a server.
• The entry bundle budget moves 120KB to 123KB, measured: the legal prose lives in the page registry, which the client router imports, so every homepage visitor now carries 2KB of copy they will never read. The budget's actual invariant — no heavy engine in the entry chunk — is asserted separately and still holds. Route-level splitting is the real fix if it creeps further.

v0.21.02026-08-25

The desk gets a headline, and the homepage gets the H1 it never had.

• grep for a top-level heading on the homepage returned zero. The site's strongest sentence was an h2 inside the manual, below the fold, on the most important page of a domain whose entire growth plan is SEO. The design idea and the technical fix turned out to be the same change.
• The headline stacks above the intake in the same optical column: eyebrow, headline, one line of subhead, then the thing you do. Two things competing for the middle of the field would be two heroes and therefore none.
• It is set in IBM Plex Sans 600 at display size, never the lockup serif. One typeface with EB Garamond confined to the logo is the decision that defines DS-1992 v0.7, and a display serif headline would reverse exactly it. Size comes from a scale token that steps at all four tiers.
• Every route in dist is now asserted to have exactly one non-empty h1. Most of them are generated, so this is the kind of thing that drifts silently.
• The manual's page-01 heading is reworded, because that sentence is the desk's headline now and a page should not print its own headline twice.
• The subhead makes no claim at all. The version it replaces packed three messaging-law violations into one line: a site-level absolute about where files go, a promise that accounts would never exist while login is being built, and an unqualified guarantee. That sentence came out of the footer in Prompt 9 and does not come back. (Written out in full here, it would have shipped the claim on a real page — the dist-wide guard caught exactly that and is the reason this bullet is paraphrased.)
• Short viewports shed the eyebrow and the subhead and shrink the headline, but never hide the heading: an h1 present for crawlers and hidden from people is cloaking, and removing it puts the page back where it started. On a phone it matters more, not less — the home screen otherwise explains nothing — so it reads first, above the slot and the icon grid.
• The menu bar had been letting its buttons overflow a fixed-height bar by two pixels top and bottom since the shell landed, and wrapping LOG IN onto a second row over the field below 880px. Once the desk had a headline, that wrapped button sat on top of it. The items fill the bar's height now, which is also what a Windows 3.1 menu item does.
• Desk CLS measured before and after: 0.0006 both times.

v0.20.02026-08-25

PAINTBRUSH.EXE, and the arcade is closed.

• The last machine: fourteen tools, five widths, the sixteen-colour period palette, and a foreground/background pair that behaves the way the original did — left-click paints with one, right-click with the other, and the filled shapes use the background for their interior.
• Undo is a bounded stack of dirty-rect snapshots, not a move log, and the module says why at length. Solitaire's undo replays its log because a card move is exact to reconstruct; a brush stroke is not, and "nearly identical" accumulates. Twenty levels, bounded to the pixels each stroke actually touched.
• The palette is content, not chrome. Those sixteen colours are literals and a test asserts they resolve to no themed token and share no value with any theme — a saved drawing whose colours changed when the viewer switched theme would be a data bug wearing a design costume.
• Save exports a real PNG. Re-encoding through the canvas drops every metadata chunk by construction, and a test reads the file's chunk table to prove it. The name you type is user input and goes through the same sanitiser every download on this site uses.
• Pointer events with coalesced-event smoothing, so a fast stroke is a curve rather than a polyline, and a finger draws instead of scrolling the page.
• A status bar that reads out the pointer position, and the size of a shape while you drag it.
• /paintbrush is live, prerendered, in the sitemap, with real content: what each tool does, and where Paintbrush came from.
• The sound switch now agrees with itself from every control. Each caller of the sound hook had been holding its own copy of the on/off state, so the tray, Settings and the desk menu could all disagree.

v0.19.02026-08-24

The palette becomes a parameter, and bits finally buy something.

