4.16  2026-06-11
    - teach the built-in `dashboard workspace` command a `-c` flag, accepted
      before or after the workspace name, that changes into the registered
      dashboard path for that name before planning the session, so
      `dashboard workspace -c foobar` behaves like `cdr foobar` followed by
      `dashboard workspace foobar` and the tmux session plus its layered
      `.env` refresh start from the registered project directory
    - fail `-c` explicitly when the workspace name is not a registered
      dashboard path, when the registered target is not a directory, or when
      the directory cannot be entered, instead of silently starting the
      workspace from the wrong directory
4.15  2026-06-11
    - keep the `install.sh` post-install activation runner on the same shell
      dialect as the bootstrap target, so blank hosts without `SHELL` exported
      (fresh Docker containers, `curl ... | sh` runs) no longer source the
      bash-flavoured activation files through plain `sh` and die on the first
      bash-only construct
4.14  2026-06-11
    - align every module under `lib/` back onto the single repository release
      version after the `4.13` bump only advanced `Developer::Dashboard`,
      leaving the other 53 packaged modules still declaring `4.12`
    - add a release-metadata gate that walks every `lib/**/*.pm` and asserts
      its `$VERSION` matches the `dist.ini` release version, so a partial
      version bump can never ship again
    - validate IPv4 loopback octets strictly in `Auth::_ip_is_loopback`, so
      malformed literals such as `127.0.0.999` are no longer classified as
      loopback addresses
    - restore the `4.12` entries in `Changes` and `FIXED_BUGS.md` that the
      `4.13` update overwrote instead of prepending
4.13  2026-06-11
    - harden the GitHub-hosted `Devel::Cover` gate again by exercising the
      installed-dist `File::ShareDir` asset lookup branch in
      `Web::App::_bundled_public_asset_path`, so clean Ubuntu runners close
      the final `99.9` statement gap and keep the reviewed `lib/` totals at
      `100.0 / 100.0 / 100.0`
4.12  2026-06-10
    - harden the GitHub-hosted `Devel::Cover` gate by exercising the
      low-traffic `Web::App` compatibility helpers directly in the focused web
      coverage tests, so route fan-out timing on CI runners cannot leave the
      reviewed `lib/` totals below `100.0 / 100.0 / 100.0`
4.11  2026-06-10
    - decouple the GitHub-hosted CPAN upload workflow from ordinary `vX.XX`
      tag pushes so signed GitHub release tags can be published without
      triggering an unasked PAUSE upload
    - broaden the CodeQL push trigger to every branch so repository-side SAST
      coverage is visible on more commit paths instead of only `master`
4.10  2026-06-10
    - move project-local isolated Docker Compose service discovery and
      disable markers under `./.developer-dashboard/config/docker/...` so
      the implementation matches the documented config-root contract across
      resolver lookup, toggle writes, and exported `DDDC` paths
4.09  2026-06-06
    - keep smart-routed skill page browser edits on their canonical
      `/app/<skill>` and nested `/app/<skill>/<sub-skill>` aliases by
      teaching the edit/source routes and Play handoff to load skill index
      pages through the same smart resolver instead of collapsing to the
      underlying `BOOKMARK: index` id
4.08  2026-06-06
    - split the Web UI bookmark editor into Jupyter-like section blocks while
      keeping the saved bookmark file format canonical, including block-aware
      syntax overlays, Tab-created sections, hidden source recomposition, and
      Play-mode save-and-render handoff
    - standardize operator-facing built-in CLI output so path, file, api, and
      skill inventory or mutation commands default to readable table summaries
      while `-o json` returns the full raw machine payload
4.04  2026-06-05
    - restore the public switchboard helper path contract for dotted
      `dashboard <skill>.<command>` dispatch, keep Windows core-backed
      built-ins routed through the shared staged `_dashboard-core` helper,
      and fix the staged private core import drift that broke `dashboard init`
      and later helper refreshes
    - harden Windows runtime helper and state-file flows so detached web,
      collector-loop, collector-worker, and watchdog launches use the staged
      foreground helper entrypoints and tolerate Windows rename collisions
      through explicit replace fallbacks
    - teach the Windows checkout bootstrap to seed `HOME` from PowerShell's
      own `HOME`, create a stable user-space `make.cmd` shim for Strawberry
      GNU make, and keep the fuzz gate lightweight under `Devel::Cover`
    - force non-interactive CPAN environment defaults for skill `cpanm`
      installs so Windows fresh-session bootstrap checks do not stall behind
      dependency configure prompts
4.03  2026-06-05
