Caterium v17.6.0 - Stability & Security
Date: 2026-09-07
Rollback baseline: v17.5.31

Security
- Closed the old bootstrap stored DOM-XSS path with shared SunSafe escaping/attribute helpers.
- Consolidated repeated esc() implementations onto one shared utility.
- Added safe DOM insertion helper for dynamic navigation/settings nodes.
- Restored the deployed caterium-create-employee Edge Function source to the project; secrets remain environment-only.

Stability
- Moved the oldest bootstrap business script out of index.html into legacy/bootstrap.js.
- Centralized PDF byte packaging in core/pdf-engine.js with one A4 geometry validator.
- Added static security and release checks plus Playwright E2E specifications and CI workflow.
- Preserved v17.5.31 as a separate rollback archive.

Performance
- Removed blocking offer-gallery-data.js Base64 payload.
- Removed unused offer-gallery/003.jpg through 010.jpg; retained the two images actually used.
- Added image lazy-loading/async decoding helper for noncritical images.
- Added targeted mobile overflow containment for category/view/settings strips.

PDF QA
- Offer templates light, editorial-grid, midnight-glass, emerald-gold generated as real PDF blobs and rendered back to images.
- Catalog PDF generated as A4 pages and rendered back to images.
- All generated pages opened successfully in PyMuPDF and use consistent A4 geometry.
- Browser print/PDF CSS rules remain explicitly A4 portrait/landscape according to document type.

Known technical debt
- PDF pages remain image-based, so text is not selectable/searchable. The two former binary writers are now one audited engine, but a later migration to a vendored library/vector-text PDF pipeline is still desirable.
- index.html/app-runtime.js still contain historical modules and should be split further in a future architecture release.