# @nannier-com/lookout
## 0.59.6
### Patch Changes
- f3601fd: The visual gate captures the half of a card that is below the fold.
`shots` took every view with a full-page screenshot, and on this page that is
the viewport and nothing else: the page sets `body { overflow: hidden }` and
scrolls the board inside its own container, while a card runs to about 1400px.
Everything past roughly a card's midpoint was in no capture at all. The comment
on the `board-done` view claimed it was the one shot carrying both halves of a
pre and post fix pair; it carried the top of that card, and the pair section
began 60px below the frame.
Measured against the commit that rewrote that section from a horizontal strip
into two columns: the full-page capture reports the two revisions identical at
both 1440x950 and 430x900, and a capture clipped to the card reports 45% and
32% of its pixels changed. The acceptance list, the record timeline and the
paths were unreached the same way, the timeline and the paths in every single
view.
`shots` now also takes four `section` captures, which scroll a card's divider
into the board's scroll container and clip to the card: the settled issue's
pair section, which is the only one with both halves, and the still-open one's,
which pairs a single frame with the alert standing in for the frame that does
not exist yet, each at the default size and at a narrow viewport where two
columns are what breaks. The open card's clip runs on past its shorter pair
section to take in the record timeline.
A section capture names the card by what it holds rather than by where it sits,
so it fails loudly when that markup goes instead of quietly framing a different
card, and its height is fixed rather than measured from the section, so a
layout change reports as pixels inside a stable frame with a crop rather than
collapsing into `diff`'s size alarm. Each height stops above the "On disk"
paths, which are absolute and would make a view differ between checkouts rather
than between revisions, and the capture checks that it did rather than trusting
the number.
## 0.59.5
### Patch Changes
- 1e95c04: An issue's pre and post fix screenshots stand in two columns.
The pairs were laid out along a horizontally scrolling strip: one pair beside
the next, each pair's two frames beside each other. A card is about 490px wide
on the default board, and two 144px tiles with their captions do not fit in
that, so the post-fix frame was clipped at the card's edge and every pair after
the first was off-screen behind a scrollbar nothing announced. The comparison
the section exists to show was the part you could not see.
The pairs now stack down the card, one view per line, with the frame from
before the fix in the left column and the one from after it in the right. A
header names the two columns once, so each tile is the picture alone and grows
with its column instead of sitting at a fixed 144px beside a caption that
repeated what the view's own label already said. The frames stop growing at
380px, the width of the thumbnail behind them, so a card with the judge's
column folded away shows bigger evidence rather than upscaled evidence.
## 0.59.4
### Patch Changes
- 502b037: The tool picker survives a refresh, and a refused run says why.
Two defects the page shared: it threw away an answer it already had.
The picker reconciled what the browser remembered against the tool list before
that list had arrived. An empty list is the fetch not having landed yet, not a
machine with no tools on it, so every remembered key was filtered out as
unknown and the selection reset to the first tool on every refresh. The
reconciliation now waits for a list with something in it.
The play button posted to `/api/check` and discarded the reply. The server
refuses a run for reasons a person can act on, and says which in the 409 it
answers with: a target that is down, a device that is not booted, an issue
being fixed in that tree right now. All of it was dropped, so the button was
indistinguishable from one wired to nothing. The reason now lands in the notice
beside the project path, where every other refused request already went.
## 0.59.3
### Patch Changes
- cce2c7e: The tool toggle shows which tool is selected, and its marks actually paint.
Two defects, one control. The marks lookout draws for Claude Code and Codex
carried no `xmlns`, and the page shows a mark through an ``, which parses
it as a standalone document with no HTML parser to imply the SVG namespace: both
failed to load, silently, leaving two 16px holes. And the selected tool was
drawn as a ghost button while the unselected one was outlined, so turning a tool
on took its border away. With both on, the picker was two words of plain text.
A selected tool is now the filled one and an unselected tool is bare, at the
same height either way, so pressing one no longer moves the row. A mark that
asks for `currentColor` is resolved against the live theme before it is encoded,
because an `` has nothing to inherit from and would otherwise paint the
Codex mark black on a dark page.
## 0.59.2
### Patch Changes
- 2e42b80: The page tells Canvas's stylesheet which scheme it is in.
Canvas resolves the colour scheme in React and paints its own components from
it, which is why the dashboard looked dark. Its CSS token layer is a separate
half that keys off a `.dark` class on the root element, and the kit does not put
it there: reaching into the DOM is something Canvas forbids itself, so applying
the class is the consuming app's job and lookout was not doing it.
The effect was a page running Canvas's light custom properties underneath its
dark components. The document behind everything was painted white, which showed
wherever the components did not cover it.
This does not settle the browser's own chrome. Scrollbars, the text caret and
native form controls are painted by the browser, and it decides from the CSS
`color-scheme` property, which nothing in the kit declares yet. That belongs in
Canvas's web stylesheet beside the `.dark` block it already ships.
## 0.59.1
### Patch Changes
- 710877e: The settings drawer scrolls, so the settings below the fold are reachable.
The panel already wrapped its contents in a scroll view, but nothing gave that
view a height to scroll within: it grew to fit its content, the drawer clipped
the overflow, and everything past the fold was simply unreachable. On a 1001px
viewport the panel wanted 1324px, so the judge rows and the delete control were
gone with no way to reach them.
Bounding the panel to the drawer that holds it is the whole fix. It was going to
get worse rather than better: a second judge row added 176px to the panel, and
each AI added later adds another.
## 0.59.0
### Minor Changes
- fa2bf1b: Three more design directions ship: `terminal-native`, `cinematic-product` and
`friendly-saas`.
A project declares a direction so the taste panel judges against the look it chose instead
of against defaults, and so what it chose on purpose stops being filed as a tell. The four
directions that shipped until now left common looks uncovered, and a project whose look had
no preset had to write its own file or be judged against generic defaults.
`terminal-native` is the near-black working surface where monospace is a working typeface
and code is the content. `cinematic-product` is the near-black screen carrying one
full-bleed image, monumental display type and a single action. `friendly-saas` is the light
ground with one bright accent, generous rounding, illustration doing real work and a
second-person voice.
Each says what it settles, so those are never filed, and what it adds, in the attribute
vocabulary the taste panel already files under. Written as judging criteria in lookout's
own words, the way the taste tells were.
The preset list in a generated config now reads from the registry rather than repeating it,
so the two cannot drift apart again.
### Patch Changes
- d2d9522: `stopWatching` now stops: it unsubscribes from the project change instead of
only closing the watchers.
A stopped watcher kept the subscriber `startWatching` had registered, so the
next `setCurrentProject` re-armed `fs.watch` on the new project and scheduled a
reaction that pumped that project's queue, dispatching a handoff nobody had
asked for. In one `lookout ui` process this only shows at shutdown; in the test
suite, which runs every file in one process, the subscriber left behind by one
file fired inside later files and failed a gate on roughly half its runs.
Starting twice now registers one subscriber rather than two, and a reaction
already in the air when the watcher is stopped returns before it dispatches.
## 0.58.0
### Minor Changes
- a2f5d2c: A project can declare the colour schemes it ships, and lookout stops photographing and
judging a scheme it does not have.
`scheme` says how an app switches appearance. The new `schemes` says what there is to
switch to. Left out, both are still walked, because a project that has not said cannot be
assumed to have one. Set, the walk is exactly those.
This closes a false finding. Every route used to be photographed in dark and light
whatever the project shipped, so an app with a single appearance produced two identical
captures, and two identical captures read as a scheme mechanism that failed. lookout was
asserting a capability the project never claimed. A project that declares one scheme is
now photographed once per route, which also halves its shots, and the byte-identical check
cannot fire because there is no pair to compare.
Where nothing is declared and the captures do come out identical, the finding now names
both causes it could have: a scheme switch that did nothing, or a project that ships one
appearance and should say so.
## 0.57.0
### Minor Changes
- 92a24d2: Warn when a target is serving a build older than the source, and stamp the run that
photographed it.
A verdict is only as good as the pixels it was made from. A server holding a stale build
renders a page that is complete, valid, and not the code that was written, so the run
comes back clean and wrong, which is worse than a missed finding because nothing in the
report says to look again. lookout already said exactly this about its own build in
`warnIfStale()`; the reasoning had never reached the app being photographed.
Every capturing verb now compares what a target volunteers about the age of what it served
against the newest source file on disk, and prints the gap before the browser launches.
The run records it too, in its flags, so an issue filed from a suspect run carries that
doubt with it. Nothing is refused and nothing is rebuilt: lookout never starts services,
so it reports and leaves the run to the operator.
No configuration. A server that sends no `Last-Modified` is silent, which is the
hot-reload case where the page is compiled per request and already fresh, and where the
source walk is skipped entirely.
## 0.56.0
### Minor Changes
- 4972d0b: A check can now be judged by two AIs.
New user-visible capability: `lookout check --challenger codex:gpt-6-astra` has
a second AI rule on what the first one filed against the same screenshots. It
agrees or disputes each finding and adds anything it missed, and the finding
carries both accounts into the backlog.
The flag names an AI and a model together, and is refused rather than ignored
when either is missing or unusable: a flag somebody typed and lookout silently
dropped is how a run comes to cost one judge's money while its operator believes
two were watching. An AI cannot challenge itself, because a second opinion from
the same AI on the same evidence is the refuter, which already runs.
A verdict two judges reached is not a verdict one reached, so the judging roster
now enters the ledger's prompt hash. Two consequences worth knowing. The first
check after upgrading re-judges rather than serving cached verdicts, once.
And the roster is hashed sorted, so which AI proposed can change between runs
without turning every run into a cache miss.
A batch whose second judge could not be reached is kept but not cached. The
proposal is real and stands; caching it would durably record a dialogue that
never happened under an identity claiming two judges agreed. This is deliberately
the opposite of how a failed refutation is treated: a refuter can only annotate,
so its absence is a missing note that a later pass repairs, while a challenger
can add findings, so its absence is a missing verdict.
## 0.55.0
### Minor Changes
- 2f75058: Two judges can reach one account of what is wrong.
New user-visible capability: a second AI can be asked to rule on what the first
one filed against the same screenshots, agreeing or disputing each finding and
adding what it missed. A finding then carries both accounts. This release is the
dialogue and its instruction file; the run does not yet start one, which is the
next change.
The decision the rest follows from: **the second judge answers by number.** It
is handed the findings numbered and rules on each positionally, and it never
restates a finding's category or attribute. Those two fields are half of a
finding's fingerprint and half of the cluster key that mints its issue id, and
they are the only ones a model writes freehand: a challenger allowed to reword
them would turn one defect into two the moment it agreed in different words.
