fix: close remaining phase 2 baseline QA failures (#6)

* feat: complete Phase 2 professional designer

Complete the Phase 2 designer, preset library, Scan Safety v2, batch generation, camera scanning, print tooling, design history, sharing, project workflow and related documentation.

* fix: close remaining phase 2 baseline QA failures

* feat: complete phase 2 implementation

Author: power0matin

.github/workflows/ci.yml

@@ -31,6 +31,7 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm test
       - run: pnpm build
+      - run: pnpm check:bundle
       - run: pnpm audit --prod --audit-level high
 
   e2e:

.github/workflows/release.yml

@@ -24,6 +24,7 @@ jobs:
       - name: Verify tag matches package version
         run: pnpm release:verify
       - run: pnpm check
+      - run: pnpm check:bundle
       - run: pnpm audit:prod
       - run: pnpm --filter @moduqr/web exec playwright install --with-deps chromium firefox webkit
       - run: pnpm --filter @moduqr/web test:e2e

CHANGELOG.md

@@ -9,11 +9,13 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
 - Ten static payload types with Smart Detect parsing and editable structured inputs.
 - ModuQR-owned SVG renderer with square, rounded, dot/circle, diamond, pixel, Connected, and Fluid module styles.
 - Independent finder overrides and multi-stop module/background gradients.
-- Sanitized PNG/JPEG/WebP/SVG logo support, center cutout, frames, and 24 data-defined presets.
-- Deterministic Scan Safety scoring plus real browser-rasterized decode verification.
+- Sanitized PNG/JPEG/WebP/SVG logo support, center cutout, advanced frames, per-region styling, and 60 searchable/favoritable data-defined presets.
+- Scan Safety v2 with deterministic scoring, browser-rasterized decode verification, blur/scale/rotation/contrast simulations and scan-first Auto Fix.
 - SVG, PNG, JPEG, WebP, and PDF export with preflight and post-compression decode checks where applicable.
-- Local image scanner, privacy-safe Scan → Redesign, IndexedDB projects, versioned JSON portability, PWA/offline behavior, SEO pages, accessibility checks, CI, CodeQL, and release gates.
-- Design schema v2 with transparent migration from schema v1.
+- Local camera/upload/drop/paste scanner, privacy-safe Scan → Redesign, IndexedDB project tags/revision history, design-only share URLs, versioned JSON portability, PWA/offline behavior, SEO pages, accessibility checks, CI, CodeQL, and release gates.
+- Design schema v3 with transparent migration from schema v1 and v2.
+- Local batch generator for up to 500 CSV/TSV/JSON rows with template variables, Worker preparation, verified SVG/PNG ZIP export and PDF sheets.
+- Mockup Preview, Print Safety Assistant, print-size/module calculator, scan-distance planning heuristic and local small-file QR capacity analysis.
 
 ### Changed
 - Added neighbour-aware Connected/Fluid rendering and richer Phase 2 finder/gradient controls.
@@ -22,7 +24,7 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
 - Local Playwright uses the system Chrome channel; CI retains the full managed Chromium/Firefox/WebKit matrix, and local QA can explicitly exercise the built production server without downloading managed browsers.
 - Local project reopening now passes only an IndexedDB project ID between routes instead of duplicating the whole design in session storage.
 - Production PWA registration warms the currently loaded Next.js static assets for stronger first-session offline behavior.
-- Batch and Dynamic roadmap pages remain accessible but are `noindex` and omitted from the sitemap until they ship.
+- Batch is now a real indexed static tool; Dynamic remains a `noindex` Phase 3 roadmap route.
 - Design tabs now use a keyboard-friendly roving tab stop with Arrow/Home/End navigation, and advanced range controls match the renderer/import schema limits.
 
 ### Fixed
@@ -53,7 +55,7 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
 - Release and CI installs use the committed lockfile with `--frozen-lockfile`; release verification also runs the production dependency audit, and CI uses bounded job timeouts with stale-run cancellation.
 
