v1.1.3 — DEEMO 1 Artwork Archive

Maintenance release of the DEEMO 1 artwork archive. The archived files are the same as in v1.1.2. The github-pages environment now accepts deployments only from tags from v1.1.2 on, and most of the remaining minor findings of the v1.1.2 reviews are fixed.

Browse: searchable gallery · slideshow

Archive contents

• data/ and assets/ are byte-identical to v1.1.2.
• No fetcher was run for this release.

Deployment

• Environment rule: the github-pages environment accepts deployments only from tags from v1.1.2 on (owner decision of 2026-10-13). A run takes the Pages workflow from its tag's commit, and v1.1.2 is the first tag whose workflow has every current check, so a run on v1.1.1 or an older tag is refused at the environment. Before this release, a re-run of the deploy job alone of a v1.1.1 run could still deploy v1.1.1 again.
• Re-run check: the job that fails a re-run without the guard job now runs only if the run was not cancelled, so cancelling such a re-run leaves it cancelled without its error.
• Unchanged: publishing a Release still deploys its tag's commit after the full test workflow passes on it; every run still checks that its tag has a published Release that is not a prerelease; a re-run without the guard job still deploys nothing. Pushes and pull requests never deploy.

Checks

• Tests: the documentation-wording tests and the expression evaluator have their own modules, tests/test_pages_docs.py and tests/test_pages_expressions.py. More samples pin the wording checks for retired deployment rules, and a few accurate sentences they refused before are now allowed.

Known gaps

• Weekly source check: its pull-request write path has not yet run against a live change.
• Documentation checks: some paraphrases of retired wording are not caught; a few accurate sentences are still refused, and the tests name those and say how to rephrase them.

Rights

The software is licensed under Apache-2.0 (see LICENSE and NOTICE). The original gallery design is by Mashiro (mashirozx/deemo). Song artwork and other game assets remain © Rayark Inc. and their respective creators; the software license grants no rights to these media. See the license and attribution index.

---

简体中文： DEEMO 1 曲绘档案的维护版本，存档文件与 v1.1.2 完全相同。

• 部署： github-pages 环境现在只接受 v1.1.2 及之后的标签（所有者 2026-10-13 的决定）。运行使用标签所指提交中的工作流，而 v1.1.2 是第一个具备全部现有检查的标签，因此 v1.1.1 及更早标签上的运行会被环境拒绝；在此之前，只重新运行 v1.1.1 某次运行的部署任务仍可能把 v1.1.1 再次部署。Re-run check 任务（让不包括 Release guard 任务的重新运行失败）现在只在运行未被取消时运行，因此取消这样的重新运行后不会再出现它的错误。
• 检查： 文档措辞测试和表达式求值器各有自己的模块；更多样例固定了对已废弃部署规则措辞的检查，个别以前被误拒的准确句子现在可以通过。
• 已知缺口： 每周来源检查的 PR 写入路径尚未在真实变更上运行过；文档检查对部分改写措辞仍无法识别，个别准确句子仍会被拒绝（测试中已注明并给出改写方式）。

曲绘及游戏素材的权利仍属于 Rayark Inc. 与对应创作者。

v1.1.2 — DEEMO 1 Artwork Archive

Maintenance release of the DEEMO 1 artwork archive. The archived files are the same as in v1.1.1. This release closes the low-severity findings of the v1.1.1 pre-release review: a re-run of part of the Pages workflow can no longer deploy, and the source check refuses one more spelling of a dot segment.

Browse: searchable gallery · slideshow

Archive contents

• data/ and assets/ are byte-identical to v1.1.1.
• No fetcher was run for this release.

Deployment

• Re-runs: the guard job now records the run's attempt next to the commit it approved, and the deploy job runs only when that record is from the current attempt. A re-run that leaves out the guard job deploys nothing; this includes a re-run of the deploy job alone and "Re-run failed jobs" after the test, build or deploy job failed. Such a re-run now fails in a new last job, "Re-run check", with an error that says the attempt did not run the guard job, deployed nothing, and that all jobs must be re-run. Re-run the whole run instead. No permission was added; the new job has none.
• Runs on v1.1.1: a run takes the Pages workflow from its tag's commit. The github-pages environment still accepts v1.1.1, whose workflow does not check the attempt, so re-run a run on v1.1.1 whole too. Runs on tags before v1.1.1 stay refused at the environment.
• Unchanged: publishing a Release still deploys its tag's commit after the full test workflow passes on it, and every run still checks that its tag has a published Release that is not a prerelease. Pushes and pull requests never deploy.

