@floless/app 0.8.0 → 0.9.1

package/dist/floless-server.cjs

@@ -72,7 +72,7 @@ var require_queue = __commonJS({
       if (!(_concurrency >= 1)) {
         throw new Error("fastqueue concurrency must be equal to or greater than 1");
       }
-      var cache = reusify(Task);
+      var cache2 = reusify(Task);
       var queueHead = null;
       var queueTail = null;
       var _running = 0;
@@ -151,7 +151,7 @@ var require_queue = __commonJS({
         return _running === 0 && self.length() === 0;
       }
       function push(value, done) {
-        var current = cache.get();
+        var current = cache2.get();
         current.context = context;
         current.release = release;
         current.value = value;
@@ -172,7 +172,7 @@ var require_queue = __commonJS({
         }
       }
       function unshift(value, done) {
-        var current = cache.get();
+        var current = cache2.get();
         current.context = context;
         current.release = release;
         current.value = value;
@@ -194,7 +194,7 @@ var require_queue = __commonJS({
       }
       function release(holder) {
         if (holder) {
-          cache.release(holder);
+          cache2.release(holder);
         }
         var next = queueHead;
         if (next && _running <= _concurrency) {
@@ -6621,12 +6621,12 @@ var require_levels = __commonJS({
     function genLsCache(instance) {
       const formatter = instance[formattersSym].level;
       const { labels } = instance.levels;
-      const cache = {};
+      const cache2 = {};
       for (const label in labels) {
         const level = formatter(labels[label], Number(label));
-        cache[label] = JSON.stringify(level).slice(0, -1);
+        cache2[label] = JSON.stringify(level).slice(0, -1);
       }
-      instance[lsCacheSym] = cache;
+      instance[lsCacheSym] = cache2;
       return instance;
     }
     function isStandardLevel(level, useOnlyCustomLevels) {
@@ -25430,7 +25430,7 @@ var require_range = __commonJS({
       parseRange(range) {
         const memoOpts = (this.options.includePrerelease && FLAG_INCLUDE_PRERELEASE) | (this.options.loose && FLAG_LOOSE);
         const memoKey = memoOpts + ":" + range;
-        const cached = cache.get(memoKey);
+        const cached = cache2.get(memoKey);
         if (cached) {
           return cached;
         }
@@ -25464,7 +25464,7 @@ var require_range = __commonJS({
           rangeMap.delete("");
         }
         const result = [...rangeMap.values()];
-        cache.set(memoKey, result);
+        cache2.set(memoKey, result);
         return result;
       }
       intersects(range, options) {
@@ -25503,7 +25503,7 @@ var require_range = __commonJS({
     };
     module2.exports = Range;
     var LRU = require_lrucache();
-    var cache = new LRU();
+    var cache2 = new LRU();
     var parseOptions = require_parse_options();
     var Comparator = require_comparator();
     var debug = require_debug2();
@@ -26445,12 +26445,12 @@ var require_plugin_utils = __commonJS({
       if (display) {
         return display;
       }
-      const cache = require.cache;
-      if (cache) {
-        const keys = Object.keys(cache);
+      const cache2 = require.cache;
+      if (cache2) {
+        const keys = Object.keys(cache2);
         for (let i = 0; i < keys.length; i++) {
           const key = keys[i];
-          if (cache[key].exports === func) {
+          if (cache2[key].exports === func) {
             return key;
           }
         }
@@ -42463,10 +42463,10 @@ var require_accept_negotiator = __commonJS({
       }
       const {
         supportedValues = [],
-        cache
+        cache: cache2
       } = options && typeof options === "object" && options || {};
       this.supportedValues = supportedValues;
-      this.cache = cache;
+      this.cache = cache2;
     }
     Negotiator.prototype.negotiate = function(header) {
       if (typeof header !== "string") {
@@ -52093,6 +52093,9 @@ function mapUserStatus(u) {
 function signInUrl() {
   return `${env().webBase}/login?app=floless`;
 }
+function webBaseUrl() {
+  return env().webBase;
+}
 function updateApiBase() {
   return `${env().apiBase}/updates/releases`;
 }
@@ -52354,7 +52357,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.8.0" : void 0,
+    define: true ? "0.9.1" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52364,7 +52367,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.8.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.9.1" : void 0 });
 }
 
 // oauth-presets.ts
@@ -52403,13 +52406,23 @@ function managedProfileYaml(preset) {
 function oauthDir() {
   return process.env.AWARE_HOME ? (0, import_node_path6.join)(process.env.AWARE_HOME, "oauth") : (0, import_node_path6.join)((0, import_node_os6.homedir)(), ".aware", "oauth");
 }
+function isUpgradableLegacyProfile(existing, preset) {
+  if (existing.startsWith(MANAGED_HEADER)) return false;
+  const content = existing.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
+  const only = content.length === 1 ? content[0] : void 0;
+  if (only === void 0) return false;
+  const m = /^client_id\s*:\s*(.+?)\s*$/.exec(only);
+  return m !== null && m[1] === preset.clientId;
+}
 function ensureManagedProfile(id) {
   const preset = OAUTH_PRESETS[id];
   if (!preset) return "not-managed";
   const dir = oauthDir();
   const file = (0, import_node_path6.join)(dir, `${id}.yaml`);
   const existing = (0, import_node_fs7.existsSync)(file) ? (0, import_node_fs7.readFileSync)(file, "utf8") : null;
-  if (existing !== null && !existing.startsWith(MANAGED_HEADER)) return "skipped";
+  if (existing !== null && !existing.startsWith(MANAGED_HEADER) && !isUpgradableLegacyProfile(existing, preset)) {
+    return "skipped";
+  }
   const desired = managedProfileYaml(preset);
   if (existing === desired) return "unchanged";
   (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
@@ -53924,6 +53937,87 @@ async function reportIssue(input) {
   return { ok: true, ref };
 }
 
