What's New

Created

Fixed

• Browser and Apple-touch icons now use the approved note with its smaller plug inside.

Upgraded

• Installable-app icons include full-size and maskable versions of the selected artwork.

See it for yourself

• Open Music in a fresh tab and inspect its icon, or add it to your home screen.

What we checked

• Local HTTP checks matched the selected PNG exports at the icon, Apple-touch and manifest URLs. This frontend-only change requires no backend deployment.

Created

• Added one machine-readable deployment-truth record that partitions the release catalogue into deployed and production-pending tools.

Fixed

• Stopped the AI guide, full LLM contract, and MCP tool contract from calling all 36 release-source tools live while production still serves 33.
• Removed queue:create from the human AI guide's list of connection scopes; connected AIs cannot hold it and must put their own recommendations in Ideas.
• Changed the parity gates so a source tool cannot become a production claim merely by appearing in the generated catalogue.

Upgraded

• Marked each of the three private-media tools Production pending without weakening their schemas, scope boundaries, or source documentation.

See it for yourself

• Open /ai/guide, /ai.txt, or /mcp-tool-contract.txt and confirm they say 33 tools are deployed while the three private-media tools are marked Production pending.

What we checked

• Outside-in probes confirmed apex and www serve /mcp directly, anonymous POST returns the canonical OAuth challenge, protected-resource metadata names the branded resource, and Clerk advertises DCR, PKCE S256, revocation, and identity-only scopes.
• The MCP and AI-doc verifiers now derive deployment claims from config/mcp-production-truth.json and require its deployed-plus-pending partition to equal the generated source catalogue.

Created

• Added resumable private image and recording uploads with first-party relay, tiny inline, and guarded public-source options.
• Added bounded private-media reads: images use freshly encoded metadata-clean copies, while recordings remain exact private bytes.
• Added an explicit image-publication and takedown lifecycle with rights evidence; recordings have no public path.

Fixed

• Bound every OAuth call and selected-project boundary to the exact verified client, so a wider AI connection cannot lend authority to a narrower one.
• Made retry, cleanup, exact-version checks, and single-use upload capabilities explicit so interrupted multi-file work does not silently duplicate or orphan media.

Upgraded

• Added separate private-media read and write permissions to AI connection settings; signing in does not silently grant either one.
• Kept capture time honest with camera, message, file, person-entered, or missing provenance, and added no GPS or location model.

See it for yourself

• In Settings → AI connections, confirm private-media read and write are separate optional permissions.
• With an approved connection, upload a synthetic image, attach its returned media ID through a normal Music save, and read back only its metadata-clean derivative.

What we checked

• Focused contract tests cover exact-client authority, separate media permissions, replay/conflict, cross-owner targets, single-use relay tokens, tiny-inline limits, URL/redirect/DNS/stream/timeout guards, exact manifests, metadata-clean derivatives, capture provenance, publication refusal, takedown, and abandoned cleanup.
• Production provider, deployment, named-client, and cleanup receipts are recorded only after those rungs complete.

Created

Fixed

• Made the planner's project-details control navigate directly to the selected project instead of relying on an event-only route push.

Upgraded

• Updated the application framework and media-processing dependency to their current security-fixed releases.

See it for yourself

• Open a project in Planner, choose Details, and confirm the matching project page opens and Back to planner returns to the same project.

What we checked

• PR #290 passed TypeScript, lint, 869 unit/contract tests, the 4,235-page production build, and the full 237-case desktop/mobile browser smoke; the merged Vercel production deployment completed successfully.

Created

• Added Settings, which did not exist as a page before — AI connections, what you have shared, and your data.
• Added Settings → Your data: export everything as two files, a readable document and the same records as machine-readable JSON, and close your account permanently.
• Added Settings → What you have shared: every share link that still works, when you shared it, whether it expires, and a Stop button on each row. A link whose record you deleted is listed too, because this is now the only place it can be closed.
• Added a page of your own numbers: how much of each kind of record you have stored, how many tool calls your AI has made, how many connections are active, and when you started.

