STOCKFISH.IO — 21 OCTOBER 2026 UPDATE Image recognition + comfortable piece dragging This is a static Namecheap/cPanel package. No host build, npm, account or backend is needed. It has NOT been deployed to the live website. 1. BACK UP FIRST In cPanel enable Settings > Show Hidden Files. Back up the domain's actual document root (normally public_html), including .htaccess, assets and engine, to a location OUTSIDE public_html. Download and verify the backup. Compare any live customisations made since your last supplied package. 2. UPLOAD AND EXTRACT Upload stockfish-io-deploy.zip and extract directly into public_html, allowing replacement of matching files. index.html is at the ZIP root, with no enclosing folder. Merge directories; do NOT delete public_html, assets or engine first. If extraction refuses overwrite, extract outside public_html then copy its contents into the domain root with overwrite enabled. Extraction adds/replaces only paths present in the ZIP. It does not remove unrelated files. Uploading a ZIP without extracting changes no application. Keep .well-known, cgi-bin, nc_assets and unrelated pages/hosting files. Remove the uploaded ZIP from public_html after checking the site. No old application files need deleting for this update. THE EXISTING ENGINE FILES MUST STAY: engine/stockfish-19-lite-single.js engine/stockfish-19-lite-single.wasm engine/stockfishjs-19-source.tar.gz (matching source archive) These paths are absent from the ZIP, so extraction cannot overwrite them. Their notices are retained. The new image recognition model/runtime ARE included. 3. WHAT CHANGES Changed: index.html, about.html, source.html, assets/css/style.css, assets/js/app.js, INSTALL.txt and .htaccess. New JS: piece-drag.js, image-importer.js, image-file.js, image-draft.js, image-geometry.js, recognition-adapter.js, recognition-worker.js. New assets: assets/recognition/fenshot-0.1.5/ (model/core/notices), assets/recognition/ort-1.26.0/ (runtime/WASM/notices), PROVENANCE.txt and ASSET-SHA256.txt. Upload the entire assets/recognition directory. Game state, rules, engine integration module, pieces, board geometry, robots, sitemap and engine notices are unchanged. Existing files included unchanged may still be overwritten by identical copies during extraction. 4. SECURITY AND MIME Only two MIME additions in .htaccess: AddType text/javascript .js .mjs AddType application/octet-stream .onnx The existing application/wasm MIME, HTTPS redirect, secret-file protections, security headers and targeted Google AdSense CSP are preserved. No unsafe-inline, new remote origin, broad unsafe-eval, COOP or COEP is added. The importer uses an external same-origin module worker; no blob-worker permission is required. .htaccess SHA-256: 084b86a9314ce9a160563938457364f900675efaec2beb9fdc41c0d935fbd3c5 Ensure .mjs returns JavaScript and .wasm application/wasm with nosniff. .onnx must return binary model data, not an HTML fallback. Files normally use 0644 and folders 0755; do not use 0777. Check cPanel Errors if a 500 appears. Preserve any later host-managed rules when merging your live .htaccess. Exact recognition asset hashes and sizes: assets/recognition/ASSET-SHA256.txt Use a local SHA-256 utility or cPanel terminal sha256sum to compare downloads. 5. CACHE AND VERIFICATION HTML and internal CSS/JS references now use ?v=20261021. Recognition dependency folders are versioned. Engine filenames/URLs are unchanged. There is no service worker. Hard refresh with Command+Shift+R (Mac) or Ctrl+Shift+R (Windows). Verify page source includes v=20261021 and id="imageOpen". Open FEN / PGN > Import image; new recognition assets load only when this feature is used. Replacing files normally becomes available immediately; no DNS wait is needed. If the previous site remains, check the domain's document root in cPanel Domains, verify index.html and all asset files were replaced, try a private window, and purge only hosting/CDN caches you actually use. Check for an index.php or custom DirectoryIndex taking precedence; inspect and back it up before removing anything. Try https://stockfish.io/?release=20261021 to bypass a cached