v1.13.4

Fixed

• Camera tiles load reliably after a refresh. A tile whose video is playing
  no longer flips to "offline" (and restarts) because one snapshot check
  timed out; a tile whose stream was refused or froze is reconnected by
  itself instead of staying black under a LIVE badge until the next page
  load; and a tile that comes up offline is checked again within seconds
  instead of waiting half a minute. Cameras that are not on screen (the
  wall's hidden phone grid) are no longer checked every 30 seconds.
• Camera tiles judge the picture itself, by the stream's own count of
  decoded frames, so a frozen or black picture is caught on the wall's
  Firefox too, even for a tile scrolled out of view. A camera that answers
  but won't play shows "connecting" (or "no video" after three tries)
  instead of LIVE, and a stream go2rtc refused is reconnected in seconds.
  Coming back to the page or the Cameras tab checks the tiles at once and
  no longer restarts a video that was only paused.
• A camera tile's LIVE badge no longer flashes "connecting" over a playing
  picture, and a camera whose stream keeps reconnecting can't fake being
  live by its frame count starting over.
• A camera whose stream keeps reconnecting without ever being judged is
  treated as stuck after its start window, and a stalled stats read can no
  longer stop the wall's camera checks.
• A single reconnect on a healthy camera stream no longer counts as stuck
  (only one that keeps reconnecting does), so a working tile isn't reloaded.
• The demo wall's weekly dishes turn is always Ruby's this week, so Ava's
  card no longer switches between five and six chores every other week.

Changed

• Shared CI workflows now come from drench44/ci-shared, and comments and docs no
  longer name private repositories. The optional operator push scanner is now
  named by the PRIVACY_SCANNER environment variable, with no default path.

v1.13.3

Fixed

• The wall's pointer now hides only after a finger (or pen) tap. A mouse
  click no longer hides it, and turning the mouse wheel brings it back.
• When the ↻ button's calendar sync partly fails, the browser console now
  says it ran with an error (and whether the Google sign-in has expired)
  instead of saying it did not run.

v1.13.2

Changed

• The wall hides the mouse pointer while people tap it, and shows it again
  as soon as someone really moves a mouse. Only a browser opened once with
  ?kiosk=1 does this; phones and laptops keep their pointer. (Idea from
  dapperdodger's fork, PR #10, which hid it for good; ours keeps the mouse
  usable.)
• The wall's ↻ button now pulls the calendars (Google, ICS and iCloud)
  before it reloads, so the page that comes back is current instead of up to
  five minutes behind. It waits at most 10 seconds, reloads whatever
  happens, turns its arrow while it works, ignores extra taps, and comes back
  if the reload goes nowhere. Taps within 15 seconds of the last sync just
  reload. Behind it, POST /api/calendar/sync answers with what happened
  (synced, or not and why: demo, cooldown, busy, or an error that says when
  the Google sign-in has expired), and no two Google syncs ever run at once.
  (From dapperdodger's fork, PR #6, without its Mealie parts.)

v1.13.1

Fixed

• Editing a chore that takes turns no longer quietly changes whose turn it
  is. Changing how often it repeats (say every other Monday to every
  Monday) keeps whoever has it now.
• The chore form says in plain words when an edit keeps the turn ("Ava
  keeps this week, same as before") or moves it ("This moves this week
  from Ava to Ruby").
• When an edit changes the first day a chore comes up (say Fridays only to
  every day), the turn kept is whoever had that same day before.

v1.13.0

Added

• Chores can take turns a week at a time: one person has the chore every
  day it comes up this week, the next person has all of next week, and so
  on (pick "Take turns", then "Switch to the next person: Every week").
  The chore's row says whose week it is ("↻ Ruby's week").
• The chores page's Edit button now reads "Edit chores".
• The chore form asks plain questions ("How often?", "Who does it?"),
  shows people as colored name buttons, offers quick emoji and day presets
  (Weekdays, Weekends), and shows who does the chore on the next few days
  (or weeks) before you save, with a one-tap "who has this week". "Each of
  them" makes the same chore for several people at once.
• Chores edit mode lists every chore with what it is in plain words, so a
  chore that is not on today can still be found and edited, and has a
  "+ New chore" button at the top.
• To-dos: drag an item by its handle to another list or another place in
  its list (touch, mouse, or the arrow keys). Tap an item to rename it,
  move it to Now, Soon or Later, or delete it. A moved item lands at the
  end of its new list.