Fixed

• Deleting your sign-in through the identity provider used to leave every one of your records in Music, permanently and invisibly. Music is now told, and removes them.
• Typed-data migration diagnostics no longer appear on the Stats page. They were engineering checks on a page about your music, and the queries behind them now require an administrator.
• The privacy page said you could delete your account from the account menu, which opened the identity provider and did not remove your records. It now points at the page that does, and describes both routes.

Upgraded

• Export and deletion read one shared list of what belongs to you, so what you can take with you is by construction exactly what deletion removes — and a check refuses to build if that list ever falls behind the database.
• Both run in bounded steps and report real progress, so a large account finishes rather than stopping halfway, and neither is a spinner that tells you nothing.
• This page can now say how far a release has actually travelled, because the pages and the backend deploy separately and pretending otherwise was least accurate exactly when you were most likely to go and try the new thing.

See it for yourself

• Open Settings → Your data and export. Two files should save: one you can read, one another program can read. Open the readable one and check your projects and songs are in it.
• Open Settings → What you have shared. Every link you have out there should be listed, and Stop should make one of them stop working immediately.
• Open your own page from the account menu and confirm the record counts match roughly what you know you have.

What we checked

• Deleting one account leaves another account's records and the shared encyclopedia completely untouched, proved by test rather than by inspection.
• An export covers exactly the tables a deletion empties — the two are checked against each other, so an export cannot quietly cover less than the deletion destroys.
• The account-deletion webhook refuses a request that is unsigned, wrongly signed, tampered with, replayed, or arriving while no signing secret is configured.
• Nothing in this release touches payment, distribution, or anything outside Assist With Music, and deleting Music never touches another Assist With site.

Created

• Added AI connections at /settings/ai: approve a connection, pick a preset or hand-pick permissions, choose whether it reaches all your work or only named projects, set how long it lasts, and revoke one connection or every connection at once.
• Added a plain record of what a connected AI did — including the one moment Music hands an approved outside step to your AI, and what your AI reported back — so the page answers what happened, not only what was blocked.

Fixed

• A connection limited to selected projects now actually works: your AI can orient itself, see that project's Queue, and read and save its plans, while work in every other project stays out of reach.
• Album work is refused with a plain explanation when a connection covers only some projects, because an album gathers songs from all of them.
• Setup pages no longer publish step-by-step instructions for particular AI products. Music has not yet completed a full recorded connection with any named product, so the guidance describes the two kinds of setup instead and names products only as examples.

Upgraded

• Signing in is still not permission: every tool call is checked against the connection you approved, re-read at the moment of the call, so revoking takes effect immediately for both the tool list and the tools themselves.
• Permissions never cover permanent deletion, export, publishing, distribution, payment, accepting terms, or sending messages, and archiving stays the reversible tidy-up path.

See it for yourself

• Open /settings/ai, approve a connection with the narrow Read only preset, and confirm your AI can read but not change anything.
• Limit a connection to one project, then ask your AI to look around: it should see that project and say plainly that the rest is outside what you approved.
• Revoke the connection and confirm the record of what it did stays on the page.

What we checked

• A scripted connection lifecycle covers connect, consent, scoped tools, bounded read, save, follow-up, cross-owner refusal, revoke, reconnect, and cleanup with a re-query proving nothing synthetic is left behind.
• No named AI product is described as supported; that claim waits on a real recorded connection with that product.
• This release changes no music record, no payment, and nothing outside Assist With Music.

Created

Fixed

• Removed document-level horizontal overflow from the detailed AI guide at a 390-pixel phone width while retaining every exact tool name and description.

Upgraded

• Added a focused browser contract that requires all 32 generated entries, a representative preferred tool, and document width equal to the phone viewport.

See it for yourself

• Open the detailed AI guide on a phone and confirm the Live MCP tools Cards wrap within the page without losing their names or descriptions.

What we checked

• Protected desktop/phone checks retain the joined Queue, MCP, Planner, and cleanup journey while adding the 390-pixel detailed-guide assertion.
• This release changes no MCP tool, Queue or Planner record, creative data, auth/provider policy, or external service state.

