From 8ecf5338d58cf842f44113258429079c9360890e Mon Sep 17 00:00:00 2001
From: poslop <poslop@archfox.org>
Date: Wed, 9 Sep 2026 18:22:31 -0500
Subject: [PATCH 1/8] CI: build dev image on dev branch pushes (palette-dev
 deploy)

---
 .gitea/workflows/ci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index ebc20ad..ec1b031 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
     tags: ['v*']
   pull_request:
 
@@ -23,8 +23,8 @@ jobs:
         run: go test -v ./...
 
   docker:
-    # build & push image only on tags (releases)
-    if: startsWith(github.ref, 'refs/tags/')
+    # build & push image only on tags (releases) and dev branch (dev deploy)
+    if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/dev'
     needs: test
     runs-on: [debian-latest]
     env:
@@ -57,6 +57,6 @@ jobs:
           push: true
           tags: |
             git.archfox.org/poslop/palette:${{ gitea.ref_name }}
-            git.archfox.org/poslop/palette:latest
+            ${{ startsWith(gitea.ref, 'refs/tags/') && 'git.archfox.org/poslop/palette:latest' || '' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

From 65ed0c70437e8e1377d72d705e1fd6f4fc187c2a Mon Sep 17 00:00:00 2001
From: agent <agent@archfox.org>
Date: Wed, 9 Sep 2026 18:27:57 -0500
Subject: [PATCH 2/8] Show actual version in topbar instead of hardcoded beta
 (Fixes #93)

---
 .gitea/workflows/ci.yml            | 1 +
 Dockerfile                         | 3 ++-
 internal/web/templates/layout.html | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index ec1b031..b62111e 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -55,6 +55,7 @@ jobs:
         with:
           context: .
           push: true
+          build-args: VERSION=${{ gitea.ref_name }}
           tags: |
             git.archfox.org/poslop/palette:${{ gitea.ref_name }}
             ${{ startsWith(gitea.ref, 'refs/tags/') && 'git.archfox.org/poslop/palette:latest' || '' }}
diff --git a/Dockerfile b/Dockerfile
index 770886b..e50b7a2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /palette ./cmd/palette
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X palette/internal/web.Version=${VERSION}" -o /palette ./cmd/palette
 
 # ---- runtime stage ----
 FROM alpine:3.20
diff --git a/internal/web/templates/layout.html b/internal/web/templates/layout.html
index d63bb50..a958df9 100644
--- a/internal/web/templates/layout.html
+++ b/internal/web/templates/layout.html
@@ -13,7 +13,7 @@
 
 {{define "topbar"}}
   <div class="topbar">
-    <a class="logo" href="/history">Palette <em>/ beta</em></a>
+    <a class="logo" href="/history">Palette <em>/ {{ version }}</em></a>
     <nav>
       <a href="/new" {{if eq .Page "new"}}class="on"{{end}}>New</a>
       <a href="/history" {{if eq .Page "history"}}class="on"{{end}}>Public</a>

From f37cc932c4f22ccb33e0db25870bb507125ab253 Mon Sep 17 00:00:00 2001
From: poslop <poslop@archfox.org>
Date: Wed, 9 Sep 2026 18:28:00 -0500
Subject: [PATCH 3/8] store: burn_after_reads>0 implies burn-after-read mode
 (#82)

---
 internal/api/burnreads_test.go | 27 +++++++++++++++++++++++++++
 internal/store/store.go        |  8 ++++++--
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/internal/api/burnreads_test.go b/internal/api/burnreads_test.go
index bd74e69..07f578b 100644
--- a/internal/api/burnreads_test.go
+++ b/internal/api/burnreads_test.go
@@ -46,6 +46,33 @@ func getWithCookie(t *testing.T, h anyHandler, id, viewer string) *httptest.Resp
 	return rec
 }
 
+// #82: burn_after_reads > 0 alone must enable burn-after-read
+// even without burn_after_read: true.
+func TestBurnReadsImpliedByBurnAfterReads(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"implied","burn_after_reads":2}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create burn_after_reads-only: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	if rec := getWithCookie(t, h, created.ID, "aaa"); rec.Code != 200 {
+		t.Fatalf("read 1: %d", rec.Code)
+	}
+	if rec := getWithCookie(t, h, created.ID, "bbb"); rec.Code != 200 {
+		t.Fatalf("read 2: %d", rec.Code)
+	}
+	if rec := getWithCookie(t, h, created.ID, "ccc"); rec.Code != 404 {
+		t.Fatalf("read 3 expected 404 (burned), got %d", rec.Code)
+	}
+}
+
 func TestBurnAfterNReadsDistinctViewers(t *testing.T) {
 	s := testServer(t)
 	h := s.routes()
diff --git a/internal/store/store.go b/internal/store/store.go
index e836e04..8755207 100644
--- a/internal/store/store.go
+++ b/internal/store/store.go
@@ -211,13 +211,17 @@ func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
 		}
 	}
 
