v2.2.1

TickTune 2.2.1 — dependencies

Three packages in the shipped bundle moved: Astro 7.4.7, music-metadata
12.3.5 and i18next 26.7.2. No source file changed.

Around them:

• Playwright 1.65.0, with the visual image moved to
  playwright:v1.65.0-noble by digest. That image has no corepack, so the
  visual job installs the pnpm that packageManager names.
• @lhci/cli 0.16.0, on Lighthouse 13. Four of the five dev-tree overrides
  left pnpm-workspace.yaml, and extract-zip left the tree, which closes its
  two high advisories. The whole-tree audit went from four to two, the two
  with no patched release.
• Tailwind 4.3.5, Vitest 5.1.0, Wrangler 4.158.0 and the rest of the
  weekly group; pnpm/action-setup 6.1.1 and sonarqube-scan-action 8.4.1.

Not taken: i18next 27, a major inside its seven-day cooldown, and
TypeScript 7, which svelte-check and typescript-eslint still refuse.

Dependabot's PR 119 for the same bumps was red because of its lockfile,
not the code; the bumps were redone by hand in PR 120.

The live checklist ran on PR 120's preview before the merge:
tests/manual/v2.2.1-live-checklist.md, docs/16 "v2.2.1".

v2.2.0

TickTune v2.2.0 — accessibility

An accessibility statement, and the barriers writing it found.

New

• ACCESSIBILITY.md: what is built in, what has been tested, what is known not
  to work, and how to report a barrier — the new "Accessibility barrier" issue
  form, or accessibility@poli0981.dev. The target is WCAG 2.2 AA; it is a
  target, not a claim.
• The single-key shortcuts (M, F, H, S, ]) can be switched off in Settings →
  Keyboard shortcuts — for speech input, or keys pressed by accident. Space,
  the arrows and Esc keep working.
• A screen reader can read the time remaining at any moment, in words. It is
  still announced only at 10, 5 and 1 minutes, 10 seconds and zero.
• The landing's looping demo has a "Stop the demo video" control.
• Windows Contrast themes: selected keys, tabs, switches and sliders now show
  their state in your theme's colours, and the landing's readouts no longer
  read "88:88".

Fixes

• Space on a focused button now presses that button. During a run it used to
  pause the music instead.
• Focus is no longer lost when the bottom bar fades or when time is up.
• The bottom bar's controls stay available to screen readers after it fades.
• A YouTube video that cannot play is announced once, not every second.
• The Setup source tabs move with the arrow keys; sliders say their unit; the
  reason "Match length" is unavailable reaches screen readers; the drop zone
  shows a focus ring; the drag handle is easier to hit.
• A desktop browser zoomed in when the page loads is told how to get in,
  instead of being told it is a phone.

v2.1.1

TickTune v2.1.1 — the tag parser

A maintenance release. Nothing you do in the app changes; the library
that reads your files is one patch newer.

What changed for you

• Tag reading (music-metadata 12.3.3). It fixes how some MP3 tags are
  read: ID3v2 tags whose unsynchronisation or extended header had been
  handled by the wrong rule. It also finds the length of an MP3 with
  no header more reliably, and fixes FLAC, MP4 and WebM/Opus handling.
  Titles, artists, cover art and lengths all come from it, and so does
  the 10:02 limit.

Checked before this tag

• On the preview, through the shipped bundle: the Vietnamese tag
  fixtures (ID3v2.3 UTF-16, ID3v2.4 UTF-8, MP4, Vorbis) read exactly,
  ID3v1 still falls back to the file name, the cover decodes, and the
  11-minute file is refused. A run played with a clean console.

Under the hood

• knip 6.44.1, for the unused-code check. It is not part of the site.

Full notes: docs/16-ROADMAP.md, "v2.1.1 — the tag parser".

v2.1.0

TickTune v2.1.0 — playlists, a countdown that follows the queue, Legal 2.1

The owner's five, in one release.

New

• YouTube playlists: choose "Playlists" above the paste box and paste up to
  ten playlist links. Their videos join the YouTube queue in playlist order,
  inside the same 50-link limit, and are checked like pasted links. Mixes and
  personal lists (Liked, Watch later) cannot be read, and the app says so.
• A countdown set with "Match length" now follows the queue while Repeat is
  off. Remove a track and the countdown loses what it had left to play: all
  of it if it was still ahead, the rest of it if it was playing. With Repeat
  on, the countdown keeps its length and the queue loops inside it. Typing a
  time or picking a preset makes the countdown yours again.
• The Legal Gate has a way out. "Decline and go back" returns you to where
  you came from, a new tab's own page included. With nowhere to go back to,
  it closes the tab or opens a blank page — browsers do not let a website
  open their home page.