HTML URL. After upload check: - Real Stockfish score/depth and gold arrow. Drag e2 to e4; Flip; Previous/Next. - Illegal/outside drops return the piece. Promotion still offers four choices. - FEN/PGN imports, exports, keyboard history and unlocked editor still work. - Import a clear complete 2D screenshot. Confirm the crop, recognise, review all 64 squares, explicitly choose whose turn it is and check historical settings. - Load position and analyse; an existing line asks for replacement confirmation. - Cancel an import midway: the previous game/editor/cursor must remain intact. - Test a second image and a mobile screen. Model download failures offer Retry. - About/Licences and model notices/checksums open correctly. 6. RECOGNITION LIMITS Screenshots and conventional 2D diagrams are the acceptance target. Multiple board detection is heuristic (up to five candidates); select the intended board or crop it manually. Keep borders/labels out of the crop. Rotate sideways images before recognition. Four-corner correction for flat perspectives is experimental. Real 3D chess pieces are NOT supported by this screenshot model. Always check the position. Confidence flags do not establish correctness; a pawnless endgame in our test had a wrong orientation despite high model scores. Choose side to move explicitly. No castling/en-passant rights are inferred from piece locations; default none, halfmove 0/fullmove 1 are labelled assumptions. One image cannot reconstruct earlier moves, repetition or draw history. 12 MiB file limit; 24 million decoded pixels; 12,000 pixels maximum per dimension; working image limited to 1,600 pixels on its longest side. PNG/JPEG/WebP only. The model/runtime download is about 14.4 MB uncompressed on first use, then normal browser caching applies. No user-image upload or external recognition service. Existing advertising still makes separate requests. Close releases image/worker resources. Games and drafts are not persistent; export PGN before reloading. 7. ADSENSE (PRESERVED) The original async loader and publisher ca-pub-6469944033866162 appear once in the head of index.html, about.html and source.html. There are no new ad slots. Keep the previously documented Auto ads exact-page exclusions for / and /index.html (and aliases of the analysis app) so ads do not cover chess controls. The ZIP cannot change account settings or verify ad approval/consent/serving. Do not hide served ads with CSS or weaken CSP to make ads appear. Existing Google-domain permissions are unchanged. Instructions: https://support.google.com/adsense/answer/9262311?hl=en https://support.google.com/adsense/answer/16283098?hl=en 8. ENGINE INSTALLATION — ONLY IF ALREADY MISSING Keep your working engine pair. The tested build is Stockfish.js v19.0.0 lite-single: https://github.com/nmrugg/stockfish.js/releases/tag/v19.0.0 Install stockfish-19-lite-single.js (21,415 bytes) and the matching .wasm (1,787,571 bytes) under public_html/engine/. Tested SHA-256 values: stockfish-19-lite-single.js: d3344124ab067fb0b90ee77873bb8e9fbf5fc01bc525fe714b0f942581e889e6 stockfish-19-lite-single.wasm: 57ac2d72312aba346760e3f173f687a8c211208e97a87268436f7f0e10bb5387 No separate network file or multithreaded isolation headers are needed. Corresponding source: https://github.com/nmrugg/stockfish.js/archive/refs/tags/v19.0.0.tar.gz Save unextracted as engine/stockfishjs-19-source.tar.gz. Keep COPYING.txt/SOURCE.txt. Both engine URLs must serve real files with correct MIME, not HTML error pages. Ordinary board play works if the engine is unavailable. Use HTTP(S), not file://. Root-relative paths assume installation at the root of the domain. 9. ROLLBACK Restore your backed-up index/about/source HTML, CSS, app.js and .htaccess together. The new image modules/assets can remain unused or be removed after rollback; old HTML/app code does not reference them. Keep all installed engine files and unrelated host files. Hard refresh/purge relevant caches and recheck the old site. A local pre-change copy is also retained in work/pre-oct21 in the development workspace. Use your live-site backup when rolling back a live installation.