native-update 1.4.9 → 3.1.0

package/docs/project-audit/AUDIT-HISTORY.md

@@ -0,0 +1,74 @@
+# Native Update — Audit & Session History
+
+Full chronological record of audits, production-readiness batches, the Docusaurus docs-site batches, and post-closure cleanups. The root `CLAUDE.md` carries only the compact summary + cooldown status; this file holds the verbose per-session detail that was moved out of `CLAUDE.md` on 2026-06-01 to keep that file under the 28 KB harness limit.
+
+## Quick status (as of last close)
+
+| Flow | Status | Cooldown lifts |
+|------|--------|----------------|
+| Production-readiness audit (10 batches) | COMPLETE — shipped 2026-05-08 → 2026-05-11 | 2026-05-18 |
+| Public Docusaurus docs site (10 batches) | COMPLETE — shipped 2026-05-11 | 2026-05-18 |
+| 2026-05-16 Finalization audit (10 batches, Play Store) | COMPLETE | 2026-05-23 |
+| 2026-05-18 Phase A post-closure Firebase/Firestore purge | COMPLETE | n/a (cleanup, not an audit batch) |
+
+Authoritative trackers:
+- `docs/tracking/production-readiness-audit-tracker.json` (replaces retired `docs/tracking/full-audit-tracker.json`)
+- `docs/tracking/finalization-2026-05-16-tracker.json`
+- `docs/docs-site/tracker.json` (Docusaurus site)
+- Audit findings: `docs/project-audit/PRODUCTION-READINESS-AUDIT-2026-05-08.md`
+- Batch plan: `docs/project-audit/BATCH-PLAN.md`
+- 2026-05-16 plan + sessions: `docs/project-audit/2026-05-16/`
+
+## Audit Record (full history)
+
+| Date | Type | Status |
+|------|------|--------|
+| 2026-05-29 | **Weekly portfolio refresh + dependency pass.** Ran `npx npm-check-updates -u` per workspace. Root plugin: `@typescript-eslint/*` 8.59.4→8.60.0 applied; `commander` 14→15 deliberately held at `^14.0.3` because commander v15 raises its Node floor to `>=22.12.0` while this published package advertises `engines.node >=18` — bumping would silently drop Node 18/20 consumers. Backend (`backend/package.json`): `concurrently` 9.2.1→10.0.0 (dev-only Vite runner). Verification: root `yarn tsc` exit 0, `yarn build` (Rollup → 3 dist bundles) exit 0, `yarn lint` exit 0; root + backend `yarn install` reconciled. Fixed stale CLAUDE.md/AGENTS.md facts: yarn `4.10.3`→`4.14.1`, example-apps `3`→`2` (firebase-backend removed in v3.0.0), AGENTS overview `v3.0.0`→`v3.0.1`. New portfolio file written to `ahsan-notebook/.../packages/NATIVE-UPDATE_portfolio-info_2026-05-29.md`. | **COMPLETE (deps current, build/lint/tsc green)** |
+| 2026-05-18 | **Phase A post-closure cleanup — Firebase/Firestore residue purge.** Single-commit follow-up to commits `3a8dda6` / `336f647` / `77b150c`, completing the v3.0.0 architecture decision (Laravel + MySQL is the only backend). Scope: (1) `website/src/pages/ExamplesPage.tsx` — `CODE_FIRESTORE_BACKEND` constant replaced with `CODE_SELF_HOSTED_BACKEND` (Express manifest-endpoint snippet); "Firestore Backend Pattern" entry renamed to "Self-Hosted Backend Pattern" pointing at Express/Laravel/Django/Rails; `usePageSEO` description rewritten. (2) `website/postbuild-seo.ts` — `/examples` description + keywords stripped of "Firestore + Google Drive" / "firestore google drive backend"; replaced with self-hosted manifest backend + laravel backend. (3) Deleted 4 archived no-cost-Firestore guide files: canonical `docs/guides/no-cost-firestore-google-drive-backend.md` + `no-cost-backend-implementation-plan.md` + their `website/public/package-docs/docs/guides/` mirrors. (4) Full rewrite of `docs/project-knowledge-base/{README,01-system-overview,02-routes-pages-forms-users,03-tech-stack-modules-services,04-data-models-integrations,05-docs-corpus-inventory,06-operations-testing-legal-content}.md` — all 7 files refreshed from 2026-03-16 stale-snapshot to 2026-05-18 truth (Sanctum + Laravel + Spatie RBAC + MySQL schema + Nova admin); all `users/{uid}` Firestore doc language replaced with `users` MySQL row keyed by `google_id`; ProtectedRoute/AdminRoute docs updated for Sanctum bearer + `can:` middleware enforcement. (5) `docs/rules-tracker.md` — R-033-FIRESTORE-RULES-INDEXES converted to permanent N/A with justification; R-023/R-024/R-030 dates bumped and stale "Firebase Analytics" / "Firebase Google popup auth" descriptions corrected; sub-project map updated to remove `example-apps/firebase-backend/`; tracker run-history row added for today. Verification: `yarn lint` exit 0 (root + website), `yarn build` exit 0 (root plugin Rollup + website Vite + postbuild-seo 16 per-route HTML + 9 discovery files). Final-pass grep confirms only explicit negative/historical Firebase mentions remain ("no Firestore branch", "do not propose Firebase Storage", `.firebase/hosting.*` gitignore note for Firebase Hosting cache). 2026-05-16 finalization-audit cooldown (until 2026-05-23) unaffected — this is post-closure stale-content cleanup, not a new audit batch. | **COMPLETE (Phase A purge — 0 Firebase/Firestore live references remaining)** |
