docs: post-v0.2.0 planning + v0.3.0 roadmap

Reports from parallel review agents (code-reviewer, researcher, project-manager)
plus brainstorm synthesis recommending the three-release sequence
(v0.2.0 ships, v0.2.1 patches review P1s, v0.3.0 features).

Plans created:
- plans/260510-0232-tsuki-v0.2.1-patch/  (status: code-complete)
- plans/260510-0144-tsuki-v0.3.0/        (6 phases, ~5d, Phase 1 complete)

Reports:
- code-reviewer-260510-0144: 30 post-v0.2.0 findings (6 P1, 13 P2, 11 P3)
- researcher-260510-0144:    Hugo theme 2026 evolution (WCAG 2.2, llm.txt, Speculation Rules)
- project-manager-260510-0144: v0.2.0 status audit
- brainstorm-260510-0144:    three-release recommendation
- code-reviewer-260510-0244: v0.2.1 patch review (9.7/10, auto-approve)
- tester-260510-0244:        v0.2.1 patch validation (11/11 smoke, CSS 3962/4200)

Cross-linked plan dependencies:
- v0.2.0 prereq → blocks v0.2.1, v0.3.0
- v0.2.1 patch → blocks v0.3.0

Journal: docs/journals/260510-0232-post-v0.2.0-planning-session.md

themes/tsuki/docs/journals/260510-0232-post-v0.2.0-planning-session.md

@@ -0,0 +1,82 @@
+# Post-v0.2.0 Planning Session: Scope, Sequencing, Unresolved Decisions
+
+**Date**: 2026-05-10 02:32  
+**Severity**: Medium  
+**Component**: tsuki v0.2.0 → v0.3.0 roadmap  
+**Status**: Completed, action phase next
+
+## What Happened
+
+Spawned 3 parallel review agents (code-reviewer, researcher, project-manager) against v0.2.0 prerelease state. Aggregated findings, ran brainstorm + plan, scaffolded v0.3.0 as 6-phase delivery (~5d total). Identified the real tension: ship v0.2.0 as-is or fold freshly discovered P1 code findings back into same tag.
+
+Recommendation adopted: three-release sequence (v0.2.0 ships now, v0.2.1 absorbs P1s, v0.3.0 features + hardening).
+
+## The Brutal Truth
+
+This planning session nearly became a disaster of scope creep. The code review team found 30 findings (6 P1, 13 P2, 11 P3) AFTER v0.2.0 was declared complete. The most severe is `render-link.html` using unsafeHTML — self-XSS in a single-author theme. The honest reality: this is embarrassing, but it's self-inflicted (author writes their own posts). Folding every finding discovered into v0.2.0 would've meant goalpost shift, gallery submission delay, and the whole prerelease becoming vaporware. Made the hard call to keep v0.2.0 boundaries crisp and patch forward.
+
+The frustrating part: that XSS check should've caught this during review iteration 1, not iteration N. Single-maintainer review fatigue is real.
+
+## Technical Details
+
+**Code review findings summary:**
+- 6 P1: `safeHTML` abuse (1), image lazy-loading gaps (2), i18n fallback correctness (1), accessibility (2)
+- 13 P2: CSS bundle bloat, TOC narrow-viewport, author UX gaps, i18n path coverage
+- 11 P3: type hints, comment quality, refactor opportunities
+
+**v0.2.0 status confirmed:** All 7 phases shipped. Prerelease checklist scoped down to mechanical (version strings, release notes) + decisions (bundling, defaults) + external (GitHub release, gallery).
+
+**v0.3.0 skeleton (6 phases):**
+- Phase 1: Conditional v0.2.1 patch carry (decide: Goldmark `unsafe: true`, XSS surface)
+- Phase 2: Budget rebase (per-kind CSS bundling ~1.2 KB gz savings) — gates phases 3+5
+- Phase 3: Author UX (details/summary collapse, TOC narrow-viewport, i18n coverage)
+- Phase 4: WCAG 2.2 AA hardening pass
+- Phase 5: AI/discovery layer (llm.txt, Speculation Rules opt-in)
+- Phase 6: Smoke-test depth + Hugo version matrix (0.146 vs 0.154)
+
+**Backwards-compat constraint:** v0.2.0 sites build on v0.3.0 zero-config (new params default off).
+
+## What We Tried
+
+1. Absorb P1s into v0.2.0 — rejected, breaks schedule and review process integrity
+2. Ship bare v0.2.0 with known P1s unpatched — considered, declined (minimal trust impact but not ideal)
+3. Sequencing: bundle budget + feature delivery — P2 rebase must happen first (3 → 5 dependent)
+
+## Root Cause Analysis
+
+Prerelease checklist execution was solid but post-release review unearthed findings the initial pass missed. Why? Single reviewer, compressed timeline, fatigue. The Goldmark `unsafe: true` decision was made early to unblock `render-link.html` use of HTML comments — never revisited during final hardening. This is process debt, not code debt.
+
+The real lesson: peer review is impossible in a one-person team. These findings would've been caught by a second pair of eyes.
+
+## Lessons Learned
+
+- **Scope closure is hard, commit to it.** Post-release review findings should not retroactively scope-creep the release. Document and defer.
+- **Sequencing gates matter.** Bundle size reduction (Phase 2) must land first — downstream feature work (Phase 3 UX, Phase 5 AI layer) needs that headroom. Skip this, ship bloated.
+- **Single maintainer risk is real.** One person shipping, reviewing, deciding, and planning is unsustainable past v0.3.0 without external validation (peer review, demo site analytics, community feedback).
+- **Goldmark `unsafe: true` is a decision debt marker.** Flag it, revisit it, document why (or remove it).
+
+## Next Steps
+
+**Decisions pending (6 open questions in plan.md):**
+1. Keep or drop Goldmark `unsafe: true` (affects Phase 1 patch shape)
+2. Hugo version floor: 0.146 (broad compat) or 0.154 (CI-tested)
+3. Audience signal: solo bloggers vs teams (prioritization for v0.4.0+)
+4. Demo site analytics (currently blind on feature usage)
+5. v0.2.1 patch: independent release or fold into Phase 1
+6. `data/profile.yaml: url` field: document or remove
+
+**Critical path:** Maintainer decisions on Q1, Q2, Q5 unblock Phase 1 scope. Budget rebase (Phase 2) follows. Phases 3–6 parallel track (5 days total).
+
+**Risk:** Single maintainer, 5d estimate is optimistic if decision stall occurs. Unblocking mechanism needed (escalate Q1–Q6 to community or triage publicly).
+
+**Reference reports (do NOT reread):**
+- code-reviewer: 30 findings audit (P1/P2/P3 classification)
+- researcher: 2026 Hugo platform evolution map (WCAG/llm.txt/Speculation Rules)
+- project-manager: v0.2.0 phase + checklist status + gap analysis
+- brainstorm: three-release sequencing rationale
+- plan.md + phase-01..06.md: full implementation scaffold
+
+---
+
+**Status:** DONE  
+**Summary:** v0.3.0 planning complete; shipping three-release sequence (v0.2.0 now, v0.2.1 patches, v0.3.0 features); 6 unresolved maintainer decisions block Phase 1, require triage.