Fetchers and checks

• Source check: an IIS-style %u escape of half a UTF-16 surrogate pair, or a lone surrogate written directly, now makes a path piece undecodable, so the path is refused. Before, such a piece could hide a .. segment. A valid pair is read as one character. None of the committed download URLs is affected.
• Archive fetcher redirects: the test that checks the evidence of each reviewed cross-host redirect (CROSS_HOST_REDIRECTS) now also accepts a cited row that records the redirect as redirected_off_site, as the reachability check writes it. The list is still empty.
• Tests: the guard-step tests have their own module, tests/test_pages_guards.py, and the fetcher tests share their loopback helpers. Further tests keep retired deployment wording out of the READMEs and the workflow, and pin the surrogate and redirect rules.

Known gaps

• Weekly source check: its pull-request write path has not yet run against a live change.
• Documentation checks: some paraphrases of retired wording are not caught, and some parts of the new wording checks are not pinned by a sample. They concern documentation checks only.

Rights

The software is licensed under Apache-2.0 (see LICENSE and NOTICE). The original gallery design is by Mashiro (mashirozx/deemo). Song artwork and other game assets remain © Rayark Inc. and their respective creators; the software license grants no rights to these media. See the license and attribution index.

---

简体中文： DEEMO 1 曲绘档案的维护版本，存档文件与 v1.1.1 完全相同。本版本修复 v1.1.1 发布前代码审查中的低严重度问题。

• 部署：
  • Release guard 任务现在会把本次运行的尝试（attempt）和它批准的提交一起记录下来，部署任务只在该记录属于当前这次尝试时运行。不包括 Release guard 任务的重新运行不会部署任何内容，例如只重新运行部署任务，或在测试、构建或部署任务失败后选择"Re-run failed jobs"。这样的重新运行现在会在新增的最后一个任务"Re-run check"中以错误失败，说明这次尝试没有运行 Release guard 任务、没有部署任何内容、应重新运行所有任务。没有新增任何权限，新任务也没有任何权限。
  • 运行使用标签所指提交中的工作流。github-pages 环境仍接受 v1.1.1，而它的工作流不检查尝试记录，因此在 v1.1.1 上的运行也应整次重新运行。v1.1.1 之前的标签仍会被环境拒绝。
  • 不变的部分：发布 Release 仍会在完整测试通过后部署该标签所指的提交，每次运行仍会检查该标签有已发布、非预发布的 Release；推送和 PR 永远不会部署。
• 来源检查： IIS 风格的 %u 转义如果只写了 UTF-16 代理对的一半，或直接出现单独的代理字符，这一段路径就视为无法解码，整条路径会被拒绝；以前这种路径段可能藏住一个 ..。合法的代理对按一个字符读取。已提交的下载地址不受影响。
• 归档抓取脚本： 核对跨主机重定向证据的测试现在也接受记为 redirected_off_site 的引用行；该列表仍为空。
• 已知缺口： 每周来源检查的 PR 写入路径尚未在真实变更上运行过；文档检查对部分改写措辞仍无法识别。

曲绘及游戏素材的权利仍属于 Rayark Inc. 与对应创作者。

v1.1.1 — DEEMO 1 Artwork Archive

Maintenance release of the DEEMO 1 artwork archive. The archived files are the same as in v1.1.0. This release tightens the deployment checks and the redirect rules of the fetchers, and closes the remaining minor findings of the independent review.

Browse: searchable gallery · slideshow

Archive contents

• data/ and assets/ are byte-identical to v1.1.0.
• No fetcher was run for this release. The fetcher changes below apply to future runs.

Deployment

• Release check: every run of the Pages workflow now checks that its tag has a published GitHub Release that is not a prerelease. The guard job, and again the build job, each make one read-only request to the GitHub API for it. This applies to a run started by a Release, to a manual run and to a re-run. The run is refused on any other answer: no Release, a draft, a prerelease, a Release of another tag, an error or an unreadable answer.
  • A re-run keeps the event of the run it repeats, so a release's run that is re-run after its Release became a draft or a prerelease, or was deleted, is refused. A re-run of the deploy job alone repeats no Release lookup, so re-run the whole run.
  • A run takes the workflow from its tag's commit. A run on a tag before v1.1.1 would use that tag's own workflow, which does not make this check; the github-pages environment refuses its deployment (see below).
• Tag form: a vX.Y.Z tag has three numbers without leading zeros. v1.10.0 is accepted; v1.02.0 and v01.1.0 are refused.
• Prerelease flag: the deploy job's own condition now also refuses a release event without a prerelease flag, as the guard and build jobs already did.
• Approved commit: the deploy job runs only for the commit that the guard job approved.
• Tag ruleset and environment: a repository ruleset, "Release tags v*", lets only repository admins create, move or delete v* tags. The github-pages environment now accepts deployments only from tags from v1.1.1 on, and no longer from main. A run takes the Pages workflow from its tag's commit, so the two keep anyone but an admin from deploying through the github-pages environment with a workflow of their own.
• Unchanged: publishing a Release still deploys its tag's commit after the full test workflow passes on it. Pushes and pull requests never deploy.