Fixed

• Scrolling the main page with a seasonal look on was slow on the wall
  (about 20 frames a second with Halloween on). The frosted glass on the
  cards no longer redraws on every scroll frame; it scrolls at a smooth 60.
• A to-do move that can't be saved puts the item straight back and says
  so, a second finger can't break a drag on the wall, and a to-do name that
  is too long says why instead of "tap again".
• The chore preview reads a one-time chore's date directly, so a date far
  in the future can't tie the hub up.
• The chore form's "Coming up" strip says why when the hub refuses the
  chore (a past date, say) instead of promising the save will work, and a
  stuck press on a to-do handle can no longer freeze the list.

v1.10.4

Fixed

• A dark band still blinked across a row of a card now and then with a look
  on (seen on the wall and on a laptop). On wide screens the cards no longer
  blur the photo live: each look ships a ready-blurred copy of its photo that
  the cards paint instead, lined up with the photo around them. The bats,
  geese and leaves behind the cards keep flying, and the wall's graphics
  chip does far less work. Phones keep the live blur.
• The little bats on the Halloween tiles in Settings hold still, so nothing
  moves under the tiles' small frosted card.

v1.10.2

Added

• Thanksgiving gains two more looks, Cranberry Harvest (a bog of floating
  cranberries seen from above) and Vine Rows (red and orange rows on an
  autumn hillside), for seven in all.

v1.10.1

Fixed

• Halloween: a black bar flickered across a row of a card now and then
  (seen on the wall and on a laptop). The far bats behind the frosted
  cards, and the spiders, now flap and walk without the sliding strip of
  frames that the frosted glass sometimes drew as a solid bar.

v1.10.0

Added

• Seasonal looks are no longer locked to their dates. Tap any look in
  Settings and it shows every day until you change it ("Pick one");
  "Calendar" goes back to changing the look with the dates.
• Thanksgiving: five harvest looks for November (a pumpkin patch, hay
  bales at sundown, a cranberry bog, corn shocks by a farmhouse and
  Jasper Cropsey's 1860 Hudson autumn), with falling leaves in each
  photo's colours, a grain mark, and a skein of birds now and then
  crossing the sky, flapping with real frames from Muybridge's 1887
  flight photographs.

Fixed

• The Wyze bridge's health check now also probes the bridge's own internal
  go2rtc. That relay can exit alone right after the container starts, and
  the bridge never relaunches it, so the Wyze cameras went dark while the
  container still reported healthy. After three failed tries the check now
  restarts the bridge, which brings the relay back.

v1.9.0

Security

• go2rtc's API is no longer published on the LAN. It has no login, and
  /api/streams and /api/config handed any device on the network every
  camera URL (often a password or token) and let it rewrite go2rtc's
  config. The hub now serves the camera player itself at /go2rtc/ and
  passes the player's WebSocket through to go2rtc for the configured
  cameras only (the video itself still comes straight from go2rtc's WebRTC
  port). data/go2rtc.yaml is mounted read-only. go2rtc's and the
  Wyze bridge's own web pages are on the server's loopback, for debugging
  over ssh.

Fixed

• go2rtc kept being killed for running out of memory. A camera snapshot
  costs go2rtc an ffmpeg, and every screen probed every camera on its own:
  now screens asking about the same camera at once share one snapshot, and
  a good one is reused for 5 seconds. go2rtc gets 768 MB with no swap (it
  died at 256 MB plus 256 MB of swap) and a Go memory target, so a runaway
  restarts in seconds instead of swapping first.
• go2rtc and the Wyze bridge have Docker health checks, and their /config
  folders are named volumes, so a docker compose down no longer leaves an
  unnamed volume behind each time.
• The Wyze bridge's web page is published on the port it really listens on
  (5080; the old mapping pointed at 5000, where nothing answers).

Added

• GET /health/full: a report of whether the hub actually works, for deploy
  gates and people. Every source the wall shows (calendar, laundry, weather,
  climate, fleet, cameras) says whether it is fresh and was read by the
  running process; the settings they need (HA_TOKEN, the Google token) and
  whether config.json is the one the deploy shipped are checked too.
  /health is unchanged (liveness only).
• /health/full names a room sensor house-climate calls stale, treats a
  data stamp from the future as an error, and turns a check that crashes
  into a named problem instead of a 500.

Changed

• Each wall refresh does less work: the calendar reads only the days it
  shows, chore streaks sort the year of history once instead of once per
  person, and the list of available integrations is worked out once per
  refresh instead of about six times.
• The Docker image installs the exact package versions in the new
  requirements.lock, runs as a non-root user (uid 1000, the same default
  as docker-compose.yml), and the web service drops all Linux
  capabilities. A new .dockerignore keeps data/, .env and the real
  config.json out of the build.

