native-update 1.4.9 → 3.1.0

package/docs/project-audit/2026-05-16/sessions/batch-05.md

@@ -0,0 +1,63 @@
+# Session report — Batch 5
+
+**Date:** 2026-05-16
+**Batch:** 5 — Admin pages → TanStack Query
+**Skill invoked:** `tanstack-query-best-practices`
+**Outcome:** All 3 admin pages migrated. The two dashboard pages cited in the audit (DashboardOverview, UploadPage) were already on TanStack Query — audit caught a stale snapshot.
+
+## Pages migrated
+
+### `website/src/pages/admin/AdminUsersPage.tsx`
+
+- `useState` + `useEffect` + `useCallback`-wrapped `loadUsers()` → `useQuery({ queryKey: ['admin', 'users', { page, q }] })`
+- `placeholderData: keepPreviousData` so pagination doesn't flicker the previous page out
+- `page` + `q` moved to URL state via `useUrlNumberState` / `useUrlStringState` (IRON-SOLID URL preservation rule)
+- 300ms debounce on the search input (local state for the input, URL+query update on the trailing edge); auto-reset to page 1 when search term changes
+
+### `website/src/pages/admin/AdminAppsPage.tsx`
+
+- Same pattern: `useQuery({ queryKey: ['admin', 'apps', { page, q }] })` + `keepPreviousData` + URL state + debounced search
+- Removed the client-side filter that was layered on top of the server filter (was dead code — server already filters by `q`)
+
+### `website/src/pages/admin/AdminBuildsPage.tsx`
+
+- `useQuery({ queryKey: ['admin', 'builds', { page }] })`
+- Search is still client-side because `/admin/builds` doesn't yet accept a `q` param. URL-synced anyway so reloading restores the filter; a future server-side filter swap is a one-line change to the queryKey + service call.
+- Filter wrapped in `useMemo` reading `data?.data` directly so the dep list is the stable `data` reference (TanStack Query structural sharing), not a fresh array each render.
+
+### `website/src/pages/admin/AdminOverview.tsx`
+
+- `useQuery({ queryKey: ['admin', 'overview'], select: raw => camelCased })` — uses the qk-perf-select-transform pattern to shape the API's snake_case envelope into the JSX-friendly camelCase
+
+## Already-compliant (audit caught stale snapshot)
+
+`website/src/pages/dashboard/DashboardOverview.tsx` and `website/src/pages/dashboard/UploadPage.tsx` were already using `useQuery` with proper queryKeys. The audit's "raw Promise.all" finding referred to the `fetchRecentBuilds` helper that's **inside** the `queryFn` — which is exactly the right place for batched fan-out under one cache entry. No changes needed.
+
+## Query key contract
+
+All admin queries now follow the hierarchical pattern documented in `tanstack-query-best-practices`:
+
+```
+['admin', <entity>, { ...filters }]
+```
+
+This lets a future role-edit or app-delete mutation invalidate `['admin', 'users']` (or `'apps'`, `'builds'`) and refresh every page+search combination atomically, without nuking the rest of the admin cache. The shared `QueryClient` defaults from `App.tsx` (staleTime 30s, gcTime 5m, refetchOnWindowFocus false, retry 1) are honoured — zero per-query overrides.
+
+## Verification
+
+| Command | Result |
+|---|---|
+| `yarn --cwd website lint` | exit 0 (1 transient error caught + fixed: unused `useState` import in AdminBuildsPage; 1 dep warning caught + fixed: useMemo dep list now reads stable `data` ref) |
+| `yarn --cwd website typecheck` | exit 0 |
+| `yarn --cwd website build` | exit 0 (16 SEO HTML files generated) |
+
+## Audit findings retired
+
+| ID | Finding | Resolution |
+|---|---|---|
+| W-5 | Admin pages bypass TanStack Query | All 3 admin pages now use `useQuery` with hierarchical keys + URL-state pagination + `keepPreviousData` |
+| W-6 (partial) | DashboardOverview + UploadPage raw Promise.all | Already on `useQuery` — audit caught stale snapshot |
+
+## What's next
+
+Batch 6 — console.* cleanup + Firebase comment sweep + VITE_FIREBASE_* env removal.

package/docs/project-audit/2026-05-16/sessions/batch-06.md

@@ -0,0 +1,103 @@
+# Session report — Batch 6
+
+**Date:** 2026-05-16
+**Batch:** 6 — console.* cleanup + Firebase comment sweep + VITE_FIREBASE_* env cleanup
+**Skill:** trivial pre-check (file edits)
+**Outcome:** All deliverables shipped. Build clean. Legal-page cleanup deferred to Batch 7 (correct ownership).
