Product Updates

New Capabilities

What Changed

1. AI search visibility baseline: the site Organization schema's sameAs adds the public GitHub repository beside the newsletter for entity resolution; each of the nine /china-ai/ explainer articles gains two frequently-asked questions restating its own on-page content, rendered as a visible FAQ section with per-article FAQPage JSON-LD and included in the text/markdown negotiation output so single articles are extractable as Q&A pairs; two operations docs land in the repository — docs/AI-VISIBILITY-MONITORING.md (18 fixed prompts sampled monthly across ChatGPT, Perplexity and Google AI Overviews with cited/mentioned/recommended tiers and CSV record templates, results kept outside the repo) and docs/AI-CONSENSUS-PLAYBOOK.md (a consensus anchor line, channel-by-channel authentic participation actions and prohibited tactics) — cross-linked from the SEO/GEO plan. Not yet released
2. Documentation-wide review remediation: the China AI Focus main spec's delivery record now reflects production reality (73 entities, 60 models, both verified against the live API) instead of the stale 49-entity pre-deployment snapshot, its two dead cross-spec links to v0.14.0/v0.15.0 folders are repointed to the archive, and the docs index lists the reported-evidence and new member-newsletter specs; the newsletter editorial desk (753-line member-newsletter.ts) gains its missing docs-first spec documenting the admin-token auth channels and the recorded risk boundary of URL-based token delivery; model counts across the SEO execution plan and keyword playbook move from the 55-page baseline to the current 60; the release process doc stops describing retired GitHub Pages as a deployment gate; and the GROWTH monetization funnel is reordered to subscription-first per the 2026-10-04 no-advertising decision, with B2B sponsorship demoted to a distant optional track requiring docs-first review before any revival. Not yet released
3. Integrated account-level newsletter desk for staff members: the main /account page detects whether the authenticated session matches the configured staff email (ADMIN_EMAIL, ADMIN_EMAILS, or ADMIN_APPROVER_EMAILS); when matched, it unlocks an exclusive EDITORIAL DESK panel with direct access to /account/newsletter, while keeping it strictly hidden and 302-intercepted for general users; the new /account/newsletter page provides a complete weekly issue curation workflow — selecting verified events from the past 7 days, one-click DeepSeek AI structured drafting, dual-pane live email preview, and instant copy-to-clipboard HTML/Markdown for Substack without requiring a separate domain or Cloudflare Zero Trust setup. Not yet released
4. Single-user admin token authentication for the newsletter editorial desk: requireAdminIdentity supports ADMIN_TOKEN via query parameter (?token=...), authorization header, or admin_token cookie, bypassing mandatory Cloudflare Access configuration so a solo publisher can securely access the AI newsletter desk, select verified candidate events, trigger DeepSeek automated draft generation, preview email layouts, and export to Substack. Not yet released
5. China AI SEO and PAA search intent enhancement: /china-ai/ adopts front-loaded title branding (China AI: Top Models, Labs, Rules & Ecosystem Explained), an on-page Frequently Asked Questions section targeting Google's top People Also Ask queries (terminology, top models, ChatGPT comparisons, and technical foundation), CollectionPage and FAQPage JSON-LD structured data, and BreadcrumbList schemas across all nine explainer primers. Not yet released
6. Commercial monetization architecture established: PRD §6 and GROWTH specifications define a three-layer monetization model to break the 'free news site does not make money' and 'shallow tool directory high bounce rate' dilemmas — an authoritative model/tools decision directory as the top-of-funnel discovery engine, B2B outbound sponsorships and partner listings for Chinese AI labs ($500–$2,000/mo), developer API/inference affiliate conversions, and high-value Pro decision briefings and price-watch monitoring for overseas funds and enterprise strategists ($399–$500/yr). Not yet released
7. Reported titles no longer name the outlet: reported Event titles start with a literal Reportedly: prefix and state the claim directly (e.g. 'Reportedly: Xiaomi retires MiMo-V2.5-Pro...'), while the outlet attribution moves entirely to the factSummary and the Reported-by label already shown on cards and Event pages — keeping the honesty hedge without diluting headline keywords with media names (2026-10-09 operator decision). Existing published titles are backfilled to the new shape. Not yet released
8. Model data evidence compliance cleanup: the five models previously inserted straight into D1 were re-audited — the ERNIE-4.0-Turbo list price and context window (filled from memory, never checked), the unconfirmed Step-2 parameter count and the FluxVLA outside-China availability were deleted so the pages honestly show Not verified; RDT-1B parameters corrected from 1.2B to the 1B stated on the canonical thu-ml/RoboticsDiffusionTransformer repository; WALL-OSS and RDT-1B open-weight evidence repointed to the repositories actually opened; every correction is recorded in audit_log; the one-off SQL script is removed from the repository so repo and production no longer drift. Sponsor disclosures link to /product/ (How we assess) instead of the retired /advertise/ page, Policy leaves the footer Explore group so header and footer navigation never duplicate, and llms-full.txt joins the export integrity checks (structure, HTTPS links, English-only, template markers). Not yet released
9. Hero layout and models directory responsive polish: .page-hero.index-hero adopts a clean top-to-bottom flex column layout eliminating the 2-column grid auto-placement bug that pushed filter pills to the far right and left a massive blank gap on the left; .registry-events li on mobile adopts a clean vertical flex stack ensuring date, lab badge, and headline flow naturally without awkward line breaks. Not yet released
10. Footer, navigation, and reading list polish: topbar and footer newsletter links open in a new tab (target=_blank rel=noopener), the retired /advertise/ page and links are removed completely, footer navigation points to /china-ai/ and adopts Privacy and terms, the More menu is reduced to the three content sections that are not already in the footer (Policy, China AI Lines, Event History; removing internal Signals and unreleased Attention Index, and dropping Policy from the footer Explore group so header and footer never duplicate), the redundant method accordion is removed from the homepage, and the reading list card (#membership) is centered as a compact 38rem card. Not yet released
11. Brand voice and section titles unified around China AI: the site-wide tagline is unified to 'China AI, from the inside' across header, footer, i18n and specs, and the homepage explore heading is standardized to 'Explore China AI' matching the top-query Trends baseline, while plural entity names (Chinese AI models, Chinese AI companies) preserve the natural English adjective form. Not yet released
12. China AI explainers expanded to nine comprehensive primers: added four major foundational guides covering Why Chinese AI labs bet on open weights, China's embodied AI and humanoid robotics boom, How Chinese labs adapt to compute constraints, and The Chinese model API price war, expanding the /china-ai/ knowledge base from five to nine articles with direct links to relevant companies and regulators. Not yet released
13. Latest model releases layout and directory filter gaps resolved: the 3-child grid bug in releaseList that jammed model release headlines into the 110px date column and forced 8-line wraps is fixed by wrapping the lab tag and headline in a full-width flex container; robotics VLA models (WALL-OSS, RDT-1B, FluxVLA) and domestic-only API models (ERNIE-4.0-Turbo, Step-2) are registered in D1 so the modality=robotics and outsideChina=china_only_api filters are fully populated, and empty filter states now provide clean reset guidance. Not yet released
14. Agent and reader experience overhaul: story rows link their entity names to company directory profiles, /llms-full.txt provides a complete single-file Markdown corpus of all 73 companies, products, explainers and API endpoints for RAG ingestion, /api/v1/openapi.json exposes a complete OpenAPI 3.0.3 specification, and Cloudflare Worker supports Accept: text/markdown content negotiation across models, companies and explainers. Not yet released
