Record the b5150ab VPS release across the docs

docs/DEVELOPMENT_AND_STAGING.md

@@ -156,7 +156,7 @@ The temporary VPS must not become another development checkout. The proposed rel
 Windows source and Git -> Rocky build and verification -> immutable image + checksum -> VPS deployment
 ```
 
-Releases are manual during user acceptance and are identified by the source commit SHA. The first installed release was `7dbc55b`; the current UAT release is `df911f1`, deployed with its full immutable image tag. Release `ef64895` is retained as the immediate application rollback. The next candidate includes explicit JSON API response types, Latvian workflow labels, and independently calibrated water-temperature templates. The VPS keeps WeatherTool in its own `/srv/weathertool` tree, publishes the application only to loopback ports, and relies on Cloudflare, Nginx, and Authelia at the public boundary. See `VPS_STAGING_PLAN.md` before changing the VPS deployment.
+Releases are manual during user acceptance and are identified by the source commit SHA. The first installed release was `7dbc55b`; the current UAT release is `b5150ab`, deployed with its full immutable image tag. Release `df911f1` is retained as the immediate application rollback. This release adds the full Brīdinājumi (LVĢMC warning-map) workspace on top of the earlier JSON API response types, Latvian workflow labels, and independently calibrated water-temperature templates. The VPS keeps WeatherTool in its own `/srv/weathertool` tree, publishes the application only to loopback ports, and relies on Cloudflare, Nginx, and Authelia at the public boundary. See `VPS_STAGING_PLAN.md` before changing the VPS deployment.
 
 The committed templates live under `deploy/vps/`. They are not a second local
 development environment. Validate them on Rocky, build the exact Git revision,

docs/README.md

@@ -14,13 +14,13 @@ This directory contains the working documentation for the WeatherTool modernizat
 - **Ūdens** uses separate authoritative 1920×1080 and 3840×1440 production templates. Its six value rectangles are measured per template and the text is optically centered from rendered glyph bounds; both exports have been visually validated.
 - **Brīdinājumi** renders current LVĢMC warning polygons over a production border overlay with feathered severity fills. Its lon/lat-to-pixel projection is an affine fit calibrated against the same validated city pixel positions Kartes/Faktiskā already use, replacing an earlier bounding-box calibration that drifted up to ~200px on the 3840 canvas.
 - Confirmed local Monda Regular/Bold files provide interface and generated-graphic typography; weather symbols use normalized transparent image assets.
-- Release `df911f1` is deployed as immutable image `weathertool:df911f14eb8a1041822959677e09bb544ce0cdcd`; release `ef64895` remains the immediate application rollback. The next candidate adds explicit JSON API responses, Latvian workflow labels, and calibrated water-temperature exports.
+- Release `b5150ab` is deployed as immutable image `weathertool:b5150abd469036ca84b94e9b749d5d0232690f38`; release `df911f1` remains the immediate application rollback. This release adds the full Brīdinājumi (LVĢMC warning-map) workspace on top of the earlier JSON API, Latvian workflow labels, and calibrated water-temperature work.
 - The isolated VPS UAT stack is running and healthy: WeatherTool is bound to `127.0.0.1:8002`, Authelia to `127.0.0.1:9091`, and PostgreSQL has no host port. Public access is routed through Cloudflare, Nginx, and Authelia.
 - Cloudflare delegation is active, strict origin TLS covers only `laikapstak.li` and `auth.laikapstak.li`, and the public Nginx/Authelia login flow is operational without changing the existing HOP site.
 - The VPS database contains a deliberately limited 14-day, 34-city synthetic dataset for newsroom visual testing. It must be cleared before authorized real-provider ingestion begins.
 - Approved 1920×1080 and 3840×1440 PNG production bases are now the rendering source for Faktiskā and Ūdens temperatūra; code draws only the changing values, selected weather symbols, and wind data over those fixed newsroom graphics.
 - Browser branding assets and Latvian Open Graph/Twitter metadata are included for favicon, Apple home-screen icon, and link-preview support. Public crawler access still depends on the Nginx/Authelia policy used for the metadata and preview image.
-- Browser verification is complete for the deployed `df911f1` release and for the later candidate changes on Rocky. The shared UAT login is ready for newsroom-user testing.
+- Browser verification is complete for the deployed `b5150ab` release, including Brīdinājumi against real live LVĢMC data. Newsroom testers will be given the domain first, without walkthrough, to see how intuitive the workflow is before any guidance is provided.
