Caterium v17.6.4 release integrity cleanup

Synchronize release metadata, backfill v17.6.2-v17.6.4 release notes, and enforce version consistency in CI.

docs/release-manifest.json

@@ -1,7 +1,7 @@
 {
   "app": "Caterium",
-  "version": "v17.6.0",
+  "version": "v17.6.4",
-  "channel": "local-test",
+  "channel": "production",
   "schema": 17,
   "legacyStateKept": true,
   "normalizedMirror": true,
@@ -11,7 +11,7 @@
   "serverReady": true,
   "workspaceAutoDiscovery": true,
   "invitesTemporarilyDisabled": false,
-  "pwaCache": "v65-v17.6.0-stability-security",
+  "pwaCache": "v69-20260907-v17-6-4-settings-orders-pdf-menu",
   "fullOfferDescriptions": true,
   "dynamicOfferRows": true,
   "pdfOfferDescriptionFix": true,
@@ -99,7 +99,7 @@
   "catalogCompositionTildaEndpoint": "getproduct",
   "catalogCompositionPremiumForceRefresh": true,
   "catalogCompositionCacheRequiresPremium": true,
-  "notes": "Stability & Security release: shared SunSafe XSS defenses, safe DOM insertion, versioned production employee Edge Function source, startup gallery trimming/lazy images, centralized A4 PDF engine, mobile overflow containment, and automated release checks. Chat navigation/order chat from v17.5.31 is preserved.",
+  "notes": "Production v17.6.4: chat photo compression and server memory counters; bounded Developer Console memory refresh; operations UX; Developer/SaaS hotfixes; one-minute order auto-completion and payment; per-offer PDF templates; styled Menu icon; GitHub QA and Cloudflare production deployment.",
   "catalogPhotoSources": 113,
   "catalogPhotosStoredInCatalog": true,
   "catalogLegacyPhotosInCatalog": 60,
@@ -237,7 +237,7 @@
   "signupTrial": "14-day Full",
   "developerMfaInputSelectorFixed": true,
   "developerMfaRepeatedValidationToastsFixed": true,
-  "release": "20260907-v17-6-0-stability-security",
+  "release": "20260907-v17-6-4-settings-orders-pdf-menu",
   "registrationFlow": "email-password-confirm-company-auto-login",
   "emailConfirmationRequired": false,
   "employeeInviteLinks": false,
@@ -293,5 +293,25 @@
   "releaseChecks": "tests/static-security.mjs + tests/release-check.mjs",
   "playwrightSpec": "tests/app.spec.mjs",
   "releaseScoreFirstPass": 7,
-  "releaseScoreSecondPass": 9
+  "releaseScoreSecondPass": 9,
+  "chatPhotoCompression": true,
+  "chatPhotoTargetBytes": 2097152,
+  "chatPhotoMaxSidePx": 2048,
+  "developerMemoryCounters": true,
+  "developerMemoryRefreshMs": 30000,
+  "developerMemoryTimeoutMs": 8000,
+  "developerMemoryMutationLoopRemoved": true,
+  "developerSupportLiveRefresh": true,
+  "menuEditorFullPage": true,
+  "calendarOverflowPanel": true,
+  "routeBaseConfigurable": true,
+  "routeOrderPopup": true,
+  "developerGateHotfixV1763": true,
+  "saasClickHotfixV1763": true,
+  "ordersAutoCompleteDelayMs": 60000,
+  "ordersAutoPayment": true,
+  "ordersAutoCompletedOriginalDatePreserved": true,
+  "clientOfferTemplatePerOrder": true,
+  "menuStyledSvgIcon": true,
+  "releaseIntegrityChecks": true
 }

docs/releases/V17.6.2-CHANGES.txt

@@ -0,0 +1,9 @@
+Caterium v17.6.2 — Operations UX
+Date: 2026-09-07
+
+1. Developer support mode received read-only live refresh with bounded polling.
+2. Menu editing moved to a full-page editor with premium box support.
+3. Calendar gained an overflow panel for days with many orders.
+4. Route origin can be configured and saved.
+5. Route order details can be opened from the route interface.
+6. GitHub QA covers the operations UX module.