+// release-notes.ts
+var FETCH_TIMEOUT_MS = 8e3;
+var AWARE_REPO = "aware-aeco/aware";
+var CHANGE_RE = /^[-*]\s+\*\*?(Added|Changed|Fixed|Removed|Security)\*\*?:\s+(.+)$/gim;
+function parseBulletChanges(body) {
+  const out = [];
+  let m;
+  CHANGE_RE.lastIndex = 0;
+  while ((m = CHANGE_RE.exec(body)) !== null) out.push({ type: m[1].toLowerCase(), description: m[2].trim() });
+  return out;
+}
+var cache = /* @__PURE__ */ new Map();
+var CACHE_TTL_MS = 5 * 6e4;
+async function getJson(url, headers = {}) {
+  try {
+    const res = await fetch(url, { headers, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { status: res.status, json };
+  } catch {
+    return null;
+  }
+}
+async function getAppReleaseNotes(version, deps = {}) {
+  const useCache = !deps.changelogUrl;
+  const key = `app:${version}`;
+  if (useCache) {
+    const hit = cache.get(key);
+    if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.notes;
+  }
+  const url = deps.changelogUrl ?? `${webBaseUrl()}/changelog.json`;
+  const r = await getJson(url);
+  let notes;
+  if (!r || r.status >= 400 || !Array.isArray(r.json)) {
+    notes = { ok: false, reason: "unavailable" };
+  } else {
+    const e = r.json.find(
+      (x) => typeof x === "object" && x !== null && x.version === version
+    );
+    notes = e ? {
+      ok: true,
+      component: "app",
+      version,
+      title: String(e.title ?? `v${version}`),
+      summary: String(e.description ?? ""),
+      changes: Array.isArray(e.changes) ? e.changes.filter((c) => typeof c === "object" && c !== null).map((c) => ({ type: String(c.type ?? ""), description: String(c.description ?? "") })) : [],
+      url: typeof e.url === "string" ? e.url : `${webBaseUrl()}/changelog#v${version}`
+    } : { ok: false, reason: "not-found" };
+  }
+  if (useCache && (notes.ok || notes.reason === "not-found")) cache.set(key, { at: Date.now(), notes });
+  return notes;
+}
+async function getAwareReleaseNotes(version, deps = {}) {
+  const useCache = !deps.apiBase;
+  const key = `aware:${version}`;
+  if (useCache) {
+    const hit = cache.get(key);
+    if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.notes;
+  }
+  const base = deps.apiBase ?? "https://api.github.com";
+  const r = await getJson(`${base}/repos/${AWARE_REPO}/releases/tags/v${version}`, {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "floless.app"
+  });
+  let notes;
+  if (!r || r.status >= 400 || typeof r.json !== "object" || r.json === null) {
+    notes = r && r.status === 404 ? { ok: false, reason: "not-found" } : { ok: false, reason: "unavailable" };
+  } else {
+    const rel = r.json;
+    const body = typeof rel.body === "string" ? rel.body : "";
+    const changes = parseBulletChanges(body);
+    const summary = body.split("\n").map((l) => l.trim()).find((l) => l && !l.startsWith("#") && !l.startsWith("-") && !l.startsWith("*")) ?? "";
+    notes = { ok: true, component: "aware", version, title: rel.name ?? `AWARE ${version}`, summary, changes, url: rel.html_url ?? `https://github.com/${AWARE_REPO}/releases/tag/v${version}` };
+  }
+  if (useCache && (notes.ok || notes.reason === "not-found")) cache.set(key, { at: Date.now(), notes });
+  return notes;
+}
+
 // run-summary.ts
 var clampMsg = (s) => {
   const t = s.trim();
@@ -56432,7 +56526,9 @@ async function startServer() {
     if (req.url.startsWith("/api/health") || req.url.startsWith("/api/license/") || req.url.startsWith("/api/bootstrap/") || req.url.startsWith("/api/autostart") || // Report-an-issue is a support lifeline: a user whose subscription lapsed must still be
     // able to report "I got locked out". It touches no workspace data and the relay still
     // requires a valid SESSION token (so it's not open abuse — see report-relay.ts).
-    req.url.startsWith("/api/report-issue") || req.url.startsWith("/api/update") || req.url.startsWith("/api/aware/update")) return;
+    req.url.startsWith("/api/report-issue") || req.url.startsWith("/api/update") || req.url.startsWith("/api/aware/update") || // Release notes are a read-only display surface for the update pills — a local control,
+    // no workspace data, never spawns `aware`. Exempt like the other update routes.
+    req.url.startsWith("/api/release-notes")) return;
     const { state: state2, signInUrl: signInUrl2 } = await getLicenseStatus();
     if (state2 !== "valid" && state2 !== "offline-grace") {
       return reply.status(402).send({ ok: false, error: "subscription required", state: state2, signInUrl: signInUrl2 });
@@ -56451,6 +56547,8 @@ async function startServer() {
       ok: true,
       appVersion: appVersion(),
       // the installed build (sq.version), so it's scriptable
+      webBase: webBaseUrl(),
+      // channel-correct public site base, for the changelog deep-link
       awareVersion: awareInstalledVersion() ?? bs.awareVersion,
       // fresh (TTL-cached) install version; the boot snapshot is only a fallback
       awareReady: bs.awareReady,
@@ -56540,6 +56638,13 @@ async function startServer() {
       awareInstallInFlight = false;
     }
   });
+  app.get("/api/release-notes", async (req, reply) => {
+    const component = req.query.component === "aware" ? "aware" : "app";
+    const version = typeof req.query.version === "string" ? req.query.version.trim().replace(/^v/, "") : "";
+    if (!/^\d+\.\d+\.\d+(?:[-+][\w.]+)?$/.test(version)) return reply.status(400).send({ ok: false, reason: "unavailable" });
+    const notes = component === "aware" ? await getAwareReleaseNotes(version) : await getAppReleaseNotes(version);
+    return notes;
+  });
   app.post("/api/bootstrap/retry", async () => {
     const st = getBootstrapState().status;
     if (st === "failed" || st === "idle") {

