v0.9.3 — accuracy pass

CI on main had been red for sixteen consecutive runs across six days, and 0.9.0, 0.9.1 and 0.9.2 were all published on top of it — so all three shipped two real WCAG 1.4.4/1.4.10 failures as product defects. The a11y gate had in fact never passed on CI once: it landed in a batch with 27 other commits, so its first run was already red.

The bug was one line, and platform-specific

Updated rendered item.updated_at as a bare ISO timestamp with no break-all, while every other value in that card had one. A 24-char token with no break opportunity set a 236px floor that min-w-0 could not shrink. On macOS that measures 301px and passes a 320px viewport; on Linux font metrics it is ~325px — exactly the {"s":325,"c":320} in every failing run, and why it never reproduced locally.

Four gates for things nothing was checking

• release-preflight (prepublishOnly) — refuses to publish unless the tree is clean, the commit is pushed and tagged, and ci.yml passed on that exact sha. Fails closed.
• docs-facts-gate — re-derives the widget size, tool count, HTTP routes, registry items and open-on-LAN endpoints from the code.
• link-gate — the previous link check had been green since the day it was added while scanning zero links.
• init-gate — now covers the seam between the two canonical sources.

Two bugs found by driving the CLI

--version printed nothing and hung — it was not a known flag, so it started a stdio server and waited on stdin, after opening the user's real database. And a whitespace-only title cleared min(3) because three spaces are three characters.

Also

Adds CONTRIBUTING.md, SECURITY.md and issue/PR templates; fixes a mangled README paragraph that was live on GitHub and npm; corrects a widget size quoted four different ways; and backfills the v0.9.0–v0.9.2 tags.

Canary sweep is 30, and every new gate is canaried in the direction that matters.

Full detail: CHANGELOG.md

v0.9.2

Ships the init fix to adopters — 0.9.1 still wrote a git-clone MCP config, so the source being correct changed nothing until this release. Published 2026-08-02. Tagged and released retroactively.

See CHANGELOG.md.

v0.9.1

MCP Registry identity (mcpName + server.json). Published to npm 2026-08-01; listed on the MCP Registry 2026-08-02. Tagged and released retroactively.

See CHANGELOG.md.

v0.9.0

First publish to npm (2026-07-27). Tagged and released retroactively during the 0.9.3 accuracy pass — tag discipline had lapsed exactly when public publishing began.

See CHANGELOG.md for the full entry.