Rackula

A large usability release. The workspace is rebuilt around the canvas, and the storage layer is rebuilt to stop silently losing work. The rest is targeted fixes and technical-debt paydown that make the app faster to work in and more reliable. You can trust it with your data now. Please. It would mean a lot.

I'm looking forward to what's next.
@ggfevans

Added

• Command palette is the search input for commands: one box runs any action or finds any device, opened from the toolbar search pill or with Ctrl+K, with recents, a selection-aware empty state, device search, and click-to-place on desktop (#2212, #2213, #2214, #2341, #2352)
• Tabbed side panel replaces the single edit panel: Layouts, Racks, and Devices tabs, contextual properties on the Edit tab, display toggles on the View tab, collapsible (#2076, #2077, #2078, #2082)
• Floating verb bars put context actions next to the selected device or rack, including a slot control for half-width devices (#2075, #2322, #2334, #2344)
• Layouts library lists every saved layout with cached previews, opened and managed from the sidebar (#2082, #2083, #2325)
• Open layouts persist as toolbar tabs and restore lazily on launch (#2079, #2080, #2324)
• Top bar reduced to workspace chrome (logo, app menu, layout name, storage status, settings); view and history controls relocated to a floating cluster at the canvas bottom-left, where the cursor already is (#2072, #2073, #2074, #2187)
• App menu behind the Rackula mark is now the main menu: reorganized by intent, with the menu-item registry contract completed, group headings renamed for clarity, dividers between groups, and a mobile sheet that renders the same projection (#2596, #2597, #2602, #2611)
• Settings dialog consolidates Appearance, Behaviour, and Data options (#2093)
• Device palette gains favourites, list virtualization for large libraries, and an image on/off toggle (#2094)
• New layouts open to a template picker instead of a blank canvas; the standalone StartScreen is gone, with entry routed through the sidebar and app menu (#2081, #2095)
• Export-all renders every layout with per-mode framing in one pass (#2045)
• Carrier device types host half-width and sub-U gear directly, replacing the fractional-rail model so sub-U placement is predictable (#2158, #2289, #2291, #2159)
• Storage status chip in the toolbar shows save state at a glance, with the storage location inline and a last-save details popover on hover or tap (#2035, #2446, #2640)
• Moving browser-stored layouts to server storage prompts before overwriting an existing server copy (#2608)
• Pre-overwrite snapshots are taken server-side with conflict detection; the Load dialog lists and restores them (#2040, #2041, #2042)
• Backup nudge tracks changes since the last export and warns before they are discarded, with a restore-from-file confirm step (#2034, #2038, #2039)
• Custom device images embed as base64 in the YAML save, so one file round-trips with its images (#617)
• Layout JSON Schema generated from the Zod schema for editor validation, under a documented versioning and compatibility policy (#1113, #2226)
• Full-depth devices render and collide on both rack faces, so a device stored facing front also occupies and shows on the rear (#2337)
• Keyboard alternative for placing devices, so a device can be added without a pointer (#106)
• Device images show a load placeholder, fade in when ready, and raise a toast on failure, with accessible alt text
• Create-custom-device promoted to a labelled button at the foot of the device palette (#2556)
• Hover-revealed edge grip on the panel seam as a second way to collapse a side panel
• Verb-bar and canvas-control tooltips are sourced from the command registry, so labels and shortcuts stay in step
• MikroTik CSS326-24G-2S+RM and CSS610-8G-2S+IN switches added to the device library (#1581)

Changed

• Persistence runs through one storage interface with an explicit, injected mode, replacing runtime probe-and-guess (#2027, #2036, #2037)
• A twin-tab guard stops two open tabs from overwriting the same working copy, with placement images namespaced per layout (#2044, #2270)
• Unknown top-level sections in a layout file survive a save instead of being dropped (#2208)
• Sidebar tabs ordered Layouts, Racks, Devices (#2326)
• Zoom snaps to round ladder rungs (#2336)
• Edit panel resolves device brand from the authoritative library; category names shown in singular (#2217, #2218, #2219)
• Display-mode toggle icon redesigned for clarity (#2335)
• Coffin-tapered mark adopted as the canonical logo (#2048)
• Rack PDUs modelled as shallow power bars that render in rear view (#2337)
• App light theme (Alucard) removed; Rackula is dark-only (#2468)
• Edit and View tab strip unified with the sidebar's segmented-control style (#2600)
• flip-device-face verb uses a transition-right glyph for clarity (#2400)
• The API validates a layout against the JSON Schema before persisting it (#2449)