Created

• Added one deterministic, reviewable catalog generated from the literal names and descriptions in the live 32-tool MCP registry.

Fixed

• Removed duplicate tool-name and description lists from the detailed AI guide, ai.txt, and MCP contract verifier so future registry changes fail closed when guidance has not been regenerated.

Upgraded

• Kept the connection-first AI experience and its workflow and safety guidance intact while proving the same 9 preferred, 19 legacy-compatibility, and 4 album-release tools across source and docs.

See it for yourself

• Open the detailed AI guide or ai.txt and confirm all 32 tools remain described after the existing connection and owner-safety guidance.

What we checked

• Focused extraction tests reject dynamic or duplicate public metadata; protected parity, AI-doc, TypeScript, build, and browser checks cover the generated result.
• This release changes no MCP handler, argument, auth policy, Queue or Planner data, music record, or provider state.

Created

• Added a three-step connection panel for adding the connector, approving owner-scoped access, and starting with Music context or Queue.
• Added an accessible Copy connector URL action with explicit success and failure feedback.

Fixed

• Moved connection setup from nearly two phone screens below the page introduction to the first action on desktop and phone.
• Separated the signed-in workspace query from the public page so the connection and agent briefing remain server-rendered.

Upgraded

• Grouped the deeper Music working agreement below the workspace tour: project direction, provenance, Queue states, Planner saves, loop discovery, and the honest Suno boundary stay readable without blocking setup.

See it for yourself

• Open Your AI on desktop or phone, copy the canonical connector URL, and confirm the three setup steps appear before Loops, Signatures, research, and the detailed working agreement.

What we checked

• Protected desktop and mobile browser checks cover page order, exact clipboard value, accessible copy feedback, and the retained agent briefing.
• Production verification is read-only and does not change Queue, Planner, MCP access, music, or provider state.

Created

• Added one joined source integration journey from signed-in Queue creation and person response through stateless HTTP MCP to a saved, internally playable Planner result.

Fixed

• Replaced the browser acceptance shortcut through lower-level Queue functions with the released owner-scoped MCP context, read, work, and activity handlers.
• Expanded QA cleanup to remove research revisions, agent runs, plan interactions, and activity—not only the visible Queue and Planner rows.

Upgraded

• Layered protected proof now checks stateless MCP context/read/save/work round trips, signed-in Queue responses, owner isolation, Queue versions, Project/Song/exact-take links, Suno provenance, playable audio data, and a real browser Play control.

See it for yourself

• Create a temporary Queue handoff in a test workspace, let a connected AI save its result, answer one Needs you gate, then confirm the Done card opens the correct Project, Song, and exact playable Planner take.

What we checked

• Candidate backend behavior is proved in the source-level stateless transport integration; the serialized non-production browser uses one hard-wired test owner and the released dev handlers, then cleans its temporary world to zero.
• Production verification is read-only and does not select, download, publish, distribute, bill, or change real creative records.

Created

• Added stable owner-scoped Queue numbers and labels such as Queue 42 across Queue, song follow-ups, deep links, and connected-AI responses.

Fixed

• Restored internal Planner playback for valid saved Suno takes whose version ID and trusted Suno song link match but whose earlier import omitted the direct audio URL.
• Kept old MUS-Q references and links working as opaque compatibility identities without leaving them as the long visible label.

Upgraded

• New and legacy Queue items receive one persisted per-owner number that is never recycled after Done, discard, or later cleanup and cannot resolve across owners.
• Connected-AI guidance now teaches people to say Queue 42 and agents to use queueNumber, while still accepting old queueRef values for compatibility.

See it for yourself

• Open Queue and confirm each card shows a short copyable Queue number and its direct link opens the same handoff.
• Open a linked song, create a follow-up in a test workspace, and confirm the new handoff receives the next Queue number while the original remains intact.
• Open Hope of Israel in Hymns Hip-Hop and confirm Promised Day Take 1 and Take 2 have internal Play controls while their separate Suno links remain available.

