Stable release 2026.08.19.07

archive/folderview.plus-2026.08.19.01.txz.sha256

@@ -0,0 +1 @@
+52fa0f1f1a52ec0e10e2c92d62b72cb26c3869a5fd971aaa43ce841b8b6f48ca  folderview.plus-2026.08.19.01.txz

archive/folderview.plus-2026.08.19.02.txz.sha256

@@ -0,0 +1 @@
+530c6a7cfe49db7945aa1b7f368ab8c3f7348a3a436c0d9250eee1d92c78b0a0  folderview.plus-2026.08.19.02.txz

archive/folderview.plus-2026.08.19.03.txz.sha256

@@ -0,0 +1 @@
+75541901c6ba2c09dc486ccdb8a3c68aa69391490875be0acae283d9e0c51784  folderview.plus-2026.08.19.03.txz

archive/folderview.plus-2026.08.19.04.txz.sha256

@@ -0,0 +1 @@
+80f3d25e4f5e2ff3328bcd71b5998ec5f320c09f7083f59ff8f619351ab5cfd7  folderview.plus-2026.08.19.04.txz

archive/folderview.plus-2026.08.19.05.txz.sha256

@@ -0,0 +1 @@
+dfd2cf4f4d27815b68ec1950b5e2e5bb5dcfabd4f439c67a97a4e83fd3011f49  folderview.plus-2026.08.19.05.txz

archive/folderview.plus-2026.08.19.06.txz.sha256

@@ -0,0 +1 @@
+94d29a56f17577d10242da0fe898eb0cb52a1d9b265ae155532a16d3457b1a59  folderview.plus-2026.08.19.06.txz

archive/folderview.plus-2026.08.19.07.txz.sha256

@@ -0,0 +1 @@
+f64322b8fda9127b3c192fea5c16d375e6965c4cec7481818daf5517dfdeab1f  folderview.plus-2026.08.19.07.txz

docs/TROUBLESHOOTING.md

@@ -96,6 +96,10 @@ If rows keep refreshing indefinitely:
 4. Export a sanitized support bundle.
 5. Refresh once to stop the stale browser session and include the approximate duration in the report.
 
+Docker diagnostics retain the current session and the five most recent completed sessions. Each summary records only timestamps, duration, exit reason, reload/render/request counts, reload cadence, native-busy passes, and whether folders returned. Full reloads are assigned one privacy-safe source category: initial bootstrap, a manual plugin refresh, a plugin configuration revision, plugin action follow-up, Unraid's native busy poll, a host dialog callback, or an unknown host caller.
+
+The automatic `FVPLUS-DKR-REFRESH-001` verdict is `suspected` after at least three unattended full reloads within 60 seconds and `confirmed` after at least six within 90 seconds. Manual refreshes and host-dialog callbacks do not count toward that verdict. A native busy loop is reported separately with its first/last observation, pass count, duration, cleared state, and folder-restoration outcome.
+
 ### Host List Or View Switching Looks Wrong
 
 Host list should restore one copy of every native Unraid Docker row. FolderView should then rebuild one copy of every saved folder row. If rows duplicate, disappear, or a selection appears to do nothing:
@@ -142,15 +146,17 @@ Open `Settings -> FolderView Plus -> Advanced -> Diagnostics`, then review the s
 
 Use the sanitized export by default. It omits or hashes names, paths, URLs, IPs, and user-agent values and records what was redacted in the v2 `redactionManifest`.
 
-The v2 bundle also includes exact build/package identity, loaded plugin script/style URLs and version queries, recent plugin actions, a bounded FolderView Plus API error-log tail, and browser-side JS error snapshots.
+The v2 bundle also includes exact build/package identity, loaded plugin script/style URLs and version queries, recent plugin actions, a bounded FolderView Plus API error-log tail, and browser-side JS error snapshots. Browser errors keep full details for the current session and the retained last-30-day window; older retained entries are reduced to aggregate counts by category.
+
+Docker support evidence includes recent session summaries, reload-source counts, the refresh-loop verdict, native busy-cycle recovery, and aggregate API identity mismatches. API mismatches record counts and first/last timestamps only. They never include container names or IDs, and they state the `native-structure-authoritative` policy and that an API mismatch did not request a host reload.
 
 To compare two systems without exposing their identities, export sanitized bundles from both and run:
 
 ```bash
 npm run compare:support-bundles -- first-bundle.json second-bundle.json
 ```
 
-The comparator refuses full bundles and reports only allowlisted versions, counts, health/status, rendering geometry, modes, and other bounded troubleshooting fields.
+The comparator refuses full bundles and reports only allowlisted versions, counts, health/status, rendering geometry, modes, and other bounded troubleshooting fields. It compares Docker reload sources, session counts, busy passes, API mismatch counts, refresh verdicts, DOM mutation records, and transferred resource bytes so a recurrence or performance regression is visible without exposing workload identities.
 