• Five themes: MACHINE ROOM, NIGHT SHIFT, SALT FLAT, GOLDEN HOUR and DEEP FIELD. MACHINE ROOM is the default and is byte-identical to the palette that shipped before, asserted, so nobody's desk changed without asking.
• The tokens split in two. Structural — spacing, the four scale tiers, bevel geometry, the type stack, touch minimums — stays in tokens.css and no theme may touch it. The palette lives in themes.css and every theme defines all of it. A test fails the build on a partial theme, on a theme reaching into structure, and on a theme inventing a token of its own.
• The contrast contract: fourteen required pairings computed for every theme against the CSS that actually ships, 4.5:1 for text and 3:1 for UI graphics, plus a rule that no theme may regress more than 10% below the default on the pairings nobody thought to name. It caught five real problems while the palettes were being written, and every one was fixed in the palette rather than the floor.
• Two rules learned the hard way are properties now rather than comments: blue is never a UI graphic on the field, and stamp-red must fail as text on chassis in every theme, which is the entire reason stamp-ink exists as a separate token.
• SETTINGS, from the Start menu and the desk's right-click menu, with real folder tabs — the active tab merges into the panel and the inactive one sits behind. Reusable, because the arcade and the image bench will both want it.
• Theme previews are miniatures of the real chrome, rendered inside a scoped data-theme container so they are painted by the same block that paints the desk. Not swatches and not drawings: a drawn preview is a second copy of a palette, and a second copy drifts.
• The theme is applied by an inline script in the head, before first paint, so a themed visitor never sees a frame of the default. Desk CLS measured before and after: 0.0006 both times.
• Bits buy the machine's finish. Three themes are free; GOLDEN HOUR opens at 500 and DEEP FIELD at 10,000. Unlocking deducts nothing — it is a threshold, not a price — and locked tiles show the preview greyed with the requirement stated plainly. No countdown, no urgency.
• /bits copy rewritten: "nothing you can spend" was true and is not any more. Every existing guarantee survives — no cash value, no rate for merch, no date.
• The messaging law now reaches surfaces that never reach dist/. Its vocabulary moved into a module so the Settings window is held to the same words as a prerendered page, which is the dist sweep's own lesson applied one level up.

v0.18.02026-08-24

The homepage stops being a page you scroll and becomes a desktop.

• The manual moves off the bottom of the page and into its own document window. The page no longer scrolls at all, which removes the bug behind the change: windows are positioned inside the desk, so scrolling down to the manual slid an open window up out of view while the taskbar still listed it as open.
• The manual's markup is unchanged and still ships in /index.html. It is mounted whether or not its window is open, rather than unmounted on close, so closing the window cannot take the homepage's crawlable content out of the DOM.
• It is closed on arrival. Opening it by default put a full-height window over INSERT FILE TO BEGIN at every desktop width, and that is the one gesture this machine is built around.
• The speed gate has been measuring a 404 page for its entire life. Its URLs were file paths — /index.html — and the client router reads location.pathname, finds no page registered for that, and replaces the hydrated page with the NotFound component. Every score it ever reported described a 27-element error page: accessibility 100, SEO 100, and the CLS number that started a documented investigation into desk chrome it was never looking at. The URLs are routes now, and a post-run check fails the build if what Lighthouse rendered turns out to be the 404.
• Two accessibility defects the 404 page had been hiding, both on the desk: USER: GUEST sat at 4.43:1 against the chassis, under the 4.5 floor for text that size, and the phone's INSERT A FILE panel had an accessible name that did not contain its own visible text.
• START has never opened a visible menu. Same defect as the tooltip: the stylesheet hides #startmenu until a class arrives, the prototype toggled one persistent element, and the React port mounts and unmounts instead. Two of the three overlays lost the class in translation. A sweep now asserts the property across all of them rather than one instance at a time.
• Desk CLS, measured for the first time on the desk: 0.0006. The budget ratchets from 0.06 to 0.01, past its own 0.02 target.
• The desk's top margin had been collapsing out through the root element and landing on the document, which added a taskbar's height of scrollable slack below the fold. Invisible while the page scrolled anyway; the entire remaining scroll once it did not.

v0.17.02026-08-20

The resizer stops assuming one job, and every tool says when it is busy.

• The size control is preset keys plus a width you can type, and the slider now stops at the original. Half its track used to be spent on upscaling, which adds pixels and not detail; the presets only ever reduce, and each one states the box it gives you so nobody has to do the arithmetic.
• A JPG that went in came out a PNG, every time, because the encoder was hardcoded to image/png. On a photo that is usually several times heavier than what was inserted. The output format is now a choice, defaulting to the format that went in.
• A live byte readout: the original size and the encoded size, from an encode that actually ran, before you commit to the download.
• WORKING, a shared progress well, wherever a tool encodes, decodes or lays out a file. Resize, compress, convert and image-to-pdf all had a silent gap between the click and the result, and the honest failure mode of a silent tool is a second click that starts the work over.

v0.16.02026-08-20

The machine reports its own state.

• BETA label on the menu bar and on every page mast, with the tooltip "Still being built. Everything you can see here works."
• /changelog — this file, prerendered in the manual's setting.
• The About box reports the site version, the design-system version, the build SHA and live counts, all derived rather than typed.
• Every arcade machine now opens itself. Solitaire, Blocks and Pong all opened Minesweeper, because the arcade window chose the game with a two-way branch written when there were only two of them. The window a game opens is a required registry field now, so the sixth machine is a compile error rather than a silent redirect.
• PONG.EXE has an icon, and the desktop's arcade menu lists the five machines that run instead of one line saying the arcade is on the bench.
• Tooltips appear. The delegated tooltip needed a class its own stylesheet required and never got one in the port, so every hover hint on the desk has been rendering invisibly since the shell landed.
• The footer's hardcoded DESKTOP.SYS string is gone. It had been stuck at v0.2 for twelve prompts, because nothing asserted that two independently written version strings agree. Now something does, and it reads the built HTML rather than asking the component what it would render.

v0.15.02026-08-19

PONG.EXE.