    - ship an explicit OWASP compliance SOW and evidence matrix, wire it into
      the OWASP and release-metadata tests, and tighten the manuals so the
      safe public wording stays `OWASP-aligned` / `OWASP-gated` until the
      remaining governance blockers are truly closed
4.02  2026-06-04
    - fix `_helper_file_supports_internal_command` substring detection so
      runtime helper refresh probes return true for matching staged helpers
      and stay stable under the plain and covered harnesses
    - harden `t/47-zombie-coverage-closure.t` with a persistent helper
      fixture and direct runtime-object assertions so the final gate loop
      stays deterministic
4.01  2026-06-02
    - add the built-in `dashboard api` management command for layered
      `config/api.json` machine auth, including merged registry listing,
      per-key inspection, SHA-256 hashing of raw secrets before persistence,
      optional `--maybe-secret` route-oriented secret input, exact saved
      `/ajax/...` route add/remove controls, duplicate-route no-op handling,
      and child-layer tombstones that hide inherited API groups without
      rewriting parent config
4.00  2026-06-02
    - add layered `config/api.json` machine auth for selected saved
      `/ajax/...` routes, including installed skill `config/api.json`
      fragments, exact route allowlists, and `X-DD-API-Key` plus
      `X-DD-API-Secret` header verification against stored SHA-256 digests
    - keep helper-session auth working on those same API-registered ajax
      routes while failing unauthenticated or wrong-secret machine callers
      closed with `403 {"status":"forbidden"}`
    - pass saved ajax API auth headers through the PSGI/Dancer adapter so
      browser-facing and direct HTTP entrypoints enforce the same machine-auth
      contract
3.99  2026-05-26
    - keep the active shell directory in dashboard-managed child `PATH`
      repairs alongside the current Perl interpreter bin so collector shell
      commands still execute cleanly during blank-environment tarball installs
      and any runtime that inherits a stripped `PATH`
3.98  2026-05-20
    - treat collector `disable` as a hard stop-and-skip flag so disabled
      collectors are not started, explicit named starts reject them, and any
      already-running managed loop is stopped during the next lifecycle action
    - remove managed collector indicators for disabled collectors instead of
      leaving stale active indicator state behind
    - normalize dashboard-owned `PERL5LIB` ordering so core/site/vendor Perl
      dirs stay ahead of inherited user-local shadow copies, preventing stale
      dual-life XS modules such as `Encode` from breaking helper startup,
      collector child commands, saved Ajax subprocesses, and skill hooks on
      hosts with older local-lib artefacts
    - keep the current Perl interpreter directory at the front of `PATH` for
      dashboard-managed child commands so collector loops, saved Ajax
      subprocesses, and skill hooks do not fall back to a mismatched system
      `perl` when they execute `dashboard` through `/usr/bin/env perl`
    - run collector shell commands through a non-login shell so macOS shell
      session restore output and other shell-init chatter do not get prefixed
      onto JSON collector output
    - slow tmux ticket/workspace status refresh from a 2-second hot loop to a
      15-second cadence so dashboard-managed tmux sessions do not burn CPU just
      to repaint status fragments
    - apply a 30-second default safety floor to shell collectors that recurse
      back into `dashboard` or `d2`, with explicit opt-outs and an environment
      override for intentionally fast dashboard polling
    - pause the collector watchdog supervisor during explicit named collector
      stop and restart actions, then restore supervision for the remaining
      watched fleet afterwards so watchdog restarts do not race manual
      lifecycle commands
    - preserve the saved managed web pid during stop flows even when shutdown
      has to fall back to persisted-state listener pids, and still escalate the
      saved pid to KILL when process discovery lags after TERM
    - scope web stop ajax cleanup to the current dashboard runtime root instead
      of sweeping every `dashboard ajax:` process owned by the user
    - make collector loop shutdown kill active worker process groups so
      long-running singleton commands stop with the collector loop instead of
      surviving as orphaned subprocesses
    - reap exited collector workers and watchdog-adopted dashboard children
      immediately on `SIGCHLD` instead of waiting for the next scheduler or
      watchdog tick, so long-interval collectors and orphaned supervisors do
      not leave visible `<defunct>` dashboard processes behind for minutes or
      days
    - persist active worker pids in collector loop state and lock in a live
      singleton regression where a long-running due run must be skipped instead
      of overlapped

