chore: deps upgrades, bug fixes, SEO/a11y improvements, and site meta files

.github/docs/ARCHITECTURE.md

@@ -528,9 +528,9 @@ The order in [../../index.html](../../index.html) is **critical**:
 <link rel="stylesheet" href="css/style.css">
 
 <!-- 2. Vendor libs (Monaco, Saxon-JS, pako) -->
-<script src="https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.44.0/..."></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.52.0/..."></script>
 <script src="lib/SaxonJS2.js"></script>
-<script src="https://cdnjs.cloudflare.com/ajax/libs/pako/..."></script>  <!-- used by share.js -->
+<script src="https://cdnjs.cloudflare.com/ajax/libs/pako/2.2.0/..."></script>  <!-- used by share.js -->
 
 <!-- 3. JS modules in dependency order -->
 <script src="js/state.js"></script>      <!-- Global state, clog -->

.github/docs/DEVELOPMENT.md

@@ -180,8 +180,8 @@ Check that vendor libraries load correctly:
 | `css/style.css` | Local file | No cache |
 | `js/*.js` | Local files | No cache |
 | `pako.min.js` | `cdnjs.cloudflare.com` (gzip for share-URL payloads) | CDN cache |
-| Monaco loader (`vs/loader.js`) + worker chunks | `cdn.jsdelivr.net/npm/monaco-editor@…` | CDN cache |
-| Lucide icons | `cdn.jsdelivr.net/npm/lucide@…` | CDN cache |
+| Monaco loader (`vs/loader.js`) + worker chunks | `cdn.jsdelivr.net/npm/monaco-editor@0.52.0/…` | CDN cache |
+| Lucide icons | `cdn.jsdelivr.net/npm/lucide@1.34.0/…` | CDN cache |
 
 **Under Cloudflare Pages** (production deployment):
 - App code (`/js/*`, `/css/*`) — `Cache-Control: no-store`

.github/workflows/codeql.yml

@@ -31,10 +31,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
+        uses: github/codeql-action/init@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
@@ -47,6 +47,6 @@ jobs:
               - dist/**
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
+        uses: github/codeql-action/analyze@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/e2e-tests.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -59,15 +59,15 @@ jobs:
 
       - name: Upload test report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-report
           path: playwright-report/
           retention-days: 30
 
       - name: Upload test results (XML)
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-results
           path: test-results/

.github/workflows/scorecard.yml

@@ -25,26 +25,26 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
           # publish_results: true serves the badge from api.scorecard.dev.
           publish_results: true
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
+        uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         with:
           sarif_file: results.sarif

.gitignore

@@ -18,6 +18,9 @@ npm-debug.log
 # Claude Code
 .claude/
 
+# Serena MCP
+.serena/
+
 # Docs: plans and specs (generated by superpowers)
 docs/superpowers/plans/
 docs/superpowers/specs/
@@ -26,4 +29,7 @@ docs/superpowers/specs/
 dist/
 .vite/
 
-CLAUDE.md
+CLAUDE.md
+
+# Internal notes (not for publication)
+internal-docs/

css/style.css

@@ -291,6 +291,41 @@
       transform: translateY(0);
     }
 
+    /* ── Mobile warning banner ── */
+    .mobile-banner {
+      display: none;
+      position: fixed;
+      bottom: 0; left: 0; right: 0;
+      background: var(--warning);
+      color: #000;
+      font-family: var(--font-mono);
+      font-size: 12px;
+      font-weight: 500;
+      padding: 10px 16px;
+      z-index: 20000;
+      align-items: center;
+      gap: 10px;
+      box-shadow: 0 -2px 12px rgba(0,0,0,0.3);
+    }
+    .mobile-banner.visible { display: flex; }
+    .mobile-banner span { flex: 1; }
+    .mobile-banner button {
+      background: none;
+      border: 1px solid rgba(0,0,0,0.35);
+      border-radius: 4px;
+      color: #000;
+      cursor: pointer;
+      font-family: var(--font-mono);
+      font-size: 11px;
+      padding: 3px 8px;
+      white-space: nowrap;
+    }
+    .mobile-banner button:hover { background: rgba(0,0,0,0.12); }
+    body.light .mobile-banner {
+      background: #d97706;
+      box-shadow: 0 -2px 12px rgba(0,0,0,0.15);
+    }
+
     /* ── HEADER — Linear/Raycast-style command bar ──
        Hairline dividers between groups, square buttons, monospace 12px,
        no glows, no rounded pills. The header is chrome — it should sit
@@ -1003,7 +1038,12 @@
     .console-body::-webkit-scrollbar-track { background: transparent; }
     .console-body::-webkit-scrollbar-thumb { background: var(--scrollbar); border-radius: var(--r-xs); }
     .log-line { line-height: 1.7; }
-    .log-line .ts { color: var(--text-dim); margin-right: 8px; }
+    .log-line .ts { color: var(--text-dim); margin-right: 6px; }
+    .log-line .log-type-icon { vertical-align: middle; margin-right: 5px; opacity: 0.7; flex-shrink: 0; }
+    .log-line.info    .log-type-icon { color: var(--text-secondary); }
+    .log-line.success .log-type-icon { color: var(--success); }
+    .log-line.error   .log-type-icon { color: var(--error); }
+    .log-line.warn    .log-type-icon { color: var(--warning); }
     .log-line.info .msg    { color: var(--text-secondary); }
     .log-line.success .msg { color: var(--success); }
     .log-line.error .msg   { color: var(--error); }
@@ -1534,6 +1574,8 @@
     }
 
     /* ── EXAMPLES LIBRARY MODAL ── */
+    body.modal-open { overflow: hidden; }
+
     .ex-modal-backdrop {
       display: none;
       position: fixed; inset: 0;