CHANGELOG.md

# Changelog

All notable changes to this repository are documented here. All `@sigx/lynx-*` packages share a single lockstep version — one entry per release covers every package.

## [Unreleased]

## [0.35.0] - 2026-10-07

### Added

- **`@sigx/lynx-core`: `getRandomBytes(length)`** ([#1337](https://github.com/signalxjs/lynx/issues/1337)). It returns cryptographically secure random bytes synchronously. It uses `crypto.getRandomValues` where the runtime has it, and otherwise the platform CSPRNG through core's `SigxCore` module: `SecRandomCopyBytes` on iOS, `SecureRandom` on Android. `SigxCore` is linked in every build, so apps no longer need their own native random-bytes bridge. There is no weak fallback. Errors are a `SigxError` with `invalid_argument` (a length outside 1–1024) or `no_random_source`.
- **`@sigx/lynx-zero`: `FileUpload`, `Chat` and `ChatLog`** ([#1276](https://github.com/signalxjs/lynx/issues/1276)). These are Wave 5 scopes of the zero fidelity campaign (#1140), on zero's `file-upload`, `chat` and `chat-log` anatomies. `FileUpload` has the parts `Root`, `Label`, `Trigger`, `ClearTrigger`, `Dropzone`, `ItemGroup`, `Item`, `ItemName`, `ItemSize` and `ItemRemove`, over a files model (`model` / `defaultFiles` / `filesChange`). Lynx has no file input, so the root takes a `pick({ accept, multiple, types })` callback. A `@sigx/lynx-file-picker` result passes straight through, and lynx-zero adds no native dependency. zero's constraints run on every pick: `accept`, `maxFiles`, `minFileSize`, `maxFileSize` and `validate`, reported through `filesReject`. `multiple` appends and dedupes, and single mode replaces. The field context and press feedback work on every button. Drag-and-drop is web-only, and `highlighted` is reachable through `ForceStates` only. `Chat` (`Root` / `Avatar` / `Header` / `Bubble` / `Footer`) stamps `placement` on the root. Lynx has no grid, so the avatar hangs out of flow, and the root reserves its measured width (`avatarGap`). `ChatLog` (`Root` / `Content` / `JumpTrigger`) renders a native scroll-view in Content that follows its tail: a content height change scrolls to the end, with a bounded settle. Scrolling up past `threshold` lets go and shows the jump trigger. It takes `model:following`. The showcase zero gallery adds `file-upload`, `chat` and `chat-log` sections for every colour and size against their states, plus the extras `file-upload/dropzone`, `/list` and `/live`, `chat/thread` and `/long`, and `chat-log/live`. The daisy skin's lynx targets are [signalxjs/zero#509](https://github.com/signalxjs/zero/pull/509) and arrive with the batched zero bump: flex rows in place of grid, the placement tail corner, the physical jump-trigger padding, and the press and focus rings.
- **`@sigx/lynx-zero`: `Combobox`** ([#1278](https://github.com/signalxjs/lynx/issues/1278)). This is a Wave 5 scope of the zero fidelity campaign (#1140), on zero's `combobox` anatomy: the native `<input>` over Select's portalled list, filtered as you type by zero's listbox core. `Combobox.Root` is data-driven like Select (`items` plus the collection accessors, `filter`, including `false` for a server-filtered list). It has three models: the value (`model`, an array under `multiple`), `model:inputValue` and `model:open`. It takes `multiple` (a tag with a remove button per value, before the field), `clearable` (zero#321), `loading` / `loadingText` and `emptyText`, `allowCustom`, `autoHighlight` (Enter, the keyboard's confirm key, commits the highlighted match), `openOnClick`, `groupSeparators`, and the `item` and `tag` slots. A single pick fills the text, closes the list and puts the keyboard away. Every close resyncs the text the way zero does (#265). The trigger toggles the list without raising the keyboard. The list flips above its field when the soft keyboard would cover it, through a new `avoidKeyboard` option on the anchor position. Inside a Dialog it follows the dialog's keyboard lift. `focus-visible` follows native focus, and `pressed` lands on the trigger, the options and a tag's remove. Arrow keys, the tag keyboard, trigger mode, inline completion and windowing stay web-only. The showcase zero gallery adds `combobox` sections for every colour and size, plus the `open`, `open-held`, `open-query`, `open-color`, `empty-loading` and `tags` extras. The daisy skin's lynx target for the scope is [signalxjs/zero#508](https://github.com/signalxjs/zero/pull/508) and arrives with the next zero pin: explicit ink and placeholder colour on the native field, box-shadow rings, centred glyph buttons, held washes, the accent restated on the portalled popup, and select's width bounds. Until then the pinned 0.15.0 keeps the web's 13rem floor and inherited ink.
- **`@sigx/lynx-zero`: `Drawer` and `Tooltip`** ([#1277](https://github.com/signalxjs/lynx/issues/1277)). These are Wave 5 overlay scopes of the zero fidelity campaign (#1140), on zero's `drawer` and `tooltip` anatomies. `Drawer` has the parts `Root`, `Trigger`, `Panel`, `Title` and `Close`, and the `backdrop` pseudo part renders as a real view in the `ZeroRoot` outlet, as Dialog's does. `placement` is `start`, `end`, `top` or `bottom`. The component lays the panel on its edge with flexbox from the outlet, because lynx resolves neither the recipe's logical insets on Android nor its `100dvh` / `85dvh`. A side panel is full height and 85% of the window wide under the skin's cap, or `measure` (px or `full`). A top or bottom sheet is full width and at most 85% of the window's height. The panel's content is padded by the safe frame on the edges it touches, lifts above the keyboard, and scrolls. `close` reports `close` (with the Close's `value`), `backdrop`, `escape` (the back button) or `programmatic`. `modal={false}` renders the panel in place (`data-l-dock="inline"`). The responsive `modal={{ below }}` mode, swipe to dismiss and focus management are not carried. `Tooltip` has the parts `Root`, `Trigger`, `Popup` and `Arrow`. It opens on a long press, because a touch screen has no hover, and closes `closeDelay` after the finger lifts (default `TOOLTIP_CLOSE_DELAY`, 1500 ms). It is anchored like Popover and takes no light-dismiss surface or back press. `Tooltip.Arrow` places itself at the trigger's centre on the popup edge that faces it (`LynxAnchorPosition.arrow()`). `partBag` gained a `layout` option (`data-l-*` plus `zx-l-*` classes), and `expectClassGrammar` checks those classes. The showcase zero gallery adds `drawer` and `tooltip` entries. The daisy skin's lynx targets are in [signalxjs/zero#506](https://github.com/signalxjs/zero/pull/506) and arrive with the batched zero bump: the panel cap, the slide keyframes, the physical corners, the buttons' pressed rendering and the arrow's paint.
- **`@sigx/lynx-zero`: `Carousel` and `Table`** ([#1279](https://github.com/signalxjs/lynx/issues/1279)). These are Wave 5 complex scopes of the zero fidelity campaign (#1140), on zero's `carousel` and `table` anatomies. `Carousel` pages through slides in a native `<scroll-view scroll-orientation="horizontal" paging-enabled>`. The active index follows real scroll, and setting the `model` (a prev/next trigger, a dot or the app) glides the viewport there through its `scrollTo` UI method. Slides take the viewport's measured width. Prev/next clamp and are disabled at their bounds. Each trigger and dot has its own press feedback. `Table` has no `<table>` or grid to build on, so its parts are flex `view`s. A cell takes its column's width (`columns`: px, `%` or a share of the slack) by its place in the row, and `colSpan` covers several columns. A spec of fixed-width columns makes the root a horizontal scroller. Plain string content is wrapped in `<text>`. `sortable` header cells cycle `model:sort` through a pressable `sort-trigger` with the ▲ `sort-indicator` (`nextTableSort` is exported). Lynx has no `:nth-child`, so under the `zebra` mod lynx-zero stamps each even, unselected body row `stripe`. `stack` (`true` or a breakpoint name) is resolved against the screen width, and a stacked table stamps `stacked` and prints each cell's column label (`cell-label`). The gallery covers both scopes (`/zero-gallery/carousel`, `/zero-gallery/table`). The daisy lynx targets are [signalxjs/zero#510](https://github.com/signalxjs/zero/pull/510) and arrive with the next zero bump.
- **`@sigx/lynx-zero`: `Pagination` and `Steps`** ([#1258](https://github.com/signalxjs/lynx/issues/1258)). These are Wave 4 navigation scopes of the zero fidelity campaign (#1140), on zero's `pagination` and `steps` anatomies. `Pagination.Root` renders its own row from `count` and the `page` model (`model` / `defaultPage` / `pageChange`). The row is zero's constant-width window: boundary pages, siblings around the current page, and ellipses. It takes `siblingCount`, `boundaryCount`, `withEdges` (the first/last triggers) and the reader labels. Every page and trigger is a `button`-trait view with its own press feedback. A trigger at its bound is disabled, and the current page is announced as `selected`. Steps has the parts `Root`, `Item`, `Indicator`, `Separator`, `Title`, `Description`, `Content`, `PrevTrigger` and `NextTrigger`. Its model is the `step` (`model` / `defaultStep` / `stepChange`). The root derives `complete` / `active` / `inactive` from the items' mount order, and an item can re-carry `color`. It also takes `linear` gating, `invalid` steps (with `invalidLabel`) and `orientation`. Only the active step's panel renders. Prev/Next move to the nearest enabled step and are disabled at a bound. Lynx has no `:has()`, so the root stamps `wizard` while a panel or trigger is mounted. zero's link mode, landmark and group names, roving focus and `lazyMount` are not carried. The showcase zero gallery adds `pagination` and `steps` sections for every colour and size against their states, plus the `pagination/window` and `steps/vertical`, `steps/wizard` and `steps/colors` extras. The daisy skin's lynx targets are in [signalxjs/zero#482](https://github.com/signalxjs/zero/pull/482) and arrive with the 0.15.0 pin: physical cell, disc and line sizes, the baked complete-disc tint, the separator bridging disc edge to disc edge, and the `wizard` wrap.
- **`@sigx/lynx-zero`: `Navbar` and `Breadcrumbs`** ([#1257](https://github.com/signalxjs/lynx/issues/1257)). These are Wave 4 navigation scopes of the zero fidelity campaign (#1140), on zero's `navbar` and `breadcrumbs` anatomies. `Navbar` (`Root` / `Start` / `Center` / `End`) is pure composition: every section is optional, and `color` / `size` ride every part. `Breadcrumbs` has the parts `Root`, `List`, `Item`, `Link`, `Separator`, `Ellipsis` and `EllipsisTrigger`. A `Link` is a tap target that emits `press` (lynx has no `href`), has the `link` trait, and stamps `active` when `current` (announced `selected`). The separator is a real `<text>` part, `/` by default, because lynx drops daisy's `::before`. With `maxItems`, a long trail collapses: the middle items (`itemsBeforeCollapse` / `itemsAfterCollapse`, 1 each by default) render nothing, and the `Ellipsis` renders in their place. Its trigger has the `button` trait, tier-2 press feedback and the `pressed` flag, and a tap sets `model:expanded`. The collapse rule is exported as `breadcrumbsHidden()`. Items join the trail in mount order. Landmarks, `asChild` and the web's keyboard focus handling are not carried. The showcase zero gallery adds `navbar` and `breadcrumbs` sections for every colour and size, plus the `navbar/compose` and `breadcrumbs/collapse` extras. The daisy skin's lynx targets for these scopes are [signalxjs/zero#480](https://github.com/signalxjs/zero/pull/480) and arrive with the 0.15.0 pin: explicit rows, the navbar's `min-height` ramp, and the ellipsis trigger's pressed ink and focus ring.
- **`@sigx/lynx-zero`: `Menu` and `NavList`** ([#1259](https://github.com/signalxjs/lynx/issues/1259)). These are Wave 4 navigation scopes of the zero fidelity campaign (#1140), on zero's `menu` and `nav-list` anatomies. `Menu` has a trigger and an anchored popup in the `ZeroRoot` outlet. The popup can hold items (`onSelect` on the root reports their `value`), a `Shortcut` hint, a `Separator`, a `Group` with a `GroupLabel`, `CheckboxItem` rows and a `RadioGroup` of `RadioItem`s (each shows an `item-indicator` ✓ and stays open by default), and tap-opened submenus (`Sub` / `SubTrigger` / `SubPopup`). A tap outside every level closes the whole menu, and `dismissTopLayer` closes the innermost level first. Lynx has no hover, so the row under the finger is stamped `highlighted` and `pressed`. On a portrait phone a submenu slides back over its parent instead of running off the screen, through a new opt-in `shift` option of the placement math. `NavList` has the parts `Root` (`color` / `size`), `Group`, `Heading`, `List`, `Item`, `Link`, `Icon` and `Meta`. `Link` takes `current` (the `active` state, announced as selected) and emits `press`, and the app navigates from that handler. `expectAnatomy`'s `portaled` option now bridges nested portals, so a submenu's rows find their popup. There are showcase gallery entries for both scopes. The daisy lynx targets for both recipes land with the 0.15.0 pin ([signalxjs/zero#484](https://github.com/signalxjs/zero/pull/484)).
- **`@sigx/lynx-zero`: `TreeView`** ([#1256](https://github.com/signalxjs/lynx/issues/1256)). This is zero's `tree-view` anatomy, a Wave 4 navigation scope of the zero fidelity campaign (#1140). The parts are `Root`, `Label`, `Tree`, `Item`, `Branch`, `BranchTrigger`, `BranchIndicator`, `BranchContent` and `NodeCheckbox`. The selection is `model` / `defaultValue`: a `string`, or a `string[]` under `multiple`, where a tap toggles a node. Open branches are `model:expandedValues` / `defaultExpandedValues`. `expandOnClick={false}` makes the row only select and moves the toggle to the indicator. `model:checkedValues`, `defaultCheckedValues` or `checkable` add check boxes: a branch is `checked` or `indeterminate` from its enabled leaves, and toggling it sets all of them. `disabled` works on the root and on each node. Branches take `loading`. Rows get the `pressed` flag (no main-thread scale unless you set `pressFeel`). A collapsed `BranchContent` stays mounted with `display: none` and the anatomy's `hidden`, so a closed branch still shows its check state. Keyboard roving and typeahead are web-only. The showcase zero gallery has a `tree-view` entry.

- **Back interceptors: `addBackInterceptor` in `@sigx/lynx` (and `@sigx/lynx-core`, with `dispatchBackInterceptors`)** ([#1290](https://github.com/signalxjs/lynx/issues/1290)). A handler returns `true` to consume an Android back press. Interceptors run newest first, and `@sigx/lynx-navigation`'s hardware-back wiring now offers every press to them before it pops. Overlays use it to close before navigation, and an app can use it for an unsaved-changes guard. The contract is pure JS in core, so packages that must not depend on navigation can register one.
- **New package `@sigx/lynx-icons-mdi`: a Material Design Icons adapter** ([#1333](https://github.com/signalxjs/lynx/issues/1333)). It reads path data from `@mdi/js` at build time and renders each glyph as a single filled SVG path. Register it with `iconSets: [{ id: 'mdi', source: '@sigx/lynx-icons-mdi' }]`, then use `<MdiIcon name="signal-cellular-outline" />` from `@sigx/lynx-icons-mdi/components` or `<Icon set="mdi" name="…" />`. Names are MDI's kebab-case names. As with the other adapters, the plugin's scanner ships only the glyphs the app uses. `@sigx/lynx-plugin` now recognizes `<MdiIcon>`, and the showcase Icons screen has an MDI row.

### Documentation

- **`@sigx/lynx-cli`: building a store `.ipa` / `.apk` in CI.** The README's external-pipeline section now covers archiving and exporting a signed iOS `.ipa` with `xcodebuild`, and why iOS CI builds stall: a codesign keychain prompt, automatic signing with no Apple account, or a cold Lynx engine compile. A new `Showcase build` workflow builds the showcase app as an unsigned `.ipa` and a release `.apk` the same way, so the recipe is exercised on every native change.
- **`@sigx/lynx-zero`: the divider rule, the alert close and the kbd face on lynx** ([#1250](https://github.com/signalxjs/lynx/issues/1250), [#1253](https://github.com/signalxjs/lynx/issues/1253), [#1254](https://github.com/signalxjs/lynx/issues/1254)). The fixes are upstream in [signalxjs/zero#479](https://github.com/signalxjs/zero/pull/479) and arrive with the 0.15.0 pin. Lynx ignores `block-size` / `inline-size`, and daisy's divider draws its thickness only through them. So the bare rule painted nothing, labelled segments filled the label row, and the size ramp did nothing. zero-kit's lynx emitter now ships the logical sizes as `height` / `width` (lynx has no writing modes). The same rewrite brings badge, status, spinner, steps, timeline, pagination, navbar and carousel sizes into effect. The daisy alert close is now a square chip on lynx, so its pressed wash and focus ring are squares instead of tall ovals. The kbd cap is set in `Menlo, monospace`. Android Lynx does not resolve CSS generic font families ([#1260](https://github.com/signalxjs/lynx/issues/1260)), so Android caps keep the system face for now. The README notes all three. Nothing changes in this repo until that pin lands.

### Changed

- **`@sigx/zero` and `@sigx/zero-daisyui` pinned to 0.17.0** ([#1248](https://github.com/signalxjs/lynx/issues/1248), [#1269](https://github.com/signalxjs/lynx/issues/1269), [#1288](https://github.com/signalxjs/lynx/issues/1288), [#1306](https://github.com/signalxjs/lynx/issues/1306)). The pin moved through 0.14.0, 0.15.0 and 0.16.0 to 0.17.0. 0.14.0 added the Wave 3 (#1140) daisy lynx targets that the 0.34.0 `@sigx/lynx-zero` display scopes were waiting on: alert and card ([signalxjs/zero#431](https://github.com/signalxjs/zero/pull/431)), badge, status and kbd ([signalxjs/zero#430](https://github.com/signalxjs/zero/pull/430)), divider, stats and empty-state ([signalxjs/zero#433](https://github.com/signalxjs/zero/pull/433)), and avatar, avatar-group, skeleton, spinner and the toast indicator ([signalxjs/zero#434](https://github.com/signalxjs/zero/pull/434)). It also keeps the textarea focus ring's base-100 gap on Android ([signalxjs/zero#435](https://github.com/signalxjs/zero/pull/435)). 0.15.0 adds the Wave 4 daisy lynx targets for the navigation scopes above: navbar and breadcrumbs ([signalxjs/zero#480](https://github.com/signalxjs/zero/pull/480)), pagination and steps ([signalxjs/zero#482](https://github.com/signalxjs/zero/pull/482)), menu and nav-list ([signalxjs/zero#484](https://github.com/signalxjs/zero/pull/484)), and tree-view fidelity ([signalxjs/zero#483](https://github.com/signalxjs/zero/pull/483)). It also adds zero-kit's lynx sizing and the daisy alert close chip and kbd face ([signalxjs/zero#479](https://github.com/signalxjs/zero/pull/479)). With it, the pagination cells and the steps discs and lines draw on device, and menu rows and nav-list links lay out as rows. 0.16.0 adds the Wave 5 daisy lynx targets: drawer and tooltip ([signalxjs/zero#506](https://github.com/signalxjs/zero/pull/506)), combobox ([signalxjs/zero#508](https://github.com/signalxjs/zero/pull/508)), carousel and table ([signalxjs/zero#510](https://github.com/signalxjs/zero/pull/510)), and file-upload, chat and chat-log ([signalxjs/zero#509](https://github.com/signalxjs/zero/pull/509)). It also brings the navbar sections that never squeeze a word ([signalxjs/zero#500](https://github.com/signalxjs/zero/pull/500)) and the divider segments centred on the label ([signalxjs/zero#512](https://github.com/signalxjs/zero/pull/512)). The zero contract adds `mergePartProps`, which `@sigx/lynx-zero` re-exports. 0.17.0 brings the fix-wave-9 daisy lynx targets ([signalxjs/zero#522](https://github.com/signalxjs/zero/pull/522)): a tree-view row selected live keeps the selected ink on its label and chevron ([#1292](https://github.com/signalxjs/lynx/issues/1292)), a narrow file-upload item row ellipsizes only the name ([#1294](https://github.com/signalxjs/lynx/issues/1294)), and the xl table sort mark no longer breaks the header label mid-word ([#1299](https://github.com/signalxjs/lynx/issues/1299)).

### Fixed

- **`@sigx/lynx-webauth`: `generatePKCE()` / `generateState()` work on iOS devices** ([#1337](https://github.com/signalxjs/lynx/issues/1337)). The Lynx background thread on iOS has no `crypto.getRandomValues`, so both helpers threw `no_random_source` and OAuth sign-in could not start. They now fall back to `@sigx/lynx-core`'s native `getRandomBytes`. `{ randomBytes }` still overrides the source, and `generateState()` stays synchronous.
- **`@sigx/lynx-zero`: a drawer always finishes sliding in, on Android and iOS** ([#1324](https://github.com/signalxjs/lynx/issues/1324), [#1325](https://github.com/signalxjs/lynx/issues/1325)). On Android a drawer open at mount (a cold deep link, or a restore after a pop) could stop part-way through its slide-in, with the panel's edge at 835, 819, 793, 705 or about 500px of 840px. On iOS a restored drawer sat 2pt short of its edge after every pop, and some cold opens did too. The cause is the same engine behavior as the #1320 dialog freeze: the view keeps a mid-flight transform after the animation ends. The #1320 fix is now one shared behavior (`behaviors/settle-transform.ts`), used by the Dialog panel, the Drawer panel and a store toast (`Toast.Root` under a `Toast.Viewport`). Once the entry motion is over, the part states an identity transform inline, alternating `scale(1)` and `translateX(0px)` so each pin is a new value. The pin happens on the animation's end (for a toast, its first transition end) and at the last fallback timer. A restored dialog or drawer settles again, as on a fresh open, and a closing toast drops its pin so the exit transition plays. Measured: 42 cold Android launches of `drawer/start` (light and dark), `drawer/end` and `drawer/dismissible`, plus 6 cold opens each followed by a restore, all gave pixel-identical panels (the unfixed build stopped at 835px on one dark launch). On iOS, 14 cold opens and 28 restores across `drawer/start`, `drawer/end` and `drawer/dismissible` all landed at the open edge; the unfixed build landed 2pt short on every restore. `dialog/open` is still 996px on Android (6 of 6) and 1109pt on iOS.
- **`@sigx/lynx-zero`: the combobox clear-trigger works while the list is open** ([#1326](https://github.com/signalxjs/lynx/issues/1326)). The open list's light-dismiss surface covers the window, the field included, so a tap on the × landed on the surface, which only focused the field. The typed text stayed. The surface now checks the clear-trigger's and the trigger's measured rects before the field's. A tap on the × clears the value and the text, focuses the field and keeps the list open on every item, as zero's web combobox does. A tap on the chevron closes the list without raising the keyboard. A tap anywhere else on the field still focuses it.
- **`@sigx/lynx-zero`: a combobox shows its value's label, and a dismiss without typing keeps the value** ([#1319](https://github.com/signalxjs/lynx/issues/1319)). In single mode a preset value's label is now the field's text even when `defaultInputValue` is `""`, as on the web. The field used to show the placeholder while a value was chosen, and a light dismiss then read that empty text as a field the user had emptied and cleared the value. The contract follows zero's web combobox: the label left in place keeps the value, typed text reverts to the label, and only text the user empties clears it. Otherwise the selection changes on a pick, the clear-trigger or a model write. The gallery's preset `combobox/open` lists pass `filter={false}` so every option stays listed under the label, and `combobox/lower-half` no longer presets a value.
- **`@sigx/lynx-zero`: an Android dialog open at mount always finishes opening** ([#1320](https://github.com/signalxjs/lynx/issues/1320)). A dialog rendered open on a cold start (a deep link) could stop part-way through its open scale on Android, at a random width per launch (945 to 995px of a 995px panel). `animationend` fires, but the view keeps a mid-flight transform, and the skin's resting `transform: none` is never re-applied because that value never changed. Neither `animation: none` nor `transition: none` clears it. The panel now states an identity transform inline when its open animation ends and at the last fallback timer (1 s), alternating `scale(1)` and `translateX(0px)` so each pin is a new value the engine applies. Measured on the Android emulator: 24 cold launches of `dialog/open` and `dialog/open-states` gave pixel-identical panels, where 7 of 9 unfixed launches stopped short.
- **`@sigx/lynx-zero`: an overlay restored when its screen is uncovered keeps the safe frame** ([#1318](https://github.com/signalxjs/lynx/issues/1318)). Since #1308 a covered screen's overlays leave the outlet and render again when the screen is uncovered. With a `ZeroRoot` per screen, the restored overlay laid out against the host frame measured while the push slid the screen away. That rect pokes out of the window, so it was dropped and every inset fell to 0: the drawer's title sat under the status bar and the dialog centred in the whole window, about half a status bar too high. It stayed that way until the overlay closed. An interactive pop re-measured the same stale rect at the drag's start, so nothing measured again once the pop settled. The host now keeps the last safe frame it measured inside the window while the current one is unusable, and it measures again when its screen comes back on top or the outlet goes from empty to showing.
- **`@sigx/lynx-zero`: the combobox chevron turns when a tap opens the list, anchored lists stay clear of the soft keyboard, and an Android carousel snaps a slow drag** ([#1309](https://github.com/signalxjs/lynx/issues/1309), [#1314](https://github.com/signalxjs/lynx/issues/1314), [#1310](https://github.com/signalxjs/lynx/issues/1310)). The combobox trigger now takes the `pressed` flag without the main-thread scale. That feel restores the part with an inline `transform: scale(1)`, which outranked the skin's open `rotate(180deg)`, so a list opened from the chevron left it pointing down. The combobox follows the keyboard from the moment its field takes focus. Lynx does not scroll a focused field into view, so on a tall Android screen the keyboard could cover the field, and the list stayed below it, under the keyboard too. An anchored popup whose anchor sits below the keyboard-trimmed frame is now placed with `shift`: it goes above and clamps onto the visible frame, right on top of the keyboard. Select, Menu and Popover also place against the keyboard-trimmed frame (`avoidKeyboard`). The carousel snaps in JS on every platform when a scroll rests off a slide. Android's `paging-enabled` pages only fast flings, and a rest it already aligned is left alone. The `combobox/lower-half` gallery note now describes the keyboard case.
- **`@sigx/lynx-zero`: a nested submenu no longer hides its parent's labels on iOS, and a `?theme=dark` gallery section no longer darkens the index after the pop** ([#1311](https://github.com/signalxjs/lynx/issues/1311), [#1313](https://github.com/signalxjs/lynx/issues/1313)). The placement math has a new `shrinkTo` option for `shift`. When a left or right popup fits neither side, it now narrows to the room beside its anchor instead of sliding over it, as long as that room is at least `shrinkTo` px. The resolved position carries the `width`, and `createAnchorPosition` paints it as `width` plus `min-width`. It decides from the widest width measured since opening, so the narrowed measurement cannot un-narrow the popup. `Menu.Sub` uses an 8rem floor. On a 402pt iPhone, the Export submenu now sits beside the root's Export row, and the Image submenu ends where the Image row begins. Before, the Image submenu covered the first letters of "Image" and "Data". In the showcase zero gallery, every screen's `ZeroRoot` used to be a root provider that wrote the global zero theme. So a dark section left the index dark under a light header after the pop. Each screen's `ZeroRoot` is now nested under a root `ThemeProvider` that pins nothing, so its theme stays on its own screen.
- **Overlays belong to their screen, and the iOS edge swipe is a back press** ([#1308](https://github.com/signalxjs/lynx/issues/1308), [#1312](https://github.com/signalxjs/lynx/issues/1312)). A navigator keeps a covered screen mounted, and an open `@sigx/lynx-zero` dialog, drawer, popover or select on it kept painting over the screen pushed on top, and on Android its back interceptor swallowed back there, so the user was stuck. `@sigx/lynx` adds `useScreenActive()` / `provideScreenActive()`, and `@sigx/lynx-navigation` provides it for every screen: active while the screen is the focused top and no transition is in flight. The overlay outlet renders only the overlays of active screens, and the dismiss stack only counts their layers, so back (and the edge swipe) on the screen on top pops it. An overlay on a covered screen stays open and renders again, as on a fresh open, when the screen is uncovered. On iOS the edge swipe did nothing while any layer was open, because the layer sat above the navigator's edge strip. The outlet now carries its own edge strip while a layer is open, and a swipe on it goes to the back interceptors (`dispatchBackInterceptors`, now re-exported from `@sigx/lynx`), like Android back: the innermost dismissible layer closes (a drawer reports `escape`), and a non-dismissible one keeps the swipe. `<Stack>` also turns its edge swipe into a back press while any interceptor is registered (`hasBackInterceptors()`, a new reactive read in `@sigx/lynx-core` and `@sigx/lynx`): interceptors first, then a pop. `@sigx/lynx-zero` exports `hasActiveDismissLayer()`, `LynxDismissLayer` takes `active`, and `useOverlayPortal()` returns `active`. The showcase zero gallery adds `dialog/push`.
- **`@sigx/lynx-zero`: tooltip bubbles size to their text on Android, the tooltip gallery shows real left and right placements, and a nested submenu no longer covers its parent** ([#1297](https://github.com/signalxjs/lynx/issues/1297), [#1293](https://github.com/signalxjs/lynx/issues/1293), [#1296](https://github.com/signalxjs/lynx/issues/1296)). `Tooltip.Popup` now states `width: max-content`. Android bounded the absolute bubble's auto width by the 0×0 overlay root, so the bubble collapsed to one glyph wide and its text stacked vertically. The skin's `max-width` still caps it. Under the `shift` option, the placement math now takes the side with more room before it clamps. A nested submenu (Export › Image) whose parent submenu already sits against the trailing edge now opens on the leading side instead of squarely over the parent's rows. The showcase `tooltip/open` extra gives the `left` and `right` triggers rows of their own, each on the far side, so neither flips.
- **`@sigx/lynx-zero`: a tree row selected by a tap re-inks its label, a narrow file-upload row shrinks only the name, and a sortable table header keeps its words** ([#1292](https://github.com/signalxjs/lynx/issues/1292), [#1294](https://github.com/signalxjs/lynx/issues/1294), [#1299](https://github.com/signalxjs/lynx/issues/1299)).
  - **TreeView (#1292).** A row selected live painted the base-content ink on the accent fill. A row selected at mount was right. The row's `transition` includes `color`, and Lynx's new animator ticks a transitioned colour into the row's own paint only, so the label, which inherits its ink, kept the old colour.
  - **FileUpload (#1294).** In a narrow row, "1.5 kB" wrapped and the × squeezed into an oval, because Lynx's flex has no automatic minimum.
  - **Table (#1299).** The xl sortable header "Name" broke as "Nam / e". The sort trigger's plain-text label now keeps its content width in lynx-zero.
  - **The skin half.** The fixes for these three scopes are in the daisy skin's lynx targets ([signalxjs/zero#522](https://github.com/signalxjs/zero/pull/522)) and arrive with the next zero bump. Tree rows transition only their background. The file-upload size and × don't shrink. The table's sort mark doesn't shrink.
  - **Gallery.** The showcase zero gallery adds `tree-view/live-select`, `combobox/in-dialog` (the keyboard-lift case), `combobox/lower-half` (the list opens above the field) and `drawer/dismissible` (a dim tap and system back both close it).
- **`@sigx/lynx-zero`: the Android back button closes the innermost overlay** ([#1290](https://github.com/signalxjs/lynx/issues/1290)). Back used to pop the screen, or exit the app at the root, with a dialog, drawer or menu open. The dismiss stack now holds a back interceptor while any layer is open (Dialog, Drawer, Popover, Select, Menu and its submenus, Combobox). One press closes one layer, innermost first, and only a press with nothing open navigates. A non-dismissible layer consumes the press without closing. The showcase gallery adds `dialog/back`, a dismissible dialog (every other dialog extra is not); `drawer/dismissible` covers the drawer. Verified on the Android emulator: dialog, drawer and a menu with an open submenu each close first, and the next press pops.
- **An open overlay no longer outlives its popped screen** ([#1291](https://github.com/signalxjs/lynx/issues/1291)). Popping a screen with a Dialog or Drawer open left a dead panel and scrim over the next screen, on Android. The overlay components were unmounted and every element removed, but the engine leaves the view of a `position: fixed` node on the page root when that node and its ancestors leave in the same flush, and the `ZeroRoot` outlet is fixed. `@sigx/lynx-runtime-main` now tracks inline `position: fixed` elements and commits each one's removal with its own flush, while its ancestors are still attached. Verified on the Android emulator. iOS was not checked on device.
- **`@sigx/lynx-zero` Combobox (Android): a preset value no longer opens the list at mount, and a pick closes it** ([#1298](https://github.com/signalxjs/lynx/issues/1298)). Android's native `<input>` fires `input` for programmatic writes (the preset label, the picked label), and the combobox took that as typing. An input event whose text equals the model's text is now ignored. Typing always changes the text, so it still opens and filters. iOS and the web never sent the echo.
- **`@sigx/lynx-zero`: Chat colour sections and a live Tooltip no longer flood the engine on iOS, and a Carousel swipe snaps to a slide on iOS** ([#1295](https://github.com/signalxjs/lynx/issues/1295), [#1300](https://github.com/signalxjs/lynx/issues/1300), [#1301](https://github.com/signalxjs/lynx/issues/1301)). Both floods were sub-pixel layout loops that tripped Lynx error 204 (`sigxPatchUpdate` / `__SendPageEvent`, 800 in a window) and raised the red screen. `Chat.Root` reserved the avatar's measured height as the row's `min-height`. On iOS that moved the avatar by a fraction, layout snapped its height between 40 and 40.33, and every re-measure re-rendered the row. The reservation is now in whole pixels, and a re-measure within a pixel is ignored. An anchored popup centred on its trigger sat at a fractional `left`, and its measured width snapped between 135.33 and 135.67, which moved it again on every frame. The placement now holds the popup's size across re-measures within a pixel and paints whole-pixel offsets. This covers Tooltip, Popover, Select, Menu and Combobox. The iOS scroll-view has no paging attribute, so `paging-enabled` never snapped there. On iOS the Carousel viewport now snaps itself when the scroll comes to rest: to the next slide in the drag's direction once the drag has moved a fifth of a slide, otherwise back. Android keeps its native paging.
- **`@sigx/lynx-zero`: a collapsed TreeView branch no longer paints its hidden leaves over its row, and labelled Divider segments sit on the label's centre** ([#1271](https://github.com/signalxjs/lynx/issues/1271), [#1272](https://github.com/signalxjs/lynx/issues/1272)). A closed `BranchContent` used `display: none`, and lynx kept painting that subtree's text: on iOS at mount, on Android after a live collapse. The closed content is now an out-of-flow, clipped, transparent, `visibility: hidden` 0×0 box, hidden from accessibility. It stays mounted, so a collapsed branch still derives its check state. A labelled divider's segments inherited the root's `align-self: stretch`, which puts a fixed-thickness line at the top of the label row on lynx. They now set `align-self: center`. The same rule lands in the daisy skin's lynx target with [signalxjs/zero#512](https://github.com/signalxjs/zero/pull/512).
- **An image that fails to load no longer raises the dev client's red error screen** ([#1252](https://github.com/signalxjs/lynx/issues/1252)). On iOS every cold load of an avatar section with a dead image URL opened the full-screen error overlay (`Error when loading image`, `error_code` 399), although Avatar handled the failure and showed its fallback. `@sigx/lynx-dev-client` now treats a Lynx image resource error (code 301, or a 3xx resource error with resource type `image`) as recoverable on iOS and Android: it logs it to the `sigx dev` terminal as a warning and keeps it off the overlay. Every other error still raises the overlay. The device-error endpoint in `@sigx/lynx-plugin` accepts `level: 'warn'` for this. On the iOS simulator, `avatar/color` now paints with no overlay, and the terminal prints the image failures as `WARN`.
- **`@sigx/lynx-zero` Dialog: a focused full-width field's ring is no longer clipped at the sides** ([#1255](https://github.com/signalxjs/lynx/issues/1255)). The dialog body has always been a `scroll-view` since #1232, and a scroll-view clips its children, so the ring, which is a box-shadow outside the field, lost its left and right bands. The body now reaches 4px (the skin's widest ring) into the panel's padding and gives it back to its content, so the content stays where it was and the ring paints on all four sides. The showcase gallery adds `dialog/field-focus`, with the field's ring forced on.
- **`@sigx/lynx-cli`: images no longer crash Android apps on 16 KB page-size devices** ([#1251](https://github.com/signalxjs/lynx/issues/1251)). On Android 15+ devices with 16 KB pages, the first `<image>` load killed the app. The cause was Fresco 2.3.0's `libimagepipeline.so`, which the system refuses to load ("program alignment cannot be smaller than system page size"). The Android template now pins Fresco 3.6.0, whose native libraries are 16 KB-aligned. The `org.lynxsdk.lynx:lynx-service-image` artifact is built against Fresco 2.x and fails at runtime on Fresco 3.x, so the template now compiles the Lynx image service from vendored Apache-2.0 sources under `app/src/main/java/com/lynx/service/image/` instead. The class name is unchanged, so `App.kt` needs no edit. Existing projects pick up both changes on the next `sigx prebuild`. The new `pnpm check:apk-16kb <app.apk>` script checks that every 64-bit native library in a built APK can load on 16 KB pages.
- **`@sigx/lynx-zero` Menu: opening a submenu closes its open sibling** ([#1273](https://github.com/signalxjs/lynx/issues/1273)). Each `Menu.Sub` used to keep its own open state. Tapping `Export` while `Share` was open left both sub-popups stacked beside the root popup, on iOS and Android. Now each level holds one open child submenu, as on the web: a submenu that opens by a tap, by `defaultOpen` or through its `model` closes the sibling that was open. A controlled sibling is closed through its model. A nested submenu is its parent's child, not a sibling, so it opens without closing its parent. The showcase gallery adds `menu/sub-states`, with a held sub-trigger, a disabled sub-trigger and an open two-level chain.
- **`@sigx/lynx-zero` Navbar: section text no longer breaks mid-word** ([#1274](https://github.com/signalxjs/lynx/issues/1274)). In a narrow xl bar with start, center and end, `Acme` wrapped as `Acm` / `e`. On the web a flex item's automatic minimum keeps the word whole. Lynx's flex layout has no automatic minimum, and its `min-width` takes no intrinsic keyword. The daisy skin's lynx section now starts each end from its content and never shrinks it, and the centre never shrinks, as in daisy. A bar narrower than its content now overflows whole. The fix is upstream ([signalxjs/zero#500](https://github.com/signalxjs/zero/pull/500)) and takes effect with the next zero pin. The README notes one difference from the web: with a centre and ends of unequal width, the centre sits off-centre by half the difference. The showcase gallery adds `navbar/squeeze`.
- **`@sigx/lynx-background`: Android release builds no longer crash at startup** ([#1266](https://github.com/signalxjs/lynx/issues/1266)). A release build (R8 on) of any app that linked the package died before any JS ran: `NoSuchMethodException: androidx.work.impl.WorkDatabase_Impl.<init>` from WorkManager's startup initializer. Room 2.6.1's consumer rule keeps `RoomDatabase` subclasses but not their constructors, and R8 full mode (the AGP default) strips a constructor that no rule names. The module manifest now adds `-keep class * extends androidx.room.RoomDatabase { <init>(); }` to the generated `proguard-rules-generated.pro`, so existing projects pick it up on the next `sigx prebuild`. On the 16 KB Pixel_10 emulator, the showcase release APK launches to the catalog, and the same build without the rule reproduces the crash.
- **`@sigx/lynx-cli`: Android device errors and warnings reach the `sigx dev` terminal** ([#1275](https://github.com/signalxjs/lynx/issues/1275)). `sigx dev` only ran `adb reverse` for the bundle port. The dev client posts `/__sigx/device-error` to `localhost` on the log/reload port (bundle port + 1), so every report failed with `Failed to connect to localhost/127.0.0.1:8789`. Both ports are now forwarded, and both are removed on exit. On the emulator, a broken avatar image now prints `📱 android … WARN {"code": 301 …}` in the terminal.
- **`@sigx/lynx-cli`: CSS generic font families resolve on Android** ([#1260](https://github.com/signalxjs/lynx/issues/1260)). Android Lynx never maps `monospace`, `serif` or `sans-serif` to a face, so they fell through to the default face. For example, the zero kbd cap (`Menlo, monospace`) and the `@sigx/lynx-markdown` code spans were not mono. The Android host now registers a Lynx `TypefaceCache` provider that maps the generics (plus `ui-monospace`, `ui-serif`, `ui-sans-serif` and `system-ui`) onto the system typefaces in the requested style. It lives in the new managed file `SigxGenericFonts.kt`, and `GeneratedModuleRegistry.registerAll` installs it, so existing projects pick it up on the next `sigx prebuild`. On the emulator, the `kbd/shortcut` caps now render in a monospace face.

