v11

What's Changed

• Set up test framework, add 41 tests, fix XSS + shuffle + OSCE bugs by @Eiasash in #18
• fix: cache key mismatch in HTML cleanup vs sw.js CACHE by @Eiasash in #19
• Claude/analyze test coverage han fl by @Eiasash in #20
• Claude/expand claude testing kh2wd by @Eiasash in #21
• fix: guard isExamTrap() against empty wc object, expand test coverage… by @Eiasash in #22
• audit: sanitize AI innerHTML, remove dead code, update counts, bump v9.18 by @Eiasash in #23
• hotfix: fix JS syntax error from commented-out user_id line by @Eiasash in #24
• feat: weekly audit workflow + acorn JS syntax checks by @Eiasash in #25
• docs: Update CLAUDE.md with current metrics, test coverage recs, and TODO roadmap by @Eiasash in #26
• test: add 66 expanded app logic tests for extracted monolith functions by @Eiasash in #27
• v9.42: fix study plan expansion, post-answer layout, dark mode colors by @Eiasash in #28
• fix: update package.json version, manifest question count, and CI threshold by @Eiasash in #29
• fix: deep audit — topic stats, exam scores, chat error handling by @Eiasash in #30
• fix: stop update banner from reappearing on every page load by @Eiasash in #31
• fix: tighten version sync checks and add package.json alignment by @Eiasash in #32
• fix: harden image question pipeline by @Eiasash in #33
• fix: image pipeline followup — cache trim, CI drift guard, helper by @Eiasash in #34
• fix: update-banner dismiss button broken by block-scoped DISMISS_KEY by @Eiasash in #35
• refactor: extract SW update logic into src/sw-update.js by @Eiasash in #36
• refactor: convert shell-level inline handlers to data-action delegation by @Eiasash in #37
• security: add defensive CSP directives by @Eiasash in #38
• Add Claude Code GitHub Workflow by @Eiasash in #39
• refactor: centralize repeated CI validation into shared scripts by @Eiasash in #40
• feat: add npm run verify for local pre-push confidence check by @Eiasash in #41
• refactor: extract localStorage helpers into src/storage.js by @Eiasash in #42
• feat: add GitHub OAuth login method by @Eiasash in #43
• Phase 8: regression tests for audit Phases 1–7 by @Eiasash in #44
• fix: guard against empty array access and incorrect NOTES lookup by @Eiasash in #45
• Add Claude Code automation bundle (hooks, subagents, skills) by @Eiasash in #47
• chore: enforce LF line endings for shell scripts (follow-up to #47) by @Eiasash in #48
• docs: strike false CI claims from AUTOMATION_BUNDLE.md by @Eiasash in #49
• Fix Hazzard drift check: range-aware node helper + notes.json citation fixes by @Eiasash in #50
• docs(readme): add claude-code-review.yml to CI Pipeline by @Eiasash in #51
• v9.61: 85 explanations, standardized exam-year tags, multi-select filter UI by @Eiasash in #52
• docs: test coverage analysis + improvement proposals by @Eiasash in #53
• test: add contentQuality guards (mojibake, RTL-punct, duplicates) by @Eiasash in #54
• tests: un-park tagMigration/aiAutopsyXss, fix 2 Hazzard-suppl Hebrew bugs, lock baseline by @Eiasash in #55
• hardening: ratchet Hebrew budgets + fix real boot-error XSS + harden innerHTML guard by @Eiasash in #56
• hardening: string-aware innerHTML checker + 2 blind-spot annotations by @Eiasash in #57
• hardening: per-piece innerHTML audit + fix real XSS in quizMeOnChapter by @Eiasash in #58
• UX: make confidence emoji optional + fix 'Read: Hazzard Ch X' nav by @Eiasash in #59
• UX follow-up: why-wrong optional + TOPIC_REF test + pre-push hook by @Eiasash in #60
• feat: bidirectional Hazzard/Harrison chapter linking (per question) by @Eiasash in #65
• feat: time-to-answer signals per question by @Eiasash in #66
• feat: sync indicator + metadata-rich offline export by @Eiasash in #67
• ci: autonomous distractor autopsy workflow by @Eiasash in #68
• feat: add cowork plugin for branch handoff workflow by @Eiasash in #69
• feat: always-on distractor autopsy + bulk generator by @Eiasash in #61
• feat: flashcards FSRS-4.5 + Due Today queue mode by @Eiasash in #62
• feat(geri): Israeli regulatory drill filter — 242 questions by @Eiasash in #63
• feat(geri): polypharmacy engine v2 — 114 drugs + 9 new STOPP rules by @Eiasash in #64
• cowork: add /cowork:claim + /cowork:collisions for tandem-session safety by @Eiasash in #70
• docs: prune stale TODOs from CLAUDE.md roadmap by @Eiasash in #71
• feat(geriatrics): opt-in daily notification UI by @Eiasash in #72
• Audit: fix topic indices for questions 100-125 (2022 block) by @Eiasash in #74
• docs: test-coverage analysis + improvement proposals by @Eiasash in #73
• docs: sync README and CLAUDE.md to v9.76 actual stats by @Eiasash in #75
• fix(ai): validate chapter number in quizMeOnChapter by @Eiasash in #76
• fix: dedup user questions, SW sync whitelist, typed AI errors, id-based onclick by @Eiasash in #77
• chore(ci): fix chapterLinking idempotency + restore innerHTML annotation by @Eiasash in #78
• audit-fix: unblock npm run verify + sync manifest + clean .gitignore by @Eiasash in #80
• chore: delete three leftover install-time staging artifacts by @Eiasash in #82
• feat(pwa): add 192x512 PNG icons for install prompt, keep SVG fallback by @Eiasash in #81
• chore: add Supabase MCP server config by @Eiasash in #83
• Split Geriatrics tables into geriatrics schema by @Eiasash in #84
• v10.4: atomic-save, PDF offline cache, SW stuck-version guard, RTL fi… by @Eiasash in #85

Full Changelog: Geriatrics...g2