Add support for message history pagination, preserve scroll in rendering, and improve draft/message workflows.

README.md

@@ -4,6 +4,16 @@ Elsewhere is an Express + SQLite app for account-based chat, persona management,
 
 A space for every conversation. Six appearance styles (Grove, Parchment, Aurora, Current, Iris, and Graphite) each support light and dark modes. The Elsewhere identity stays consistent across styles. Internal theme and storage keys remain stable to preserve saved preferences.
 
+## Conversation workspace
+
+Conversation drafts are saved in this browser per account and conversation, including references to completed image uploads. Uploads still in progress cannot be recovered after a reload. If a recovered image has expired or is unavailable, remove it and attach it again. Drafts stay local to the browser and are cleared after a successful send and history refresh.
+
+Chat settings include **Branches & compare** for browsing the conversation tree, opening related chats, and comparing response versions side by side. **Conversation memory** provides editable facts, a running summary, and an approximate context-token count. Summary edits detect conflicting updates; subsequent automatic summaries build on saved corrections.
+
+History opens with the latest 50 messages. **Load older messages** fetches earlier pages without losing the reading position. `GET /chats/:id/messages` accepts `limit` (1–100), `before`, and `leaf` cursors; reuse the response's `pagination.before` and `pagination.leafId`. A changed branch returns 409. `around` opens a page ending at a search match, with **Back to latest messages** available in the UI.
+
+`GET /health` is public and returns `{ok: true}` (200) for a healthy model backend or `{ok: false}` (503) when it is unavailable. Detailed diagnostics remain protected. Registration and password changes reject new passwords over 72 UTF-8 bytes, matching [bcrypt's documented limit](https://github.com/kelektiv/node.bcrypt.js#security-issues-and-concerns). Existing passwords remain usable for login and current-password checks.
+
 ## Setup
 
 Node.js 22.13 or newer is required.
@@ -340,7 +350,7 @@ Search emits `{status: "searching"}` only when retrieval actually runs, then `{s
 
 Sources appear below assistant messages as numbered links. They persist in a nullable SQLite `chat_messages.sources` JSON column, added automatically on startup using the existing additive schema mechanism; no manual migration is needed. Old messages remain valid. Sources are preserved in JSON exports/imports and branches. Regenerating an answer reuses its stored results without performing another search; a fresh search requires sending another message with the toggle enabled.
 
-Run `node --test --test-isolation=none` and `npm run lint` to check the feature and existing flows. `test/webSearch.test.js` uses local HTTP protocol fixtures and an isolated in-memory database; no production search results are mocked. Live SearXNG/Ollama verification still requires configured, reachable services. There is no TypeScript or build command in this framework-free project.
+Run `npm test` and `npm run lint` to check the feature and existing flows. `test/webSearch.test.js` uses local HTTP protocol fixtures and an isolated in-memory database; no production search results are mocked. Live SearXNG/Ollama verification still requires configured, reachable services. There is no TypeScript or build command in this framework-free project.
 
 ## Legal
 
@@ -362,4 +372,6 @@ Protected pages redirect to sign-in with a local return destination. Public disc
 
 All page routes render the same navigation from `src/pageLayout.js` into the `<!-- site-header -->` placeholder. `public/css/shell.css` owns the shared header, page spacing, and mobile navigation; `public/js/workspaceNavigation.js` owns sign-out. Page-specific headers contain only local titles and actions. The chat sidebar is reserved for conversation history. Public and home content share `public/css/pages.css` and `public/js/pages.js`. Page routes run before static assets and authenticated API routers; rendered pages use private, non-cacheable responses.
 
-For environments that block child-process test workers, run `node --test --test-isolation=none`.
+Run the full suite with `npm test` and `npm run lint`. The browser navigation harness is tracked in `browser-tests/`; `npm run test:browser` prints its local URL. It shares its cases with `test/conversation.test.js`.
+
+For environments that block child-process test workers, run one test file at a time with `node --test --test-isolation=none test/<name>.test.js`; combining all files without isolation can leak their browser globals and mocks between suites.