 - Frontend dependency maintenance is complete: Solid runtime and Vite tooling were updated, obsolete packages were removed, TypeScript checking was added, and a clean Rocky `npm ci`, typecheck, production build, full audit, and production-only audit all pass with zero known vulnerabilities.
 - This is not yet approved or hardened for workplace production.
 

docs/UPDATE_ROADMAP.md

@@ -7,7 +7,7 @@ This document tracks proposed WeatherTool improvements. Work should be delivered
 - **Windows source workspace:** source editing, review, and Git operations only; do not install dependencies, compile, build, run, or test here.
 - **Rocky development and staging:** the sole compile, build, development-runtime, and test environment, with production-like Docker staging at `http://192.168.1.101:9190`.
 - **Git over SSH:** Windows pushes reviewed commits to a private bare repository on Rocky; the Rocky staging checkout pulls those commits and rebuilds.
-- **Ubuntu VPS deployment:** release `ef64895` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset; the VPS does not compile or build the project.
+- **Ubuntu VPS deployment:** release `b5150ab` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset; the VPS does not compile or build the project.
 - **Workplace production:** remains separate until changes are reviewed, tested, and explicitly approved for workplace use.
 
 Do not synchronize `.env`, database directories, generated dependencies, build output, or provider credentials between machines.
@@ -165,13 +165,14 @@ Status: in progress
 - [x] Provision a dedicated `/srv/weathertool` tree, Compose project, private network, database storage, and loopback-only application and Authelia ports.
 - [x] Configure Authelia with one temporary shared account, Argon2id password storage, rate limiting, and temporary IP bans.
 - [x] Add an exact-host Cloudflare origin certificate and Nginx authorization routing without disrupting the existing HOP site.
-- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update only the application service. Current full-SHA image: `weathertool:df911f14eb8a1041822959677e09bb544ce0cdcd`; PostgreSQL and Authelia were not restarted.
+- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update only the application service. Current full-SHA image: `weathertool:b5150abd469036ca84b94e9b749d5d0232690f38`; PostgreSQL and Authelia were not restarted.
 - [ ] Complete UAT verification: public authentication and application health pass; direct-origin blocking, logout, throttling, PNG downloads, backups, logs, and rollback remain.
+- [ ] Share the domain with newsroom testers without a walkthrough first, to observe unassisted intuitiveness, before providing any guidance.
 - [ ] Run the month-long user test with manual releases and record feedback before any workplace-production decision.
 
 ## Known current limitations
 
-- The fixed production PNG bases, browser/social metadata, reviewed frontend dependency updates, stabilized header navigation, and authenticated API routing are deployed in UAT release `df911f1`; newsroom workflow validation is in progress.
+- The fixed production PNG bases, browser/social metadata, reviewed frontend dependency updates, stabilized header navigation, authenticated API routing, and the full Brīdinājumi warning-map workspace are deployed in UAT release `b5150ab`; newsroom workflow validation is in progress.
 - Link-preview crawlers cannot authenticate through Authelia; the final Nginx policy must deliberately expose only the minimum preview metadata/assets if WhatsApp previews are required.
 
 - Staging uses synthetic PostgreSQL station data.