• Two paddles, first to eleven, three CPU difficulties and a two-player mode on one keyboard.
• Swept collision against the paddle plane, so a fast ball cannot tunnel through a paddle between frames.
• The CPU gets a reaction line as well as a speed cap: a cap alone can't work, because over a full traverse the CPU always converges on the ball.

v0.14.02026-08-17

BLOCKS.EXE.

• Seven pieces, SRS rotation with a separate I-piece kick table, a 7-bag randomiser, hold, ghost piece and lock delay.
• One function serves both the ghost and the hard drop, so the preview cannot lie about where the piece lands.
• The T piece was drawn in ink, which on the CRT field read as a hole rather than a block on a full board. Caught by rendering, not by testing.

v0.13.02026-08-13

SOL.EXE.

• Klondike, draw one or draw three, with the card cascade on the win.
• The rules are a reducer over a move log: an illegal move returns null, so the board and the log cannot disagree, and undo is a replay of the log one move shorter.

v0.12.02026-08-13

Snake gets a real start state.

• Countdown, pause, resume and game-over as one phase machine, shared by every machine in the arcade.
• The manual gains five captioned figures, spaced off the scale rather than by eye.

v0.11.02026-08-13

Five defects a visitor hits in the first thirty seconds.

• Fixes to the desk chrome found in the 13 August design critique, plus the manual's editorial pass.

v0.10.12026-08-13

Speed, and a guard that stopped being a list.

• The messaging guard now enumerates every HTML file in dist/ instead of a list of page kinds. It had missed twice from the same cause.
• The Lighthouse gate was measuring a 1350x940 desktop with throttling disabled, because preset silently overrides emulatedFormFactor. Every number recorded before this was void.
• Latin-only font subsets, and the two above-the-fold Plex weights preloaded.

v0.10.02026-08-12

THE ARCADE opens.

• SNAKE.EXE and MINES.EXE, with the shared shell, the seeded RNG, the fixed-timestep loop and the capped bit payouts they all use.

v0.9.22026-08-11

The speed budget becomes a gate.

• Lighthouse budgets run in blocking CI and only ever ratchet down.
• Measured font fallback metrics took tool-page CLS from 0.0361 to 0.0018. The earlier round had guessed the numbers.

v0.9.12026-08-11

Deploy and chrome fixes.

• Only the canonical host may be indexed.
• The dock no longer sits on top of the system tray.
• A comment key in vercel.json had been failing the production build before it started, leaving production silently stale. CI now proves production is serving the commit it just shipped.

v0.9.02026-08-11

The registry renders the desk.

• Grid and dock membership is locked by test, so a missing icon is a compile error rather than a missing icon.
• Right-click, long-press and Properties on the desktop and on every icon.
• The system tray becomes furniture, and on a phone the dock lists open windows.

v0.8.02026-08-07

DS-1992 v0.9 chrome.

• The system bar, the taskbar, the 13-icon grid, the intake slot and the menu language, ported from the prototype.
• /machine, /arcade and /convert-to-pdf.

v0.7.02026-08-07

DS-1992 v0.7 and v0.8.

• The lit sea-teal field replaces the cream one. One typeface. Chrome dimensions read viewport-linked scale tokens at four tiers instead of literal pixels.

v0.6.12026-08-07

The file-safety law, applied backwards.

• Resize, compress and convert had trusted the browser's reported MIME type, which meant an SVG could reach a canvas. All three now sniff magic bytes.

v0.6.02026-08-06

Image to PDF, and the law it established.

• Sniff magic bytes, never trust the extension. Hard size and count caps with a plain-English message at the boundary. SVG is not an accepted input type.

v0.5.02026-08-06

Index hygiene.

• status becomes the one index gate. Roughly 45 bench stubs left the sitemap; flipping one field reverses all four levers.
• One origin literal for canonicals, og:url, JSON-LD, robots and every sitemap entry.
• /the-slot and /bits, and the first owned 1-bit plates with a CI licence gate.

v0.4.12026-08-04

Chrome and cards.

• The favicon set, a per-page OG card for every route, and an honest 404.

v0.4.02026-08-04

Four more tools on the open shelf.

• QR code generator, password generator, word counter and case converter.

v0.3.02026-08-04

Images.

• Compress an image, convert between PNG, JPG and WEBP, and a page for every format pair.

v0.2.02026-08-04

Every job gets a real page.

• The landing-page generator: routes, sitemap.xml and llms.txt all read from one registry, and every route ships as prerendered HTML with its tool on it.

v0.1.02026-08-04

The desk.

• The Windows 3.1 shell: menu bar, taskbar, draggable icons, windows with the close box at the left, and synthesized UI sound.