diff --git a/.gitignore b/.gitignore
index 90fdfd5b..24689899 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,6 +28,12 @@ docs/research/
docs/superpowers/
/skills/
+# Detailed security reports for findings that are not yet fixed. This repo is
+# public (docs/security.md): reproduction traces for a live defect must never
+# be committed. Findings are coordinated through private GitHub Security
+# Advisories; only opaque identifiers and safe status go in tracked plans.
+docs/security-findings/
+
# Mutation-testing output (npm run test:mutate). Local-only by design: a
# surviving-mutant report maps exactly which behaviour nothing tests.
Client/tauri-client/.stryker-tmp/
diff --git a/Client/tauri-client/.nvmrc b/Client/tauri-client/.nvmrc
index 209e3ef4..a45fd52c 100644
--- a/Client/tauri-client/.nvmrc
+++ b/Client/tauri-client/.nvmrc
@@ -1 +1 @@
-20
+24
diff --git a/Client/tauri-client/playwright.config.prod.ts b/Client/tauri-client/playwright.config.prod.ts
index 8f5f4ff9..5f3c3366 100644
--- a/Client/tauri-client/playwright.config.prod.ts
+++ b/Client/tauri-client/playwright.config.prod.ts
@@ -40,7 +40,10 @@ export default defineConfig({
],
webServer: {
- command: "npm run preview",
+ // Spawn Vite directly rather than through npm — see the note in
+ // playwright.config.ts: an `npm run` wrapper leaves vite alive as an
+ // orphaned grandchild on teardown and the runner never exits.
+ command: "npx vite preview",
url: "http://localhost:4173",
reuseExistingServer: !process.env.CI,
timeout: 60_000,
diff --git a/Client/tauri-client/playwright.config.ts b/Client/tauri-client/playwright.config.ts
index b7c47bb9..d3be9b0b 100644
--- a/Client/tauri-client/playwright.config.ts
+++ b/Client/tauri-client/playwright.config.ts
@@ -43,8 +43,16 @@ export default defineConfig({
},
],
+ // Kills the dev server the runner cannot kill itself; without it the suite
+ // passes and then hangs forever. See tests/e2e/global-teardown.ts.
+ globalTeardown: "./tests/e2e/global-teardown.ts",
+
webServer: {
- command: "npm run dev",
+ // Run Vite's entry point directly so the listening process IS Playwright's
+ // child — globalTeardown kills the listener, which only releases the
+ // runner's ChildProcess handle if that listener is the child itself. Going
+ // through `npm run dev` would leave the npm process holding it open.
+ command: "node node_modules/vite/bin/vite.js",
url: "http://localhost:1420",
reuseExistingServer: !process.env.CI,
timeout: 60_000,
diff --git a/Client/tauri-client/tests/e2e/global-teardown.ts b/Client/tauri-client/tests/e2e/global-teardown.ts
new file mode 100644
index 00000000..8088929f
--- /dev/null
+++ b/Client/tauri-client/tests/e2e/global-teardown.ts
@@ -0,0 +1,84 @@
+import { execFileSync } from "node:child_process";
+
+/**
+ * Force-kill the dev server Playwright leaves running, so the runner can exit.
+ *
+ * Playwright's own `webServer` teardown does not stop the Vite dev server on
+ * Windows. After the last test the runner still holds a live ChildProcess
+ * handle plus its stdio pipes (`process.getActiveResourcesInfo()` reports
+ * `ProcessWrap` + several `PipeWrap`), the event loop never drains, and
+ * `playwright test` hangs forever with the whole suite already passed —
+ * printing no summary, which is why the failure looked like "tests never
+ * finish" rather than "process never exits".
+ *
+ * Every in-Playwright workaround was tried and failed the same way: spawning
+ * through `npm run dev`, spawning Vite's entry point directly,
+ * `reuseExistingServer: false`, and `gracefulShutdown`. Spawning through `npx`
+ * appears to fix it only because npx exits as soon as Vite is up; Playwright
+ * reads that as the server dying, tears the group down mid-run, and every
+ * later test fails with ERR_CONNECTION_REFUSED.
+ *
+ * Killing the listener here closes the runner's handle so the process exits
+ * normally. It also reaps servers orphaned by an earlier interrupted run,
+ * which `reuseExistingServer` would otherwise silently adopt.
+ *
+ * Failing to kill must not fail an otherwise green suite, but it must not be
+ * silent either: an earlier revision used `netstat`, which is not on PATH in
+ * every shell here, and the swallowed ENOENT made this look fixed when the
+ * hang was still present.
+ */
+const BASE_URL = process.env.PLAYWRIGHT_BASE_URL ?? "http://localhost:1420";
+
+export default function globalTeardown(): void {
+ const port = Number(new URL(BASE_URL).port);
+ if (!Number.isInteger(port) || port <= 0) return;
+ try {
+ if (process.platform === "win32") {
+ killListenerWindows(port);
+ } else {
+ killListenerPosix(port);
+ }
+ } catch (error) {
+ console.warn(
+ `[global-teardown] could not stop the dev server on port ${port}; ` +
+ `the runner may hang. ${String(error)}`,
+ );
+ }
+}
+
+/**
+ * Children first, then the listener itself: Vite spawns esbuild, which
+ * inherits the stdio pipes the runner is waiting on.
+ */
+function killListenerWindows(port: number): void {
+ execFileSync(
+ "powershell",
+ [
+ "-NoProfile",
+ "-NonInteractive",
+ "-Command",
+ `$ids = @(Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue |` +
+ ` Select-Object -ExpandProperty OwningProcess -Unique);` +
+ ` foreach ($id in $ids) {` +
+ ` Get-CimInstance Win32_Process -Filter "ParentProcessId=$id" -ErrorAction SilentlyContinue |` +
+ ` ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue };` +
+ ` Stop-Process -Id $id -Force -ErrorAction SilentlyContinue }`,
+ ],
+ { stdio: "ignore" },
+ );
+}
+
+function killListenerPosix(port: number): void {
+ const out = execFileSync("lsof", ["-ti", `tcp:${port}`, "-sTCP:LISTEN"], {
+ encoding: "utf8",
+ });
+ for (const pid of new Set(out.split(/\s+/).filter(Boolean).map(Number))) {
+ if (Number.isInteger(pid) && pid > 0) {
+ try {
+ process.kill(pid, "SIGKILL");
+ } catch {
+ // Already gone.
+ }
+ }
+ }
+}
diff --git a/Client/tauri-client/tests/unit/message-list.test.ts b/Client/tauri-client/tests/unit/message-list.test.ts
index 643fde2a..77358070 100644
--- a/Client/tauri-client/tests/unit/message-list.test.ts
+++ b/Client/tauri-client/tests/unit/message-list.test.ts
@@ -252,27 +252,55 @@ describe("MessageList", () => {
expect(container.querySelector('[data-testid="message-150"]')).not.toBeNull();
});
- it("OC-0217: repeated jumps do not each register a permanent abort listener on the component-lifetime signal", () => {
+ it("OC-0217/OC-0286: repeated jumps do not each register a permanent row listener on the component-lifetime signal", () => {
// As a user clicking a reply bar's jump arrow, a search hit, or a pinned
// entry repeatedly does across a live session.
const messages = Array.from({ length: 10 }, (_, i) => makeMessage({ id: i + 1 }));
setMessages(1, messages);
msgList.mount(container);
+ // Row listeners are registered as addEventListener(type, fn, { signal }).
// Installed after mount() so it only observes what scrollToMessage does,
- // not mount's own (single, expected) abort registration.
- const addEventListenerSpy = vi.spyOn(AbortSignal.prototype, "addEventListener");
+ // not mount's own (single, expected) registrations.
+ const addEventListenerSpy = vi.spyOn(EventTarget.prototype, "addEventListener");
- for (let i = 1; i <= 5; i++) {
- expect(msgList.scrollToMessage(i)).toBe(true);
+ /** Distinct AbortSignals handed to row listeners since the previous call. */
+ function rowSignalsSinceLastRender(): AbortSignal[] {
+ const signals = addEventListenerSpy.mock.calls
+ .map((call) => call[2])
+ .filter(
+ (opts): opts is AddEventListenerOptions =>
+ typeof opts === "object" && opts !== null && "signal" in opts,
+ )
+ .map((opts) => opts.signal)
+ .filter((signal): signal is AbortSignal => signal != null);
+ addEventListenerSpy.mockClear();
+ return [...new Set(signals)];
}
- // Each jump's highlight-flash cleanup must not add a new listener to the
- // whole-lifetime AbortSignal — that accumulates one listener (and pins
- // one detached row element through its closure) per jump, released only
- // when the channel unmounts, not when that jump's flash finishes.
- const abortRegistrations = addEventListenerSpy.mock.calls.filter(([type]) => type === "abort");
- expect(abortRegistrations.length).toBe(0);
+ const windowSignals: AbortSignal[] = [];
+ for (let i = 1; i <= 5; i++) {
+ expect(msgList.scrollToMessage(i)).toBe(true);
+ const [signal, ...extra] = rowSignalsSinceLastRender();
+ // Every row in a rendered window shares that window's single signal.
+ expect(extra).toHaveLength(0);
+ if (signal === undefined) throw new Error(`jump ${i} rendered no row listeners`);
+ windowSignals.push(signal);
+ }
+
+ // Each jump renders against a fresh signal, so nothing accumulates row
+ // listeners on one long-lived signal.
+ expect(new Set(windowSignals).size).toBe(windowSignals.length);
+
+ // A superseded window is released by the render that replaced it, not
+ // deferred to destroy(). Before OC-0286 rows registered directly against
+ // the component-lifetime signal (`ac.signal`), so all five of these would
+ // still be live here, each pinning a whole window of detached rows and
+ // everything they reference — videos, images, embeds, tooltips.
+ const superseded = windowSignals.slice(0, -1);
+ const current = windowSignals[windowSignals.length - 1];
+ expect(superseded.every((signal) => signal.aborted)).toBe(true);
+ expect(current?.aborted).toBe(false);
addEventListenerSpy.mockRestore();
});
diff --git a/Client/tauri-client/tests/unit/noise-suppression-restart.test.ts b/Client/tauri-client/tests/unit/noise-suppression-restart.test.ts
index ec045269..29626b79 100644
--- a/Client/tauri-client/tests/unit/noise-suppression-restart.test.ts
+++ b/Client/tauri-client/tests/unit/noise-suppression-restart.test.ts
@@ -60,9 +60,19 @@ function makeFakeAudioContext() {
describe("createRNNoiseProcessor restart (OC-0277)", () => {
beforeEach(() => {
+ // Must be a real constructor: noise-suppression.ts calls
+ // `new MediaStream([inputTrack])` before handing the result to the (mocked,
+ // argument-ignoring) createMediaStreamSource. A vi.fn() whose
+ // implementation is an arrow function is not constructible, so Vitest 4
+ // throws "is not a constructor" there instead of running the assertions.
vi.stubGlobal(
"MediaStream",
- vi.fn().mockImplementation((tracks: unknown[]) => ({ tracks })),
+ class {
+ tracks: unknown[];
+ constructor(tracks: unknown[] = []) {
+ this.tracks = tracks;
+ }
+ },
);
});
diff --git a/docs/audit-2026-08-23-repository-health.md b/docs/audit-2026-08-23-repository-health.md
new file mode 100644
index 00000000..76d18daa
--- /dev/null
+++ b/docs/audit-2026-08-23-repository-health.md
@@ -0,0 +1,130 @@
+# OwnCord full repository-health audit
+
+**Audited:** 2026-08-23
+**Audited head:** `5cc0888964e26276d1aca145e83270a2c1b9febd` (`dev`)
+**Conclusion:** strong server foundation; not beta-ready
+
+## Executive status
+
+OwnCord is in a promising but pre-beta state. The server is the stronger half:
+its principal build, race, deadlock, tagged-test, and vet gates pass. The
+client has a substantial desktop foundation, but its required unit-coverage
+gate is red and its full Playwright process does not terminate. The approved
+browser/PWA/phone/tablet product is mostly still a planned workstream.
+
+| Area | Status | Evidence-based conclusion |
+| ---------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Server core | Strong / amber | Builds and concurrency-oriented tests pass; coverage is 74.6%; architecture, security boundaries, capacity, and operations still need work. |
+| Desktop client | Amber-red | TypeScript, build, static checks, Rust checks, and browser smoke pass; 5,255 unit tests pass but 2 fail, and Playwright does not exit cleanly. |
+| Browser/PWA/mobile | Red | No production browser target, optional server-hosted bundle, PWA lifecycle, Web Push, or beta-quality mobile navigation is complete. |
+| Security/privacy | Red / pending | Private current-head security evidence contains unresolved work. The restarted independent deep scan was not sealed because it produced no manifest or result before the audit budget limit. |
+| CI/release/platforms | Amber-red | Signing, checksums, source snapshots, and cold-boot foundations are good; exact-SHA dev evidence, ARM64 coverage, multi-architecture Docker, and native release qualification remain incomplete. |
+| Repository/community | Amber | Server/client separation is understandable; a focused client-layout and contributor-experience migration is justified. |
+| Overall beta readiness | Red | Do not publish the public beta from this head. |
+
+## Validation evidence
+
+### Server
+
+- Default, OpenTelemetry, Wazero-tagged WASM runtime, and combined builds pass.
+- `go vet`, the full race suite, deadlock tests, and tag-gated tests pass.
+- CI-style aggregate coverage is 74.6%; there are many tests and fuzz targets,
+ but no benchmark baseline for the highest-risk hot paths.
+- Docker validation was unavailable locally because no Docker daemon was
+ attached. Local `golangci-lint` could not load because its binary and module
+ toolchains differed; this needs matched-tool or CI evidence.
+- Structural debt remains in large hub/serve/lifecycle files and numerous
+ direct database call sites.
+
+### Client
+
+- Application and E2E typechecks, ESLint, Prettier, Knip, production npm audit,
+ Vite build, Rust Clippy, and 115 Rust tests pass.
+- Vitest coverage is red: 5,255 passed and 2 failed in the message-list and
+ noise-suppression restart contracts.
+- Three direct Chromium browser tests pass, but this is a narrow API harness,
+ not a production browser client.
+- The 293-test Playwright journey reaches its test activity but does not exit;
+ an isolated five-test voice-widget run also hangs.
+- Oxlint exits successfully but reports 471 warnings. The largest lazy feature
+ output is approximately 2.0 MB minified / 1.345 MB gzip, with additional
+ oversized-chunk and dynamic-import warnings.
+
+### Repository and release
+
+- The audited SHA has no GitHub Actions run, so local evidence is not an
+ exact-SHA integration qualification.
+- The release workflow has good signing, checksum, source-snapshot, and
+ server-cold-boot foundations, but the approved Windows/Linux ARM64 and
+ multi-architecture Docker matrix is not complete.
+- Node guidance is inconsistent (`.nvmrc` 20 versus CI 24); the repository
+ needs one enforced version source.
+- Generated graph/ledger artifacts, protocol ownership, tool discovery, hooks,
+ issue intake, and externally triggered automation all need explicit policy.
+
+## Product gaps that block beta
+
+The approved requirements require server-hosted browser support disabled by
+default, shared desktop/browser contracts, PWA installation, phones/tablets,
+opt-in per-server Web Push, N/N-1/N-2 protocol epochs, recovery kits, session
+alerts and sign-out-everywhere, deletion that survives restore, configurable
+retention, Message Requests, moderation reports/appeals, NSFW no-fetch-before-
+consent, translation-ready English text, and the full release architecture
+matrix. Most of these are absent or only partial today.
+
+## Repository structure decision
+
+A targeted migration is justified, not a rewrite:
+
+1. Flatten `Client/tauri-client/` to `Client/` in adjacent pure-move and
+ mechanical-path-rewrite commits.
+2. Keep one shared UI and add typed desktop/browser platform contracts later in
+ B7, after server-first contracts and services are stable.
+3. Keep `Server/` and its package tree stable.
+4. Make protocol schema, generated artifacts, tools, hooks, and contributor
+ commands explicit and reproducible.
+
+## Deployment constraints that must be designed into beta
+
+Public domains and eligible stable public IPs can use built-in ACME. Private
+or reserved LAN addresses cannot receive public-CA certificates and require a
+server-local CA plus one-time trust installation on each browser device. Web
+service workers, media capture, screen sharing, and Push API behavior require a
+secure context in normal browser use. See the [Let’s Encrypt IP certificate
+guidance](https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability),
+[ACME challenges](https://letsencrypt.org/docs/challenge-types/), and [W3C
+secure-context standards](https://www.w3.org/TR/secure-contexts/).
+
+Fully offline browser use can work after local trust onboarding, but closed-app
+Web Push cannot be treated as an offline capability. CGNAT, blocked ports, and
+changing raw IP origins remain operator/network limitations rather than bugs
+OwnCord can hide.
+
+## Phased route
+
+The approved execution sequence is B0–B10:
+
+`B0 truth → B1 repository foundation → B2 protocol/trust → B3 server guardrails → B4 identity/privacy → B5 community/moderation → B6 deployment/capacity → B7 shared desktop platform → B8 browser/PWA/mobile → B9 unified UX/accessibility → B10 qualification/public release`
+
+No phase closes on elapsed time. Each phase requires exact-SHA evidence, and
+B10 additionally requires a complete platform/deployment matrix, migration,
+restore, rollback, security, accessibility, capacity, and release scorecard.
+
+## Audit artifacts
+
+- [Beta product requirements](plans/beta-product-requirements-2026-08-23.md)
+- [Exhaustive issue register](plans/repo-health-issue-register-2026-08-23.md)
+- [Server-first roadmap](plans/repo-health-roadmap-2026-08-23.md)
+- [Requirement traceability](plans/beta-requirements-traceability-2026-08-23.md)
+- [Repository-layout audit](audit-2026-08-23-repository-layout.md)
+
+The detailed reports under `docs/security-findings/` are intentionally
+untracked/private and must not be committed to a public repository before
+coordinated remediation.
+
+## Recommended first implementation slice
+
+Begin B0 only: repair the two failing unit contracts, make Playwright terminate
+reliably, obtain matched lint/Docker evidence, reconcile private security
+findings, and run the full exact-SHA matrix. Then perform the isolated B1
+repository migration before implementing new client features.
diff --git a/docs/audit-2026-08-23-repository-layout.md b/docs/audit-2026-08-23-repository-layout.md
new file mode 100644
index 00000000..ce82eefa
--- /dev/null
+++ b/docs/audit-2026-08-23-repository-layout.md
@@ -0,0 +1,175 @@
+# OwnCord repository-layout and contributor-experience audit
+
+**Audited:** 2026-08-23
+**Audited head:** `5cc0888964e26276d1aca145e83270a2c1b9febd` (`dev`)
+**Decision:** a targeted, isolated layout phase is justified; a wholesale
+repository or server rewrite is not
+**Product input:**
+[beta-product-requirements-2026-08-23.md](plans/beta-product-requirements-2026-08-23.md)
+**Canonical work register:**
+[repo-health-issue-register-2026-08-23.md](plans/repo-health-issue-register-2026-08-23.md)
+
+## Executive verdict
+
+OwnCord's top-level server/client separation is understandable and the Go
+server's package layout is generally healthy. The repository does not need a
+monorepo rewrite, a `Server/` rename, or broad movement of historical documents.
+
+A smaller structural phase is worthwhile before beta feature work because the
+new browser/PWA requirement exposes a real boundary problem: the only client is
+nested and named as Tauri-specific, while the shared frontend directly imports
+native Tauri APIs in at least 20 production files. Contributor entry points,
+branch automation, release coverage, generated artifacts, and active-document
+navigation also need consolidation.
+
+The structural work must be mechanical and independently reversible. File
+moves and path rewrites must not contain functional changes, and the later
+platform-boundary extraction must preserve behavior behind tests before adding
+the browser implementation.
+
+Priorities follow the health register: P0 is a red required gate, P1 must close
+before beta, and P2 is scheduled architecture, quality, or operational debt.
+
+## What should remain stable
+
+- Keep `Server/` and its existing domain packages. Later hotspot extraction is
+ architecture work, not repository layout work.
+- Keep existing release asset names and updater contracts so alpha-to-beta
+ upgrades do not break.
+- Keep one shared client UI, store, protocol, and domain implementation. Do not
+ fork a second web application.
+- Keep build-required generated sources committed: sqlc output, generated
+ protocol types, Tauri-generated bindings, and runtime assets required by a
+ release build.
+- Keep historical audits and plans at their existing paths. Index their status
+ instead of moving them and breaking references.
+- Keep the canonical findings ledger until a deliberate tracker migration
+ provides equivalent history and validation.
+
+## Recommended target
+
+```text
+Client/
+ package.json
+ src/
+ platform/
+ contracts/
+ browser/
+ desktop/
+ src-tauri/
+ tests/
+Server/
+protocol/
+ schema.json
+deploy/
+docs/
+ README.md
+ plans/
+tools/
+```
+
+The current `Client/tauri-client/` content should be flattened into `Client/`
+as two adjacent non-functional commits: first pure file moves, then mechanical
+rewrites of active paths. `Client/` has no other tracked child, and the current
+name incorrectly implies that browser/PWA support should become a separate
+application. The capitalized `Client/` and `Server/` names may remain: changing
+both for style alone would create widespread path churn without improving a
+runtime or contributor boundary.
+
+The protocol schema is executable cross-component source and should move from
+`docs/protocol-schema.json` to a small root `protocol/` boundary. Documentation
+continues to explain the contract, while root tooling owns generation for both
+consumers.
+
+## Findings
+
+| ID | Pri | Finding | Required disposition |
+| ----- | --: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| RL-01 | P1 | All tracked client content is under the redundant `Client/tauri-client/` level, and active automation/documentation hard-code that path. The name is misleading now that browser/PWA is approved. | Flatten to `Client/` in two adjacent non-functional commits—pure moves, then active-path rewrites—and leave historical evidence untouched. |
+| RL-02 | P1 | At least 20 frontend files directly import `@tauri-apps/*`; API, WebSocket, credentials, profiles, notifications, media, LiveKit, updates, logs, and window state do not have a browser-neutral platform seam. | Record the target boundary during the layout phase, then introduce typed `platform/contracts`, `platform/desktop`, and `platform/browser` ownership in client phase B7. Add contract tests that run against both adapters. |
+| RL-03 | P1 | The Vite configuration contains Tauri-specific HTML transformation, and there is no independent browser/PWA production build contract. | In client phase B7, split shared build configuration from target adapters and add explicit `build:web` and `build:desktop` gates using one application source tree. |
+| RL-04 | P2 | Root `package.json` exposes release and hook commands but no discoverable bootstrap, format, generated-code, server, client, or full verification entry points. | Add a cross-platform root command facade. Decide workspace consolidation from measured install/lockfile behavior rather than requiring Node for ordinary Go-only work. |
+| RL-05 | P2 | Three JavaScript package/lock roots are maintained separately, while dependency automation does not cover all of them. | Either adopt a documented npm workspace or add complete per-package automation; retain component-local commands and deterministic lockfile installs. |
+| RL-06 | P2 | Tracked `graphify-out/` is about 20 MB, led by a roughly 19.3 MB generated JSON graph. Portable regeneration was not demonstrated in this audit environment because the available launcher failed before a query could run. Repeated refreshes grow normal Git history. | Stop tracking large graph payloads after providing a portable regeneration command and CI/release artifact. Do not rewrite published history. A compact architecture report may remain if it is mechanically verified. |
+| RL-07 | P2 | `.superpowers/FINDINGS.md` duplicates the canonical ledger as a large generated rendering. The canonical JSON ledger remains necessary today. | Keep the authoritative JSON ledger, remove the tracked human rendering after a drift check exists, and generate it on demand or as a downloadable CI artifact. |
+| RL-08 | P2 | A prebuilt example `hello.wasm` is committed for a plugin system that is experimental and disabled, without a source-drift verification gate. | Keep its source, stop tracking the prebuilt example, and compile/verify it deterministically in CI or release checks without making an API compatibility promise. |
+| RL-09 | P2 | Cross-component protocol source lives under `docs/`, while a server-owned generator writes both Go and TypeScript consumers. | Move the schema/generator entry point to the root protocol/tool boundary and verify both generated outputs from one command. |
+| RL-10 | P1 | `Server/scripts/seed.go` is included in broad Go package discovery and its initialization creates a runtime data directory during test discovery. | Move executable tools under a conventional `cmd/` or tool package and remove import/test-time filesystem side effects. |
+| RL-11 | P2 | A client “unit” test reads server admin HTML directly, hiding a cross-component contract inside the wrong ownership and test tier. | Move the invariant to the owning server test or a clearly named root contract/system-test tier. Inventory siblings before moving only one file. |
+| RL-12 | P2 | There is no canonical docs landing page that distinguishes active guidance, reference material, historical audits, and superseded plans. Active files also disagree about Node and branch policy. | Add `docs/README.md` and a plan index; mark status without relocating historical evidence. Generate or check high-value version/branch/platform facts. |
+| RL-13 | P2 | The Go module declares `github.com/owncord/server`, while the public repository is `github.com/J3vb/OwnCord`. | Align the module to `github.com/J3vb/OwnCord/Server` in an isolated mechanical change and verify every import, generator, build tag, source archive, and downstream instruction. |
+| RL-14 | P0 | `dev` can receive direct commits without an exact-SHA CI run because push CI covers `main`, while `dev` relies on PR or manual events. | Add protected PR-only integration or run the complete blocking matrix for every `dev` push. This duplicates G-03 and must map to one canonical issue. |
+| RL-15 | P1 | Release automation does not cover the approved platform matrix: Windows ARM64 client/server, Linux ARM64 server, and multi-architecture Docker publication are missing. | Add build, package, install/boot smoke, signing, manifest, and update checks for all BPR-010/BPR-011 targets. |
+| RL-16 | P1 | A version tag can start publication without proving that the exact tagged commit completed the full beta gate. | Couple release publication to green exact-SHA evidence and a protected release approval; retain current version, signature, checksum, cold-boot, and source-snapshot strengths. |
+| RL-17 | P1 | Client `.nvmrc` and active contributor docs say Node 20 while CI/release use Node 24; package metadata does not enforce the intended Node/npm versions. | Establish one Node 24 source of truth read by local setup, packages, CI, release, and documentation. This duplicates C-01 and must map to one canonical issue. |
+| RL-18 | P1 | Dependency automation omits root tooling, `tools/mcp-introspect`, and Docker; runtime/build containers use mutable tags. | Cover every dependency root, pin or automatically review container digests, and produce signed SBOM/provenance evidence for releases. |
+| RL-19 | P2 | Formatting/lint coverage omits material Markdown, YAML, JSON, CSS, Rust formatting, repository-wide Go formatting, shell scripts, and workflow syntax. There is no root `.editorconfig`. | Add fast, cross-platform format and repository-lint gates with generated/vendor exclusions and one editor baseline. |
+| RL-20 | P2 | Committed hooks are POSIX shell and invoke `make`, but Windows is an official contributor platform without those prerequisites being explicit. | Make hooks thin optional wrappers around cross-platform root commands and document any Git Bash dependency until removed. |
+| RL-21 | P2 | Community intake does not match the approved model: feature requests still become Issues, and bug forms omit browser/PWA, ARM64, deployment mode, and architecture detail. | Route ideas/feedback to Discussions and modernize bug forms, PR guidance, contributor entry points, and support links. |
+| RL-22 | P1 | Authorization for externally triggered paid repository automation is not sufficiently constrained. | Limit execution to explicitly trusted maintainers, retain least-privilege permissions, add cost-abuse regression tests, and keep the concrete pre-fix mechanism private. |
+
+## Strong foundations to preserve
+
+- CI already exercises Go build tags, race/deadlock behavior, TypeScript/Rust
+ checks, a limited browser harness, mocked-desktop Playwright, Docker smoke,
+ vulnerability checks, and coverage artifacts. These are foundations, not
+ evidence that a production browser/PWA client exists.
+- GitHub Actions are SHA-pinned and generally use narrow permissions.
+- Release automation already checks version agreement, cold-boots the built
+ server, signs metadata, verifies signatures, generates checksums, and
+ publishes an AGPL source snapshot.
+- `.gitattributes` enforces stable line endings and ignore files cover most
+ ordinary build/runtime output.
+- Component documentation is detailed; the primary problem is discoverability
+ and stale duplicated facts, not absence of technical knowledge.
+
+## Isolated implementation sequence
+
+1. Restore the two currently red client test contracts, make the full and
+ isolated Playwright runs terminate after completion, and establish the exact
+ baseline checks. Structural validation must start green.
+2. Add the docs/plan index and root cross-platform command facade, then align
+ Node 24 and branch/CI truth.
+3. Relocate or stop tracking non-product generated artifacts after their
+ replacement generation/artifact paths are proven.
+4. Flatten `Client/tauri-client/` to `Client/` as two adjacent commits in one
+ PR: pure file moves, then mechanical active-path rewrites. Neither commit
+ changes behavior.
+5. Record the browser-neutral contract map and owners. Implement the adapters,
+ native extraction, and web production build later in client phase B7 after
+ the server-first phases close.
+6. Move protocol ownership to the root and verify both generated consumers.
+7. Reclassify cross-stack tests and executable tools; remove test-time
+ filesystem side effects.
+8. Correct platform/release/dependency automation independently of the moves.
+9. Run the full server, client, Rust, browser, generated-code, Docker, and
+ release-path matrix on the exact resulting SHA.
+
+## Exit gate
+
+- a fresh Windows or Linux contributor can find one setup path and run scoped
+ or full checks without guessing directories;
+- existing desktop behavior and release/update names are unchanged;
+- the browser-neutral contract design, owners, and B7 validation plan are
+ approved without prematurely refactoring client runtime behavior;
+- every supported release architecture has an owned automation path;
+- every active commit on `dev` has exact-SHA CI evidence;
+- generated sources and large analysis artifacts have explicit, reproducible,
+ separately verified ownership;
+- no active documentation contradicts branch, Node, platform, support, plugin,
+ or beta-scope policy;
+- the complete baseline is green and the worktree contains no accidental build
+ or generated output.
+
+## Migration risks and controls
+
+| Risk | Control |
+| --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| Hard-coded client paths are missed | Inventory active references before the move; run workflow, hook, generator, docs-link, package, and release-manifest checks afterward. |
+| Browser and desktop behavior diverge | One shared application plus tested platform contracts; no copied feature implementations. |
+| Root tooling makes Node mandatory for server contributors | Keep direct Go commands supported and make the root facade a convenience/orchestration layer. |
+| Release or updater compatibility breaks | Do not rename binaries/assets; smoke installation, update manifests, signatures, and in-place upgrades. |
+| Rename obscures functional review | Pure-move and mechanical-path-rewrite commits are followed by separately reviewed adapter changes. |
+| Generated analysis output disappears without replacement | Prove local generation and downloadable CI artifacts before untracking; retain published Git history. |
+
+No production source was moved or changed during this audit.
diff --git a/docs/plans/README.md b/docs/plans/README.md
new file mode 100644
index 00000000..bc3bf7f9
--- /dev/null
+++ b/docs/plans/README.md
@@ -0,0 +1,75 @@
+# Plan index
+
+Closes G-04. Historical plans are kept at their existing paths — links from
+audits and commit messages must keep resolving — so status is recorded **here**
+rather than by moving or rewriting them.
+
+A plan's own header can drift out of date after its table is updated in place.
+Where that has happened it is called out below, and **this index is the
+authority**.
+
+## Active — these drive current work
+
+| Plan | State |
+| --- | --- |
+| [beta-product-requirements-2026-08-23](beta-product-requirements-2026-08-23.md) | Approved beta scope, frozen. 57 `BPR-*` requirements. |
+| [repo-health-roadmap-2026-08-23](repo-health-roadmap-2026-08-23.md) | Phase order and gates, B0–B10. No phase complete. |
+| [repo-health-issue-register-2026-08-23](repo-health-issue-register-2026-08-23.md) | 88 planning rows. Public-safe; not a replacement for the ledger. |
+| [beta-requirements-traceability-2026-08-23](beta-requirements-traceability-2026-08-23.md) | Requirement → phase → evidence map. No row is release-qualified. |
+| [b0-baseline-2026-08-25](b0-baseline-2026-08-25.md) | **Supersedes the roadmap's "current evidence snapshot."** B0 measurements and dispositions. |
+| [audit-2026-08-19-remediation](audit-2026-08-19-remediation.md) | Phases 1–6 done 2026-08-20; **phase 7 pending**. Its header still reads "in progress 2026-08-19" — stale; the phase table is correct. |
+
+## Partially implemented
+
+| Plan | State |
+| --- | --- |
+| [bug-detection-improvements](bug-detection-improvements.md) | Tier 1a (`make fuzz`) and Tier 2 (five ESLint rules) shipped 2026-08-08. Remaining tiers open. |
+
+## Design only — not implemented
+
+| Plan | State |
+| --- | --- |
+| [slash-commands](slash-commands.md) | Design only. No implementation; not in beta scope. |
+
+## Shipped — kept for history, do not use as current status
+
+| Plan | Shipped |
+| --- | --- |
+| [audit-2026-07-19-decisions](audit-2026-07-19-decisions.md) | Decisions recorded; greenlit items implemented through 2026-07-23. |
+| [channel-visibility-unification](channel-visibility-unification.md) | 2026-07-20 (D9), re-verified 2026-08-04. |
+| [v2-dispatch-migration](v2-dispatch-migration.md) | 2026-07-20 (D10), re-verified 2026-08-04. |
+| [tauri-capability-narrowing](tauri-capability-narrowing.md) | 2026-07-20, re-verified 2026-08-04. |
+| [http-tofu-proxy](http-tofu-proxy.md) | 2026-07-19, re-verified 2026-08-04. |
+| [permission-middleware-consolidation](permission-middleware-consolidation.md) | 2026-07-23 (D13), re-verified 2026-08-04. |
+| [security-hardening-remediation](security-hardening-remediation.md) | 2026-07-23, re-confirmed 2026-08-04. |
+| [security-scan-2026-07-22-remediation](security-scan-2026-07-22-remediation.md) | All 8 findings F1–F8 closed, verified 2026-08-04. |
+| [sqlc-adoption](sqlc-adoption.md) | Shipped, verified 2026-08-04. |
+| [discord-parity](discord-parity.md) | Phases 1–6 complete, verified 2026-08-04. Phase 1's table reads as a gap list but every row shipped. |
+| [infrastructure-roadmap](infrastructure-roadmap.md) | 2026-08-15, with two recorded leftovers (TOTP persister seam; published capacity numbers). |
+
+## Where status actually lives
+
+Planning documents are not trackers. Do not read a defect count out of one.
+
+| Concern | Source of truth |
+| --- | --- |
+| Defect status | `.superpowers/findings-ledger.json` (`FINDINGS.md` is rendered from it) |
+| Security-sensitive defects | Private GitHub Security Advisories |
+| Product scope | [beta-product-requirements-2026-08-23](beta-product-requirements-2026-08-23.md) |
+| Phase order and gates | [repo-health-roadmap-2026-08-23](repo-health-roadmap-2026-08-23.md) |
+| Current measured baseline | [b0-baseline-2026-08-25](b0-baseline-2026-08-25.md) |
+
+Ledger at 2026-08-25: **306 fixed / 38 open / 3 declined / 1 duplicate = 348**.
+All 38 open records still resolve to a live `file:line` at
+`5cc0888964e26276d1aca145e83270a2c1b9febd` — none is stale. Verify with:
+
+```
+node .superpowers/render-ledger.mjs --check
+```
+
+## Adding a plan
+
+1. Give it a `**Status:**` line with a date, and update that line — not only
+ the phase table — when it changes.
+2. Add a row here. A plan absent from this index has no recorded status.
+3. Mark a superseded plan here; leave it at its path so existing links resolve.
diff --git a/docs/plans/audit-2026-08-19-remediation.md b/docs/plans/audit-2026-08-19-remediation.md
index d4f3f096..396eedfd 100644
--- a/docs/plans/audit-2026-08-19-remediation.md
+++ b/docs/plans/audit-2026-08-19-remediation.md
@@ -1,7 +1,9 @@
# Audit 2026-08-19 Remediation — Phased Plan
-**Status:** in progress 2026-08-19 — phases execute in order; each phase's
-status is updated in place when it lands.
+**Status:** in progress — phases 1–6 landed 2026-08-20 (merged as `03fcb7d5`,
+PR #1396); **phase 7 is still pending**. Phases execute in order; each phase's
+status is updated in place when it lands, so the table below is authoritative
+for per-phase state. Indexed in [README.md](README.md).
**Source:** [audit-2026-08-19.md](../audit-2026-08-19.md) — this plan executes
its §8 MUST-fix verdict and §9.1 fix order verbatim. Items outside that list
(§6 DEBT beyond D-01..D-05, §9.2 alpha-exit work) are deliberately NOT in
diff --git a/docs/plans/b0-baseline-2026-08-25.md b/docs/plans/b0-baseline-2026-08-25.md
new file mode 100644
index 00000000..500b70e8
--- /dev/null
+++ b/docs/plans/b0-baseline-2026-08-25.md
@@ -0,0 +1,214 @@
+# B0 baseline and audit reconciliation
+
+**Measured:** 2026-08-25
+**Base commit:** `5cc0888964e26276d1aca145e83270a2c1b9febd` (the audited head)
+**Branch:** `fix/b0-baseline-2026-08-25`
+**Supersedes the "current evidence snapshot" in**
+[repo-health-roadmap-2026-08-23.md](repo-health-roadmap-2026-08-23.md)
+
+Every row below is either **measured** in this session or explicitly marked
+**carried** from the 2026-08-23 audit without re-verification. Nothing is
+inherited silently.
+
+## Environment
+
+| Tool | Version | Note |
+| --- | --- | --- |
+| Node | 26.4.0 | **Local only.** CI pins 24. See ENV-01. |
+| npm | 11.17.0 | |
+| Go | 1.26.7 | Matches `Server/go.mod` `toolchain go1.26.7`. |
+| golangci-lint | 2.11.3 (built with go1.26.5) | Runs correctly despite the mismatch. See G-05. |
+| Playwright | 1.62.1 | |
+| Vitest / Vite / TypeScript | 4.1.11 / 8.2.2 / 6.0.3 | |
+| oxlint / eslint / prettier | 1.79.0 / 10.9.0 / 3.9.6 | |
+| Client version | 1.2.0-alpha.3 | |
+
+## Measured results
+
+| Gate | Result | Provenance |
+| --- | --- | --- |
+| Server build — default | pass | measured |
+| Server build — `otel` | pass | measured |
+| Server build — `wazero` | pass | measured |
+| Server build — `otel wazero` | pass | measured |
+| `go vet ./...` | pass | measured |
+| `golangci-lint run ./...` | **0 issues**, 19 linters active, 1.18s | measured |
+| Go `-race ./...` | pass (exit 0, no data race) | measured |
+| Go `-tags deadlock ./...` | pass (exit 0) | measured |
+| Client unit + integration | **5257 passed / 192 files, 0 failed** | measured |
+| Client `tsc` (build + e2e + root) | pass | measured |
+| Client `prettier --check` | pass | measured |
+| Client `npm run lint` | pass (exit 0) | measured |
+| oxlint warnings | **471** | measured — unchanged from audit |
+| Playwright full suite | **293 passed, exit 0, 37s** | measured |
+| Client production build | pass, 401ms | measured |
+| Docker build + boot smoke | **pass** — image 50.1 MB, boots on `:8443` with TLS | measured (see ENV-02) |
+| Server coverage | **74.6% aggregate** | measured — confirms the carried figure exactly |
+| Rust clippy + 115 tests | pass | **carried**, not re-measured |
+
+### Bundle sizes (measured)
+
+| Chunk | Minified | Gzip |
+| --- | ---: | ---: |
+| `livekitSession` | 1,998.25 kB | 1,344.96 kB |
+| `livekit` | 495.41 kB | 127.88 kB |
+| `MainPage` | 192.18 kB | 58.92 kB |
+| `index` | 187.18 kB | 59.07 kB |
+| `SettingsOverlay` | 47.56 kB | 13.98 kB |
+
+Confirms the audit's "~2.0 MB minified / 1.345 MB gzip" for the largest lazy
+chunk. This is the budget baseline B7 ratchets against.
+
+## Dispositions
+
+### Closed
+
+| ID | Was | Now | Evidence |
+| --- | --- | --- | --- |
+| G-01 | P0 confirmed | **fixed** | See "G-01 was inverted" below. |
+| G-02 | P0 confirmed | **fixed** | `MediaStream` stub replaced with a real constructible class; Vitest 4 threw `is not a constructor` at `noise-suppression.ts:162` before, passes after. OC-0277 assertions unchanged. |
+| Playwright non-termination | P0-adjacent confirmed | **fixed** | Root cause and fix below. |
+| G-03 | P0 confirmed | **fixed** | `dev` branch protection applied 2026-08-25: PR required, `required_approving_review_count: 0`, `enforce_admins: true`, force-pushes and deletions off. Every dev commit now arrives via PR and hits the existing `pull_request` trigger. Also closes RL-14. Status checks still unpinned — see below. |
+
+### Refuted
+
+| ID | Claim | Finding |
+| --- | --- | --- |
+| G-05 | "Local `golangci-lint` could not load because its Go 1.26.5 build mismatched the module's Go 1.26.7 toolchain." | **Does not reproduce.** `golangci-lint run ./...` completes with 19 active linters (bodyclose, contextcheck, cyclop, dupl, errcheck, funlen, gocritic, gosec, govet, ineffassign, modernize, nestif, nilerr, prealloc, staticcheck, unconvert, unparam, unused, wastedassign) in 1.18s and reports 0 issues. Verified with `-v` specifically to rule out the known zero-linters false-green. The gate does not need waiving or CI substitution. |
+
+### Still open
+
+| ID | Pri | State | Note |
+| --- | --- | --- | --- |
+| ~~G-03~~ | P0 | **closed 2026-08-25** | `dev` is PR-only: PR required, 0 approvals, enforced on admins, force-pushes off. Moved to Closed. |
+| G-04 | P1 | **mostly closed** | Active-plan index added at [README.md](README.md): every plan in `docs/plans/` now has a recorded state (active / partial / design-only / shipped). One real stale claim found and fixed — `audit-2026-08-19-remediation.md` still read "in progress 2026-08-19" while its own table showed phases 1–6 done 2026-08-20 with only phase 7 pending. No plan was found claiming "0 open findings". Remaining: the *automated* check that prevents conflicting status/count claims (B1). |
+| ENV-02 | — | **closed** | Docker smoke now measured locally and passing. Moved to Closed. |
+
+### New findings
+
+| ID | Pri | Finding |
+| --- | --- | --- |
+| ENV-03 | P2 | **`docker-smoke.sh` cannot be run from Git Bash on Windows.** MSYS path conversion rewrites the container-internal path `/chatserver` into `C:/Program Files/Git/chatserver`, so `docker exec` fails with exit 127 and the script reports `container never reported healthy within 30s` — indistinguishable from a genuine boot regression. The image is fine; with `MSYS_NO_PATHCONV=1` the same script passes. CI is unaffected (Linux). Windows is an official contributor platform, so the script should either set this itself or document it — related to RL-20. |
+| ENV-01 | P2 | **Three Node versions were in play**, not two. `.nvmrc` said 20, CI says 24, and the local runtime is 26.4.0. `.nvmrc` is now 24 to match CI. The local runtime remains 26, so every "measured" row above was produced on Node 26, not CI's 24 — this is the one standing gap between this baseline and a CI baseline. Full single-source-of-truth work stays in B1 (RL-17 / C-01). |
+
+## G-01 was inverted, not stale
+
+The register recorded G-01 as a stale assertion. It is worse than that: the
+original test **passed on the bug and failed on the fix**.
+
+`message-list.test.ts` spied on `AbortSignal.prototype.addEventListener` and
+asserted zero `"abort"` registrations. Two things were true:
+
+- The pre-OC-0286 leak registered row listeners as
+ `element.addEventListener(type, fn, { signal: ac.signal })`. That path never
+ calls `AbortSignal.prototype.addEventListener`, so the leak produced **zero**
+ registrations and the assertion passed.
+- The OC-0286 fix rotates a per-window controller and hands rows
+ `AbortSignal.any([ac.signal, rowAc.signal])`. Each rebuild registers one
+ listener on a fresh signal, so five jumps produced **five** registrations and
+ the assertion failed.
+
+Measured directly: with the fix, 5 registrations across **5 distinct** signals,
+4 already aborted and 1 live. With the fix reverted, **0** registrations.
+
+The test now captures the signal each window's row listeners are registered
+against and asserts the invariant its name always claimed:
+
+- every rendered window's rows share exactly one signal;
+- each jump renders against a *fresh* signal (nothing accumulates);
+- every superseded window's signal is already aborted, and exactly one is live.
+
+Verified both directions: green on the fix, and with `beginRowRender()` reverted
+to `rowSignal = ac.signal` it fails with `expected 1 to be 5` — the accumulation
+shape, named precisely.
+
+## Playwright non-termination: root cause
+
+None of the three hypotheses in the B0 plan was correct.
+
+The runner finished every test and then never exited, printing no summary — so
+the failure looked like "tests never finish" when it was "process never exits."
+`process.getActiveResourcesInfo()` at hang time showed the runner holding a live
+`ProcessWrap` plus several `PipeWrap`: the Vite dev server was still alive.
+
+Playwright's `webServer` teardown does not kill it on Windows. Measured:
+
+| webServer setup | Terminates | Tests |
+| --- | --- | --- |
+| `npm run dev` | no — hangs | pass |
+| `node node_modules/vite/bin/vite.js` | no — hangs | pass |
+| `reuseExistingServer: false` | no — hangs | pass |
+| `gracefulShutdown: { SIGTERM, 3s }` | no — hangs | pass |
+| `npx vite` | yes | **290 of 293 fail** |
+| no `webServer` (server pre-started) | yes | 293 pass in 33s |
+
+`npx vite` only appears to work: npx exits once Vite is up, Playwright reads
+that as the server dying and tears the group down mid-run, so later tests fail
+with `ERR_CONNECTION_REFUSED`.
+
+**Fix:** `tests/e2e/global-teardown.ts` kills the process listening on the dev
+port after the run, which releases the runner's handle. The `webServer` command
+spawns Vite's entry point directly so the listening process *is* Playwright's
+child — through `npm run dev` the npm process would still hold the handle open.
+
+Result: `npm run test:e2e` exits 0 in 37s with 293 passed, reproducibly, leaving
+no orphaned listener. Before, it never exited at any timeout.
+
+An earlier revision of the teardown used `netstat`, which is not on PATH in
+every shell here; the swallowed `ENOENT` made the fix look effective while the
+hang was still present. It now uses PowerShell on Windows, `lsof` elsewhere, and
+**warns on failure instead of failing silently**.
+
+## G-03 — the one decision B0 still needs
+
+`.github/workflows/ci.yml` triggers on `push: [main]` and
+`pull_request: [main, dev]`. A direct push to `dev` with no open PR receives no
+run at all, which is exactly why the audited head has no CI evidence.
+
+The existing `concurrency` group is `ci-${{ github.ref }}`. A dev push is
+`refs/heads/dev` and its PR is `refs/pull/N/merge` — **different groups**, so
+adding `dev` to `push` genuinely double-runs the suite while a dev→main PR is
+open. The trigger comment records that as the original reason for removing it.
+
+**Decision (2026-08-25): make `dev` PR-only** via branch protection. No workflow
+change is needed — the existing `pull_request: [main, dev]` trigger already
+covers every PR — and no run is duplicated. Direct pushes to `dev` stop being
+possible, which is the point.
+
+The rejected alternative was adding `dev` to `push.branches`: a one-line change
+that keeps direct pushes but runs the full matrix twice per push whenever a
+dev→main PR is open, because the two events fall in different `concurrency`
+groups.
+
+Apply with [`b0-dev-branch-protection.sh`](b0-dev-branch-protection.sh), which
+records the settings and the reasoning. It must be run by a human: repository
+settings writes are blocked from the agent sandbox. Status-check pinning is
+deliberately left unset until the exact job names are confirmed from a green
+run — requiring names that never report would deadlock every PR.
+
+This is the canonical owner for layout finding RL-14; close both as one issue.
+
+## Docker evidence has to come from a local run
+
+The CI Docker job is gated `if: github.ref_name == 'main' || github.base_ref ==
+'main'`, so it is **skipped on any PR targeting `dev`** — including the PR that
+carries this baseline. A dev-targeted change therefore cannot obtain Docker
+evidence from CI at all; it must be run locally (or the gate widened). Measured
+here: image builds at 50.1 MB and `docker-smoke.sh` exits 0.
+
+## Not yet done in B0
+- Step 6 follow-up: pin required status checks on `dev` once the exact job
+ names are confirmed from the first green PR run
+ (`gh api repos/J3vb/OwnCord/commits/dev/check-runs -q '.check_runs[].name'`).
+ Until then a PR is required but may still merge red.
+- Step 8: individual adjudication of the 38 open `OC-*` records. The count was
+ verified as **306 fixed / 38 open / 3 declined / 1 duplicate = 348**, matching
+ the register, and a staleness pass confirmed **all 38 still resolve to a live
+ `file:line`** at this commit — none is superseded by later work, so all 38 are
+ genuinely open (11 medium, 27 low, all from hunt `general-2026-08-22-b`).
+ Deciding each one is bughunt-fix work, not B0 work. The duplicate pairs the
+ register names are mapped: RL-14↔G-03 (closed together here) and RL-17↔C-01
+ (Node, partly addressed by ENV-01).
+- Step 9: nothing outstanding. Coverage re-measured at 74.6%; the only figure
+ still carried is Rust clippy + 115 tests.
+- Step 10: HP-0 sign-off.
diff --git a/docs/plans/b0-dev-branch-protection.sh b/docs/plans/b0-dev-branch-protection.sh
new file mode 100644
index 00000000..e468fc50
--- /dev/null
+++ b/docs/plans/b0-dev-branch-protection.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# G-03 / RL-14: make `dev` PR-only so every integration commit gets CI.
+#
+# Today `.github/workflows/ci.yml` triggers on `push: [main]` and
+# `pull_request: [main, dev]`. A direct push to `dev` with no open PR runs
+# nothing at all — which is why the audited head 5cc08889 has no CI evidence.
+# Requiring a PR routes every dev commit through the existing pull_request
+# trigger, with no workflow change and no duplicated runs.
+#
+# Run this yourself: Claude Code's sandbox blocks repo-settings writes.
+# bash docs/plans/b0-dev-branch-protection.sh
+#
+# Choices worth knowing:
+# required_approving_review_count: 0
+# A PR is required, but you can merge your own without a second person.
+# Anything above 0 would lock a solo maintainer out entirely.
+# enforce_admins: true
+# Applies to you too. With `false` an admin silently bypasses the PR
+# requirement, which on a solo-admin repo makes the whole guard
+# decorative. Toggle it off any time if you need an emergency push.
