v0.3.0

Highlights

• Production basemap fix (#118): GitHub Pages' CDN gzips binary assets and range-slices the compressed body, which broke the vector basemap for first-load / no-service-worker visitors. The PMTiles archive now ships as data/basemap.pmtiles.png (CDN-gzip-exempt), with a runtime preflight + in-memory fallback so future CDN policy changes degrade gracefully instead of breaking the map.
• GPX import (#3): import a GPX file to prefill origin/destination/via waypoints.
• Seamarks / AtoN overlay (#7): 1,794 curated aids-to-navigation with IALA glyphs and light characteristics (default off, ODbL-attributed).
• Ownship position marker (#25): GPS marker usable in any map context, decoupled from Live View (default off).
• Solver fix (#67): visited stamps no longer seal pruned cells at the frontier cap.
• UAT environment (#96/#106/#107/#108): develop auto-deploys to /uat/ as a separately-installable, noindexed preview PWA with an in-app badge; production bundle verified byte-identical.
• Deploy hardening (#117, partial): every deploy now ends with a CDN smoke probe (identity-encoded Range 206 + PMTiles magic) — transport regressions redden the deploy run instead of reaching users silently.

Full details in release PR #122.

v0.2.0 — UI modernization

v0.2.0 — UI/UX modernization

The app's planner and results views have been rebuilt to a modern, state-of-the-art standard (#64), plus branch-protection/CI policy documentation.

✨ UI modernization (#64)

• New component system — Card / Field / Button / Chip / Disclosure primitives on the --sc-* design tokens; planner regrouped into a single "Reise" card.
• Searchable harbor picker — the harbor mega-list is now a WAI-ARIA combobox ("Hafen suchen") with prefix-before-substring ranking, recently-used harbors first, and each harbor's depth caveat inline. Selecting an endpoint collapses it to a tidy row with "Ändern".
• Ergebnis results card — a clean stat grid (arrival · distance · duration · avg speed), a faster-rig recommendation (Genua ★ / Fock), a sail/motor split bar, an advanced-options disclosure, and the legs table tucked inside a disclosure.
• Refined states & motion — dedicated empty / loading / error states, with motion that respects prefers-reduced-motion.

🛡️ Project process

• Branch-protection & code-review policy documented in SECURITY.md (#71).
• protect-main ruleset documented — one ruleset covering main and develop via literal refs (#73).

Notes

• No changes to routing, data, or offline behavior. Wind grids remain stored per saved plan; navigability is still decided at query time by safety depth.
• Verified via a local production-bundle walkthrough (0 console errors, responsive to 390 px) and full CI (app + e2e).

Live: https://docgerd.github.io/sail_command/

v0.1.2 — public readiness: CodeQL, Dependabot, hardened CI, Scorecard

Public-readiness release — the repository now carries the security, supply-chain, and documentation posture expected of a public project. No changes to the deployed app's runtime behavior; the PWA you install is the same as v0.1.1 plus dev-dependency bumps.

Five issues closed through four reviewed, CI-gated PRs (#55, #56, #57, #61) plus a repo-settings close-out (#16), with a clean cross-PR final review.

Security & supply chain

• CodeQL code scanning (#12): JavaScript/TypeScript + Python analysis on every push/PR to main and weekly — first scans came back with zero alerts (PR #56).
• Dependabot (#13): weekly grouped version updates for app npm, pipeline npm, pipeline pip, and GitHub Actions; security updates land immediately and ungrouped. Deliberate pins are guarded (TypeScript fully; majors of fast-check/vitest/Playwright/React/workbox held back for manual migration) (PR #57).
• Private vulnerability reporting enabled, with a SECURITY.md that documents scope and the reporting channel (PR #55).
• Full-history secrets scan (gitleaks): clean. GitHub secret scanning + push protection active.

CI hardening (#14, PR #61)

• Least-privilege permissions: in every workflow; elevation only where the deploy job needs it.
• Every action pinned to a full commit SHA (Dependabot keeps the pins fresh).
• Concurrency groups cancel superseded PR runs; pushes to main always run to completion.
• New mask-integrity job: verify_mask.py flood-fill-checks the committed navigation mask whenever pipeline/** or app/public/data/** change.
• OpenSSF Scorecard runs weekly and on main pushes, publishing results; badges (CI · CodeQL · Scorecard) now head the README.

Documentation (#10, PR #55)

• README: screenshots (start view, planned route), an architecture sketch (build-time pipeline → committed static assets → PWA with the isochrone router in a Web Worker), and the test-timeout policy.
• New CONTRIBUTING.md (ground rules: protected main, no backend, offline first, not a navigation device) and SECURITY.md.
• Repo metadata: topics, homepage, description aligned with the live app.

Dependencies

• vite 8.1.4 → 8.1.5 (dev, PR #59)
• @types/node 24.13.3 → 26.1.1 (dev, PR #60)

Live app: https://docgerd.github.io/sail_command/ — SailCommand is a passage-planning aid, not a navigation device.

v0.1.1 — wide-screen layout, DocGerdSoft identity, robust installs, map data layers

Post-release hardening and feature wave over v0.1.0 — seven PRs (#30, #32, #34, #40, #41, #42, #43), all merged through the full review pipeline (per-PR reviewer rounds, multi-lens self-review, every inline thread resolved, CI-gated).