+| 2026-05-16 | **Finalization audit for Play Store publishing — ALL 10 BATCHES COMPLETE.** User-authorised cooldown bypass of the 2026-05-11 production-readiness audit (override condition #1) to make the website Capacitor-wrapped Play Store publishable + Laravel backend deploy-ready + plugin polished. Scope: every batch from `docs/project-audit/2026-05-16/01-BATCH-PLAN.md`. Batch 1 (backend Sanctum/LOG_LEVEL/Firebase docblock cleanup; 110/110 tests). Batch 2 (11 ESLint rules-of-hooks errors fixed across 8 files + plugin `getLocalStorage()` safe-accessor → 62/62 tests, was 53/62). Batch 3 (auth-token.ts rewritten with @capacitor/preferences + in-memory cache + event-driven 401 auto-redirect). Batch 4 (26 new backend tests across OAuth + Sanctum + Spatie + UpdateBuildRequest FormRequest → 136/136 backend tests). Batch 5 (4 admin pages migrated to TanStack Query with hierarchical keys + URL-state pagination + keepPreviousData). Batch 6 (VITE_FIREBASE_* dropped + Firebase comment sweep + HomePage step-02 fixed). Batch 7 (Play Store full-description.md + data-safety.md rewritten + 4 legal pages updated for Sanctum stack + unverifiable SOC/ISO/SLA claims removed from SecurityPage). Batch 8 (signingConfigs.release + ProGuard/R8 + network_security_config.xml + 10-section BUILD_FOR_PLAY_STORE.md runbook). Batch 9 (15 branded launcher PNGs + 11 splash PNGs + 3 Play Store graphics rendered from SVG via rsvg-convert + screenshots/CAPTURE-GUIDE.md). Batch 10 (PAGE_LAST_UPDATED + JSON-LD softwareVersion 2.0.0→3.0.1 + sitemap regen). Final verification: yarn build (root plugin + website) exit 0, yarn lint exit 0, root yarn test:run 62/62, backend php artisan test 136/136 (+26 over baseline), npx cap sync android clean, gradle config parses. Plan: `docs/project-audit/2026-05-16/00-FINALIZATION-PLAN.md`. Tracker: `docs/tracking/finalization-2026-05-16-tracker.json`. Per-batch session reports under `docs/project-audit/2026-05-16/sessions/batch-01.md` through `batch-10.md`. **Flow CLOSED.** Next allowed re-run: 2026-05-23 (7-day cooldown). Override conditions: broken build/tests, production incident, new high-severity CVE, major API change, explicit user bypass. | **COMPLETE (10/10 — 7-day cooldown until 2026-05-23)** |
+| 2026-05-11 | Production-readiness audit Batch 10 — Final closure + v3.0.1 cut (flow COMPLETE). package.json 3.0.0 → 3.0.1 (patch bump — audit added docs+tooling without changing plugin's public API; SemVer-correct). docs/CHANGELOG.md: new [3.0.1] entry above the existing 3.0.0 entry, with Added (docs site / pentest checklist / perf bench / example-bundle CI / example-app capability cards), Fixed (stale firebase-backend card on ExamplesPage), Documentation (marketing-website findings / MARKETING_WEBSITE_TRACKER supersession / React 18-vs-19 reasoning), Closed (production-readiness audit with 7-day cooldown) sections. Audit tracker last_run.status flipped 'in_progress' → 'complete'; completed_at=2026-05-11; next_allowed_run_after=2026-05-18 (7-day cooldown). All 10 batch entries (1-9 + 5b + 10) carry status='completed'. Verification: yarn lint exit 0; yarn build exit 0 (root plugin); website tsc + build verified at Batch 9 commit. 9 pre-existing test failures in src/__tests__/integration.test.ts persist (vitest node env lacks localStorage; not blocking per fix-only override conditions). Portfolio-info weekly refresh deferred to its own cadence; website in-page changelog deferred to next website touch under the SEO 3-day-plus-commit-delta gate. **Audit flow CLOSED.** Next allowed re-run: 2026-05-18. Override conditions: broken build/tests, production incident, new high-severity CVE, major API change. | **COMPLETE (Audit 10/10 — 7-day cooldown until 2026-05-18)** |
+| 2026-05-11 | Production-readiness audit Batch 9 — Marketing-website tracker close-out (R5). website/src/pages/ExamplesPage.tsx: removed third backendExamples entry advertising the deleted example-apps/firebase-backend (GitHub link 404'd, description contradicted website's own v3 architecture rule); two canonical examples (React + Capacitor, Node + Express) kept; Layers icon import retained (used elsewhere). docs/MARKETING_WEBSITE_TRACKER.md: marked SUPERSEDED with redirect block pointing to current findings doc + per-route SEO coverage tracker + website CLAUDE.md SEO history (file kept for history archaeology, not deleted). docs/project-audit/MARKETING-WEBSITE-FINDINGS-2026-05-11.md: new per-page findings doc — 1 inline fix (ExamplesPage card), 3 deferred follow-ups (stale MDX docs mirror at website/public/package-docs/docs/examples/firebase-backend-example.md, HomePage missing Screenshots/Demo section, DocsPage.tsx 1,406-line size violation), 7 surfaces explicitly cleared (Header/Footer internal links resolve to all registered routes, dashboard empty states across 6 pages, AboutPage CodePush references are correct, JSON-LD version current, console.* migrated to logger). Website tsc --noEmit exit 0; yarn build exit 0 (16 per-route SEO HTML files; 9 discovery files). | In progress (Audit Batch 9/10) |