Answering positionally, it cannot diverge on an identity it never writes. Only
its own additions carry free text, and those go through the ordinary judge
ingestion with the same lane, the same vocabularies and the same caps.
Disagreement is kept, not applied. A disputed finding is still filed and still
open, and a dispute changes no status and no severity; both accounts are on the
record and a person decides. Letting one AI close or downgrade another's
finding would hand a single vendor a veto over the backlog.
Nothing the second judge says is trusted. An unrecognised verdict word, a number
pointing at no finding, a second verdict for one finding, or a dispute with no
reasons is treated as absent, leaving the first judge's finding standing. Never
as a dispute: a mangled reply must not be able to cast doubt on work somebody
has to act on.
A challenge that fails is not fatal and not silent. The proposal stands alone
and the batch is reported as undialogued, so it can be left out of the cache
rather than durably recording a dialogue that never happened.
The skill is written for whichever AI reads it, and the second judge speaks in
its own voice in the transcript, so two AIs working one panel can be told apart.
## 0.54.6
### Patch Changes
- bccbc3b: Replace the browser interface with a bundled React Native Web application built entirely from Canvas components and primitives.
## 0.54.5
### Patch Changes
- f298f5f: A finding can record what the judging AIs said about it.
Groundwork for two AIs judging together: a finding may now carry which AI filed
it, which agreed, and which disputed it with its reasons. Nothing writes it yet;
this release is the shape, its validation and the rules that keep it honest.
Three of those rules are worth stating, because each is a way the feature could
have gone wrong:
It is never part of a finding's identity. Two AIs agreeing about one defect must
produce one row in the backlog, and an identity that carried who spoke would
split it the moment the second agreed. A test pins the fingerprint and the
cluster key as byte-identical with and without a dialogue.
A dispute is not a status. `FindingStatus` stays closed at its four values and
"disputed" is derived when a card is drawn, because an objection is a caveat on
open work rather than an adjudication. Letting one AI's disagreement close
another's finding would hand a single vendor a veto.
The record is refreshed by a run that held a dialogue and never cleared by one
that did not. A run whose challenge call failed carries no verdict, and silence
must not erase the dispute the last run recorded, for the same reason a run with
the refuter switched off does not erase its note.
No backlog schema bump: every field is optional and absent-tolerant, no record
is rewritten, and no fingerprint moves. Absence reads as unknown rather than as
whichever AI happens to be configured, so an old finding is never stamped with a
verdict it never got.
## 0.54.4
### Patch Changes
- 3971a6a: Keep the browser validation fixture on the current route identity format so startup remains repair-free and deterministic.
- 8c75075: Make browser validation independent of a locally installed Claude CLI by supplying a deterministic fixture probe.
- 1e58051: Validate the real browser UI and an isolated install of the packed npm artifact before releasing.
## 0.54.3
### Patch Changes
- 5155614: Serialize persistent state changes across Lookout processes and replace fixed temporary files with durable atomic writes.
## 0.54.2
### Patch Changes
- 5716833: Prevent distinct routes from sharing screenshot paths, finding fingerprints, and accessibility issue keys. Existing unambiguous evidence migrates automatically, while legacy pixels from colliding routes are discarded for recapture.
## 0.54.1
### Patch Changes
- e7f7fc3: The skills no longer name the AI reading them.
Every shipped instruction file said what to judge and never who was judging,
with five exceptions that all said the same thing: "read the screenshot with
the Read tool". That is one CLI's vocabulary, and it reads perfectly well right
up until a second AI is handed the same file and told to use a tool it does not
have. The sentence is now a `{{howToOpen}}` placeholder each adapter fills in
its own words, and `renderSkill` already refuses a prompt with an unfilled
placeholder, so an AI added later cannot forget to supply it. One reference to
a named design tool went the same way.
A test now holds the rule, because it is the kind that decays silently: these
files are prose, they can be edited by hand or amended by lookout itself, and
nothing before this would have noticed a vendor's name reappearing.
Because the judge's composed instructions changed, their prompt hash changes,
so the first check after upgrading re-judges rather than serving cached
verdicts. That is one re-judge, once, which is the failure this cache prefers.
The clean-without-reading check now knows it cannot always run. It depends on
the CLI reporting which files it opened, and not all of them do; an AI that
cannot be audited that way is recorded as such rather than having every clean
shot demoted every run, which would re-judge the same batch forever.
## 0.54.0
### Minor Changes
- bbab7f4: Codex can judge, and its model is chosen from what the installed CLI offers.
New user-visible capability: the settings panel now carries a Codex model row
beside the Claude Code one, each a menu built from the models that install
actually offers, each with that CLI's version beneath it. Codex is a judge
lookout can ask rather than only a tool it can hand an issue to.
Two filters decide the Codex menu, and both are the CLI's own answers rather
than lookout's: `visibility`, which is that CLI's judgement about what a picker
should show, and whether the model accepts an image at all. This install lists
a text-only model among its visible ones, and a model that cannot see a
screenshot has no business in a menu of judges.
Codex is found even when it is not on PATH. It installs itself where its own
plugin manager chooses, so lookout looks at an environment override first, then
PATH, then the locations that manager uses. A moved path is data rather than a
bug, and `LOOKOUT_CODEX_BIN` names an install nobody predicted.
Four things about that CLI were established by running it rather than by
reading about it, and each is load-bearing: it hangs waiting for end of input
unless its stdin is closed; `exec` refuses to run outside a git repository, and
the judge runs in a scratch directory on purpose; its final message can be
written to a file, so a verdict never depends on parsing an event stream; and
its stream does not report opening an image. That last one means lookout cannot
run its clean-without-looking check against Codex, so the adapter says so rather
than concluding every shot went unread.
Judging still runs on one AI. This release is the adapter, the discovery and the
settings row; the dialogue between two judges follows.
## 0.53.3
### Patch Changes
- ccbe870: The CLI version under the model menu is found wherever that CLI puts its own
name.
It was read as the leading token, which is right for a CLI that prints
`2.1.263 (Claude Code)` and wrong for one that prints its name first: the whole
line came back, so a panel labelled with the tool would have said the product
name twice. The dotted number is picked out of the line instead, and a version
carrying no such number is still quoted whole rather than dropped.
## 0.53.2
### Patch Changes
- b6caf6b: Validate the prepared release commit before pushing version metadata or publishing.
CI and Release now share typecheck, lint, test and build gates. Release stops if
main advances or the checked tree changes, instead of rebasing and publishing
untested code. Automatic runs, manual runs and runs with no pending changesets
all use the same gate. Major changesets are rejected using Changesets' parsed
release plan, and the release summary reports failures without claiming a publish.
## 0.53.1
### Patch Changes
- 169dbb8: A click beside the settings panel dismisses it.
The panel floats over the board now rather than sitting in the header, so the
click people reach for to uncover what it is covering is a click beside it,
ahead of Escape and well ahead of a second trip to the cog at the foot of the
rail. There were two ways out and now there are three.
The click is spent on the dismissal and does nothing else. That matters here
because the board underneath carries the buttons that file an issue and reorder
the fix queue, and one press should not both put the panel away and move one of
those. It cancels a link's own default too: the shot tiles are anchors to the
raw PNG with target="\_blank", so without that the press that put the panel away
also left a picture open in a new tab.
It is the first thing the page's click handler asks, so that every control
counts as outside. Placed below the handlers it shares that function with, it
read as the same rule but was not: a shot tile, a rail button and the tool
toggle each answered first and left the panel open over whatever they had just
changed. The one exception is the destructive prompt, which is the only thing
that opens on top of this panel: while it is up nothing behind it is outside
anything, so answering it still finds the panel where it was.
`tools/ui-check drive` covers all of it, nine assertions checked against a
build without the change to confirm each one fails there.
## 0.53.0
### Minor Changes
- 15a7869: The judge's model is chosen from a menu of what the installed CLI offers, with
that CLI's version under it.
New user-visible capability: the settings panel reads the model names off the
Claude Code install on this machine and offers them as a menu, where it
previously took a model as free text and could not say what the valid names
were. It also prints the version of the CLI those names came from.
The old text box was reasoned, not lazy: a list of model names baked into
lookout would be wrong within a release while still looking authoritative. That
reasoning still holds, and is why the menu asks rather than declares. Nothing in
this repo names a model. The names come from the typings the CLI's own package
ships beside its binary, which carry the aliases as a union type; an install
whose binary sits outside its package (a wrapper script, a package manager's
shim) falls back to the aliases `--help` documents for `--model`. An install
that answers neither gets the text box back, because refusing to accept a typed
name would be a worse answer than the one being replaced.
A name the menu does not offer is still reachable through Custom, and a stored
name that is not in the menu comes back selected there rather than being
dropped. That keeps a pinned full model name available for judging that has to
stay reproducible across a CLI upgrade.
The version line is the other half of the same probe. It says which install the
names came from, which is what to look at when a name somebody expected is not
in the list.
## 0.52.2
### Patch Changes
- 086aeb4: The settings cog moved to the foot of the left rail, and its panel moved with it.
The cog sat in the header beside the run button, where the two controls that
have least to do with each other were adjacent: one starts a check, the other
configures where lookout is pointed, and the press that costs money was a
neighbour of the press that costs nothing. The rail already holds the page's
navigation and had an empty half below its two areas.
The cog is now the last thing in the rail, pushed to its foot. It is not a third
area: it carries aria-expanded rather than the aria-current the two area buttons
carry, and no data-view, so nothing routes to it and the area you were in is the
area you are still in when the panel opens over it. It is round where they are
rounded squares, and it never wears the accent that marks the current area.
The panel follows the button. It used to drop out of the header as a full-width
row, which pushed the whole board down every time somebody opened it; it is now
anchored beside the rail at the cog's own height, floating over the board
instead of displacing it, capped to the viewport and scrolling inside itself
when there is not room. It carries a heading, because a panel that no longer
sits under the word it opened from has to say what it is. Escape still closes
it, the cog still says "Close settings" while it is open, and the destructive
prompt still stands in front of it.
The narrow header is 28px shorter as a result: the cog was the element that
pushed the run controls onto a line of their own.
## 0.52.1
### Patch Changes
- 64a8c46: The settings panel can be dismissed with Escape, and the cog says so.
The cog was the only control that opened the panel and the only one that closed
it, while still reading "Settings" with the panel open, so the way out was a
button that did not look like one. Escape, which is what people try first, fell
straight past the panel to the filter underneath it and cleared that instead.
Escape now closes the panel, taking its turn after the confirm prompt and the
shot inspector and before the filter, for the same reason those two come first:
dismissing what somebody is looking at must not quietly clear something else.
While the panel is open the cog reads "Close settings", and its tooltip names
the key.