## [0.34.0] - 2026-09-28

### Added

- **`@sigx/lynx-cli`: a typed app env in `signalx.config.ts`, set per variant and baked into the bundle, plus an OTA variant check** ([#1244](https://github.com/signalxjs/lynx/issues/1244)). The new `env` field holds build-time settings such as the API base URL, feature flags or public keys. Values are JSON, and `variants.<name>.env` deep-merges onto them, overriding only keys the base declares. App code reads it with `import { env } from '@sigx/lynx'` (also exported from `@sigx/lynx-core`). `env` is frozen and `{}` when unset. The app types it once with a `src/sigx-env.d.ts` that extends the global `SigxAppEnv` interface with `EnvOf<typeof config>`. `lynx.config.ts` reads it with `appEnv()` from `@sigx/lynx-plugin`. Before the config is evaluated, the CLI loads `.env`, `.env.local`, `.env.<variant>` and `.env.<variant>.local`, and a variable already set in the real environment wins. The new `readEnv()` and `requireEnv()` from `@sigx/lynx-cli/config` read those variables in the config without the Node `process` global. Resolving the config rejects non-JSON values and names their key path. It also warns about keys that look like secrets; list a key in `envAllow` to silence it. `sigx build`, `dev`, `run:web` and `build:web` now always resolve the config, and `run:web` / `build:web` take `--variant`. Each production build writes `dist/.sigx-build.json` with the variant and a hash of the env. `sigx updates:publish` takes `--variant`, which applies the variant's `updates.defaultChannel`, and refuses a bundle built for another variant or with no marker (`--skip-build-check` overrides both). It warns when the baked env differs from the config it resolves now. The flik and showcase examples declare an `env`.
- **`@sigx/lynx-zero`: `Badge`, `Status` and `Kbd`** ([#1234](https://github.com/signalxjs/lynx/issues/1234)). These are Wave 3 display scopes of the zero fidelity campaign (#1140), on zero's `badge`, `status` and `kbd` anatomies. `Badge` (`Root` / `Dot`) is a standing label. Its optional status dot re-carries `color`: the dot's own colour wins, a dot without one follows the pill's, and on an uncoloured pill the dot is the pill's ink. `running` stamps the dot's one state. `Status` is an empty presence dot. Without `label` it is not an accessible element; with `label` it is an `image` named by the label. `Kbd` is a keycap. Badge and Kbd take their text as a `<text>` child, and a `label` makes the root one named element. `asChild` and the `<kbd>` element's semantics are not carried on lynx. The showcase zero gallery adds `badge`, `status` and `kbd` sections for every colour and size, plus the `dots`, `with-text` and `shortcut` extras. The daisy skin's lynx fixes for these scopes are in [signalxjs/zero#430](https://github.com/signalxjs/zero/pull/430) and arrive with the next zero pin: the dot's ink in place of `currentColor`, per-theme halos, physical dot and keycap sizes, and content-sized pills and caps.
- **`@sigx/lynx-zero`: `Alert` and `Card`** ([#1235](https://github.com/signalxjs/lynx/issues/1235)). These are the first wave-3 display scopes (#1140), on zero's `alert` and `card` anatomies. `Alert` has the parts `Root`, `Icon`, `Title`, `Description` and `Close`. Its model is `open` (`model` / `defaultOpen` / `openChange`, open by default), and a closed alert unmounts, which is how lynx keeps `hiddenIn: ['closed']`. `Alert.Close` has the `button` trait, tier-2 press feedback and the `disabled` and `pressed` flags. It is named "Close" and draws `×` by default. The icon is decoration and is kept out of the accessibility tree. Lynx has no live region, so zero's `live` and `finalFocus` are not taken. Lynx also has no grid and no `:has()`, so the root stamps `with-icon` / `with-close` on the title and description while an Icon or Close renders, and the skin lays the alert out from those. `Card` has `Root`, `Media`, `Header`, `Title` (the `header` trait), `Description`, `Body` and `Footer`. It takes no `asChild`. The root tracks its bands in mount order and stamps `first` / `last` on `Card.Media`, so the skin can round the corners the band shares with the card. The showcase gallery adds `alert` (colour and size against default, close pressed, close focus and close disabled, plus a `compose` extra with a live dismissable alert) and `card` (colour and size, plus `media` and `bands`). The daisy skin's lynx targets for both are [signalxjs/zero#431](https://github.com/signalxjs/zero/pull/431) and arrive with the next zero bump. Until then the pinned 0.13.0 lays the alert out as a plain stack.
- **`@sigx/lynx-zero`: `Divider`, `Stats` and `EmptyState`** ([#1236](https://github.com/signalxjs/lynx/issues/1236)). Three wave-3 display scopes on the zero anatomy (#1140). `Divider` (`Root` / `Label`) takes `orientation`, `color` and `size`, and a label takes `placement` (`start` / `end`). On lynx the root is the line. With a `Divider.Label` mounted, the root draws the web's `::before` / `::after` segments as views that carry its own line classes, and leaves out the one on the label's placed side. `Stats` (`Root` / `Item` / `Title` / `Value` / `Desc` / `Figure`) mirrors its orientation onto every item, and an item's own `color` outranks the root's. Lynx has no `item + item` or grid, so the first item is stamped `first` and an item holding a figure is stamped `figure`, and the skin draws the seams and pins the figure from those. `EmptyState` (`Root` / `Icon` / `Title` / `Description` / `Actions`) takes the tone as its `color`. Text parts render as lynx `<text>`. The showcase zero gallery adds `divider`, `stats` and `empty-state` sections, plus the `divider/vertical`, `stats/row` and `stats/column` extras. The daisy skin's lynx targets for these scopes are [signalxjs/zero#433](https://github.com/signalxjs/zero/pull/433) and arrive with the next zero pin: physical label insets, the labelled and segment rules, flex stats items with the seams and the figure, and empty-state margins and text ink.
- **`@sigx/lynx-zero`: `Avatar`, `AvatarGroup`, `Skeleton`, `Spinner`, and `Toast.Indicator` with promise toasts** ([#1237](https://github.com/signalxjs/lynx/issues/1237), [#1196](https://github.com/signalxjs/lynx/issues/1196)). These are zero's display scopes (wave 3, #1140). `Avatar` (`Root` / `Image` / `Fallback`) follows the lynx `<image>`'s load and error events through `loading` / `loaded` / `error`. It renders only the face its state shows: the image drops on `error`, and the fallback drops once the image has `loaded`. A missing `src`, or a root with no image, settles on `error`, and `Fallback delay` holds back the initials. `AvatarGroup` (`Root` / `Overflow`) pushes its size and colour down to its avatars, where an avatar's own prop wins. It stamps every avatar after the first as `stacked` for the skin's overlap, because lynx has no `:first-child`. `Overflow` shows `+N` and is announced as "N more". `Skeleton` has a `loading` model that defaults to `true`, and its children stay mounted in both states. `Spinner` has a visually hidden label ("Loading" by default) and a `decorative` mode. Toasts gain a `status` (`loading` / `complete` / `error`), drawn by the new `Toast.Indicator`, plus `toaster.update()` and `toaster.promise()`. While a mark shows, every part of the toast carries the `marked` modifier: the lynx spelling of the web skin's `:has(> indicator)`. The showcase zero gallery adds `avatar`, `avatar-group`, `skeleton` and `spinner` sections and a `toast/indicator` extra. The daisy skin's lynx targets for these scopes are [signalxjs/zero#434](https://github.com/signalxjs/zero/pull/434) and arrive with the next zero pin: the stacked faces, the physical group overlap, a spinner on daisy's `loading` size ramp, and the toast's ring, tick and cross drawn without `clip-path`.
- **`@sigx/lynx-zero`: `NumberInput` and `Fieldset`** ([#1202](https://github.com/signalxjs/lynx/issues/1202)). Two more wave-2 form scopes on the zero anatomy. `NumberInput` is zero's spinbutton over the native `<input>`, with the parts `Label`, `Control`, `Input`, `IncrementTrigger` and `DecrementTrigger`. Its model is `number | null`. Typing is a draft that commits on blur or on the keyboard's confirm key: it is parsed, snapped to the `step` grid anchored at `min`, then clamped. Unparseable text reverts. A trigger steps on tap and repeats on long press (`spinInterval`, default `NUMBER_INPUT_SPIN_INTERVAL`), and is disabled at its bound. A committed value out of range marks the control `invalid`, and native focus stamps `focus-visible`. A tap on the label or the control's box focuses the input, and inside a `Field` the Field's label does too. `Fieldset` (`Root` / `Legend`) carries `disabled`, `readonly` and `invalid` to every control inside through zero's `FieldsetContext`. Nested fieldsets chain, and the legend's content takes the outer flags. NumberInput reads it; the other lynx-zero controls do not yet ([#1208](https://github.com/signalxjs/lynx/issues/1208)). The web's `hidden-input`, `name`, `locale` / `formatOptions`, `largeStep` and wheel stepping are not carried. The showcase zero gallery adds both scopes. The daisy skin's lynx fixes for them ([signalxjs/zero#395](https://github.com/signalxjs/zero/pull/395)) ship with the 0.12.0 pin: fieldset as a flex column, number-input steppers centred with physical seams, and a focus ring that follows the control's radius.
- **`@sigx/lynx-zero`: `Toggle` and `ToggleGroup`** ([#1204](https://github.com/signalxjs/lynx/issues/1204)), the first Wave 2 form scopes of the zero fidelity campaign (#1140). `Toggle.Root` is a button with a persistent `on|off` mode (`model` / `defaultPressed` / `onPressedChange`), announced as `selected` on a `button` trait. `ToggleGroup.Root` + `ToggleGroup.Item` hold one value model whose shape follows `multiple`: a `string` in single mode (`''` = none, `deselectable` by default), a `string[]` under `multiple`. The group takes `orientation`, `disabled`, `invalid` and `required`, and the Field's flags and size. Both press with the tier-2 main-thread feel (`pressFeel={false}` opts out), and every item owns its own press. There is no keyboard roving, `hidden-input` or group role on lynx; the README explains why. The showcase gallery adds `toggle` and `toggle-group` sections (color/size × off/on/pressed/on·pressed/focus/disabled, plus `content`, `vertical` and `multiple`). The daisy skin's lynx replacements (pressed wash, join seams, focus rings, content-sized roots) are [signalxjs/zero#394](https://github.com/signalxjs/zero/pull/394) and ship with the 0.12.0 pin.
- **`@sigx/lynx-zero`: `Checkbox`, `CheckboxGroup` and `RadioGroup`** ([#1203](https://github.com/signalxjs/lynx/issues/1203)). These are zero's `checkbox`, `checkbox-group` and `radio-group` anatomies, the first form controls of wave 2 (#1140). `Checkbox.Root` takes a `boolean` model, or a `string[]` model in array mode where each box toggles its own `value`. It also takes `indeterminate` and `hideLabel`. Inside a `CheckboxGroup.Root` a box joins the group's `string[]` model, and a `parent` box shows all, some or none of `allValues` and selects all or none. `RadioGroup.Root` takes a `string` model, explicit `RadioGroup.Item`s or data mode (`items` with the collection accessors), and a `RadioGroup.Label`. `disabled`, `invalid`, `required` and `readonly` come from the prop, an enclosing Field or the group. A readonly or disabled control refuses taps and shows no press, and `pressed` lands on the visible control while a touch is held. There is no form on lynx, so the hidden native input, `name`/`form` and native validity are not taken. `partA11y` takes `mixed` (announced for an indeterminate box). The showcase zero gallery adds `checkbox`, `checkbox-group` and `radio-group` sections for every colour and size against their states, plus `labelled`, `parent` and `horizontal` extras. The daisy skin's lynx fixes for these scopes are in [signalxjs/zero#396](https://github.com/signalxjs/zero/pull/396) and ship with the 0.12.0 pin: round focus rings, pinned row layout, and horizontal radio groups.
- **`@sigx/lynx-zero`: `Input`, `Textarea` and `Field`** ([#1205](https://github.com/signalxjs/lynx/issues/1205)). These are zero's `input`, `textarea` and `field` anatomies on the native lynx text fields (zero wave 2, W2C). Input has `Root`, `Label`, `Control`, `Input`, `Adornment`, `ClearTrigger` and `VisibilityTrigger`. Textarea has `Root`, `Label` and `Textarea`. Field has `Root`, `Label`, `Description` and `Error`, and provides zero's `FieldContext`. Switch, Slider, Select, Button and the new fields adopt its flags, and its size when they set none. The value is a `string` `model` with no `value` prop. A password field also takes `model:visible`. State paints on views, because iOS never repaints a native field's styles after mount, and a native field is focused through its `focus` UI method. `Field.Label` focuses the first control that reported to its Field. `enterkeyhint` maps to `confirm-type`, and `inputmode` picks the digit or number pad. Lynx has no constraint validation, so `validate` and `Field.Error`'s `match` are not taken. The showcase gallery adds `input`, `textarea` and `field` sections. The daisy lynx targets for these scopes are upstream in [signalxjs/zero#398](https://github.com/signalxjs/zero/pull/398) and ship with the 0.12.0 pin: explicit ink, placeholder colour, physical adornment spacing and focus rings.
- **`@sigx/lynx-zero`: `useOutletFill()`, `Popover.Description`, and the lynx-runtime JSX type for `native-interaction-enabled`** ([#1190](https://github.com/signalxjs/lynx/issues/1190)). The overlay outlet layer is now 0×0 (see Fixed), so a custom overlay root that must cover the window spreads `useOutletFill()` (the window's size) instead of `top/right/bottom/left: 0`. `native-interaction-enabled={false}` takes an element's native view out of platform hit-testing while lynx taps still reach it. `Popover.Description` is zero 0.6's `description` part. Popover's `arrow` stays web-only and its `anchor` part is not taken.
- **`@sigx/lynx-zero`: `OVERLAY_ROOT_STYLE` and `fixedOutletRect`** ([#1180](https://github.com/signalxjs/lynx/issues/1180)). The first is the hit-testing contract of the overlay outlet: the root of a portal closure spreads it (`pointer-events: auto`) into its inline style so it takes its own touches under the pass-through layer. The second is the pure outlet-rect helper the host uses in place of a measurement.

### Changed

- **`@sigx/zero` and `@sigx/zero-daisyui` pinned to 0.13.0** ([#1178](https://github.com/signalxjs/lynx/issues/1178), [#1188](https://github.com/signalxjs/lynx/issues/1188), [#1198](https://github.com/signalxjs/lynx/issues/1198), [#1213](https://github.com/signalxjs/lynx/issues/1213), [#1228](https://github.com/signalxjs/lynx/issues/1228)). 0.13.0 carries the fix-wave-5 lynx fixes: zero-kit's lynx emitter drops SVG data-URI images and `clip-path`, the daisy checkbox tick and dash drawn without them, the toggle-group join ends, the textarea floor and focus ring, and the number-input placeholder colour ([signalxjs/zero#403](https://github.com/signalxjs/zero/pull/403), [signalxjs/zero#404](https://github.com/signalxjs/zero/pull/404), [signalxjs/zero#406](https://github.com/signalxjs/zero/pull/406)). It also carries the combobox control growing with wrapped tags ([signalxjs/zero#408](https://github.com/signalxjs/zero/pull/408)). 0.12.0 carries the Wave 2 daisy lynx targets for toggle and toggle-group, number-input and fieldset, checkbox and radio, and input, textarea and field ([signalxjs/zero#394](https://github.com/signalxjs/zero/pull/394), [signalxjs/zero#395](https://github.com/signalxjs/zero/pull/395), [signalxjs/zero#396](https://github.com/signalxjs/zero/pull/396), [signalxjs/zero#398](https://github.com/signalxjs/zero/pull/398)). 0.11.0 carries the fix-wave-3 `clearable` select flag and the daisy skin rule keyed on it ([signalxjs/zero#388](https://github.com/signalxjs/zero/pull/388)). 0.10.0 carries the fix-wave-2 daisyUI lynx fixes: the Select clear-trigger chip and the rem-to-px rewrite at 16px/rem ([signalxjs/zero#383](https://github.com/signalxjs/zero/pull/383), [signalxjs/zero#384](https://github.com/signalxjs/zero/pull/384)). It also includes 0.9.0, which carries the fix-wave-1 daisyUI lynx fixes that the Fixed entries below depend on: focus rings that follow the part's radius, var-bearing button edges as longhands with a content-sized button root, and the select root width and portalled-popup accent ([signalxjs/zero#367](https://github.com/signalxjs/zero/pull/367), [signalxjs/zero#369](https://github.com/signalxjs/zero/pull/369), [signalxjs/zero#372](https://github.com/signalxjs/zero/pull/372)). 0.9.0 also keeps the lynx divider a painted line with its size ramp, which zero 0.8.0 had dropped ([signalxjs/zero#376](https://github.com/signalxjs/zero/pull/376)).

### Fixed

- **`__SIGX_VARIANT__` stays set in variant builds of apps with `iconSets`** ([#1244](https://github.com/signalxjs/lynx/issues/1244)). The plugin's icon step, which runs inside the rspeedy build, resolved the base config, and resolving the config overwrote the `SIGX_LYNX_VARIANT` that lynx-cli had set. So `variant` read `''` in a `--variant` build. `sigx dev`'s x86_64 SVG check did the same in the dev process. Both now resolve with the active variant.
- **`@sigx/lynx-zero` Dialog on iOS: the panel lifts above the soft keyboard, and a Select in an opening dialog lands at its trigger** ([#1232](https://github.com/signalxjs/lynx/issues/1232), [#1233](https://github.com/signalxjs/lynx/issues/1233)). The dialog renders through the overlay portal, so an app cannot wrap it in a `KeyboardAvoidingView`, and the keyboard covered the focused textarea and the footer. While open, `Dialog.Popup` now follows the keyboard height from the native safe-area publisher (no `<SafeAreaProvider>` needed; `@sigx/lynx-safe-area` exports the provider-free `subscribeSafeArea` for this). The backdrop pads its bottom by the keyboard's overlap, measured against the outlet's no-keyboard height so an Android window that resized for the keyboard is not lifted twice. The panel is capped at the visible box, and its body is always a vertical `scroll-view`, so a tall panel scrolls inside and the rising keyboard never remounts the focused field. A Select opened inside an opening dialog was measured under the panel's open scale (0.95) and stayed about 8pt right of its trigger on 4 of 5 cold links. The panel's `animationend` / `transitionend` (plus two fallback timers per open) now make every open anchored popup inside it re-measure once, in a bounded burst. `@sigx/lynx-runtime`'s JSX types gain the `bindanimation*` / `bindtransition*` events. On the iOS simulator, 5 of 5 cold links into `dialog/nested` aligned, and the new `dialog/keyboard` gallery section keeps the focused Bio field and the footer above the keyboard.
- **Readonly text fields show their value on Android** ([#1231](https://github.com/signalxjs/lynx/issues/1231)). On Android a readonly `Input`, `Textarea`, `NumberInput` or `Field` control showed its placeholder instead of its value. Android's native `<input>`/`<textarea>` passes every text write through a readonly filter, and that includes the `setValue` UI method the runtime uses to paint a model value. `@sigx/lynx-runtime` now also writes a non-empty initial value as the native `default-value` in the mount batch, which is the one write that passes the filter. It also wraps a later programmatic write to a readonly field: it lifts `readonly`, writes, then restores `readonly` in a later batch. This fixes every model-bound readonly `<input>`/`<textarea>`, not only lynx-zero's. The showcase gallery adds `input/readonly-update`, with readonly fields whose values change after mount.
- **Checkbox and radio on the daisy skin, with `@sigx/zero-daisyui` 0.13.0: no red error screen on iOS, a real tick, a centred dash** ([#1215](https://github.com/signalxjs/lynx/issues/1215), [#1216](https://github.com/signalxjs/lynx/issues/1216), [#1217](https://github.com/signalxjs/lynx/issues/1217)). The fix is upstream ([signalxjs/zero#401](https://github.com/signalxjs/zero/issues/401)). It ships with the 0.13.0 pin. This repo adds the tests and README notes. daisy paints a noise texture on the checkbox and the radio dot. The texture is an SVG data-URI image, which iOS Lynx cannot decode, so every checkbox and radio section of a dev build opened on the red error screen. daisy also cuts its checkbox tick out of a rotated square with `clip-path`, which lynx does not apply. The checked box showed a solid diamond, and the indeterminate box a block over its top half. zero-kit's lynx emitter now drops, each with a report entry, every SVG data-URI image (with the tokens that hold one and every read of them) and every `clip-path`. On lynx, the daisy checkbox draws daisy's L as two borders on a rotated box, and its stroke follows the size axis. Its indeterminate mark is a bar centred in the box. A new `lynx-zero-daisyui` test checks the shipped CSS.
- **daisy ToggleGroup and Textarea on lynx: the join's leading corners, the textarea's height floor, and its focus ring** ([#1218](https://github.com/signalxjs/lynx/issues/1218), [#1219](https://github.com/signalxjs/lynx/issues/1219), [#1220](https://github.com/signalxjs/lynx/issues/1220)). On iOS a horizontal toggle group's first item painted square corners and had no leading hairline, because the frame's clip did not round it. Lynx has no `:first-child` or `:last-child`, so `ToggleGroup.Root` now tracks its items in mount order and stamps the end items with the `first` and `last` modifiers (`zx-m-first` / `zx-m-last`). The daisy skin keeps the frame's four edges and rounds the end items' outer corners itself, in both orientations. An empty textarea was one line tall: the floor's nested `calc(calc(…) * 2)` never applied, so the skin now writes it as one flat `calc()` per size. The textarea's focus ring was a solid 4px band because Lynx iOS reverses the stacking of a view's outset shadows when it lays the view out again (`LynxBackgroundManager.updateShadow`). A fixed-height Input never gets that second pass, but a growing textarea does. The skin's lynx ring for the textarea is now one outset ring plus an inset hairline, which paint areas that don't overlap, with the box's border as the gap. The skin changes are [signalxjs/zero#406](https://github.com/signalxjs/zero/pull/406) and ship with the 0.13.0 pin. The showcase gallery adds a `C on` toggle-group state, vertical groups with an end item filled, held or focused, and a textarea `invalid·focus` state.
- **`@sigx/lynx-zero`: a tap on a label or on a text field's box focuses the native field, and NumberInput shows its `format`** ([#1223](https://github.com/signalxjs/lynx/issues/1223), [#1221](https://github.com/signalxjs/lynx/issues/1221)). On device, taps on `Field.Label`, on `Input.Label`, `Textarea.Label` and `NumberInput.Label`, and on a control's padding or adornment focused nothing. The focus call went through `el.invoke('focus')`, but a callback `ref` on the background thread is a ShadowElement, which has an `id` and no `invoke`, so the call returned early. The unit tests had only covered it with a spy `invoke`. The call now rides the runtime's `INVOKE_UI_METHOD` op, the path `setValue` already takes. NumberInput's `format` never reached the screen: the field showed "25", not "25 %". Lynx's `digit` and `number` fields pass every write, `setValue` included, through a numeric key filter. With a custom `format`, the native field is now `type="text"`, so it shows the full keyboard in place of the number pad. The dark-theme placeholder colour for NumberInput ([#1222](https://github.com/signalxjs/lynx/issues/1222)) is fixed upstream in [signalxjs/zero#403](https://github.com/signalxjs/zero/pull/403) and ships with the 0.13.0 pin. The gallery's `number-input/label` extra gains a `parse` that reads its format back.
- **A theme pinned while the app is still mounting reaches the root `ThemeProvider`: cold dark deep links no longer get white system-bar strips** ([#1193](https://github.com/signalxjs/lynx/issues/1193)). Under `?theme=dark`, most cold deep links into the zero gallery painted the status-bar and home-indicator strips white, with black status-bar text, around the dark screen. A warm link was correct. `useLinkingNav` routes a cold link from `onMounted`, and that hook runs inside the root provider's first render. The routed screen pins its theme there. The reactive core drops a notification to an effect that is still running ([signalxjs/core#739](https://github.com/signalxjs/core/issues/739)), so the provider kept the theme it had mounted with. Since #1212 the link is no longer delivered a second time, and that second delivery had been re-rendering the provider. The root and nested providers in `@sigx/lynx-daisyui` (lynx-zero-legacy) and `@sigx/lynx-zero` now re-render once after mounting if the theme or font scale changed during the mount. On the iOS simulator, 8 of 10 cold dark links were white before the fix. After it, 18 of 18 cold links across select, button, dialog, toast and tabs (dark and dim) were correct, and 11 of them took the in-mount path.
- **A cold deep link opens its screen once on iOS, so overlays no longer paint a ghost copy and heavy screens no longer flood `Lynx.Sigx.AvPublish`** ([#1181](https://github.com/signalxjs/lynx/issues/1181), [#1200](https://github.com/signalxjs/lynx/issues/1200)). A SwiftUI scene app forwards the launch URL from `onOpenURL` after the Lynx view exists, so the link reached the bundle twice: as `initialURL`, which `useLinkingNav` routes with `replace`, and as a `urlReceived` event, which it routed again with `push`. The stack held two copies of the screen. The covered copy's overlays still painted in the page-root outlet layer: a second popover over the section title, a doubled dialog backdrop, a second toast stack under the status bar (and, in Zero Pilot, a second toast for every one shown). The pushed copy also mounted a heavy section a second time during a push slide. `useLinkingNav` now drops a second delivery of the link it routed last while the screen that link opened is still on top. The #1197 settle loop also cost too much: every Popover and Select, open or closed, re-measured its anchor and the shared safe frame every 32 ms through the slide, and each measurement published a fresh object over the SharedValue bridge. Now `@sigx/lynx-runtime`'s `useViewportRect` does not publish a measurement equal to the current rect. `@sigx/lynx-zero`'s re-measure loops tick on one shared clock: loops due in the same frame measure in one batch, and the safe frame is measured once per batch. Only an open popup measures (`createAnchorPosition`'s new `isOpen` option), and each burst is capped at about two seconds. On the iOS simulator, `popover/open` showed the ghost on 4 of 6 cold links before the fix and 0 of 10 after. 50 cold links into `popover/size`, `select/size-1`, `popover/color-1`, `select/color-1` and `tabs/color-1` (dark) raised no 204 error.
- **`@sigx/lynx-navigation`: the edge-swipe back no longer throws on the main thread** ([#1201](https://github.com/signalxjs/lynx/issues/1201)). It regressed with device rotation (#920). Every edge-swipe back threw `TypeError: not a function` on iOS, and on Android too. A worklet reaches the module-level helpers it names through its capture, and the capture crosses to the main thread as JSON. JSON drops a plain function, and it also drops a method called on a captured object. The gesture called the plain `screenWidthMT()`, and `useScreenMT()` called `ORIENTATIONS.indexOf`. `useScreenMT()`, `useWidthClassMT()` and `useHeightClassMT()` in `@sigx/lynx-core` are now `'main thread'` functions. Call them from worklet code only. `useScreenMT()` is self-contained. This also fixes daisyui `<Select>`'s placement read, which captured `useScreenMT`. The gesture's per-drag state is now a main-thread ref owned by the `<Stack>`. Before, each handler had its own copy, so the drag was measured from x=0 and a fast flick could never commit. A ref owned by the edge handle would not work: the handle unmounts as the back transition starts. A new lynx-plugin test audits every workspace worklet's captures for these hazards. Verified on the iOS simulator (commit, cancel, flick) and the Android emulator.
- **Select's value no longer runs under the clear-trigger at `lg`/`xl`** ([#1191](https://github.com/signalxjs/lynx/issues/1191)). On the web, the skin makes room for the × with `:has(> clear-trigger)`. lynx's class grammar has no `:has()`, so the room was dropped and the value ran into the chip and its focus ring. zero now publishes this as a flag, `clearable`, on the trigger, value and indicator while the clear-trigger renders ([signalxjs/zero#387](https://github.com/signalxjs/zero/issues/387), shipped in [signalxjs/zero#388](https://github.com/signalxjs/zero/pull/388)). `@sigx/lynx-zero` stamps it as `zx-f-clearable`, but only on the parts the installed zero declares it for. The daisy skin reserves the chip's width off the flag, and the value clips with an ellipsis. The skin rule and the anatomy ship with the 0.11.0 pin. The showcase gallery adds a `clearable long` Select state.
- **Showcase zero gallery: every section fits one screen, and `?theme=` themes the whole page** ([#1192](https://github.com/signalxjs/lynx/issues/1192), [#1193](https://github.com/signalxjs/lynx/issues/1193)). With sizes 1:1 with the web since the 0.10.0 pin, some sections ran off the bottom of the screen (accordion and select rows missing from every shot), and xl switch, dialog and popover cells overlapped their neighbours. Each registry entry now carries a `cell` model, the footprint of its largest state cell per size, computed from the daisy size ramp. The axis sections paginate from it, so section ids such as `accordion/color-3` changed. A layout test asserts that every section fits an iPhone 17 Pro screen and every cell fits its column. The switch, dialog, popover, select and button columns widen, and the toast rows put their label above the cells. Under `?theme=`, the status-bar and home-indicator strips stayed the app theme's white, with black status-bar text. While a gallery screen is focused, the app theme now mirrors the zero theme's scheme and `base-100`.
- **`@sigx/lynx-zero` overlays on iOS: popups opened at mount land at their anchor, toasts clear the safe area, and the page scrolls while a toast or popover is open** ([#1181](https://github.com/signalxjs/lynx/issues/1181), [#1182](https://github.com/signalxjs/lynx/issues/1182), [#1190](https://github.com/signalxjs/lynx/issues/1190)). A cold deep link opens its screen with a push slide. The anchor and the safe frame were measured mid-slide, a screen width to the right. A slide is a transform and fires no layout event, so they were never measured again: anchored popups stayed clamped against the right edge, and the frame, poking out of the window, was dropped, so toasts sat under the status bar and in the home-indicator strip. Both now keep re-measuring until they hold still, and a frame outside the window counts as still moving. The page could not scroll because iOS starts a scroll view's pan from UIKit's hit-test, which ignores `pointer-events`. The full-window outlet layer was the deepest view under every point. The layer is now 0×0 with `overflow: visible`; the window's size comes from a childless sizer that is out of both hit-tests. Popover and Select light-dismiss through a surface that is out of native hit-testing, with the popup as its sibling, so a tap outside still closes them. A pan beside them scrolls the page, and the popup follows its anchor through the scroll and its fling. A dialog backdrop still holds the pan. Android is unchanged in behaviour and was re-verified on the emulator. The "ghost" second copy reported in #1181/#1182 no longer reproduced on main after #1187.
- **`@sigx/lynx-zero` overlays: taps reach the overlay again, one popup paints at its anchor, toasts clear the safe area** ([#1180](https://github.com/signalxjs/lynx/issues/1180), [#1181](https://github.com/signalxjs/lynx/issues/1181), [#1182](https://github.com/signalxjs/lynx/issues/1182)). Regressions from the 0.33.1 full-window outlet. Both engines inherit `pointer-events`, so everything inside the `pointer-events: none` outlet layer was `none` too. On Android every tap on a dialog, popover or Select went to the page underneath: a Select item opened the button below it, and a dialog could not be closed. The root of every overlay now sets `pointer-events: auto`, exported as `OVERLAY_ROOT_STYLE` for custom overlays rendered through `useOverlayPortal()`; a touch that misses every overlay still reaches the page. The outlet layer now mounts once with the page and only toggles `display`, instead of re-inserting a fixed node each time something opens, and its rect is no longer measured: it sits at the page root's origin with its own layout size (`fixedOutletRect`). On iOS the measured rect came back shifted, which rejected the safe frame (toasts under the status bar and in the home-indicator strip) and pushed anchored popups into the right-edge clamp, with a second copy of the last popup painted at the top left.
- **Select's clear-trigger on the daisy skin: a small chip beside the chevron, not a full-height pill over it** ([#1184](https://github.com/signalxjs/lynx/issues/1184)). The × stretched to the field's full height, at an offset set for the `md` trigger, so its focus ring was a tall pill that covered half the ▾ at `lg` and `xl`. The skin now draws a 1.5rem square chip, centred in the field and placed per size just before the chevron, whose box is pinned to `1em`. Its focus ring is inset, inside the chip. The fix is in the skin upstream ([signalxjs/zero#383](https://github.com/signalxjs/zero/pull/383)) and ships with the 0.10.0 pin. A regression test pins the size stamps the skin places the chip by.
- **zero skins size components at the web's 16px rem on lynx** ([#1183](https://github.com/signalxjs/lynx/issues/1183)). Lynx resolves `rem` against its 14px default page font size, so every rem-based zero size drew 12.5% small: daisy's buttons measured 21/28/35/42/49 instead of 24/32/40/48/56. zero-kit's lynx emitter now rewrites every `rem` length to `px` at 16px/rem ([signalxjs/zero#381](https://github.com/signalxjs/zero/issues/381)). The change ships here with the 0.10.0 pin. App CSS outside the skin is not rewritten, so a `rem` there still resolves at 14px. The `lynx-zero-daisyui` and `lynx-zero` READMEs document this. The Zero Pilot probe's rem control is relabelled to the engine's 140px.
- **daisyUI focus rings on lynx follow the part's radius** ([#1163](https://github.com/signalxjs/lynx/issues/1163), [#1164](https://github.com/signalxjs/lynx/issues/1164)). Lynx's `outline` ignores `border-radius` and lynx has no `outline-offset`, so every forced focus ring painted as a square box flush on the part. The fix is in the skin upstream ([signalxjs/zero#365](https://github.com/signalxjs/zero/issues/365)) and takes effect here with the next `@sigx/zero-daisyui` bump; until then the pinned 0.7.0 still paints the outline. With the bump, the rings will be two spread box-shadows, a 2px surface gap then 2px of ink, which follow the radius. The Accordion trigger's ring will be inset, because the item card clipped it away, and the Slider ring will be on the thumb only. The showcase gallery adds Select's `focus-visible` and `clear focus` states.
- **`@sigx/lynx-zero` Button on the daisy skin: the loading spinner, the disabled outline/dash border, and labels breaking mid-word** ([#1161](https://github.com/signalxjs/lynx/issues/1161), [#1162](https://github.com/signalxjs/lynx/issues/1162), [#1165](https://github.com/signalxjs/lynx/issues/1165)). The cause of the first two is a lynx engine rule. A declaration holding `var()` is stored unexpanded under its own property id and expanded after the cascade, in the order the property ids were first seen. So a var-bearing `border`/`border-color` beat a static longhand of the same edge whatever its specificity. That closed the spinner's transparent arc, so the spin could not be seen, and it kept the ink border on a disabled outline or dash button. The daisy skin's lynx section now writes every var-bearing edge as longhands ([signalxjs/zero#372](https://github.com/signalxjs/zero/pull/372)). The button root, and the Dialog and Popover triggers, are now content-sized and never squeezed, as daisy's `btn` is: in a row narrower than its content a button overflows instead of breaking its label mid-word. `block` and `wide` now fill the row on lynx, where they never applied before. The skin changes arrive with the next zero release. The `lynx-zero` README documents the `var()` shorthand rule for skin authors. The showcase gallery's button sections widen and gain `modifiers` and `squeeze`.

## [0.33.1] - 2026-09-27

### Added

- **`@sigx/lynx-zero`: `useOverlayInsets()`**, with the pure `computeOverlayInsets` and `containedFrame` ([#1169](https://github.com/signalxjs/lynx/issues/1169)). It returns the per-edge insets of the host's safe frame inside the full-window overlay outlet (see Fixed), for a custom overlay that should dim the whole window but keep its content clear of the status bar, the home indicator and any header. `provideOverlayOrigin` takes the frame as an optional third argument.

### Fixed

- **`@sigx/lynx-zero`: overlays cover the whole window** ([#1169](https://github.com/signalxjs/lynx/issues/1169)). The overlay outlet used to be the `ZeroRoot` host itself, so inside a `SafeAreaView` a dialog backdrop left the status-bar and home-indicator strips undimmed, and a bottom toast's shadow was cut at the inset. The outlet is now a `position: fixed` layer, which lynx attaches to the page root, so no clipping ancestor (a navigation stack, safe-area padding) confines it. It mounts only while something is open and is `pointer-events: none`, so a touch that misses every overlay still reaches the page. The host's own box is the safe frame the content respects: the dialog panel centers in it, toast viewports pin to its edges, and Popover and Select flip and clamp against it. A frame measured mid-transform is ignored until it is re-measured. The outlet no longer rides a screen transform, so an open overlay stays put while its screen slides. The showcase gallery adds `dialog/nested`: a Select opened inside an open dialog.
- **`@sigx/lynx-zero` Select popup** ([#1167](https://github.com/signalxjs/lynx/issues/1167), [#1168](https://github.com/signalxjs/lynx/issues/1168)). The popup and each group are now flex columns, so item rows and the group separator span the popup: the pressed wash fills the row and the separator rule shows. Every portalled part carries the root's colour axis, and a regression test covers it. The skin half, which restates `--select-accent` on the popup and moves the width bounds onto the root so the clear-trigger stays over the trigger ([#1166](https://github.com/signalxjs/lynx/issues/1166)), is [signalxjs/zero#367](https://github.com/signalxjs/zero/pull/367). It lands with the next zero bump.
- **`@sigx/lynx-cli`: debug installs build only for the connected device's ABI** ([#1170](https://github.com/signalxjs/lynx/issues/1170)). `run:android` and the dev dashboard's installs now pass `android.injected.build.abi`, as Android Studio's Run does, so the debug APK carries one ABI's native libs instead of four. The showcase APK drops from 245 MB to 90 MB. The full APK made installs fail with "Requested internal only, but not enough space" on emulators with default-size storage. Every ABI is still packaged when the connected devices differ in CPU architecture, or when `SIGX_ANDROID_ALL_ABIS=1` is set. That install error now gets an out-of-storage hint. The hint makes clear that the space it means is the device's, not the host disk's.

### Changed

- **`@sigx/zero-daisyui` 0.7.0 draws the daisy tabs underline on `Tabs.Indicator`** ([signalxjs/zero#340](https://github.com/signalxjs/zero/issues/340), [signalxjs/zero#341](https://github.com/signalxjs/zero/pull/341)). With 0.33.0 the skin kept the indicator hidden and the tab border stood in for the underline. On the 0.7.0 pin, the `border` flavor paints daisy's 3px, 80%-wide bar in the active ink on the measured indicator box, and the tab draws no border of its own. `lift` and `box` keep the indicator hidden. A `@sigx/lynx-zero-daisyui` test now holds the shipped CSS to this.
- **`@sigx/zero` and `@sigx/zero-daisyui` pinned to 0.7.0** ([#1159](https://github.com/signalxjs/lynx/issues/1159)). The release carries the daisyUI lynx-fidelity fixes for button, toast, tabs, accordion, timeline, dialog, popover, select, progress, slider and switch ([signalxjs/zero#338](https://github.com/signalxjs/zero/pull/338), [signalxjs/zero#339](https://github.com/signalxjs/zero/pull/339), [signalxjs/zero#341](https://github.com/signalxjs/zero/pull/341), [signalxjs/zero#343](https://github.com/signalxjs/zero/pull/343)).

## [0.33.0] - 2026-09-26

### Added

- **`@sigx/lynx-zero/testing`: `ForceStates`** ([#1141](https://github.com/signalxjs/lynx/issues/1141)). It forces interaction flags such as `pressed` and `focus-visible` onto every lynx-zero part below it, so a held press or a focus ring can be rendered and screenshotted without input. A flag lands only on the parts whose anatomy declares it, and it is applied as both the `zx-f-*` class and the `data-*` attribute, so a forced tree still passes `expectAnatomy` and `expectClassGrammar`. `parts` limits the forcing to named parts, `false` forces a flag off, and a nearer `ForceStates` replaces an outer one. A viewport carries the forcing across its portal to the toasts in the overlay outlet.
- **`@sigx/lynx-zero`: `Select.Root` takes `defaultOpen`**, matching Dialog and Popover.
- **`@sigx/lynx-zero`: Dialog, Popover and Select on zero 0.6's anatomy** ([#1146](https://github.com/signalxjs/lynx/issues/1146)). Select gains `clearable`, which renders a `clear-trigger` beside the trigger while something is selected (`clearLabel` names it), and `groupSeparators`, which draws a `separator` between runs of options (zero#321). It also gains `readonly`, from the prop or the Field: the root and trigger carry the flag, the popup stays shut and nothing writes the value. The open state is now a model (`model:open`, `onOpenChange`). The indicator, item indicator and clear glyphs (`▾`, `✓`, `×`) render as `<text>`, because lynx has no pseudo-elements and the indicators used to be empty views. New `Dialog.Cancel` is the least-destructive action of an alert-style dialog. `Dialog.Close`, `Dialog.Cancel` and `Popover.Close` take `disabled` and `label`. The showcase gallery adds Select's `readonly` and `clearable` states and the overlays' open-state sections.
- **`@sigx/lynx-zero`: `computeOutletPosition`**, the placement math in outlet coordinates (see Fixed).
- **`@sigx/lynx-zero`: `Tabs.Indicator`**, zero 0.6's indicator part ([#1145](https://github.com/signalxjs/lynx/issues/1145); [signalxjs/zero#324](https://github.com/signalxjs/zero/issues/324)). On lynx the part positions itself as an absolute box over the active tab. The box is measured from the tab's and the list's rects, and its size comes from the tab's layout frame, so a press transform does not shrink it. The skin only paints it. `Tabs.List` renders one on its own: on lynx it is where daisy's active underline is drawn, because lynx drops the web's `::before`. An app-placed `<Tabs.Indicator />` replaces the list's own.
- **`@sigx/lynx-zero`: `Accordion.Root` takes `orientation` and `disabled`** (zero 0.6). The orientation is stamped on the root and every trigger. A trigger's accessibility status now announces `expanded`/`collapsed`.
- **Showcase: zero state-matrix gallery** (`/zero-gallery/:scope/:section`). Each section shows every axis value of a lynx-zero scope against every forced state on one screen. It is driven by a registry with one entry per scope. The showcase now answers `showcase://` deep links.
- **`scripts/zero-qa/`**: tap-free visual QA on the iOS simulator. `sim-lock.mjs` is an atomic owner lock for the single simulator. `shoot.mjs` deep-links into a gallery section, waits for the screen to settle, and saves the screenshot plus zoomed crops. `web-ref.mjs` captures zero's web playground as a reference. `sheet.mjs` builds a self-contained HTML contact sheet. See `scripts/zero-qa/README.md`.
- **`@sigx/lynx-zero`: main-thread press feel** ([#1143](https://github.com/signalxjs/lynx/issues/1143)). Every part wired through `createPressFeedback` now responds in the same frame as the touch. That covers Button, the Tabs tab, the Accordion trigger, the Dialog and Popover triggers and closes, the Select trigger and items, and the Toast action and close. The touch handlers are main-thread worklets: touch-down scales the touched element to `PRESSED_SCALE` (0.97), then hands the `pressed` flag to the background thread for the skin's own pressed paint. Release restores the scale. Neither tier fires while the part is disabled. `createPressFeedback({ feel })` tunes it: `feel: false` keeps only the flag, and `feel: { scale, opacity }` adjusts the feel. Opacity is off by default, because the release writes an explicit `opacity: 1` that would hide a skin's disabled fade. Button takes `pressFeel={false}`. Without the worklet transform (unit tests), the handlers fall back to background touch handlers that drive the flag alone. `PRESSED_SCALE` and `PRESSED_OPACITY` are exported.
- **`@sigx/lynx-zero`: `Button` takes `loading`** ([#1143](https://github.com/signalxjs/lynx/issues/1143)). It blocks the press like `disabled`, stamps zero's `loading` state instead of the disabled fade, and renders the anatomy's `spinner` part before the label.
- **`@sigx/lynx-zero`: Toast follows zero's anatomy** ([#1143](https://github.com/signalxjs/lynx/issues/1143)). A toast is created `closed` and flips to `open` a frame later, so the skin's entry transition plays. `dismiss(id)` flips it back and removes it once the exit has played (`createToaster({ exitDuration })`, 200 ms by default; the new `remove(id)` skips the exit). A toast can carry `color` and an `action` (`{ label, onPress }`, rendered as the anatomy's `action` part), and `Toast.Viewport` takes `size`. The parts are public and compose like zero's: `Toast.Root` / `Title` / `Description` / `Action` / `Close`. They also render in place, outside a viewport. An enclosing `ForceStates` now reaches a viewport's cards across the portal.
- **`@sigx/lynx-zero`: Switch, Slider and Progress on the zero 0.6 anatomy** ([#1144](https://github.com/signalxjs/lynx/issues/1144)). `Switch` and `Slider` take `readonly`, from the prop or the enclosing Field. A readonly control is still announced, but it refuses every tap or drag and shows no press. `Slider` accepts a `number[]` model: one thumb per value, the nearest thumb drags, thumbs never cross, and `minStepsBetweenThumbs` keeps them apart. It also takes `orientation="vertical"` (bottom-to-top) and fires `valueCommit` once when a drag that moved the value ends. Its handlers are typed by the model's shape. `Progress` takes `min` and `getValueText`/`locale`/`formatOptions`. `Progress.ValueText` with no children shows the formatted value, and the root's accessibility label announces the same string.

