# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 59 → 52 (-6.2)
- Rubric changed (rubric-2026.08.25 → rubric-2026.09.4) — scores are not directly comparable.

## Lenses

- Code Health 56 → 42 (-14.5)
- Architecture 88 → 88 (-0.1)
- Maturity 63 → 63 (-0.0)
- Readiness 57 → 57 (+0.0)
- Security 84 → 87 (+3.6)
- Domain Modelling 60 → 65 (+5.6)
- Event Sourcing 100 → 100 (+0.0)
- Accessibility 59 → 59 (+0.0)
- Performance 71 → 71 (+0.0)

## Resolved (32)

- Duplicated block (5 lines × 3) (src/Imprint.Editor/Api/AuthoringApi.cs)
- H (cognitive 36) (widgets/cai-score-card.js)
- H (cyclomatic 28) (widgets/cai-score-card.js)
- IL efficiency: 15 authored method(s) exceed the IL budget (src/Imprint.Editor/Api/AuthoringApi.cs)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- The concept of a container node is named 'Copy' in one parameter and 'container' in another. 'Copy' is likely a typo or misnomer for 'container' given the context of node hierarchy, whereas 'container' is the standard semantic term used elsewhere (e.g., Imprint.Authoring.Domain.Pages.IContainerNode).
- The domain model specification is authoritative but does not state where to find the test suite or how tests are run. (docs/domain-model.md)
- U (cyclomatic 19) (widgets/cai-card-gallery.js)
- cardFromGallery (cyclomatic 19) (widgets/_src/live.js)
- normalize::walk (cognitive 22) (src/Imprint.Editor/wwwroot/js/rich-toolbar.js)
- onKeyDown (cyclomatic 16) (src/Imprint.Editor/wwwroot/js/canvas-interop.js)
- …and 12 more

## New (24)

- (anonymous) (cognitive 30) (tools/mobile-sweep.js)
- AuthoringNodeJson.ApplyProps (cognitive 16) (src/Imprint.Editor/Api/AuthoringNodeJson.cs)
- AuthoringNodeJson.ParseLink (cognitive 20) (src/Imprint.Editor/Api/AuthoringNodeJson.cs)
- Duplicated block (20–21 lines × 2) (src/Imprint.Rendering/RichTextHtml.cs)
- Duplicated block (4–5 lines × 4) (src/Imprint.Editor/Api/AuthoringApi.cs)
- H (cognitive 37) (widgets/cai-score-card.js)
- IL efficiency: 17 authored method(s) exceed the IL budget (src/Imprint.Editor/Api/AuthoringNodeJson.cs)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (src/Imprint.Editor/Mcp/ImprintAuthoringMcpTools.cs)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (tools/ContentSeeder/BlockMapper.cs)
- Members sharing a duplicated core (9 members, 50+ identical tokens) (tools/ContentSeeder/BlockMapper.cs)
- No dependency advisory monitoring
- The parameter name 'Node Copy' contains a space, which is non-standard for C# identifiers and likely a typo or copy-paste artifact. It refers to the same concept as the type 'Node' or a copy of it.
- TooManyMethods: Site (src/Imprint.Authoring/Domain/Sites/Site.cs)
- normalize::walk (cognitive 23) (src/Imprint.Editor/wwwroot/js/rich-toolbar.js)
- paint (cognitive 22) (widgets/cai-survey-list.js)
- paint (cognitive 26) (widgets/_src/cai-survey-list.js)
- paint (cyclomatic 24) (widgets/_src/cai-survey-list.js)
- paint (cyclomatic 24) (widgets/cai-survey-list.js)
- render (cognitive 16) (widgets/cai-language-board.js)
- render (cognitive 19) (widgets/cai-survey-list.js)
- …and 4 more

## Changes since last survey

- 22 commits — 16 feature/other, 6 fixes

## By area

- src/Imprint.Rendering — 8 commits
- src/Imprint.Publishing — 5 commits
- src/Imprint.Authoring — 3 commits
- src/Imprint.Editor — 2 commits
- tests/Imprint.Publishing.Tests — 2 commits
- tools/mobile-sweep.js — 1 commit
- widgets/_src — 1 commit

## Notable commits

- fix: fix(cai-survey-list): drop the "bus factor 1" chip from the project cards
- fix: fix(chrome): breakpoint at 1080px, where the bar measurably stops fitting
- fix: fix(chrome): every nav dropdown is the same width
- fix: fix(chrome): nav labels never break, and the burger takes over before they must
- fix: fix(chrome): the nav dropdowns are readable, and the brand font loads
- fix: fix(publishing): the publisher honours the site's chosen home page
- change: Asset links: a file download that survives publishing
- change: Base: border-box everywhere
- change: Chrome: centered cards clamp to the section; long tokens may break
- change: Chrome: honest island fallbacks; wide figures scroll on phones
- change: Chrome: mobile nav, honest kickers, inline SVG brand, styled code blocks
- change: Chrome: overflow-wrap anywhere, not break-word, in prose
- change: Chrome: round-two mobile clamps, and the stylesheet pays its own way
- change: Chrome: the mobile header must FIT
- change: MCP: unpublish_page — take a page out of the output, keep the draft
- change: Preview plane renders page drafts, not the published projection
- change: Table node + page article declarations for structured data
- change: Widget fallback carries a real link to the live view
- change: feat(authoring): a page has a readable history, and can be put back to a revision
- change: feat(authoring): the API can delete a page, not only create one
- …and 2 more

## API surface

- 3 added · 0 removed (a removed endpoint is potentially breaking)

## Added endpoints (3)

- DELETE /api/authoring/pages/{pageId}
- GET /api/authoring/pages/{pageId}/history
- POST /api/authoring/pages/{pageId}/restore/{version}

## Architecture

- Unchanged — 3 containers · 6 contexts · 8 edges