## 0.52.0
### Minor Changes
- 2aeec89: Minor justification (new public capability): the model a judge rules with is
chosen from the settings panel, per project.
It was a `--model` flag with a default written out in ten places, which meant
the page could not offer it and nobody running `lookout ui` could change it
without leaving the page. The panel now carries a row per AI lookout can judge
with, the choice is stored in that project's `.lookout/ui.json`, and the run the
play button starts is given it.
Per project rather than per browser, unlike the tool selector, because it is not
a preference about the reader: the ledger files a verdict under the model that
gave it, so judging a project with a different model is a different body of
evidence about that repository.
Free text rather than a menu, because the names a CLI accepts change under
lookout and a list baked into the page would be wrong within a release while
still looking authoritative. An empty box means lookout's own default, and the
panel reports what that default is rather than printing a name of its own.
The value is refused unless it could be a model name, and in particular it may
not begin with a dash: it becomes the word after `--model` in a spawn, and a
stored setting must not be able to arrive as an option nobody typed.
## 0.51.1
### Patch Changes
- 80bb38f: The taste panel after its first real run.
Calibrated with the real judge on a planted page carrying one tell per group
(ten filed, ten confirmed, none refuted; its clean twin drew none), on four
Canvas docs component specimens (eight shots, no findings: the specimen
exemption held), on twelve Canvas docs template pages (twenty-four shots, no
findings), on four routes of the Canvas app on an iPhone simulator (four
findings, all the docs app's own decorative backdrop, and not one platform
idiom filed), and on the ionize dashboard (desktop clean; at phone width one
defect, a desktop keyboard-shortcut chip left in the header, filed seven times
on five routes under two attributes).
That last result is the lesson. An element carried over from another form
factor unadapted is the geometry panel's responsive finding, not a choice
nobody made, so the taste bullet now says so, and the refuter's taste band asks
first whether the claim is a tell at all rather than a defect another lane
owns. One element is one finding: the panel is told to file an element once
under the attribute that names the cause, using the listed tokens, and the
refuter strikes a second filing of the same element. A single tell, however
prominent, opens at low; two calibration findings had opened at medium on
their own. The hand-off has to be worded as leaving the defect out of the
reply and counting the shot clean: told only that the defect was "the
geometry panel's", the judge filed it under a category named geometry,
ingestion rejected it, and a shot with only rejected findings is unruled and
re-judged every run. With the final wording the same five phone shots came
back ruled clean, nothing filed and nothing rejected. `judge-taste` rises to
3 and `refute-finding` to 7, so standing taste verdicts are re-judged once.
Directions behaved as designed on the planted page: under industrial-brutalist
the numbered section labels disappeared as waived vocabulary, and the gradient
and the rounding were re-filed under the direction's own attributes.
## 0.51.0
### Minor Changes
- 196d433: Minor justification (new public capability): the page's tool picker is a
selector rather than a switch, and two tools selected work one issue together.
Pressing the second mark used to replace the first, because an issue went to one
tool and the choice was one name. Selecting both now means both: the queue
records the list, hands the issue to the first, and gives the turn after a spent
attempt to the next one on the list instead of back to the same tool. The second
agent opens on a tree the first has already worked, and on a note it left in the
issue's own folder saying what it changed and why, so the review has the "why"
that a diff never carries.
Turns rather than a committee, because they share one working tree: two agents
in one checkout is the failure the queue's lease exists to prevent, and nothing
about selecting two tools relaxes it. One tool selected behaves exactly as it
always did, down to the same tool getting its own issue back.
A queue written by an older build names one `tool`, and is read as a one tool
list rather than migrated, so an upgrade loses no press and a downgrade strands
nothing.
## 0.50.1
### Patch Changes
- c3e5a65: A backlog nobody can read takes one request down, not the whole server.
`lookout ui` exited on a `.lookout/backlog.json` that was valid JSON without a
`findings` key. `reconcileIssues` defaults `backlog.issues` to `{}` and then
iterates `backlog.findings` on the next line without defaulting it, so the load
threw a `TypeError` from three frames below anything that could name the file
it came from. The `/api/status` route already caught that and answered 500 with
the reason on it, which was the right intent and half the paths: the same board
build is reached from the watcher's timer and from the server's own start, both
through a bare `void pumpQueue(...)`, and there a rejection is an unhandled one
and the process goes. A watcher is the first thing to see a bad file appear, so
the usual way to meet this was a `lookout ui` that had been up for hours dying
the moment something wrote a half-formed backlog underneath it. Starting one
against a project already in that state died before the first request.
Both halves are fixed, because neither covers for the other.
`loadBacklog` now imposes the shape the `Backlog` type promises on whatever was
actually parsed: `findings` and `issues` that are missing, null, or the wrong
kind of container each become an empty record. That is the one place the file
becomes a `Backlog`, and it is the only place that can say which file was
wrong; the dozen call sites below it that iterate those two keys had all taken
them on faith. An array is coerced rather than passed through even though
`Object.values` would survive one, because an id minted onto an array is a
string key and `JSON.stringify` drops those, which is precisely the forgotten
id that reconciling on load exists to prevent. Findings themselves are left
alone: a malformed one is `backlog check`'s report to make, by fingerprint, and
dropping it here would hide a defect somebody is still owed.
`pumpQueue` now holds to the property its own header claims. The catch inside
`advanceQueue` was already there and said as much, but the board build sits in
the argument list outside it, and building the board is itself a read of the
backlog.
A backlog nobody can PARSE still throws, deliberately. Reading a corrupt record
as empty would show a project whose every finding had been ruled gone, and the
next save would make that true. It reaches the page the way it always should
have: `/api/status` answers 500 with the parse error, the board recovers on the
next write once the file is repaired, and no restart is needed.
## 0.50.0
### Minor Changes
- 34f074a: Minor justification (new public capability): `direction` in `lookout.config.ts`
declares the project's design direction, as a shipped preset
(`minimalist-editorial`, `industrial-brutalist`, `premium-agency`,
`utility-dense`), the project's own DESIGN.md, or both, and the taste panel and
the refuter judge against it.
The taste panel ships judging the defaults every design practice rejects.
Beyond those, the practices contradict each other: no radius against soft
corners, gradients banned against gradients encouraged, one call to action
against exactly two. None of that is judgeable until a project says which
direction it chose, and this is where it says so. What a direction declares is
settled and never filed; the rules it adds are judged where a still can show
them, and its rules about motion, hover or code are not, because a capture
cannot see them.
lookout reads the file when it composes the prompt; the judge never opens it,
and the prompt names it by its config-relative spelling only. The first 12 KB
of a project's file reach the judge, with a Stitch-format `components:` table
dropped first when the file is over budget and a marker saying how many lines
were cut. The text is filled into the taste panel's composed prompt alone, so
it enters only that panel's cache key: editing a DESIGN.md re-judges taste and
leaves every other panel's verdicts standing. The refuter sees the same
direction in its "What the project declared" section, beside the `neverFile`
lines.
Presets ship in the package under `skills/judge-taste/directions/`; no brand's
DESIGN.md does. A legacy `.lookout/config.*` that names a direction file is
repointed when it migrates to the root, the way `rubric` is.
## 0.49.0
### Minor Changes
- db8916d: Two clear buttons in the page: one empties the judge's transcript, one deletes
everything lookout found here.
The page had no way to throw anything away. A finished run's transcript stayed
in the judge's column with only a fold button to hide it, and nothing anywhere
reset a project: no verb, no route. Starting clean meant deleting `.lookout/` by
hand, which does not work, and the way it fails is the reason both of these are
server-side rather than a wipe of the page.
What the page shows is assembled from three stores. The files under the
project's `.lookout/`; the server's caches over them, the status body and the
narration cursor, neither of which re-reads a file it has already answered from;
and the server's own memory, which for the queue is not a cache at all, since
`session.queue` is the authority and `queue.json` is only its sidecar. Deleting
the directory reaches one of the three, which is why a page whose record was
removed by hand goes on reporting the shot count and duration of a run whose
files are gone.
So the reset reaches all three. It deletes the record entry by entry rather than
removing the directory, which keeps `ui.json` with no window where the settings
exist only in this process: wiping the record and being asked to choose the
folder again are two acts, and only one of them is this. It is refused with a
409 while a run is in flight, matching stop, since deleting the workspace
underneath a capture would race the writer.
Clearing the transcript truncates the narration file rather than unlinking it,
because a run in flight holds that path and goes on appending, and it resets the
cursor, without which every open page would keep showing what was cleared.
Both ask first, through one prompt that names what it costs rather than asking
whether you are sure: the issue folders and their frozen before and after
screenshots are not in git, and no undo reaches them. Focus lands on Cancel, and
Escape and the scrim both answer no. The transcript's clear sits at the end of
the judge's header; the wipe sits in the settings panel, ruled off below the
rows that only change where lookout looks.
New routes `/api/narration/clear` and `/api/reset`, both POST, both pushed to
every open tab.
- fa736a4: A fix queue in the page: pressing play on an issue queues it, and lookout hands
one over at a time.
The play button on a card opened a Terminal there and then, so pressing it on
five cards opened five sessions into one working tree. It now writes the issue
into a queue kept at `/.lookout/queue.json`, and a pump hands over the
head, waits, and moves on.
What it waits for is lookout's own ruling. A handoff opens a Terminal this
server has no handle on, so "the fix finished" is not something it can observe;
"the defect is gone" is, because `verify-fix` writes it down. The head leaves
the queue when the board says done, archived or blocked, and the next is handed
over with nothing clicked. The handoff prompt now carries the `verify-fix`
command itself rather than leaving it near the end of `Issue.md`, and the head's
row says how long it has been waiting and offers to have lookout rule on it now,
for the case where whoever was fixing it stopped without asking.
The judge's column is split to show it: the transcript on top, the queue
beneath, each row with an X that takes it back out. New routes `/api/queue`,
`/api/queue/remove` and `/api/rule`; `/api/launch` is gone, replaced by the
first of those. Starting a check is refused while an issue is being fixed,
since a check would photograph a half-edited tree.
- 83c53d4: Minor justification (new public capability): a seventh judge panel,
`judge-taste`, files the generic defaults a build fell into under the new
`taste` category, and `--panels judge-taste` runs it alone.
The rubric's third band said every choice of palette, typeface, radius, density
and voice was the project's and never a defect. That excused the one thing a
model is best placed to see: a screen assembled from defaults nobody chose. The
band now separates DECLARED choices (a `neverFile` line, a `design:` hand-off,
and from the next release a declared `direction`) from undeclared ones.