package/dist/web/app.css

@@ -2265,3 +2265,221 @@ body {
   .req-thumb { width: 46px; height: 46px; padding: 0; border: 1px solid var(--border-strong); border-radius: 4px; background: var(--bg); overflow: hidden; cursor: pointer; flex-shrink: 0; transition: border-color 0.15s; }
   .req-thumb img { width: 100%; height: 100%; object-fit: cover; display: block; }
   .req-thumb:hover { border-color: var(--accent-dim); }
+
+  /* ============================================================================
+   * Release notes — the click-to-open popover on the footer update pills, and the
+   * relaunch-surviving "what's new" panel after a floless.app self-update.
+   * Baseline tokens only (shadcn dark slate-blue): no new fonts/colours/aesthetics.
+   * The popover's upward shadow IS the elevation cue (no decorative arrow); change
+   * types are typeset, never coloured badges (only `.added` borrows --accent).
+   * ==========================================================================*/
+
+  /* ── Popover (shared by #app-update and #aware-update) ───────────────────── */
+  .relnotes-popover {
+    position: fixed;
+    width: 320px;
+    background: var(--surface);
+    border: 1px solid var(--border-strong);
+    border-radius: 8px;
+    box-shadow: 0 -8px 32px rgba(0, 0, 0, 0.55), 0 0 0 1px var(--border-strong);
+    z-index: 1000;
+    color: var(--text);
+    animation: relnotes-in 0.14s ease-out;
+  }
+  .relnotes-popover[hidden] { display: none; }
+  @keyframes relnotes-in {
+    from { opacity: 0; transform: translateY(6px); }
+    to   { opacity: 1; transform: translateY(0); }
+  }
+  .relnotes-header { padding: 16px 16px 0; }
+  .relnotes-title { font-size: 14px; font-weight: 700; color: var(--text); line-height: 1.3; }
+  .relnotes-summary { font-size: 12px; color: var(--text-muted); margin-top: 4px; line-height: 1.45; }
+  .relnotes-body {
+    padding: 12px 16px;
+    max-height: 260px;
+    overflow-y: auto;
+    border-top: 1px solid var(--border);
+    border-bottom: 1px solid var(--border);
+  }
+  .relnotes-actions { padding: 12px 16px; display: flex; gap: 8px; align-items: center; }
+
+  /* Typed change bullets — REUSED verbatim by the what's-new panel (one renderer). */
+  .relnotes-group { margin-bottom: 12px; }
+  .relnotes-group:last-child { margin-bottom: 0; }
+  .relnotes-type {
+    font-family: var(--mono);
+    font-size: 9px;
+    text-transform: uppercase;
+    letter-spacing: 0.16em;
+    font-weight: 600;
+    color: var(--text-dim);
+    margin-bottom: 5px;
+  }
+  .relnotes-type.added { color: var(--accent); }
+  .relnotes-list { list-style: none; display: flex; flex-direction: column; gap: 3px; }
+  .relnotes-item {
+    position: relative;
+    font-size: 12px;
+    color: var(--text-muted);
+    line-height: 1.45;
+    padding-left: 12px;
+  }
+  .relnotes-item::before { content: "–"; position: absolute; left: 0; color: var(--text-dim); }
+
+  /* Skeleton — renders instantly while notes load; the action row is live beneath it. */
+  .relnotes-skel { display: flex; flex-direction: column; gap: 8px; }
+  .relnotes-skel-line {
+    height: 11px;
+    border-radius: 3px;
+    background: var(--surface-2);
+    position: relative;
+    overflow: hidden;
+  }
+  .relnotes-skel-line:nth-child(2) { width: 85%; }
+  .relnotes-skel-line:nth-child(3) { width: 70%; }
+  .relnotes-skel-line::after {
+    content: "";
+    position: absolute;
+    inset: 0;
+    transform: translateX(-100%);
+    background: linear-gradient(90deg, transparent, var(--surface-3), transparent);
+    animation: relnotes-shimmer 1.3s ease-in-out infinite;
+  }
+  @keyframes relnotes-shimmer { to { transform: translateX(100%); } }
+  .relnotes-unavailable { font-size: 12px; color: var(--text-dim); font-style: italic; }
+
+  /* Action row — Update now reuses the modal .primary recipe; the changelog link is a ghost. */
+  .relnotes-update {
+    background: var(--accent);
+    color: #fff;
+    border: 1px solid var(--accent);
+    font-weight: 600;
+    padding: 7px 14px;
+    border-radius: 4px;
+    font-size: 12px;
+    cursor: pointer;
+    transition: background 0.15s, box-shadow 0.15s;
+  }
+  .relnotes-update:hover { background: var(--accent-bright); box-shadow: 0 0 14px var(--accent-glow); }
+  .relnotes-update[disabled] { opacity: 0.6; cursor: default; }
+  .relnotes-update[disabled]:hover { background: var(--accent); box-shadow: none; }
+  .relnotes-changelog {
+    margin-left: auto;
+    background: transparent;
+    border: 1px solid transparent;
+    color: var(--text-dim);
+    padding: 7px 10px;
+    border-radius: 4px;
+    font-size: 12px;
+    text-decoration: none;
+    cursor: pointer;
+    transition: background 0.15s, border-color 0.15s, color 0.15s;
+  }
+  .relnotes-changelog:hover { background: var(--surface-2); border-color: var(--border-strong); color: var(--text-muted); }
+  .relnotes-update:focus-visible,
+  .relnotes-changelog:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+
+  /* The AWARE version label becomes a notes affordance after an in-place upgrade. */
+  .aware-version.relnotes-reopen { cursor: pointer; }
+  .aware-version.relnotes-reopen:hover { color: var(--accent-bright); }
+
+  /* ── What's-new panel (floless.app post-update) ─────────────────────────────
+     A 4th grid row above the footer — NOT absolutely positioned. .has-whats-new
+     inserts an `auto` row + a full-width `whats-new` area between the body and footer. */
+  .app.has-whats-new {
+    grid-template-rows: 60px 1fr auto 44px;
+    grid-template-areas:
+      "header   header   header"
+      "chat     canvas   inspect"
+      "whats-new whats-new whats-new"
+      "footer   footer   footer";
+  }
+  .whats-new {
+    grid-area: whats-new;
+    background: var(--surface);
+    border-top: 1px solid var(--border);
+    border-bottom: 1px solid var(--border);
+    border-left: 3px solid var(--accent);
+    font-size: 12px;
+    padding: 0 18px;
+    overflow: hidden;
+  }
+  .whats-new[hidden] { display: none; }
+  .whats-new-summary { display: flex; align-items: center; gap: 10px; height: 44px; }
+  .whats-new-label {
+    font-family: var(--mono);
+    font-size: 10px;
+    text-transform: uppercase;
+    letter-spacing: 0.14em;
+    color: var(--accent);
+    font-weight: 600;
+    flex-shrink: 0;
+  }
+  .whats-new-summary-text {
+    font-size: 12px;
+    color: var(--text-muted);
+    flex: 1;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .whats-new-toggle {
+    flex-shrink: 0;
+    background: transparent;
+    border: 1px solid var(--border-strong);
+    color: var(--text-muted);
+    padding: 4px 10px;
+    border-radius: 4px;
+    font-size: 11px;
+    cursor: pointer;
+    transition: border-color 0.15s, color 0.15s, background 0.15s;
+  }
+  .whats-new-toggle:hover { color: var(--accent); border-color: var(--accent-dim); }
+  .whats-new-link {
+    flex-shrink: 0;
+    color: var(--text-dim);
+    font-size: 11px;
+    text-decoration: none;
+    padding: 4px 6px;
+    border-radius: 4px;
+    transition: color 0.15s;
+  }
+  .whats-new-link:hover { color: var(--accent-bright); }
+  .whats-new-dismiss {
+    flex-shrink: 0;
+    width: 26px;
+    height: 26px;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    padding: 0;
+    background: transparent;
+    border: 1px solid transparent;
+    border-radius: 4px;
+    color: var(--text-dim);
+    font-size: 12px;
+    line-height: 1;
+    cursor: pointer;
+    transition: color 0.15s, border-color 0.15s, background 0.15s;
+  }
+  .whats-new-dismiss:hover { color: var(--text); border-color: var(--border-strong); background: var(--surface-2); }
+  .whats-new-toggle:focus-visible,
+  .whats-new-link:focus-visible,
+  .whats-new-dismiss:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+  .whats-new-detail {
+    display: grid;
+    grid-template-rows: 0fr;
+    transition: grid-template-rows 0.18s ease-out;
+    overflow: hidden;
+  }
+  .whats-new-detail.open { grid-template-rows: 1fr; }
+  .whats-new-detail-inner { overflow: hidden; padding-bottom: 14px; }
+
+  /* Reduced motion — kill the popover entry, the skeleton shimmer, and the
+     what's-new expand transition; the surfaces still read via their static styling.
+     Mirrors the .rtn-fired-flash / node-running reduced-motion precedents above. */
+  @media (prefers-reduced-motion: reduce) {
+    .relnotes-popover { animation: none; }
+    .relnotes-skel-line::after { animation: none; }
+    .whats-new-detail { transition: none; }
+  }