 ### Tests
-- Added regressions for schema migration/import safety, payload edge cases, QR capacity failure, favorite persistence, logo MIME/SVG hardening, logo-padding cutout behavior, resolution-invariant obstruction scoring, frame/quiet-zone separation, finder/gradient contrast, runtime renderer hardening, PWA behavior, roadmap `noindex`, keyboard tab navigation, and responsive overflow.
+- Added regressions for v1/v2→v3 migration/import safety, payload edge cases, QR capacity failure, favorite/history persistence, logo MIME/SVG hardening, region/frame rendering, design-share privacy, batch parsing/limits, print planning, Auto Fix, resolution-invariant obstruction scoring, finder/gradient contrast, runtime renderer hardening, PWA behavior, dynamic-roadmap `noindex`, keyboard tab navigation, RTL and responsive overflow.
 - Browser QA covers renderer→scanner round trips, all shipped presets, advanced styles, exports, accessibility, and mobile/desktop behavior.
 
 > The first public release, `v0.1.0`, remains gated on a clean install from the committed lockfile and the complete lint, typecheck, unit, production-build, browser, accessibility, dependency-audit, and security acceptance matrix. Roadmap phase numbers do not determine SemVer major versions.

README.md

@@ -25,38 +25,40 @@ The second rule is privacy. Static payloads, WiFi credentials, logos, scanned im
 
 ## Designer
 
-The current static studio includes the complete Phase 1 foundation plus the first Phase 2 professional-designer primitives:
+The current static studio includes the Phase 1 foundation plus the Phase 2 professional-designer implementation candidate:
 
 - URL, text, email, phone, SMS, WhatsApp, WiFi, vCard, geolocation and iCalendar payloads
 - Smart input detection plus editable parsing for structured WiFi, vCard, calendar and messaging payloads
 - ModuQR-owned SVG rendering over a raw QR matrix
 - square, rounded, extra-rounded, dot/circle, diamond, soft-square, pixel, Connected and Fluid module styles
 - neighbour-aware Connected/Fluid rendering
 - square, rounded and circular finder rendering with independent top-left, top-right and bottom-left overrides
-- solid colors, multi-stop linear/radial module gradients, independent background gradients, quiet-zone and error-correction controls
+- solid colors, multi-stop linear/radial module gradients, independent background gradients, per-region data/timing/alignment styling, quiet-zone and error-correction controls
 - PNG, JPEG, WebP and sanitized SVG logos with protected finder regions and center cutout
 - minimal, rounded, badge, label and sticker-style frames kept outside the QR square
-- 24 data-defined presets; the planned 50+ validated Phase 2 preset library is not claimed as shipped yet
-- live preview, Undo/Redo, Reset, Surprise Me, keyboard shortcuts and local project saving
-- versioned JSON design import/export with explicit v1 → v2 project migration
+- 60 data-defined presets with search, category filters and local favorites; every preset is covered by automated decode regression tests
+- live preview, advanced Undo/Redo, Reset, Surprise Me, keyboard shortcuts, project tags, duplicate/search and 40-revision local design history
+- versioned JSON design import/export with explicit v1/v2 → v3 project migration plus privacy-safe design-only share URLs
 - custom raster export from 256–8192 px plus 512/1024/2048/4096 presets
 - SVG, PNG, JPEG, WebP and PDF export through the same renderer
+- mockup preview, printer-aware sizing guidance, Scan Safety v2 stress simulations and deterministic scan-first Auto Fix
+- local CSV/TSV/JSON batch generation up to 500 rows with templates, Worker preparation, ZIP exports and PDF sheets
 
 ### Scan → Redesign
 
-The local scanner accepts uploaded, dropped or pasted raster images. It detects the decoded content type, previews normalized HTTP(S) URLs before navigation, and can send the payload into the Designer using same-tab `sessionStorage` instead of putting sensitive content into the URL.
+The local scanner accepts live camera input plus uploaded, dropped or pasted raster images. It detects the decoded content type, previews normalized HTTP(S) URLs before navigation, and can send the payload into the Designer using same-tab `sessionStorage` instead of putting sensitive content into the URL.
 