Declared stays settled and unfiled. Undeclared is judged by the new panel
against a short list of tells every design practice in the source material
agrees on: the violet-to-blue wash and the coloured glow, three equal feature
cards, a stock hero stack, a headline wrapped into a wall, a label numbering
nothing, "scroll to explore", copy made of clichés, an error state that
apologises instead of explaining. Each is filed only when it is visible in the
pixels, opens at low, and reaches medium only when several compound until the
whole view reads as a template. On a device shot the platform's own idiom (the
system typeface, capsule and pill controls, tab bars, large titles, tonal
surfaces) is declared by construction and never a tell.
Every other panel keeps judging consequences in its own lane: `judge-craft`'s
guard sentence now hands the choice itself to the taste lane instead of
excusing it, and `judge-text` files placeholder people, brands and round
figures left on a production surface as copy that was never written.
The refuter gains a third band for these claims and a section carrying the
project's `neverFile` lines, so a taste finding that re-litigates an excused
choice is struck rather than confirmed.
Costs one more panel call per view group: six on a plain group, seven with a
design hand-off. `judge-core` rises to 12, `judge-craft` and `judge-text` to
5, `refute-finding` to 6, so every standing verdict is re-judged once. No
category was renamed, so no backlog is orphaned.
- 35bbf67: Minor justification (new public capability): the settings panel points lookout
at another project, and remembers it.
The `Project` row under the cog was a label. It is a control now: a native
folder chooser beside a box you can type or paste a path into. Choosing one
re-resolves everything scoped to a project — its config, its own base URL and
calls-to-action consent, its queue, the board and the judges' transcript — so
the page is looking at the new repository without being restarted in it.
The choice is remembered, which is what the picker this replaces could not do
without a machine-wide home. The pointer is written to the directory the server
was STARTED in (`/.lookout/ui.json`), never the one it points at: a
pointer still cannot live inside the thing it points to, and the launch
directory is the somewhere else it needed. A `lookout ui` started there again
comes back pointed where you left it, and one whose remembered project has since
moved says so and serves the launch directory rather than refusing to start.
A directory that is no project at all is still refused rather than littered, and
one that is a repository without a config gets one written, exactly as launching
the verb inside it would.
### Patch Changes
- 58d891c: An incident's `project` is only trusted when it is an absolute path.
`incidentLogDir` handed whatever it was given to `locateConfig`, which resolves
against the working directory and climbs to the nearest `lookout.config.*`. A
display name such as "p" — which is not a directory at all — therefore found the
config of whichever repository the process happened to be standing in and logged
there, bypassing the checkout `LOOKOUT_CHECKOUT` had pointed it at. Two of the
self-heal tests failed from this the moment `lookout ui` was run inside lookout's
own checkout, because that writes a `lookout.config.ts` at the repository root by
design. The field was always documented absolute; it is now enforced.
- 6cbeeb8: A card's pre/post pairs each say which route and state they picture.
The caption under a pair was form factor and scheme alone, so an issue frozen
across six interaction states of one route on phone showed "phone · dark" four
times in a row and "phone · light" four times after it, which reads as the same
screenshot pasted over and over. The pairs were always distinct; the caption was
not. It now carries the route and the state, the same words the inspector's own
label already used for the same frame.
- 9a26c21: The queue holds until the agent it launched has gone, not until lookout has
ruled.
Handing an issue over opens a Terminal this server has no handle on, so the
pump had one way to ask whether an agent was still working: the board. An
issue was busy while its attempt count stood still and free the moment a
ruling landed. That reading is wrong in the one direction that costs a working
tree, because a ruling is something an agent asks for in the MIDDLE of its
turn — it runs `verify-fix`, reads the answer, reports, keeps editing.
Both halves of "one at a time" failed on it. A still-open ruling spends an
attempt, which the pump read as the agent having given up, so it opened a
second window on the same issue while the first agent was still in the file;
the two then spent both of that issue's attempts racing each other. And a
settled ruling dropped the head and started the next issue immediately, onto a
checkout the last agent had not left. Observed on a project where four issue
windows were open at once, two of them editing one component.
The handoff script now takes a lease before it starts the tool and drops it
however the window ends, and the pump refuses to hand anything over while one
is held. Liveness is the process rather than the file, so a Terminal that was
force-quit before its trap could run does not park the queue forever: a lease
whose pid is gone is not a lease, and is cleared as it is read.
## 0.48.1
### Patch Changes
- c2d985e: **Seven defects found by auditing the last release, one of which filed findings against applications that had none.**
A route captured through an `element` selector is photographed cropped, but the affordance harvest walks the whole document, so the navigation planner could pick a control that sits outside the frame. Focusing it produced a crop identical to its rest twin and filed `focus-invisible` against an application whose focus indicator was fine, on a channel nothing refutes. A control outside the captured frame is now skipped with a reason, and hover is framed like the rest shot it is compared with rather than full-page, which also un-breaks `hover-silent`: a full-page hover could never hash equal to an element-cropped rest, so on those routes it could not fire at all.
The rest, in what they cost:
- `trimAria` was not idempotent, and every tree the judge sees is trimmed twice. Its own elision markers matched the text-run detector, so a run of twenty collapsed lines reported "1 more" on the second pass, and the trailing line-budget marker dropped the first pass's count entirely: an 800-line tree told the judge 181 lines were missing when 681 were. Both markers now carry their counts forward, and a run that ends the tree marks its loss at the run's own indent instead of at the page root, where a YAML block scalar reads it as a text node of the document.
- `verify-fix` reported measured moves the display cap had dropped as "not measured (no baseline pixels on hand)". The two remainders are now counted separately and said separately.
- A failed accessibility-tree write left `ariaHash` on the shot record without the sidecar, which cached a pixels-only verdict under a ledger key asserting the tree. The hash is written only after the file survives.
- `navigation.maxFocusStatesPerRoute` and `maxHoverStatesPerRoute` were never validated, so `"abc"` reached the planner's prompt verbatim while `slice(0, NaN)` silently turned the feature off.
- A control that will not show `:focus-visible` is now skipped, which is what the file header, the README and the release note all said it did; it was filing a `capture-error` per form factor and scheme on every run instead.
- The issue document told a fixer a focus or hover state was "reached by clicking" the control, which reproduces a different screen. `ViewFacts` carries the interaction now, so the document says it after the workspace is gone.
Plus documentation that had drifted: `judge-visibility` still asked the panel to judge control size by eye, which the rubric forbids and axe now measures; the axe impact sentence claimed a severity the ingest may have capped, and reads the real one now; and README and two code comments still justified the phone-only `target-size` hook with a form-factor gate that no longer exists.
The frozen regression set also carries the accessibility tree now. It froze the provenance sidecar and not the aria one, so `skills replay` graded `judge-integrity` and `judge-text` without evidence production gives them, on 60 of the set's 164 claims.
## 0.48.0
### Minor Changes
- 130072e: Minor justification (new public capability): lookout captures a control's keyboard-focus and pointer-hover states deliberately and judges their indicators, with `navigation.maxFocusStatesPerRoute` and `navigation.maxHoverStatesPerRoute` as the new options.
**Where the keyboard and the pointer are.** The navigation planner gains two outcomes. `focus` presses Tab to put Chromium into keyboard modality, focuses the one control it named, and verifies the browser really is showing it as keyboard focus; a control that will not show one is skipped rather than photographed, because that shot would file lookout's own capture as the application's defect. `hover` rests the pointer on a control, waits for anything on a JS delay, and is skipped at phone width where there is no pointer. One of each per route by default, counted separately from `maxStatesPerRoute` so a route spending its budget on overlays can still have them. Their shots are named `focus-` and `hover-`.
**This narrows a rule the rubric was right to have.** Focus rings were never filed because nothing in a rest, overlay or in-page shot holds focus on purpose, so a ring there is an accident of what was clicked last. That still holds everywhere except a shot whose manifest line says lookout put the keyboard on a named control, where that one control's indicator becomes judgeable. Focus ORDER remains never-file: a still shows which control has focus, never how it got there.
**The half a judge cannot see is measured.** A screenshot never draws the cursor and a judge sees a state's view group without its rest sibling, so "hovering did nothing" is a comparison, not something visible in the evidence. lookout compares each indicator shot with its own rest shot and files `focus-invisible` (`a11y`) or `hover-silent` (`states`) when they are identical, one-sided on purpose: identical pixels prove the interaction did nothing, different pixels prove only that something moved.
`judge-core` rises to version 11 because the shared rubric changed, so every panel's standing verdicts are re-judged once, in every project. `plan-navigation` rises to version 4, and a cached plan made by an older planner is now re-planned even when the route's controls have not moved, since otherwise no existing project would ever receive one of these states.
Not graded against the frozen regression set: the family replay that would have measured whether the narrowed rubric costs any settled claim was stopped before it finished. The four gates are green and the behaviour was verified against a served fixture, but the judging-policy half of this change ships on that evidence alone.
### Patch Changes
- 0283a85: **The craft panel can name two things it was already looking for.** `judge-craft`'s `composition` bullet now names structure that encodes nothing (step numbers on items that are not a sequence, eyebrow labels and dividers that separate nothing, so the reader looks for an order that is not there) and emphasis spent everywhere at once (gradients, glows, shadows or accent colour on many unrelated elements, so no element reads as the point and the decoration is easier to find than the content). The `consistency` bullet gains one role in two accent colours, where two different "primary" colours on controls of the same rank leave the reader unable to tell which action is primary.
A guard comes with them: a palette, a typeface pairing or a layout recognisable as a common default is not itself a finding, only its visible cost on this screen is. That is the line between a defect and a preference, and without it this edit would invite exactly the taste the panel is told to leave out.
Paraphrased from Anthropic's `frontend-design` skill (Apache-2.0), inverted from guidance for making a page into criteria for judging one, and credited in the skill's front matter. `judge-craft` rises to version 4, so its standing verdicts are re-judged once.
## 0.47.4
### Patch Changes
- a0899a3: **lookout keeps nothing in a home directory of its own.** `LOOKOUT_HOME` is
gone, `~/.lookout` is never read or written, and `src/home.ts` is deleted.
Everything lookout writes about a project is in that project's gitignored
`.lookout/`, and everything it writes about itself is in its own checkout's.
The one file that travels with a repository is `lookout.config.ts` at its root.
`lookout doctor` reports a leftover `~/.lookout` when it finds one and says it
is safe to delete; nothing deletes it, and nothing migrates out of it. A run
that still has `LOOKOUT_HOME` exported prints one line saying the variable is
no longer read, so an operator is told rather than left wondering where their
state went.
## 0.47.3
### Patch Changes
- f27ae4e: **`lookout ui` serves the project it is started in.** The page no longer asks
for a folder or remembers one: start it in a project and it reads the
`lookout.config.ts` at that root, writes one when the project has none (with
the `.lookout/` ignore line beside it), and keeps its base URL and its
calls-to-action consent in that project's own `.lookout/ui.json`. Started in a
directory that is no project at all, it refuses and says how to proceed instead
of leaving files there. `--url` and `--config` are unchanged and still write
nothing.