docs/releases/V17.6.3-CHANGES.txt

@@ -0,0 +1,8 @@
+Caterium v17.6.3 — Developer and SaaS hotfixes
+Date: 2026-09-07
+
+1. Platform developer access no longer gets stuck behind workspace loading.
+2. Developer Console opening is guarded for platform-admin use.
+3. SaaS management click handling no longer passes a DOM event as a Developer Console navigation target.
+4. Event propagation is stopped safely and HTMLElement inputs are validated.
+5. Desktop/mobile browser regression tests cover the developer gate and SaaS action.

docs/releases/V17.6.4-CHANGES.txt

@@ -0,0 +1,10 @@
+Caterium v17.6.4 — Settings stability, order completion, offer templates and Menu icon
+Date: 2026-09-07
+
+1. Developer Console memory refresh no longer reacts to its own DOM mutations. Requests are deduplicated, have an 8-second timeout and refresh at a controlled 30-second interval while the console is visible.
+2. One minute after the scheduled order time, eligible orders are automatically marked fully paid, balance becomes zero, status becomes «Отдан заказчику», and the order moves to completed while its original date/time remain intact.
+3. Client proposal/PDF design is stored per order/proposal. The four existing designs remain available independently: Light, Editorial Grid, Midnight Glass and Emerald Gold.
+4. Menu navigation uses a styled SVG serving-dish icon consistent with the interface.
+5. PWA cache is v69 / v17.6.4-settings-orders-pdf-menu.
+6. Static, release, desktop/mobile Playwright and Cloudflare preview checks passed before merge; production Cloudflare deployment and production QA also passed.
+7. Release metadata was reconciled after deployment: package-lock, production release manifest and missing v17.6.2–v17.6.4 release notes now match the shipped v17.6.4 build. CI now verifies version consistency automatically.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "caterium-app",
-  "version": "17.6.0",
+  "version": "17.6.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "caterium-app",
-      "version": "17.6.0",
+      "version": "17.6.4",
       "devDependencies": {
         "@playwright/test": "^1.51.0",
         "http-server": "^14.1.1",

tests/release-check.mjs

@@ -2,8 +2,12 @@ import fs from 'node:fs';
 import path from 'node:path';
 const root=process.cwd(), pub=path.join(root,'public');
 const read=p=>fs.readFileSync(path.join(pub,p),'utf8');
+const readRoot=p=>fs.readFileSync(path.join(root,p),'utf8');
 let bad=0;const check=(v,m)=>{console.log(`${v?'OK':'FAIL'}: ${m}`);if(!v)bad++};
 const index=read('index.html'),runtime=read('app-runtime.js'),sw=read('service-worker.js'),css=read('core/stability-v1760.css'),performance=read('core/performance.js'),ops=read('core/ops-ux-v1762.js'),hotfix=read('core/hotfix-v1763.js'),ux=read('core/ux-fixes-v1764.js');
+const pkg=JSON.parse(readRoot('package.json'));
+const lock=JSON.parse(readRoot('package-lock.json'));
+const releaseManifest=JSON.parse(readRoot('docs/release-manifest.json'));
 check(index.includes('core/stability-v1760.css'),'mobile stability stylesheet loaded');
 check(css.includes('overflow-x:hidden')&&css.includes('.cats'),'mobile overflow guard present');
 check(!index.includes('offer-gallery-data.js'),'blocking Base64 gallery absent');
@@ -31,4 +35,9 @@ check(ux.includes('persistOfferTemplate')&&ux.includes('clientOfferTemplateId')&
 check(ux.includes('sun-v1764-menu-icon')&&ux.includes('<svg'),'menu uses a styled SVG icon');
 check(fs.existsSync(path.join(root,'supabase/functions/caterium-create-employee/index.ts')),'employee Edge Function source is versioned');
 check(!/sb_secret_[A-Za-z0-9_-]{20,}|service_role\s*[:=]\s*["'][A-Za-z0-9._-]{30,}/i.test(index+runtime+performance+ops+hotfix+ux),'no client secret-like token');
+check(lock.version===pkg.version&&lock.packages?.['']?.version===pkg.version,'package.json and package-lock.json versions match');
+check(releaseManifest.version===`v${pkg.version}`,'release manifest version matches package.json');
+check(releaseManifest.channel==='production','release manifest channel is production');
+check(String(releaseManifest.pwaCache||'').includes('v17-6-4'),'release manifest points to current PWA cache');
+check(['17.6.2','17.6.3','17.6.4'].every(v=>fs.existsSync(path.join(root,`docs/releases/V${v}-CHANGES.txt`))),'release notes exist for v17.6.2 through v17.6.4');
 if(bad)process.exit(1);