v2.2.0

Hatchdoor v2.2.0 is a major release. It introduces write mode (full note editing from the web UI and through MCP tools), then hardens the backend after a complete robustness and client edge-case audit, adds a read-only demo mode, and ships a public-ready distribution.

✍️ Write Mode (new)

Hatchdoor is no longer read-only. You can now create and modify vault content from the web app and let agents do the same over MCP.

• Inline note editor with live preview, drafts, and a contained mobile editing experience.
• Note management dialogs: create, rename, move, archive, and delete notes.
• Conflict review: concurrent edits are detected and surfaced for review instead of silently clobbering.
• Write API: new backend note write endpoints backing the editor.
• MCP write tools: create, edit, append, replace-section, move, rename, archive, and trash notes, plus attachment import, all vault-safe and exposed to agents.
• Image uploads normalized to WebP (respecting the encoded image type).
• Markdown quality warnings reported on write.
• Renamed notes return their new slugs over MCP so callers stay in sync.

🔒 Security & Hardening

Following a full backend robustness audit:

• MCP now requires a bearer token whenever it is enabled, so there is no unauthenticated tool access.
• The server refuses to start unauthenticated on a public bind.
• Access tokens are redacted from request trace spans.

🛡️ Reliability & Data Safety

• Git sync: recovers from an interrupted merge before syncing, runs fetch/push outside the vault write-lock, commits the whole working tree each sync, and retries transient failures on a backoff.
• Cache: self-heals notes after a per-note embedding failure, recovers a poisoned writer mutex instead of wedging, rebuilds the vector index when the embedder model changes, and rebuilds a half-initialised schema instead of bricking startup.
• Vault writes: rename-first, all-or-nothing asset moves on delete; fsync of the temp file and parent dir in atomic writes; rollback of multi-file rewrites when one fails; safer trash-collision handling.
• MCP protocol: negotiates the version instead of exact-match lockout, and reports "note not found" as a proper tool error on write tools.
• HTTP: raises the attachment body limit to the configured max and preserves JSON rejection status codes.

🖥️ Frontend Fixes

• The service worker no longer auto-reloads mid-edit and destroys unsaved changes.
• The image normalizer now applies EXIF orientation instead of re-encoding blindly.
• The graph page no longer redraws at 60fps with per-frame O(n log n) work.
• Read failures now surface the server's error body.

✨ Other Features

• Read-only demo mode for safe public deployments.
• Starter docs seeded automatically for empty vaults.

🧱 Refactors & Internals

• Split oversized backend modules per the architecture audit.
• Extracted App hooks, regrouped frontend modules, and split the graph simulation.
• Fixed the sqlite_vec extern-fn transmute to use c_char instead of i8.

📦 Docs & Packaging

• README overhaul: screenshots, live demo link, table of contents, and agent-native / MCP-first framing.
• Docker: qualified base-image references, rootless/distroless image and Podman support documented, Docker Hub surfaced, and starter-vault seed docs bundled into the image.

---

Full changelog: v2.1.1...v2.2.0