Files
OwnCord/Client
J3vb fbb85b4d76 fix(b2-8): close the nine B2-tagged ledger findings (#1436)
* docs(b2-8): record the B2-1 pre-squash head and ledger the voice_join ordering hazard

- B2-1 evidence block: PR #1435 pre-squash head 069412db (refs/pull/1435/head), squash 1fe3df79
- Ledger OC-0349 (open, low): the joiner's own voice_state takes the hub queue while the
  rest of the join burst is written directly, so its position on the joiner's socket is
  not ordered (documented in docs/protocol.md during B2-1, not yet fixed)

* fix(client): 2 defect(s) (OC-0311, OC-0315)

OC-0311: scope the voice_leave E2EE participant-left notification to this client's own voice channel — the frame is broadcast to the whole channel read audience, so a peer leaving a channel we merely read could delete their key, clear their verification, and trigger a room-key rotation in our live session.

OC-0315: parse server timestamps with parseTimestamp instead of Date.parse in the reconnect replay gate and the clock-skew sample — the wire form is naive UTC with no 'Z', which Date.parse reads as local time, so an east-of-UTC viewer silently swallowed genuinely live messages.

* fix(voice): 1 defect(s) (OC-0316)

* fix(client): 1 defect(s) (OC-0317)

* fix(plugin): 1 defect(s) (OC-0318)

@
Route every directory-manifest resolution through loadManifestFromDir so
InstallFromZip and scanPluginDirectory apply identical plugin.toml over
plugin.json precedence. A TOML-only zip now installs, and a zip carrying
both manifests is rejected rather than validating one while the loader
later obeys the other.
@

* fix(client): 1 defect(s) (OC-0322)

* fix(ws): 1 defect(s) (OC-0337)

liveVoiceEventsSince's cold-tier fallback handed a cap-truncated window to
resuming clients as if it were complete. The query is oldest-first with a
LIMIT, so a full result means the NEWEST rows were dropped - for a voice
room, quite possibly a peer's voice_leave. Degrade to nil (the documented
best-effort miss) on a cap hit, matching reconnectSelectReplay's guard.

* fix(plugin): 1 defect(s) (OC-0338)

* fix(client): 1 defect(s) (OC-0328)

* docs(b2-8): ledger records, plan evidence and count claims for the nine fixes

- Ledger: OC-0311/0315/0316/0317/0318/0322/0328/0337/0338 -> fixed, each with
  commit, pinning test and revertProof: pass (verify-fixes.mjs 8/8, plus a hand
  RED/GREEN of the wazero-tagged OC-0318 parity test)
- Plan: B2-8 evidence block and status line (B2-0, B2-1, B2-8 landed; B2-2 next)
- Count claims in README, b0-baseline, hp-0-scorecard and the issue register
  follow the ledger (315 fixed / 30 open / 3 declined / 1 duplicate = 349)

* fix(ws): replay a complete cap-sized voice window instead of skipping it (OC-0337 follow-up)

Codex review on #1436: liveVoiceEventsSince decided truncation by
len(persisted) >= coldCap, so a complete window of exactly coldCap rows was
treated as truncated and the supplement returned nil. Fetch coldCap+1 rows
and discard only when the extra row exists. Test-first: the exact-cap case
fails before the change and passes after; the over-cap case still degrades
to nil.
2026-08-28 15:13:49 +00:00
..