@@ -205,14 +206,14 @@ Record completed work here by date and commit after the Git workflow is establis
 | 2026-08-22 | `ef64895` | Deploy the reviewed zero-advisory frontend dependency state as an immutable full-SHA VPS release while leaving PostgreSQL, Authelia, and HOP uninterrupted | Yes — isolated Rocky smoke test, dual-host checksum, matching image ID, container health, loopback, authentication-gate, and HOP checks |
 | 2026-08-22 | `36d094e` | Stabilize the header, keep the primary workspaces visible, and move secondary workspaces into an icon-labelled menu | Yes — Rocky browser and Jam navigation checks |
 | 2026-08-22 | `df911f1` | Preserve API 401 responses through Authelia/Nginx so frontend queries do not follow cross-origin login redirects | Yes — Rocky and VPS health checks; authenticated browser query verified after refreshing synthetic data |
-| 2026-08-22 | `f3197bf` | Return query API payloads with an explicit JSON content type | Yes — Rocky API and browser verification; VPS deployment pending |
+| 2026-08-22 | `f3197bf` | Return query API payloads with an explicit JSON content type | Yes — Rocky API and browser verification; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `0608865` | Localize the operator-facing workspace names and concise workflow copy in Latvian | Yes — Rocky browser verification; VPS deployment pending |
+| 2026-08-22 | `0608865` | Localize the operator-facing workspace names and concise workflow copy in Latvian | Yes — Rocky browser verification; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `7f09181` | Independently calibrate both Ūdens templates and optically center Monda values using visible glyph bounds | Yes — both native-resolution PNG exports visually validated on Rocky; VPS deployment pending |
+| 2026-08-22 | `7f09181` | Independently calibrate both Ūdens templates and optically center Monda values using visible glyph bounds | Yes — both native-resolution PNG exports visually validated on Rocky; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `bc5bee1` | Add the Brīdinājumi LVĢMC warning-map workflow with metadata/polygon ingestion, day/phenomenon filtering, and manual title entry | Yes — Rocky browser verification; VPS deployment pending |
+| 2026-08-22 | `bc5bee1` | Add the Brīdinājumi LVĢMC warning-map workflow with metadata/polygon ingestion, day/phenomenon filtering, and manual title entry | Yes — Rocky browser verification; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `13115f0` | Add production border overlay artwork and feathered warning-polygon fills to Brīdinājumi | Yes — Rocky browser verification; VPS deployment pending |
+| 2026-08-22 | `13115f0` | Add production border overlay artwork and feathered warning-polygon fills to Brīdinājumi | Yes — Rocky browser verification; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `4395935` | Replace Brīdinājumi's 4-corner bounding-box projection, which drifted up to ~200px on the 3840 canvas, with an affine fit calibrated against the validated Kartes/Faktiskā city pixel positions | Yes — Rocky typecheck, build, and headless-browser screenshot comparison at both native export resolutions; VPS deployment pending |
+| 2026-08-22 | `4395935` | Replace Brīdinājumi's 4-corner bounding-box projection, which drifted up to ~200px on the 3840 canvas, with an affine fit calibrated against the validated Kartes/Faktiskā city pixel positions | Yes — Rocky typecheck, build, and headless-browser screenshot comparison at both native export resolutions; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `924e410` | Limit Brīdinājumi to one selected warning per export, remove the on-canvas legend, collapse card detail until clicked, and pre-fill the title from the selected warning's phenomenon | Yes — Rocky typecheck, build, and headless-browser screenshot verification of selection switching and card detail; VPS deployment pending |
+| 2026-08-22 | `924e410` | Limit Brīdinājumi to one selected warning per export, remove the on-canvas legend, collapse card detail until clicked, and pre-fill the title from the selected warning's phenomenon | Yes — Rocky typecheck, build, and headless-browser screenshot verification of selection switching and card detail; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `cafc75a` | Redesign Brīdinājumi warning cards as compact phenomenon-icon chips and move full warning text into a dialog popup over a dimmed, blurred backdrop | Yes — Rocky typecheck, build, and headless-browser screenshot verification of the popup open/close flow; VPS deployment pending |
+| 2026-08-22 | `cafc75a` | Redesign Brīdinājumi warning cards as compact phenomenon-icon chips and move full warning text into a dialog popup over a dimmed, blurred backdrop | Yes — Rocky typecheck, build, and headless-browser screenshot verification of the popup open/close flow; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `70fd24c` | Give Brīdinājumi chips a hover-expanding severity capsule, adapted from a reviewed Uiverse.io reference component | Yes — Rocky typecheck, build, and headless-browser screenshot verification of rest/hover/active chip states; VPS deployment pending |
