v1.6.0 — Stable baseline

[1.6.0] - 2026-09-10

The "stable baseline" release completes v1's fork-consolidation arc: the
retained product now has deterministic browser and PostgreSQL gates, a shared
resilient AI-insight lifecycle, measured cold-route boundaries, a generated
public API contract, and a verified fresh-install path before v2 begins building
cross-market intelligence.

Added

• Disposable clean-install verification — CI now builds the application with
  the locked Node 22 frontend and Python 3.11 runtime, migrates and boots a fresh
  PostgreSQL/pgvector plus Redis Compose project, checks health, SPA, Swagger,
  OpenAPI, and fresh-database authentication, then destroys only its
  CI-namespaced volumes. Docker build context exclusions keep local databases and
  caches out of images, while blank template credentials preserve honest no-key
  first boot. The newly exercised deep-health endpoint now reports Redis and
  SQLite cache-tier readiness instead of failing on a missing cache method.
• Generated API contract — a complete checked-in OpenAPI document and human
  endpoint/family matrix now cover every backend operation, including effective
  bearer middleware, API-key permission, unauthenticated, and audited product
  state metadata. Runtime /docs exposes the same accurate authentication
  boundary, the schema-generator dependencies are pinned, and CI rejects
  generated-reference drift.
• Disposable PostgreSQL CI contract — a separate pgvector/PostgreSQL 16 job
  now migrates a fresh openterminalui_ci database, closes the migration gap for
  owner-scoped portfolios, notes, and API keys, and exercises portfolio plus
  external-note ingestion contracts. Normal pytest remains
  forcibly isolated on SQLite; PostgreSQL tests require GitHub Actions, an
  explicit localhost opt-in, and _ci/_test database and user names,
  preventing accidental use of the deployment database.
• Cancellable AI insight lifecycle — market, risk, portfolio, screener, and
  backtest insight cards now use a shared NDJSON progress contract with explicit
  cancellation and stable non-streaming fallback. Browser cancellation stops the
  server-side provider task rather than leaving inference running. Compatible
  providers now stream structured-response tokens through that lifecycle, giving
  the card real response-arrival progress while withholding sections until the
  complete result passes schema validation. Unsupported, interrupted, empty, or
  invalid streams fall back within the same bounded lifecycle.

Changed

• Node 24 GitHub Actions runtime — CI action majors now use their maintained
  Node 24 implementations, removing the runner's forced compatibility override;
  the application image remains on the separately versioned Node 22 LTS baseline.
• Faster initial terminal load — the decorative Three.js background now
  loads after the document and browser idle boundary instead of blocking the
  first route, and stays disabled for reduced-motion or data-saver users. The
  measured production entry plus router payload falls from about 219.4 KiB to
  93.2 KiB gzip while preserving the immediate CSS terminal background. News
  now draws its small sentiment trend with accessible SVG, and Screener defers
  its optional chart workspace, removing the 134.8 KiB gzip Recharts dependency
  from both cold default routes. Backtesting now waits for a completed result
  before loading its chart, heatmap, mosaic, and 3D analytics modules, removing
  about 433.4 KiB gzip from the pre-run route path in the measured production
  build while preserving the complete result workspace.
• Validated AI results and typed degradation — shared insight output is
  published only when it satisfies the section schema, with one bounded repair;
  disabled, unavailable, timed-out, invalid, and provider-error states are typed
  and rendered with actionable card copy. The server owns the generation deadline.
• Deterministic browser-test foundation — consolidated Playwright on one
  root configuration, seeded a stable test identity, isolated each run's SQLite
  state, classified the retained legacy journeys, and restored a focused
  Chromium login plus authenticated shell/navigation smoke set to regular CI.
  Backtesting now also has a provider-free submit/poll/result smoke journey that
  verifies the production lazy result workspace with deterministic analytics.

Fixed

• Automation API-key listing — map the persisted key_prefix field to the
  public prefix response contract so Settings can retrieve created keys without
  a FastAPI response-validation failure; full key secrets remain creation-only.

[1.5.0] - 2026-09-07