### Changed

- **`@sigx/lynx-cli`: the Android template moves to Gradle 9.8, AGP 9.4 and Kotlin 2.4 — JDK 25 and 26 build directly** ([#1149](https://github.com/signalxjs/lynx/issues/1149)). Gradle 8.11 couldn't run on anything newer than JDK 23, so a machine with only the current LTS (JDK 25) had to fall back to Android Studio's JDK. The supported range is now JDK 17–26; verified with debug and release builds on JDK 25 and 26. AGP 9 compiles Kotlin itself (built-in Kotlin):
  - the app module no longer applies `org.jetbrains.kotlin.android`, and the Lynx annotation processor runs through AGP's `com.android.legacy-kapt`;
  - `kotlinOptions` is gone; Kotlin's `jvmTarget` follows `targetCompatibility`;
  - `androidx.vectordrawable` is pinned to 1.2.0, because AGP 9 rejects the 1.0.0 artifacts that share a namespace (they arrive transitively on release builds with Firebase).

  **Existing apps upgrade on their next prebuild.** The root `build.gradle.kts`, `gradle/wrapper/gradle-wrapper.properties`, `gradlew`, `gradlew.bat` and `gradle-wrapper.jar` are now managed files: sigx refreshes them on every prebuild, like `app/build.gradle.kts` and the version catalog. The versions must move together. Build logic you added to the root `build.gradle.kts` is overwritten; put it in `app/build.gradle.kts` instead.

- **`@sigx/lynx-zero-daisyui` builds from `@sigx/zero*` 0.6.0** (was 0.4.0) ([#1150](https://github.com/signalxjs/lynx/issues/1150)). The skin's press rules now reach lynx ([signalxjs/zero#326](https://github.com/signalxjs/zero/issues/326)): a held Button, Toggle, Pagination item, Steps item, Alert action, Combobox option or Number-input stepper paints `.zx-f-pressed` instead of nothing. This also brings in the zero 0.5/0.6 anatomy additions.

- **`@sigx/lynx-zero`: `provideVariantAxes` returns the reader it provides.** The returned reader includes any flags forced by an enclosing `ForceStates`. Carriers now stamp their own part from it with `const axes = provideVariantAxes(…)`. `partAxes` also carries `forced`, and `partBag` takes a `forced` option.

### Fixed

- **`@sigx/lynx-zero`: Popover and Select opened at mount no longer render off-screen to the left** ([#1146](https://github.com/signalxjs/lynx/issues/1146)). The overlay outlet's origin was measured once, at mount, while the screen was still sliding in on its navigation push. The anchor was measured again after the slide settled, so the popup landed a screen width to the left. Placement now runs in the outlet's own space. The anchor, the popup and the outlet are re-measured together on every trigger, and flip/clamp work against the outlet's box, so a translation shared by the anchor and the outlet cancels out. `provideOverlayOrigin` takes an optional `measure` as its second argument, and `OverlayHost` wires it.
- **`@sigx/lynx-zero`: the toast viewport no longer renders shifted left** ([#1143](https://github.com/signalxjs/lynx/issues/1143)). The skin's web centering (`left: 50%` + `translateX(-50%)`) survived under the viewport's inline full-width `left: 0`, which pulled the strip half its width off the left edge. The viewport now cancels the transform inline and sets `display: flex`, which it needs because a lynx view defaults to linear layout.
- **`@sigx/lynx-zero` Slider lands on the touched value on Android** ([#1144](https://github.com/signalxjs/lynx/issues/1144)). Android's `bindlayoutchange` rect is not page-relative, so a slider anywhere but the page origin mapped touches to the wrong value. Touches now map through the track's viewport rect (`boundingClientRect` against `clientX`/`clientY`). The layout frame is the first-touch fallback, and each touch-down re-measures.
- **`@sigx/lynx-zero` Progress: an indeterminate range writes no inline width** ([#1144](https://github.com/signalxjs/lynx/issues/1144)). The inline 30% overrode the skin's 40% sweep. A degenerate range with a value now reads as `complete` at full width, as zero 0.6 does. Before, it fell back to a 0–100 range.
- **iOS deep links reach `@sigx/lynx-linking`** ([#1141](https://github.com/signalxjs/lynx/issues/1141)). A SwiftUI scene app never receives `application(_:open:)` or a launch-options URL; the scene gets them. So no deep link arrived, cold or warm. The `sigx prebuild` iOS template now forwards `.onOpenURL` and `.onContinueUserActivity` to the generated package hooks. An existing iOS project keeps its old `App.swift` because the scaffold writes it only once. Regenerate the `ios/` directory, or add the two modifiers to the `WindowGroup` content by hand.

These `@sigx/lynx-cli` fixes cover the first-run experience ([#1147](https://github.com/signalxjs/lynx/issues/1147)). A fresh app on a stock Windows + Android Studio machine failed twice: `sigx dev` stopped at a bare ES-module link error, and `sigx run:android` failed with `What went wrong: 25.0.2`.

- **Android builds pick a JDK Gradle can run.** Gradle 8.11 can't start on JDK 25. The failure was a bare version string, and `sigx doctor` reported the same JDK as fine. JDK discovery now checks the major version against the supported range across `JAVA_HOME`, `PATH` and Android Studio's bundled JDK on Windows, macOS and Linux. If `JAVA_HOME` / `PATH` are out of range, it uses the bundled JDK and says so in one line. It also fixes the `JAVA_HOME` probe on Windows, which never matched because it looked for `java` without `.exe`. The dev dashboard's installs now get the same JDK/SDK environment as `run:android`.
- **Android build failures name the cause and the fix.** The error is now `Android build failed: <Gradle's reason>` plus a fix for known causes: JDK out of range, SDK not found, SDK licenses, NDK missing, no device, signature mismatch, out of memory, network. Before, it was a bare `Android build failed`.
- **Version-mismatch check before `dev` / `build` / `run:*`.** An app whose `@sigx/runtime-core` / `@sigx/reactivity` / `@sigx/cli` didn't match its `@sigx/lynx-*` packages crashed with `does not provide an export named 'declareLiveClient'`. Older `npm create @sigx` templates pinned core `^0.7.0`. These commands now stop with the mismatched versions and `npx sigx upgrade` as the fix, and `sigx doctor` checks the same thing.
- **`sigx upgrade` updates the whole set.** It now also moves `@sigx/runtime-core`, `@sigx/reactivity`, `@sigx/cli` and the `@lynx-js/*` build packages to the ranges the target release declares. It includes the `@sigx/lynx` umbrella, which it used to skip. And on Windows it runs the install instead of failing with exit code `null`, as it did on current Node: `npm.cmd` can't be spawned without a shell. The same fix applies to `sigx add` / `sigx remove`.
- **`run:android` launches the app it installed.** An `applicationId` with a hyphen (every template default, e.g. `com.example.my-app`) installs as `com.example.myapp`. The install check and auto-launch used the raw id, so the dashboard said "no sigx app installed" and never launched it.
- **`run:android` with no device connected** boots the most recently used emulator, or says how to create one. It no longer runs a full Gradle build that ends in `No connected devices!`.
- **No more `DEP0190` warnings, and paths with spaces work.** Gradle and `npx rspeedy` are spawned without `shell: true`. That also fixes projects whose path contains a space on Windows.
- **Android SDK found in Android Studio's default location without `ANDROID_HOME`**, including `%LOCALAPPDATA%\Android\Sdk` on Windows. This applies to the SDK, `adb` and emulator lookups.
- **`sigx doctor`:**
  - Requires Node 22 (it accepted 18).
  - Lists emulators.
  - Prints a `fix:` line for each problem and exits non-zero on errors.
  - Stops warning about the optional `sigx-lynx-go` sandbox app.
- **`@sigx/lynx-plugin`: `sigx dev` works on pnpm-installed apps.** The HMR client (`@rspack/core/hot/dev-server`) and the runtime's MT hot-update bridge (`@rspack/core/hot/emitter`) were requested from the app and from `@sigx/lynx-runtime`, and neither depends on `@rspack/core`. npm's hoisting hid that. Under pnpm every dev build failed with `Can't resolve '@rspack/core/hot/dev-server'`. `@rspack/core/hot` now resolves to the copy rspeedy runs.
- **`@sigx/lynx-plugin`:** the `@lynx-js/css-extract-webpack-plugin` peer is `^0.10.1` (was `>=0.10.1`). 0.11 needs `template-webpack-plugin ^0.16`, so npm hit `ERESOLVE` against the pinned 0.15.0.
- `@sigx/lynx-cli` declares `engines.node >=22`. Its tarball no longer ships a stray Gradle cache from `templates/android/.gradle`.

## [0.32.0] - 2026-09-26

### Added

- **`@sigx/lynx-zero`: a part that re-carries an axis is a nearer provider** ([#1125](https://github.com/signalxjs/lynx/issues/1125); zero's `PartSpec.carries`, [signalxjs/zero#94](https://github.com/signalxjs/zero/issues/94)). A part whose anatomy declares `carries` for a named axis stamps its own value (`zx-a-<axis>-<value>`) on itself and every part below it, and passes the carrier's value through when it has none. The nearest provider wins, matching the web compiler. New `provideCarriedAxes(anatomy, part, own)` opts a part in; it takes only the axes the anatomy declares. No new CSS is needed: the compiled lynx rule is the same whichever element supplied the value.
- **`@sigx/lynx-zero`: `Timeline`** (`Root` / `Item` / `Marker` / `Connector` / `Content`) on zero's timeline anatomy, styled by the `timeline.css` the design-system shell already ships. `Timeline.Marker` takes `color`, mirroring zero's `TimelineMarkerProps`: its own value outranks the root's, and a marker without one follows the root.

### Changed

- **`@sigx/lynx-daisyui`: navigation, markdown and emoji skins move to subpaths** ([#1136](https://github.com/signalxjs/lynx/issues/1136)). **Breaking.** The root barrel re-exported components that statically import the package's *optional* peers (`@sigx/lynx-navigation`, `-markdown`, `-emoji`, `-sheet`). An app that installed only `@sigx/lynx-daisyui`, as the README says, failed to bundle with `Module not found`. That included every app from `npm create @sigx -- --kind lynx --styling daisyui`. Import them from their subpaths instead, the same pattern as `@sigx/lynx-heroui/navigation`:
  - `NavTabBar`, `NavHeader`, `NavDrawer` (+ prop types) → `@sigx/lynx-daisyui/navigation`
  - `markdownComponents`, `useMarkdownEditorTheme`, `EditorToolbar`, `daisyToolbarItem` (+ types) → `@sigx/lynx-daisyui/markdown`
  - `emojiClasses`, `emojiClassesBottomTabs`, `EmojiPickerSheet` (+ props) → `@sigx/lynx-daisyui/emoji`
- **`@sigx/lynx-navigation`: `@sigx/lynx-linking` is a required peer.** It was marked optional, but the root entry imports it unconditionally (URL parsing, `useHardwareBack`, `useLinkingNav`), so it was never optional in practice.
- **New guard:** `scripts/__tests__/optional-peers.test.mjs` fails when any package's root entry statically reaches an optional peer. Peer-dependent code goes on a subpath the app opts into.
- **`@sigx/lynx-zero/testing`: `expectAnatomy` checks a stamped axis against its nearest provider.** A named-axis attribute is accepted only on the carrier or on a part that declares it carries that axis (zero's rule). A value pushed down below a re-carrying part must now match that part, not the carrier. Before, it was compared with the carrier and failed.

### Fixed

- **`@sigx/lynx-daisyui`: `Card.Actions`, `Modal.Actions`, `Tabs` and `Steps` lay out in a row again** ([#1136](https://github.com/signalxjs/lynx/issues/1136)). Their rules (`.card-actions`, `.modal-action`, `.tabs`, `.steps`) set `flex-direction: row` without `display: flex`. Lynx views use linear layout by default, so the children stacked vertically on device. The same bug hit `Rating` in #508. A new guard, `scripts/__tests__/css-flex-display.test.mjs`, fails on any package stylesheet rule that sets `flex-direction: row` without `display: flex` (on the rule itself or on the base class it modifies).

## [0.31.0] - 2026-09-22

### Changed

- **sigx core 1.0** ([#1126](https://github.com/signalxjs/lynx/issues/1126)). **Breaking.** The catalog moves `@sigx/reactivity` and `@sigx/runtime-core` from `^0.15.0` to `^1.0.0`, so an app on `@sigx/lynx` needs sigx core 1.x. The siblings move with it to their core-1.0 releases: `@sigx/cli` `^0.12.0`, `@sigx/terminal` `^0.13.0`, `@sigx/richtext` and `@sigx/richtext-markdown` `^0.4.0`, and `@sigx/zero` and `@sigx/zero-daisyui` `0.4.0` (exact pins). Core 1.0 ships the global `JSX` namespace, so a component typed `=> unknown` is no longer a JSX element type. `List` (lynx-list), `Link` and `Header` (lynx-navigation), the daisyui and heroui `NavHeader`s, and `Swiper` (lynx-gestures) are now typed `JSXElement`. `@sigx/lynx` re-exports core's newly promoted `peekRestored`, `invalidateRestored` and `provideTypeHandlers`.
- **`@sigx/lynx-zero`: `Select` moves onto zero's collection core.** **Breaking.** zero 0.3 removed the `options` sugar (`segmentOptions`, `OptionInput`, `OptionSegment`). `Select.Root` now takes `items` with `itemKey` / `itemLabel` / `itemValue` / `itemGroup`, infers `T` from `items`, and models `T | null` (or `V | null` under `itemValue`). A scoped `item` slot customises a row. `SelectOption` is gone. The behaviors barrel exports `createCollection`, `segmentBy`, `defaultItemKey`, `defaultItemLabel` and the `Collection*` types instead. The zero 0.3/0.4 contract additions (the layout vocabulary, `AXIS_VALUE_PATTERN`, `RESERVED_DATA_ATTRS`, `htmlAttrs`, `changeEventOf`, `defaultPropOf`, …) are re-exported through `@sigx/lynx-zero`.
- **`@sigx/lynx-zero/testing`: `expectAnatomy` checks axis push-down against zero's carrier rule.** zero 0.3's oracle rejects a `data-color` / `-size` / `-variant` on any part that is not the carrier and does not declare `carries`. On lynx every part stamps the carrier's axes, because lynx CSS has no descendant selector. The adapter now checks each stamped axis against the carrier it came from (the nearest carrier above the part, or else the scope's first carrier) and hides it from that rule. A stamped value that disagrees with its carrier, or that no carrier renders, fails.
- **`@sigx/lynx-markdown`, `@sigx/lynx-emoji/markdown`, `@sigx/lynx-daisyui/markdown` move onto the richtext packages** ([#1122](https://github.com/signalxjs/lynx/issues/1122)). **Breaking.** `@sigx/markdown` is superseded by `@sigx/richtext` (the core: schema, formats, render engine, editor) and `@sigx/richtext-markdown` (the CommonMark + GFM parser and serializer, `markdownFormat`, `markdownPreset`), both at `^0.3.0`. `MarkdownView` and `MarkdownEditor` keep their names and props; underneath, the editor installs `markdownPreset` (input rules and the `text/markdown` clipboard flavour are no longer built into the core) and reads / writes source through `markdownFormat`. Plugin shape: `RichTextPlugin` replaces `MarkdownPlugin` — node specs under `nodes`, markdown syntax and serializer rules under `formats.markdown` (`{ name, nodes: [emojiNode], formats: { markdown: { inline: [createEmojiSyntax()] } } }`); `InlineKindSpec` / `mentionInlineKind` are gone (a node spec's `inline` mapping — `lynxMentionNode` keeps the chip's `kind`). Types: `LynxMarkdownComponents` is `ComponentMap<JSXElement>` (only `root` required), `LynxMarkdownChild` is `RenderChild`; re-exports: `createTextStream` (was `createMarkdownStream`), `markdownFormat`, `lynxMentionNode`, and `markdownPreset` on the editor entry; the `declare module` augmentation for plugin nodes targets `@sigx/richtext`. `lynx-emoji/markdown` exports `emojiNode`; `lynx-daisyui`'s `markdownComponents` is typed as `LynxMarkdownComponents`.

## [0.30.0] - 2026-09-12

### Changed

- **`@sigx/lynx-markdown`: `MarkdownEditor` is now the Lynx host of `@sigx/markdown/editor`'s block-tree core** ([#1117](https://github.com/signalxjs/lynx/issues/1117); closes [#755](https://github.com/signalxjs/lynx/issues/755); roadmap [signalxjs/markdown#6](https://github.com/signalxjs/markdown/issues/6)). **Breaking.** The editor used to be a single `<sigx-richtext>` field over a flat span model with its own markdown converters, plugin contract and trigger machinery. It is now one `createEditor()` per component: the document is the mdast `Root` every sigx package shares, every root block renders as a keyed `BlockView` — paragraphs and headings as native rich-text fields in `boundary-keys` mode (#1116), code blocks as a `<textarea>`, lists / quotes / tables as views — and the core owns state, history, commands, keymap, input rules, plugins and trigger sessions. Untouched blocks are never re-rendered. New: `document` / `onDocumentChange(doc, transaction)` alongside `value` / `onChange(markdown)`, `keymap`, `inputRules`, `components` (block chrome), `suggestions="none"` + `renderSuggestions(api)` + `onTriggerSession` for hosts that dock their own suggestion list (#755), `controller.editor` / `run(command | name)` / `getDocument` / `setDocument` / `setMarkdown` / `undo` / `redo`. The `@sigx/lynx-markdown/editor` entry also exposes the surfaces (`createLynxInlineSurface`, `createLynxCodeSurface`, `flatToDoc` / `docToFlat`), the block views (`BlockView`, `InlineBlock`, `CodeBlock`, `createLynxEditorView`) and re-exports the core's editor API (`createEditor`, `commands`, `commandRegistry`, `createSlashPlugin`, `createTriggerSessionManager`, `toolbarState`, …) so a Lynx app keeps a single import. Requires `@sigx/markdown ^0.2.0`. On a native build without `bindboundarykey` the editor degrades: a typed newline still splits the block, but Backspace / Delete at a block's edges stay in-block and arrows do not cross blocks.

  | Before | After |
  |---|---|
  | `MarkdownEditorPlugin { name, inline, trigger, toolbar }` (`plugins` prop) | `MarkdownPlugin` with an `editor` slice (`{ inline, triggers, toolbar, commands, keymap, inputRules }`) — the core's `EditorPlugin`; `plugins` takes the same array `<MarkdownView>` does |
  | `InlinePluginSpec { syntax, component, serialize }` | `plugin.inline` (syntax) + `plugin.serialize` + `plugin.editor.inline: InlineKindSpec[]`; preview components go to `components` |
  | `TriggerSpec.onQuery` / `onSelect(item, api)` with `api.controller`, `api.replaceQuery(text)` | the core's `TriggerSpec` (`search`, `onSelect(item, api)`); `api.replaceQuery({ text, spans })`, `api.run(command)`; row renderers via `renderItem` on the spec (`LynxTriggerExtras`) |
  | `createTriggerSessionManager` (Lynx) | the core's, re-exported unchanged in name |
  | `mdToDoc` / `docToMd` | removed — `parseMarkdown` / `toMarkdown` from `@sigx/markdown`; the per-block `flatToDoc` / `docToFlat` are the element mapping |
  | `onSelectionChange(sel: SelectionState)` | `onSelectionChange(selection: EditorSelection)` (key-addressed) |
  | `controller.getSelection(): SelectionState \| null` | `controller.getSelection(): EditorSelection` |
  | `createMentionPlugin({ search, renderItem, component, trigger, debounce })` → `MarkdownEditorPlugin` | same options → a `MarkdownPlugin` (`LynxMentionPlugin`, with `component` for `<MarkdownView>`); a baseline mention plugin is always registered so `insertChip` round-trips without one |
  | `@sigx/lynx-daisyui` `<EditorToolbar selection>` | no `selection` prop — active states come from the editor; `daisyToolbarItem(item, active, run, enabled)` |
  | `@sigx/lynx-emoji/markdown` `createEmojiPlugin()` → `MarkdownEditorPlugin` | → `MarkdownPlugin` with an `editor` slice (usable in `<MarkdownView plugins>` too) |

  Keyboard on device: Enter splits, Backspace at a block's start joins, Delete at its end joins forward, ArrowUp / ArrowDown off the first / last line move between blocks, Tab / Shift-Tab indent list items, Escape selects the block. Android verified on a Pixel; iOS reviewed only.

### Added

- **`@sigx/lynx-richtext`: `boundary-keys` mode — the keys that cross a block's edge are reported, not acted on** ([#1116](https://github.com/signalxjs/lynx/issues/1116); for the block-tree editor host of `@sigx/markdown/editor`, roadmap [signalxjs/markdown#6](https://github.com/signalxjs/markdown/issues/6)). `<RichTextInput boundaryKeys onBoundaryKey>` (`boundary-keys` attribute, `bindboundarykey` event, `RichTextBoundaryKey` / `RichTextBoundaryKeyEvent` types): `Enter` / `Shift-Enter` always (Return never inserts `\n` in this mode), `Backspace` collapsed at 0, `Delete` collapsed at the end, `ArrowUp` / `ArrowDown` on the first / last visual line, `ArrowLeft` / `ArrowRight` at the edges, `Tab` / `Shift-Tab` and `Escape` — with `{ key, start, end }`. iOS (`deleteBackward`, `pressesBegan`, the delegate's Return), Android (an `InputConnectionWrapper` for soft keyboards plus `onKeyDown` for hardware ones) and the web element (`keydown`) share one table. Off by default. The showcase has a "Rich text: boundary keys" screen.

### Fixed

- **`@sigx/lynx-runtime-main`: a UI method invoked on an element created in the same batch is no longer lost** ([#1117](https://github.com/signalxjs/lynx/issues/1117)). `INVOKE_UI_METHOD` on an element whose `CREATE` sits in the same ops batch — a `ref` callback calling `RichTextMethods.focus` on a field the same render created — used to reach `__InvokeUIMethod` before the flush that creates the native UI, and the fire-and-forget path swallowed the refusal. Such invokes are now replayed right after the tail flush (and flushed again so they are delivered).
- **`@sigx/lynx-richtext`: `heightchange` is reported once the element has its width, and `focus()` before attach is replayed on attach** ([#1117](https://github.com/signalxjs/lynx/issues/1117)). The initial value lands before the first layout, so a multi-line value reported a one-line height (Android had no text layout yet, iOS measured against the screen width) and never corrected itself — the field clipped until the next edit. Both platforms now re-report after a layout at a new width. A `focus()` that arrives while the view is still off-window (`requestFocus` / `becomeFirstResponder` are refused there) is applied when it attaches.
- **`@sigx/lynx-richtext`: Android now emits `focus` / `blur`** ([#1116](https://github.com/signalxjs/lynx/issues/1116)). iOS and the web element always did; `RichTextInput`'s `onFocus` / `onBlur` never fired on Android.
- **`@sigx/lynx-richtext`: release builds keep the native classes** ([#1116](https://github.com/signalxjs/lynx/issues/1116)). The module now ships an R8 keep rule (`-keep class com.sigx.richtext.** { *; }`) through `signalx-module.json` `android.proguardRules`; `sigx run:android --release` used to strip the `@LynxProp` setters and method handlers. Run `sigx prebuild` after upgrading.

## [0.29.0] - 2026-09-12

### Changed

- **`@sigx/lynx-markdown` consumes `@sigx/markdown` — the parser, the streaming controller and the render engine moved upstream, and the AST is mdast** ([#1112](https://github.com/signalxjs/lynx/issues/1112), part of [#891](https://github.com/signalxjs/lynx/issues/891); roadmap [signalxjs/markdown#6](https://github.com/signalxjs/markdown/issues/6)). The incremental parser, `createMarkdownStream` and the platform-neutral render engine that lived in `packages/lynx-markdown/src/{parser,stream.ts,render/engine.tsx}` are now the renderer-free core of [`@sigx/markdown`](https://github.com/signalxjs/markdown) (a regular dependency of `@sigx/lynx-markdown`; its `@sigx/reactivity` / `@sigx/runtime-core` peers resolve to the copies `@sigx/lynx` already carries), so web chat UI and Lynx share one parser and one set of stable-block semantics. `@sigx/lynx-markdown` keeps `<MarkdownView>` (now a thin adapter: one `createIncrementalEngine({ plugins })` per instance, `renderDocument()` over a Lynx component map), `defaultComponents`, the editor subpath and the editor half of the mention plugin, and re-exports `createMarkdownStream`, `createIncrementalEngine`, `parseMarkdown`, `renderDocument`, `mentionSyntax`, `mentionPlugin` and **every `@sigx/markdown` type** (`export type *`), so `@sigx/lynx-daisyui` and `@sigx/lynx-emoji` keep a single pin.

  **The AST is mdast now** — a `@sigx/markdown` tree is valid `remark` input and vice versa. Every consumer touching node types or the `components` map renames:

  | Before (lynx-markdown 0.28) | After (`@sigx/markdown`) |
  |---|---|
  | `heading.level` | `heading.depth` |
  | `codeBlock` (`closed: boolean`, `lang?: string`) | `code` (`open?: true` only while the fence is unterminated; `lang: string \| null`, plus `meta`) |
  | `em` / `del` / `codeSpan` / `br` | `emphasis` / `delete` / `inlineCode` / `break` |
  | `autolink` node + `components.autolink` slot | a `link` node with `data.autolink: true`; the `link` renderer prop `autolink: boolean` replaces the slot (removed) |
  | `link.href` / `image.src` | `link.url` / `image.url` (`LinkProps.url`, `ImageProps.url`) |
  | `extension { name, attrs, raw }` nodes + `components.extension[name]` | plugin-defined node types (`{ type: 'mention', id, label }`, `{ type: 'emoji', name, glyph }`) rendered by `components[type]` (`components.mention`, `components.emoji`); the `extension` map is removed |
  | `node.raw` | `node.position` (`sliceSource(source, node)`) |
  | `list.tight` / `list.items` | `list.spread` (inverted meaning) / `list.children` (`listItem` nodes with `checked?: boolean \| null`); `listItem` renderers receive `spread` |
  | `table.header` / `table.rows` | `table.children` (`tableRow` nodes, the first is the header) of `tableCell` nodes; `tableRow`/`tableCell` renderers receive `index` |
  | `ParserInlineExtension` (`match(text, pos)` → `{ node, end }` with `raw`) | `InlineSyntaxExtension` (`match(text, pos, ctx)` → `{ node, end }`; `ctx.position()` for a position) |
  | `<MarkdownView extensions={[syntax]}>` | `<MarkdownView plugins={[plugin]}>` (`readonly MarkdownPlugin[]`) |
  | `MarkdownComponents` (Lynx-bound) | `MarkdownComponents<JSXElement>` — alias `LynxMarkdownComponents`; `MarkdownChild` → `MarkdownChild<JSXElement>` / `LynxMarkdownChild`; the per-slot prop types are `@sigx/markdown`'s (`HeadingProps<E>`, `ListProps<E>`, `ListItemProps<E>`, `CodeProps`, `TableProps<E>`, `TableRowProps<E>`, `TableCellProps<E>`, `LinkProps<E>`, `ImageProps`, `NodeProps<E, N>`); `StrongProps`/`EmProps`/`DelProps`/`CodeSpanProps`/`AutolinkProps`/`ExtensionProps`/`RootProps`/`ParagraphProps`/`BlockquoteProps`/`ThematicBreakProps` are gone |
  | `parseBlocks(src)` / `parseInline(src)` root exports | `parseMarkdown(src, { plugins })` (root re-export); `parseBlocks`/`parseInline` from `@sigx/markdown` directly |

  Behaviour that moved with the engine: a soft line break is kept as `\n` inside `text.value` (mdast) — the Lynx `text` slot (new; `defaultComponents` and daisyUI's `markdownComponents` both ship one) collapses it to a space, and a new `html` slot shows raw HTML as literal text. **URL sanitisation happens at render time** (the engine applies `sanitizeUrl` before calling `link`/`image`; `onLink` receives the sanitised URL and the node) instead of in the parser — `mdToDoc` sanitises link hrefs itself so the editor field never carries a live `javascript:` destination. A plugin node without a registered component falls back to the plugin's `serialize` rule as text (the mention plugin's, for instance, renders `@[Andy](u1)`), no longer to a `raw` slice. Link reference definitions and reference links now parse (`definition`, `linkReference`, `imageReference` nodes; the engine resolves them).

  **Editor subpath:** `InlinePluginSpec.syntax` is an `InlineSyntaxExtension`, `component?(props: { node, children })` receives the plugin node, and `docMapping.toSpan(node)` takes the plugin node; the editor routes `toSpan` by **node type**, which must equal `syntax.name`. `MdToDocOptions.extensions` → `plugins: readonly MarkdownPlugin[]` and `ExtensionSpanMapper` → `PluginSpanMapper` (`spanMappers` keyed by node type). The mention label rule follows `@sigx/markdown`'s syntax: a label cannot contain `]`/CR/LF, an id cannot contain `)`/CR/LF (previously both refused `]` and `)`).

  **`@sigx/lynx-emoji/markdown`:** `createEmojiSyntax()` returns an `InlineSyntaxExtension<EmojiNode>` producing `{ type: 'emoji', name, glyph }`; `emojiExtensionComponent` → `emojiComponent` (register as `components.emoji`); wrap the syntax for `<MarkdownView>` as `plugins={[{ name: 'emoji', inline: [createEmojiSyntax()] }]}`. **`@sigx/lynx-daisyui`:** `markdownComponents` is typed `MarkdownComponents<JSXElement>` with the mdast slot names above.

- **`@sigx/lynx-daisyui-zero` is renamed `@sigx/lynx-zero-daisyui`** ([#1107](https://github.com/signalxjs/lynx/issues/1107)). The daisyUI shell on the zero contract follows the same base-then-flavor order as its upstream source (`@sigx/zero` → `@sigx/zero-daisyui`) and as the icon adapters (`@sigx/lynx-icons` → `@sigx/lynx-icons-lucide`), so it sits beside `@sigx/lynx-zero` as `@sigx/lynx-zero-daisyui`; the heroui shell will be `@sigx/lynx-zero-heroui`. Same version, same contents, same import paths under the new scope (`@sigx/lynx-zero-daisyui`, `@sigx/lynx-zero-daisyui/css/index.css`). The old name existed on npm for under a day with no dependents and is unpublished rather than deprecated.

- **`@sigx/lynx-icons`: glyphs are standard SVG — the color rides Lynx 4.0's `current-color` attribute instead of a placeholder spliced into the markup** ([#949](https://github.com/signalxjs/lynx/issues/949) §2, tracked from [#945](https://github.com/signalxjs/lynx/issues/945)). Probed on a Pixel 9 Pro XL on 4.0.1 (section 6 of the showcase's `CSS engine probe`, evidence on the `949-evidence` branch): `fill="currentColor"` and `stroke="currentColor"` resolve from the `<svg current-color>` attribute; `var()` in that attribute does not evaluate, and the host's CSS `color` is still never inherited — so `<Icon>` keeps resolving one concrete color exactly as before, and only the transport changed. `@sigx/lynx-icons-fa-free` and `@sigx/lynx-icons-lucide` now emit plain `currentColor` markup; `defineIconSet` glyphs can be ordinary SVG (the `__COLOR__` placeholder is still honored as an alias). Web is the exception: `@lynx-js/web-core`'s `x-svg` is a blob-URL `<img>` with no `current-color`, so a `svg-color.web.ts` twin substitutes the color into the markup's `currentColor` paints there. `@sigx/lynx-runtime` types the new `current-color` attribute on `<svg>`.

## [0.28.0] - 2026-09-02

### Changed

- **`@sigx/lynx-daisyui-zero`: physical-only lynx CSS — the slider thumb finally centers on Android** ([#1088](https://github.com/signalxjs/lynx/issues/1088)). The catalog moves to `@sigx/zero` / `@sigx/zero-daisyui` `0.2.0-beta.6` ([zero#393](https://github.com/andtii/zero-wip/pull/393)): probe bars on `/zero-pilot` measured that Android's engine resolves none of the logical inset/margin/padding spellings nor the standalone `translate`/`rotate`/`scale` properties (iOS resolves them all — a silent cross-platform asymmetry), so ~215 such declarations across 35 lynx component artifacts were replaced with physical spellings, and the emitter now refuses the asymmetric ones outright.

- **`@sigx/lynx-daisyui-zero`: tabs get their underline, checkboxes their tick, radios their dot** ([#1082](https://github.com/signalxjs/lynx/issues/1082)). The catalog moves to `@sigx/zero` / `@sigx/zero-daisyui` `0.2.0-beta.5` ([zero#389](https://github.com/andtii/zero-wip/pull/389)): the tabs border-flavor underline now spends a per-color/per-theme baked ink instead of `currentColor` — which never resolves on lynx, so the underline was transparent on both platforms — and the same sweep gave the checkbox tick and the radio dot/ring real inks. The lynx emitter now refuses `currentColor` outright, so the class of bug cannot ship silently again.

- **`@sigx/lynx-daisyui-zero`: the pilot fidelity wave reaches the skin** ([#1077](https://github.com/signalxjs/lynx/issues/1077)). The catalog moves to `@sigx/zero` / `@sigx/zero-daisyui` `0.2.0-beta.4`, closing out the on-device causes measured in #1075 and #1066: the emitter now inlines calc-holding custom-property chains at compile time and rewrites `inline-flex` to `flex` ([zero#385](https://github.com/andtii/zero-wip/pull/385)) — the empty progress track and the vertically-stacked tabs; the slider gets real range/thumb paint on lynx ([zero#384](https://github.com/andtii/zero-wip/pull/384)); the switch gets a `targets.lynx` flex layout, no grid or `min()` ([zero#380](https://github.com/andtii/zero-wip/pull/380)); buttons carry daisy's fixed height ramp ([zero#379](https://github.com/andtii/zero-wip/pull/379)); and tabs gain daisy's border/lift/box flavor axis defaulting to `border` — the underline flavor — ([zero#381](https://github.com/andtii/zero-wip/pull/381)), which the axis-defaults registry picks up automatically.

- **`@sigx/lynx-daisyui-zero`: axis defaults cover every pilot component** ([#1073](https://github.com/signalxjs/lynx/issues/1073)). The catalog moves to `@sigx/zero` / `@sigx/zero-daisyui` `0.2.0-beta.3` ([zero#367](https://github.com/andtii/zero-wip/pull/367)): the daisy manifest now declares `defaults` for 11 scopes instead of 4 — progress, slider and select gain `color: primary` + `size: md`, and tabs, accordion, collapsible and toast gain `size: md` (their neutral default ink/surface is deliberately not a color default). With the #1070 resolution mechanism already in place, `DAISY_AXIS_DEFAULTS` regenerates with the full set and prop-less pilot components stamp their design-system defaults.

- **`@sigx/lynx-daisyui-zero`: the compiled daisy CSS is coherent for the first time** ([#1068](https://github.com/signalxjs/lynx/issues/1068)). The catalog moves to `@sigx/zero` / `@sigx/zero-daisyui` `0.2.0-beta.2`, which carries two upstream emitter fixes ([zero#360](https://github.com/andtii/zero-wip/pull/360), [zero#363](https://github.com/andtii/zero-wip/pull/363)).

  What the skin shipped before: **24 custom properties it used and never defined**, reaching 295 of its 1043 rules. On lynx an unresolvable `var()` does not fall back the way the web's invalid-at-computed-value-time rule does — the declaration is dropped and the element paints nothing at all, which is why the daisy switch rendered as bare text rather than as an unstyled control. It also shipped `min()`, which lynx ignores, and no `--text-*` ramp at all, leaving ~262 `font-size` declarations inert.

  After the bump: **0 dangling properties, no `min(`, and every component has a size ramp** — `switch`, `radial-progress`, `rating-group`, `spinner` and `status` had none. Dropped declarations across the skin fall from **594 to 219**, and the remainder is almost entirely legitimate (92 pseudo-element selectors, 81 hover rules, 33 conditional at-rules). `packages/lynx-daisyui-zero/__tests__/shell.test.ts` gains those three as assertions, so this package fails rather than an app, on the day it is pointed at an older or hand-patched skin build.

### Fixed

- **`@sigx/lynx-zero`: anchored popups landed one header-height too low — the outlet origin was double-counted** ([#1086](https://github.com/signalxjs/lynx/issues/1086)). #1081 moved anchored positioning to viewport-space `boundingClientRect` measurement, but the popup renders absolutely inside the overlay OUTLET — OverlayHost's `position: relative` view, whose own origin sits below the navigation header. Every anchored popup therefore rendered ~96dp low; with enough empty space below the anchor it merely looked loose, but a select near the bottom of the screen put its item list mostly off-glass — "the select does nothing". OverlayHost now measures its own viewport origin and provides it (`provideOverlayOrigin`); the positioning style subtracts it when converting to outlet coordinates. Verified end-to-end on the Android emulator: the list opens flush under the trigger and tapping an item completes the selection. The `/zero-pilot` probe card also gains the #1084 vertical-centering verdict bars (logical inset, standalone translate, physical transform, logical margin) that pinned the Android-only CSS asymmetry driving the upstream zero-wip#393 sweep.

- **`@sigx/lynx-zero`: anchored overlays position correctly on Android, and dialogs actually center** ([#1080](https://github.com/signalxjs/lynx/issues/1080)). On Android, `bindlayoutchange`'s payload carries the element's size but NOT page-relative coordinates (`top`/`left` of 0) — so the select's item list clamped to the screen corner and the popover's panel never got a sane position; iOS happened to work only because its payload is page-relative, and even there the rect went stale after any scroll. `createAnchorPosition` now measures both the anchor and the floating panel with `useViewportRect` (`boundingClientRect`, transform-aware) — layout events are just re-measure triggers, and the floating panel's measure re-measures the anchor, so a popup opening after a scroll positions against where the anchor is. Select and Popover wire the new `main-thread:ref` handles. Separately, the Dialog backdrop now centers its panel explicitly: on the web that centering is the native `<dialog>`'s UA `margin: auto`, which the compiled skin never carries, so the panel pinned to the top on both platforms. Verified on the Android emulator (Pixel, density 420) and the iOS 18.3 simulator: select opens under its trigger, popover anchors at its button, dialog centers over the dimmed backdrop.

- **`@sigx/lynx-zero`: unstyled is no longer the default — components resolve the design system's declared axis defaults** ([#1070](https://github.com/signalxjs/lynx/issues/1070)). The lynx target's compiled CSS deliberately has no `:not()` default-twin selectors, so a `<Button>` rendered without an explicit `variant`/`size`/`color` stamped no `zx-a-*` class and every rule keyed on those axes was dead — the unfilled buttons on `/zero-parity`. `@sigx/lynx-zero` gains an axis-defaults registry (`registerAxisDefaults` / `resolveVariantAxes`, exported beside the axis push-down seams): the design-system shell registers its manifest's `components.<scope>.defaults` at load, and every carrier resolves `explicit prop ?? registered default` per scope before stamping. `@sigx/lynx-daisyui-zero`'s build now harvests those defaults into a generated `DAISY_AXIS_DEFAULTS` table (validated against the declared axis values) and registers it in the same import side effect as the themes. With nothing registered, unset axes stamp nothing — exactly the previous behavior. Only four daisy scopes declare defaults in `0.2.0-beta.2` (button, switch, toggle, toggle-group); broader coverage lands with the upstream recipe defaults.

- **`@sigx/lynx-zero`: nothing under `<ZeroRoot>` could scroll** ([#1064](https://github.com/signalxjs/lynx/issues/1064)). A `<ScrollView flex={1}>` inside the theme host sized itself to its content and overflowed the screen instead of scrolling — so the Zero Pilot showcase screen simply ran off the bottom.