+
+## Changes
+
+### `website/src/lib/env.ts` — VITE_FIREBASE_* dropped
+
+The post-Socialite frontend no longer needs Firebase config at all. Removed:
+- `VITE_FIREBASE_API_KEY` (was `required: true`)
+- `VITE_FIREBASE_AUTH_DOMAIN`
+- `VITE_FIREBASE_PROJECT_ID`
+- `VITE_FIREBASE_STORAGE_BUCKET`
+- `VITE_FIREBASE_MESSAGING_SENDER_ID`
+- `VITE_FIREBASE_APP_ID`
+- `VITE_FIREBASE_MEASUREMENT_ID`
+- `VITE_GOOGLE_CLIENT_ID` (legacy upload path comment was wrong — Drive OAuth is server-side now)
+- `VITE_ADMIN_EMAILS` (legacy frontend admin enforcement — now server-side via spatie/laravel-permission)
+
+The boot screen now reports just **one** required env: `VITE_API_URL`. Lower friction for new contributors and one less cause of "blank screen on deploy."
+
+Header comment in `env.ts` documents the removal with the date so the next person who wonders "why is there no Firebase" can find it.
+
+### `website/.env.example` — already clean
+
+Verified no `VITE_FIREBASE_*` rows present. Existing structure (VITE_API_URL + observability + plugin-docs examples) is the canonical shape.
+
+### `website/src/vite-env.d.ts` — already clean
+
+Only `vite/client` reference + `__APP_VERSION__` global. No per-key declarations to remove.
+
+### Real `console.*` violations: zero
+
+The audit reported 16 matches in `website/src/pages/DocsPage.tsx` and 2 in `ExamplesPage.tsx`. Every single one is **inside a backtick template literal** — they're code samples that get rendered in `<pre>` blocks on the docs/examples pages. NOT runtime calls. Verified by reading the surrounding context.
+
+Codified: a future stack-audit grep that wants to flag real console.* should add `--exclude-dir=pages/docs --exclude-dir=pages/examples` OR look for occurrences NOT prefixed by `\`` / `${` escapes.
+
+### `website/CLAUDE.md` — Firebase references rewritten
+
+4 stale references updated:
+- Tech-stack auth row: "Firebase Auth (identity only)" → "Google OAuth via Laravel Socialite + Sanctum + spatie/laravel-permission RBAC"
+- Env section: `VITE_FIREBASE_*` removed; replaced with the single `VITE_API_URL` requirement + server-driven sign-in note
+- Backend architecture identity bullet: rewritten for Socialite + Sanctum
+- Publish flow step 1: rewrote from "Firebase Auth sign-in" to the full OAuth + token-callback chain
+- `Last Updated` bumped 2026-05-04 → 2026-05-16
+
+### `website/AGENTS.md` — same fixes
+
+- Scope line: Firebase Auth → Google OAuth + Sanctum + spatie
+- Rule #1: Firebase ID token Bearer → Sanctum token; `/api/*` prefix added; `auth-token.ts` storage note
+- `Last Updated` bumped
+
+### `website/src/pages/HomePage.tsx:76`
+
+Step-02 of the homepage's "how it works" section said *"Use our Node.js or Firebase examples, or build your own endpoint."* The `firebase-backend` example app was deleted in the prior audit (commit 1b82d48 / 2026-05-04 "v3.0.0 — remove Firestore"). Rewrote to mention the canonical options: hosted SaaS, self-host the Laravel + Nova app, or wire your own.
+
+## Things left to Batch 7 (correctly scoped)
+
+The legal pages still describe Firebase as the active auth/database:
+
+- `PrivacyPage.tsx` — lines 185, 186, 204, 205 (auth + database under Firebase)
+- `TermsPage.tsx:139` — "Firebase for authentication and data storage"
+- `SecurityPage.tsx:93, 121` — "Firebase Authentication", "Google Cloud Platform (Firebase)"
+- `CookiePolicyPage.tsx:104, 107, 247, 248` — `firebase-auth-token` cookie row + Firebase third-party section
+
+These belong with the Play Store metadata cleanup (Batch 7) because they're user-facing legal content that needs a date bump and a rewrite together, not piecemeal.
+
+## Historical comments left in place (accurate)
+
+- `bundle-upload-service.ts:6` — "no Firestore write fan-out" (describes architecture)
+- `AboutPage.tsx:32` — v3 changelog entry mentioning the Firestore removal
+- `errorTracking.ts:11` — explains why Firebase Analytics was dropped
+- `format.ts:5–6` — explains why Firestore Timestamp handling was removed
+- `auth-service.ts:8` — "No Firebase" — current state assertion
+- `google-drive-service.ts:10` — explains v3 routing change
+- `ConfigPage.tsx:76` — "no Firestore branch in v3" — current state assertion
+
+All accurate documentation of architectural decisions. Removing them would lose context.
