KOKOTO WebChat (Bukkit, Spigot, Paper, Purpur)

# KOKOTO WebChat 5.3.3 release notes

## 5.3.3

5.3.3 is compared directly with the finalized 5.3.2 maintenance baseline. It keeps configuration schema **5.3.0** and Relay Protocol **2.2**. The release focuses on notification correctness, local/offline Help, upload-retention semantics, private-window presentation fixes, version/reporting consistency, and Forge 26.3 activation.

### Added

- **Offline/local Help with custom translation packs**: the Web account **Help** button opens documentation served by the same KWC HTTP server. English, Korean, Japanese, and Simplified Chinese docs are bundled, unsupported UI locales fall back to English, and administrators may install `plugins/KOKOTO-WebChat/docs/<locale>/` Markdown translations without having them overwritten. Local Help renders Markdown as safe styled HTML with headings, lists, tables, code blocks, local navigation, and explicit online Docs/Wiki links.
- **Local Help image support for real manual screenshots**: bundled Markdown may reference KWC-owned PNG/SVG/WebP images under `docs/assets/ui/`; offline Help serves the synchronized copy through same-origin `/help/assets/`. Remote Markdown images and path traversal remain blocked. The source tree includes an authoring guide so the Korean manual, translated Docs, Wiki mirror, and offline Help can share stable real-UI screenshots.

### Changed

- **Animated GIF profile images**: custom profile avatars now accept GIF in addition to PNG/JPEG/WebP. The existing 2 MiB profile-image limit is unchanged; GIF bytes are preserved so animation remains intact in browser profile/avatar rendering.
- **Release version and config schema version are separate**: generated/current config shows `release-version: "5.3.3"` for the running KWC product release while `config-version: "5.3.0"` remains the configuration-schema/migration marker. `release-version` is informational and automatically synchronized by KWC; it is excluded from operator-value migration comparisons.
- **Pin/unpin confirmation**: pinning or unpinning a public-chat or Group message asks for confirmation before the server mutation is sent. Canceling leaves the pinned state unchanged; pin-order controls remain immediate.
- **Filter settings Save placement**: the Filter panel uses the shared admin-modal header Save action, matching the Settings panel. Word-list and custom-rule editor Save buttons remain local to their editors.
- **Original upload filenames**: `upload.filename-mode: original` continues to preserve sanitized Unicode names, while whitespace runs are normalized to `-` so stored URLs/path components do not contain literal spaces. Existing `-` and `_` separators are retained.
- **Forge 26.3 exact target**: Forge 26.3 is now an active release target pinned to Forge `66.0.3` with Java 25 and the existing `compat26` source layer. The deployable release matrix is now 48 artifacts.

### Fixed

- **Mobile JPEG photo orientation after metadata stripping**: normal image uploads and custom profile images now preserve only the non-sensitive EXIF Orientation value (2–8), rewritten into a minimal sanitized EXIF block when required. GPS, camera/device, author, IPTC, comment, and other EXIF metadata remain removed, while the JPEG pixel payload is left byte-for-byte compressed rather than re-encoded. Portrait photos taken on phones therefore no longer turn sideways after upload.
- **UUID-wide personal blocking and bounded blocked-user list**: personal blocks now canonicalize Relay identities to the underlying Minecraft UUID, so blocking the same account applies across every relayed server instead of creating separate `remote~server~UUID` entries. Legacy server-scoped block entries collapse and deduplicate automatically when preferences are read. The blocked-user list shows one account row and scrolls internally when it grows long.