package/dist/web/aware.js

@@ -1585,11 +1585,194 @@
     _handleMenuAction(action);
   };
 
+  // ── Release notes: shared state + popover ─────────────────────────────────────
+  // The channel-correct public site base (e.g. https://floless.io), captured from
+  // /api/health in the health poll. The changelog deep-link is omitted entirely when
+  // this is empty — never hardcode floless.io (it would be wrong on stage/dev).
+  let webBase = '';
+  // The what's-new panel reveals at most once per session (guard against the 5s
+  // health poll re-triggering it after the user expands/dismisses).
+  let whatsNewShown = false;
+
+  const $notesPopover = document.getElementById('notes-popover');
+
+  // ONE renderer for typed change bullets — used by BOTH the popover body and the
+  // what's-new panel detail. Groups bullets by change type (first-seen order); each
+  // group is a typeset label + a bullet list. Only `.added` borrows --accent (CSS).
+  function renderTypedChanges(container, changes) {
+    if (!container) return;
+    const groups = [];
+    const byType = new Map();
+    for (const c of (Array.isArray(changes) ? changes : [])) {
+      const type = String((c && c.type) || '').trim() || 'changed';
+      const desc = String((c && c.description) || '').trim();
+      if (!desc) continue;
+      if (!byType.has(type)) { byType.set(type, []); groups.push(type); }
+      byType.get(type).push(desc);
+    }
+    if (!groups.length) { container.innerHTML = '<p class="relnotes-unavailable">No itemised changes</p>'; return; }
+    container.innerHTML = groups.map((type) => {
+      const items = byType.get(type).map((d) => `<li class="relnotes-item">${escapeHtml(d)}</li>`).join('');
+      return `<div class="relnotes-group">`
+        + `<div class="relnotes-type ${escapeAttr(type)}">${escapeHtml(type)}</div>`
+        + `<ul class="relnotes-list">${items}</ul></div>`;
+    }).join('');
+  }
+
+  // Open the shared release-notes popover for an update pill (or the AWARE version
+  // label). The action row — Update now + the changelog deep-link — renders FIRST,
+  // so "Update now" is live before (and regardless of whether) the notes arrive.
+  // `onUpdate` is optional: the post-AWARE-upgrade label reopen passes none (read-only).
+  let _notesEscHandler = null, _notesOutsideHandler = null, _notesOriginEl = null;
+  function closeNotesPopover() {
+    if (!$notesPopover || $notesPopover.hidden) return;
+    $notesPopover.hidden = true;
+    $notesPopover.innerHTML = '';
+    if (_notesEscHandler) { document.removeEventListener('keydown', _notesEscHandler, true); _notesEscHandler = null; }
+    if (_notesOutsideHandler) { document.removeEventListener('mousedown', _notesOutsideHandler, true); _notesOutsideHandler = null; }
+    const origin = _notesOriginEl; _notesOriginEl = null;
+    if (origin) {
+      origin.setAttribute('aria-expanded', 'false');
+      origin.removeAttribute('aria-controls');
+      try { origin.focus(); } catch { /* origin may have hidden (pill → relaunch) */ }
+    }
+  }
+  function openNotesPopover({ component, version, anchorEl, onUpdate }) {
+    if (!$notesPopover || !version) return;
+    // Clean up a prior open instance's document listeners (reopening from a different
+    // pill) without the focus-restore — the new anchor takes over below.
+    if (_notesEscHandler) { document.removeEventListener('keydown', _notesEscHandler, true); _notesEscHandler = null; }
+    if (_notesOutsideHandler) { document.removeEventListener('mousedown', _notesOutsideHandler, true); _notesOutsideHandler = null; }
+    if (_notesOriginEl && _notesOriginEl !== anchorEl) { _notesOriginEl.setAttribute('aria-expanded', 'false'); _notesOriginEl.removeAttribute('aria-controls'); }
+    const compLabel = component === 'aware' ? 'AWARE' : 'floless.app';
+    $notesPopover.setAttribute('aria-label', compLabel + ' v' + version + ' release notes');
+
+    // Build the "full notes" link, component-aware:
+    //  - app   → the floless.io changelog (floless.app-only by design). Omit when webBase is empty.
+    //  - aware → the PUBLIC AWARE GitHub release. A stable URL built straight from `version`
+    //            (no webBase, no dependency on the notes fetch) — AWARE is NOT on floless.io.
+    const changelogHtml = component === 'aware'
+      ? `<a class="relnotes-changelog" target="_blank" rel="noopener" href="${escapeAttr('https://github.com/aware-aeco/aware/releases/tag/v' + version)}">Full release notes ↗</a>`
+      : (webBase
+        ? `<a class="relnotes-changelog" target="_blank" rel="noopener" href="${escapeAttr(webBase + '/changelog#v' + version)}">Full changelog ↗</a>`
+        : '');
+    const updateHtml = onUpdate ? `<button type="button" class="relnotes-update">Update now</button>` : '';
+
+    // Render the shell: header (skeleton title), body (skeleton bars), action row (LIVE).
+    $notesPopover.innerHTML =
+      `<div class="relnotes-header"><div class="relnotes-title">${compLabel} v${escapeHtml(version)}</div></div>`
+      + `<div class="relnotes-body" aria-busy="true">`
+      +   `<div class="relnotes-skel"><div class="relnotes-skel-line"></div><div class="relnotes-skel-line"></div><div class="relnotes-skel-line"></div></div>`
+      + `</div>`
+      + `<div class="relnotes-actions">${updateHtml}${changelogHtml}</div>`;
+    $notesPopover.hidden = false;
+
+    // Wire Update now — it never waits on the notes fetch.
+    const $update = $notesPopover.querySelector('.relnotes-update');
+    if ($update && onUpdate) {
+      $update.onclick = () => { closeNotesPopover(); onUpdate(version); };
+    }
+
+    // Position relative to the anchor: hang above it (footer is at the bottom), and
+    // clamp the right edge so a wide pill near the left can't push it off-screen.
+    if (anchorEl) {
+      const rect = anchorEl.getBoundingClientRect();
+      $notesPopover.style.bottom = (window.innerHeight - rect.top + 8) + 'px';
+      $notesPopover.style.right = Math.max(8, window.innerWidth - rect.right) + 'px';
+    }
+
+    // a11y: mark the originating control expanded; move focus into the dialog.
+    _notesOriginEl = anchorEl || null;
+    if (anchorEl) { anchorEl.setAttribute('aria-expanded', 'true'); anchorEl.setAttribute('aria-controls', 'notes-popover'); }
+    try { $notesPopover.focus(); } catch { /* container is tabindex=-1 */ }
+
+    // Tab cycles only the (up to 2) action controls; Escape closes + restores focus.
+    const focusables = () => Array.from($notesPopover.querySelectorAll('.relnotes-update, .relnotes-changelog'));
+    _notesEscHandler = (e) => {
+      if (e.key === 'Escape') { e.preventDefault(); closeNotesPopover(); return; }
+      if (e.key === 'Tab') {
+        const f = focusables();
+        if (!f.length) return;
+        const first = f[0], last = f[f.length - 1];
+        const active = document.activeElement;
+        if (e.shiftKey && (active === first || active === $notesPopover)) { e.preventDefault(); last.focus(); }
+        else if (!e.shiftKey && active === last) { e.preventDefault(); first.focus(); }
+      }
+    };
+    document.addEventListener('keydown', _notesEscHandler, true);
+    // Click outside closes — but ignore the opening click on the anchor itself.
+    _notesOutsideHandler = (e) => {
+      if ($notesPopover.contains(e.target) || (anchorEl && anchorEl.contains(e.target))) return;
+      closeNotesPopover();
+    };
+    document.addEventListener('mousedown', _notesOutsideHandler, true);