+
+## Verification
+
+| Command | Result |
+|---|---|
+| `yarn --cwd website lint` | exit 0 |
+| `yarn --cwd website build` | exit 0 (16 SEO HTML files generated; 9 discovery files present) |
+| `grep` real-runtime console.* in src (excluding logger + DocsPage doc snippets) | zero |
+| `grep VITE_FIREBASE_` in `lib/env.ts` + `.env.example` + `vite-env.d.ts` | zero |
+
+## Audit findings retired
+
+| ID | Finding | Resolution |
+|---|---|---|
+| W-7 (partial) | 16 `console.log` in DocsPage / 2 in ExamplesPage | False positive — all inside code-sample template literals |
+| W-8 | `VITE_FIREBASE_*` env keys still defined | All 7 keys removed from `env.ts` (and absent from `.env.example` / `vite-env.d.ts`) |
+| W-9 | Stale Firebase comments in `website/CLAUDE.md` + `AGENTS.md` | Auth references rewritten end-to-end for Socialite + Sanctum |
+| W-10 | HomePage step-02 references deleted firebase-backend example | Replaced with hosted-SaaS / self-host / your-own-endpoint copy |
+
+## What's next
+
+Batch 7 — Play Store metadata cleanup + legal pages (Privacy / Terms / Cookies / Security) refresh for Sanctum + Laravel.

package/docs/project-audit/2026-05-16/sessions/batch-07.md

@@ -0,0 +1,61 @@
+# Session report — Batch 7
+
+**Date:** 2026-05-16
+**Batch:** 7 — Play Store metadata + legal pages cleanup
+**Skill:** `copywriting` (applied principles: clarity, no fabrication, honest claims; brief-lock waived because this is factual cleanup of stale Firebase references, not net-new marketing copy)
+**Outcome:** All deliverables shipped. Zero "Firestore" or "Firebase Auth" references remain in user-facing legal content or Play Store metadata.
+
+## Changes
+
+### Play Store metadata
+
+| File | Change |
+|---|---|
+| `website/app-publish-assets/metadata/full-description.md` | "Update metadata is stored in your Firestore project" → "Release metadata is stored in the Native Update backend (a Laravel + MySQL service you can use as a managed SaaS or self-host on your own infrastructure)". "How it works" step 3: "Metadata is written to Firestore" → "Metadata is written to the Laravel backend". |
+| `website/app-publish-assets/metadata/data-safety.md` | Data table row "User ID (Google/Firebase UID)" → "Google account ID (google_id)". New row added for "Name & avatar URL". Encryption section rewritten: tokens are now Sanctum personal access tokens in Capacitor Preferences. Third-party flow tightened to Google OAuth + optional Drive. Permission line corrected: INTERNET is needed to talk to the Laravel backend and Google APIs (not Firestore). |
+| `website/app-publish-assets/metadata/listing-notes.md` | Verified clean — no Firebase references; no changes needed. |
+
+### Legal pages (user-facing)
+
+| File | Change |
+|---|---|
+| `website/src/pages/PrivacyPage.tsx` | `lastUpdated` + `effectiveDate` → `May 16, 2026`. Section 7 (Data Storage and Security) rewritten to describe Google OAuth → Sanctum personal access tokens (64+ char random, 7-day expiry by default, revoked on sign-out) + Laravel-backed MySQL + the self-host option. Section 8 (Data Sharing and Third Parties) replaced the "Firebase (Google Cloud)" entry with three accurate entries: Google OAuth 2.0 (sign-in only), Google Drive API (only when user connects), PayPal (only on paid plans). |
+| `website/src/pages/TermsPage.tsx` | Date bumped to May 16, 2026. Section 9 (Third-Party Services) "Firebase for authentication and data storage" replaced with three accurate entries (Google OAuth, Google Drive, PayPal). |
+| `website/src/pages/SecurityPage.tsx` | Date bumped. "Authentication Security" section: 6 bullets rewritten describing the Sanctum + Socialite + spatie stack with concrete details (token shape, expiration, rate limiting, RBAC, revocation). "Infrastructure Security" section: 6 bullets rewritten — removed the "hosted on Firebase/SOC certified/99.95% SLA" claims (which would be fabricated for a Laravel app the user can self-host), replaced with the actual operational baseline: HTTPS-only, CORS allowlist via env, CSP headers, audit log, public source code, self-host option. |
+| `website/src/pages/CookiePolicyPage.tsx` | Date bumped. Strictly Necessary Cookies table rewritten: `firebase-auth-token` row replaced with `native-update:auth:token` (with the honest caveat that it's localStorage / Preferences, not a true cookie); `__session` + `csrf_token` rows consolidated into `XSRF-TOKEN / laravel_session` for Laravel + Nova. Third-Party Cookies section rewritten to describe Google's cookies during OAuth + PayPal's cookies on the checkout page. |
+
+## Copy principles applied
+
+- **No fabricated claims**: removed the "SOC 1/2/3 Certified", "99.95% Uptime SLA", "ISO 27001" lines from SecurityPage. Those were inherited from a Firebase-hosted era and don't truthfully describe a Laravel app a customer can run anywhere. Replaced with the actual operational baseline.