Legal 2.1 — everyone is asked to agree once more

• TickTune was built with Claude Code by Anthropic: Claude Opus 4.8 for
  0.2–1.0, Claude Opus 5.5 since 1.1, under the developer's review. The
  Disclaimer's new §7 says so, and that the app sends nothing to any AI.
• The Privacy Policy now says what it should have said: a request for an
  address that does not exist reaches our server and is logged for 7 days,
  headers included. Real pages still never are.
• Playlist IDs go to the YouTube Data API from our server, and what a
  playlist holds is kept for up to an hour.

Fixes

• A YouTube "videoseries" embed link is no longer mistaken for a video.

Under the hood

• Node 26 LTS everywhere. The Sonar scan runs its action's own scanner. One
  dependency override is retired. Dependabot's group update is in.

v2.0.4

v2.0.4 — YouTube's own ⏯ drives the run

A pause or play made inside the YouTube player — its own controls, its
keyboard shortcuts, the OS media keys — now pauses and resumes the whole
run: the countdown, ON AIR and the finish notice follow it. Until now only
the transport's icon did, so a pause in the player stopped the music and
left the countdown running.

A state the app did not ask for counts once it has held 300 ms, so a
seek's passing pause, the player's echo of our own commands and a video's
end never do — the real player's sequences were measured first. Nothing
is sent back to the player, and each toggle is logged TT-YT-009.

Checked on the preview with real YouTube: a pause and a play in the frame
stop and start the countdown, a seek and a video's natural end leave it
running, and the app's own ⏯ still means what it shows.

docs/16 has the review; tests/manual/v2.0.4-live-checklist.md the live
run. Merged as #103 and released from this signed tag.

v2.0.3

TickTune v2.0.3 — the API rate limit

A maintenance release for the server side. Nothing you do in the app
changes, unless you send YouTube lookups faster than a person can.

Why

• The site's documentation had promised a limit of 60 requests a
  minute per address on its YouTube lookups since the first YouTube
  release. Measured on 2026-10-27, it was never switched on: 75 rapid
  calls to the live site all went through. The link-length lookup had
  its own limit; the title lookup had none.

What changed for you

• Nothing in normal use. Pasting 50 links makes 51 lookups, one at a
  time, and fits inside the limit. Past it, a link is kept and marked
  "Could not check — will retry when you start", as before.

Under the hood

• Every /api/ request now spends from a per-address budget of 60 a
  minute, kept in Cloudflare's memory for that minute and never
  logged. It is declared in wrangler.jsonc as a Workers rate limit, so
  it holds on every host the Worker serves.
• The pages themselves are not limited, on purpose: Cloudflare serves
  them before the Worker runs, free and unmetered, and putting the
  Worker in front would log every page view.
• The Privacy Policy's rate-limit line now names the title lookup as
  well. It is the same count, kept the same way, so you are not asked
  to accept the documents again.

Full notes: docs/16-ROADMAP.md, "v2.0.3 — the rate limit that was never there".

---

Measured after release (2026-10-27). On the live site the Worker's per-address budget is best-effort only: Cloudflare's machines in one location do not share its counts quickly enough, and in our tests it refused nothing — 300 calls in 73 seconds from one address all went through. What does enforce is a Cloudflare zone rule added the same day: 60 requests per 10 seconds per address on /api/, blocked for 10 seconds. The numbers are in docs/10-CLOUDFLARE-SETUP.md §6.

v2.0.2

TickTune v2.0.2 — dependencies

A maintenance release. Nothing you do in the app changes; the libraries
under it are current again.

Why

• The weekly security audit failed on 2026-10-26: a component Astro
  uses while building the site (undici, under its font resolver) had a
  high-severity advisory. It runs at build time and was never part of
  the page your browser loads, but the audit counts it, and the fix is
  a plain update.

What changed for you

• Tag reading (music-metadata 12.3.0), settings storage (Dexie 4.4.7),
  the translations engine (i18next 26.5.10) and the Svelte integration
  are each a patch or minor release newer.

Under the hood

• Every patch and minor update that was out, Vitest 5 and TypeScript
  6 for the test and type tooling, and two pinned overrides inside the
  development-only toolchain where upstream has not shipped a fix yet.
• The production dependency audit is clean. One advisory pair remains
  in Lighthouse CI's development-only tree (extract-zip), which has no
  release to move to and whose code that setup never runs.

