# Changelog

## Score

- CAI 59 → 61 (+2.1)
- Rubric changed (rubric-2026.09.10 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 85 → 85 (-0.6)
- Architecture 100 → 96 (-3.8)
- Maturity 63 → 63 (-0.1)
- Readiness 81 → 80 (-1.0)
- Security 50 → 56 (+6.2)
- Event Sourcing 100 → 100 (+0.0)
- Accessibility 54 → 54 (+0.0)
- Performance 91 (new)

## Resolved (29)

- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (no pnpm-resolved versions to grade)
- Documentation: no installation or build instructions (README.md)
- Documentation: no installation or build instructions (crates/koharu-ml/benches/fixtures/inpaint/README.md)
- Documentation: no project overview (crates/koharu-ml/benches/fixtures/inpaint/README.md)
- Documentation: no usage examples (README.md)
- Duplicated block (24 lines × 6) (crates/koharu-translator/src/remote/atlas_cloud.rs)
- Duplicated block (6 lines × 2) (crates/koharu-app/src/commands/project.rs)
- Duplicated block (9 lines × 4) (crates/koharu-pipeline/src/stages/inpainting.rs)
- FileTooLong: editor/PageRail.tsx (packages/koharu/components/editor/PageRail.tsx)
- Hotspot: crates/koharu-app/src/commands/agent/host.rs (crates/koharu-app/src/commands/agent/host.rs)
- Hotspot: crates/koharu-app/src/commands/project.rs (crates/koharu-app/src/commands/project.rs)
- Hotspot: crates/koharu-canvas/src/web.rs (crates/koharu-canvas/src/web.rs)
- Hotspot: crates/koharu-llama/src/context/params.rs (crates/koharu-llama/src/context/params.rs)
- Hotspot: crates/koharu-ml/src/bin/pp_doclayout_v3.rs (crates/koharu-ml/src/bin/pp_doclayout_v3.rs)
- Hotspot: crates/koharu-pipeline/src/stages/detection.rs (crates/koharu-pipeline/src/stages/detection.rs)
- Hotspot: crates/koharu-rasterizer/src/compositor.rs (crates/koharu-rasterizer/src/compositor.rs)
- Hotspot: crates/koharu-runtime/src/hardware/hip/linux.rs (crates/koharu-runtime/src/hardware/hip/linux.rs)
- Hotspot: crates/koharu-scene/src/change.rs (crates/koharu-scene/src/change.rs)
- Hotspot: crates/koharu-scene/src/patch.rs (crates/koharu-scene/src/patch.rs)
- Hotspot: crates/koharu-torch/src/tensor/npy.rs (crates/koharu-torch/src/tensor/npy.rs)
- …and 9 more

## New (42)

- Dependency source pinned to a moving git ref
- Duplicated block (24 lines × 5) (crates/koharu-translator/src/remote/deepseek.rs)
- Duplicated block (9 lines × 4) (crates/koharu-pipeline/src/stages/inpainting.rs)
- FileTooLong: src/bubble.rs (crates/koharu-renderer/src/bubble.rs)
- High CVE: [GHSA redacted] (bun.lock)
- High CVE: [GHSA redacted] (bun.lock)
- High CVE: [GHSA redacted] (bun.lock)
- Hotspot: packages/koharu/components/controls/FontPicker.tsx (packages/koharu/components/controls/FontPicker.tsx)
- Hotspot: packages/koharu/components/controls/ModelPicker.tsx (packages/koharu/components/controls/ModelPicker.tsx)
- Hotspot: packages/koharu/components/controls/OutputPicker.tsx (packages/koharu/components/controls/OutputPicker.tsx)
- Hotspot: packages/koharu/components/editor/AgentPanel.tsx (packages/koharu/components/editor/AgentPanel.tsx)
- Hotspot: packages/koharu/components/editor/CanvasOverlay.tsx (packages/koharu/components/editor/CanvasOverlay.tsx)
- Hotspot: packages/koharu/components/editor/PageRail.tsx (packages/koharu/components/editor/PageRail.tsx)
- Medium CVE: [GHSA redacted] (bun.lock)
- Medium CVE: [GHSA redacted] (bun.lock)
- Medium vulnerability: RUSTSEC-2026-0285 (Cargo.lock)
- Members sharing a duplicated core (5 members, 50+ identical tokens) (crates/koharu-translator/src/remote/deepseek.rs)
- ModelPicker.ModelPicker (cognitive 24) (packages/koharu/components/controls/ModelPicker.tsx)
- ModelPicker.ModelPicker (cyclomatic 27) (packages/koharu/components/controls/ModelPicker.tsx)
- Off the main sequence: @koharu/ui
- …and 22 more

## Changes since last survey

- 27 commits — 16 feature/other, 11 fixes

## By area

- (root) — 14 commits
- packages/koharu — 4 commits
- .github/workflows — 3 commits
- .github/sponsorkit — 2 commits
- crates/koharu-app — 2 commits
- crates/koharu-renderer — 1 commit
- crates/koharu-translator — 1 commit

## Notable commits

- fix: Revert "fix(ci): recover incomplete release asset uploads"
- fix: chore(deps): use upstream Tauri plugins after updater fix
- fix: fix(app): skip Windows store configuration in debug builds
- fix: fix(canvas): preserve authored text rotation
- fix: fix(ci): install GTK 4 for Tauri v3
- fix: fix(ci): recover incomplete release asset uploads
- fix: fix(deps): align gpu-allocator Windows bindings
- fix: fix(deps): pin patched updater for macOS
- fix: fix(desktop): force X11 ozone platform for Linux CEF (#1110)
- fix: fix(renderer): preserve joined balloon text placement
- fix: fix(translator): cache model-listing client with five-second timeout (#1103)
- change: chore(deps): pin latest Tauri v3 and plugins commits
- change: chore(deps): track hf-hub main branch
- change: chore(deps): update Tauri CEF to 3.0.0-alpha.2
- change: chore(deps): upgrade Tauri to v3 alpha
- change: chore(deps-dev): bump @types/node from 26.4.0 to 26.5.0 (#1081)
- change: chore(release): 0.83.0
- change: chore(release): 0.83.1
- change: chore(release): 0.83.2
- change: chore(release): 0.83.3
- …and 7 more