15. Homepage Explore Chinese AI cards sharpened: card titles drop the ambiguous 'China AI' label in favor of 'China AI Explainers' (with copy describing essential primers on terminology, frontier startups and compliance), while Chinese AI models, companies and policy cards gain specific, value-oriented copy covering open weights, 73 catalogued entities and filing standards. Not yet released
16. Model profile pages redesigned into structured specifications: model pages drop the flat 1185px-wide Verified facts dump and adopt the desktop two-column layout matching company profiles (main column: model summary, Specifications table, Release timeline, More from lab; side column: sticky Access & availability card with global access, license, Hugging Face link, and ModelPriceLab note), giving model pages the look of a clean benchmark spec sheet rather than an internal audit log. Not yet released
17. Explainer hero copy refined and backed by Trends evidence: the /china-ai/ index hero adopts the Title Case heading China AI Explained and a cleaner subtitle (Core terms, foundational labs, and regulatory frameworks — verified from primary sources.) eliminating the triple repetition of explain; Google Trends comparison data confirmed china ai dominates search interest over Chinese AI in both the US (47 vs 20) and globally (58 vs 24, peaking at 100 in May 2026), firmly validating the /china-ai/ URL structure. Not yet released
18. Explainers enriched with internal links and exploration paths: each explainer article now links directly to the Chinese AI companies and regulators discussed (for example the Six AI Tigers article links to Zhipu, Moonshot, MiniMax, Baichuan, StepFun and 01.AI directory profiles with their monograms), and the /china-ai/ index page ends with an Explore Chinese AI section connecting to models, companies and policy. Not yet released
19. Homepage company rail polished: the tracked rail gains an uppercase Tracked label so readers understand the row is curated coverage, links render as crisp tag chips with micro-borders instead of loose floating text, and Unitree's rail link is explicitly pinned to Unitree instead of resolving to its robot model G1. Not yet released
20. The explainer index moves from /learn/ to /china-ai/ so the URL carries the China focus: navigation entries now read China AI, page kickers and breadcrumbs say China AI explainer, article canonicals, sitemap paths and llms.txt point at the new URLs, each article gains a next-explainer link, and learn-page cards keep their titles on one line after the avatar grid was scoped to company cards only; the old /learn/ paths are retired outright with no redirects. Not yet released
21. Outbound links now identify the site: external evidence, product and channel links drop the link-level noreferrer flag, so the existing strict-origin-when-cross-origin policy sends https://aigc.news/ as the referrer to company sites, GitHub and Hugging Face without leaking page paths, and links keep rel=noopener for security. Not yet released
22. Product catalog widened beyond models: Huawei lists the Pangu model family and Ascend AI processors (and joins the chips filter), Unitree lists G1 and Go2, UBTECH the Walker S2, AgiBot the A2 and X2, Fourier the GR-2, Leju the KUAVO, EngineAI the PM01, Cambricon the MLU line, Moore Threads the Kuae GPUs, Biren the BR series, Enflame the CloudSurfer, MetaX the C500 and Iluvatar the Tiangen 100, while Baidu gains the Qianfan model studio, JD the JoyAI family and Manus its agent product — robots and AI chips now sit beside models as first-class catalogued products. Not yet released
23. Companies and products now carry letter marks: directory cards, company page headers and product cards show a deterministic monogram (first letter, site palette, hairline border) rather than third-party logos, giving every profile and product a visual identifier without hosting trademarked assets or hotlinking brand CDNs. Not yet released
24. Company profile pages were redesigned: desktop widths get a two-column layout (Products, Models, media and Events in the main column; the Verified facts record, official channels and profile sources in a side column), each product is a card with the name, Chinese name and source link on one head line and the one-line introduction below instead of a single wrapped run of text, and the Known-for line stops after three names with a +N count. Applies to every company page, not one company. Not yet released
25. Company products are grouped and introduced: each catalogued product now carries a category (model family, model API, assistant app, image, video, 3D, speech, AI search, office AI, robot, chip) and a one-line English description, and company pages render the Products section grouped by kind; model APIs are catalogued as products (DeepSeek API, Zhipu BigModel, Kimi API, Alibaba Bailian, Volcano Ark, StepFun, Baichuan, SenseNova), Tencent's page now spans Hunyuan models, Hunyuan3D, Yuanbao and ima across three product kinds, Tongyi, ERNIE Bot, iFlytek Spark, Zhipu Qingyan and Skywork assistants joined their makers, and the open-weight model families Yi, MiniCPM, MiMo, LongCat and Ling are listed for their labs. Not yet released
26. Robotics and embodied AI directory expansion: eleven more Chinese robotics companies enter the registry (Kepler Robotics, Astribot, LimX Dynamics, Pudu, Deep Robotics, Galaxea, Spirit AI, X Square Robot, Dobot, Robot Era, AI2 Robotics), each with an official channel that was fetched and verified, a sourced product link, Chinese search aliases and ambiguity guards on prose-prone names; the entity resolver now lets a guarded explicit alias override the implicit name alias, so wording like the robot era or Fourier transforms no longer classifies as a China entity, and the company directory grows from 49 to 60 entries. Not yet released
27. Watchlist followed-company rows no longer overlap: the Open Event and Company page links for each followed company shared the same desktop grid cell and rendered on top of each other; the two actions now stack inside one action cell, and the desktop column rule only positions direct-child row links. Not yet released
28. Editorial evidence recovery: China-related media changes enter review; drafting and publication share the one-Tier-1 or two-verified-independent-Tier-2 gate, with publisher, author and syndication deduplication. Recent candidates rotate across sources, incomplete evidence no longer consumes scoring slots, explicitly labeled source publication dates pass validation, and publication reports name blockers (unreleased; publisher identities require reviewed private configuration through an approver- and token-protected audited API; catalog sync preserves verification until source identity changes)
29. The Worker-rendered news sitemap again covers only the last 48 hours instead of 48 days, matching the static export and Google's news sitemap rule. Not yet released
30. Events created from Chinese-language source titles get a readable English slug when the English draft lands, while the Event is still in review; repeat Chinese headlines keep attaching to the same Event through the linked signal. Not yet released
31. The newsletter is named AIGC Newsletter consistently across the site, llms.txt and the sponsorship page, matching the existing Substack publication name. Not yet released
32. Scheduled billing catalog freshness: the member Worker's hourly Cron re-verifies every configured Stripe price against the provider, at most one request per offer every 12 hours, and records the outcome in D1. The deploy-time catalog timestamp no longer expires Checkout offers after 24 hours, a provider price that stops matching the deployed config or no longer exists immediately withdraws that offer even while the deploy timestamp is fresh, a changed price is never sold on the old price's verification, subscription webhooks keep mapping sold prices after the catalog timestamp goes stale, and transient provider failures keep the previous verification until the 24-hour fail-closed deadline. Checkout itself stays closed until Stripe is configured in production. Not yet released
33. Search engines now see one brand, AIGC News: the homepage title leads with it, page titles, site and organization structured data (with AIGC.NEWS and aigc.news as alternate names), the share site name and the news sitemap all use it. The wordmark on the page stays AIGC.NEWS. Not yet released
34. The not-found page is now noindex, so retired Event URLs no longer look like indexable pages, and the Attention Index stays out of the sitemap until its first week is published. Not yet released