+
+    // Fetch the notes and fill the body (or the unavailable state). The action row
+    // is untouched — Update now and the changelog link stay live throughout.
+    (async () => {
+      const $body = $notesPopover.querySelector('.relnotes-body');
+      let notes = null;
+      try {
+        const r = await fetch('/api/release-notes?component=' + encodeURIComponent(component) + '&version=' + encodeURIComponent(version));
+        notes = await r.json();
+      } catch { notes = null; }
+      // The popover may have been closed/reopened while the fetch was in flight.
+      if ($notesPopover.hidden || !$body || !$body.isConnected) return;
+      $body.removeAttribute('aria-busy');
+      if (notes && notes.ok) {
+        const title = $notesPopover.querySelector('.relnotes-title');
+        if (title && notes.title) title.textContent = notes.title;
+        const summaryHtml = notes.summary ? `<div class="relnotes-summary">${escapeHtml(notes.summary)}</div>` : '';
+        const header = $notesPopover.querySelector('.relnotes-header');
+        if (header && summaryHtml && !header.querySelector('.relnotes-summary')) header.insertAdjacentHTML('beforeend', summaryHtml);
+        $body.innerHTML = '<div class="relnotes-changes"></div>';
+        renderTypedChanges($body.querySelector('.relnotes-changes'), notes.changes);
+      } else {
+        $body.innerHTML = '<p class="relnotes-unavailable">Release notes unavailable</p>';
+      }
+    })();
+  }
+
   // ── App self-update tag ───────────────────────────────────────────────────────
   // Surface updater.ts: poll GET /api/update (on load + every 6h); when a newer
-  // installed build exists, show a footer tag → confirm → POST /api/update/apply,
-  // which downloads + relaunches into the new version. Hidden in dev/npm (supported:false).
+  // installed build exists, show a footer pill → click opens the release-notes
+  // popover → Update now → POST /api/update/apply, which downloads + relaunches into
+  // the new version. Hidden in dev/npm (supported:false).
   const $appUpdate = document.getElementById('app-update');
+  // The apply body, extracted so the popover's "Update now" can drive it with the
+  // polled target version (no textContent scrape). Preserves the npm-vs-desktop
+  // branch verbatim: npm copies the command; desktop confirms → relaunch.
+  async function applyAppUpdate(version) {
+    if (!$appUpdate) return;
+    // npm channel can't self-apply (no Update.exe) — copy the command for the user's terminal.
+    if ($appUpdate.dataset.channel === 'npm') {
+      const cmd = $appUpdate.dataset.command || 'npm i -g @floless/app@latest';
+      // Best-effort copy — fire-and-forget so the toast never blocks on clipboard permission.
+      if (navigator.clipboard) navigator.clipboard.writeText(cmd).catch(() => {});
+      showToast('Update in your terminal — ' + cmd, 'info');
+      return;
+    }
+    // desktop (Velopack): one-click download + relaunch
+    const v = version || '';
+    if (!window.confirm('Download v' + v + ' and relaunch floless.app now?')) return;
+    // Record the pending version so the new build's first paint can reveal the
+    // what's-new panel (survives the relaunch via localStorage; cleared once shown).
+    try { localStorage.setItem('floless.whatsNew.pending', v); } catch { /* private mode */ }
+    $appUpdate.disabled = true;
+    $appUpdate.textContent = '↑ Updating…';
+    try {
+      const r = await fetch('/api/update/apply', { method: 'POST', headers: { 'content-type': 'application/json' } });
+      const d = await r.json().catch(() => ({}));
+      if (!r.ok || !d.ok) throw new Error(d.error || 'update failed');
+      // Success: the server is exiting + Update.exe relaunches the new build. The health
+      // poll flips to offline (R1 overlay), then the new version reconnects on its own.
+    } catch (e) {
+      $appUpdate.disabled = false;
+      try { localStorage.removeItem('floless.whatsNew.pending'); } catch { /* private mode */ }
+      showToast('Update failed — ' + String((e && e.message) || e).slice(0, 80), 'warn');
+      refreshUpdate();
+    }
+  }
   async function refreshUpdate() {
     if (!$appUpdate) return;
     try {
@@ -1600,57 +1783,99 @@
         $appUpdate.textContent = '↑ Update to v' + d.targetVersion;
         $appUpdate.dataset.channel = d.channel || 'desktop';
         $appUpdate.dataset.command = (npm && d.command) ? d.command : '';
-        $appUpdate.dataset.tip = npm
-          ? 'A newer floless.app (v' + d.targetVersion + ') is on npm — click to copy the update command'
-          : 'A newer floless.app is available — click to download and relaunch into v' + d.targetVersion;
+        $appUpdate.dataset.target = d.targetVersion;
+        $appUpdate.dataset.tip = "What's new in v" + d.targetVersion;
+        $appUpdate.setAttribute('aria-haspopup', 'dialog');
         $appUpdate.hidden = false;
       } else {
-        $appUpdate.hidden = true; // up-to-date / dev / registry-or-feed error → no tag
+        // Dev-override (ships inert): an E2E can force the pill visible deterministically
+        // by setting localStorage['floless.dev.forceUpdate'] = {"component":"app","version":"x.y.z"}.
+        // Read on every poll; absent by default → no behaviour change.
+        if (!applyDevForcedUpdate('app', $appUpdate)) $appUpdate.hidden = true; // up-to-date / dev / registry-or-feed error → no tag
       }
-    } catch { $appUpdate.hidden = true; }
+    } catch {
+      if (!applyDevForcedUpdate('app', $appUpdate)) $appUpdate.hidden = true;
+    }
   }
   if ($appUpdate) {
-    $appUpdate.onclick = async () => {
-      // npm channel can't self-apply (no Update.exe) — copy the command for the user's terminal.
-      if ($appUpdate.dataset.channel === 'npm') {
-        const cmd = $appUpdate.dataset.command || 'npm i -g @floless/app@latest';
-        // Best-effort copy — fire-and-forget so the toast never blocks on clipboard permission.
-        if (navigator.clipboard) navigator.clipboard.writeText(cmd).catch(() => {});
-        showToast('Update in your terminal — ' + cmd, 'info');
-        return;
-      }
-      // desktop (Velopack): one-click download + relaunch
-      const v = $appUpdate.textContent.replace(/^[^0-9]*/, ''); // "↑ Update to v0.5.2" → "0.5.2"
-      if (!window.confirm('Download v' + v + ' and relaunch floless.app now?')) return;
-      $appUpdate.disabled = true;
-      $appUpdate.textContent = '↑ Updating…';
-      try {
-        const r = await fetch('/api/update/apply', { method: 'POST', headers: { 'content-type': 'application/json' } });
-        const d = await r.json().catch(() => ({}));
-        if (!r.ok || !d.ok) throw new Error(d.error || 'update failed');
-        // Success: the server is exiting + Update.exe relaunches the new build. The health
-        // poll flips to offline (R1 overlay), then the new version reconnects on its own.
-      } catch (e) {
-        $appUpdate.disabled = false;
-        showToast('Update failed — ' + String((e && e.message) || e).slice(0, 80), 'warn');
-        refreshUpdate();
-      }
+    $appUpdate.onclick = () => {
+      const version = $appUpdate.dataset.target || '';
+      openNotesPopover({ component: 'app', version, anchorEl: $appUpdate, onUpdate: applyAppUpdate });
     };
     refreshUpdate();
     setInterval(refreshUpdate, 6 * 60 * 60 * 1000); // re-check every 6h so a long-running window notices
   }
 