Fetchers and checks

• Archive fetcher redirects: a reachability check of a catalogued page follows a redirect only over https to the page's own host or its www. sibling (the host without its leading www., or with www. added when it has none).
  • A redirect to another host is followed only along an entry of a reviewed list, CROSS_HOST_REDIRECTS. No committed row was redirected to another host, so the list is empty.
  • A page on an IP address follows no redirect, and no redirect to an IP address is followed.
  • Any other redirect is not requested and is recorded as redirected_off_site.
  • This replaces the registrable-domain rule of v1.1.0.
• Redirect bodies: no request reads the body of a redirect any more. Before, requests read that body in full, even for a redirect it did not follow; in the wiki fetcher that read bypassed its 64 MiB response limit.
• Unreadable redirects: a redirect whose Location is not UTF-8 is now refused with the fetcher's own error, which names that Location, and nothing more is requested.
  • In the archive fetcher's reachability checks, that page is now recorded as request_failed. In v1.1.0 the error ended the whole catalog step, which was then recorded as an unexpected failure.
  • Elsewhere it was already recorded as a failed request, only with a bare UTF-8 decoding error.
  • In the wiki fetcher's discovery and DeemoSongs requests it still stops the run with an error, like any other refused request.
• Redirect targets: a Location is read the way requests reads it before it is resolved.
• Source check: a path is also refused when a piece becomes . or .. after Unicode normalization, after invisible format characters are removed, after an IIS-style %u escape is decoded, or after trailing dots and spaces are trimmed. None of the committed download URLs is affected.
• Tests: further tests pin the deployment guard, the redirect rules and the wiki fetcher's response handling.

Known gaps

• Weekly source check: its pull-request write path has not yet run against a live change.
• Pre-release review: its low-severity findings are left for v1.1.2. Among them, a re-run of the deploy job alone repeats no Release lookup; re-run the whole run instead.

Rights

The software is licensed under Apache-2.0 (see LICENSE and NOTICE). The original gallery design is by Mashiro (mashirozx/deemo). Song artwork and other game assets remain © Rayark Inc. and their respective creators; the software license grants no rights to these media. See the license and attribution index.

---

简体中文： DEEMO 1 曲绘档案的维护版本，存档文件与 v1.1.0 完全相同。

• 部署：
  • 每次运行（由 Release 触发、手动运行或重新运行）都会检查该标签是否有已发布、非预发布的 GitHub Release：检查任务和构建任务各向 GitHub API 发出一次只读请求，其他任何结果都会拒绝运行。只重新运行部署任务时不会再次查询 Release，因此应重新运行整次运行。
  • 运行使用标签所指提交中的工作流，v1.1.1 之前的标签不做这项检查；github-pages 环境现在只接受 v1.1.1 及之后的标签（不再接受 main），会拒绝这类运行的部署。
  • 标签的三个数字不能有前导零（v1.10.0 可以，v1.02.0 不行）。
  • 部署任务自身的条件现在也拒绝缺少预发布标记的 Release 事件（此前已由检查任务和构建任务拒绝）；部署任务只部署检查任务批准的提交。
  • 仓库规则集 "Release tags v*" 只允许仓库管理员创建、移动或删除 v* 标签。
• 抓取脚本：
  • 目录页面的可达性检查只跟随到页面自身主机（或加上、去掉 www.）的 https 重定向，或经审核列表中的跨主机重定向（该列表目前为空）；不跟随与 IP 地址有关的重定向。
  • 任何请求都不再读取重定向响应的正文（以前 requests 会完整读取该正文；在 wiki 抓取脚本中不受其 64 MiB 上限约束）。
  • 非 UTF-8 的重定向地址现在以抓取脚本自己的错误拒绝，并写明该地址；归档脚本的可达性检查只把该页面记为 request_failed，不再中断整个目录步骤；其他请求此前已记为失败。
  • 来源检查拒绝更多 ./.. 路径段的写法。
• 已知缺口： 每周来源检查的 PR 写入路径尚未在真实变更上运行过；发布前代码审查的低严重度问题留到 v1.1.2（例如只重新运行部署任务时不会再次查询 Release，应重新运行整次运行）。

