v1.9.2: Acceptance hardening and release hygiene (2026-08-03)

Added

• The generated archive-coverage contract now reports source/revision, basin and year ranges, measured records/storms/frames/advisories/marks, distribution profiles, and final/inferred/operational/stale/closed/unavailable statuses for all 15 bundled datasets; About, offline diagnostics, STAC summaries, and research-export provenance consume the same facts.
• Copy-ready APA and BibTeX release citations now appear on every analytical side panel and About surface, travel with research and storm exports, and are emitted by the starter notebook from the same HURDAT2 revision/hash contract; shared URLs now pin the full release-manifest SHA-256.
• Bundled data metadata now carries a lifecycle status for each source; the retired NOAA NCEI Billion-Dollar Disasters series is explicitly closed at 2024, validates against that end date, and renders closed-series copy separately from an unavailable feed.
• Hand-maintained seasonal outlook and ENSO snapshots now carry issue/validity windows, with a 45-day in-season freshness warning, hard expiry gate, and visible validity dates plus a current NOAA CPC link in the stats card.
• The primary document now denies form submissions in its meta CSP; the Cloudflare Worker and bundled self-hosting server add the response CSP with same-origin framing protection.
• Evacuation guidance now discloses Esri address transmission, offers a coordinate-only Florida path, probes the pinned Florida layer before querying it, labels outage/invalid-response fallback, and records official source links for North Carolina, South Carolina, Georgia, Texas, Virginia, Maryland, and Massachusetts.
• The no-build startup path now preloads every declared CSS layer, both local fonts, and the static boot module graph; the bundle audit enforces a two-wave first-paint request budget and high-priority main/data hints.
• The service worker now registers as a module with cache-bypass updates, derives its application shell from the main.js import graph, and serializes install/validation/repair handshakes with a Web Lock.
• Storm track playback can now be rendered and downloaded as a self-contained WebM with selectable frame rate and duration, storm dates, category legend, and NOAA attribution; unsupported browsers receive an explicit availability explanation.
• Storm panels now include a keyboard-openable, localized textual track timeline with hazard milestones ordered first, complete chronological observations on demand, and polite playback time announcements for screen readers.
• Online archived radar fallback now uses IEM's zoomable, cache-stable XYZ tiles with explicit 404/503 miss handling; bundled radar frames and offline packs remain full local PNGs.
• The colour-blind palette now remaps archived PNGs and online IEM radar tiles to a Cividis reflectivity ramp, with a matching dBZ legend and playback coverage.
• The mobile header action rail now exposes clipped controls with a visible edge cue and keyboard Home/End/arrow scrolling, while preserving full focus reachability at 390 px.
• iPhone and iPad Safari users now get an intent-triggered, localized offline-install guide from Storage; it explains Share → Add to Home Screen, returns focus on dismissal, and stays hidden in standalone mode.
• The STAC catalog is now discoverable from the HTML entry point, validated in core/full distributions, and retained in the required offline data pack.
• README now keeps current-release highlights and sends older release history to the changelog; the quality plan now reflects shipped modularization and visual-regression work.
• Dead translation keys and an unused logo generator are gone; the source-tree distribution descriptor no longer pretends to have a commit, Inter is the primary UI font, IEM radar tiles use the bounded tile cache, and Ctrl+M now reaches the filter module without a window global while Cmd+M remains available to macOS.
• Visual regression now reports and skips non-Windows runs instead of creating false OS-specific baseline failures; the Docker Python base is digest-pinned, and the documented local server supplies no-cache and security headers.
• Playwright acceptance now routes a service-worker-owned IEM tile through the browser context, snapshots storm/settings/advisory-replay ARIA trees in English, Spanish, and Haitian Creole, and stores the 16 Windows visual baselines as lossless WebP.
• Storm panels now show on-demand OpenFEMA disaster-declaration context grouped by declaration, state, and designated area, with incident-date/title matching, official record links, memory caching, and explicit no-match or unavailable states.
• Build tooling now uses Playwright 1.62.1 and esbuild 0.28.2, and the optional Cesium globe is refreshed to 1.144 with verified SRI and a renewed review window.
• Optional feeds now share localized loading, empty, stale-last-good, offline, rate-limit, malformed, timeout, and retry presenters with request cancellation guards across active, map-layer, panel, glossary, seasonal, radar, tide, wind, FEMA, and population surfaces.
• Localized accessibility coverage now exercises desktop and mobile filters, search, statistics, comparison, tables, preparedness, evacuation, spatial search, on-this-date, storm/replay, globe fallback, action-rail focus, reduced motion, and forced colors with deterministic feed and clock fixtures.
• The static STAC publication now uses the stable 1.1.0 core contract, declares the file extension on every catalog document, and validates source-tree/core/full relative-link navigation against synchronized release metadata.

Fixed

• The npm dependency graph now resolves the fast-uri high-severity advisory to patched release 3.1.5, with a regenerated lockfile-bound audit snapshot.
• The checked-in AOML detailed continental-U.S. landfall table now provides a build-time ground-truth artifact and reports a 16/16 (100.0% precision, 100.0% recall) hurricane-strength match for 1983-1990; inferred tropical-storm candidates remain separately scoped, and HURDAT2 C closest-approach records cannot be promoted to inferred landfalls.
• The offline core now installs only runtime data; raw Atlantic/Eastern Pacific HURDAT2 text and the full release manifest are an integrity-checked, user-initiated source bundle capped at 13 MB, with storage diagnostics and distribution metadata reporting the optional payload separately.
• Offline launches now classify the shell/data tuple as intact, evicted, stale-but-valid, or invalid and offer an explicit repair action; each storm panel reports its cached radar-frame coverage.
• High-contrast defaults now follow prefers-contrast: more until a local choice is made, and Windows forced-colors receives system-colored map controls, legends, panels, and focus rings with browser axe coverage.
• The components stylesheet now follows the declared cascade without !important; desktop trend tables, mobile playback targets, reduced-motion settings, and light/dark operational surfaces retain their tested behavior through normal layer-specific rules.
• Closest-approach and city return-period queries now measure the great-circle track segments between HURDAT2 fixes, interpolate the location and intensity at the true closest point, and cover the Miami, Cape Hatteras, New York, and segment-only regression cases.
• The Cloudflare Worker now permits same-origin geolocation while continuing to deny microphone and camera access, and its policy test locks the complete security-header contract.
• Leaflet’s disputed upstream advisory is now represented as a permanent, cited security decision with check:popup-sinks as its compensating control; the Playwright smoke injects a poisoned advisory fixture and verifies it stays inert text.
• The linked self-hosting, Cloudflare, GOES, quality-plan, and licensing documents are now publishable GitHub files, with a build gate ensuring every relative README link resolves to a tracked target.
• All browser data and optional-feed requests now share finite, per-feed AbortSignal.timeout() budgets, including radar probes and the module worker, with a static guard against reintroducing bare fetch() calls.
• The i18n contract now verifies that each supported locale updates the document language metadata used by screen readers.
• The browser accessibility smoke now scans the main view, settings, and storm panel independently in English, Spanish, and Haitian Creole.
• The saved-view file picker now has an explicit localized label, keeping the expanded settings surface axe-clean.
• The application now exposes a focusable <main> landmark for skip-link navigation, and the accessibility smoke includes axe best-practice rules.
• The dynamic timeline now stays inside the main landmark and exposes its localized region name.