+  // Dev-override helper — the ONLY forced-visible path. Reveals a pill with a fixed
+  // version when localStorage['floless.dev.forceUpdate'] matches the component, so an
+  // E2E can exercise the popover without a real pending update. Returns true if forced.
+  function applyDevForcedUpdate(component, pillEl) {
+    if (!pillEl) return false;
+    let forced = null;
+    try { forced = JSON.parse(localStorage.getItem('floless.dev.forceUpdate') || 'null'); } catch { forced = null; }
+    if (!forced || forced.component !== component || !forced.version) return false;
+    const v = String(forced.version);
+    pillEl.dataset.target = v;
+    pillEl.dataset.tip = "What's new in v" + v;
+    pillEl.setAttribute('aria-haspopup', 'dialog');
+    if (component === 'aware') { pillEl.textContent = '↑ Upgrade AWARE to v' + v; }
+    else { pillEl.textContent = '↑ Update to v' + v; pillEl.dataset.channel = pillEl.dataset.channel || 'desktop'; }
+    pillEl.hidden = false;
+    return true;
+  }
+
   // ── AWARE runtime upgrade tag ─────────────────────────────────────────────────
   // Surface aware-update.ts: poll GET /api/aware/update (on load + every 6h); when a
-  // newer @aware-aeco/cli exists, show a footer pill → confirm → POST apply, which
-  // reinstalls AWARE in place (no relaunch — the app stays open) and re-stamps the
-  // version live. Mirrors the app self-update pill; differs in that success is silent
-  // (the live version re-stamp IS the confirmation) and there is no relaunch.
+  // newer @aware-aeco/cli exists, show a footer pill → click opens the release-notes
+  // popover → Update now → POST apply, which reinstalls AWARE in place (no relaunch —
+  // the app stays open) and re-stamps the version live. Mirrors the app self-update
+  // pill; differs in that success is silent (the live version re-stamp IS the
+  // confirmation) and there is no relaunch.
   const $awareUpdate = document.getElementById('aware-update');
   // After a successful upgrade, briefly trust the upgraded version: a /api/health request that
   // was in flight before the reinstall finished could resolve with the OLD version and momentarily
   // revert the footer. The live re-stamp (health poll) honors this short settle window.
   let awareUpgradeFloor = null, awareUpgradeFloorUntil = 0;
+  // Extracted apply body — driven by the popover's "Update now" with the polled
+  // target version. Preserves the awareUpgradeFloor settle window + the live
+  // #aware-version re-stamp verbatim; additionally makes the version label a notes
+  // affordance and shows a brief "installed" confirmation before the pill hides.
+  async function applyAwareUpdate(version) {
+    if (!$awareUpdate) return;
+    const v = version || '';
+    if (!window.confirm('Upgrade AWARE runtime to v' + v + '? This reinstalls the npm package in place — the app stays open and the version restamps automatically.')) return;
+    $awareUpdate.disabled = true;
+    $awareUpdate.textContent = '↑ Upgrading…';
+    try {
+      // Cap the wait so the pill never sticks disabled if the global npm install wedges.
+      const r = await fetch('/api/aware/update/apply', { method: 'POST', headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(120000) });
+      const d = await r.json().catch(() => ({}));
+      if (!r.ok || !d.ok) throw new Error(d.error || 'aware upgrade failed');
+      // Success is silent: the pill disappears and the AWARE version re-stamps live.
+      $awareUpdate.disabled = false;
+      const wv = document.getElementById('aware-version');
+      if (wv && d.version) {
+        wv.textContent = 'AWARE ' + d.version;
+        awareUpgradeFloor = d.version; awareUpgradeFloorUntil = Date.now() + 10000;
+        // The version label becomes a notes affordance — click to reopen what changed.
+        wv.classList.add('relnotes-reopen');
+        wv.setAttribute('role', 'button');
+        wv.setAttribute('tabindex', '0');
+        wv.dataset.tip = "What's new in v" + d.version + ' — click for notes';
+        wv.dataset.notesVersion = d.version;
+      }
+      // Brief confirmation (~2s) before the pill hides.
+      $awareUpdate.textContent = 'AWARE v' + (d.version || v) + ' installed';
+      setTimeout(() => { $awareUpdate.hidden = true; refreshAwareUpdate(); }, 2000);
+    } catch (e) {
+      $awareUpdate.disabled = false;
+      const msg = (e && e.name === 'TimeoutError')
+        ? 'AWARE upgrade is taking a while — it may still be installing; the version updates when it finishes'
+        : 'AWARE upgrade failed — ' + String((e && e.message) || e).slice(0, 80);
+      showToast(msg, 'warn');
+      refreshAwareUpdate(); // restore the pill text for retry
+    }
+  }
   async function refreshAwareUpdate() {
     if (!$awareUpdate) return;
     try {
@@ -1659,42 +1884,109 @@
       if (r.ok && d.updateAvailable && d.targetVersion) {
         $awareUpdate.textContent = '↑ Upgrade AWARE to v' + d.targetVersion;
         $awareUpdate.dataset.target = d.targetVersion;
-        $awareUpdate.dataset.tip = 'A newer AWARE runtime (v' + d.targetVersion + ') is available — click to install it in place (no relaunch)';
+        $awareUpdate.dataset.tip = "What's new in v" + d.targetVersion;
+        $awareUpdate.setAttribute('aria-haspopup', 'dialog');
         $awareUpdate.hidden = false;
       } else {
-        $awareUpdate.hidden = true; // up-to-date / absent / registry error → no pill
+        // Dev-override (ships inert) — see applyDevForcedUpdate. Read on every poll.
+        if (!applyDevForcedUpdate('aware', $awareUpdate)) $awareUpdate.hidden = true; // up-to-date / absent / registry error → no pill
       }
-    } catch { $awareUpdate.hidden = true; }
+    } catch {
+      if (!applyDevForcedUpdate('aware', $awareUpdate)) $awareUpdate.hidden = true;
+    }
   }
   if ($awareUpdate) {
-    $awareUpdate.onclick = async () => {
-      const v = $awareUpdate.dataset.target || '';
-      if (!window.confirm('Upgrade AWARE runtime to v' + v + '? This reinstalls the npm package in place — the app stays open and the version restamps automatically.')) return;
-      $awareUpdate.disabled = true;
-      $awareUpdate.textContent = '↑ Upgrading…';
-      try {
-        // Cap the wait so the pill never sticks disabled if the global npm install wedges.
-        const r = await fetch('/api/aware/update/apply', { method: 'POST', headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(120000) });
-        const d = await r.json().catch(() => ({}));
-        if (!r.ok || !d.ok) throw new Error(d.error || 'aware upgrade failed');
-        // Success is silent: the pill disappears and the AWARE version re-stamps live.
-        $awareUpdate.hidden = true;
-        $awareUpdate.disabled = false;
-        const wv = document.getElementById('aware-version');
-        if (wv && d.version) { wv.textContent = 'AWARE ' + d.version; awareUpgradeFloor = d.version; awareUpgradeFloorUntil = Date.now() + 10000; }
-      } catch (e) {
-        $awareUpdate.disabled = false;
-        const msg = (e && e.name === 'TimeoutError')
-          ? 'AWARE upgrade is taking a while — it may still be installing; the version updates when it finishes'
-          : 'AWARE upgrade failed — ' + String((e && e.message) || e).slice(0, 80);
-        showToast(msg, 'warn');
-        refreshAwareUpdate(); // restore the pill text for retry
-      }
+    $awareUpdate.onclick = () => {
+      const version = $awareUpdate.dataset.target || '';
+      openNotesPopover({ component: 'aware', version, anchorEl: $awareUpdate, onUpdate: applyAwareUpdate });
     };
     refreshAwareUpdate();
     setInterval(refreshAwareUpdate, 6 * 60 * 60 * 1000); // re-check every 6h
   }
 