To look at another project, restart the page there. What that gives up is a
running page that could be re-pointed, and the native folder picker that did
it; what it buys is that lookout keeps nothing in a home directory of its own,
and that the page's settings travel with the checkout they describe. The
consent is still stored against the directory it was given for, so a
`.lookout/` copied into another checkout does not carry permission to click
that one's controls.
`~/.lookout/ui.json` is no longer read or written. Nothing now reads
`~/.lookout` at all.
## 0.47.2
### Patch Changes
- 1a6561a: **`self-heal` keeps its own record beside the checkout it edits.** The lock,
the heals that stuck and every reverted attempt's diff, gate output and raw
reply now live under `/.lookout/self-heal/` instead of under
`~/.lookout`. The lock guards a checkout, which is what it was always for: two
heals in one checkout revert each other's work and commit the result, and a
lock kept anywhere else was guarding the wrong thing. A heal is a commit in
that repository, so a settled group stays settled whichever project the next
run starts from.
`self-heal` now refuses to run in a checkout that does not ignore `.lookout/`,
naming the fix, because a failed gate reverts with `git clean -fd` and would
otherwise delete the attempt it had just written and the log it read to choose
the work. lookout's own repository has ignored it all along.
An installed package has no checkout, so it has no heals, no attempts and no
lock, and the learning area of `lookout ui` renders that state rather than
assuming a directory exists. `~/.lookout/heals.jsonl` and
`~/.lookout/self-heal/` are no longer read or written; only the ui's settings
still live in the home.
## 0.47.1
### Patch Changes
- 7474f2e: **Incidents are recorded where they happened.** What goes wrong with lookout
itself, crashes, operator errors, judge replies that could not be parsed and
findings rejected at ingestion, is appended to
`/.lookout/incidents.jsonl` instead of to one file per machine. A
failure with no configured project in scope goes to lookout's own checkout,
and on an installed package, which has no source to heal and no `self-heal` to
read the log, it is dropped rather than written into whatever directory the
command was run in.
`lookout check` and the learning area of `lookout ui` now report the failures
of the project in front of them. `lookout doctor` reads both the project it was
run in and lookout's own checkout, and prints which logs it read, so "none
active" cannot be mistaken for "nothing has ever gone wrong". `lookout
self-heal` reads its own checkout, the project it was started in, and the one
`--project` names; what that gives up, and it is a real loss, is clustering
across projects, so a bug seen once in each of three projects no longer adds up
to one heavy group.
An incident's `project` is a directory at every write site now. Ten of them
recorded the display name from the config, which made the field useless for
finding a project that could grade a replay; the judge, the refuter and the
reply ingest are handed the project's directory to make that true.
`~/.lookout/incidents.jsonl` is no longer read or written. Nothing is migrated:
old entries name projects by display name as often as by path, and the log ages
out its own entries after 90 days.
## 0.47.0
### Minor Changes
- eebadf3: Minor justification (new public capability): every web shot now carries the page's accessibility tree as evidence, and two judge panels rule with it; `aria: false` and `--no-aria` are the new ways to decline it.
**The judge gets one piece of evidence that is not a picture.** Beside every web screenshot lookout writes `.png.aria.json`, the accessibility tree as Playwright reports it: each meaningful element as a role, its accessible name, and for some controls its state. The integrity and text panels are given it in their prompts. Both were inferring from pixels things the tree states outright, so a dialog whose tree holds a `button "Close"` has its dismiss affordance whatever the picture suggested, a `textbox "Email address"` has its label, and a paragraph the layout cut off with an ellipsis reads whole in the tree, which turns "that looks truncated" into a finding worth filing. Their skills say the other half too: a finding the tree contradicts is not filed, the tree says nothing about how anything looks, and a tree cut for length proves nothing by what it omits.
Geometry, visibility and craft are not shown it, because it is evidence about what exists and they rule on how things look. It is a verdict input for the two that are, so it enters their cached verdicts' identity the way a design hand-off does: changing an `aria-label` re-judges those two and leaves the other three cached, with no pixel moved. Native captures have no DOM, so they carry no sidecar and their prompts promise none.
`aria: false` in `lookout.config.ts`, or `--no-aria` for one run, turns it off. `judge-integrity` and `judge-text` rise to version 4, so their standing verdicts are re-judged once.
## 0.46.0
### Minor Changes
- f206f88: Minor justification (new user-visible capability): **accessibility checks now cover the phone and tablet layouts.** The axe scan used to run once per route at the widest form factor, so a hamburger button with no accessible name, or content a media query pushes off screen, was never checked. Under the default `--axe route` the scan now runs at every form factor's rest shot: a violation is filed at the widest form factor that shows it and, at each narrower one, only the nodes the wider layouts did not show, so a phone-only defect is filed once and a defect shared by every width is not filed three times. `--axe all` files every violation on every form factor; `--axe off` is unchanged. Measured on a one-route page: 4 s with the scan at three form factors against 3 s with it off. Animation sampling and the navigation harvest deliberately stay at the widest form factor, where the full set of controls is visible.
### Patch Changes
- 5694777: **`lookout ask` photographs every form factor, and the words say what a run walks.** Since the verb landed it captured desktop and phone only and never said so; tablet is where a two-column layout most often breaks. It now walks every form factor of the project's fold, dark only as before, and `--viewports` still narrows. The README gains a "Form factors: two folds" section, `lookout protocol` says what a capture photographs in either fold and what narrowing a ruling costs, `lookout help` lists `--viewports`, `--schemes` and `--platforms`, the fact-checker names an uncaptured form factor as a reason evidence cannot answer, and the config `lookout init` writes names the three presets, the fold and the native block's keys.
## 0.45.10
### Patch Changes
- 708514a: **A ruling says how far the pixels moved, not just that they did.** `verify-fix` compared screenshots by hash, so a one-pixel nudge and a whole re-layout were the same answer. It now decodes the baseline and the fresh capture and measures: the verdict prints one `moved:` line per changed screenshot naming the percentage, the size and position of the region that moved, and by how much the view grew or shrank when it did ("the view is 1836px taller; 56% of pixels changed, scattered across a 2880x3636 area down the whole view"); `--json`, `state.json` and the issue document carry the same figures, the document naming the largest move. Changed screenshots whose baseline pixels are no longer on disk are counted and said to be unmeasured, rather than left out where their absence would read as barely moving.
The guard itself is no weaker: a measurement can only move a screenshot from changed to unchanged, and only by proving the two images are identical, which closes the case where a re-encode of the same pixels between filing and ruling hashed differently and let judge variance pass. Two notes that claimed the screenshots were "byte-identical" now say "identical pixel for pixel", which is what the rule actually checks.
## 0.45.9
### Patch Changes
- 1144266: **The capture workspace lives inside the project it belongs to.** Screenshots
and their provenance sidecars, `capture-report.json`, `judge-report.json`,
`verify-report.json`, `events.jsonl`, the narration, the judge transcripts and
the contact sheets are written to `/.lookout/workspace/` now, beside
the backlog and the issue folders they were always paired with, instead of to
`~/.lookout/evidence/-/`. `lookout protocol` names the new path,
so an agent reading the contract is told where the evidence is. The directory is
`workspace/` rather than `evidence/` because `.lookout/evidence/` is the
pre-0.35 store that `backlog` and the issue frames still adopt from, and one
name for both would make a live report indistinguishable from an inherited one.
**lookout writes the ignore line whenever it writes a config**, creating a
`.gitignore` when the project has none. Printing a note was fair while the
ignored directory held text; it is not now that a capture puts megabytes of
screenshots in the working tree. `lookout init` and the config a first run
writes from `--url` both go through it.
**The judge runs from a scratch directory outside every project.** Its working
directory used to be the evidence, which was outside every repository, so the
isolation came for free: the Claude Code CLI reads instructions upward from
where it stands, and standing in the operator's home meant a judged project's
`CLAUDE.md`, its `.claude/settings.json` and its hooks never reached the oracle.
With the workspace inside the project that had to be asked for, so
`invokeClaude` now defaults to a per-process scratch directory. Every path a
prompt names is absolute, so the judge loses nothing by standing somewhere
empty.
Nothing is migrated: one capture rebuilds the workspace, and the pixels worth
keeping were frozen into each issue's folder when it was filed. An old
`~/.lookout/evidence/` is no longer read and is safe to delete.
## 0.45.8
### Patch Changes
- 9b9ff7b: **An issue filed on a device says so.** The document's "How to see it" renders a device view as the deep link with the scheme in it, the device by name and id, and the simulator or emulator commands lookout used, instead of a URL and a CSS viewport; the scope of verification names the platform and the device kinds a ruling walks; board tiles and frozen frames name the platform when it is not the web.
## 0.45.7
### Patch Changes
- 504ccab: **The device fold reaches the judges.** A native or React Native project is now photographed on its booted iOS and Android devices by default, one phone and one tablet per platform, each addressed by its own identifier: an iPad is recorded as `tablet`, never as a phone, and a phone and a tablet shot of one route are two files. Device shots are judged by the same panels as web shots, with their own identity (the platform is part of a device finding's fingerprint and issue key; every web key is unchanged), and `verify-fix` rules a device issue on its devices. Each fold is probed for what it needs before a run: the web fold's URL over HTTP, the device fold's simulators and emulators with the app installed, using the new `native..startHint` in the project's own words and `native..devices` for the kinds a run must have. `lookout targets` and the page's settings panel show the booted devices beside the targets; the play button refuses for the same reasons a run would fail.
## 0.45.6
### Patch Changes
- ef57948: **How much two screenshots differ is now a measurement rather than a boolean.** `src/verify/pixels.ts` compares two PNGs channel by channel with no tolerance, reporting how many pixels changed, the smallest region containing them, how densely that region is filled, and whether the images are even the same size; a re-layout that changes the page height counts as change rather than refusing to answer, and an image that will not decode returns nothing rather than throwing. `changeSaid` puts the result in a sentence ("0.3% of pixels changed, in one 420x80 area near the top"), and `writeDiffCrop` saves the changed region enlarged. `tools/ui-check` now uses it in place of its own copy, which is where the algorithm came from and where it has caught three bugs no other gate saw. No verb behaves differently yet.
## 0.45.5
### Patch Changes
- 3a5a3a9: **A form factor the judge never opened is never recorded clean, and every check says what it judged per form factor.** lookout now keeps every `Read` a judge makes; a shot the reply called clean whose file (or every piece of it) the model never opened is downgraded to "nobody ruled on this", left out of the cache, judged again next run, and written to the incident log with the form factors it skipped. `lookout check` prints one line per platform counting each form factor's shots judged, cached and carrying findings, and a second line naming any form factor that was not judged; `--json` carries the same tally under `formFactors`.
