Game data is unchanged from 0.12.26 (Homecoming 2026.1.1242, last client re-export 2026-07-07) and the optimizer's model stays at v36, so every certified champion carries the same score. This release is the guided tour, a security hardening, and a better user guide.
A guided tour of the whole app. New here, or never sure what a button does? A compass button in the header opens a chooser: pick one section or take the complete tour (56 steps across 7 sections). The tour walks a drawn example screen, a Brute damage build with every panel filled in, laid out exactly like the real app, so any part of it works at any time and nothing about your own work is ever touched. Every card highlights the control it explains in tour green, clicks that open something (the enhancement picker, the power details, the targets editor, the What-changed window, the Journey, the bug report) actually open it on the example screen, and small controls get annotated drawings. You advance with Next, the arrow keys, or the space bar; stray clicks do nothing; every card offers "Save my spot & exit" and the compass offers to resume right there. Every power card also carries its own ? that jumps straight to the card explained. A fresh install offers the tour once; after that it waits behind the compass and the ? beside each section.
Security: another website can no longer make the app do things. 0.12.28 stopped other sites reading from the app. This closes the other half: a page in another tab could still send the app an instruction your browser would faithfully deliver, such as telling it to close, even though that page never saw a reply. The app now refuses anything that changes something unless the request came from its own page. Nothing about normal use changes, and the tools and Companion Lite that talk to it are unaffected.
The user guide grew. The Hero/Villain section now explains that switching sides also switches which accolades are assumed and recalculates your totals (it was described as pure style, which was wrong), and new "Locking a power" and "Reading the Numbers" sections cover the padlock and how to read the bars.
Both downloads are code-signed (CN=Joel Andrew Chambers). The tour engine is driver.js 1.8.0 (MIT), vendored and credited in CREDITS.md.