  Both hosts wrote the flex-fill long form (`flexGrow`/`flexShrink`/`flexBasis`/`minHeight`) and **neither wrote `display: flex`**. A lynx `<view>` defaults to `display: linear`, where a child's flex properties are inert — so every flex declaration below the host was ignored, the scroll container never received a bounded height, and `overflow` had nothing to scroll. `@sigx/lynx-zero-legacy`'s ThemeProvider has always set `display: flex` + `flexDirection: column` on both its root and nested branches for exactly this reason; the port onto the zero contract dropped them. `ThemeProvider` and `OverlayHost` both carry them again, and `packages/lynx-zero/__tests__/host-layout.test.tsx` pins the whole chain — theme host, outlet host, and the nested content-island branch.

- **`@sigx/lynx-zero`: a theme switch left the page on the old theme** (#1064). Selecting `dark` recolored the components and left the surface white with dark-on-dark, unreadable text. On the web, zero's base layer paints `:root`; nothing ships that layer to lynx, and a compiled skin's `.zx-root` block *declares* `--color-base-100` / `--color-base-content` without spending either. The theme host now paints both — the same two tokens the legacy provider spent, on the same element. `color` does reach `<text>` through lynx's built-in text-property inheritance (verified on the iOS 18.3 simulator); the `enableCSSInheritance` page flag governs general inheritance, not this.

- **`@sigx/lynx-runtime-main`: Lynx's performance and timing APIs report again — the whole surface, not just one channel** ([#982](https://github.com/signalxjs/lynx/issues/982), [lynx-family/lynx#8405](https://github.com/lynx-family/lynx/issues/8405), fix contributed by the Lynx team in #1020). Native hands the `loadBundle` **pipeline** to `renderPage`'s second argument, `options.pipelineOptions`. sigx ignored it — and since `renderPage` here only puts up a placeholder while the app's real element tree arrives later over the background thread's op stream, the flush that actually painted the app carried no pipeline at all. The engine therefore opened no timing scope for it, collected nothing, and every consumer went quiet together: the background-thread `PerformanceObserver`, the legacy `addTimingListener`, all four platform perf/timing callbacks, and Android's `forceGetPerf()` (which returned `null`, not zeroes). The runtime now carries those options to the first flush that paints real content, and spends them exactly once — a later update must not be attributed to the load pipeline, and neither must the placeholder.

  This corrects the diagnosis recorded in #982, which read the engine's `TimingCollector::Scope` as something only the engine's own render entry points could open, and concluded a framework driving the element PAPIs directly was locked out by design. It isn't: the scope follows the flush's pipeline options, so forwarding them is the entire contract. Nothing in sigx's renderer had to change.

  Measured with the raw probe from #982 on **both** platforms, release builds, Lynx 4.0.1 — a physical Pixel 9 Pro XL (Android 17) and the iPhone 16 Pro simulator (iOS 18.3). Both deliver `addTimingListener.onSetup` with the full `setup_timing` dictionary (`metrics.lynx_fcp` / `lynx_tti`) and a `pipeline.loadBundle` entry carrying `pipelineStart` / `pipelineEnd` / `paintEnd`, a nested `lynxFcp` metric (241.7 ms Android, 190.8 ms iOS) and a populated `frameworkRenderingTiming`. Two things worth knowing: there is no separate `metric.fcp` entry on 4.0.1 — first paint is that nested metric, not the `MetricFcpEntry` you might reach for — and `hostPlatformTiming` differs by platform: Android fills `measureStart/End`, `layoutStart/End` and `drawStart/End`, while iOS reports only `hostPlatformType`.

  **The dev perf HUD displays numbers for the first time.** Its timing half (#994) is wired to Lynx 4.0's typed *platform* observer — a different channel from the probe above — and had shown "Waiting for metrics…" since the day it was written. On the simulator it now renders FCP, Bundle, JS core, Pipeline, MTS, Layout and UI flush beside the memory readings (a debug build, so treat the values as relative — the dev engine inflates main-thread costs — but presence is the point). `FMP` is still blank, which is exactly right: `actualFmp` needs the part of the contract below.

  What's still missing is the rest of that contract — update pipelines (`_generatePipelineOptions` / `_onPipelineStart`), `_markTiming` on the standard keys, and `__lynx_timing_flag` binding — so today the **load** pipeline reports and post-load updates don't. #978 picks up the HUD from here.

- **`@sigx/lynx-zero`: an overlay opened inside another overlay's portaled content never settled** (#1051). Opening a popover from inside an open dialog remounted the dialog, which remounted the popover, which minted a fresh portal entry, which remounted the dialog again — a microtask cascade that starved the event loop, so the app didn't misrender, it *stopped*.

  The fault was one shape rule in sigx core, fixed in `@sigx/runtime-core` 0.15.4 (signalxjs/core#658): `normalizeChild` gave an **array child three different vnode shapes depending on its length** — `0 → Comment`, `1 → the bare item vnode`, `2+ → Fragment`. Crossing the 1↔2 boundary therefore changed `vnode.type` at that child position, the reconciler saw a different node, and it unmounted and remounted the whole array. `OverlayHost`'s outlet renders `{slots.default?.()}{registry.entries().map(…)}` — an array child beside a sibling, which is exactly the broken case, and one open overlay is exactly the broken length. The asymmetry that hid this everywhere else: an array rendered as an element's **only** child flattens into the parent's children and was never affected.

  The lockfile moves the core line to 0.15.4; the catalog range stays `^0.15.0` because `verify:catalog` requires a single-minor caret. The guard is a nested-overlay test in `packages/lynx-zero/__tests__/behaviors.test.tsx` that caps the inner component's setup count — the failure mode is a hang, and a hang cannot be caught by a timeout when the loop being starved is the one the timer runs on.

  One visible consequence of the core fix: a single-element array child now carries a fragment anchor, which is a real node on this platform. Nothing renders differently, but a test counting a parent's children will see one more.

- **`@sigx/lynx-cli`: `run:ios --device` could never build to a physical device** (#1032). Three defects, found by trying it on an iPad and each hidden behind the one before it.

  `listConnectedIosDevices()` reported devicectl's **CoreDevice identifier** (`16B3FA2D-…`) as the device's `udid`, but `xcodebuild -destination id=…` matches only the **hardware UDID** (`00008132-…`) — so every device build died with "Unable to find a device matching the provided destination specifier". `devicectl --device` accepts either, so the hardware UDID is now the one identifier both tools understand.

  Automatic signing was also never allowed to do its job: without `-allowProvisioningUpdates`, xcodebuild refuses to create or refresh a provisioning profile, so a first build to a newly registered device fails with "No profiles for '<bundle id>' were found" even with the team set correctly. Passed for device targets only — a simulator build isn't signed.

  Then the failure said **"Check that a development team is selected in Xcode"** — printed for *any* non-zero xcodebuild exit on a device, including that one, which sent the reader to certificates while the real message sat three lines above. The two device failures worth naming are now named: a device that is connected but whose developer disk image isn't mounted (unlock it and leave it awake), and an id xcodebuild couldn't match. Anything else keeps the signing guess. `run:ios` and `sigx dev` had **two copies** of this logic and now share one helper, so the next fix can't miss one of them.

### Added

- **`@sigx/lynx-cli`: `SIGX_IOS_BUNDLE_ID`** (#1032). An App ID is globally unique across all of Apple, so a shared example app cannot ship one that works for everyone — the scaffold's `com.example.<app>` placeholder is unregisterable by anybody ("The app identifier … cannot be registered to your development team because it is not available"), and any real identifier is claimable exactly once, by whoever device-builds first. The variable rewrites `PRODUCT_BUNDLE_IDENTIFIER` on every prebuild, so a contributor supplies their own without editing a tracked file. Applied like the team override, because the identifier is otherwise a scaffold-time template variable frozen into the generated project.

- **`@sigx/lynx-cli`: `SIGX_IOS_DEVELOPMENT_TEAM`** (#1032). A device build needs a `DEVELOPMENT_TEAM`, and the only way to supply one was `ios.developmentTeam` in `signalx.config.ts` — the wrong place for an identifier personal to whoever is building. `examples/showcase` ships an empty team for exactly that reason, so its device build could not be signed by anyone. The variable overrides the config when set, and **takes part in the prebuild fingerprint**: `applyIosSigningSettings` only runs in the slow path, so without that an exported team was silently ignored on an already-prebuilt project (fingerprint format `v9`).


- **`@sigx/lynx-secure-storage`: `requireBiometric` never worked on Android** (#1027, device-found on a Pixel 9 Pro XL). `setItem(key, value, { requireBiometric: true })` failed every time, on every device, with `set failed: IllegalBlockSizeException` — the headline feature of the package, dead on one platform since it shipped, while iOS was fine.

  The write encrypted with the very key it was gating: a Keystore AES key created with `setUserAuthenticationRequired(true)`. An auth-bound *symmetric* key demands a fresh authentication for **every** operation, encryption included, and nothing drives a prompt on the write path, so Keystore refused it (`KEY_USER_NOT_AUTHENTICATED`) and `doFinal` reported the refusal as a block-size error.

  Android now stores an **envelope**: a per-key Keystore **RSA** pair whose auth requirement binds the private half, a one-shot in-memory AES-256-GCM key encrypting the value, and that AES key wrapped with the public half. Wrapping is a public-key operation, so **writing never prompts** — the contract `README.md` and the `setItem` JSDoc always promised and iOS's `SecItemAdd` always delivered. Reading authorises the RSA-decrypt `Cipher` through `BiometricPrompt.CryptoObject`, unwraps, and decrypts: one prompt, where it belongs.

  **Any biometric value must be written again.** The blob format goes to `v3` and a stale blob is discarded along with its Keystore alias, so `getItem` reports the key as absent rather than failing — but nothing needs migrating in practice, since no device can hold a readable older blob: `v1` could never be written and `v2` (an interim envelope) could never be read.

- **`@sigx/lynx-secure-storage`, `@sigx/lynx-biometric`: the biometric prompt is raised on the main thread, posted rather than inline** (#1027). Both packages built `BiometricPrompt` and called `authenticate()` on whatever thread the `@LynxMethod` ran on — the JS thread — though it is a `DialogFragment` whose constructor touches the FragmentManager and the activity's `LifecycleRegistry`, and whose `authenticate` commits a transaction. Every other dialog in the repo already hopped (`lynx-datetime-picker`, `lynx-file-picker`).

  It is **posted** to the main looper rather than run through `Activity.runOnUiThread`, because that helper executes inline when the caller is already on the main thread — and one caller always is: a prompt raised from another prompt's callback, which is what authenticating and then reading a gated key does. Inline meant committing inside FragmentManager's own execution and throwing `IllegalStateException: FragmentManager is already executing transactions`. Device-caught, both of them.

### Changed

- **Web engine: `@lynx-js/web-core` 0.20.4 → 0.24.0**, plus `@lynx-js/web-elements` `>=0.12.7` and `@lynx-js/tailwind-preset` `^0.5.0` (#975). **Closes #1001.**

  That issue was an unmet peer nothing in an app could satisfy: `@lynx-js/template-webpack-plugin` 0.15 depends on `@lynx-js/css-serializer` 0.1.7, while `@sigx/lynx-cli`'s `web-core@^0.20.4` declared an **exact** `0.1.6` peer — so the graph carried two `web-core` lines and two `css-serializer` lines at once, and `pnpm peers check` stopped being a clean signal. The lockfile now resolves exactly one of each (`web-core@0.24.0`, `css-serializer@0.1.7`).

  **The `__SetGestureDetector` guards stay, and now say why.** They are how the main-thread runtime detects the web engine, and `web-core` still ships no such global at 0.24.0 — re-checked. Worth recording because the neighbouring globals are *not* interchangeable for this: `__CreateWrapperElement` and `__ReplaceElement` **are** present in 0.24.0, so neither would work as a web probe.

  `@lynx-js/tailwind-preset` 0.5's peer is still `tailwindcss ^3.4.0`, so this forces no Tailwind 4 decision.


- **`@lynx-js/react` 0.121 → 0.123.3** (#975). This package's WASM transform *is* sigx's snapshot template system (#620), so the bump was checked against emitted output rather than taken on trust.

  **Codegen is unchanged for this repo.** The one difference upstream introduced is a 5th argument on LEPUS `updateSpread` — the new `experimental_transformBuiltinAttributeNames` flag, default off. Snapshot uniqIDs are identical, so there is no cross-thread desync, and sigx's 4-arity `updateSpread` ignores the extra argument. Both worklet loaders continue to resolve a single copy of the transform, which is the invariant that matters: a split copy would desync template ids between the two threads.

  **Both existing workarounds re-verified and kept, with the check recorded next to each.** `use:*` attributes still panic the transform (`RuntimeError: unreachable`) on both the JS and LEPUS targets at 0.123.3, while plain JSX transforms cleanly — so `SNAPSHOT_UNSUPPORTED_RE` does not come off with a version bump. And `processGesture` is still absent from every entry in the package's `exports` map (upstream merely relocated it to `runtime/lib/snapshot/gesture/`), so `@sigx/lynx-runtime-main` keeps its vendored port. Both comments now name the version they were checked against and the check to repeat.


- **Toolchain: rspeedy 0.16 / rsbuild 2 / rspack 2** (#975). `@lynx-js/rspeedy` `>=0.14.4` → `>=0.16.3`, which brings `@rsbuild/core` 1.7 → 2.1 and `@rspack/core` 1.7 → 2.1, plus `@lynx-js/runtime-wrapper-webpack-plugin` `>=0.2.3` and `@lynx-js/webpack-dev-transport` `>=0.3.0`.

  **`@sigx/lynx-plugin` stopped shipping its own `@rsbuild/core` types.** `rsbuild.d.ts` declared the module with hand-written minimal types, and because that file sits inside the root tsconfig's `include`, the declaration shadowed the real package **across the whole repo** — `CHAIN_ID` and the bundler chain were `any`, so none of the plugin's most intricate code was ever type-checked. It is a devDependency; the real types now apply, and the migration below was driven by the resulting compiler errors rather than by guesswork.

  **The CSS pipeline was rebuilt for rsbuild 2's rule shape.** Rsbuild 2 nests CSS loaders under `oneOf` sub-rules: the `css` rule carries only `test` + `dependency` and has no `uses`, while the real chain lives in `oneOf(CSS_MAIN)`. The previous surgery targeted the parent rule, so every `.use()` and `.delete()` landed on an empty `uses` — silently. The main-thread clone never received `ignore-css-loader`, raw CSS reached rspack's JS parser, and the build died on `@tailwind base; → Expression expected`. Ported to the `oneOf` shape, mirroring `@lynx-js/react-rsbuild-plugin`'s own port — including carrying `dependency: { not: 'url' }` over and taking `test` from the parent rule.

  **`tools.swc.jsc.target: 'es2019'` is gone**, because rspeedy owns the compilation target through `env` and now *errors* when both are set (`env` and `jsc.target` cannot be used together). What replaces it is stricter, not looser: `env.targets: { chrome: '120' }` plus an explicit `env.include` list covering the ES2017–ES2022 syntax PrimJS needs lowered, and it additionally lowers `let`/`const` to `var` for QuickJS parse speed. The practical delta is that native `async`/`await` and `**` are now emitted rather than downlevelled — verified on device, where a syntax the engine rejects fails loudly at bundle load.

  **`performance.chunkSplit` is no longer set.** Rspeedy defaults `splitChunks` to `false`, which is what `all-in-one` meant, and rsbuild warns that `performance.chunkSplit` is deprecated and **will not work** when both are present — so the option this relied on was being silently ignored while still reading as deliberate.

  **`ProvidePlugin` / `DefinePlugin` now come from the `rspack` instance rsbuild passes in**, rather than a `createRequire('@rspack/core')` of our own. Resolving it ourselves picked up 2.0.2 from the optional peer while rsbuild drove 2.1.9, so plugin instances crossed rspack copies and worked only by duck-typing. `@rspack/core` stays an optional peer either way — there is still no top-level import.

  Not in this change: `@lynx-js/react` 0.123 and `@lynx-js/web-core` 0.24. They fail in different ways and want different device evidence, so they follow separately.

- **`examples/showcase`: the Auth demo stops teaching a double prompt.** Its unlock called `Biometric.authenticate()` and then `SecureStorage.getItem()`, prompting twice for the same thing — its own comment conceded "a real app would skip the first step". Unlock is now the single-prompt flow, with a separate **Authenticate only** button for the one shape that should call `Biometric.authenticate()` directly: an identity check with no stored key behind it.

- **A native failure is now a rejection in ten more packages** (#857, convention **C4**, rubric **D1.2**/**D6.2**). `callAsync` only rejects when the *synchronous* bridge call throws; every native module reports its own failures by **resolving** `{ error: string }` on the callback. Ten packages passed that payload straight to the caller, typed as the success shape — so `try`/`catch` never fired and the failure arrived as plausible-looking data. All ten now unwrap through `unwrapNative` / `unwrapNativeVoid` from `@sigx/lynx-core`, throwing a `SigxError` with `code: 'native_error'` and the C10 message `[@sigx/lynx-<pkg>] <action> failed: <cause>`, with the raw native payload on `cause`.

  **This is breaking on purpose: code that used to silently continue now throws.** What each package was doing before:

  | Package | A failure used to look like |
  | --- | --- |
  | `lynx-background` | `register()` resolving as if scheduled — an iOS identifier missing from `BGTaskSchedulerPermittedIdentifiers` (the most common setup mistake here) succeeded, and the task simply never fired. `getRegistered()` handed a non-iterable `{ error }` to a `for…of`. |
  | `lynx-camera` | Kept its own `settleCapture`; a permission-denied or FileProvider-misconfigured capture now throws instead of rethrowing an unprefixed raw string, and a payload matching none of the three documented outcomes fails loudly instead of reporting a cancel. |
  | `lynx-file-picker` | A picker that couldn't open at all — Android launcher unregistered, iOS with no view controller — reported a user dismiss. |
  | `lynx-file-system` | A failed `readFile` resolved the envelope typed as `string`; a failed `writeFile` looked like a success. |
  | `lynx-image-picker` | Same as file-picker: a launch failure arrived as `{ cancelled: true }` and the app silently did nothing. |
  | `lynx-linking` | `openURL()` resolved whether or not anything opened, making try-the-deep-link/fall-back-to-https dead code; `BackHandler.exitApp()` resolved as if the app had backed out. |
  | `lynx-location` | Permission-denied and no-fix arrived as a `LocationResult` full of `undefined` — the showcase crashed in render on `fix.lat.toFixed(5)` because its `catch` never ran. |
  | `lynx-network` | A failure arrived as `isConnected: undefined`, so the offline branch of `if (state.isConnected)` ran with nothing caught. |
  | `lynx-notifications` | `schedule()` handed back an `{ error }` object typed `string`, so the caller held an id that cancels nothing; `setBadgeCount()` discarded the error outright. |
  | `lynx-secure-storage` | Its hand-rolled unwrap threw plain `Error`s with no `code` and no `cause`. |

  **A cancel is still not an error** (C5). A user dismissing a camera, file picker or image picker resolves `{ cancelled: true }` as before — as does a pick superseded by a newer one or cut short by Activity teardown, which Android tags with sentinel `error` strings and iOS doesn't. Those sentinels are matched *before* the unwrap.

  Three deliberate **C3/C4 opt-outs** are now documented in JSDoc and README rather than left implicit: `Notifications.cancel` / `cancelAll` (advisory, idempotent, fired from cleanup paths — a failure stays `false`), `Notifications.registerForPushNotifications` / `unregisterForPushNotifications` (the failure is already published on the shared token-error channel, so throwing would make callers handle it twice), and `Notifications.requestPermission` (iOS folds an authorization error into `{ status: 'denied', error }`; whether that becomes a throw is the repo-wide C6 question on #895).

- **`@sigx/lynx-core`: "the native module isn't linked" now carries a `code`** (#857, #873). `getModule` — and therefore `callSync`, `callAsync` and `guardModule` — throws a `SigxError` with `code: 'module_unavailable'` and `package: 'lynx-core'` instead of a bare `Error`. The message is unchanged and still names the package to install. Between this and `unwrapNative`'s `'native_error'`, every module package's two failure modes are branchable without writing an error of its own; the READMEs telling callers to "branch on `code`, not the message" are now true for both. Prefer `isAvailable()` over catching `'module_unavailable'` — a build without the module never recovers at runtime. Core's README also stops claiming `getModule` returns `undefined` when the module is missing; it always threw.

### Fixed

- **Every main-thread worklet silently stopped running** (#1021). Gestures didn't respond, animations didn't animate, and — because a navigation card is positioned by a main-thread transform — every screen pushed onto the stack rendered its header over an empty body. The app looked broken in a way no error explained: the build was green, nothing threw, and the JS ran fine.

  A worklet ships as two halves that must agree. The background bundle keeps a `{_wkltId: "<id>"}` placeholder; the main-thread bundle must carry a matching `registerWorkletInternal("main-thread", "<id>", …)`, which is what `runWorklet` looks up at dispatch. On the MT layer that registration is the module's *only* reason to exist — nothing imports a binding from it — so declaring `sideEffects: false` (#1002) told the bundler it was free to drop the module, and it did: **72 of 101 worklets lost their registration**. Fourteen packages were affected, including `lynx-navigation`, `lynx-motion`, `lynx-gestures`, `lynx-sheet` and `lynx-list`.

  `@sigx/lynx-plugin` now marks every module on the main-thread layer as side-effectful, rather than relying on 14 manifests staying correct forever — the override also covers an app's own dependencies, which no manifest audit here could. `sideEffects: false` remains *true* for these packages as an ES-module claim; it is only the MT transform that turns them into registration modules, so the exception belongs to the layer.

- **The build now fails when a worklet would silently never run** (#1021). `SigxWorkletGuardPlugin` diffs the background bundle's worklet placeholders against the main-thread bundle's registrations and errors on any id present in the first and missing from the second, naming the ids and pointing at `sideEffects`. This is the check that was missing: #1002 passed `typecheck`, 4044 tests, `lint` and `verify:pack` while deleting 72 worklets, because nothing in the toolchain compared the two halves. Verified to fail the build on the exact regression it exists to catch.

- **`@sigx/lynx-navigation`: a dropped main-thread ack can no longer wedge navigation** (#1021). `animateProgress` awaited the landing write's MT batch acknowledgement before clearing the transition, and a set transition blocks every push and pop. `runOnMainThread` resolves only on that ack, so a dropped one would have hung the await forever and left the app navigable-looking but inert — taps still firing their haptics, nothing moving, no error. The wait is now bounded, matching the guard `settleBeforeTransition` already applies to `waitForFlush` for the same reason. Defensive: a wedge was reported during verification but never reproduced under a 10-cycle push/pop stress test, so this closes the remaining unbounded await in that path rather than a diagnosed fault.


- **A release build could launch to a permanently blank screen** (#1015). Bundle evaluation threw `TypeError: m.loadLazyBundle is not a function` and `loadCard` failed, so nothing ever mounted. `lynx.loadLazyBundle` is not an engine API — it appears in no version of `@lynx-js/types`. `@lynx-js/react` installs it on the `lynx` object as a module side effect, and a sigx background bundle contains no `@lynx-js/react` modules at all (the worklet loaders pass `dynamicImport: false` precisely so the transform never injects that import). Because the lazy-chunk loader runs during initial evaluation, **one unreachable deferred chunk took down the whole app** rather than failing the screen that needed it.

  Nothing in this repo's source caused it. `@lynx-js/template-webpack-plugin` 0.11 → 0.15 (#984, needed because `@media`/`@supports` only encode from `@lynx-js/tasm` 0.0.41) changed which chunks are treated as lazy bundles: up to 0.13 only chunk groups with an explicit `webpackChunkName` entered `__webpack_require__.lynx_aci`, and sigx produces none, so every `import()` took the `lynx.requireModuleAsync` branch that `@sigx/lynx-cli` embeds and serves (#599/#612). 0.14 began synthesising a name for *unnamed* groups too, moving every dynamic import onto the broken branch at once. It stayed hidden because the change only lands on a fresh `pnpm install` — an existing checkout kept building with the plugin it already had on disk.

  `@sigx/lynx-plugin` now pins async chunks to the path it actually implements: `lynx_aci` is reset to an empty map by a runtime module that sorts after the one populating it, the `output.chunkFilename` the encoder repoints at `lazy-bundle/` is restored, and lazy-bundle templates get an inert manifest so `LynxEncodePlugin` stops inlining the real chunks into them and deleting the standalone files — which was what left `dist/static/js/async/` empty and gave `embedAsyncAssets` nothing to carry into the app. Code splitting works as before; the now-unused `lazy-bundle/*.bundle` outputs are left in place and are not embedded. Teaching sigx's runtime to load real lazy bundles is tracked separately.

- **`sigx dev` failed to start at all in a fresh checkout** (#1015). `args.entryNames is not iterable`, thrown from `@lynx-js/css-extract-webpack-plugin` 0.7.1: `@lynx-js/template-webpack-plugin` 0.15 replaced `entryNames` with `chunkGroups` on its `beforeEncode` / `beforeEmit` hooks, and the two packages release in lockstep. The catalog pinned the encoder to an exact `0.15.0` but left css-extract on a `>=0.7.1` floor, and `autoInstallPeers` silently accepted the unsatisfiable `^0.11.0` peer instead of failing the install. Release builds were spared only because the offending tap sits behind an HMR check. The floor is now `>=0.10.1`, whose peer range actually admits the pinned encoder. `CssExtractWebpackPlugin` handling was dropped with it — css-extract 0.8.0 deleted that export when it dropped webpack support, and a stale ambient declaration in `@sigx/lynx-plugin` had been hiding that from the typechecker.

- **`@sigx/lynx-file-system`: `getInfo` disagreed with itself across platforms** (#857, #879). iOS populated `size` / `isDirectory` / `modifiedAt` only inside an `if exists` branch, so a missing file resolved a `FileInfo` whose non-optional fields were `undefined`; Android always sent all five. iOS also reported `modifiedAt` in **seconds** (`timeIntervalSince1970`) where Android sends milliseconds and the README documents milliseconds — every timestamp rendered as January 1970 on one platform only. Both natives now fill the whole record in epoch ms, zeroed when the file doesn't exist. And a path that exists but can't be stat'd (a protected-data file on a locked device, permission denied) used to fall through as `size: 0` — a real failure disguised as an empty file; it now rejects.

- **`@sigx/lynx-file-system`: deleting a `content://` URI no longer reports a success that deleted nothing** (#857, #879). A picker's `content://` URI is a ContentResolver grant, not a path: `File()` built a nonexistent relative path under `filesDir` whose delete "succeeded" while the picked document sat untouched. Android now rejects it, naming the reason. A `file://` URI is unaffected — pickers handing one back have already copied the bytes into the app sandbox.

- **`@sigx/lynx-secure-storage`: argument rejections carry a `code` too** (#857, #903). An empty key or a non-string value threw a plain `Error`, so the README's "branch on `code`" was false for the two failures a caller is most likely to hit first. They are now `SigxError`s with `code: 'invalid_argument'`.

### Added

- **Adaptive layout: window size classes in core, per-breakpoint props in zero** (#1013). Everything in the framework was implicitly phone-shaped — the only device signal was `Platform.isPad`, which is iOS-only, frozen at module load, and stays `true` for an iPad squeezed into a narrow Split View pane. The measurement layer was already right (core's `ScreenMetricsPublisher` tracks iPad Split View and Stage Manager by watching the LynxView's own bounds, not the display's); what was missing was everything above the raw number.

  `@sigx/lynx-core` gains `useWidthClass()` / `useHeightClass()` (`Computed<'compact'|'medium'|'expanded'|'large'|'xlarge'>`, height without the last two), the predicates `useWidthAtLeast(dp)` / `useHeightAtLeast(dp)`, worklet-safe `useWidthClassMT()` / `useHeightClassMT()`, the pure `widthClassOf()` / `heightClassOf()`, and the `Breakpoint` constants — Material's dp thresholds (width 600/840/1200/1600, height 480/900), the one widely-used set expressed in density-independent units rather than desktop CSS pixels, which matters because Lynx lengths are already dp/pt. An iPad Air 13 is `expanded` in portrait and `large` in landscape.

  **These are a separate read from `useScreen()` for a reason.** `useScreen()` changes on every pixel, so branching on it re-renders continuously while a Stage Manager divider is dragged; a bucketed or boolean derivation only notifies when its value actually changes, so `useWidthAtLeast(840)` fires exactly once, as the threshold is crossed. Predicates take an arbitrary `dp` compared against the real width — not snapped to a bucket — and are monotone "at least" reads on purpose, so adding a bucket later can never silently change what an existing call site means. **Branch on height too:** an iPhone 15 Pro in landscape is 852×393, so its *width* reads `expanded` — the same bucket as an iPad in portrait — while its height is `compact`. That asymmetry is how a vertical nav rail ends up on a 393dp-tall screen.

  `@sigx/lynx-zero` gains `Responsive<T>` and `resolveResponsive()`, and every style prop on `Row` / `Col` / `Center` / `Spacer` / `ScrollView` now accepts a per-breakpoint object — `padding={{ initial: 16, expanded: 32 }}` — resolved mobile-first, where a key applies at its breakpoint and every wider one. `Row` and `Col` also gain `direction`, so the stack-on-phone / side-by-side-on-tablet flip restyles in place: written as `{wide ? <Row/> : <Col/>}` it would change the component type and remount the whole subtree on every rotation. Resolution is plain JS off `useWidthClass()` — no Tailwind, no class names, no CSS pipeline, so it behaves identically under every design system and under none. It also has to be JS: these primitives emit inline styles, and a stylesheet `@media` rule cannot override an inline style. There is deliberately no `useResponsive()` hook, because it would build one `computed()` per call site and `computed()` has no disposer while a signal's subscriber set holds strong references — every mount would leak one; the core hooks memoize per threshold for the same reason.

  Also fixed in passing: **`<ScrollView flex={n}>` wrote the `flex` shorthand**, which Lynx expands to `flex: n n auto` — and `flexBasis: 'auto'` sizes a box to its content first. On a *scroll* container that is the whole bug: it grew to its content height instead of taking the parent's leftover space, so the parent overflowed and nothing scrolled. It now writes the long form (`flexGrow`/`flexShrink`/`flexBasis: 0`/`minHeight: 0`) like `resolveBoxStyle` and `.flex-fill` already did. No app in the repo passed `flex` to a `ScrollView`, so nothing depended on the old behaviour. `<Spacer />`'s `flex: 1` fallback is deliberately left alone — the element is empty, so `flexBasis: 'auto'` resolves to zero and it expands correctly.

  Nothing was added to `@sigx/lynx-daisyui`, `@sigx/lynx-heroui` or `@sigx/lynx-navigation`. An adaptive navigation component (declare destinations once; render as bottom bar / rail / permanent sidebar) and a list-detail split view are deferred — the latter needs a pane-scoped width first, since `Stack`'s slide transitions currently read the full screen width. `Platform.isPad` is kept but documented as device identity, not a layout signal. The showcase's Orientation screen grows a live size-class readout and a responsive-props demo.

- **`@sigx/lynx-appearance`: `getColorScheme()`** (#857) — an async, authoritative read of the OS colour scheme from the native module, resolving `null` when the module isn't linked. It answers something `readGlobalColorScheme()` structurally cannot: the BG thread's `__globalProps` is a load-time snapshot that doesn't follow an in-place OS flip (#990). `<AppearanceProvider>` now uses it to self-heal — when the sync read is `null` at mount it probes native once and adopts the answer, instead of sitting on its `'light'` seed for the session. Zero bridge calls on the normal path: the probe is skipped entirely when `globalProps` already answered or the module is unlinked, a reply landing after unmount is dropped, and a live `appearanceChanged` event outranks a slower reply.

  The method existed and worked on both platforms — both native docblocks already advertised it as JS-facing — but nothing in JS had ever called it, which is what the C12 gate was reporting.

### Changed

- **Both conformance baselines are now nearly empty** (#857). `scripts/api-conventions-baseline.json` drops from **44 entries to 5**, and `scripts/module-manifests-baseline.json` from **4 to 0** — C12 is fully clean, every `signalx-module.json` now agrees with the JS call sites, the Swift `methodLookup` and the Kotlin module. Remaining C10 throw prefixes were cleared in the runtime, plugin, web-host and publisher packages; `@sigx/lynx-webrtc` now re-exports `PermissionResponse` from its barrel (C6) so consumers can type a permission result without importing core.

  The five entries left are each owned by a decision rather than by neglect: three `C2` `isAvailable` violations (`lynx-appearance`, `lynx-biometric`, `lynx-sqlite`) are breaking public renames reserved for their module-review issues, `lynx-cli`'s 56 throws await a decision on whether a terminal error should carry a package prefix at all (#871), and `lynx-zero` is outside the review (#927).

- **`@sigx/lynx-core`: a failing `getAppState` seed is now logged at `warn`, not `debug`.** Release builds log at `warn`, so a seed that kept failing left `AppState.current` on its fallback for the whole session with nothing visible in production.

### Fixed

- **`@sigx/lynx-core`: a subscriber that throws no longer escapes into native event dispatch** (#857). Three channels — `appStateChanged`, `screenChanged`, `onFontScaleChanged` — wrote a signal directly from the emitter listener, and sigx flushes `watch`/`effect` callbacks synchronously inside that write. So an ordinary consumer bug (a throwing foreground handler, a throwing render effect reading `useScreen()`) propagated out of the listener and into the engine's own dispatch, aborting delivery of that event for **every other listener on the channel**, silently. All three now go through `subscribeNative`, which contains a throwing listener and reports it. The same three sites also silently dropped any payload that arrived as a JSON **string** rather than an object — the bridge shape that varies by path (#342) — so a rotation, a Dynamic Type change or a foreground transition delivered that way was simply never seen.

- **`@sigx/lynx-webrtc`: a peer created before the runtime was ready no longer deafens the module for the process** (#857). `ensureSubscribed` latched on having *called* `subscribeNative` once, but off-device — and before the Lynx runtime injects its `GlobalEventEmitter` — that call is a silent no-op returning a disposer indistinguishable from a real one. The latch is now keyed on `isNativeEventsAvailable()`, so a later peer retries.

- **`@sigx/lynx-core`: `subscribeNative` survives a host whose `addListener` throws.** Several packages wire their subscription lazily on first API read, so a throwing emitter surfaced as `AppState.current` or `useScreen()` throwing — permanently, because the latch never set. It now degrades to the off-device no-op.

### Changed

- **One native-event subscription for the whole repo** (#857, convention **C7**, rubric **D2.8**/**D3.1**/**D3.2**). Ten packages each carried a hand-rolled `GlobalEventEmitterLike` + `safeParse` + string-or-object payload branch, re-deriving the same four edge cases; all of them now call `subscribeNative()` from `@sigx/lynx-core`, and the only copy left in the repo is core's own implementation. Every subscription therefore gets an idempotent `() => void` disposer, listener-throw containment, defensive payload parsing and a safe off-device no-op — the four things each copy had to get right independently.

  **Breaking, and the point of C7:** `@sigx/lynx-linking`'s `BackHandlerSubscription` and `URLSubscription` were the repo's only `{ remove() }` disposers and are now plain `() => void`. That is what let `@sigx/lynx-navigation` stop special-casing which shape it was handed per call site.

  Two additions to core came out of doing the migration rather than from planning it. `subscribeNative` gained a **`raw`** option, because `urlReceived` delivers the URL as a bare string (the default treats every string as JSON, so `JSON.parse('myapp://…')` threw and swallowed every warm-start deep link) and `hardwareBackPress` carries no payload at all (the default drops `undefined` before the callback, killing the Android back button). And **`isNativeEventsAvailable()`** is now exported, because a lazy latch cannot be keyed on `subscribeNative`'s return value — off-device it hands back a no-op disposer that looks exactly like a real one.

  Its `namespace` option now also builds the logger rather than only decorating the message text, so a package's subscription diagnostics land on that package's namespace and are filterable there — which is what the option always claimed to do.

### Fixed

- **`@sigx/lynx-navigation`: pressing back at the root of the stack no longer raises an unhandled rejection** (#857). `useHardwareBack` called `void BackHandler.exitApp()`, and that promise rejects whenever the bridge call throws synchronously — which is *always* off Android, where the module either rejects by design or isn't linked at all. On the main thread an unhandled rejection is a fatal exception rather than a warning (#863), and the `void` made it look deliberate. It now consumes the rejection and reports it through `createLogger`. The regression test drives a back press with no native module and asserts the log record; it fails without the fix.

### Changed

- **Errors and logging now follow C10 across nine packages** (#857, rubric **D6.4**/**D6.5**). Thrown messages carry the scoped `[@sigx/lynx-<pkg>] <action> failed: <cause>` prefix, and anything a caller might branch on extends `SigxError` from `@sigx/lynx-core` with a stable `code`. 50 unprefixed throws went to zero in `lynx-navigation` (24), `lynx-http` (8), `lynx-webrtc` (7), `lynx-websocket` (4), `lynx-sqlite` (3), and one each in `lynx-sheet`, `lynx-emoji`, `lynx-webauth` and `lynx-linking`. Bare `console.*` diagnostics moved onto `createLogger` namespaces, so module failures reach the `sigx dev` terminal the way the root README has always claimed. The conventions baseline drops from 21 entries to **12**.

  **Messages changed, so anything matching on the old text breaks** — `useTabs() called outside of a <Tabs> component.` is now `[@sigx/lynx-navigation] useTabs() failed: called outside of a <Tabs> component.`. Branch on `code`, never on the message; that is what `code` is for. `instanceof Error` is unaffected.

  Where a native error class is load-bearing it is kept rather than replaced: `lynx-websocket` still throws real `TypeError`/`SyntaxError` where the WHATWG spec does, and its `DOMException`-shaped failures wear the standard name on both `name` and `code`; `lynx-navigation`'s `compilePath` keeps `TypeError` so `instanceof TypeError` still narrows. `@sigx/lynx-navigation`, `@sigx/lynx-sheet` and `@sigx/lynx-emoji` gain a runtime dependency on `@sigx/lynx-core` for `SigxError`.

### Changed

- **Every package now declares `sideEffects`, so bundlers can drop what an app doesn't import** (#857). 52 of the 57 packages left the field unset, which a bundler reads as "assume every module does something at import" — importing one symbol from a barrel dragged in the whole package, and rubric item D2.4 failed repo-wide. Each package was classified by reading every module in its `src/` for real module-scope work, then re-checked by a second pass whose default was to refute: 40 are `sideEffects: false`, and 12 name the exact entries that do work at import rather than falling back to `true`.

  The twelve are real effects, not caution: `@sigx/lynx` and `@sigx/lynx-http` install the `fetch`/`Headers`/`FormData`/`Response` globals; `@sigx/lynx-core` registers its console log transport behind a `globalThis` HMR flag; `@sigx/lynx-websocket` assigns `globalThis.WebSocket`; `@sigx/lynx-gestures` and `@sigx/lynx-richtext` call `customElements.define()` for their web elements; `@sigx/lynx-daisyui` and `@sigx/lynx-heroui` push their built-in palettes into `@sigx/lynx-zero`'s theme registry; `@sigx/lynx-icons` pulls in the generated `@font-face` stylesheet; `@sigx/lynx-keyboard` restores last run's lift height from storage; `@sigx/lynx-dev-client` installs the console streamer and error logging; and `@sigx/lynx-runtime` lists the eight modules that mount globals, directives and bridges.

  Four packages publish CSS through their `exports` map, and a stylesheet is imported purely for its side effect — so `@sigx/lynx-zero` (`styles/tokens.css`, `@import`ed by both design systems), `@sigx/lynx-heroui` and `@sigx/lynx-daisyui` (`styles/index.css`) and `@sigx/lynx-icons` (the generated `__font-face.css`) list their CSS entries too. A bundler that believed `sideEffects: false` here would drop the tokens and the icon `@font-face` at runtime.

### Documentation

- **Every README ends with `## License`, and `## Gotchas` is called `## Gotchas`** (#857, convention **C11**, rubric **D7.4**). The template's closing section was missing from 19 packages, and two had invented their own name for the platform-quirks section — `## Notes & caveats` (`@sigx/lynx-sqlite`) and `## Caveats vs the browser` (`@sigx/lynx-websocket`) — which breaks the docs site's section-based navigation and any grep across package READMEs. `@sigx/lynx-webrtc` carried the license as a bare `License: MIT` line. `## 📚 Documentation` was missing from `@sigx/lynx-sheet` and `@sigx/lynx-updates-publisher`, both of which have a live docs page; `@sigx/lynx-web-host` keeps that gap deliberately, since sigx.dev has no page for it.

- **Three READMEs stopped contradicting their own packages** (#857, rubric **D7.4**).

  `@sigx/lynx-safe-area`'s only example didn't compile — `defineApp` takes a JSXElement and returns an app to mount, not a setup function — so a reader copying it got a type error and a blank screen. It now has an `## API` table covering all eleven exports (they had no in-repo reference at all) and a `## Gotchas` section: the no-provider `ZERO_INSETS` fallback, why `<SafeAreaView>` sets `flexBasis: 0`, and why insets are inline style rather than an MT animated style.

  `@sigx/lynx-keyboard` documented neither its web story (every primitive renders and none of them lift, because lynx-safe-area publishes no keyboard inset there) nor its units — `duration` is seconds, not milliseconds, and every length is in Lynx logical pixels (what `@sigx/lynx-safe-area`'s docs call dp/pt). `resetRememberedKeyboardLift` is now documented as the test seam it is rather than being an unexplained barrel export.