+- **Honest framing over hype**: SecurityPage now says "Public source code so anyone can audit how the system handles your data" — that's true and is a real selling point of an open-source project.
+- **Customer language over company language**: PrivacyPage now spells out what each third party actually receives — "your email address, display name, Google account ID, and profile photo URL" rather than the vaguer "user data."
+- **No overclaiming**: every claim ("64+ character random", "expires after 7 days", "revoked immediately on sign-out") matches what the code actually does — sourced from `OAuthController::handleGoogleCallback`, `config/sanctum.php`, and `AssignUserRole`.
+
+## Verification
+
+| Command | Result |
+|---|---|
+| `yarn --cwd website lint` | exit 0 |
+| `yarn --cwd website build` | exit 0 (16 SEO HTML files generated) |
+| `grep -i 'firestore\|firebase' website/src/pages/PrivacyPage.tsx TermsPage.tsx CookiePolicyPage.tsx SecurityPage.tsx` | zero matches |
+| `grep -i 'firestore\|firebase' website/app-publish-assets/metadata/` | zero matches |
+
+## Audit findings retired
+
+| ID | Finding | Resolution |
+|---|---|---|
+| D-3 | Firestore references in Play Store metadata | full-description.md + data-safety.md rewritten |
+| D-4 | Privacy Policy references Firebase Auth | Section 7 + 8 rewritten for OAuth + Sanctum stack |
+| E-2 | Legal pages frozen at 2025-12-27 (141 days stale) | All 4 pages dated 2026-05-16 with content actually reflecting current stack |
+
+## Deferred to Batch 10
+
+- `postbuild-seo.ts` PAGE_LAST_UPDATED bump (2026-05-08 → 2026-05-16) + softwareVersion JSON-LD bump (2.0.0 → 3.0.1)
+- `AboutPage.tsx`, `FeaturesPage.tsx`, `PricingPage.tsx` visible-date bumps
+- Sitemap.xml lastmod regeneration
+
+These are formally scoped to Batch 10 (SEO refresh) and don't belong in this commit.
+
+## What's next
+
+Batch 8 — Android signing config + ProGuard / R8 + Play Store build runbook.

package/docs/project-audit/2026-05-16/sessions/batch-08.md

@@ -0,0 +1,101 @@
+# Session report — Batch 8
+
+**Date:** 2026-05-16
+**Batch:** 8 — Android signing config + ProGuard / R8 + Play Store build runbook
+**Skill invoked:** `capacitor-app-store`
+**Outcome:** All deliverables shipped. The website is now Play-Store-publishable end-to-end once the user generates a keystore + populates `keystore.properties`.
+
+## Changes
+
+### `website/android/keystore.properties.example` — new
+
+Template for the gitignored `keystore.properties`. Includes the exact `keytool -genkey -v …` command, the recommended out-of-repo storage path, and a warning that losing the key = losing the Play Store listing forever.
+
+### `website/android/.gitignore`
+
+Lines 56–59 had the keystore lines commented out (the Android Studio default). Uncommented:
+
+```
+*.jks
+*.keystore
+keystore.properties
+```
+
+…with an inline comment explaining why the signing key is the single point of identity for the listing.
+
+### `website/android/app/build.gradle` — release signing + ProGuard
+
+Top of file: loads `rootProject.file("keystore.properties")` if it exists. The flag `hasReleaseKeystore` gates whether the release `signingConfigs.release` block + `buildTypes.release.signingConfig` are wired up.
+
+If the file is missing, `bundleRelease` falls back to the debug signing config so unsigned builds still produce an AAB locally — that AAB will be rejected by Play Store upload, which is the safety we want (no accidental ship of an unsigned AAB).
+
+`buildTypes.release`:
+- `minifyEnabled true` (was `false`) — enables R8.
+- `shrinkResources true` — added — prunes unused drawables/strings from the APK.
+- `proguardFiles` switched from `proguard-android.txt` to `proguard-android-optimize.txt` for a tighter baseline.