3.92  2026-05-20
    - keep `dashboard ps1` on a lighter switchboard path by lazy-loading the
      unknown-command suggestion runtime and helper-staging-only modules
      instead of paying for them on every prompt render
    - stage only the requested built-in helper on the hot path and reuse one
      `PathRegistry` object across the switchboard invocation, instead of
      rescanning and restaging the entire helper tree for every prompt
    - load installed skill config fragments directly from layered
      `config/config.json` files in `Config` so prompt-time config reads do not
      pull in the full skill dispatch runtime

3.91  2026-05-20
    - make `dashboard ps1` skip `tmux show-environment` when `TMUX` is unset,
      stop constructing an unused collector object, and refresh only
      prompt-visible core indicators on the prompt path
    - read the prompt branch directly from `.git/HEAD` and worktree `gitdir:`
      metadata instead of spawning `git branch`, keeping branch rendering fast
      on slower hosts such as iSH
    - add a collector-sync fast path so repeated prompt renders avoid the full
      collector indicator rewrite path when the stored config-backed indicator
      state already matches

3.90  2026-05-20
    - make `PathRegistry` actually reuse a precomputed invocation cwd and
      memoize repeated DD-OOP-LAYERS path derivation so thin helper commands
      stop recalculating the same runtime chain during one process
    - make `EnvLoader` plain-directory traversal reuse the registry cwd cache
      instead of re-running `cwd()` while it walks root -> project -> leaf
      `.env` layers
    - tighten the nested skill env/compose fix set with the final blank-host
      and coverage gate closure work

3.89  2026-05-19
    - expand nested skill env loading from root to leaf for dotted skill
      commands and participating docker compose skill services, preserving
      overwritten parent values under cumulative aliases such as
      `foo_VERSION` and `foo_bar_VERSION`
    - discover nested installed-skill docker compose roots so participating
      leaf services such as `skills/foo/skills/bar/skills/zzz/config/docker`
      contribute both leaf `zzz_DDDC` and cumulative `foo_bar_zzz_DDDC`
      aliases during compose resolution
    - cover the remaining action-runner defensive and background-child startup
      branches so the final tree can close the 100% coverage gate again

3.88  2026-05-19
    - load participating skill-root `.env` files into `dashboard docker compose`
      resolution and export normalized `<skill>_DDDC` variables for each
      participating skill docker root
    - run detached background page command actions through a reaped supervisor
      path so blank-container tarball installs and root-owned hosts do not
      leave stale background wrappers behind or fail the tarball gate

3.86  2026-05-19
    - fixed packaged shell bootstrap generation so staged helpers always
      re-enter the active dashboard entrypoint instead of leaking a stale
      inherited source-tree path into extracted tarball installs and tests

3.85  2026-05-19
    - export one skill-specific <skill-name>_DDDC compose env variable for each participating skill docker root
    - keep participating skill .env loading isolated to docker compose resolution without executing skill .env.pl files

3.84  2026-05-19
    - load participating installed skill .env files into docker compose resolution without executing skill .env.pl files

3.83  2026-05-18
    - fixed interactive `dashboard skills install` progress so dependency rows
      are only added when the matching manifest file actually exists in the
      fetched skill, instead of printing `[OK] ... skipped: ... not present`
      noise for absent files
    - filtered operating-system-specific dependency rows so `aptfile`,
      `apkfile`, `dnfile`, `wingetfile`, and `brewfile` only appear on their
      matching host families and stay hidden on unrelated platforms even when
      those files exist in the skill
    - kept cross-platform manifest rows such as `package.json`,
      `requirements.txt`, `cpanfile`, `cpanfile.local`, `Makefile`, `ddfile`,
      and `ddfile.local` visible only when those files are present, which
      leaves the progress board focused on real work instead of skipped probes

3.79  2026-05-16
    - replaced the `tomq` backend dependency with `TOML::Parser`, inflating
      TOML booleans to plain Perl `1` and `0` scalars so query output stays
      stable while the blank-container `cpanm` install gate no longer trips
      over the failing upstream `TOML::Tiny 0.21` test suite on Perl 5.38

3.78  2026-05-16
    - fixed the tag-driven GitHub release workflow so it installs
      `Devel::Cover` before running the numeric coverage gate; this avoids
      the exit-127 `cover` failure that previously blocked signed GitHub
      release publication and kept Scorecard from seeing any releases

3.77  2026-05-15
    - aligned every shipped Perl module under `lib/` with the distribution
      version after the blank-host installer fix so the source tree, release
      metadata, and CI coverage gates all read one consistent `3.77` version
      instead of a mixed `3.75`/`3.76` module set

3.76  2026-05-15
    - fixed blank Ubuntu `curl ... | sh` bootstrap installs so `install.sh`
      seeds `File::ShareDir::Install` into `~/perl5` before `cpanm --notest .`
      runs against the cloned checkout, avoiding the configure-time
      `Can't locate File/ShareDir/Install.pm` failure on fresh hosts
    - aligned `install.ps1` with the same configure-prerequisite bootstrap so
      the checkout install path does not drift between Unix-like and Windows
      operators