  `@sigx/lynx-maps` published `Closes signalxjs/lynx#84` to npm, with its opening sentence severed from its own bullet list by the Documentation section. Its v2 list claimed imperative methods were blocked on a `UIMethodInvoker` surface "not wired through sigx-lynx yet" — stale: lynx-webview, lynx-list and lynx-richtext all drive native methods through `MainThread.Element.invoke` today, so they are unimplemented, not blocked. The same list called itself "tracked as v2 follow-ups" when no issue tracks any of it. And `latitudeDelta` is ignored on Android (zoom is derived from `longitudeDelta` alone) while iOS drops a region missing either delta outright — a per-platform difference the `region` row presented as uniform.

- **Every native-module README now has an accurate `## Web` section** (#857, convention **C11**, rubric **D7.5**). 23 packages were missing one — the whole `C11/readme-missing-web-section` rule class — despite `sigx run:web` being a headline feature, so the CI baseline shrinks from 44 entries to 21 and that rule is now clear repo-wide. Each section states supported / degraded / unsupported, the mechanism, and what to use instead, grounded in the actual handler list in `packages/lynx-web-host/src/host.ts` and the `.web.ts` swap in `packages/lynx-plugin/src/entry.ts` rather than in what sounds plausible.

  The useful ones are the degradations nobody had written down: `@sigx/lynx-appearance` reads the color scheme on web with no shim at all (the page bridge publishes `globalProps.appearance` from `matchMedia`) while its system-bar setters resolve `{ ok: false, reason: 'unsupported' }`; `@sigx/lynx-datetime-picker` resolves `{ cancelled: true }` **without ever showing UI**, which is indistinguishable from the user cancelling; `@sigx/lynx-camera` points at `@sigx/lynx-image-picker`, whose web path reaches the camera through the browser's own file chooser; and `scaleWithText` on `@sigx/lynx-icons` is inert on web because no web publisher writes `lynx.__globalProps.fontScale`.

### Added

- **Public-surface freeze tests for 54 of the 57 packages** (#857). Rubric item **D7.1** asks each package to lock its exported API so an accidental rename or removal breaks CI instead of reaching consumers — 6 packages had one. 48 more now do (`@sigx/lynx-zero`, `@sigx/lynx-daisyui` and `@sigx/lynx-heroui` are deliberately left out while the design-system layering in #927 is in flight — freezing a surface that is still moving would only churn), modelled on `packages/lynx-navigation/__tests__/public-surface.test.ts` and the compact `packages/lynx-clipboard` variant: a runtime `Object.keys(mod).sort()` snapshot, a second snapshot of the namespace object for C1 packages, and `expectTypeOf` pins on the shapes `CONVENTIONS.md` constrains — `isAvailable` staying synchronous (C2), subscriptions returning `() => void` (C7), permission methods returning `PermissionResponse` (C6), the `SV`/`MT` hook suffixes (C8), `cancelled` unions (C5). The 13 packages shipping a `.web.ts` also assert that both implementations expose the same surface (**D7.1b**) — the plugin swaps them by `extensionAlias`, so a method added to one and not the other is a runtime failure on whichever target missed it, invisible to a typecheck. +237 tests.

  The tests freeze today's surface; they do not fix it. Where a package already violates a convention — `lynx-http`'s `isHttpAvailable` instead of `isAvailable`, `lynx-notifications` exporting its four push subscriptions both bare and on the namespace, `lynx-sheet` and `@sigx/lynx` publishing internals — the current shape is pinned as-is and recorded on the owning module-review issue.

- **`test` script on the 34 packages that lacked one** (**D7.2**), matching the 23 that already had `"test": "vitest run"`. Every package now has at least one test to run.

## [0.27.0] - 2026-08-10

### Changed

- **Built-in theme palettes now resolve from generated CSS instead of inline custom properties** (#985). `<ThemeProvider>` used to declare the whole active theme — ~30 `--color-*` plus the text ramp and both surface paints — as inline style on its host view, rebuilt every render. The design-system packages now generate their built-ins into real stylesheet rules from the same registry data at build time (`scripts/gen-theme-css.mjs`), and the provider just puts the theme name on the host. Two rules per theme: a pinned `.daisy-dark { … }`, and a `@media (prefers-color-scheme: dark)` twin selected by an extra class while the app follows the OS. The media rule is compound (`.lynx-zero.scheme-dark-daisy-dark`) so it scores (0,2,0) against the pinned rule's (0,1,0) and wins without depending on source order — which is the point: **the painted theme is now the engine's own answer about the color scheme, not the background thread's.** A stale or missing `__globalProps` snapshot (#990) can no longer paint a light app on a dark device.

  **Runtime-registered themes are unchanged and stay that way.** A tenant palette fetched from a backend has no rule to resolve against — Lynx has no runtime stylesheet-injection API (#116) — so it keeps declaring its exact palette inline, first-frame-correct, switches re-resolving. `extendTheme()` deliberately does **not** propagate the new `staticCss` flag: a derived theme is a new name with no generated rule behind it, and inheriting the flag would leave an app with no palette at all.

  The choice is gated on a new `__SIGX_CSS_RULE__` build define rather than on assumption, because the media layer silently vanishes two ways — the `enableCSSRule` kill switch, and the web target, whose encoder drops at-rules upstream. Web therefore keeps the JS appearance path exactly as before, and any build without the define falls back to the inline transport. `enableCSSInlineVariables` stays load-bearing for that path.

  Also in this change: the `--text-*` ramp is emitted only when `fontScale !== 1`, since `.lynx-zero` already declares exactly those literals and a class declaration on the element beats any ramp inherited from an enclosing scaled provider.

### Fixed

- **`@sigx/lynx-daisyui`: Input no longer stays painted in the previous palette after a live theme switch on iOS** (#993). iOS's input element ignores post-mount inline style updates, so the field kept its mount-time colors — most visibly a solid white box on a dark screen after toggling the theme (or, before #990's seed fix, on any dark cold start). The themed box (background + border) now lives on a wrapper `<view>`, which repaints reliably on both platforms; the native field inside is transparent and carries only text metrics and colors. Device-verified: iOS recolors on a live toggle, Android keeps its correct behavior including typed-text survival across #986's in-place dark flips, and focus/typing/layout are unchanged.
- **iOS: the appearance scheme now reaches the background thread's cold-start snapshot** (#990). The publisher seeded only on the next runloop tick — after `loadTemplate` — so the BG thread's `lynx.__globalProps` (a load-time snapshot that post-load `updateGlobalProps` never refreshes) stayed empty for the whole session: `readGlobalColorScheme()` returned null and follow-system themes mounted light on dark devices, visibly leaving natively-painted widgets (e.g. the daisy Input, #993) in light colors. The publisher now seeds synchronously at attach, falling back from the view's (possibly `unspecified`) trait collection to the screen's and then the process-wide current traits, with the runloop-tick pass kept as the authoritative correction. Device-verified: a dark cold start now reports `colorScheme: dark` from the BG read at first render and mounts the dark theme. The post-load BG staleness itself remains tracked in #990.

### Added

- **Android dark-mode flips now switch in place** (#986). The CLI template lists `uiMode` in `android:configChanges`, so an OS appearance flip no longer recreates the Activity and reloads the bundle: `@sigx/lynx-appearance`'s application-level configuration callback republishes the scheme — the engine re-resolves `@media (prefers-color-scheme)` via `updateColorScheme` and JS follows via `appearanceChanged` — with all app state preserved (device-verified: probe screen and its tap counter survive the flip). The template's Compose `MaterialTheme` also follows `isSystemInDarkTheme()`, so the surface behind the LynxView no longer flashes white in dark mode during load. Matches iOS, which switches in place since #984. Caveat recorded on #990: the BG thread's `readGlobalColorScheme()` reads a load-time snapshot and does not see in-place flips — live BG updates come from the `appearanceChanged` event.

- **CSS `@media` / `@supports` / `prefers-color-scheme` now reach the device — theming can start moving out of JS signals** (#951). Three pieces, verified on both platforms with a release-build probe screen:
  - **`@sigx/lynx-plugin`**: `@lynx-js/template-webpack-plugin` bumped 0.11.0 → 0.15.0 (`@lynx-js/tasm` 0.0.49; the Node 20 pin that held it died with #957, and this is deliberately decoupled from the #975 rspeedy/rsbuild migration), plus a new `enableCSSRule` page-config flag (default `true`, kill switch). Both are required: media/supports encoding exists only from tasm 0.0.41, **and** only through the `CSSRuleParser` path gated on the undocumented `enableCSSRule` key — without it the encoder silently drops every at-rule, no diagnostic. Also guards the web target against tpwp ≥ 0.14's async-template pass crashing on lazy chunk groups whose JS deduplicated into the main chunk (`SigxWebEncodeGuardPlugin`). The web bundle still carries no media/supports rules — upstream's `WebEncodePlugin` drops them; web keeps the JS appearance path.
  - **`@sigx/lynx-appearance`**: the publisher now drives the engine's own color scheme (`LynxView.updateColorScheme`, "channel 0") on both platforms, and the CLI templates seed the initial value at LynxView construction — the engine never tracks the OS scheme by itself (negative-control-verified: without this wiring a dark device resolves light). On iOS, foreground appearance flips are now observed via `registerForTraitChanges` (iOS 17+); previously they reached neither JS nor the engine until the next app-foreground.
  - **Node 20 support is dropped** (agreed in #957, executed here): the tasm WASM encoder the new template-webpack-plugin ships needs a newer V8 than Node 20 ("Unknown heap type -14" on web builds). CI now tests Node 22/24 and `@sigx/lynx-plugin` declares `engines.node >= 22`.
  - Device verdicts: `prefers-color-scheme` correct at cold start and on live flips; width/orientation queries evaluate in **logical px** and re-evaluate live on rotation; stylesheet-declared and `@media`-scoped custom properties resolve and inherit (the pure-CSS theme-palette primitive #116 was missing); `@supports` matches honestly (no false positives, doesn't claim `oklch()`); `@font-face` loads via `data:` URIs (bundler-emitted `url()` assets don't resolve — the lynx-icons v1.1 path is inlining or native registration). Inline `--*` custom properties register only through runtime `SET_STYLE` styles, not snapshot-template static styles — `enableCSSInlineVariables` stays load-bearing for ThemeProvider; a CSS-first ThemeProvider is a follow-up. The showcase gains a permanent **CSS engine probe** screen (verdict swatches: green = works).

### Fixed

- **`@sigx/lynx-list`: chat first paint lands on the newest message on Android — and `bottomInset` starts working** (#930). Opening a chat whose history exceeds the viewport landed *near* the bottom but not at it, with the newest message(s) hidden behind the composer; sending one message snapped it right. Android's instant scroller is padding- and cell-height-blind — `UIList.scrollToPosition` computes `offsetPx += rv.getHeight() - dipToPx(itemHeight ?? 0)` and we never pass `itemHeight`, so it anchors the target cell's **top** at `paddingTop + viewportHeight` and the cell lands entirely below the visible edge. Device logs confirm it exactly: `scrollToPositionNoSmooth: position=52, offset=1914`, and 1914px is the viewport. `LinearLayoutManager.fixLayoutEndGap` only corrects a gap, never an overshoot, so nothing pulled it back. The instant pin is now two-phase: after `scrollToPosition` it consumes one clamped `scrollBy({ offset: viewport })` on the **next** `layoutcomplete` — `RecyclerView.scrollBy` stops at `getEndAfterPadding()`, so it is padding-aware and cell-height-agnostic and lands exactly at the end. The #839 re-pin skips the pin entirely and uses that one clamped call. Android only; iOS's scroller already uses the real cell height, and the smooth follow path was never affected.

  **This also revives `bottomInset`.** Its native compensation only runs when `wasPinned` — `pin && distanceFromBottom <= 1` — so a first pin that lands short left it permanently false: on Android the newest message never actually stayed clear of a keyboard or sheet, despite that being the whole point of the prop. With the pin exact it fires, device-confirmed against the showcase Chat composer's emoji sheet. See #973 for why this also blocked evaluating whether the `sigx-list` platform subclass can be retired.

- **`@sigx/lynx-list`: the pull-to-refresh indicator no longer paints at rest** (#754). A refresh-enabled `<List>` permanently showed `Refreshing…` (or the `refresh` slot) bleeding over whatever sat directly above it. The indicator is parked at `position: absolute; top: -pullThreshold` inside the content wrapper — outside that wrapper's bounds — and Lynx views default to visible overflow, so document order made it paint over the earlier sibling. The **measuring** wrapper now clips when `refreshEnabled`; it has to be that one and not the content wrapper, because the indicator is a child of the content wrapper and translates down with it, so clipping there would hide it during the pull too. `props.style` is spread after, so a caller can still opt out.

### Added

- **`@sigx/lynx-observability`: `Memory.query()` — what the Lynx engine is actually holding** (#953). The package captured errors but had no resource telemetry, and the repo had no JS-side memory instrumentation at all. One call now returns a process-global reading covering every LynxView: `totalBytes` against the app's own `appBytes`, the element tree as `elementBytes` **and** `elementNodeCount`, platform UI bytes, both runtime heaps, and a per-instance breakdown sorted by size. That element-bytes-against-node-count pairing is the signal #603 and #606 have been missing — it turns "the screen went blank" into "we're mounting 12,000 nodes".

  This gives the package its **first native code** (`signalx-module.json` + `ios/` + `android/`), because the reading cannot be had from JS: Lynx does emit a `memory` performance entry, but it sends it with `kEventTypePlatform` only, so it reaches native observers and never the background or main-thread JS runtimes. `MemoryUsageEntry` is nonetheless declared in `@lynx-js/types`, which makes `observe(['memory'])` type-check and return silence on device — a trap worth knowing about, and the reason a bridge of our own was the only route. Requires **Lynx ≥ 4.0.1** and a `sigx prebuild`; no engine setting is needed, since `enable_memory_monitor` gates only the passive entry stream and fetcher registration is unconditional.

  A `'timeout'` status is a **partial result, not an error** — `query()` resolves, and `completedInstanceCount` against `expectedInstanceCount` tells you how much of the reading you got. Device-verified on both platforms against release builds; the README records which fields each platform actually populates, because they differ (Android reports no `viewBytes`, iOS reports no background-runtime bytes, and only iOS fills in `url`). **Installing this package changes your OTA runtime fingerprint** — it adds native sources — so re-prebuild, cut a store release, and republish your update bundles.

- **`@sigx/lynx-observability`: `Memory.startReporting()` — memory on a timer, not just on demand** (#953). Samples engine memory on an interval and logs each reading under a `memory` namespace, so it reaches the `sigx dev` terminal and any registered sink with no extra wiring. Also reachable declaratively through `logging.production.memory` in `signalx.config.ts`, presence-means-enabled exactly like the existing `sink`.

  It reschedules from **completion**, not on a fixed interval — an engine query can take the full timeout, and `setInterval` would stack overlapping process-global collections. Every tick catches, because an unhandled rejection on the background runtime is a fatal main-thread exception under PrimJS (#863), not a warning someone might read. `maxInstances` (default 5) caps the per-instance rows so a record can't grow with the app's LynxView count. Unlike `Memory.query()`, it **no-ops instead of throwing** when the native module isn't linked: it's ambient telemetry started before app code runs, and a throw there would take down an app whose only mistake was forgetting to re-run `sigx prebuild`.

  **A wrapper for Lynx's background-thread `PerformanceObserver` was written for this release and then withdrawn**, because it doesn't work here. `lynx.performance.createObserver` exists, `observe()` succeeds, and no entry is ever delivered — not `pipeline`, not `metric`, and not the older `addTimingListener` callbacks either. Verified on a release build on device, with the raw engine API rather than only our wrapper. Shipping it would have been the exact failure mode this package documents elsewhere: an API that type-checks, reads correctly, and returns silence. First-paint and FCP reporting therefore isn't available yet; the finding is filed with its repro as #982.

- **`examples/flik`: stress harness and the measurement it was built for** (#937). Disc count up to 400, a broadphase toggle, a switch that defeats the dirty-write cull, and a `loop` mode that re-kicks at quiescence so the worst case is sustained rather than a decaying transient. The headline result, on a 120Hz Pixel 9 Pro XL release build: **up to 200 simultaneously moving discs the three render paths are indistinguishable** — publishing 200 SharedValue tuples per frame at 114fps is below what the instrument can resolve, which was not the expected answer, since the bridge publish was the suspected bottleneck going in. What does cost is the simulation, superlinearly with contacts: 0.2ms at 12 discs, 1.5ms at 200, 6.8ms at 400 where the board jams solid. A `0 writes` reading at 400 turns out to mean "the board settled and the dirty-write cull is doing its job", not "the bindings died" — the counter has two meanings and only the `all` toggle separates them.

- **`examples/flik`: switchable render paths** (#937). Three ways to get a disc's position onto the screen, chosen at runtime: a `SharedValue` with a `useAnimatedStyle` binding (the idiomatic path, which also publishes every write to the background thread), a raw `setStyleProperty` from the simulation, and the same binding over an *unbridged* `MainThreadRef` — which works because the style-binding flush resolves `refMap[wvid].current?.value` and never consults `bridgedAvWvids`, so the mapper runs with no publish. The third exists to split the first's cost between the mapper and the bridge. Switching remounts the disc layer so the losing path's bindings are genuinely unregistered rather than left idling in the flush loop. At the real game's twelve discs all three measure the same on a 120Hz Pixel 9 Pro XL (p50 5.8–6.0ms, tick 0.1–0.2ms) — twelve bridge tuples a frame is below what the instrument can resolve, which is itself the result.

- **`@sigx/lynx-plugin`: `__DEV_BUILD__`** (#937). A plain boolean build-tier literal, folded per environment alongside `__WEB__` / `__NATIVE__`. App code had no safe way to ask "is this a development build": the bare `__DEV__` define expands to a `process.env` expression that **throws in the Lynx background runtime** — the plugin's own comment already warned against referencing it, but offered nothing in its place. `__DEV_BUILD__` is resolved in Node at build time, so `if (__DEV_BUILD__)` both works at runtime and tree-shakes out of a release bundle. Declared in `@sigx/lynx/client`.

- **`examples/flik`: a frame-timing HUD** (#937). The repo's first performance instrumentation. It reports frame interval and tick cost as separate numbers, because their divergence is the whole diagnosis — a short tick inside a long frame means the time is going somewhere outside our control, while a tick that fills the frame means it is our JavaScript. Percentiles come from an 8-bucket histogram interpolated within the containing bucket, since the main thread's only clock is `Date.now()` at 1ms granularity and a precise percentile off it would be fiction. The sparkline is written one bar per frame straight from the worklet — one style write per frame regardless of disc count, and no background traffic, so it cannot distort what it displays; the numeric panel drains to the background thread at 2Hz. First reading, release build on a 120Hz Pixel 9 Pro XL at 12 discs: `120fps p50 6.0 p95 11.4 · tick 0.3/1.0ms`.

- **`@sigx/lynx-audio`: `Audio.subscribeInterruptions(cb)`** (#867). What happened to playback or recording during a phone call, an alarm, or another app taking the session was previously **undefined to the app** — and on Android nothing requested audio focus at all, so playback simply talked over calls and a recording could be silently ruined. Both platforms now report interruptions on one session-wide channel: iOS observes `AVAudioSession.interruptionNotification`, Android holds reference-counted audio focus for the lifetime of any player or recorder and maps focus loss/gain onto the same event. `{ type: 'began' | 'ended', shouldResume: boolean }`; returns an unsubscribe function per C7. A permanent loss reports `began` with no matching `ended`, which is accurate — the session isn't coming back on its own.

- **`examples/flik`: the flick gesture — FLIK is playable** (#937). You put a finger on one of your discs, slide it anywhere inside your own end of the board, and throw it; the release velocity of your hand IS the shot, so there is no aim line and no power meter. All of it runs on the main thread — `onEnd` has the velocity in hand, writes it into the disc and arms the frame loop in the same frame the finger lifts, and the background thread is told afterwards purely so the ruleset can record which disc was launched. Disc size is felt at both ends: a big disc leaves the finger slower for the same flick (same effort, more mass) and hits harder when it arrives, netting about half again the momentum. Sliding costs nothing — only a flick above the minimum speed commits a turn.

- **`examples/flik`: a main-thread physics simulation** (#937). The FLIK example gained the simulation half of its reason to exist: a fixed-timestep integrator, uniform-grid broadphase and elastic collision resolution, all running as `'main thread'` worklets driven by `useFrameCallback` (#933). It is the repo's first sustained 60 Hz main-thread workload, and the baseline the render-path comparison will be measured against — a ~1.5 second shot is roughly 90 frames and sends the background thread exactly **one** message, at quiescence. The physics is split one worklet per phase rather than inlined into a single body, which works because a captured `'main thread'` worklet resolves to a real callable on the other side (a captured plain function does not — hence the tuning constants being inlined, with a test pinning them against `tuning.ts`). Because `'main thread'` is just a string expression statement under node, the tests drive the **real** worklets rather than a copy.

### Changed

- **`@sigx/lynx-dev-client`: the perf HUD shows engine memory, and stops pretending to show timings** (#978). Both HUDs have been broken since they were written, which nobody had noticed because they fail by displaying "Waiting for metrics…" rather than by erroring. Measured on a Pixel 9 Pro XL and an iOS 26 simulator: Android's `LynxView.forceGetPerf()` returns **null** at 2 s, 5 s, 10 s and 20 s after load, so its 2-second poll always took the placeholder branch; iOS populated only from `didReceiveFirstLoadPerf` and the `onSetup` / `onUpdate:timing:` dictionaries, none of which are ever called. Nine perf surfaces were probed across the two platforms and every one is silent, with ordinary lifecycle callbacks firing on the same client as the control.

  So the HUD now shows what can actually be measured: **`Lynx mem` and `Nodes`**, from `LynxMemoryUsageQuery` (#953's engine memory query, called directly — the dev client can't depend on `@sigx/lynx-observability` being installed). Polled every 5 s and only while the overlay is visible, because the engine offers no push channel for memory.

  The timing half is wired to Lynx 4.0's typed performance observer — `LynxViewClientV2.onPerformanceEvent` on Android, `LynxPerformanceObserverProtocol` via `LynxViewLifecycleV2` on iOS, each hopping off the engine's reporter thread before touching view state — and it renders **nothing today**, because the observer never fires. That is a Lynx-side problem, tracked in #982 and asked upstream as lynx-family/lynx#8405: `TimingCollector` only records inside a scope the engine opens around its own pipeline, and a framework driving the element PAPIs directly never enters one. The legacy sources it replaces were themselves returning null, so nothing measurable was lost; the eight timing metrics simply start appearing when that is resolved. Metrics that haven't arrived are omitted rather than rendered as `0.0ms`.

  The vocabulary those eight will use — `FCP`, `FMP`, `Bundle`, `JS core`, `Pipeline`, `MTS`, `Layout`, `UI flush` — is declared once per platform in native source, so a test reads both files and fails on a rename, a reorder or a dropped group. That parity was the point of the issue, and it is worth pinning now rather than after the two platforms have drifted again.

  Two fixes ride along. The collector is registered when the LynxView is built rather than when the overlay is toggled, since FCP and FMP fire once during startup and subscribing later would miss them permanently. And the iOS toggle persists across relaunch, matching Android's `DevSettings.perfHudEnabled` — you can leave the HUD on while chasing a number.

- **BREAKING — `@sigx/lynx-list`: `itemSnap` takes the shape native actually reads** (#950). It was typed `'start' | 'center' | 'end' | 'none'` and emitted as a bare string, but **both platforms read `item-snap` as a dictionary** — `setPagingAlignment(ReadableMap)` on Android, `LYNX_PROP_SETTER("item-snap", …, NSDictionary *)` on iOS — so the string never reached either setter and paginated snapping has never worked. It went unnoticed because the prop has no consumer anywhere in the repo: no package, no example, and the one test asserted only that the string landed as an attribute. `itemSnap` now accepts either the alignment shorthand (`'start' | 'center' | 'end'`, expanded to `factor` `0` / `0.5` / `1`) or the full `{ factor, offset, maxSnapCount }`, and is normalized to the dictionary before emission. `'none'` is gone — omit the prop, which is what native means by an absent `item-snap`. Also adds **`maxSnapCount`** (Lynx 4.0+): how many items one fling may cross, default `1`, emitted only when set so pre-4.0 hosts see the attribute unchanged.

- **`@sigx/lynx-plugin`: `enableElementApiNewRegistration` page-config flag** (#957). Lynx 4.0 can register the Fiber Element API through a new raw binding path instead of the long-standing `RenderBindingFunction` one. Pinned **off** — the path every `<sigx-*>` custom element is verified on, since they are all created through the generic `__CreateElement` and therefore move as one surface. This one is encoded for a stronger reason than the other flags: upstream marks it `readSettings: true`, so a **host setting** can flip it under a bundle that never asked for it; the page config takes precedence, so writing the resolved boolean keeps the choice with the app. Opt in with `pluginSigxLynx({ enableElementApiNewRegistration: true })`.

  Four other 4.0 page-config flags were evaluated and deliberately left alone, with the reasoning now in the plugin README: `enableNativeInteraction` (belongs with the gesture work), `syncXElementRegistry` (no evidence it helps), `enableNativeList` (device-tested in #950 — it does not do what it looks like it does, because `custom-list-name` still selects the platform node), and `enableSingleSession` (a devtool setting, not a page config).

- **`@sigx/lynx-plugin`: `enableNewSticky` page-config flag** (#950). Lynx 4.0 ships a new sticky layout implementation for `<list>` section headers, gated behind this page config and **off by default upstream**. The plugin now encodes the resolved boolean rather than leaving the key absent, so an engine that later flips its own default cannot relayout our sticky headers without us choosing it. Opt in with `pluginSigxLynx({ enableNewSticky: true })`; hosts older than 4.0 ignore the key.

- **BREAKING — the native Lynx engine moves from 3.9.0 to 4.0.1** (#946). `@sigx/lynx-cli`'s Android and iOS templates now pin `4.0.1` for `lynx`, `lynx-jssdk`, `lynx-trace`, `lynx-service-{image,log,http}`, `xelement`, `xelement-input` and `lynx-processor` (Gradle) and `Lynx`, `LynxService`, `XElement` (CocoaPods), with `@sigx/lynx-dev-client`'s devtool coordinates and `@sigx/lynx-icons`' `xelement-svg` following. **PrimJS is now pinned explicitly at `4.0.0` on both platforms** — the old comments claiming an explicit pin would mismatch the engine described 3.9, which wanted the pre-release `3.8.0-alpha.6`; Lynx 4.0.1 declares stable `primjs 4.0.0` in its POM and `PrimJS/quickjs == 4.0.0` in its podspec, so the pin now states the pairing instead of hiding it. The JS side gains a `@lynx-js/*` block in the pnpm catalog — these deps were spread over nine manifests at four different range styles, which resolved eight of them to two versions at once — and `@lynx-js/types` moves to the `4.0.x` line.

  **Breaking:** apps must rebuild their native hosts (`sigx prebuild --clean`) and cut a store release. The Lynx SDK version is folded into the OTA runtime-version fingerprint, so **every already-published OTA update is invalidated by this bump**: a 4.0.1 binary will not accept a bundle published against a 3.9.0 host, and a 3.9.0 binary still in the field will not accept anything published after it. Publish fresh updates once the new binary ships.

  What it unlocks, all still to be adopted: real CSS media queries with a dynamic `UpdateColorScheme` API, element templates with event/data attributes and cached static trees, a native `<blur-view>` (including iOS liquid glass), first-party `<webview>` and `<markdown>` elements, memory and frame metrics, declarative pan interception, and `default-value` on inputs. Two upstream behaviour changes ship on by default and are worth knowing about: text render optimization (iOS `enableTextLayerRenderer` flips to on) and animation culling for offscreen views. Two others are page-config-gated and default **off**, so nothing changes until we opt in: `enableNewSticky` and `enableElementApiNewRegistration`. What 4.0 does *not* bring: the gesture arena still reserves `PINCH`/`ROTATION` enum slots without shipping handlers for them (verified against the 4.0.1 handler factory), so `<sigx-pinch>` stays.

- **BREAKING — `@sigx/lynx-secure-storage`: `set`/`get`/`delete` are now `setItem`/`getItem`/`removeItem`** (#903, #907). The two storage packages contradicted each other about the same operation: `@sigx/lynx-storage` used `setItem`/`getItem`/`removeItem`, this one used `set`/`get`/`delete`, and callers swap between them by durability. `setItem` wins because it matches `localStorage`, `@react-native-async-storage/async-storage` **and** `expo-secure-store` — arriving from web or React Native, it's the name you already know. No aliases: keeping both spellings alive is the thing being fixed. `clear`, `hasKey` and `isAvailable` are unchanged. Native wire names stay `set`/`get`/`delete` — they aren't public API, and renaming them would churn Swift, Kotlin and the manifest for no caller benefit.

- **BREAKING — `@sigx/lynx-clipboard`: `setString` is now `Promise<void>` and rejects on failure** (#872). It was synchronous and returned `void`, so a failed write was **silently invisible**. That wasn't theoretical: Android's `setPrimaryClip` genuinely throws for a clip over the binder transaction limit, and the native method returned nothing, so JS could never learn about it. Both native sides gained a callback; the JS unwraps it through core's `unwrapNativeVoid`, rejecting with a `SigxError` (`code: 'native_error'`). Existing `Clipboard.setString(x)` calls keep compiling, since the promise is simply unawaited — but they do **not** keep behaving the same: an ignored rejection is an unhandled rejection, which surfaces as an `unhandledrejection` event on web and which this engine has treated as fatal (see #863). So the sweep isn't optional tidying — an unawaited call that previously failed silently can now take the app down. On web the same call now rejects when the browser denies clipboard-write permission, instead of logging and swallowing it.

  Two clipboard gaps are also settled as **won't-do**, with the reasons now in the README: **URL clipboard** (iOS has a dedicated `UIPasteboard.url` slot, Android has no equivalent, so one call would mean different things per platform) and a **change listener** (iOS has no clipboard-change notification at all, and polling fires the "Pasted from …" toast repeatedly). Image support is deferred to #934.

### Added

- **`@sigx/lynx-runtime`: `useFrameCallback` — a per-frame main-thread callback** (#933). The runtime had no per-frame API at all, so anything needing one — a physics simulation, a game loop, an inertial settle, a custom easing that has to see every frame — hand-rolled a self-recursive `requestAnimationFrame` chain inside a worklet body and guarded it with a `MainThreadRef` flag (`@sigx/lynx-gestures`' `Draggable` edge-scroll tick is the in-repo example). `useFrameCallback(worklet)` registers the worklet once and returns `{ start, stop, dispose }`; the main thread drives **one** rAF chain for every registered callback and invokes each active one with `{ timestamp, timeSinceFirstFrame, timeSincePreviousFrame, frameNumber }`. `timeSincePreviousFrame` is `0` on a run's first frame and clamped non-negative, so an integrator can never be handed a negative `dt` when the wall clock steps backwards. The ctx crosses the bridge once and is hydrated once: reusing the per-call `INVOKE_WORKLET` path instead would deep-clone `_c`, rebind, and re-`addRef` every `runOnBackground` handle **sixty times a second**, climbing upstream's `_jsFunctionLifecycleManager` refcount without bound. Activation is a separate wire op precisely so it is reachable from the main thread: `startFrameCallback(fc)` / `stopFrameCallback(fc)` are themselves `'main thread'` worklets, so a fling's `onEnd` starts the simulation in the frame the finger lifts rather than a background round trip later, and the simulation stops itself the frame it settles. New wire ops `REGISTER_FRAME_CALLBACK` / `SET_FRAME_CALLBACK_ACTIVE` / `UNREGISTER_FRAME_CALLBACK`.

- **`@sigx/lynx-testing`: `waitFor`, `findBy*` queries, `within`, and failure output that prints the tree** (#908). The package had no way to wait for a *condition* — `waitForUpdate()` advances exactly one microtask plus one macrotask — so any test whose state needed more turns had to guess how many, and the guess is load- and engine-dependent. That is the root cause of both flaky tests in `@sigx/lynx-emoji` (`picker-layout` pumped five turns, `grid-scroll` slept 60ms), and 12+ test files across the repo hand-roll a timing wait today. `waitFor(condition)` polls instead, treats a throwing condition as "not yet", and on timeout rethrows the condition's own error rather than a bare timeout — so a failure still says what was missing. `findByType`/`findByText`/`findByProp` pair it with the matching query, `within(node)` scopes a query to a subtree, and a failing `getBy*` now prints the tree it searched instead of only naming what it wanted.

### Fixed

- **`@sigx/lynx-runtime-main`: animated method bindings never resolved their element on native** (#930). `flushAnimatedMethodBindings` unwrapped a bound `main-thread:ref` by reading `_el`, the handle on our own `MTElementWrapper`. On native `bindMtRef` hands the element to upstream's `updateWorkletRef`, which wraps it in `@lynx-js/react`'s own `Element`, whose handle is `element` — the same class `upstream-invoke-patch.ts` patches for #863. So every native binding fell through to the registry fallback, found nothing, and stayed dirty forever, while the identical code worked on web. Affected every `useAnimatedMethod` consumer.

- **`@sigx/lynx-runtime-main`: a natively-rejected animated method invoke is retried** (#930). The flush kept a binding dirty when the invoke *threw* or the ref was unresolved, but `__InvokeUIMethod` returns normally and reports failure through its callback — which was ignored, so `lastValue` was recorded regardless. Android creates a `<list>` platform UI asynchronously, so the first flushes answer `NO_UI_FOR_NODE` (6); those counted as delivered and never retried, stranding the native state for any producer that then settled. The callback may run synchronously (native answering inline, the ordering trap behind #863) or later, so both are handled, and a late failure for a stale attempt cannot clobber a newer value that already applied.

- **`@sigx/lynx-runtime`: a derived value can skip the background bridge** (#930). `useDerivedValue` / `useDerivedValueReactive` registered a BG sink unconditionally, so a derived value consumed only by main-thread bindings still published every fold. A gesture delta changes every frame by construction — ~60-100 MT→BG dispatches a second for a reader that does not exist, enough on its own to trip the engine's limiter (`ContextProxy::DispatchEvent called too frequently`, error 204) and red-box mid-drag. Both forms now accept `{ bridge: false }`: the value still exists and folds on the main thread, only the publish is skipped.

- **`@sigx/lynx-cli`: `run:{android,ios} --release` no longer packages a stale JS bundle — or none at all** (#960). Embedding the built bundle happened inside `runPrebuild`, *after* its fingerprint fast path. That fingerprint covers prebuild's inputs — config, manifests, templates — and deliberately not the JS bundle, so on a JS-only change the fast path fired and returned before the copy ever ran. The release build then packaged whatever the native project was already holding: the previous bundle, or on a checkout where the fast path fired before anything had been embedded, nothing at all. Nothing downstream could catch it — Gradle and Xcode saw genuinely unchanged inputs and correctly reported up-to-date — so the failure reached the device as an app that launches fine and simply **runs older code**, or one that shows "No bundle found". Embedding is a build-output copy rather than a generation step, so it no longer skips with the pipeline. Release builds additionally verify the bundle they are about to package byte-for-byte against `dist/main.lynx.bundle` and refuse to continue on a mismatch, because this is not a failure you can see: minification defeats grepping the APK for a new symbol, and comparing hashes was the only thing that ever confirmed it. Found twice while measuring on device — once as "no bundle", once as a stale one — costing a build cycle each time.

- **`@sigx/lynx-runtime-main`: a gesture registered before its element exists is no longer dropped** (#958). `useGestureDetector` pushes its registration from `onMounted`, and the element is bound by a separate op. Normally the ref op lands first — but not when the detector's owner mounts *earlier* than the element it binds to, which is what any component that measures itself before rendering its content does. The main thread resolved the element, found nothing, and gave up: the op was pushed, the batch stayed well-formed, nothing threw on either thread, and the gesture was **permanently dead with no diagnostic at all**. It now parks the registration and replays it when the element binds — from `bindMtRef`, the chokepoint both binding paths share, since elements inside a compiled snapshot template never emit a `SET_MT_REF` op at all — in arrival order — a composed gesture arrives as several ops whose relations reference each other by id, so order is load-bearing. A REMOVE arriving while the SET is still parked forgets it, so a component that unmounts inside that window doesn't install a gesture for itself a frame later. Found while building `examples/flik` (#937), where it cost a full device-debug session to identify precisely because it was invisible.

- **`@sigx/lynx-audio`: `onMeter`'s unsubscribe no longer starves other listeners** (#867). The disposer wasn't idempotent, so calling one listener's disposer twice — an ordinary double effect-cleanup — drove the shared reference count to zero and told the native side to stop metering **while another listener was still subscribed**. It went silent, with no error. Each disposer now releases at most once, per `CONVENTIONS.md` C7.
- **`@sigx/lynx-audio`: malformed native payloads say what went wrong** (#867). `getStatus()` typed its result as `PlayerStatus` without checking, handing callers `undefined` where numbers were promised; `stop()` read `.uri` off a payload checked only for `.error`, so an absent result surfaced as a `TypeError` on `undefined` rather than a message. Both now normalize, and thrown errors carry the scoped `[@sigx/lynx-audio]` prefix and a machine-readable `code`.
- **`scripts/check-module-manifests.mjs` no longer misses calls with nested generics** (#867). `callAsync<Partial<T> & { error?: string }>(…)` read as uncalled, because the generic was matched with `<[^>]*>` and stopped at the first `>` — producing false "declared but never called" drift, one of which was already sitting in the baseline for `@sigx/lynx-updates`.

- **A UI method that errors no longer red-boxes the app** (#863). A main-thread `invoke(...)` whose native answer arrives inline was escalated to a fatal main-thread exception, whatever the caller did. Reproduced in the showcase's Chat composer: each appended message makes `<List inverted stickToBottom>` issue a smooth `scrollToPosition`, the relayout that causes fires `layoutcomplete` again, and its re-pin issues a second one while the first is still animating — so native answers `{code: 1, data: "dumplicated, scrollToPositionSmoothly is working"}`, meaning nothing worse than "already scrolling". Both the upstream worklet `Element.invoke` (`@lynx-js/react`) and our own `MTElementWrapper.invoke` rejected from *inside* the Promise executor, because `__InvokeUIMethod` calls its callback synchronously; PrimJS reports unhandled rejections at rejection time, so the engine had already fired before `invoke()` even returned. No caller-side guard could win that race — `@sigx/lynx-list`, `@sigx/lynx-emoji`, `@sigx/lynx-webview` and `@sigx/lynx-gestures` all carried correct-but-inert `.catch()`es. Both implementations now settle an envelope that can only resolve and derive the caller-facing promise from it, so the rejection lands one microtask later, after callers have attached their handlers. The public contract is unchanged: resolves with `data` on `code === 0`, rejects with the same `Error` otherwise; a caller that attaches no handler still gets a genuine unhandled rejection. Since native binds `mtRef.current` to upstream's `Element`, its prototype is patched once off the first bound ref (`upstream-invoke-patch.ts`) — remove that shim if upstream defers the rejection itself.

- **`@sigx/lynx-webrtc`: Android release builds no longer abort on the first `getUserMedia`** (#854). R8 deleted `org.webrtc.WebRtcClassLoader` — a class libwebrtc's `JNI_OnLoad` looks up by name and that has no Java callers at all — so loading the native library killed the process (`SIGABRT`) the moment a call started. Debug builds are unminified, which is why this only ever showed up in store builds: a release APK carried 100 `org/webrtc` class names where the debug one had 438. The `io.github.webrtc-sdk` AAR ships no consumer proguard rules, so nothing supplied the keep. The module now declares its own.

### Added

- **`@sigx/lynx-clipboard`: a showcase screen, and tests for the path that ships** (#872). The module review found the native surface (`src/clipboard.ts`) had **no tests at all** — only the web shim was covered — and no showcase screen, so there was no way to exercise it by hand on a device. Both now exist; the screen deliberately covers the failure paths (unlinked module, empty clipboard, denied web read) rather than only the happy one. Also adds a public-surface freeze test, which additionally pins that the web and native implementations expose the same methods — the plugin swaps them by `extensionAlias`, so a method added to one and not the other is a runtime failure on whichever target missed it, invisible to a typecheck.

### Fixed

- **`@sigx/lynx-clipboard`: `getString()` / `hasString()` no longer assert their return type** (#872). `callAsync<string>` only *declares* the type; a malformed native payload — or `undefined` from a denied web clipboard read — was handed to callers as a `string` that wasn't one. Both now coalesce. Also: the web path's write failure goes through `createLogger` instead of `console.warn`, so it reaches the `sigx dev` dashboard (it is the only signal a caller gets, since `setString` is sync `void`); `sideEffects: false` is declared, which is what makes the package tree-shake; and the README documents that every method throws when the module isn't linked, plus the text-only and can't-report-failure limitations.

- **`@sigx/lynx-core`: `subscribeNative`, `unwrapNative` and `SigxError`** (#860). The three pieces every native module was reinventing. `subscribeNative(channel, cb)` is one native → JS event subscription — emitter lookup, the string-or-object payload parse, a listener-throws guard and the off-device no-op fallback, all in one place; sixteen files had each re-derived them. It returns `() => void` and is safe to call twice, per `CONVENTIONS.md` C7. `unwrapNative(pkg, action, raw)` is the single `{ error }` unwrap, replacing five bespoke variants and throwing `[@sigx/lynx-<pkg>] <action> failed: <cause>` (C4, C10). `SigxError` carries a machine-readable `code` and the raising package, for anything a caller might branch on. Existing packages adopt these through their module review issues (epic #857).
- **Two CI gates for the module contract** (#860). `pnpm check:conventions` enforces the mechanically-checkable parts of C1–C12 — no bare `isAvailable` export, no `isAvailable` returning a Promise, `PermissionResponse` re-exported by permission-bearing packages, scoped prefixes on thrown messages, a `## Web` section in every native module's README. `pnpm check:manifests` cross-checks each module's method names across JS call sites, `signalx-module.json`, the Swift `methodLookup` and Kotlin's `@LynxMethod` — nothing validated these before, and four had already drifted. Both run as ratchets against a checked-in baseline: pre-existing violations are recorded and owned by module review issues, new ones fail CI, and a baseline entry that is no longer needed also fails, so the baselines shrink as audits land.