## 0.45.4
### Patch Changes
- 7324716: **Every panel judges every form factor, and every device, as a rendering of its own.** The rubric gains a section on what a phone layout must do (fit the width with no horizontal scroll, stack rather than squeeze, finger-sized controls, tables adapted rather than clipped, chrome that leaves the screen to content, overlays that fit), what a tablet layout must do (use its width: neither a stretched phone nor a squeezed desktop), and what a device shot must do on top (content clear of the safe areas, the platform's navigation whole and legible, the application itself rather than a splash, a permission dialog or a bundler screen). The procedure now judges each form factor or device in full before comparing, and the comparison steps read the batch header rather than assuming all three form factors were captured. Each panel's categories name their phone, tablet and device instances: a page wider than the phone screen, a menu opened at phone that renders off screen, navigation collapsed with no control to open it, labels wrapped into fragments at phone scale, touch targets judged hardest where a finger is the pointer, a status bar left illegible by the header behind it, hierarchy that must still lead the eye on the first phone screen. The acceptance verifier rules a criterion about a form factor the header marks as not captured not verifiable. Every cached verdict is judged once more on the next check, because the judging text changed.
## 0.45.3
### Patch Changes
- 38eb5a8: **The judge is told what a batch holds, and reads tall screenshots in pieces it can actually read.** Every list of shots a model is handed (the judge, the refuter, the acceptance verifier, `lookout ask`) now opens with a header naming the platform, the form factors and the schemes present and, for a narrowed run, the ones not captured, so a batch without a tablet shot can no longer invite a claim about tablet. The description of a shot is written once, in `src/judge/manifest.ts`. Measured on 2026-09-02 with the judge's own model and tool: a 7802 px tall capture was transcribed exactly, an 11202 px one came back with digits and letters misread, and a 29500 px one was illegible. A full-page shot taller than 8000 px is therefore cut, from the same bytes, into pieces of a whole number of screens, and the model is told to read the pieces instead of the file; the same 11202 px capture read in pieces was transcribed exactly. The file stays the shot (its hash is the ledger key, its path is what an issue freezes); the pieces are working evidence beside it, rebuilt when the shot's hash changes.
## 0.45.2
### Patch Changes
- b10868d: **lookout knows which fold a project is judged in.** A web application is photographed at desktop, tablet and phone; a native or React Native application is photographed on iOS and Android devices. `lookout targets` now says which fold a project is in and why (a `react-native` dependency, an `ios/` Xcode project, a Gradle build, the config's `native` block), a configured native platform joins the default walk without `--platforms`, and a new `platforms` key in `lookout.config.ts` decides outright. The ordered form-factor set lives in one exported constant, `FORM_FACTORS`, so a run narrowed with `--viewports` walks in the same order as a full one whatever order the flag listed, and an unknown value is answered with the set. `capture --json` reports the platforms it walked.
## 0.45.1
### Patch Changes
- 0bfe034: **The adversarial verifier is handed lookout's own measurements, and rules on
acceptance criteria while it still has the evidence.** The verifier used to
receive a claim, a screenshot, and an instruction to lean refuted when
uncertain. That instinct is right and it has a cost: the findings hardest to
see in a still are the ones it kills, and some are real. Two refutations in one
stored run dismissed a control as a deliberate mobile simplification when
lookout had measured its box sitting past the right edge of the page and never
showed it.
Each finding now carries what was measured on its shot: the deterministic
checks that fired, what scrolls, and a short geometry brief from the provenance
sidecar naming the elements whose boxes leave the page. The skill says what
those lines are worth. A claim they contradict is refuted; a claim they prove
is confirmed even where the pixels are ambiguous; and a number the judge wrote
in its own prose is still invented and still refutable on that ground. This
costs no extra model call, and it re-keys every cached verdict once per project
because the verifier's text is part of every panel's prompt hash.
The same reply now rules each confirmed finding's acceptance criteria. A
criterion no screenshot could settle is replaced with an observable rewrite
where one exists and dropped where none does; one already true on the defective
shot is dropped, since it would read as met while the defect stood. Both used
to surface a whole fix cycle later as a not-verifiable verdict that blocked
nothing. Each drop becomes a signal for the panel that wrote it.
The frozen regression set now copies each case's measurements and its
provenance sidecar, so a replay grades an amendment under the evidence a real
run has rather than a thinner version of it. The rubric's rationale for not
naming another form factor is corrected in the same change: a judge is handed a
whole view, so a criterion naming another form factor from that batch was
always inside its evidence.
## 0.45.0
### Minor Changes
- 6d11e22: **A new deterministic check: content painted over other content.** Every
geometry check lookout had asked about one element and its container. None
compared two elements with each other, so a chip drawn across the name beside
it, a floating control covering the last row of a table, or a bar sitting on
the heading under it, all of which destroy information outright, were visible
to nobody but a judge reading an image.
`box-collision` measures the overlaps from live boxes and files under
`layout-overflow` at medium, naming both elements by their own on-screen text
and how much of the covered one is hidden. Overlap on its own means nothing,
because a page is layers and most of them are deliberate, so the check counts
only two ordinary siblings in normal flow whose overlap the browser itself
confirms at the intersection centre. Anything positioned out of flow is
excluded, and so is everything inside it: the items in a dropdown are ordinary
static elements, and it is the panel around them that was lifted, so checking
the element alone found every menu item sitting on whatever the open menu
covers. Modals, hidden and transparent elements, and ancestor pairs are
excluded for the same reason. It shares the `--no-edge-clip` switch, since both
answer the same question about whether content is where a reader can read it.
## 0.44.0
### Minor Changes
- 727079a: **Control size is measured at the width where a finger is the pointer.** axe
ships its `target-size` rule disabled, and lookout's default (`--axe route`)
scans once per route at the widest form factor, which is desktop. Between them,
no phone screenshot had ever been scanned and the one rule whose whole subject
is touch had never run anywhere. Meanwhile the visibility panel was asked to
file "touch targets too small or too crowded to hit reliably" from an image,
while the rubric rightly forbids it the measurement that would make such a
finding actionable.
The rule now runs at phone width on every rest shot, selected by name so it
runs whether or not it ships enabled. Findings arrive as ordinary accessibility
violations with the attribute `axe-target-size`, carrying the sizes axe
measured, and they account for spacing, so a small control with room around it
passes and a small control crowded by its neighbours does not. They open at
medium rather than at axe's own severity: what is measured is the element's
box, which is not always its hit area, and nothing refutes a deterministic
finding, so a possible false positive should not sit at the top of a backlog
with no second opinion available.
## 0.43.2
### Patch Changes
- 023ac4a: **One defect stops being minted under two or three names.** The `attribute` is
free text a judge writes, and it is half of both a finding's fingerprint and
its issue cluster key, so the same defect arriving under a different word mints
a second issue, splits the attempt history, and makes the first look resolved.
The list of names lookout already had was built once per run, from open
findings only, which left two gaps.
Names a person settled now travel too, marked `(settled)` and explained as
names rather than defects to hunt for. That closes the case that taught the
lesson: once a colour-scheme defect was ruled by-design, the next run stopped
seeing its name, re-filed it under a fresh attribute, and minted a second issue
the ruling could not reach, because merge suppresses an exact fingerprint and
cannot suppress a synonym.
And what a run has already filed travels within that run. Each view group's
confirmed findings become names later groups can reuse, capped like the
existing list, refuted names excluded so a group is never invited to file what
the verifier just killed. Groups judged concurrently are still blind to each
other, so the first two anchor independently; every later group sees whichever
finished first.
## 0.43.1
### Patch Changes
- 5a3fb2a: **The judges and the adversarial verifier are told what scrolls.** A table
whose last column sits past the edge of the frame is either a defect or a drag
away, and a still image cannot show which. Told nothing, a model reads those
pixels as content that is gone, which is one sentence from a filed defect that
is not there, and the verifier makes the opposite error just as easily: told to
lean refuted when uncertain, it can dismiss a genuinely clipped control as a
deliberate collapse.
The clip check already measures every horizontal scroller in a frame and how
much of each is off screen, so the shot now carries that as a note. It appears
in the judge's manifest beside the animation note and under each finding in the
refuter's prompt. It is not a finding and never becomes one, and it is
deliberately not part of the group hash, the same rule the animation flag
follows: it describes how a page is built, not what it looks like, so it must
never re-judge anything on its own. The signals line moves into a module the
two prompts share, so the two can no longer drift apart.
## 0.43.0
### Minor Changes
- a3cf949: **A new deterministic check: content clipped where nothing scrolls.** The
horizontal-overflow check files only when the document itself scrolls sideways.
A control pushed past a header with hidden overflow, or a table column cut off
by the panel that holds it, produces no page scroll at all, so that check
computed the offending elements and threw them away. What was left to notice it
was a judge reading an image, which the rubric rightly forbids from measuring:
the finding arrived as an eye-judged claim under whichever category the panel
that happened to run owned, and the adversarial verifier could refute it by
calling the missing content a deliberate responsive collapse. A box is not
arguable.
`edge-clipped` is measured at every shot from the live boxes, files under
`layout-overflow` with the attribute saying what did the clipping (the viewport
or an ancestor that hides its overflow), names the elements it measured with
their own on-screen text, and arrives already verified at no model cost. Where
every offender sits inside the same landmark, the finding takes that shell
region, so one clipped header control is one defect for the application rather
than one per route.
It stays silent about everything that leaves its box on purpose: content inside
a horizontal scroller (it is reachable, and the scrollers are recorded on the
shot instead), a label truncated with an ellipsis or a line clamp, anything
hidden, transparent, or collapsed, and any subtree a project names in the new
`checks.edgeClip.ignore` config. `--no-edge-clip` turns it off for a run;
`verify-fix` refuses that flag for the same reason it refuses `--axe off`,
since a criterion about clipped content would otherwise be ruled met without
anything being measured.
## 0.42.1
### Patch Changes
- 5bd3612: **A run says which judge left which screenshots unruled, not just how many.**
A panel whose reply accounts for a shot in neither its findings nor its clean
list costs that whole (view group, panel) pair its cached verdict, and the run
reported only a count of such shots. The count says a verdict is missing
without saying whose it was or about what, so nothing could be taught from it.
The judge report now carries `unaccounted`: the panel, the view group, and the
shot ids, beside the existing `unjudged` count. `skills improve` reads it as a
new signal kind, one per panel per run, since a reply that dropped four shots
dropped them under one set of instructions. Where the panel's own prose names
a shot it left out, that finding's title goes in the signal, because a defect
the panel described on a shot it never listed is exactly the failure the
output contract exists to catch.