 It also includes bounded Dashboard visual-layout snapshots. Its troubleshooting-domain summary keeps layout/rendering evidence separate from configuration, runtime/request, storage, icon, theme, localization, and update findings.
 

docs/docker-runtime-architecture.md

@@ -16,7 +16,7 @@ This document tracks the staged modularization of `docker.js` while preserving U
   - Owns dynamic capability-path checks, unavailable/legacy snapshots, provider accessors, and privacy-safe compatibility evidence mapping.
 - `scripts/docker.runtime.api-coordinator.js`
   - Owns API-first list and targeted reconciliation for the legacy Docker renderer.
-  - Merges only schema-confirmed runtime fields into the PHP-authoritative identity/metadata map, serializes requests, rejects stale work, schedules structural host refreshes, and applies permanent/transient failure policy.
+  - Merges only schema-confirmed runtime fields into the PHP-authoritative identity/metadata map, serializes requests, rejects stale work, schedules structural host refreshes only for verified configuration revisions, and applies permanent/transient failure policy.
 - `scripts/docker.runtime.container-model.js`
   - Normalizes GraphQL, PHP runtime, and DOM fallback records into one immutable container contract.
 - `scripts/docker.runtime.provider-health.js`
@@ -27,6 +27,10 @@ This document tracks the staged modularization of `docker.js` while preserving U
 - `scripts/docker.runtime.column-controller.js`
   - Owns Docker app-column measurement, cached-width bootstrap, gap enforcement, reflow scheduling, theme/viewport/font hooks, resizer observation, and teardown.
   - Receives runtime state and host dependencies from `docker.js`; it does not own Docker rows, preferences, or render orchestration.
+- `scripts/docker.runtime.refresh-diagnostics.js`
+  - Owns bounded, privacy-safe Docker session summaries, reload-source attribution, native busy-cycle evidence, API mismatch aggregates, and the automatic refresh-loop verdict.
+  - Counts completed renders by monotonic render generation, while `docker.runtime.diagnostics.js` remains the single owner of deferred page-snapshot scheduling.
+  - Retains five completed sessions and never stores container names, identifiers, API payloads, URLs, call stacks, or host process details.
 - `scripts/runtime.folder-ordering.js`
   - Owns deterministic folder depth, saved-order slot replacement, and Docker order reconciliation shared by Docker, VM, and Dashboard.
   - Preserves live folder-slot order for the default created mode while applying explicit sort and pin preferences consistently.

docs/releases/2026.08.19.01.md

@@ -0,0 +1,5 @@
+- Fix: Stop API container identity differences from recursively scheduling Unraid Docker list reloads after every FolderView render.
+- Reliability: Keep Unraid's native Docker/PHP configuration revision path authoritative for structural changes while using GraphQL only to enrich containers already present in the host runtime map.
+- Reliability: Detect Unraid's visible Docker busy-poll cycle and temporarily preserve its native rows instead of rebuilding every folder and preview on each host refresh.
+- Performance: Avoid repeated full runtime request bundles, folder grouping, preview hydration, and DOM replacement during unresolved API identity differences or native Docker service polling.
+- Test: Add coordinator, host busy-indicator, and double-reload regression coverage, then validate the fix through the complete lint/test suite, real-browser fixtures, and large-runtime performance budgets.

docs/releases/2026.08.19.02.md

@@ -0,0 +1,6 @@
+- Diagnostics: Retain up to five bounded Docker-page session summaries with start/end time, duration, exit reason, load/render/request counts, reload cadence, native busy-cycle recovery, and restored-folder evidence.
+- Diagnostics: Classify full Docker reloads by fixed privacy-safe sources and derive `healthy`, `suspected`, or `confirmed` refresh-loop verdicts with reference `FVPLUS-DKR-REFRESH-001`.
+- Reliability: Record API identity differences as aggregate counts only and keep Unraid's native configuration revision authoritative without requesting a host reload from the mismatch path.
+- Diagnostics: Preserve detailed browser-error evidence for the current session and previous 30 days while reducing older retained errors to category counts.
+- Maintenance: Extend sanitized support-bundle comparison to highlight refresh-loop, busy-cycle, API-mismatch, mutation, and transfer regressions.
+- Privacy: Keep Docker refresh diagnostics bounded and free of container names, IDs, raw API payloads, GraphQL queries, URLs, tokens, cookies, process lists, syslogs, and call stacks.