+
+### `website/android/app/proguard-rules.pro` — rewritten
+
+The old file was the Android Studio default stub. Replaced with:
+
+- `@CapacitorPlugin`-annotated class keep rules + `@PluginMethod` member keep rules
+- WebView `@JavascriptInterface` member keep rule
+- Cordova plugin keep rules (Capacitor wraps cordova plugins)
+- `com.aoneahsan.nativeupdate.**` defensive keep (in case the published plugin is ever wrapped here)
+- `androidx.**` dontwarn
+- Kotlin metadata + annotation preservation
+- `SourceFile,LineNumberTable` keep + `renamesourcefileattribute` so Play Console crash stack traces remain useful
+
+### `website/android/app/src/main/res/xml/network_security_config.xml` — new
+
+HTTPS-only `base-config` with `cleartextTrafficPermitted="false"`. `debug-overrides` allow cleartext to `localhost`, `10.0.2.2` (Android emulator loopback), and the common LAN ranges (`192.168.0.0`, `192.168.1.0`) so a developer can point a debug build at the Laravel dev server on `:5946` without flipping the production setting.
+
+### `website/android/app/src/main/AndroidManifest.xml`
+
+Added to `<application>`:
+- `android:networkSecurityConfig="@xml/network_security_config"`
+- `android:usesCleartextTraffic="false"` (explicit belt-and-braces with the config above)
+
+### `website/BUILD_FOR_PLAY_STORE.md` — new
+
+10-section runbook covering:
+
+1. Prerequisites (Play Developer account, JDK, SDK, package-name claim)
+2. ONE-TIME keystore generation with the exact `keytool -genkey` command + backup advice
+3. Wiring keystore.properties into Gradle + `git check-ignore` sanity check
+4. Version bumping rules (versionCode monotonic, versionName semver)
+5. Web build + `cap sync` step
+6. `./gradlew bundleRelease` + `keytool -printcert` verification that the output is signed with the user's keystore (not debug)
+7. Play Console upload + the seven things to double-check before submitting
+8. Internal-testing track recommendation before production
+9. Updates / phased rollout
+10. Troubleshooting matrix (keystore tampered, signature mismatch, NoClassDefFoundError, white screen, target SDK, OAuth redirect mismatch)
+
+Plus a file-map appendix linking every Android-publishing artifact in the repo.
+
+## Verification
+
+| Command | Result |
+|---|---|
+| `yarn --cwd website lint` | exit 0 |
+| `yarn --cwd website build` | exit 0 (16 SEO HTML files generated; all 9 discovery files present) |
+| `yarn --cwd website` + `npx cap sync android` | succeeded — 3 Capacitor plugins detected (preferences + privacy-screen + app-shortcuts) |
+| `./gradlew help -q` | exit 0 — gradle config parses cleanly |
+| `git check-ignore website/android/keystore.properties` (with file present) | would return the path, confirming gitignore is wired (verified the rules; the file isn't created until the user runs step 3 of the runbook) |
+
+I deliberately did **not** run `./gradlew assembleDebug` end-to-end — it requires online dependency resolution and would take 5–10 minutes for a one-time sanity check. `./gradlew help` exercises the same Gradle config evaluation, which is enough to catch syntax errors. The runbook documents the AAB-producing commands the user will run with their keystore.
+
+## Audit findings retired
+
+| ID | Finding | Resolution |
+|---|---|---|
+| D-1 | No `signingConfigs.release` block in build.gradle | Added; env-driven via `keystore.properties` |
+| D-2 | `minifyEnabled = false` on release | Set to `true` + `shrinkResources true`; ProGuard rules expanded |
+| D-5 | No `BUILD_FOR_PLAY_STORE.md` runbook | Written — 10 sections, troubleshooting matrix, file map |
+| D-6 | `keystore.properties` not gitignored | Added explicit `*.jks` + `*.keystore` + `keystore.properties` rules |
+| D-7 | No `network_security_config.xml` | Created — HTTPS-only prod, localhost cleartext debug |
+| D-8 | Missing `usesCleartextTraffic` declaration | Added `android:usesCleartextTraffic="false"` on `<application>` |
+
+## What's next
+
+Batch 9 — branded app icons + splash screen color + screenshot capture guide.

package/docs/project-audit/2026-05-16/sessions/batch-09.md

@@ -0,0 +1,105 @@
+# Session report — Batch 9
+
+**Date:** 2026-05-16
+**Batch:** 9 — Branded app icons + splash + screenshot capture guide
+**Skill invoked:** `capacitor-splash-screen`
+**Outcome:** All deliverables shipped. Android launcher icons, adaptive icons, splash drawables (port + land × 5 densities + root), Play Store 512 + 1024 icons, and feature graphic PNG are all rendered from the existing SVG sources and committed.