## 0.42.0
### Minor Changes
- 27a88b6: **A judge can say which other screenshots of a view show the defect it just
filed, and those screenshots count as ruled on.** The rubric asked a judge to
file one finding per defect on the most representative shot and to name the
other affected shots in the problem text. The output contract then had no
bucket for a shot named that way: `reply.ts` accounted for a shot only as a
finding's `shotId` or in `cleanShotIds`, so every shot mentioned only in prose
came back unaccounted. That made the whole (view group, panel) pair
uncacheable, so its judge call was re-bought on the next run, and the run
reported those shots as not judged. It was the single largest source of
`judge-rejected` incidents in real use, and it fell hardest on the panels that
judge a view as a whole.
Findings now carry `alsoShotIds`: the other shots of THIS view showing the
SAME defect. Ingestion validates each id against the batch, drops the primary
and any duplicate, and expands the rest into their own findings, each stamped
`siblingOf` with the shot the judge chose. That happens before the adversarial
verifier, so a sibling is ruled on its own evidence and an over-listed one is
refuted on its own shot without touching the primary; the refuter's prompt
prints it as a short row pointing at the primary's index rather than repeating
the paragraph once per shot. Identity is unchanged: form factor and scheme are
already part of a fingerprint, and the cluster key fuses the sightings back
into one issue. A sibling id naming a shot outside the batch is dropped with
one incident line and never costs the finding. Prose lapses and refuter-supplied
plain sentences are counted on the primary alone, so one badly written problem
teaches its panel one lesson rather than four.
The accounting sentence in the contract now names all three buckets, and
`judge-core` moves to version 9 with output `judge-findings-v3`, which re-keys
every cached verdict once per project.
## 0.41.1
### Patch Changes
- 1c88852: **The board and the backlog markdown read in words.** A card's headline is
the defect's own title (or the group's, "2 accessibility problems on /"),
not `category/attribute on routes`; the status pill says "still open", "fix
confirmed", "verifying now", "filed away"; the category chip is the phrase a
person reads ("accessibility", "interaction state") with its gloss on hover;
every defect carries a `rule category/attribute` line so the token is never
a bare label; each acceptance criterion says its verdict beside the mark
("met", "not met", "not verifiable", "not ruled") instead of a glyph a
viewer has to decode; the frozen pair says "screenshot", not "frame"; and
the record feed shortens a forty-character commit the way `git log` does.
`BACKLOG.md` drops the fingerprint column, links each row's issue number to
its document, and lists every fingerprint once under `## Identities`.
## 0.41.0
### Minor Changes
- 4dcf091: **`lookout backlog check --strict`, and lookout counts the findings a judge
wrote for one reader.** A finding whose `problem` fails the two-part bar
(the title again, a single paragraph, a rule id where a plain sentence
belonged) is still filed: rejecting it would throw away a real defect over
its prose. It is now counted at ingestion, one incident per batch, and
written to the judge report as `degraded`, where `skills improve` reads it
as a signal of kind `unreadable` attributed to the panel that wrote it.
`backlog check` reports each such record as a warning
(`problem-unexplained`) that does not fail the check; the new `--strict`
flag makes warnings fail, for a gate that wants every record readable on
its own. The mock judge's default finding meets the bar, so the suite's
runs stay clean.
Minor because `backlog check` gains a new option, `--strict`.
## 0.40.21
### Patch Changes
- 0ae339f: **Every prose field names its reader, and the refuter supplies the plain
sentence a judge left out.** The judge's contract now says what `title` is
for (printed on its own: what is wrong and where, no rule ids or tokens),
that `observed` is quoted back to a person as lookout's verdict, and that a
criterion has to be readable on its own beside being decidable. The
acceptance verifier's `reasoning`, the placement advisor's `reason` and
`blastRadius`, and the navigation planner's `why` say the same. The six
judge panels share one file for their pointer to the audience rule instead
of six pasted copies. Versions are bumped, so every cached verdict is
re-judged under the new wording.
The adversarial verifier's contract becomes `refute-verdicts-v2`: when it
confirms a finding whose problem does not open with a sentence a person can
follow, it may supply that sentence in `plain`, and lookout puts it above the
judge's text (never in place of it), only when the judge's text needed one
and only when the sentence passes the same bar (`src/backlog/prose.ts`, the
one definition of "written for both readers"). Each such repair is reported
with the panel that skipped the sentence, so the panel can be taught.
## 0.40.20
### Patch Changes
- de10fc8: Acceptance criteria are stated as the check passing, with the check named:
"/profile passes the accessibility check `heading-order` at desktop, dark
scheme." rather than "No accessibility violation of rule `heading-order` on
/profile at desktop, dark scheme.". The two criteria lookout adds to every
issue read "Every screenshot this issue was filed against was photographed
again, and at least one of them changed." and "lookout re-read the source and
no longer sees this."; the second used to speak of "the oracle", a word the
document never introduces. Rulings already made on the old wording carry
over to the new by origin, so nothing resets to pending.
## 0.40.19
### Patch Changes
- 7fbce7d: **Every deterministic finding has a title, an expected state and an observed
state of its own.** The title used to be the check's message, which leads
with a rule id or a measurement ("heading-order: Heading levels should only
increase by one"), and `expected` and `observed` were empty for every check
but axe. Each type now names the defect as a person would recognise it ("The
page logged an error: TypeError: x is undefined", "Content runs 42px off the
side of the screen (.card\_\_title)", "\"Menu\" did nothing when clicked",
and axe's own help sentence without the rule id in front), states the fixed
condition, and records what this capture showed with the detail the check
kept (the error's file and line and how often it fired, the request's method,
the overflow's path). A grouped issue's title names its category in words:
"4 accessibility problems on /users", not "4 a11y defects". The five checks
that describe lookout's own capture rather than the application (a blank
shot, a state that could not be reached, identical light and dark captures,
a frame still rendering, a capture that landed elsewhere) say so first and
trail "What lookout recorded" rather than "What the check measured". axe's
impact sentence names the severity lookout files the finding under. Existing
findings pick all of this up the next time their view is captured.
## 0.40.18
### Patch Changes
- 4e4b947: A criterion's id is a hash of its text, so rewording a template minted new
ids and every verdict lookout had ruled on the old text reset to pending. A
derived criterion is unique per finding and the universal one per issue, so
when an id misses, the previous criterion with the same origin is the same
question reworded, and its ruling, note, evidence and stamp carry over. Judge
criteria are several per finding and are never carried by origin alone. Two
attributes that fell through to a default template naming the category
token (`dead-control`, and an axe scan whose rule id was not recorded) state
themselves now, and the default names the category in words. The category
vocabulary gains its words (`src/judge/glossary.ts`), held to the category
list by a test.
## 0.40.17
### Patch Changes
- db118c9: **Each panel's reply is kept, and the issue points at it.** The judge's raw
reply was distilled into title, problem, expected, observed and acceptance
and then discarded. Every panel call now writes its reply whole to
`judge-replies/@.txt` in the capture workspace (overwritten
like a screenshot, never in git), the ledger entry for that verdict carries
the file's path, and the issue document and `Issue.json` list, under
"Artifacts", every transcript behind the issue's own views that is still on
disk, by panel and run.
## 0.40.16
### Patch Changes
- d097cf9: **`Issue.json` is the document's twin.** It was a projection narrower than
the markdown: no placement, no expected or observed text, no confidence,
region or seen routes, no attempts, no rendering element, no source location,
and evidence paths relative to a workspace nobody reading the file is in. It
now carries every member finding whole (with each evidence path made absolute
and stamped with when it was captured), every attempt as `state.json` keeps
it and the baseline the next ruling is measured against, the placement, the
scope a ruling will photograph, the other issues on the same screenshots, and
every artifact path with whether it exists. Both files are built from one
loaded context, so a fact reaches both or neither.
## 0.40.15
### Patch Changes
- ef4fb92: **An accessibility finding names the elements, the standard and each check.**
axe reports far more than a rule id, and lookout kept the selectors of three
elements and a flattened summary. The capture now keeps, for up to twenty
failing elements, a summary of the element's markup (its tag, a few naming
attributes such as `id`, `aria-label` and `alt`, an `href` stripped of its
query, and the visible text, at most eighty characters; values, sources,
styles, handlers and other data attributes are dropped before anything is
written, because the record is committed with the project), the impact axe
gave the element, and the sentence each of axe's checks wrote about it, plus
the rule's tags.
The ticket's prose spends them: "It fired on 2 elements on this screen: the
`
` reading "Overview", the `
` reading "Recent activity""
instead of a selector list (the selectors stay in the record for the agent
that resolves them), "It is a WCAG 2.0 level A requirement" or "an axe
best-practice rule rather than a WCAG requirement" from the tags, and one
sentence per check per element in place of the flattened summary. A capture
from before these were kept reads as before. The issue document also merges
what the finding kept of its view with what the workspace still records of
the shot, field by field, instead of letting one shadow the other whole.
## 0.40.14
### Patch Changes
- 2d3cc8a: **Capture records how each view was photographed, and the checks keep what a
fixer needs.** Every web shot now carries the URL it loaded (with the scheme
in it) and where it landed when that differs, the viewport in CSS pixels and
the device scale, how the colour scheme was applied, the element when one was
framed, and for a state other than rest the planner's description of it and
the control that was clicked to reach it, with what was expected. The issue
document prints these ahead of anything it would reconstruct from the config,
and the finding keeps a copy, so a cleaned workspace loses none of it.
A thrown page error keeps its stack (twelve frames), which names the file
and line that threw; a console error keeps its column and how many times it
fired, counted on the first sighting instead of filed again; a failed request
keeps its method and resource type; the horizontal-overflow checks keep the
five worst protruders with their paths, not only the worst; a dead control
keeps its selector and role and the path it was expected to lead to, and the
provenance join now names its element too.
## 0.40.13
### Patch Changes
- b00370a: **A finding keeps what the check recorded, how the view was photographed,
and what the verifier said.** A deterministic finding survived ingestion as
an attribute, a region and one rendering element; the rest of the check's
record (every element a rule fired on, the error's location, the offending
path, the reference link) was written into prose once and then gone, and the
adversarial verifier's own account of why a judged finding stood was dropped
outright. Each finding now carries `check` (the check's type and its record,
bounded: strings to 400 characters, lists to 20 items, nesting to two levels,
the provenance join left out since `renderedBy` and the sidecar carry it),
`view` (whatever capture recorded about how the view was photographed:
today the design hand-off, its hash and the sidecar path; more as capture
records it) and, on the AI channel, `verifierNote`. All three are refreshed
when a newer sighting carries them and never cleared by one that does not.