What we checked

• Focused tests cover owner isolation, sequence migration and non-reuse, numeric read/action round trips, follow-up lineage, strict Suno identity validation, and Suno-only Planner persistence.
• Protected CI, production migration, authenticated MCP readback, and signed-in desktop/phone playback proof are required before this release is marked live.

Created

• Added stable owner-scoped Queue references such as MUS-Q-2X8AASDY, with copy controls, direct Queue links, MCP lookup/action support, collision handling, and a bounded legacy backfill.
• Added Follow-up request on Queue cards and linked song details; it creates a separate Waiting for your AI handoff with the original Queue item, song, project, and instructions preserved as lineage.
• Added bounded genre discovery through the existing songplanner_context tool: top-level genres, families, direct subgenres, and concise ranked search, followed by the exact-name rich recipe reader.

Fixed

• Fixed project details for existing large catalogs so links such as Hymns Hip-Hop load from the indexed project projection instead of constructing the owner's full catalog.
• Fixed generated-result navigation so each take opens that exact version in the owner-scoped Planner/player first, with a separate optional link to the original in Suno.
• Kept song detail project navigation aligned with the song's current Planner project after an organization move.

Upgraded

• Queue list, read, activity, and work responses now echo the stable Queue reference and direct link; owner-scoped lookup makes absent and foreign references indistinguishable.
• Planner URLs now understand an optional take identifier and focus the requested version without autoplaying, selecting, downloading, publishing, or changing music data.
• The AI hub, guide, ai.txt, llms.txt, full contract, and MCP contract now teach the discovery-to-exact-read workflow and Queue reference behavior with explicit caps and empty cases.

See it for yourself

• Open a Done Queue card and confirm its reference can be copied, Project and Song open internally, and each generated take has distinct Planner and Suno choices.
• Open Follow-up request from a Queue card or song, describe the next step, and confirm the new reference appears in Waiting for your AI while the original stays unchanged.
• Ask a connected AI to list genres, navigate a family to direct subgenres, search an unfamiliar term, and hydrate one exact result.

What we checked

• Focused tests cover reference stability, tenant isolation, follow-up lineage, migration idempotency, project-detail bounded reads, take deep links, safe Suno serialization, and encyclopedia discovery/search caps.
• MCP and AI documentation consistency verifiers require the new discovery actions and Queue reference contract while preserving the same 32-tool catalog.

Created

• Added a safe Markdown reader for source text, lyrics, research documents, creative briefs, prompts, and generation notes without executing stored HTML or unsafe links.
• Added accessible copy actions for source text, individual research documents, Copy all research, lyric drafts, prompts, and generation notes.
• Placed the active Generation prompt directly beside the source record, with Suno style and exclusions kept together and independently copyable.

Fixed

• Made Most recent the first and default Planner sort on desktop and phone, while preserving alternate sorts and the indexed bounded phone path.
• Replaced prominent TEXT-PLUS jargon with the clearer Exact public-domain hymn text + original arrangement language.
• Reconciled 23 generated Hope of Israel handoffs from stale Needs you cards to Done while preserving their lyrics, research, plans, and existing Suno outputs; the unfinished Gospel-Trap plan remains honest.

Upgraded

• Queue activity now retains compact relative time, exposes the full local date and time down to seconds on hover or keyboard focus, and shows elapsed time between workflow events.
• Stored source links now open only safe web or internal destinations, while copied research preserves the original source text for provenance.

See it for yourself

• Open Uphill from Summer and confirm the source, Generation prompt, research, and history read naturally and each intended section can be copied.
• Open Planner on desktop and phone and confirm Most recent is selected and newest songs appear first.
• Open Queue activity and confirm exact timestamps and elapsed durations remain readable on keyboard and phone layouts.

What we checked

• Focused tests cover safe Markdown, copy formats, Planner ordering and bounded parity, Queue timing, readable labels, and generated-handoff reconciliation; a separate AI audit's four findings were fixed before release.
• Live MCP and signed-in Queue readback verified the #259 cleanup without selecting a take or altering creative records.

