0.9.0

New

• Post / surface vocabulary — a published artifact is now a post (an ordered list of surfaces). New /api/posts, /p/:id routes and publish_post / update_post / list_posts MCP tools join the legacy ones; all old routes, tools, and keys remain as deprecated aliases.
• Open-as-image — each surface footer gains an action to open it as a PNG (/s/:id.png), live on Workers deployments.
• sideshow --version — prints the installed version and checks npm for updates.
• Sidebar empty-state slot — ss:aside-empty is now host-overridable; shows a "Connect an agent" nudge when empty.

Fixes

• Data dir moved to ~/.sideshow/ — fixes EACCES under sudo npm i -g and data loss on upgrade; one-time migration from the old package-relative location.
• SQLite parent-dir guard — first-run crash when the db paths parent directory doesnt exist.
• Submit-time validation — rejects diffs and mermaid diagrams that wont render.
• Connection cap — held SSE / long-poll connections bounded per workspace (default 32).
• Mobile viewer — improved layout for phone-sized screens.

Breaking (embedders)

• identity.accountSlug → identity.workspaceSlug on the injected host contract.