release: v0.3.1 — reliability, accessibility & data-integrity hardening

[varunpan]

Summary

v0.3.1 is a reliability, accessibility, and data-integrity hardening release. Full changelog section below.

[0.3.1] — 2026-07-14

Added

• Odometer entry is now whole-numbers only. The odometer field rejects a
  decimal point or comma as you type and enforces whole-number steps, so a
  stray . or , can no longer land in a reading. When the field is empty its
  placeholder now hints the last recorded reading — or "No last fuel up" when
  there's no history — instead of a fixed example (enhancement: Odometer entry #64).

Changed

• Re-bumped @sveltejs/kit to 2.68.0, dropping the temporary 2.64.0 pin.
  v0.3.0 pinned kit to 2.64.0 to dodge a CSS-preload doubled-path 404 regression
  introduced in 2.65.0 (kit #16039);
  the upstream fix (#16026) shipped in
  2.65.1, so the pin is no longer needed and kit is back on a caret range at the
  current latest. The css-preload e2e guard confirms the doubled-path 404s stay
  gone. Dev/build dependency only — no runtime or behaviour change.
• Screen readers now announce the Volume and Cost fields by name. Both amount
  fields carry an explicit accessible label rather than relying on their
  placeholder, so assistive tech reads "Volume" / "Cost" instead of the example
  value.