docs/releases/2026.08.19.03.md

@@ -0,0 +1,5 @@
+- Diagnostics: Count completed Docker renders from the monotonic render generation even when a later runtime-sync snapshot supplies the stored page evidence.
+- Diagnostics: Advance the trace-health top-level timestamp on every trace or page-snapshot write while preserving the other trace sections.
+- Performance: Remove the duplicate Docker page-snapshot timer and keep deferred snapshot scheduling owned by the diagnostics module.
+- Test: Add regression coverage for runtime-sync render attribution, duplicate-generation suppression, timestamp freshness, and single-owner snapshot scheduling.
+- Quality: Complete the full release, workflow, browser, theme, performance, dependency, Git-integrity, and GitHub security audit before the main merge.

docs/releases/2026.08.19.04.md

@@ -0,0 +1,8 @@
+- Fix: Stop API container identity differences from recursively scheduling Unraid Docker list reloads and eliminate the resulting 5-7 second Docker-page refresh loop.
+- Fix: Stop blank or unreachable container icon URLs from generating repeated requests by using the local fallback immediately and remembering failed sources across later renders for the current page session.
+- Reliability: Keep Unraid's native Docker/PHP configuration revision authoritative for structural changes, enrich only matching containers through API-first reads, and preserve native rows while Docker is busy.
+- Performance: Replace broad action-followup redraws with incremental runtime reconciliation and remove duplicate deferred support-snapshot scheduling.
+- Diagnostics: Add five-session Docker refresh history, privacy-safe reload-source attribution, busy-cycle recovery, API-mismatch aggregates, browser-error aging, and the `FVPLUS-DKR-REFRESH-001` loop verdict.
+- Diagnostics: Count completed renders by monotonic generation and keep trace-health timestamps current so exported support bundles accurately describe the observed session.
+- Privacy: Keep refresh and API evidence bounded and free of container identities, raw API payloads, GraphQL queries, URLs, tokens, cookies, call stacks, process lists, and syslogs.
+- Test: Validate the stable candidate through complete lint, static analysis, unit, workflow, release, install, deterministic-build, browser, theme, responsive, performance, dependency, Git-integrity, and GitHub security checks.

docs/releases/2026.08.19.05.md

@@ -0,0 +1,4 @@
+- Fix: Restore Docker folder boxes for folders created through the Add Folder wizard when Unraid renders container rows with short container IDs instead of container names.
+- Reliability: Resolve Docker row identities through the normalized runtime container model and preserve deterministic first-folder ownership when rules overlap.
+- Diagnostics: Add privacy-safe aggregate folder-grouping evidence for host-row resolution, claimed members, missing members, rendered folders, and hide-empty removals.
+- Test: Reproduce the reported 25-folder and 18-container layout with manual, regex, label, and advanced-rule membership in unit and browser fixtures.

docs/releases/2026.08.19.06.md

@@ -0,0 +1,4 @@
+- Fix: Keep populated Docker folders visible when Hide empty folders removes earlier empty rows and later folders have high saved-order positions.
+- Reliability: Insert folder shells relative to connected rows in the reconciled host order and leave member rows under Unraid ownership if a shell cannot be attached.
+- Diagnostics: Report aggregate successful, fallback, and failed folder-shell insertion counts without exposing folder or container identities.
+- Test: Reproduce the reported 25-folder and 18-container layout with Hide empty folders enabled, disabled, and enabled again across repeated renders.

docs/releases/2026.08.19.07.md

@@ -0,0 +1,13 @@
+- Fix: Eliminate the 5–7 second Docker-page refresh loop caused by API container-identity differences recursively scheduling native list reloads after FolderView renders.
+- Fix: Prevent FolderView-generated images with blank or unreachable icon URLs from repeatedly requesting the failed source during subsequent FolderView renders, while immediately using the local fallback for blank values.
+- Fix: Restore Docker folder boxes created through the Add Folder wizard when Unraid identifies container rows by short container IDs instead of container names.
+- Fix: Keep populated folders visible when Hide empty folders removes earlier placeholders and later populated folders have high saved-order positions.
+- Reliability: Keep Unraid's native Docker/PHP configuration revision authoritative for structural changes, use GraphQL only to enrich containers already present in the host runtime map, and preserve native rows during Docker busy-poll cycles.
+- Reliability: Resolve Docker row identities through the normalized runtime model, retain deterministic first-folder ownership for overlapping rules, insert folder shells relative to connected host rows, and leave member rows under Unraid ownership if a shell cannot be attached safely.
+- Performance: Replace broad action-followup redraws with incremental runtime reconciliation and remove duplicate deferred support-snapshot scheduling to avoid unnecessary request bundles, folder grouping, preview hydration, and DOM replacement.
+- Diagnostics: Retain five bounded Docker-page session summaries with privacy-safe reload-source attribution, render and request counts, cadence, busy-cycle recovery, API-mismatch aggregates, and the `FVPLUS-DKR-REFRESH-001` healthy/suspected/confirmed verdict.
+- Diagnostics: Count completed renders by monotonic generation, keep trace-health timestamps current, age browser-error evidence, and report aggregate host-row resolution, folder claims, missing members, hide-empty removals, and folder-shell insertion outcomes.
+- Privacy: Keep runtime, refresh, API, icon, and folder-grouping diagnostics bounded and free of container identities, raw API payloads, GraphQL queries, URLs, tokens, cookies, call stacks, process lists, and syslogs.
+- Docs: Expand troubleshooting and Docker runtime/API architecture guidance for native refresh ownership, busy polling, identity mismatches, folder grouping, support-bundle interpretation, and safe escalation.
+- Test: Add coordinator, native busy-indicator, double-reload, image fallback, short-ID grouping, high-position hide-empty, repeated-render, browser-fixture, support-bundle, and large-runtime performance regressions.
+- Quality: Validate the complete stable promotion through strict lint, static analysis, unit, workflow, release, install, deterministic-build, browser, theme, responsive, performance, dependency, Git-integrity, and GitHub security checks.