+# required_status_checks: null
+# Deliberately not set yet. Requiring check names that never report
+# deadlocks every PR, so pin them only after confirming the exact job
+# names from a green run:
+# gh api repos/J3vb/OwnCord/commits/dev/check-runs \
+# -q '.check_runs[].name'
+#
+# To undo:
+# gh api -X DELETE repos/J3vb/OwnCord/branches/dev/protection
+set -euo pipefail
+
+REPO="${REPO:-J3vb/OwnCord}"
+
+gh api -X PUT "repos/${REPO}/branches/dev/protection" --input - <<'JSON'
+{
+ "required_status_checks": null,
+ "enforce_admins": true,
+ "required_pull_request_reviews": {
+ "required_approving_review_count": 0,
+ "dismiss_stale_reviews": false,
+ "require_code_owner_reviews": false
+ },
+ "restrictions": null,
+ "allow_force_pushes": false,
+ "allow_deletions": false,
+ "required_conversation_resolution": false,
+ "required_linear_history": false
+}
+JSON
+
+echo
+echo "Applied. Verifying:"
+gh api "repos/${REPO}/branches/dev/protection" -q '
+ " PR required: " + ((.required_pull_request_reviews != null)|tostring),
+ " approvals needed: " + (.required_pull_request_reviews.required_approving_review_count|tostring),
+ " applies to admins:" + (.enforce_admins.enabled|tostring),
+ " force pushes: " + (.allow_force_pushes.enabled|tostring)'
diff --git a/docs/plans/beta-product-requirements-2026-08-23.md b/docs/plans/beta-product-requirements-2026-08-23.md
new file mode 100644
index 00000000..c99d1eb3
--- /dev/null
+++ b/docs/plans/beta-product-requirements-2026-08-23.md
@@ -0,0 +1,147 @@
+# OwnCord beta product requirements
+
+**Approved:** 2026-08-23
+**Release target:** first public beta after the `1.2.0-alpha.*` line
+**Planning model:** quality-gated, with no calendar deadline
+**Owner authority:** product decisions below are fixed; engineering may choose
+the safest and most performant implementation that satisfies them.
+
+This document records the decisions that define “beta-ready.” It is the product
+input to the repository-health issue register and phased roadmap; it is not an
+implementation checklist by itself.
+
+Companion documents:
+
+- [repository-health issue register](repo-health-issue-register-2026-08-23.md);
+- [server-first beta roadmap](repo-health-roadmap-2026-08-23.md);
+- [repository-layout audit](../audit-2026-08-23-repository-layout.md).
+
+## Release and scope
+
+| ID | Requirement |
+| ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-001 | Beta is a public GitHub release that anyone can download. |
+| BPR-002 | There is no deadline. A phase closes only when its evidence and exit gates are green. |
+| BPR-003 | Beta scope is frozen to this document. New ideas go to the post-beta backlog unless needed for security, correctness, accessibility, platform parity, or completion of an approved feature. |
+| BPR-004 | Existing alpha server data, attachments, configuration, credentials, and client settings must survive an in-place beta upgrade. |
+| BPR-005 | Unsigned payloads are deterministic where the platform permits, packaging is repeatable, and releases carry signed provenance/SBOM evidence. Checksums, signatures, update metadata, source snapshots, and the final published artifacts are verified before publication; timestamped platform signatures are not required to be byte-identical across rebuilds. |
+
+## Supported platforms and delivery
+
+| ID | Requirement |
+| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| BPR-010 | Official desktop targets are Windows x64, Windows ARM64, Linux x64, and Linux ARM64. Native Windows ARM64 validation is available; Linux ARM64 may use cross-build and emulated smoke evidence until real hardware is available. |
+| BPR-011 | The supported server matrix is Windows x64/ARM64 executables, Linux x64/ARM64 archives, and multi-architecture Docker images for `linux/amd64` and `linux/arm64`. Docker is the primary deployment path; standalone binaries remain fully tested release assets. |
+| BPR-012 | Each server is independently hosted by its owner. The project operates no official OwnCord community server or identity service. |
+| BPR-013 | Internet-facing servers commonly run directly behind port forwarding. A reverse proxy must not be required. |
+| BPR-014 | Domain names and raw public IP addresses are supported connection addresses. |
+| BPR-015 | Public domains and stable public IPs use a built-in automatic public-CA certificate lifecycle. Private LAN/offline deployments use a server-generated local CA with guided, unavoidable one-time trust installation on each browser device. Owners may instead supply a certificate explicitly; no reverse proxy or recurring manual renewal is required by the default paths. |
+| BPR-016 | Private LAN-only and fully offline deployments are first-class supported modes. Offline browser use works after local certificate trust, while internet-dependent capabilities such as closed-app Web Push clearly report that they are unavailable. |
+
+## Browser and PWA client
+
+| ID | Requirement |
+| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-020 | A server may host the browser client only when its owner explicitly enables it; it is disabled by default. |
+| BPR-021 | The browser client targets desktop parity wherever browser APIs permit. Installer, desktop updater, system tray, and native OS integrations are desktop-only. |
+| BPR-022 | Phones and tablets are official browser targets. Layout, touch input, virtual keyboards, safe areas, media constraints, and accessibility must be tested. |
+| BPR-023 | The browser client is installable as a Progressive Web App with icons, standalone presentation, and safely cached application assets. |
+| BPR-024 | Background Web Push is supported where the browser and operating system permit it. It requires explicit owner and user opt-in, uses no OwnCord-operated relay, and degrades honestly on offline or unsupported systems. |
+| BPR-025 | The desktop and browser clients share product behavior and contracts rather than becoming divergent applications. |
+
+## Capacity and compatibility
+
+| ID | Requirement |
+| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-030 | The beta reference profile supports at least 250 registered users, 100 simultaneous connections, and 25 concurrent voice participants per server, backed by published measurements on stated hardware. |
+| BPR-031 | A server owner upgrades the server before users install the corresponding client update. |
+| BPR-032 | An upgraded server supports the current advertised protocol epoch and the previous two epochs (`N/N-1/N-2`). Patch releases that retain an epoch remain compatible; prerelease and release metadata declare their epoch explicitly. The server-bundled browser client matches its server and is not an independently versioned compatibility generation. A new client is not required to support an older server. |
+| BPR-033 | Connected users receive a clear update notification and can install the compatible client release. Clients outside the compatibility window fail safely with an actionable update requirement. |
+| BPR-034 | One client connects to one server at a time. Saved profiles remain isolated and easy to switch; background multi-server aggregation is outside beta. |
+| BPR-035 | One server-local account may have multiple simultaneous device sessions, with a device/session list, new-login notice, individual revocation, and sign-out-everywhere. |
+
+## Identity, registration, and recovery
+
+| ID | Requirement |
+| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-040 | Accounts and usernames are local to each server. There is no global OwnCord identity. |
+| BPR-041 | New servers default to invite-only registration. Owners may explicitly enable approval-based or open registration. |
+| BPR-042 | All messages, files, calls, and moderation features require an authenticated account. Anonymous guest access is outside beta. |
+| BPR-043 | Email is optional. Registration and recovery work without SMTP or any central service. |
+| BPR-044 | Account recovery uses a locally generated recovery kit whose server-side secrets are stored only in protected, non-reversible form and rotate after use. |
+| BPR-045 | Administrators may issue short-lived recovery credentials after local identity verification. Recovery revokes affected sessions and creates a safe audit record. |
+| BPR-046 | Existing TOTP multi-factor authentication and emergency recovery codes remain supported beta features. Optional SMTP recovery may be enabled, but SMTP and all external services remain nonessential to registration, login, and local recovery. Security questions are prohibited. |
+
+## Privacy, deletion, and retention
+
+| ID | Requirement |
+| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| BPR-050 | OwnCord follows Discord's hybrid privacy model: text and files are available to the trusted server for delivery, search, moderation, and backup; voice, video, and screen sharing are end-to-end encrypted between participants. |
+| BPR-051 | The server-operator trust model is disclosed plainly. Transport and at-rest controls do not claim to hide stored text or files from the machine owner. |
+| BPR-052 | Account deletion erases the user's profile, credentials, sessions, messages, reactions, uploads, and other authored data rather than leaving attributed or anonymized content behind. |
+| BPR-053 | Necessary integrity records retain no identifying or content data after deletion. Immutable moderation/audit history survives only as an unlinkable event category, time, action class, and integrity proof after the subject mapping is cryptographically erased. Durable deletion markers prevent a later backup restore from silently resurrecting erased data. |
+| BPR-054 | Message history is retained indefinitely by default. Owners may configure automatic retention at server or channel scope, with corresponding attachment cleanup. |
+| BPR-055 | OwnCord sends no automatic product or usage telemetry. Diagnostics remain local and support-bundle export is user initiated. Any future crash reporting is explicit opt-in. |
+
+## Messaging, content, and safety
+
+| ID | Requirement |
+| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-060 | First-time direct messages enter a Message Requests inbox. A recipient may safely preview, accept, ignore, delete, or block; acceptance establishes a server-local trusted-sender relationship. |
+| BPR-061 | Link previews, GIF search, YouTube/media embeds, and existing rich external content remain supported and must meet the beta security, privacy, accessibility, failure-state, and performance gates. Provider expansion beyond the existing set is optional and otherwise post-beta. |
+| BPR-062 | Automatic external retrieval uses privacy-preserving, resource-bounded, SSRF-resistant boundaries with strict redirect, address, type, size, time, concurrency, cache, and offline behavior. |
+| BPR-063 | Owner-designated NSFW channels remain supported. They require explicit labels and per-user acknowledgement, with concealed previews and no automatic third-party media loading before consent. |
+| BPR-064 | English is the only officially supported beta language. User-facing text is organized so community translations can be added later without a rewrite. |
+
+## Moderation
+
+| ID | Requirement |
+| ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-070 | Users can report messages, users, and attachments to that server's local moderators. There is no central OwnCord moderation service. |
+| BPR-071 | Desktop, browser, and PWA clients contain a permission-gated Moderation Center for the report queue, evidence and surrounding context, assignment, status, internal notes, actions, and immutable audit history. |
+| BPR-072 | Day-to-day moderator actions include warning, timeout, content removal, kick, and ban according to narrowly assigned role permissions. Operational TLS, backup, and update controls remain owner-only. |
+| BPR-073 | Moderated users can submit a rate-limited in-app appeal to local moderators and receive status updates. Appeal decisions are audited. |
+
+## Extensions and deferred systems
+
+| ID | Requirement |
+| ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-080 | The WASM plugin runtime remains experimental and disabled by default. No beta plugin API compatibility promise is made because no supported plugins exist yet. |
+| BPR-081 | The audit identifies cohesive features and provider integrations that could become plugins later, without moving them behind the experimental runtime during beta. |
+| BPR-082 | Server federation, cross-server messaging, and federation-specific architecture work are outside beta. The idea may be reconsidered only after the beta codebase and operations are healthy. |
+| BPR-083 | There is no centralized public server directory. Owners distribute addresses and invite links themselves. |
+
+## Client experience and accessibility
+
+| ID | Requirement |
+| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-090 | Preserve OwnCord's recognizable visual identity and familiar workflows while improving consistency, responsiveness, accessibility, and performance. A wholesale visual rebrand is outside beta. |
+| BPR-091 | Accessibility is a release property across keyboard, pointer, touch, screen reader, reduced-motion, contrast, focus, zoom, and responsive layouts—not a later cosmetic pass. |
+| BPR-092 | Browser limitations and offline states are explicit. The UI does not present unavailable media, push, update, or network behavior as functional. |
+
+## Community and governance
+
+| ID | Requirement |
+| ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-100 | GitHub Issues is the official bug tracker; GitHub Discussions hosts support, ideas, and community feedback. |
+| BPR-101 | Vulnerabilities use private GitHub security reporting and are not disclosed through public issues before coordinated remediation. |
+| BPR-102 | Community pull requests are welcome. Contributor documentation defines setup, scope, quality gates, generated files, review expectations, and safe security reporting. |
+| BPR-103 | Repository layout and contributor experience are audited before implementation. A restructure occurs only when evidence shows a durable improvement and is performed as an isolated, migration-safe phase. |
+
+## Engineering-controlled choices
+
+Within these product boundaries, implementation details such as cryptographic
+libraries, data structures, cache policy, browser/version matrix, performance
+budgets, backup schedule, CI topology, branch automation, module boundaries,
+and release mechanics are chosen for security, maintainability, and measured
+performance. Material tradeoffs and accepted risks must still be recorded.
+
+## Explicitly outside beta
+
+- server federation and cross-server identity;
+- native macOS, iOS, or Android applications;
+- more than one active server connection per client;
+- anonymous guest access or a public server directory;
+- a stable third-party plugin API or bundled third-party plugins;
+- an OwnCord-operated hosting, identity, telemetry, push, or moderation service;
+- unrelated feature expansion after this scope freeze.
diff --git a/docs/plans/beta-requirements-traceability-2026-08-23.md b/docs/plans/beta-requirements-traceability-2026-08-23.md
new file mode 100644
index 00000000..79a0e96d
--- /dev/null
+++ b/docs/plans/beta-requirements-traceability-2026-08-23.md
@@ -0,0 +1,187 @@
+# OwnCord beta requirement traceability
+
+**Prepared:** 2026-08-23
+**Requirements source:**
+[beta-product-requirements-2026-08-23.md](beta-product-requirements-2026-08-23.md)
+**Execution source:**
+[public-beta roadmap](repo-health-roadmap-2026-08-23.md)
+**Structural input:**
+[repository-layout audit](../audit-2026-08-23-repository-layout.md)
+**Current status:** all 57 requirements are mapped; none is release-qualified
+
+## How to use this document
+
+- The primary phase owns the implementation invariant, coordinates any
+ downstream consumers, and records the first acceptance evidence.
+- A phase range means every earlier exit gate in that range is a prerequisite.
+- Some server-owned requirements need later client proof. Those rows name B7,
+ B8, or B9 evidence explicitly and remain open until that proof exists.
+- B10 repeats every applicable verification against one immutable release
+ candidate. Earlier green evidence cannot substitute for release evidence.
+- Security-sensitive proof is linked from a private advisory. The public row
+ records only the security property, test category, and pass/fail status.
+- The canonical product wording remains in the requirements source. Short
+ labels here are navigation aids, not replacements.
+
+## Phase ownership
+
+| Phase | Primary requirement IDs |
+| ---------------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| B0 — truth and scope | BPR-002, BPR-003 |
+| B1 — repository and contributor foundation | BPR-100, BPR-101, BPR-102, BPR-103 |
+| B2 — server protocol, trust, and compatibility | BPR-031, BPR-032, BPR-040, BPR-050, BPR-051, BPR-080, BPR-081, BPR-082, BPR-083 |
+| B3 — server architecture and guardrails | No direct product requirement; mandatory prerequisite for B4–B10 |
+| B4 — identity, recovery, privacy, and data lifecycle | BPR-041, BPR-042, BPR-043, BPR-044, BPR-045, BPR-046, BPR-052, BPR-053, BPR-054, BPR-055 |
+| B5 — community, content, and moderation services | BPR-060, BPR-061, BPR-062, BPR-063, BPR-070, BPR-071, BPR-072, BPR-073 |
+| B6 — deployment, operations, and capacity | BPR-011, BPR-012, BPR-013, BPR-014, BPR-015, BPR-016, BPR-030 |
+| B7 — shared client platform and desktop parity | BPR-033, BPR-034, BPR-035 |
+| B8 — browser, PWA, phone, and tablet | BPR-020, BPR-021, BPR-022, BPR-023, BPR-024, BPR-025 |
+| B9 — unified UX, accessibility, and polish | BPR-064, BPR-090, BPR-091, BPR-092 |
+| B10 — qualification and release | BPR-001, BPR-004, BPR-005, BPR-010; final proof for every row |
+
+## Release and scope
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | -------------------------------------- | ------------- | ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-001 | Public GitHub beta | B10 | B0–B9; BPR-005 and BPR-010 | Public release points to the qualified tag; an unauthenticated user can download every declared asset; install/cold-boot smoke succeeds; release page, source, checksums, signatures, SBOM, provenance, and support links agree. |
+| BPR-002 | No deadline; evidence gates | B0 | Approved requirements | Every phase template omits calendar-based completion, records exact-SHA evidence, and blocks closure when any exit row is red or unavailable. B10 confirms all phase scorecards are green. |
+| BPR-003 | Frozen beta scope | B0 | Approved requirements; canonical issue intake | Issue/Discussion triage maps work to a BPR or post-beta label; phase diffs show no unapproved feature; any exception records why it is required for security, correctness, accessibility, parity, or an approved feature. |
+| BPR-004 | In-place alpha-to-beta upgrade | B10 | B2 protocol; B4 migrations/deletion markers; B6 deployment/backup; B7 client settings | Upgrade representative alpha Docker and standalone datasets to the RC and verify row/file/config/credential/attachment/client-setting checksums and behavior; rehearse interrupted upgrade, restart, backup restore, and declared rollback without loss. |
+| BPR-005 | Deterministic, signed release evidence | B10 | B1 release gates; B6 supply chain; B7/B8 artifacts | Rebuild unsigned payloads twice where the platform permits and compare; repeat packaging; verify timestamped-signature exception; validate checksums, signatures, update metadata, source snapshot, signed SBOM/provenance, cold boot, and exact published bytes. |
+
+## Supported platforms and delivery
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | --------------------------------------- | ------------- | ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-010 | Four desktop targets | B10 | B6 server artifacts; B7 desktop; B8/B9 shared-client qualification | Windows x64, native Windows ARM64, Linux x64, and Linux ARM64 packages build and pass install, boot, connect, media, update, rollback, and recovery smoke. Linux ARM64 evidence states whether it is cross-build/emulated or real hardware. |
+| BPR-011 | Complete server artifact matrix | B6 | B1 CI/release foundation; B3 lifecycle | Windows x64/ARM64 executables, Linux x64/ARM64 archives, and Docker linux/amd64 plus linux/arm64 are published from one commit; every artifact cold-boots, migrates, reports healthy, serves traffic, drains, restarts, and preserves data. |
+| BPR-012 | Independently owner-hosted | B6 | B2 central-dependency audit; B4 local identity/recovery | Fresh deployment, registration, login, messaging, moderation, update verification, recovery, and backup work without an OwnCord account/service; controlled network capture shows no undeclared central dependency. |
+| BPR-013 | No required reverse proxy | B6 | B2 trust contracts; B6 TLS configuration | Domain and public-IP deployments work through documented direct port forwarding with the built-in TLS path; a clean install contains no reverse-proxy prerequisite; blocked-port/CGNAT limits fail actionably. |
+| BPR-014 | Domain and raw public IP | B6 | BPR-013; certificate-mode design | Automated integration covers DNS name, eligible stable IPv4, and eligible stable IPv6 origins through HTTPS/WSS, reconnect, update, and browser-origin checks; address changes and unsupported cases are explicit. |
+| BPR-015 | Automatic public CA and guided local CA | B6 | B2 trust model; protected persistent configuration | ACME staging covers public domain and eligible public IP issue/renew/expiry/hot reload; LAN/offline covers local-CA generation, fingerprint, one-time trust install, rotation, and removal on supported browser devices; owner-supplied certificate mode also passes. |
+| BPR-016 | LAN-only and fully offline | B6 | BPR-015; B4 local recovery; B5 offline service behavior | After local trust, server and client cold-boot, authenticate, message, call where local media permits, back up, restore, and update from local artifacts with internet blocked; internet-dependent push/provider features report unavailable without retry storms. |
+
+## Browser and PWA client
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | ---------------------------------------- | ------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-020 | Optional server-hosted browser client | B8 | B6 default-off host/origin contract; B7 web contract build | Clean server exposes no browser application while disabled; owner enablement serves the version-matched signed bundle; disable removes access without affecting API/desktop; upgrade and rollback keep the setting and bundle consistent. |
+| BPR-021 | Browser desktop parity within API limits | B8 | B5 services; B7 shared contracts; BPR-020 | Requirement-journey comparison passes on desktop and supported browsers; every intentional difference has an API-based rationale and honest UI; installer, updater, tray, and native integrations remain desktop-only. |
+| BPR-022 | Phone and tablet browser support | B8 | B7 contracts; responsive navigation design; BPR-021 | Real Android phone/tablet and iPhone/iPad plus automation cover navigation, touch targets, virtual keyboard, safe areas, orientation, zoom/reflow, media constraints, screen reader, and recovery/moderation workflows. |
+| BPR-023 | Installable PWA | B8 | BPR-020; secure origin; cache policy | Manifest/icons/standalone launch pass installability checks; service worker is correctly scoped; only approved application assets cache; version change, stale cache, offline fallback, logout, and server rollback do not expose messages, credentials, attachments, or moderator evidence. |
+| BPR-024 | Opt-in Web Push without OwnCord relay | B8 | B5 per-server push backend; B6 HTTPS; BPR-023 | Owner-disabled, user-denied, subscribed, revoked, expired, 404/410 cleanup, VAPID rotation, click routing, offline, iOS installed-PWA, and unsupported cases pass; default payload is generic and network inspection shows no OwnCord relay. |
+| BPR-025 | One shared product and contracts | B8 | B1 target layout; B7 platform contracts; BPR-021 | Static checks keep native imports inside desktop ownership; the same domain/store/protocol suites run against desktop and browser adapters; no copied feature implementation or independently versioned browser protocol exists. |
+
+## Capacity and compatibility
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | -------------------------------------- | ------------- | --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-030 | 250/100/25 reference profile | B6 | B3 benchmarks/simulation; B5 completed services | Reproducible load run on stated hardware sustains 250 registered users, 100 simultaneous connections, and 25 concurrent voice participants; publish configuration, duration, p50/p95/p99 latency, errors, CPU, memory, disk/database waits, network, reconnect, and recovery behavior. |
+| BPR-031 | Server upgrades first | B2 | B1 protocol owner and release metadata | Update-state tests prove the old server never directs users to an incompatible new client; server upgrade exposes signed compatible-client metadata; operator and client wording describes the sequence. |
+| BPR-032 | Protocol epochs N/N-1/N-2 | B2 | B1 generated protocol gate; BPR-031 | Fixtures for epochs N, N-1, and N-2 connect and exercise required journeys; N-3 rejects safely; patch versions within an epoch interoperate; prerelease/release metadata declares epoch; bundled browser version always matches server. |
+| BPR-033 | Update notice and safe incompatibility | B7 | BPR-031 and BPR-032; signed update metadata | Connected clients in-window receive a clear notice and can verify/install the compatible release; incompatible clients show an actionable non-destructive requirement; tampered, missing, offline, rollback, and user-deferral cases pass. |
+| BPR-034 | One active server connection | B7 | BPR-040; isolated profile storage; platform contracts | Instrumented unit/E2E tests prove only one live server transport/media session exists; switching tears down old resources, isolates credentials/cache/notifications, preserves profiles, and never aggregates background servers. |
+| BPR-035 | Multiple device sessions | B7 | B4 session inventory/revocation and login events; BPR-034 | Two or more devices remain active for one account; list labels/current-device state are correct; new-login notice appears; individual revoke affects only its target; sign-out-everywhere revokes all tokens and live connections. |
+
+## Identity, registration, and recovery
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | ------------------------------------------------- | ------------- | ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-040 | Server-local accounts | B2 | B1 protocol boundary; no central identity | The same username can represent unrelated identities on two servers; credentials, sessions, recovery, profiles, and moderation never cross; dependency/network audit finds no global identifier or OwnCord identity lookup. |
+| BPR-041 | Invite-only default, optional approval/open | B4 | B3 configuration/domain boundaries; BPR-040 | Fresh install is invite-only; valid/expired/revoked/concurrent invite tests pass; explicit transitions to approval/open and back are audited; upgrade preserves the owner's chosen mode without silently opening registration. |
+| BPR-042 | Authentication required; no guests | B4 | B2 canonical auth/authz; BPR-041 | Anonymous requests and sockets cannot message, upload, call, report, moderate, or fetch protected data; revoked/expired/partial sessions fail uniformly; UI and public docs expose no guest path. |
+| BPR-043 | Email optional and no central recovery dependency | B4 | BPR-040; local recovery design | Registration, login, recovery, device revocation, and administration pass with SMTP unset and internet blocked; optional email absence never blocks account creation or local recovery. |
+| BPR-044 | Rotating local recovery kit | B4 | B3 secret-storage guardrails; BPR-043 | Kit generation/recovery/replay/concurrency/restart tests prove only protected non-reversible server material is stored; one successful use rotates/invalidates it; logs, audit, backup, and support bundles contain no usable secret. |
+| BPR-045 | Admin-assisted short-lived recovery | B4 | BPR-044; canonical audit/session revocation | Issuance requires authorized admin and recorded local-verification decision; credential expires, is single-use and rate-limited; success revokes affected sessions; unauthorized, replay, concurrent, restart, and audit-redaction tests pass. |
+| BPR-046 | TOTP, emergency codes, optional SMTP | B4 | BPR-043–BPR-045; current MFA migration fixtures | Existing TOTP and emergency recovery codes survive upgrade/restart and pass enrollment, verification, replay, rotation, exhaustion, clock-skew, revocation, and recovery tests; SMTP failure cannot block local paths; configuration/UI contain no security questions. |
+
+## Privacy, deletion, and retention
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | -------------------------------------------------- | ------------- | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-050 | Hybrid privacy and media E2EE | B2 | B1 protocol ownership; private threat model | Storage inspection confirms the trusted server can deliver/search/moderate/backup text and files; authenticated media interoperability and adversarial membership/rekey/removal tests demonstrate participant E2EE for voice, video, and screen share; docs state the boundary accurately. |
+| BPR-051 | Plain server-operator trust disclosure | B2 | BPR-050; B1 docs source of truth | Setup, privacy, backup, moderator, and client disclosures say the machine owner can access stored text/files and distinguish transport/at-rest controls from E2EE; technical review and user comprehension check find no contradictory claim. |
+| BPR-052 | Erase all user-authored data | B4 | B3 data ownership inventory; BPR-042; backup fixtures | Deletion traverses profile, credentials, sessions, messages, reactions, uploads, thumbnails/cache, request/report references, and every later data class; pre/post database and storage inventory is empty for the subject; interruption resumes safely; B7/B9 UI confirms impact and completion. |
+| BPR-053 | Unlinkable integrity history and anti-resurrection | B4 | BPR-052; cryptographic mapping and backup design | After deletion, audit/moderation rows retain only allowed event category, time, action class, and integrity proof; subject/content mapping key is cryptographically erased; correlation attempts fail; restore of an older backup reapplies the durable deletion marker and cannot resurrect data. |
+| BPR-054 | Indefinite default and configurable retention | B4 | B3 scheduler/lifecycle; BPR-052/BPR-053 | Fresh and upgraded servers default to indefinite history; server/channel policies handle precedence, clock boundaries, restart, batches, attachments, cache/search, reports/audit, deletion, and disk pressure; owner UI/docs preview and confirm effects. |
+| BPR-055 | No automatic telemetry | B4 | B1 dependency inventory; local diagnostics design | Network capture across install, startup, use, crash, update check, offline, and support workflows shows no automatic product/usage reporting; support bundle requires user action and passes secret/content review; any future crash option defaults off and records consent. |
+
+## Messaging, content, and safety
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | --------------------------------------- | ------------- | ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-060 | Message Requests | B5 | B4 identity/block/deletion/retention; B3 state-machine guardrails | Server state/property tests cover pending, safe preview, accept, ignore, delete, block, races, reconnect, multi-device, retention, and deletion; B9 desktop/browser/mobile E2E proves inbox UX and that only acceptance creates server-local trust. |
+| BPR-061 | Preserve existing rich content safely | B5 | BPR-062; current provider/feature inventory | Existing link preview, GIF search, YouTube/media embed, and rich-content journeys pass security, privacy, accessibility, offline/failure, and performance budgets on B9 clients; provider expansion is not required and any new provider maps to post-beta unless separately justified. |
+| BPR-062 | Bounded privacy-safe external retrieval | B5 | B2 trust model; B3 bounded-work guardrails | Private adversarial suite covers DNS rebinding/resolution, IPv4/IPv6/private addresses, redirect chains, type sniffing, compressed/streamed size, timeout, concurrency, cache partition/expiry, residual buffering, cancellation, and offline behavior for every fetch path. |
+| BPR-063 | NSFW consent before load | B5 | BPR-062; per-user preference/authz storage | Server and B9 client tests prove explicit owner label plus per-user acknowledgement; previews stay concealed; network inspection confirms content and third-party media are not requested before consent; revoke, new device, logout, accessibility, and moderator cases pass. |
+| BPR-064 | English-only, translation-ready | B9 | B7/B8 shared UI; frozen beta strings | All user-facing strings are inventoried behind translation-ready boundaries with no required second language; dynamic/plural/error/accessibility strings are covered; static scan finds unjustified hard-coded UI text; layout tolerates representative expansion. |
+
+## Moderation
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | ---------------------------------- | ------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| BPR-070 | Local reports only | B5 | B4 identity/deletion/retention; B2 permissions | Authenticated users can report message/user/attachment to their own server; cross-server/central delivery is impossible; duplicate/rate-limit/block/deleted-target/access-control tests pass; B9 clients expose the flows without leaking reporter/evidence. |
+| BPR-071 | Permission-gated Moderation Center | B5 | BPR-070; B2 audit/authz; B7/B8 clients | Service tests cover queue, evidence/context, assignment, status, notes, action links, immutable history, retention, and deletion unlinking; B9 desktop/browser/PWA E2E proves permitted roles see correct data and all others see none. |
+| BPR-072 | Narrow moderator actions | B5 | BPR-071; canonical effective permissions | Role matrix and adversarial tests cover warning, timeout, removal, kick, ban, hierarchy, self/peer/owner targets, concurrent changes, voice/text effects, and audit; B9 UI hides/blocks unauthorized actions; TLS/backup/update remain owner-only. |
+| BPR-073 | Rate-limited local appeals | B5 | BPR-071/BPR-072; B4 rate limits/notifications | State/property tests cover submission, rate limit, assignment, status, decision, notification, repeat/closed/blocked users, deletion, retention, and audit; B9 clients show only authorized appeal content and accurate status. |
+
+## Extensions and deferred systems
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | ------------------------------------- | ------------- | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-080 | Experimental WASM disabled by default | B2 | B1 artifact provenance; configuration audit | Fresh, upgraded, Docker, and standalone configurations leave WASM disabled; release/docs/UI mark it experimental with no compatibility promise; example WASM is reproducible or provenance-verified; enabling requires explicit owner action. |
+| BPR-081 | Identify future plugin candidates | B2 | B0 audit; B3 boundary inventory | Architecture note lists cohesive candidates and why they are separable, while explicitly keeping auth/authz, TLS, safe fetch, quota, E2EE, updater, deletion, recovery, and moderation audit in core; no beta feature is moved to WASM. |
+| BPR-082 | No federation in beta | B2 | B0 scope freeze; BPR-040 | Protocol/API/config/release review finds no federation, cross-server identity, or cross-server messaging feature; plans/issues route the idea post-beta; generic work is accepted only when justified by a current non-federation requirement. |
+| BPR-083 | No centralized public directory | B2 | BPR-012 and BPR-040 | Server/client/config/network review finds no automatic listing, discovery submission, central browse/search, or OwnCord directory dependency; owner-shared addresses and invite links pass connect/onboarding tests. |
+
+## Client experience and accessibility
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | ------------------------------------ | ------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| BPR-090 | Preserve and polish OwnCord identity | B9 | B7 desktop baseline; B8 responsive client; design tokens | Visual regression and owner review show recognizable navigation/identity and familiar workflows across targets; consistency, responsiveness, accessibility, startup, interaction, and bundle budgets improve or meet accepted baselines; no wholesale rebrand. |
+| BPR-091 | Accessibility is release-blocking | B9 | B7 semantic foundations; B8 mobile/browser behavior | Automated accessibility plus manual keyboard, pointer, touch, screen reader, reduced-motion, contrast, focus, zoom/reflow, virtual-keyboard, safe-area, error/announcement, and media-control checks pass every critical journey on supported targets. |
+| BPR-092 | Honest browser/offline limitations | B9 | B6 deployment modes; B8 capability detection | Browser/device/network matrix verifies unavailable media, push, screen capture, updater, native integration, certificate, and offline behavior is disabled or explained actionably; no control falsely reports success; recovery after capability/network return passes. |
+
+## Community and governance
+
+| ID | Short label | Primary phase | Prerequisites | Minimum verification and closure evidence |
+| ------- | ------------------------------------------- | ------------- | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BPR-100 | Issues for bugs; Discussions for community | B1 | B0 scope/intake model | Repository navigation, issue forms, blank-issue policy, Discussions links, support links, and contribution docs route bugs to Issues and support/ideas/feedback to Discussions; dry-run submissions reach the intended destination. |
+| BPR-101 | Private coordinated vulnerability reporting | B1 | B0 private/public handling; repository security settings | Security policy and forms point to private GitHub reporting; public templates warn against disclosure; permissions and a tabletop report prove private receipt, triage, advisory, fix, coordinated disclosure, and safe public status. |
+| BPR-102 | Community pull requests supported | B1 | B0 gates; root command facade | A fresh Windows and Linux contributor follows docs to bootstrap, run scoped/full checks, understand scope/generated files/review/security rules, and submit a passing sample change; CI feedback matches local commands. |
+| BPR-103 | Evidence-based isolated restructure | B1 | Layout audit; green B0 baseline | Targeted migration uses adjacent pure-move and mechanical-path-rewrite commits, preserves release names/desktop behavior/history, proves all active references and generated ownership, and passes the complete exact-SHA matrix; no wholesale repository/server rewrite occurs. |
+
+## Cross-cutting qualification rule
+
+A row may be marked:
+
+- planned: prerequisites or implementation have not started;
+- in progress: the primary phase owns active work;
+- implemented, awaiting downstream proof: the server/core invariant is green
+ but a named client or deployment journey is not;
+- phase-verified: all evidence named in the row is green on that phase commit;
+- release-qualified: B10 repeated the evidence on the immutable release
+ candidate.
+
+Only release-qualified satisfies beta. No row is release-qualified at the
+audited head; implementation maturity ranges from an existing partial
+foundation to entirely absent and must be refreshed during B0.
+
+## Completeness check
+
+The map contains exactly the approved IDs:
+
+- BPR-001 through BPR-005;
+- BPR-010 through BPR-016;
+- BPR-020 through BPR-025;
+- BPR-030 through BPR-035;
+- BPR-040 through BPR-046;
+- BPR-050 through BPR-055;
+- BPR-060 through BPR-064;
+- BPR-070 through BPR-073;
+- BPR-080 through BPR-083;
+- BPR-090 through BPR-092;
+- BPR-100 through BPR-103.
+
+Gaps in the numeric sequence are intentional category spacing, not missing
+requirements.
diff --git a/docs/plans/repo-health-issue-register-2026-08-23.md b/docs/plans/repo-health-issue-register-2026-08-23.md
new file mode 100644
index 00000000..a82242d5
--- /dev/null
+++ b/docs/plans/repo-health-issue-register-2026-08-23.md
@@ -0,0 +1,330 @@
+# OwnCord repository-health issue register
+
+**As of:** 2026-08-23
+**Audited head:** `5cc0888964e26276d1aca145e83270a2c1b9febd` (`dev`)
+**Release target:** first public beta, quality-gated with no calendar deadline
+**Purpose:** exhaustive, public-safe planning index for bringing the server,
+desktop client, browser/PWA client, repository, and release process to the
+approved beta bar.
+
+Companion documents:
+
+- [Beta product requirements](beta-product-requirements-2026-08-23.md)
+- [Repository-layout audit](../audit-2026-08-23-repository-layout.md)
+- [Phased beta roadmap](repo-health-roadmap-2026-08-23.md)
+
+This document is a planning view, not a replacement for
+`.superpowers/findings-ledger.json`. The ledger remains authoritative for
+`OC-*` finding status. Security-sensitive reproduction detail belongs in a
+private GitHub Security Advisory; this public register contains only opaque
+work packages and non-sensitive acceptance criteria.
+
+## Overall status
+
+**OwnCord is not beta-ready at this audited head.** The server has a strong
+tested foundation, but security remediation, compatibility, deployment,
+capacity, identity, recovery, deletion, retention, and moderation work remain.
+The desktop client has broad automated coverage, but its required unit-coverage
+gate is red and its full Playwright run does not terminate. The approved
+browser/PWA/phone/tablet client is mostly not implemented.
+
+| Surface | Evidence at the audited head | Health conclusion |
+| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ |
+| Server builds | Default, OpenTelemetry, Wazero, and combined build-tag variants pass; `go vet` passes | Strong |
+| Server behavior | Full race suite, deadlock suite, and tagged tests pass; CI-style aggregate coverage is 74.6% | Strong, with missing coverage/performance gates |
+| Server local limitations | Docker daemon was unavailable; local `golangci-lint` could not load because its Go 1.26.5 build mismatched the module's Go 1.26.7 toolchain | CI/container evidence still required for the exact SHA |
+| Client static/build | App and E2E typechecks, ESLint, Prettier, Knip, production dependency audit, Vite build, Rust Clippy, and 115 Rust tests pass | Healthy foundation |
+| Client unit coverage | 5,255 tests pass and 2 fail (`message-list` and `noise-suppression-restart`) | Required gate red |
+| Client browser tests | Three Chromium browser tests pass | Useful but too narrow |
+| Client Playwright | All 293 test start markers appeared with no reported assertion failure, but the run never exited; an isolated five-test voice-widget run also hung | Cannot be claimed green |
+| Client bundles | Build succeeds, but RNNoise/live-session output is about 2.0 MB minified / 1.345 MB gzip and Vite reports oversized/dynamic-import warnings | Performance work required |
+| Browser/PWA/mobile | No standalone browser production target, optional server hosting, PWA, Web Push, or beta-quality phone/tablet navigation exists | Major beta capability gap |
+| Security | A private current-HEAD source review identified unresolved security-boundary work; public tracking uses opaque remediation families while detailed evidence remains private | Beta blocker; details remain private |
+| Repository/release | Exact `dev` SHA has no Actions run; supported ARM64 and multi-architecture release coverage is incomplete | Beta blocker |
+
+## Classification and counting rules
+
+Priority:
+
+- **P0:** a required gate is red or the audited integration cannot be released.
+- **P1:** close before beta; security, authorization, data safety, compatibility,
+ or major reliability/release risk.
+- **P2:** scheduled architecture, performance, accessibility, operational, or
+ contributor-experience debt.
+- **P3:** low-risk cleanup, monitoring, or an explicitly recorded decision.
+
+State:
+
+- **confirmed:** reproduced, validated, or directly observed at the audited head.
+- **verify:** credible evidence exists, but a focused reproduction is required.
+- **decision:** the owner must select and record one supported direction.
+- **watch:** an upstream or accepted risk has no demonstrated reachable defect.
+- **resolved/superseded:** the original observation is no longer current; a
+ broader active item owns any remaining work.
+
+The tables deliberately separate four kinds of work. They must not be added
+together as if each row were a unique defect:
+
+1. `OC-*` rows are the canonical open defect ledger.
+2. `G/C/S/R/L-*` rows are audit work packages, guardrails, or architecture debt.
+3. `SEC-*` rows are opaque security-remediation families; duplicates are
+ explicitly named.
+4. `BG-*` rows are approved beta capabilities that are absent or incomplete,
+ not regressions in an already-complete feature.
+
+## Canonical findings-ledger truth
+
+| Status | Count |
+| --------- | ------: |
+| Fixed | 306 |
+| Open | 38 |
+| Declined | 3 |
+| Duplicate | 1 |
+| **Total** | **348** |
+
+All 38 open records are listed below. Closing a planning row does not close an
+`OC-*` record: the implementation, regression test, focused verification, full
+required gates, and ledger update must land together.
+
+## Immediate gate and truth issues
+
+| ID | Pri | State | Issue and evidence | Phase | Closure evidence |
+| ---- | --: | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| G-01 | P0 | confirmed | `message-list.test.ts` expects zero abort registrations while current row-scoped cancellation registers five; the full coverage run fails. | B0 | Test states the intended row-lifetime invariant, proves the historical leak shape, and passes in the complete Node 24/Vitest 4 run. |
+| G-02 | P0 | confirmed | `noise-suppression-restart.test.ts` supplies a non-constructible arrow-function mock for `MediaStream`; Vitest 4 rejects it. | B0 | Constructible test double, meaningful RED proof, and complete coverage run green. |
+| G-03 | P0 | confirmed | Current `dev` SHA has no Actions run because ordinary `dev` pushes are not covered by the complete push matrix. This is the canonical owner for layout finding RL-14. | B0/B1 | Every integration SHA receives the protected full blocking matrix; this exact SHA or its superseding remediation SHA is green. |
+| G-04 | P1 | confirmed | The ledger now correctly exposes 38 open items, but older plans/snapshots still claim zero open or leave shipped phases pending. | B0/B1 | Active-plan index identifies current, complete, and superseded documents; automated checks prevent conflicting status/count claims. |
+
+## Canonical open defect ledger
+
+The wording below is intentionally concise. The ledger contains the detailed
+evidence, reproduction, and suggested fix for each record.
+
+| ID | Sev | Area | Public-safe defect summary | Phase | Required closure evidence |
+| ------- | ------ | ----------------------- | --------------------------------------------------------------------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------ |
+| OC-0311 | Medium | Client voice/E2EE | A leave event from another readable voice channel can mutate the active call's peer-key state. | B2/B7 | Scope leave handling to the active channel and cover reordered leave/join/replay sequences. |
+| OC-0312 | Medium | Client PTT | Binding push-to-talk during a call can clear mute ownership before the deferred mute applies, leaving PTT unusable. | B7 | Preserve the PTT ownership transition atomically and test mid-call binding/restart. |
+| OC-0313 | Medium | Client profiles | Legacy per-user volume fallback is repeatedly copied across server profiles instead of being consumed once. | B4/B7 | One-time scoped migration, legacy-key removal, and cross-server isolation tests. |
+| OC-0314 | Medium | Client identity | The client discards the server's partial-success warning when a credential change succeeds but session revocation does not. | B4/B9 | Surface warnings for password/TOTP changes with an action to review sessions; test all affected endpoints. |
+| OC-0315 | Medium | Client replay | Replay-gate timestamps mix naive UTC server values with local wall-clock parsing. | B2/B7 | One UTC parsing contract and timezone-varied replay boundary tests. |
+| OC-0316 | Medium | Server/client E2EE | WebSocket resume restores peer public keys but not a room key rotated during the outage. | B2/B7 | Resume re-establishes the current room key and the security indicator cannot claim success prematurely; rotation/outage test passes. |
+| OC-0317 | Medium | Client DM state | The replay path can regress a DM's `lastMessageId`, undermining duplicate-count protection. | B2/B7 | Monotonic last-message updates with duplicate, out-of-order, and reconnect tests. |
+| OC-0318 | Medium | Server plugins | Install-time and restart-time plugin manifest precedence differs between JSON and TOML. | B2 | One canonical manifest contract or explicit ambiguity rejection; install/restart parity test. |
+| OC-0319 | Medium | Client accessibility | The Large Font preference is overridden by a higher-priority inline font-size value. | B9 | Verified text-scale change across restart, zoom, responsive layouts, and accessibility checks. |
+| OC-0320 | Medium | Server updater | Server self-update selects Linux AMD64 independently of the running architecture. | B6/B10 | Architecture-aware manifest selection and signed update/rollback smoke on every supported server target. |
+| OC-0321 | Medium | Server TOTP | A TOTP key-file read failure can be treated as absence and lead to key replacement. | B4 | Generate only on confirmed non-existence; all other read errors fail closed without modifying the file. |
+| OC-0322 | Low | Client connection | TypeScript host validation accepts a hostname form rejected by the native proxy. | B2/B7 | Shared validation corpus produces identical browser, desktop, and Rust decisions. |
+| OC-0323 | Low | Server unread state | Mark-read/channel-focus can overwrite a mention count from a newer message using a stale snapshot. | B3/B5 | Atomic/monotonic read-state update with concurrent-message regression coverage. |
+| OC-0324 | Low | Server auth | Login rate-limit identity folding differs from SQLite account lookup semantics. | B4 | Account lookup and limiter use one tested canonical identity rule, including Unicode collision cases. |
+| OC-0325 | Low | Client search | Search results parse naive UTC timestamps as local time. | B7/B9 | Shared UTC parser and timezone/day-boundary rendering tests. |
+| OC-0326 | Low | Client pins | Pinned-message timestamps parse naive UTC values as local time. | B7/B9 | Shared UTC parser and timezone/day-boundary rendering tests. |
+| OC-0327 | Low | Server voice moderation | Server mute/deafen also affects screen-share audio contrary to the product contract. | B5 | Effective moderation applies only to intended media sources; SFU and client-policy tests agree. |
+| OC-0328 | Low | Client unread state | Channel badges lack the message-ID replay guard already used by DMs. | B2/B7 | Monotonic channel replay guard with duplicate/out-of-order/reconnect tests. |
+| OC-0329 | Low | Client privacy | Legacy DM profile notes fall back across servers indefinitely. | B4/B7 | One-time server-scoped migration, old-key removal, and cross-server privacy test. |
+| OC-0330 | Low | Client pins | Pinned messages discard author identity and therefore cannot resolve nicknames. | B7/B9 | Preserve author ID and render the same display identity as ordinary messages. |
+| OC-0331 | Low | Server admin UI | API-token Created/Last Used values parse naive UTC timestamps as local time. | B6/B9 | Shared UTC contract and timezone/day-boundary admin tests. |
+| OC-0332 | Low | Client updater | Bare IPv6 server addresses produce an invalid updater URL. | B6/B10 | Central URL builder brackets IPv6 literals and passes domain/IPv4/IPv6/update smoke tests. |
+| OC-0333 | Low | Client voice UI | Voice-roster render identity does not change when a participant is renamed mid-call. | B7/B9 | Reactive identity signature and rename-in-call test. |
+| OC-0334 | Low | Client PTT | Escape closes Settings and can simultaneously be saved as the captured PTT key. | B7/B9 | Escape cancels capture without persistence; teardown and timeout paths are tested. |
+| OC-0335 | Low | Client lifecycle | Each Add Server modal retains listeners and its removed subtree for the connect-page lifetime. | B7 | Modal-owned abort lifecycle; repeated open/close instrumentation shows no accumulation. |
+| OC-0336 | Low | Client lifecycle | Server-profile rows re-register page-lifetime listeners on every render. | B7 | Row/render ownership prevents accumulation under repeated updates and teardown. |
+| OC-0337 | Low | Server replay | Cold-tier voice replay truncation can discard the newest events and reconstruct the wrong roster. | B2/B3 | Ordered, bounded replay retains the correct window; boundary/resume tests reconstruct the authoritative roster. |
+| OC-0338 | Low | Server plugins | TOML plugin manifests can omit configured memory and CPU resource limits. | B2/B3 | Explicit TOML mapping and JSON/TOML resource-limit parity tests. |
+| OC-0339 | Low | Server config | A valid but empty configuration section is reported as an unknown ineffective key. | B6 | Empty known sections are accepted; true unknown keys remain actionable and tested. |
+| OC-0340 | Low | Server CLI | A negative API-token expiry can create a token that never expires. | B4/B6 | CLI and HTTP share positive-expiry validation; negative/zero/boundary tests fail safely. |
+| OC-0341 | Low | Server CLI | A numeric token label cannot be revoked because parsing commits to the ID path. | B4/B6 | Unambiguous ID/label selection or safe fallback with numeric-label regression tests. |
+| OC-0342 | Low | Client voice UI | Voice avatar letter/color derives from username while the adjacent label may be a nickname. | B9 | Avatar and label consistently derive from the displayed identity. |
+| OC-0343 | Low | Desktop shell | Clicking the tray icon can hide a minimized window instead of restoring it. | B7/B9 | Minimized windows unminimize and focus; only visible, non-minimized windows toggle hidden. |
+| OC-0344 | Low | Server TLS | Automatic HTTP-to-HTTPS redirect assumes port 443 instead of the configured HTTPS endpoint. | B6 | Redirect derives the configured public origin/port and passes default/custom/domain/IP tests. |
+| OC-0345 | Low | Server owner auth | Owner middleware repeats a role read and maps a transient read failure to forbidden. | B3/B4 | Reuse the authenticated context and preserve correct unavailable/unauthorized distinctions in failure tests. |
+| OC-0346 | Low | Server telemetry | Panic recovery reads trace context before tracing middleware creates it. | B3/B6 | Middleware order gives recoveries the active trace ID; panic-path structured-log test passes. |
+| OC-0347 | Low | Client DM voice UI | A DM call label reads but does not subscribe to DM state, so it remains stale. | B7/B9 | Subscribe to the owning state and test mid-call rename/update. |
+| OC-0348 | Low | Client presence | The online-count header includes the local invisible user while the member list presents that user as offline. | B7/B9 | Count and list share one visibility policy with invisible-status regression tests. |
+
+## Public-safe security remediation
+
+An independent current-HEAD security review produced detailed reports that
+remain untracked/private until fixed or coordinated through private advisories.
+This register carries only non-sensitive security properties and opaque
+remediation families; an apparently related engineering row is not evidence
+that any private report is fixed.
+
+| ID | Pri | State | Opaque remediation family | Phase | Public closure evidence |
+| ------ | --: | --------- | --------------------------------------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| SEC-01 | P1 | confirmed | Atomic concurrent password-confirmation admission. | B4 | One server-owned admission decision, bounded concurrent attempts, and race/load regression coverage. |
+| SEC-02 | P1 | confirmed | Effective channel-level voice moderation permissions. | B5 | Voice moderation delegates to the same effective-permission policy as the authoritative channel action, with override and denial tests. |
+| SEC-03 | P1 | confirmed | Bounded per-response and aggregate preview/media reads. | B2/B5 | Streaming limits are enforced before buffering; aggregate memory/concurrency budgets, timeout, cancellation, and adversarial boundary tests pass. |
+| SEC-04 | P1 | confirmed | Durable per-user/server storage quotas and disk headroom. | B3/B6 | Transaction-safe quotas cover files and cumulative storage; low-disk behavior fails safely and is exercised by restart/concurrency tests. |
+
+## Client engineering issues
+
+These are broader gates and work packages; canonical `OC-*` defects above are
+not recounted here.