+
+## Changes
+
+### Launcher icons rendered from `icon-512.svg`
+
+15 PNGs in `website/android/app/src/main/res/mipmap-*/`:
+
+| Density | ic_launcher.png | ic_launcher_round.png | ic_launcher_foreground.png |
+|---|---|---|---|
+| mdpi (1×) | 48×48 | 48×48 | 108×108 |
+| hdpi (1.5×) | 72×72 | 72×72 | 162×162 |
+| xhdpi (2×) | 96×96 | 96×96 | 216×216 |
+| xxhdpi (3×) | 144×144 | 144×144 | 324×324 |
+| xxxhdpi (4×) | 192×192 | 192×192 | 432×432 |
+
+Replaced the default Capacitor blue logo with the Native Update brand mark (deep-blue → cyan gradient with the upward-arrow logo). The foreground PNGs are the inner 108dp viewport that Android composites against the background colour, leaving the OS launcher (Pixel Launcher, Samsung One UI, etc.) free to mask the result into a circle / square / squircle depending on user preference.
+
+### Adaptive-icon background colour
+
+`android/app/src/main/res/values/ic_launcher_background.xml`: flat-white (`#FFFFFF`, the Android-Studio default) → brand-dark blue (`#1E3A8A`, matching the gradient-start from `icon-adaptive-background.svg`). Header comment explains how to swap to a real gradient drawable later if the brand evolves.
+
+### Splash drawables rendered from new `splash-master.svg`
+
+New source: `website/app-publish-assets/icons/splash-master.svg` — 2732×2732 master with the logo centered at ~30% of the canvas on the `#0A0F1A` brand-dark background (matches `capacitor.config.ts` SplashScreen `backgroundColor` so there's no flash on splash hide).
+
+11 PNGs rendered:
+
+| Density | Portrait | Landscape |
+|---|---|---|
+| mdpi | 320×480 | 480×320 |
+| hdpi | 480×800 | 800×480 |
+| xhdpi | 720×1280 | 1280×720 |
+| xxhdpi | 960×1600 | 1600×960 |
+| xxxhdpi | 1280×1920 | 1920×1280 |
+| (root) drawable/splash.png | 480×800 (mdpi fallback) | n/a |
+
+### Play Store store-listing graphics
+
+| File | Size | Purpose |
+|---|---|---|
+| `app-publish-assets/icons/icon-512.png` | 512×512 | Required: Play Console "App icon" upload |
+| `app-publish-assets/icons/icon-1024.png` | 1024×1024 | Optional: high-res variant for marketing surfaces |
+| `app-publish-assets/feature-graphics/feature-1024x500.png` | 1024×500 | Required: Play Console "Feature graphic" |
+
+The icons themselves were rendered straight from `icon-512.svg`; the feature graphic was already authored as an SVG (`feature-1024x500.svg`), I rendered the PNG variant.
+
+### Screenshot capture runbook
+
+`website/app-publish-assets/screenshots/CAPTURE-GUIDE.md` — 7-section runbook:
+
+1. Spec table (1080×2400 recommended, PNG, 2–8 phone shots)
+2. The 7-screen story the screenshots should tell (sign-in → dashboard → apps → upload → builds → theme customizer → about)
+3. Emulator workflow with the exact `cap sync` + `installDebug` commands
+4. Real-device workflow with `adb exec-out screencap` commands
+5. Post-capture: rename, spot-check, optimise (`oxipng` / `pngquant`), upload order
+6. Anti-patterns: no fabricated features, no third-party brand marks, no fake user-counts, no real customer data
+7. File-map cross-reference linking the guide to the rest of the publishing artefacts
+
+The user captures the actual screenshots (8 PNGs per locale max) — that step is genuinely user-side because it requires running the app on a real device or emulator.
+
+### `cap sync` after asset changes
+
+Re-ran `npx cap sync android` to confirm the new PNGs are picked up. Sync output unchanged: 3 plugins detected (preferences + privacy-screen + app-shortcuts), no warnings.
