Snapshot 2026-09-10 — visitor on-site timers read real arrivals

Snapshot of main as of 2026-09-10. Parelay is developed on a private GitLab
instance and published here as a credential-free snapshot, so this repo's
history is one commit per publish — the notes below are what changed since the
last one people could see (the 2026-07-29 snapshot).

CHANGELOG.md
carries the full record.

Fixed in this snapshot

The live monitor's "on site" time was the agent's login time. Every visitor
already on a site when an agent signed in showed the same arrival — the moment
that agent's window connected — because nothing on the wire carried an arrival
and the dashboard stamped its own clock on the first heartbeat it heard. The
widget now keeps a persisted visit clock: it spans page navigation and reloads,
and a visitor returning after five minutes away starts a fresh visit, so the
timer reads time since this arrival rather than since they were first ever
seen. It also replaces a performance.now() reading that restarted the count on
every page load. Same fix retires a quieter symptom: a backgrounded tab
heartbeats every 60s against a 25s liveness grace, which used to drop the
visitor to offline and reset their timer on the way back.

Also new since the 2026-07-29 snapshot

• Live traffic map — visitors plot as scaled dots on real OpenStreetMap
  tiles (OpenFreeMap: no key, no account, no usage cap), replacing bundled
  country outlines that could only answer "which country".
• City-level geolocation, with country as the guaranteed floor. Resolution
  moved to the server, so a visitor's IP is no longer sent to a third party
  from their own browser on page load.
• Markdown in AI replies, parsed once on the server into a closed node tree
  that both the widget and the dashboard render.
• Forgot-password flow — emailed single-use link, one hour, sha256-stored
  token — replacing "ask a super-admin".
• Agent invite and site-assignment emails, with links derived from
  PUBLIC_APP_URL rather than the request Host.
• Contact and chat deletion, who's online by site, per-provider AI
  sampling ranges, and a per-site monitor_browsing switch for sites that
  only want the chat.

Notes

Version is still 0.1.0: pre-1.0, the widget embed API (window.Parelay.*) and
the Socket.IO event contract may change between minor versions. This tag marks a
published snapshot, not a semver release.