kyeunga25 · kyeunga25 · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -19,3 +19,20 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run check
+      - run: npm run format:check
+      - run: npm run worker:check
+        env:
+          WRANGLER_LOG_PATH: /tmp/wallpect-wrangler-ci.log
+
+  browser:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium webkit firefox
+      - run: npm run test:e2e -- --project=chromium --project=webkit-mobile --project=firefox
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,27 @@ All notable changes to Wallpect are recorded in this file. The format follows [K
 
 ## [Unreleased]
 
+## [0.2.3] - 2026-08-02
+
+### Added
+
+- Added a bilingual architecture document covering the browser-only boundary, data lifecycle, renderer invariants, offline model, and verification gates.
+- Added production-mode browser coverage for exact PNG/JPEG/WebP dimensions, zero post-upload HTTP(S) egress, Object URL cleanup, offline navigation, keyboard editing, dark OS preference stability, and every mobile editor panel.
+- Added raw build-size budgets and Chromium, WebKit, and Firefox jobs to GitHub CI; Microsoft Edge remains part of the complete local browser matrix.
+
+### Changed
+
+- Migrated recent-device preferences from `wallpect:recent-devices` to the sanitized, versioned `wallpect:recent-devices:v1` key.
+- Replaced simulated listbox options with native device-selection buttons and labelled every information dialog through its visible heading and introduction.
+- Fixed the accepted light-rail/dark-stage interface to a light browser color scheme so operating-system dark preference does not recolor native controls.
+- Updated service-worker installation and activation lifecycles, bypassed HTTP cache during update checks, and limited offline shell fallback to navigation requests.
+- Expanded the release process with explicit public-data review, fixed-SHA merge, deployed-asset byte comparison, and evidence requirements before tagging.
+
+### Security
+
+- Updated `minimatch` and `brace-expansion` in the development dependency lock to a patched release for CVE-2026-14257.
+- Confirmed zero known vulnerabilities in the complete and production npm dependency graphs at release preparation time.
+
 ## [0.2.2] - 2026-07-25
 
 ### Added
@@ -73,7 +94,8 @@ All notable changes to Wallpect are recorded in this file. The format follows [K
 - Uploaded images remain in browser memory and are not sent to an upload API or analytics service.
 - Local secrets, credentials, build output, browser reports, and editor/OS metadata are excluded from version control.
 
-[Unreleased]: https://github.com/kyeunga25/wallpect/compare/v0.2.2...HEAD
+[Unreleased]: https://github.com/kyeunga25/wallpect/compare/v0.2.3...HEAD
+[0.2.3]: https://github.com/kyeunga25/wallpect/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/kyeunga25/wallpect/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/kyeunga25/wallpect/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/kyeunga25/wallpect/releases/tag/v0.2.0
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -12,6 +12,7 @@
 - 執行 `npm ci` 安裝鎖定版本的依賴。
 - 不要加入圖片上傳 API、圖片分析、帳戶追蹤或其他把用戶圖片傳離瀏覽器的功能。
 - 預覽與匯出必須共用相同的變換及渲染計算。
+- 持久偏好必須使用版本化 key 及明確遷移；目前只允許 `wallpect:locale:v1` 與 `wallpect:recent-devices:v1`。
 - 裝置資料必須位於 `src/data/devices`，不要寫入 UI 元件。
 - 推算或估算的設定檔資料不得標示為 `verified`。
 
