The Yarnmates changelog.

## 2026-09-13 — Video & Game Visibility

- Fixed Latest Videos so newest published videos appear first.
- Kept Featured Video separate from the Latest Videos order.
- Verified and repaired GTA VI First Look thumbnail fallback.
- Added visibility checks for the Mr Hopps game hub.
- Normalized the Mr Hopps slug to `mr-hopps` when needed.
- Improved PWA navigation caching so new videos, games, and articles appear without stale homepage content.
- Added no-cache protection for live HTML pages.
- Desktop and mobile/PWA behavior included in this update.

# MimiStitch Changelog

## Day 1 — August 23, 2026

### Version 1.0.0 — Initial Development

- Started the independent MimiStitch application
- Created the separate `~/Projects/MimiStitch` project folder
- Created a separate Python virtual environment
- Created the initial Flask application
- Created the separate MimiStitch SQLite database structure
- Added the official MimiStitch branding
- Confirmed the official slogan: `CROCHET. CREATE. CONNECT.`
- Added the official yarn-heart and crochet-hook logo
- Created the responsive MimiStitch dashboard
- Added the initial project-tracking system
- Added the New Project form
- Added functional row-counter controls
- Added automatic project-progress calculations
- Added the initial yarn-stash section
- Added sample crochet projects from the approved mockups
- Added the application health endpoint
- Assigned development port `8003`
- Kept MimiStitch completely separate from Nexis, Axis and AviPath

### Sample Projects

- Lavender Dreams Blanket
- Bunny Plushie
- Sunflower Tote Bag
- Cozy Ribbed Beanie

### Day 1 Status

Development started. Initial dashboard foundation is being built and tested.

## Day 1 Logo Update — August 23, 2026

- Installed the official MimiStitch logo
- Added the logo to the application navigation
- Confirmed the official slogan: CROCHET. CREATE. CONNECT.
- Preserved the original pink, purple, yarn-heart and crochet-hook branding

## Day 1 Logo Correction — August 23, 2026

- Removed the duplicate logo
- Removed the black borders from the uploaded logo
- Preserved the original MimiStitch artwork
- Installed one clean official logo in the sidebar

## Day 2 Deployment Preparation — August 24, 2026

### Version 1.0.1

- Prepared MimiStitch for private GitHub deployment
- Prepared MimiStitch for always-on operation on Vinny
- Connected secure environment configuration
- Connected environment-controlled database configuration
- Changed debug mode to an environment-controlled development option
- Added automatic instance-directory creation
- Added the Gunicorn production server
- Preserved the official MimiStitch logo and visual identity
- Confirmed that the database, uploads, secrets, backups and logs remain outside Git
- Reserved production port 8003
- Prepared phone testing through Tailscale

## Day 2 Private Accounts and Marketplace — August 24, 2026

### Version 1.1.0

- Added required user registration and login
- Added secure password hashing
- Added login persistence and logout
- Added private user ownership for projects
- Added private user ownership for yarn
- Removed automatic demonstration projects and yarn
- Made every new account start with a blank workspace
- Prevented users from viewing or changing another user’s projects
- Replaced the hardcoded Mimi profile with the current user
- Added Owner and Member roles
- Added working navigation destinations
- Added the Marketplace preview page
- Added the Shop upgrade page
- Kept payments and purchases disabled
- Added blank project and yarn states
- Updated the health version to 1.1.0

## Day 2 Brand Footer — August 24, 2026

### Version 1.1.1

- Added MimiStitch trademark identification
- Added the 2026 copyright notice
- Added the all-rights-reserved notice
- Added Developed by ClarkWorks
- Displayed the brand footer throughout the application

## Day 2 Community Foundation — August 24, 2026

### Version 1.2.0

- Added a shared crochet Community feed
- Added member-created discussion posts
- Added optional project-photo uploads
- Added comments and supportive replies
- Added post likes
- Added post reporting
- Added Owner moderation controls
- Added member controls for deleting personal posts and comments
- Kept private projects and yarn separate from Community posts
- Added clear Community and Marketplace separation
- Added mobile Community layouts
- Added Community safety guidance
- Kept Community image files outside GitHub


## Functional Dashboard Repair — August 30, 2026

### Version 1.2.1

- Fixed dashboard buttons that previously had no action
- Added working project and yarn search
- Added functional View All projects control
- Added project action menus
- Added project editing
- Added project deletion confirmation
- Added editable project status, yarn, hook size, notes and color
- Added working Yarn Stash management modal
- Connected Manage Yarn to the existing yarn inventory backend
- Connected Ask the Assistant to the Crochet Assistant section
- Added notification feedback instead of an unresponsive button
- Added button types to prevent accidental form submissions
- Improved modal close behavior, including Escape-key support
- Improved row-counter error handling
- Added automatic flash-message dismissal
- Updated health endpoint to version 1.2.1