曲绘及游戏素材的权利仍属于 Rayark Inc. 与对应创作者。

v1.1.0 — DEEMO 1 Artwork Archive

Maintenance release of the DEEMO 1 artwork archive. The archived files are the same as in v1.0.0. This release changes how the site is deployed, hardens the fetchers and adds a pinned code-quality toolchain. It also fixes the findings of an independent code review.

Browse: searchable gallery · slideshow

Archive contents

• data/ and assets/ are byte-identical to v1.0.0: the same 1,109 public source files and 320 inherited game textures, with the same provenance records.
• No fetcher was run for this release. The fetcher changes below apply to future runs.

Deployment

• What deploys: the site now deploys only a vX.Y.Z tag whose commit is on main.
  • Publishing a GitHub Release for such a tag, not marked as a prerelease, deploys it.
  • A manual run of the Pages workflow on such a tag also deploys its commit, without checking that the tag has a Release. Use it only to redeploy a released tag.
• Pushes: pushes to main are tested but no longer deploy.
• Refused before anything is built:
  • a branch;
  • a tag of another form, such as v1.1 or v1.1.0-rc1;
  • a prerelease;
  • a tag whose commit is not on main.
• Tests first: the full test workflow, lint included, must pass on the tagged commit in the same run before the site is staged.

Website

• Slideshow:
  • Without JavaScript, the page shows a notice in English and Chinese that links to the archive page, instead of a blank page.
  • The caption links its source only to an http(s) page.
  • An invalid CSS declaration that browsers ignored was removed. Nothing looks different.
• Language switch: ?lang= stays in sync on an address that has only a fragment, such as index.html#screenshot.
• Archive viewer:
  • An arrow key pressed with a modifier is left to the browser (Alt+Left is Back).
  • Holding an arrow key turns one image only.

Fetchers and checks

• Wiki fetcher:
  • Images are downloaded only over https from each wiki's own image path. Every redirect is checked, and each download is capped at 64 MiB.
  • The weekly source check applies the same rule to a proposed snapshot, and it now also reports metadata changes.
  • A MediaWiki list that keeps continuing now fails discovery instead of looping without end. This covers more than 1,000 continuation requests, and a repeated or malformed continuation.
  • Image-metadata (imageinfo) continuations are followed.
  • Images are written atomically.
  • A re-verified record takes the current credit and notes.
• Artist fetcher:
  • Current records win the download-URL cache.
  • A superseded version is reinstated when its canonical record is dropped.
  • A malformed Tumblr post fails on its own.
• Archive fetcher:
  • Decodes every image completely, on download and on --verify.
  • Its reachability checks of catalogued pages follow a redirect only over https and only within the page's registrable domain. Any other redirect is not requested and is recorded as redirected_off_site.
• Catalog build:
  • Accepts only lowercase hex SHA-256 values.
  • --verify fails on any tracked file under assets/ outside public/, legacy/, thumbs/ and site/.
• Pages size budget: checked on every push and pull request.

Code quality

• Pinned tools:
  • ruff for lint and format, with line length 120.
  • mypy for the build and publication scripts.
  • ESLint, check-only, for the JavaScript and CSS files in src/. Vendored code and the slideshow page's inline script are not linted.
  • actionlint and the pre-commit whitespace hooks.
• CI lint job: runs every hook on every file. It excludes generated files, data/, assets/, vendored code and byte-pinned files.
• Coverage: coverage.py measures scripts/ in CI. Coverage went from 83.9% to 89.2%, and the run fails below 89%.
• Lint and type findings: ruff went from 21 to 0 and mypy from 27 to 0.
• Reformat: Python files were reformatted once, mechanically. That commit is listed in .git-blame-ignore-revs.

Independent review

• Scope: an independent line-level review covered the fetchers, the build and publication scripts, the website and the tests. A separate verifier checked each finding.
• Findings: the first round raised 41 findings. The verifiers confirmed 4 as major and 35 as minor.
• Major fixes: every confirmed major finding was fixed with a regression test that fails without the fix. Another reviewer then verified each fix.
• Other items: later rounds fixed most of the other items. The ones still open are the known gaps below.