35. The model directory now lists 29 Chinese open-weight models with parameters, context window, license, availability outside China and official list prices, each linked to its official source and verification date. Model pages lead with those facts in the title, description and first paragraph. Not yet released
36. Model release dates now cite the vendor's own announcement instead of the Hugging Face repository date, which ran ahead of release by up to a month. Models without a cited date are withdrawn until verified; a second batch brings the directory to 55 models. Not yet released
37. List prices are re-checked against their official pricing pages every week. A price whose amounts no longer appear on its source is flagged for an editor; nothing changes on the public page until an editor confirms it. Not yet released
38. Links to retired stories now open the homepage instead of a Page Not Found. Not yet released
39. Stories below the homepage selection bar are no longer hidden: every verified China AI Event keeps its page, appears on the timeline, company pages, sitemaps and RSS, and only the homepage is curated. Not yet released
40. Promotional stories below the bar (awards, rankings, visits, customer stories, marketing) stay unpublished; the scorer flags them, and two passes must agree. Not yet released
41. Company profiles now show the official website, founding year, headquarters city and key people, each with its source and verification date. Not yet released
42. A beta Hot list ranks this week's Chinese AI stories by how many independent sources carried them, in English and Chinese, and says so plainly when nothing qualifies yet. Not yet released
43. A cleaner homepage: the masthead is the headline and one scrollable company rail, each top story carries a single company · source · date line instead of five rows of labels, the filters are evenly spaced with Official source set apart, empty China AI Lines no longer show a placeholder, a new strip lists the latest Chinese AI models, and one-sentence stories no longer lead the page. Not yet released
44. Faster first paint: every public page preloads its two brand fonts, and fonts are cached for a year. Not yet released
45. Stories reported by a single Chinese outlet now publish within the hour instead of waiting for official confirmation, labeled “Reported by <outlet> · not yet confirmed” on the homepage, timeline and story page, with the headline and summary attributing the claim; when the company or a second independent outlet confirms it, the label upgrades automatically. Not yet released
46. Drafting no longer stalls when the model provider fails: billing, rate-limit, outage and timeout errors stop the run without using up a story's drafting attempts, the story retries an hour later, /api/v1/health reports when the outage began, and the daily monitor opens an alert after an hour. The automatic repair round now names every field a banned phrase appears in, so one fix no longer leaves it elsewhere, and “potentially” is no longer a banned hedge. Not yet released
47. A denser homepage feed: rows drop their separate action line (the title is the link and save sits at the right), summaries and why-it-matters lines clamp to two lines, and up to twenty Events show, roughly doubling what fits on one desktop screen. Selected cards no longer call older stories Also today. Not yet released
48. The homepage update list is grouped by day with a count (Today, Yesterday, then dates), each item gives the complete first sentence of why it matters instead of a clipped fragment, and a new Official filter shows only Events with first-party evidence. Not yet released
49. Selection before drafting: each candidate Event is scored twice against one written rubric, with thresholds by source tier (60 for official sources, 76 for media) and caps for awards, rankings, certifications, official visits, customer stories without numbers and marketing; Events below the threshold are hidden with an audit record, and an editor can restore them. A labeled calibration set and evaluation script ship with it. Drafts now name their subject in the title, keep the article type, and answer first in the summary. New RSS feeds (all Events, models, companies, policy) and an /agent/ guide join llms.txt. Paid model calls keep receipts so retries reuse what was paid for, under a daily cap. The method draws on the open-source AIHOT project (MIT); none of its data is used. Not yet released
50. Stories now start on the first screen: the homepage masthead is one compact band, the edition index and closing block are gone, and the three selected stories become one lead card and two compact cards side by side on wide screens. Company names follow the entity registry everywhere, and drafts that copy a source headline are sent back for a rewrite. The update list adds All, Models, Companies and Policy filters, and a single official source reads Official source instead of 1 source. Event pages end with Latest in Chinese AI, five more stories to read, and public pages are cached at the edge for 60 seconds. Not yet released
51. Public pages now load Google Analytics 4 alongside Cloudflare Web Analytics; account and editor pages load no analytics. Because the site has no consent banner, visits from the EEA, the UK and Switzerland are measured without cookies, and advertising features, ad personalization and Google signals are off everywhere. The copyright and privacy page explains this in a new Analytics and privacy section, and the sponsorship policy now limits its no-trackers promise to the sponsor units themselves. Not yet released
52. First Chinese-language official sources, in shadow: DeepSeek's Chinese announcements, Unitree's Chinese newsroom, Zhipu's Chinese articles (from its public article listing) and the Cyberspace Administration of China's news list, filtered to AI rules, generative AI filing notices and enforcement campaigns. The page watcher now reads unquoted links and dates printed next to a link, as Chinese government sites use, and can filter by keywords; the JSON adapter maps a CMS's own field names and builds article links from a template. The homepage update list adds All, opens on the narrowest window that shows at least six Events, shows up to twelve, and labels the lead as Top 3 of all published Events so the site no longer looks like it has only three stories. Not yet released
53. The editorial desk drafts again. A failed draft is retried after 1, 4 and 12 hours and then left for an editor, so one bad draft no longer blocks the queue, and a draft that uses a banned phrase or a number not in the evidence gets one targeted correction with the rules unchanged. Hugging Face model and GitHub repository Events are drafted with the model card or README as supplementary evidence (fetched under robots.txt and safety checks, never stored or published), and a public Hugging Face model page is recorded as downloadable open weights. Only signals from the last 60 days become Events, so a source's first run no longer turns its history into news, and titles naming different model versions (such as Kimi-K2.6 and Kimi-K3) are no longer merged. The Qwen blog feed, which stopped in 2025 when the blog moved to qwen.ai without a feed, is retired, and ERNIE blog pages with a zero date are no longer read as 2001 posts. The homepage leaves out China AI Lines that have no evidence Event yet and lists only companies with published Events in the company rail; Event pages say when sources do not state availability outside China. Editors can see failed drafting attempts and approvers can request a fresh draft with a recorded reason. Not yet released
54. The China source map grows from 33 to 74 sources. Hugging Face coverage adds eleven organizations, including Ant Group's inclusionAI, BAAI, NetEase Youdao, Alibaba's Tongyi Lab, PAI and Wan, Meituan LongCat, ByteDance, Kuaishou Kolors, AgiBot and Kunlun Tech's Skywork. Twenty-four official GitHub organizations of Chinese labs are watched for new repositories through the GitHub REST API once a read-only token is configured. Six Chinese tech outlets (QbitAI, Leiphone, TMTPost, ifanr, GeekPark and IT Home) contribute headlines that name AI. Alibaba's Alizila newsroom is filtered the same way, so e-commerce, fashion, charity and obituary stories no longer reach the editorial desk. Keyword matching accepts version numbers and plurals, so headlines such as Qwen3.5, Wan2.2 or GPUs are no longer missed, and a filtered feed that returns no items at all (for example a web page or a challenge page) now fails and is degraded instead of reading as healthy. Approvers can hide an off-topic review Event, or restore it, with a recorded reason. The entity registry adds Ant Group, Meituan, Kunlun Tech, BAAI and NetEase Youdao. InfoQ China is retired because its feed stopped in 2019. /signals/ and /api/v1/signals now publish only signals with a China nexus. Official-site sitemaps were checked and do not give reliable publication dates, so they are not used; X and WeChat official accounts are not collected automatically. Not yet released