3.75  2026-05-15
    - fixed Windows background web helper lookup so source-tree and CI test
      runs no longer die when `RuntimeManager` asks `File::ShareDir` for an
      installed dist share that does not exist yet; helper fallback now reuses
      the same guarded helper-asset resolver used elsewhere in the runtime
    - replaced the built-in `/js/jquery.js` shim with a bundled local copy of
      jQuery 4.0.0, while keeping `/js/jquery-4.0.0.min.js` as a compatibility
      alias for the same shipped asset
    - taught the browser bookmark editor to expand `:---` into the full
      separator line and insert the next sensible unique directive so common
      `TITLE -> HTML -> CODE<N>` authoring flows are smoother
    - added release and route coverage for the bundled jQuery asset and the
      missing-dist-share helper fallback path

3.74  2026-05-15
    - added direct `python` dispatch for executable `cli/*.py` commands and
      hook files so Python-backed skills now run through the same logical
      command and hook resolution path as Perl, Node, Go, Java, and shell
      helpers
    - added `requirements.txt` to the skill dependency chain after
      `package.json`, installing Python dependencies through
      `python -m pip install --user --requirement requirements.txt`
    - regenerated README.md from the canonical POD after the runtime and
      dependency-chain changes so release metadata stays in sync

3.73  2026-05-15
    - added direct `node` dispatch for executable `cli/*.js` commands and
      hook files, so JavaScript-backed skill commands now run through Node in
      the same extension-resolution path already used for Perl, Go, Java, and
      shell helpers
    - fixed the platform runnable-file resolver so logical command names can
      discover matching `.js` files on Unix and Windows without breaking the
      existing `package.json` dependency-install chain used by
      `dashboard skills install`
    - fixed the prompt tmux-status unit coverage to clear `WORKSPACE_REF`
      explicitly so ordinary tmux sessions still test the non-dashboard path

3.72  2026-05-14
    - fixed collector watchdog supervision so a managed loop that stays alive
      but stops making progress is treated as stalled, restarted
      automatically, and reported explicitly instead of sitting silent until
      an operator notices
    - renamed the primary tmux workflow from `dashboard ticket` to
      `dashboard workspace`, while keeping the older `dashboard ticket`
      spelling plus `TICKET_REF` session state as compatibility fallbacks
    - added layered plain-directory `.env` refresh for workspace sessions, so
      the highest ancestor `.env` acts as the base, parent `.env` files merge
      next, the current directory `.env` overrides last, and resumed tmux
      workspace sessions are refreshed in place with dropped keys unset

3.71  2026-05-14
    - fixed live collector status writes so managed indicator ordering now
      keeps the collector array order from `config/config.json` even after one
      collector refreshes its own state, instead of dropping back to
      alphabetical order in `/system/status`, page-header indicators, and
      `dashboard ps1`
    - fixed runtime `config/routes.json` aliases so normal saved bookmarks
      such as `/app/learn.ai` can be reached through shorter custom paths like
      `/java`, and widened that runtime alias loading across `/app`, `/ajax`,
      `/js`, `/css`, and `/others` instead of limiting custom paths to
      installed skill route metadata only

3.70  2026-05-13
    - moved skill route metadata to `config/routes.json` and changed the
      schema to the flat custom-path form, where each public path maps to one
      local smart route string or an object with `to` and optional `type`
    - expanded custom skill route support beyond Ajax so installed skills can
      publish fallback custom paths for `/app`, `/ajax`, `/js`, `/css`, and
      `/others` without breaking the smart longest-prefix parent routing
    - kept saved skill-page Ajax URL generation on the canonical custom path
      from `config/routes.json`, with Ajax custom routes defaulting to `json`
      unless an explicit route-level `type` is supplied
    - fixed browser `/system/status`, page-header status, and `dashboard ps1`
      indicator ordering so managed collector indicators now follow the
      collector array order from config instead of drifting alphabetically
    - fixed `dashboard serve logs -f` so a line appended immediately after
      the initial tail output is no longer skipped by a seek-to-end race
      before follow mode starts streaming new content