 ## Scan safety
 
-The current score is deterministic and explainable. It evaluates contrast, weakest gradient-stop contrast, inherited and customized finder contrast, quiet zone, QR density/version, output module size, logo pressure, higher-risk geometry, encoding failure and — most importantly — whether the final browser-rasterized SVG can actually be decoded.
+Scan Safety v2 is deterministic and explainable. It evaluates contrast, weakest gradient-stop contrast, finder and per-region contrast, quiet zone, QR density/version, output module size, logo pressure, higher-risk geometry, encoding failure and — most importantly — whether the final browser-rasterized SVG can actually be decoded. Optional local degradation tests exercise blur, down/up-scaling, rotation and reduced contrast; Auto Fix applies conservative styling changes and is regression-tested to improve deliberately risky designs.
 
 Every export performs a decode preflight. Raster exports are checked again after image compression before the download is allowed. The score is a risk signal, not a guarantee for every printer, surface, camera or lighting condition.
 
 See [Scan Safety](docs/SCAN_SAFETY.md).
 
 ## Local projects
 
-Projects are stored in IndexedDB and carry an explicit document schema version. The Projects view supports search, sorting, favorites, rename, duplicate, delete and reopen. Transactions are treated as complete only after IndexedDB commits them. JSON export is the portable backup format.
+Projects are stored in IndexedDB and carry an explicit document schema version. The Projects view supports search across names/tags/content, sorting, tags, favorites, rename, duplicate, delete and reopen. Saved edits retain the latest 40 local revisions for explicit restore-as-working-copy history. Transactions are treated as complete only after IndexedDB commits them. JSON export is the portable backup format.
 
 ## Privacy & security
 
@@ -120,13 +122,13 @@ Set `NEXT_PUBLIC_SITE_URL` to the public HTTPS origin before a production deploy
 
 ## Testing
 
-Vitest covers payloads, project migration/import boundaries, renderer behavior, presets and safety scoring. Playwright covers decode round trips, export preflight, PWA behavior, accessibility smoke tests, project persistence, over-capacity payload handling and horizontal-overflow checks at 320, 375, 390, 430, 768, 1024, 1280, 1440 and 1920 CSS pixels.
+Vitest covers payloads, v1/v2→v3 project migration/import boundaries, renderer behavior, 60 presets, batch parsing/limits, ZIP generation, design-only sharing, print planning and safety scoring. Playwright covers decode round trips, Phase 2 preset scans, safety simulations/Auto Fix, camera permission handling, batch Worker preparation, export preflight, PWA behavior, accessibility smoke tests, project persistence/history/tags, over-capacity payload handling, RTL/touch behavior and horizontal-overflow checks at 320, 375, 390, 430, 768, 1024, 1280, 1440 and 1920 CSS pixels.
 
 A new visual style is not releaseable merely because it looks good: it must survive automated decode regression coverage.
 
 ## SEO
 
-Useful landing pages exist for static features that actually ship. Batch and Dynamic routes remain accessible as roadmap documentation but are `noindex` and omitted from the sitemap until those features ship. Metadata includes canonical URLs, sitemap, robots, raster OpenGraph/Twitter artwork and structured SoftwareApplication/FAQ data.
+Useful landing pages exist for static features that actually ship. Batch is a shipped Phase 2 static feature and is indexed; the Dynamic route remains roadmap documentation, is `noindex`, and stays out of the sitemap until Phase 3 server mode ships. Metadata includes canonical URLs, sitemap, robots, raster OpenGraph/Twitter artwork and structured SoftwareApplication/FAQ data.
 