+| 2026-05-11 | Production-readiness audit Batch 8 — Roadmap features for v3.x (R3 second half + R1 + R2 + R4/I16 + I17). .github/workflows/example-bundle.yml (release+manual+weekly-cron — build example app, sign, attach signed zip + .sig + metadata to GitHub Release; ephemeral-key fallback with warning when NATIVE_UPDATE_EXAMPLE_PRIVATE_KEY secret missing; concurrency-grouped per tag). docs/PERFORMANCE.md (what-dominates-real-world-OTA framing, microbenchmark targets, regression workflow, hot-paths map, what-NOT-covered block). tools/bench/ Vitest microbenchmark scaffold — verify-checksum.bench.ts (SHA-256 over 1/5/20 MB), verify-signature.bench.ts (RSA-2048 + RSA-4096 SHA-256 verify over 5 MB), tools/bench/README.md (3-section methodology). docs/security/PRE-LAUNCH-PENTEST-CHECKLIST.md (~10-section DIY pentest checklist — dep hygiene, authN/authZ, CORS/CSRF, bundle integrity, file safety, data handling, operational safety, mobile platform, 9 specific attack paths). example-apps/react-capacitor/src/App.tsx — 3 new capability cards (App Update getAppUpdateInfo+openAppStore, App Review canRequestReview+requestReview, Background Update toggle with allowMeteredConnection+nextCheckTime status) wired with 5 useState + 3 useCallback + data-testid hooks; App.css extended with .capability-card visual language. example-apps/react-capacitor/README.md — new "React 18 vs React 19" section explaining stable-downstream-target reasoning. eslint.config.js — added tools/bench/** to ignores (bench files are vitest-bench, not production source). yarn lint clean; yarn build clean; example-app tsc + vite build clean (after 3 type-fixes during integration: BackgroundUpdateType.LIVE_UPDATE enum reference, nextCheckTime field, allowMeteredConnection field). Discovered pre-existing finding: 9 src/__tests__/integration.test.ts failures predate this batch (NativeUpdateWeb.loadStoredData reads localStorage in constructor; vitest node env lacks it). Verified via git-stash baseline — NOT a regression. Logged for a future test-infrastructure batch (likely Batch 10 cleanup). | In progress (Audit Batch 8/10) |
+| 2026-05-11 | Docs site Batch 10 — SEO + Firebase deploy + GitHub publish (final batch, flow CLOSED). static/robots.txt with 30+ AI-bot allow list (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended, OAI-SearchBot, anthropic-ai, Claude-Web, Perplexity-User, YouBot, CCBot, Diffbot, cohere-ai, Meta-ExternalAgent, FacebookBot, Amazonbot, MistralAI-User, +traditional search bots) + 8-bot block list; static/llms.txt (9.6KB llmstxt.org index of all 58 pages by Diátaxis quadrant); static/llms-full.txt (15.4KB long-form LLM summary); static/humans.txt; static/.well-known/security.txt (RFC 9116 with 2027 Expires + inline responsible-disclosure policy); static/sitemap-index.json (machine-readable section index complementing sitemap.xml). docusaurus.config.ts: headTags with 3 JSON-LD blocks (WebSite + SoftwareApplication softwareVersion 3.0.0 + Organization), canonical link, theme-color, application-name; themeConfig.metadata extended with description fallback, expanded keywords, max-image-preview:large robots meta, twitter:site, og:locale, og:image:width/height. firebase.json (public=build, cleanUrls, immutable asset Cache-Control, HSTS+CSP-lite security headers); .firebaserc; package.json firebase:emulate/deploy/preview yarn scripts. DEPLOY.md 6-section runbook (gh repo create + Firebase project create + custom domain DNS + recurring deploy + GSC/Bing submission + troubleshooting). yarn typecheck + yarn build green; all 7 discovery files in build/; 3 JSON-LD blocks verified in built index.html. **Docs site flow CLOSED.** tracker.json last_run.status='complete', completed_at=2026-05-11, next_allowed_run_after=2026-05-18 (7-day cooldown). Firebase deploy + GitHub repo creation are documented user-actions in DEPLOY.md (require user-account auth — cannot be agent-automated). | **COMPLETE (Docs site 10/10 — 7-day cooldown until 2026-05-18)** |