55. All data now lives in Cloudflare D1; the repository snapshot and the legacy Node/SQLite pipeline are retired. The Worker reconciles source lifecycles once a day with an audit trail: five consecutive failures quarantine a source, two unhealthy runs degrade an active source, quarantined sources are probed daily without writing signals and return to shadow after three healthy probes, and degraded sources recover after the activation window. Promoting new shadow sources stays an editor decision unless SOURCE_AUTO_ACTIVATE is turned on. /sources/ now shows live lifecycle and latest-run health, /api/v1/sources publishes the allowlisted report, and llms.txt points to the live JSON API. The static /data/*.json export, the retired /scout/ and /actors/ pages and static Event fallback pages are removed; the source health issue and production monitor read the live API instead of committed files. Not yet released
56. The default homepage reading surface no longer shows unreviewed preprints. The three deep reads, the Latest verified AI updates feed, /api/v1/home and windowed /api/v1/events requests without a research filter only admit papers that pass the same high-impact research review as the Timeline, with at most one paper among the three deep reads; fresh arXiv preprints had made up about 95% of published Events and crowded out product, pricing, policy, capital and deployment changes. A paper is now an Event with a research category or arXiv primary evidence, so launches that only cite an arXiv report still qualify, and public Event DTOs expose a researchImpact.qualified flag.
57. Homepage dates now separate edition freshness from Event chronology: the status line labels the active public projection as Brief updated, while each deep read labels its happenedAt value as Event date. Static fallback and live D1 hydration use the same terms, so an older Event date is no longer presented as the current edition date. Not yet released
58. The homepage opens with a compact edition heading and an asymmetric lead-plus-two Event index. Full titles replace clipped previews, secondary stories stack on desktop and all entries follow reading order on mobile. Selection guidance and deep-read anchors remain available; the existing teal palette and typography are preserved. Not yet released
59. The latest verified Event ledger now gives evidence the primary visual weight: Save is the same compact 44px bookmark utility used by the three homepage deep reads, while its Save/Saved text remains available to assistive technology and its dynamic title and state behavior stay intact. The shared Account, Watchlist and conditional Billing workbench reduces the display-title ceiling from 4rem to 2.75rem and lowers section headings without shrinking body copy, touch targets or controls. The Public and Member Workers deliver this UI slice together without a database migration
60. Event Watchlist capacity now defaults to twenty saved Events for Free and no product-level collection quota for Pro. The Member Worker resolves the effective entitlement on every read and mutation, returns maxItems=20 or null, and renders used capacity or Unlimited accordingly. Free/Pro plan limits, mutation item count and request-body safety ceilings are centralized defaults with controlled runtime overrides; invalid configuration fails back to safe defaults, and request safety is not presented as a paid-plan quota. Downgrading never deletes saved Events and still permits removal toward the Free limit, while new additions remain blocked above it. The runtime and configuration are deployed; authenticated Free/Pro capacity still awaits controlled production browser acceptance
61. The public acquisition loop is now one coherent path: a reader opens a verified Event, chooses Save, continues through the unified Google sign-in-or-create action, returns to the same public page, completes the pending save, and can revisit the private Watchlist. Free Watchlist is visible in the desktop header, mobile bottom navigation, homepage and footer; Decision Brief remains a separate secondary path, every new anonymous link goes to /login with an allowlisted source, and authenticated visits to /login return safely to the requested page or Watchlist. Pending Event consumption works for initial controls and dynamically mounted drawers, clears only after success or an already-saved result, and empty Watchlists suggest at most three current verified Events without saving them. The Newsletter fallback states its actual sample date, removes repeated legacy-weekly explanations and uses a ruled reading sequence instead of three equal cards. Migration 0025 stores only fixed Google/account/first-save/7-day-return stages, UTC day, environment and source—never email, IP, user agent, referrer, raw OAuth state or subject, return URL or Event content. Google identity linking is excluded from acquisition, and OAuth completion/account creation is recorded only after Session issue succeeds. Member-bound rows cascade on account deletion; an independent retention Cron purges rows older than 180 days even while private-content maintenance stays disabled, with aggregate-only output and fail-open telemetry. Unspoofable HEAD probes preserve side-effect-free GET routing status, including projection-not-ready, without creating a Watchlist or counting a human visit; HEAD requests to the Google callback return 405 before token exchange, identity writes or Session issue. This slice is committed and deployed, and migration 0025 is applied to production D1. Anonymous entry, redirect and health checks are accepted; authenticated automatic save and return still await controlled production browser acceptance
62. Watchlist is now an Event-first reading memory instead of a second Topic preference editor. New accounts start with an empty list; Free readers may save zero to twenty Events, Pro has no product-level collection quota, and either plan can remove the final Event. Topic choices remain local to public Trend ordering and no longer appear in Watchlist or consume its capacity. Legacy Topic and Trend rows are hidden without a destructive migration and are naturally pruned by the next versioned Event mutation. The runtime is deployed; authenticated production and historical-data acceptance remain open
63. Public pages now hydrate only the boolean authenticated Session state with a same-origin no-store request. Desktop, mobile, homepage membership and footer acquisition links become Account and Watchlist for signed-in readers without projecting email, plan, capabilities or Session data into cacheable HTML. A known anonymous Save intent records the pending Event and redirects immediately through the unified Google entry; unknown or expired Sessions still fail closed through the Watchlist 401 path, and the Event is saved after return. This reuses the existing Session and Watchlist APIs, adds no migration, and is deployed; authenticated production browser acceptance remains open
64. Public Event retention now connects to the existing default Watchlist instead of stopping at a decorative control. The three homepage deep reads, verified update rows, Event detail and timeline evidence drawer expose one Save/Saved action backed by the versioned Watchlist GET and PUT contract; signed-out intent continues through the unified Google entry and returns to the original Event before saving, while signed-in state is refreshed from the server, submits only Event items and retries one version conflict. Free fails visibly at twenty Events without overwriting existing items; Pro has no product-level collection quota. Open the evidence remains the primary reading action in the three homepage Briefs, while Save and Share are compact icon-only 44px utilities with dynamic titles, accessible names and complete states. Public share controls across the homepage, completed daily brief and static or live Event detail use the standard share glyph instead of the ambiguous X-shaped brand mark. Other lists and Event detail retain visible labels. Event detail groups Share on X with canonical-link copy in one compact menu. No migration or public member-state projection is introduced. The previously deployed runtime remains live; this icon treatment is local until the next deployment, and authenticated save/share browser acceptance remains open
