docs: record maintainer decisions for the 2026-07-19 audit

Add docs/plans/audit-2026-07-19-decisions.md capturing the eight decisions
taken on the audit's open questions (announcement channels: implement;
data layer: adopt sqlc + remove store/; protocol constants: real codegen;
client HTTP TOFU pinning: next security work; Solid beachhead: delete;
specs: one refresh PR after codegen) with sequencing, and mark the greenlit
items (protocol codegen + quick-wins batch).

Update the closure table in docs/audit-2026-07-19.md from OPEN to DECIDED
for the seven findings these decisions cover.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UA17KPvqGBX3XbXYnMf1rA

docs/plans/audit-2026-07-19-decisions.md

@@ -0,0 +1,48 @@
+# Audit 2026-07-19 — Maintainer Decisions
+
+**Date decided:** 2026-07-19
+**Decided by:** J3vb
+**Status:** decisions recorded; work sequenced below, not yet implemented
+**Source:** decision points raised by [docs/audit-2026-07-19.md](../audit-2026-07-19.md)
+
+This document records the maintainer's answers to the open decision points from
+the 2026-07-19 architectural audit, so follow-up PRs can implement against a
+settled direction instead of re-litigating it. Update the **Status** column
+here (and the audit's closure table) as items land.
+
+## Decisions
+
+| # | Decision point | Audit ID | Decision | Status |
+|---|----------------|----------|----------|--------|
+| D1 | `announcement` channel type (documented + offered by admin API, rejected by DB triggers) | A-2026-07-01 | **Implement end-to-end**: migration to allow the type, posting-permission semantics, admin support, client rendering, spec updates. Not a doc-strip — this becomes a real feature. | Planned (not yet greenlit to start) |
+| D2 | Data-layer direction (raw SQL vs dead sqlc `db/dbgen` vs `store.Store`) | A-2026-07-05 / A-2026-07-06 | **Adopt sqlc for real**: wire `db.DB` method bodies to the generated `dbgen` queries so sqlc becomes the actual, type-checked query layer. The `sqlc-verify` CI job stays and starts earning its keep. | Planned |
+| D3 | Fate of `Server/store/` (untested abstraction seam) | prior audit #6 | **Remove `store/`**: execute the prior audit's P4 "single data layer" direction. Services call the (sqlc-backed) `db` package directly; tests use in-memory SQLite instead of `MemStore`. | Planned (sequence with/after D2) |
+| D4 | Protocol constants sync (`message_types.go` / `protocolTypes.ts` claim a nonexistent `docs/protocol-schema.json`) | A-2026-07-08 | **Create real codegen**: commit an actual `protocol-schema.json` plus a generator that emits the Go and TS constant files (and, ideally, protocol.md's message table), making the "single source of truth" comment true. | **Greenlit** |
+| D5 | Client HTTP TLS gap (`allowSelfSigned: true`, no TOFU pinning on the REST path) | A-2026-07-02 | **Next security work**: build the TOFU HTTP proxy in Rust (mirroring `ws_proxy.rs`) as the next security task — highest-priority security item. | Planned |
+| D6 | Abandoned SolidJS beachhead + stale `docs/client-architecture.md` | A-2026-07-12 | **Delete it all**: remove `src/components/solid/`, `solidMount`/`solidAdapter`, `vite-plugin-solid`, and Solid test deps; retire `client-architecture.md` in favor of [docs/architecture/client.md](../architecture/client.md). | Planned |
+| D7 | Spec refresh strategy for api.md / protocol.md / schema.md | A-2026-07-03 | **One refresh PR first**, using the audit's §2 conformance matrix as the checklist; afterwards specs are kept current per-PR (see the maintenance rule in [docs/architecture/README.md](../architecture/README.md)). Announcement channels (D1) later update the *fresh* specs. | Planned |
+| D8 | What to implement first | backlog §6 | **Greenlit now: Protocol codegen (D4) + the quick-wins batch** — `LogAudit` error handling (`admin/handlers_backup.go`), contradictory upload `Cache-Control` (`upload_handler.go`), hub inline settings SQL through the data layer (`ws/hub.go`), Hub constructor cleanup (required collaborators into `NewHub`). | **Greenlit** |
+
+## Suggested sequencing
+
+1. **Now (greenlit):**
+   - Quick-wins batch (small, independent, low-risk).
+   - Protocol codegen (D4) — also unblocks the protocol.md portion of D7.
+2. **Next:**
+   - Spec refresh PR (D7) — after D4 so protocol.md tables can be generated.
+   - Client HTTP TOFU proxy (D5) — next security work.
+   - Solid cleanup (D6) — small, can slot in anywhere.
+3. **Then (larger, sequenced together):**
+   - sqlc adoption (D2), followed by `store/` removal (D3) once queries are
+     type-checked — doing D3 after D2 avoids rewiring services twice.
+   - Announcement channels (D1) — after the spec refresh so it patches fresh
+     specs; needs its own small design note (permission semantics: who can
+     post vs read).
+
+## Explicitly not decided here
+
+- Channel-visibility unification (audit backlog 3) and finishing the V2
+  dispatch migration (backlog 11) were not greenlit yet — they remain open
+  backlog items, not rejected.
+- Client unit suite triage to green/blocking (A-2026-07-04) remains tracked in
+  the audit; no scheduling decision was taken.