+| 2026-05-11 | Docs site Batch 9 — Concepts & explanations (6 pages, ~12,000 words). how-ota-updates-work.md (five-moving-parts framing + 11-step lifecycle + why-this-design covering integrity/atomicity/reversibility); bundle-integrity-and-signing.md (envelope-and-bag metaphor, SHA-256 vs RSA-SHA256 layer split, five-entity trust chain, what signing does NOT protect, RSA algorithm-choice rationale); update-strategies-compared.md (4-strategy comparison + one-line decision tree, per-strategy deep dives, background-orthogonal-to-strategies, what's-not-in-the-model); architecture.md (5-component overview + 3 mermaid diagrams (build-time flowchart, deploy-time sequence, runtime sequence) + trust-boundaries diagram with 4-zone breakdown + SDK-vs-backend versioning intersection rule); security-model.md (3-class threat model, 3-layer defense, explicit in-scope vs out-of-scope, 6 operational assumptions, regulated-industries note); error-handling-philosophy.md (fail-closed-on-correctness vs fail-open-on-availability framing, typed-error-codes everywhere, host-app-must-keep-running rule with safeBootstrapOta pattern, calibration rationale for 60s notifyAppReady window + 30min signed-URL TTL). sidebars.ts wired; commented Batch-9 placeholder removed. yarn build green; all 6 .html files generated under build/concepts/; mermaid theme already enabled. Docs site total now 58 pages (all content sections complete — only final SEO+deploy batch remains). | In progress (Docs site Batch 9/10) |
+| 2026-05-11 | Docs site Batch 8 — Tutorials & How-to guides (8 pages, ~12,800 words). Tutorials: first-ota-update.md (10-step happy-path from install → keypair → bundle → sign → SaaS upload → device verify → ship a visible-change update) and backend-first-walkthrough.md (13-step self-hosted Laravel + Nova: clone/install/migrate/serve/Nova-login/seed-admin-via-tinker/first-App/first-ApiKey/first-SigningKey/wire-app-to-LAN/bundle-sign-upload/device verify). How-to: manage-channels (channel model + setChannel runtime switch + promote patterns); rotate-signing-keys (scheduled multi-key transition with publicKey-as-array + 95%-app-store-adoption gate; emergency-revoke path with expedited-review note; 3 anti-patterns); roll-back-bundle (3-layer: auto crash-rollback via notifyAppReady 60s window, cohort-wide via Rollout%/Is_Active/downgrade-as-latest, explicit per-device rollback API); migrate-from-codepush (App Center retirement, concept-mapping table, 6-step side-by-side migration, sync-option mapping); ci-cd-github-actions (full production workflow with concurrency + umask + verify-as-release-gate + cleanup-always + manual-approval via GitHub Environments); test-bundles-locally (3 loops in increasing fidelity: bundle-verify smoke / dev server / full LAN test). sidebars.ts wired with both new categories; commented Batch-8 placeholders removed. yarn build green; all 8 .html files generated under build/tutorials + build/how-to. Docs site total now 52 pages (only Concepts + final SEO/deploy batches remain). | In progress (Docs site Batch 8/10) |
+| 2026-05-11 | Docs site Batch 7 — Platform guides (3 pages, ~6,000 words). android.md (6 required permissions with sensitive vs non-sensitive breakdown + tools:node='remove' opt-out, manifest-additions <service> + <receiver>, WorkManager constraints NetworkType.UNMETERED/setRequiresBatteryNotLow/setRequiresCharging with Doze + App Standby caveats, Play Core + Play Review with internal-testing-track gotcha, network security config for localhost cleartext, ProGuard rules + likely failure modes, Play Console rejection rules for merged-manifest sensitive permissions + foreground-service notification requirement, smoke tests with adb logcat filters); ios.md (deployment target iOS 14, SPM vs CocoaPods, BGTaskSchedulerPermittedIdentifiers, UIBackgroundModes, NSAppTransportSecurity with localhost exception, PrivacyInfo.xcprivacy template covering UserDefaults CA92.1 + FileTimestamp C617.1, SKStoreReviewController throttling (Apple 3/365 + plugin's knobs), App Store Review Guideline 2.5.2 compliance with WKWebView carve-out and rejection-reason examples, Keychain accessibility level, TestFlight + Xcode debugging including BGTaskScheduler LLDB simulate command); web.md (what-works method-by-method, service-worker update path with full message-passing code, three legitimate use cases, three when-NOT-to-use callouts, browser-support matrix). sidebars.ts wired; commented Batch-7 placeholder removed. yarn build green; all 3 .html files generated under build/platforms/. Docs site total now 44 pages (SDK + CLI + Backend + Platforms sections complete). | In progress (Docs site Batch 7/10) |
+| 2026-05-11 | Docs site Batch 6 — Backend setup guides (5 pages, ~9,200 words). overview.md (when-to-self-host vs SaaS, 3-option matrix, what-stays-the-same invariants); laravel-nova-self-host.md (full env walk-through, ~14-table schema notes, queue-worker systemd unit, 4 storage backends, Firebase token verification + clock-skew gotcha, smoke-test commands); node-express-minimal.md (~160-line ref dissected, contract-mapping with code snippets, what's-missing-for-production callouts); api-contract.md (full wire spec for 6 endpoints with auth/headers/response shapes, error envelope convention, 11 canonical field names callout); nova-admin-overview.md (Content vs Security groups, 5-resource tour with fields/actions/use-cases, 10 Nova Actions table, admin-bypass `before`-hook policy pattern). sidebars.ts wired; commented Batch-6 placeholder removed. yarn build green; all 5 .html files generated under build/backend/. Docs site total now 41 pages (SDK + CLI + Backend sections complete). | In progress (Docs site Batch 6/10) |