65. The private Member area now has two top-level destinations: Watchlist for recurring Event retention and Account for sign-in, privacy and data controls. Public sign-in and first-time account creation return to the Event-first Watchlist, while Topic preferences stay local to the public Trend view. Primary member actions now use the cool-teal accent with selector specificity that keeps their light labels visible instead of rendering near-black blocks. The standalone settings route, its public proxy entry and the static site's legacy settings data attribute are removed; /settings now returns 404. Internal list versions and cursors are no longer rendered, the Delta action appears only when its server rollout is open, and Free accounts without verified purchase history no longer receive top-level Billing navigation or empty subscription and payment operations. Direct Billing access remains available as a compact truthful Free state. Production payment, Restore, Delta and Decision Brief flags are unchanged
66. Member entry now stays on the first-party https://aigc.news/ origin. The public Worker forwards an allowlist of login, Account, Watchlist, settings, billing and private API paths to the isolated Member Worker through a Cloudflare Service Binding, and Google OAuth uses the exact callback https://aigc.news/auth/google/callback. Users, same-origin checks and __Host- Session cookies see one hostname while Google secrets and member writes remain isolated. Public /briefs, Event, Trend and Newsletter APIs, Sitemaps and static assets stay on the public runtime; account.aigc.news remains only a migration fallback and is no longer generated in new user links
67. Member access now has one Google entry instead of separate login and registration decisions. /login shows Continue with Google: an existing identity signs in, while a first-time identity creates a Free account under the current Terms and Privacy versions; Newsletter consent remains separate. The legacy /register URL preserves only a safe same-site returnTo and recognized OAuth errors before redirecting with private no-store caching to the unified page, and OAuth failures return there as well. The old login mode remains fail-closed for compatibility and cannot create an unknown identity. The compact 28rem Studio-cool surface keeps Google as the only public method, uses only a compact AIGC.NEWS wordmark and back link without an additional graphic logo, removes email and code UI, and adds an in-button loading state without changing Session or entitlement boundaries. A controlled user has completed the existing main-domain Google provider smoke; the current acquisition and Event-save slice still requires a fresh post-deploy browser acceptance
68. The Google OIDC slice defines a useful Free post-login path rather than an empty account shell: both first-time and returning members enter an Event-first Watchlist, which may stay empty until they deliberately save a public Event. Topic choices remain optional local Trend-view preferences and do not become member Watchlist items. The optional onboarding route remains available for future controlled Brief personalization but is not a login gate. Public Event, Trend and Evidence facts remain free; Google login grants no Pro entitlement and does not enable Newsletter consent, Checkout, Substack Restore, Delta or Decision Briefs. Authorization Code plus PKCE, signed state, nonce and Google JWKS/RS256 ID-token verification remain unchanged, and only the provider subject binding is stored. Account continues to expose boolean-only sign-in status plus session, export and deletion controls without provider subject data
69. The critical Member journey now has a real 390x844 local browser acceptance path. One isolated account uses both development OTPs to bind a different-email Substack purchase and restore Pro; another runs the no-charge site subscription through cancel-scheduled, expiry to Free, visible repurchase/recovery controls and reactivation to Pro with zero console errors. The run exposed and fixed two Billing blockers: development completion did not persist a succeeded Checkout payment state, and a historical successful Checkout was treated as processing forever after its associated subscription terminated, hiding the next purchase action. Billing now distinguishes a newer Checkout still awaiting subscription projection from a completed historical attempt whose later terminal subscription is authoritative. This is local isolated-D1 evidence only, not Stripe sandbox, real Substack or production acceptance
70. The v0.12.0 local release gate now runs one privacy scanner over the real static export, versioned repository snapshot, safe log fixtures, error artifacts and aggregate Analytics fixtures. It rejects non-allowlisted email addresses, credential-bearing URLs, secrets and headers, payment-provider object identifiers, private identity/billing/content fields, internal data names and local filesystem paths; runtime artifacts additionally reject IP, OTP and Session values plus raw subscriber CSV rows, while reports contain only category and file location. The audit exposed upstream release and commit email addresses in public Signal summaries and the historical snapshot; public serialization now redacts them, credential-bearing public URLs fail closed, and a narrow host allowlist preserves public kernel mailing-list Message-ID links without allowing general email leakage. The versioned snapshot changed only 114 redactions with identical structure and counts, and 416 real text artifacts scan with zero issues locally. Production logs, Pages/CDN and Analytics receivers remain unverified
71. The two billing sources now share one adapter-level member lifecycle integration. A signed Stripe subscription webhook and controlled Substack full/delta reconciliation create two finite source grants through the normalized inbox, deterministic projector and OR resolver. Stripe cancellation leaves Pro active through Substack; an explicit Substack terminal delta removes the final source and immediately returns the account to Free; a later Stripe reactivation restores Pro. The test never edits the legacy plan or current entitlement records directly and preserves foreign-key integrity. This remains local provider-fixture evidence, not Stripe sandbox or production Substack synchronization
72. The subscription projector now has deterministic concurrency and crash-recovery gates. An expand-safe last_event_order_key orders provider occurrence time, controlled receipt time, restrictive lifecycle rank and event id; losing events remain in the ignored inbox and cannot overwrite the current subscription or source grant. Provider identities produce deterministic internal customer/subscription ids, while D1 triggers require both objects to share one member owner. Tests cover sequential, delayed and concurrent replay, equal-timestamp state/event conflicts, reconciliation plus webhook on one subscription, and legacy backfill alongside a live provider grant. A forced abort at entitlement-event insertion rolls back customer, subscription, inbox, grant and audit writes before the same event retries safely. This is local D1 evidence only, not provider-sandbox or production acceptance
73. The v0.12.0 identity slice now has an executable OTP and Session security matrix. In addition to registration, purpose binding, replay, concurrent single consumption, attempt locking, logout/revocation and fresh-auth binding, local tests prove that email-hour, email-day, device-hour, IP-hour and global-hour budgets fail closed before a code is created and emit aggregate no-PII metrics only. Login verification presented with a caller-selected cookie always issues a new random Session token and id rather than accepting the supplied value. This is local D1 and mock-Email evidence only; production Email Sending and real OTP delivery remain unverified
74. The automated release contract now requires package and product versions to match, exactly one website entry marked released with releaseReady=true, and valid identical dates in the website and repository changelogs. Negative tests reject unreleased, non-ready, empty, impossible, mismatched and duplicate entries, while generated GitHub Release titles now use AIGC.NEWS. An expand-schema compatibility suite also executes the pre-v0.12 Worker column-level SQL and legacy cookie/session path with every v0.12 rollout gate off. It exposed and fixed rolling deployment rejection of sessions created by the old Worker after migration: the new Worker uses session created_at only when the new authenticated_at column is null. The formal version remains v0.11.1; no tag, release or deployment is created by this change