+| 2026-08-22 | `70fd24c` | Give Brīdinājumi chips a hover-expanding severity capsule, adapted from a reviewed Uiverse.io reference component | Yes — Rocky typecheck, build, and headless-browser screenshot verification of rest/hover/active chip states; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `6fbf672` | Split Brīdinājumi warning selection (checkbox) from viewing detail (chip click) and widen the detail popup | Yes — Rocky typecheck, build, and headless-browser verification that checkbox clicks change the map selection without opening the popup and chip clicks open the correct warning's detail without changing the selection; VPS deployment pending |
+| 2026-08-22 | `6fbf672` | Split Brīdinājumi warning selection (checkbox) from viewing detail (chip click) and widen the detail popup | Yes — Rocky typecheck, build, and headless-browser verification that checkbox clicks change the map selection without opening the popup and chip clicks open the correct warning's detail without changing the selection; deployed to VPS in release `b5150ab` on 2026-08-22 |
-| 2026-08-22 | `56b8716` | Replace single-warning Brīdinājumi selection with multi-select checkboxes and severity-ordered polygon compositing, and restyle chips as narrower, fully severity-colored, white-icon/white-text buttons with a ported Uiverse.io checkbox component | Yes — Rocky typecheck, build, and headless-browser screenshot verification of multiple simultaneous checked warnings compositing correctly on the map; VPS deployment pending |
+| 2026-08-22 | `56b8716` | Replace single-warning Brīdinājumi selection with multi-select checkboxes and severity-ordered polygon compositing, and restyle chips as narrower, fully severity-colored, white-icon/white-text buttons with a ported Uiverse.io checkbox component | Yes — Rocky typecheck, build, and headless-browser screenshot verification of multiple simultaneous checked warnings compositing correctly on the map; deployed to VPS in release `b5150ab` on 2026-08-22 |

docs/VPS_STAGING_PLAN.md

@@ -1,6 +1,6 @@
 # Temporary VPS staging plan
 
-Status: **Release `ef64895` publicly operational behind Cloudflare, Nginx, and Authelia with temporary synthetic data**
+Status: **Release `b5150ab` (Brīdinājumi warning maps) publicly operational behind Cloudflare, Nginx, and Authelia with temporary synthetic data**
 
 This document defines the next deployment stage for approximately one month of
 newsroom-user testing. It records the intended boundary before any VPS changes
@@ -59,10 +59,10 @@ Cloudflare -> Nginx -> Authelia authorization -> WeatherTool
 
 The host root plus `releases/` and `backups/` exist with owner `ubuntu:ubuntu`
 and mode `0750`. Baseline release `7dbc55b` installed the reviewed deployment
-bundle. The current release `ef64895` was built from the exact Git archive on
+bundle. The current release `b5150ab` was built from the exact Git archive on
-Rocky, passed an isolated read-only-container smoke test, was verified against
+Rocky, smoke-tested via a full local Rocky staging rebuild, verified against
 its SHA-256 manifest on both Rocky and the VPS, and was loaded as the full-SHA
-image `weathertool:ef6489549b990864c59a720f2ba5b25f5caaa4f1`. It was deployed
+image `weathertool:b5150abd469036ca84b94e9b749d5d0232690f38`. It was deployed
 by recreating only the application service. The dedicated Compose stack is running; no
 existing HOP container, network, volume, port, or Nginx site was changed.
 
@@ -255,6 +255,37 @@ supplies explicit inert provider values. No provider fetch is scheduled, and
 real provider credentials must not be added until their contracts and handling
 are reviewed.
 
+Brīdinājumi release completed on 2026-08-22:
+
+- exact source revision `b5150abd469036ca84b94e9b749d5d0232690f38` was built
+  from a clean Git archive using `deploy/vps/Dockerfile`; all three existing
+  Scala tests passed during the build;
+- a separate full local rebuild (Rocky staging Compose, `Dockerfile.local`)
+  was browser-tested end to end — Home, Kartes, Faktiskā, Ūdens, and
+  Brīdinājumi all loaded with zero browser console errors, and Brīdinājumi
+  rendered 7 real live LVĢMC warnings through the production `/api/warnings`
+  route;
+- the compressed image artifact passed SHA-256 verification on Rocky and the
+  VPS, and the loaded VPS image ID matched the Rocky image ID
+  `sha256:cc3d4a7a4e94356a16a428c56c8593c62ef0b396f0b7944285f6e5063de89eb2`;
+- `.env.staging` was backed up as `backups/env.staging.before-b5150ab` with
+  mode `0600` before selecting the new full-SHA image tag;
+- only the WeatherTool application container was recreated; PostgreSQL and
+  Authelia were left running and healthy throughout;
+- the application became healthy; loopback WeatherTool and Authelia health
+  checks returned HTTP 200; the unauthenticated public route returned the
+  expected Authelia redirect; an unauthenticated `/api/` request returned
+  HTTP 401; and the unrelated HOP containers remained healthy and untouched;
+  and
+- release `df911f1` remains the immediate compatible application rollback.
+
+This release adds the full Brīdinājumi (LVĢMC warning-map) workspace:
+calibrated lon/lat-to-pixel projection, multi-warning selection so combined
+severity levels of one phenomenon can be shown together, icon chips with a
+detail popup, and a phenomenon-templated title. Newsroom testers have not
+yet been walked through the tool; the plan is to share the domain first and
+observe how intuitive the workflow is unassisted before providing guidance.
+
 ## Manual release procedure
 
 Continuous deployment is deliberately out of scope for the first testing