+| 2026-05-11 | Docs site Batch 5 — CLI Reference (9 pages, ~6,500 words). overview.md (install, when-to-use matrix, quick-start workflow, exit codes, default-artifact-locations, what-CLI-does-NOT-do, FAQ); init.md (4-prompt interactive flow, generated config shape, common errors); keys-generate.md (RSA 2048/4096 + EC P-256/P-384 matrix, chmod 600 private key, rotation guidance); bundle-create.md (flags, refused-bundle list for safety, success output sample, reproducibility note); bundle-sign.md (RSA-SHA256, .sig sidecar JSON shape, CI workflow, PEM-error catalogue); bundle-verify.md (sidecar lookup convention, CI release-gate pattern, step-by-step verification flow); server-start.md (4 endpoints documented, localhost-vs-LAN caveat for devices); monitor.md (dashboard preview, /api/stats response shape, 5s polling + 5-failure bail, SIGINT/SIGTERM handling); backend-create.md (express/firebase/vercel, SCAFFOLD_BANNER explained, TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY] grep workflow, when-NOT-to-use guidance pointing to example-apps/node-express + backend/). sidebars.ts wired; commented Batch-5 placeholder removed. yarn build green; all 9 .html files generated under build/reference/cli/. Docs site total now 36 pages. | In progress (Docs site Batch 5/10) |
+| 2026-05-08 | Batch 7 — env-sync + repo-public runbook + URL-state sweep + CI yarn fix + release workflow. backend/.env.example per-var GOOGLE/PAYPAL comments; website/.env.example + 3 `VITE_NATIVE_UPDATE_*` rows; new `docs/SECURITY-IF-REPO-PUBLIC.md` (preventive runbook ~250 lines); 4 dashboard pages migrated to URL state via `lib/hooks/useUrlState.ts` (extended with useUrlEnumState + useClearUrlParams); duplicate hook removed via consolidation. `.github/workflows/ci.yml` rewritten npm→yarn (corepack, node 20, yarn 4); `.github/workflows/release.yml` created (tag-driven npm publish with provenance + GitHub Release). | In progress (Batch 7/10) |
+| 2026-05-08 | Batch 6 — website UI/UX polish (I4 + I5 + I6). Dialog.tsx migrated to @radix-ui/react-dialog (public API preserved across all 6 call sites; gains role/aria-modal/focus-trap/ESC/portal for free). New `src/hooks/useUrlState.ts` (5 helpers); AppsPage delete + form dialogs converted from useState to `?formMode/?editId/?deleteId` URL state. Zero per-page Query overrides confirmed via grep; canonical cache-contract doc in App.tsx. yarn typecheck + yarn build green. | In progress (Batch 6/10) |
+| 2026-05-08 | Batch 5b — AboutPage rewrite + postbuild-seo body-injection. AboutPage extended to ≥1000 words with definition-first intro, project history timeline, audience cards, 7-entry FAQ, tips, author/date, plus AboutPage+Person+FAQPage JSON-LD. postbuild-seo gained a `bodyContent` field that injects a semantic-HTML `<noscript>` block right after `<div id="root">` so AI crawlers without JS see real content. Static HTML word counts: /features 1492→1956, /pricing 1457→1897, /about (thin)→1913. | In progress (Batch 5b/10) |
+| 2026-05-08 | Batch 5 — SEO/AEO content enrichment (I7 partial, I8, I9). FeaturesPage + PricingPage rewritten to ≥1000 unique words each with definition-first intro, use cases, HowTo steps, FAQ (7+8), tips, author, lastUpdated, plus JSON-LD (SoftwareApplication / FAQPage / HowTo / Product with 3 Offers showing real $0/$29/$199 tiers). Created `website/public/pricing.md` machine-readable pricing. Feed.xml `lastBuildDate` now emits runtime stamp. AboutPage rewrite + postbuild-seo body-injection deferred to Batch 5b. Static HTML: /features 1492 words, /pricing 1457 words. | In progress (Batch 5/10) |
+| 2026-05-08 | Batch 4 — centralized logger + plugin polish + CLI scaffold (I1, I2, I3, B2). 9 live `console.*` in src/web.ts + src/core/event-emitter.ts → Logger; ConsoleAnalyticsProvider documented as architectural exception. iOS Capacitor SDK workaround comment added. CLI backend-create.js: 8 TODOs → `TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]` greppable markers; SCAFFOLD_BANNER injected into 3 entry-point templates; post-generation warning. yarn lint+build exit 0, 62/62 tests still pass. | In progress (Batch 4/10) |
+| 2026-05-08 | Batch 3 — backend tests + FormRequests + auto-create flag (B5, I14, I11, I10) + pre-existing test fix + storage_path bug fix. New: 4 FormRequest classes, 2 test files (BundleUploadTest 7 cases + UserLicenseTest 5 cases), `native_update.firebase_auto_create` config flag. Refactored AppController/ApiKeyController/BuildController to use FormRequests. php artisan test 117/117 passing (was 104/105). | In progress (Batch 3/10) |
