# Release notes — 2026.08.27.1

## First database-backed application foundation

This release begins YourStories production development from the approved visual concept. It is the first package with real account, QR, claim, story and publication state.

### Security choices

- The public QR and private activation code are separate.
- Activation codes are stored as keyed SHA-256 hashes, never readable plaintext.
- Plain activation codes are returned only at generation and must be exported then.
- Email codes expire, are single-use and lock after repeated failures.
- Browser sessions use random tokens; only token hashes are stored in MySQL.
- QR claiming uses an expiring reservation and final database transaction.
- New stories default to private.
- Cross-site state-changing requests are blocked by origin/fetch-site checks.
- Turnstile and rate-limit hooks are present.
- Failed OTP attempts persist even when verification is rejected.
- Verified QR claim sessions are extended to match the active reservation window.
- Expired claim sessions cannot silently create an unlinked story.
- Browser Turnstile widgets reset after failed requests because tokens are single-use.
- R2 objects are checked for expected size and content type before becoming ready.
- Protected account, claim, dashboard, administration and API routes send explicit no-store headers.
- Original filenames are not exposed in R2 object keys.

### Known staging limitations

- A private invited guest cannot enter an access code yet; only Story Keepers can sign in.
- Uploaded cover images use private R2 presigned read links and have no derivative-processing pipeline yet.
- The public story supports the opening and prepared text entries, but the full chapter composer is not included.
- The package was created without `node_modules` or a generated lock file; the first staging installation creates `package-lock.json`. Preserve that file after the verified install.
- The packaging environment could not download npm dependencies, so a real `next build` still has to pass on the staging cPanel server. Source syntax, JSX parsing, imports, assets, JSON and CSS structure have been validated.