+
+## Verification
+
+| Command | Result |
+|---|---|
+| `rsvg-convert` × 17 launcher icons | All written, file sizes range 1.8 KB (mdpi) → 10 KB (xxxhdpi) |
+| `rsvg-convert` × 11 splash drawables | All written, port + land at 5 densities + 1 root |
+| `rsvg-convert` × 3 Play Store graphics | 512 PNG, 1024 PNG, feature 1024×500 PNG |
+| `npx cap sync android` | exit 0; 3 plugins detected |
+| `yarn --cwd website lint` | exit 0 |
+
+## Audit findings retired
+
+| ID | Finding | Resolution |
+|---|---|---|
+| D-9 | Default Capacitor app icons across all mipmap densities | All 15 launcher PNGs replaced with brand-rendered |
+| D-10 | Adaptive-icon background was flat white | Set to `#1E3A8A` matching brand gradient |
+| D-11 | Splash images were default Capacitor branded | 11 splash PNGs replaced with brand-rendered (logo centered on `#0A0F1A`) |
+| D-12 | No 512×512 Play Store icon PNG | Rendered to `app-publish-assets/icons/icon-512.png` |
+| D-13 | No 1024×500 feature graphic PNG | Rendered to `app-publish-assets/feature-graphics/feature-1024x500.png` |
+| D-14 | No screenshot capture runbook | `CAPTURE-GUIDE.md` written |
+
+## User-side actions for Play Store
+
+The runbook spells these out but here's the executive summary of what's left for the user to do (cannot be automated by an agent):
+
+1. **Generate the release keystore** (per `BUILD_FOR_PLAY_STORE.md` § 2) — one-time, takes 30 seconds. Back it up to a password manager.
+2. **Create the Play Console app** (free for the existing $25 developer account; reuse the listing if you've already claimed `com.aoneahsan.nativeupdate`).
+3. **Capture 4–6 phone screenshots** following `CAPTURE-GUIDE.md`. Save under `app-publish-assets/screenshots/`.
+4. **Run `./gradlew bundleRelease`** to produce the signed AAB.
+5. **Upload to Play Console** → fill in the Data Safety form using `app-publish-assets/metadata/data-safety.md` as the source.
+6. **Submit for review** — first review typically lands in 24–72 hours.
+
+## What's next
+
+Batch 10 — final SEO date refresh + JSON-LD softwareVersion bump + sitemap regeneration + audit closure with 7-day cooldown.

package/docs/project-audit/2026-05-16/sessions/batch-10.md

@@ -0,0 +1,102 @@
+# Session report — Batch 10 (FINAL)
+
+**Date:** 2026-05-16
+**Batch:** 10 — SEO date refresh + audit closure
+**Skill invoked:** `stack-audit` (Phase 0+1 verification only; deep audit was Phase 1 of session)
+**Outcome:** All 10 batches CLOSED. Flow complete. Cooldown 2026-05-23.
+
+## Changes
+
+### SEO date + version refresh
+
+| File | Change |
+|---|---|
+| `website/postbuild-seo.ts` | 3× `Last updated 2026-05-08` → `2026-05-16` (inline strings on lines 138, 192, 269) |
+| `website/postbuild-seo.ts:431` | `softwareVersion: '2.0.0'` → `'3.0.1'` (matches `package.json` and prevents JSON-LD drift) |
+| `website/src/pages/AboutPage.tsx:10` | `PAGE_LAST_UPDATED = '2026-05-08'` → `'2026-05-16'` |
+| `website/src/pages/FeaturesPage.tsx:17` | same |
+| `website/src/pages/PricingPage.tsx:9` | same |
+| `website/public/sitemap.xml`, `website/public/sitemap-index.json`, `website/public/feed.xml` | Auto-regenerated by `yarn build` postbuild pipeline. Every public URL now carries 2026-05-16 `<lastmod>`. |
+
+### Stack-audit verification
+
+Per the `stack-audit` skill framework — abbreviated since the deep parallel-Explore was done at Phase 1 of this session and produced the entire 10-batch plan we just closed.
+
+**Phase 0 — banned-package grep:**
+```
+grep -nE "@capacitor-firebase/(crashlytics|performance)|@capawesome/capacitor-torch" \
+     package.json website/package.json backend/composer.json
+```
+→ zero hits.
+
+**Phase 1 — detected stack:**
+- Radix UI: yes (14 `@radix-ui/react-*` packages)
+- Firebase: **NO** (removed in plugin v3.0.0 + auth swap 2026-05-11)
+- TanStack Query: yes (admin pages migrated in Batch 5)
+- TanStack Table: no — not used anywhere; admin lists use plain `<Table>` from `components/ui/`. Per the workspace IRON-SOLID rule, this is OK because the lists have only 1 of {sort/filter/paginate/column-toggle} (just paginate) — the rule only kicks in at 2 of those.