3.69  2026-05-13
    - added skill-local `dashboards/routes.json` metadata so installed skill
      Ajax handlers can publish canonical custom paths, optional fallback
      aliases, and default response types such as `json`, `html`, or raw
      mime strings without breaking the smart `/ajax/<repo>/...` resolver
    - fixed saved skill-page Ajax URL generation so `Ajax(file => ...)`
      emits the declared canonical custom route when route metadata exists,
      while the longest-prefix smart `/ajax/...` route remains the primary
      resolver and custom aliases are fallback-only before a normal `404`
    - fixed browser `/system/status`, page-header status, and `dashboard ps1`
      indicator ordering so managed collector indicators now follow the
      collector array order from config instead of drifting alphabetically

3.68  2026-05-13
    - added collector overlap control with explicit `mode` and `multiple`
      config fields, defaulting collectors to singleton scheduling and
      allowing bounded parallel runs only when a collector opts into
      `mode = multiple`
    - fixed collector loop scheduling so long-running jobs no longer block
      the next interval tick for opt-in multiple-mode collectors, while
      singleton collectors still suppress overlap by design
    - made collector status updates lock-safe so active-run counts and the
      `running` flag stay correct when overlapping collector workers finish
      concurrently

3.67  2026-05-13
    - fixed managed runtime child cleanup so detached web startup helpers,
      collector stop paths, the collector watchdog supervisor, SSL frontend
      connection workers, and background page actions no longer leave zombie
      processes behind on hosts such as macOS and WSL
    - fixed the SSL frontend accept loop so child-reaping `SIGCHLD` traffic
      no longer makes the public listener shut its backend down early, while
      TERM/INT/HUP now request a clean frontend shutdown explicitly instead
      of depending on interrupted `accept()` side effects
    - tightened regression coverage so collector stop and watchdog shutdown
      tests fail if the runtime leaves direct child processes unreaped, and
      action/background SSL runtime tests now enforce the no-zombie contract

3.66  2026-05-08
    - added a collector watchdog supervisor that restarts unexpectedly-dead
      managed collector loops after startup instead of leaving them silently
      stopped until an operator notices
    - persisted watchdog restart counters, timestamps, error text, and
      `attention_required` collector status metadata so repeated crash loops
      are explicit in `dashboard collector status <name>` and collector logs
    - stopped the watchdog from thrashing forever by raising an explicit
      attention-required state after too many crashes inside the watchdog
      window, forcing a visible operator follow-up instead of silent churn

3.64  2026-05-08
    - fixed macOS Terminal.app shell bootstrap to source /etc/bashrc_Apple_Terminal
      when update_terminal_cwd is missing, preventing "command not found"
      errors on fresh macOS bash sessions

3.63  2026-05-08
    - added dockerfile manifest support to skill installation, allowing skills
      to declare Docker images that get built automatically during install
    - fixed Progress.pm to support unlimited streaming output for long-running
      operations like Docker builds, with optional max_detail_lines cap
    - added has_dockerfile metadata to skill list and usage output
    - fixed macOS Terminal.app shell bootstrap to source /etc/bashrc_Apple_Terminal
      when update_terminal_cwd is missing, preventing "command not found"
      errors on fresh macOS bash sessions

3.62  2026-05-07
    - remove matching root ddfile skill source entries when uninstalling a skill

3.61  2026-05-06
    - switched the project license from Perl_5 to MIT across the repository
      metadata, shipped LICENSE text, README, canonical POD, and Scorecard
      guardrails so the published license state is explicit and consistent
    - removed the old Artistic sidecar license file and Perl dual-license
      wording so the repo no longer advertises conflicting licensing terms

3.60  2026-05-06
    - documented the open-source license disclaimer more explicitly in the
      canonical POD and synced README, making it clear that the software is
      provided "as is", no warranty is given, and normal free-software use is
      covered by the project's baseline liability disclaimer

3.59  2026-05-06
    - fixed shared skill-nav discovery so nested installed skill trees such
      as `skills/ho/skills/coverage/dashboards/nav/index.tt` now render on
      the nested skill route itself and also join the shared nav strip above
      normal saved pages such as `/app/index`
    - taught the skill dispatcher to recurse through nested installed
      `skills/<repo>` trees when collecting skill nav pages for the web UI,
      while preserving deterministic order and disabled-skill filtering
    - fixed layered skill nav route-id discovery so `dashboards/nav/*`
      recursively includes nested fragment paths instead of only direct files
      in the first `nav/` directory