Created

• Added a Music-native Queue screen with exactly Needs you, Working, Waiting for your AI, and Done.
• Added directive-first cards with handoff timing, one exact person action, the current Music step, named project/song/source context, an openable result, and attributable activity.
• Added a compact handoff composer that can keep work with a project, Singles, a new project, or let your AI file it later.

Fixed

• Replaced the Queue navigation's unbounded legacy count with tenant-scoped, indexed, explicitly capped four-state counts.
• Made connection language honest: Music can show that an AI checked the Queue before, but never claims it is connected right now or that work runs by itself.
• Made new person-created handoffs record their first attributable activity receipt and hardened removable QA cleanup against older duplicate fixture rows.

Upgraded

• Promoted Queue coverage into the dedicated authenticated desktop and phone QA world, with one removable fixture in each state and verified cleanup.
• Kept owner actions behind optimistic version checks and unique operation receipts, while AI work remains bounded by Queue scopes, leases, and revocation.

See it for yourself

• Open Queue from the main navigation and move through all four states; confirm each card explains what happened and what comes next.
• Open Activity on a handoff and confirm it identifies You, Your AI, or Assist With Music without exposing an internal account identifier.
• Confirm the connection receipt never promises that your AI is online or working automatically.

What we checked

• Local proof passed 49 test files / 333 tests, the complete CI contract verifier set, and authenticated desktop/mobile Queue traversal against the removable development QA world.
• Production user data was preserved unchanged; the QA fixture and its Queue activity cleaned to zero after browser proof.

Created

• Added owner-scoped projection maintenance and a bounded repair path for older rows whose effective project no longer matched their canonical song record.

Fixed

• Kept planner summaries and targeted project reads aligned immediately after a song moves between projects.
• Repaired the production HYMN-032 projection from hymns-hiphop to hymns-jazz without changing its canonical song or version content.

Upgraded

• Extended import, backfill, and move tests to cover same-key cross-owner isolation, idempotent repairs, and all derived song and version projection rows.
• Verified production parity across 793 songs, 1,973 clips, and 10 bounded planner pages after the repair.

See it for yourself

• Move a song to another project and confirm it disappears from the old project and appears in the new project without a refresh race or duplicate.

What we checked

• PR #160 shipped the projection maintenance and repair tooling; production dry-run, apply, post-run idempotency, and bounded parity proof are recorded on the pull request and SONG-123.

Created

• Build an ordered album from songs that remain in their original projects. The album keeps one selected version per track and rejects unknown, mismatched, duplicate, or cross-owner assignments atomically.
• Use four additive album tools — songplanner_upsert_album, songplanner_set_album_tracks, songplanner_get_album_context, and songplanner_update_release_progress — within the live 31-tool MCP catalog.
• Open a signed-in album page to review its ordered tracks, selected audio, per-track release step, next action, and album-level artwork, metadata, and DistroKid preparation state.

Fixed

• Made the MCP catalog discoverable to signed-in users while keeping every tool call deny-by-default when connected-agent access is disabled.
• Sanitized album and planner domain errors at the gateway boundary so callers receive useful messages without leaking internal function names or stack details.
• Removed a planner URL-synchronization race that could make required browser checks stall or land on the wrong project or album state.

Upgraded

• Synchronized the 31-tool registry, public contract, AI guides, and automated contract verifiers around the four new album tools.
• Promoted signed-in desktop and mobile browser smoke to a required main-branch gate, including the cross-project album release view and horizontal-overflow proof.
• Proved the production backup and restore path across 54 tables and 36,655 rows before the next tenant-safety migration proceeds.

See it for yourself

• Open an album from a project and confirm the ordered tracks, selected audio, next action, and release-state chips agree.
• Connect an AI agent, confirm the live contract contains 31 tools, and use songplanner_get_album_context to inspect the same album state.
• Confirm release work remains preparation-only: there is no tool that publishes music, spends money, or submits a DistroKid release.