docs/sbom.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f6b26184-7c5b-8984-a57e-75fb80c030ce",
+  "serialNumber": "urn:uuid:7d763a96-545a-896b-b7a7-d64cb56bf965",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "FolderView Plus",
-      "version": "2026.08.18.08",
+      "version": "2026.08.19.07",
       "properties": [
         {
           "name": "folderview-plus:runtime-dependencies",

docs/security/csp-readiness.json

@@ -3,7 +3,7 @@
   "mode": "report-only-shared-unraid-document",
   "scope": {
     "scannedRoot": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus",
-    "scannedFiles": 230,
+    "scannedFiles": 233,
     "exclusions": [
       "third-party icon asset pack",
       "vendored scripts",
@@ -21,7 +21,7 @@
   "totals": {
     "inlineEventAttributes": 0,
     "inlineScriptBlocks": 0,
-    "externalScriptTags": 200,
+    "externalScriptTags": 205,
     "inlineStyleBlocks": 0,
     "inlineStyleAttributes": 0,
     "evalCalls": 0,
@@ -72,7 +72,7 @@
   "htmlStringSinkInventory": [
     {
       "path": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus/scripts/docker.js",
-      "line": 1230,
+      "line": 1238,
       "sink": ".innerHTML =",
       "risk": "high",
       "dataClass": "persisted-or-runtime-data",
@@ -82,7 +82,7 @@
     },
     {
       "path": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus/scripts/docker.js",
-      "line": 1241,
+      "line": 1249,
       "sink": ".innerHTML =",
       "risk": "reviewed",
       "dataClass": "static-or-controlled-ui-template",
@@ -92,7 +92,7 @@
     },
     {
       "path": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus/scripts/docker.js",
-      "line": 1286,
+      "line": 1294,
       "sink": ".innerHTML =",
       "risk": "high",
       "dataClass": "persisted-or-runtime-data",
@@ -102,7 +102,7 @@
     },
     {
       "path": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus/scripts/docker.js",
-      "line": 3465,
+      "line": 3468,
       "sink": ".innerHTML =",
       "risk": "high",
       "dataClass": "persisted-or-runtime-data",
@@ -486,7 +486,7 @@
       "path": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus/Folder.page",
       "inlineEventAttributes": 0,
       "inlineScriptBlocks": 0,
-      "externalScriptTags": 30,
+      "externalScriptTags": 31,
       "inlineStyleBlocks": 0,
       "inlineStyleAttributes": 0,
       "evalCalls": 0,
@@ -498,7 +498,7 @@
       "path": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus/FolderViewPlus.page",
       "inlineEventAttributes": 0,
       "inlineScriptBlocks": 0,
-      "externalScriptTags": 7,
+      "externalScriptTags": 8,
       "inlineStyleBlocks": 0,
       "inlineStyleAttributes": 0,
       "evalCalls": 0,
@@ -522,7 +522,7 @@
       "path": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus/folderview.plus.Docker.page",
       "inlineEventAttributes": 0,
       "inlineScriptBlocks": 0,
-      "externalScriptTags": 62,
+      "externalScriptTags": 64,
       "inlineStyleBlocks": 0,
       "inlineStyleAttributes": 0,
       "evalCalls": 0,
@@ -558,7 +558,7 @@
       "path": "src/folderview.plus/usr/local/emhttp/plugins/folderview.plus/scripts/custom.php",
       "inlineEventAttributes": 0,
       "inlineScriptBlocks": 0,
-      "externalScriptTags": 4,
+      "externalScriptTags": 5,
       "inlineStyleBlocks": 0,
       "inlineStyleAttributes": 0,
       "evalCalls": 0,