-	// #49: burn-after-read pastes carry a read budget (default 1 read)
-	if p.BurnAfterRead {
+	// #49/#82: burn-after-read pastes carry a read budget (default 1 read).
+	// burn_after_reads > 0 alone implies burn mode even without burn_after_read.
+	if p.BurnAfterRead || (p.BurnAfterReads != nil && *p.BurnAfterReads > 0) {
 		limit := int64(1)
 		if p.BurnAfterReads != nil && *p.BurnAfterReads > 0 {
 			limit = int64(*p.BurnAfterReads)
 		}
 		p.readsLimit = &limit
+		if !p.BurnAfterRead {
+			p.BurnAfterRead = true
+		}
 	}
 
 	visibility := p.Visibility

From 805cc3ff2b241b84b2ce1c969a0dff77da1ef2d4 Mon Sep 17 00:00:00 2001
From: fen <fen@archfox.org>
Date: Wed, 9 Sep 2026 18:40:09 -0500
Subject: [PATCH 4/8] web: restore persisted theme on page load (#100)

---
 internal/web/templates/layout.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/internal/web/templates/layout.html b/internal/web/templates/layout.html
index d63bb50..52bef33 100644
--- a/internal/web/templates/layout.html
+++ b/internal/web/templates/layout.html
@@ -3,9 +3,10 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <link rel="stylesheet" href="/static/app.css">
 <script>
-// preset preview hook (#16): ?theme=<name> sets data-preset for screenshots only
+// preset hook (#16): ?theme= wins; else persisted choice (#100)
 (function () {
   var t = new URLSearchParams(location.search).get('theme');
+  if (!t) try { t = localStorage.getItem('palette-theme'); } catch (e) {}
   if (t) document.documentElement.dataset.preset = t;
 })();
 </script>

From f6e81de2a3ea6794d3dee7ca794b5d99d468ca9a Mon Sep 17 00:00:00 2001
From: fen <fen@archfox.org>
Date: Wed, 9 Sep 2026 19:15:44 -0500
Subject: [PATCH 5/8] Fix README: build path ./cmd/palette, Go 1.27+,
 design-doc wiki link (#110)

---
 README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 51ee774..0c15dbd 100644
--- a/README.md
+++ b/README.md
@@ -45,10 +45,10 @@ every environment variable documented, including which are required (only the
 