+
+| ID | Pri | State | Issue and evidence | Phase | Closure evidence |
+| ---- | --: | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| C-01 | P1 | confirmed | `.nvmrc`/active docs use Node 20, while CI uses Node 24 and package metadata does not enforce the intended runtime. Canonical owner for RL-17. | B1 | One Node/npm source of truth drives local setup, packages, CI, release, and docs; wrong majors fail fast. |
+| C-02 | P1 | confirmed | Oxlint exits zero with 471 warnings, concentrated in LiveKit/E2EE bindings. | B7 | Narrowly allow intentional generated/external names, fix actionable warnings, and make the blocking invocation warning-free. |
+| C-03 | P1 | confirmed | Coverage cannot complete because G-01/G-02 fail, and exercised entry/orchestration files remain excluded. | B0/B7 | Green full report includes exercised production files; exclusions are minimal and documented; thresholds ratchet from an honest baseline. |
+| C-04 | P2 | confirmed | Unit/E2E runs emit expected warnings and large expected debug/error output, obscuring unexpected failures. | B7 | Expected logs are captured/asserted; a green run has no unexplained runtime warnings or log flood. |
+| C-05 | P3 | confirmed | Knip passes with four configuration hints. | B7 | No hints, or each retained exception has a current inline rationale. |
+| C-06 | P0 | confirmed | Full Playwright and an isolated voice-widget subset fail to terminate on Windows after their observed test activity. | B0/B10 | Playwright exits unaided locally and in CI; the cause is regression-tested and no child process remains. |
+| C-07 | P1 | confirmed | Static RNNoise inclusion creates an approximately 2.0 MB minified / 1.345 MB gzip feature chunk. | B7/B9 | Load on demand, cache after first use, and prove voice/noise restart/fallback behavior. |
+| C-08 | P2 | confirmed | Vite warns about oversized chunks, but no startup/route/feature bundle budget blocks regressions. | B7/B9 | Recorded gzip budgets fail CI on regression and distinguish startup from lazy feature cost. |
+| C-09 | P1 | confirmed | Desktop external-preview destination policy is not fully centralized at the native trust boundary. | B2/B7 | One native policy owns resolution, redirects, destinations, time/body limits, and parsing; broad capability scope is removed. |
+| C-10 | P1 | confirmed | Client CSP permits broad HTTPS/WSS destinations and lacks a generated per-deployment allowlist contract. | B2/B7/B8 | Required origins/protocols are inventoried and minimized for desktop/browser modes with functional regression tests. |
+| C-11 | P2 | confirmed | Four production import cycles remain in LiveKit/audio and message attachment/media/embed code. | B7 | Production graph is acyclic or an approved seam and boundary test documents each unavoidable cycle. |
+| C-12 | P2 | confirmed | High-change client modules remain very large, including LiveKit/E2EE, dispatcher, and settings surfaces. | B7/B9 | Responsibility maps guide cohesive extractions behind stable tested seams without behavior or coverage regression. |
+| C-13 | P2 | confirmed | Duplicated color/host literals, many timer call sites, and an O(n) sidebar DOM-rebuild TODO remain. | B7/B9 | Shared tokens/config, lifecycle-owned timers, and measured incremental sidebar updates replace the duplication/hot path. |
+| C-14 | P1 | confirmed | Native smoke configuration exists but is absent from blocking CI because it needs a built app and real server. | B10 | Release candidates run packaged native smoke on the supported Windows/Linux architecture matrix. |
+| C-15 | P1 | confirmed | Full Tauri packaging is not a routine exact-SHA integration gate. | B1/B10 | Cost-conscious integration/nightly/RC jobs package without exposing signing secrets to untrusted dependency PRs. |
+| C-16 | P2 | confirmed | Mutation fixes landed after the last measured 67.04% baseline; the suite was not rerun. | B7/B10 | Fresh baseline, survivor triage, and ratcheted targets for critical transport/auth/E2EE modules. |
+| C-17 | P3 | confirmed | Direct real-browser coverage is only three Chromium tests and is concentrated on RNNoise. | B8/B10 | Browser-only API risk inventory drives blocking Chromium/Firefox/WebKit coverage plus real-device qualification where emulation is insufficient. |
+| C-18 | P3 | watch | Cargo has no known reachable vulnerability, but allowed unmaintained transitive crates and compatible patches require ownership. | B10 | Compatible patches are reviewed; warnings are revisited each dependency cycle; platform migration path is recorded. |
+
+## Server engineering issues
+
+| ID | Pri | State | Issue and evidence | Phase | Closure evidence |
+| ---- | --: | --------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| S-01 | P1 | confirmed | Typing currently checks a weaker permission than posting. | B2/B3 | Typing delegates to the same send-policy predicate; denial, announcement, and override tests prevent drift. |
+| S-02 | P1 | confirmed | Invite create/revoke are privileged mutations without the audit coverage used by sibling mutation families. | B4/B5 | Successful create/revoke produce safe, non-secret audit events; failure behavior is tested. |
+| S-03 | P2 | confirmed | Admin channel name/topic/category validation lacks one explicit rune/normalization contract. | B3/B5 | Shared limits cover admin and user writers; boundary tests count runes, not bytes. |
+| S-04 | P2 | confirmed | Sibling admin channel lookups expose inconsistent DM/not-found response contracts. | B3 | One non-DM resolution policy and response contract covers both paths. |
+| S-05 | P2 | confirmed | Repository-wide Go formatting is not a required gate. | B1 | Tree is formatted and a fast required gate fails future drift. |
+| S-06 | P2 | confirmed | Server coverage is uploaded without a global or core-package regression floor; current aggregate is 74.6%. | B3/B10 | Documented baseline/exclusions and ratcheted global/core thresholds. |
+| S-07 | P2 | confirmed | Thousands of tests and 17 fuzz targets exist, but there are no Go benchmarks for hub/replay, permission, DB, or fan-out hot paths. | B6/B10 | Stable microbenchmarks and reference load baselines cover the highest-risk paths. |
+| S-08 | P2 | confirmed | Large lifecycle/hub/serve files remain structural hotspots. | B3 | Cohesive extractions preserve lifecycle, locking, race, and deadlock invariants. |
+| S-09 | P2 | confirmed | API/admin/WebSocket layers still contain many direct database call sites. | B3 | Each use moves behind a narrow service/store seam or is documented as an intentional transaction/composition boundary. |
+| S-10 | P2 | confirmed | Auth routes still consume raw database ownership and are the first intended S-09 migration slice. | B3/B4 | Tested AuthService/narrow interfaces preserve enumeration and sentinel-error behavior. |
+| S-11 | P2 | confirmed | Hub construction uses post-construction collaborator setters, leaving required wiring temporally coupled to `Run`. | B3 | Required collaborators are validated constructor/options inputs; only genuinely dynamic dependencies remain mutable. |
+| S-12 | P2 | confirmed | Ready/refresh/WebSocket paths mirror message send-permission policy by hand. | B3 | All paths delegate to one value-taking predicate with parity tests. |
+| S-13 | P2 | confirmed | Durable TOTP used-code and partial-auth persister work remains incomplete. | B4 | Hash-only persistence, expiry, restart, and failure-mode tests land without persisting sliding rate-limit windows. |
+| S-14 | P1 | confirmed | Load tooling exists, but no supported capacity result is published for the approved 250 users / 100 connections / 25 voice profile. | B6/B10 | Reproducible report states hardware/software, CPU, memory, DB waits, p95/p99 latency, and pass/fail thresholds. |
+| S-15 | P3 | verify | `voice_speakers` and `member_leave` remain reserved protocol entries with no production emit site. | B2 | Compatibility review removes unused entries before the epoch freeze or explicitly reserves and fixtures them; schema, generated types, docs, and tests agree. |
+| S-16 | P3 | verify | Voice key-holder TOCTOU hardening remains a documented follow-up without a demonstrated contract failure. | B2/B3 | Threat-model review either records why outer checks suffice or adds an in-function recheck and race-focused private test. |
+| S-17 | P3 | watch | Vulnerability tooling found no reachable Go advisory, while non-called/unmaintained upstream paths remain. | B6/B10 | Dependency path is monitored, compatible fixes are applied, and reachable-symbol scanning remains required. |
+
+## Repository, CI, documentation, and supply chain
+
+| ID | Pri | State | Issue and evidence | Phase | Closure evidence |
+| ---- | --: | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| R-01 | P1 | confirmed | Real-server admin E2E remains job-level non-blocking; its approximately 30-green graduation evidence is not recorded. | B10 | Thirty consecutive required integration runs or an equivalent statistically justified criterion passes before the job becomes blocking. |
+| R-02 | P2 | confirmed | Active documents disagree whether contributors branch/PR against `main` or `dev`. | B0/B1 | One protected branch model is reflected in docs, automation, templates, and repository settings. |
+| R-03 | P2 | resolved/superseded | The graph was refreshed at the audited head, resolving the old stale-SHA observation; generated-artifact ownership and local launcher portability remain under L-06. | B1 | No separate action; L-06 owns the remaining artifact-policy exit gate. |
+| R-04 | P1 | confirmed | Build/runtime container references use mutable tags without complete digest-refresh ownership. Canonical beta owner for the release supply-chain portion of RL-18. | B1/B6 | Reviewed immutable digests or automated digest PRs with smoke tests cover release/runtime images. |
+| R-05 | P2 | confirmed | Repeated API/schema/protocol prose drift is guarded mostly by a PR checkbox. | B1/B2 | Generated inventories/contract tests cover machine-checkable facts and the remaining prose has an explicit review gate. |
+| R-06 | P2 | confirmed | Active, completed, historical, and superseded plans are not indexed consistently. | B0/B1 | Docs landing page and plan index expose status; link/status checks catch contradictions. |
+| R-07 | P2 | confirmed | Major dependency, license, SBOM, and provenance review lacks one documented cadence across all dependency roots. | B1/B6/B10 | Automated coverage plus a dated recurring major/license review and signed release SBOM/provenance. |
+| R-08 | P1 | confirmed | No single beta scorecard defines allowed open priorities, platform coverage, security sign-off, soak, upgrade/restore drills, or performance evidence. | B0/B10 | Owner-approved scorecard is green after the release-candidate soak and links every evidence artifact. |
+| R-09 | P1 | confirmed | A version tag can publish without proof that the exact tagged SHA completed the protected beta gate. Canonical owner for RL-16. | B1/B10 | Publication consumes immutable exact-SHA gate evidence and a protected release approval. |
+
+## Repository layout and contributor experience
+
+The layout audit recommends a targeted, isolated migration—not a wholesale
+monorepo/server rewrite. Pure moves, mechanical path rewrites, and
+behavior-changing work must remain in separate reviewable commits.
+
+| ID | Pri | Source | Required work | Phase | Closure evidence |
+| ---- | --: | ------ | ------------------------------------------------------------------------------------------------------------------------------------------ | ----- | ----------------------------------------------------------------------------------------------------------------------- |
+| L-01 | P1 | RL-01 | Flatten `Client/tauri-client/` to `Client/` as two adjacent non-functional commits: pure file moves, then mechanical active-path rewrites. | B1 | History/release asset names are preserved and the full baseline is unchanged after both commits. |
+| L-02 | P1 | RL-02 | Record the browser/desktop platform-contract map in B1, then introduce typed adapters for native-dependent frontend services. | B7 | The same adapter contract suite passes for desktop and browser implementations. |
+| L-03 | P1 | RL-03 | Establish independent `build:web` and `build:desktop` contracts from one shared UI after server-first phases close. | B7 | Both production builds are required and target-specific behavior is isolated. |
+| L-04 | P2 | RL-04 | Add cross-platform root bootstrap, format, generation, scoped, and full verification commands. | B1 | Fresh Windows/Linux contributors can discover and run the intended checks; Go-only direct commands remain supported. |
+| L-05 | P2 | RL-05 | Record the workspace decision and cover every lock root with deterministic install/dependency automation. | B1 | Measured rationale, immutable installs, and update coverage for all package roots. |
+| L-06 | P2 | RL-06 | Make large Graphify payloads reproducible CI artifacts; retain only a compact deterministic report if needed. | B1 | Portable local/CI generation works, committed report drift is checked, and published history is not rewritten. |
+| L-07 | P2 | RL-07 | Remove the tracked duplicate human rendering after deterministic on-demand/CI rendering and a drift check exist. | B1 | The JSON ledger remains canonical; a downloadable rendering is reproducible and CI rejects generation failure or drift. |
+| L-08 | P2 | RL-08 | Keep the example WASM source, stop tracking its prebuilt output, and compile/verify it in CI or release checks. | B1/B2 | Deterministic source build passes and no stable plugin API promise is implied. |
+| L-09 | P2 | RL-09 | Move protocol schema/generator ownership to a root protocol/tool boundary. | B1/B2 | One command generates Go and TypeScript consumers with zero drift. |
+| L-10 | P1 | RL-10 | Move executable tooling under conventional command ownership and remove package-discovery filesystem side effects. | B1 | Broad Go discovery is read-only and tool execution is explicit/tested. |
+| L-11 | P2 | RL-11 | Reclassify cross-stack invariants under an explicit owner or root system-contract tier. | B1 | Test names/location/commands expose ownership and CI runs the correct tier. |
+| L-12 | P2 | RL-13 | Align the Go module namespace to `github.com/J3vb/OwnCord/Server` in an isolated mechanical change. | B1 | Imports, generators, build tags, source archives, and downstream instructions agree. |
+| L-13 | P2 | RL-19 | Add an editor baseline and repository gates for Markdown, YAML, JSON, CSS, Rust, Go, shell, and workflows. | B1 | Cross-platform fast checks cover material tracked sources with explicit generated/vendor exclusions. |
+| L-14 | P2 | RL-20 | Make hooks portable and remove undocumented `make`/POSIX assumptions on Windows. | B1 | Hooks are thin optional wrappers around cross-platform root commands; prerequisites are explicit. |
+| L-15 | P2 | RL-21 | Route ideas/feedback to Discussions and modernize issue forms for browser, ARM64, deployment mode, and security reporting. | B1 | Intake matches BPR-100..102 and captures reproducible environment details. |
+| L-16 | P1 | RL-22 | Harden authorization for externally triggered paid automation. | B1 | Trusted authorization, least privilege, and cost-abuse regression tests are required. |
+
+Layout findings reconciled elsewhere: RL-12 is owned by R-06; RL-14 by G-03;
+RL-15 by BG-20; RL-16 by R-09; RL-17 by C-01; and RL-18 by L-05,
+R-04, and R-07.
+
+## Approved beta capability gaps
+
+Every row below is required by the frozen beta product requirements. These are
+feature-completion gaps, not additions beyond scope.
+
+| ID | Pri | State | Missing or incomplete beta capability | Phase | Exit evidence |
+| ----- | --: | --------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BG-01 | P1 | confirmed | Optional server-hosted browser client, disabled by default. | B5/B8 | Owner opt-in controls hosting; disabled mode exposes no app route/assets; enabled mode passes upgrade/security smoke. |
+| BG-02 | P1 | confirmed | Installable PWA with safe shell caching, icons, standalone presentation, and update behavior. | B8 | Manifest/installability audits pass; service worker never caches API/messages/credentials and handles version changes safely. |
+| BG-03 | P1 | confirmed | Beta-quality responsive phone/tablet navigation, touch, keyboard, safe-area, and media UX. | B8/B9 | Real-device and emulated phone/tablet matrix passes defined journeys and accessibility checks. |
+| BG-04 | P1 | confirmed | Browser parity for credentials, transport, notifications, media/calls/E2EE, files, and safe external content where browser APIs allow. | B7/B8/B9 | Shared behavior/contract suite passes; every unavoidable browser limitation is explicit and safely degraded. |
+| BG-05 | P1 | confirmed | Per-server owner/user opt-in Web Push without an OwnCord-operated relay. | B5/B8 | Per-server keys/subscriptions, permission UX, unsubscribe/cleanup, privacy defaults, and supported-platform delivery tests pass. |
+| BG-06 | P1 | confirmed | Secure browser deployment for domains, raw public IPs, LAN, and offline modes without a required reverse proxy or routine manual renewal. | B6/B8 | Domain/IP automated TLS, private-LAN local-trust onboarding, manual-cert escape hatch, renewal/restart tests, and honest limitations are documented. |
+| BG-07 | P1 | confirmed | Explicit server/current-and-previous-two-client protocol negotiation and safe rejection. | B2/B7/B10 | N/N-1/N-2 compatibility matrix passes; out-of-window clients fail with an actionable update requirement. |
+| BG-08 | P1 | confirmed | New-login notices and sign-out-everywhere UI; per-session list/revoke backend exists but is not a complete user journey. | B4/B9 | Multi-device list, individual/all revocation, notices, stale-device handling, and audit tests pass. |
+| BG-09 | P1 | confirmed | Offline recovery kit, audited admin-assisted reset, and optional SMTP recovery. | B4/B9 | Non-reversible server storage, one-time rotation, session revocation, rate limits, operator/user UX, and restore tests pass. |
+| BG-10 | P1 | confirmed | Complete closed/invite/approval/open registration modes with invite-only default. | B4/B9 | Mode transitions, approvals, abuse limits, invitations, audit, and migration tests pass. |
+| BG-11 | P1 | confirmed | Full account erasure and backup non-resurrection. | B4 | Profile/auth/session/message/reaction/upload deletion is transactional/resumable, integrity logs are deidentified, and restore honors deletion markers. |
+| BG-12 | P1 | confirmed | Configurable server/channel retention with corresponding attachment cleanup. | B4/B5/B9 | Default indefinite retention remains; scheduled deletion, holds, audit, storage cleanup, backup/restore, and boundary tests pass. |
+| BG-13 | P1 | confirmed | Discord-style Message Requests for first-time DMs. | B5/B9 | Preview/accept/ignore/delete/block/trust relationship behavior is abuse-resistant and consistent across desktop/browser/PWA. |
+| BG-14 | P1 | confirmed | Local reports, permission-gated Moderation Center, workflow/audit history, moderator actions, and appeals. | B5/B9 | Report/evidence/assignment/status/notes/actions/appeal journeys enforce narrow permissions and immutable audit records. |
+| BG-15 | P1 | confirmed | Privacy-safe support bundle and verified zero automatic telemetry. | B6/B9 | Redaction tests and user preview/consent protect secrets/content; network audit proves no automatic product telemetry. |
+| BG-16 | P1 | confirmed | English-only but translation-ready user-facing text organization. | B7/B9 | User-visible strings are inventoried/extracted or deliberately exempted; locale/time/plural formatting has a stable seam. |
+| BG-17 | P1 | confirmed | Plugin-candidate boundary audit and consistent experimental/disabled labeling. | B2 | Candidate integrations are documented for post-beta; beta core security/identity/update/moderation/deletion remains core; no compatibility promise leaks. |
+| BG-18 | P1 | confirmed | NSFW consent must prevent fetch/render leakage before acknowledgement, not merely overlay already-mounted content. | B5/B9 | No content, preview, attachment, or third-party request occurs pre-consent; blur/gate/revoke tests pass. |
+| BG-19 | P1 | confirmed | Secure polish for link previews, GIFs, YouTube, and rich media. | B5/B9 | Provider boundaries, privacy controls, bounded retrieval, consent, caching, failure UX, and offline behavior pass shared tests. |
+| BG-20 | P1 | confirmed | Public-beta packaging/update matrix for Windows x64/ARM64, Linux x64/ARM64, server binaries, and multi-architecture Docker. | B6/B10 | Build, install/boot, signature/checksum, manifest, in-place alpha upgrade, rollback, and update tests pass on every approved architecture. |
+
+## Discovery passes required before claiming exhaustive coverage
+
+No finite static audit proves the absence of every latent defect. The strongest
+defensible completion claim is that each defined risk surface was inspected,
+candidates were independently validated, and accepted risks have owners. The
+following focused passes are mandatory during B0 through B10:
+
+1. Authentication, session, recovery, TOTP, registration, and authorization
+ sibling sweep.
+2. WebSocket sequencing, replay, replacement, compatibility, and lock-order
+ simulation.
+3. Voice/LiveKit/E2EE lifecycle, moderation, resume, and fault injection.
+4. Client async lifetimes, detached DOM/listeners, timers, cancellation, and
+ stale snapshots.
+5. Desktop proxy/TOFU/updater/signing, browser TLS/PWA/push, secure-context, and
+ secrets-at-rest threat review.
+6. Database migrations, account deletion, retention, backup/restore,
+ non-resurrection, disk-full, and crash consistency.
+7. Release supply chain, container provenance, dependency licenses, SBOM, and
+ exact-SHA publication controls.
+8. Performance/memory profiling for startup, large histories, reconnect storms,
+ 100 connections, 25 voice participants, media restart, and long sessions.
+9. Keyboard, focus, screen reader, reduced motion, contrast, zoom, touch,
+ phone/tablet layout, virtual keyboard, and destructive UX journeys.
+10. API/protocol/schema/config/documentation contract diff, including
+ N/N-1/N-2 compatibility fixtures.
+11. Test-quality audit: stale assertions, tests that cannot fail, mutation
+ survivors, fuzz targets, real-browser/native gaps, and shutdown leaks.
+12. Operational drills: unhealthy DB/disk/hub, certificate renewal, offline/LAN
+ trust, backup recovery, updater rollback, and release artifact boot/install.
+
+Each pass returns **confirmed / refuted / duplicate / accepted / blocked**.
+Security-sensitive confirmed detail moves to a private advisory before public
+planning or implementation discussion.
+
+## Explicitly outside beta
+
+Do not convert these into health-remediation work unless they reveal a defect
+in an approved beta contract:
+
+- federation, cross-server identity, or cross-server messaging;
+- more than one active server connection per client;
+- anonymous guests or a centralized server directory;
+- native macOS, iOS, or Android applications;
+- a stable plugin API or bundled third-party plugins;
+- OwnCord-operated hosting, identity, push relay, telemetry, or moderation;
+- unrelated feature expansion after the frozen scope.
+
+Good post-beta plugin candidates include GIF/embed providers, slash
+commands/bots/automation, webhooks/integrations, optional moderation automation
+with human/audit control retained, UI tabs, import/export bridges, and
+observability exporters. Authentication, authorization, TLS, safe fetch,
+quotas, E2EE, updates, moderation audit, deletion, and recovery remain beta core.
diff --git a/docs/plans/repo-health-roadmap-2026-08-23.md b/docs/plans/repo-health-roadmap-2026-08-23.md
new file mode 100644
index 00000000..19e82317
--- /dev/null
+++ b/docs/plans/repo-health-roadmap-2026-08-23.md
@@ -0,0 +1,1119 @@
+# OwnCord public-beta execution roadmap
+
+**Prepared:** 2026-08-23
+**Audited head:** 5cc0888964e26276d1aca145e83270a2c1b9febd on dev
+**Release target:** first public beta after the 1.2.0-alpha line
+**Status:** proposed implementation sequence; no phase is complete yet
+**Planning model:** quality-gated, with no calendar deadline
+
+Primary inputs:
+
+- [beta product requirements](beta-product-requirements-2026-08-23.md)
+- [requirement traceability](beta-requirements-traceability-2026-08-23.md)
+- [repository-layout audit](../audit-2026-08-23-repository-layout.md)
+- [repository-health issue register](repo-health-issue-register-2026-08-23.md)
+
+## Decision
+
+OwnCord is not beta-ready today. The server has the stronger engineering
+baseline, but it still needs security remediation, compatibility contracts,
+data-lifecycle work, deployment qualification, and capacity evidence. The
+desktop client has a useful foundation, but its required gate is red and the
+approved browser, PWA, phone, tablet, moderation, recovery, and privacy
+experience is incomplete.
+
+The best route is an ordered server-first program:
+
+1. restore one truthful baseline;
+2. perform the justified repository cleanup as an isolated migration;
+3. freeze server protocol, trust, and compatibility contracts;
+4. strengthen server boundaries before adding beta services;
+5. complete server identity, privacy, community, moderation, deployment, and
+ operations;
+6. bring the shared desktop client onto explicit platform contracts;
+7. add the browser/PWA target from the same application;
+8. finish cross-client experience, accessibility, and polish;
+9. qualify one release candidate against the complete matrix.
+
+This is deliberately not a wholesale rewrite. Existing server packages,
+desktop behavior, release asset names, updater contracts, and the shared
+client application remain stable unless a phase has evidence for a narrower
+change.
+
+## Current evidence snapshot
+
+This is audit evidence, not a release claim. It must be refreshed in B0.
+
+| Area | Evidence at the audited head | Consequence |
+| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| Server | Default, OpenTelemetry, Wazero-tagged WASM runtime, and combined builds pass; vet, race, deadlock, and tagged tests pass; aggregate CI-style coverage is 74.6%. | Strong baseline, but not a beta qualification. |
+| Server limitations | Local Docker evidence was unavailable and local golangci-lint could not load because its Go toolchain differed from the module toolchain. | Obtain clean CI or matched-tool evidence; do not waive either gate. |
+| Client | Type checks, ESLint, Prettier, Knip, production dependency audit, Vite build, browser smoke, Rust Clippy, and 115 Rust tests pass. | Useful desktop foundation. |
+| Client blockers | Two Vitest tests fail; Playwright completes test cases but does not terminate; Oxlint reports 471 warnings. | The client gate is red and structural work must not begin on a false-green baseline. |
+| Client size | The livekitSession chunk is about 2.0 MB minified and 1.34 MB gzip; additional LiveKit and main-page chunks are material. | Establish budgets before client decomposition and browser delivery. |
+| Browser/PWA | No production browser target, optional server host, PWA, Web Push, or adequate mobile navigation is implemented. | This is a planned product workstream, not an existing capability. |
+| Exact-SHA CI | No workflow run was found for the audited dev commit. | B0 and B1 must close the integration-evidence gap. |
+| Security | A prior untracked report set exists and an independent deep scan is being reconciled. | Keep details private until coordinated remediation; publish only safe status. |
+
+## Non-negotiable execution rules
+
+### Gate-driven, not date-driven
+
+- There is no delivery deadline.
+- A phase closes only when every exit condition has dated evidence on the exact
+ integration commit.
+- An incomplete requirement cannot be renamed done, deferred silently, or
+ hidden by changing a threshold.
+- Calendar estimates may be added for personal planning, but they never replace
+ a gate.
+
+### One coherent invariant per change
+
+Every implementation change should:
+
+1. identify one behavior, boundary, migration, or extraction;
+2. start with a failing contract, reproducer, measurement, or code-level proof;
+3. change the smallest reviewable surface;
+4. update source, tests, generated output, reference documentation, and
+ migration notes together;
+5. run the complete affected-component gate;
+6. record exact-SHA evidence and tracker disposition.
+
+Do not combine a security-boundary change, dependency major, layout move, and
+architecture refactor in one pull request. Rename-only changes contain no
+functional edits.
+
+### One source of truth per concern
+
+- Product scope: beta-product-requirements-2026-08-23.md.
+- Requirement ownership and proof: beta-requirements-traceability-2026-08-23.md.
+- Defect status: the canonical OC finding ledger or its approved successor.
+- Security-sensitive defects: private GitHub Security Advisories.
+- Phase order and gates: this roadmap.
+- Historical audits: dated audit files, never reused as current status without
+ re-verification.
+
+Planning identifiers are not duplicate defect trackers. Every confirmed defect
+must map to one canonical OC issue or one private advisory before remediation.
+
+### Public and private security handling
+
+- Never commit the untracked detailed security reports to the public repository
+ while the findings are exploitable.
+- Public plans use opaque identifiers, affected security properties, safe
+ acceptance criteria, and a status only.
+- Reproduction steps, source-to-sink traces, exploit conditions, secrets,
+ patches under embargo, and scanner artifacts stay in private advisories.
+- Every candidate is independently validated or refuted. Sibling call sites are
+ checked before declaring the class fixed.
+- A fix is not closed until regression tests, affected-platform tests, and a
+ second review pass are green.
+- Release notes may describe repaired impact after coordinated remediation
+ without exposing unnecessary exploit detail.
+- B10 requires zero unresolved security advisory. Accepted risk cannot be used
+ for a known exploitable beta blocker.
+
+## Phase dependency chain
+
+ B0 Truth and scope
+ ↓
+ B1 Repository and contributor foundation
+ ↓
+ B2 Server protocol, trust, and compatibility
+ ↓
+ B3 Server architecture and permanent guardrails
+ ↓
+ B4 Server identity, recovery, privacy, and data lifecycle
+ ↓
+ B5 Server community, content, and moderation services
+ ↓
+ B6 Server deployment, operations, and capacity
+ ↓
+ B7 Shared client platform and desktop parity
+ ↓
+ B8 Browser, PWA, phone, and tablet
+ ↓
+ B9 Unified experience, moderation UX, accessibility, and polish
+ ↓
+ B10 Beta qualification and public release
+
+The phase exits are serial. Parallelism is allowed only inside the active phase
+or for non-mutating preparation of the next phase. Server behavior and
+operations are therefore stable through B6 before browser feature work begins.
+
+## Common entry and exit contract
+
+An item is ready for implementation only when it has:
+
+- impact, priority, affected requirement, and explicit non-goals;
+- a reproducer, failing test, measurement, or reviewed code proof;
+- known protocol, migration, privacy, and rollback effects;
+- dependencies and an owner;
+- a verification plan capable of failing before the change.
+
+An item is done only when:
+
+- its acceptance evidence is green on supported environments;
+- the full affected server, client, browser, Rust, deployment, and generated
+ contract gates remain green;
+- no new warning, advisory, documentation drift, or generated drift appears;
+- the exact integration commit has CI evidence;
+- tracker, requirement map, and phase scorecard agree;
+- rollback, compatibility, and data-migration notes exist where applicable.
+
+## B0 — Restore truth, freeze scope, and reconcile the audit
+
+**Objective:** replace stale or contradictory status with one reproducible
+baseline before source restructuring or feature development.
+
+**Primary requirements:** BPR-002 and BPR-003.
+
+### Entry gate
+
+- The audited commit is recorded.
+- Product decisions and supported targets are fixed in the beta requirements.
+- Existing source, audit documents, and untracked security evidence are
+ preserved.
+
+### Workstreams
+
+1. Freeze a machine-readable baseline manifest containing commit, tool
+ versions, dependency locks, test totals, coverage, warnings, bundle sizes,
+ release targets, and environment limitations.
+2. Repair the two failing client unit contracts without weakening their
+ assertions.
+3. Reproduce and fix the Playwright shutdown defect so the required suite exits
+ unaided on Windows and CI.
+4. Run the complete server matrix with a matched lint toolchain and obtain
+ Docker smoke evidence in an environment with a daemon.
+5. Run the complete client, browser-smoke, Rust, dependency, generated-code,
+ and packaging-preflight gates.
+6. Reconcile every open ledger entry, issue-register item, layout finding,
+ product gap, and security candidate. Record duplicate, refuted, accepted,
+ blocked, or confirmed status with evidence.
+7. Complete the independent deep security scan and deduplicate it against prior
+ evidence without publishing sensitive details.
+8. Define which checks are required per pull request, integration commit,
+ nightly run, and release candidate.
+9. Freeze beta scope. New nonessential ideas go to the post-beta backlog.
+
+### Hold point HP-0 — Baseline acceptance
+
+No layout or feature source change begins until the owner can inspect one
+scorecard and answer:
+
+- what is green, red, unavailable, and unverified;
+- which confirmed issues block each later phase;
+- which checks protect the integration branch;
+- which security details remain private.
+
+### Exit gate
+
+- The required baseline server and client checks are green on one exact commit.
+- Playwright terminates normally and Docker/lint evidence is available.
+- Every audit candidate has a canonical disposition; no unverified candidate is
+ counted as fixed or ignored.
+- All product requirements appear exactly once in the traceability map.
+- The exact dev integration commit receives the defined blocking matrix.
+- The worktree contains no accidental generated or build output.
+- The beta scope and post-beta boundary are explicit.
+
+### Required evidence
+
+- baseline manifest and phase scorecard;
+- CI links for the exact SHA;
+- server/client command and result matrix;
+- red-to-green test evidence for the two unit failures and E2E shutdown;
+- private security reconciliation record;
+- canonical issue and requirement exports.
+
+### Safe parallelism
+
+Server validation, client validation, requirement mapping, and independent
+security review may run in parallel because they are read-only or isolated.
+Fixes to shared test infrastructure are serialized. No product feature work is
+safe during B0.
+
+## B1 — Isolated repository and contributor foundation
+
+**Objective:** make the repository discoverable, cross-platform, and ready for
+one shared desktop/browser application without mixing layout churn with
+behavior changes.
+
+**Primary requirements:** BPR-100 through BPR-103.
+
+### Entry gate
+
+- HP-0 is accepted.
+- All baseline gates are green.
+- The layout-audit target and migration controls are approved.
+
+### Workstreams
+
+1. Add a root cross-platform command facade for bootstrap, scoped checks, full
+ checks, generation, and release preflight while preserving direct Go
+ commands for server-only contributors.
+2. Add a documentation landing page and active-plan index. Establish one source
+ of truth for Node 24, branch policy, supported platforms, generated files,
+ and security reporting.
+3. Add a root editor baseline and complete formatting/lint coverage for
+ Markdown, YAML, JSON, CSS, Rust, Go, scripts, and workflows.
+4. Make hooks optional thin wrappers around the root commands so Windows
+ contributors are not required to infer POSIX or Make prerequisites.
+5. Decide and implement complete dependency automation for every lock root,
+ container, action, and build image.
+6. Prove portable regeneration or CI artifact replacement before untracking
+ large graph and rendered-ledger payloads. Do not rewrite published history.
+7. Flatten Client/tauri-client into Client as two adjacent non-functional
+ commits: first pure file moves, then mechanical rewrites of active
+ automation, release, generator, hook, and documentation paths. Leave
+ historical audit links intact.
+8. Move executable protocol ownership from docs into a root protocol boundary
+ and verify both Go and TypeScript consumers from one command.
+9. Move executable Go tools to conventional ownership and remove
+ package-discovery filesystem side effects.
+10. Reclassify cross-component tests into their real owner or an explicit
+ contract/system tier.
+11. Align or deliberately document the Go module namespace.
+12. Protect dev with exact-SHA CI, require full evidence before tag
+ publication, modernize issue forms and Discussions routing, and restrict
+ paid comment-triggered workflows to trusted associations.
+13. Document the future platform contract folders without moving native
+ behavior yet. Functional adapter extraction belongs to B7.
+
+### Hold point HP-1 — Structural diff review
+
+Review the pure-move commit, the adjacent path-rewrite commit, active path
+inventory, generated-artifact ownership, command facade, and protocol
+relocation as mechanical changes. If behavior changed, split it out and re-run
+the structural review.
+
+### Exit gate
+
+- Fresh Windows and Linux contributors can find one setup path and run scoped
+ or complete checks without guessing directories.
+- Desktop behavior, release asset names, and update contracts are unchanged.
+- The pure-move and mechanical-path-rewrite commits are independently
+ reviewable and active path references are complete.
+- Generated sources and analysis artifacts have explicit reproducible owners.
+- The protocol schema generates and verifies both consumers from the root.
+- Every dev integration commit has exact-SHA CI.
+- Issues, Discussions, pull requests, and private security reporting match the
+ approved community model.
+- Full B0 evidence remains green after the migration.
+
+### Required evidence
+
+- before/after path manifest and rename similarity report;
+- fresh-clone setup smoke on Windows and Linux;
+- root-command output and direct server-command parity;
+- docs link checker and repository lint results;
+- generated-source drift check;
+- exact-SHA workflow and protected-release evidence.
+
+### Safe parallelism
+
+Documentation/index work, root command design, generated-artifact
+investigation, and community-template updates may proceed in parallel. The
+client flatten, protocol move, and executable-tool move are separate serialized
+changes. No functional platform extraction is mixed into them.
+
+## B2 — Freeze server protocol, trust, and compatibility contracts
+
+**Objective:** establish the security and version boundaries that all later
+server services and clients must obey.
+
+**Primary requirements:** BPR-031, BPR-032, BPR-040, BPR-050, BPR-051, and
+BPR-080 through BPR-083.
+
+### Entry gate
+
+- B1 is complete and protocol source has one owner.
+- Confirmed security findings have private owners and acceptance tests.
+- Existing alpha protocol fixtures and updater contracts are captured.
+
+### Workstreams
+
+1. Define explicit protocol-epoch and capability negotiation. The upgraded
+ server accepts epochs N, N-1, and N-2 and rejects older epochs with a safe
+ actionable response. Patch releases within an epoch remain compatible, and
+ prerelease/release metadata declares its epoch.
+2. Define server-first update ordering and signed update metadata contracts.
+ A new client is not required to speak to an old server.
+3. Add version fixtures and compatibility tests that survive later code
+ refactors and generated-type changes.
+4. Document and enforce the trust model: server-readable stored text/files;
+ authenticated transport; participant E2EE for voice, video, and screen
+ sharing.
+5. Reconcile authentication, channel visibility, send, typing, moderation,
+ voice moderation, and session-admission predicates so effective permissions
+ have canonical production ownership.
+6. Record safe audit events for security-sensitive actions without storing
+ content or secrets unnecessarily.
+7. Prove accounts are server-local and no global identity, central directory,
+ federation, or OwnCord-operated runtime dependency is introduced.
+8. Keep the WASM runtime experimental and disabled by default. Document that
+ beta makes no stable plugin API promise.
+9. Inventory cohesive post-beta plugin candidates: provider integrations,
+ slash commands and automation, webhooks, optional moderation automation,
+ UI tabs, import/export bridges, and observability exporters.
+10. Keep authentication, authorization, TLS, safe fetch, quotas, E2EE, update
+ verification, deletion, recovery, and moderation audit in core.
+
+### Hold point HP-2 — Protocol and threat-model sign-off
+
+Freeze protocol versions, downgrade behavior, trust claims, E2EE membership
+rules, permission predicates, and deferred-system boundaries before database or
+service expansion. Security details remain in private review.
+
+### Exit gate
+
+- Clients from epochs N, N-1, and N-2 pass the server compatibility matrix;
+ N-3 fails safely and actionably. The server-bundled browser client matches
+ the server epoch rather than becoming an independent generation.
+- Protocol and update metadata changes are generated, documented, and
+ downgrade-tested.
+- Effective permission and resource-existence sibling cases have parity tests.
+- Voice/video/screen E2EE membership and key-change behavior pass adversarial
+ tests.
+- No central identity, directory, federation path, or required external
+ service exists.
+- WASM is disabled by default and release artifacts do not imply API stability.
+- No unresolved B2 security advisory remains.
+
+### Required evidence
+
+- compatibility fixture matrix and protocol changelog;
+- threat model and private security validation;
+- permission and E2EE integration tests;
+- update-order and incompatibility UX contract tests;
+- configuration/default audit for plugins and central dependencies.
+
+### Safe parallelism
+
+Compatibility fixtures, trust-model review, plugin-boundary inventory, and
+central-dependency audit can start in parallel. Production protocol changes,
+permission consolidation, and E2EE changes are serialized behind HP-2.
+
+## B3 — Strengthen server architecture and permanent guardrails
+
+**Objective:** remove temporal coupling and duplicate domain rules before beta
+services increase the server's surface.
+
+**Primary requirements:** none. B3 is a mandatory engineering-enabling phase
+for every later requirement.
+
+### Entry gate
+
+- B2 contracts are frozen and covered by compatibility tests.
+- Server baseline, race, deadlock, and security tests are green.
+- Hotspots and direct database call sites have an owned inventory.
+
+### Workstreams
+
+1. Add baseline-ratcheted aggregate and critical-package coverage floors.
+2. Add focused benchmarks and deterministic hub simulations for reconnect,
+ supersession, replay, acknowledgement, subscription, fan-out, and failure
+ ordering.
+3. Add fuzz seeds and model/property tests around protocol parsing, permissions,
+ uploads, recovery tokens, and state transitions.
+4. Move auth middleware and routes behind narrow services while preserving
+ enumeration defenses and database sentinel mappings.
+5. Classify every direct database call above the domain layer as migrate,
+ explicit transaction/composition boundary, or accepted adapter. Move one
+ domain family at a time.
+6. Move required hub collaborators into validated constructor options. Runtime
+ mutation remains only for genuinely replaceable state.
+7. Replace mirrored send/visibility rules with canonical value-taking
+ predicates.
+8. Split construction, start, stop, drain, and router mounting into explicit
+ ownership with one composite close contract.
+9. Decompose handshake/replay, broadcast, command, voice, query, and auth
+ hotspots along tested lock and transaction boundaries.
+10. Generate or verify machine-readable protocol, API, schema, and
+ configuration documentation.
+11. Establish performance baselines for permission invalidation, read-state
+ writes, broadcast/replay, database waits, reconnect storms, and upload
+ admission.
+
+### Hold point HP-3 — First vertical-slice review
+
+Complete one domain extraction from route through service, storage, tests, and
+documentation. Confirm that it reduces coupling without weakening B2 contracts
+before repeating the pattern.
+
+### Exit gate
+
+- Every direct database use above the domain layer is justified or removed.
+- Required hub wiring cannot be omitted after construction.
+- Permission rules have one production implementation per security property.
+- Start, stop, drain, and failure ownership is explicit and tested.
+- Race, deadlock, compatibility, fuzz seeds, model simulation, coverage, and
+ load baselines remain green.
+- No measured regression exists outside a recorded tradeoff accepted at HP-3.
+
+### Required evidence
+
+- boundary and database-call inventory with dispositions;
+- before/after dependency graph for each extraction;
+- coverage, benchmark, race, deadlock, fuzz, and model-test reports;
+- lifecycle failure-injection report;
+- generated-contract drift check.
+
+### Safe parallelism
+
+Guardrail tooling and baseline measurement may run while the first vertical
+slice is prepared. After HP-3, unrelated domain families may proceed in
+parallel only when they do not share schema migrations, permission predicates,
+or hub lifecycle ownership.
+
+## B4 — Complete identity, recovery, privacy, and data lifecycle
+
+**Objective:** make local accounts and stored data recoverable, revocable,
+retained, and erasable without central services or misleading privacy claims.
+
+**Primary requirements:** BPR-041 through BPR-046 and BPR-052 through BPR-055.
+
+### Entry gate
+
+- B3 domain, database, audit, and lifecycle boundaries are established.
+- Backup/restore fixtures and representative alpha data are captured.
+- Destructive operations have private threat and failure models.
+
+### Workstreams
+
+1. Implement invite-only default registration with explicit approval-based and
+ open modes.
+2. Require authentication for messages, files, calls, and moderation; keep
+ anonymous guest access absent.
+3. Keep email optional and SMTP nonessential for registration or recovery.
+4. Implement a locally generated recovery kit with only protected,
+ non-reversible server-side verification material and one-time rotation.
+5. Implement short-lived administrator-assisted recovery after local identity
+ verification, with safe audit, affected-session revocation, and rate limits.
+6. Preserve TOTP multi-factor authentication and emergency recovery codes as
+ beta features. Optional SMTP recovery may be enabled, but no external
+ service becomes an availability dependency. Prohibit security questions.
+7. Expose device/session listing, new-login events, individual revocation, and
+ sign-out-everywhere server contracts for later client consumption.
+8. Implement atomic admission budgets for password confirmation and other
+ expensive authentication work.
+9. Implement complete account erasure for profile, credentials, sessions,
+ messages, reactions, uploads, and other authored data.
+10. Retain only unlinkable event category, time, action class, and integrity
+ proof after cryptographically erasing the subject mapping. Preserve durable
+ deletion markers sufficient to prevent backup resurrection.
+11. Implement indefinite default message retention plus server/channel
+ policies and attachment cleanup.
+12. Keep diagnostics local, make support-bundle export user initiated, and
+ prevent automatic product or usage telemetry.
+
+### Hold point HP-4 — Irreversible-data review
+
+Before enabling deletion or retention cleanup, review migration, transaction,
+backup, restore, interrupted-operation, disk-full, and legal/operator wording.
+Run the destructive tests against disposable copies of real-shaped alpha data.
+
+### Exit gate
+
+- All registration modes enforce their documented default and transitions.
+- Recovery works without SMTP, rotates secrets, revokes sessions, rate-limits
+ attempts, and produces content-free audit evidence.
+- Multi-device session contracts list and revoke only the correct account's
+ devices.
+- Deletion removes every required data class and backup restore cannot
+ resurrect the account.
+- Retention removes messages and attachments consistently without bypassing
+ legal/operator holds if such a mechanism is explicitly introduced.
+- Support bundles are user initiated, reviewed for secrets, and no automatic
+ telemetry traffic occurs.
+- Alpha-shaped data migrates forward and rolls back according to the declared
+ boundary.
+
+### Required evidence
+
+- registration-mode state tests;
+- recovery abuse, replay, concurrency, and restart tests;
+- session inventory/revocation integration tests;
+- deletion data-lineage checklist and post-restore proof;
+- retention clock/attachment cleanup tests;
+- network capture demonstrating no automatic telemetry;
+- migration and rollback rehearsal report.
+
+### Safe parallelism
+
+Registration/session work and local-diagnostics work may proceed in parallel.
+Recovery, deletion, and retention share schema and audit concerns and are
+serialized until HP-4 fixes their data contracts.
+
+## B5 — Add community, content, and moderation services
+
+**Objective:** complete the server-side services needed for safe community
+operation before building their full cross-client experience.
+
+**Primary requirements:** BPR-060 through BPR-063 and BPR-070 through BPR-073.
+
+### Entry gate
+
+- B4 identity, audit, deletion, retention, and session behavior is stable.
+- Canonical permission predicates and bounded-work primitives exist.
+- Abuse cases and data ownership for each service are documented.
+
+### Workstreams
+
+1. Implement a Message Requests state machine for first contact: pending,
+ safely previewed, accepted, ignored, deleted, or blocked. Acceptance creates
+ a server-local trusted-sender relationship.
+2. Retain and polish the existing link-preview, GIF-search, YouTube/media
+ embed, and rich-content set behind privacy-preserving bounded retrieval.
+ Provider expansion is optional and otherwise post-beta.
+3. Enforce redirect, resolved-address, type, size, duration, streaming,
+ concurrency, cache, and offline policies for every external fetch. Avoid
+ residual full-body buffering.
+4. Add durable upload/storage quotas, reserved disk headroom, cleanup, and
+ operator-visible pressure behavior.
+5. Enforce NSFW labels and per-user acknowledgement server-side. Do not return
+ or fetch concealed third-party media before consent.
+6. Implement local report intake for messages, users, and attachments with
+ evidence snapshots, surrounding-context rules, assignment, status, internal
+ notes, action links, retention, and immutable audit history.
+7. Implement narrowly permissioned warning, timeout, removal, kick, and ban.
+ Keep TLS, backup, update, and other operator controls owner-only.
+8. Implement rate-limited appeals, status transitions, moderator decisions,
+ user-visible status, and audit.
+9. Implement per-server Web Push subscription storage and dispatch plumbing
+ with owner enablement, user consent, generic-content defaults, VAPID
+ rotation, and stale-subscription cleanup. There is no OwnCord relay.
+10. Keep automation optional. Human moderation authority and audit remain core
+ even if automation becomes a post-beta plugin candidate.
+
+### Hold point HP-5 — Abuse and privacy review
+
+Review spam, block bypass, malicious previews, private-address resolution,
+redirects, decompression, oversized streams, storage exhaustion, report
+confidentiality, moderator privilege, appeal abuse, and notification leakage
+before exposing the endpoints.
+
+### Exit gate
+
+- Message Requests cannot bypass block, permission, retention, or deletion
+ rules.
+- External retrieval passes address, redirect, streaming-size, timeout,
+ concurrency, media-type, and offline adversarial tests.
+- NSFW content and third-party fetches remain unavailable before consent.
+- Report, moderation, and appeal state machines enforce least privilege and
+ immutable safe audit.
+- Storage quotas and disk headroom fail safely under concurrency and restart.
+- Push subscriptions are per server/device, opt-in, revocable, and contain no
+ sensitive default payload.
+- No unresolved B5 security advisory remains.
+
+### Required evidence
+
+- state-machine and property tests for requests, reports, actions, and appeals;
+- private safe-fetch and quota security validation;
+- storage-pressure and cleanup tests;
+- role/permission matrix;
+- push endpoint and subscription lifecycle tests;
+- retention/deletion integration for every new data class.
+
+### Safe parallelism
+
+Message Requests, moderation, and content retrieval may be separate teams only
+after shared permission, audit, rate-limit, and retention interfaces are
+frozen. Push storage may proceed independently but dispatch waits for those
+privacy defaults.
+
+## B6 — Qualify server deployment, operations, and capacity
+
+**Objective:** prove an owner can securely deploy, upgrade, recover, and
+operate the completed server on every supported mode without an OwnCord
+service.
+
+**Primary requirements:** BPR-011 through BPR-016 and BPR-030.
+
+### Entry gate
+
+- Server behavior through B5 is feature-complete for beta.
+- Configuration, migration, storage, and release contracts are frozen.
+- Representative domain, public-IP, LAN, offline, and failure test
+ environments are available.
+
+### Workstreams
+
+1. Build and smoke Windows x64/ARM64 executables and Linux x64/ARM64 archives
+ as fully tested standalone release assets.
+2. Publish and smoke Docker images for linux/amd64 and linux/arm64 with
+ persistent-data, health, migration, graceful-drain, and minimal-privilege
+ behavior.
+3. Implement owner-friendly HTTPS/WSS modes:
+ - public domain with automatic ACME;
+ - stable public IPv4/IPv6 with an eligible public-CA flow;
+ - private LAN/offline with an OwnCord local CA and explicit device trust;
+ - manual certificate mode for advanced owners.
+4. Keep reverse proxies optional. Validate direct port-forwarded operation and
+ document blocked-port, CGNAT, hairpin-NAT, dynamic-IP, and firewall limits
+ honestly.
+5. Protect certificate/account keys, persist renewal state, hot-reload
+ certificates, renew with ample margin, and exercise expiry/rotation.
+6. Add the disabled-by-default optional browser-hosting switch and stable
+ origin/path contract. B8 supplies the final signed client bundle.
+7. Rehearse alpha-to-beta database, attachment, configuration, credential, and
+ backup upgrade/rollback on Docker and standalone deployments.
+8. Publish hardware-specific measurements proving at least 250 registered
+ users, 100 simultaneous connections, and 25 concurrent voice participants.
+9. Measure reconnect storms, database waits, message fan-out, voice control,
+ upload/download pressure, TLS overhead, and graceful shutdown.
+10. Exercise backup/restore, deletion-marker restore, disk-full, low-headroom,
+ corrupt input, unhealthy dependency, interrupted migration, and rollback.
+11. Pin or automatically review containers and build inputs; produce signed
+ SBOM, provenance, checksums, and source-snapshot evidence.
+12. Document local logs, support-bundle generation, capacity limits, ports,
+ storage growth, certificate trust, recovery, updates, and safe failure.
+
+Public IP certificates are feasible only for eligible stable public addresses
+and currently require short-lived certificate handling. Private or reserved IP
+addresses cannot receive public-CA certificates, so LAN/offline mode needs
+explicit local trust. Implementation and test plans must follow the current
+[Let's Encrypt IP certificate guidance](https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability),
+[ACME challenge guidance](https://letsencrypt.org/docs/challenge-types/), and
+[CA/B Forum requirements](https://cabforum.org/working-groups/server/baseline-requirements/requirements/).
+
+### Hold point HP-6 — Operator and capacity acceptance
+
+An owner unfamiliar with the code must deploy each mode from current
+documentation, understand unavoidable network/trust limitations, recover a
+backup, rotate trust, and interpret failure. The reference load profile must
+meet its budgets on stated hardware before client expansion begins.
+
+### Exit gate
+
+- Every server artifact installs or starts, migrates, becomes healthy, serves
+ WSS/API traffic, drains, restarts, and restores data.
+- Domain, public-IP, LAN, and offline TLS modes pass their owned matrix.
+- Direct port forwarding works where the network permits it; limitations are
+ actionable and never disguised as application success.
+- Browser hosting is disabled by default and cannot accidentally expose an
+ incomplete bundle.
+- The 250/100/25 profile is met with published hardware, configuration, p95/p99
+ latency, resource, and failure measurements.
+- Backup/restore, disk pressure, certificate rotation, update, and rollback
+ drills pass.
+- Release inputs and outputs are traceable and signed.