+  // The AWARE version label, once it's a notes affordance (post in-place upgrade),
+  // reopens the popover on click or Enter/Space.
+  {
+    const $awareVersion = document.getElementById('aware-version');
+    if ($awareVersion) {
+      const reopen = () => {
+        const v = $awareVersion.dataset.notesVersion;
+        if (v) openNotesPopover({ component: 'aware', version: v, anchorEl: $awareVersion });
+      };
+      $awareVersion.addEventListener('click', () => { if ($awareVersion.classList.contains('relnotes-reopen')) reopen(); });
+      $awareVersion.addEventListener('keydown', (e) => {
+        if (!$awareVersion.classList.contains('relnotes-reopen')) return;
+        if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); reopen(); }
+      });
+    }
+  }
+
+  // ── What's-new panel (floless.app post-update, relaunch-surviving) ────────────
+  // Called from the health poll AFTER #app-version is stamped (so the version
+  // compare has a real value). Reveals once: if a pending self-update version was
+  // recorded before the relaunch AND the now-running build matches it AND the user
+  // hasn't already dismissed that version, fetch its notes and show the panel.
+  function maybeShowWhatsNew() {
+    if (whatsNewShown) return;
+    let pending, seen;
+    try { pending = localStorage.getItem('floless.whatsNew.pending'); seen = localStorage.getItem('floless.whatsNew.seen'); } catch { return; }
+    if (!pending) return;
+    const appVer = (document.getElementById('app-version')?.textContent || '').replace(/[^0-9.]/g, '');
+    if (appVer !== pending || seen === pending) { try { localStorage.removeItem('floless.whatsNew.pending'); } catch { /* private mode */ } return; }
+
+    const panel = document.getElementById('whats-new-panel');
+    if (!panel) return;
+    whatsNewShown = true; // guard: reveal at most once per session
+
+    const $summaryText = panel.querySelector('.whats-new-summary-text');
+    const $toggle = panel.querySelector('.whats-new-toggle');
+    const $detail = panel.querySelector('.whats-new-detail');
+    const $detailInner = panel.querySelector('.whats-new-detail-inner');
+    const $link = panel.querySelector('.whats-new-link');
+    const $dismiss = panel.querySelector('.whats-new-dismiss');
+
+    // Changelog deep-link — channel-correct base only; omit (hide) when unknown.
+    if ($link) {
+      if (webBase) { $link.href = webBase + '/changelog#v' + pending; $link.hidden = false; }
+      else { $link.removeAttribute('href'); $link.hidden = true; }
+    }
+    if ($summaryText) $summaryText.textContent = 'floless.app v' + pending + ' is now running.';
+
+    // Toggle expands/collapses the detail (grid-rows transition); label + aria flip.
+    if ($toggle && $detail) {
+      $toggle.onclick = () => {
+        const open = $detail.classList.toggle('open');
+        $toggle.setAttribute('aria-expanded', open ? 'true' : 'false');
+        $toggle.textContent = open ? 'Hide' : "What's new";
+      };
+    }
+    // Dismiss — no confirm; persist the seen version so it never re-reveals.
+    if ($dismiss) {
+      $dismiss.onclick = () => {
+        try { localStorage.setItem('floless.whatsNew.seen', pending); localStorage.removeItem('floless.whatsNew.pending'); } catch { /* private mode */ }
+        panel.hidden = true;
+        document.getElementById('app')?.classList.remove('has-whats-new');
+      };
+    }
+
+    // Reveal the panel (adds the 4th grid row), then fill the detail with shared bullets.
+    document.getElementById('app')?.classList.add('has-whats-new');
+    panel.hidden = false;
+    (async () => {
+      let notes = null;
+      try {
+        const r = await fetch('/api/release-notes?component=app&version=' + encodeURIComponent(pending));
+        notes = await r.json();
+      } catch { notes = null; }
+      if (notes && notes.ok) {
+        if ($summaryText && notes.summary) $summaryText.textContent = notes.summary;
+        renderTypedChanges($detailInner, notes.changes);
+      } else if ($detailInner) {
+        $detailInner.innerHTML = '<p class="relnotes-unavailable">Release notes unavailable</p>';
+      }
+    })();
+  }
+
   // ONE Run (the approved single-Run model). "▶ Run workflow" does a REAL run against
   // the live host, using the app inputs. If the app has a report node, it drives
   // the in-app HTML Viewer (renders + caches the returned HTML); otherwise it
@@ -2245,8 +2537,14 @@
           // version CAN change (an out-of-band `npm i -g`, or the in-app upgrade), so
           // re-stamp it whenever /api/health reports a different value — never show a
           // stale runtime version in the footer.
+          // Capture the channel-correct public site base for the changelog deep-links
+          // (popover + what's-new). Empty until /api/health reports it → links omitted.
+          if (h && h.webBase) webBase = h.webBase;
           const av = document.getElementById('app-version');
           if (av && h && h.appVersion && !shownVersion) { av.textContent = 'v' + h.appVersion; shownVersion = true; }
+          // After the build version is stamped, reveal the relaunch-surviving what's-new
+          // panel iff this is the build we just self-updated into (guarded to once).
+          maybeShowWhatsNew();
           const wv = document.getElementById('aware-version');
           if (wv && h && h.awareVersion) {
             const next = 'AWARE ' + h.awareVersion;