75. The default-off public Pro-sample path no longer depends on an editor hand-writing placeholder JSON. The existing Pro content review workspace lists gated Event/Evidence candidates from the active public projection, then accepts only one to twelve public refs, a controlled decision lens and a slug. The server rebuilds a URL-free model input with no member, Watchlist, payment, provider or free-text profile data, and applies the Decision Brief v2 question, priority, seven-change, one-to-three-action, near-term-action and counter-signal gates. A D1 idempotency record is inserted before model invocation so exact replay returns the same drafted sample without another charge; request, model or validator failure creates no sample. Success remains review-only and never publishes automatically. This has mock-model and local D1 evidence only; no real model or real sample was used and PRO_SAMPLE_PUBLISH_ENABLED remains false
76. The no-charge local Checkout now includes a development-only Manage subscription lifecycle. After simulated payment, the Billing portal returns to a session-owned local page that projects active to cancel-scheduled to expired to active through the real normalized subscription-event inbox and entitlement projector. Pro remains valid before the verified period end, becomes Free on expiry, and returns on reactivation of the same subscription; identical idempotency keys do not create another event, guessed cross-account objects return 404, and provider subscription IDs are never rendered. Every page and API is 404 in production. This proves the local state machine and UI only, not Stripe sandbox, a real Portal, cancellation or revenue
77. Pro Decision Brief generation now has a default-off v2 quality gate. The model receives only a controlled onboarding primary-use lens—company strategy, product planning, investment research, technical diligence, market research or general executive—with no email, free-text profile, organization, payment or provider data. A candidate must ask a concrete decision question, preserve the highest-priority Delta changes in order, show at most seven changes, contain one to three actions with at least one inside 30 days, and include non-empty decision impact, counter-signals and supports/weakens conditions. The same gate applies to Admin approve/correct so manual editing cannot reintroduce oversized or empty output. This is locally verified only; real-model quality, editor samples, preview and recurring delivery remain incomplete
78. Watchlist Delta now uses delta-v2-materiality: a published object is not automatically material, explanatory-only Events and ordinary Trend refreshes count as checked without becoming items, and future Events or revisions are neither emitted nor consumed by the target cursor. Corrections sort first and the default-off hourly maintenance can queue a relevant correction inside the normal 24-hour cadence, while the same input hash folds correction, scheduled and member refresh triggers into one Workflow run. No-change still returns the current thesis and public Watch next. This is locally verified only; production content and maintenance flags remain off, and recurring-content/preview acceptance is incomplete
79. The legacy Member share-template surface is now explicitly an optional publishing add-on, while the Pro page continues to lead only with Watchlist Delta, reviewed Decision Briefs and their archive. Free users on /share and the plan-required compose API return to the first-party /pro value page instead of being told to upgrade for sharing or being sent directly to the external newsletter. The public entry remains closed, this is local code only, and it does not make Pro purchasable
80. The v0.12.0 work now makes the permanently free public-facts boundary executable. Public Event facts and Evidence URLs, published Trends, and every initial, material-shift and correction revision remain on the Public Worker without consulting Member Session, entitlement or Pro-content flags. Anonymous requests and requests carrying invalid Member cookies or Authorization return identical public DTOs with shared public caching and no Cookie variance; public history pagination reaches every published revision. Static validation also requires each published Event page to expose every safe Evidence URL and rejects member-only, entitlement, upgrade or login-continuation gates on Event and Trend output. A local export of 348 Events passes with zero integrity issues. This does not make registration, payment or Pro content operational, and production edge/cache acceptance remains incomplete
81. The default-off v0.12.0 private Watchlist, Delta and Brief paths now have an explicit object-authorization and concurrency attack matrix. A default-Watchlist mutation affects only the Session member; another member who guesses a snapshot or Brief id receives the same non-enumerating 404 and cannot checkpoint, read HTML/API body or write feedback. Two distinct idempotency keys racing the same snapshot and cursor produce exactly one 200 and one 409, one cursor advance and one checkpoint row. Removing the final entitlement makes the next Delta and Brief list/detail/feedback requests return 403 with private no-store, without trusting old client state. The model request is also asserted to omit the current account email/member/Watchlist/provider/Evidence URL and another member's private focus item. These are local D1 tests only; the production audience remains off
82. The default-off v0.12.0 private Brief Admin surface now lists only the latest published, corrected or withdrawn revision per series as a safe summary, and exposes strict detail only for the current editable revision. Withdrawn detail returns a null payload; superseded, review and rejected rows are not readable through this route. Correction and withdrawal retain expected-revision, current entitlement, Delta and Evidence provenance, strict brief.v1 validation and append-only member audit. A 409 keeps the editor contents and focus, while payloads never enter URLs, logs or localStorage. An isolated local D1 browser journey passed published revision 1, corrected revision 2 and body-free withdrawn revision 3 at desktop and 390px with no horizontal overflow and zero console errors or warnings; it also caught and fixed a tab panel whose CSS display overrode hidden. Production publishing remains false, and real-candidate plus preview/production acceptance remain incomplete
83. The default-off v0.12.0 private Delta and Decision Brief path now uses independent versioned JSON Schema artifacts at runtime. Delta snapshot commit and every GET state plus published/corrected Brief serialization fail closed on unknown fields, HTTP or credential-bearing Evidence URLs, HTML and Decision Brief timeframe drift outside 24h, 7d, 30d or 90d. A source prompt-injection corpus covers instruction override, JSON breakout, HTML, URL exfiltration and duplicate-change attacks, proving injected source text remains JSON data and cannot create structural fields, unknown Delta ids or bypass the strict model-output validator. Local contract and runtime DTO tests pass; real-model adversarial and production content-quality acceptance remain incomplete
84. The default-off v0.12.0 billing plane now exposes an Access-approver-only, read-only aggregate reconciliation report. Fixed checks cover normalized duplicate provider identities, legacy Pro without a current finite source, customer/subscription ownership or parallel-active conflicts, unknown states, overdue synchronization and open quarantine grouped by internal reason code. The query never selects or returns email or email hashes, member/provider/payment object ids, subscriber lists, quarantine object/details, actor or raw payload, and reading it cannot grant, revoke, transfer or resolve anything. Local D1, API-role, no-store and privacy tests pass; alert delivery and production reconciliation remain disabled and unverified
85. The default-off v0.12.0 private Member surface now has a static-publishing hard gate. Account, Pro, Billing, Restore, Watchlist, Delta and Brief responses have no-store and noindex contract coverage; public validation fails if Auth, Account, Pro, Restore or Watchlist directories appear in the static root, and scans the Sitemap, News Sitemap, llms.txt, robots.txt plus root RSS, Atom and Feed XML for Member origins, private pages or member API URLs. Public /briefs/:slug samples and /product/ remain allowed. The current local dist passes; production edge and cache acceptance remain incomplete