+
+### Required evidence
+
+- artifact and container install/boot matrix;
+- ACME staging, public-IP, local-CA, expiry, and rotation reports;
+- network-mode integration matrix;
+- load-test dataset and reproducible commands;
+- upgrade/rollback/restore drill;
+- SBOM, provenance, signatures, checksums, and source snapshot;
+- operator usability record.
+
+### Safe parallelism
+
+Packaging, TLS modes, capacity measurement, failure drills, and supply-chain
+work can proceed in parallel after configuration and storage contracts freeze.
+The same release candidate and data fixtures must be used before HP-6 closes.
+
+## B7 — Establish the shared client platform and desktop parity
+
+**Objective:** move desktop behavior behind explicit platform contracts,
+strengthen client architecture, and consume the completed server services
+without regressing the current application.
+
+**Primary requirements:** BPR-033 through BPR-035.
+
+### Entry gate
+
+- The complete beta server is stable through B6.
+- Generated protocol and compatibility fixtures are available to clients.
+- Desktop behavior, bundle, startup, memory, and test baselines are recorded.
+
+### Workstreams
+
+1. Define typed contracts for HTTP, WebSocket, credentials, profiles,
+ notifications, media, LiveKit, update, logs, filesystem, and window
+ behavior.
+2. Move native Tauri use behind the desktop adapter one responsibility at a
+ time. Add contract tests before implementing browser adapters.
+3. Split target-neutral Vite configuration from desktop packaging and create
+ explicit desktop and web compile gates from one source tree.
+4. Clear the 471-warning Oxlint baseline, unexplained Knip hints, unexpected
+ test logs, and unjustified coverage exclusions. Ratchet all gates.
+5. Add client startup, route, LiveKit, RNNoise, and feature bundle budgets.
+ Dynamically load/cache optional voice processing outside startup paths.
+6. Break production import cycles and decompose voice/session, E2EE, dispatcher,
+ message, store, and large UI modules by ownership, not arbitrary line count.
+7. Centralize timer/listener ownership and test teardown, reconnect,
+ supersession, replay, ordering, and long-session memory.
+8. Implement the server-led compatible-update notice and safe incompatible
+ state.
+9. Keep one active server connection while preserving isolated saved profiles
+ and quick switching.
+10. Add device/session list, new-login notice, individual revoke, and
+ sign-out-everywhere UI.
+11. Add desktop flows for registration modes, recovery, deletion, retention
+ disclosure, and local support-bundle export.
+12. Build and smoke Windows x64/ARM64 and Linux x64/ARM64 desktop artifacts,
+ using native Windows ARM64 evidence and declared Linux ARM64 evidence.
+
+### Hold point HP-7 — Desktop parity before browser behavior
+
+The desktop adapter must reproduce the existing app plus approved B2–B6 client
+flows with no direct Tauri imports outside owned adapter/bootstrap files.
+Review performance, accessibility foundations, and packaging before filling in
+browser implementations.
+
+### Exit gate
+
+- One application compiles through explicit desktop and web contract surfaces.
+- Native APIs are isolated and contract-tested.
+- Required client checks are green with zero unapproved warnings and honest
+ coverage.
+- E2E exits unaided and teardown/leak tests pass.
+- Compatible updates, incompatible-version failure, profile switching, and
+ multi-device session management work end to end.
+- Desktop artifacts pass install, boot, connect, update, rollback, media, and
+ recovery smoke on the supported architecture matrix.
+- Startup, bundle, voice-join, and long-session budgets meet or improve the
+ accepted baseline.
+
+### Required evidence
+
+- adapter inventory and contract-test matrix;
+- import-cycle and native-import checks;
+- unit, browser-smoke, E2E, Rust, Clippy, build, and dependency reports;
+- bundle manifest and runtime performance measurements;
+- signed desktop artifact smoke matrix;
+- server-version/session/recovery integration recordings.
+
+### Safe parallelism
+
+Test-gate cleanup and adapter contract design may proceed together. Adapter
+migrations are serialized by responsibility. After the contracts stabilize,
+UI flows for updates, profiles, sessions, and recovery may run in parallel.
+Architecture extraction never shares a change with new feature behavior.
+
+## B8 — Deliver browser, PWA, phone, and tablet support
+
+**Objective:** implement the optional server-hosted browser client from the
+shared application, with honest secure-context, offline, push, and mobile
+behavior.
+
+**Primary requirements:** BPR-020 through BPR-025.
+
+### Entry gate
+
+- HP-7 confirms desktop parity and stable platform contracts.
+- B6 browser-hosting, TLS, and origin contracts are available.
+- B5 push service and privacy defaults are available.
+
+### Workstreams
+
+1. Implement browser adapters for network, credential/session storage,
+ notifications, media, LiveKit, logs, updates, and unsupported native
+ capabilities.
+2. Package the web application as a server-owned optional asset, disabled by
+ default and served from one canonical HTTPS origin when enabled.
+3. Add an installable manifest, icons, standalone presentation, update
+ behavior, and a service worker scoped to application assets.
+4. Do not cache API responses, credentials, message content, attachments, or
+ moderator evidence unless a later reviewed design explicitly requires it.
+5. Implement Web Push opt-in, per-device subscriptions, generic notification
+ payloads, click routing, revocation, VAPID rotation, and stale-subscription
+ cleanup without an OwnCord relay.
+6. Design responsive phone and tablet navigation rather than merely hiding
+ desktop sidebars. Cover touch targets, virtual keyboards, safe areas,
+ orientation, zoom, and constrained media.
+7. Handle secure-context requirements for service workers, media capture,
+ screen sharing, and push. Provide local-CA onboarding, fingerprint,
+ installation, rotation, and removal guidance for LAN/offline devices.
+8. Make unsupported browser or OS behavior explicit and actionable.
+9. Test current Chromium, Firefox, and WebKit engines in automation, then test
+ real supported browsers/devices for release qualification.
+10. Preserve one active server connection and per-server account/profile
+ isolation.
+
+Service workers, camera/microphone, Web Push, and screen capture require secure
+contexts in normal browser use. The plan follows the relevant
+[Secure Contexts](https://www.w3.org/TR/secure-contexts/),
+[Service Workers](https://www.w3.org/TR/service-workers/),
+[Media Capture](https://www.w3.org/TR/mediacapture-streams/),
+[Push API](https://www.w3.org/TR/push-api/), and
+[Screen Capture](https://www.w3.org/TR/screen-capture/) standards. Automated
+WebKit coverage is useful but does not replace real Safari/iPhone/iPad
+qualification.
+
+### Hold point HP-8 — Browser/mobile preview acceptance
+
+Run an owner-enabled preview on desktop browser, Android phone/tablet, and
+iPhone/iPad. Confirm installation, navigation, auth, media, push availability,
+offline state, local trust, update, and disable/removal behavior before
+declaring browser parity.
+
+### Exit gate
+
+- Browser hosting remains unavailable until an owner explicitly enables it.
+- Desktop/browser share domain behavior and protocol contracts; divergence is
+ limited to documented API constraints.
+- PWA installation, asset update, cache invalidation, and offline fallback are
+ safe.
+- Phone/tablet workflows remain usable with touch, virtual keyboard, safe
+ areas, rotation, zoom, and constrained media.
+- Push requires owner and user opt-in, uses no OwnCord relay, and degrades
+ honestly where unavailable or offline.
+- Secure-context and LAN trust onboarding is actionable.
+- Chromium, Firefox, WebKit automation and real-device qualification are green
+ for the declared support matrix.
+
+### Required evidence
+
+- web build and server-host toggle tests;
+- manifest/service-worker/cache inspection;
+- push subscription, payload, revocation, and cleanup tests;
+- browser engine and real-device matrix;
+- responsive screenshots plus keyboard/touch/screen-reader records;
+- secure-context, local-CA, offline, and update tests.
+
+### Safe parallelism
+
+Service-worker/PWA work, responsive layout foundations, push client work, and
+browser media adapters may proceed in parallel after shared adapter and origin
+contracts freeze. Final cache, permission, and navigation integration is
+serialized before HP-8.
+
+## B9 — Complete unified feature UX, accessibility, and polish
+
+**Objective:** expose every approved server capability consistently across
+desktop, browser, PWA, phone, and tablet while preserving OwnCord's identity.
+
+**Primary requirements:** BPR-064 and BPR-090 through BPR-092. B9 also closes
+the client experience for BPR-060 through BPR-063 and BPR-070 through BPR-073.
+
+### Entry gate
+
+- Desktop and browser platform matrices are green.
+- B5 service contracts are stable and security-reviewed.
+- Design tokens, interaction patterns, and accessibility test rules are agreed.
+
+### Workstreams
+
+1. Add the Message Requests inbox with safe preview, accept, ignore, delete,
+ and block behavior.
+2. Polish link previews, GIF search, YouTube/media embeds, and external-content
+ consent/loading/error behavior across network modes.
+3. Replace the current NSFW concealment-only behavior with a gate that prevents
+ content and third-party fetch before acknowledgement.
+4. Add a permission-gated Moderation Center for report queue, evidence/context,
+ assignment, status, notes, actions, audit history, and appeal handling.
+5. Add warning, timeout, removal, kick, ban, and appeal status experiences that
+ reveal only authorized information.
+6. Organize English UI text behind translation-ready boundaries without
+ promising another beta language.
+7. Preserve recognizable OwnCord navigation and visual identity while
+ rationalizing spacing, states, feedback, responsive behavior, and
+ performance.
+8. Treat accessibility as a blocking property: keyboard, pointer, touch,
+ screen reader, focus, contrast, reduced motion, zoom, reflow, announcements,
+ errors, virtual keyboard, and media controls.
+9. Clearly label desktop-only features, unsupported browser APIs, offline
+ state, notification limitations, update state, and degraded media.
+10. Run privacy, moderation, deletion, retention, block, session, and
+ compatibility journeys across every client surface.
+
+### Hold point HP-9 — Feature freeze and accessibility acceptance
+
+No new beta feature enters after this point. Review every requirement journey
+on all applicable surfaces, triage every accessibility defect, and freeze
+strings, protocol, migrations, and user-visible behavior for the release
+candidate.
+
+### Exit gate
+
+- Every approved feature has end-to-end desktop and browser evidence, with
+ documented browser exceptions.
+- Message Requests, moderation, appeals, NSFW consent, and external content
+ preserve server security and privacy rules.
+- Accessibility tests and manual assistive-technology checks have no release
+ blocker.
+- Phone/tablet layouts expose all required navigation and actions.
+- English strings are centralized/structured for later translation.
+- No UI claims unsupported offline, media, push, update, or network behavior.
+- Performance budgets and OwnCord visual identity are preserved.
+
+### Required evidence
+
+- requirement-journey matrix and recordings;
+- automated accessibility reports and manual keyboard/screen-reader/touch
+ checklist;
+- visual regression and responsive evidence;
+- privacy/network inspection for consent-gated content;
+- moderation role matrix and audit walkthrough;
+- translation-readiness scan and bundle/performance report.
+
+### Safe parallelism
+
+Message Requests, moderation UX, content/NSFW UX, and translation extraction
+may proceed in parallel behind stable B5 contracts. Accessibility reviewers
+work continuously across all streams. Shared navigation, design tokens, and
+global state changes are serialized.
+
+## B10 — Qualify and publish the public beta
+
+**Objective:** prove one immutable release candidate satisfies the complete
+product, security, platform, upgrade, operations, and community contract before
+publishing it on GitHub.
+
+**Primary requirements:** BPR-001, BPR-004, BPR-005, and BPR-010. B10
+re-verifies every BPR.
+
+### Entry gate
+
+- HP-9 freezes features, protocol, migrations, and strings.
+- All B0–B9 exit gates are green.
+- One release-candidate commit and version are selected.
+- No unresolved security advisory or unverified release blocker exists.
+
+### Qualification work
+
+1. Run the complete required matrix on the exact release-candidate SHA.
+2. Require 30 consecutive green integration runs, excluding only documented
+ external infrastructure cancellations.
+3. Hold a 14-day release-candidate soak with long sessions, reconnects,
+ upgrades, restarts, media, push, retention, deletion, moderation, and
+ operator review.
+4. Test in-place upgrade from representative 1.2.0-alpha data, attachments,
+ configuration, credentials, and client settings, plus rollback within the
+ declared boundary.
+5. Re-run protocol epochs N, N-1, and N-2 plus actionable N-3 rejection.
+6. Re-run the full Windows x64/ARM64 and Linux x64/ARM64 desktop matrix, server
+ artifacts, multi-architecture Docker, browser engines, Android
+ phone/tablet, and iPhone/iPad matrix.
+7. Re-run domain, public-IP, LAN, offline, optional browser hosting, PWA,
+ Web Push, backup/restore, disk-full, certificate rotation, and update
+ scenarios.
+8. Reproduce the 250/100/25 reference capacity profile and compare it with B6.
+9. Confirm zero open P0/P1 defect, zero unresolved advisory, and explicit
+ owner/rationale/review trigger for every accepted lower risk.
+10. Verify release version agreement, source snapshot, licenses, SBOM,
+ provenance, checksums, signatures, update manifests, cold boot, install,
+ update, rollback, and download.
+11. Verify public setup, security, privacy, operator, recovery, moderation,
+ accessibility, support, feedback, and contribution documentation.
+12. Prepare safe release notes and coordinated fixed-vulnerability disclosure.
+ Do not publish private exploit material by default.
+
+### Hold point HP-10 — Human go/no-go
+
+The owner reviews one final scorecard. Publication is allowed only when every
+required artifact points to the same commit, all evidence is green, the private
+security queue is empty, and rollback is rehearsed. A known blocker means
+no-go, regardless of elapsed time.
+
+### Exit gate
+
+- The exact release candidate passes all phase and requirement evidence.
+- Thirty consecutive integration runs and the 14-day soak are green.
+- Zero P0/P1 and zero unresolved security advisory remain.
+- All supported artifacts install, start, connect, update, roll back, and
+ verify.
+- Upgrade preserves required server data and client settings.
+- Capacity, performance, accessibility, privacy, deletion, recovery,
+ moderation, browser/PWA, and operations budgets pass.
+- GitHub release assets, source, metadata, checksums, signatures, SBOM, and
+ provenance agree.
+- Public documentation and community intake are ready.
+
+### Required evidence
+
+- immutable release scorecard linked to the exact commit and tag;
+- integration-run history and 14-day soak log;
+- complete platform/deployment/device matrix;
+- migration, rollback, restore, and deletion proof;
+- security closure attestations;
+- signed artifact and metadata verification;
+- anonymous download/install smoke;
+- final requirements traceability export with no missing or failed row.
+
+### Safe parallelism
+
+Platform, deployment, browser/device, capacity, accessibility, and
+documentation qualification may run in parallel against the same immutable
+candidate. Tagging and publication are serialized after HP-10.
+
+## Safe parallelism summary
+
+| Phase | Work that may overlap | Work that stays serialized |
+| ----- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| B0 | Read-only validation, requirement mapping, independent security review | Shared test-infrastructure fixes and baseline acceptance |
+| B1 | Docs, command design, artifact investigation, community templates | Each move/rename and its full verification |
+| B2 | Fixtures, threat review, plugin inventory, dependency audit | Protocol, permission, and E2EE production changes |
+| B3 | Guardrail tooling and measurement | First vertical slice; shared schema/lifecycle/permission work |
+| B4 | Registration/session and local diagnostics | Recovery, deletion, retention data contracts until HP-4 |
+| B5 | Requests, moderation, content, and push after shared contracts | Shared authz/audit/rate-limit/retention integration |
+| B6 | Packaging, TLS, load, failure drills, supply chain | Final candidate convergence and operator acceptance |
+| B7 | Gate cleanup and contract design; later independent UI flows | Adapter moves and architecture extractions |
+| B8 | PWA, responsive, push, and media adapters after contracts | Final cache/permission/navigation integration |
+| B9 | Feature UIs behind stable services | Navigation, design tokens, global state, final accessibility acceptance |
+| B10 | Qualification lanes on one immutable candidate | Tag, publication, and coordinated disclosure |
+
+Preparation for the next phase may include design notes, fixtures, and
+non-mutating research. It may not merge production behavior before the current
+exit gate.
+
+## Release-blocker policy
+
+- P0: a required gate is red, the integration is not safely releasable, or an
+ active compromise/data-loss/release-integrity failure exists. Stop work that
+ could obscure the cause; remediate security-sensitive cases privately.
+- P1: supported-path security, correctness, privacy, compatibility,
+ accessibility, install, upgrade, or operations failure. Must close before the
+ owning phase exits.
+- P2: material quality or maintainability risk. Must be fixed in its planned
+ phase or accepted explicitly with owner, rationale, review date, and trigger.
+- P3: nonblocking improvement. May move post-beta only when it does not violate
+ a frozen requirement or permanent quality ratchet.
+
+New P0/P1 discoveries enter the active phase immediately. Other new feature
+ideas remain post-beta unless they are required for security, correctness,
+accessibility, platform parity, or completion of an approved requirement.
+
+## Phase scorecard
+
+Every hold point and phase exit records at least:
+
+| Metric | Baseline | Target | Actual | Exact evidence |
+| ------------------------------ | ---------------------------: | --------------: | -----: | -------------- |
+| Required checks green | refresh in B0 | 100% | | |
+| Open P0 / P1 | refresh in B0 | 0 / 0 | | |
+| Unresolved security advisories | private count | 0 | | |
+| Requirement rows passing | 0 fully qualified | 100% applicable | | |
+| Server aggregate/core coverage | 74.6% aggregate | ratchet | | |
+| Client honest coverage | refresh in B0 | ratchet | | |
+| Static-analysis warnings | 471 Oxlint | 0 unapproved | | |
+| Unit/browser/E2E/Rust | two unit failures; E2E hangs | green and exits | | |
+| Largest startup/lazy chunks | refresh in B0 | budget | | |
+| Desktop/browser/device matrix | incomplete | 100% supported | | |
+| Server 250/100/25 profile | unproven | met | | |
+| Upgrade/rollback/restore | unproven | green | | |
+| Generated/doc drift | refresh in B0 | 0 | | |
+
+The actual values and links belong in phase evidence, not as optimistic edits
+to this plan.
+
+## First implementation slice
+
+Start with B0 only:
+
+1. repair the two failing Vitest contracts;
+2. make Playwright terminate reliably;
+3. collect matched server lint and Docker evidence;
+4. finish issue/security/requirement reconciliation;
+5. run the exact-SHA full matrix and publish the non-sensitive baseline
+ scorecard.
+
+Then execute the B1 structural work as isolated changes. Do not begin server
+feature implementation, client architecture extraction, or browser work before
+those two gates close.
diff --git a/graphify-out/.graphify_labels.json b/graphify-out/.graphify_labels.json
index 69f432f0..3a9ef762 100644
--- a/graphify-out/.graphify_labels.json
+++ b/graphify-out/.graphify_labels.json
@@ -1,15 +1,15 @@
{
- "0": "newRoleCRUDService",
+ "0": "markdown.ts",
"1": "createElement",
"2": "testing.T",
- "3": "livekitSession.ts",
- "4": "dispatcher.ts",
+ "3": "LiveKitSession",
+ "4": "channels.store.ts",
"5": "openMigratedMemory",
"6": "context.Context",
"7": "buildChannelRouter",
- "8": "MessageInput.ts",
- "9": "attachments.ts",
- "10": "DMService",
+ "8": "seedMemberUser",
+ "9": "MessageInput.ts",
+ "10": "members.store.ts",
"11": "waitRegistered",
"12": "types.ts",
"13": "NewAdminAPI",
@@ -26,24 +26,24 @@
"24": "newAuthTestDB",
"25": "newMigratedTestDB",
"26": "time.Time",
- "27": "Config",
+ "27": "test-utils.ts",
"28": "secret_store.rs",
"29": "Hub",
"30": "database/sql.Result",
"31": "newUploadTestDB",
- "32": "AppearanceTab.ts",
- "33": "writeJSON",
- "34": "AuditWriter",
+ "32": "VideoGrid.ts",
+ "33": "net/http.HandlerFunc",
+ "34": "newAdminTestDB",
"35": "HashToken",
- "36": "content-parser.ts",
- "37": "drag-reorder.test.ts",
+ "36": "attachments.ts",
+ "37": "DMService",
"38": "newRegistryWithDir",
- "39": "messages.store.ts",
+ "39": "dispatcher.ts",
"40": "Instance",
- "41": "Queries",
+ "41": "screenShare.ts",
"42": "NewChecker",
"43": "middleware_test.go",
- "44": "MainPage.ts",
+ "44": "UserBar.ts",
"45": "DB",
"46": "testing.F",
"47": "Result",
@@ -51,26 +51,26 @@
"49": "native/helpers.ts",
"50": "NewRouter",
"51": "profileCreateToken",
- "52": "User",
+ "52": "buildErrorMsg",
"53": "newTestDB",
- "54": "MemberList.ts",
+ "54": "MainPage.ts",
"55": "newServeHub",
"56": "3. Security",
"57": "permissions_test.go",
- "58": "seedMemberUser",
+ "58": "newOverrideFixture",
"59": "postJSONWithToken",
"60": "http_proxy.rs",
"61": "newVoiceTestDB",
"62": "livekit_test.go",
"63": "dbgen/models.go",
"64": "ProfileManager",
- "65": "architecture/README.md",
+ "65": "README.md",
"66": "devDependencies",
"67": "LoadOrGenerate",
"68": "helpers_test.go",
- "69": "ConnectPage.ts",
+ "69": "main.ts",
"70": "Security Policy",
- "71": "Role",
+ "71": "WriteAudit",
"72": "channels.sql.go",
"73": "Deployment Guide",
"74": "livekit_proxy_test.go",
@@ -81,62 +81,62 @@
"79": "db/db.go",
"80": "Tables",
"81": "newMentionFixture",
- "82": "message.go",
+ "82": "messages_test.go",
"83": "newWAFMiddleware",
- "84": "ws.ts",
+ "84": "Config",
"85": "storage_test.go",
"86": "Migrate",
"87": "Hub",
"88": "admin/export_test.go",
- "89": "logger.ts",
+ "89": "dispatcher.test.ts",
"90": "updater_test.go",
"91": "newTestMessageService",
- "92": "textAssetServer",
+ "92": "newTestUpdater",
"93": "Hub",
"94": "compilerOptions",
"95": "OwnCord — Repo Health Audit",
- "96": "net/http.Request",
+ "96": "handleCreateEmoji",
"97": "emoji_handler_test.go",
- "98": "buildErrorMsg",
- "99": "channelFromFields",
- "100": "openAdminTestDB",
- "101": "NewEventRingBuffer",
+ "98": "buildVoiceLeave",
+ "99": "media.ts",
+ "100": "doRequest",
+ "101": "handleRestoreBackup",
"102": "Auth Endpoints",
"103": "MigrateFS",
- "104": "PermissionService",
+ "104": "Queries",
"105": "Save",
"106": "REST API Reference",
- "107": "deps.go",
+ "107": "RateLimiter",
"108": "joinVoice",
"109": "ptt.rs",
"110": "OwnCord Audit — Documentation Accuracy & UI/UX Test Coverage (2026-08-04)",
"111": "scripts",
"112": "checkSourceWith",
"113": "Load",
- "114": "handleVoiceE2EEAnnounceV2",
- "115": "Registry",
+ "114": "Registry",
+ "115": "AdminActions.ts",
"116": "newEmitTestHub",
"117": "Plan: Remediate security-hardening review regressions",
"118": "verify.go",
"119": "chdirTemp",
- "120": "StartEventPruner",
+ "120": "NewEventPersister",
"121": "EnsureLiveKitBinary",
"122": "clientip_test.go",
- "123": "reaction-tooltip.ts",
- "124": "VoiceTopic",
- "125": "gif_handler_test.go",
- "126": "e2e/helpers.ts",
+ "123": "Queries",
+ "124": "newRoleCRUDService",
+ "125": "net/http.Handler",
+ "126": "navigateToMainPage",
"127": "messages.sql.go",
"128": "Channel Endpoints",
"129": "newSignedTestUpdater",
"130": "host_http_test.go",
- "131": "Topic",
+ "131": "VoiceTopic",
"132": "DB",
"133": "users",
"134": "Client",
- "135": "Queries",
- "136": "handleChatCommandV2",
- "137": "Queries",
+ "135": "ConnectPageCallbacks",
+ "136": "newWazeroTestRegistry",
+ "137": "OwnCord beta requirement traceability",
"138": "wizardHandler",
"139": "middleware_and_spawn_test.go",
"140": "password_test.go",
@@ -144,20 +144,20 @@
"142": "handleVoiceTokenRefreshV2",
"143": "pubsub_test.go",
"144": "newChannelTestAPI",
- "145": "gapProbeSSEWriter",
- "146": "setupPrecheck",
+ "145": "TestHandleLogStream_EntryWrittenDuringBackfillIsDelivered",
+ "146": "net/http.Request",
"147": "log/slog.Value",
"148": "Updater",
- "149": "seedChannel",
+ "149": "Queries",
"150": "dependencies",
"151": "newHarvestVoiceDB",
"152": "Config Key Reference",
- "153": "Queries",
- "154": "markdown.ts",
- "155": "NewRegistry",
- "156": "OwnCord Client UX Specification (target state)",
- "157": "OwnCord — Comprehensive Project Audit",
- "158": "streamPreview.ts",
+ "153": "connectionStats.ts",
+ "154": "FenwickTree",
+ "155": "totp_test.go",
+ "156": "github.com/owncord/server/syncutil.Mutex",
+ "157": "NewRegistry",
+ "158": "ChannelSidebar.ts",
"159": "deep-link.ts",
"160": "testing.M",
"161": "newMockDB",
@@ -166,24 +166,24 @@
"164": "buildTauriMockScript",
"165": "OwnCord Introspection MCP Server",
"166": "Bug-detection improvements — design",
- "167": "EventPersister",
+ "167": "ux/README.md",
"168": "eslint-rules.js",
"169": "DB",
"170": "OwnCord — Security Review",
"171": "Plan: Slash command dispatcher in WS",
"172": "vad-worklet-timing.test.ts",
"173": "ChannelTopic",
- "174": "fakeStore",
+ "174": "rate-limiter.ts",
"175": "Open",
- "176": "RateLimiter",
- "177": "Key",
+ "176": "MountAuthRoutes",
+ "177": "e2e/helpers.ts",
"178": "fallback_crypto.rs",
"179": "Direct Messages",
"180": "WebSocket Protocol Reference",
"181": "command.go",
"182": "NewRingBuffer",
"183": "ws-load.js",
- "184": "newDMFixture",
+ "184": "NewMessageService",
"185": "handler",
"186": "tauri-client/package.json",
"187": "screen-share-tracks.test.ts",
@@ -206,15 +206,15 @@
"204": "handleVoiceE2EEOfferV2",
"205": "AudioPipeline",
"206": "Messaging — target UX",
- "207": "serviceErrorToResult",
- "208": "LiveKitProcess",
+ "207": "B0 baseline and audit reconciliation",
+ "208": "message.go",
"209": "LiveKitClient",
"210": "migrate.go",
- "211": "VoiceAudioTab.ts",
- "212": "Manifest",
- "213": "newWazeroTestRegistry",
- "214": "1. Channel sidebar",
- "215": "doRequest",
+ "211": "voice-audio-tab.test.ts",
+ "212": "OwnCord beta product requirements",
+ "213": "OwnCord repository-health issue register",
+ "214": "Queries",
+ "215": "newTestRoleService",
"216": "knip.json",
"217": "RNNoiseProcessor",
"218": "Store",
@@ -223,13 +223,13 @@
"221": "Connection & Authentication — target UX",
"222": "Settings & Admin — target UX",
"223": "buildClientUpdateRouter",
- "224": "EventSink",
+ "224": "DeviceManager",
"225": "newTestRoleService",
"226": "event.go",
"227": "NewTopicRateLimiter",
"228": "Skill Authoring — taxonomy, licensing, confidentiality, editing rules",
"229": ".oxlintrc.json",
- "230": "net/http.Handler",
+ "230": "setupDiagnosticsRouter",
"231": "e2e/dm-system.spec.ts",
"232": "Queries",
"233": "emoji.sql.go",
@@ -238,20 +238,20 @@
"236": "Voice Signaling",
"237": "Quick Start Guide",
"238": "OwnCord — Test Audit",
- "239": "newBackupFileDB",
+ "239": "OwnCord public-beta execution roadmap",
"240": "index.mjs",
- "241": "Checker",
+ "241": "Channel",
"242": "bughunt.harness.mjs",
- "243": "voice-audio-tab.test.ts",
- "244": "reactions.sql.go",
+ "243": "video-grid.test.ts",
+ "244": "context.CancelFunc",
"245": "Channel Permission Overrides",
"246": "Server Stats & User Administration",
"247": ".DeleteAccount",
- "248": "scanPluginDirectory",
- "249": "Channel",
+ "248": "loadPref",
+ "249": "syntax-highlight.ts",
"250": "slashFS",
"251": "Running the bughunt pipeline",
- "252": "VideoGrid.ts",
+ "252": "EventSink",
"253": "reconnectAfterCertAccept",
"254": "setupVoiceRoom",
"255": "emoji-voicemod.parity.spec.ts",
@@ -259,10 +259,10 @@
"257": "include",
"258": "VoiceWidgetOptions",
"259": "Custom Emoji",
- "260": "OwnCord — Test-Coverage Audit",
+ "260": "LiveKitProcess",
"261": "OriginAcceptOptions",
"262": "EventRingBuffer",
- "263": "setupRouter",
+ "263": "OwnCord full repository-health audit",
"264": "newTokenTestDB",
"265": "scripts",
"266": "bughunt-fix.harness.mjs",
@@ -274,31 +274,31 @@
"272": "Queries",
"273": "TestChannelVisibility_RESTWSAgreement",
"274": "Hub",
- "275": "Finish the V2 Dispatch Migration (backlog item 11) — Design",
+ "275": "plans/README.md",
"276": "Port Forwarding Guide",
"277": "Chat Messages",
"278": "hello/main.go",
- "279": "cancelAfterArm",
- "280": "Queries",
+ "279": "profile_fields_test.go",
+ "280": "noise-suppression.ts",
"281": "Client HTTP TOFU Proxy (D5) — Design",
"282": "create_tray",
"283": "API Tokens",
"284": "Backups",
"285": "Plugin Administration",
"286": "Invite Endpoints",
- "287": ".UpdateUserProfile",
+ "287": "Manifest",
"288": "Infrastructure roadmap — design",
"289": "Member Updates",
"290": "genprotocol/main.go",
"291": "RingBuffer",
- "292": "TestOwnerOnlyMiddleware_OwnerAllowed",
+ "292": "AuditWriter",
"293": "ChatSendCmd",
"294": "Environments, Activation Setup, and Handoff-Doc Mode",
- "295": "newBlockService",
+ "295": "scanPluginDirectory",
"296": "capabilities-scope.test.ts",
- "297": "notifications.ts",
+ "297": "window-state.ts",
"298": "GET /admin/api/updates",
- "299": "Channel-Visibility Unification (backlog item 3) — Design",
+ "299": ".deliverBroadcast",
"300": "sqlc Adoption (D2) — Progress & Plan",
"301": "Authentication Flow",
"302": "Voice Moderation",
@@ -307,28 +307,28 @@
"305": "prettier",
"306": "openFileDB",
"307": "hello plugin",
- "308": "TestHandlePresenceUpdate_BareStatusReadFailureAbortsBeforeCommit",
- "309": "groupDMFixture",
+ "308": "handleVoiceE2EEAnnounceV2",
+ "309": "IsUniqueConstraintError",
"310": "Tauri HTTP Capability Narrowing — Design",
"311": "protocol_contract_test.go",
"312": "ChatCommandCmd",
"313": "ci-check",
"314": "Comprehensive Review (scheduled or fallback)",
"315": "Credential storage",
- "316": "extractChatserverFromTarGz",
+ "316": "buildChannelUpdate",
"317": "cert-tofu.spec.ts",
- "318": "navigateToMainPageReady",
- "319": "newDeafenRaceDB",
+ "318": "updater.spec.ts",
+ "319": "OwnCord repository-layout and contributor-experience audit",
"320": "tsconfig.build.json",
"321": "User Blocks",
"322": "PATCH /admin/api/settings",
"323": "GET /api/v1/gif/search",
"324": "First-Run Setup",
"325": "LiveKit Endpoints",
- "326": "fuzzOpenMigratedMemory",
- "327": "README.md",
+ "326": "reactions.sql.go",
+ "327": "Tailscale Guide (Zero-Config Remote Access)",
"328": "LiveKitProcess",
- "329": "erroringMembersStore",
+ "329": "Voice, Video & E2EE — target UX",
"330": "ChatEditCmd",
"331": "VoiceE2EEOfferCmd",
"332": "VoiceModDeafenCmd",
@@ -339,11 +339,11 @@
"337": "OwnCord Architecture Blueprints",
"338": "Voice End-to-End Encryption",
"339": "feature_request.md",
- "340": "TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots",
- "341": "isAddrInUse",
- "342": "adminPanelSource",
+ "340": "ResolveTokenHash",
+ "341": "VerifyTOTPCodeOnce",
+ "342": "Hub",
"343": "ChatDeleteCmd",
- "344": "Permission-Middleware Consolidation (audit finding A-2026-07-16) — Design",
+ "344": "OwnCord — Test-Coverage Audit",
"345": "MessageDeletedDMEvent",
"346": "MessageEditedDMEvent",
"347": "MessageSentDMEvent",
@@ -368,7 +368,7 @@
"366": "VoiceE2EEOfferGuardedEvent",
"367": "File Upload and Serving",
"368": "Server Logs (SSE)",
- "369": "livekit-client",
+ "369": "B0 — Restore truth, freeze scope, and reconcile the audit",
"370": "CallSignalEvent",
"371": "DMChannelOpenEvent",
"372": "MessageDeletedChannelEvent",
@@ -412,17 +412,17 @@
"410": "Transport Layer",
"411": "pre-commit",
"412": "pre-push",
- "413": "stubBroadcastAllEvent",
+ "413": "scaledAuthLimit",
"414": "seedUser",
- "415": "@stryker-mutator/api/core",
+ "415": "global-keybinds.test.ts",
"416": "015_plugins.sql",
"417": "tryLoadPluginTOML",
"418": "tryLoadPluginTOML",
- "419": "roleDeletingInvalidator",
- "420": "buildMetricsRouter",
+ "419": "Queries",
+ "420": "mockTauriFullSessionWithVoice",
"421": "syscall.SysProcAttr",
- "422": "@tauri-apps/api/core",
- "423": "@tauri-apps/api/event",
+ "422": ".UpdateUserProfile",
+ "423": "B10 — Qualify and publish the public beta",
"424": "protocol-change/SKILL.md",
"425": "strip-appimage-bundled-libs.sh",
"426": "build.rs",
@@ -448,7 +448,7 @@
"446": "voice-test.sh",
"447": "proc_spawner_nix.go",
"448": "proc_spawner_win.go",
- "449": "failNthInstallStore",
+ "449": "OwnCord — Comprehensive Project Audit",
"450": "playwright.config.ts",
"451": "playwright.config.admin.ts",
"452": "playwright.config.native.ts",
@@ -529,14 +529,67 @@
"527": "hub_livekit.go",
"528": "hub_sweep.go",
"529": "message_types.go",
+ "530": "handleLogStream",
"531": "docker-smoke.sh",
- "532": "TestRegisterNow_ReplacementNeverLosesAConcurrentGlobalBroadcast",
+ "532": "B1 — Isolated repository and contributor foundation",
"533": "prettier",
+ "534": "buildUserUpdate",
"535": "@vitest/coverage-v8",
- "536": "RunningInContainer",
- "540": "RunningUnderSupervisor",
+ "536": "B2 — Freeze server protocol, trust, and compatibility contracts",
+ "537": "2. Code Quality",
+ "538": "B3 — Strengthen server architecture and permanent guardrails",
+ "539": "B4 — Complete identity, recovery, privacy, and data lifecycle",
+ "540": "B5 — Add community, content, and moderation services",
+ "541": "buildChannelDelete",
"542": "addrinuse_unix.go",
"543": "addrinuse_windows.go",
"544": "msg-actions-bar-focus-css.test.ts",
- "546": "hub_wiring_test.go"
+ "545": "navigation-guard.ts",
+ "546": "hub_wiring_test.go",
+ "547": "volume-menu.test.ts",
+ "548": "New",
+ "549": "B6 — Qualify server deployment, operations, and capacity",
+ "550": "MetricsSources",
+ "551": "B7 — Establish the shared client platform and desktop parity",
+ "552": "updater.test.ts",
+ "553": "B8 — Deliver browser, PWA, phone, and tablet support",
+ "554": "B9 — Complete unified feature UX, accessibility, and polish",
+ "555": "groupDMFixture",
+ "556": ".finishVoiceLeave",
+ "557": "protocolTypes.ts",
+ "558": "TestNewRouter_DeleteAccount_BroadcastsMemberBanOverWS",
+ "559": "4. Dependencies & Supply Chain",
+ "560": "global-teardown.ts",
+ "561": "newDeafenRaceDB",
+ "562": "5. Test Coverage & Quality",
+ "563": ".RoundTrip",
+ "564": "perm_grid_test.go",
+ "565": "NewRoleService",
+ "566": "buildMetricsRouter",
+ "567": "TestAdminAPI_PatchUser_RoleChangeBroadcastsEvenIfRoleReReadFails",
+ "568": "isAddrInUse",
+ "569": "TestRegisterNow_ReplacementNeverLosesAConcurrentGlobalBroadcast",
+ "570": "b0-dev-branch-protection.sh",
+ "571": "extractChatserverFromTarGz",
+ "572": "1. Architecture",
+ "573": "6. CI/CD & DevEx",
+ "574": "7. Observability",
+ "575": "TestHandleVoiceCameraV2_RefusedWhenScreenshareSlotFull",
+ "576": "audio-pipeline-vad-worklet.test.ts",
+ "577": ".applyMicMuteState",
+ "578": "RunningUnderSupervisor",
+ "579": "Non-negotiable execution rules",
+ "580": "failNthInstallStore",
+ "581": "TestAdminAuthMiddleware_DBErrorIsNotUnauthorized",
+ "582": "Security Policy",
+ "583": "TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots",
+ "584": "D7 — Module map",
+ "585": "D5 — Entity-relationship overview",
+ "586": "WebSocket / Real-time Engine",
+ "587": "adminPanelSource",
+ "588": "ParseLevel",
+ "589": "roleDeletingInvalidator",
+ "590": "identityKeyFailStore",
+ "591": "BuildTOTPURI",
+ "592": "errDMParticipantsStore"
}
diff --git a/graphify-out/.graphify_labels.json.sig b/graphify-out/.graphify_labels.json.sig
index 265d5ffc..8f551d13 100644
--- a/graphify-out/.graphify_labels.json.sig
+++ b/graphify-out/.graphify_labels.json.sig
@@ -1 +1 @@
