v1.4.0 — the screenshot corpus can be looked at, not only compared

Eighteen PRs since v1.3.0 (#429 → #451), telling one story: the screenshot corpus can be looked at, not only compared.

What earns the minor

Layer	PRs
The set viewer — /set/[label], every screenshot grouped by the story it belongs to, under its tier	#448
A sample set that ships its shots, so the deployed console has one to open	#449
A pinned filter bar over it — theme and viewport, each strip leading with auto	#450
The releases get read on the blog, not only on github.com	#429
Each release opens its own conversation	#430
/changelog says what the repository is before the first version	#435
/about points at the portfolio three times, as a link and never a redirect	#451
A post slug shape-checked before it reaches the filesystem	#438
The local console asks who a mutation came from	#436
The wand glyph pinned to the story the differ photographs	#437
A wide table scrolls itself instead of the page	#443
The four apps live on carloslima.dev, so the repo says so	#447
Two posts — the board as the part of a spec an agent cannot infer, and why GitHub bills jobs rather than wall clock	#441, #442
Dependencies, the last of them vitest 4 → 5 across every workspace	#439, #440, #444, #445

This repository has photographed its design system since 1.0.0 and offered no way to look at the photographs. You could compare two screenshot sets and read the verdict; you could not open a set and see what was in it — which is a strange gap in a repo whose subject is its own evidence. The viewer draws each shot at its own ratio and never upscales or crops it, so a 12px-tall atom reads as a shot rather than as a gap in the layout: the pixels are the evidence, and resizing them to look tidy would be editing the evidence. #449 matters more than its one line suggests — a route that only works on a checkout is a route most readers never see. And 160 screenshots across 63 stories is long enough that the tier nav scrolled away, so a reviewer checking dark contrast read the 80 they did not want in order to reach the 80 they did; #450's filters are native radios read through :has(), so the page carries 160 images and still hydrates nothing.

Ten manifests, still ten

No new workspace this cycle — the first release since 1.1.0 that adds none. The reason for lockstep is the one 1.0.0 stated and every release since has kept: nothing publishes to npm, every workspace is private, so the version is a coherence marker rather than a distribution fact. Every internal dependency is workspace:*, so pnpm-lock.yaml is unaffected and --frozen-lockfile still resolves — verified rather than assumed.

The index, measured rather than adjusted

PROJECT_INDEX.md was stamped 2026-08-31 and had drifted in both directions and by omission:

Claim	Corrected to
apps/blog 18 files / 378 tests	26 / 513 (510 passed, 3 skipped)
apps/visual-diff-ui 53 / 829	56 / 928
apps/storybook 5 / 128	5 / 131
44 acceptance scenarios	53 (EXPECTED_SCENARIOS)
158 committed baselines	160
packages/ui 26 stories	27 — which the index's own "every one storied but Stack" already implied of 28 components
build.env is two variables	four; #429 added BLOG_RELEASES_FIXTURE and GITHUB_TOKEN

The structure tree had also lost three of this release's own routes: /changelog, /set/[label], and both changelog workflows. Unchanged, and verified rather than assumed: the orchestrator's own suite (39 / 654), packages/ui (35 / 512), packages/visual-diff (10 / 327), packages/logger (2 / 20), apps/manual (6 / 69), the two-scenario local lane, 28 components in four tiers, 19 Storybook docs pages.

These corrections landed in #453, after this tag rather than with it — which is the first of the gaps below.

Known gaps

This release was cut without its index audit, and these notes were first published without their shape. The body was the release commit's message pasted whole — no thesis, no table, no corrections, no gaps — which made it the only entry on /changelog rendering as an unbroken wall, on a page whose own post says every release since 1.0.0 has the same four parts. The cause was that the standard lived only in that post and nowhere in the repository, so nothing went red when the release PR bumped ten manifests and stopped. #453 writes it down as RELEASING.md, carries the index and README refresh that belonged here, and rewrote this body.

changelog-deploy has never run green. Its BLOG_DEPLOY_HOOK_URL secret is stored empty, so publishing this tag could not ask the blog to rebuild — the one edge that puts a release on the site failed silently at the moment it was needed. The workflow anticipated a skipped build and a replayed cache, and polls the live page rather than trusting the API for exactly that reason; what it did not anticipate was an empty credential that reads as set.

Upstream and unchanged: #68 ESLint 10 is unreachable, #47 TypeScript 7 is blocked. Dependabot ignores both majors on purpose.

Full changelog: v1.3.0...v1.4.0