Release v1.11.0: PWA install + code-only PWA login + email/metrics fixes #187

Merged

developer merged 6 commits from development into master 2026-07-05 21:02:09 +00:00

Conversation 1 Commits 6 Files Changed 45

+823 -87

developer commented 2026-07-05 21:00:02 +00:00

Owner

Copy Link

Copy Source

Promote development → master for the v1.11.0 release. Additive only — a new (appended) FlatBuffers field, static PWA assets, and metric bucket boundaries; no DB migration, no breaking changes, so image rollback stays DB-safe.

Included (merged into development this session)

• #184 — PWA install. The web SPA is installable: manifest.webmanifest + an install-only service worker + 192/512/maskable icons; a platform-adaptive install CTA (one-tap on Chromium, manual Add-to-Home-Screen instructions on iOS Safari, hidden elsewhere / once installed / inside a Mini App) under the logged-out login card and at the bottom of Settings; a third web-version entry (/app/) on the landing with captions (Telegram / VK / Веб-версия).
• #185 — Code-only PWA email login + email security. A login requested from an installed PWA omits the one-tap confirm link (it would open in a separate browser out of the PWA's reach) — the email carries only the code, typed in the same window; plain-browser logins keep the link. Separately, the operator alert digest no longer embeds the /_gm admin-console URL (an admin link must not travel in an email).
• #186 — p99 latency metric fix. edge_request_duration now uses second-scale histogram buckets; the OTel default ms-calibrated buckets binned every request into one bucket and made p99 interpolate to ~4.95s, flapping the ">1s" edge-latency alert on every app open. Fixes the flap on both contours.

Verification

All three merged green (CI + test-contour deploy). Latest post-merge development CI #712 all-green. This master PR runs the test-only gate (no auto prod deploy — prod is manual workflow_dispatch).

After merge

Tag v1.11.0 on master. Prod deploy is a separate owner-initiated step (I'll run /deploy-check first); no schema migration in this release.

Promote `development` → `master` for the **v1.11.0** release. Additive only — a new (appended) FlatBuffers field, static PWA assets, and metric bucket boundaries; **no DB migration, no breaking changes**, so image rollback stays DB-safe. ## Included (merged into development this session) - **#184 — PWA install.** The web SPA is installable: `manifest.webmanifest` + an install-only service worker + 192/512/maskable icons; a platform-adaptive install CTA (one-tap on Chromium, manual Add-to-Home-Screen instructions on iOS Safari, hidden elsewhere / once installed / inside a Mini App) under the logged-out login card and at the bottom of Settings; a third **web-version** entry (`/app/`) on the landing with captions (Telegram / VK / Веб-версия). - **#185 — Code-only PWA email login + email security.** A login requested from an installed PWA omits the one-tap confirm link (it would open in a separate browser out of the PWA's reach) — the email carries only the code, typed in the same window; plain-browser logins keep the link. Separately, the operator alert digest no longer embeds the `/_gm` admin-console URL (an admin link must not travel in an email). - **#186 — p99 latency metric fix.** `edge_request_duration` now uses second-scale histogram buckets; the OTel default ms-calibrated buckets binned every request into one bucket and made p99 interpolate to ~4.95s, flapping the ">1s" edge-latency alert on every app open. Fixes the flap on both contours. ## Verification All three merged green (CI + test-contour deploy). Latest post-merge development CI #712 all-green. This master PR runs the test-only gate (no auto prod deploy — prod is manual `workflow_dispatch`). ## After merge Tag **v1.11.0** on master. Prod deploy is a separate owner-initiated step (I'll run `/deploy-check` first); no schema migration in this release.

developer added 6 commits 2026-07-05 21:00:03 +00:00

feat(pwa): installable web app + landing web entry ... 51147a1429

Make the web SPA an installable PWA and surface it to users:

- manifest.webmanifest + an install-only service worker + 192/512/maskable
  icons (ui/public); PWA head tags in index.html; the .webmanifest MIME type
  registered in the gateway (the distroless image has no /etc/mime.types).
- Platform-adaptive install CTA (components/InstallApp.svelte + lib/pwa):
  one-tap on Chromium, manual Add-to-Home-Screen instructions on iOS Safari,
  hidden elsewhere / once installed / inside a Mini App. Shown under the
  logged-out login card and at the bottom of Settings.
- The landing gains a third entry linking /app/ (the brand tile), with a
  caption under all three (Telegram / VK / Веб-версия).

The service worker is navigation-only (network-first, cached-shell fallback);
hashed assets and the Connect stream are untouched. It exists to satisfy
Chromium's installability requirement and is the single growth point for a
future opt-in offline mode.

Tests: pwa.ts unit tests; a webui probe (manifest/sw.js content-type + the
SPA-fallback-to-HTML trap); e2e for the one-tap CTA, the iOS instructions
modal and the landing web entry. Docs: ARCHITECTURE §13, FUNCTIONAL (+ru),
gateway README.

Merge pull request 'feat(pwa): installable web app + landing web entry' (#184) from feature/pwa-install-cta into development d19609f87d

feat(email): PWA login sends code only; drop admin link from alert emails ... 061366da5a

Two email changes, per the owner:

1. Code-only login from an installed PWA. A login requested while running as a
   standalone PWA now omits the one-tap confirm link from the email — the link
   would open in a separate browser whose minted session cannot reach the PWA,
   stranding the login. The code is typed in the same window instead. The client
   sends a `pwa` flag (isStandalone) on the email-code request (a new FBS field,
   threaded through the gateway); the backend omits the deeplink when it is set,
   reusing the existing deletion-code link-omission path. Non-PWA browser logins
   keep the one-tap link. No polling, no migration.

2. Security: the operator alert digest no longer embeds the admin-console (/_gm)
   URL. An admin link must never travel in an email, where a mail provider could
   cache or index it; the operator opens the console directly.

Tests: an inttest asserting the PWA login email omits the link (and a browser one
keeps it); a codec round-trip of the new pwa field; the alert-digest test flipped
to guard the admin link is absent. Docs: ARCHITECTURE + FUNCTIONAL (+ru).

Merge pull request 'feat(email): PWA login sends code only; drop admin link from alert emails' (#185) from feature/pwa-login-code-only into development a2c79c149a

fix(metrics): second-scale buckets for edge_request_duration ... 00bb66ba0f

The edge request-latency histogram records seconds but used the OTel SDK's
default millisecond-calibrated bucket boundaries (first boundary 5), so every
sub-5s request fell into one bucket and histogram_quantile(0.99) interpolated
to ~4.95s for every message type — regardless of the real (millisecond)
latency. That tripped the >1s "Gateway request latency p99 high" alert on
essentially every request, flapping fire/resolve on each app open (seen on the
test and prod contours).

Set explicit second-scale bucket boundaries (0.005 … 10s) straddling the 1s SLO
so the p99 reflects real latency and the alert fires only on genuine slowness.
Regression test asserts the histogram carries a sub-second boundary.

Merge pull request 'fix(metrics): second-scale buckets for edge_request_duration' (#186) from fix/edge-latency-histogram-buckets into development 3a85f64726

owner approved these changes 2026-07-05 21:00:48 +00:00

developer merged commit 57ff2d03f8 into master 2026-07-05 21:02:09 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#187