3.58  2026-05-06
    - stamped dashboard-managed helper bodies with an explicit
      `developer-dashboard-managed-helper-version` marker so installed hosts
      can prove which helper build they actually have when staged helper
      behavior drifts from the active tarball
    - fixed Debian-family bash bootstrap installs and repairs so
      dashboard-managed shell lines are kept above the standard
      non-interactive `return` guards in `~/.bashrc`, including the Ubuntu
      single-line `[ -z "$PS1" ] && return` form, which keeps
      `dashboard ticket` tmux status commands working on installed hosts such
      as `hp.local`
    - taught `dashboard doctor` to audit and repair that misplaced
      `~/.bashrc` bootstrap shape with `dashboard doctor --fix`
    - fixed Windows `.cmd` and `.bat` command dispatch on Linux, WSL, and
      packaged-install hosts so an extensionless local `cmd` helper found in
      `PATH` is normalized back to `cmd.exe` instead of being treated as a
      custom command processor
    - taught `dashboard doctor` to audit staged helper drift under
      `~/.developer-dashboard/cli/dd/`, report stale or missing
      dashboard-managed helpers such as `_dashboard-core`, and restage them
      with `dashboard doctor --fix` when the currently shipped helper assets
      can repair the runtime
    - added direct regression coverage for extensionless `cmd` shims, stale
      helper staging, and shell bootstrap drift through both source-tree and
      packaged-install paths
    - fixed packaged helper asset discovery so tarball, PAUSE, and `cpanm`
      install-test trees keep resolving `share/private-cli` from a stable
      absolute module source path even after later `chdir` calls in
      long-running test processes
    - hardened the post-build smart-router two-stage Docker guard so one
      transient upstream `cpanm` fetch or unpack failure is retried once
      before the repository packaging gate is treated as broken
    - fixed the installer docs so they match the real checkout/master
      bootstrap behavior and the current shell-bootstrap repair workflow

3.45  2026-05-05
    - fixed Unix-like `install.sh` so blank streamed installs no longer fall
      back to the stale `Developer::Dashboard` CPAN target; when no explicit
      `DD_INSTALL_CPAN_TARGET` override is set they now install the current
      checkout directly or clone GitHub `master` into a temporary checkout
      for `curl ... | sh` style bootstraps
    - added `tmux` to the shipped `aptfile`, `apkfile`, `dnfile`, and
      `brewfile` bootstrap package sets because `dashboard ticket` is a
      first-party tmux workflow
    - fixed blank Ubuntu bootstrap coverage so Debian-family installer docs
      and tests now prove the extra XS build header requirement for the live
      `cpanm` dependency chain instead of silently assuming the base image
      already ships it

3.43  2026-05-05
    - fixed managed helper staging so upgraded home runtimes remove
      dashboard-owned older flat helpers from `~/.developer-dashboard/cli/`
      and keep the active built-in helper surface converged on
      `~/.developer-dashboard/cli/dd/`
    - added direct staged-helper regression coverage so the managed
      `dashboard shell bash` helper itself must emit the ticket tmux status
      bootstrap after staging, not just the repo checkout command path
    - fixed the blank-environment integration image so host-built tarball
      installs now include the native CPAN build packages required by
      XML::Parser, Net::SSLeay, and related transitive prerequisites
    - switched the blank-environment integration image to a real Debian
      Chromium runtime so browser smoke checks no longer die on the Ubuntu
      snap-wrapper launcher stub
    - fixed the host-side blank-environment launcher so it rebuilds the
      integration image from the current Dockerfile before running the
      installed-runtime smoke, preventing stale cached images from hiding
      browser-runtime fixes

3.42  2026-05-05
    - fixed blank-mac `curl ... | sh` bootstrap so `install.sh` now
      bootstraps Homebrew automatically before reading the repo `brewfile`
      and continuing the normal macOS package flow
    - fixed Linux runtime lifecycle isolation so `dashboard restart` and
      `dashboard stop` no longer adopt or kill Developer Dashboard web and
      collector pids that belong to a different pid namespace such as a
      sibling Docker container
    - added Docker-style rolling detail lines to `dashboard skills install`
      so long-running dependency manifests keep the epic task board visible
      while streaming the newest manifest output under the active step
    - fixed tmux ticket-session prompt/status behavior so existing and new
      `dashboard ticket` tmux sessions suppress inline prompt indicators,
      move the full indicator strip into the first row of a two-line bottom
      tmux status block, keep tmux's normal indexed session/window row
      beneath it, preserve TT-backed percentage indicators and live
      collector values, refresh automatically through tmux status updates,
      and leave ordinary tmux sessions on the normal inline prompt path

3.40  2026-05-05
    - moved prompt indicators out of inline shell prompts and into tmux
      `status-right` whenever the generated shell bootstrap runs inside tmux,
      while keeping the existing prompt indicators outside tmux
    - added a dedicated `dashboard ps1 --mode tmux-status` formatter and a
      `--no-indicators` prompt path so bash, zsh, POSIX sh, and PowerShell
      all share the same tmux-aware indicator behavior