-{"0": "ac77d0122ef1555b", "1": "e5be7262e817a8ea", "2": "1422671422441f97", "3": "b24c640c69407772", "4": "ca078c5a047dd07a", "5": "b8cb3b918b55a8a6", "6": "15f028fb1f368a03", "7": "bbda31e9741b65ac", "8": "4db51b1186aba0c2", "9": "d89b4d3e165891c8", "10": "bfbb0e6d15b4dc38", "11": "9327371952c6b6ef", "12": "90a5ba3345033199", "13": "4f1c87a9e7ff53ce", "14": "5776f7c7988b82af", "15": "7c49f6c7a25f1530", "16": "9d741f94d81a3cd5", "17": "b9d8b8fdfa107bbf", "18": "7c9334676b1eb362", "19": "f8ce9287e17f57a7", "20": "9a220b6ce6e4e851", "21": "79138093d14c4ce6", "22": "95158fb3df6fd1b1", "23": "28e7fb57f105818e", "24": "7d2c830ef6746b2f", "25": "a7b49882d9bc31f8", "26": "caa3a87cd72b8617", "27": "f3e9520b8c8d5171", "28": "fd3ba1d91df8b616", "29": "a7fbf66660425838", "30": "59bb9a2533fe4194", "31": "d4bb1a6ccff4a470", "32": "d4c46e45f3bd0107", "33": "23658c6e9398450c", "34": "7b91c7aaedff92e5", "35": "031910c24045294b", "36": "339e8156e7062c0f", "37": "4ea2b3ca02685cef", "38": "b007eb4d03d8ca74", "39": "807a63346b3343e8", "40": "16f52ab4d444170d", "41": "6e4ea9f6236016a6", "42": "480ef6d8d310ee55", "43": "a87746d8a1ed11f7", "44": "11e5de65ad87afe6", "45": "ef0ddfd62ee1af6c", "46": "7b503a24456e4d9d", "47": "fbe5e62aee5c11c3", "48": "2a883b5f7e85a353", "49": "6bdf4d070b3aae61", "50": "97e707b536037e38", "51": "512b7aa4a9f3064b", "52": "dfacd2478bdc45e9", "53": "518d8c7abd745ce0", "54": "462b6d8f2110a3b5", "55": "52c03ae4f4404445", "56": "d08592eb98a96332", "57": "71fc411b1fc2daf5", "58": "60822ba74d8e3524", "59": "39146ed5af711881", "60": "5b96dd71c07d1ec9", "61": "d4c8b9121fa03cea", "62": "45f7c46b2d28d4db", "63": "478a1f9aabe1396c", "64": "67b7afb27c1f614d", "65": "16936fe0368fc08b", "66": "1fbf914ecae8473b", "67": "01d5c2ac668ea3e6", "68": "811aba9b7e859132", "69": "08febbfc78b1d154", "70": "4a2f9e11fd8ad084", "71": "8180d8473a92f306", "72": "545bbbd39a248e29", "73": "7e4a40b5c5c1d071", "74": "8b0559bf907640fe", "75": "57e9dbae8cf30f7a", "76": "48b763021519f2a6", "77": "7253f203400c5712", "78": "b0da50b69a76bc5b", "79": "ba0f4b3f7fb661bf", "80": "91d3aac154fbba39", "81": "325b0eb1e8f50643", "82": "f84868df3e3dcc18", "83": "a923f80a3e6cd277", "84": "ff674221a10150a0", "85": "cc27d34a82baf0cb", "86": "9d36098cda825281", "87": "e895a286efb23a77", "88": "66b29e368318e4b5", "89": "00b724803ca95734", "90": "c5da94002b1f17db", "91": "f744a4e6cec5a88e", "92": "5df08bc640341c29", "93": "bb9bb9f2337b8d04", "94": "0be3404f5c1e9264", "95": "9deec6951409e3c3", "96": "82959bfe9c09e052", "97": "efd51105f845d501", "98": "4f9419fab9cc995e", "99": "665ad6175b42a095", "100": "4e97a4a347b230a0", "101": "69959e9d2e8fd013", "102": "5ab19fc02977b444", "103": "fc74ebf917288d7c", "104": "b86879854122eb9c", "105": "8fc345f8960bd6ec", "106": "eae9c625b2e16cb9", "107": "19e7223a5ad31fe9", "108": "ad3fc6cb8637d6dc", "109": "faf160496c49a4af", "110": "7fa5e86fb5b859f7", "111": "5cf7ebaa1ab0f37c", "112": "2bc803d90aa52552", "113": "7ab858a59463838e", "114": "1b3668e066f5eca2", "115": "adb4da3992febdd3", "116": "6898770b4fe27648", "117": "e28dca951d7ca0a3", "118": "ce7667c6140515eb", "119": "78103278da749676", "120": "f5c3cdad7af69c0f", "121": "071c3814840ec72b", "122": "e6960501ed3e0976", "123": "ff746090a6dd88d3", "124": "137f943e7a47a090", "125": "b4c1a3ea46e3acda", "126": "d81320ddfc819f0b", "127": "c799ccdc983e40b4", "128": "2d3e48273f7ed7ae", "129": "21f72c3b967e4ff5", "130": "b9f9504a399eb7bd", "131": "bf541c1a8282c650", "132": "fdf3cebcbea2e3cc", "133": "189a87afcf0f3b02", "134": "1d339b5e315b05c1", "135": "bba80df6c941b043", "136": "e062e1bbddca6377", "137": "a4746e007546400c", "138": "978bf0ba2de6d154", "139": "e063df6a515b15e8", "140": "5d1e96037e649140", "141": "92b8387e905bd90a", "142": "2b304474febf47a8", "143": "0ef764c5f251be42", "144": "996f94557438583f", "145": "2d44c093e5a71c6d", "146": "30f80458d09e5b48", "147": "d7ca194d611b730c", "148": "0c1bcff18cd6454e", "149": "2e35ce7a611e2ba8", "150": "202079945a56ce0a", "151": "2eda179d5abfdcf7", "152": "7dcd65f1f266a81d", "153": "17ed6623f148ec33", "154": "a936170cee711d5f", "155": "43f3d9718f40831d", "156": "42a3706375724a82", "157": "35db494ddf2c9541", "158": "bdd1773582fa0971", "159": "f90032e18a88ae3a", "160": "0047f55b4c80ff3b", "161": "c79b342c3c88739d", "162": "5349dc2e2ead6b40", "163": "42b1082d08c39b50", "164": "cd2c511a507fee5c", "165": "29cf43922e27fcc7", "166": "17cd6b23530afb97", "167": "a2c7b7ea8be2f0fa", "168": "425cb5871b3739fc", "169": "b6df613137960580", "170": "9583c984e370d0d7", "171": "70a44128ddd2a585", "172": "49455575456ca470", "173": "517756f8553274d5", "174": "60addf096897ab6f", "175": "4d613e41c036fbef", "176": "cb892a20ba323832", "177": "fd2770b6f0cd7eaf", "178": "8d3980fb2d44c170", "179": "7f0867debcb50394", "180": "86dd0abd68cce7bd", "181": "ab27823e12e1283b", "182": "cfe6225489122f9f", "183": "695cd7213266a959", "184": "4515da9fab063374", "185": "b449b4a1ae023429", "186": "49d33e1357a9c00e", "187": "b3fb262962922e5d", "188": "375479e75c342a49", "189": "2dbaefd48b31fbc1", "190": "46a836d2f70462de", "191": "3f3097a99f96211e", "192": "3f63a31ea952b813", "193": "6a2bad7ce6457339", "194": "aa67b379db81e18d", "195": "80338e7eabe1b94c", "196": "595537927e06acd6", "197": "59a29a27fe2aeb9b", "198": "ee9af2e31bb4d69e", "199": "45b5cdd1c0a3ed42", "200": "80a8eac4990f3c80", "201": "7f371359f8cbcae2", "202": "bde48ea01a78a31d", "203": "0e16b67c17622c6f", "204": "50b0db243e43934e", "205": "c4d8ac9a64a2cb36", "206": "f08b62fd56b53e63", "207": "ec5fda742f130ffc", "208": "9ae4ebcfafa7eef2", "209": "6cf8ae3a4377e8b3", "210": "993a2cc7f78ff5ee", "211": "d1a7bed9160831c4", "212": "4bcb08f10ee16efb", "213": "a428c4b6a276a21b", "214": "5be335bd678dc0e1", "215": "347a27e0695d6fce", "216": "c9502ff1fbec6e44", "217": "efcccc9129fb764a", "218": "a7835c798db175d7", "219": "2cd77561eef54d01", "220": "e75e725824ea9795", "221": "8011beca70a26ddf", "222": "e36690c4c6ea70dc", "223": "cbc3054c23c3e7c5", "224": "53c6829d5f417c09", "225": "1ca0e4f9e70ba0d8", "226": "be63a5fb74ce6591", "227": "073ebfc0d82ece5d", "228": "3d31ed6ba0035a9b", "229": "34b2126166cd1733", "230": "87769fb1faacd828", "231": "2ec66a29728379d7", "232": "69e3b0ad6e14fa56", "233": "dfcf1f53c2773eb6", "234": "d7151cc443a0d3ae", "235": "2d05c9dc165201e2", "236": "d47bda53fbf25407", "237": "b416fd92acbee855", "238": "45e2860c8c0d0d86", "239": "0e5086758666bd0c", "240": "0f16e037eb9da7b4", "241": "f41542b0537d3cce", "242": "fbb4ab8be6c63ee0", "243": "10281c2ef334ecf4", "244": "7b77c2e3209f5c22", "245": "4c0203d1daf94100", "246": "227f41969be7714c", "247": "52abca3569d568bb", "248": "f112b69c214dce28", "249": "060853a92fa6dea2", "250": "c1df22372e374115", "251": "4947e519c0aa830e", "252": "337aacc1db59f54a", "253": "81fd07e37694bb91", "254": "ae237711c2d05ad1", "255": "92b3baf8159e81d2", "256": "1bb48df81eb9177a", "257": "57da7506a410e4c8", "258": "ff6b62985215b71d", "259": "64061d63755dcf02", "260": "ba0167872c22b9d6", "261": "1491b8a5363601cd", "262": "31d692257bc0702d", "263": "fbb4344484a7fbb6", "264": "bbe0c8307b3719e6", "265": "d76c76e1145c5388", "266": "00a64e391b99cf8b", "267": "085196be307a22ff", "268": "ad708fbbe273ea95", "269": "918a9a562f01d4b3", "270": "fc4d27cde7ab8041", "271": "a340dfcd2eef6466", "272": "b6ab67e936bbd2e8", "273": "2da1d6a29e2fa105", "274": "e8f560585613a477", "275": "61c4dcf3f1ab0602", "276": "787ddc45a8e0ec99", "277": "bea1ab731f0016f2", "278": "a09acd94fcd91d09", "279": "456ef8f6059447c9", "280": "5b30b4eda20a98ee", "281": "18c2e73219a8171e", "282": "1e74126cfe8be8f6", "283": "ca33300f9a4be4d6", "284": "ae28fff87ffd21de", "285": "c081e8e9a5c3bd2a", "286": "328141ae395782a7", "287": "67d7668d4d0e26cb", "288": "55212395aebde232", "289": "61d341e3d6044e8e", "290": "810021694c13c86a", "291": "f12390b81ac69412", "292": "6371cd26913882c1", "293": "dcd2c0a709ab925f", "294": "7a86aaf4c3bb953c", "295": "ee5414973eed2a25", "296": "8f62c91f05330539", "297": "f5667ec3c4db253d", "298": "7ba09cce935b3d00", "299": "3c2ae2c4e7a1949b", "300": "8c5971b6925882d9", "301": "a067f6922115aaf0", "302": "a4603b1fbd5baddb", "303": "01585298c38b36a8", "304": "475f5428cc83ef87", "305": "136daf70e87e02a1", "306": "af2df6004f1e66a0", "307": "056986f3ca294dd3", "308": "2ec463aca9d774d1", "309": "e7606d5f074f0c4d", "310": "f62d0ff4241734e7", "311": "25e9a083b16b3359", "312": "a6e061b71798841a", "313": "584cf83aec10d424", "314": "acb3d709fc667892", "315": "801f765642d5458b", "316": "c9ae6a4b792a928a", "317": "aabbe1539b1ea302", "318": "3cb4433f63bb8819", "319": "a99387f9796707fc", "320": "251cbef260203d82", "321": "c280bf8df5883070", "322": "fe91bb0c9b69b090", "323": "2aec9a247ab92436", "324": "c7b5c0e2e629c2d4", "325": "d3cb51cbbf3254d3", "326": "b5242e6420cd22fb", "327": "97e045514e973d2d", "328": "6945d99925be4760", "329": "13bb81b4ea9530f6", "330": "f5a77f29a2d6d382", "331": "4a291a3cef78d580", "332": "853cf2126f3d3ada", "333": "1b5f723dea319f63", "334": "f0746bdf38c1afea", "335": "4c0a8ecc52436e89", "336": "261f6356a40c3cbb", "337": "bdf0e713b9cb48eb", "338": "8be778cfe8685fb6", "339": "4543c1aaff9332d7", "340": "49001d475ec85417", "341": "ff74a0c0b8496fb3", "342": "41d7c89699e88e49", "343": "21be76d4e02295dc", "344": "97aa1c8e01d7a9c0", "345": "f15493f543e0c1b1", "346": "e7fea49f1afe32dd", "347": "bcb3eb55e616c950", "348": "0965d9688e11641b", "349": "34bdc9bb28b363f4", "350": "89dccdf78f8c8f4f", "351": "9352b4af27abc878", "352": "2c252003e531c9bb", "353": "69e0f04ac9f09daf", "354": "b5bd1df08506feb0", "355": "c2b0575b173483c1", "356": "d26d35a80d122be4", "357": "0ecd5fdfa040950b", "358": "90747e9042f6671d", "359": "14d1ae3b1cff934b", "360": "30b502e616e3e01f", "361": "036ef64c84d005dc", "362": "a17154091b064a55", "363": "9c064fb7bd3825f9", "364": "929f7966f607c2d6", "365": "f0ad02437c65fd4c", "366": "434949c322bbb405", "367": "a0bb14cb255fa338", "368": "6e032d61f89e38fa", "369": "6880eadd7d37de1c", "370": "eb6489b237602a3d", "371": "a0585796f9a4646b", "372": "fa8b6c3807ddf216", "373": "6788416604fad624", "374": "5a983f36c68ca3fc", "375": "f24eef4943ea4f25", "376": "efd98c8abf12ad1d", "377": "9a35a514b76efbd1", "378": "9a0d84f44fe4ffc1", "379": "8277fe2d31b3a3f4", "380": "d1c5c1a32b6c4110", "381": "b39493ed39b45bf3", "382": "74af31ee46d6ef60", "383": "d24cfd824810865e", "384": "b357e2723c6a435a", "385": "767ac74dca429121", "386": "8ac01c348ddfdfe5", "387": "a9e4077d96048018", "388": "1fefb64451ff7eaa", "389": "381b13c3a3ba2e23", "390": "d0cdc78e9b7af43f", "391": "1558277daf85e870", "392": "1532d0b3c0551e59", "393": "06fb128ecf74138b", "394": "c3446b19fa9dba31", "395": "7c07f28b71bd0b3e", "396": "708dd0b18a0a4798", "397": "3241630562395df9", "398": "6a32693f62f4d088", "399": "76864a54ed005737", "400": "b696475a2e95f25f", "401": "5bd0d859725efccb", "402": "a8129cea84bdcfe6", "403": "470ea7aa81f5394b", "404": "e3c70389ad967171", "405": "6db915995bc0b271", "406": "0a3aca6ad397c44b", "407": "3f6f84c96be50d9d", "408": "cc9ee9a966b5e226", "409": "5cae267c36b80958", "410": "6b09b53b2124e9a9", "411": "16c63dcd9e5ed158", "412": "fb8672f03334a2a4", "413": "93fd39edfeaa955b", "414": "f9ef593a617ceb1d", "415": "db4057e429756870", "416": "98b98cadd83b05c3", "417": "3765a56555254119", "418": "84cc8611b5a317a5", "419": "5edad9c36ac42b90", "420": "82ddf091c9b63fbc", "421": "f8e524ce16d0fad4", "422": "0a4016518602de5a", "423": "61602d52d6b9c79b", "424": "ec847b053e0fc5cc", "425": "99edf7dd8356014f", "426": "1528a41acca8dc22", "427": "e6b0c5ae9144bfae", "428": "0bf8dbaa131f820a", "429": "b713ce65d240607c", "430": "bb8a02b6078be30b", "431": "b98e2c63125b8b99", "432": "512542ea60d90da9", "433": "249cd145a7048b49", "434": "92c9d40a819f368c", "435": "2076e1d05932fb62", "436": "d6ec261087f6bc77", "437": "34981a383ae71409", "438": "9d98be4fc7b9da16", "439": "649a9984065fda98", "440": "9ed13a6b1fdd29aa", "441": "4ca798e5f087260d", "442": "0c612ec956a1e9a3", "443": "3a3e18d9ac643f35", "444": "77ec63a8255989aa", "445": "47ce12ec866ee546", "446": "ee2953da63e41f03", "447": "15ae692d06dbdc79", "448": "00e62a56bdf3e98e", "449": "7ec28e0c9d210330", "450": "d08e08c1bef8ce42", "451": "2388d3b1bcf4afd0", "452": "3eaf0f83b4b5d217", "453": "0602067ecbc34d32", "454": "855a53cf44d537f7", "455": "c076f675fe74d98b", "456": "a6b1875c48d8f77e", "457": "96083d75134d170d", "458": "6b646ba69c312c9e", "459": "c8b3ee00dc822e1f", "460": "5cc6567aacbdccba", "461": "e4685a8dbc331296", "462": "c8cdb11a4360d582", "463": "1bdd1e69dc924512", "464": "b96ad4e2e72ee4e0", "465": "e30952305e11ce35", "466": "b0904ef0f0aaf7d4", "467": "4423f00984596bb5", "468": "b9e2755adb66c626", "469": "5748723725fac7bc", "470": "1aaf664c6ffe5a62", "471": "96a9c1c3b06d45b6", "472": "61e9b8c4d917cbbf", "473": "3dd7b2223b12a178", "474": "4ecc297368533e1d", "475": "2ed3d7513c9e9432", "476": "2feb06e3b9fe8085", "477": "8fcea9acee447ea8", "478": "2018180f7ade5b0e", "479": "b5c49b147ba220ed", "480": "c8ab14ccfb2ceb29", "481": "8a2b334f3892ec42", "482": "d5fe45ae7ec07826", "483": "3ada99807193fa75", "484": "c32d2544c6f24a5d", "485": "4f37fd92e0afd609", "486": "82870a72bd6f6775", "487": "922a3676522aa1db", "488": "0c5f4349a24e692e", "489": "4346fd7b60bbee63", "490": "e651d1e0a6a9d2f7", "491": "d97c392f2988607d", "492": "1cc0949deb48d80b", "493": "f73cc7f508a09a27", "494": "328cc6def8813c2b", "495": "ac2f1b72332c19e0", "496": "b9bc48fd0c5bd742", "497": "7b531173c84842e3", "498": "bac56080d614f4e5", "499": "ef4b31ee0b8691a7", "500": "04a02bc8cec46614", "501": "d26007b612e0d28f", "502": "399136a1201e626a", "503": "34da019da67be529", "504": "6f34b9f536c17cca", "505": "cf10ee822d8aa3b5", "506": "634f6e7943a22ae0", "507": "4930f7207553cdd2", "508": "f84d9c6dd0ae72e4", "509": "d786feb243f024f3", "510": "b08fe51e110c766a", "511": "2d6f4b8ec71816fb", "512": "20baa70a65a36421", "513": "ed98e9a9d974754d", "514": "3374a018515d73e0", "515": "75e25c552169d0b1", "516": "31c658375ca655fb", "517": "6faffa92a422d0e1", "518": "ac654ab9bd4ae870", "519": "b8d1ed53bae3e3dd", "520": "25ba94c1e0b355b4", "521": "9747497c2bde5eba", "522": "7eef6136f6be4db7", "523": "a20171ea17b536bb", "524": "945939db6a08497b", "525": "57a40d480d1a07de", "526": "f5c67e18959e1a96", "527": "8782ecf8e7770bcc", "528": "cbcfc4ab756bcc7e", "529": "5c2a9932d803ae8d", "531": "1a46e3c34fd4dfbb", "532": "93a1d044672ad228", "533": "fdb6d627efd3ea42", "535": "72d68125d7c45efa", "536": "9dd604b2237f7ea5", "540": "75b620b9607e6d07", "542": "c60c6111389210c3", "543": "7afbc10971e64d7b", "544": "c81dfbf19c9e877f", "546": "e4ae735963728e8d"}
\ No newline at end of file
+{"0": "cbf9e6d0fc7965ee", "1": "0ba88535e31ad3ae", "2": "77aba4fe9920ccf0", "3": "a9652d7c4650e80c", "4": "c2a0db3c87d07007", "5": "b8cb3b918b55a8a6", "6": "5b7666cd184bd48f", "7": "f81d81a13ecadfa8", "8": "9cc9d91eba98f028", "9": "583478d648e0b782", "10": "5d4f412509792a6a", "11": "5d22e0c09f706441", "12": "f00328eaf39f6ce6", "13": "e7c77c800217bf47", "14": "5776f7c7988b82af", "15": "55a90766ac33fcf1", "16": "9d741f94d81a3cd5", "17": "c5c1d2d247bca0ae", "18": "7c9334676b1eb362", "19": "4c610e05154be068", "20": "deef72b25509f034", "21": "ce5ab1e3723cc565", "22": "134714050917120f", "23": "28e7fb57f105818e", "24": "f3fe0ac4ee032933", "25": "a7b49882d9bc31f8", "26": "daa50d1da934d65e", "27": "602b64f8b6b64106", "28": "fd3ba1d91df8b616", "29": "2bae6ee81aae8170", "30": "59bb9a2533fe4194", "31": "5a2f3fe61bb6e43a", "32": "e35ce5c41b607f5d", "33": "f6a4f341baf7bf02", "34": "7da9599b1238d4aa", "35": "0ea94d3b0ef8dcf2", "36": "5a311d03ace7c223", "37": "d1e75cd7502b7d85", "38": "b007eb4d03d8ca74", "39": "27523e9af4c32869", "40": "3b12d300f18ba6df", "41": "277ed89c8fe46141", "42": "dea0aabdad78114e", "43": "6a05c77b24c8dd7e", "44": "64ddea6d74fe80ae", "45": "ef0ddfd62ee1af6c", "46": "3cbdd741e3ce2f8c", "47": "4765815ca957172e", "48": "2a883b5f7e85a353", "49": "6bdf4d070b3aae61", "50": "90f6e3facc2de67e", "51": "a68e166378e0d2c2", "52": "8107f634fb0eba89", "53": "518d8c7abd745ce0", "54": "9503a0f67ac40290", "55": "52c03ae4f4404445", "56": "d08592eb98a96332", "57": "064123b81d806408", "58": "24d6e60e30f1ecca", "59": "0d36d7e0b0dd113e", "60": "5b96dd71c07d1ec9", "61": "d4c8b9121fa03cea", "62": "45f7c46b2d28d4db", "63": "478a1f9aabe1396c", "64": "67b7afb27c1f614d", "65": "5b08733c0d7538ca", "66": "1fbf914ecae8473b", "67": "5def14c3d356627a", "68": "b5b11cd728c2cc6a", "69": "5d5a8eb6595d6ed4", "70": "4a2f9e11fd8ad084", "71": "1ee8cdd4971ae48f", "72": "545bbbd39a248e29", "73": "7e4a40b5c5c1d071", "74": "8b0559bf907640fe", "75": "a2011e254f787940", "76": "48b763021519f2a6", "77": "7253f203400c5712", "78": "3d94c956f08e9926", "79": "aa42ad190998fd83", "80": "91d3aac154fbba39", "81": "325b0eb1e8f50643", "82": "aaf7b8ad5599565f", "83": "3ffcb73ed2f9303a", "84": "cc7c686f346af783", "85": "cc27d34a82baf0cb", "86": "9d36098cda825281", "87": "88e35d7382a187e8", "88": "c8666f256c795f84", "89": "055dfffe38134afd", "90": "b4a39a0cb80c2e15", "91": "f744a4e6cec5a88e", "92": "c91acad862ae9aac", "93": "099f51388a33dd00", "94": "0be3404f5c1e9264", "95": "9deec6951409e3c3", "96": "c19206bf2a62627a", "97": "efd51105f845d501", "98": "5be55f8feaa92db6", "99": "5d1e19085e0ee752", "100": "374f71979d0c5a53", "101": "0f0e9cb69442f5e6", "102": "5ab19fc02977b444", "103": "fc74ebf917288d7c", "104": "6e4ea9f6236016a6", "105": "8fc345f8960bd6ec", "106": "eae9c625b2e16cb9", "107": "b4e3f62738019488", "108": "8416ca7f0087145c", "109": "faf160496c49a4af", "110": "7fa5e86fb5b859f7", "111": "5cf7ebaa1ab0f37c", "112": "2bc803d90aa52552", "113": "7ab858a59463838e", "114": "adb4da3992febdd3", "115": "ac106bcdee938b25", "116": "d43d95f56802f05f", "117": "e28dca951d7ca0a3", "118": "ce7667c6140515eb", "119": "78103278da749676", "120": "9bb250515528164d", "121": "071c3814840ec72b", "122": "e6960501ed3e0976", "123": "a4746e007546400c", "124": "ac77d0122ef1555b", "125": "1a49df9789dba2bb", "126": "901d521414ce4d54", "127": "c799ccdc983e40b4", "128": "2d3e48273f7ed7ae", "129": "0bf148cef1dbd79f", "130": "b9f9504a399eb7bd", "131": "4860f69bf2be606a", "132": "f689a0b9a840e7a4", "133": "189a87afcf0f3b02", "134": "1d339b5e315b05c1", "135": "408409da47e22825", "136": "a428c4b6a276a21b", "137": "97516dec512f4c01", "138": "978bf0ba2de6d154", "139": "935818a3424ed643", "140": "603fc7ac275a955b", "141": "92b8387e905bd90a", "142": "2b304474febf47a8", "143": "0ef764c5f251be42", "144": "996f94557438583f", "145": "8369b0728bfa9ef1", "146": "6018e62aca91d8e4", "147": "d7ca194d611b730c", "148": "0c1bcff18cd6454e", "149": "17ed6623f148ec33", "150": "202079945a56ce0a", "151": "ff179ce14d195ec0", "152": "7dcd65f1f266a81d", "153": "159fabc41fbc4d85", "154": "4d1dfde6c1945b9d", "155": "bd01bf21522accbd", "156": "1de073dc60568a70", "157": "514c2f0918c8fd26", "158": "f0cf0a8e088cde06", "159": "a241c14cd8ee3a0e", "160": "0047f55b4c80ff3b", "161": "c79b342c3c88739d", "162": "5349dc2e2ead6b40", "163": "42b1082d08c39b50", "164": "a64556f048a3fa3a", "165": "c6019ae39467b559", "166": "17cd6b23530afb97", "167": "4f76e37f7e52cc3a", "168": "425cb5871b3739fc", "169": "b6df613137960580", "170": "9583c984e370d0d7", "171": "70a44128ddd2a585", "172": "49455575456ca470", "173": "c1351003d2eb31ea", "174": "997d402f1879ea0d", "175": "4d613e41c036fbef", "176": "9b65b040a38ad74b", "177": "ab0436af885c2d09", "178": "8d3980fb2d44c170", "179": "7f0867debcb50394", "180": "86dd0abd68cce7bd", "181": "ab27823e12e1283b", "182": "658ad6e4aaec1814", "183": "695cd7213266a959", "184": "081e9f88cf43be17", "185": "bd8287a40f84cb9a", "186": "49d33e1357a9c00e", "187": "b3fb262962922e5d", "188": "375479e75c342a49", "189": "2dbaefd48b31fbc1", "190": "46a836d2f70462de", "191": "3f3097a99f96211e", "192": "3f63a31ea952b813", "193": "6a2bad7ce6457339", "194": "aa67b379db81e18d", "195": "80338e7eabe1b94c", "196": "d3317c8f471f2165", "197": "fd084d0e2ebe28e8", "198": "ee9af2e31bb4d69e", "199": "45b5cdd1c0a3ed42", "200": "a42f7314feda511e", "201": "7f371359f8cbcae2", "202": "bde48ea01a78a31d", "203": "0e16b67c17622c6f", "204": "69e8b95438e584e1", "205": "d830ebe608ff9509", "206": "2688a8e6bd6d4a8b", "207": "1eefa30b0ba0d303", "208": "860a1103c73432e3", "209": "c8d4ef8480b56ec5", "210": "993a2cc7f78ff5ee", "211": "10281c2ef334ecf4", "212": "4224c6c0ec63b96d", "213": "9f83b409518befb9", "214": "bba80df6c941b043", "215": "767ffe7ae6daa219", "216": "c9502ff1fbec6e44", "217": "efcccc9129fb764a", "218": "a7835c798db175d7", "219": "2cd77561eef54d01", "220": "e75e725824ea9795", "221": "8011beca70a26ddf", "222": "e36690c4c6ea70dc", "223": "cbc3054c23c3e7c5", "224": "5b4e26a08e3df49c", "225": "fe91cbfe2aa8d0a3", "226": "be63a5fb74ce6591", "227": "073ebfc0d82ece5d", "228": "3d31ed6ba0035a9b", "229": "34b2126166cd1733", "230": "ec128ac502affad1", "231": "77dc6aacce128d60", "232": "69e3b0ad6e14fa56", "233": "dfcf1f53c2773eb6", "234": "d7151cc443a0d3ae", "235": "2d05c9dc165201e2", "236": "d47bda53fbf25407", "237": "b416fd92acbee855", "238": "45e2860c8c0d0d86", "239": "ef5e664c9da3249a", "240": "0f16e037eb9da7b4", "241": "63534891be71805e", "242": "fbb4ab8be6c63ee0", "243": "5fc41909360529ec", "244": "446ef5f6558f135d", "245": "4c0203d1daf94100", "246": "227f41969be7714c", "247": "52abca3569d568bb", "248": "6523cd9b2588a624", "249": "683e83e60c3505b6", "250": "c1df22372e374115", "251": "4947e519c0aa830e", "252": "53c6829d5f417c09", "253": "81fd07e37694bb91", "254": "ae237711c2d05ad1", "255": "49c7a214980abb46", "256": "7294472aa6f83fef", "257": "57da7506a410e4c8", "258": "ff6b62985215b71d", "259": "64061d63755dcf02", "260": "ab8e82f4c8678049", "261": "1491b8a5363601cd", "262": "31d692257bc0702d", "263": "d47382fbfa681d2b", "264": "bbe0c8307b3719e6", "265": "d76c76e1145c5388", "266": "00a64e391b99cf8b", "267": "085196be307a22ff", "268": "ad708fbbe273ea95", "269": "5176ddbb64f53f47", "270": "fc4d27cde7ab8041", "271": "a340dfcd2eef6466", "272": "b6ab67e936bbd2e8", "273": "2da1d6a29e2fa105", "274": "d524c17bbb230b9a", "275": "920fed454ec6b82d", "276": "787ddc45a8e0ec99", "277": "bea1ab731f0016f2", "278": "a09acd94fcd91d09", "279": "5a712a0556f1c2a3", "280": "eb06485f699acdb0", "281": "18c2e73219a8171e", "282": "1e74126cfe8be8f6", "283": "ca33300f9a4be4d6", "284": "ae28fff87ffd21de", "285": "c081e8e9a5c3bd2a", "286": "328141ae395782a7", "287": "4bcb08f10ee16efb", "288": "55212395aebde232", "289": "61d341e3d6044e8e", "290": "810021694c13c86a", "291": "f12390b81ac69412", "292": "0dcec2e2c01e9a14", "293": "dcd2c0a709ab925f", "294": "7a86aaf4c3bb953c", "295": "e6b899caef7b6dac", "296": "8f62c91f05330539", "297": "762206e727553d79", "298": "7ba09cce935b3d00", "299": "df5a61b3729c9fde", "300": "8c5971b6925882d9", "301": "a067f6922115aaf0", "302": "a4603b1fbd5baddb", "303": "01585298c38b36a8", "304": "475f5428cc83ef87", "305": "136daf70e87e02a1", "306": "af2df6004f1e66a0", "307": "056986f3ca294dd3", "308": "28b0ecefb2317a52", "309": "cc1e7b533d4da379", "310": "f62d0ff4241734e7", "311": "25e9a083b16b3359", "312": "a6e061b71798841a", "313": "584cf83aec10d424", "314": "acb3d709fc667892", "315": "801f765642d5458b", "316": "4165d31fa372b793", "317": "aabbe1539b1ea302", "318": "88da36f056092097", "319": "a68ce96d1793a24c", "320": "251cbef260203d82", "321": "c280bf8df5883070", "322": "fe91bb0c9b69b090", "323": "2aec9a247ab92436", "324": "c7b5c0e2e629c2d4", "325": "d3cb51cbbf3254d3", "326": "7b77c2e3209f5c22", "327": "b24dc65160a65c31", "328": "6945d99925be4760", "329": "44b65edd735f755b", "330": "f5a77f29a2d6d382", "331": "4a291a3cef78d580", "332": "853cf2126f3d3ada", "333": "1b5f723dea319f63", "334": "f0746bdf38c1afea", "335": "4c0a8ecc52436e89", "336": "261f6356a40c3cbb", "337": "bdf0e713b9cb48eb", "338": "8be778cfe8685fb6", "339": "4543c1aaff9332d7", "340": "20076a5869711382", "341": "b73babab67af0170", "342": "d1eebdde54b656d8", "343": "21be76d4e02295dc", "344": "ba0167872c22b9d6", "345": "f15493f543e0c1b1", "346": "e7fea49f1afe32dd", "347": "bcb3eb55e616c950", "348": "0965d9688e11641b", "349": "34bdc9bb28b363f4", "350": "89dccdf78f8c8f4f", "351": "9352b4af27abc878", "352": "2c252003e531c9bb", "353": "69e0f04ac9f09daf", "354": "b5bd1df08506feb0", "355": "c2b0575b173483c1", "356": "d26d35a80d122be4", "357": "0ecd5fdfa040950b", "358": "90747e9042f6671d", "359": "14d1ae3b1cff934b", "360": "30b502e616e3e01f", "361": "036ef64c84d005dc", "362": "a17154091b064a55", "363": "9c064fb7bd3825f9", "364": "929f7966f607c2d6", "365": "f0ad02437c65fd4c", "366": "434949c322bbb405", "367": "a0bb14cb255fa338", "368": "6e032d61f89e38fa", "369": "e33479f55de3f5c5", "370": "eb6489b237602a3d", "371": "a0585796f9a4646b", "372": "fa8b6c3807ddf216", "373": "6788416604fad624", "374": "5a983f36c68ca3fc", "375": "f24eef4943ea4f25", "376": "efd98c8abf12ad1d", "377": "9a35a514b76efbd1", "378": "9a0d84f44fe4ffc1", "379": "8277fe2d31b3a3f4", "380": "d1c5c1a32b6c4110", "381": "b39493ed39b45bf3", "382": "74af31ee46d6ef60", "383": "d24cfd824810865e", "384": "b357e2723c6a435a", "385": "767ac74dca429121", "386": "8ac01c348ddfdfe5", "387": "a9e4077d96048018", "388": "1fefb64451ff7eaa", "389": "381b13c3a3ba2e23", "390": "d0cdc78e9b7af43f", "391": "1558277daf85e870", "392": "1532d0b3c0551e59", "393": "06fb128ecf74138b", "394": "c3446b19fa9dba31", "395": "7c07f28b71bd0b3e", "396": "708dd0b18a0a4798", "397": "3241630562395df9", "398": "6a32693f62f4d088", "399": "76864a54ed005737", "400": "b696475a2e95f25f", "401": "5bd0d859725efccb", "402": "a8129cea84bdcfe6", "403": "470ea7aa81f5394b", "404": "e3c70389ad967171", "405": "6db915995bc0b271", "406": "0a3aca6ad397c44b", "407": "3f6f84c96be50d9d", "408": "cc9ee9a966b5e226", "409": "5cae267c36b80958", "410": "6b09b53b2124e9a9", "411": "16c63dcd9e5ed158", "412": "fb8672f03334a2a4", "413": "18259707b6496a5d", "414": "134ee95a187d1ce2", "415": "b2178152aa1e1daa", "416": "98b98cadd83b05c3", "417": "3765a56555254119", "418": "84cc8611b5a317a5", "419": "5b30b4eda20a98ee", "420": "a607edf903085a68", "421": "f8e524ce16d0fad4", "422": "67d7668d4d0e26cb", "423": "742b0fc86471465b", "424": "ec847b053e0fc5cc", "425": "99edf7dd8356014f", "426": "1528a41acca8dc22", "427": "e6b0c5ae9144bfae", "428": "0bf8dbaa131f820a", "429": "b713ce65d240607c", "430": "bb8a02b6078be30b", "431": "b98e2c63125b8b99", "432": "512542ea60d90da9", "433": "249cd145a7048b49", "434": "92c9d40a819f368c", "435": "2076e1d05932fb62", "436": "d6ec261087f6bc77", "437": "34981a383ae71409", "438": "9d98be4fc7b9da16", "439": "649a9984065fda98", "440": "9ed13a6b1fdd29aa", "441": "4ca798e5f087260d", "442": "0c612ec956a1e9a3", "443": "3a3e18d9ac643f35", "444": "77ec63a8255989aa", "445": "47ce12ec866ee546", "446": "ee2953da63e41f03", "447": "15ae692d06dbdc79", "448": "00e62a56bdf3e98e", "449": "02ea03bd94b8d70e", "450": "d08e08c1bef8ce42", "451": "2388d3b1bcf4afd0", "452": "3eaf0f83b4b5d217", "453": "0602067ecbc34d32", "454": "855a53cf44d537f7", "455": "c076f675fe74d98b", "456": "a6b1875c48d8f77e", "457": "96083d75134d170d", "458": "6b646ba69c312c9e", "459": "c8b3ee00dc822e1f", "460": "5cc6567aacbdccba", "461": "e4685a8dbc331296", "462": "c8cdb11a4360d582", "463": "1bdd1e69dc924512", "464": "b96ad4e2e72ee4e0", "465": "e30952305e11ce35", "466": "b0904ef0f0aaf7d4", "467": "4423f00984596bb5", "468": "b9e2755adb66c626", "469": "5748723725fac7bc", "470": "1aaf664c6ffe5a62", "471": "96a9c1c3b06d45b6", "472": "61e9b8c4d917cbbf", "473": "3dd7b2223b12a178", "474": "4ecc297368533e1d", "475": "2ed3d7513c9e9432", "476": "2feb06e3b9fe8085", "477": "8fcea9acee447ea8", "478": "2018180f7ade5b0e", "479": "b5c49b147ba220ed", "480": "c8ab14ccfb2ceb29", "481": "8a2b334f3892ec42", "482": "d5fe45ae7ec07826", "483": "3ada99807193fa75", "484": "c32d2544c6f24a5d", "485": "4f37fd92e0afd609", "486": "82870a72bd6f6775", "487": "922a3676522aa1db", "488": "0c5f4349a24e692e", "489": "4346fd7b60bbee63", "490": "e651d1e0a6a9d2f7", "491": "d97c392f2988607d", "492": "1cc0949deb48d80b", "493": "f73cc7f508a09a27", "494": "328cc6def8813c2b", "495": "ac2f1b72332c19e0", "496": "b9bc48fd0c5bd742", "497": "7b531173c84842e3", "498": "bac56080d614f4e5", "499": "ef4b31ee0b8691a7", "500": "04a02bc8cec46614", "501": "d26007b612e0d28f", "502": "399136a1201e626a", "503": "34da019da67be529", "504": "6f34b9f536c17cca", "505": "cf10ee822d8aa3b5", "506": "634f6e7943a22ae0", "507": "4930f7207553cdd2", "508": "f84d9c6dd0ae72e4", "509": "d786feb243f024f3", "510": "b08fe51e110c766a", "511": "2d6f4b8ec71816fb", "512": "20baa70a65a36421", "513": "ed98e9a9d974754d", "514": "3374a018515d73e0", "515": "75e25c552169d0b1", "516": "31c658375ca655fb", "517": "6faffa92a422d0e1", "518": "ac654ab9bd4ae870", "519": "b8d1ed53bae3e3dd", "520": "25ba94c1e0b355b4", "521": "9747497c2bde5eba", "522": "7eef6136f6be4db7", "523": "a20171ea17b536bb", "524": "945939db6a08497b", "525": "57a40d480d1a07de", "526": "f5c67e18959e1a96", "527": "8782ecf8e7770bcc", "528": "cbcfc4ab756bcc7e", "529": "5c2a9932d803ae8d", "530": "9d8dadd9075c0790", "531": "1a46e3c34fd4dfbb", "532": "9dbb74edad92225a", "533": "fdb6d627efd3ea42", "534": "182d81828440294f", "535": "72d68125d7c45efa", "536": "11eb24aa38fd4bc4", "537": "b522c0397de29a55", "538": "8bf8c4edc89ac040", "539": "8627a51a1c495fad", "540": "68ede77045690d2b", "541": "4d66d6474ca3c9b6", "542": "c60c6111389210c3", "543": "7afbc10971e64d7b", "544": "c81dfbf19c9e877f", "545": "4b85d417053ce1bb", "546": "e4ae735963728e8d", "547": "455559150f1f41ac", "548": "eef98dbddf275b78", "549": "eb6af3d80b052fd1", "550": "6c813dc2c3dec42b", "551": "9555b15167aa52aa", "552": "dc99b776b2d3bde9", "553": "65f234184df243d3", "554": "6ed0f4263070bba9", "555": "98643ea1d93d9603", "556": "3ba63cdc21d55afb", "557": "c2bb2aa96d8d4c13", "558": "35fcf68ec3c97656", "559": "6eb94279bdfa4c8e", "560": "9e255868db3755dd", "561": "a99387f9796707fc", "562": "4698af944673671b", "563": "589eb257be817a5b", "564": "1957e05ff32f608d", "565": "a3c47ba79172f981", "566": "82ddf091c9b63fbc", "567": "ba033c78ff3271e7", "568": "ff74a0c0b8496fb3", "569": "93a1d044672ad228", "570": "f19a5e5e5b964474", "571": "c9ae6a4b792a928a", "572": "155f139761bfda01", "573": "a824e2955ce6ec76", "574": "d6992de6b08f4dc2", "575": "accfebd3c599e7d0", "576": "c43182f74537ef96", "577": "8fe136db2cf325ec", "578": "75b620b9607e6d07", "579": "f763e4ab1cc8f31f", "580": "7ec28e0c9d210330", "581": "a4d8ec220988fc20", "582": "74f36a13253765e1", "583": "49001d475ec85417", "584": "c61e20863630c32d", "585": "87bc1a0079f4f956", "586": "80f28d09566e7863", "587": "41d7c89699e88e49", "588": "db4079789881dc4f", "589": "5edad9c36ac42b90", "590": "881014cbbb24ba03", "591": "2543d269dd8f24a9", "592": "16f92aa807d5bd5a"}
\ No newline at end of file
diff --git a/graphify-out/GRAPH_REPORT.md b/graphify-out/GRAPH_REPORT.md
index 38e52872..f8b1b2ca 100644
--- a/graphify-out/GRAPH_REPORT.md
+++ b/graphify-out/GRAPH_REPORT.md
@@ -1,31 +1,31 @@
-# Graph Report - OwnCord (2026-08-23)
+# Graph Report - OwnCord (2026-08-25)
## Corpus Check
-- 1159 files · ~1,691,933 words
+- 1170 files · ~1,717,146 words
- Verdict: corpus is large enough that graph structure adds value.
## Summary
-- 12183 nodes · 35115 edges · 540 communities (445 shown, 95 thin omitted)
+- 12360 nodes · 35316 edges · 593 communities (486 shown, 107 thin omitted)
- Extraction: 85% EXTRACTED · 15% INFERRED · 0% AMBIGUOUS · INFERRED: 5127 edges (avg confidence: 0.8)
- Token cost: 0 input · 0 output
## Graph Freshness
-- Built from commit: `35bc7aed`
+- Built from commit: `ccbd4dd9`
- Run `git rev-parse HEAD` and compare to check if the graph is stale.
- Run `graphify update .` after code changes (no API cost).
## Community Hubs (Navigation)
-- newRoleCRUDService
+- markdown.ts
- createElement
- testing.T
-- livekitSession.ts
-- dispatcher.ts
+- LiveKitSession
+- channels.store.ts
- openMigratedMemory
- context.Context
- buildChannelRouter
+- seedMemberUser
- MessageInput.ts
-- attachments.ts
-- DMService
+- members.store.ts
- waitRegistered
- types.ts
- NewAdminAPI
@@ -42,24 +42,24 @@
- newAuthTestDB
- newMigratedTestDB
- time.Time
-- Config
+- test-utils.ts
- secret_store.rs
- Hub
- database/sql.Result
- newUploadTestDB
-- AppearanceTab.ts
-- writeJSON
-- AuditWriter
+- VideoGrid.ts
+- net/http.HandlerFunc
+- newAdminTestDB
- HashToken
-- content-parser.ts
-- drag-reorder.test.ts
+- attachments.ts
+- DMService
- newRegistryWithDir
-- messages.store.ts
+- dispatcher.ts
- Instance
-- Queries
+- screenShare.ts
- NewChecker
- middleware_test.go
-- MainPage.ts
+- UserBar.ts
- DB
- testing.F
- Result
@@ -67,26 +67,26 @@
- native/helpers.ts
- NewRouter
- profileCreateToken
-- User
+- buildErrorMsg
- newTestDB
-- MemberList.ts
+- MainPage.ts
- newServeHub
- 3. Security
- permissions_test.go
-- seedMemberUser
+- newOverrideFixture
- postJSONWithToken
- http_proxy.rs
- newVoiceTestDB
- livekit_test.go
- dbgen/models.go
- ProfileManager
-- architecture/README.md
+- README.md
- devDependencies
- LoadOrGenerate
- helpers_test.go
-- ConnectPage.ts
+- main.ts
- Security Policy
-- Role
+- WriteAudit
- channels.sql.go
- Deployment Guide
- livekit_proxy_test.go
@@ -97,62 +97,62 @@
- db/db.go
- Tables
- newMentionFixture
-- message.go
+- messages_test.go
- newWAFMiddleware
-- ws.ts
+- Config
- storage_test.go
- Migrate
- Hub
- admin/export_test.go
-- logger.ts
+- dispatcher.test.ts
- updater_test.go
- newTestMessageService
-- textAssetServer
+- newTestUpdater
- Hub
- compilerOptions
- OwnCord — Repo Health Audit
-- net/http.Request
+- handleCreateEmoji
- emoji_handler_test.go
-- buildErrorMsg
-- channelFromFields
-- openAdminTestDB
-- NewEventRingBuffer
+- buildVoiceLeave
+- media.ts
+- doRequest
+- handleRestoreBackup
- Auth Endpoints
- MigrateFS
-- PermissionService
+- Queries
- Save
- REST API Reference
-- deps.go
+- RateLimiter
- joinVoice
- ptt.rs
- OwnCord Audit — Documentation Accuracy & UI/UX Test Coverage (2026-08-04)
- scripts
- checkSourceWith
- Load
-- handleVoiceE2EEAnnounceV2
- Registry
+- AdminActions.ts
- newEmitTestHub
- Plan: Remediate security-hardening review regressions
- verify.go
- chdirTemp
-- StartEventPruner
+- NewEventPersister
- EnsureLiveKitBinary
- clientip_test.go
-- reaction-tooltip.ts
-- VoiceTopic
-- gif_handler_test.go
-- e2e/helpers.ts
+- Queries
+- newRoleCRUDService
+- net/http.Handler
+- navigateToMainPage
- messages.sql.go
- Channel Endpoints
- newSignedTestUpdater
- host_http_test.go
-- Topic
+- VoiceTopic
- DB
- users
- Client
-- Queries
-- handleChatCommandV2
-- Queries
+- ConnectPageCallbacks
+- newWazeroTestRegistry
+- OwnCord beta requirement traceability
- wizardHandler
- middleware_and_spawn_test.go
- password_test.go
@@ -160,20 +160,20 @@
- handleVoiceTokenRefreshV2
- pubsub_test.go
- newChannelTestAPI
-- gapProbeSSEWriter
-- setupPrecheck
+- TestHandleLogStream_EntryWrittenDuringBackfillIsDelivered
+- net/http.Request
- log/slog.Value
- Updater
-- seedChannel
+- Queries
- dependencies
- newHarvestVoiceDB
- Config Key Reference
-- Queries
-- markdown.ts
+- connectionStats.ts
+- FenwickTree
+- totp_test.go
+- github.com/owncord/server/syncutil.Mutex
- NewRegistry
-- OwnCord Client UX Specification (target state)
-- OwnCord — Comprehensive Project Audit
-- streamPreview.ts
+- ChannelSidebar.ts
- deep-link.ts
- testing.M
- newMockDB
@@ -182,24 +182,24 @@
- buildTauriMockScript
- OwnCord Introspection MCP Server
- Bug-detection improvements — design
-- EventPersister
+- ux/README.md
- eslint-rules.js
- DB
- OwnCord — Security Review
- Plan: Slash command dispatcher in WS
- vad-worklet-timing.test.ts
- ChannelTopic
-- fakeStore
+- rate-limiter.ts
- Open
-- RateLimiter
-- Key
+- MountAuthRoutes
+- e2e/helpers.ts
- fallback_crypto.rs
- Direct Messages
- WebSocket Protocol Reference
- command.go
- NewRingBuffer
- ws-load.js
-- newDMFixture
+- NewMessageService
- handler
- tauri-client/package.json
- screen-share-tracks.test.ts
@@ -222,15 +222,15 @@
- handleVoiceE2EEOfferV2
- AudioPipeline
- Messaging — target UX
-- serviceErrorToResult
-- LiveKitProcess
+- B0 baseline and audit reconciliation
+- message.go
- LiveKitClient
- migrate.go
-- VoiceAudioTab.ts
-- Manifest
-- newWazeroTestRegistry
-- 1. Channel sidebar
-- doRequest
+- voice-audio-tab.test.ts
+- OwnCord beta product requirements
+- OwnCord repository-health issue register
+- Queries
+- newTestRoleService
- knip.json
- RNNoiseProcessor
- Store
@@ -239,13 +239,13 @@
- Connection & Authentication — target UX
- Settings & Admin — target UX
- buildClientUpdateRouter
-- EventSink
+- DeviceManager
- newTestRoleService
- event.go
- NewTopicRateLimiter
- Skill Authoring — taxonomy, licensing, confidentiality, editing rules
- .oxlintrc.json
-- net/http.Handler
+- setupDiagnosticsRouter
- e2e/dm-system.spec.ts
- Queries
- emoji.sql.go
@@ -254,20 +254,20 @@
- Voice Signaling
- Quick Start Guide
- OwnCord — Test Audit
-- newBackupFileDB
+- OwnCord public-beta execution roadmap
- index.mjs
-- Checker
+- Channel
- bughunt.harness.mjs
-- voice-audio-tab.test.ts
-- reactions.sql.go
+- video-grid.test.ts
+- context.CancelFunc
- Channel Permission Overrides
- Server Stats & User Administration
- .DeleteAccount
-- scanPluginDirectory
-- Channel
+- loadPref
+- syntax-highlight.ts
- slashFS
- Running the bughunt pipeline
-- VideoGrid.ts
+- EventSink
- reconnectAfterCertAccept
- setupVoiceRoom
- emoji-voicemod.parity.spec.ts
@@ -275,10 +275,10 @@
- include
- VoiceWidgetOptions
- Custom Emoji
-- OwnCord — Test-Coverage Audit
+- LiveKitProcess
- OriginAcceptOptions
- EventRingBuffer
-- setupRouter
+- OwnCord full repository-health audit
- newTokenTestDB
- scripts
- bughunt-fix.harness.mjs
@@ -290,31 +290,31 @@
- Queries
- TestChannelVisibility_RESTWSAgreement
- Hub
-- Finish the V2 Dispatch Migration (backlog item 11) — Design
+- plans/README.md
- Port Forwarding Guide
- Chat Messages
- hello/main.go
-- cancelAfterArm
-- Queries
+- profile_fields_test.go
+- noise-suppression.ts
- Client HTTP TOFU Proxy (D5) — Design
- create_tray
- API Tokens
- Backups
- Plugin Administration
- Invite Endpoints
-- .UpdateUserProfile
+- Manifest
- Infrastructure roadmap — design
- Member Updates
- genprotocol/main.go
- RingBuffer
-- TestOwnerOnlyMiddleware_OwnerAllowed
+- AuditWriter
- ChatSendCmd
- Environments, Activation Setup, and Handoff-Doc Mode
-- newBlockService
+- scanPluginDirectory
- capabilities-scope.test.ts
-- notifications.ts
+- window-state.ts
- GET /admin/api/updates
-- Channel-Visibility Unification (backlog item 3) — Design
+- .deliverBroadcast
- sqlc Adoption (D2) — Progress & Plan
- Authentication Flow
- Voice Moderation
@@ -323,28 +323,28 @@
- prettier
- openFileDB
- hello plugin
-- TestHandlePresenceUpdate_BareStatusReadFailureAbortsBeforeCommit
-- groupDMFixture
+- handleVoiceE2EEAnnounceV2
+- IsUniqueConstraintError
- Tauri HTTP Capability Narrowing — Design
- protocol_contract_test.go
- ChatCommandCmd
- ci-check
- Comprehensive Review (scheduled or fallback)
- Credential storage
-- extractChatserverFromTarGz
+- buildChannelUpdate
- cert-tofu.spec.ts
-- navigateToMainPageReady
-- newDeafenRaceDB
+- updater.spec.ts
+- OwnCord repository-layout and contributor-experience audit
- tsconfig.build.json
- User Blocks
- PATCH /admin/api/settings
- GET /api/v1/gif/search
- First-Run Setup
- LiveKit Endpoints
-- fuzzOpenMigratedMemory
-- README.md
+- reactions.sql.go
+- Tailscale Guide (Zero-Config Remote Access)
- LiveKitProcess
-- erroringMembersStore
+- Voice, Video & E2EE — target UX
- ChatEditCmd
- VoiceE2EEOfferCmd
- VoiceModDeafenCmd
@@ -355,11 +355,11 @@
- OwnCord Architecture Blueprints
- Voice End-to-End Encryption
- feature_request.md
-- TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots
-- isAddrInUse
-- adminPanelSource
+- ResolveTokenHash
+- VerifyTOTPCodeOnce
+- Hub
- ChatDeleteCmd
-- Permission-Middleware Consolidation (audit finding A-2026-07-16) — Design
+- OwnCord — Test-Coverage Audit
- MessageDeletedDMEvent
- MessageEditedDMEvent
- MessageSentDMEvent
@@ -384,6 +384,7 @@
- VoiceE2EEOfferGuardedEvent
- File Upload and Serving
- Server Logs (SSE)
+- B0 — Restore truth, freeze scope, and reconcile the audit
- CallSignalEvent
- DMChannelOpenEvent
- MessageDeletedChannelEvent
@@ -427,14 +428,17 @@
- Transport Layer
- pre-commit
- pre-push
-- stubBroadcastAllEvent
+- scaledAuthLimit
- seedUser
+- global-keybinds.test.ts
- 015_plugins.sql
- tryLoadPluginTOML
- tryLoadPluginTOML
-- roleDeletingInvalidator
-- buildMetricsRouter
+- Queries
+- mockTauriFullSessionWithVoice
- syscall.SysProcAttr
+- .UpdateUserProfile
+- B10 — Qualify and publish the public beta
- protocol-change/SKILL.md
- strip-appimage-bundled-libs.sh
- jitsi-rnnoise.d.ts
@@ -446,19 +450,72 @@
- 014_events_table.sql
- chaos-test.sh
- voice-test.sh
-- failNthInstallStore
+- OwnCord — Comprehensive Project Audit
- @vitest/browser-playwright
- github.com/owncord/server
- owncord-client
- attachments
- attachments
- emoji
+- handleLogStream
- docker-smoke.sh
-- TestRegisterNow_ReplacementNeverLosesAConcurrentGlobalBroadcast
+- B1 — Isolated repository and contributor foundation
- prettier
+- buildUserUpdate
- @vitest/coverage-v8
-- RunningInContainer
+- B2 — Freeze server protocol, trust, and compatibility contracts
+- 2. Code Quality
+- B3 — Strengthen server architecture and permanent guardrails
+- B4 — Complete identity, recovery, privacy, and data lifecycle
+- B5 — Add community, content, and moderation services
+- buildChannelDelete
+- navigation-guard.ts
+- volume-menu.test.ts
+- New
+- B6 — Qualify server deployment, operations, and capacity
+- MetricsSources
+- B7 — Establish the shared client platform and desktop parity
+- updater.test.ts
+- B8 — Deliver browser, PWA, phone, and tablet support
+- B9 — Complete unified feature UX, accessibility, and polish
+- groupDMFixture
+- .finishVoiceLeave
+- protocolTypes.ts
+- TestNewRouter_DeleteAccount_BroadcastsMemberBanOverWS
+- 4. Dependencies & Supply Chain
+- global-teardown.ts
+- newDeafenRaceDB
+- 5. Test Coverage & Quality
+- .RoundTrip
+- perm_grid_test.go
+- NewRoleService
+- buildMetricsRouter
+- TestAdminAPI_PatchUser_RoleChangeBroadcastsEvenIfRoleReReadFails
+- isAddrInUse
+- TestRegisterNow_ReplacementNeverLosesAConcurrentGlobalBroadcast
+- b0-dev-branch-protection.sh
+- extractChatserverFromTarGz
+- 1. Architecture
+- 6. CI/CD & DevEx
+- 7. Observability
+- TestHandleVoiceCameraV2_RefusedWhenScreenshareSlotFull
+- audio-pipeline-vad-worklet.test.ts
+- .applyMicMuteState
- RunningUnderSupervisor
+- Non-negotiable execution rules
+- failNthInstallStore
+- TestAdminAuthMiddleware_DBErrorIsNotUnauthorized
+- Security Policy
+- TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots
+- D7 — Module map
+- D5 — Entity-relationship overview
+- WebSocket / Real-time Engine
+- adminPanelSource
+- ParseLevel
+- roleDeletingInvalidator
+- identityKeyFailStore
+- BuildTOTPURI
+- errDMParticipantsStore
## God Nodes (most connected - your core abstractions)
1. `DB` - 319 edges
@@ -475,42 +532,42 @@
## Surprising Connections (you probably didn't know these)
- `buildTotpSection()` --indirect_call--> `render()` [INFERRED]
Client/tauri-client/src/components/settings/AccountTab.ts → .superpowers/render-ledger.mjs
-- `renderMessage()` --indirect_call--> `att()` [INFERRED]
- Client/tauri-client/src/components/message-list/renderers.ts → Client/tauri-client/tests/unit/attachments-media.test.ts
-- `ModerationGates` --calls--> `roleHasPermission()` [EXTRACTED]
- Client/tauri-client/src/components/MemberList.ts → Client/tauri-client/src/lib/permissions.ts
-- `mountGate()` --calls--> `createNsfwGate()` [EXTRACTED]
- Client/tauri-client/tests/unit/nsfw-gate.test.ts → Client/tauri-client/src/components/NsfwGate.ts
-- `StatusOption` --references--> `UserStatus` [EXTRACTED]
- Client/tauri-client/src/components/settings/AccountTab.ts → Client/tauri-client/src/lib/types.ts
+- `createSidebarDmSection()` --indirect_call--> `dm()` [INFERRED]
+ Client/tauri-client/src/pages/main-page/SidebarDmSection.ts → Client/tauri-client/tests/unit/read-state.test.ts
+- `setupRestartAfterResponse()` --calls--> `tryDirectRestartPending()` [INFERRED]
+ Server/admin/setup_handler.go → Server/admin/restart.go
+- `E2EEDeps` --references--> `WsClient` [EXTRACTED]
+ Client/tauri-client/src/lib/livekitE2EE.ts → Client/tauri-client/src/lib/ws.ts
+- `mountModal()` --calls--> `createCertMismatchModal()` [EXTRACTED]
+ Client/tauri-client/tests/unit/cert-mismatch-modal.test.ts → Client/tauri-client/src/components/CertMismatchModal.ts
## Import Cycles
-- 3-file cycle: `Client/tauri-client/src/lib/audioElements.ts -> Client/tauri-client/src/lib/livekitSession.ts -> Client/tauri-client/src/lib/roomEventHandlers.ts -> Client/tauri-client/src/lib/audioElements.ts`
- 3-file cycle: `Client/tauri-client/src/components/message-list/attachments.ts -> Client/tauri-client/src/components/message-list/media.ts -> Client/tauri-client/src/components/message-list/content-parser.ts -> Client/tauri-client/src/components/message-list/attachments.ts`
- 3-file cycle: `Client/tauri-client/src/components/message-list/attachments.ts -> Client/tauri-client/src/components/message-list/media.ts -> Client/tauri-client/src/components/message-list/embeds.ts -> Client/tauri-client/src/components/message-list/attachments.ts`
+- 3-file cycle: `Client/tauri-client/src/lib/audioElements.ts -> Client/tauri-client/src/lib/livekitSession.ts -> Client/tauri-client/src/lib/roomEventHandlers.ts -> Client/tauri-client/src/lib/audioElements.ts`