 ### Build from source
 
-Requires Go 1.21+.
+Requires Go 1.27+.
 
 ```bash
-go build -o palette .
+go build -o palette ./cmd/palette
 ./palette
 # open http://localhost:8080
 ```
@@ -76,7 +76,7 @@ Full REST API: [wiki/API](https://git.archfox.org/poslop/palette/wiki/API). One
 curl -X POST http://localhost:8080/api/pastes -d '{"content":"hello"}'
 ```
 
-Design docs: [wiki/design](https://git.archfox.org/poslop/palette/wiki/design/attachments-storage) (e2e encryption, attachments & storage, cookie preferences).
+Design docs: [wiki/design](https://git.archfox.org/poslop/palette/wiki/design-attachments-storage) (e2e encryption, attachments & storage, cookie preferences).
 
 
 

From 6b95994c531862700e74520e5a8b9e6889660c42 Mon Sep 17 00:00:00 2001
From: fen <fen@fen-vm.archfox.org>
Date: Wed, 9 Sep 2026 19:52:32 -0500
Subject: [PATCH 6/8] Admin lock on every load, drop settings hint, derive
 theme swatches from CSS vars (#112)

---
 internal/web/templates/admin.html    |  4 +++-
 internal/web/templates/settings.html | 30 ++++++++++++++++++++--------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/internal/web/templates/admin.html b/internal/web/templates/admin.html
index 86f10ee..6af4d74 100644
--- a/internal/web/templates/admin.html
+++ b/internal/web/templates/admin.html
@@ -103,7 +103,9 @@
     });
   });
 
-  if (key()) loadSettings();
+  // #112: always show the lock on fresh load — do not auto-restore the
+  // panel from a stale sessionStorage key. The key is only written after a
+  // successful unlock (above) so in-page actions still work within this visit.
 })();
 </script>
 {{template "foot" .}}
diff --git a/internal/web/templates/settings.html b/internal/web/templates/settings.html
index 368d08b..91e5585 100644
--- a/internal/web/templates/settings.html
+++ b/internal/web/templates/settings.html
@@ -8,23 +8,37 @@
     <div class="settings-body">
       <h3>Theme</h3>
       <div class="theme-grid" id="theme-grid"></div>
-      <p class="hint" style="margin-top:10px">Applies instantly and is saved in this browser.</p>
       <p class="admin-link-row"><a class="admin-link" href="/admin">Admin</a></p>
     </div>
   </div>
 </div>
 <script>
 (function () {
-  var themes = [
-    { id: 'midnight',        name: 'Midnight',        colors: ['#241B30', '#2D2340', '#3A2D52', '#7A6A9E', '#C4A8F0'] },
-    { id: 'smooth',          name: 'Smooth',          colors: ['#F6F5FA', '#DAD7E6', '#B5B1C9', '#7A7796', '#2A2A36'] },
-    { id: 'pastel-lavender', name: 'Pastel Lavender', colors: ['#e6e0f5', '#cbb8e7', '#b29edb', '#9b85cf', '#806bb8'] },
-    { id: 'pastel-peach',    name: 'Pastel Peach',    colors: ['#ffe0d6', '#ffc4a8', '#ffa78f', '#ff8b76', '#f9826c'] },
-    { id: 'pastel-cloud',    name: 'Pastel Cloud',    colors: ['#cdb4db', '#ffc8dd', '#ffafcc', '#bde0fe', '#a2d2ff'] }
+  // #112: derive each preset's swatches from the real CSS variables in
+  // app.css by temporarily applying data-preset, so they can never drift.
+  var themeNames = [
+    { id: 'midnight',        name: 'Midnight' },
+    { id: 'smooth',          name: 'Smooth' },
+    { id: 'pastel-lavender', name: 'Pastel Lavender' },
+    { id: 'pastel-peach',    name: 'Pastel Peach' },
+    { id: 'pastel-cloud',    name: 'Pastel Cloud' }
   ];
+  var SWATCH_VARS = ['--bg', '--surface', '--surface-2', '--muted', '--accent'];
+
+  function presetColors(id) {
+    var root = document.documentElement;
+    var prev = root.getAttribute('data-preset');
+    root.setAttribute('data-preset', id);
+    var cs = getComputedStyle(root);
+    var colors = SWATCH_VARS.map(function (v) { return cs.getPropertyValue(v).trim(); });
+    if (prev === null) root.removeAttribute('data-preset'); else root.setAttribute('data-preset', prev);
+    return colors;
+  }
+
   var grid = document.getElementById('theme-grid');
   var current = document.documentElement.dataset.preset || 'midnight';
-  themes.forEach(function (t) {
+  themeNames.forEach(function (t) {
+    var colors = presetColors(t.id);
     var btn = document.createElement('button');
     btn.type = 'button';
     btn.className = 'theme-card';

From a677e627a854ec2087cfea56f9149188a4dec817 Mon Sep 17 00:00:00 2001
From: fen <fen@fen-vm.archfox.org>
Date: Wed, 9 Sep 2026 20:55:13 -0500
Subject: [PATCH 7/8] Fix #114: use presetColors(t.id) for theme card swatches

t.colors was removed by #113; rendering threw on first iteration and
the theme grid rendered empty. Use the colors returned by
presetColors(t.id) instead. Verified in headless chromium: 5
theme-card elements render on /settings.
---
 internal/web/templates/settings.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/web/templates/settings.html b/internal/web/templates/settings.html
index 91e5585..b4a8629 100644
--- a/internal/web/templates/settings.html
+++ b/internal/web/templates/settings.html
@@ -44,7 +44,7 @@
     btn.className = 'theme-card';
     btn.setAttribute('aria-pressed', current === t.id ? 'true' : 'false');
     btn.innerHTML = '<strong>' + t.name + '</strong>' +
-      '<span class="swatches">' + t.colors.map(function (c) {
+      '<span class="swatches">' + colors.map(function (c) {
         return '<span class="swatch" style="background:' + c + '"></span>';
       }).join('') + '</span>';
     btn.addEventListener('click', function () {

From 073d39ccbab63c85fad3476733d0541bdb7fb303 Mon Sep 17 00:00:00 2001
From: fen <fen@archfox.org>
Date: Wed, 9 Sep 2026 21:18:53 -0500
Subject: [PATCH 8/8] Fix #116: allow inline styles in CSP (style-src 'self'
 'unsafe-inline')

---
 internal/web/securityheaders_test.go | 2 +-
 internal/web/web.go                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/web/securityheaders_test.go b/internal/web/securityheaders_test.go
index b6d54c7..61d0b56 100644
--- a/internal/web/securityheaders_test.go
+++ b/internal/web/securityheaders_test.go
@@ -16,7 +16,7 @@ func TestSecurityHeaders(t *testing.T) {
 	h := SecurityHeaders(pages)
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
-	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
+	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
 	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
 		t.Errorf("CSP = %q, want %q", got, wantCSP)
 	}
diff --git a/internal/web/web.go b/internal/web/web.go
index fb12054..6d164ae 100644
--- a/internal/web/web.go
+++ b/internal/web/web.go
@@ -344,7 +344,7 @@ func SecurityHeaders(next http.Handler) http.Handler {
 		// is harmless and arguably desirable.
 		h := w.Header()
 		h.Set("Content-Security-Policy",
-			"default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
+			"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
 		h.Set("Referrer-Policy", "no-referrer")
 		h.Set("X-Content-Type-Options", "nosniff")
 		next.ServeHTTP(w, r)