3.37  2026-05-02
    - added an explicit InternalCLI coverage guard for installed layouts where
      File::ShareDir already returns the private-cli root, keeping the numeric
      Devel::Cover gate at 100 percent after the Windows bootstrap fixes
    - added a Windows smoke guard that re-enters a fresh profile-loaded
      PowerShell session after install.ps1 so the streamed bootstrap must
      resolve `dashboard`, print `dashboard version`, and run
      `dashboard logs`

3.36  2026-05-02
    - fixed the generated PowerShell profile bootstrap so fresh Windows
      sessions no longer try to pass the multi-line `dashboard shell ps`
      output array straight into `Invoke-Expression`
    - fixed the streamed Windows installer so `irm .../install.ps1 | iex`
      now writes a self-contained profile block that can load `dashboard`,
      `local::lib`, and the PowerShell prompt bootstrap in future sessions

3.35  2026-05-02
    - fixed the installed private helper asset lookup on Windows so
      `dashboard init` no longer stops at an empty
      `MSWin32-x64-multi-thread/auto/Developer/Dashboard/private-cli`
      directory when the real shipped helper assets live under
      `auto/share/dist/Developer-Dashboard/private-cli`
    - fixed the streamed Windows checkout bootstrap so a blank host can now
      finish `dashboard init` after `irm .../install.ps1 | iex`, stage the
      home helper runtime, and continue into the generated PowerShell shell
      bootstrap cleanly

3.34  2026-05-02
    - fixed the installed private helper asset lookup so Windows local::lib
      installs no longer look for `_dashboard-core` under the wrong arch-auto
      path when the shared dist asset root actually lives under
      `auto/share/dist/Developer-Dashboard/private-cli`
    - fixed the streamed PowerShell bootstrap so `install.ps1` now runs
      `dashboard init` before activating `dashboard shell ps` in the current
      shell, ensuring the staged home helper runtime exists before the
      bootstrap asks for PowerShell shell wiring
    - fixed the generated PowerShell profile guard so future sessions only ask
      `dashboard shell ps` for bootstrap output after the staged home helper
      runtime exists under `~/.developer-dashboard/cli/dd/_dashboard-core`

3.33  2026-05-01
    - fixed the packaged install metadata so blank Windows hosts no longer
      pull test-only dependencies such as `Plack::Test` and `Test::Pod`
      during `cpanm --notest Developer::Dashboard`, which previously dragged
      the `Test::SharedFork` chain into the streamed PowerShell bootstrap and
      broke fresh installs
    - fixed the streamed Windows checkout bootstrap so it now installs from
      the current GitHub checkout shape cleanly on Windows, including the
      Windows-safe `Makefile.PL` version path and the self-healing private
      helper staging path used by lightweight commands such as `dashboard
      encode`
    - fixed the PowerShell bootstrap so `install.ps1` now sets the CurrentUser
      execution policy to `RemoteSigned` before writing the generated profile,
      allowing new PowerShell sessions to load the `dashboard shell ps`
      bootstrap instead of failing with `running scripts is disabled`
    - fixed the generated PowerShell profile block so `PERL_MB_OPT` is now
      written with format-string quoting instead of nested literal quotes that
      broke new sessions with `Unexpected token '$ddInstallRoot""'`
    - replaced the repository PSGI test dependency on `Plack::Test` with a
      local harness under `t/lib` so the release metadata can stay focused on
      real runtime requirements while the web route coverage still stays
      intact
    - corrected the install bootstrap docs so the Windows examples use the
      `install.ps1` entrypoint and describe the lighter packaged install path

3.30  2026-05-01
    - fixed the streamed Windows bootstrap so native `winget` command output
      is written to the host terminal instead of leaking into typed helper
      return values, which previously broke the Strawberry Perl path hand-off
      during `irm .../install.ps1 | iex`
    - fixed the Windows Perl bootstrap so `install.ps1` no longer tries to
      self-install `App::cpanminus` while the downloaded `cpanm` bootstrap
      script is still running, avoiding the Windows file-replacement failure
      that broke the `local::lib` setup step on blank hosts
    - documented the exact streamed PowerShell bootstrap command as
      `irm https://raw.githubusercontent.com/manif3station/developer-dashboard/refs/heads/master/install.ps1 | iex`
      and updated the Windows install docs to describe the standalone
      `cpanmin.us` plus `local::lib` bootstrap flow accurately