Fixed

• A database write that fails (for example "database is locked") now rolls
  back instead of leaving a transaction open, which could freeze later reads
  on an old snapshot and stop the database log from being trimmed.
• Reading the laundry cycle log no longer blocks the rest of the hub while
  it waits on the database.
• Finished to-dos are deleted 60 days after they were checked off (only
  the last 30 days can be restored), so the list no longer grows forever.
• Turning a person or chore on or off only accepts on or off (1 or 0); any
  other number is rejected instead of quietly hiding it.
• The phone screen-size report now stops reading an oversized report sent
  without a declared size, instead of reading all of it into memory.
• One camera entry in config.json that is not an object no longer breaks
  every camera tile, and a hub with no cameras no longer lets anyone probe a
  camera stream named cam.
• /health/full no longer says config.json: None for a healthy config.
• scripts/install-hooks.sh no longer bypasses the ci-policy global git
  hooks: when they are the machine's global core.hooksPath, it chains this
  repo's .githooks behind them (ci-policy.chainHooksPath) instead of
  setting core.hooksPath=.githooks, which had silently skipped them.
• A double tap on Save in the chore or person editor no longer adds the
  chore or person twice. Save waits for the first save to finish, and
  comes back if it fails.
• The wall keyboard's Done key now saves the person form too, not just the
  chore form.
• A chore tapped in the All chores view counts for the day on screen. If
  that day ended while the view was open, the tap says so and the view
  catches up, instead of ticking the chore on the wrong day.
• The full calendar and All chores views now refresh every minute while
  open and nobody is using them. Before, a wall left on either one showed
  stale events and ticks all day.
• A device that follows the house theme no longer flashes the default grey
  theme on every load before switching. It remembers the house theme and
  paints it straight away.
• The camera health check no longer downloads a full snapshot from every
  camera every 30 seconds. It checks the answer and drops the picture, and
  its time limit now covers the whole check.
• A camera whose name has a quote in it no longer breaks the camera
  health check.
• One part of the wall failing to draw no longer shows the hub as
  "offline" or stops the other parts from updating. The error is logged,
  the rest of the wall still refreshes, and the header reads "live · 1
  panel failed" (or "1 part" for something that is not a panel, like the
  backup badge) in amber until it draws again; hovering names it
  ("Calendar").
• A failed part of the wall that has no plain name yet is still counted in
  the header ("1 part failed") and named by its code name, instead of being
  left out.
• A full-screen dashboard that scales to fit now re-fits when the phone is
  turned or the window changes size, not just when it opens.
• A fast double tap on an iCloud reminder no longer ticks and unticks it
  at the same time. Taps wait until the first one is saved.
• Removed unused styles (.micro and the --p1 colour) and fixed a stale
  comment about when the wall keyboard turns on.
• Deleting an iCloud reminder from the wall now refuses anything that is not
  a reminder, so a stray id can no longer remove a calendar event from iCloud.
• When iCloud is set by environment variables, saving other credentials or
  disconnecting in settings now says so (409) instead of answering ok and
  changing nothing.
• The iCloud credentials file and the Google token.json written by
  scripts/google-auth.py are now always owner-only and written atomically.
• The wall skips completed reminders before reading them, and no longer shows
  reminders from a list that is gone from iCloud.
• The iCloud sync skips reminders that have not changed since the last sync
  instead of re-reading and re-saving every one (completed ones included)
  each time, saves each list in one go, and no longer keeps copies of
  calendar events or of the whole reminder list that nothing used.
• A reminder list deleted or unshared in iCloud is dropped once every good
  sync for a full day has found it missing (failed syncs in between start
  that day over). Wall changes still waiting for it are kept and set aside
  (and logged) instead of counting as "not yet synced" forever. If the list
  comes back they go out again, except chore reminders for days that have
  passed, which are not sent.
• The missing-list clock no longer trusts a saved time later than now (the
  list would never drop, silently) or a saved value that is not a clock
  store at all (every iCloud sync failed). Both are logged and start over.
• A wall change iCloud keeps refusing (for example on a read-only list) is set
  aside after iCloud refuses it 5 times, instead of retrying forever; failed
  tries during an outage do not count toward that. The sync status says how
  many are set aside, and settings shows how many changes iCloud would not
  take ("kept but not sent") next to the "not yet synced" count. Sending
  changes now stops after 90 seconds a round, so a slow iCloud cannot hold
  up the Google calendar sync.
• A wall change iCloud refuses no longer asks you to reconnect iCloud, and
  neither does a failed change whose web address happens to contain 401 or
  403 (a chore's number, say). The sync reads the answer's status code, not
  the words in the error.
• Picking a different Reminders list for a person now moves their chore
  reminders to it (done ones stay where they are), and a person whose list
  is gone from iCloud no longer gets reminders queued into it every day.
• Settings says when a person's iCloud chore list is gone (deleted, unshared
  or moved), even when every list is gone: the iCloud panel shows "Sam's
  iCloud chore list is gone; pick a new one", the person's editor says the
  same above the list picker (until a new list is saved), and their badge
  reads "iCloud list gone" instead of a tick. The sync status names them
  too. Before, their chores failed to reach iCloud with nothing on screen
  saying why.
• A person's gone iCloud list shows as "(list gone)" in their list picker,
  so picking "none" really clears it, even when no other lists exist.
  Before, "none" already looked chosen and picking it saved nothing.
• A calendar whose last event has moved out of the synced date range no
  longer shows "kept last-synced" for a day when it comes back empty; the
  empty-calendar guard now only holds when events inside the range vanish.
• The off-box backup copy no longer mirrors deletions: a new or empty local
  backup folder (a replaced disk, a changed FH_OUT) can no longer wipe the
  history on the NAS. The copy only adds files, and each NAS tier is pruned
  by the same keep counts as the local one.
• Backup snapshots are now single files with no -wal/-shm leftovers (some
  systems left one next to every snapshot), and leftovers from a killed run
  are swept.
• The changelog check no longer lets a code change skip its entry just by
  also bumping VERSION; only a diff limited to the files a release writes
  counts as a release. A pull request that cuts its own release still
  passes, as long as it wrote new entries into that release.
• If iCloud does not say whether a collection i...