pj-rise became slide-only in F09, but .pd-title-word still started at opacity 0 with a blur, so every /projects/<repo> title stayed hidden. The words now start visible and only slide; the F09 reveal test covers a project page and fails on blur too (it failed on the previous build).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The scheduled build (every 6 h) changes the prerendered HTML and the GitHub
snapshot together, but the CDN or a browser cache (JSON max-age 300) can
serve one build's HTML with the next build's JSON. Hydrating that patches
the text and keeps the old attributes (React 16), e.g. commit links pointing
at the previous commits.

- prerender stamps data pages with data-snapshot: the generatedAt of
  index.json (and of repos/<name>.json on a project page)
- snapshotStore.snapshotVersion() reports the same for the loaded data;
  src/index.js hydrates only on a match, otherwise renders fresh
- tests: the stamp in raw HTML; a match keeps the prerendered nodes; the next
  build's snapshot gets a fresh render with the new links (both failed on
  the previous build)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- every scroll reveal and the Projects / Open Source hero entrances start
  visible and only slide in (transform), so nothing waits at opacity 0
- Inter and JetBrains Mono are self-hosted (OFL) and the latin files are
  preloaded with font-display: optional: no Google Fonts request, no swap,
  layout shift ~0 on every page; first paint 0.7-0.9 s sooner than the
  Google Fonts setup on a throttled phone (same-session A/B)
- the contact status pill stays on one line on phones
- one manifest link; manifest gets id, scope, start_url "/", description and
  purpose "any"; /favicon.ico and /apple-touch-icon.png at the root
- Projects "Ready when you are" label meets contrast (#15803d light)
- /resume.pdf ready to switch on once the new PDF lands
- tests: f09-hygiene (reveals, icons, manifest, resume link, CLS on 8 pages
  at both widths); networkidle waits capped at 8 s; the Apache test image
  drops Debian's /icons/ alias

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- the browser no longer calls api.github.com for Aayush's data: a snapshot
  store reads public/data/github (index + per-repo files); githubClient keeps
  only the JSON cache the news feeds use
- the snapshot now carries the recent-commit stream, the activity feed (push
  head commits matched to their messages) and authored pull requests; ci,
  chore, fix and merge commits stay out of the public feeds
- deploy.yml rebuilds every 6 hours (and on demand) to refresh it
- no API x/60 counter or refresh button; counters show the real number from
  the first render (a dash while loading, never a fake 0)
- prerendered data pages preload the snapshot and the app waits for it before
  adopting the page, so nothing flashes or shifts
- copy: synced from GitHub several times a day, Activity log

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- scripts/prerender: after the build, headless Chromium renders every route
  (8 pages, each repository, each Tech Universe channel) into
  build/_pages/<route>.html and / into index.html, plus 404.html, sitemap.xml,
  llms.txt and a 1200x630 share image per route; live third-party feeds are
  not baked in; repos named with a blocked client term are never listed
- public/.htaccess: clean URLs for prerendered pages, real 404s for
  anything else, /home -> /, www -> apex, no trailing slashes; LiteSpeed-safe
- SeoHeader: per-route titles, share images and Tech Universe metadata
- the app hydrates the prerendered page when it is that URL in the default
  theme (else renders over it), after the HTML has painted; bundles defer
- metric-matched fallback fonts (CLS from font swaps ~0), non-blocking
  Google Fonts, font-display swap, WebP contact avatar, no noscript banner
- CI: prerender + raw-HTML checks before deploy and after it (live)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

With Home linking to / (F05), the NavLink matched every path, so Home was
highlighted on every page. Adds a regression test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- the intro never auto-plays: it runs on /splash only, from the new Play
  intro button in the hero or the header logo; / (with or without utm/ref
  parameters) renders the hero at once
- sound is off by default; a Sound on/off toggle in the intro is remembered
  and never skips it; the Enter gate that waited for a click is gone
- the intro ends on / (canonical); Home links point to /
- tests: no intro on plain visits, Play intro, sound toggle, reduced motion,
  header logo replay (desktop + mobile)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- the footer's fake success (no endpoint -> 700 ms 'Preview captured') is
  gone; until issue #1 the box says Newsletter coming soon with no form
  (portfolio.js newsletter.status), ?newsletter=preview shows the real one
- api/subscribe.php: origin, honeypot, form token, 5/h and 20/day per IP,
  then Buttondown POST /v1/subscribers (Buttondown sends the confirmation:
  double opt-in); same answer whether or not the address was subscribed
- api/buttondown-webhook.php: X-Buttondown-Signature HMAC, once per event,
  confirmed/unsubscribed/created mirrored into subscribers
- tests: a fake Buttondown for PHP integration tests (Docker + CI), and
  Playwright for coming-soon, success, errors and validation

