diff --git a/docs/audit-2026-08-19.md b/docs/audit-2026-08-19.md
new file mode 100644
index 00000000..cdbce42b
--- /dev/null
+++ b/docs/audit-2026-08-19.md
@@ -0,0 +1,441 @@
+# OwnCord — Repo Health Audit
+
+**Date:** 2026-08-19
+**Branch:** `claude/repo-health-audit-s0xnyo` (audited tree: `eacba10` = `main`)
+**Scope:** full-repo health check — prior-finding closure verification, dynamic
+checks (build/test/boot), doc/code drift across the three reference specs, and
+a static sweep focused on the WebSocket hub, reconnect/sync handling, and the
+REST/WS boundary. Read-only; no code changes ship with this audit.
+**Relationship to prior audits:** successor to the 2026-08-04 pair
+([security](audit-2026-08-04.md), [docs & coverage](audit-2026-08-04-docs-and-coverage.md)),
+which remain the closure trackers for their own findings. Every item those
+audits left open is re-verified in §2.
+**Method:** ten parallel analysis passes (3 prior-finding verification, 3
+doc-drift, 4 static-sweep), every BROKEN/FRAGILE candidate then re-traced by an
+independent adversarial verifier instructed to refute it (7 confirmed, 1
+downgraded, 0 refuted). Every dynamic-check number in §3 comes from an actual
+run in this session. Rank legend: **BROKEN** = fails or states falsehoods now
+· **FRAGILE** = works today, likely to break · **DEBT** = cleanup, no user
+impact.
+
+---
+
+## 1. Executive summary
+
+The code is in the best shape any of the six audits has found it: every suite
+passes, the server boots clean, the bug-hunt ledger is fully closed (188
+fixed / 2 declined / 1 duplicate / **0 open**), and the heavily-audited
+subsystems — hub locking, replay tiers, permission funnels, plugin sandbox —
+all verified sound again (§7).
+
+What has decayed is the **documentation**, again. Fifteen days after the
+2026-08-04 spec refresh, the three reference docs carry ten newly wrong
+statements (§4): `schema.md` misses two migrations and documents the exact FK
+behavior migration 030 was written to remove; `protocol.md` claims DM chat
+events are unsequenced when they are stamped, ring-buffered and replayable,
+and documents five rate limits as "None" that are all enforced;
+`api.md` tells non-admins they can call an admin-only endpoint and documents
+three error codes the server never emits. The keep-docs-current-per-PR rule
+(A-2026-07-03) is not holding on its own.
+
+On the code side the sweep found **five FRAGILE items and no BROKEN ones** —
+two silent-failure gaps in auth persistence, a role-change/handshake race that
+can leave a socket on stale subscriptions, dead-on-arrival client replay-dedup
+machinery, and one block-enforcement asymmetry (blocking a user does not evict
+them from a live 1:1 DM voice call) that continues the exact defect family the
+2026-08-04 security review closed. One client unit test is a load-sensitive
+timeout flake. Everything else is debt.
+
+---
+
+## 2. Prior-finding closure verification
+
+Every item left open by a prior audit, re-verified against `eacba10`.
+
+### 2.1 Carried findings
+
+| Item | Sev | Verdict 2026-08-19 | Evidence |
+|---|---|---|---|
+| A-2026-07-10 router god-constructor | MED | **PARTIALLY FIXED** | `NewRouter` is down to 171 lines (`Server/api/router.go:39-209`) with 7 extracted helpers (`routerTOTPKey` :213 … `routerMetricsRoutes` :412), but remains the composition root: builds limiter/services/hub, spawns `go hub.Run()` (:161), and the returned cleanup (:204-206) still covers only `limiterStopCh` |
+| A-2026-07-11 Hub `Set*` post-construction wiring | MED | **STILL OPEN, hazard mitigated** | 6 setters remain (`ws/hub_events.go:40,48,60,70`, `ws/hub_livekit.go:10,48`); three are now atomic stores safe post-`Run`, the other three are guarded by `rejectIfRunning` (`ws/hub.go:721-728`) — a missed setter is no longer a race, but the temporal coupling stands |
+| A-2026-07-14 scattered client constants | LOW | **STILL OPEN, grew** | `#5865F2` ×19 across 12 files (was 18/11); `localhost:8443` ×3; `setTimeout/setInterval` at 114 call-site lines across 43 non-test files (was 64); `src/lib/constants.ts` still holds only 2 constants |
+| 2026-04-07 #9 auth handler bypasses service layer | MED | **STILL OPEN** | `Server/api/router.go:117` passes `database *db.DB` to `MountAuthRoutes` while siblings get `svc`; handlers call `database.*` directly (`auth_handler.go:166,201,209,483,572,584,673,757`) |
