v0.2.0
The 2026-08-16 audit filed 35 findings against v0.1.0. This release ships all 34 that could be built here.
Live mode was the worst of it. Ownership of a pick lived only in the browser, so every reload or dropped
connection emptied "Your roster" — and a pick arriving from Sleeper could never be claimed as yours at all,
which meant roster tracking, lineup needs and bye warnings were dead in the exact mode the feature exists for.
Ownership is now server state. Picks of players the board doesn't rank are counted instead of dropped; losing
them used to put the pick counter, "your pick", the survival odds and opponent attribution one behind for the
rest of the draft. A pick undone in Sleeper is now undone on the board. Snake maths follows board depth, so a
10-team league drafting 20 rounds is no longer told "no picks left" from pick 161.
Security. POST /state refuses cross-origin writes. No raw angle bracket reaches the page's inline data:
escaping only </ left <!--<script> in any dataset string able to render a blank board. A javascript:
source URL no longer executes on click.
On a phone, best available, your roster and the managers picking before you sat roughly 15,000 px below
the top of the board. They now lead the page.
Accessibility. Secondary text — notes, tier ranges, rank numbers, every card heading — ran between 3.4:1
and 4.4:1. The lowest ratio on the board is now 4.7:1, in both themes, guarded by a test. The toast keeps Undo
on screen at 390 px, waits while you're reading it, and takes focus when the cross-off came from the keyboard.
Also: a Theme toggle (the light palette was unreachable without changing your OS setting); a superflex board
now plans and prices with two QB slots instead of claiming "QB Single"; validate reports malformed datasets
instead of raising tracebacks; name search ignores punctuation, so "jamarr" finds Ja'Marr Chase; and repainting
the board is no longer quadratic.
Full detail in CHANGELOG.md.
Verified: 282 tests, ruff clean, Chromium and Firefox, wheel installed from a clean venv, and refresh /
variant / tiers run against the live public APIs.