- 4-file cycle: `Client/tauri-client/src/components/message-list/attachments.ts -> Client/tauri-client/src/components/message-list/media.ts -> Client/tauri-client/src/components/message-list/content-parser.ts -> Client/tauri-client/src/components/message-list/custom-emoji.ts -> Client/tauri-client/src/components/message-list/attachments.ts`
-## Communities (540 total, 95 thin omitted)
+## Communities (593 total, 107 thin omitted)
-### Community 0 - "newRoleCRUDService"
-Cohesion: 0.17
-Nodes (24): assertAudit(), newRoleCRUDService(), TestAffectedUserIDs(), TestCreateRole_CannotGrantUnheldBit(), TestCreateRole_CannotPlaceAtOrAboveOwnRank(), TestCreateRole_DefaultPlacementAvoidsCollision(), TestCreateRole_DefaultsToJustBelowActor(), TestCreateRole_HappyPath() (+16 more)
+### Community 0 - "markdown.ts"
+Cohesion: 0.18
+Nodes (18): BlockNode, buildMatches(), codeSpanEnd(), DELIMS, DelimSpec, EMPTY_MATCHES, InlineNode, InlineStyle (+10 more)
### Community 1 - "createElement"
Cohesion: 0.02
-Nodes (214): appendBanFlow(), buildRow(), CertFirstUseModalOptions, CertMismatchModalOptions, createCertFirstUseModal(), createCertMismatchModal(), createIdentityMismatchModal(), IdentityMismatchModalOptions (+206 more)
+Nodes (186): buildRow(), CertFirstUseModalOptions, CertMismatchModalOptions, createCertFirstUseModal(), createCertMismatchModal(), createIdentityMismatchModal(), IdentityMismatchModalOptions, createChannelSidebar() (+178 more)
### Community 2 - "testing.T"
Cohesion: 0.02
-Nodes (182): google.golang.org/protobuf/proto.Message, testing.T, TestLoginRateLimit_Value(), TestPerUserFailureCapsStayUnscaled(), TestRateLimiterCleanupHorizon_CoversMaxSlowMode(), TestSlashFS_GlobNormalizes(), TestSlashFS_ResolvesBackslashPath(), TestCleanup_MixedEntries() (+174 more)
+Nodes (177): google.golang.org/protobuf/proto.Message, testing.T, TestLiveKitHealth_Degraded_NilError(), TestLiveKitHealth_Degraded_WithError(), TestLiveKitHealth_OK(), TestWriteJSON_BasicSuccess(), TestSlashFS_GlobNormalizes(), TestSlashFS_ResolvesBackslashPath() (+169 more)
-### Community 3 - "livekitSession.ts"
-Cohesion: 0.01
-Nodes (204): AVATAR_COLORS, buildVoiceModOptions(), canModerateVoice(), closeIdentityModal(), log, nsfwIndicator(), openIdentityMismatchModal(), pickAvatarColor() (+196 more)
+### Community 3 - "LiveKitSession"
+Cohesion: 0.04
+Nodes (3): LiveKitSession, RoomEventHandlers, VideoTrackDeps
-### Community 4 - "dispatcher.ts"
+### Community 4 - "channels.store.ts"
Cohesion: 0.02
-Nodes (156): ChannelSidebarOptions, createChannelSidebar(), renderCategoryGroup(), invalidateReactionUsers(), QuickSwitcherOptions, QuickSwitchProfile, ToastContainer, ApiClient (+148 more)
+Nodes (110): QuickSwitcherOptions, SearchOverlayOptions, createVoiceWidget(), formatElapsed(), QUALITY_BARS, QUALITY_COLORS, STATUS_LABELS, navigateToChannel() (+102 more)
### Community 5 - "openMigratedMemory"
Cohesion: 0.03
@@ -518,31 +575,31 @@ Nodes (193): setRole(), TestDeleteAccount_AdminAllowedWhenOwnerExists(), TestDel
### Community 6 - "context.Context"
Cohesion: 0.02
-Nodes (39): lockedBuffer, ChannelUpdate, fakeAuditStore, ServerStats, SessionWithBanStatus, context.Context, sync.Mutex, DB (+31 more)
+Nodes (63): channelPermissionsResponse, fakeStore, APITokenListItem, Attachment, channelFields, ChannelUpdate, fakeAuditor, fakeAuditStore (+55 more)
### Community 7 - "buildChannelRouter"
Cohesion: 0.06
-Nodes (146): aroundResponse, offlineBroadcaster, purgeBroadcast, purgeResponseBody, reactionUsersResponse, recordingPurgeBroadcaster, aroundPath(), decodeAround() (+138 more)
+Nodes (138): aroundResponse, offlineBroadcaster, purgeBroadcast, purgeResponseBody, reactionUsersResponse, recordingPurgeBroadcaster, aroundPath(), decodeAround() (+130 more)
-### Community 8 - "MessageInput.ts"
-Cohesion: 0.03
-Nodes (106): attachChannelContextMenu(), CHANNEL_MUTE_CHANGED, buildPreview(), byLabel(), createEmojiAutocomplete(), EmojiAutocompleteComponent, EmojiAutocompleteOptions, EmojiSuggestion (+98 more)
+### Community 8 - "seedMemberUser"
+Cohesion: 0.16
+Nodes (48): callMsg(), seedGroupDM(), TestCallDecline_ForwardsToOtherParticipants(), TestCallDecline_RateLimited(), TestCallRing_BlockedOneToOneForbidden(), TestCallRing_ForwardsToOtherParticipants(), TestCallRing_GroupWithInternalBlockStillRings(), TestCallRing_NonParticipantForbidden() (+40 more)
-### Community 9 - "attachments.ts"
+### Community 9 - "MessageInput.ts"
Cohesion: 0.04
-Nodes (66): animateGifsPref, baseMime(), closeDbAfterTransaction(), createObjectUrl(), fetchMediaAsObjectUrl(), fetchServerFile(), formatFileSize(), idbGet() (+58 more)
+Nodes (85): byLabel(), createEmojiAutocomplete(), EmojiAutocompleteComponent, EmojiAutocompleteOptions, EmojiSuggestion, filterEmojiSuggestions(), MAX_EMOJI_SUGGESTIONS, MIN_EMOJI_QUERY (+77 more)
-### Community 10 - "DMService"
-Cohesion: 0.08
-Nodes (19): createDMResponse, listDMsResponse, github.com/owncord/server/syncutil.Mutex, DMChannelInfo, DMUser, NewDMChannelInfo(), DMService, Store (+11 more)
+### Community 10 - "members.store.ts"
+Cohesion: 0.06
+Nodes (45): attachReactionTooltip(), buildReactionTooltip(), cache, cacheKey(), chipSetFor(), formatReactorNames(), getCachedReactionUsers(), hide() (+37 more)
### Community 11 - "waitRegistered"
Cohesion: 0.07
-Nodes (125): TestBuildReady_IncludesCanSend(), TestBuildReady_CarriesChannelFeatureFlags(), TestHandleVoiceCamera_BadPayload(), TestHandleVoiceCamera_NotInVoice2(), TestHandleVoiceDeafen_BadPayload(), TestHandleVoiceDeafen_NotInVoice2(), TestHandleVoiceMute_BadPayload(), TestHandleVoiceMute_NotInVoice2() (+117 more)
+Nodes (126): TestBuildReady_IncludesCanSend(), TestBuildReady_CarriesChannelFeatureFlags(), TestHandleVoiceCamera_BadPayload(), TestHandleVoiceCamera_NotInVoice2(), TestHandleVoiceDeafen_BadPayload(), TestHandleVoiceDeafen_NotInVoice2(), TestHandleVoiceMute_BadPayload(), TestHandleVoiceMute_NotInVoice2() (+118 more)
### Community 12 - "types.ts"
Cohesion: 0.02
-Nodes (96): SearchOverlayOptions, ApiClientConfig, createApiClient(), log, OnUnauthorized, SessionInfo, SessionsListResponse, ensureHttpProxy() (+88 more)
+Nodes (93): ApiClientConfig, createApiClient(), log, OnUnauthorized, SessionInfo, SessionsListResponse, isValidHost(), ApiError (+85 more)
### Community 13 - "NewAdminAPI"
Cohesion: 0.08
@@ -553,16 +610,16 @@ Cohesion: 0.01
Nodes (306): Fixed, OC-0001 — high — Wrapped room keys have no freshness binding, so old offers replay forever, OC-0002 — high — A dead E2EE worker is invisible; the Secured badge cannot detect it, OC-0003 — high — Unverified peers get no safety number, removing TOFU's only out-of-band escape hatch, OC-0004 — medium — Key-holder promotion silently no-ops when the client's own voice_state has not arrived, OC-0005 — medium — Rotation offers exceed the server rate limit in large channels, permanently starving the same peers, OC-0006 — medium — Both rotation paths call keyProvider.setKey with no session-generation guard, OC-0007 — medium — Reconnect reaches the Secured state without confirming the room key is current (+298 more)
### Community 15 - "messages.go"
-Cohesion: 0.03
-Nodes (105): BuildDMChannelOpenInfoForTest(), handleChatSendV2(), buildAuthError(), buildChannelCreate(), buildChannelCreateFor(), buildChannelDelete(), buildChannelUpdate(), buildChatBulkDeleted() (+97 more)
+Cohesion: 0.06
+Nodes (42): buildChannelCreateFor(), buildChatBulkDeleted(), buildChatMessage(), buildChatSendOK(), buildJSON(), buildVoiceConfig(), buildVoiceDisconnected(), buildVoiceE2EEOffer() (+34 more)
### Community 16 - "telemetry.go"
Cohesion: 0.03
Nodes (73): go.opentelemetry.io/otel/attribute.KeyValue, go.opentelemetry.io/otel/metric.Float64Gauge, go.opentelemetry.io/otel/metric.Float64Histogram, go.opentelemetry.io/otel/metric.Int64Counter, go.opentelemetry.io/otel/metric.Meter, go.opentelemetry.io/otel/trace.Span, go.opentelemetry.io/otel/trace.Tracer, Invite (+65 more)
### Community 17 - "DB"
-Cohesion: 0.06
-Nodes (89): adminContextKey, adminMeResponse, adminUserResponse, backupEntry, createChannelRequest, createTokenRequest, createTokenResponse, errorResponse (+81 more)
+Cohesion: 0.07
+Nodes (79): adminContextKey, adminMeResponse, adminUserResponse, createChannelRequest, createTokenRequest, createTokenResponse, errorResponse, HubBroadcaster (+71 more)
### Community 18 - "NewTestClient"
Cohesion: 0.06
@@ -574,15 +631,15 @@ Nodes (92): channelFocusMsg(), denyReadOnChannel(), TestChannelFocus_AdminBypass
### Community 20 - "livekitE2EE.ts"
Cohesion: 0.06
-Nodes (56): ANNOUNCE_DOMAIN, base64ToUint8(), buildAnnounceMessage(), computeKeyFingerprint(), computeRawKeyFingerprint(), deriveWrappingKey(), encodeOfferEpoch(), exportIdentityKeyPair() (+48 more)
+Nodes (58): ANNOUNCE_DOMAIN, base64ToUint8(), buildAnnounceMessage(), computeKeyFingerprint(), computeRawKeyFingerprint(), deriveWrappingKey(), encodeOfferEpoch(), exportIdentityKeyPair() (+50 more)
### Community 21 - "drainChanTimeout"
-Cohesion: 0.08
-Nodes (98): drainChanTimeout(), SetClientVoiceStateForTest(), countVoiceLeaves(), TestWebhook_ParticipantLeft_LeaverWithoutReadStillNotified(), TestWebhook_ParticipantLeft_NoDoubleBroadcast_AfterFreshCleanup(), TestWebhook_ParticipantLeft_OldToken_DoesNotTeardownReplacement(), TestWebhook_ParticipantLeft_SurvivesCancelledRequestContext(), TestWebhookHandler_SignedParticipantLeftDispatches() (+90 more)
+Cohesion: 0.09
+Nodes (94): drainChanTimeout(), voiceTokenRefreshMsg(), TestWebhook_ParticipantLeft_SurvivesCancelledRequestContext(), TestWebhookHandler_SignedParticipantLeftDispatches(), captureLogs(), participantIdentityFor(), roomNameFor(), TestWebhook_ParticipantJoined_MalformedInput() (+86 more)
### Community 22 - "newDMTestDB"
-Cohesion: 0.08
-Nodes (80): evictCall, mockBroadcaster, watermarkVoiceBroadcaster, decodeBlockedIDs(), dmPut(), jsonContainsEmptyBlockList(), TestBlockUser_InvalidUserID(), TestBlockUser_SelfBlockRejected() (+72 more)
+Cohesion: 0.07
+Nodes (85): cancelAfterArm, cancelOnLookupStore, evictCall, mockBroadcaster, watermarkVoiceBroadcaster, decodeBlockedIDs(), dmPut(), jsonContainsEmptyBlockList() (+77 more)
### Community 23 - "tofu.rs"
Cohesion: 0.06
@@ -590,7 +647,7 @@ Nodes (55): CapturedFingerprint, CertificateDer, capture_verifier_records_leaf_n
### Community 24 - "newAuthTestDB"
Cohesion: 0.08
-Nodes (87): recordingAuthBroadcaster, TestDeleteAccount_BroadcastsMemberBan(), TestDeleteAccount_NoBroadcasterOmitted(), buildAuthRouter(), buildAuthRouterWithProxies(), contains(), containsStr(), deleteJSONWithToken() (+79 more)
+Nodes (85): recordingAuthBroadcaster, TestDeleteAccount_BroadcastsMemberBan(), TestDeleteAccount_NoBroadcasterOmitted(), buildAuthRouter(), buildAuthRouterWithProxies(), contains(), containsStr(), deleteJSONWithToken() (+77 more)
### Community 25 - "newMigratedTestDB"
Cohesion: 0.06
@@ -598,91 +655,91 @@ Nodes (73): TestBlockUser_And_IsBlocked(), TestBlockUser_Idempotent(), TestBlock
### Community 26 - "time.Time"
Cohesion: 0.04
-Nodes (28): touchThrottle, failingLockoutStore, failingWriteLockoutStore, PluginRow, rowScanner, rowsScanner, Event, GetEventsSinceParams (+20 more)
+Nodes (27): touchThrottle, failingLockoutStore, failingWriteLockoutStore, PluginRow, rowScanner, rowsScanner, Event, GetEventsSinceParams (+19 more)
-### Community 27 - "Config"
-Cohesion: 0.09
-Nodes (26): BackupConfig, DatabaseConfig, EventPersistenceConfig, LoggingConfig, PluginsConfig, SecurityConfig, ServerConfig, UploadConfig (+18 more)
+### Community 27 - "test-utils.ts"
+Cohesion: 0.04
+Nodes (41): ensureHttpProxy(), log, pending, stopHttpProxy(), CreateProfileData, createProfileManager(), createTauriBackend(), FetchFn (+33 more)
### Community 28 - "secret_store.rs"
Cohesion: 0.07
Nodes (65): credential_lock_serializes_overlapping_commands(), CredentialData, CredentialStoreProbe, delete_credential(), delete_identity_key(), identity_account(), load_credential(), load_identity_key() (+57 more)
### Community 29 - "Hub"
-Cohesion: 0.05
-Nodes (31): TestBuildDMChannelOpen_NilAvatar(), TestBuildDMChannelOpen_NilRecipient(), TestBuildDMChannelOpen_ValidRecipient(), TestQualityBitrate_EmptyFallsBackToMedium(), TestQualityBitrate_KnownPresets(), TestQualityBitrate_UnknownFallsBackToMedium(), TestBuildChatSendOK_ValidJSON(), TestBuildJSON_ChannelValue_ReturnsFallback() (+23 more)
+Cohesion: 0.04
+Nodes (34): TestBuildDMChannelOpen_NilAvatar(), TestBuildDMChannelOpen_NilRecipient(), TestBuildDMChannelOpen_ValidRecipient(), TestQualityBitrate_EmptyFallsBackToMedium(), TestQualityBitrate_KnownPresets(), TestQualityBitrate_UnknownFallsBackToMedium(), TestBuildChatSendOK_ValidJSON(), TestBuildJSON_ChannelValue_ReturnsFallback() (+26 more)
### Community 30 - "database/sql.Result"
Cohesion: 0.04
Nodes (30): ApplyVoiceServerDeafenParams, ApplyVoiceServerMuteParams, ClearVoiceServerDeafenParams, ClearVoiceServerMuteParams, CreateAPITokenParams, DeleteOtherSessionsParams, DeleteSessionByIDParams, EnableCameraIfUnderLimitParams (+22 more)
### Community 31 - "newUploadTestDB"
-Cohesion: 0.13
-Nodes (64): io.Closer, io.Seeker, buildAvatarRouter(), doAvatarUpload(), TestUploadAvatar_IsReadableByOtherUsersWhileInUse(), TestUploadAvatar_NotMountedWithoutStorage(), TestUploadAvatar_RejectsNonImageAndOversizedDimensions(), TestUploadAvatar_RequiresAuthAndAFile() (+56 more)
+Cohesion: 0.12
+Nodes (66): io.Closer, io.Seeker, buildAvatarRouter(), doAvatarUpload(), TestUploadAvatar_IsReadableByOtherUsersWhileInUse(), TestUploadAvatar_NotMountedWithoutStorage(), TestUploadAvatar_RejectsNonImageAndOversizedDimensions(), TestUploadAvatar_RequiresAuthAndAFile() (+58 more)
-### Community 32 - "AppearanceTab.ts"
-Cohesion: 0.15
-Nodes (23): buildAppearanceTab(), getDefaultAccent(), hexToRgb(), applyTheme(), ThemeName, THEMES, applyStoredAppearance(), syncOsMotionListener() (+15 more)
+### Community 32 - "VideoGrid.ts"
+Cohesion: 0.08
+Nodes (24): appendModerationSection(), showUserVolumeMenu(), VoiceModMenuOptions, computeGridLayout(), createVideoGrid(), GridLayout, setButtonIcon(), VideoGridComponent (+16 more)
-### Community 33 - "writeJSON"
-Cohesion: 0.05
-Nodes (99): changePasswordRequest, createDMRequest, createGroupDMRequest, createInviteRequest, dmVisibilityMarker, dmVoiceEvictor, EmojiBroadcaster, emojiResponse (+91 more)
+### Community 33 - "net/http.HandlerFunc"
+Cohesion: 0.09
+Nodes (70): changePasswordRequest, createDMRequest, createGroupDMRequest, createInviteRequest, dmVisibilityMarker, dmVoiceEvictor, inviteResponse, ProfileBroadcaster (+62 more)
-### Community 34 - "AuditWriter"
-Cohesion: 0.10
-Nodes (22): AuditStore, fakeAuditor, pendingAudit, slowAuditStore, captureLogs(), TestWriteAudit_LogsFailureButDoesNotPropagate(), TestWriteAudit_SuccessLogsNothing(), AuditWriter (+14 more)
+### Community 34 - "newAdminTestDB"
+Cohesion: 0.06
+Nodes (59): slowAuditStore, newAdminTestDB(), TestAdminCreateChannel(), TestAdminCreateChannel_DefaultsNotNSFW(), TestAdminCreateChannel_EmptyOptionals(), TestAdminDeleteChannel(), TestAdminDeleteChannel_NonExistent(), TestAdminUpdateChannel() (+51 more)
### Community 35 - "HashToken"
-Cohesion: 0.08
-Nodes (63): TestHandleLogStream_EntryWrittenDuringBackfillIsDelivered(), handleLogStream(), newLogStreamTestDB(), TestHandleLogStream_BackfillStopsAfterAPITokenRevocation(), TestHandleLogStream_BackfillStopsAfterSessionRevocation(), TestHandleLogStream_SurvivesServerWriteTimeout(), TestNewRouter_LiveKitProcessStartFailure_VoiceJoinFailsClosed(), voiceJoinWSMsg() (+55 more)
+Cohesion: 0.09
+Nodes (58): GenerateToken(), HashToken(), TestGenerateToken_HexCharacters(), TestGenerateToken_Length(), TestGenerateToken_MultiDeviceUniqueness(), TestGenerateToken_Uniqueness(), TestHashToken_ConsistentAfterRotation(), TestHashToken_Deterministic() (+50 more)
-### Community 36 - "content-parser.ts"
+### Community 36 - "attachments.ts"
Cohesion: 0.02
-Nodes (152): isSafeUrl(), setServerHost(), appendBlocks(), appendInline(), buildChannelNode(), buildList(), buildMaskedLink(), buildMentionNode() (+144 more)
+Nodes (156): animateGifsPref, baseMime(), buildDownloadButton(), buildFileMeta(), closeDbAfterTransaction(), createObjectUrl(), downloadFile(), fetchMediaAsObjectUrl() (+148 more)
-### Community 37 - "drag-reorder.test.ts"
-Cohesion: 0.15
-Nodes (18): attachDragHandlers(), DragState, ensureGlobalDragListeners(), listenerOwners, releaseOwner(), retargetDetachedDrag(), ChannelReorderData, updateChannelPosition() (+10 more)
+### Community 37 - "DMService"
+Cohesion: 0.06
+Nodes (29): createDMResponse, listDMsResponse, MemberSummary, TestNewDMChannelInfo_EmptyRecipientsIsNotNil(), TestNewDMChannelInfo_ExcludesViewerAndPicksRecipient(), DMChannelInfo, DMUser, NewDMChannelInfo() (+21 more)
### Community 38 - "newRegistryWithDir"
Cohesion: 0.16
Nodes (30): TestRegistry_EnablePlugin_ConcurrentDisableDuringActivationWindow(), buildZip(), Registry, newRegistryWithDir(), simpleManifest(), TestRegistry_Activate_AfterClose(), TestRegistry_Activate_WithoutRuntime(), TestRegistry_DisablePlugin_ClearsFlagAndCommands() (+22 more)
-### Community 39 - "messages.store.ts"
+### Community 39 - "dispatcher.ts"
Cohesion: 0.04
-Nodes (90): MessageListComponent, handleParticipantLeft, rollbackPendingVideo(), Attachment, ChatDeletedPayload, ChatEditedPayload, ChatMessagePayload, MessageResponse (+82 more)
+Nodes (109): invalidateReactionUsers(), MessageListComponent, ApiClient, findChannelById(), DispatcherCleanup, enforceModeratorAudioState(), livekitSession(), log (+101 more)
### Community 40 - "Instance"
-Cohesion: 0.09
-Nodes (14): github.com/tetratelabs/wazero/api.Memory, github.com/tetratelabs/wazero/api.Module, Instance, CommandResult, Registry, Registry, Registry, Registry (+6 more)
+Cohesion: 0.08
+Nodes (19): github.com/tetratelabs/wazero/api.Memory, github.com/tetratelabs/wazero/api.Module, Instance, CommandResult, Registry, Registry, Registry, Registry (+11 more)
-### Community 41 - "Queries"
-Cohesion: 0.12
-Nodes (8): BanUserParams, CreateUserParams, ListMembersRow, UpdateUserIdentityKeyParams, UpdateUserStatusParams, UpdateUserTOTPSecretParams, Queries, User
+### Community 41 - "screenShare.ts"
+Cohesion: 0.11
+Nodes (32): attachDiagnosticListeners(), bumpGeneration(), CAMERA_PRESETS, CAMERA_PUBLISH_BITRATES, CameraTrackState, disableCamera(), disableScreenshare(), enableCamera() (+24 more)
### Community 42 - "NewChecker"
-Cohesion: 0.15
-Nodes (48): NewChecker(), TestHandleChannelFocus_SkipsNoOpReadStateWrite(), NewChannelService(), TestHandleChannelFocus_DMExemptFromArchiveGate(), TestHandleChannelFocus_RefusedInArchivedChannel(), TestHandleTyping_BlockedInDMEmitsNothing(), TestHandleTyping_NoRateLimitKeyForNonexistentChannel(), TestHandleTyping_NoRateLimitKeyWithoutReadPermission() (+40 more)
+Cohesion: 0.14
+Nodes (58): NewChecker(), TestHandleChannelFocus_SkipsNoOpReadStateWrite(), NewChannelService(), TestHandleChannelFocus_DMExemptFromArchiveGate(), TestHandleChannelFocus_RefusedInArchivedChannel(), TestHandleTyping_BlockedInDMEmitsNothing(), TestHandleTyping_NoRateLimitKeyForNonexistentChannel(), TestHandleTyping_NoRateLimitKeyWithoutReadPermission() (+50 more)
### Community 43 - "middleware_test.go"
Cohesion: 0.08
-Nodes (57): contextKey, errorResponse, SecurityHeaders(), TestRateLimitMiddlewareWithPrefix_SeparatesClientUpdateBucket(), TestRateLimitMiddlewareWithPrefix_SeparatesLiveKitBucket(), AdminIPRestrict(), AuthMiddleware(), MaxBodySize() (+49 more)
+Nodes (58): contextKey, errorResponse, SecurityHeaders(), TestRateLimitMiddlewareWithPrefix_SeparatesClientUpdateBucket(), TestRateLimitMiddlewareWithPrefix_SeparatesLiveKitBucket(), AdminIPRestrict(), AuthMiddleware(), MaxBodySize() (+50 more)
-### Community 44 - "MainPage.ts"
-Cohesion: 0.02
-Nodes (125): clearAttachmentCaches(), closeActiveLightbox(), clearReactionUsersCache(), setReactionUsersFetcher(), applyConnectionStatus(), createServerBanner(), ServerBannerControl, colorForStatus() (+117 more)
+### Community 44 - "UserBar.ts"
+Cohesion: 0.04
+Nodes (70): createDmProfileSidebar(), DmProfileData, DmProfileSidebarOptions, legacyNoteKey(), loadNote(), saveNote(), scopedNoteKey(), STATUS_COLORS (+62 more)
### Community 45 - "DB"
Cohesion: 0.05
Nodes (25): dbtx, MessageWithUser, ReactionCount, ReactionInfo, UserPublic, database/sql.DB, database/sql.Row, database/sql.Rows (+17 more)
### Community 46 - "testing.F"
-Cohesion: 0.11
-Nodes (16): testing.F, fuzzGIFBytes(), FuzzImageDimensions(), fuzzJPEGBytes(), fuzzPNGBytes(), fuzzWebPVP8(), fuzzWebPVP8L(), fuzzWebPVP8X() (+8 more)
+Cohesion: 0.08
+Nodes (19): fuzzTestHelper, testing.F, FuzzValidateAvatarURL(), FuzzValidateDisplayName(), FuzzSanitizeUploadFilename(), FuzzValidateUsername(), FuzzValidatePasswordStrength(), fuzzOpenMigratedMemory() (+11 more)
### Community 47 - "Result"
-Cohesion: 0.10
-Nodes (47): requirePerm(), Event, TestHandleVoiceJoinV2_SignalsJoin(), handlePresenceV2(), handleTypingV2(), handleVoiceJoinV2(), registerVoiceControlsV2(), mustCreateVideoCappedChannel() (+39 more)
+Cohesion: 0.04
+Nodes (114): Key(), MessageService, Store, getCommandConstructor(), hasPerm(), requirePerm(), Event, BuildCallSignalForTest() (+106 more)
### Community 48 - "livekit_proxy.rs"
Cohesion: 0.06
@@ -693,24 +750,24 @@ Cohesion: 0.09
Nodes (35): CDP_PORT, cleanupUserDataDir(), createUserDataDir(), __dirname, __filename, NativeFixtures, acquirePersistentPage(), CDP_PORT (+27 more)
### Community 50 - "NewRouter"
-Cohesion: 0.07
-Nodes (44): EventPersisterMetrics, healthDeps, healthResponse, infoResponse, livekitHealthResponse, MetricsSources, ServerMetrics, database/sql.DBStats (+36 more)
+Cohesion: 0.09
+Nodes (38): healthDeps, healthResponse, infoResponse, livekitHealthResponse, TestBodyCapExemptions_RouteEnvelopesReachable(), TestHandleHealth_CanceledRequestDoesNotPoisonCache(), TestHandleHealth_ChecksAreCached(), TestHandleHealth_DegradedReturns503WithReason() (+30 more)
### Community 51 - "profileCreateToken"
-Cohesion: 0.11
-Nodes (52): identityKeyFailStore, net/http/httptest.ResponseRecorder, getWithToken(), TestUpdateProfile_BroadcastCarriesEveryProfileField(), TestUpdateProfile_RejectsBadDisplayName(), TestUpdateProfile_SetsDisplayNameAndAbout(), TestChangePassword_MalformedBody(), TestChangePassword_MissingNewPassword() (+44 more)
+Cohesion: 0.12
+Nodes (50): getWithToken(), TestUpdateProfile_BroadcastCarriesEveryProfileField(), TestUpdateProfile_RejectsBadDisplayName(), TestUpdateProfile_SetsDisplayNameAndAbout(), TestChangePassword_MalformedBody(), TestChangePassword_MissingNewPassword(), TestChangePassword_MissingOldPassword(), TestChangePassword_Unauthorized() (+42 more)
-### Community 52 - "User"
-Cohesion: 0.04
-Nodes (76): AuthBroadcaster, authSuccessResponse, deleteAccountRequest, loginRequest, passwordConfirmationRequest, registerRequest, totpConfirmationRequest, totpEnableResponse (+68 more)
+### Community 52 - "buildErrorMsg"
+Cohesion: 0.15
+Nodes (13): encoding/json.RawMessage, VoiceState, parseCallChannelID(), Client, Hub, buildErrorMsg(), buildErrorMsgWithID(), buildVoiceState() (+5 more)
### Community 53 - "newTestDB"
Cohesion: 0.04
Nodes (79): newTestDB(), TestBanUser_Permanent(), TestBanUser_Temporary(), TestCreateInvite_Success(), TestCreateInvite_UnlimitedUses(), TestCreateSession_Success(), TestCreateUser_CaseInsensitiveDuplicate(), TestCreateUser_DuplicateUsername() (+71 more)
-### Community 54 - "MemberList.ts"
-Cohesion: 0.05
-Nodes (49): BAN_DURATIONS, ChannelContextMenuOptions, ContextMenuResult, createChannelContextMenu(), createMemberContextMenu(), createMenuItem(), createSeparator(), MemberContextMenuOptions (+41 more)
+### Community 54 - "MainPage.ts"
+Cohesion: 0.02
+Nodes (146): VoiceModerationCallbacks, DmProfileSidebarComponent, clearAttachmentCaches(), closeActiveLightbox(), clearReactionUsersCache(), setReactionUsersFetcher(), applyConnectionStatus(), createServerBanner() (+138 more)
### Community 55 - "newServeHub"
Cohesion: 0.09
@@ -721,16 +778,16 @@ Cohesion: 0.20
Nodes (10): 3. Security, Authentication & Authorization, Input Validation, Observations (not blocking), Overall Posture: **GOOD** (no critical issues in core app security), Rate Limiting, Secrets & Configuration, SQL Injection (+2 more)
### Community 57 - "permissions_test.go"
-Cohesion: 0.07
-Nodes (48): overrideMatrixBits(), permGridBits(), TestAdminPanelOverrideMatrixCoversChannelScopedBits(), TestAdminPanelOverrideMatrixHasSingleDefinedBits(), TestAdminPanelPermGridCoversEveryPermissionBit(), TestAdminPanelPermGridHasNoDuplicateOrCompositeBits(), EffectivePerms(), HasAdmin() (+40 more)
+Cohesion: 0.09
+Nodes (39): EffectivePerms(), HasAdmin(), HasAnyPerm(), HasPerm(), HasServerPerm(), TestAdminPerimeter_Membership(), TestEffectivePerms_AllowAddsPermission(), TestEffectivePerms_AllowAndDenyTogether() (+31 more)
-### Community 58 - "seedMemberUser"
-Cohesion: 0.17
-Nodes (47): callMsg(), seedGroupDM(), TestCallDecline_ForwardsToOtherParticipants(), TestCallDecline_RateLimited(), TestCallRing_BlockedOneToOneForbidden(), TestCallRing_ForwardsToOtherParticipants(), TestCallRing_GroupWithInternalBlockStillRings(), TestCallRing_NonParticipantForbidden() (+39 more)
+### Community 58 - "newOverrideFixture"
+Cohesion: 0.62
+Nodes (6): newOverrideFixture(), seedChannelUserOverride(), TestListVisibleChannels_PerUserOverrideSplitsRoleMates(), TestPermissionService_AppliesUserOverrideLayer(), TestPermissionService_InvalidateUserPicksUpNewOverride(), visibleIDs()
### Community 59 - "postJSONWithToken"
-Cohesion: 0.13
-Nodes (44): postJSONWithToken(), buildCombinedRouter(), TestCombinedRouter_ProfileAndInvites(), TestCreateInvite_MalformedJSON(), TestCreateInvite_WithExpiration(), TestEnableTOTP_AlreadyEnabled(), TestListInvites_MemberForbidden(), TestRevokeInvite_AlreadyRevoked() (+36 more)
+Cohesion: 0.12
+Nodes (46): postJSONWithToken(), buildCombinedRouter(), TestCombinedRouter_ProfileAndInvites(), TestCreateInvite_MalformedJSON(), TestCreateInvite_WithExpiration(), TestEnableTOTP_AlreadyEnabled(), TestListInvites_MemberForbidden(), TestRevokeInvite_AlreadyRevoked() (+38 more)
### Community 60 - "http_proxy.rs"
Cohesion: 0.08
@@ -748,33 +805,33 @@ Nodes (49): TestWebhookParseIdentity_Invalid(), TestWebhookParseIdentity_Valid()
Cohesion: 0.05
Nodes (28): Attachment, AuditLog, Channel, ChannelOverride, ChannelUserOverride, DmOpenState, DmParticipant, Emoji (+20 more)
-### Community 65 - "architecture/README.md"
-Cohesion: 0.06
-Nodes (28): Client Architecture (Tauri), D7 — Module map, Key mechanisms, Quality tooling, D5 — Entity-relationship overview, Data Model, Domain notes, How the schema is accessed (+20 more)
+### Community 65 - "README.md"
+Cohesion: 0.07
+Nodes (22): D2 — Package map, D3 — REST request lifecycle, Server Architecture, D1 — System context and trust boundaries, D8 — Deployment topology, System Overview, D6 — Voice join + E2EE key exchange, Voice and End-to-End Encryption (+14 more)
### Community 66 - "devDependencies"
Cohesion: 0.06
Nodes (35): devDependencies, eslint, @eslint/js, fast-check, jsdom, knip, oxlint, @playwright/test (+27 more)
### Community 67 - "LoadOrGenerate"
-Cohesion: 0.16
-Nodes (25): TLSResult, crypto/tls.Config, fileExists(), GenerateSelfSigned(), loadACME(), loadCertPair(), LoadOrGenerate(), loadOrGenerateSelfSigned() (+17 more)
+Cohesion: 0.21
+Nodes (17): GenerateSelfSigned(), LoadOrGenerate(), TestGenerateSelfSignedCreatesFiles(), TestGenerateSelfSignedInvalidCertPath(), TestGenerateSelfSignedInvalidKeyPath(), TestGenerateSelfSignedProducesValidCert(), TestLoadOrGenerateACME_HTTPRedirect(), TestLoadOrGenerateACME_IPAddress() (+9 more)
### Community 68 - "helpers_test.go"
-Cohesion: 0.09
-Nodes (39): ExtractBearerToken(), IsEffectivelyBanned(), IsSessionExpired(), TestExtractBearerToken_BearerCaseInsensitive(), TestExtractBearerToken_BearerWithNoToken(), TestExtractBearerToken_EmptyHeaderValue(), TestExtractBearerToken_MissingHeader(), TestExtractBearerToken_MultipleSpaces() (+31 more)
+Cohesion: 0.08
+Nodes (41): ExtractBearerToken(), IsEffectivelyBanned(), IsSessionExpired(), TestExtractBearerToken_BearerCaseInsensitive(), TestExtractBearerToken_BearerWithNoToken(), TestExtractBearerToken_EmptyHeaderValue(), TestExtractBearerToken_MissingHeader(), TestExtractBearerToken_MultipleSpaces() (+33 more)
-### Community 69 - "ConnectPage.ts"
+### Community 69 - "main.ts"
Cohesion: 0.03
-Nodes (64): createUserUpdateCredentialSaver(), deleteCredential(), getInvoke(), loadCredential(), log, saveCredential(), SavedCredential, isValidHost() (+56 more)
+Nodes (82): createLogsTab(), formatLogEntry(), LOG_FILTER_LEVELS, LOG_LEVEL_COLORS, LOG_MIN_LEVELS, LogsTabHandle, TabName, createUpdateNotifier() (+74 more)
### Community 70 - "Security Policy"
Cohesion: 0.14
Nodes (14): Account Deletion, Audit Logging, Client Security Hardening, Credential Storage, Input Validation, Known Limitations, Reporting Vulnerabilities, Search and Rate Limiting (+6 more)
-### Community 71 - "Role"
-Cohesion: 0.17
-Nodes (11): Role, RoleInput, RoleService, Store, requireBelowActor(), requireGrantable(), validateColor(), validatePosition() (+3 more)
+### Community 71 - "WriteAudit"
+Cohesion: 0.10
+Nodes (24): AsyncAuditor, Auditor, WriteAudit(), Role, Name(), TestMentionEveryone_BitIsFreeAndNamed(), TestName_KnownAndUnknownBits(), ModerationService (+16 more)
### Community 72 - "channels.sql.go"
Cohesion: 0.08
@@ -790,7 +847,7 @@ Nodes (45): net/url.URL, LiveKitHealthHandlerForTest(), copyWS(), isOriginAllowe
### Community 75 - "newEmojiService"
Cohesion: 0.10
-Nodes (27): recordingEmojiBroadcaster, Emoji, EmojiImageURL(), Store, NewEmojiService(), NormalizeShortcode(), newEmojiService(), TestEmojiCreate_DuplicateShortcodeIsConflict() (+19 more)
+Nodes (28): recordingEmojiBroadcaster, Emoji, EmojiImageURL(), Store, NewEmojiService(), NormalizeShortcode(), newEmojiService(), TestEmojiCreate_DuplicateShortcodeIsConflict() (+20 more)
### Community 76 - "ws_proxy.rs"
Cohesion: 0.06
@@ -801,12 +858,12 @@ Cohesion: 0.06
Nodes (35): ARGS, BUGCLASS_LENSES, buildAdaptiveLenses(), churnFiles, cleanStreak, clusterOf(), confirmedAll, confirmedSorted (+27 more)
### Community 78 - "NewHandler"
-Cohesion: 0.18
-Nodes (13): TestNewHandler_APIRoutesMounted(), TestNewHandler_AuthProtectedRoute(), TestNewHandler_ReturnsNonNilHandler(), TestNewHandler_ServesStaticRoot(), TestNewHandler_SetsCSPOnRoot(), TestNewHandler_WithUpdater(), TestOwnerOnlyMiddleware_AdminDenied(), TestOwnerOnlyMiddleware_MemberDenied() (+5 more)
+Cohesion: 0.14
+Nodes (19): TestNewHandler_APIRoutesMounted(), TestNewHandler_AuthProtectedRoute(), TestNewHandler_ReturnsNonNilHandler(), TestNewHandler_ServesStaticRoot(), TestNewHandler_SetsCSPOnRoot(), TestNewHandler_WithUpdater(), TestOwnerOnlyMiddleware_AdminDenied(), TestOwnerOnlyMiddleware_MemberDenied() (+11 more)
### Community 79 - "db/db.go"
-Cohesion: 0.07
-Nodes (35): DBTX, Queries, seedChannel, seedMessage, seedUser, hasKeywordPrefix(), isMemoryPath(), isReadOnlySQL() (+27 more)
+Cohesion: 0.08
+Nodes (29): DBTX, Queries, seedChannel, seedMessage, seedUser, hasKeywordPrefix(), isMemoryPath(), isReadOnlySQL() (+21 more)
### Community 80 - "Tables"
Cohesion: 0.05
@@ -816,17 +873,17 @@ Nodes (37): Admin perimeter, api_tokens, attachments, audit_log, Bit Map, channe
Cohesion: 0.14
Nodes (39): parseMentionTokens(), MessageService, mentionCount(), newMentionFixture(), sendAs(), TestChannelFocus_ClearsMentionCount(), TestDeleteMessage_ClearsMentionCount(), TestDeleteMessage_RepeatedDeleteDoesNotDecrementMentionCountTwice() (+31 more)
-### Community 82 - "message.go"
-Cohesion: 0.07
-Nodes (23): AttachmentInfo, ReactionUser, MessageService, MessageService, Store, requireChannelWritable(), RequireDMNotBlocked(), MessageService (+15 more)
+### Community 82 - "messages_test.go"
+Cohesion: 0.08
+Nodes (37): buildAuthError(), buildChatDeleted(), buildChatEdited(), buildMemberBan(), buildMemberJoin(), buildReactionUpdate(), buildTypingMsg(), buildVoiceToken() (+29 more)
### Community 83 - "newWAFMiddleware"
Cohesion: 0.09
-Nodes (40): matchRecorder, coraza.WAF, github.com/corazawaf/coraza/v3/types.Interruption, github.com/corazawaf/coraza/v3/types.MatchedRule, github.com/corazawaf/coraza/v3/types.Transaction, captureSlog(), TestNewCRSWAF_LoadsCoreRuleSet(), TestNormalizeCRSMode() (+32 more)
+Nodes (41): matchRecorder, coraza.WAF, github.com/corazawaf/coraza/v3/types.Interruption, github.com/corazawaf/coraza/v3/types.MatchedRule, github.com/corazawaf/coraza/v3/types.Transaction, sync.Mutex, captureSlog(), TestNewCRSWAF_LoadsCoreRuleSet() (+33 more)
-### Community 84 - "ws.ts"
-Cohesion: 0.10
-Nodes (30): adminPanelUrl(), openAdminPanel(), RFC-3986, ServerMessage, bracketBareIPv6Host(), CertFirstUseListener, CertMismatchListener, CertTofuEvent (+22 more)
+### Community 84 - "Config"
+Cohesion: 0.11
+Nodes (23): BackupConfig, DatabaseConfig, EventPersistenceConfig, LoggingConfig, PluginsConfig, SecurityConfig, ServerConfig, UploadConfig (+15 more)
### Community 85 - "storage_test.go"
Cohesion: 0.07
@@ -842,27 +899,27 @@ Nodes (8): sync/atomic.Pointer, Client, LiveKitProcess, Hub, TopicRateLimiter, b
### Community 88 - "admin/export_test.go"
Cohesion: 0.12
-Nodes (25): TestAdminAPI_CreateChannel_SurvivesContextCancelAfterCommit(), TestAdminAPI_PatchChannel_ArchiveCleansVoice(), TestAdminAPI_PatchChannel_ArchiveSurvivesContextCancelAfterCommit(), TestAdminAPI_PatchChannel_UnarchiveDoesNotCleanVoice(), CaptureSetupLimiter(), CurrentRestartState(), ForceRestartState(), ResetRestartState() (+17 more)
+Nodes (24): TestAdminAPI_CreateChannel_SurvivesContextCancelAfterCommit(), TestAdminAPI_PatchChannel_ArchiveCleansVoice(), TestAdminAPI_PatchChannel_ArchiveSurvivesContextCancelAfterCommit(), TestAdminAPI_PatchChannel_UnarchiveDoesNotCleanVoice(), CaptureSetupLimiter(), CurrentRestartState(), ForceRestartState(), ResetRestartState() (+16 more)
-### Community 89 - "logger.ts"
-Cohesion: 0.02
-Nodes (91): clearEmbedCaches(), ToggleItem, TOGGLES, buildAdvancedTab(), clearImageCache(), clearLocalStoragePreservingUserData(), clearLogFiles(), isMissingPathError() (+83 more)
+### Community 89 - "dispatcher.test.ts"
+Cohesion: 0.05
+Nodes (49): adminPanelUrl(), openAdminPanel(), RFC-3986, wireConnectionStatus(), handleParticipantLeft, isVoiceConnected(), isVoiceSessionActive(), ClientMessage (+41 more)
### Community 90 - "updater_test.go"
-Cohesion: 0.06
-Nodes (56): archive/tar.Header, net/http.Response, TestCheckForUpdate_ErrorCaching(), TestCheckForUpdate_IncludesAssetsList(), TestDownloadFile_NoTokenToExternalHost(), TestDownloadFile_SendsTokenToGitHub(), TestFetchTextAsset_Error(), TestFetchTextAsset_Success() (+48 more)
+Cohesion: 0.10
+Nodes (33): archive/tar.Header, TestCheckForUpdate_ErrorCaching(), TestCheckForUpdate_IncludesAssetsList(), TestDownloadFile_NoTokenToExternalHost(), TestDownloadFile_SendsTokenToGitHub(), TestFindClientAssets_ByTarget(), TestFindClientAssets_NilCache(), TestFindClientAssets_NoMatchingAssets() (+25 more)
### Community 91 - "newTestMessageService"
Cohesion: 0.12
Nodes (32): seedAroundHistory(), TestGetMessagesAround_ClampsLimit(), TestGetMessagesAround_DeletedCentreIsNotFound(), TestGetMessagesAround_DMNonParticipantIsNotFound(), TestGetMessagesAround_EdgesReportNoMore(), TestGetMessagesAround_ExactFitReportsNoMore(), TestGetMessagesAround_MessageFromAnotherChannelIsNotFound(), TestGetMessagesAround_RejectsBadIDs() (+24 more)
-### Community 92 - "textAssetServer"
-Cohesion: 0.22
-Nodes (10): net/http/httptest.Server, dialAndAuthWS(), TestNewRouter_DeleteAccount_BroadcastsMemberBanOverWS(), TestCheckForUpdateCancelledCallerDoesNotPoisonCache(), TestFetchTextAssetCachedCancelledCallerDoesNotPoisonCache(), TestFetchTextAssetCachedCachesFailures(), TestFetchTextAssetCachedCoalescesConcurrentMisses(), TestFetchTextAssetCachedEvictsExpiredKeys() (+2 more)
+### Community 92 - "newTestUpdater"
+Cohesion: 0.10
+Nodes (29): TestCheckForUpdateCancelledCallerDoesNotPoisonCache(), TestFetchTextAssetCachedCancelledCallerDoesNotPoisonCache(), TestFetchTextAsset_Error(), TestFetchTextAsset_Success(), serverDownloadAssetName(), TestCheckForUpdateCoalescesConcurrentMisses(), TestFetchTextAssetCachedCachesFailures(), TestFetchTextAssetCachedCoalescesConcurrentMisses() (+21 more)
### Community 93 - "Hub"
-Cohesion: 0.06
-Nodes (16): userUpdateSpy, TestExtractEventType(), TestExtractEventTypeLengthCap(), Hub, extractEventType(), wrapWithSeq(), buildEmojiUpdate(), buildPresenceMsg() (+8 more)
+Cohesion: 0.10
+Nodes (5): Hub, buildPresenceMsg(), buildRolesUpdate(), buildServerRestartMsg(), TestBuildServerRestartMsg()
### Community 94 - "compilerOptions"
Cohesion: 0.06
@@ -872,29 +929,29 @@ Nodes (34): compilerOptions, esModuleInterop, forceConsistentCasingInFileNames,
Cohesion: 0.11
Nodes (19): 1. Executive summary, 2.1 Carried findings, 2.2 CI gates and pins (all verified holding), 2.3 Plan statuses (docs/plans/), 2. Prior-finding closure verification, 3. Dynamic checks (this session, at `eacba10`), 4. New findings — BROKEN (all documentation), 5. New findings — FRAGILE (+11 more)
-### Community 96 - "net/http.Request"
-Cohesion: 0.13
-Nodes (25): memberUnbanBroadcaster, patchUserRequest, PluginAdminHandler, net/http.Request, net/http.ResponseWriter, handleForceLogout(), handlePatchUser(), patchUserApplyBan() (+17 more)
+### Community 96 - "handleCreateEmoji"
+Cohesion: 0.10
+Nodes (35): EmojiBroadcaster, emojiResponse, FileStore, uploadResponse, net/http.Client, broadcastEmojiSet(), chi.Router, handleCreateEmoji() (+27 more)
### Community 97 - "emoji_handler_test.go"
Cohesion: 0.17
Nodes (32): emojiHarness, emojiSeedUser(), gifBytes(), jpegBytes(), newEmojiHarness(), pngBytes(), TestBroadcastEmojiSet_SurvivesCanceledRequestContext(), TestEmojiDelete_BadIDIs400() (+24 more)
-### Community 98 - "buildErrorMsg"
-Cohesion: 0.14
-Nodes (13): encoding/json.RawMessage, VoiceState, parseCallChannelID(), Client, Hub, buildErrorMsg(), buildVoiceState(), parseChannelID() (+5 more)
+### Community 98 - "buildVoiceLeave"
+Cohesion: 0.27
+Nodes (7): github.com/livekit/protocol/livekit.WebhookEvent, Client, Hub, MountWebhookRoute(), parseParticipantIdentity(), parseRoomChannelID(), buildVoiceLeave()
-### Community 99 - "channelFromFields"
-Cohesion: 0.16
-Nodes (10): channelPermissionsResponse, channelFields, Invite, channelFromFields(), Channel, ChannelRoleOverride, ChannelUserOverride, DB (+2 more)
+### Community 99 - "media.ts"
+Cohesion: 0.04
+Nodes (70): CODE_BLOCK_REGEX, INLINE_CODE_REGEX, MASKED_LINK_REGEX, URL_REGEX, applyOgMeta(), clearEmbedCaches(), EMPTY_OG, fetchOgMeta() (+62 more)
-### Community 100 - "openAdminTestDB"
+### Community 100 - "doRequest"
Cohesion: 0.09
-Nodes (41): mockPermInvalidator, openAdminTestDB(), TestAdminAPI_PatchRole_NoRenameNoMemberUpdate(), TestAdminAPI_PatchRole_RenameBroadcastsMemberUpdate(), createUserWithRole(), decodeRole(), doRequestRaw(), newRolesHandler() (+33 more)
+Nodes (39): mockPermInvalidator, doRequest(), TestAdminAPI_PatchRole_NoRenameNoMemberUpdate(), TestAdminAPI_PatchRole_RenameBroadcastsMemberUpdate(), createUserWithRole(), decodeRole(), newRolesHandler(), TestAdminAPI_CreateRole_DuplicateNameIsBadRequest() (+31 more)
-### Community 101 - "NewEventRingBuffer"
-Cohesion: 0.20
-Nodes (18): NewEventRingBuffer(), TestConcurrent_PushAndEventsSince(), TestEventsSince_AfterSeqEqualsOldest_ReturnsNil(), TestEventsSince_AfterSeqZero_ReturnsBehavior(), TestEventsSince_AfterSpecificSeq(), TestEventsSince_AheadOfNewestSeq(), TestEventsSince_AtLatestSeq(), TestEventsSince_CapacityBoundaries() (+10 more)
+### Community 101 - "handleRestoreBackup"
+Cohesion: 0.09
+Nodes (26): backupEntry, backupFile, MaintainBackups(), pruneExpiredBackups(), runScheduledBackup(), scanBackups(), absOrRaw(), closeDatabase() (+18 more)
### Community 102 - "Auth Endpoints"
Cohesion: 0.07
@@ -904,9 +961,9 @@ Nodes (30): Auth Endpoints, DELETE /api/v1/auth/account, DELETE /api/v1/users/me
Cohesion: 0.20
Nodes (29): testing/fstest.MapFS, MigrateFS(), countVersions(), hasVersion(), simpleFS(), tableExists(), TestMigrate_AllMigrationsRecorded(), TestMigrate_AppliedAtIsISO8601() (+21 more)
-### Community 104 - "PermissionService"
+### Community 104 - "Queries"
Cohesion: 0.12
-Nodes (13): ChannelService, Store, newOverrideFixture(), seedChannelUserOverride(), TestListVisibleChannels_PerUserOverrideSplitsRoleMates(), TestPermissionService_AppliesUserOverrideLayer(), TestPermissionService_InvalidateUserPicksUpNewOverride(), visibleIDs() (+5 more)
+Nodes (8): BanUserParams, CreateUserParams, ListMembersRow, UpdateUserIdentityKeyParams, UpdateUserStatusParams, UpdateUserTOTPSecretParams, Queries, User
### Community 105 - "Save"
Cohesion: 0.18
@@ -916,13 +973,13 @@ Nodes (20): bytesProvider, go.yaml.in/yaml/v3.Node, validateYAML(), applyPatch()