The issue document lists the check's record key by key under each
deterministic defect ("What the check recorded") and prints the verifier's
account under each judged one. `backlog check` rejects an unknown check type.
## 0.40.12
### Patch Changes
- db7f814: `lookout protocol` names every file in an issue's folder (`frames.json` and
`handoff.command` were missing, and `state.json` now says it holds what was
reported, what lookout observed and the capture the next ruling is measured
against), describes where the working evidence lives (`$LOOKOUT_HOME/
evidence/-/` with the capture and judge reports, the run log,
the contact sheets, and the `.png.provenance.json` sidecar beside every
screenshot with its `shotHash` drift check), and says what `--note` becomes,
what a ruling is measured against, that a ruling which does not pass spends an
attempt, and what reopens a blocked issue. Exit 2 is "could not run or could
not rule; no attempt is spent". The README and the skill no longer place the
frozen frames under `evidence/fix-frames/`, where they have not lived since
they moved into the issue's own folder, and the README's fix loop no longer
presents a scoped `check` before `verify-fix` as a step that affects the
ruling.
## 0.40.11
### Patch Changes
- aca7bc7: `verify-fix` refuses `--no-capture` (a ruling on the last capture instead of
a fresh one) and `--axe off` (every accessibility criterion met without the
check running), before anything runs, with the reason in the error. Both
passed through to the re-capture and could confirm a fix nothing had looked
at. A `--settle` that differs from the one the filing capture used is noted
in the run log rather than refused, since a slow render sometimes needs it:
pixels may move for reasons unrelated to the fix.
## 0.40.10
### Patch Changes
- 36fea92: **A ruling is measured against the issue's own record, not the workspace.**
This changes the verdict rule's input. The pixels-moved guard (nothing passes
on unchanged pixels) compared fresh screenshots to whatever the capture
workspace held, and the workspace moves with every capture: a `lookout check`
of the routes between the edit and the ruling put the fixed page in it, the
ruling compared the fixed page to itself, and a real fix was ruled "nothing
changed" and spent an attempt. The README recommended that very loop.
Each shot is now compared, in this order, to the capture of the previous
ruling (recorded in `state.json` as the ruling's baseline, by shot and hash),
then to the frame frozen when the issue was filed (frames now record the shot
they copy and the hash of its pixels; frames frozen earlier recover both from
the file and the view), and only for shots the issue has no record of, such
as the routes a shell verify tops up with, to the workspace and the backlog's
evidence as before. A `check` or `capture` between the edit and the ruling no
longer moves the baseline. The attempt record, the stdout account and the
document each say which of the three the ruling compared against.
## 0.40.9
### Patch Changes
- 7bde430: **What `verify-fix` prints after a ruling carries the same facts the
regenerated document does.** The account now says how many attempts are left
before the issue blocks, what was photographed (URL, routes, form factors,
schemes) and what it was compared against (the previous capture's run and
when it finished, and how many comparable screenshots changed), which routes
had pixels that never moved, every finding still filed with the judge's own
account of it, each criterion with its verdict mark, its note, the shots that
decided it and the verifier's suggestion, what was recorded about the
repository (the commit, the uncommitted files, the files changed since the
previous attempt) beside the note verbatim, and that the document now carries
this attempt, with its path. A blocked ruling names the command that reopens
the issue. A ruling that could not be made says no attempt was spent. The
`--json` payload carries the same facts as objects: `attemptsLeft`,
`stillOpen` with shot ids and the judge's account, `baseline`, `photographed`,
`reported`, `observed`, `doc`, and `evidence` and `suggestion` on each
criterion.
## 0.40.8
### Patch Changes
- b0d786a: **The attempt record says what the ruling saw.** `state.json` kept one
sentence about each attempt; everything else the ruling knew (how many
screenshots were compared and how many moved, which findings were still
filed and what the judge said about each, which criteria failed and why, the
contact sheet, the flags that narrowed the capture) was printed to stdout and
lost. Each attempt now records all of it, plus what lookout observed in the
repository at ruling time (HEAD, the uncommitted files with `.lookout/`
excluded, and the files changed since the previous attempt's commit), kept
apart from what the fixer reported so a claim is never filed as lookout's own
fact. The issue document prints every one of these under the attempt, in the
order a second attempt needs: what was reported, what lookout observed, what
it saw, then the verdict.
The acceptance verifier's `evidence` (which shots decided a criterion) and
`suggestion` (what it would change) used to be dropped when its answers were
matched back onto the criteria; they are kept now, written onto the criterion
beside its note, and printed under it in the document.
## 0.40.7
### Patch Changes
- 51ae620: **The issue document says how to see the defect and where everything lookout
wrote about it lives.** A "How to see it" block per photographed view gives
the URL with the colour scheme already in it, the viewport in CSS pixels and
the scale the PNG was taken at, how the scheme was applied (browser
emulation, a url parameter, or the config's recipe), the element when only
one was framed, what a state other than rest is and what lookout clicked to
reach it (from the navigation plan, or the config's recipe description), the
design hand-off the view was judged against with its hash, the provenance
sidecar beside the screenshot with how many elements it names and whether
the shot has been re-captured since, the workspace screenshot, and when and
by which run it was captured. Facts reconstructed from the config are marked
"(per the current config)"; facts the capture recorded win over them.
"Where it renders" now draws on the sidecars for every member, so a judged
finding, which carries no element of its own, gets the same list of named
elements with component chains and source hints that a check's finding did.
An "Artifacts" section names the config, the backlog, the judge ledger, the
navigation plan, the capture and judge reports, the run log and the contact
sheets, absolute, each only when it is on disk.
## 0.40.6
### Patch Changes
- 00b8e0e: **The issue document names the other issues filed on the same screenshot.** A
thrown error, a failed request or a blank capture on the same picture is often
the cause of the visual defect filed beside it, and clustering gives each its
own number, so the two documents never mentioned each other. An "Also on this
screenshot" section lists every open or blocked finding in another issue that
shares a screenshot with this one, by issue id, severity, rule and title, and
says that none of them is closed by fixing this one. The materializer hands
the backlog it already holds to the renderer for this; a caller rendering one
issue in isolation gets no section rather than a wrong one.
## 0.40.5
### Patch Changes
- fd34280: **The issue document says what lookout will photograph before anyone asks
for a ruling.** A "Scope of verification" section names the target and its
URL, every route `verify-fix` will re-capture and which of them the shell
rule added from the config (a shell defect is ruled on at least two routes),
the form factors and schemes, the panel that re-judges, and the fact that
lookout rules on what the URL serves at that moment and never starts, rebuilds
or restarts anything (with the config's `startHint` when it has one). It
states the pixels-moved rule and what the comparison is against, naming the
run that filed the issue and when it finished, and that a `lookout capture` or
`check` of those routes between the edit and the ruling replaces that baseline
so a real fix reads as no change. When the capture workspace still holds the
filing run, the flags it ran with are listed. Every `verify-fix` flag is named
with what it does to the ruling: which are set from the issue, which narrow
the capture and the comparison, and which cannot confirm a fix.
The verify block says `--commit` may be left out, what `--note` becomes and
what the useful ones have said, that a ruling which does not pass spends an
attempt (N of M spent), what blocks the issue, that `--max-attempts` raises the
cap for one ruling, and what every exit code means, including 2: lookout could
not rule and no attempt was spent. The routes a target's config lists are
derived once (`configuredRoutesOf`, beside `clusterScope`) for the verb and the
document alike, so the two cannot disagree.
## 0.40.4
### Patch Changes
- 6f8fbe6: **The issue document says what has been tried.** Every attempt `verify-fix`
has ruled on was already on disk in `state.json`, and the document printed one
integer about it. It now carries a "What has been tried" section: each attempt
as it was reported (commit and the fixer's note, verbatim), what it surfaced
elsewhere, and what lookout ruled with the judge's account, in the same
sentences the board's record feed uses (one formatter, `src/fix/attempts.ts`,
serves both). A judge that saw the same thing twice is written as "unchanged
from attempt 1" rather than repeated. A blocked issue's document states the
reason, the command that reopens it, what number the next ruling counts as,
and what `--max-attempts` would leave one more round.
**The document regenerated by a ruling now carries that ruling.** `verify-fix`
saved the backlog (which rewrites the document) and then wrote the attempt, so
the document could never include the attempt just ruled. The attempt is
written first now, in both channels.
**Acceptance criteria say what the last ruling saw.** A criterion checked and
failed drew the same empty box as one never checked, and its note (the
verifier's reasoning) printed only when it was not verifiable. Four marks now:
`[x]` met, `[!]` not met, `[-]` could not be verified, `[ ]` not ruled yet,
with a legend, the note under every ruled verdict, and when and by which run
it was ruled.
**The header states the record.** `status:` (with the adjudication or blocked
`reason:` when there is one), `confidence:`, `region:` when a member has one,
`seen on:` when the defect has been photographed on more routes than it is
filed under, `attempts: N of M spent` naming the default cap, and `caused by:`
for a regression, with the commit and its forge link. The blocked answer from
`verify-fix` names the reopen command and the document that records every
attempt. The default attempts cap lives beside the verdict rule
(`src/fix/rule.ts`) so the document can state it without importing a command.
- 7ea635a: The live feed's cursor on a card being re-judged is a block again. The
stylesheet spelled it `"█"`, which is not a CSS escape (CSS wants
`"\2588"`), so the backslash escaped the `u` and the page drew the letters
`u2588` after the last line. The ui gate had never captured a card mid-verify,
so nothing saw it until the fixture gained one.
## 0.40.3
### Patch Changes
- e3e3370: The issue document's sections each live in their own module beside the
assembly (`src/issues/doc-defects.ts`, `doc-evidence.ts`, `doc-verify.ts`),
reading from one `IssueContext` that the JSON record (`src/issues/record.ts`)
shares. The attempt record and the judge's one-sentence account are written by
one module for both channels (`src/verify/attempt.ts`), the axe scan has its
own (`src/capture/axe.ts`), and the device scale factor lives beside the
viewport table so a document can state a screenshot's geometry without loading
the browser. No output changes: every Issue.md and Issue.json regenerated from
the ui-check fixture is byte-identical before and after.
## 0.40.2
### Patch Changes
- 73e7196: **The calls-to-action consent moves under the cog.** It was an icon button
beside play, which made a consequential decision look like a view preference:
a small outline that changed colour, with the whole of what it authorizes
living in a tooltip nobody hovers. It is a settings row now, next to where the
project and the base URL are chosen, and it says in words which of the two
runs play will spend: `Off: runs photograph each route at rest`, or
`On for this project`, with the consequence spelled out underneath rather than
hidden in a title attribute. The row is not a `