- **`@sigx/lynx-cli`: native modules can contribute R8 keep rules** (#854). New `android.proguardRules?: string[]` field in `signalx-module.json`, aggregated across linked modules (de-duped) and written to a generated `app/proguard-rules-generated.pro` that the scaffold's `build.gradle.kts` lists in `proguardFiles(...)`. Previously a module whose native dependency shipped no `proguard.txt` had no way to say so, and the app's own `proguard-rules.pro` is scaffold-once — so the rules could not be added on the module's behalf either. That file stays hand-owned; prebuild only ever writes the generated sibling. Run `sigx prebuild` after upgrading.

- **Device rotation: in-place relayout, live screen metrics, and a runtime orientation lock** (#856). A sigx-lynx app can now rotate. Three pieces, all in `@sigx/lynx-core` plus the generated hosts:

  **It rotates in place.** The managed Android manifest now declares `configChanges="fontScale|orientation|screenSize|smallestScreenSize|screenLayout|keyboardHidden"` — a rotation used to recreate the Activity, rebuild the LynxView and reload the bundle, losing all app state. On iOS the host pinned `preferredLayoutWidth/Height` to the launch size with `layoutWidthMode = .exact` and never updated it, so the engine kept laying out portrait-shaped content in a landscape window; the new `ScreenMetricsPublisher` re-pins them and calls `updateViewport(…needLayout: true)` on every size change. Both platforms also push `LynxView.updateScreenMetrics()` so `rpx` re-bases. (`uiMode` is deliberately still absent from `configChanges` — dark-mode switching keeps going through Activity recreation, which `@sigx/lynx-appearance` is built around.)

  **Live screen metrics in JS.** `useScreen()` returns a reactive `{ width, height, scale, orientation, isLandscape }` (logical units) that follows rotation, split-screen and foldable unfold; `useOrientation()` is the coarse `'portrait' | 'landscape'` read, and `useScreenMT()` is the synchronous form for `'main thread'` worklet bodies. `Platform.pixelWidth`/`pixelHeight` remain a load-time device snapshot by design — use these wherever the value feeds layout. `readGlobalScreen()` also closes a long-standing gap (#333): it reads `__globalProps`, which is mirrored onto both threads, so screen size is finally available on the background thread where `lynx.SystemInfo` is empty. `@sigx/lynx-web-host` publishes the same two channels from `resize` / `screen.orientation`.

  **Runtime lock.** `Orientation.lock('landscape')` / `.unlock()`, plus `useOrientationLock(...)` which holds the lock for exactly as long as a screen is mounted — stacked, so popping a covering screen restores the covered one's lock instead of falling through to the build default (`@sigx/lynx-navigation` keeps covered screens mounted). `'default'` means "no runtime lock" and is an alias for `unlock()` on every platform. `signalx.config.ts`'s `orientation` is the ceiling: requesting something the app didn't declare **rejects** with a message naming the config change instead of silently doing nothing. On iOS 15 a lock applies at the next physical rotation (forcing one needs `requestGeometryUpdate`, iOS 16+); no private-API fallback.

  Consumers that had frozen their dimensions at module load now follow rotation: `@sigx/lynx-sheet`'s detents and bottom-edge anchor (closes #791), `@sigx/lynx-navigation`'s transition geometry and edge-back threshold, and `@sigx/lynx-daisyui`'s `<Select>` dropdown placement. Run `sigx prebuild` after upgrading — AndroidManifest / App.swift / ContentView are managed files.


## [0.26.0] - 2026-08-05

### Added

- **`@sigx/lynx-list`: `bottomInset` — frame-synced bottom content inset (Android + iOS)** (#844). New prop `bottomInset?: number | SharedValue<number>`: the native recycler keeps that much of its bottom viewport clear, applied directly (no CSS write, no layout pass) so a main-thread SharedValue — `useKeyboardLiftSV()`, a `BottomSheet`'s `onReveal` — can drive it per frame. The package gains its first native side under the opt-in platform tag `sigx-list` (via `custom-list-name`, set only when the prop is present): Android `SigxListUI extends UIList` (RecyclerView padding delta + pinned `scrollBy` compensation, re-stacked across CSS relayouts); iOS `SigxListUI: LynxUICollection` (`contentInset.bottom` delta with delta-measured pinned compensation, re-stacked in `updateFrame`, plus an `alignTo:"bottom"` bias in `scrollToPosition` — the engine scroller targets the viewport bottom ignoring extra inset, which would land every chat re-pin under the keyboard). In chat mode the newest item stays anchored above the inset via same-frame native compensation, and chat release detection becomes inset-aware (tracked on the main thread as `scrollTop + inset`) so compensation scrolls can't falsely release the pin or fire spurious `endReached`. Run `sigx prebuild` after upgrading; hosts without the native module (web) ignore the inset.

- **`@sigx/lynx-navigation`: `useDidAppear()` — run work after the entrance transition settles** (#849). The heavy-work sibling of `useFocusEffect`: the callback runs only once the screen is focused *and* no transition is in flight, with the returned cleanup on blur, on a new transition, or on unmount. `useFocusEffect` cannot serve this case — `useIsFocused` is `nav.current.key === myKey` and a push commits the stack immediately, so it fires while the slide is still running. That matters because component setup runs on the BG thread but the resulting op batch is applied on the MAIN thread in one uninterruptible pass — the same thread driving the tween — so mount work scheduled on focus starves the animation.

- **`@sigx/lynx-runtime`: `useAnimatedMethod` — SharedValue-driven native UI methods** (#844, groundwork). The imperative sibling of `useAnimatedStyle`: bind a `MainThreadRef`'s element to a `SharedValue` and the MT runtime invokes a named UI method (`{...params, [valueKey]: value}`) on every flush boundary where the value changed — same dirty-diffing and derived-value ordering as style bindings, no thread crossing per frame. For natively-backed per-frame state a style write can't express without a layout pass; first consumer is `<list>`'s upcoming `setBottomInset` (frame-synced bottom inset under keyboards and dragged sheets). Static and reactive (`() => spec | null`) call shapes; new wire ops `REGISTER_AV_METHOD_BINDING` / `UNREGISTER_AV_METHOD_BINDING`.

### Fixed

- **`@sigx/lynx-navigation`: a modal/sheet pop now slides immediately** (#849). Every pop awaited `settleBeforeTransition()`, which exists to let the *un-hidden* underneath layer relayout before the slide starts. Only a card pop un-hides anything — `computeLayers` keeps the whole static run below an overlay at `hidden: false` the entire time it is up — so for a modal or sheet that wait staged nothing and simply delayed the motion. On a heavy screen `pendingOps()` never goes quiet, so it cost the full `PRE_STAGE_MAX_MS`: the header repainted instantly and the screen then sat still. Measured on device, popping the showcase's Chat composer produced 2-3 frames in the 400 ms after the press; it now produces 35-36, matching a light screen.

- **`@sigx/lynx-navigation`: navigation requested mid-transition is replayed instead of dropped** (#849). `push` / `replace` / `pop` used to `return` outright while a transition was in flight. A transition outlives its own slide — `animateProgress` awaits a main-thread landing ack after the duration elapses — so a press arriving once the animation *looked* finished still vanished, and (since consumers commonly fire a selection haptic first) the dead tap even buzzed. The most recent intent is now remembered and replayed when the transition clears, guarded so it can't over-navigate: a repeated tap on the same row won't stack a duplicate screen, a second back press won't pop an extra one, and an intent older than 1 s is discarded. Gesture starts (`beginBackGesture`, `commitSheetDismiss`) and programmatic jumps (`popTo`, `popToRoot`, `dismiss`) are still dropped, where a late replay would be more surprising than a no-op.

- **`@sigx/lynx-emoji`: category slices are bucketed in one pass** (#849). Building the picker ran one `filter` per category over the whole ~1,900-entry dataset — nine full walks. Now a single pass buckets every entry into its category.

## [0.25.0] - 2026-08-05

### Fixed

- **`@sigx/lynx-list` chat mode: the bottom pin now survives relayouts** (#839). The scroll-to-bottom used to be one-shot per trigger (first paint, append), so any cell growth *after* the pin landed — late self-measure of long text, images decoding, a streaming last message growing without a count change — left the viewport stranded above the newest item, and consumers had to follow streaming growth by hand. While the viewport is at the bottom (and `stickToBottom` is on), every `layoutcomplete` now re-pins instantly; scrolling up still releases the pin on the first real movement.

- **`@sigx/lynx-list` windowing: a head-prepend now translates the window instead of shifting its contents** (#840). Paging older history into the front of `items` left `{start, end}` numerically unchanged but referencing different items, so the rendered slice visibly jumped on every load-older while scrolled up. The List now detects the prepend by finding the old first item's key again and translates the window by the prepended count — the same cells keep rendering the same items. Requires a real `keyExtractor`.

- **`@sigx/lynx-list`: scroll invokes can no longer red-box the app**. During layout transitions (keyboard resize, teardown) the native list can be in a state where `invoke('scrollToPosition')` throws *synchronously*; with the chat re-pin firing per `layoutcomplete` this surfaced on-device as a fatal main-thread exception. Every scroll invoke (the List's worklets and `ListMethods`) is now wrapped best-effort.

### Added

- **`@sigx/lynx-list`: `scrollHandle` prop with `scrollToEnd({ smooth? })`** (#841). A programmatic "jump to the newest" that accounts for the header/footer/loading cells and the rendered window — index math consumers cannot do themselves once windowing is on. In chat mode it also marks the viewport at-bottom and clears the unread affordance, so a target cell that hasn't reached native yet is caught by the next relayout's re-pin. Follows the `EmojiGridScrollHandle` populate-at-setup pattern (the handle must be identity-stable); exported as `ListScrollHandle`.

- **`@sigx/lynx-list`: `newMessagesOffset` prop** — the chat `newMessages` affordance floats a fixed 12 px above the wrapper's bottom edge, which hides it behind the floating composer overlay most chat UIs put there (found on-device: the pill was present but invisible). The new prop raises the affordance to clear such overlays; default stays 12.

## [0.24.0] - 2026-08-05

### Changed

- **Aligned to sigx core 0.15** (#835). The workspace catalog now pins `@sigx/reactivity` / `@sigx/runtime-core` at `^0.15.0`, and the sibling pins moved with their tiers: `@sigx/cli` `^0.9.0` → `^0.10.0`, `@sigx/terminal` `^0.11.0` → `^0.12.0`. Core 0.15 widened the slot-call return type from an array to any renderable (a single node/scalar as well as an array), so the two `Divider` components (`@sigx/lynx-daisyui`, `@sigx/lynx-heroui`) now normalize their label slot's result to an array and drop non-rendering values (`null`/`undefined`/booleans) before counting it. **This changes behavior for one existing fill shape**: a slot fill whose array contains only non-rendering values — literally `false` or `null`, e.g. `<Divider>{cond && <text>…</text>}</Divider>` with `cond` false — used to count as label content and force the labeled layout, and now renders the plain divider. A single-node fill (newly expressible under core 0.15) counts as content.

- **The dev dashboard's Devices tab is now the control surface, and its actions are visible** (#833). Reported from real use: `d` "not working", `r` "not working", and `a`/`i` "just open anything, you don't select a device". All three were accurate, and the first two shared a cause.

  **Feedback went where nobody was looking.** `showDevices`, `installAndroid`, `buildLaunchIos` and `reload` all reported through `logger.log` / `printLines`, which in dashboard mode are `createShellLogger` and `shell.say()` — and in fullscreen `say` writes into the log store (the **Build** tab) plus a `printStatic` that only reaches the terminal on exit. Pressing any of those keys on the **Devices** tab therefore painted nothing at all. `d`'s device listing was being produced correctly the whole time; it was one tab over. Actions now report on the tab where the key was pressed.

  **Nothing was selectable.** `showDevices()` looped every Android device *and* every iOS simulator/device and launched on all of them — it was not "show devices", it was "launch on everything". `installAndroid()` built, then launched on every device. `buildLaunchIos()` auto-picked a simulator. None consulted the table cursor that has existed since #824.

  So the table now lists **every detected device** rather than the targets picked at startup, with what each has installed, and `Enter` installs-if-needed and launches on **that** device. `a` and `i` are gone: they were the workaround for not being able to choose, and one key on a row that already knows its platform replaces both. `d` rescans and no longer launches anything.

  **A long install is followable from the row it belongs to**: the device's own Status cell shows a spinner and the current phase (`building` / `installing` / `launching`), and the latest build line sits under the table. Full output still goes to **Build**. The ticker only runs while a row is busy — an idle dashboard left open all afternoon should not repaint at 80ms.

  `reload()` now returns a summary instead of only logging one, so `r` says what it did — including the case it used to hide: with no device streaming logs and nothing installed, the WS reload reaches nobody and the native relaunch has nothing to relaunch, so `r` genuinely does nothing and now says so.

  Physical iOS devices are launched, not built — signing belongs to `sigx run:ios --device`, and the tab says that rather than starting a build that would fail on provisioning halfway through.

  The legacy raw-stdin `r`/`d`/`a`/`i` keys on the `--no-ui` path are untouched.

- **The `sigx dev` dashboard is laid out from the pane the shell gives it, and shows the QR once** (#824). `@sigx/lynx-cli` moves to `@sigx/cli ^0.9.0` and `@sigx/terminal ^0.11.0`, and its plugin manifest declares `"requires": ">=0.9.0"` (was `>=0.4.0`).

  The version floor matters twice over. `@sigx/cli` 0.9.0 pins `@sigx/terminal ^0.11.0` while this package pinned `^0.10.0` — disjoint single-minor ranges, so pnpm resolved **two physical copies** of `@sigx/terminal`, and with them two `@sigx/reactivity` and two `@sigx/runtime-terminal` singletons. A renderer singleton is exactly the wrong thing to have two of: `printStatic` from one copy knows nothing about the live region the other mounted. And `ShellTab.render(pane)` is a *host* capability — the installed `sigx` binary is what calls it, so on a 0.8.x host `render()` receives no argument and every `pane.height` would be a `TypeError` at first paint.

  `requires` does **not** prevent that second case. `@sigx/cli`'s plugin discovery treats the field as advisory: it logs `… requires sigx CLI >=0.9.0 but this project runs 0.8.0 — some commands may misbehave` and then loads the plugin anyway (verified against a real 0.8.0 binary, which registers every command after the warning). So the manifest floor is a diagnostic, and the actual gate is `supportsShellPane(ctx.cliVersion)`: on a host that cannot pass a pane, `sigx dev` prints an actionable warning and falls back to the plain streaming banner — the same fully-working output `--no-ui` produces — rather than crashing. Unknown or unparseable versions count as unsupported, because the cost is asymmetric: a false negative is the plain banner, a false positive is a stack trace.

  With the pane available, `Math.max(8, getTerminalSize().rows - 13)` is gone — a literal that re-counted the shell's own chrome by hand and was wrong the moment the shell changed shape, silently. All arithmetic now lives in `src/dev-ui/layout.ts` and is derived through `boxChrome`, which mirrors the renderer's `drawBox`, so a change to the box primitive moves these numbers instead of invalidating them. One asymmetry is worth knowing, because it is invisible until it shears the screen: `LogView` takes its *outer* width and subtracts its own box internally, while `DataTable` charges the cursor gutter and its box against the terminal only when deriving its **default** width — an explicit `width` goes straight to `layoutTable` and the gutter is still prefixed to every row. Handing `DataTable` the raw pane therefore overflows by exactly one column. `dataTableWidth()` exists to stop that being rediscovered.

  The zoom checks the pane too, rather than assuming the whole tab area is enough just because it is bigger than half of it — on an 80×24 terminal *nothing* fits, so it shows the URL and says how many rows are needed. The measured quiet zone is passed to `<QRCode>`, since rendering the default would silently undo the fit that was just calculated.

  **The Connect tab is deleted.** It rendered an identical `<QRCode>` for the same URL as the Devices tab — same size, no difference. Devices owns the QR now. That forced an honest look at a problem the second tab had been hiding: a real bundle URL is 63 characters, which encodes to QR version 4 — **21 rows by 41 columns** at the default quiet zone, 18×35 at the tightest. A tab pane on an 80×24 terminal is about 14 rows, so the QR does not fit there at any setting. Rather than draw it clipped — which leaves it unscannable while looking fine — the layout is *measured*: side by side with the target table when it fits, otherwise the table takes the full width and `z` (or `/connect`) swaps the pane for a full-size QR, Esc back. Not `pushView`: `runShell` resolves a pushed id against the registered tab list and renders nothing for an id that is not a tab, while every registered tab appears in the tab strip — so a "pushed" QR would either be blank or put the second tab straight back.

  The target list is now a `DataTable` rather than lines of text, and the shell title bar finally shows a version (`createDevShell` accepted the prop; nothing passed it).

  Key arbitration is now documented at the top of `dev-shell.tsx`, because it is the likely future regression: `runShell` registers shortcuts on the `overlay` layer and components register on `control`, so **a shell shortcut always wins**. Adding a single letter there makes it permanently unreachable inside any focused component, silently. `DataTable`'s own `r` (reverse sort) is already unreachable — `r` is reload, which is the right trade — so no table here sets `sortable`, and `f`/`j`/`k` are reserved for the components. Tab-scoped keys are gated on `ShellHandle.activeTab` (new in 0.9.0) rather than tracked locally, since the shell's `1`–`9` move tabs without telling the plugin.

  `sigx dev --no-ui` and non-TTY output are unchanged; the plain banner and the dashboard now share one `QR_SCAN_LABEL` so the two surfaces cannot drift.

  `examples/showcase` follows to `@sigx/cli ^0.9.0`. #823 had just moved it to `^0.8.0` to stop it running a stale host; raising the plugin's floor in the same release would have put it straight back into the fallback path — the showcase's `sigx dev` would have printed the plain banner and no dashboard, which is exactly the drift that issue set out to fix.

### Added

- **Device logs keep their structure, and the dashboard can filter them** (#828). Every device log already reached the CLI as a record — level, platform, client id, timestamp — and `formatDeviceLogLine` flattened it to an ANSI string one line later (`dev-server.ts`). Nothing downstream could filter by anything, and no amount of work on the dashboard could recover it, because the structure was gone before the dashboard saw it.

  A new structured store keeps the records, and the old `Logs` tab splits in two: **Build** keeps the text `LogView` over the dev server's and native toolchain's output, which is genuinely unstructured and right to leave as text, and **Logs** becomes a `DataTable` of your app's `console.*` — time, level, device, namespace, message — with per-level colouring and a cursor.

  One dimension came free. `@sigx/lynx-core`'s default transport emits `[${namespace}]` as the first console argument, so a `createLogger('http')` record is machine-identifiable: namespace is a column and a filter, matching the namespaces `signalx.config.ts` can already silence. Only an *exact* `[…]` first argument counts — `console.log('[warn] hand-rolled')` is one argument, not a namespaced record, and inventing a namespace nobody declared would be worse than showing none.

  Filters are slash commands, and their shape is dictated by the host: `runShell` dispatches on the first token and discards the rest, so a slash command cannot take an argument. Hence one command per level (`/level:warn`, `/level:error`, …, `/level:all`) — the palette filters by prefix, so typing `/level` lists them all with descriptions, which is more discoverable than an argument would have been. Values only known at runtime cycle instead: `/platform` and `/ns` step through what has actually been seen, `/filters` clears everything, `/clear` discards the collected logs, and the `l` key cycles the level floor. **A free-text search is not expressible under this contract** and is left out rather than faked.

  While a filter is active the status bar carries the withheld count, because a filtered view that looks quiet is otherwise indistinguishable from a quiet app. A multi-line message shows a `⏎n` marker and expands with `Enter` into a detail pane (Esc closes) — below 20 rows the detail takes the pane rather than sharing it, since a split leaves the table too short to be worth having.

  Two deliberate routing decisions. Device logs no longer go into the text store at all, so device chatter cannot drown the build log — that separation is half the point of the split. The exception is `error`, which is *also* written to the permanent transcript: in fullscreen that flushes to real scrollback on exit, so a crash trail survives the alt screen and stays greppable. Doing that for every level would dump the whole session into the terminal on quit. `--no-ui`, non-TTY, and `--no-device-logs` are all unchanged.

  Retention is 2 000 records, not the text store's 10 000: each record holds the full message plus derived fields and the filter is a scan, so this is the interactive working set — the full history is still scrollable in **Build**. The filtered view is memoised against a monotonic buffer version rather than the record count, because at the retention limit every push evicts one and appends one — the count is constant while the contents turn over completely, which would have frozen the view exactly when logs were busiest.

### Fixed

- **The showcase example ran the wrong `sigx`** (#823). `examples/showcase` devDepended on `@sigx/cli ^0.4.2` while `@sigx/lynx-cli` — a *plugin* to that CLI, with no `bin` of its own — had moved to `^0.8.0`, so the showcase's `sigx dev` / `sigx build` / `sigx prebuild` ran a four-minor-old host loading a plugin built against the current one. It also dragged `@sigx/reactivity` and `@sigx/runtime-core` **0.4.9** into the workspace (via that CLI's `@sigx/runtime-terminal@0.5.0`), sitting alongside the catalog's 0.14.0 — the two-copies hazard the catalog exists to prevent, ten minors apart. Nothing published was affected: the example is private and dev-only. `verify:catalog` now also reads `pnpm-lock.yaml` and fails when a core package RESOLVES outside the catalog, or at two versions at once — checks 1 and 2 only police what the repo *declares*, and no manifest here mentioned the old line at all.

## [0.23.0] - 2026-07-30

### Changed

- **The whole `@sigx/lynx-*` line now builds against sigx core 0.14** (#819, #820). `@sigx/reactivity` and `@sigx/runtime-core` move from `^0.13.0` to `^0.14.0` across the catalog, and `@sigx/lynx-cli`'s sibling pins follow to the core-0.14-aligned releases — `@sigx/cli` `^0.7.0` → `^0.8.0`, `@sigx/terminal` `^0.9.0` → `^0.10.0`, so the CLI resolves the same single core line as the rest of the graph. This is the release that puts that alignment on npm: `@sigx/lynx-*@0.22.0` shipped before it and still declares `@sigx/reactivity: ^0.13.0`, so an app on 0.22 that also depends on core 0.14 directly resolves two physical copies of the reactivity graph.

### Fixed

- **`@sigx/lynx-navigation` — `<Screen.TabBarItem>`'s render-prop child works on core 0.14** (#820). Core 0.14 invokes a function passed as children as a scoped slot (signalxjs/core#476). `TabBarItem` predates that feature and implemented the render-prop pattern by hand — it called `slots.default?.()` expecting the function back and applied it to `{ active }` itself — so on 0.14 the renderer invoked that function first, with `undefined`, and `({ active }) => …` threw on the destructure before the normalise logic ran. The slot is now declared as what it has always been (`Define.Slot<'default', { active: boolean }>`) and invoked with the context, so the declaration and the runtime agree and `active` is type-checked at the call site instead of cast. The manual normalise is kept: a nested function, or a single-element array holding one, still has to be applied by hand, and plain JSX children pass through with `active` ignored.

## [0.22.0] - 2026-07-28

### Fixed

- **`@sigx/lynx-sheet` — a `{ keyboard: true }` detent no longer double-counts the bottom inset** (#811). `resolveDetents` added the bottom safe-area inset back onto keyboard detents unconditionally, but that add-back is only correct for a sheet whose bottom edge reaches the true screen bottom. A sheet that also passes `bottomOffset` (an ancestor `SafeAreaView` already pads the gesture bar — the showcase composer's case) counted it twice and opened a gesture bar **taller than the keyboard it replaces**: 73 px on a Pixel 9 Pro XL, visible as the composer's input row jumping on every keyboard↔emoji swap. Worse, that inflated detent is also `setReveal`'s `openFloor`, which clamped away the live main-thread capture — so `openToLift`, whose whole purpose is a pixel-stable swap, was a no-op. It now adds back only the part the sheet still has to cover: `max(0, bottomInset - bottomOffset)`. Sheets that don't pass `bottomOffset` are unchanged.
- **`@sigx/lynx-keyboard` — the observed keyboard height is now remembered app-wide and across runs** (#811). The memory keeps the LATEST height, never a running max: a device's keyboard is not one height (the suggestion strip comes and goes, numeric and alpha layouts differ, IMEs differ), and a panel sized to occupy its space must match the keyboard about to appear — the best predictor being the one that appeared last. Keeping a max latched onto the tallest ever observed and opened the panel 36 px too tall from then on. It was tracked per `<BottomSheet>` instance starting from 0, so the first keyboard-sized panel opened on a screen where nothing had been typed yet fell back to `fallbackPx` and then visibly corrected itself when the real keyboard returned — the showcase composer's input row jumped **53 px** on that first emoji→keyboard swap (measured: panel at 64+320 dp, real keyboard 64+344). `rememberedKeyboardLift()` exposes the last lift seen, recorded by any mounted lift hook and persisted via the optional `@sigx/lynx-storage` peer (without it the memory is per-run); `<BottomSheet>` seeds from it. A real observation supersedes a restored one even if shorter, so a different IME or split screen can't strand a panel too tall. Down to **1 px** on the same swap, across a full app restart with no keyboard shown in that run.
- **`@sigx/lynx-sheet` — an already-open sheet now follows a change to its open detent** (#815). `<BottomSheet>` only moved on an `open` *transition*, so changing `openDetentIndex` (or re-resolving `detents` such that that index moves) while the sheet was already open did nothing: it kept the height it opened to and the new content rendered into the old slice. That is the natural shape for a sheet hosting more than one panel — a keyboard-height panel and a taller one, swapped without ever closing — and the only workaround was to close the sheet and reopen it a tick later, throwing the reveal away and flashing. Detent *identity* changes were already live (#743); the open target was the remaining gap. Two guards keep it from fighting the user: nothing happens mid-drag, or once the sheet has been dragged off the position `open` put it at. Unlike every other programmatic move here this one animates — `animate` defaults to `false` so that some *other* motion (a keyboard sliding away) can reveal an already-painted sheet, and a mid-open detent change has no such external motion.
- **`@sigx/lynx-icons-lucide` — icons containing `<line>`, `<polyline>` or `<polygon>` render again**. Lynx's `<svg content=…>` silently drops those primitives, so `hash` painted nothing at all and `smile` lost its eyes; 98 of lucide's 1,956 icons contain at least one. All three convert losslessly to `<path>`, which does paint.

### Added

- **`@sigx/lynx-sheet` — `pinnedBottomRef` and the `rest` event** (#811). The panel is laid out as tall as the top detent and slid down, so its own bottom edge is off-screen at every rest below the top detent — `position: absolute; bottom: 0` pins to a place nobody can see. `pinnedBottomRef` binds an element to the inverse of that slide, so it sits last in flow yet paints flush with the visible bottom edge, on the main thread, every frame of a drag or keyboard lift (WhatsApp's emoji category row). Keeping the body at full panel height is what stops a drag opening a gap under it — which in turn means the body extends below the fold, so `onRest` now reports the sheet's **settled visible height** in px (mount, `open` toggle, drag settle, dismiss) for content that has to size or bound itself to the slice actually on screen. `onSnap` says *which* detent; `onRest` says *how tall*.
- **`@sigx/lynx-emoji` — WhatsApp picker chrome** (#811): `tabPlacement: 'top' | 'bottom'` (default `'top'`) makes the category row the picker's last row; `tabBarRef` hands its wrapper to a sheet's `pinnedBottomRef`; `gridBottomInset` adds a trailing scroll spacer so a grid whose box hangs below the fold can still scroll its last rows into view (before this, the compact emoji panel stranded the tail of the dataset — the flags section stopped ~8 rows early and the last emoji was unreachable). `EMOJI_CATEGORY_ICONS` maps CLDR group keys to monochrome icon names as **plain data**, so the package keeps glyphs as its headless default and takes no icon dependency — render them through the existing `renderCategoryTab` prop, and force-include the names in `signalx.config.ts` (a map lookup is a dynamic icon name the build-time scanner can't see).
- **`@sigx/lynx-emoji` — `<EmojiStrip>`**: a one-row horizontal strip of emoji cells for search hits or recents — the shape WhatsApp shows above the keyboard while you search, and what a reaction bar wants. Plain elements rather than a virtualized `<list>`, so it re-renders per keystroke without the grid's staging machinery; picks push to the shared recents like the picker's. Cells default to the SAME screen-adaptive, text-size-aware size `<EmojiPicker>` resolves, so a strip and a grid on one surface read as one control.
- **`@sigx/lynx-daisyui` — `emojiClassesBottomTabs`**: the emoji skin for `tabPlacement="bottom"` (divider on the bar's top edge, opaque background — a pinned bar paints over the grid rows it overlaps).

### Changed

- **`@sigx/lynx-emoji` — the picker now follows the OS text-size setting** (#811). It was *pinned* against it (#776, "like a keyboard panel"): every glyph's `fontSize` was counter-divided by the scale so cells held one designed size forever. On a phone at 1.15 that read as a stubbornly tiny grid next to labels that had grown — measured on a Pixel 9 Pro XL, 11 columns at 92 px against WhatsApp's 9 at 101 px. `resolveEmojiGeometry` takes a `fontScale` (default 1, so nothing changes for callers that don't pass one) and scales the target cell and both ink clamps, trading columns for size: 9 columns at 112 px at that same 1.15. The counter-divide stays — it is what makes the PAINTED size equal the resolved `cellSize`, which the row/scroll-offset math assumes; the scale now lands in the resolved value instead of being cancelled out. Frozen at mount like `columns`/`cellSize`.
- **`EmojiRenderCategoryTab` gains a 4th `size` argument** — the tab glyph's VISUAL size (the em already multiplied by the platform ink ratio). Icon tabs that fill their box need it: sized off the raw em they come out ~1.6× larger than the glyph tabs they replace on Android, where emoji ink only 64% of it.

- **Showcase "Chat composer" search is a two-stage flow**, because the field's focus can only be observed and never commanded (see the note under Fixed): tapping 🔍 swaps the panel's chrome row for a search field WITHOUT moving the sheet — the emoji grid stays exactly where it is, so there is never a stranded bar hovering over empty space waiting for a keyboard no API can summon. Once the field reports focus and the keyboard actually arrives, the sheet takes WhatsApp's layout: floor shrinks to [input + strip + field] riding the keyboard. The stage is keyed off the KEYBOARD's presence, not the field's focus — on Android the back key hides the IME without blurring the field, so a focus-driven layout stranded the strip.

- **Showcase "Chat composer" now matches the WhatsApp reference** (#811): the emoji panel fills exactly the keyboard rectangle (device-measured: input-row top 1255 px with the keyboard up vs 1254 px with the panel open, was 1255 vs 1182), monochrome icon tabs pinned to the bottom edge through a drag to the full detent, and search behind a 🔍 button that collapses the panel to a one-row result strip above the keyboard instead of putting a focusable field *under* one.

## [0.21.0] - 2026-07-23

### Fixed

- **Corrective release for the out-of-tier-order 0.20.0** (#800, #801). `@sigx/lynx-cli` pinned the **core-0.12-era** sibling releases (`@sigx/cli` `^0.6.0`, `@sigx/terminal` `^0.8.0`) while the catalog was already on `@sigx/reactivity` / `@sigx/runtime-core` `^0.13.0` — so `@sigx/lynx-cli@0.20.0` dragged a second physical copy of core into the build toolchain. 0.20.0 was cut before the core-0.13-aligned `@sigx/cli 0.7.0` and `@sigx/terminal 0.9.0` existed. The pins now move to `@sigx/cli` `^0.7.0` and `@sigx/terminal` `^0.9.0`, so the CLI resolves the same single core 0.13 line as the rest of the graph. No source or public API change. npm versions are immutable, so this ships as a follow-up minor; as part of this release the `@sigx/lynx-*@0.20.0` line will be deprecated on npm, superseded by 0.21.0.

## [0.20.0] - 2026-07-23

### Changed

- **Aligned to sigx core 0.13** (#794). The pnpm catalog pins for `@sigx/reactivity` and `@sigx/runtime-core` move from `^0.12.0` to `^0.13.0`, so every `@sigx/lynx-*` package now resolves the core 0.13 line. No source or public API change — this is the ecosystem's single-minor-core alignment (one physical copy of `@sigx/reactivity` across the graph). Sibling pins are unchanged: `@sigx/cli` `^0.6.0` and `@sigx/terminal` `^0.8.0`.

## [0.19.0] - 2026-07-23

### Changed (breaking)

- **`@sigx/lynx-sheet` — NEW package: the unified bottom sheet** (#774). One engine (`useSheetEngine` + `createSheetPan` + `Backdrop`) now powers every sheet in the framework, and a standalone **`<BottomSheet>`** ships for route-free use — the one-off tray and the WhatsApp-style composer no longer need a navigator. Geometry is declared as **`DetentSpec`s** (`px | { px } | { fraction } | { keyboard: true, fallbackPx? }`) resolved live against screen height, safe-area insets, the remembered keyboard height (the component owns the BG-reactive tracking and bottom-inset add-back apps used to hand-roll), and `topOffset`/`bottomOffset` caps so a fully-open sheet never slides under a header — `bottomOffset` matters whenever an ancestor pads the bottom safe area, since the cap anchors at the sheet's real bottom edge. Modes: persistent floor (composer) or `dismissible` (release projecting below half the floor parks at 0 + emits `dismiss`); optional `backdrop` (dim tracks the drag, inert while parked, `[0, top]` fade for dismissible sheets); `dragMode: 'handle' | 'surface' | 'grabber' | 'none'` with the full 8-step drag↔scroll arbitration in `'surface'` (this component provides the `ScrollDragHost` an inner gestures `<ScrollView>` adopts). Worklet-visible render state (drag gate, dismissible flag, bottom edge) travels a `syncGeom` push — fixing the #758 class where render-side `SharedValue` writes were silent no-ops and `dragEnabled` changes never reached the gesture.
- `@sigx/lynx-navigation` — **`presentation: 'sheet'` rebuilt on the `@sigx/lynx-sheet` engine** (#784): the navigator's sheet SV now carries **reveal px** (was progress 0..1), `SheetDragController` and `internal/sheet-math.ts` are deleted in favor of a ~40-line `SheetDragAdapter`, and `useSheetHeight()` returns the reveal SV directly. **Renamed screen options** (compile-error migration): `snapPoints` (fractions) → `detents` (`DetentSpec[]`, default `[{ fraction: 0.5 }]`), `initialSnapIndex` → `initialDetentIndex`, `dragHandle` → `dragMode`. The **inline `BottomSheet` export is removed** — import it from `@sigx/lynx-sheet` (richer API, same tuned behaviors; the release snap now uses the unified 0.2s projection). Release tween on drag settles is 0.2s (was 0.18s route / 0.15s inline).
- `@sigx/lynx-emoji` — **`SheetPicker` removed** (#788): its role is exactly `<BottomSheet dismissible backdrop>` + `<EmojiPicker>`. `@sigx/lynx-daisyui`'s `EmojiPickerSheet` keeps its one-liner API unchanged, rebuilt on the unified sheet (drag-to-dismiss on a visible grabber pill, live dim, cold-mounted grid preserved); daisyui gains `@sigx/lynx-sheet` as an optional peer.

### Changed

- **Themes and safe-area insets now ride inline CSS custom properties — first-frame-perfect for runtime/backend themes** (#116). Upstream Lynx supports registering custom properties declared in inline `style` behind the `enableCSSInlineVariables` page-config flag (since 3.6; value-change propagation to descendant `var()` uses since 3.9). `@sigx/lynx-plugin` now encodes the flag into every template (kill switch: `pluginSigxLynx({ enableCSSInlineVariables: false })`), `@sigx/lynx-cli`'s native templates move from Lynx 3.8.0 to **3.9.0** (PrimJS now resolves transitively — the engine pins its exact build), and `@sigx/lynx-runtime` exempts `--*` keys from number→px normalization. On this base, `@sigx/lynx-zero`'s `ThemeProvider` declares the full theme (colors, radius/size overrides, `fontScale` text ramp) inline on its host view — **runtime-registered themes (`registerTheme`) paint their exact palette on the very first frame**, instead of a built-in fallback class swapped post-mount — and `SafeAreaProvider` declares `--sat`/`--sar`/`--sab`/`--sal`/`--safe-area-keyboard` the same way (no more `getElementById().setProperty` retry loop). The whole class-generation workaround is gone: `scripts/gen-theme-css.mjs` (daisyui + heroui), the generated `builtins.generated.css`, the registry's `staticCss` flag and `hasStaticCss()`, and `ThemeProvider`'s post-mount `setProperty` swap are all removed. **Breaking:** apps must rebuild their native hosts (`sigx prebuild --clean`) — new bundles on hosts older than Lynx 3.9 paint themes on first frame but won't re-resolve theme *switches* (< 3.9) or won't paint themed surfaces at all (< 3.6).

- `@sigx/lynx-web-host` — **web/native text-color parity**: the host installer now adopts `x-text { color: inherit }` into the `<lynx-view>` shadow root. Upstream `@lynx-js/web-core` styles top-level text `color: initial` (black) while the native engine lets text inherit the ancestor chain's `color` — so on web, dark-theme screens painted their text black-on-dark (surfaced by the showcase catalog in dark mode). Opt out with `installSigxWebHost(view, { textColorInheritance: false })` (#116 follow-up).

### Added

- `@sigx/lynx-richtext` — **`<sigx-richtext>` now works on web.** The rich-text input was a native-only element (UITextView / EditText) with no web counterpart, so on `sigx run:web` / `build:web` it was an inert `HTMLUnknownElement` — `MarkdownEditor` and the WhatsApp/chat composer rendered but their text field couldn't be focused or typed into (#771). A real `contenteditable` custom element now mirrors the native contract on web: the same `RichDoc` model (UTF-16 offsets, mentions as one U+FFFC, blocks on line boundaries), inline formats (bold/italic/strike/code/link) and block types (heading/list/quote/code), `change`/`selection`/`heightchange`/`focus`/`blur` events with an element-local caret rect, auto-height with `min`/`max` clamping, the `setDocument`/`toggleFormat`/`setBlockType`/`applyFormat`/`insertText`/`setSelectionRange`/`insertChip`/`focus`/`blur` commands, and the `localVersion` echo/stale-write rules from `SigxRichTextUI.swift`. It ships as a self-contained, self-registering module (`@sigx/lynx-richtext/web-element`) that `@sigx/lynx-cli` serves to the generated host page automatically when the app depends on the package — no wiring. Text is vertically inset to match the native element's 8/8 internal padding (with `box-sizing: border-box` and `line-height: 1.5`, the same line budget `MarkdownEditor` sizes against), so a single line sits centered in the field instead of hugging the top. Web differences: a collapsed `toggleFormat` is a no-op (select-then-toggle; native's typing-attribute path is native-only), and `confirm-type` is advisory (no on-screen return key). Note: inside a bottom sheet, tapping the mention popup or a send button is still blocked on web by the sheet's pointer capture (#764) — the input itself (focus, type, format, auto-grow, mention anchoring) works.

- **Apps now honor the OS font scale** (#766) — text in sigx-lynx apps was rendering at unscaled CSS px, visibly smaller than every other app on a device with a non-default system text size (iOS pinned `builder.fontScale = 1.0`; Android never set it). The native hosts now seed `LynxViewBuilder.fontScale` from the OS (iOS Dynamic Type via `UIFontMetrics(.body)` — tracks Apple's real non-linear curve including accessibility sizes; Android `Configuration.fontScale`) and push runtime changes in place via `LynxView.updateFontScale()` — the engine relayouts live (no Activity recreation, no bundle reload; the managed manifest adds `android:configChanges="fontScale"`) and scales `font-size`/`line-height` only, leaving layout lengths untouched. A new `FontScalePublisher` in `@sigx/lynx-core` owns the mapping/clamping and seeds `lynx.__globalProps.fontScale = { scale, os }` before first paint; `@sigx/lynx-appearance` adds `useFontScale()` / `useFontScaleMT()` riding the engine's own `onFontScaleChanged` event. App policy via `signalx.config.ts` `fontScale: { follow, min, max }` (default `{ true, 0.5, 2.0 }` — 2.0 is Android's slider ceiling; raise `max` for text-heavy apps, `follow: false` restores the old pinned behavior). `@sigx/lynx-zero`'s ThemeProvider `fontScale` stays an independent in-app multiplier — the engine already scales its px ramp, so the two compose multiplicatively (don't seed one from the other). Module manifests may now declare `publisherClass` as an **array** (`@sigx/lynx-cli`); existing projects pick everything up on the next `sigx prebuild`. Web builds are unaffected (`@lynx-js/web-core` has no font-scale concept — tracked separately).

- `@sigx/lynx-daisyui` — plain-prop change callbacks for the two model-only form controls: `Select` gains `onChange(value)` and `Radio.Item` gains `onSelect(value)`. Both are plain function props rather than `emit` events, which is what makes them work at all — these components take a prop named `value`, and that shadows `@sigx/runtime-core`'s emit handler lookup so events never fire (#323). For controlled, non-`model` usage; `model` remains the canonical path and is written *before* the callback runs, so a callback reading the bound signal sees the committed value and the two compose. `Radio.Item` never fires while `disabled` (#336).

- `@sigx/lynx-datetime-picker` — **`formatDate(date, pattern)`**, a locale-free token formatter for displaying a picked date. The Lynx runtime ships no `Intl`, so every consumer was hand-rolling the same `pad()` + template literal (the showcase demo included); `formatDate(r.value, 'YYYY-MM-DD HH:mm')` replaces it. Tokens `YYYY`/`YY`, `MM`/`M`, `DD`/`D`, `HH`/`H`, `hh`/`h`, `mm`/`m`, `ss`/`s`, `A`/`a` in local time, `[bracketed]` literals pass through unsubstituted, and a missing or Invalid `Date` returns `''` so a cancelled result needs no null check. No month/weekday names — those need locale data the runtime doesn't have (#255).

