v1.12.0

Fixed

• Undo now sticks. Tapping "Undo" on the ban or return toast previously only reverted the change locally, so the entry silently came back in History and Collection on the next reload; the undo now also removes it on the server, including when it happens offline.
• Database migrations that rebuild a table can no longer cascade-delete user data. The migration that added German, Italian, and Spanish did exactly that: instances that upgraded through it lost their banned cards and play history.
• Once an account lockout expires, the failed-attempt counter resets, so a single wrong password no longer re-locks the account for another full period.
• The shared demo account no longer remembers the previous visitor's language choice.
• Switching screens in quick succession can no longer show the wrong screen: the router now discards a navigation that was overtaken by a newer one.
• Tapping a pile and then a navigation link during the short launch animation no longer yanks you to the draw screen afterward.
• The change-password dialog in Settings now behaves like the other dialogs: Escape and clicking outside close it, keyboard focus stays trapped inside, and focus returns to the control that opened it.
• The password-strength meter shown on the forced first-login change now follows the server's configured strength policy instead of a hardcoded threshold.
• The app manifest is now part of the offline cache, so the installed app keeps its name and icons offline right after an update.
• Docker builds run from a working copy no longer bake the local development database (server/var/) into the image.
• The bundled nginx configuration no longer strips the app's Content-Security-Policy and Permissions-Policy headers; deployments based on it were running without CSP.
• Creating a card whose identifier already exists shows the proper "identifier already in use" message again instead of a generic server error.
• The admin Users tab shows creation and last sign-in times in the viewer's timezone; they were shifted by the UTC offset.
• "Reduce motion" now also covers the full-screen reveal flash, the revealed card's looping shine, and the screen slide-in animation.
• Switching tabs and back on a revealed card no longer restarts ripple effects that had already finished, and a leftover card-return animation can no longer freeze the tilt effect on the next draw.
• ENABLE_REGISTRATION set in .env now actually reaches the container, and the HTTPS deployment variants also pass ADMIN_RESET and ENABLE_DEMO_ACCOUNT through, so the documented recovery and demo switches work without editing the compose file.
• Two deck edits saved within the same second no longer leave clients on the stale text: the deck version now includes a persistent revision counter.
• The container healthcheck follows a custom PORT instead of assuming 3000.

Changed

• The card reveal was redesigned around a "gold dust" sequence. The card levitates while golden particles swirl into it, takes a sharp breath, then flips with a light sweep; the landing sends out a golden shockwave (the full-screen white flash is gone), embers rain down, the card text cascades in, and the revealed card keeps floating over its shadow surrounded by a thin ambient dust. The floating emoji hearts are retired in favor of that dust, and particle density adapts to the device.
• A card opened from Collection or History now floats over its ground shadow like a freshly revealed one; the one-shot reveal effects stay reserved for live draws.
• Switching screens now plays a soft crossfade: the app had transition styles but never actually drove them, so every navigation was an abrupt content swap.
• The rest of the interface now speaks the reveal's gold language: tapping a pile charges it with gold light instead of a brightness flash, the halo around the most recently drawn card in the Collection and the pile counter pop turn gold, the syncing indicator drops its lone cyan for gold, History gets gilded date separators with a gently staggered entrance, and the sign-in card receives the same parchment wash and gold hairline as the rest of the app.
• Toasts, the sync banner, and dialogs now animate out instead of vanishing in one frame, the boot splash fades into the app, Collection tiles respond to touch, admin tabs gain hover states and the same glowing indicator as the bottom navigation, and every one of these animations is disabled under "reduce motion".
• The Docker image is roughly half as large: file ownership is set during copy instead of in a duplicating chown layer.
• /api/health no longer exposes the app version publicly; it only reports liveness.
• Seed files are validated at first boot with the same rules as the admin "sync from files" operation; malformed files are skipped with a warning instead of seeding unvalidated data.
• Switching the admin panel language re-renders the lists from memory instead of refetching them.
• The CI license check now installs the root dependencies before running, so the libraries actually bundled for browsers (zxcvbn, fflate) are checked; the step previously inspected an empty tree and verified nothing.
• The backup documentation now covers WAL mode properly: a hot copy must include the -wal and -shm companion files, and stopping the container first remains the reliable method.