0.1.0: the base image, the lockfile, and a README that is true

[kisielewski]

Everything 0.1.0 needs from this repository, and nothing else. The version was
already 0.1.0 in package.json, package-lock.json and both README examples;
what follows is what the runbook's checklist turned up when it was actually run.

The base image had stopped being built

Dockerfile served from nginx:1.27-alpine, whose last build on Docker Hub was
2025-04-16 — seventeen months of nginx patches and Alpine package updates
that never reached it, while docker pull kept working the whole time. It is
also the only stage of this image with system packages in it, since the second
stage is dist/ copied in.

Now nginx:1.30-alpine: the stable line, rebuilt 2026-09-03. nginx numbers even
minors stable and odd ones mainline.

AlgoJudge-Ops (NGINX_TAG:-1.27-alpine) and AlgoJudge-Docs (1.29-alpine)
are stale the same way. Each is its own release's step, and docs/RELEASE.md
says so rather than leaving it implied.

Sixteen packages, inside the ranges they already had

npm update and nothing else: Mantine 9.5.2 → 9.6.0 across all five,
@playwright/test 1.62.1 → 1.63.0, ESLint 10.9.1 → 10.10.0,
@typescript-eslint/* 8.68.0 → 8.70.0, @types/react-dom, i18next and its two
neighbours, katex, postcss, eslint-plugin-react-refresh.

package.json did not move, which is what makes it a refresh rather than a
decision. npm audit reads zero at every severity afterwards, against one
moderate before it (GHSA-p498-v437-472g, @humanfs/node through eslint, in the
development tree, never in the image).

Two majors are deliberately not here — TypeScript 7 and markdown-it-anchor
10. Both move a range in package.json and need the whole gate again; nothing is
published yet, so there is no installation to protect by taking them today.

The README was wrong in three places

• ESLint 9 against 10.10.0 installed. CLAUDE.md carried the same sentence.
• Eight of the ten check: scripts the build job runs: check:languages
  and check:ranking were missing, so the gate a reader trusted was shorter than
  the one that blocks a merge.
• The address the example points at. It said https://localhost:7004;
  .env.example has pointed at http://localhost:5171 since 9d40088. The scheme
  is not cosmetic — the session cookie is SameSite=Lax and a browser counts the
  two as different sites, so an HTTP page against an HTTPS API cannot sign in at
  all.

Checked and correct, so left alone: sixteen screens in the manager panel is the
number of managerRoute calls in src/App.tsx; port 5173; the Technology
versions; the four build-time and two runtime variables; and the related
repositories.

README.md also states the Node rule now, rather than "24 or later".

One flaky check, fixed as a race

verify-activity.mjs asserted the organiser's document was on screen after a
fixed wait(1500). ActivityPage reaches ContentView through
lazy(() => import(...)), and the dev server transforms that chunk the first
time it is asked for — so the wait is a bet, and it loses under load. It failed
once in a full run (four scripts at a time) and passed 5/5 alone.

It now polls, with a ten-second ceiling, and ends in the same assertion. Proved
by sabotage: with both the poll and the assertion pointed at text no page
contains, the script fails after ten seconds rather than hanging or passing.

The runbook

docs/RELEASE.md gains what this pass needed and did not have:

• Every image this repository pins — the three of them, with the command that
  reads when a tag was last built, because a tag that still resolves is not a tag
  anybody still maintains.
• What goes stale in a README — four kinds of claim, three of which had
  drifted here, and how to check each. The old checklist read two docker pull
  lines and would have passed a README wrong about everything else.
• Node is an Active LTS on the day of the release, in .nvmrc, engines and
  the Dockerfile together. Node 24 qualifies until 2026-10-20.
• The dependency and .env readings, retaken on 2026-09-08. The .env in
  history (76f259c, untracked in 836c451) holds two VITE_APP_* keys and no
  third — looked at rather than assumed.

Evidence

npm ci, lint, lint:deps, typecheck, build and all ten check: scripts
green on the refreshed tree. npm run check:ui in full: 51 passed, 1 failed
— sign-in-redirect, which fails on any checkout holding a .env that
configures a real API origin, because providerChallenge.ts builds the challenge
address from it. CI has no .env; the browser-checks job on this pull request
is the reading that counts.