86. The default-off v0.12.0 Member entry and Pro pages now have a first accessibility and no-JavaScript safety pass. Register and login use native forms with Enter submission, required consent and OTP constraints; Auth, Account, Billing, Restore and Delta mutations expose disabled and aria-busy states, assertive error live regions, network-failure recovery and focused retry fields. Without scripts, Auth and Restore hide native forms so email cannot fall into a default GET, Billing performs no mutation, and committed server HTML remains readable. Local 390x844 browser checks passed the two-step OTP Enter flow, Auth, Account, Billing, Restore and closed-Brief overflow and 44px targets, 3px Tab focus, Restore 503 recovery and key no-script states. Real screen-reader, keyboard and no-script content-state coverage for Watchlist, committed Delta and Brief detail plus production acceptance remain incomplete
87. The default-off v0.12.0 private Delta and Decision Brief routes now share one server-side Pro authorizer with a fixed fail-closed order: valid Session, feature and audience, rollout allowlist, capability entitlement, then object ownership. A closed rollout no longer advertises an unavailable upgrade to Free members, an allowlist miss does not reveal entitlement state, and only an open audience returns the entitlement-required upgrade boundary. The signed-in Brief closed state returns to Watchlist instead of asking the member to sign in again. Delta and Brief API, HTML, feedback, downgrade and cross-account reads remain private no-store and ownership-scoped, with off/free/allowlist matrix tests passing locally
88. The default-off v0.12.0 Stripe Checkout path now stores an allowlisted checkout-event inbox and separates Session lifecycle from payment state. Completed-unpaid, async-payment-succeeded, async-payment-failed and expired events converge to pending, succeeded, failed and abandoned without granting Pro; provider occurrence time prevents late completion or expiry from regressing newer facts, exact event replay is a no-op and a reused event id with changed normalized facts is quarantined. A linked PaymentIntent reuses the common payment-alias ledger, while subscription-mode Sessions without one wait for Invoice facts instead of fabricating a payment. Billing reads the persisted state after the return query disappears, suppresses repeat purchase while verification is pending, and exposes failed or expired recovery honestly. Migration-upgrade, recovery, ordering, replay, mismatch, missing-PaymentIntent and no-early-entitlement tests pass locally; Stripe sandbox/live and a real asynchronous payment method remain unverified
89. The default-off v0.12.0 invite-only Checkout gate now uses finite D1 grants instead of an unaudited environment-variable member list. Only an active member with an unexpired grant can see a purchase control or create Checkout while SITE_CHECKOUT_MODE is allowlist. Cloudflare Access approvers use expected-version grant, up-to-90-day renewal and revoke mutations whose conditional audit insert shares the same D1 batch; expired, revoked, stale-version, editor, wrong-Origin and legacy environment-list attempts fail closed. Admin DTOs omit member email and public export forbids the table name. Production mode remains off
90. The default-off v0.12.0 Billing and Restore surface now has purpose-specific HMAC rate buckets for same-email claim, dual-email Restore request/verify, Checkout and Portal. Restore limits member, IP, global and target purchase email scopes, including a three-per-day target ceiling across rotating accounts and IPs; replaying the same idempotency key does not count or send again. D1 stores only action, dimension, a 64-character HMAC scope, bucket and count, maintenance removes buckets after 48 hours, and public export treats the table name as forbidden. This has local tests only; production gates remain off
91. The default-off v0.12.0 entry funnel exposes Sign in and Start free on public desktop, mobile More and the footer, then sends verified Free members directly to Watchlist; one-to-six topic management now lives on that retained-use surface, while /onboarding remains an optional compatibility page instead of a first-reading gate. A development-only checkout simulator is available only when environment, dev OTP and dev checkout gates all agree, labels itself as no-charge, and reuses the real subscription/payment event projectors so the isolated local journey can prove Free, checkout, Pro entitlement, Delta/no-change and Billing without fabricating Stripe sandbox or revenue evidence. The full desktop path plus 390px critical states completed with zero console errors. Maintenance deletes OTP HMAC rate buckets older than 48 hours. Production registration, checkout, content, Substack and maintenance gates remain off, and real Email, Stripe sandbox, alert delivery and preview/production acceptance are still incomplete
92. The default-off v0.12.0 public Pro-sample path now accepts only strict content plus Event/Evidence references that resolve in the active public projection. Draft, publish, correction and withdrawal are immutable expected-revision records; publication atomically writes a dedicated public version and current pointer with an audit row that has no member link. The public Worker reads only those public projection tables through /api/v1/pro-samples/:slug and /briefs index/detail, revalidates the current pointer with revision ETags, and returns a body-free withdrawal DTO instead of a stale sample when Evidence changes. An Access-protected Admin workspace now lists latest revisions, edits strict public input, publishes/corrects/withdraws samples and exposes only safe summaries for private Brief approve/reject. Withdrawn Admin detail is read-only and cannot recover superseded body content. An isolated local D1 browser journey passed draft, publish, correction, withdrawal, desktop/390px rendering and zero console errors. Email, member/Watchlist/private-Brief/run/payment/provider identifiers, unknown Evidence and stale projection refs fail closed. No real sample has been created or released, PRO_SAMPLE_PUBLISH_ENABLED remains false, and preview edge/cache plus content-value acceptance remain incomplete
93. The first private v0.12.0 value slice now has a single versioned Watchlist, per-item active-public-projection baselines, explicit cursors and optimistic mutation guards, so existing history is not mislabeled as a first-time change and newly added items start at their join point. /watchlist/delta and its v1 APIs re-check server-side watchlist.delta entitlement plus PRO_CONTENT_AUDIENCE and PRO_DELTA_ENABLED before every private read or mutation. A deterministic compiler pins projection/input hash, compares intrinsic Event timestamps and per-Trend revision numbers so a projection copy cannot fabricate change, resolves real public Trend DTO Evidence, persists ready/no-change/pending/stale/failed envelopes, and advances only through an exact snapshot/watchlist/cursor/projection checkpoint. Member requests only create queued runs; a dedicated MemberContentWorkflow retries bounded compilation, re-checks audience and entitlement before execution and commit, permits same-input retries after failure, and then runs a default-off model Brief step. The model receives only a rebuilt, URL-free Delta input with no member, payment or provider data; strict versioned output validation rejects unknown or duplicate Delta IDs, URLs, HTML and extra fields, while Evidence is rebound from the server ledger. Missing model configuration, request failure or invalid output fails only the Brief run and never publishes a filler or invalidates the verified Delta. Valid output remains review-only until Admin approve/reject/correct/withdraw re-checks the publish flag, current entitlement, expected revision, Evidence ledger and Delta provenance; the Admin surface now exposes safe summaries, approve/reject and current-revision correct/withdraw controls. A separate default-off hourly maintenance handler folds due entitled Watchlists into the same input hash, recovers stale queued/running jobs, and records aggregate-only retention runs while clearing Delta payloads after 90 days, Pro Brief payloads after 12 months of continuous access or a 90-day post-downgrade recovery window, unreferenced run metadata after 30 days and member audit rows after 180 days. After the 24-hour account-deletion window it atomically removes identity, OTP, sessions, preferences, Watchlist/Delta/Brief/feedback and current grants per member while detaching retained subscription/payment/refund/dispute facts from member and email; one failed account is isolated for the next retry. Expired Delta rows return stale and cannot advance cursors. Alert delivery, real-candidate and public-sample content, preview crash recovery, deletion-SLA and production availability remain incomplete, and all production content and maintenance flags stay off