What we checked

• PR #135 shipped the album pipeline; PRs #138, #140, and #141 completed deployment-size and MCP-boundary hardening.
• Production browser proof on July 17, 2026 loaded the two-track QA Album Pipeline at 390px and 1280px with matching viewport and page widths; required main run 29604746479 passed desktop and mobile browser smoke.
• Production backup run 29586844579 recorded 31 gateway tool rows and artifact convex-2026-07-17T14-10-27Z restored 54 of 54 tables with matching row counts.

Created

• Connect a compatible AI assistant through the branded https://thesongplanner.com/mcp endpoint. It offers 27 tools for reading context, saving work, organizing projects, and moving requests forward.
• Choose whether connected AI agents may access your private workspace with the per-user “Allow connected AI agents” setting. Turning it off blocks agent access without affecting your normal sign-in.
• Set creative direction for a project, including ideas to avoid and influences to use sparingly, so people and agents share the same musical boundaries.
• Keep standalone songs in Singles, capture and manage Requests comfortably on mobile, and store research documents and private artist notes alongside the work they support.

Fixed

• Hardened the AI connection so callers cannot bypass internal authorization, cross into another user’s workspace, or use an unbranded server identity.
• Made decisions tenant-safe and replaced guessable sharing paths with opaque, revocable links that owners can turn off.
• Bounded large planner and research reads so growing libraries stay responsive instead of loading an unlimited amount of private data at once.

Upgraded

• Requests, planner views, research, artists, and statistics now share one coherent quality-assurance world, making regressions easier to catch before release.
• Protected the main code line with stronger automated checks for security boundaries, public agent documentation, release notes, production builds, and representative browser flows.
• Refreshed the core application, design-system, testing, and Convex dependencies, including the WebSocket security fix in Convex 1.42.1.

See it for yourself

• Confirm the connected-agent setting can deny and restore access for your own account.
• Open Singles and Requests on a phone-sized screen and confirm the primary actions remain easy to reach.
• Create and revoke a share link, then confirm the revoked link no longer opens the shared item.

What we checked

• Release candidate proof is attached to the SONG-208 C+D pull request; production smoke was completed after merge, deployment, and the v0.3.0 tag.

Created

• Added the agent-ready creation workspace V1 so planning work can be organized around durable songs, source notes, prompts, generation attempts, and review state.
• Published the MCP tool contract draft at /mcp-tool-contract.txt for the next tool/OAuth implementation slice.
• Linked the contract from /ai, /ai.txt, /llms.txt, and /llms-full.txt so assistants have one consistent place to learn the expected tool names and safety boundaries.

Fixed

• At release time, clearly separated the planned MCP contract from the not-yet-live endpoint; the endpoint is now live at https://thesongplanner.com/mcp.
• Preserved the signed-out boundary for private planner data while keeping public AI documentation readable.

Upgraded

• The AI documentation now explains the handoff between human creative judgment, external generation tools, and Song Planner as the durable workspace.
• Release proof now covers the AI guide, plain-text agent docs, full LLM contract, and MCP contract draft.

See it for yourself

• Open /ai and confirm the current live MCP connection guide is discoverable.
• Open /mcp-tool-contract.txt and confirm it describes the current live tool contract.
• Open /planner while signed out and confirm the private workspace still routes through the sign-in boundary.

What we checked

• PR #27 merged as f98c5d12655c1350876e0be8047d1dda82153089 and production routes /, /updates, /ai, /ai.txt, /llms.txt, and /llms-full.txt were proven.
• PR #28 merged as 5ee8c223fe8754c0103a5507f4ef2e5f7ee44470 and production /mcp-tool-contract.txt returned HTTP 200 after Vercel completed.

Created

• Created the standard What's New page at /updates so future releases have a visible home.

Fixed

• The Updates destination now opens as a real page instead of a missing-page response.

Upgraded

• Connected the visible release marker to the app's package version source.

See it for yourself

• Open /updates and confirm the baseline wording feels accurate and conservative.

What we checked

• PR #26 route commit 453d553 was committed at 2026-06-19T13:07:40Z.