 ## Roadmap and versioning
 

ROADMAP.md

@@ -5,12 +5,12 @@
 ## Phase 1 — Foundation & Static QR Studio
 Release-candidate static generator foundation: custom SVG renderer, image scanner, scan-safety v1, local projects, offline PWA, exports, accessibility and SEO. Public release remains gated by the complete clean-install and browser/security QA matrix.
 
-## Phase 2 — Professional Designer — In progress
-Neighbour-aware rendering, richer frames/gradients, 50+ validated presets, mockups, print assistant, safety simulations/Auto Fix, camera scanner, batch generation and advanced history.
+## Phase 2 — Professional Designer — Implementation complete, acceptance gate pending
+The Phase 2 implementation now contains neighbour-aware Connected/Fluid rendering, independent finder controls, per-region styling, advanced gradients/frames, 60 searchable/favoritable presets, Surprise Me, project tags/search/duplicate/history, design-only sharing, schema-v3 migration, mockups, Print Safety Assistant, Scan Safety v2 simulations/Auto Fix, camera/upload/drop scanner flows, Scan → Redesign, and a local 500-row CSV/TSV/JSON batch pipeline with Worker preparation, templates, ZIP/PDF exports and capacity analysis.
 
-Current Phase 2 foundation includes neighbour-aware Connected/Fluid modules, independent finder overrides, multi-stop module/background gradients, schema-v2 project migration, and matching scan-safety regression coverage.
+Phase 2 does **not** become release-complete until the clean-install lint/typecheck/unit/build/a11y/E2E/browser matrix, 500-row batch acceptance run, dependency/security checks, performance/bundle audit and Phase 1 regressions are green.
 
-## Phase 3 — Dynamic & Developer Platform
-Optional PostgreSQL server mode, dynamic redirects, privacy-respecting analytics, REST/OpenAPI, API keys, SDK/React/CLI/embed/MCP packages and Docker self-hosting.
+## Phase 3 — Dynamic & Developer Platform — Next after Phase 2 gate
+Optional PostgreSQL server mode, dynamic redirects, privacy-respecting analytics, REST/OpenAPI, API keys, SDK/React/CLI/embed/MCP packages and Docker self-hosting. Static generation must remain server-independent.
 
 Each phase is gated by regression, accessibility, performance, dependency and security audits.

apps/web/app/about/page.tsx

@@ -8,6 +8,6 @@ export default function AboutPage() {
     <h1>A QR tool built around the part other editors hide: reliability.</h1>
     <p>ModuQR separates QR encoding from visual rendering, keeps static generation local, and treats scanability as a product feature rather than an afterthought.</p>
     <h2>Current scope</h2>
-    <p>The static QR studio, local image scanner, local projects, exports, PWA behavior, accessibility, SEO, and open-source quality form the current release-candidate foundation. Phase 2 is expanding the professional designer while the optional dynamic server platform remains a later milestone.</p>
+    <p>The static QR studio, local camera/image scanner, local projects, exports, PWA behavior, accessibility, SEO, professional design controls, safety simulations, and local batch generation form the current Phase 2 release-candidate foundation. The optional dynamic server platform remains a later milestone.</p>
   </article>;
 }

apps/web/app/batch-qr-code-generator/page.tsx

@@ -1,14 +1,17 @@
 import type { Metadata } from 'next';
-import { SeoPage } from '@/components/seo-page';
+import { BatchGenerator } from '@/components/batch-generator';
 import { seoContent } from '@/lib/seo-content';
 
 export const metadata: Metadata = {
   title: 'Batch QR Code Generator',
   description: seoContent.batch.intro,
   alternates: { canonical: '/batch-qr-code-generator' },
-  robots: { index: false, follow: true },
 };
 
 export default function Page() {
-  return <SeoPage content={seoContent.batch}/>;
+  return (
+    <div className="page">
+      <BatchGenerator />
+    </div>
+  );
 }