v1.58.0

1.58.0 (2026-10-12)

⚠ BREAKING CHANGES

• QR helpers renderQrToCanvas and createQrDataUrl move from client/lib/slide-runtime/poll.js to client/lib/util/qr.js. The unused getOrCreateVoterId and mountPollBars exports are removed. The safeSlug export in server/utils/slug.js is removed; use generateSlug from shared/slug.js with fallback presentation where needed. Fork callers must update imports.

Fixed

• a share-link guest comments through a route under the token (B179) (#1584) (c5c9f68)
• AI session logs are one instance setting, off in the test suite (B661) (#1580) (70b56fb)
• auth: the session token uses the signed-payload seam (B288) (#1582) (838aa89)
• owner_email is normalised on write, read sites compare bare (B392) (#1586) (806c1dd)
• phase 2 accepts a slide type exactly where it is offered (B663) (#1588) (8411b95)
• respect theme heading transform on chart titles (#1596) (ee0e672)
• share slug rules and refuse invalid publish renames (#1595) (db06b00)
• show the complete selected image in inspector previews (#1597) (5d19de9)
• the client branches on error codes, refusals are inline (B674) (#1589) (0488bd2)
• the schema funnel runs every step, a stamp skips nothing (B239) (#1583) (93ab9bc)
• the settings page and sidebar read one tab register (B679) (#1591) (92362c2)
• the weekly digest sends again and is opt-in (B662) (#1587) (400dffb)
• unify AI request parameters and imported image placeholders (#1594) (4216ff1)
• unify remaining HTTP error envelopes (#1593) (8554ff5)
• use one slide-type offer for MCP and one-shot AI (#1592) (5b61e99)

Changed

• announce removed fork helper imports before release (fddef11)