94. v0.12.0 billing and entitlement implementation now has a local-only, provider-neutral ledger for customers, checkout intents, subscriptions, payments, normalized subscription/payment events, current grants, append-only entitlement events, reconciliation runs/items, claim challenges and quarantine. Existing legacy Pro/Founding rows receive only a finite 90-day manual_legacy review grant and never become fabricated payments. Session, Account, Billing and legacy member-share gates resolve independent Stripe, Substack and manual sources server-side instead of trusting members.plan. The first Stripe adapter creates server-mapped Hosted Checkout and Portal sessions, verifies raw-body webhooks, projects subscription lifecycle, and never grants from a success redirect. Invoice, Refund and Dispute events converge through allowlisted PaymentIntent, Charge, InvoicePayment and Invoice aliases; partial/full refunds and disputes update payment facts without inferring that an otherwise active subscription has ended, and Billing/Account export expose only safe summaries. Billing now renders processing, canceled return, scheduled cancellation, past-due, partial/full refund, dispute, failure, expiry and duplicate-source states from verified ledgers; an unverified Checkout return suppresses repeat-purchase controls, while delayed Substack imports direct the member to wait for reconciliation or use Restore. The Substack path locally normalizes allowlisted columns from the official Subscriber Dashboard CSV before an Access/approver Admin reconciliation applies full or delta runs, row-count protection and finite 72-hour leases; free rows never create billing objects and gift/comp/trial access never becomes reported revenue. Same-email pending purchases can be claimed atomically during registration or refreshed later, while /restore-access binds two OTPs to one member/session/customer for different-email recovery. Production DIRECT_REGISTRATION_ENABLED, SITE_CHECKOUT_MODE, SUBSTACK_RESTORE_ENABLED and Admin SUBSTACK_RECONCILIATION_ENABLED remain off; no remote migration, provider sandbox/live acceptance, real payment/refund or Pro content availability is claimed
95. The underlying v0.12.0 account core still includes the earlier default-off direct-registration and purpose-bound OTP slice for recovery and compatibility: new-email OTP can atomically record policy, Free member, consent, audit and a secure Session in controlled environments; Account can append communication consent, export only the signed-in DTO, and queue version-checked deletion while revoking every Session. HMAC challenges, enumeration-safe responses, layered email/daily-rotating-device/IP/global limits, replay protection, fresh-auth binding and deletion integrity have local D1/mock-email coverage. Hourly abuse metrics contain only metric, purpose, dimension and count; no scope hash, email, IP, device or challenge is stored. Production D1 migrations 0011–0024 were subsequently applied, but public direct OTP registration remains disabled, /register is now only a compatibility redirect, migration 0025 is not applied, and no production deletion-SLA, real-email, payment-provider, Substack or Pro-content acceptance is claimed
96. The v0.12.0 Pro Beta docs-first specification now defines planned direct email-OTP registration, a first-party checkout adapter, Substack purchase reconciliation and access recovery, server-side subscription entitlements, Watchlist Delta, evidence-linked Pro Decision Briefs, privacy boundaries, operational recovery and real-payment acceptance gates; none of these planned capabilities are represented as released, and the formal product version remains v0.11.1
97. The public product is now explicitly English-only: earlier plans for an indexable Chinese /zh mirror are superseded, and neither the current product nor v0.12.0 restores /zh or /zh/* product routes
98. Public X sharing now uses credential-free Web Intents: readers can share the current three-story homepage brief, an individual homepage Event, or an Event detail only after confirming in X; static export and live Worker hydration use the same bounded public-field copy and canonical URLs, while the separate Pro template code remains an unpublished entitlement
99. SEO now expands beyond the AIGC News brand query: the homepage explicitly serves AI news intent while preserving evidence-led differentiation; only Events that pass evidence, observable-change, and decision-depth gates remain indexable, with accurate per-Event modification dates, a 48-hour Google News Sitemap, large-image metadata, and a first-party About & Editorial page that explains responsibility, AI assistance, and the Decision Brief relationship
100. Hourly collection now uses recoverable leases: workflow-start failures are written back immediately, stale queued jobs without an instance are failed after five minutes, and inactive queued/running jobs are recovered after thirty minutes so one orphaned record cannot freeze the public projection
101. Decision Brief now treats the official Substack RSS feed as the public source of truth: the Worker exposes an allowlisted latest-post DTO and atomically hydrates the dated sample on /newsletter/ with a 24-hour daily edge cache, while timeout, redirect, size, origin, or schema failures preserve the complete versioned static fallback; new posts may take up to one day to appear, and publishing, audience selection, and final Send remain manual in Substack
102. The public site now prioritizes visitor retention without overstating the newsletter: homepage briefs require a concrete material change and distinguish publishers from hosting platforms; a local Decision Brief explainer with a dated public sample follows the three deep reads, explicitly discloses the external Substack page's legacy weekly wording, and routes Event or Trend subscription intent through the local contract first; static Events no longer expose an ungated Pro share prompt, and dynamic navigation points Verifiable Actions to the real Scout route; Event and Trend details restore full navigation, evidence context, and related exits; Signals opens with five source-distinct leads and category breadth first, while Scout and Sources use ranked small batches before accessible progressive disclosure; mobile navigation keeps Today, Trends, Timeline, Brief, and More with 44px targets and managed focus
103. The homepage now opens with a three-story jump index and explicit selection rationale; verified Event updates show four items first on mobile and expand to eight while preserving real 24-hour / 7-day / 30-day totals; Trend Pulse adds what to watch next, the top bar focuses on three primary routes plus trend customization and Newsletter, source and date labels are more precise, and unsupported weekly promises have been removed
104. The homepage now has three deliberate reading depths: three full decision briefs, a live published-Event update ledger with 24-hour / 7-day / 30-day windows and server totals, and one 7-day / 30-day Trend Pulse that labels unchanged reviews explicitly; top-three Events are deduplicated, verified updates require primary evidence or two independent sources, and Signals or future/invalid-time Events never enter the homepage
105. Homepage and footer guidance typography now sits below editorial content: the completion note, Newsletter prompt, method disclosure, footer statement, wordmark and weekly-brief link use compact responsive sizes while Event headlines keep their existing hierarchy
106. The homepage is now a continuous 5–8 minute daily decision brief: three ranked Events each show What happened, Why it matters, and What to watch next; evidence opens in place, static export and Worker hydration share the same materiality ranking, random judgments are removed, and the Newsletter appears after the main reading flow
107. The earlier parallel 0.0.x-to-0.1.0 commercial numbering is superseded by the repository's single SemVer line and the planned v0.12.0 Pro Beta specification; historical planning no longer names future releases

New Capabilities

What Changed

1. Improved the public reading experience and strengthened the underlying editorial workflow.

New Capabilities

What Changed

1. Improved the public reading experience and strengthened the underlying editorial workflow.

New Capabilities

What Changed

1. Improved the public reading experience and strengthened the underlying editorial workflow.

New Capabilities

What Changed

1. Improved the public reading experience and strengthened the underlying editorial workflow.