package/dist/web/index.html

@@ -133,6 +133,21 @@
       <div class="inspect-body" id="inspect-body"></div>
     </aside>
 
+    <!-- What's-new panel — a relaunch-surviving, calm "what changed" strip shown
+         once after a floless.app self-update. A direct grid child of .app (sibling
+         to header/body/footer); occupies the extra `whats-new` row that .app.has-whats-new
+         inserts above the footer. Dismiss persists in localStorage so it never nags. -->
+    <div id="whats-new-panel" class="whats-new" hidden>
+      <div class="whats-new-summary">
+        <span class="whats-new-label">Updated</span>
+        <span class="whats-new-summary-text"></span>
+        <button class="whats-new-toggle" type="button" aria-expanded="false">What's new</button>
+        <a class="whats-new-link" target="_blank" rel="noopener">Full changelog ↗</a>
+        <button class="whats-new-dismiss" type="button" aria-label="Dismiss">✕</button>
+      </div>
+      <div class="whats-new-detail"><div class="whats-new-detail-inner"></div></div>
+    </div>
+
     <footer>
       <div class="status">
         <span class="stat"><span class="dot"></span><span class="stat-val">runtime online</span></span>
@@ -155,6 +170,11 @@
     </footer>
   </div>
 
+  <!-- Single reusable release-notes popover — anchored to the clicked update pill
+       (or the AWARE version label) at open time. Shared by #app-update and
+       #aware-update; its body is rendered per-open in aware.js. -->
+  <div id="notes-popover" class="relnotes-popover" role="dialog" aria-modal="true" aria-label="Release notes" tabindex="-1" hidden></div>
+
   <div class="menu" id="menu" role="menu">
     <button class="menu-item" data-action="open" role="menuitem">
       <span class="menu-icon" aria-hidden="true"><svg viewBox="0 0 24 24"><path d="m6 14 1.5-2.9A2 2 0 0 1 9.24 10H20a2 2 0 0 1 1.94 2.5l-1.54 6a2 2 0 0 1-1.95 1.5H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H18a2 2 0 0 1 2 2v2"/></svg></span>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {