- Shipped
- August 25, 2026 at 5:53 PM UTC
- Author
- kamo
- Commit
- a8482d9
Five things found reading the first cut back, all of them real. The "Added below" badge lied. It tracked only which card had been clicked, so hitting Remove on the slot left the card still claiming its logo was down there -- precisely the state in which somebody submits the wizard believing they have a logo. Now compares File identity, which also stops a member's own hand-uploaded logo.svg lighting up a suggestion they never took. The scan only fired from the Next button on Basics. The stepper lets a member jump straight to a visited step, so anyone who corrected their website and then clicked "Logo" in the sidebar saw suggestions from the old URL or none at all. The banner now requests one on mount too -- free, because requestScan is a no-op for an already-scanned URL. FULL/SIMPLE was computed server-side and then ignored on the client, so the compact rail led with wordmark lockups. Slot shape now sorts first. Deliberately a sort and not a filter: an SVG scales, and a site whose only vector is its full lockup should be offered it, not an empty rail. normalizeWebsite tested for "has a dot", which accepted javascript:alert(1.0). The server refused it -- safely, but after a pointless round trip and only because two other layers were doing their jobs. Now matched against a real hostname shape, with :port kept so a staging URL still scans. Four copies of hostOf collapsed into one hostLabel, and the panels no longer repeat the host the banner named two inches above them.