Cohesion: 0.07
Nodes (29): Admin API Authorization, Audit Log, Authentication, Channel Management (admin), Diagnostics, Error Codes, GET /admin/api/audit-log, GET /admin/api/me (+21 more)
-### Community 107 - "deps.go"
-Cohesion: 0.10
-Nodes (26): hasPerm(), registerChatHandlers(), registerPingHandler(), registerPresenceHandlers(), reactionV2Handler(), registerReactionHandlers(), NewHandlerRegistry(), fullV2Registry() (+18 more)
+### Community 107 - "RateLimiter"
+Cohesion: 0.15
+Nodes (15): entry, lockoutEntry, LockoutPersister, rateLimiterShard, time.Duration, SetSetupLimiterReapTiming(), RateLimiter, NewPersistentRateLimiter() (+7 more)
### Community 108 - "joinVoice"
Cohesion: 0.25
-Nodes (32): receiveMsgOfType(), voiceMuteMsg(), auditActions(), joinVoice(), newVoiceModHub(), seedVoiceUserWithRole(), TestVoiceDeafen_SelfUndeafenWhileServerDeafened_Refused(), TestVoiceMod_Deafen_ClearingRestoresSelfUnmute() (+24 more)
+Nodes (31): voiceMuteMsg(), auditActions(), joinVoice(), newVoiceModHub(), seedVoiceUserWithRole(), TestVoiceDeafen_SelfUndeafenWhileServerDeafened_Refused(), TestVoiceMod_Deafen_ClearingRestoresSelfUnmute(), TestVoiceMod_Deafen_SetsServerDeafenedAndMutes() (+23 more)
### Community 109 - "ptt.rs"
Cohesion: 0.11
@@ -944,17 +1001,17 @@ Nodes (18): go/ast.File, go/ast.ImportSpec, go/token.FileSet, Rule, Violation, a
Cohesion: 0.16
Nodes (23): IsDefaultVoiceCredentials(), Load(), TestIsDefaultVoiceCredentials(), TestLoadDefaults(), TestLoadEnvironmentVariableOverrides(), TestLoadEnvOverride_EventPersistence(), TestLoadEnvOverridesPrecedenceOverYAML(), TestLoadEnvVarNoUnderscore() (+15 more)
-### Community 114 - "handleVoiceE2EEAnnounceV2"
-Cohesion: 0.25
-Nodes (12): TestVoiceE2EEAnnounceV2_EmptyPublicKey(), TestVoiceE2EEAnnounceV2_HappyPath(), TestVoiceE2EEAnnounceV2_InvalidBase64(), TestVoiceE2EEAnnounceV2_NoReply(), TestVoiceE2EEAnnounceV2_NoSignature_LegacyAccepted(), TestVoiceE2EEAnnounceV2_NotInVoiceChannel(), TestVoiceE2EEAnnounceV2_PublicKeyTooLarge(), TestVoiceE2EEAnnounceV2_SignatureInvalidBase64() (+4 more)
-
-### Community 115 - "Registry"
+### Community 114 - "Registry"
Cohesion: 0.12
Nodes (15): archive/zip.File, archive/zip.Reader, sync.RWMutex, bytesReaderAt, Config, UITabBinding, PluginStore, Manifest (+7 more)
+### Community 115 - "AdminActions.ts"
+Cohesion: 0.13
+Nodes (17): appendBanFlow(), BAN_DURATIONS, ChannelContextMenuOptions, ContextMenuResult, createChannelContextMenu(), createMemberContextMenu(), createMenuItem(), createSeparator() (+9 more)
+
### Community 116 - "newEmitTestHub"
-Cohesion: 0.11
-Nodes (27): TestEmitEvents_PresenceOthersEvent_UsesNormalPriorityQueue(), TestEmitEvents_PresenceEvent_UsesNormalPriorityQueue(), TestEmitEvents_PresenceSelfEvent_UsesNormalPriorityQueue(), drainChan(), Hub, newEmitTestHub(), registerEmitTestClient(), registerEmitTestVoiceClient() (+19 more)
+Cohesion: 0.10
+Nodes (28): TestEmitEvents_PresenceOthersEvent_UsesNormalPriorityQueue(), TestEmitEvents_PresenceEvent_UsesNormalPriorityQueue(), TestEmitEvents_PresenceSelfEvent_UsesNormalPriorityQueue(), drainChan(), Hub, newEmitTestHub(), registerEmitTestClient(), registerEmitTestVoiceClient() (+20 more)
### Community 117 - "Plan: Remediate security-hardening review regressions"
Cohesion: 0.08
@@ -968,9 +1025,9 @@ Nodes (15): aead.dev/minisign.PublicKey, os.File, TestEnsureVPrefix(), ensureVPr
Cohesion: 0.21
Nodes (19): StubRestart(), chdirTemp(), TestHandleBackup_RequiresOwner(), TestHandleBackup_Success(), TestHandleDeleteBackup_InvalidNameTraversal(), TestHandleDeleteBackup_NotFound(), TestHandleDeleteBackup_RequiresOwner(), TestHandleDeleteBackup_Success() (+11 more)
-### Community 120 - "StartEventPruner"
-Cohesion: 0.23
-Nodes (8): runPrune(), StartEventPruner(), TestRunPruneCutoffCalculation(), TestRunPruneErrorDoesNotPanic(), TestStartEventPrunerContextCancellation(), TestStartEventPrunerNilStoreIsNoop(), TestStartEventPrunerStartupDelayBoundedByInterval(), EventStore
+### Community 120 - "NewEventPersister"
+Cohesion: 0.26
+Nodes (10): NewEventPersister(), captureLogs(), openPersisterTestDB(), TestEventPersisterDropsOnFullQueue(), TestEventPersisterEnqueueAfterStopDropsLoudly(), TestEventPersisterFlushesBatch(), TestEventPersisterStopDrains(), TestEventPersisterStopWaitsForGoroutineExit() (+2 more)
### Community 121 - "EnsureLiveKitBinary"
Cohesion: 0.17
@@ -980,21 +1037,21 @@ Nodes (23): io.Reader, io.ReaderAt, sync/atomic.Int32, cleanupOldLiveKitBinaries
Cohesion: 0.13
Nodes (30): clientDiag, diagnosticsResponse, serverDiag, voiceDiag, inCIDRs(), TestClientIP_BroadTrustedCIDRKeepsClientsDistinct(), TestClientIP_NoTrustedProxies_UsesRemoteAddr(), TestClientIP_RemoteAddrWithoutPort() (+22 more)
-### Community 123 - "reaction-tooltip.ts"
-Cohesion: 0.14
-Nodes (21): attachReactionTooltip(), buildReactionTooltip(), cache, cacheKey(), chipSetFor(), formatReactorNames(), getCachedReactionUsers(), hide() (+13 more)
+### Community 123 - "Queries"
+Cohesion: 0.11
+Nodes (10): CloseDMParams, FindDMChannelIDBetweenParams, GetDMParticipantsForUserRow, GetDMParticipantsRow, GetUserDMChannelsRow, IsDMParticipantParams, OpenDMParams, RemoveDMParticipantParams (+2 more)
-### Community 124 - "VoiceTopic"
-Cohesion: 0.12
-Nodes (14): github.com/livekit/protocol/livekit.WebhookEvent, FuzzParseParticipantIdentity(), FuzzParseRoomChannelID(), Client, Hub, MountWebhookRoute(), parseParticipantIdentity(), parseRoomChannelID() (+6 more)
+### Community 124 - "newRoleCRUDService"
+Cohesion: 0.17
+Nodes (24): assertAudit(), newRoleCRUDService(), TestAffectedUserIDs(), TestCreateRole_CannotGrantUnheldBit(), TestCreateRole_CannotPlaceAtOrAboveOwnRank(), TestCreateRole_DefaultPlacementAvoidsCollision(), TestCreateRole_DefaultsToJustBelowActor(), TestCreateRole_HappyPath() (+16 more)
-### Community 125 - "gif_handler_test.go"
-Cohesion: 0.30
-Nodes (19): lastRequest, buildGIFRouter(), decodeGIFError(), decodeGIFResults(), gifGET(), stubKlipy(), TestGIFAuthCheckedBeforeDisabledCheck(), TestGIFDisabledMakesNoUpstreamCall() (+11 more)
+### Community 125 - "net/http.Handler"
+Cohesion: 0.18
+Nodes (25): lastRequest, go.opentelemetry.io/otel/sdk/metric.MeterProvider, go.opentelemetry.io/otel/sdk/trace.TracerProvider, net/http.Handler, net/http/httptest.ResponseRecorder, doRequestRaw(), buildGIFRouter(), decodeGIFError() (+17 more)
-### Community 126 - "e2e/helpers.ts"
-Cohesion: 0.14
-Nodes (12): MOCK_INVITES, MOCK_MESSAGES_RICH, MOCK_READY_PAYLOAD, mockTauriFullSession(), mockTauriFullSessionWithAutoConnect(), mockTauriFullSessionWithEcho(), mockTauriFullSessionWithFailingMessages(), mockTauriFullSessionWithMessages() (+4 more)
+### Community 126 - "navigateToMainPage"
+Cohesion: 0.19
+Nodes (6): emitWsEvent(), emitWsMessage(), mockTauriFullSession(), mockTauriFullSessionWithMessages(), navigateToMainPage(), simulateReconnect()
### Community 127 - "messages.sql.go"
Cohesion: 0.13
@@ -1005,20 +1062,20 @@ Cohesion: 0.09
Nodes (23): Channel Endpoints, DELETE /api/v1/channels/{id}/pins/{messageId}, Errors, GET /api/v1/channels, GET /api/v1/channels/{id}/messages, GET /api/v1/channels/{id}/messages/around/{messageId}, GET /api/v1/channels/{id}/messages/{messageId}/reactions/{emoji}/users, GET /api/v1/channels/{id}/pins (+15 more)
### Community 129 - "newSignedTestUpdater"
-Cohesion: 0.19
-Nodes (23): aead.dev/minisign.PrivateKey, multiAssetManifest(), testHash(), TestVerifyReleaseManifest_LegacySingleAssetStillVerifies(), TestVerifyReleaseManifest_MultiAssetBadChecksumFails(), TestVerifyReleaseManifest_MultiAssetSelectsLinuxEntry(), TestVerifyReleaseManifest_MultiAssetSelectsWindowsEntry(), TestVerifyReleaseManifest_MultiAssetUnknownAssetFails() (+15 more)
+Cohesion: 0.20
+Nodes (22): aead.dev/minisign.PrivateKey, multiAssetManifest(), testHash(), TestVerifyReleaseManifest_LegacySingleAssetStillVerifies(), TestVerifyReleaseManifest_MultiAssetBadChecksumFails(), TestVerifyReleaseManifest_MultiAssetSelectsLinuxEntry(), TestVerifyReleaseManifest_MultiAssetSelectsWindowsEntry(), TestVerifyReleaseManifest_MultiAssetUnknownAssetFails() (+14 more)
### Community 130 - "host_http_test.go"
Cohesion: 0.11
Nodes (21): net.Conn, net.IP, net.Listener, HTTPRequest, HTTPResponse, TestEmptyAllowlistDeniesEveryHost(), Registry, GuardedDialContext() (+13 more)
-### Community 131 - "Topic"
-Cohesion: 0.20
-Nodes (8): TestEmitEvents_DirectPresenceDropsQueuedEntry(), Client, NewPubSub(), TestUserTopic(), topicFor(), UserTopic(), PubSub, Topic
+### Community 131 - "VoiceTopic"
+Cohesion: 0.17
+Nodes (10): TestEmitEvents_DirectPresenceDropsQueuedEntry(), Client, NewPubSub(), TestUserTopic(), TestVoiceTopic(), topicFor(), UserTopic(), VoiceTopic() (+2 more)
### Community 132 - "DB"
-Cohesion: 0.09
-Nodes (14): mentionExecer, mentionTargetColumn, ChannelOverride, DB, MentionTarget, Message, insertMentionRows(), LowerASCII() (+6 more)
+Cohesion: 0.11
+Nodes (10): mentionExecer, mentionTargetColumn, ChannelOverride, DB, MentionTarget, Message, insertMentionRows(), LowerASCII() (+2 more)
### Community 133 - "users"
Cohesion: 0.14
@@ -1028,29 +1085,29 @@ Nodes (15): channel_overrides, channels, messages, messages_fts, roles, sessions
Cohesion: 0.09
Nodes (5): Hub, Client, newClient(), TestApplyConnectStatus_DoesNotStampStatusWhenDBWriteFails(), wsConn
-### Community 135 - "Queries"
+### Community 135 - "ConnectPageCallbacks"
+Cohesion: 0.10
+Nodes (7): SimpleProfile, ConnectPageCallbacks, mockLoadCredential, testProfiles, testProfiles, testProfiles, testProfiles
+
+### Community 136 - "newWazeroTestRegistry"
+Cohesion: 0.31
+Nodes (14): Registry, newWazeroTestRegistry(), TestPlatformInitPageCountDoesNotOverflowUint32(), TestWazeroActivateCompilesModule(), TestWazeroCloseTearsDownRuntime(), TestWazeroConcurrentDispatchRace(), TestWazeroCPUBudgetOverrunDoesNotBrickPlugin(), TestWazeroDeactivateClosesCompiledModule() (+6 more)
+
+### Community 137 - "OwnCord beta requirement traceability"
Cohesion: 0.12
-Nodes (9): GetAuditLogParams, GetAuditLogRow, ListAllUsersParams, ListAllUsersRow, LogAuditParams, SetSettingParams, UpdateUserRoleParams, Queries (+1 more)
-
-### Community 136 - "handleChatCommandV2"
-Cohesion: 0.15
-Nodes (19): getCommandConstructor(), TestCanPluginBroadcast_NilServiceFailsClosed(), TestChatCommandConstructor_Errors(), TestHandleChatCommandV2_NoRegistry(), TestHandleVoiceLeaveV2_RateLimited(), TestHandleVoiceLeaveV2_RateLimited_StillSignalsLeave(), TestHandleVoiceLeaveV2_SignalsLeave(), TestVoiceJoinConstructor_Errors() (+11 more)
-
-### Community 137 - "Queries"
-Cohesion: 0.11
-Nodes (10): CloseDMParams, FindDMChannelIDBetweenParams, GetDMParticipantsForUserRow, GetDMParticipantsRow, GetUserDMChannelsRow, IsDMParticipantParams, OpenDMParams, RemoveDMParticipantParams (+2 more)
+Nodes (16): Browser and PWA client, Capacity and compatibility, Client experience and accessibility, Community and governance, Completeness check, Cross-cutting qualification rule, Extensions and deferred systems, How to use this document (+8 more)
### Community 138 - "wizardHandler"
Cohesion: 0.33
Nodes (11): getSetting(), TestSetupStatus_DefaultsOnlyPreSetupAndSecretFree(), TestSetupWizard_ConfigWriteFailureWarnsButCreatesAccount(), TestSetupWizard_ForeignOriginBlocked(), TestSetupWizard_FullFlow(), TestSetupWizard_IdentityFieldsStoredRawNotEscaped(), TestSetupWizard_InvalidValuesRejectBeforeAccountCreation(), TestSetupWizard_LegacyPayloadUnchangedBehaviour() (+3 more)
### Community 139 - "middleware_and_spawn_test.go"
-Cohesion: 0.17
-Nodes (18): isolateSpawnedTestBinary(), openWhiteboxTestDB(), TestAdminAuthMiddleware_RoleNotFound(), TestHandleGetAuditLog_DBError(), TestHandleGetSettings_DBError(), TestHandleGetStats_DBError(), TestHandleListChannels_DBError(), TestHandleListUsers_DBError() (+10 more)
+Cohesion: 0.10
+Nodes (18): mockHubWB, isolateSpawnedTestBinary(), openWhiteboxTestDB(), TestAdminAuthMiddleware_RoleNotFound(), TestHandleGetAuditLog_DBError(), TestHandleGetSettings_DBError(), TestHandleGetStats_DBError(), TestHandleListChannels_DBError() (+10 more)
### Community 140 - "password_test.go"
-Cohesion: 0.14
-Nodes (19): CheckPassword(), FuzzValidatePasswordStrength(), getDummyHash(), TestCheckPassword_CorrectPassword(), TestCheckPassword_EmptyHash(), TestCheckPassword_EmptyHashTimingResistance(), TestCheckPassword_EmptyPassword(), TestCheckPassword_MalformedHash() (+11 more)
+Cohesion: 0.16
+Nodes (18): CheckPassword(), getDummyHash(), TestCheckPassword_CorrectPassword(), TestCheckPassword_EmptyHash(), TestCheckPassword_EmptyHashTimingResistance(), TestCheckPassword_EmptyPassword(), TestCheckPassword_MalformedHash(), TestCheckPassword_WrongPassword() (+10 more)
### Community 141 - "newPurgeService"
Cohesion: 0.19
@@ -1068,13 +1125,13 @@ Nodes (21): assertChanEmpty(), assertChanMsg(), Client, makeTestClient(), newTes
Cohesion: 0.25
Nodes (20): channelFlags, newChannel(), newChannelTestAPI(), patchChannelFlags(), TestCreateChannel_AnyTypeUnderAnyCategory(), TestCreateChannel_UnknownTypeRejected(), TestDeleteChannel_RefusesDM(), TestListChannels_ExcludesDMs() (+12 more)
-### Community 145 - "gapProbeSSEWriter"
-Cohesion: 0.20
-Nodes (6): gapProbeSSEWriter, revokingSSEWriter, bytes.Buffer, net/http.Header, TestRingBuffer_SnapshotAndSubscribe_NoGap(), TestRingBuffer_SnapshotAndSubscribe_SnapshotExcludedFromChannel()
+### Community 145 - "TestHandleLogStream_EntryWrittenDuringBackfillIsDelivered"
+Cohesion: 0.15
+Nodes (8): gapProbeSSEWriter, revokingSSEWriter, lockedBuffer, bytes.Buffer, net/http.Header, TestHandleLogStream_EntryWrittenDuringBackfillIsDelivered(), TestRingBuffer_SnapshotAndSubscribe_NoGap(), TestRingBuffer_SnapshotAndSubscribe_SnapshotExcludedFromChannel()
-### Community 146 - "setupPrecheck"
-Cohesion: 0.12
-Nodes (29): setupDefaults, SetupOptions, setupRequest, setupResponse, setupStatusResponse, setupWizardRequest, net.IPNet, tryDirectRestartPending() (+21 more)
+### Community 146 - "net/http.Request"
+Cohesion: 0.09
+Nodes (42): setupDefaults, SetupOptions, setupRequest, setupResponse, setupStatusResponse, setupWizardRequest, loginRequest, PluginAdminHandler (+34 more)
### Community 147 - "log/slog.Value"
Cohesion: 0.14
@@ -1084,9 +1141,9 @@ Nodes (9): log/slog.Value, logAttrValue(), Config, GIFConfig, GitHubConfig, Voic
Cohesion: 0.16
Nodes (14): tauriPlatformResponse, tauriUpdateResponse, golang.org/x/sync/singleflight.Group, ensureV(), chi.Router, handleClientUpdate(), MountClientUpdateRoute(), Updater (+6 more)
-### Community 149 - "seedChannel"
-Cohesion: 0.23
-Nodes (18): TestCacheStats_HitsAndMisses(), newTestPermService(), TestHasChannelPerm_Allowed(), TestHasChannelPerm_Denied(), TestHasChannelPerm_OverrideAllow(), TestHasChannelPerm_OverrideDeny(), TestHasChannelPerm_UnknownUserReturnsFalse(), TestInvalidateAll_ClearsEntireCache() (+10 more)
+### Community 149 - "Queries"
+Cohesion: 0.15
+Nodes (7): CountRoleMembersRow, CreateRoleParams, GetUserWithRoleRow, SetRolePositionParams, UpdateRoleParams, Queries, Role
### Community 150 - "dependencies"
Cohesion: 0.09
@@ -1094,39 +1151,35 @@ Nodes (23): dependencies, @jitsi/rnnoise-wasm, livekit-client, @tauri-apps/api,
### Community 151 - "newHarvestVoiceDB"
Cohesion: 0.09
-Nodes (42): mustCreateVoiceChannel(), newHarvestVoiceDB(), seedHarvestVoiceUser(), TestHandleVoiceCameraV2_ChannelLookupErrorFailsClosed(), TestHandleVoiceJoin_AbortedSwitchDoesNotResurrectVoiceTopicSubscription(), TestSweepStaleVoiceStates_EvictionIsScopedToCheckedChannel(), TestRefreshChannelVisibility_ReconnectDuringFanOutActsOnLiveClient(), TestCleanupVoiceForChannel_NotifiesReadAudienceOfArchivedChannel() (+34 more)
+Nodes (39): mustCreateVoiceChannel(), newHarvestVoiceDB(), seedHarvestVoiceUser(), TestHandleVoiceCameraV2_ChannelLookupErrorFailsClosed(), TestHandleVoiceJoin_AbortedSwitchDoesNotResurrectVoiceTopicSubscription(), TestSweepStaleVoiceStates_EvictionIsScopedToCheckedChannel(), TestRefreshChannelVisibility_ReconnectDuringFanOutActsOnLiveClient(), TestCleanupVoiceForChannel_NotifiesReadAudienceOfArchivedChannel() (+31 more)
### Community 152 - "Config Key Reference"
Cohesion: 0.10
Nodes (21): Backups (`backup`), Config Key Reference, Database (`database`), Environment Variable Overrides, Event Persistence (`event_persistence`), Example config.yaml, First-run setup wizard, GIF Picker (`gif`) (+13 more)
-### Community 153 - "Queries"
+### Community 153 - "connectionStats.ts"
+Cohesion: 0.17
+Nodes (13): collectAllStats(), ConnectionStats, ConnectionStatsPoller, createConnectionStatsPoller(), EMPTY_STATS, extractMetrics(), formatBitrate(), formatBytes() (+5 more)
+
+### Community 155 - "totp_test.go"
Cohesion: 0.15
-Nodes (7): CountRoleMembersRow, CreateRoleParams, GetUserWithRoleRow, SetRolePositionParams, UpdateRoleParams, Queries, Role
+Nodes (20): NewPartialAuthStore(), NewPendingTOTPStore(), TestGenerateTOTPCode_InvalidSecret(), TestGenerateTOTPCodeAndVerify_RFCVector(), TestGenerateTOTPSecret_Unique(), TestPartialAuthStore_Consume(), TestPartialAuthStore_ConsumeInvalidToken(), TestPartialAuthStore_ExpiryCleanup() (+12 more)
-### Community 154 - "markdown.ts"
-Cohesion: 0.11
-Nodes (20): FenwickTree, BlockNode, buildMatches(), codeSpanEnd(), DELIMS, DelimSpec, EMPTY_MATCHES, InlineNode (+12 more)
+### Community 156 - "github.com/owncord/server/syncutil.Mutex"
+Cohesion: 0.17
+Nodes (7): PartialAuthChallenge, pendingTOTPEnrollment, github.com/owncord/server/syncutil.Mutex, generateOpaqueToken(), PartialAuthStore, PendingTOTPStore, keyedMutex
-### Community 155 - "NewRegistry"
-Cohesion: 0.18
-Nodes (16): TestManifestCommandsValidation(), TestRegisterCommandRequiresManifestDeclaration(), TestStorageKeysIsolatedPerPlugin(), TestStorageRejectsOversizedKeyAndValue(), openPluginTestDB(), TestDispatchCommandRuntimePlatformRace(), ParseManifest(), TestParseManifestRejectsBadEntrypoint() (+8 more)
+### Community 157 - "NewRegistry"
+Cohesion: 0.20
+Nodes (15): TestManifestCommandsValidation(), TestRegisterCommandRequiresManifestDeclaration(), TestStorageKeysIsolatedPerPlugin(), TestStorageRejectsOversizedKeyAndValue(), openPluginTestDB(), TestDispatchCommandRuntimePlatformRace(), ParseManifest(), TestParseManifestRejectsBadEntrypoint() (+7 more)
-### Community 156 - "OwnCord Client UX Specification (target state)"
-Cohesion: 0.22
-Nodes (9): 1. View-state vocabulary, 2. Feedback primitives, 3. Connection status is a first-class, observable state, 4. Global event → reaction map, 5. Error & permission reaction matrix, 6. Cross-cutting principles, Documents, Maintenance rule (+1 more)
-
-### Community 157 - "OwnCord — Comprehensive Project Audit"
-Cohesion: 0.04
-Nodes (46): 1. Architecture, 2. Code Quality, 4. Dependencies & Supply Chain, 5. Test Coverage & Quality, 6. CI/CD & DevEx, 7. Observability, 8. Plugin System Governance, 9. Prioritized Top-10 Action List (+38 more)
-
-### Community 158 - "streamPreview.ts"
-Cohesion: 0.18
-Nodes (14): getRemoteVideoStream, attachStreamPreview(), clearPreviewState(), createPlaceholder(), createUnavailablePlaceholder(), hidePreview(), PreviewState, previewTimers (+6 more)
+### Community 158 - "ChannelSidebar.ts"
+Cohesion: 0.03
+Nodes (107): attachChannelContextMenu(), CHANNEL_MUTE_CHANGED, attachDragHandlers(), DragState, ensureGlobalDragListeners(), listenerOwners, releaseOwner(), retargetDetachedDrag() (+99 more)
### Community 159 - "deep-link.ts"
-Cohesion: 0.20
-Nodes (11): initDeepLinks(), InviteLink, linkSegments(), log, MessageLink, parseIdSegment(), parseInviteLink(), parseMessageLink() (+3 more)
+Cohesion: 0.21
+Nodes (12): formatMessageLink(), initDeepLinks(), InviteLink, linkSegments(), log, MessageLink, parseIdSegment(), parseInviteLink() (+4 more)
### Community 160 - "testing.M"
Cohesion: 0.11
@@ -1145,20 +1198,20 @@ Cohesion: 0.11
Nodes (15): allResults, ARGS, byFile, clusters, commits, excluded, FIX_RESULTS, fixed (+7 more)
### Community 164 - "buildTauriMockScript"
-Cohesion: 0.12
-Nodes (14): buildReadyPayload(), buildTauriMockScript(), chatEchoHandlers(), MOCK_LOGIN_2FA_RESPONSE, MOCK_LOGIN_RESPONSE, MOCK_TOKEN, mockTauriConnect(), mockTauriConnectWith2FA() (+6 more)
+Cohesion: 0.13
+Nodes (13): buildReadyPayload(), buildTauriMockScript(), chatEchoHandlers(), MOCK_LOGIN_2FA_RESPONSE, MOCK_LOGIN_RESPONSE, MOCK_TOKEN, mockTauriFullSessionWithAutoConnect(), mockTauriFullSessionWithFailingMessages() (+5 more)
### Community 165 - "OwnCord Introspection MCP Server"
-Cohesion: 0.08
-Nodes (22): 1. Install dependencies, 2. Mint an API token, 3. Put the token in your environment, 4. Enable in Claude Code, `api_request`, API tokens (server side), Authentication, `client_logs` (+14 more)
+Cohesion: 0.11
+Nodes (19): 1. Install dependencies, 2. Mint an API token, 3. Put the token in your environment, 4. Enable in Claude Code, `api_request`, API tokens (server side), Authentication, `client_logs` (+11 more)
### Community 166 - "Bug-detection improvements — design"
Cohesion: 0.11
Nodes (18): 1a. `make fuzz`, 1b. Scoped Stryker runs, 1c. Browser-mode vitest, 1d. Prerequisite, 3a. Client model-based tests, 3b. Server hub simulation, 3c. Fault-injected transport, Bug-detection improvements — design (+10 more)
-### Community 167 - "EventPersister"
-Cohesion: 0.19
-Nodes (12): sync/atomic.Uint64, sync.Once, EventPersister, NewEventPersister(), captureLogs(), openPersisterTestDB(), TestEventPersisterDropsOnFullQueue(), TestEventPersisterEnqueueAfterStopDropsLoudly() (+4 more)
+### Community 167 - "ux/README.md"
+Cohesion: 0.08
+Nodes (23): 1.1 Channel type affordances, 1.1a Per-channel notification mutes, 1.2 Channel switching, 1.3 Reorder & CRUD (admin), 1. Channel sidebar, 2.1 Typing indicator, 2.2 Member actions (context menu), 2. Member list (+15 more)
### Community 168 - "eslint-rules.js"
Cohesion: 0.12
@@ -1181,24 +1234,24 @@ Cohesion: 0.39
Nodes (7): callsUntilMessageOfType(), __dirname, frame(), freshUngatedProcessor(), loadVadProcessor(), postMessageMock(), WORKLET_PATH
### Community 173 - "ChannelTopic"
-Cohesion: 0.15
-Nodes (16): TestEmitSequencedDM_UsesNormalQueueToPreserveSeqOrder(), TestEmitUserTargeted_KeepsHighPriorityFastLane(), NewTestClientWithChannel(), TestComputeAllowedChannels_DMLookupErrorIsFatal(), TestDeliverBroadcast_ShedFrameLeavesNoSeqGap(), TestEmitEvents_DMChannelOpenForcesFullResyncForOlderClients(), TestFailedHandshake_MarksUserOfflineWhenNoReplacementRemains(), TestKickClient_SubscribeRaceCannotLeaveDeadSubscriber() (+8 more)
+Cohesion: 0.16
+Nodes (15): TestEmitSequencedDM_UsesNormalQueueToPreserveSeqOrder(), TestEmitUserTargeted_KeepsHighPriorityFastLane(), NewTestClientWithChannel(), TestComputeAllowedChannels_DMLookupErrorIsFatal(), TestDeliverBroadcast_ShedFrameLeavesNoSeqGap(), TestEmitEvents_DMChannelOpenForcesFullResyncForOlderClients(), TestFailedHandshake_MarksUserOfflineWhenNoReplacementRemains(), TestKickClient_SubscribeRaceCannotLeaveDeadSubscriber() (+7 more)
-### Community 174 - "fakeStore"
-Cohesion: 0.06
-Nodes (19): fakeStore, APITokenListItem, Attachment, Session, DB, User, AttachmentAccess, DB (+11 more)
+### Community 174 - "rate-limiter.ts"
+Cohesion: 0.22
+Nodes (12): createChatLimiter(), createPresenceLimiter(), createRateLimiter(), createRateLimiterSet(), createReactionLimiter(), createTypingLimiter(), createVideoCameraLimiter(), createVoiceLimiter() (+4 more)
### Community 175 - "Open"
Cohesion: 0.04
Nodes (46): Declined, Duplicate, OC-0039 — medium — DeleteMessage treats a GetChannel read error as "not a DM", letting a moderator hard-delete another user's private DM message, OC-0092 — low — Plugin slash-command broadcast can post live content into an archived (read-only) channel, OC-0159 — medium — Handshake/replay writes have no write deadline, so a client that stops reading pins a server goroutine + socket forever, OC-0238 — medium — Managed LiveKit process is never configured to send webhooks, so both webhook handlers are dead in the default deployment, OC-0311 — medium — handleParticipantLeft is channel-blind: a voice_leave for any readable channel mutates this session's E2EE peer state, OC-0312 — medium — Binding a push-to-talk key mid-call leaves PTT permanently dead — the `pttOwnsMute` latch is cleared by the store subscriber before the deferred `setMuted(true)` lands (+38 more)
-### Community 176 - "RateLimiter"
-Cohesion: 0.14
-Nodes (18): backupFile, entry, lockoutEntry, LockoutPersister, rateLimiterShard, time.Duration, MaintainBackups(), pruneExpiredBackups() (+10 more)
+### Community 176 - "MountAuthRoutes"
+Cohesion: 0.12
+Nodes (31): AuthBroadcaster, authSuccessResponse, deleteAccountRequest, passwordConfirmationRequest, registerRequest, totpConfirmationRequest, totpEnableResponse, userResponse (+23 more)
-### Community 177 - "Key"
-Cohesion: 0.22
-Nodes (16): Key(), newFocusTestDeps(), TestChannelFocusV2_ChannelNotFound_SilentDrop(), TestChannelFocusV2_HappyPath_SetsChannelID(), TestChannelFocusV2_InvalidChannelID_SilentDrop(), TestChannelFocusV2_NoEvents(), TestChannelFocusV2_NoPermission_ReturnsForbidden(), TestChannelFocusV2_RateLimited_SilentDrop() (+8 more)
+### Community 177 - "e2e/helpers.ts"
+Cohesion: 0.18
+Nodes (11): MOCK_INVITES, MOCK_MESSAGES_RICH, MOCK_READY_PAYLOAD, mockTauriConnect(), mockTauriConnectWith2FA(), mockTauriFullSessionWithEcho(), mockTauriFullSessionWithMessagesAndEcho(), mockTauriLoginError() (+3 more)
### Community 178 - "fallback_crypto.rs"
Cohesion: 0.25
@@ -1217,20 +1270,20 @@ Cohesion: 0.12
Nodes (7): encoding/json.Number, parseModTarget(), ChannelScoped, PingCmd, VoiceLeaveCmd, VoiceModKickCmd, VoiceTokenRefreshCmd
### Community 182 - "NewRingBuffer"
-Cohesion: 0.14
-Nodes (24): log/slog.Leveler, TestRingBuffer_WriteDoesNotAllocate(), NewMultiHandler(), NewRingBuffer(), newTeeLogger(), TestCategorizeSource_AttributesAdminPackage(), TestMultiHandler_Enabled(), TestMultiHandler_ErrorAttr_RecordLevel() (+16 more)
+Cohesion: 0.16
+Nodes (21): TestRingBuffer_WriteDoesNotAllocate(), NewRingBuffer(), newTeeLogger(), TestCategorizeSource_AttributesAdminPackage(), TestMultiHandler_Enabled(), TestMultiHandler_ErrorAttr_RecordLevel(), TestMultiHandler_ErrorAttr_WithAttrsLevel(), TestMultiHandler_LogValuerResolved() (+13 more)
### Community 183 - "ws-load.js"
Cohesion: 0.12
Nodes (14): authTime, broadcastLatency, CHANNEL_ID, handleSummary(), options, textSummary(), wsAcks, wsAuthed (+6 more)
-### Community 184 - "newDMFixture"
-Cohesion: 0.21
-Nodes (12): Store, newDMFixture(), TestDeleteMessage_DMFanoutSurvivesDeleterDisconnectAfterCommit(), TestDeleteMessage_FailsClosedWhenChannelLookupErrors(), TestDeleteMessage_RefusedInArchivedChannel(), TestEditMessage_DMFanoutSurvivesEditorDisconnectAfterCommit(), TestEditMessage_FailsClosedWhenChannelLookupErrors(), TestSendMessage_DMFanoutSurvivesSenderDisconnectAfterCommit() (+4 more)
+### Community 184 - "NewMessageService"
+Cohesion: 0.26
+Nodes (13): newDMFixture(), TestDeleteMessage_DMFanoutSurvivesDeleterDisconnectAfterCommit(), TestDeleteMessage_FailsClosedWhenChannelLookupErrors(), TestDeleteMessage_RefusedInArchivedChannel(), TestEditMessage_DMFanoutSurvivesEditorDisconnectAfterCommit(), TestEditMessage_FailsClosedWhenChannelLookupErrors(), TestSendMessage_AttachmentsSurviveSenderDisconnectAfterLink(), TestSendMessage_DMFanoutSurvivesSenderDisconnectAfterCommit() (+5 more)
### Community 185 - "handler"
-Cohesion: 0.12
-Nodes (14): multiHandler, ringHandler, log/slog.Attr, log/slog.Handler, log/slog.Level, log/slog.Record, handler, categorizeSource() (+6 more)
+Cohesion: 0.17
+Nodes (10): multiHandler, ringHandler, log/slog.Attr, log/slog.Handler, log/slog.Level, log/slog.Leveler, handler, NewMultiHandler() (+2 more)
### Community 186 - "tauri-client/package.json"
Cohesion: 0.25
@@ -1269,12 +1322,12 @@ Cohesion: 0.32
Nodes (11): DecryptTOTPSecret(), EncryptTOTPSecret(), LoadOrGenerateTOTPKey(), TestDecryptTOTPSecret_FailsClosed(), TestDecryptTOTPSecret_LegacyPlaintextPassthrough(), TestEncryptDecryptTOTPSecret_RoundTrip(), TestEncryptTOTPSecret_NonceIsRandom(), testKey() (+3 more)
### Community 196 - "logstream.go"
-Cohesion: 0.18
-Nodes (11): ticketEntry, ticketStore, tokenStore, logStreamAuthorize(), adminAuthMiddleware(), RequireAdminAuth(), requirePerm(), ResolveTokenHash() (+3 more)
+Cohesion: 0.25
+Nodes (5): ticketEntry, ticketStore, log/slog.Record, categorizeSource(), TestCategorizeSource_NoPCIsServer()
### Community 197 - "plugins_handler_test.go"
-Cohesion: 0.34
-Nodes (15): NewPluginAdminHandler(), buildZipUpload(), newTestPluginRegistry(), newTestPluginRegistryWithStore(), openPluginTestDB(), TestPluginsHandlerEnableDisableUninstallReturn503WhenRegistryNil(), TestPluginsHandlerInstallHappyPath(), TestPluginsHandlerInstallRejectsNonZipContentType() (+7 more)
+Cohesion: 0.28
+Nodes (17): NewPluginAdminHandler(), buildZipUpload(), newTestPluginRegistry(), newTestPluginRegistryWithStore(), openPluginTestDB(), TestHasZipMagic(), TestIsZipContentType(), TestPluginsHandlerEnableDisableUninstallReturn503WhenRegistryNil() (+9 more)
### Community 198 - "badDirFile"
Cohesion: 0.14
@@ -1285,8 +1338,8 @@ Cohesion: 0.13
Nodes (15): Active Branches, Available Commands, Branch Naming, Client (Tauri v2), Code Style, Commit Format, Contributing, Dependency Policy (+7 more)
### Community 200 - "github.com/coder/websocket.Conn"
-Cohesion: 0.15
-Nodes (16): github.com/coder/websocket.Conn, applyConnectStatus(), authenticateConn(), Client, Hub, handshakeWrite(), Client, Hub (+8 more)
+Cohesion: 0.17
+Nodes (15): github.com/coder/websocket.Conn, TestWritePump_DrainsQueuedFramesAfterCloseSend(), applyConnectStatus(), Client, Hub, handshakeWrite(), Client, Hub (+7 more)
### Community 201 - "mcp-introspect/package.json"
Cohesion: 0.13
@@ -1301,52 +1354,52 @@ Cohesion: 0.14
Nodes (13): Acting on Observations, Archival on Write, How to Log, Log Structure, Quick Reference, Reference files — load on demand, not up front, Referencing Observations, Session Start Protocol (+5 more)
### Community 204 - "handleVoiceE2EEOfferV2"
-Cohesion: 0.38
-Nodes (12): offerDeps(), TestVoiceE2EEOfferV2_EmptyFields(), TestVoiceE2EEOfferV2_HappyPath(), TestVoiceE2EEOfferV2_InvalidBase64(), TestVoiceE2EEOfferV2_NilKeyHolder_ReturnsInternal(), TestVoiceE2EEOfferV2_NoReply(), TestVoiceE2EEOfferV2_NotInVoiceChannel(), TestVoiceE2EEOfferV2_NotKeyHolder() (+4 more)
+Cohesion: 0.31
+Nodes (13): offerDeps(), TestVoiceE2EEOfferV2_EmptyFields(), TestVoiceE2EEOfferV2_HappyPath(), TestVoiceE2EEOfferV2_InvalidBase64(), TestVoiceE2EEOfferV2_NilKeyHolder_ReturnsInternal(), TestVoiceE2EEOfferV2_NoReply(), TestVoiceE2EEOfferV2_NotInVoiceChannel(), TestVoiceE2EEOfferV2_NotKeyHolder() (+5 more)
### Community 205 - "AudioPipeline"
-Cohesion: 0.06
-Nodes (12): AudioPipeline, createRNNoiseProcessor(), createScriptProcessorPipeline(), loadRNNoise(), log, ProcessingPipeline, RNNoiseModule, { mockLoadPref, mockSavePref } (+4 more)
+Cohesion: 0.12
+Nodes (4): AudioPipeline, { mockLoadPref, mockSavePref }, { mockLoadPref, mockSavePref }, { mockLoadPref, mockSavePref }
### Community 206 - "Messaging — target UX"
-Cohesion: 0.07
-Nodes (25): 1. Message list — states, 2. Composer — permission & connection gating, 3. Sending — optimistic lifecycle, 4. Edit / delete, 5. Reactions, 6. Attachments, 7. Replies, pins, search, read/unread, 7a. Jumping to a message (+17 more)
+Cohesion: 0.14
+Nodes (14): 1. Message list — states, 2. Composer — permission & connection gating, 3. Sending — optimistic lifecycle, 4. Edit / delete, 5. Reactions, 6. Attachments, 7. Replies, pins, search, read/unread, 7a. Jumping to a message (+6 more)
-### Community 207 - "serviceErrorToResult"
-Cohesion: 0.17
-Nodes (13): BuildCallSignalForTest(), handleCallDeclineV2(), handleCallRingV2(), registerCallHandlers(), dmEventOrFallback(), TestDMEventOrFallback(), Event, handleChatDeleteV2() (+5 more)
+### Community 207 - "B0 baseline and audit reconciliation"
+Cohesion: 0.14
+Nodes (14): B0 baseline and audit reconciliation, Bundle sizes (measured), Closed, Dispositions, Docker evidence has to come from a local run, Environment, G-01 was inverted, not stale, G-03 — the one decision B0 still needs (+6 more)
-### Community 208 - "LiveKitProcess"
-Cohesion: 0.08
-Nodes (10): cancelAfterBlockStore, context.CancelFunc, os/exec.Cmd, Store, detachFetch(), LiveKitProcess, wsToHTTP(), cancelAfterCreateGroupDMStore (+2 more)
+### Community 208 - "message.go"
+Cohesion: 0.09
+Nodes (21): AttachmentInfo, ReactionUser, MessageService, Store, requireChannelWritable(), RequireDMNotBlocked(), MessageService, MessageService (+13 more)
### Community 209 - "LiveKitClient"
-Cohesion: 0.13
-Nodes (8): github.com/livekit/protocol/livekit.ParticipantInfo, github.com/livekit/server-sdk-go/v2.RoomServiceClient, LiveKitProcess, Hub, LiveKitClient, participantIdentity(), RoomName(), TestRoomName()
+Cohesion: 0.12
+Nodes (9): github.com/livekit/protocol/livekit.ParticipantInfo, github.com/livekit/server-sdk-go/v2.RoomServiceClient, LiveKitProcess, Hub, LiveKitClient, participantIdentity(), RoomName(), TestRoomName() (+1 more)
### Community 210 - "migrate.go"
Cohesion: 0.33
Nodes (13): io/fs.FS, applyMigration(), ensureSchemaVersions(), DB, isApplied(), isCommentOnly(), isDuplicateColumn(), isExistingDatabase() (+5 more)
-### Community 211 - "VoiceAudioTab.ts"
-Cohesion: 0.22
-Nodes (12): buildVoiceAudioTabInner(), CameraInvalidationRegistrar, CameraRegistrar, createVoiceAudioTab(), MicRegistrar, VoiceAudioTabHandle, reapplyAudioProcessing, setInputVolume (+4 more)
+### Community 211 - "voice-audio-tab.test.ts"
+Cohesion: 0.18
+Nodes (6): mockReapplyAudioProcessing, mockSetInputVolume, mockSetOutputVolume, mockSetVoiceSensitivity, mockSwitchInputDevice, mockSwitchOutputDevice
-### Community 212 - "Manifest"
-Cohesion: 0.22
-Nodes (9): Capability, CommandSpec, Resources, UISpec, UITab, Manifest, FuzzValidateRelativePath(), TestValidateRelativePath() (+1 more)
-
-### Community 213 - "newWazeroTestRegistry"
-Cohesion: 0.31
-Nodes (14): Registry, newWazeroTestRegistry(), TestPlatformInitPageCountDoesNotOverflowUint32(), TestWazeroActivateCompilesModule(), TestWazeroCloseTearsDownRuntime(), TestWazeroConcurrentDispatchRace(), TestWazeroCPUBudgetOverrunDoesNotBrickPlugin(), TestWazeroDeactivateClosesCompiledModule() (+6 more)
-
-### Community 214 - "1. Channel sidebar"
+### Community 212 - "OwnCord beta product requirements"
Cohesion: 0.14
-Nodes (14): 1.1 Channel type affordances, 1.1a Per-channel notification mutes, 1.2 Channel switching, 1.3 Reorder & CRUD (admin), 1. Channel sidebar, 2.1 Typing indicator, 2.2 Member actions (context menu), 2. Member list (+6 more)
+Nodes (14): Browser and PWA client, Capacity and compatibility, Client experience and accessibility, Community and governance, Engineering-controlled choices, Explicitly outside beta, Extensions and deferred systems, Identity, registration, and recovery (+6 more)
-### Community 215 - "doRequest"
+### Community 213 - "OwnCord repository-health issue register"
+Cohesion: 0.14
+Nodes (14): Approved beta capability gaps, Canonical findings-ledger truth, Canonical open defect ledger, Classification and counting rules, Client engineering issues, Discovery passes required before claiming exhaustive coverage, Explicitly outside beta, Immediate gate and truth issues (+6 more)
+
+### Community 214 - "Queries"
+Cohesion: 0.12
+Nodes (9): GetAuditLogParams, GetAuditLogRow, ListAllUsersParams, ListAllUsersRow, LogAuditParams, SetSettingParams, UpdateUserRoleParams, Queries (+1 more)
+
+### Community 215 - "newTestRoleService"
Cohesion: 0.11
-Nodes (50): doRequest(), itoa(), TestDeleteChannelPermission_ClearsOverride(), TestDeleteChannelPermission_EscalationGuard(), TestDeleteChannelPermission_RefusesEqualOrHigherRole(), TestDeleteChannelPermission_UnknownRole(), TestGetChannelPermissions_DMRejected(), TestGetChannelPermissions_NotFound() (+42 more)
+Nodes (49): itoa(), newTestRoleService(), TestDeleteChannelPermission_ClearsOverride(), TestDeleteChannelPermission_EscalationGuard(), TestDeleteChannelPermission_RefusesEqualOrHigherRole(), TestDeleteChannelPermission_UnknownRole(), TestGetChannelPermissions_DMRejected(), TestGetChannelPermissions_NotFound() (+41 more)
### Community 216 - "knip.json"
Cohesion: 0.15
@@ -1376,13 +1429,9 @@ Nodes (13): 1. Settings overlay, 2.1 Profile edit, 2.2 Change password (with ses
Cohesion: 0.41
Nodes (12): buildClientUpdateRouter(), fakeGitHubRelease(), platformEntry(), TestClientUpdate_AlreadyLatest(), TestClientUpdate_DebTargetNoContent(), TestClientUpdate_FutureVersion(), TestClientUpdate_GitHubError(), TestClientUpdate_LinuxArm64TargetGetsAarch64AppImage() (+4 more)
-### Community 224 - "EventSink"
-Cohesion: 0.19
-Nodes (6): Broadcaster, TestEventDeliveryHasNoGuestPath(), EventSink, NewEventSink(), TestEventSink_Emit_DeliversToBroadcaster(), TestEventSink_Emit_NilBroadcaster_NoOp()
-
### Community 225 - "newTestRoleService"
-Cohesion: 0.23
-Nodes (14): Store, NewModerationService(), newTestModerationService(), newTestRoleService(), roleIDOf(), TestBanUser_AuthorizedSucceeds(), TestBanUser_HierarchyEnforced(), TestBanUser_RequiresBanPermission() (+6 more)
+Cohesion: 0.31
+Nodes (12): newTestModerationService(), newTestRoleService(), roleIDOf(), TestBanUser_AuthorizedSucceeds(), TestBanUser_HierarchyEnforced(), TestBanUser_RequiresBanPermission(), TestChangeUserRole_AuditWritten(), TestChangeUserRole_CannotAssignAtOrAboveOwnRank() (+4 more)
### Community 226 - "event.go"
Cohesion: 0.22
@@ -1400,13 +1449,13 @@ Nodes (11): Author Attribution Template, Confidentiality layers, Editing skills
Cohesion: 0.17
Nodes (11): categories, correctness, perf, suspicious, ignorePatterns, public, rules, no-map-spread (+3 more)
-### Community 230 - "net/http.Handler"
-Cohesion: 0.20
-Nodes (10): go.opentelemetry.io/otel/sdk/metric.MeterProvider, go.opentelemetry.io/otel/sdk/trace.TracerProvider, net/http.Handler, setupDiagnosticsRouter(), TestDiagnosticsConnectivity_HonoursTrustedProxies(), TestDiagnosticsConnectivity_MemberForbidden(), TestDiagnosticsConnectivity_ReturnsData(), TestDiagnosticsConnectivity_Unauthenticated() (+2 more)
+### Community 230 - "setupDiagnosticsRouter"
+Cohesion: 0.43
+Nodes (6): setupDiagnosticsRouter(), TestDiagnosticsConnectivity_HonoursTrustedProxies(), TestDiagnosticsConnectivity_MemberForbidden(), TestDiagnosticsConnectivity_ReturnsData(), TestDiagnosticsConnectivity_Unauthenticated(), TestIsPrivateIP()
### Community 231 - "e2e/dm-system.spec.ts"
-Cohesion: 0.20
-Nodes (13): MOCK_DM_CHANNELS, MOCK_READY_WITH_DMS, mockTauriSessionWithDms(), navigateToMainPageWithDms(), emitWsEvent(), emitWsMessage(), MOCK_AUTH_OK, MOCK_CHANNELS (+5 more)
+Cohesion: 0.23
+Nodes (10): MOCK_DM_CHANNELS, MOCK_READY_WITH_DMS, mockTauriSessionWithDms(), navigateToMainPageWithDms(), MOCK_AUTH_OK, MOCK_CHANNELS, MOCK_ROLES, submitLogin() (+2 more)
### Community 232 - "Queries"
Cohesion: 0.21
@@ -1436,29 +1485,29 @@ Nodes (12): Choose Your Setup Path, Client Connection Notes, If Remote Users Can
Cohesion: 0.18
Nodes (11): 1. Method, 2. Findings, 3. Measured baselines (diff against these next time), 4. Bugs surfaced by the tests, 5. Refuted candidates (do not re-raise), 6. Backlog, Client (`vitest run --coverage`), Go — cross-package (`go test -coverpkg=./... ./...`) (+3 more)
-### Community 239 - "newBackupFileDB"
-Cohesion: 0.35
-Nodes (10): newBackupFileDB(), TestBackupToSafe_ErrorKeepsPreexistingFile(), TestBackupToSafe_RejectsDoubleQuote(), TestBackupToSafe_RejectsNullByte(), TestBackupToSafe_RejectsPathOutsideRoot(), TestBackupToSafe_RejectsSemicolon(), TestBackupToSafe_RejectsSingleQuote(), TestBackupToSafe_RejectsSQLComment() (+2 more)
+### Community 239 - "OwnCord public-beta execution roadmap"
+Cohesion: 0.22
+Nodes (9): Common entry and exit contract, Current evidence snapshot, Decision, First implementation slice, OwnCord public-beta execution roadmap, Phase dependency chain, Phase scorecard, Release-blocker policy (+1 more)
### Community 240 - "index.mjs"
Cohesion: 0.23
Nodes (6): collectLogs(), httpsAgent(), REPO_ROOT, request(), safeParse(), server
-### Community 241 - "Checker"
-Cohesion: 0.07
-Nodes (22): DB, ChannelOverride, ChannelUnread, ChannelOverride, ChannelRef, Checker, EffectiveChannelPerms(), ChannelOverride (+14 more)
+### Community 241 - "Channel"
+Cohesion: 0.04
+Nodes (34): memberUpdateCall, mockHub, restartCall, DB, ChannelOverride, Channel, ChannelUnread, ChannelOverride (+26 more)
### Community 242 - "bughunt.harness.mjs"
Cohesion: 0.17
Nodes (3): here, none, scenarios
-### Community 243 - "voice-audio-tab.test.ts"
-Cohesion: 0.18
-Nodes (6): mockReapplyAudioProcessing, mockSetInputVolume, mockSetOutputVolume, mockSetVoiceSensitivity, mockSwitchInputDevice, mockSwitchOutputDevice
+### Community 243 - "video-grid.test.ts"