+| 2026-05-08 | Batch 2 — backend security hardening + deploy runbook (B4, I12, I13, H1, I15, B6, N4, N5). New policies (User/Build/ApiKey/SigningKey/App admin-bypass) + AuthServiceProvider; Nova/User.php canSee guards; backend/config/cors.php with env-driven allowlist; PayPal webhook Feature test (4 cases); docs/deployment/PRODUCTION-DEPLOY-CHECKLIST.md. php artisan test 104/105 passing (1 pre-existing failure unrelated to this batch). yarn lint exit 0, 62/62 plugin tests still passing. | In progress (Batch 2/10) |
+| 2026-05-08 | Production-readiness audit kickoff + Batch 1 — created `docs/project-audit/PRODUCTION-READINESS-AUDIT-2026-05-08.md` (39 items + 5 roadmap), `docs/project-audit/BATCH-PLAN.md` (10 batches), `docs/tracking/production-readiness-audit-tracker.json` (resumeable, 7-day cooldown). Retired `docs/tracking/full-audit-tracker.json`. Batch 1 fixes: package.json `files` += android/manifest-additions.xml; cli/commands/monitor.js (interval/spinner cleanup, signal handlers, failure bail); rollup.config.js duplicate `comments` key removed; example-apps/react-capacitor/README.md firebase-backend refs replaced with node-express + Laravel pointers + standalone-install instructions. yarn lint exit 0, yarn build exit 0, 62/62 tests pass. | In progress (Batch 1/10) |
+| 2026-05-04 | v3.0.0 — Firestore removed from plugin SDK + website; Laravel-only backend; +preferences/me/analytics/rollouts dashboard endpoints; deleted `example-apps/firebase-backend/`, `src/firestore/`, `website/src/types/firestore.ts`, `website/src/types/index.ts`. yarn build + 62/62 tests + website tsc all green. Commits 1b82d48, 4ce5a78. | Passed |
+| 2026-05-03 | Full audit re-run requested → SKIPPED (7-day cooldown, last run 2026-05-02) | Skipped |
+| 2026-05-02 | Full audit + fixes (code, SEO, AEO, content) | Passed |
+| 2026-04-25 | Generic Project Rules Master Pass (R-001→R-039) | Passed |
+| 2026-04-24 | Website SEO/AEO/AIO Full Pass | Passed |
+| 2026-03-28 | Laravel Backend + Nova | Passed |
+| 2026-03-24 | Portfolio + Docs Refresh | Passed |
+| 2026-02-02 | Package Update | Passed |
+| 2026-01-23 | Full Audit | Passed |
+
+**Last Audit Details (pre-v3 baseline):** Package manager (yarn confirmed), Build (0 errors), TypeScript (0 errors), Tests (89/89 passing), Features (all complete), TODOs (none found). Code/SEO/Content audit found and fixed: Firestore disconnectDrive atomicity, console.* → logger across services + dashboard pages, ExamplesPage route + nav + sitemap wiring, dead GitHub link, stale humans.txt/llms-full.txt/security.txt/robots.txt dates, broken icon refs in index.html + manifest.json, stale 1.4.9 → 2.0.0 in JSON-LD softwareVersion. Generic Project Rules tracker at `docs/rules-tracker.md`.
+**Last Verified:** 2026-05-02 | **Next Audit Due:** 2026-05-16
+
+## Re-run procedures (moved from CLAUDE.md)
+
+### Production-readiness audit
+- Read `docs/tracking/production-readiness-audit-tracker.json` FIRST. If `last_run.status == "complete"` AND today < `last_run.next_allowed_run_after`, SKIP — tell the user the date and what completed. If `in_progress`, find the lowest-numbered batch with `status != "completed"` in `batches[]` and resume there. Do NOT redo earlier batches.
+- Per-batch: invoke RULE #0 skills → apply fixes per `BATCH-PLAN.md` → run that batch's verification → ONE commit per batch → update tracker.
+- Final closure: set `last_run.status = "complete"`, `completed_at = today`, `next_allowed_run_after = today + 7 days`. Sync this history + CLAUDE.md summary in the same commit.
+- Override conditions: explicit user bypass, broken build/tests, production incident, critical-dep CVE.
+
+### Public Docusaurus docs site
+- Sibling repo: `/home/ahsan/Documents/01-code/projects/native-update-docs/` (remote `github.com/aoneahsan/native-update-docs`, created by user via `gh repo create`).
+- Hosting: Firebase Hosting project `native-update-docs` (deployed by user via `yarn firebase:deploy`).
+- Dev port: 5960 (preview 5961) — registered in `~/.dev-ports.json` as `native-update-docs`.
+- Tracker: `docs/docs-site/tracker.json`; scope: `docs/docs-site/scope.md`; plan: `docs/docs-site/plan.md` (10 batches); deploy runbook: `native-update-docs/DEPLOY.md`.
+- Re-run protocol: read tracker FIRST; same cooldown/resume logic as the production audit. ONE commit per batch in each affected repo.
+- Why a separate repo: plugin source GitHub is private; a public docs repo gives an additional indexable surface, satisfies AI-bot crawl access, and lets contributors propose doc fixes without plugin-source access.
+- Site totals at last close (Batch 10): 58 pages, ~76k words, full Diátaxis coverage (Tutorials + How-to + Reference + Explanation), 7 discovery files (robots/llms/llms-full/humans/security/sitemap-index/sitemap), 3 JSON-LD blocks per page (WebSite + SoftwareApplication + Organization), Firebase Hosting deploy-ready.