Fixed

• Documentation reconciled with the code. A full grounding review of every
  technical and user doc (plus architecture.md and deployment.md) against
  the v0.3.1 code found ~75 stale or wrong claims — pre-fix implementation
  descriptions (locale pinning, ISO date handling, queue pruning, 2-provider
  OCR activation, separate vehicle caches), outdated constants and UI
  descriptions, dead anchors, and undocumented behavior. All verified findings
  fixed; docs now match the shipped code.
• Screen readers now announce the submit outcome. The logged / saved-offline /
  failed toast after submitting a fill-up was invisible to assistive tech; it now
  carries a live-region role (status, or alert for errors) like every other
  transient panel in the app.
• Offline fill-ups replayed hours or days later can no longer create duplicate
  records in LubeLogger. If a submission's POST landed upstream but the app
  never learned it (the service worker was killed before marking the entry
  synced, or the response was lost in transit), the queued entry would be
  re-sent on the next app open — past the server's 60-second dedupe window —
  and a second identical gas record appeared in LubeLogger. Replayed
  submissions are now flagged, and the server checks LubeLogger for an
  already-landed record (same date + odometer + fuel volume) before writing,
  so a re-send finds the original instead of duplicating it.
• Failed-but-billed OCR calls now count against the daily budget. When a
  paid vision provider returned a response that then failed validation (bad
  JSON, out-of-range reading), the spend was never recorded — the money was
  burned invisibly and the daily budget cap could never trip on it. The budget
  and the audit log now record the estimated cost of every paid attempt that
  actually got a response, including failed attempts inside a provider chain;
  pure network/timeout failures still cost nothing.
• Rate-limiter memory no longer grows forever. The per-IP tracking maps
  behind the OCR and client-log endpoints kept an entry for every IP that ever
  called them — entries for IPs that never returned were never cleaned up, a
  slow leak on a long-running server. Both maps now sweep out expired entries
  opportunistically (at most once per rate window).
• Two fillups on the same day no longer show the earlier one as "last
  fillup". The last-fillup lookup compared records by date only, so with two
  fillups on one date it returned whichever LubeLogger listed first — usually
  the earlier one, which threw off the odometer prefill and the home-page
  strip. Same-day ties now go to the record with the higher odometer reading.
• Oversized uploads are now rejected before they are buffered into memory.
  The fillup and client-log endpoints read the whole request body before any
  size check ran, so a huge (or hostile) upload could balloon server memory —
  the container deliberately runs without a transport body cap. Both endpoints
  now reject from the advertised Content-Length up front with a clean 413:
  fillup at twice the photo policy (OCR_MAX_IMAGE_MB) plus form slack, the
  log endpoint at its existing 100 KiB batch cap. Requests without the header
  still fall through to the existing post-parse checks.
• The health endpoint no longer echoes raw LubeLogger error text. When the
  upstream check failed, /healthz returned the internal error message —
  including the upstream status and a preview of its response body — to anyone
  who asked. It now answers a generic "upstream unreachable" and keeps the
  real cause in the server log.
• A fillup submitted with a blank submission id can no longer silently
  swallow the next one. The API's required-field check let an empty or
  whitespace-only clientSubmissionId through, where it became a shared
  idempotency key — two different submissions sending "" within a minute
  collided, and the second got the first's cached "success" without ever being
  recorded. The server now rejects a blank or non-string id with a clear 400.
• Stopped Tailwind from emitting an invalid utility class out of the compose
  files. Tailwind v4's automatic class detection scanned the whole project —
  including compose.dev.yml / compose.example.yml — and turned the Docker
  security_opt hardening line into a bogus arbitrary-property CSS rule that
  browsers logged as a dropped declaration on every page load. Detection is now
  scoped to src/ (where all the app's markup lives), so the junk rule and its
  console warning are gone; every real utility class is unaffected.
• A manually-entered FX rate no longer survives a currency switch. When
  the rate sources were unreachable and you typed a manual rate, switching the
  currency select — including back to your instance's own currency — hid the
  field but silently kept the value, and the next submit sent it, mis-pricing
  the fillup (the same retention could carry one currency's rate into
  another). Any currency change now discards the typed rate.
• A fill-up can no longer vanish silently when both the server and device
  storage are unavailable. When a submission hit a server error and the
  offline save-for-later also failed (Safari private mode, storage quota), the
  app showed nothing at all — no error, no queued chip, fill-up gone. It now
  shows an explicit "Couldn't save — device storage unavailable. This fill-up
  was NOT saved." error so you know to retry.
• A pasted decimal odometer reading is rounded before submit. The odometer
  field blocks a typed . or ,, but pasting or autofilling a value like
  50123.4 slipped through and was submitted as-is. The submission now rounds
  to the nearest whole reading, matching what the photo-OCR apply already did.
• The "Logged: …" confirmation now formats the cost in the currency the
  server reported. It previously fell back to the cached instance currency,
  which shows the wrong symbol on a cold cache (a fresh install before the
  server info has been fetched). The server response carries the authoritative
  currency for the converted cost — the toast now uses it.
• Reopening the camera and cancelling no longer discards the photo queued
  for attachment. Tapping a photo pill again used to throw away the retained
  pump/odometer photo the moment the picker opened — backing out of the picker
  left nothing to attach and the attach row gone. The retained photo is now
  replaced only when a new one is actually picked.
• A crop dragged flush against the photo's edge is no longer silently
  discarded. Floating-point rounding in the zoom/pan crop math could push an
  edge-flush crop a hair past the image boundary, and the sanitizer then threw
  the whole crop away — the full photo went to OCR as if no crop had been
  made. Such crops are now clamped to the edge and kept; genuinely invalid
  crop rectangles still fall back to the full image.
• History is no longer silently capped at 5 fill-ups per vehicle. The
  offline queue pruned synced fill-ups down to the newest 5 per vehicle on
  every sync — and those rows are exactly what the History page shows, so
  older entries (and their converted-cost snapshots) quietly vanished. The
  cap is now a setting — Settings → "Fill-ups kept per vehicle", default
  200 — so History keeps a real trail and you control how much stays on the
  device.

Tests

• e2e specs locate the odometer field by its #odometer id rather than by
  placeholder text (6 specs, 21 call sites). Placeholder text isn't a stable
  test contract — matching on it coupled the specs to a fixed string and would
  break them when the placeholder becomes dynamic; the id keeps them robust.

Test plan

• Automated sweep green — lint / check (0 errors, 0 warnings) / 806 unit tests / build / 92 e2e
• Image vulnerability scan clean — 0 fixable CRITICAL/HIGH (Trivy, scripts/scan.sh)
• Per-feature/fix UAT completed on iPhone Safari during the release cycle (each change UAT'd before its merge into the release branch)
• Screenshots NOT refreshed this cycle — shipping stale by explicit choice (notably the new Settings "Fill-ups kept per vehicle" control)

🤖 Generated with Claude Code