+| 2026-04-07 #5 plugin HTTP exfiltration | accepted | **ACCEPTED RISK INTACT** | All four mitigations re-verified: defaults off + empty allowlist (`config/config.go:351-357`), empty allowlist denies all (`plugin/host_http.go:140-158`), WASI-only runtime with no host imports (`plugin/sandbox_wazero.go:100-113`), inert `EventSink.Dispatch` + no production `Subscribe` (`plugin/host_events.go:122-131`) |
+| A-2026-07-06 residual: direct DB above service layer | MED | **IMPROVED ~50%** | ~170 direct call sites in non-test `api`/`admin`/`ws` (was ~359), 30 files; top offenders `ws/voice_join.go` (14), `admin/handlers_channel_perms.go` (13), `ws/hub_broadcast.go` (11) |
+| `channelCanSend` copy (permission-middleware plan disclosure) | MED | **STILL OPEN** | `Server/ws/serve_ready.go:142-160` still hand-mirrors `MessageService.checkSendPermission` (`service/message_perms.go:78-102`); guarded by the mirror test `ws/can_send_test.go` but synced by hand |
+| audit-2026-08-04 §5: backup restore hardcodes DB path; 500-path serves a closed DB | obs | **FIXED** | `admin.SetDatabasePath` wired from `main.go:337` (pinned by `handlers_backup_test.go:553-577`); every restore failure branch now rolls back the safety copy and/or restarts (`handlers_backup.go:276-329`) — no branch leaves a closed DB serving |
+| T-2026-07-25-11 residual: `HandleLiveKitHealthForTest` duplicate | LOW | **STILL OPEN (test-only)** | All 7 legacy callers unmigrated (`api/middleware_test.go:1026,1049,1075`, `api/coverage_push_test.go:327,350,373,642`); production handler is single-sourced |
+| T-2026-07-25 §4: `logctx.WithGroup` nesting decision | LOW | **STILL OPEN by design** | Behavior unchanged (`logctx.go:52-54`), pinned by test; no production code opens a logger-level group; doc comment defers explicitly (note: stray word "ponytail" at `logctx.go:49`) |
+| T-2026-07-25 backlog #8: gofmt drift in `storage/storage.go` | LOW | **FIXED — but recurred elsewhere** | `gofmt -l Server/` is clean except one **new** drifted file, `admin/handlers_users_broadcast_test.go` (§6); no gofmt gate exists in CI or `.golangci.yml`, which is why it drifted in |
+| T-2026-07-25-17/-18/-19 (`main.go`/seed untested; `MainPage.ts`/`main.ts` excluded; no Go/Rust coverage floor) | LOW | **UNCHANGED, documented** | vitest excludes still carry written justifications (+1 justified entry: `noise-suppression.ts`); the rest are recorded accepted positions |
+| T-2026-07-25-20 `ws` flake under `-coverpkg` | LOW | **CAN'T VERIFY** | Not reproduced this session (plain `go test` used); stays on watch |
+| DC-14 reserved protocol entries (`voice_speakers`, `member_leave`) | P3 | **STILL OPEN, deliberate** | Constants + schema entries exist, zero non-test emit sites; consistently documented "Reserved" in `protocol.md:1506,1508`; a protocol rev for the owner to schedule |
+| `admin-e2e` soak graduation | P2 | **STILL PENDING** | `ci.yml:311` `continue-on-error: true`, graduation criterion recorded 2026-08-15 (~30 consecutive green main runs, `ci.yml:302-307`) |
+| 2026-07-19 §5: `tauri-build` never runs on push to `main` | LOW | **STILL TRUE** | `ci.yml:440-443` gates on `pull_request` + `base_ref == main`; only other desktop build is the `v*`-tag release workflow |
+| `livekitSession.ts` monolith | MED | **STILL OPEN, grew** | 1809 LOC (was 1719); satellites `roomEventHandlers.ts`/`livekitDiagnostics.ts` were added without shrinking the core. `AccountTab.ts` 1185, `SidebarArea.ts` 848, `LoginForm.ts` 784 |
+| TODO inventory | — | **3 remain** | `ws/voice_e2ee.go:167` (key-holder TOCTOU, documented accepted), `ws/deps.go:271` (generics), `SidebarArea.ts:659` (H16 DOM thrash). The `update_handlers.go` container TODO is **resolved** (503 `CONTAINER_DEPLOYMENT` via `updater.RunningInContainer`, `update_handlers.go:49-53`) |
+
+### 2.2 CI gates and pins (all verified holding)
+
+`.nvmrc` = 20 matches all six `setup-node` pins; knip, `client-e2e`,
+`client-e2e-parity` genuinely blocking (no `continue-on-error`, no `|| true`);
+`-tags wazero ./plugin/...` and `-tags otel ./telemetry/...` run in CI
+(`ci.yml:87-89`); `rust-tests` runs on every event;
+`tests/e2e/E2E-ISSUES.md` matches the live Playwright configs (293 tests vs
+the doc's dated 291 — normal growth, counts are labeled as a run snapshot).
+
+### 2.3 Plan statuses (docs/plans/)
+
+| Plan | Verdict | Notes |
+|---|---|---|
+| security-hardening-remediation | **complete, verified** | W2-4/W3-3 closed with the named locking tests present |
+| channel-visibility-unification, http-tofu-proxy, permission-middleware-consolidation, v2-dispatch-migration, audit-2026-07-19-decisions | **shipped, nothing reopened** | only cosmetic line-number drift in citations |
+| security-scan-2026-07-22-remediation | **shipped; header stale in the good direction** | F3 follow-up 3 (`getIdentityPin` fail-open) is marked open but was fixed (`identity.ts:158-175`, tri-state lookup citing DC-08) |
+| sqlc-adoption | **accurate** | residual raw queries (variable `IN`, FTS, tx) still deliberately raw as listed |
+| tauri-capability-narrowing | **DNS-rebinding follow-up still open** | `embeds.ts:8` still fetches user-posted URLs from the renderer via `@tauri-apps/plugin-http`; `capabilities/default.json` still grants `https://*` (:33,:36); no Rust og-meta command exists |
+| infrastructure-roadmap | **shipped except 2 named leftovers** | TOTP/partial-auth persister seam (no persist code in `auth/totp.go`) and published capacity numbers (the load-baseline workflow exists to produce them) |
+| discord-parity | **phases 1-6 shipped; named leftovers open** | role hoist/mentionable + `@RoleName` mentions, categories as real entities; its still-dead-code list is one item stale (sounds table was dropped by migration 029) |
+| bug-detection-improvements | **header stale — partially implemented** | header says "not implemented" but Tier 1a (`make fuzz`, `Server/Makefile:43-48`) and Tier 2 (5 ESLint rules, delivered 2026-08-08 per its own body) exist; Tiers 3-4 open |
+| slash-commands | **design-only, as stated** | no `plugin_commands` migration, no autocomplete surface |
+
+---
+
+## 3. Dynamic checks (this session, at `eacba10`)
+
+Environment: Linux container, 4 CPU / 15 GB; go 1.24.7 host +
+`GOTOOLCHAIN=auto`; Node 22.22.2 (CI pins 20), npm 10.9.7.
+
+| Check | Command | Result |
+|---|---|---|
+| Go vet | `cd Server && go vet ./...` | **PASS** |
+| Go tests | `go test -count=1 ./...` | **PASS** — 15 test packages ok (`ws` 54s, `db` 14.5s) |
+| Client typecheck | `npm run typecheck` | **PASS** |
+| Client lint | `npm run lint` | **PASS** — exit 0 with 25 non-blocking `no-underscore-dangle` warnings, all in `livekitSession.ts:1656-1759` (delegating-method section) |
+| Client unit suite | `npm test` | **5044/5045** — one timeout failure, shown to be a load flake (§5, F-5); passes 3/3 in isolation |
+| Server build | `go build .` | **PASS** |
+| Server boot | run binary in empty dir | **CLEAN** — first-run config + certs generated, expected WARNs only; `/health` 200 `{"status":"ok","uptime":1,"online_users":0}`; `/admin` 200 serving the SPA (145,663 bytes); LiveKit auto-download + managed start; clean shutdown on SIGTERM |
+| Client build | `npm run build` | **PASS** (chunk-size warnings only) |
+| Protocol codegen gate | `go run ./scripts/genprotocol` diffed against committed output | **CLEAN** — byte-identical Go + TS |
+| sqlc gate | `make sqlc-verify` | **SKIPPED** — sqlc binary absent in this container; CI covers it |
+| knip | `npx knip` | **exit 0** — zero unused files/exports/deps (4 cosmetic config hints) |
+| Go module hygiene | `go mod tidy -diff` | **CLEAN** — empty diff |
+
+---
+
+## 4. New findings — BROKEN (all documentation)
+
+No code-level BROKEN findings. All ten are reference-doc statements that are
+false against the running code; a reader following them writes wrong clients
+or wrong ops procedures. All were independently re-verified.
+
+### schema.md
+
+| ID | Finding | Evidence | Fix |
+|---|---|---|---|
+| B-01 | Migration table ends at 029; `attachments.message_id` documented as `ON DELETE CASCADE`, the exact behavior migration 030 removed (`ON DELETE SET NULL`, to stop stranding uploaded files); 031 undocumented | `schema.md:44-74`, `:420` vs `migrations/030_attachments_unlink_on_message_delete.sql:25` (+ header lines 1-16), `031_sessions_expiry_index.sql` | Add 030/031 rows; flip :420 to `SET NULL` with the unlink semantics |
+| B-02 | Indexes table lists 3 dropped indexes (`idx_sessions_token`, `idx_invites_code`, `idx_channel_overrides_channel_role`) and omits 7 live ones (`idx_channel_overrides_role`, `idx_attachments_message`, `idx_messages_pinned`, `idx_api_tokens_user`, `idx_users_avatar`, `idx_channels_dm_group`, `idx_sessions_expires_at`) | `schema.md:719,723,728` vs `migrations/019_perf_indexes.sql`, `020_drop_redundant_indexes.sql:6-7`, `018:27`, `027:28`, `028:29`, `031:13`; the doc's own migration rows (:64-65) contradict its index table | Rewrite the table from cumulative migration state |
+| B-03 | "The connection pool is pinned to a single connection" — false for file-backed (production) DBs, which run a 1-writer + up-to-64-reader pool split | `schema.md:27` vs `db/db.go:223` (`writer.SetMaxOpenConns(1)`), `:239-244` (reader pool `max(4, NumCPU)`, `database.max_readers`) | Describe the writer/reader split and the knob |
+
+### protocol.md
+
+| ID | Finding | Evidence | Fix |
+|---|---|---|---|
+| B-04 | DM `chat_message`/`chat_edited`/`chat_deleted`/`reaction_update` documented as unsequenced and excluded from the ring buffer; they are seq-stamped, ring-buffered AND persisted (tier-1 replayable) | `protocol.md:98,263-264,1489-1494` vs `ws/emit.go:23-26` → `hub_broadcast.go:923-935` (`nextSeq` + `replayBuf.Push` + `persistEvent`); emit sites `handlers_chat.go:102,123,146`, `handlers_reaction.go:47` | Fix the seq tables + reconnection section |
+| B-05 | `plugin_broadcast` documented "Has seq? No"; it rides the sequenced, replayable channel-broadcast path | `protocol.md:1524` vs `ws/event.go:347-357`, `hub_broadcast.go:939-964` | Flip the row to Yes |
+| B-06 | `RATE_LIMITED` WS errors claimed to "include retry_after in seconds"; no WS error payload ever carries it (only REST 429 headers do) | `protocol.md:1399` vs `ws/messages.go:332-358`, `ws/event.go:7-12`; repo-wide grep negative | Delete the clause (or implement the field) |
+| B-07 | Five c2s types documented rate limit "None" are all limited: `channel_focus` 5/s, `mark_read` 5/s, `call_decline` 1/3s, `chat_command` 5/s, `ping` 2/s | `protocol.md:1461,1462,1478,1479,1480,1535` vs `ws/handlers_presence.go:19-22,107,135`, `handlers_call.go:15-18,75-77`, `handlers_command.go:29-36,49-51` (comment cites OC-0091 — limiter added, doc never updated), `handlers_ping.go:14-16` | Document all five incl. silent-drop vs `RATE_LIMITED` behavior |
+| B-08 | E2EE prose says "Both E2EE message types are rate limited at 5 per second", contradicting the doc's own table (offers 64/s) and the code; the inner 5/s-per-target offer cap is undocumented | `protocol.md:1112` vs `:1433,1437-1439`; `ws/voice_e2ee.go:16-24,213-223` | Fix the prose; document the per-target inner cap |
+
+### api.md
+
+| ID | Finding | Evidence | Fix |
+|---|---|---|---|
+| B-09 | `GET /api/v1/diagnostics/connectivity` documented "any authenticated user"; code requires ADMINISTRATOR (H-8) — a non-admin following the doc gets 403. Also: limiter is per-IP not "per user"; `livekit_url` is sanitized to host:port, not the documented full URL | `api.md:2472,2473,2485` vs `api/router.go:153-158`, `middleware.go:228-229`, `diagnostics_handler.go:54-58` | Fix auth line, limiter scope, example |
+| B-10 | Error-code table documents `SERVER_ERROR` / `INTERNAL` / `TOO_LARGE` — none ever emitted by REST (real 500 code is `INTERNAL_ERROR`, ×60+ sites; oversize upload is 400 `BAD_REQUEST`); `STORAGE_ERROR` 507 missing entirely. A client switching on documented codes never matches | `api.md:57-58,119,181,229,310` vs greps (zero `SERVER_ERROR`/`TOO_LARGE` emissions), `upload_handler.go:115-146`, `storage/storage.go:172`, `ws/errors.go:6` | Replace with `INTERNAL_ERROR`, correct the 413 row, add `STORAGE_ERROR` |
+
+---
+
+## 5. New findings — FRAGILE
+
+**F-1 — Blocking a user does not evict them from a live 1:1 DM voice call.**
+`BlockUser` commits with zero side effects (`service/block.go:24-54`;
+`api/dm_handler.go:83-88` takes no evictor). The only block re-checks for a
+user already in voice are client-volunteered (`ws/voice_join.go:136-141` join
+gate; `:579-590` token refresh). The minute-sweep — whose own invariant
+comment says "Revocation must evict a live session, not merely block the next
+join" (`ws/hub_sweep.go:167`) — re-checks only role CONNECT_VOICE
+(`hub_sweep.go:185,328-354`), which has no DM/block branch; LiveKit validates
+tokens at join only, so a client that stops calling `voice_token_refresh`
+keeps its SFU session indefinitely. Contrast: `CloseDM` evicts via
+`dmVoiceEvictor` (`api/dm_handler.go:236-242`). This is the same
+guard-asymmetry family as A-2026-08-03 (block check on rings), one sink over.
+*Adversarially verified: CONFIRMED.*
+**Fix:** have `handleBlockUser` evict via the existing `dmVoiceEvictor` for
+the pair's shared 1:1 DM channel (mirroring `handleCloseDM`), or add a
+DM-block re-check to the sweep.
+
+**F-2 — Role reassignment racing a WS handshake leaves the socket on
+old-role subscriptions.** The handshake resolves permissions from the
+auth-time `c.user` snapshot (`ws/serve.go:124-132`; `computeAllowedChannels`
+via `GetRoleByID(user.RoleID)` at `:670`, used by both `:306` and `:736`), and
+nothing revalidates handshake-time subscriptions (the OC-0024 recheck covers
+only `applySetChannelID`; the sweep re-checks CONNECT_VOICE only). The
+demotion's live revocation, `revokeUnreadableChannels`
+(`hub_broadcast.go:797-879`), early-returns if the user is not yet in
+`h.clients` (:818-822) and its `Unsubscribe` no-ops on a replaced client via
+the pubsub identity guard (`pubsub.go:133-134`) — so a role change landing in
+the handshake window is never applied to that socket, which then receives
+events for channels the new role cannot see until the next reconnect.
+`RefreshChannelVisibility` handles both hazards explicitly (`hub_broadcast.go:443-444`);
+the role path predates that pattern. *Adversarially verified: CONFIRMED.*
+**Fix:** re-read the user row inside `reconnectPrecheck`/`handleFreshConnect`,
+and make `revokeUnreadableChannels` re-resolve the live client before
+`sendMsg`/`Unsubscribe`, mirroring `RefreshChannelVisibility`.
+
+**F-3 — Auth lockout persistence failures are silent.** All three lockout
+writes discard errors with no log: `_ = r.store.UpsertLockout(...)`
+(`auth/ratelimit.go:172`), `_ = ...DeleteLockout` (:234),
+`_ = ...CleanupExpiredLockouts` (:283) — while the load path got exactly this
+fix as ledger finding OC-0061 (the file's only `slog` call, :88). The doc
+comment at :162-164 says "The persist write must land once the lockout is
+decided", yet a failed write leaves zero trace and the lockout evaporates on
+restart. *Adversarially verified: CONFIRMED (not an OC-0061 duplicate — this
+is the symmetric write-path gap).*
+**Fix:** mirror OC-0061 — `slog.Warn` on all three error paths.
+
+**F-4 — Session-cap eviction failure is invisible (observability gap;
+downgraded from a stronger claim).** `CreateSession` discards the H-6
+eviction error (`db/auth_queries.go:244` `_ = d.q.EvictOldestSessions(...)`)
+with no log anywhere in the chain. The verifier established the cap is not
+durably disabled — the DELETE trims to the newest 24 so the next successful
+login self-heals, and a persistent DB failure also fails the subsequent
+`InsertSession` — so the residue is: a transient failure lets one session
+exceed the cap, and no failure of a security control is ever logged.
+*Adversarially verified: DOWNGRADED to this statement.*
+**Fix:** `slog.Warn` on eviction error only.
+
+**F-5 — One client unit test is a load-sensitive timeout flake.**
+`tests/unit/message-list.test.ts` › "does not report success when
+renderWindow's own >30-in-2s breaker drops the rebuild" performs 30
+synchronous full `renderWindow` rebuilds of a 100-row jsdom list inside the
+default 5s vitest timeout. In this session's full run (concurrent with `go
+test` on a 4-CPU box) it timed out — 5044/5045 — then passed 3/3 in isolation
+(~4.2s per whole-file run). Same class as the open T-2026-07-25-20 watch item.
+**Fix:** give that test an explicit larger timeout (or shrink the fixture) so
+CI-under-load cannot produce a spurious red.
+
+**F-6 — Client replay-dedup machinery can never engage (dead safety net +
+misleading tests).** The server always writes `auth_ok` *before* the replay
+burst (`ws/serve.go:531,537-544`), but the client creates `replayDedup` in the
+socket-`open` handler and clears it when `auth_ok` is processed
+(`ws.ts:463-465`, `:358`) — so the dedup set and `isReplaying()` (`ws.ts:788`)
+are inactive for every real replayed frame; the dispatcher's gates at
+`dispatcher.ts:580,592` never fire, and its own comment at `:612-618` admits
+the timing. The pinning tests inject replay frames in an order a
+spec-compliant server never produces (`ws-reconnect.test.ts:409-497`).
+Meanwhile the server *can* legitimately duplicate a voice frame on resume (the
+voice supplement is re-read outside `seqMu`, `serve.go:263-271,553-556`), which
+is what the machinery was presumably for. Today's no-op behavior is actually
+correct for unread counts, making this inert-but-misleading rather than
+harmful. *Adversarially verified: CONFIRMED.*
+**Fix:** either delete the inert machinery (and fix comments + tests) or move
+the clear to end-of-burst — decide, don't leave it half-true.
+
+---
+
+## 6. New findings — DEBT
+
+Grouped; every item carries its evidence at the cited lines.
+
+**Docs/comments**
+- D-01 `protocol.md` error-code table missing `BAD_PAYLOAD` and
+  `NOT_KEY_HOLDER` (emitted at `ws/voice_e2ee.go:119-199`).
+- D-02 `protocol.md` ready/member_join field lists incomplete: `voice_states`
+  omits `username`/`speaking`/`camera`/`screenshare`, `roles` omits
+  `position`/`is_default`, `member_join` omits its top-level `status` field
+  (`serve_ready.go:365`, `db/models.go:99-106,234-245`, `ws/messages.go:56-67`).
+- D-03 `api.md`: body-cap exemption list wrong (3 exempt prefixes, not 1 —
+  `api/constants.go:177-184`); `identity_public_key` accepted by
+  `PATCH /users/me` but undocumented (`profile_handler.go:29-37,100-114`);
+  plugin endpoints return plain-text errors contradicting the "all errors use
+  the JSON envelope" claim, and the `X-Plugin-Runtime` header is undocumented
+  (`plugins_handler.go:51-136`); `/health`'s 503 degraded state + `reason`
+  field undocumented (`router.go:446-453,509-544`); metrics/LiveKit endpoints
+  have their own CIDR keys with admin fallback, not "admin CIDRs"
+  (`config/config.go:219-233`); `updates/apply` can 409
+  `RESTART_PENDING`/`UPDATE_IN_PROGRESS`, absent from its table
+  (`admin/restart.go:104-112`).
+- D-04 Stale comments: `buildReady`'s claims "no slow_mode … voice_* extras"
+  contradicted by `readyChannelPayloads` directly above
+  (`serve_ready.go:312-315` vs `:216-224`); `tsconfig.e2e.json:2-3` +
+  `ci.yml:155-156` say "47 spec files + the three playwright configs" (52 and
+  four); stray word "ponytail" in `logctx.go:49`.
+- D-05 Three plan headers understate shipped work (bug-detection-improvements,
+  security-scan-2022-remediation F3-3, discord-parity's sounds-table row) —
+  all drift in the direction that misdirects planning toward finished work.
+- D-06 **Branch-flow docs contradict practice**: README:230-232 and
+  `contributing.md:152-153` say branch from `dev`, PR to `dev`, "dev is merged
+  to main for releases"; root `CLAUDE.md:63` says branch from `main`, PR to
+  `main`. Practice matches CLAUDE.md — the 5 most recent merged PRs
+  (#1390-#1394) are `base:main`, and the sync direction is inverted (commit
+  `40cba79` merges `main` *into* `dev`; `dev` is 4 graph-refresh commits
+  ahead, 0 behind).
+
+**Dead code / hygiene (deadcode + knip corroborated)**
+- D-07 `Hub.hasChannelPerm` is unreachable in production; its doc comment
+  claims the sweep calls it, but the sweep uses `hasChannelPermChecked`
+  (`ws/handlers.go:286-292` vs `hub_sweep.go:185,320-354`); the F5 guarantee
+  test pins the dead copy (`voice_perm_stale_test.go`).