package/docs/project-audit/BATCH-PLAN.md

@@ -0,0 +1,168 @@
+# Production-Readiness Batch Plan
+
+**Created:** 2026-05-08
+**Source audit:** `docs/project-audit/PRODUCTION-READINESS-AUDIT-2026-05-08.md`
+**Tracker:** `docs/tracking/production-readiness-audit-tracker.json`
+
+## Batching philosophy
+
+Each batch groups items that:
+1. Share a domain (so context loads once, not many times)
+2. Can be verified together with one build/test/lint pass
+3. Aren't too small (wastes overhead) and aren't too large (risks context exhaustion / partial-batch state)
+
+Each batch ends with: `yarn lint` + `yarn typecheck` + `yarn build` + `yarn test:run` clean (plus `php artisan test` for backend batches), then ONE commit per batch (per project rule), then tracker update.
+
+---
+
+## Batch 1 — npm-publish + immediate-ship blockers (THIS SESSION)
+
+**Goal:** every fix here unblocks shipping v3.0.x.
+
+| ID | Severity | Fix |
+|---|---|---|
+| B1 | Blocker | Add `"android/manifest-additions.xml"` to `package.json` `files` array |
+| B3 | Blocker | `cli/commands/monitor.js`: capture interval ID, install SIGINT/SIGTERM handlers, `clearInterval` + `spinner.stop()` on exit, bail on N consecutive failures |
+| B7 | Blocker | Decide example-apps lockfile strategy: declare workspaces in root `package.json` OR document standalone `cd example-apps/react-capacitor && yarn install` flow |
+| B8 | Blocker | Strip `firebase-backend` references from `example-apps/react-capacitor/README.md` (lines 14, 101, 210); replace with `node-express` only |
+| N1 | Nit (free with ✏️) | `rollup.config.js`: remove duplicate `comments` key |
+
+**Verification:** `yarn lint && yarn build && yarn test:run` from root + `cd example-apps/react-capacitor && yarn install` succeeds.
+**Commit message:** `fix(release): unblock v3.0.x publish — manifest-additions in files, monitor cleanup, example lockfile, README v3 cleanup`
+
+---
+
+## Batch 2 — Backend security hardening (high-value, single domain)
+
+| ID | Severity | Fix |
+|---|---|---|
+| B4 | Blocker | Add Nova policies (`canViewAny`/`canCreate`/`canUpdate`/`canDelete`) for User, App, Build, ApiKey, SigningKey resources; register in `AuthServiceProvider` |
+| I12 | Important | Wrap Nova User admin panels (Suspend, License, Custom Limits) with `canSee(fn ($req) => $req->user()->isAdmin())` |
+| I13 / H1 | Important / Sec-High | Publish `config/cors.php`; lock `paths` to `['api/*']`, `allowed_origins` to explicit list (`nativeupdate.aoneahsan.com` + `localhost:5942`/`5944`/`5946`) |
+| I15 | Important | Confirm + test PayPal webhook is CSRF-exempt; add Feature test that POST to webhook with valid signature succeeds |
+
+**Verification:** `cd backend && php artisan test && composer dump-autoload`.
+**Commit message:** `fix(backend): Nova authorization gates, CORS lockdown, PayPal webhook test`
+
+---
+
+## Batch 3 — Backend bundle/license tests + FormRequests + deploy runbook
+
+| ID | Severity | Fix |
+|---|---|---|
+| B5 | Blocker | Feature test for bundle upload + signature verify + monotonic version + duplicate detection + chunk merge (`tests/Feature/Build/BundleUploadTest.php`) |
+| I14 | Important | Feature test for `User::hasValidLicense()` and a paid-tier-gated endpoint |
+| I11 | Important | Extract inline validators to `app/Http/Requests/*Request.php`; use `$this->authorize()` |
+| I10 | Important | Add config flag `auth.firebase.auto_create` (default `true` to preserve current behavior); document in deploy runbook |
+| B6 | Blocker | Create `docs/deployment/PRODUCTION-DEPLOY-CHECKLIST.md`: APP_DEBUG=false, LOG_LEVEL=warning, APP_ENV=production, key:generate, config:cache, migrate --force, queue daemon, composer install --no-dev |
+| N4 / N5 | Nit | Add comments in `backend/.env.example` recommending Redis for cache + queue daemon for prod |
+
+**Verification:** `cd backend && php artisan test`.
+**Commit message:** `feat(backend): bundle/license tests, FormRequests, production deploy runbook`
+
+---
+
+## Batch 4 — Centralized logger + plugin polish
+
+| ID | Severity | Fix |
+|---|---|---|
+| I1 | Important | Replace 18 `console.*` in `src/web.ts` with `Logger.{warn,error}`; replace `console.error` in `src/core/event-emitter.ts:52`. Verify via `grep -rEn "\bconsole\." src --include="*.ts" \| grep -v "src/utils/logger"` returns zero |
+| I2 | Important | Add `// CAPACITOR-SDK-WORKAROUND:` comment block in `ios/Plugin/NativeUpdatePlugin.swift:72-75` referencing Capacitor 8.x |
+| I3 | Important | Reconcile `cli/templates/express/` against `example-apps/node-express/` so the scaffold ships working code |
+| B2 | Blocker | For each TODO in `cli/commands/backend-create.js` (8 sites), either implement or prepend generated file with `// SCAFFOLD — implement before deploying` banner + doc reference |
+
+**Verification:** `yarn lint && yarn build && yarn test:run`.