@@ -20,7 +21,7 @@
 1. 建立範圍清晰的分支及變更。
 2. 為行為修正或新邏輯加入相應測試。
 3. 修改裝置設定檔時，提供來源、檢查日期、證據類型及準確度等級。
-4. 不要提交私人桌布、Apple 專有素材、憑證、環境檔或建置產物。
+4. 不要提交私人桌布、Apple 專有素材、憑證、環境檔或建置產物。提交前逐一審閱 status、diff、staged diff 及 untracked files，只明確暫存本次檔案。
 5. 執行以下檢查：
 
 ```bash
@@ -44,6 +45,7 @@ npm run test:e2e
 - UI 變更附上不含私人圖片的前後畫面。
 - 裝置資料變更連結到可靠來源，並依照[準確度政策](docs/ACCURACY_POLICY.md)標示資料。
 - 確認上傳圖片仍只留在瀏覽器中。
+- 涉及圖片、storage、快取或 service worker 時，加入零 HTTP(S) egress、Object URL 釋放、遷移或 production-mode 離線測試。
 
 一般錯誤或功能建議可使用 GitHub Issues。涉及未公開漏洞或可能洩露資料的問題，請勿在公開 issue 中附上敏感細節。
 
@@ -57,6 +59,7 @@ Thank you for helping improve Wallpect. Keep each issue or pull request focused
 - Run `npm ci` to install the locked dependency versions.
 - Do not add image upload APIs, image analytics, account tracking, or any feature that sends a user's image out of the browser.
 - Preview and export must share the same transform and rendering calculations.
+- Persistent preferences require a versioned key and explicit migration. The only current keys are `wallpect:locale:v1` and `wallpect:recent-devices:v1`.
 - Keep device data in `src/data/devices`, outside UI components.
 - Never label derived or estimated profile data as `verified`.
 
@@ -65,7 +68,7 @@ Thank you for helping improve Wallpect. Keep each issue or pull request focused
 1. Create a focused branch and change set.
 2. Add tests for behavior fixes or new logic.
 3. For device profiles, include sources, review dates, evidence types, and accuracy levels.
-4. Do not commit private wallpapers, proprietary Apple assets, credentials, environment files, or generated build output.
+4. Do not commit private wallpapers, proprietary Apple assets, credentials, environment files, or generated build output. Review status, diff, staged diff, and untracked files individually before committing; stage only explicit files in scope.
 5. Run the core checks:
 
 ```bash
@@ -89,5 +92,6 @@ For deployment or release changes, also follow the [release guide](docs/RELEASIN
 - Include before/after images for UI changes, without private imagery.
 - Link device-data changes to reliable sources and follow the [accuracy policy](docs/ACCURACY_POLICY.md).
 - Confirm that uploaded image content still stays in the browser.
+- For image, storage, cache, or service-worker changes, add the relevant zero HTTP(S) egress, Object URL release, migration, or production-mode offline test.
 
 Use GitHub Issues for ordinary bugs and feature requests. Do not place sensitive details in a public issue when reporting an undisclosed vulnerability or possible data exposure.
diff --git a/README.md b/README.md
@@ -43,7 +43,7 @@ Wallpect helps you compose an image for a selected Apple device, inspect likely
 4. Adjust the composition and enable the guides you want to inspect.
 5. Choose PNG, JPEG, or WebP and export at the displayed resolution.
 
-Your image stays in browser memory and is released when it is replaced, the page is refreshed, or the page is closed. Only the selected locale and up to four recent device identifiers are saved in versioned `localStorage`. Normal requests for public site files still pass through Cloudflare, but they do not contain your selected image bytes.
+Your image stays in browser memory and is released when it is replaced, the page is refreshed, or the page is closed. Only the selected locale (`wallpect:locale:v1`) and up to four recent device identifiers (`wallpect:recent-devices:v1`) are saved in versioned `localStorage`. Normal requests for public site files still pass through Cloudflare, but they do not contain your selected image bytes.
 
 The website provides directly accessible Traditional Chinese and English privacy, terms, disclaimer, and data-source notices. Maintenance and third-party source/API rules are documented in the [Terms, Privacy, and Data Policy](docs/LEGAL_PRIVACY_AND_DATA_POLICY.md).
 