3.28  2026-05-01
    - renamed the Windows checkout bootstrap entrypoint from `install.ps` to
      `install.ps1` so the shipped filename matches normal PowerShell script
      expectations while keeping the streamed `irm ... | iex` flow explicit
    - hardened the Windows bootstrap winget path so package installs are
      pinned to the community `winget` source and the installer performs one
      `winget source reset --force` plus source refresh retry before failing
      with a clear HRESULT-style exit code

3.27  2026-05-01
    - added a repo-root `install.ps1` bootstrap entrypoint for Windows
      PowerShell hosts so blank-machine installs can bootstrap Git,
      Strawberry Perl, Node.js, user-space Perl tooling, and the dashboard
      runtime from a checkout or a streamed `irm ... | iex` flow
    - updated the install bootstrap docs, release metadata guards, and
      shipped tarball asset checks so the Windows bootstrap path is tracked
      alongside the existing Unix-like `install.sh` flow

3.26  2026-04-30
    - changed the blank-container tarball installation gate to use
      `cpanm --notest` after the normal source-tree test and coverage gates
      have already passed, so packaged dependency resolution and installed
      runtime behavior stay verified without rerunning the full tarball test
      suite
    - updated the blank-environment integration runner, release docs, and
      integration guardrails so the post-build `t/44-smart-router-two-stage.t`
      check and the broader tarball integration flow both follow the same
      `cpanm --notest` policy

3.25  2026-04-29
    - fixed the installed Dancer web stack so the public `/app`, `/ajax`,
      `/js`, `/css`, and `/others` routes now reuse the backend smart route
      dispatcher instead of bypassing skill-local namespace resolution
    - added PSGI coverage that proves top-level and nested skill-local app,
      ajax, js, css, and others routes all work through the real installed
      web route layer
    - added the post-build `t/44-smart-router-two-stage.t` guard and wired the
      blank-environment host integration launcher to run it immediately after
      `dzil build` so extracted-dashboard routing regressions are caught at the
      tarball stage instead of only in source-tree tests
    - fixed helper-login blank-editor rendering so a helper user who lands on
      the root editor path still sees helper chrome, including the logout link
      and helper username, during installed integration runs

3.24  2026-04-29
    - added skill-local web namespaces for `dashboards/ajax/*` and
      `dashboards/public/{js,css,others}/*` so installed skills can serve
      saved Ajax handlers and public assets without copying them into the
      shared dashboard roots
    - added longest-prefix route resolution so `/app`, `/ajax`, `/js`,
      `/css`, and `/others` can distinguish skill prefixes from normal nested
      global paths and can also resolve nested child skills under
      `skills/<repo>/...`
    - kept nested global saved-bookmark assets and saved Ajax files working
      even when their leading path segments match an installed skill name

3.23  2026-04-29
    - fixed the README source-of-truth process so the checked-in README.md is
      regenerated from the canonical Developer::Dashboard POD instead of being
      hand-edited independently
    - added a checkout sync helper and release-metadata guard so README.md
      must exactly match the generated Markdown output from the canonical POD
    - fixed the JS fast-check wrapper so npm update-notifier chatter does not
      break the stderr-clean fuzz gate on newer npm releases

3.22  2026-04-29
    - regenerated README.md as real Markdown instead of accidental POD content
    - added a release-metadata guard so README.md cannot silently regress back
      into POD format

3.21  2026-04-29
    - removed the final stale API Dashboard POD example from the public
      dashboard entrypoint so the extracted API and SQL dashboards are now
      fully pruned from core code, docs, POD, tests, and shipped assets

3.20  2026-04-29
    - fixed bare dashboard skills install so a first successful install from
      the home root ddfile is reported as installed even when the skill ships
      no .env VERSION metadata, instead of showing unknown with blank version
      markers
    - fixed named collector stop summaries so dashboard stop collector NAME
      still reports the stopped collector row when the managed loop is alive
      but its process title has not become observable yet

3.19  2026-04-29
    - extracted optional browser workspaces out of the core distribution,
      leaving the core runtime seeded-page set and manuals focused on the
      features that still ship in Developer Dashboard itself
    - removed core seeded-page handling, runtime bootstrap wiring, release
      metadata assertions, and shipped browser tests for the extracted
      optional browser workspaces
    - moved the extracted page assets, dedicated tests, and supporting
      notes out of the core repository tree so the default core tarball no
      longer carries that optional feature set

3.19  2026-04-29
    - fixed dashboard stop and restart so they follow the saved managed
      listener port back to the real serving pid when the live web process
      renames itself into the underlying starman master listener shape
    - fixed minimal Docker lifecycle control so container stop/restart runs no
      longer lose ownership of the active listener after startup