Fixed

• Devices keep their container across same-rack and cross-rack moves, nudges, and YAML export; stale links are cleared on move (#2127, #2128, #2129, #2131, #2135, #2224)
• Keyboard nudge no longer ejects a contained device from its container (#2146)
• Undo and redo bind to the correct rack and no longer throw on deleted racks (#2126)
• In-progress device name edits stay attached to their device (#2223)
• Rack height input reverts when a bayed rack rejects the resize (#2222)
• Half-U stacking works again for 0.5U devices (#2152)
• NetBox import validates enum and interface fields instead of casting blindly (#2119, #2122)
• Export download no longer races object-URL revocation (#2201)
• Layout loads remap rack groups and container IDs in a two-pass load (#2155)
• Placement images survive server reconciliation and YAML round-trips (#2220, #2225)
• Layouts mark clean after a debounced auto-save (#2057, #2058, #2061, #2084)
• Snapshot data loss closed with strictly monotonic updatedAt and a per-layout write lock (#2067, #2233)
• Muted-text and QR-brand contrast raised to WCAG AA, nested-interactive controls flattened, and canvas racks given a listbox parent so axe WCAG AA passes (#2255, #2256)

Security

• CSV export escapes spreadsheet formula injection (#2200)
• Patched libssl3 and libcrypto3 for CVE-2026-45447 (alerts #80-83)
• Automated security-alert triage via Claude Code (#2357)
• Pinned libexpat to >=2.8.1-r0 in the deploy image for CVE-2026-45186 (#2562)

Technical

• Type checking restored across the utils, storage, and component layers; the last @ts-nocheck surfaces are gone (#1705, #2104, #2105)
• Layout store decomposed into per-layout instances behind a facade, with rack and device logic split into domain action modules; Canvas coordinate math and markup extracted; export.ts and EditPanel.svelte split into focused modules (#1077, #1080, #1396, #1398, #1610, #2024, #2025)
• E2E suite reworked: two-tier model with an environment approval gate, 4-way sharding, assertion-based waits, and role/label selectors, plus new undo/redo and accessibility coverage (#1227, #1231, #1420, #2002, #2003)
• Regression gates added: visual-diff tripwire, axe-core accessibility checks, a bundle-size budget, and a ban on CSS-class selectors in tests (#1423, #2098, #2099, #2185)
• Upgrade-safety net so a self-hosted deployment can take new images without losing saved data: prior-release layouts load through the real parse path in a self-discovering fixture corpus with silent-loss detection, plus a fail-closed release guard; the Docker upgrade smoke drives the compose stack from the previous released image to the new build against the same volume and confirms the saved layout survives byte-for-byte (#2448, #2515)
• i18n deferred to M011; the orphaned Paraglide runtime removed (#2184)
• Dev tooling hardened: cloud-safe superpowers bootstrap, worktree-aware main-edit guard, POSIX husky hooks, the /orchestrate-issues command, and pre-push gate fixes (#2102, #2288)
• Upgrade corpus exercises the loadLayout path with v0.6 single-rack YAML fixtures (#2450, #2451)
• Vendor asset directories normalized and the generic device library split from brand packs (#2552)
• @testing-library/svelte pinned to 5.3.1 to restore runes compatibility in the unit suite (#2587)
• SPA entry document revalidated on deploy so a stale cache stops serving the old build (#2599)
• DCO sign-off section added to CONTRIBUTING (#2559)
• Research spikes: accurate depth model for M021 (#2622) and Cloudflare Workers Static Assets for #2029 prep (#2620)
• Dependency updates across the production, development, vitest, eslint, and api groups