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- api/contact.php: origin + JSON + size checks, honeypot, signed form token
  (min 3 s old), per-IP rate limit (3/10 min, 10/day), server validation;
  saves the lead and emails it via SMTP with Reply-To = the sender
- src/services/api/forms.js: form tokens, one automatic retry for a
  too-quick submit or an expired token, never throws
- the contact page shows sending / delivered / field errors / a fallback
  panel (open in mail app, copy, try again); mailto is only the fallback;
  the result is centred on phones and takes focus
- the footer's Get in touch opens the same form; a Book a 20-min call button
  appears once contactSection.booking.url is set; privacy text updated
- api: deprecations on newer PHP (8.4 live) are logged, not fatal; CI tests
  PHP 8.1 and 8.4
- tests: PHP endpoint tests, Playwright with the API mocked for every
  outcome, and a full-stack run against Docker + Mailpit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy.yml: PHP 8.2 + Composer (no dev packages), php -l, stage api/ into
build/, write the API config from secrets and upload it outside public_html,
then POST /api/migrate.php with the admin token (non-fatal).

test.yml (every push and PR): PHPUnit on PHP 8.1 and 8.3 against MySQL 8
and Mailpit service containers, and the Playwright suite (desktop + mobile)
on the production build, with cspell.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- api/: health, signed form tokens, admin-only migrate and mail-test
  endpoints, JSON 403/404
- lib/: Config, Db (PDO, real prepared statements), Validator, RateLimit
  (MySQL with a file fallback), FormToken (HMAC time-trap CSRF token), Http
  (origin check, body limits, client IP, admin token), Mailer (PHPMailer over
  SMTP), Migrator; migrations/001_init.sql creates leads, subscribers,
  rate_limits and webhook_events
- api/.htaccess keeps lib/, vendor/, migrations/, tests/ and config files
  private, and every response no-store + noindex; the root .htaccess hands
  /api and /admin to their folders before the SPA fallback
- scripts/deploy: stage api/ into build/ without tests or dev packages, and
  write the config from secrets
- PHPUnit: unit tests plus integration tests against MySQL, Mailpit and Apache
  (tests/server/docker-compose.yml)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- robots.txt lists Googlebot, Bingbot and the major AI crawlers in one
  allow-all group, and keeps them out of /api/, /admin/ and /splash
- scripts/qa/check-bots.mjs fetches a page with each crawler's user agent
  and fails on a block or a challenge page; once /api/health.php exists it
  also requires JSON 200 for webhook and CI user agents
- the Live check workflow runs it after every deploy, daily and on demand,
  from a GitHub datacenter IP (what webhook senders look like)
- docs: the hPanel AI Audit change that still returns 429 to GPTBot

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- Senior SDET & QA Lead is the one job title (hero, intro, footer, contact
  card, JSON-LD) and Aayush Mishra · Senior SDET & QA Lead the one site title
  (index.html, og:title, manifest)
- the JSON-LD Person drops the empty phone and address fields, keeps
  Instagram out of sameAs, and lists a certificate URL only when no other
  certificate shares it
- certificate cards checked against the certificates: links that opened
  another course's certificate are removed; Selenium, Postman, Swift and AWS
  name the course and issuer on the certificate
- copy: a variety of, documentary, Recurrence, Volunteering

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- desktop (1280px) and mobile (375px) projects against the production build,
  served by scripts/serve-build.mjs (or any BASE_URL)
- a fixture fails a test on console errors or uncaught exceptions
- serious/critical axe findings are compared with a baseline recorded from
  main (tests/fixtures/axe-baseline.json)
- smoke test for every top-level page
- cspell for the site copy (npm run spell)
- scripts/qa/screens.mjs takes 1280/375 report screenshots

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The site deploys from .github/workflows/deploy.yml (FTP to Hostinger); the
predeploy/deploy npm scripts and the gh-pages package were GitHub Pages
leftovers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Both were left uncommitted on main; the v3.1 plan asks for them to land
before the first feature branch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>