### Version 1.2.1 Final Functional Pass

- Replaced critical dashboard JavaScript-only controls with native HTML links and forms
- Added dedicated New Project page
- Added dedicated Edit Project page
- Added persistent project color editing
- Added native row increase and decrease controls
- Added dedicated Yarn Stash management page
- Added working server-side project and yarn search
- Added dedicated Notifications page
- Added functional Crochet Assistant question page
- Made project action menu work without JavaScript using native HTML details
- Prevented inactive modal overlays from blocking page clicks
- Kept JavaScript limited to optional enhancements such as the mobile menu and flash dismissal


# October 5, 2026 — Launch Hardening

## October 05, 2026 — 11:11 PM PDT

### Clarkium branding
- Updated Yarnmates legal and privacy-facing ownership references from the developer's personal name to Clarkium.
- Updated Privacy, Terms, legal contact information, documentation and About branding.
- Verified the public Privacy page displays Clarkium.

### CDN and cache protection
- Corrected stale dynamic HTML being served through Bunny CDN.
- Dynamic HTML now uses private/no-store/no-cache response headers.
- Verified current public pages are reaching the updated application instead of stale cached HTML.
- Static assets remain separate from dynamic HTML handling.

### Security review
- Verified global CSRF protection is enabled.
- Verified secure session cookie configuration.
- Verified login and registration rate limiting.
- Verified password hashing and account ownership protections.
- Verified environment files are not tracked by Git.
- Verified application security headers remain active.

### Newsletter restored
- Restored the NewsletterSubscriber application model against the existing newsletter_subscriber database table.
- Restored the /newsletter POST route.
- Added CSRF protection to the newsletter signup form.
- Added newsletter rate limiting at 5 requests per minute.
- Verified tokenless newsletter submissions are rejected with HTTP 400.
- Existing newsletter database structure was preserved.

### Public changelog
- Removed the login requirement from /changelog.
- Changelog can now be viewed without a Yarnmates account.
- Verified /changelog returns HTTP 200 for logged-out visitors.

### Login CSRF verification
- Verified the login page generates a CSRF token.
- Verified the login page generates the matching session cookie.
- Verified a POST using the matching session and CSRF token is accepted by CSRF protection.
- Login route and login form passed the local CSRF session test.

### Deployment
- Yarnmates remained active on KINGTAY throughout the verified repairs.
- Python compilation passed after controlled changes.
- Backups were created before each launch-hardening repair.

## October 05, 2026 — 11:20 PM PDT — Verified User Flow & Privacy Testing

### Account flow
- Verified a new account can register successfully through the real registration form.
- Verified new accounts are assigned the Member role.
- Verified registration generates and validates a CSRF token.
- Verified successful registration opens the authenticated Yarnmates workspace.
- Verified authenticated sessions receive working CSRF protection.
- Verified POST logout works correctly.
- Verified protected pages redirect logged-out users to login.

### Projects and row tracking
- Verified an authenticated Member can create a private project.
- Verified the created project is assigned to the correct user account.
- Verified the project row counter can advance a row.
- Verified project progress calculation updates correctly from row totals.
- Test result: row 1 of 20 correctly calculated as 5% progress.

### Yarn Stash
- Verified an authenticated Member can create a yarn record.
- Verified the yarn record is assigned to the correct user account.
- Verified Yarn Stash CSRF protection is active.

### Pattern Library
- Verified an authenticated Member can create a private pattern.
- Verified the pattern is assigned to the correct user account.
- Verified the pattern owner can view the private pattern.
- Verified Pattern Library CSRF protection is active.

### Cross-account privacy isolation
- Created two isolated temporary Member accounts for controlled privacy testing.
- Verified a second authenticated account cannot access another user's project edit page.
- Verified a second authenticated account cannot access another user's project tracker.
- Verified a second authenticated account cannot access another user's yarn edit page.
- Verified a second authenticated account cannot view another user's private pattern.
- Verified a second authenticated account cannot edit another user's private pattern.
- Unauthorized cross-account requests returned HTTP 404.
- Verified no private project, yarn or pattern content appeared in unauthorized responses.
- Verified the original owner's records remained unchanged after access attempts.

### Test cleanup
- Created a database backup before removing temporary test data.
- Verified temporary test records before deletion.
- Removed only the controlled launch-test accounts and their test records.
- Verified all launch-test records were removed successfully.
- Verified existing Yarnmates user data remained intact after cleanup.
- Database returned to 2 existing users, 1 existing project, 2 existing yarn records and 1 existing pattern.
- Yarnmates service remained active throughout testing.