+- D-08 `UserService.SetCustomStatus`/`ClearCustomStatus`: zero production
+  callers; "Called on logout" comment false (logout writes the DB directly,
+  `auth_handler.go:584`); duplicates the length validation
+  `HandlePresenceUpdate` owns (`service/user.go:201-215` vs `channel.go:183`).
+- D-09 Production-unused hub APIs: `PubSub.PublishHigh` (`pubsub.go:181`),
+  `Hub.BroadcastToAllLow` (`hub_broadcast.go:907`),
+  `EventRingBuffer.EventsSince` (`ringbuffer.go:43`), and the
+  `Hub.Register/Unregister` clientEvents queue (`hub.go:446-453`, whose
+  `Run` branch is test-only and would fail closed for a future production
+  caller); `TopicsForClient`'s "debugging and tests" doc is stale — it has a
+  production caller (`hub_broadcast.go:850`).
+- D-10 gofmt drift: `admin/handlers_users_broadcast_test.go` (one misaligned
+  field); no gofmt/gofumpt gate exists in CI or `.golangci.yml`.
+- D-11 25 non-blocking `no-underscore-dangle` lint warnings accumulated in
+  `livekitSession.ts:1656-1759`.
+
+**Boundary asymmetries (all privileged-actor or minor; the next members of
+the audit-2026-08-04 defect family — worth sweeping in one pass)**
+- D-12 `typing_start` requires only READ_MESSAGES on guild channels while the
+  send it advertises requires SEND_MESSAGES (announcement: MANAGE_MESSAGES) —
+  a send-muted member can still broadcast typing (`service/channel.go:133` vs
+  `message_perms.go:93-99`; the DM branch *is* fully gated).
+- D-13 `getPermChannel` answers a DM id with 400 "DM channels do not support
+  permission overrides" while its sibling `getAdminChannel` deliberately
+  answers 404 to avoid confirming which ids are DMs (A-2026-08-02) — same
+  perimeter, one oracle left (`admin/handlers_channel_perms.go:40-44` vs
+  `handlers_channels.go:44-61`).
+- D-14 Admin channel create/patch has no length cap or sanitation on
+  name/topic/category (only the 1 MiB body cap); the group-DM writer of the
+  same column caps at 100 runes and its comment claims a channel-name parity
+  that does not exist (`admin/handlers_channels.go:104-116,171-183` vs
+  `service/dm.go:173-175,234-237`).
+- D-15 Invite create/revoke are the only privileged mutation family with no
+  audit row and no log line — an operator cannot see who minted an invite
+  (`service/invite.go:29-77`; every sibling family audits: roles, bans,
+  emoji, settings, channels, purge, auth).
+- D-16 `channel_focus`'s read-state write is called "the load-bearing half"
+  in its own comment, then discarded unlogged
+  (`service/channel.go:275-286`); a persistent failure means unread badges
+  never clear with zero trace.
+
+---
+
+## 7. Verified clean (read end-to-end and found sound)
+
+Recorded so future audits don't re-spend the effort. Hub dispatch loop (panic
+breaker, stop idempotence, register/replacement ordering); every `seqMu`
+critical section (no lock held across real I/O; shed frames never burn a seq);
+lock ordering across `seqMu`/`h.mu`/`ps.mu`/`rb.mu`/`c.mu`/`keyHolderMu` with
+no reverse edge; pubsub index hygiene and identity guards; three-tier client
+queues + writePump anti-starvation; topic rate limiter and pruner/persister
+lifecycle (no goroutine leaks found); ring-buffer tier boundaries (both edges
+fall conservative to full ready) and the closed lost-update window
+(register-inside-`seqMu`); cold-tier contiguity probes including the
+correct off-by-one on the prune gap; replay authorization incl. the OC-0206
+watermark re-check under `seqMu`; seq reseeding across restarts; client
+backoff/generation discipline (OC-0219) and optimistic-send reconciliation
+across reconnects; REST/WS message-family parity (send/edit/delete/reaction/
+pin/purge all funnel through the same service gates); REST-mutation fan-out
+ordering (post-commit, `context.WithoutCancel`, watermark bumps); admin
+users/bans/roles/override families (hierarchy, audit rows, invalidation
+ordering); plugin sandbox mitigations (§2.1); protocol type inventory
+(27 c2s / 39 s2c identical across schema, Go, TS, and doc tables) and
+generated-code gates (protocol codegen byte-identical; `go mod tidy` clean;
+knip zero findings; no TS zombie modules; Rust `unwrap`s confined to test
+modules); E2EE section of protocol.md including the `eacba10` epoch change —
+fully documented and accurate.