New

• Wide-screen side panel (#24): at ≥ 1024 px the planner becomes a ~1/3-width left column with the map at full height beside it; phones/cockpit portrait keep the bottom sheet unchanged.
• DocGerdSoft corporate identity: "Datum → Waterline" mark (sail over hull, waterline gap), chart-navy #10243D, azure accent, theme-aware banner tokens with dark-mode variants, About tagline (de/en), README banner, og:/twitter: social card. All 14 WCAG contrast pairs verified ≥ 4.5:1.
• Harbor markers on the map (#38): the 33 curated harbors render always (localized labels), click-to-pick fills origin/destination with the curated snap point.
• Water-depths overlay (#39): user-toggleable bathymetry raster rendered client-side from the committed mask — absolute depth only; the safety-depth setting never changes the display.

Fixed / hardened

• First install shrunk from 791 precache entries (~44 MB) to 24 (~33 MB) (#28): font glyphs moved to a runtime cache with an idle background warm-up — slow-connection first visits no longer risk the browser killing the install. Retired glyph caches are cleaned on activate.
• One-shot recovery for the pre-service-worker window (#27): basemap failures from GitHub Pages' broken gzip Range responses now recover automatically (single guarded reload on first SW control).
• Map attribution no longer overlaps the planner sheet on phones (#33): starts collapsed (one tap expands it) at every viewport width.
• Armed pick + harbor click now always takes the curated snap — a React scheduling race let the raw tap coordinate win; caught pre-merge by a review-mandated regression test and fixed by construction (harbor hits are gated out of the generic tap).
• Branch protection (#15): protect-main ruleset — PR-only merges, required app + e2e checks (strict up-to-date), no force pushes.

Licensing & attribution (#11 — complete)

• Correction to the v0.1.0 notes: the project is Apache-2.0 (LICENSE landed shortly after v0.1.0; the "no license yet — all rights reserved" caveat in those notes is obsolete).
• The shipped Noto Sans glyphs now carry their SIL OFL 1.1 text; basemap sprites carry their MIT notice (and are correctly attributed to tangrams/icons, © 2017 Mapzen — previously mislabeled BSD-3).
• THIRD-PARTY-NOTICES.txt (generated, CI-drift-guarded) ships with the site for all bundled dependencies.
• Map-corner attribution now links OSM, Protomaps, EMODnet, and Open-Meteo per each licence's requirements; the land/depth mask is declared an ODbL Derivative Database.

Known limits (unchanged from v0.1.0 unless noted)

• Passage-planning aid, not a navigation device; official charts remain authoritative.
• Polars are a VPP-style estimate (ORC 2026 certificate, corrected to white sails).
• Full offline font coverage converges via background warm-up after install (total eventual download ~45 MB).
• Flensburg→Marstal routes only at safety depth ≤ 2.3 m (data behavior, documented).

🤖 Generated with Claude Code

SailCommand 0.1.0 — MVP

First release of SailCommand — an offline-capable PWA that plans time-optimal sailing routes for a Salona 45 in the Flensburg Fjord / Danish South Sea area (54.3–55.3°N, 9.4–11.0°E), using hourly Open-Meteo wind forecasts and an isochrone router that prices tacks/gybes as time penalties.

Live: https://docgerd.github.io/sail_command/

⚠️ SailCommand is a passage-planning aid, not a navigation device. It has no chart authority — always navigate with official charts and publications.

Highlights

• Isochrone router over a real land/depth mask (~100 m cells) with query-time safety depth (default 3.0 m, boat draft 2.1 m) — changing safety depth never requires regenerating data
• Runs twice per plan (main+genoa, main+fock) and recommends the faster rig; both results visible
• Motor legs are first-class: planned below the sailing-speed threshold (default 2.5 kn) at motor speed (default 6.5 kn), always flagged
• Tack/gybe minimization emerges from a maneuver time penalty (default 45 s) inside the cost function — no post-hoc route surgery
• Wind grids are stored with each plan (IndexedDB): a saved route always renders against the forecast it was computed from
• Curated harbor list with pilotage notes, de/en i18n, full offline operation after first load (service-worker precache incl. PMTiles basemap with Range/206 support)

Things to know

• ~44 MB first load — the offline precache includes the regional basemap, land/depth mask, and polars. Wi-Fi recommended for the first visit.
• Polar tables are VPP estimates for a Salona 45 (main+genoa / main+fock), not measured performance.
• Planning requires network (Open-Meteo, called directly from the browser); everything else works offline.
• Deploys are gated by the build only until #15 lands required status checks.
• No LICENSE yet (#11) — all rights reserved until a license is chosen.

Known limits

• Some harbors are excluded from routing by the mask connectivity gate (#9: Arnis, Kappeln, Maasholm, Dyvig, Gråsten); Flensburg→Marstal routes only at safety depth ≤ 2.3 m (correct data behavior, documented).
• Language is applied at load; switching updates the UI but document metadata follows on next load.
• First visit on a warm GitHub-Pages edge can show a broken basemap until the service worker takes over (#27, self-heals); on slow connections the first offline-cache install may need a second visit to complete (#28).
• Currents/waves (#18) and multi-day trips (#19) are future features.