- **Saved-conversation viewer/PDF responsiveness**: saved conversation viewers no longer build the entire archive synchronously on the UI thread. Reply targets are indexed once, viewer messages render in small batches so Close remains responsive on large snapshots, viewer images use lazy loading, and PDF export renders from the complete saved snapshot instead of cloning only the currently rendered viewer DOM.
- **Forge build-cache recovery**: Windows Forge builds now validate ForgeGradle/Mavenizer cached JARs after a failed target build. Truncated/corrupt cache JARs are removed and the same target is retried once, covering interrupted downloads/reboots such as `zip END header not found` without clearing the entire Gradle cache.
- **YouTube virtual-scroll autoplay**: `preview.youtube-autoplay-on-open` now applies only when the user explicitly opens a YouTube preview. If an already-open/remembered preview is destroyed by virtual scrolling and later recreated, the iframe is restored with autoplay disabled so a paused video does not start again merely because it re-entered the viewport.
- **Game-side personal blocking**: account-based personal blocks now filter KWC-delivered Public chat in-game as well as Web views. Bukkit/Paper additionally removes blocked senders from native player-chat recipient sets, and Relay Public messages use the same server-scoped remote account key.
- **Visible-target notification acknowledgement**: Public, DM, and Group exact-message notifications are acknowledged as soon as the target message is actually visible. Canonical inbox synchronization, post-render retries, foreground/focus changes, mobile `visualViewport` resize/scroll, window resize, and orientation changes all re-run the same guarded visibility sweep. With remove-after-view enabled the matching row is removed; otherwise it becomes Read.
- **Public reply/keyword/reaction attention targeting**: public-chat notifications now explicitly identify Public chat as their target, preventing an already-viewed public message from lingering unread because of an ambiguous target.
- **Deleted-message notification inbox lifecycle**: globally deleting a public, DM, or Group message removes notification-inbox rows that target that exact message, whether unread or already Read. Cross-server DM deletion and `/kchat dm delete` apply the same cleanup using the receiver-local DM message ID. Persisted stale rows are pruned and delayed writes are revalidated so deleted targets cannot be resurrected by a race.
- **Notification settings wording**: signed-in notification categories and keyword lists are correctly described as account-wide. Browser Notification permission/enablement and Web Push subscription are browser/device specific and must be enabled on each PC browser or mobile device that should receive alerts.
- **Desktop private-window presentation**: touch-capable Windows/ChromeOS/Linux desktops are no longer mistaken for mobile solely because `maxTouchPoints > 1`. Desktop Standalone DM/Group multi-window, dragging, and desktop typography remain on the desktop presentation path. DM/Group sender names and message bodies use the same base chat font-size token as public chat, while timestamp/status metadata sizing is unchanged.
- **Game/Web online user count**: the signed-in user counter uses the UUID-deduplicated union of Game and Web presence. A user connected from both counts once; Game-only and Web-only users are both included, while the existing Offline privacy rule still excludes hidden accounts.
- **Upload retention lifecycle**: `upload.retention-days` is now an actual age limit rather than being extended indefinitely by ordinary Public/DM/Group message references. With `pinned.preserve-uploads: true`, attachments referenced by public or Group pinned-message snapshots remain protected. Upload and external-media cache retention cleanup also runs periodically on long-lived servers.
- **Group-pin upload preservation**: Group pinned-message snapshots participate in the same upload/external-cache preservation set as public pins, including after the source Group message is deleted or aged out.
- **Resume-refresh skip policy**: `ui.resume-refresh.skip-unchanged` is exposed to browser config and now actually controls whether focus/resume history refreshes can short-circuit unchanged history.
- **Windows release-build progress/bootstrap**: the 48-target matrix progress counters use Fabric 17 / NeoForge 13 / Forge 17 totals. Gradle/JDK bootstrap downloads show progress and use bounded timeouts so a stalled dependency bootstrap no longer looks indefinitely frozen.
- **Cross-loader product version reporting**: Fabric, NeoForge, and Forge runtime/mod status paths use the shared 5.3.3 product version instead of stale hard-coded 5.3.1 strings. Legacy BMWC conversion also writes the configuration schema migration marker instead of deriving it from the product patch version.

### Compatibility

- Bukkit/Paper/Spigot: Minecraft 1.18–26.3
- Fabric: 17 exact targets, Minecraft 1.18.2–26.3
- NeoForge: 13 exact targets, Minecraft 1.20.2–26.3
- Forge: 17 exact targets, Minecraft 1.18.2–26.3; Minecraft 26.3 is pinned to Forge 66.0.3.
- Deployable release matrix: **48 artifacts**.
- Relay Protocol remains **2.2**.
- Configuration schema/reference remains **5.3.0**. `release-version` is a managed informational marker and does not create a new operator setting or schema generation.