v1.5.0 — the console works from a phone on a bad connection

Fifteen PRs since v1.4.0 (#453 → #467), telling one story: the console works from a phone on a bad connection, and says more before you open anything.

What earns the minor

Layer	PRs
Every browser request from the console gives up after 30 seconds, so a stalled confirm says so instead of spinning, and a stalled poll no longer stops the job log for good	#465
A report row carries its bucket chips, and each chip opens the report already filtered to that bucket	#466
A set that repeats an older set's sha is marked same sha, so a second capture of one commit reads as a repeat rather than as a change	#467
The manual puts its way in above the prose, and gains a five-step tour that links into the console instead of photographing it	#458, #459
The published Storybook counts its readers, the fourth surface to do so	#457
Links between the five surfaces say where they came from	#461
PROJECT_INDEX.md is held to the repository by a gate, and the release standard is written down as RELEASING.md	#453, #454
The dialog story stops photographing the browser's own button	#460
The Sandcastle judgment roles run on Opus 5.5 at medium effort	#462
Dependencies, among them mermaid 11 → 12 and dotenv 17 → 18	#455, #456, #463, #464

The three console PRs came from using it where it had never been used. Opened on a phone over a VPN from a train, the console hung on the first dropped packet. fetch has no timeout of its own, so a delete neither landed nor failed, and the job poller, which schedules its next poll only once the current one returns, stopped for good on a single stalled request. Thirty seconds is generous on purpose: a limit tight enough to be felt on a good connection would fail requests that were only slow. The chips and the badge answer the same reader. A phone makes every opened report a round trip, so the dashboard now says what each comparison found and which sets are the same commit twice.

#464 is a dependency bump that would have broken every local build. dotenv 18 ships its own dotenv command, and it replaced dotenv-cli's under the same name. Every root script that wraps turbo then exited 1 with dotenv's usage message. CI stayed green, because its jobs call pnpm turbo run directly and never go through those scripts. The PR moved the scripts to dotenv run -q --override -- and removed dotenv-cli before it merged.

Eleven manifests, not ten

packages/links is new this cycle. #461 added it to hold tagOutbound and the list of sources it tags a link with, so the eleven manifests move together. Nothing publishes to npm and every workspace is private, so the version is a coherence marker rather than a distribution fact. Every internal dependency is workspace:*, and pnpm install --frozen-lockfile resolves with pnpm-lock.yaml untouched, verified rather than assumed.

The index, measured rather than adjusted

PROJECT_INDEX.md was stamped 2026-09-14. Every count was measured again with the turbo cache forced off:

Claim	Corrected to
Orchestrator suite 39 files / 654 tests	39 / 656
apps/visual-diff-ui 56 / 928	56 / 938
next ^16.3.2 / react ^19.2.8, "blog and storybook"	^16.3.5 / ^19.3.0, used by the console and the manual too
turbo ^2.10.11	^2.11.2
No mention of dotenv	dotenv 18, whose own CLI wraps every root turbo script

The console's entry in the structure tree and README's status row also lacked this release's three console changes, and now describe them. Unchanged, and measured: packages/ui 35 / 512, apps/blog 26 / 514 (511 passed, 3 skipped), packages/visual-diff 10 / 327, apps/storybook 6 / 186, packages/logger 2 / 20, apps/manual 7 / 92, packages/links 1 / 10, 53 acceptance scenarios and the two-scenario local lane, 160 committed baselines, 28 components in four tiers, 27 stories and 19 docs pages.

Known gaps

The changelog is showing its unavailable note. changelog-check failed on 2026-09-26: the deployed /changelog says the releases could not be loaded when the page was built. changelog-deploy has still never run green, so publishing this release cannot count on the blog rebuilding to show it. The build-time fetch, or the credential it uses, is the fault to find next.

The board and the code disagree on one chip. Board 04 draws changed in the danger tone, and the console draws it in the accent tone. This predates this release, and #466 followed the board rather than choosing between them.

Jobs from another device go through a proxy outside this repository. The console's localhost guard is unchanged and still refuses a job whose Host is not loopback. Running jobs from a phone on the LAN or a VPN works through a small proxy on the machine that runs the console, which this repository does not ship.

Upstream and unchanged: #68 ESLint 10 is unreachable, and #47 TypeScript 7 is blocked. Dependabot ignores both majors on purpose.

Full changelog: v1.4.0...v1.5.0