Known gaps

• Registrable domain: chosen with a fixed list of second-level labels, not the Public Suffix List.
• Weekly source check: its pull-request write path has not yet run against a live change.

Rights

The software is licensed under Apache-2.0 (see LICENSE and NOTICE). The original gallery design is by Mashiro (mashirozx/deemo). Song artwork and other game assets remain © Rayark Inc. and their respective creators; the software license grants no rights to these media. See the license and attribution index.

---

简体中文： DEEMO 1 曲绘档案的维护版本，存档文件与 v1.0.0 完全相同。

• 部署：
  • 网站只部署提交位于 main 上的 vX.Y.Z 标签：为该标签发布正式（非预发布）的 GitHub Release 即会部署。
  • 在该标签上手动运行工作流也会部署，但不检查是否有 Release，因此只用于重新部署已发布的标签。
  • 推送到 main 只运行测试，不再部署。
• 网站：
  • 未启用 JavaScript 时，幻灯片显示提示；
  • 说明中的来源链接只接受 http(s) 页面；
  • 修复了仅含片段的地址上 ?lang= 不同步的问题，以及查看器的按键问题。
• 抓取脚本： 加入了主机、重定向和大小限制，并修复了数据完整性问题。
• 代码质量：
  • 新增固定版本的 ruff、mypy、ESLint 和 pre-commit，并加入 CI lint 任务；
  • 覆盖率由 83.9% 提升到 89.2%。
• 独立审查： 已确认的主要问题均已修复并附回归测试；其余问题中，除上面列出的已知缺口外均已处理。

曲绘及游戏素材的权利仍属于 Rayark Inc. 与对应创作者。

v1.0.0 — DEEMO 1 Artwork Archive

First release of the DEEMO 1 artwork archive: a searchable gallery and a slideshow of public DEEMO 1 song artwork, with a provenance record for every file.

Browse: searchable gallery · slideshow

What is in the archive

• 1,109 public source files, each with its source page, download URL, SHA-256 and retrieval status:
  • 86 artist uploads;
  • 809 wiki images (Fandom 561, BWIKI 248);
  • 189 historical Tumblr covers;
  • 19 OST packaging scans;
  • 4 official website illustrations;
  • 2 official reference PDFs.
• 320 inherited game textures from the original gallery, plus their 320 palette-quantized copies (offered as paired downloads).
• 1,411 gallery images after byte-identical files are shown once. Different versions of the same song are counted separately.
• All original bytes are kept as downloaded. Only the archive grid uses derived WebP previews; the viewer and downloads serve the originals.

Highlights of this release

• Licensing and attribution:
  • MIT texts for the bundled html2canvas, punycode and Pace.
  • A provenance table for every inherited site file.
  • Two commercially licensed fonts are no longer redistributed.
  • Attribution links point to NOTICE.
• Data integrity:
  • Refetches never drop verified records or overwrite archived files.
  • The build fails on missing inputs or unreferenced files.
  • Five BWIKI UI sprites that had been imported as collection covers were removed.
• Archive page:
  • Search ignores browser locale, full-width input and kana differences.
  • The interface appears in the chosen language before the catalog finishes loading.
  • The viewer locks page scrolling and shows provenance caveats and composers.
  • Grid previews cut the first screen from about 39 MB to under 1 MB of images.
• Slideshow:
  • Every control is a named, keyboard-operable button, and ArrowLeft/ArrowRight turn slides.
  • The screenshot overlay no longer depends on the URL.
  • Phone layouts are fixed.
  • Slides label reposts and scans and credit composers.
• CI:
  • Every pull request and push runs the offline test suite and a browser smoke test, and Pages deploys only after both pass.
  • The weekly wiki source check runs third-party code with read-only permissions and manages only this repository's snapshot pull request.

Changes: #5, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15.

Rights

The software is licensed under Apache-2.0 (see LICENSE and NOTICE). The original gallery design is by Mashiro (mashirozx/deemo). Song artwork and other game assets remain © Rayark Inc. and their respective creators; the software license grants no rights to these media. See the license and attribution index.

---

简体中文： DEEMO 1 曲绘档案的首个正式版本：可搜索图库与幻灯片，每个文件都附有来源记录（1,109 个公开来源文件 + 320 张原仓库纹理）。本版本补齐了第三方许可与署名，不再分发两款商业字体，修复了数据完整性、档案页与幻灯片的无障碍和移动端问题，并为每个 PR 和推送加入测试门禁。曲绘及游戏素材的权利仍属于 Rayark Inc. 与对应创作者。