### Fixed

- `@sigx/lynx-runtime-main` / `@sigx/lynx-web-host` — **interactive elements inside a bottom sheet now work on web** (#764). The web gesture recognizer captured the pointer on every `pointerdown`; since `pointerdown` bubbles child → ancestor, a sheet's full-surface drag captured last and retargeted the whole `pointermove`/`pointerup`/`click` sequence to itself — so a button or a suggestion-popup row *inside* the sheet never saw its own terminal event, its tap never resolved, and (for a `Pressable`) its pressed visual stranded. The composer's **send button** and **mention-popup selection** were both dead on web. Capture is now taken **lazily** — only once a drag/pinch actually commits (`Pan` onStart, pinch/rotation pair formation), never on `pointerdown` — so a not-yet-moved press leaves the descendant under the pointer to resolve its own tap, matching the native arena where an ancestor pan only wins after crossing threshold (sheet drag, draggable, swiper all verified unaffected). Alongside it, `@sigx/lynx-web-host` now honors **`ignore-focus`** on web: a capture-phase `mousedown` `preventDefault` on a non-focusable `[ignore-focus]` element keeps a tap from blurring a focused editor (so the mention trigger session survives the tap); a focusable descendant — the editor lives inside the composer's `ignore-focus` row — is left alone. Opt out with `installSigxWebHost(view, { ignoreFocus: false })`. (Touch focus management is a follow-up; the mousedown path covers mouse/desktop.)
- `@sigx/lynx-icons` / `@sigx/lynx-emoji` — **icons and the emoji picker are now consistent under the OS font scale** (#776). Font-mode `<Icon>` glyphs (FontAwesome's default) were scaled by the engine while their box stayed fixed — clipping at 1.3×+ — and SVG-mode icons didn't scale at all; the emoji picker's glyphs scaled while its pinned row geometry didn't (clipping + scroll-offset drift). Now: **icons hold their designed dp size by default** on every backend (font-mode glyphs counter-divide by the effective scale so the engine's multiply lands back on `size`), and a new **`scaleWithText`** prop on `<Icon>` (forwarded by `LucideIcon`/`Fa*Icon`) opts an icon into growing with the text — glyph and box together, live. The emoji picker is pinned end-to-end like a keyboard panel (grid cells, section labels, category tabs, tone popover; the est==actual geometry contract holds by construction — the vnode cache keys on the scale so live setting changes re-pin). Emoji inside message text are ordinary text and keep scaling with it.

- `@sigx/lynx-richtext` / `@sigx/lynx-markdown` — **the editor's text rendered ~2.25× the requested size on Android** (#770), a regression from the Lynx 3.8 → 3.9 native bump (#757): CSS-named custom-element props now ride the engine's style pipeline, which delivers `font-size` in physical px on the mount pass but the raw number on updates (both probed on device) — `COMPLEX_UNIT_DIP` then re-multiplied the mount value by density. No single native unit interpretation can satisfy both paths, so the element attribute is renamed to the non-CSS **`editor-font-size`**, which bypasses the style pipeline and arrives verbatim (dp) on mount and update alike; `RichTextInput`'s JS `fontSize` prop is unchanged. `min-height`/`max-height` arrive as layout dp consistently and were already correct; iOS was unaffected (pt) and gets the same rename for parity. On top of the unit fix, **`MarkdownEditor` now follows the OS font scale** (#766 never reached custom native text elements): `fontSize` is multiplied by the effective scale at the point the auto-grow window derives from it, so text and the 1→N-line box scale together, live. The reactive read moved to its natural home — `useFontScale()` / `useFontScaleMT()` / `readGlobalFontScale()` now live in `@sigx/lynx-core` (which owns the FontScalePublisher), are re-exported by the `@sigx/lynx` umbrella and `@sigx/lynx-appearance` (same import paths as before, no provider needed), and `AppearanceProvider` no longer carries a font-scale signal.

- `@sigx/lynx-runtime-main` — **every `Pressable`-based control was inert on web**: taps fired `longPress` instead of `press`, so nothing bound to `onPress` ever ran. `<Pressable longPressDuration={0}>` disables long-press by pushing the recognizer's `minDuration` to `Number.MAX_SAFE_INTEGER` — a delay no timer should ever reach. That's true of a native timer, but `setTimeout` coerces its delay to a signed 32-bit int, so on web it wrapped to ≤ 0 and LongPress fired on the tick *after* touch-down. The fired long-press then both disqualified the tap (`isTap` requires no long-press fired) and short-circuited `LongPress.onEnd`'s press fallback, leaving no path to `press` at all. The web recognizer now refuses to arm a timer it can't represent — a duration past the 32-bit ceiling means "never fires", as intended. `longPressDuration={0}` is what essentially every daisyui/heroui control passes (`Button`, `Checkbox`, `Toggle`, `Radio`, `Select`, `Rating`, `Collapse`, `Tabs`, `NavTabBar`) including **`NavHeader`'s back button** — so on web the whole component layer, and going back, silently did nothing (#763).

- `@sigx/lynx-web-host` / `@sigx/lynx-cli` — **navigation geometry on web now matches the `<lynx-view>`, not the monitor.** Upstream `@lynx-js/web-core` fills `SystemInfo.pixelWidth/pixelHeight` from `screen.availWidth/availHeight × devicePixelRatio` — the physical display — but everything downstream reads those as "the screen the app occupies": `@sigx/lynx-navigation` slides cards in from `SCREEN_WIDTH` px away and rests sheets at a fraction of `SCREEN_HEIGHT`, `@sigx/lynx-gestures`' Swiper falls back to it for page width, and `Platform.isPad` derives from it. In a 500×813 view on a 1710×1008 display, a sheet declaring `snapPoints: [0.4, 0.9]` settled at `translateY(604.8)` instead of `487.8` — 117px too low, and entirely below the fold on a shorter window, which is what "the sheet never appears" was. Both the generated host page (`sigx run:web` / `build:web`, via an inline `browser-config` attribute set during parsing, before the engine upgrades the element) and `installSigxWebHost` now describe the element's own box. New export `viewportBrowserConfig(view)` for hand-written host pages; opt out with `installSigxWebHost(view, { viewport: false })`. Resizes aren't tracked — web-core freezes `SystemInfo` when the view is constructed (#759).

- `@sigx/lynx-navigation` — a push/pop transition now **asserts its end state** instead of assuming the tween finished on time. The completion callback waits a BG-side wall clock, not the tween's real completion, and then clears the transition — which flips `props.animation` to `null` and unregisters the layer's main-thread binding, after which nothing ever writes the resting value. A tween that was starved, late, or never ticked therefore froze its layer at whatever transform it had reached, permanently: a `presentation: 'modal'` screen resting 44–77pt low on iOS, or a popped-to screen stranded off-screen left, which reads as "the back button does nothing". The navigator now cancels the animation and lands the target value on the main thread before the binding goes away — idempotent, so a tween that did finish writes the value it already holds (#758, shipped in #760).

- `@sigx/lynx-navigation` — the #651 pre-stage settle window is **bounded for real**. `PRE_STAGE_MAX_MS` gated only the loop condition; `await waitForFlush()` itself was unbounded, and that promise settles only when the host invokes the `callLepusMethod` callback for the batch. One dropped ack left `pendingOps()` true forever and the await never resumed — so the transition never started (the incoming screen stayed parked at its pre-stage transform) *and* the transition signal was never cleared, which made `isTransitioning()` reject every subsequent push and pop for the rest of the session. Each wait now races the remaining budget, so a lost ack costs the pre-stage, not the navigator (#759).

- `@sigx/lynx-cli` — `sigx prebuild`'s fast path now hashes the CLI's own `templates/` tree (fingerprint format `v8`). It hashed project inputs plus `cliVersion`, which covers a published CLI but not a workspace one: editing a managed template (`ContentView.swift`, `MainActivity.kt`, `SigxProductionResources.*`, …) left the fingerprint unchanged, so `refresh{Ios,Android}ManagedFiles` never ran and the previous run's stale template was what landed in the built app — silently, with the only workaround being to delete `node_modules/.cache/@sigx/lynx-cli/prebuild-inputs.hash` by hand. Contributor dev-loop only; it's a fixed ~40-file tree, so the hashing cost is noise next to a prebuild (#614).

- `@sigx/lynx-dev-client` — the Android resource fetchers' `request == null` guards are live again. `fetchResource` / `fetchTemplate` / `fetchSSRData` declared their `LynxResourceRequest` parameter non-null, so Kotlin's `checkNotNullParameter` intrinsic threw an NPE at function entry before the guard could return a structured failure — the checks read as handled but were dead code (`Condition is always 'false'` at compile time). The parameter is now nullable, matching the production fetchers in `SigxProductionResources.kt` (#613).

- `@sigx/lynx-cli` / `@sigx/lynx-notifications` — linking `@sigx/lynx-notifications` no longer breaks the Android build when Firebase isn't configured. The module contributed the `com.google.gms.google-services` Gradle plugin unconditionally, and that plugin hard-requires `google-services.json` at build time, so a fresh clone (or CI, or any contributor who had never built before) died on `Execution failed for task ':app:processDebugGoogleServices'` — while `copyGoogleServicesFile` merely *warned* that remote push wouldn't initialize. A module's Gradle-plugin entry can now declare `"requires": "android.googleServicesFile"`, and prebuild applies the plugin only when that config resolves to a real file, logging when it's skipped; the notifications manifest opts in. Local notifications need no Firebase at all, and remote push degrades exactly as the warning always claimed. An unknown `requires` value is rejected loudly rather than silently dropping the plugin (#618).

## [0.18.1] - 2026-07-21

### Fixed

- `@sigx/lynx-navigation` — **push/pop transitions no longer stutter into heavy screens** (#651): animated transitions now *pre-stage* the incoming work. A push commits its render immediately but parks the incoming layer off-screen (the transition SV is seeded 0 in-stream, in the same MT batch as the mount and binding registrations, so no stale-SV flash) and holds the `withTiming` start until the BG→MT pipeline goes quiet — the screen's mount batch, post-mount effect flushes, native layout, and `<list>` initial cell pulls all complete while the outgoing screen is still presented, then the slide animates a fully-built tree. Cards/modals park with a ~2px sliver on-screen (`PRE_STAGE_PEEK`) rather than exactly off-screen — a fully off-screen layer's texture is culled and never rasterized, which put the whole screen's raster cost on the first animation frame (one ~36ms frame at motion onset on the 2000-row snapshot-list bench); the sliver forces the raster into the settle window, flattening the entire slide to vsync cadence. Pops get the same settle window for the underneath layer's `display: none → flex` reveal relayout. The wait is bounded (`PRE_STAGE_MAX_MS`, 160 ms), so screens that never go quiet (pollers, streaming data) still transition promptly with a best-effort pre-stage; a `reset()` during the window is guarded like the existing sheet-push deferral. `@sigx/lynx-runtime` adds the quiescence probe this rides on: `pendingOps()` — true while ops are buffered, scheduled, or sent-but-unacked; false once the MT has applied everything (pairs with `waitForFlush()`).

- `@sigx/lynx-navigation` — `<BottomSheet>` now tracks `detents` / `maxHeight` **after mount**. They were snapshotted at setup and baked into main-thread state (the `reveal` seed, both derived-value offsets, and the `minReveal`/`maxReveal`/`detents` lexicals captured by the pan worklets), so later updates did nothing — silently. That broke the component's headline use case: a composer accessory's collapsed floor is inherently variable (an attachment chip row appears above the input, the input grows from one line to several, banners come and go), and since the sheet reveals the top `reveal` px of top-aligned content, a floor that couldn't grow pushed the input row and send button out of the revealed slice and behind the keyboard. Geometry is now read live, the two derived offsets use `useDerivedValueReactive` (the derived SV identity is stable, so `onReveal` consumers stay bound), worklet geometry is pushed through a main-thread ref so the drag clamp and release-snap candidates stay current, a parked sheet follows its floor, and geometry that shrinks pulls the held `reveal` and any captured `openToLift` rest back into range (#743).

## [0.18.0] - 2026-07-21

### Added

- `@sigx/lynx-core` — **app foreground/background state** (#607): `AppState.current` / `AppState.available` / `AppState.subscribe(cb)`, plus a reactive `useAppState()` (`Computed<AppStateStatus>`). For reconnecting a socket the instant the app resumes, refreshing data that went stale while backgrounded, or pausing timers/media. Hosted in core as an ambient lifecycle primitive alongside `Platform`/`DeviceInfo` (not a standalone package): Android reuses core's existing `SigxActivityHook` (`onResume`/`onPause`) to drive an `AppStateBus` — no second activity hook; iOS adds an `AppStatePublisher` (`didBecomeActive`/`didEnterBackground`) and a `getAppState` seed on the `SigxCore` module. Driven by a single signal, so imperative subscribers and reactive consumers share the reactivity system's `watch` + `Object.is` dedup rather than a hand-rolled listener set. Core gains its first dependency, `@sigx/reactivity` (a zero-dependency leaf, so no cycle) (#609).

### Fixed

- `@sigx/lynx-list` — chat mode (`inverted` + `stickToBottom`) can no longer stay stuck at `opacity: 0`: a bounded safety-net reveals the thread even when a mount-time layout race prevents the first `layoutcomplete` from landing (the `layoutcomplete` path still wins in the common case, so there's no flash). Surfaced by the showcase WhatsApp emoji composer demo, whose layout was also fixed — chat fill / no modal bleed-through, input at the correct safe-area position, and the warm emoji picker no longer peeking below the input while collapsed (#741).

## [0.17.0] - 2026-07-19

### Changed

- `@sigx/lynx-cli` — adopt the core-0.12 line of the sigx CLI toolchain: `@sigx/cli` `^0.5.0` → `^0.6.0` and `@sigx/terminal` `^0.6.1` → `^0.8.0`. `@sigx/terminal@0.8.0` now declares its `@sigx/reactivity`/`@sigx/runtime-core` deps at `^0.12.0`, so the transitively-pulled terminal family resolves against this repo's single 0.12.0 core copy natively — the CLI-only build stray (an old `@sigx/reactivity@0.4.9` reaching in via `@sigx/cli@0.5.0` → `@sigx/terminal@0.5.0`) is gone from the runtime path. With that, the `peerDependencyRules.allowedVersions` override in `pnpm-workspace.yaml` (widened to `>=0.12.0 <0.13.0` for the `@sigx/terminal*`/`@sigx/runtime-terminal` families in #720 as a workaround for terminal 0.6.1 not declaring a 0.12 core peer) is no longer needed and is removed; strict installs stay clean with no unmet-peer warnings for the terminal family. Dep bump + override cleanup only — no lynx source change (#727).

## [0.16.0] - 2026-07-18

### Added

- `@sigx/lynx-notifications` — **local** notifications work on web (#718 Tier 2): `schedule`/`cancel`/`cancelAll` via the `@sigx/lynx-web-host` bridge to the browser Notification API (delay + repeat as page-lifetime timers; cancel closes shown entries), permission methods with browser-denial → `blocked`, badges via the Badging API best-effort with a locally-tracked count. Remote push degrades cleanly: `registerForPushNotifications()` resolves `{ error }`, listeners never fire, `getInitialNotification()` resolves `null` (#723).

- `@sigx/lynx-location` works on web (first Tier-2 shim, #718): `getCurrentPosition` routes through the `@sigx/lynx-web-host` bridge to `navigator.geolocation` (`accuracy: 'high'` → `enableHighAccuracy`, `timeout` passthrough, coords mapped with null-normalized altitude/speed/heading); permission methods map the Permissions API (browser denial → `blocked`/`canAskAgain: false`; `requestPermission` surfaces the prompt via a position request). Requires a secure context (#721).

- Root README documents the web story: the gesture system (all six recognizers + Race/Simultaneous/Exclusive composition, same-element arena semantics), animations, navigation, appearance, deep links and 9+ shimmed native modules in the browser, with `sigx run:web` (zero config) and `sigx build:web` (static export). A hosted public demo was deliberately deferred — a GitHub Pages project site for this repo would shadow the docs site's `sigx.dev/lynx/` path (#716).

- `@sigx/lynx-cli` — **`sigx build:web`**: deployable static export of the web app to `dist/web/` (host page, `@lynx-js/web-core` engine, app bundle + async chunks, `@sigx/lynx-web-host` bridge, plus `_headers`/`vercel.json` COOP/COEP samples). Flags: `--out`, `--base` (subpath hosting), `--coi` (vendored cross-origin-isolation service worker for header-less hosts like GitHub Pages — one automatic first-visit reload). The one-shot build waits for the rspeedy child to exit before assembling, so a stale bundle can never be exported mid-clean; `hostHtml` is now shared between `run:web` and the export (reload/base/coi options) (#714).

- `@sigx/lynx-runtime-main` — the page root gets the native-equivalent layout context on web: `renderPage`/`sigxHotReload` set `display: flex; flex-direction: column` directly on the page DOM node (web-core maps `flex-direction` through `__SetInlineStyles` onto a custom property only `x-*` elements consume, so the real property is written instead — browser-verified). Fixes `flex: 1` app roots collapsing to 0-height on web; `__WEB__`-gated, native bundles unchanged (#709).

- Web implementations for six more native modules on the #703 host bridge (web bundle swaps them in via #697; native unchanged): **`@sigx/lynx-clipboard`** (`navigator.clipboard`; read denial → `''`/`false`), **`@sigx/lynx-linking`** (`openURL`/`canOpenURL` via `window.open` + scheme allowlist; inbound `getInitialURL`/`addEventListener` work unchanged through the host publisher — inbound logic extracted to a shared `inbound.ts` used by both platforms), **`@sigx/lynx-share`** (`navigator.share`; call from a tap handler so the user gesture survives the RPC), **`@sigx/lynx-image-picker`** + **`@sigx/lynx-file-picker`** (browser file dialog → `blob:` URLs with metadata and image dimensions; permissions resolve granted), and **`@sigx/lynx-haptics`** (best-effort `navigator.vibrate` patterns — still never-throw, `isAvailable()` stays `false` as a degraded approximation). Each README gains a "Web" section (#706).

- **New package `@sigx/lynx-web-host`** — the host-page side of SignalX web support: handles the worker's `sigx.*` RPC calls (clipboard, linking open/canOpen, share, file picker with image dimensions, vibrate) against real browser APIs, and publishes page state into the card — `globalProps.appearance` + live `appearanceChanged` events from `prefers-color-scheme` (so `@sigx/lynx-appearance` works on web with **no** shim) and `globalProps.initialURL` + `urlReceived` on popstate/hashchange (consumed by `@sigx/lynx-linking` unchanged). `dist/host.js` is a self-contained ESM file; `sigx run:web` serves and installs it automatically. `@sigx/lynx-core` gains the worker-side caller: `webHostCall<T>(name, data)` (protocol `sigx.<module>.<method>`, `{ok, value}|{ok:false, error}` responses) + `isWebHostAvailable()` — the primitive the upcoming host-bridge `.web.ts` shims build on (#703).

- Web implementations for three native modules (first Tier-1 shims on the #697 `.web.ts` mechanism — the web bundle swaps them in automatically; native bundles are unchanged): **`@sigx/lynx-storage`** is backed by IndexedDB with a write-through in-memory mirror preserving the sync-void `setItem`/`removeItem`/`clear` shape (read-after-write consistent; writes flush in call order); **`@sigx/lynx-websocket`** re-exports the Worker-global WHATWG `WebSocket` (the native base64/demux bridge tree-shakes out of the web bundle); **`@sigx/lynx-network`** reports `navigator.onLine` + `navigator.connection.type`. Each package README gains a "Web" section (#701).

- `@sigx/lynx-plugin` + `@sigx/lynx-cli` — `sigx run:web` no longer requires an `environments` block in `lynx.config.ts`: the CLI sets `SIGX_WEB_ENV=1` for the rspeedy child and the plugin auto-provides `environments.lynx` + `environments.web`, merging only missing keys (user-declared environments and their contents are never touched). Plain `sigx dev` / `sigx build` / direct `rspeedy build` are unchanged — no env var, no injection. Opt out with the new `pluginSigxLynx({ web: false })` option (#699).

- `@sigx/lynx-plugin` — on the web environment, `resolve.extensionAlias` now maps `.js → ['.web.js', …]` (and `.jsx` likewise), merged ahead of rsbuild's tsconfig-driven aliases. This makes per-package `*.web.ts` files work for **published dists** too: a package can ship `storage.ts` (native bridge) + `storage.web.ts` (browser implementation) and the web bundle picks the `.web` variant even through the dist's explicit `./storage.js` imports, while the native bundle tree-shakes it out entirely. Foundation for the native-module web shims (#697).

- `@sigx/lynx-runtime-main` — arena relations work on web: `waitFor` and `simultaneous` (what `Gesture.Race`/`Exclusive`/`Simultaneous` compile to) now gate gesture activation in the web recognizer. Per press each gesture is possible → active | failed; only `onStart` is gated (`onBegin`/`onEnd` always fire, so `Pressable`'s LongPress.onEnd visual reset keeps working); activating a gesture fails related non-simultaneous rivals; `Race`'s mutual waitFor resolves as first-ready-wins; a Fling not recognized within ~300ms fails, letting `Exclusive(Fling, Pan)` hand over to the pan mid-drag. Unrelated gestures keep co-firing exactly as before (no relations → no behavior change). `continueWith` has no consumers and is logged-and-ignored (#695).

### Changed

- `@sigx/lynx`, `@sigx/lynx-runtime`, `@sigx/lynx-runtime-main`, `@sigx/lynx-appearance`, `@sigx/lynx-safe-area`, `@sigx/lynx-testing` — adopt **sigx core 0.12.0**: the `catalog:` pin for `@sigx/reactivity` and `@sigx/runtime-core` moves `^0.10.0` → `^0.12.0` (a one-line bump in `pnpm-workspace.yaml`; every package already consumes core via `catalog:`). No lynx source change: the 0.10 namespace-agnostic-runtime-core rework only adds *optional* `RendererOptions` host ops (`getElementNamespace`/`getChildNamespace`/`getContainerNamespace`) — lynx's dual-thread renderer has no element namespaces and doesn't implement them — and the 0.11 `isSVG`→`ns` renderer-hook rename is positional, which lynx's `createElement`/`patchProp` ignore; 0.11/0.12 are otherwise additive (coded prod errors, `@sigx/server`, the vite adapter — none consumed here). Build, typecheck and the full test suite pass against 0.12.0. Published manifests rewrite `catalog:` to `^0.12.0` at pack time, as before (#720).
- The `peerDependencyRules.allowedVersions` override for the CLI-only `@sigx/terminal*` family (pulled in transitively by `@sigx/lynx-cli`) widens `>=0.10.0 <0.11.0` → `>=0.12.0 <0.13.0`. No 0.12-compatible `@sigx/terminal` exists yet — its latest `0.7.0` moved core from peer- to regular-dependencies pinned at 0.10.x, which would install a second physical `@sigx/reactivity` copy — so we stay on the peer-based `@sigx/terminal@^0.6.1` and keep it resolving against this repo's single 0.12.x copy (#720).
- `@sigx/lynx-runtime-main` — web gesture `touch-action` is now derived axis-aware from ALL gestures on the element instead of blanket `none`: Pan `axis:'x'` (Swipeable, Range) → `pan-y` so vertical page scrolling keeps working through horizontal swipe surfaces (a browser-claimed vertical swipe `pointercancel`s the press — graceful handoff); Pan `axis:'y'` (sheet drag) → `pan-x`; free Pan/directionless Fling/Pinch/Rotation → `none` as before; horizontal Fling → `pan-y`, vertical → `pan-x`; conflicting wants collapse to `none`; Tap/LongPress-only elements stay untouched. Recomputed on every gesture register/unregister with the original value restored when nothing needs an override (#693).

### Added

- `@sigx/lynx-runtime-main` — `Gesture.Pinch()` and `Gesture.Rotation()` are recognized on web (two-finger): the first two concurrent pointers pair up — `onStart` when the second lands, `onUpdate` on either's move, one dedicated `onEnd` with final values when either lifts. Payloads follow the legacy `usePinch`/`useRotation` semantics: pinch `params.scale` = currentDistance/baseDistance; rotation `params.rotation` = cumulative signed radians (properly unwrapped across ±π, unlike the hooks) plus `params.velocity` (rad/ms); both carry `focalX/focalY` (page-coordinate midpoint, mirrored into pageX/pageY). Pinch/Rotation elements get `touch-action: none` so the browser doesn't claim two-finger contact for page zoom. Since the native arena handlers are unfinished (#418), this payload is the contract native should converge on. The showcase PinchRotateDemo gains an arena-driven pad next to the legacy-hook pad (#690).

- `@sigx/lynx-runtime-main` — `Gesture.Fling()` is recognized on web: at the primary pointer's release, velocity over a trailing ~100ms sample window is matched against the gesture's `direction` and `minVelocity` (px/ms, default 0.3 ≈ 300 px/s); a match fires `onStart` with `params.velocityX/velocityY` before the universal `onEnd`. Fling elements get a `touch-action` override like Pan so the browser doesn't claim the swipe (axis-aware since #693 — see the Changed entry above). The `FlingBuilder.minVelocity` JSDoc now documents the px/ms unit (#687).

### Fixed

- `@sigx/lynx-runtime-main` — web gesture recognizer now tracks pointers per `pointerId` instead of one flat press state, so a second finger no longer clobbers an active press: the press stays driven by the primary pointer, a secondary contact disqualifies Tap and cancels pending LongPress timers (matching native recognizers failing on a second touch), and a secondary lift no longer ends the press. Foundation for two-finger Pinch/Rotation on web (#685).

## [0.15.0] - 2026-07-16

Conversation-grade notifications (stacking + remote dismissal) and the WhatsApp-class emoji picker (sectioned, instant-mount, screen-adaptive).

### Added

- `@sigx/lynx-emoji` — WhatsApp-style sectioned picker: ONE continuous scroll over every category with sticky full-span section headers. Tab tap scrolls (a main-thread worklet drives `scrollToPosition` — the mounted row set never changes); the active tab follows the scroll via exact per-section offset math; recents are the first section, snapshotted per mount (empty recents hide the tab). New `recentsLabel` prop and `classes.sectionHeader` theming; `SectionHeader` poolable template; `EmojiCell` gains an `itemKey` override. Search keeps the flat filtered grid (#663).
- `@sigx/lynx-list` — `sticky`/`stickyOffset` props pass through to the native `<list>`; `SCROLL_METHOD` exported; JSX gains `sticky` on `<list>` and boolean `sticky-top`/`sticky-bottom` on `<list-item>` (#663).
- `@sigx/lynx-emoji` — new public surface from the instant-mount work: `EmojiGridScrollHandle`/`scrollHandle` (staged-aware scroll-to-section), `createStagingDriver` (budget-adaptive cooperative staging, reusable for warm pre-staging), context `ready` signal, stores' `loaded` (#667).
- `@sigx/lynx-notifications` — Android conversation-style stacking for data-only pushes. Sending `data.style: "messaging"` renders the tray entry with `MessagingStyle` and **accumulates**: each push under the same `data.notification_id` appends a line (sender + message, last 7 kept) instead of replacing the body, so earlier messages stay visible — WhatsApp-style chat notifications. New optional keys: `data.sender_name`/`senderName` (line attribution, falls back to `title`), `data.conversation_title`/`conversationTitle` (header, carried over when omitted), and `data.group` (bundles conversations under one expandable tray group with an auto-posted summary; `cancel(group)` dismisses the summary). History lives in the tray itself (extracted from the active notification on each post), so it survives process death without storage. Plain pushes keep today's replace-in-place; below API 23 stacking falls back to replace-in-place. Tap contract unchanged: payload = latest push's `data`. iOS is untouched — `aps.thread-id` already stacks natively. Re-run `sigx prebuild` to pick up the native change (#660).

### Changed

- `@sigx/lynx-notifications` — `cancel(id)` now dismisses delivered **remote** pushes whose `data.notification_id` matches the id, on both platforms. This was previously incidental on Android (same `hashCode` keying, now a documented contract) and impossible on iOS (delivered remote entries carry a system-assigned request identifier; `cancel` now also matches on the payload id). Gives apps a cross-platform "clear this notification from JS" — e.g. dismissing a conversation's tray entry when it's read on another device. Also fixed on iOS: notification tap responses now report the payload's `notification_id` (falling back to the request identifier for local schedules) instead of the system-assigned identifier, so the tap contract from #619 holds for remote pushes. `cancel()`/`cancelAll()` are now typed `Promise<boolean>` (what the native side always resolved) instead of `Promise<void>`, and `cancel()` resolves `false` for a null/empty id (previously Android hashed `''` and cancelled notification id 0). Re-run `sigx prebuild` to pick up the native changes (#659).
- `@sigx/lynx-emoji` — picker mount is instant and cooperative: tap→first-paint drops ~4.3s → ~0.8–0.9s (emulator) and no thread blocks past ~a frame while ~1,900 rows stage. Sectioned rows render via plain-row templates instead of per-row component instances; the grid mounts once, gated on stores hydrated + region measured (also fixes cold-start recents rendering empty); the remainder stages in ~14ms budget slices; a far tab tap mid-staging parks and lands without a second tap (#667).
- `@sigx/lynx-emoji` — screen-adaptive glyph sizing: the default `cellSize` derives from the measured grid width (`width / columns × 0.78`, clamped 28–44) instead of a fixed 32px, so the picker no longer renders undersized on dense/large screens. Explicit `cellSize` still wins; the skin-tone popover follows the resolved size (new optional `size` prop); tab glyphs and header labels bumped to match; search results share the resolved size (#670).

### Fixed

- `scripts/build-snapshot-dist.mjs` (templated package dists, e.g. `@sigx/lynx-emoji`) — `runOnMainThread` and MT event worklets inside a packaged dist were structurally dead: the dist emitter stripped `'main thread'` bodies into placeholders but never emitted their registrations, so the MT registry lookup returned undefined (`cannot read property 'bind' of undefined`). The emitter now appends guarded `registerWorkletInternal` registrations for every worklet id a dist references, with a build-failing completeness invariant (#665).

## [0.14.0] - 2026-07-16

### Changed (breaking)

- `@sigx/lynx`, `@sigx/lynx-runtime`, `@sigx/lynx-appearance`, `@sigx/lynx-safe-area`, `@sigx/lynx-testing` — adopt **sigx core 0.10.0**: `@sigx/reactivity` and `@sigx/runtime-core` bumped `^0.7.0` → `^0.10.0`, skipping three minors. This is how core's renderer work reaches Lynx: `@sigx/lynx-runtime`'s renderer *is* runtime-core's `createRenderer`, and core 0.8.0 was a heavy perf release for exactly that code — an LIS-based keyed diff, a single-child reconciliation fast path, fewer per-vnode allocations in `jsx()`, plus reactivity proxy-trap and dependency-link reuse. `@sigx/reactivity` has no public API change across 0.7.0 → 0.10.0 (pure perf); `@sigx/runtime-core` drops four exports, which the `@sigx/lynx` umbrella re-exports and therefore no longer provides (#647):
  - **`Suspense` → `Defer`.** Core 0.9.0's value-first async rework retires `Suspense` in favour of `<Defer fallback>`, whose fallback covers lazy *chunk* loading. Apps wrapping a `lazy()` route or component in `<Suspense>` should rename it to `<Defer>`; the props are the same shape. `lazy()` / `isLazyComponent()` are unchanged.
  - **`ErrorBoundary` → `errorScope`.** Replaced by the `errorScope` seam from the same rework.
  - **`useAsync` → `useData` / `useAction`.** Superseded by the value-first pair, read through `match`.
  - **`SuspenseProps` → `DeferProps`.**
- `@sigx/lynx-navigation` — lazy routes now mount their `fallback` inside a `<Defer>` boundary instead of `<Suspense>` (#647). No API change: `RouteDefinition.fallback` keeps its shape and meaning, and eager routes are unaffected. Callers placing their own boundary above `<NavigationRoot>` (the documented alternative to a per-route `fallback`) must rename it to `<Defer>`.

### Fixed

- `@sigx/lynx-runtime` — `useData` / `useAction` now run on Lynx. Core gates its async fetchers on `isLiveClient()`, whose fallback is `typeof window !== 'undefined'` — false on the Lynx BG thread — so without an explicit declaration core treated every Lynx app as a *server render* and never ran a fetcher: the cell sat at `pending` forever, silently. The runtime now calls core's `declareLiveClient()` on import (the seam core added for exactly this, naming Lynx as a target), before any component setup can read a cell. Verified on device: a `useData` read goes from `pending` (hung) to `ready` with the fetched value (#647).

### Changed

- The sigx core versions are now declared once, as a pnpm **`catalog:`** in `pnpm-workspace.yaml`, instead of an `^x.y.z` range hand-copied into each package. Future core bumps are a one-line change rather than a ten-range sweep across eight manifests, which is what let `examples/showcase` drift onto a stale `@sigx/cli` unnoticed. Published manifests are unaffected — `pnpm publish` rewrites `catalog:` to the concrete range exactly as it already does for `workspace:^` (#647).

## [0.13.0] - 2026-07-15

### Added

- `@sigx/lynx-list` — new `itemsKey` prop: an identity for the dataset. When it changes, `items` is treated as a brand-new list instead of an update — the window (when windowing) re-anchors to its initial position and the scroll resets to the start (the bottom in chat mode). Use it when swapping wholesale between datasets (tabs, categories, a new search); previously such a swap left the viewport stranded wherever scrolling had left it in the old dataset. Zero-cost when omitted (#600).
- `@sigx/lynx-list` — new `initialMainAxisSize` prop: pins the native list to a known main-axis size on its very first frame instead of the 1px placeholder, killing the mount-frame flash + re-layout for consumers that already know the box (the live measure still wins once it lands) (#610).
- `@sigx/lynx-emoji` — `EmojiGrid` gains optional `itemsKey` (dataset identity, forwards to `List.itemsKey`) and `initialHeight` (forwards to `List.initialMainAxisSize`) props for headless grid users (#602, #610).

### Fixed

- `@sigx/lynx-notifications` — notification-tap payloads now survive to JS, on both platforms and for every message shape. Five defects on one path, each of which alone made tap routing look broken (#619):
  - **Tap events arrived with every scalar field stripped (both platforms).** `sendGlobalEvent` drops a payload's sibling scalars when it carries a nested map (#342 — the same Lynx 0.5.0 / PrimJS 3.8 regression `@sigx/lynx-http` documents), and *every* notification payload nests `data`. So `title`, `body`, `foreground`, `notificationId` and `actionIdentifier` all arrived `undefined` while `data` came through intact — which is exactly why the bug read as "the data is there but tap routing does nothing", and why nobody noticed the missing scalars. Both buses now JSON-encode each event and emit it as a single string, mirroring `HttpEventBus` / `WebRTCEventBus`; the JS shim already parsed string-form events. `getInitialNotification()` returns a JSON string for the same reason — it is the one callback in the module carrying a nested map, and nested-map marshalling over `Callback` / `LynxCallbackBlock` is unproven (the sole precedent, `FilePickerModule`, is masked by JS-side defaulting) — and `src/notifications.ts` parses it.
  - **Android: a tap on an OS-rendered notification lost the payload entirely.** FCM only calls `onMessageReceived` for a backgrounded/terminated app when the message is data-only; a message carrying a `notification` block is rendered by the OS, which never invokes it — so the module never built its tap intent, and `getInitialNotification()` came back empty on exactly the cold start deep-linking exists for. `PushActivityHook` now also treats a launch intent carrying `google.message_id` as a tap and harvests the sender's `data` keys back out of it, delegating the reserved-key filter to `RemoteMessage(Bundle).getData()` (the SDK's own, so Google's reserved set stays authoritative — the approach react-native-firebase and flutterfire use). Best-effort by nature: cold start is reliable, but the warm tap goes through an intent FCM builds and may not be delivered at all, so data-only remains the dependable path when tap routing matters.
  - **Android: data-only messages showed no tray entry.** `title` was read only from `message.notification`, so the one shape that *does* reach `onMessageReceived` in the background produced no notification at all — making the standard fix for the above (switch the sender to data-only) trade one failure for another. `title`/`body` now fall back to the `data` map.
  - **Android: warm taps never reached `onNewIntent`.** The tap intent was `getLaunchIntentForPackage()`'s ACTION_MAIN/CATEGORY_LAUNCHER intent; starting one against an existing task is treated as a launcher relaunch — the task is brought forward and the intent is never delivered, so the extras evaporated and `addNotificationResponseListener` never fired for a background-but-alive tap. The module now builds an explicit-component intent with `SINGLE_TOP | CLEAR_TOP`.
  - **Android: a config-change recreate re-delivered a drained tap.** The tap marker was never cleared from `activity.intent`, so a rotation or font-scale change re-ran `onCreate` and re-stashed a payload JS had already consumed, deep-linking a second time. The markers are now consumed, and `onCreate` ignores a recreate.
- `@sigx/lynx-notifications` — iOS: `getInitialNotification()` no longer reports a notification the user never tapped. iOS populates `launchOptions[.remoteNotification]` when a `content-available` push launches the app **in the background**, with no interaction; the hook stashed that as the initial tap, so the next manual open deep-linked off a silent push. The same branch also double-handled genuine taps (captured at launch *and* republished by `didReceive`). The launchOptions branch is gone — `didReceive` fires for every real tap including cold start, since the delegate is installed before `didFinishLaunching` returns, and is now the single source of truth (the approach RN Firebase and Expo rely on) (#619).
- `@sigx/lynx-notifications` — iOS: a cold-start tap is no longer stranded when JS calls `getInitialNotification()` early. The cold-start window closed on the first `consume` even when it returned nil, so a call landing in the gap between launch and `didReceive` — the normal path for a local notification launched from a terminated state — sent the tap to the response channel, where nothing was listening yet. The window is now keyed on whether the app has ever reached `.active` (a launch tap precedes activation; an in-session tap follows it) and `consume` is a pure one-shot drain (#619).
- `@sigx/lynx-notifications` — iOS: `actionIdentifier` now means the same thing on both platforms. iOS reported Apple's raw `UNNotificationDefaultActionIdentifier` (`"com.apple.UNNotificationDefaultActionIdentifier"`) for a standard tap while Android sent `"default"` — which `NotificationResponse` documents — so an app routing on `actionIdentifier === 'default'` worked on Android and silently never matched on iOS. The native side now maps Apple's default constant onto `'default'`; custom category action ids pass through untouched. Normalized natively rather than in the JS shim, so the raw event channels carry the same contract as the typed API. Apple's dismiss constant is mapped to `'dismiss'` for the same reason, though nothing emits it yet — iOS only delivers that action for a category registered with `.customDismissAction`, and Android sets no `deleteIntent` (#619).
- `@sigx/lynx-notifications` — iOS: nested APNs custom values are recoverable. Values were coerced with `"\(v)"`, which renders a nested object as Swift's *debug* description (`{ id = 42; }`) and a JSON `true` as `"1"`. Non-string values are now JSON-encoded, so `data.yourKey` round-trips via `JSON.parse` and booleans read as `"true"`. The wire type stays `Record<string, string>` — FCM's `data` map is string-only, so strings remain the cross-platform floor (#619).
- `@sigx/lynx-cli` + `@sigx/lynx-plugin` — dynamic `import()` now works in standalone/store builds (#599). Async chunks (`dist/static/js/async/<hash>.js`) previously loaded only in `sigx dev` (the dev server served them); release builds shipped without them and no fetcher, so every dynamic import rejected at runtime with the native `No available provider or fetcher` error — silently, since nothing warned at build time. Now: (1) release flows (`sigx run:* --release`, `sigx prebuild --embed-bundle`) mirror `dist/static/js/async/**` into the native projects (iOS `LynxAssets/` blue-folder reference — injected idempotently into existing pbxprojs on prebuild — and Android `assets/`); (2) the managed native shells register production resource fetchers (`SigxProductionResources.swift`/`.kt`) that map the runtime's root-relative chunk URLs onto those embedded assets, with an http(s) fallback for remotely-hosted chunks; (3) `@sigx/lynx-plugin` pins the production `output.assetPrefix` to `/` (only when unset) so chunk request URLs stay root-relative and map 1:1; (4) `sigx build` and the plugin's after-build hook surface every emitted async chunk, and `sigx updates:publish` refuses to publish while `dist/` contains async chunks (OTA payloads carry only `main.lynx.bundle`) unless `--allow-async-chunks` is passed for remotely-hosted setups. Existing apps pick everything up on the next `sigx prebuild`.
- `@sigx/lynx-list` — edge events (`scrolltoupper`/`scrolltolower`) now act **once per arrival** and only re-arm when a real scroll moves away from that edge. Native re-fires them continuously while a list is parked at an edge — measured 1,674 `scrolltoupper` dispatches with no scrolling at all and only 2 renders (~240/s, far above frame rate) — and a list whose container size is momentarily invalid reports both edges at once. Acting on every dispatch ping-ponged the window (expandNewer trims the head → the top edge re-fires → expandOlder trims the tail → repeat), spun hundreds of re-renders, and handed consumers hundreds of bogus `startReached` calls (#606).
- `@sigx/lynx-list` — the top edge is now bound only when it can do work (chat mode, a window with older items to reveal, or a real `onStartReached` listener), and `bindscroll` is throttled by default (100ms). `List` always binds `bindscroll` internally and nothing internal needs per-frame resolution; both changes cut needless native→JS dispatch (#606).
- `@sigx/lynx-emoji` — the picker no longer renders blank, and switching categories no longer trips the engine's event-dispatch limiter (error 204, red-screened by the dev overlay). Two independent causes, both measured on device:
  - **Blank:** the native list produces invalid layout — blank, or content displaced off-screen — once roughly 130-150+ cells are mounted at once. It is racy (the same count renders on one run and blanks on the next), it predates the windowed grid (release 0.12.2 mounted all 171 smileys and blanked identically), and it reproduces with no emoji code at all by raising the List showcase demo's window to ~250 (#603). The grid window is **64 cells initially / 96 at full expansion**, which renders reliably where 120+ did not.
  - **204 flood:** category grids are no longer kept mounted behind `use:show`, and exactly one grid is mounted at a time. A hidden grid has a zero-height container, so it believes it is permanently parked at its bottom edge and dispatches `scrolltolower` to JS forever — 599 dispatches over 3 tab switches with 4 kept grids, vs 8 with only the active one (#606).
- `@sigx/lynx-emoji` — switching categories no longer freezes on big categories, and tapping a tab highlights it immediately. `EmojiGrid` renders through a windowed `List` (`@sigx/lynx-list`): the sigx renderer eagerly builds every rendered `<list-item>` subtree (the native recycler only virtualizes views for scrolling), so a switch to people-body previously tore down and rebuilt ~388 cell subtrees in one pass. Switches are two-phase — the tab highlight paints in its own cheap flush, the grid swap follows a tick later — and the grid lays out at full height on its first frame instead of flashing a 1px placeholder (#602, #610).
- `@sigx/lynx-emoji` — the picker no longer renders a fully blank screen on device. `createEmojiContext` now snapshots the dataset to plain objects once (it is static by contract and JSON-born, so the round-trip is lossless): grid items and search entries read proxy-free, dropping deep-proxy read overhead over ~1900 entries (#602).