+Cohesion: 0.14
+Nodes (7): TileConfig, mockGetScreenshareAudioMuted, mockGetScreenshareAudioVolume, mockGetUserVolume, mockMuteScreenshareAudio, mockSetScreenshareAudioVolume, mockSetUserVolume
-### Community 244 - "reactions.sql.go"
-Cohesion: 0.25
-Nodes (6): AddReactionParams, GetReactionCountsRow, GetReactionUsersParams, GetReactionUsersRow, RemoveReactionParams, Queries
+### Community 244 - "context.CancelFunc"
+Cohesion: 0.07
+Nodes (17): cancelAfterBlockStore, context.CancelFunc, Store, Store, assetFilenameFromURL(), Updater, isGitHubHost(), TestIsGitHubHost() (+9 more)
### Community 245 - "Channel Permission Overrides"
Cohesion: 0.18
@@ -1472,13 +1521,13 @@ Nodes (11): DELETE /admin/api/users/{id}/sessions, Errors, GET /admin/api/stats,
Cohesion: 0.33
Nodes (7): database/sql.Tx, database/sql.TxOptions, anonymiseUser(), deleteAccountAdminGuard(), deleteAccountCloseDMChannels(), deleteAccountDMChannels(), DB
-### Community 248 - "scanPluginDirectory"
-Cohesion: 0.26
-Nodes (10): foundPlugin, Manifest, rejectSymlinksUnder(), scanPluginDirectory(), TestRejectSymlinksUnderClean(), TestRejectSymlinksUnderFindsNestedSymlink(), TestRejectSymlinksUnderFindsSymlink(), TestScanPluginDirectory_SkipsBadPluginButReturnsGood() (+2 more)
+### Community 248 - "loadPref"
+Cohesion: 0.03
+Nodes (86): buildAccessibilityTab(), ToggleItem, TOGGLES, buildAppearanceTab(), getDefaultAccent(), hexToRgb(), applyTheme(), createToggle() (+78 more)
-### Community 249 - "Channel"
-Cohesion: 0.08
-Nodes (7): memberUpdateCall, mockHub, mockHubWB, restartCall, unbanMockHub, Channel, errGetChannelStore
+### Community 249 - "syntax-highlight.ts"
+Cohesion: 0.12
+Nodes (14): ALIASES, BACKTICK_STRING, C_BLOCK_COMMENT, CodeToken, DQ_STRING, HASH_COMMENT, JS_LIKE, LANGS (+6 more)
### Community 250 - "slashFS"
Cohesion: 0.29
@@ -1488,9 +1537,9 @@ Nodes (4): slashFS, failReadDirFS, io/fs.File, toSlashPath()
Cohesion: 0.20
Nodes (9): 1. Hunt, 2. Gate (human), 3. Fix, 4. Verify the fixes independently — REQUIRED, Composing the batch, Running the bughunt pipeline, Security findings, Testing the workflows themselves (+1 more)
-### Community 252 - "VideoGrid.ts"
-Cohesion: 0.06
-Nodes (28): appendModerationSection(), showUserVolumeMenu(), VoiceModMenuOptions, computeGridLayout(), createVideoGrid(), GridLayout, setButtonIcon(), TileConfig (+20 more)
+### Community 252 - "EventSink"
+Cohesion: 0.19
+Nodes (6): Broadcaster, TestEventDeliveryHasNoGuestPath(), EventSink, NewEventSink(), TestEventSink_Emit_DeliversToBroadcaster(), TestEventSink_Emit_NilBroadcaster_NoOp()
### Community 253 - "reconnectAfterCertAccept"
Cohesion: 0.31
@@ -1501,12 +1550,12 @@ Cohesion: 0.33
Nodes (9): Client, Hub, setupVoiceRoom(), TestRegisterNow_KeepsKeyHolderWhenVoiceStateTransfers(), TestRegisterNow_ReelectsKeyHolderWhenReplacedClientLeavesVoice(), TestRegisterNow_ResumeRestoresVoiceTopicAndE2EEKey(), TestRegisterNow_ResumeVoiceTopicIgnoresReadGate(), TestWebhookParticipantLeft_ReelectsKeyHolder() (+1 more)
### Community 255 - "emoji-voicemod.parity.spec.ts"
-Cohesion: 0.19
-Nodes (10): CapturedCall, getCapturedCalls(), mockSessionWithCustomEmoji(), mockVoiceSessionWithoutModPermission(), SEEDED_CUSTOM_EMOJI, waitForCapturedCall(), emitWsMessageAndWait(), mockTauriFullSessionWithVoice() (+2 more)
+Cohesion: 0.24
+Nodes (8): CapturedCall, getCapturedCalls(), mockSessionWithCustomEmoji(), mockVoiceSessionWithoutModPermission(), SEEDED_CUSTOM_EMOJI, waitForCapturedCall(), emitWsMessageAndWait(), voiceWsHandlers()
### Community 256 - "voice-e2ee-verify.spec.ts"
-Cohesion: 0.18
-Nodes (7): joinVoiceChannelByName(), MOCK_CHANNELS_WITH_CATEGORIES, MOCK_VOICE_STATE, emitPeerAnnounce(), mockE2EEVoiceSession(), PeerCrypto, voiceJoinWithTokenHandler()
+Cohesion: 0.22
+Nodes (6): MOCK_CHANNELS_WITH_CATEGORIES, MOCK_VOICE_STATE, emitPeerAnnounce(), mockE2EEVoiceSession(), PeerCrypto, voiceJoinWithTokenHandler()
### Community 257 - "include"
Cohesion: 0.15
@@ -1516,9 +1565,9 @@ Nodes (12): compilerOptions, types, exclude, extends, include, node, tests/e2e,
Cohesion: 0.20
Nodes (10): Custom Emoji, DELETE /api/v1/emoji/{id}, Errors, Errors, GET /api/v1/emoji, GET /api/v1/emoji/{id}/image, POST /api/v1/emoji, Response 200 OK (+2 more)
-### Community 260 - "OwnCord — Test-Coverage Audit"
-Cohesion: 0.20
-Nodes (10): 1. How coverage was measured (and why the CI number is wrong), 2. Finding closure status, 3. Measured baselines (diff against these next time), 4. Two bugs surfaced by writing the tests, 5. CI gates after this pass, 6. Backlog, Client (`npx vitest run --coverage`), Go — cross-package (`make cover-all`) (+2 more)
+### Community 260 - "LiveKitProcess"
+Cohesion: 0.17
+Nodes (10): TLSResult, crypto/tls.Config, os/exec.Cmd, fileExists(), loadACME(), loadCertPair(), loadOrGenerateSelfSigned(), writePEM() (+2 more)
### Community 261 - "OriginAcceptOptions"
Cohesion: 0.31
@@ -1528,9 +1577,9 @@ Nodes (8): github.com/coder/websocket.AcceptOptions, OriginAcceptOptions(), Test
Cohesion: 0.13
Nodes (4): github.com/owncord/server/syncutil.RWMutex, Hub, eventEntry, EventRingBuffer
-### Community 263 - "setupRouter"
-Cohesion: 0.32
-Nodes (11): setupRouter(), TestAPIV1InfoEndpoint(), TestAPIV1InfoOmitsVersion(), TestAPIV1InfoReturnsServerName(), TestHealthEndpointOmitsVersion(), TestHealthEndpointReturns200(), TestHealthEndpointReturnsJSON(), TestHealthEndpointStatusOK() (+3 more)
+### Community 263 - "OwnCord full repository-health audit"
+Cohesion: 0.17
+Nodes (12): Audit artifacts, Client, Deployment constraints that must be designed into beta, Executive status, OwnCord full repository-health audit, Phased route, Product gaps that block beta, Recommended first implementation slice (+4 more)
### Community 264 - "newTokenTestDB"
Cohesion: 0.37
@@ -1553,7 +1602,7 @@ Cohesion: 0.22
Nodes (8): CI wiring (`.github/workflows/ci.yml`), Current status: 291 web tests, 291 passed (100%), E2E Test Status — 2026-08-05, Environment notes for local runs, History (dispositions of the old contents of this file), Known issues (open), Resolved (2026-08-04 remediation), Suite inventory
### Community 269 - "render-ledger.mjs"
-Cohesion: 0.27
+Cohesion: 0.43
Nodes (6): main(), render(), selftest(), SEV_RANK, VALID_STATUS, validate()
### Community 270 - "MountGIFRoutes"
@@ -1572,9 +1621,13 @@ Nodes (4): CreateAttachmentParams, GetAttachmentByIDRow, GetAttachmentWithChanne
Cohesion: 0.67
Nodes (6): equalSets(), idSet(), seedVisibilityUser(), sortedKeys(), TestChannelVisibility_RESTWSAgreement(), TestChannelVisibility_UserOverrideAgreement()
-### Community 275 - "Finish the V2 Dispatch Migration (backlog item 11) — Design"
-Cohesion: 0.22
-Nodes (8): Approach — port the 3, then delete the V1 machinery, As implemented (2026-07-20), Current state — only 3 types remain on V1, Files touched, Finish the V2 Dispatch Migration (backlog item 11) — Design, Non-goals, Problem, Test plan
+### Community 274 - "Hub"
+Cohesion: 0.19
+Nodes (4): buildVoiceE2EEAnnounce(), TestBuildVoiceE2EEAnnounce_ValidJSON(), Client, Hub
+
+### Community 275 - "plans/README.md"
+Cohesion: 0.08
+Nodes (24): Audit 2026-08-19 Remediation — Phased Plan, Decisions taken, Phases, Approach — funnel all four through the checker that already exists, Channel-Visibility Unification (backlog item 3) — Design, Files touched, Non-goals, Problem (+16 more)
### Community 276 - "Port Forwarding Guide"
Cohesion: 0.22
@@ -1584,13 +1637,13 @@ Nodes (9): Always required, Before You Start, Connect Address to Share, Dynamic
Cohesion: 0.22
Nodes (9): chat_bulk_deleted (Server -> Client, broadcast), chat_delete (Client -> Server), chat_deleted (Server -> Client, broadcast), chat_edit (Client -> Server), chat_edited (Server -> Client, broadcast), chat_message (Server -> Client, broadcast), Chat Messages, chat_send (Client -> Server) (+1 more)
-### Community 279 - "cancelAfterArm"
-Cohesion: 0.27
-Nodes (4): cancelAfterArm, cancelOnLookupStore, sync/atomic.Bool, newCancelAfterArm()
+### Community 279 - "profile_fields_test.go"
+Cohesion: 0.29
+Nodes (11): Store, newUserSvc(), TestClearCustomStatus(), TestSetCustomStatus_RoundTripClearAndBound(), TestUpdateProfile_AvatarOnlyPatchDoesNotOverwriteUsername(), TestUpdateProfile_ConcurrentUpdatesSerializePerUser(), TestUpdateProfile_OversizedDisplayNameAndAboutRejectedBeforeSanitizing(), TestUpdateProfile_RejectsOverlongFields() (+3 more)
-### Community 280 - "Queries"
-Cohesion: 0.24
-Nodes (4): CreateInviteParams, GetInviteRow, ListInvitesRow, Queries
+### Community 280 - "noise-suppression.ts"
+Cohesion: 0.15
+Nodes (7): createRNNoiseProcessor(), createScriptProcessorPipeline(), loadRNNoise(), log, ProcessingPipeline, RNNoiseModule, { mockLoadPref, mockSavePref }
### Community 281 - "Client HTTP TOFU Proxy (D5) — Design"
Cohesion: 0.22
@@ -1616,9 +1669,9 @@ Nodes (8): DELETE /api/v1/admin/plugins/{id}, GET /api/v1/admin/plugins, Plugin
Cohesion: 0.25
Nodes (8): DELETE /api/v1/invites/{code}, GET /api/v1/invites, Invite Endpoints, POST /api/v1/invites, Request, Response 200 OK, Response 201 Created, Response 204 No Content
-### Community 287 - ".UpdateUserProfile"
-Cohesion: 0.28
-Nodes (4): UpdateUserCustomStatusParams, UpdateUserPasswordParams, UpdateUserProfileParams, Queries
+### Community 287 - "Manifest"
+Cohesion: 0.22
+Nodes (9): Capability, CommandSpec, Resources, UISpec, UITab, Manifest, FuzzValidateRelativePath(), TestValidateRelativePath() (+1 more)
### Community 288 - "Infrastructure roadmap — design"
Cohesion: 0.25
@@ -1632,33 +1685,33 @@ Nodes (8): emoji_update (Server -> Client, broadcast), member_ban (Server -> Cli
Cohesion: 0.57
Nodes (7): message, schema, header(), main(), renderGo(), renderTS(), validate()
-### Community 292 - "TestOwnerOnlyMiddleware_OwnerAllowed"
-Cohesion: 0.50
-Nodes (7): TestOwnerOnlyMiddleware_OwnerAllowed(), backdate(), listBackupFiles(), mustSetSetting(), TestMaintainBackups_RetentionNeverDeletesNewest(), TestMaintainBackups_ScheduleAndRetention(), SetBackupBaseDir()
+### Community 292 - "AuditWriter"
+Cohesion: 0.13
+Nodes (10): AuditStore, pendingAudit, sync/atomic.Bool, sync/atomic.Uint64, sync.Once, AuditWriter, DB, waitForPersisted() (+2 more)
### Community 294 - "Environments, Activation Setup, and Handoff-Doc Mode"
Cohesion: 0.29
Nodes (6): Compaction behaviour, Environments, Activation Setup, and Handoff-Doc Mode, Handoff-doc analysis (when one arrives), Handoff-doc mode (no persistent storage), Recommended activation setup, User-facing documentation
-### Community 295 - "newBlockService"
-Cohesion: 0.46
-Nodes (7): newBlockService(), TestBlockService_BlockUser(), TestBlockService_BlockUser_Idempotent(), TestBlockService_BlockUser_Rejections(), TestBlockService_ListBlocked(), TestBlockService_UnblockUser(), TestBlockService_UnblockUser_Rejections()
+### Community 295 - "scanPluginDirectory"
+Cohesion: 0.23
+Nodes (11): foundPlugin, Manifest, rejectSymlinksUnder(), scanPluginDirectory(), TestRejectSymlinksUnderClean(), TestRejectSymlinksUnderFindsNestedSymlink(), TestRejectSymlinksUnderFindsSymlink(), TestScanPluginDirectory_SkipsBadPluginButReturnsGood() (+3 more)
### Community 296 - "capabilities-scope.test.ts"
Cohesion: 0.29
Nodes (4): Permission, permissions, ScopedPermission, ScopeEntry
-### Community 297 - "notifications.ts"
-Cohesion: 0.07
-Nodes (37): invalidateMuteCache(), isChannelMuted(), keyExists(), listMutedChannels(), muteChannel(), mutedKey(), notificationAllowed(), parseMutedIds() (+29 more)
+### Community 297 - "window-state.ts"
+Cohesion: 0.22
+Nodes (7): initWindowState(), isRectOnScreen(), log, MonitorRect, WindowRect, h, PRIMARY
### Community 298 - "GET /admin/api/updates"
Cohesion: 0.29
Nodes (7): Errors, Errors, GET /admin/api/updates, POST /admin/api/updates/apply, Response 200 OK, Response 200 OK, Server Updates
-### Community 299 - "Channel-Visibility Unification (backlog item 3) — Design"
-Cohesion: 0.29
-Nodes (6): Approach — funnel all four through the checker that already exists, Channel-Visibility Unification (backlog item 3) — Design, Files touched, Non-goals, Problem, Test plan
+### Community 299 - ".deliverBroadcast"
+Cohesion: 0.27
+Nodes (4): TestExtractEventType(), TestExtractEventTypeLengthCap(), extractEventType(), wrapWithSeq()
### Community 300 - "sqlc Adoption (D2) — Progress & Plan"
Cohesion: 0.29
@@ -1692,13 +1745,13 @@ Nodes (6): openFileDB(), seedChannelAndUser(), TestFilePool_ConcurrentReadsAndWr
Cohesion: 0.29
Nodes (6): Build command, Building the WASM, hello plugin, Manifest, Prerequisites, Tests
-### Community 308 - "TestHandlePresenceUpdate_BareStatusReadFailureAbortsBeforeCommit"
-Cohesion: 0.43
-Nodes (5): Store, TestHandlePresenceUpdate_BareStatusReadFailureAbortsBeforeCommit(), TestHandlePresenceUpdate_CustomStatusWriteFailureKeepsStoredText(), TestHandlePresenceUpdate_CustomStatusWriteFailureSwallowedAfterStatusCommit(), faultyStore
+### Community 308 - "handleVoiceE2EEAnnounceV2"
+Cohesion: 0.30
+Nodes (11): TestVoiceE2EEAnnounceV2_EmptyPublicKey(), TestVoiceE2EEAnnounceV2_HappyPath(), TestVoiceE2EEAnnounceV2_InvalidBase64(), TestVoiceE2EEAnnounceV2_NoReply(), TestVoiceE2EEAnnounceV2_NoSignature_LegacyAccepted(), TestVoiceE2EEAnnounceV2_NotInVoiceChannel(), TestVoiceE2EEAnnounceV2_PublicKeyTooLarge(), TestVoiceE2EEAnnounceV2_SignatureInvalidBase64() (+3 more)
-### Community 309 - "groupDMFixture"
-Cohesion: 0.31
-Nodes (10): groupDMFixture(), TestCreateGroupDMChannel_OpensForEveryone(), TestCreateGroupDMChannel_RefusesUnderThree(), TestGetDMParticipants_CollapsesInvisible(), TestGetOrCreateDMChannel_IgnoresShrunkGroup(), TestLeaveGroupDM_DeletesChannelOnLastLeave(), TestLeaveGroupDM_LastLeavePreservesAttachmentsForReclaim(), TestNewDMChannelInfo_EmptyRecipientsIsNotNil() (+2 more)
+### Community 309 - "IsUniqueConstraintError"
+Cohesion: 0.21
+Nodes (11): IsUniqueConstraintError(), TestIsUniqueConstraintError_CaseSensitive(), TestIsUniqueConstraintError_MatchesSQLiteMessage(), TestIsUniqueConstraintError_NilError(), TestIsUniqueConstraintError_UnrelatedError(), TestIsUniqueConstraintError_WrappedSQLiteError(), TestSentinelErrors_AreDistinct(), TestSentinelErrors_DoubleWrapped() (+3 more)
### Community 310 - "Tauri HTTP Capability Narrowing — Design"
Cohesion: 0.22
@@ -1720,21 +1773,17 @@ Nodes (5): Approval policy, Comprehensive Review (scheduled or fallback), Constr
Cohesion: 0.25
Nodes (8): Credential storage, Environment causes that remain possible, From the client, From Windows directly, Root cause of the 2026-07 identity-key regression, The fix, Verifying the credential store on a machine, Write verification and the fallback store
-### Community 316 - "extractChatserverFromTarGz"
-Cohesion: 0.40
-Nodes (5): extractChatserverFromTarGz(), buildTarGz(), TestExtractChatserverFromTarGz(), TestExtractChatserverFromTarGzEntryFilters(), TestExtractChatserverFromTarGzRefusesExistingDest()
+### Community 316 - "buildChannelUpdate"
+Cohesion: 0.24
+Nodes (13): buildChannelCreate(), buildChannelUpdate(), flaggedSampleChannel(), sampleChannel(), TestBuildChannelCreate_Payload(), TestBuildChannelCreate_Type(), TestBuildChannelCreate_ValidJSON(), TestBuildChannelMessages_CarryFeatureFlags() (+5 more)
### Community 317 - "cert-tofu.spec.ts"
Cohesion: 0.33
Nodes (4): CertTofuPayload, FIRST_USE, MISMATCH, MISMATCH_LIVE_HOST
-### Community 318 - "navigateToMainPageReady"
-Cohesion: 0.18
-Nodes (5): mockTauriFullSessionWithVoiceFailure(), navigateToMainPageReady(), voiceJoinFailureHandler(), mockUpdaterSession(), NOTE: These tests do NOT exercise real LiveKit/WebRTC connections.
-
-### Community 319 - "newDeafenRaceDB"
-Cohesion: 0.73
-Nodes (5): mustCreateDeafenRaceChannel(), newDeafenRaceDB(), seedDeafenRaceUser(), TestVoiceModDeafen_RollbackFollowsTargetChannelMove(), TestVoiceModDeafen_UndeafenRollbackDoesNotApplyOnUnauthorizedChannel()
+### Community 319 - "OwnCord repository-layout and contributor-experience audit"
+Cohesion: 0.22
+Nodes (9): Executive verdict, Exit gate, Findings, Isolated implementation sequence, Migration risks and controls, OwnCord repository-layout and contributor-experience audit, Recommended target, Strong foundations to preserve (+1 more)
### Community 320 - "tsconfig.build.json"
Cohesion: 0.25
@@ -1760,17 +1809,17 @@ Nodes (6): First-Run Setup, GET /admin/api/setup/status, POST /admin/api/setup,
Cohesion: 0.33
Nodes (6): GET /api/v1/livekit/health, LiveKit Endpoints, /livekit/* (Reverse Proxy), POST /api/v1/livekit/webhook, Response 200 OK, Response 503 Service Unavailable
-### Community 326 - "fuzzOpenMigratedMemory"
-Cohesion: 0.60
-Nodes (4): fuzzTestHelper, fuzzOpenMigratedMemory(), FuzzSanitizeFTSQuery(), DB
+### Community 326 - "reactions.sql.go"
+Cohesion: 0.25
+Nodes (6): AddReactionParams, GetReactionCountsRow, GetReactionUsersParams, GetReactionUsersRow, RemoveReactionParams, Queries
-### Community 327 - "README.md"
-Cohesion: 0.16
-Nodes (10): Benefits, Setup, Tailscale Guide (Zero-Config Remote Access), TLS Recommendation, Voice/Video with Tailscale, Why Tailscale, Hardening documentation, Reporting a vulnerability (+2 more)
+### Community 327 - "Tailscale Guide (Zero-Config Remote Access)"
+Cohesion: 0.33
+Nodes (6): Benefits, Setup, Tailscale Guide (Zero-Config Remote Access), TLS Recommendation, Voice/Video with Tailscale, Why Tailscale
-### Community 329 - "erroringMembersStore"
-Cohesion: 0.40
-Nodes (3): Store, erroringMembersStore, rendezvousListStore
+### Community 329 - "Voice, Video & E2EE — target UX"
+Cohesion: 0.18
+Nodes (11): 1. Two state machines, one status, 2. Join / leave, 3. Local controls, 4. Push-to-talk, 5. Voice roster (per channel), 6. Token refresh & reconnect (invisible), 7. E2EE identity verification surface, 8. Media processing & devices (+3 more)
### Community 334 - "admin-static-channel-perms.test.ts"
Cohesion: 0.33
@@ -1796,21 +1845,17 @@ Nodes (5): voice_e2ee_announce (Client -> Server), voice_e2ee_announce (Server -
Cohesion: 0.40
Nodes (4): Additional Context, Alternatives Considered, Problem, Proposed Solution
-### Community 340 - "TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots"
-Cohesion: 0.70
-Nodes (4): mustCreateVideoCappedChannel2(), newOC0006VideoStreamDB(), seedOC0006VideoStreamUser(), TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots()
+### Community 340 - "ResolveTokenHash"
+Cohesion: 0.27
+Nodes (8): tokenStore, adminAuthMiddleware(), RequireAdminAuth(), requirePerm(), ResolveTokenHash(), future(), past(), TestResolveTokenHash()
-### Community 341 - "isAddrInUse"
-Cohesion: 0.40
-Nodes (4): isAddrInUse(), TestIsAddrInUse_RealBindConflict(), TestIsAddrInUse_Table(), TestServeWithBindRetry()
+### Community 341 - "VerifyTOTPCodeOnce"
+Cohesion: 0.25
+Nodes (10): UsedTOTPCodeStore, NewUsedTOTPCodeStore(), TestUsedTOTPCodeStore_DifferentCodes(), TestUsedTOTPCodeStore_DifferentUsersSameCode(), TestUsedTOTPCodeStore_MarkUsed(), TestVerifyTOTPCodeOnce_InvalidCodeRejected(), TestVerifyTOTPCodeOnce_NilStoreAccepted(), TestVerifyTOTPCodeOnce_ReplayRejected() (+2 more)
-### Community 342 - "adminPanelSource"
-Cohesion: 0.83
-Nodes (3): adminPanelSource(), TestAdminPanelEmojiSectionIsWired(), TestAdminPanelEmojiUsesTheMemberAPI()
-
-### Community 344 - "Permission-Middleware Consolidation (audit finding A-2026-07-16) — Design"
-Cohesion: 0.33
-Nodes (6): Approach — one server-scoped predicate, and fail closed on override load, Files touched, Non-goals, Permission-Middleware Consolidation (audit finding A-2026-07-16) — Design, Problem, Test plan
+### Community 344 - "OwnCord — Test-Coverage Audit"
+Cohesion: 0.20
+Nodes (10): 1. How coverage was measured (and why the CI number is wrong), 2. Finding closure status, 3. Measured baselines (diff against these next time), 4. Two bugs surfaced by writing the tests, 5. CI gates after this pass, 6. Backlog, Client (`npx vitest run --coverage`), Go — cross-package (`make cover-all`) (+2 more)
### Community 361 - "OwnCord"
Cohesion: 0.33
@@ -1832,6 +1877,10 @@ Nodes (4): File Upload and Serving, GET /api/v1/files/{id}, POST /api/v1/uploads
Cohesion: 0.50
Nodes (4): GET /admin/api/logs/stream?ticket={ticket}, POST /admin/api/logs/ticket, Response 200 OK, Server Logs (SSE)
+### Community 369 - "B0 — Restore truth, freeze scope, and reconcile the audit"
+Cohesion: 0.29
+Nodes (7): B0 — Restore truth, freeze scope, and reconcile the audit, Entry gate, Exit gate, Hold point HP-0 — Baseline acceptance, Required evidence, Safe parallelism, Workstreams
+
### Community 373 - "DM Calls"
Cohesion: 0.50
Nodes (4): call_decline (Client -> Server) / call_declined (Server -> Client), call_incoming (Server -> Client), call_ring (Client -> Server), DM Calls
@@ -1872,41 +1921,229 @@ Nodes (3): Presence, presence (Server -> Client, broadcast), presence_update (Cl
Cohesion: 0.67
Nodes (3): Transport Layer, Transport Limits, WebSocket Endpoint
-### Community 414 - "seedUser"
-Cohesion: 0.11
-Nodes (31): NewDMService(), TestDMService_CreateDM_AllowsLapsedTemporaryBan(), TestDMService_CreateDM_RefusesBannedRecipient(), TestDMService_CreateGroupDM_OversizedNameRejectedBeforeSanitizing(), TestDMService_CreateGroupDM_ParticipantOfflineWhenDisconnected(), TestDMService_CreateGroupDM_RefusesBannedRecipient(), TestDMService_CreateGroupDM_SurvivesCancelledPostCommitRead(), TestDMService_DMSummaryFor_RecipientOfflineWhenDisconnected() (+23 more)
+### Community 413 - "scaledAuthLimit"
+Cohesion: 0.27
+Nodes (7): scaledAuthLimit(), setAuthRateScale(), TestLoginRateLimit_Value(), TestPerUserFailureCapsStayUnscaled(), TestRateLimiterCleanupHorizon_CoversMaxSlowMode(), TestScaledAuthLimit_NeverBelowOne(), TestSetAuthRateScale_ClampsMultiplier()
-### Community 420 - "buildMetricsRouter"
-Cohesion: 0.53
-Nodes (5): buildMetricsRouter(), TestHandleMetrics_AdminIPRestrict_AllowsAdmin(), TestHandleMetrics_AdminIPRestrict_BlocksNonAdmin(), TestHandleMetrics_ReturnsExpectedFields(), TestHandleMetrics_WithoutLiveKitHealthCheck()
+### Community 414 - "seedUser"
+Cohesion: 0.12
+Nodes (24): User, Store, TestHandlePresenceUpdate_BareStatusReadFailureAbortsBeforeCommit(), TestHandlePresenceUpdate_CustomStatusWriteFailureKeepsStoredText(), TestHandlePresenceUpdate_CustomStatusWriteFailureSwallowedAfterStatusCommit(), NewDMService(), TestDMService_CreateDM_AllowsLapsedTemporaryBan(), TestDMService_CreateDM_RefusesBannedRecipient() (+16 more)
+
+### Community 419 - "Queries"
+Cohesion: 0.24
+Nodes (4): CreateInviteParams, GetInviteRow, ListInvitesRow, Queries
+
+### Community 420 - "mockTauriFullSessionWithVoice"
+Cohesion: 0.25
+Nodes (6): joinVoiceChannelByName(), mockTauriFullSessionWithVoice(), mockTauriFullSessionWithVoiceFailure(), voiceJoinFailureHandler(), NOTE: These tests do NOT exercise real LiveKit/WebRTC connections., VOICE_STATE_EVENT
### Community 421 - "syscall.SysProcAttr"
Cohesion: 0.40
Nodes (3): syscall.SysProcAttr, liveKitSysProcAttr(), liveKitSysProcAttr()
-### Community 536 - "RunningInContainer"
+### Community 422 - ".UpdateUserProfile"
+Cohesion: 0.28
+Nodes (4): UpdateUserCustomStatusParams, UpdateUserPasswordParams, UpdateUserProfileParams, Queries
+
+### Community 423 - "B10 — Qualify and publish the public beta"
+Cohesion: 0.29
+Nodes (7): B10 — Qualify and publish the public beta, Entry gate, Exit gate, Hold point HP-10 — Human go/no-go, Qualification work, Required evidence, Safe parallelism
+
+### Community 449 - "OwnCord — Comprehensive Project Audit"
+Cohesion: 0.22
+Nodes (9): 8. Plugin System Governance, 9. Prioritized Top-10 Action List, Bonus (quick wins), CRITICAL Issues, Finding closure status (maintained; last updated 2026-07-20), OwnCord — Comprehensive Project Audit, Plugin Architecture, Strengths (+1 more)
+
+### Community 530 - "handleLogStream"
+Cohesion: 0.62
+Nodes (5): handleLogStream(), newLogStreamTestDB(), TestHandleLogStream_BackfillStopsAfterAPITokenRevocation(), TestHandleLogStream_BackfillStopsAfterSessionRevocation(), TestHandleLogStream_SurvivesServerWriteTimeout()
+
+### Community 532 - "B1 — Isolated repository and contributor foundation"
+Cohesion: 0.29
+Nodes (7): B1 — Isolated repository and contributor foundation, Entry gate, Exit gate, Hold point HP-1 — Structural diff review, Required evidence, Safe parallelism, Workstreams
+
+### Community 534 - "buildUserUpdate"
+Cohesion: 0.38
+Nodes (5): userUpdateSpy, buildUserUpdate(), UserUpdate, TestBuildUserUpdate_IncludesIdentityKey(), userUpdatePayload
+
+### Community 536 - "B2 — Freeze server protocol, trust, and compatibility contracts"
+Cohesion: 0.29
+Nodes (7): B2 — Freeze server protocol, trust, and compatibility contracts, Entry gate, Exit gate, Hold point HP-2 — Protocol and threat-model sign-off, Required evidence, Safe parallelism, Workstreams
+
+### Community 537 - "2. Code Quality"
+Cohesion: 0.25
+Nodes (8): 2. Code Quality, Go — Error Handling, Go — Interface Design, Go — Large Files (>800 lines), Go — Security-Relevant TODOs, TypeScript — Error Handling Gaps, TypeScript — Large Components, TypeScript — Type Safety
+
+### Community 538 - "B3 — Strengthen server architecture and permanent guardrails"
+Cohesion: 0.29
+Nodes (7): B3 — Strengthen server architecture and permanent guardrails, Entry gate, Exit gate, Hold point HP-3 — First vertical-slice review, Required evidence, Safe parallelism, Workstreams
+
+### Community 539 - "B4 — Complete identity, recovery, privacy, and data lifecycle"
+Cohesion: 0.29
+Nodes (7): B4 — Complete identity, recovery, privacy, and data lifecycle, Entry gate, Exit gate, Hold point HP-4 — Irreversible-data review, Required evidence, Safe parallelism, Workstreams
+
+### Community 540 - "B5 — Add community, content, and moderation services"
+Cohesion: 0.29
+Nodes (7): B5 — Add community, content, and moderation services, Entry gate, Exit gate, Hold point HP-5 — Abuse and privacy review, Required evidence, Safe parallelism, Workstreams
+
+### Community 541 - "buildChannelDelete"
+Cohesion: 0.20
+Nodes (8): buildChannelDelete(), buildMemberUpdate(), TestBuildChannelDelete_Payload(), TestBuildChannelDelete_Type(), TestBuildChannelDelete_ValidJSON(), TestBuildMemberUpdate_Payload(), TestBuildMemberUpdate_Type(), channelTopicID()
+
+### Community 548 - "New"
+Cohesion: 0.47
+Nodes (4): New(), TestHandlerAddsReqID(), TestHandlerEnabledDelegates(), TestHandlerSurvivesWithGroup()
+
+### Community 549 - "B6 — Qualify server deployment, operations, and capacity"
+Cohesion: 0.29
+Nodes (7): B6 — Qualify server deployment, operations, and capacity, Entry gate, Exit gate, Hold point HP-6 — Operator and capacity acceptance, Required evidence, Safe parallelism, Workstreams
+
+### Community 550 - "MetricsSources"
Cohesion: 0.50
-Nodes (3): RunningInContainer(), TestRunningInContainer_BareMetalDefault(), TestRunningInContainer_EnvSemantics()
+Nodes (4): EventPersisterMetrics, MetricsSources, ServerMetrics, database/sql.DBStats
+
+### Community 551 - "B7 — Establish the shared client platform and desktop parity"
+Cohesion: 0.29
+Nodes (7): B7 — Establish the shared client platform and desktop parity, Entry gate, Exit gate, Hold point HP-7 — Desktop parity before browser behavior, Required evidence, Safe parallelism, Workstreams
+
+### Community 552 - "updater.test.ts"
+Cohesion: 0.40
+Nodes (4): invoke, listen, relaunch, unlisten
+
+### Community 553 - "B8 — Deliver browser, PWA, phone, and tablet support"
+Cohesion: 0.29
+Nodes (7): B8 — Deliver browser, PWA, phone, and tablet support, Entry gate, Exit gate, Hold point HP-8 — Browser/mobile preview acceptance, Required evidence, Safe parallelism, Workstreams
+
+### Community 554 - "B9 — Complete unified feature UX, accessibility, and polish"
+Cohesion: 0.29
+Nodes (7): B9 — Complete unified feature UX, accessibility, and polish, Entry gate, Exit gate, Hold point HP-9 — Feature freeze and accessibility acceptance, Required evidence, Safe parallelism, Workstreams
+
+### Community 555 - "groupDMFixture"
+Cohesion: 0.42
+Nodes (8): groupDMFixture(), TestCreateGroupDMChannel_OpensForEveryone(), TestCreateGroupDMChannel_RefusesUnderThree(), TestGetDMParticipants_CollapsesInvisible(), TestGetOrCreateDMChannel_IgnoresShrunkGroup(), TestLeaveGroupDM_DeletesChannelOnLastLeave(), TestLeaveGroupDM_LastLeavePreservesAttachmentsForReclaim(), TestSetDMChannelName_RefusesNonDM()
+
+### Community 556 - ".finishVoiceLeave"
+Cohesion: 0.50
+Nodes (3): Client, Hub, leaveVoiceChannelWithRetry()
+
+### Community 557 - "protocolTypes.ts"
+Cohesion: 0.29
+Nodes (6): ClientMessageType, ClientMessageTypeValue, MessageType, MessageTypeValue, ServerMessageType, ServerMessageTypeValue
+
+### Community 558 - "TestNewRouter_DeleteAccount_BroadcastsMemberBanOverWS"
+Cohesion: 0.38
+Nodes (5): net/http/httptest.Server, dialAndAuthWS(), TestNewRouter_DeleteAccount_BroadcastsMemberBanOverWS(), TestNewRouter_LiveKitProcessStartFailure_VoiceJoinFailsClosed(), voiceJoinWSMsg()
+
+### Community 559 - "4. Dependencies & Supply Chain"
+Cohesion: 0.29
+Nodes (7): 4. Dependencies & Supply Chain, Go Modules — 30 direct deps, ALL exact-pinned ✅, Known Vulnerabilities, License Compliance, Lockfile Status, npm — 13 production deps, ALL floating (^) ⚠️, Overall Posture: **MODERATE RISK** (Go excellent, npm floating)
+
+### Community 560 - "global-teardown.ts"
+Cohesion: 0.83
+Nodes (3): globalTeardown(), killListenerPosix(), killListenerWindows()
+
+### Community 561 - "newDeafenRaceDB"
+Cohesion: 0.73
+Nodes (5): mustCreateDeafenRaceChannel(), newDeafenRaceDB(), seedDeafenRaceUser(), TestVoiceModDeafen_RollbackFollowsTargetChannelMove(), TestVoiceModDeafen_UndeafenRollbackDoesNotApplyOnUnauthorizedChannel()
+
+### Community 562 - "5. Test Coverage & Quality"
+Cohesion: 0.29
+Nodes (7): 5. Test Coverage & Quality, Go — Critical Coverage Gaps, Go — Package Coverage, Go — Test Quality: GOOD, TypeScript — E2E Coverage: EXCELLENT, TypeScript — Test Files, TypeScript — Unit Coverage: MINIMAL (<10%)
+
+### Community 564 - "perm_grid_test.go"
+Cohesion: 0.48
+Nodes (6): overrideMatrixBits(), permGridBits(), TestAdminPanelOverrideMatrixCoversChannelScopedBits(), TestAdminPanelOverrideMatrixHasSingleDefinedBits(), TestAdminPanelPermGridCoversEveryPermissionBit(), TestAdminPanelPermGridHasNoDuplicateOrCompositeBits()
+
+### Community 565 - "NewRoleService"
+Cohesion: 0.24
+Nodes (7): Store, TestAffectedUserIDs_LookupFailureReportsNotOK(), TestCreateRole_ConcurrentCreatesCannotCollideOnPosition(), Store, NewRoleService(), erroringMembersStore, rendezvousListStore
+
+### Community 566 - "buildMetricsRouter"
+Cohesion: 0.53
+Nodes (5): buildMetricsRouter(), TestHandleMetrics_AdminIPRestrict_AllowsAdmin(), TestHandleMetrics_AdminIPRestrict_BlocksNonAdmin(), TestHandleMetrics_ReturnsExpectedFields(), TestHandleMetrics_WithoutLiveKitHealthCheck()
+
+### Community 567 - "TestAdminAPI_PatchUser_RoleChangeBroadcastsEvenIfRoleReReadFails"
+Cohesion: 0.33
+Nodes (4): unbanMockHub, TestAdminAPI_PatchUser_RoleChangeBroadcastsEvenIfRoleReReadFails(), TestAdminAPI_PatchUser_RoleChangeRefreshesVisibility(), TestAdminAPI_PatchUser_UnbanBroadcastsMemberUnban()
+
+### Community 568 - "isAddrInUse"
+Cohesion: 0.40
+Nodes (4): isAddrInUse(), TestIsAddrInUse_RealBindConflict(), TestIsAddrInUse_Table(), TestServeWithBindRetry()
+
+### Community 571 - "extractChatserverFromTarGz"
+Cohesion: 0.40
+Nodes (5): extractChatserverFromTarGz(), buildTarGz(), TestExtractChatserverFromTarGz(), TestExtractChatserverFromTarGzEntryFilters(), TestExtractChatserverFromTarGzRefusesExistingDest()
+
+### Community 572 - "1. Architecture"
+Cohesion: 0.40
+Nodes (5): 1. Architecture, Anti-patterns, Communication Patterns, Dependency Direction, Layer Map
+
+### Community 573 - "6. CI/CD & DevEx"
+Cohesion: 0.40
+Nodes (5): 6. CI/CD & DevEx, Build Reproducibility, Gaps, Linting Enforcement, Pipeline Gates
+
+### Community 574 - "7. Observability"
+Cohesion: 0.40
+Nodes (5): 7. Observability, Client-Side: LIMITED ⚠️, Error Surfacing: GOOD ✅, Logging: STRONG ✅, Metrics & Tracing: PRESENT (build-tag gated)
+
+### Community 575 - "TestHandleVoiceCameraV2_RefusedWhenScreenshareSlotFull"
+Cohesion: 0.73
+Nodes (5): mustCreateVideoCappedChannel(), newOC0023VideoLimitDB(), seedOC0023VideoLimitUser(), TestHandleVoiceCameraV2_RefusedWhenScreenshareSlotFull(), TestHandleVoiceScreenshareV2_RefusedWhenCameraSlotFull()
+
+### Community 577 - ".applyMicMuteState"
+Cohesion: 0.24
+Nodes (6): isMicPolicyGated(), setListenOnly(), setLocalMuted(), mockGetLocalDevices, { mockLoadPref, mockSavePref }, mockVoiceState
+
+### Community 579 - "Non-negotiable execution rules"
+Cohesion: 0.40
+Nodes (5): Gate-driven, not date-driven, Non-negotiable execution rules, One coherent invariant per change, One source of truth per concern, Public and private security handling
+
+### Community 582 - "Security Policy"
+Cohesion: 0.40
+Nodes (4): Hardening documentation, Reporting a vulnerability, Security Policy, Supported versions
+
+### Community 583 - "TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots"
+Cohesion: 0.70
+Nodes (4): mustCreateVideoCappedChannel2(), newOC0006VideoStreamDB(), seedOC0006VideoStreamUser(), TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots()
+
+### Community 584 - "D7 — Module map"
+Cohesion: 0.50
+Nodes (4): Client Architecture (Tauri), D7 — Module map, Key mechanisms, Quality tooling
+
+### Community 585 - "D5 — Entity-relationship overview"
+Cohesion: 0.50
+Nodes (4): D5 — Entity-relationship overview, Data Model, Domain notes, How the schema is accessed
+
+### Community 586 - "WebSocket / Real-time Engine"
+Cohesion: 0.50
+Nodes (4): D4a — Connect, authenticate, replay, D4b — Broadcast fanout and backpressure, D4c — Typed command dispatch, WebSocket / Real-time Engine
+
+### Community 587 - "adminPanelSource"
+Cohesion: 0.83
+Nodes (3): adminPanelSource(), TestAdminPanelEmojiSectionIsWired(), TestAdminPanelEmojiUsesTheMemberAPI()
+
+### Community 588 - "ParseLevel"
+Cohesion: 0.67
+Nodes (3): ParseLevel(), TestLoggingLevelFromEnv(), TestParseLevel()
## Knowledge Gaps
-- **2065 isolated node(s):** `here`, `scenarios`, `FOUR_FILES`, `PROVE_FAIL`, `meta` (+2060 more)
+- **2220 isolated node(s):** `Environment`, `Bundle sizes (measured)`, `Closed`, `Refuted`, `Still open` (+2215 more)
These have ≤1 connection - possible missing edges or undocumented components.
-- **95 thin communities (<3 nodes) omitted from report** — run `graphify query` to explore isolated nodes.
+- **107 thin communities (<3 nodes) omitted from report** — run `graphify query` to explore isolated nodes.
## Suggested Questions
_Questions this graph is uniquely positioned to answer:_
-- **Why does `DB` connect `DB` to `newRoleCRUDService`, `testing.T`, `openMigratedMemory`, `context.Context`, `buildChannelRouter`, `waitRegistered`, `NewAdminAPI`, `NewTestClient`, `newHandlerHub`, `drainChanTimeout`, `newDMTestDB`, `newAuthTestDB`, `newMigratedTestDB`, `Hub`, `database/sql.Result`, `newUploadTestDB`, `writeJSON`, `AuditWriter`, `HashToken`, `NewChecker`, `middleware_test.go`, `DB`, `Result`, `NewRouter`, `profileCreateToken`, `User`, `newTestDB`, `newServeHub`, `seedMemberUser`, `postJSONWithToken`, `newVoiceTestDB`, `Role`, `newEmojiService`, `NewHandler`, `db/db.go`, `newMentionFixture`, `Migrate`, `Hub`, `newTestMessageService`, `net/http.Request`, `emoji_handler_test.go`, `buildErrorMsg`, `openAdminTestDB`, `MigrateFS`, `PermissionService`, `deps.go`, `joinVoice`, `gif_handler_test.go`, `wizardHandler`, `middleware_and_spawn_test.go`, `newPurgeService`, `handleVoiceTokenRefreshV2`, `newChannelTestAPI`, `setupPrecheck`, `seedChannel`, `newHarvestVoiceDB`, `NewRegistry`, `EventPersister`, `RateLimiter`, `newDMFixture`, `Server/main.go`, `logstream.go`, `plugins_handler_test.go`, `github.com/coder/websocket.Conn`, `LiveKitProcess`, `doRequest`, `Store`, `newTestRoleService`, `net/http.Handler`, `newBackupFileDB`, `Checker`, `.DeleteAccount`, `Channel`, `newTokenTestDB`, `MountGIFRoutes`, `TestMigrate_UpgradeFromMigration019PreservesData`, `TestChannelVisibility_RESTWSAgreement`, `cancelAfterArm`, `newBlockService`, `openFileDB`, `groupDMFixture`, `newDeafenRaceDB`, `TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots`, `errDMChannelIDsStore`, `seedUser`, `roleDeletingInvalidator`, `failNthInstallStore`?**
- _High betweenness centrality (0.021) - this node is a cross-community bridge._
-- **Why does `fakeDir` connect `badDirFile` to `Migrate`?**
- _High betweenness centrality (0.008) - this node is a cross-community bridge._
-- **Why does `getCommandConstructor()` connect `handleChatCommandV2` to `buildErrorMsg`, `command.go`, `Result`?**
+- **Why does `DB` connect `DB` to `testing.T`, `openMigratedMemory`, `context.Context`, `buildChannelRouter`, `seedMemberUser`, `waitRegistered`, `NewAdminAPI`, `handleLogStream`, `newHandlerHub`, `NewTestClient`, `drainChanTimeout`, `newDMTestDB`, `newAuthTestDB`, `newMigratedTestDB`, `Hub`, `database/sql.Result`, `newUploadTestDB`, `net/http.HandlerFunc`, `newAdminTestDB`, `HashToken`, `NewChecker`, `middleware_test.go`, `groupDMFixture`, `DB`, `Result`, `newDeafenRaceDB`, `NewRouter`, `profileCreateToken`, `newTestDB`, `newServeHub`, `newOverrideFixture`, `postJSONWithToken`, `newVoiceTestDB`, `TestHandleVoiceCameraV2_RefusedWhenScreenshareSlotFull`, `failNthInstallStore`, `helpers_test.go`, `WriteAudit`, `TestEnableVideoSlot_SameUserDoubleStreamCountsTwoSlots`, `newEmojiService`, `roleDeletingInvalidator`, `identityKeyFailStore`, `NewHandler`, `db/db.go`, `newMentionFixture`, `errDMParticipantsStore`, `Migrate`, `Hub`, `newTestMessageService`, `handleCreateEmoji`, `emoji_handler_test.go`, `doRequest`, `handleRestoreBackup`, `MigrateFS`, `joinVoice`, `NewEventPersister`, `newRoleCRUDService`, `net/http.Handler`, `wizardHandler`, `middleware_and_spawn_test.go`, `newPurgeService`, `handleVoiceTokenRefreshV2`, `newChannelTestAPI`, `net/http.Request`, `newHarvestVoiceDB`, `NewRegistry`, `MountAuthRoutes`, `NewMessageService`, `Server/main.go`, `plugins_handler_test.go`, `github.com/coder/websocket.Conn`, `newTestRoleService`, `Store`, `newTestRoleService`, `setupDiagnosticsRouter`, `Channel`, `context.CancelFunc`, `.DeleteAccount`, `newTokenTestDB`, `MountGIFRoutes`, `TestMigrate_UpgradeFromMigration019PreservesData`, `TestChannelVisibility_RESTWSAgreement`, `profile_fields_test.go`, `AuditWriter`, `openFileDB`, `ResolveTokenHash`, `errDMChannelIDsStore`, `seedUser`?**
+ _High betweenness centrality (0.018) - this node is a cross-community bridge._
+- **Why does `Hub` connect `Hub` to `VoiceTopic`, `EventRingBuffer`, `waitRegistered`, `DB`, `NewTestClient`, `newHandlerHub`, `drainChanTimeout`, `time.Time`, `github.com/owncord/server/syncutil.Mutex`, `HashToken`, `AuditWriter`, `Result`, `NewRouter`, `newServeHub`, `Server/main.go`, `livekit_proxy_test.go`, `LiveKitClient`, `RateLimiter`, `joinVoice`, `Channel`, `Registry`, `NewEventPersister`, `clientip_test.go`, `EventSink`?**
+ _High betweenness centrality (0.009) - this node is a cross-community bridge._
+- **Why does `createElement()` connect `createElement` to `VideoGrid.ts`, `media.ts`, `attachments.ts`, `main.ts`, `channels.store.ts`, `dispatcher.ts`, `MessageInput.ts`, `members.store.ts`, `UserBar.ts`, `AdminActions.ts`, `MainPage.ts`, `loadPref`, `ChannelSidebar.ts`?**
_High betweenness centrality (0.008) - this node is a cross-community bridge._
- **Are the 289 inferred relationships involving `waitRegistered()` (e.g. with `TestChannelFocus_AdminBypassesDeny()` and `TestChannelFocus_AllowedByDefault()`) actually correct?**
_`waitRegistered()` has 289 INFERRED edges - model-reasoned connections that need verification._
-- **What connects `here`, `scenarios`, `FOUR_FILES` to the rest of the system?**
- _2065 weakly-connected nodes found - possible documentation gaps or missing edges._
+- **What connects `Environment`, `Bundle sizes (measured)`, `Closed` to the rest of the system?**
+ _2220 weakly-connected nodes found - possible documentation gaps or missing edges._
- **Should `createElement` be split into smaller, more focused modules?**
- _Cohesion score 0.019929954915733055 - nodes in this community are weakly interconnected._
+ _Cohesion score 0.023886328725038403 - nodes in this community are weakly interconnected._
- **Should `testing.T` be split into smaller, more focused modules?**
- _Cohesion score 0.019091415830546264 - nodes in this community are weakly interconnected._
\ No newline at end of file
+ _Cohesion score 0.01990049751243781 - nodes in this community are weakly interconnected._
\ No newline at end of file
diff --git a/graphify-out/graph.html b/graphify-out/graph.html
index c14ed378..01f5229f 100644
--- a/graphify-out/graph.html
+++ b/graphify-out/graph.html
@@ -63,12 +63,12 @@
- 540 nodes · 1498 edges · 540 communities
+ 593 nodes · 1603 edges · 593 communities