- attach.StaticHandler and attach.StaticHandlerPublic set X-Content-Type-Options: nosniff on every response
- the stored disposition is read with one Attributes call after the is_public gate and sent on GET and HEAD; a value mime.ParseMediaType rejects is sent as attachment
- blobs without a stored disposition are served as before
- lagoon README, storage and attachments docs pages, surf uploads comment updated
Covers 33-14-SUMMARY.md, the release and deploy logs and the release notes. Release items settled: tags, changelog posts, grzybyfunkcjonalne.pl sitemaps and post head, G1 on the demo; W5 SQL check waived by Jakub. Open: live MCP session, Rich Results Test, visual and admin checks (with grzyby checklist items 3, 5, 6, 7). Seeds 33-UAT.md.
Importing attach/webp registers the encoder library's WebP decoder ahead
of the pure Go one for the whole process, so WebP uploads are decoded
through the system libwebp when it is installed. The lagoon README and
the attachments page say so and name -tags nodynamic.
- vue-seo-layer v0.2.0: the route report's noindex paths, sitemap pages per
locale and not over a catch-all, root files 503 while the backend is unknown
- vue-journal-layer v0.8.0: path-form listing routes, the catch-all upgrade
note, post article meta
- vue-menu-layer and vue-faq-layer v0.5.0: the catch-all upgrade note
- 33-14-vue-demo-app-locale.patch and 33-14-sm-demo-app-locale.patch move the
demo to prefix_except_default on top of the 33-12 demo patches
- release-note drafts for the framework, the three plugins and four layers
- the read-only RISK-MAX query for production databases
- deferred items and the broken-windows ledger after the six fixes
- layers: node --test runs checked with a TAP detector (self-tested), every
vue-seo-layer smoke, guard:check and purge:check, all five journal
expectation files (postTitleTag h1 and p), the journal purge checks and
check-git-install.sh --self-test
- consumers: the 33-12 and 33-13 app patches pass git apply --check, and
the 33-14 demo locale patches apply on top of the 33-12 ones in scratch
worktrees
- pact: the content kinds and tools, zero facts, the value types
- cabana: mergeRequestOptions precedence, one call per type, fail-open,
no shared maps
- attach: VariantKey on thumbnail names
- attach/webp: every image kind, the stored content type, the
broken-image thumbnail and a refused mode
- go: the framework's new unit tests by required name
- plugins: the sitemap, SEO and Journal unit tests by required name
- docker: the phase's Postgres suites by required name per plugin,
TestChromeRenderer when a Chrome or Chromium binary is present, and the
framework's lagoon/attach packages
- deploy log: after-tags, production in 33-14 (no separate uat since the
2026-10-31 cutover), the en and Additional addresses steps confirmed at
the 33-14 release checkpoint, the production check list
- summary with the rehearsal, head diff and self-check
- deferred items: the demo moves to prefix_except_default (decided)
- sm-grzybyfunkcjonalne-app: Journal tag pages off and author pages at
/autor/:author, the sitemap and SEO config, nginx without the root-file
locations (P33-49), check-deploy, smoke.sh (companions, route report,
page names, seo-pages.csv, Additional addresses, rebuild), smoke-seo.sh,
urls.txt, pl as the only enabled locale, seo-settings.yaml with the
author templates and page suffix, DEPLOY.md release steps, tests
- vue-grzybyfunkcjonalne-app: nuxt.config on the SEO layer options
without @nuxtjs/seo keys, no page useSeoMeta, footer sitemap link,
title template for pages the CMS does not answer, SEO fixtures from
the rehearsal
- local wiring note and the deferred findings
demo:seed tags no post, so the tag_pages check in TestSEOOutput passed
without config/golem15.journal.yaml as well. The test now tags the seeded
post and requires /blog/tag/releases to resolve not_found; without the
config it fails.
- sm-demo-app: Journal, sitemap and SEO config, nginx without sitemap
locations, env templates, DEPLOY.md SEO steps, seo-pages.csv,
TestSEOOutput, scripts/smoke-seo.sh, release smoke on the new format
- vue-demo-app: seo.noindexRoutes for the decks, page meta for auth and
signed-in pages, SeoSitemapLink in the footer, @nuxtjs/seo keys removed
- vue-summercmsio-app: changelog on seo.cms false, expectations for it
- sm-summercmsio-app: no change beyond the pin bumps
- 33-12-local-wiring.md: the scratch wiring for 33-13 and 33-14
- attach.VariantKey: a thumbnail's copy in another format next to it
- attach/webp (separate package, so only binaries that import it link
the encoder): Encode at quality 80 and Variant, which writes the WebP
copy of a thumbnail once and leaves no file on a failed encode
- github.com/gen2brain/webp v0.6.4, decided in
.planning/notes/2026-10-28-webp-gen2brain.md
- lagoon README and docs/database/attachments.md
github.com/gen2brain/webp pinned at v0.6.4 (approved 2026-11-04), with
how it runs (purego or the wasm2go-transpiled libwebp), the linking
consequence, the benchmark and where the code lives.