- `@sigx/lynx-updates` — Android: a purely numeric `updates.runtimeVersion` pin (e.g. `'2'`) made every `checkForUpdate()` report `incompatible`: aapt stores numeric-looking `<meta-data android:value>`s as typed (non-String) values, and the native reader used `Bundle.getString()`, which logs a `ClassCastException` warning and returns null for them — the binary's runtime version read back as `"unknown"`. The reader is now type-tolerant (`get(...)?.toString()`), and `@sigx/lynx-cli` prebuild warns when a pinned runtimeVersion would be re-typed by aapt (already-shipped binaries keep the old reader, and non-canonical forms like `0x1A` or `1e3` still can't round-trip). iOS was unaffected. Note: the fix changes `@sigx/lynx-updates`' Android source content, so auto-computed runtime fingerprints change on next prebuild (#598).

## [0.12.1] - 2026-07-13

### Changed

- `@sigx/lynx-cli` — adopted `@sigx/cli` 0.5.0's typed plugin args (#589): the dependency moves `^0.4.2` → `^0.5.0` and all ~30 `ctx.args.<flag> as boolean` / `as string | undefined` casts in `plugin.ts` are gone — `ctx.args` now infers its exact types from the `a` builders inside `definePlugin`. No behavior change; `sigx-cli.requires` stays `>=0.4.0` since no new runtime contract features are used.

## [0.12.0] - 2026-07-13

_Backfilled — the 0.12.0 release PR (#586) shipped without rolling this file._

### Added

- `@sigx/lynx-list` — new data-driven virtualized list: feed mode, chat mode (bottom-anchored + stick-to-bottom), pull-to-refresh + infinite load-more, windowing / load-older for large histories (#548, #550, #552, #554).
- `@sigx/lynx-cli` — FCM google-services plugin/json + iOS aps-environment wired for remote push (#565).

### Fixed

- `@sigx/lynx-list` — clipping/scroll/prepend fixes (#562, #564, #567).

## [0.11.0] - 2026-06-24

### Added

- `@sigx/lynx-camera` — **video recording**: `Camera.recordVideo(options?: CameraVideoOptions): Promise<VideoResult | CameraCancelled>` opens the system camera in video mode and returns the recorded clip's URI (`file://` on iOS, `content://` on Android), loadable directly by `@sigx/lynx-video`. iOS uses `UIImagePickerController` movie mode (honoring `maxDurationMs` via `videoMaximumDuration` and `facing` via `cameraDevice`); Android uses an `ACTION_VIDEO_CAPTURE` launcher wired through `@sigx/lynx-permissions`' `MediaCapture`. New exports: `CameraVideoOptions`, `VideoResult`, and `CameraCancelled`. Both `takePicture` and `recordVideo` now follow a three-outcome contract — resolve with a result (always carrying a `uri`), resolve with `{ cancelled: true }` (no `uri`) on user-cancel, or **throw** on failure (permission denied, no camera, …) — so callers narrow on `result.uri` and `try/catch` failures (the Android `{ error: "cancelled" }` cancel sentinel is normalized away). The cross-platform "photo or video" choice is an app-level chooser (see the showcase's `MediaCaptureCard`); a single in-camera toggle is iOS-only at the system level (#541).
- `examples/showcase` — the **Media** screen gains a WhatsApp-style "Capture or pick" card (`MediaCaptureCard`) whose one button fans out to Take Photo, Record Video, Pick Photo, and Pick Video — surfacing camera capture and the already-existing `ImagePicker.pickVideo` library video picker (#541).
- `@sigx/lynx-dev-client` / `@sigx/lynx-plugin` — **device runtime exceptions now stream to the `sigx dev` terminal.** The native red-screen error sink (Android `LynxViewClient.onReceivedError`, iOS `didRecieveError`) — a *superset* of the JS `lynx.onError` hook that also catches main-thread-script, template, render and native-module errors — is POSTed to a new `/__sigx/device-error` endpoint on the dev log server (dev port + 1) and printed as a `📱 <platform> … ERR …` line, so anything on the on-device red screen is also copyable in the terminal's Logs tab. Errors that also travel the existing JS console path are de-duplicated server-side within a short window, so each error shows up once (#540).

### Fixed

- `@sigx/lynx-camera` — Android: `takePicture` / `recordVideo` now request the `CAMERA` runtime permission before launching the system-camera intent. Because the autolinker declares `CAMERA` in the manifest, Android **requires it granted** before `ACTION_IMAGE_CAPTURE` / `ACTION_VIDEO_CAPTURE` will fire — without it the launch failed with *"Permission Denial … requires android.permission.CAMERA"*. `recordVideo` additionally requests microphone, but only when the app declares `RECORD_AUDIO` (e.g. `@sigx/lynx-audio` is installed), so camera-only apps aren't over-prompted. This brings Android to parity with iOS (which already auto-requests at the `AVCaptureDevice` layer), so callers no longer have to call `requestPermission()` first (#544).
- `examples/showcase` — declare the `@sigx/lynx-camera` dependency that `MediaCaptureCard` uses. It resolved via pnpm workspace hoisting so the JS bundle built, but the autolinker keys off declared dependencies, so the native `Camera` module wasn't linked and capture failed at runtime (#544).
- `@sigx/lynx-video` — Android: `<video-player>` crashed on mount (`createUI catch error … ExoPlayerImpl.addListener`, surfaced to the app as Lynx's `Insertion (new) failed due to unknown child signature`). `LynxUI`'s super constructor calls `createView()` before the subclass's property initializers run, so the `playerListener` field was still `null` when `createView` registered it on ExoPlayer (whose `addListener` rejects null). Build the listener in a function and seed the player with explicit defaults instead (#537).
- `@sigx/lynx-video` — the `onStateChange` event never reached JS handlers on either platform: `statechange` is a reserved event name in the Lynx engine, so custom `bind` handlers for it were silently dropped (sibling events `load` / `timeupdate` / `end` / `error` were unaffected). Renamed the underlying wire event `statechange` → `videostatechange`; the public `onStateChange` prop is unchanged (#539).

## [0.10.0] - 2026-06-23

### Added

- `@sigx/lynx-cli` — first-class **build variants**: a `variants` map in `signalx.config.ts` and a `--variant <name>` flag (or `SIGX_VARIANT`) on `prebuild` / `build` / `run:android` / `run:ios` / `dev`, so a dev/staging/preview build installs **alongside** the production app instead of overwriting it. Each variant is a deep-partial config override plus convenience fields (`idSuffix`, `nameSuffix`, `schemeSuffix`, `extends`, `release`, `iconBadge`); `resolveConfig` deep-merges it and auto-suffixes the app id / display name / deep-link scheme, with per-variant output dirs (`android-<name>/`, `ios-<name>/`). Extras: automatic iOS signing for non-release variants, OTA channel auto-bind, an auto launcher-icon badge, and a runtime `variant` / `isVariant()` / `isBaseBuild()` flag (`__SIGX_VARIANT__`, also exposed natively). Base builds (no flag) are byte-for-byte unchanged (#531).
- `@sigx/lynx-video` — `<VideoPlayer>` gains a `startTime` prop (a one-shot initial seek in seconds applied before the first play, for resume / deep-link into a clip) and an `onStateChange` event (`bindvideostatechange`) firing `playing` / `paused` / `buffering` / `ended` transitions with `{ state, positionMs }`, surfacing OS- and controls-driven pauses the declarative `playing` prop can't observe. New exports: `VideoPlaybackState`, `VideoStateChangeEvent`, `VideoStateChangeEventDetail` (#532).

## [0.9.2] - 2026-06-22

### Fixed

- `@sigx/lynx-webauth` — iOS: fix a typo'd protocol name (`ASWebAuthenticationSessionPresentationContextProviding` → `ASWebAuthenticationPresentationContextProviding`) that made `WebAuthModule.swift` fail to compile, so the package could not build into an iOS app at all in 0.9.0/0.9.1.

## [0.9.1] - 2026-06-18

### Fixed

- `@sigx/lynx-webauth` — Android: on a programmatic `AbortSignal` cancel, keep consuming a late redirect from a still-open Custom Tab until the tab is dismissed, so an abandoned auth flow can't leak back as a global `Linking` 'url' event (#523).
- `@sigx/lynx-webauth` — validate `authorizeUrl` is an `http(s)` URL on both platforms (and drop the dead `Uri.parse` catch on Android); normalize a full redirect URI down to the bare scheme; distinguish "missing required parameter" from "invalid authorizeUrl" in error messages (#523).

## [0.9.0] - 2026-06-18

### Added

- `@sigx/lynx-webauth` — new package: a system web-auth-session primitive for OAuth / OpenID-Connect sign-in. `openAuthSession(authorizeUrl, callbackScheme, options?)` presents `ASWebAuthenticationSession` on iOS and Chrome Custom Tabs on Android, returning the callback URL inline (`{ url }` / `{ canceled: true }` / `{ error }`). Supports `AbortSignal`, iOS ephemeral sessions, and Android toolbar color / preferred browser. Ships an opt-in `@sigx/lynx-webauth/oauth` helper (PKCE per RFC 7636, `state`, callback parsing) — pure JS, no token-exchange opinions (#518).
- `@sigx/lynx-linking` — `LinkingState.addInterceptor` (Android): a one-shot URL interceptor consulted before a deep link is published, so a claimed URL (e.g. an OAuth callback) isn't also delivered as a `Linking` 'url' event. Used by `@sigx/lynx-webauth` (#518).

## [0.8.1] - 2026-06-18

Toolchain-compatibility release: unblocks mobile release builds on current CI toolchains (Xcode 26 and Linux runners). Also rounds out the `@sigx/lynx-daisyui` form/disclosure components.

### Added

- `@sigx/lynx-daisyui` — `Table` component (#513).
- `@sigx/lynx-daisyui` — `Range` (slider) form control (#512).
- `@sigx/lynx-daisyui` — `Collapse` / `Accordion` disclosure component (#511).
- `@sigx/lynx-daisyui` — `Rating` star-input form control (#506), with half-step support via `allowHalf` (#510).

### Fixed

- `@sigx/lynx-cli` — the generated iOS `Podfile` now appends `-Wno-c99-designator` to every pod target (including per-pod subprojects). Xcode 26's clang flags the Lynx C++ core's C99 designated initializers, and the pod compiles with `-Werror`, which aborted the archive (`** ARCHIVE FAILED **`); this unblocks iOS release builds on Xcode 26 (#516).
- `gradlew` template — pinned to LF via a new repo-level `.gitattributes`. A publish with `core.autocrlf` enabled had shipped the wrapper with a CRLF (`#!/bin/sh\r`) shebang, failing on Linux/macOS with `bad interpreter: /bin/sh^M: no such file or directory`; this restores Android builds from the generated project (#516).
- `@sigx/lynx-daisyui` — `Rating` colors now apply via CSS classes, with a horizontal layout (#508).

## [0.8.0] - 2026-06-15

Adopts **sigx core 0.7.0** (`@sigx/reactivity` / `@sigx/runtime-core`) across the runtime, and ships the accumulated backlog: the `use:*` directive system with the built-in `show` directive, the `Platform` API with build-time platform splitting, the W3C-shaped `@sigx/lynx-webrtc` module, and `@sigx/lynx-device-info` folded into `@sigx/lynx-core` (breaking `DeviceInfo` shape).

### Added

- `@sigx/lynx-runtime` — `use:*` directive system wired into the renderer, with the built-in **`show`** directive. `use:show={cond}` toggles an element's visibility via `display` while keeping it mounted (a single style op + preserved native state like input focus/value and scroll position), unlike conditional rendering which unmounts/remounts. Define custom directives with `defineDirective` (typed via the `LynxDirective`/`DirectiveAttribute` helpers) and register them with `registerBuiltInDirective` or per-app `app.directive()`. Also fixes a latent style-dedup issue where a `show`-hidden element re-emitted `display:none` on every re-render (#491).
- `@sigx/lynx-testing` — the test renderer now runs the `use:*` directive lifecycle, so `use:show` and custom directives work in component tests. `use:show` toggles a node's effective `_style.display` (kept mounted), assertable via the new `TestNode.isVisible` getter; custom directives' `created`/`mounted`/`updated`/`unmounted` hooks fire. The shared directive runtime in `@sigx/lynx-runtime` is now host-agnostic (`DirectiveHost`), and `show` is a per-host definition (the test host gets a `TestNode`-based one) (#493).
- `@sigx/lynx-core` — `Platform` API for platform checks & rendering, sourced from the Lynx `SystemInfo` global and re-exported from `@sigx/lynx`: `Platform.OS` (`'ios' | 'android' | 'web'`), `Platform.Version`, `pixelRatio`/`pixelWidth`/`pixelHeight`, best-effort `isPad`, and `Platform.select({ ios, android, web, native, default })`. Plus build-time, tree-shakeable platform splitting: `@sigx/lynx-plugin` injects `__WEB__` / `__NATIVE__` defines per rspeedy environment (typed via `@sigx/lynx/client`) and resolves `.web.tsx` / `.lynx.tsx` / `.native.tsx` file extensions ahead of the generic file (web↔native only; iOS↔Android stay runtime) (#484).
- `@sigx/lynx-webrtc` — W3C-shaped WebRTC module (Android + iOS): `RTCPeerConnection` (offer/answer, trickle + non-trickle ICE, `iceServers`, state events, `ontrack`, `ondatachannel`), `RTCDataChannel` (text + binary), `mediaDevices.getUserMedia({ audio })` with browser-style `NotAllowedError` on denial, and `MediaStream`/`MediaStreamTrack` (`enabled` mute, `stop()`). Remote audio plays automatically through the device audio module. Non-W3C extras: `WebRTC.setAudioOutput('speaker'|'earpiece')` and the camera/audio-style `requestPermission()`/`getPermissionStatus()` (#479). iOS rides WebRTC's `RTCAudioSession` manual-audio mode (`.playAndRecord`/`.voiceChat`, defaultToSpeaker, background `audio` mode).

### Changed

- `@sigx/lynx-core` — `DeviceInfo.getInfo()` now resolves a **platform-discriminated** `DeviceInfoResult` instead of returning the raw native payload verbatim. The native modules normalize to one documented shape: a guaranteed common core (`platform`, `manufacturer`, `model`, `brand`, `systemName`, `systemVersion`, `appVersion`, `deviceId`, `screenWidth`, `screenHeight`, `screenScale`) plus a `platform` discriminant narrowing to per-platform extras (`IosDeviceInfo`: `modelName`, `appBuildNumber`, `bundleId`; `AndroidDeviceInfo`: `sdkVersion`, `appPackage`). Breaking: `screenWidth`/`screenHeight` are now density-independent points (dp/pt) on **both** platforms — Android previously reported physical pixels — and `screenDensity` was renamed to `screenScale` (the dp→px multiplier). Re-run `sigx prebuild` to pick up the native changes (#486).
- `@sigx/lynx-runtime`, `@sigx/lynx`, `@sigx/lynx-appearance`, `@sigx/lynx-safe-area`, `@sigx/lynx-testing` — adopt **sigx core 0.7.0**: `@sigx/reactivity` and `@sigx/runtime-core` bumped `^0.6.3` → `^0.7.0`. Core 0.7.0 types a declared slot accessor as optional, so `@sigx/lynx-daisyui`'s `<Divider>` now calls `slots.default?.()` (an absent `default` slot is treated as no label content) (#499).
- `@sigx/lynx-cli` — bump the sigx CLI toolchain: `@sigx/cli` `^0.4.1` → `^0.4.2` and `@sigx/terminal` `^0.5.0` → `^0.6.1` (#499).

### Removed

- `@sigx/lynx-device-info` — folded into `@sigx/lynx-core`. The `DeviceInfo` API is unchanged but now imports from `@sigx/lynx` (or `@sigx/lynx-core`); its native module is served by core's own `SigxCore` module. Remove the `@sigx/lynx-device-info` dependency and re-run `sigx prebuild` (#484).

### Fixed

- `scripts/publish.js` — already-published skip filters were quoted with single quotes, which cmd.exe treats as literal characters: on Windows a partial-failure re-run selected zero projects and quietly published nothing. Filters now use double quotes, valid on both cmd.exe and POSIX shells (#477).
- iOS red-box crash `Exception occurs while updating property … -[NSNull length]: unrecognized selector` when an optional native string prop was left unset (e.g. a `<Map>` without `mapType`). A JS `undefined`/`null` prop reaches native as `NSNull`, and the affected `NSString *` setters bridged it with `value as String?` — which messages `NSNull` with `-length` and crashes. Hardened every `NSString *` prop setter in `@sigx/lynx-maps`, `@sigx/lynx-webview`, `@sigx/lynx-richtext` and `@sigx/lynx-video` to use the type-checked `value as? String` (returns `nil` for `NSNull`), and `@sigx/lynx-maps` now omits unset optional string props instead of emitting them (#475).

## [0.7.0] - 2026-06-12

New module: `@sigx/lynx-sqlite`. Breaking: `Updates.configure()` → `defineUpdates()`. lynx-cli moves to the sigx CLI 0.4 fluent arg contract.

### Added

- `@sigx/lynx-sqlite` — embedded SQLite database module (Android + iOS, platform-provided SQLite, no bundled C library): `openDatabase`, parameterized `execute`, atomic `executeBatch`, interactive `transaction()`, `PRAGMA user_version` migrations, and a `useLiveQuery` hook that re-runs queries when their tables are written — the persistence layer for chat-style offline-first apps (#466).

### Changed

- `@sigx/lynx-cli` — plugin arg schemas migrated to `@sigx/cli@0.4.x`'s fluent `a.*` builders (`@sigx/args` under the hood); requires sigx CLI >= 0.4.0 (#468). `sigx add`/`sigx remove` now declare their module names as a proper rest argument (the new parser no longer passes loose positionals via `args._`), and every flag gets typed `--help` output. User-visible deltas inherited from the CLI: unknown flags now error instead of being silently ignored, and boolean flags accept `--no-<flag>` negation.

## [0.6.1] - 2026-06-12

### Added

- `@sigx/lynx-updates` — OTA bundle updates: pluggable `UpdateProvider` backends (static-manifest built in), silent / immediate / mandatory / manual modes, native streaming download with SHA-256 verify, two-phase apply with crash-driven rollback, and a prebuild-computed runtime-version fingerprint that refuses updates requiring a newer native build (#432).
- `@sigx/lynx-updates-ui` — prebuilt update UI on daisyUI: `<UpdateGate>` (mandatory blocking), `<UpdatePrompt>`, `<UpdateProgress>`, `<UpdateReadyBanner>` (#432).
- `@sigx/lynx-cli` — `sigx updates:publish` packages a built bundle into a static-host OTA layout; `bundleResolverClass` autolink hook + always-generated `GeneratedBundleResolver` lets a linked package redirect startup bundle loading; runtime-version fingerprint computed at prebuild (`.sigx/runtime-versions.json`, Android manifest meta-data, iOS `SigxRuntimeVersion` Info.plist key); `updates` block in `signalx.config.ts` (#432).
- `@sigx/lynx-plugin` — `__SIGX_RUNTIME_VERSIONS__` / `__SIGX_UPDATES_CHANNEL__` build defines (#432).
- `@sigx/lynx-cli` — typed passthrough for native app config without a dedicated field, applied on every prebuild (no post-prebuild patching). iOS `ios.infoPlist` merges arbitrary Info.plist keys (scalars, arrays, nested dicts) and `ios.usesNonExemptEncryption` is a convenience for `ITSAppUsesNonExemptEncryption` (clears App Store "Missing Compliance"); Android `android.applicationAttributes` merges arbitrary `<application>` attributes (the counterpart to `manifestMetaData`). Native modules can declare the same `infoPlist` / `applicationAttributes` in `signalx-module.json`; app config wins on key collision (#456).

## [0.5.7] - 2026-06-12

### Added

- `showcase` — Gestures & Motion area: 7 gesture/animation demos (#421).

### Fixed

- `lynx-cli` — iOS Release archive failed to compile: the generated `ContentView.swift` referenced `DevPerfMetric` (a `SigxDevClient` type excluded from Release via `EXCLUDED_SOURCE_FILE_NAMES`) outside a `#if DEBUG` guard. The `perfMetrics` state is now DEBUG-gated, matching its other usages.

## [0.5.6] - 2026-06-10

### Added

- `@sigx/lynx-heroui` — Checkbox / Toggle / Radio / Select adopt the sigx `model` two-way binding, matching daisyUI (#405).

### Fixed

- `@sigx/lynx-runtime` — `<input>` / `<textarea>` `model` binding now displays the bound value (prefill / edit), not just write-back. The value is applied via a short deferred `setValue` after the native view is laid out, since iOS ignores the `value` attribute and an in-mount-batch `setValue` for initial display (#404).

## [0.5.5] - 2026-06-10

### Fixed

- `@sigx/lynx-dev-client` — graceful 404 for missing CSS hot-update files, stopping a spurious HMR error (#396).
- `@sigx/lynx-dev-client` — dedupe the error overlay with LogBox, filter HMR noise, and parse Lynx-JSON errors (#394).

### Changed

- `@sigx/lynx-plugin` — de-flake the icons-apply integration test (#398).
- Docs — update the stale module count in the README (25+ → 40+) (#392).

## [0.5.4] - 2026-06-10

### Added

- `@sigx/lynx-dev-client` — reason-first error overlay: collapsible stack, multi-error pager, copy (#389).
- `@sigx/lynx-plugin` — transparent bare `fetch()` on Lynx via `ProvidePlugin` (#384).
- `@sigx/lynx` — re-export `fetch` from the umbrella (Lynx 0.5.0 bare-fetch fix) + docs (#380).

### Fixed

- `@sigx/lynx-cli` — add R8 `-dontwarn` for the SmartRefreshLayout/material gap (#385).
- `@sigx/lynx-richtext` (iOS) — guard `NSNumber` prop setters against `NSNull` (#381).

### Changed

- Docs — repoint homepage/docs links to sigx.dev and trim README drift (#388); surface logging/observability in the root README + showcase config (#382).

## [0.5.3] - 2026-06-09

### Added

- `@sigx/lynx-dev-client` — surface uncaught errors in dev (terminal + richer iOS overlay) (#376).
- `@sigx/lynx-cli` — `sigx doctor` checks `@sigx/lynx-*` version consistency + staleness (#372).
- Logging — declarative `signalx.config.ts` config + release observability auto-wiring (Phase 2b) (#369).

### Fixed

- `@sigx/lynx-http` — global `fetch` must win on the Lynx runtime (Lynx 0.5.0 engine-fetch regression) (#374).

### Changed

- Docs — trim the README package tables, point to sigx.dev/lynx (#363).

## [0.5.2] - 2026-06-09

### Added

- `@sigx/lynx-core` — logging layer: leveled + namespaced logger with HTTP request/timing logs (#352).
- `@sigx/lynx-observability` — opt-in production error capture + provider-agnostic sinks (logging Phase 2) (#361).
- `@sigx/lynx` — re-export the logger from the umbrella for app code (#359).
- `@sigx/lynx-cli` — stable dev-server port + reload-on-reconnect (#350); invalidate build caches on a dependency version change (#353).
- `@sigx/lynx-dev-client` — iOS dev-feature parity with Android + a connection banner (#357).

### Fixed

- `@sigx/lynx-dev-client` — stop double-logging device console lines in the dev terminal (#365).

## [0.5.1] - 2026-06-09

### Added

- `showcase` — Fetch demo: status check, upload progress bar, streaming-markdown render (#345).

### Fixed

- `@sigx/lynx-http` — deliver fetch events as a JSON string so `Response.status` survives the Lynx 0.5.0 bridge (#343).

## [0.5.0] - 2026-06-08

Major release: the `@sigx/lynx-zero` neutral foundation + the `@sigx/lynx-heroui` pilot design system (epic #219), a web build target, and WHATWG `fetch`.

### Added

- `@sigx/lynx-zero` — neutral UI foundation: shared contract, style utils and press constants (#221); layout primitives `Row`/`Col`/`Center`/`Spacer`/`ScrollView` (#223, #224); theme engine moved from daisyui (#227); soft color tokens (#235); headless tabs selection context (#238); shared Tailwind preset (#242); `SwiperIndicator` hoisted from daisy (#317, #318).
- `@sigx/lynx-heroui` — HeroUI pilot package + theme data (#231); pilot components + showcase Lab (#233); forms batch 1 — Textarea/Toggle/Checkbox/Radio (#297, #299); forms batch 2 + layout — Select/FormField/Divider (#300, #301); feedback + data — Badge/Alert/Loading/Progress/Skeleton/Steps/Avatar (#303, #304); `NavHeader` + `NavTabBar` (#324, #325); `NavDrawer` (daisy parity) (#328, #331).
- Web target — `sigx run:web` build/serve/live-reload (#326, #327); web template emit from the plugin (#305); `Gesture.Tap` on web (#316, #319); LongPress + Pan gestures on web (#320, #321).
- `@sigx/lynx-http` — WHATWG `fetch` + `FormData` multipart upload, default-wired through `@sigx/lynx` (#249, #253); streaming response bodies via `res.body.getReader()` for SSE (#250, #289).
- `@sigx/lynx-daisyui` — two-way `model` binding for form controls (#323); Divider label slot (#217); `SwiperIndicator` index-only animation (#215); `NavTabBar` standalone mode (#214); `Text` `autoSize` for Lynx 3.8 (#167, #213); Button accessibility passthrough (#237, #246).
- `@sigx/lynx-core`! — shared native runtime: `SigxActivityHolder` + iOS top-presenter (#257, #276).
- `@sigx/lynx-navigation` — `'sheet'` presentation: partial-height bottom sheet with snap points (#259, #273).
- `@sigx/lynx-datetime-picker` — native date/time picker module (#251).
- `@sigx/lynx-file-picker` — generic native file picker + FileSystem binary read (#248, #252).
- `@sigx/lynx-emoji` — themable emoji picker package (#218).
- `@sigx/lynx-markdown`! — editor surface moves to the `./editor` subpath (#177, #245); block-level WYSIWYG — lists, blockquote, code block, headings 4–6, links (#153, #200); reference mention plugin (#157 part 2, #198); `MarkdownEditor` fullscreen overlay + fixed-mode polish (#154, #202).
- `@sigx/lynx-richtext` — native mention chips: U+FFFC attachment pills + `insertChip` (#157 part 1, #184).
- `@sigx/lynx-runtime` — install a web-standard `queueMicrotask` global in the BG bootstrap (#298).
- `@sigx/lynx-cli` — device support & orientation (#197); icon & splash modernization (#195); post-prebuild hook (#190); iOS CI archivability (#187); exclude the iOS dev client from Release builds (#199); warn on x86_64 Android targets where Lynx SVG icons render blank (#270, #279).
- Native — bump Lynx/PrimJS pins from 3.7.0 to 3.8.0 (#207).
- `showcase` — HeroUI components area + Foundation page (#288, #295); DaisyUI component reference catalog (#209); searchable example catalog (#206).

### Fixed

- `@sigx/lynx-runtime-main` — apply animated styles via raw `__SetInlineStyles` on web (#312, #313); handle keyed moves in `<list>` diffing (#277).
- Web — make tap→navigation work (Haptics no-op + gesture PAPI guard) (#310, #311); guard runtime `setProperty` so SignalX apps render on web (#307, #308).
- `@sigx/lynx-runtime` — expand the inline-style `flex` shorthand into longhands (#266).
- `@sigx/lynx-daisyui` — Modal no longer closes on taps inside the box (#268); themed text & placeholder colors on native Input/Textarea (#225, #243).
- `@sigx/lynx-zero` — nested `ThemeProvider` no longer collapses to zero height inside scroll content (#269, #271); screen-theme subpath packaging + Modal placeholder alignment (#240).
- `@sigx/lynx-cli` — keep the Android version catalog managed, `--clean` does a full re-scaffold (#334, #337); fix `run:ios` picking up a stale `.app` from another checkout's DerivedData (#244); restrict cleartext traffic to debug builds (#193).
- `@sigx/lynx-permissions` — declared as a dependency of permission-using modules (#283); declare `androidx.fragment` 1.8.5 so `lintVitalRelease` passes (#191).
- `@sigx/lynx-richtext` — qualify `CGFloat.greatestFiniteMagnitude` for Xcode 26 (#205); Android spans recolor live on theme switch (#155, #201).
- Sheet — animation feel + drag-gesture fixes + showcase examples (#290, #291, #285, #284, #286, #258).

### Changed

- `@sigx/lynx-daisyui`! — color/variant split per the shared contract (#229).
- Icon-color resolver hoisted to the zero `ThemeProvider` (#324, #325).
- Docs — root README full-stack pitch rewrite (#275); README-upkeep rules in AGENTS.md (#267); document the built-in global `fetch` (#292, #293).
- Chore — sync standard scripts from `signalxjs/repo-template` (#338); add `codecov.yml` patch-coverage gate (#339).

## [0.4.9] - 2026-06-05

### Added

- `@sigx/lynx-markdown` — parser inline extensions for the P3 plugin API, part 1 (#170).
- `@sigx/lynx-markdown` — editor plugin API: trigger sessions + suggestion popup, P3 plugin API part 2 (#176).
- `@sigx/lynx-markdown` / `@sigx/lynx-daisyui` — pluggable `EditorToolbar` (generic + daisyUI) (#169).
- `@sigx/lynx-cli` — env-driven Android release signing with debug fallback (#186).

### Fixed

- `@sigx/lynx-richtext` (Android) — the `editable` prop now defaults to `true`
  when null/absent (`defaultBoolean = true`, mirroring iOS's `?? true`).
  Previously an explicitly-undefined `editable` coerced to `false`, leaving the
  EditText disabled and unfocusable — a `MarkdownEditor` without `disabled` was
  completely inert on Android (#182).
- `@sigx/lynx-markdown` — `MarkdownEditor` now passes a concrete boolean to
  `<sigx-richtext>`'s `editable` (`props.disabled !== true`) instead of
  `undefined`, so no platform has to guess a default.

## [0.4.8] - 2026-06-05

### Added

- `@sigx/lynx-richtext` — new package: a native rich-text input element
  (`<sigx-richtext>`, UITextView / EditText) with attributed editing over a
  flat span-based `RichDoc` bridge model, selection events with active formats
  + caret rect, auto-height reporting, IME-safe versioned `setDocument`, and
  fire-and-forget formatting commands (`RichTextMethods`). v1 covers
  bold/italic/strike/code/link + headings.
- `@sigx/lynx-markdown` — `MarkdownEditor`: true-WYSIWYG markdown editing on
  `<sigx-richtext>` (optional peer). External contract is markdown
  (`value`/`onChange`); converters map markdown ↔ the rich span model with an
  extent-aware serializer and a lossless `raw`-block escape hatch for
  not-yet-modeled syntax (lists, tables, code fences). Chat-style sizing
  (`minLines`/`maxLines` auto-grow, `fixed`, `fullscreen`) and an imperative
  controller (`toggleBold`, `setHeading`, `clear`, …). The showcase gains a
  **Markdown editor lab** and a **Markdown composer lab** (the full chat-composer
  shape: editor + formatting toolbar riding `KeyboardStickyView`, scroll-to-newest
  on send).
- `@sigx/lynx-daisyui` — `useMarkdownEditorTheme()`: reactively resolves the
  active theme's palette (normalized to hex — the native element can't read
  CSS variables) into `MarkdownEditor` color props; a theme switch recolors
  the editor live.
- `@sigx/lynx-runtime` — `ignore-focus` is now a typed common JSX attribute.
  Put it on input-accessory chrome (toolbars, send bars): without it, iOS
  dispatches `endEditing:` on any touch-down outside the focused field and
  folds the keyboard before the tapped command can run.

### Fixed

- `@sigx/lynx-gestures` — dynamic `Pressable` `disabled` never reached the
  main-thread gesture worklets (the BG-side ref write doesn't cross threads):
  a Pressable mounted disabled stayed dead at the gesture layer forever, even
  after the prop flipped to enabled. Changes now ship via a `runOnMainThread`
  worklet. Affects every Pressable-based control (`Button`, …).
- `@sigx/lynx-webview` — `enable-debug` prop setter took a primitive `Bool`,
  which the `propSetterLookUp` bridging path fills with object pointer bits;
  now `NSNumber?` with manual unboxing (latent, same class of bug as the
  richtext `editable` issue found during P1 QA).

### Removed (breaking)

- `@sigx/lynx-markdown` — removed `XMarkdown` (the thin wrapper around Lynx's
  platform-gated native `<x-markdown>` XElement) and its `x-markdown` JSX
  intrinsic/event types. `MarkdownView` is the package's only renderer; it is
  cross-platform and fully replaces the native element use case.

## [0.4.7] - 2026-06-04

### Added

- `@sigx/lynx-keyboard` — new package: soft-keyboard handling with an RN-mirroring API. `<KeyboardStickyView>` (aliases `KeyboardAccessoryView`/`KeyboardToolbar`) pins a composer bar + accessory toolbar to the keyboard's top edge with an MT-animated `translateY`; `<KeyboardAvoidingView>` (`padding`/`translate`/`height` behaviors) keeps content above the keyboard via inline BG styles; `useKeyboard()`/`useKeyboardLift()`/`useKeyboardLiftSV()` expose the state, the lift math (`max(0, keyboard − bottomInset)`) and a smoothly animated SharedValue. Builds on the `keyboard` inset already published by `@sigx/lynx-safe-area` — no new native module. The showcase gains a **Keyboard lab** (Settings tab) demonstrating the chat-composer shape.

### Fixed

- `@sigx/lynx-runtime` — programmatic writes to a model-bound `<input>`/`<textarea>` (clear-on-send, editor toolbar inserts) now repaint the native field. The `value` attribute is initial-only once the user has edited the field, so the runtime additionally pushes such writes through the element's `setValue` UI method (new `INVOKE_UI_METHOD` op). The model echo of the user's own typing is suppressed, leaving cursor/IME composition untouched while typing. (#143)

## [0.4.6] - 2026-06-03

### Added

- `@sigx/lynx-markdown` — replaced the thin `<x-markdown>` wrapper with a SignalX-native, streaming-aware markdown renderer. `<MarkdownView>` parses markdown in JS (zero dependencies) and renders to native `<view>`/`<text>` primitives, so it renders identically on every platform. It exposes a render-function `components` override map (any design system can control the look) and ships `createMarkdownStream()` for flicker-free incremental rendering of AI output. Core CommonMark + GFM. The previous native-element wrapper is preserved as `XMarkdown`.
- `@sigx/lynx-daisyui` — ships `markdownComponents`, a themed daisyUI mapping for `@sigx/lynx-markdown` (optional peer dependency).

### Changed (breaking)

- `@sigx/lynx-markdown` — the renderer export was renamed `Markdown` → `MarkdownView` (making room for a future `MarkdownEditor`). The previous `Markdown` component (the `<x-markdown>` wrapper) is now `XMarkdown`.

## [0.4.0] - 2026-05-19

First lockstep release: every publishable `@sigx/lynx-*` package now ships at the same version. Bump together from here on. See [`RELEASING.md`](./RELEASING.md#versioning-lockstep).

### Changed (breaking)

- `@sigx/lynx-cli` — config file renamed from `sigx.lynx.config.{ts,js,mjs}` to `signalx.config.{ts,js,mjs}`. Hard cut — the legacy name is detected on load and produces a `Found legacy sigx.lynx.config.ts — rename to signalx.config.ts` error pointing at the migration. Rename the file (`git mv`); contents stay identical.
- `@sigx/lynx-cli` — native modules are now auto-discovered from the consumer app's installed dependencies. Any package shipping a `signalx-module.json` manifest is linked automatically the next time `sigx prebuild` runs; the explicit `modules: [...]` array is now optional and only needed when you want to pass per-module `config: {…}`, restrict `platforms: [...]`, or `disabled: true` an installed module. To skip a module that's installed transitively, add `excludeModules: ['@sigx/lynx-foo']`.
- Native modules — manifest filename renamed from `sigx-module.json` to `signalx-module.json` across all `@sigx/lynx-*` packages. Republish your own native modules with the new filename + matching `package.json` `exports` entry.

Future releases will be auto-generated from PR titles via Release Drafter.

## [0.1.8] - 2026-05-13

### Added

- `@sigx/lynx-cli` — `sigx dev` now auto-runs `prebuild` on first invocation when the project has a `sigx.lynx.config.ts` but no `android/` or `ios/` folders yet. Fresh projects scaffolded by `pnpm create @sigx` no longer fall through to the legacy "no iOS or Android targets detected — connect a device or boot a simulator" QR-only mode (same cli code, just gated on the missing folders); the user gets the standard simulator/AVD picker on the very first `pnpm dev`.

- `@sigx/lynx-cli` 0.3.0 — `sigx dev` picker now shows available (shutdown) iOS simulators and (offline) Android AVDs as inline selectable entries, sorted by most-recently-used. Selecting one boots/launches it and proceeds to install + run the app. Previously the picker only listed *currently live* targets and required navigating an extra "+ Boot iOS simulator…" / "+ Launch Android emulator…" sub-picker; cold-start UX is now one-keystroke. `sigx dev --android` / `--all` also auto-launch the most-recent AVD when no Android device is connected, mirroring the existing iOS auto-boot fallback. Toolchain absent (no Xcode simulators, no AVDs) still degrades to a clear empty-state message. Fixes signalxjs/lynx#14.
- `@sigx/lynx-cli` 0.2.0 — pretty-print `xcodebuild` and `gradle` output by default for `sigx run:ios`, `sigx run:android`, and `sigx dev`'s native build paths. A cold iOS build used to dump ~16k lines of clang invocations that looked identical line-to-line; users assumed the build was looping. Output is now filtered to top-level action lines (`▸ Compiling [N] Target/file.cc`, `▸ Linking …`, `▸ Signing …`, `** BUILD SUCCEEDED **`) with errors and warnings always surfaced. Gradle output similarly collapses `UP-TO-DATE`/`NO-SOURCE` tasks and indents ninja CXX progress. If `xcbeautify` is installed (`brew install xcbeautify`), iOS output is piped through it instead — auto-detected, never required. New `--verbose` flag (also `SIGX_VERBOSE=1` / `SIGX_VERBOSE_XCODEBUILD=1`) restores raw streaming for diagnostics. Zero new npm dependencies. Fixes signalxjs/lynx#15.
- Initial extraction of `@sigx/lynx*`, `@sigx/lynx-runtime*`, `@sigx/lynx-cli`, and `@sigx/lynx-testing` from `signalxjs/core` into a dedicated repository.
- `@sigx/lynx` un-privatized: first publishable build with `index`, `jsx-runtime`, and `jsx-dev-runtime` entry points.
- `@sigx/lynx-daisyui` un-privatized: first publishable build with shared CSS asset copy.
- Native modules (`@sigx/lynx-{camera,clipboard,device-info,file-system,haptics,image-picker,linking,location,network,notifications,permissions,safe-area,share,storage}`) now ship `sigx-module.json` for `@sigx/lynx-cli` auto-linking.
- npm Trusted Publishing (OIDC) release workflow.
- `RELEASING.md` with dist-tag strategy (publish to `@beta` first, soak, promote to `@latest`).

### Fixed

- `@sigx/lynx` 0.1.2 — `0.1.1` was published with `"@sigx/lynx-runtime": "workspace:^"` unresolved in its dependencies (an earlier publish bypassed `pnpm publish -r`'s rewrite). `pnpm install` would fail with `ERR_PNPM_WORKSPACE_PKG_NOT_FOUND` for any consumer.
- `@sigx/lynx-plugin` 0.2.5 — `0.2.4` was published referencing the obsolete `@sigx/runtime-lynx-internal` (the pre-rename name). Republished against the canonical `@sigx/lynx-runtime-internal`.
- `@sigx/lynx-runtime` 0.2.4, `@sigx/lynx-runtime-internal` 0.2.4, `@sigx/lynx-runtime-main` 0.2.4 — first publish under the renamed names. The old `@sigx/runtime-lynx*` packages on npm are orphaned tarballs from the `signalxjs/core` era.
- `@sigx/lynx-dev-client` 0.1.1 — `sigx-module.json` was listed in `exports` but missing from `files`, so the published tarball didn't contain the manifest. Without it, `@sigx/lynx-cli` couldn't auto-discover the package and iOS builds failed with "cannot find SigxDevClient in scope".
- `@sigx/lynx-cli` 0.1.1 — `scaffoldAndroid` now force-chmods `gradlew` to 0o755 after copy. npm normalizes file modes to 0o644 in tarballs (except `bin` entries), so the exec bit set on the template was being stripped during publish — consumers got a non-executable `gradlew`.

### Deferred

- `@sigx/lynx-navigation` remains private in v0.1: depends on the unreleased `@sigx/motion`. Will ship in a follow-up release.