@@ -73,15 +73,15 @@ npm ci
 npm run dev
 ```
 
-Run the core quality checks:
+Run the core quality checks. `npm run check` includes lint, unit/integration tests, a strict production build, and the raw build-size budget:
 
 ```bash
 npm run check
 npm run format:check
 npm run worker:check
 ```
 
-The Playwright suite additionally covers Chromium, WebKit, Microsoft Edge, and Firefox:
+The Playwright suite builds the app and starts a production-mode local preview on port `4174`. It covers Chromium, WebKit, Microsoft Edge, and Firefox:
 
 ```bash
 npm run test:e2e
@@ -108,9 +108,12 @@ See the [deployment guide](docs/DEPLOYMENT.md) for platform settings and the [re
 
 Preview and export both call `renderWallpaper`. Pan offsets use the target canvas's normalized coordinate space, so a scaled preview and full-resolution export preserve the same composition.
 
+See the [architecture document](docs/ARCHITECTURE.md) for the runtime boundary, local-data lifecycle, storage migration, offline behavior, and verification invariants.
+
 ## Documentation
 
 - [Accuracy policy](docs/ACCURACY_POLICY.md)
+- [Architecture](docs/ARCHITECTURE.md)
 - [Device profile guide](docs/DEVICE_PROFILE_GUIDE.md)
 - [Deployment guide](docs/DEPLOYMENT.md)
 - [Release guide](docs/RELEASING.md)

diff --git a/README.zh-Hant.md b/README.zh-Hant.md
@@ -43,7 +43,7 @@ Wallpect 讓你按所選 Apple 裝置調整圖片構圖、檢查可能遮擋內
 4. 調整構圖，並開啟需要檢查的輔助線。
 5. 選擇 PNG、JPEG 或 WebP，再按顯示的解析度匯出。
 
-圖片只會保存在瀏覽器記憶體，當圖片被取代、頁面重新整理或關閉時便會釋放。只有介面語言及最多四個最近使用的裝置識別碼會儲存在版本化 `localStorage`；公開網站檔案的正常請求仍會經過 Cloudflare，但不包含你選擇的圖片 bytes。
+圖片只會保存在瀏覽器記憶體，當圖片被取代、頁面重新整理或關閉時便會釋放。只有介面語言（`wallpect:locale:v1`）及最多四個最近使用的裝置識別碼（`wallpect:recent-devices:v1`）會儲存在版本化 `localStorage`；公開網站檔案的正常請求仍會經過 Cloudflare，但不包含你選擇的圖片 bytes。
 
 網站內可直接查閱繁中／英文的私隱、使用條款、免責及資料來源說明。維護與新增第三方來源／API 的規則記錄於 [條款、私隱與資料政策](docs/LEGAL_PRIVACY_AND_DATA_POLICY.md)。
 
@@ -73,15 +73,15 @@ npm ci
 npm run dev
 ```
 
-執行主要品質檢查：
+執行主要品質檢查；`npm run check` 包括 lint、單元／整合測試、strict production build 及 raw build size budget：
 
 ```bash
 npm run check
 npm run format:check
 npm run worker:check
 ```
 
-Playwright 測試另外涵蓋 Chromium、WebKit、Microsoft Edge 及 Firefox：
+Playwright 會先 build，再在 `4174` 啟動 production-mode 本機 preview，並涵蓋 Chromium、WebKit、Microsoft Edge 及 Firefox：
 
 ```bash
 npm run test:e2e
@@ -108,9 +108,12 @@ Wallpect 以不含 Worker script 的 Cloudflare Workers Static Assets 模式部
 
 預覽與匯出均會呼叫 `renderWallpaper`。平移值使用目標 Canvas 的標準化座標，因此縮小預覽與完整解析度匯出可保持相同構圖。
 
+完整 runtime 邊界、本機資料生命週期、偏好遷移、離線行為及驗證不變條件見[架構文件](docs/ARCHITECTURE.md)。
+
 ## 技術文件
 
 - [準確度政策](docs/ACCURACY_POLICY.md)
+- [架構文件](docs/ARCHITECTURE.md)
 - [裝置設定檔指南](docs/DEVICE_PROFILE_GUIDE.md)
 - [部署指南](docs/DEPLOYMENT.md)
 - [發布指南](docs/RELEASING.md)