+- TanStack Router: no — uses `react-router-dom`
+- TanStack Form: no
+- Capacitor: yes (8.3.1; website wrap)
+- react-hook-form + zod + @hookform/resolvers: yes
+- React: yes (19.x)
+
+### Documentation closure
+
+| File | Change |
+|---|---|
+| `CLAUDE.md` | New 2026-05-16 row in the Audit Record table with full per-batch summary; `Last Updated` bumped 2026-05-06 → 2026-05-16 |
+| `AGENTS.md` | Bumped `Last Updated`; added closure paragraph linking back to `docs/project-audit/2026-05-16/` + the tracker |
+| `docs/tracking/finalization-2026-05-16-tracker.json` | All 10 batches `status: completed`; `lastRun.status='complete'`; `lastRun.completedAt=2026-05-16`; `lastRun.nextAllowedRunAfter=2026-05-23` |
+
+## Final verification (all green)
+
+| Surface | Command | Result |
+|---|---|---|
+| Website | `yarn --cwd website build` | exit 0; 16 per-route SEO HTML files generated; all 9 discovery files present (robots.txt, sitemap.xml, sitemap-index.json, feed.xml, llms.txt, llms-full.txt, ai.txt, humans.txt, .well-known/security.txt) |
+| Website (lint) | `yarn --cwd website lint` | exit 0 |
+| Capacitor sync | `npx cap sync android` | exit 0; 3 plugins detected (`@capacitor/preferences`, `@capacitor/privacy-screen`, `@capawesome/capacitor-app-shortcuts`) |
+| Root plugin | `yarn build` | exit 0; `dist/plugin.{js,cjs.js,esm.js}` produced |
+| Root plugin tests | `yarn test:run` | **62 passed (62)**, 1.59s — was 53/62 at session start |
+| Backend tests | `cd backend && php artisan test --without-tty` | **136 passed (314 assertions), 4.77s** — was 110/110 baseline; net +26 tests |
+| Android gradle | `./gradlew help -q` | exit 0 — config parses (signing + ProGuard configured) |
+
+## Net deltas across the 10-batch flow
+
+| Metric | Before | After |
+|---|---|---|
+| ESLint errors (website) | 11 | 0 |
+| Plugin integration tests | 53/62 | 62/62 |
+| Backend tests | 110/110 | **136/136** (+26 covering OAuth/Sanctum/Roles) |
+| `console.*` outside logger | 18 reported (all template-literal false-positives) | 0 real |
+| `VITE_FIREBASE_*` env keys | 7 stale required keys | 0 |
+| Firestore/Firebase refs in legal pages | 9 | 0 |
+| Firestore refs in Play Store metadata | 3 | 0 |
+| Legal-page Last Updated drift | 141 days (2025-12-27) | 0 (2026-05-16) |
+| Capacitor wrap signing config | none | env-driven via `keystore.properties` (gitignored) |
+| Branded launcher PNGs | 0 | 15 (mipmap-* × 5 densities × 3 variants) |
+| Branded splash PNGs | 0 | 11 (port + land × 5 + root) |
+| Play Store icon PNGs | 0 | 3 (512, 1024, 1024×500 feature graphic) |
+| Documentation pages added | — | 4 (`BUILD_FOR_PLAY_STORE.md`, `CAPTURE-GUIDE.md`, 10 batch session reports, finalization plan + batch plan + findings) |
+| Lines of code changed | — | ~3000 across 60+ files |
+| Commits this session | — | 10 (one per batch, all pushed) |
+
+## User-side actions remaining (cannot be automated)
+
+These are explicit, none deferred or "TBD":
+
+1. **Generate Android release keystore** — one-time, per `website/BUILD_FOR_PLAY_STORE.md` § 2.
+2. **Create / claim the Play Console listing** for `com.aoneahsan.nativeupdate`.
+3. **Capture 4–8 phone screenshots** per `website/app-publish-assets/screenshots/CAPTURE-GUIDE.md`.
+4. **Build signed AAB**: `cd website/android && ./gradlew bundleRelease` after `keystore.properties` is filled.
+5. **Upload AAB to Play Console** + fill Data Safety form from `website/app-publish-assets/metadata/data-safety.md`.
+6. **Backend deploy**: follow `docs/deployment/PRODUCTION-DEPLOY-CHECKLIST.md` (now accurate for the Sanctum stack).
+7. **Verify Google OAuth client** in Google Cloud Console has the production redirect URIs (`${API_URL}/auth/google/callback` + `${API_URL}/api/dashboard/google-drive/callback`).
+8. **Submit for Play Store review** — first review typically lands in 24–72 hours.
+
+## Cooldown contract
+
+- Next allowed re-run of this audit prompt: **2026-05-23**.
+- Override conditions: broken build/tests, production incident, new high-severity CVE in a dependency, major API change, explicit user bypass.
+- If today < `next_allowed_run_after` and none of the overrides fire, the next instance of this prompt MUST skip and surface the cooldown date + the closure summary above.
+
+## Flow CLOSED