Full notes: docs/16-ROADMAP.md, "v2.0.2 — dependencies".

v2.0.1

TickTune v2.0.1 — three live defects

Three defects reported from the console on v2.0.0, the day it shipped.

Fixes

• Settings opens again after an import that skipped files. Two skipped
  files logged in the same millisecond gave the diagnostics list two
  identical keys, and the panel threw instead of opening.
• The automatic dimming over a background picture works, and so does
  the cover-art tint. Both read the picture by fetching it, which the
  site's own security policy refuses for local files — so since v0.7.0
  neither had ever run in production. They now read it as an image; the
  policy is unchanged, and a picture that cannot be read is logged.
• Local files and YouTube links no longer mix. Switching between
  Playlist and YouTube used to keep one shared list: links pasted after
  a switch joined the files, and Start could play a file on the YouTube
  player in silence. Each source now keeps its own list, and switching
  back finds the other one as it was left — including files that were
  still importing when you switched.

Under the hood

• The CSP check now acts in the browser — picks a picture, stages a
  cover — under the real policy, instead of only loading pages.
• An empty YouTube tab says to paste a link (English, Vietnamese,
  Japanese).

Full notes: docs/16-ROADMAP.md, "v2.0.1 — three live defects".

v2.0.0

TickTune v2.0.0 — every post-1.1 direction

The whole post-1.1 backlog in one release. Three spikes decided three
features before any of their code was written: the crossfade (S4b) and
the finish notification (S5) shipped; loudness normalization (S6) did not.

New

• Crossfade: local tracks fade into each other over 0–5 s (2 s by
  default, 0 for a straight cut), and a single track can loop by fading
  into itself. Skips and pauses now ramp instead of cutting, so they no
  longer click.
• A finish notification (opt in, Settings → Countdown): the countdown's
  own worker shows a system notification at zero while the tab is in the
  background. Generic text, never a track name; nothing is pushed or sent
  anywhere.
• YouTube link lengths, from the YouTube Data API through this site's
  server, which sends Google only the video IDs — so "Match queue length"
  now works for links.
• Installable, and it starts offline: /app/ installs as an app and, once
  visited, opens without a network. Local files play as ever; YouTube
  needs a connection.
• Settings as a file: export them, import them on another machine.
• A light "LCD" theme for the app, and a 14-segment clock face beside the
  7-segment one.
• Japanese: the app, the landing page and the 404.
• Legal 2.0: the terms and the privacy policy cover all of the above, and
  the EULA names the law of Viet Nam. Everyone is asked to agree once more.

Fixes

• YouTube: the player is no longer asked for its time, video or volume
  before it is ready (the console errors after Start), and a track opened
  before then is the one that plays.
• Files whose headers carry no length — a VBR MP3 without a Xing header,
  raw AAC — get their exact length at import, so the 10:02 limit and the
  crossfade judge them correctly.
• The visualizer's canvas is capped at 1440p's pixel count, so a large
  screen drawing without a GPU keeps its frame rate.
• The legal pages no longer shift as their fonts arrive.

Under the hood

• Lighthouse CI, visual regression in a pinned Playwright image and a
  render-cost probe run on every pull request.
• The spike harnesses are no longer built into production.
• img-src no longer allows i.ytimg.com — measured unused.
• The October dependency updates; the vulnerable versions inside the
  dev-only @lhci/cli are overridden.

Full notes: docs/16-ROADMAP.md, "v2.0 — every post-1.1 direction".

v1.1.1

TickTune v1.1.1 — two live defects

The first step of the v2.0 plan, released on its own because both defects
were live on production.

Fixes

• A forward change of the system clock no longer strands a visible countdown
  at 0.000. The timer worker keeps its own copy of the deadline, and a
  re-anchored deadline never reached it; now it does, and a safety net
  re-sends it if the worker ever reports zero early.
• A track that has played keeps its cover art. Moving through a playlist used
  to revoke the previous track's cover along with its audio, so its info
  panel, the setup preview and the cover background showed a broken image.
• Pasting YouTube links: a duplicate no longer takes one of the free slots of
  the 50-link limit.
• The language button's accessible name now starts with the code it shows
  (WCAG 2.5.3, label in name).

Under the hood

• The object-URL leak canary in the debug panel finally reports live, with the
  end-to-end spec that docs/13 always described.
• music-metadata 12.2.0; happy-dom 21 and prettier-plugin-astro 1.1.1 (dev).
• CI also builds and tests on Node 26 ahead of its LTS date.

Full notes: docs/16-ROADMAP.md, "v1.1.1 — two live defects".