+
+---
+
+## 8. Verdict
+
+**MUST fix (before the next feature work lands on top):**
+1. The ten BROKEN reference-doc statements (§4) — one spec-refresh PR, same
+   shape as 2026-08-04's C1. Docs are the record everything else keys off,
+   and two of the ten are security-relevant reader traps (B-09 auth claim,
+   B-07 undocumented limits).
+2. F-1 block/voice eviction — it is the live continuation of the
+   guard-asymmetry family the security review closed; small, testable fix.
+3. F-3 + F-4 + D-16 silent-failure logging — three `slog.Warn` lines
+   restoring visibility to security/UX controls.
+
+**CAN wait (scheduled, not urgent):**
+F-2 (handshake race — real but narrow window; needs a careful hub change +
+deadlock-tag run), F-5 (test timeout bump), F-6 (delete-or-fix decision),
+all §6 DEBT including the D-12..D-15 asymmetry sweep and the D-06
+contributing-docs correction, and every §2 carried architecture item
+(service-layer consolidation, hub constructor, client constants, monoliths).
+
+**Already done (no action):** everything in §2 marked FIXED/intact — backup
+restore, CI gates, `.nvmrc`, plugin mitigations, DC-08, W2-4/W3-3, protocol
+codegen and ledger hygiene — plus §7's verified-clean list. The bug-hunt
+ledger has zero open findings.
+
+---
+
+## 9. Roadmap
+
+### 9.1 Fix order (every BROKEN + FRAGILE, dependencies first, smallest verifiable step first)
+
+1. **F-5** test-timeout bump (one line in one test) — protects the CI signal
+   every later step relies on.
+2. **§4 B-01..B-10** spec-refresh PR for schema.md/protocol.md/api.md,
+   folding in D-01..D-05 while in the files — pure docs, zero code risk, ends
+   the "docs are the record" debt before code changes add more drift.
+3. **F-3 + F-4 + D-16** logging PR (three `slog.Warn` sites, mirrors the
+   shipped OC-0061 pattern) — trivial, independently testable.
+4. **F-1** block → DM-voice eviction (reuses the existing `dmVoiceEvictor`
+   seam `CloseDM` already exercises; pin with a test like
+   A-2026-08-03's) — smallest security-adjacent code fix.
+5. **F-2** handshake/role-change race — hub-internal, needs the `ci-check`
+   deadlock pass; do after 4 so the voice-eviction test infrastructure is
+   fresh.
+6. **F-6** replay-dedup decision (delete vs repair) — last because it needs
+   an owner call; either branch also fixes the misleading tests/comments.
+
+### 9.2 Alpha exit — what stands between here and a stable beta
+*(each item backed by a finding above or an existing plan)*
+
+- **Graduate the two non-blocking CI legs**: `admin-e2e` (soak criterion
+  already written in `ci.yml:302-307`) and a `tauri-build` push-to-main or
+  nightly trigger (2026-07-19 §5, still true) — after which every surface is
+  gated.
+- **Add a gofmt gate** (D-10 proved the gap; one CI line).
+- **Close the DNS-rebinding follow-up** (tauri-capability-narrowing): move
+  link-preview fetches behind a Rust command and drop the `https://*`
+  capability — the last open item from the F3 security track.
+- **Finish the two infrastructure-roadmap leftovers**: TOTP/partial-auth
+  persister seam, and publish the capacity numbers the load-baseline workflow
+  exists to produce.
+- **Start the service-layer consolidation** at `MountAuthRoutes`
+  (2026-04-07 #9, the designated first step of backlog 12), then the hub
+  constructor cleanup (A-2026-07-11 S-effort half).
+- **Unify `channelCanSend`** onto the permission checker — the last
+  hand-mirrored visibility/permission copy.
+- **Protocol rev decision** (owner): emit-or-drop `voice_speakers` /
+  `member_leave` (DC-14), and wire the plugin wire types into the client or
+  document desktop non-support (D-02's sibling).
+- **Docs process hardening**: the 15-day re-drift (§4) says the per-PR rule
+  alone doesn't hold; add the docs-check line to CI or the PR template
+  checklist with teeth (a grep-able "docs reviewed" gate), plus the D-06
+  contributing-flow correction so new contributors aim at the right branch.
+
+### 9.3 Ideas — opinion, not findings
+
+1. Slash-commands Phase A (plan exists, design-only today) — first
+   user-visible plugin payoff.
+2. Role hoist/mentionable + `@RoleName` mentions (discord-parity leftover).
+3. Categories as real entities (discord-parity leftover).
+4. Linux ARM64 server binary + prebuilt Docker image (README platform-matrix
+   gap).
+5. macOS PTT support (currently a stub, noted in discord-parity's dead-code
+   list).