+**Commit message:** `refactor(plugin): centralized logger in web.ts/event-emitter, CLI scaffold parity, iOS workaround docs`
+
+---
+
+## Batch 5 — SEO/AEO content enrichment (3 marketing pages + pricing.md + feed fix)
+
+This is the largest batch. Treat as multi-page content batch per global playbook §13.
+
+| ID | Severity | Fix |
+|---|---|---|
+| I7 | Important | Rewrite `FeaturesPage.tsx`, `AboutPage.tsx`, `PricingPage.tsx` to ≥1000 unique words each: definition-first intro (80-120 words), 3-5 use cases (50-80 words), 4-6 HowTo steps (30-40 words), 2-3 examples, 5-8 FAQ, 3-6 tips, author + lastUpdated. Wire into `postbuild-seo.ts` so the static HTML carries the same body. Use `ai-seo` + `copywriting` skills. |
+| I8 | Important | Create `website/public/pricing.md` machine-readable file: tiers, limits, FAQ, in plain markdown. Linked from llms.txt. |
+| I9 | Important | Fix `website/scripts/generate-sitemap.mjs` so feed `<lastBuildDate>` and sitemap `<lastmod>` use `new Date().toUTCString()` / `new Date().toISOString()` at build time. |
+
+**Verification:** `cd website && yarn build` (postbuild-seo step verifies prerendered HTML); manually open three prerendered HTML pages in `dist/` and confirm `<noscript>` body has the rich content.
+**Commit message:** `feat(seo): per-page rich SEO content for Features/About/Pricing + pricing.md + feed-date fix`
+
+---
+
+## Batch 6 — Website UI/UX polish (a11y dialog + URL state)
+
+| ID | Severity | Fix |
+|---|---|---|
+| I4 | Important | Migrate `website/src/components/ui/Dialog.tsx` to `@radix-ui/react-dialog`. Update all import sites. |
+| I5 | Important | Convert `AppsPage.tsx:50,55` and any other dashboard `useState` modal/form state to URL search params (`?deleteId=ID`, `?formMode=create\|edit&appId=ID`). Use the project's `useUrlState` hook family. Sweep all dashboard pages. |
+| I6 | Important | Audit per-page TanStack Query `staleTime`/`gcTime` overrides; document the cache contract in a code comment in `App.tsx`. |
+
+**Verification:** `cd website && yarn typecheck && yarn build`; manual: open `/dashboard/apps?deleteId=test` in incognito, confirm dialog opens; reload, confirm dialog still open; close, confirm URL param drops.
+**Commit message:** `refactor(website): Radix Dialog migration, URL state for dashboard modals, query cache audit`
+
+---
+
+## Batch 7 — env-sync + security preventive docs
+
+| ID | Severity | Fix |
+|---|---|---|
+| M1 | Sec-Med | Add one-line "where to get this" note next to each individual PayPal/Google sub-var in `backend/.env.example` |
+| M2 | Sec-Med | Add `VITE_NATIVE_UPDATE_PUBLIC_BACKEND_URL`, `VITE_NATIVE_UPDATE_API_KEY`, `VITE_NATIVE_UPDATE_PUBLIC_KEY` rows (as `[OPTIONAL]`) to `website/.env.example` |
+| H2 | Sec-High preventive | Create `docs/SECURITY-IF-REPO-PUBLIC.md` runbook: rotate every committed secret, add patterns to .gitignore, audit history with git-filter-repo |
+
+**Verification:** none beyond docs-only changes; quick grep confirms env-example coverage.
+**Commit message:** `docs(security): env-example sync + repo-public runbook`
+
+---
+
+## Batch 8 — Roadmap features for v3.x release
+
+| ID | Severity | Fix |
+|---|---|---|
+| R3 | Roadmap | Create `.github/workflows/release.yml`: on tag, run `yarn build:prod`, `yarn test:run`, then `npm publish --provenance` |
+| R3 | Roadmap | Create `.github/workflows/example-bundle.yml`: scheduled+manual; create signed bundle from `example-apps/react-capacitor`, attach to release |
+| R4 / I16 | Important | Expand `example-apps/react-capacitor/src/App.tsx` to demo: download/apply update, app-update check, app-review prompt, background-update toggle, signature verify. One section per method. |
+| I17 | Important | React 18 vs 19 decision: bump to 19 + verify build (recommended) OR add explicit "stable downstream target" note in README. |
+| R1 | Roadmap | Performance-benchmarking scaffold: `tools/bench/` with Vitest-based microbench for bundle-verify + signature-verify hot paths. Doc in `docs/PERFORMANCE.md`. |
+| R2 | Roadmap | `docs/security/PRE-LAUNCH-PENTEST-CHECKLIST.md`: dep audit, manual auth/CSRF/CORS check, signature-verify fuzz, license-bypass attempts. |
+
+**Verification:** `cd example-apps/react-capacitor && yarn build && yarn lint`; root `yarn test:run`; CI workflows: `actionlint .github/workflows/*.yml` if available.
+**Commit message:** `feat(release): GitHub Actions release workflow, example-app coverage, perf bench scaffold, pentest checklist`
+
+---
+
+## Batch 9 — Marketing-website tracker (rendered-on-live-pages items)
+
+| ID | Severity | Fix |
+|---|---|---|
+| R5 | Roadmap | Sweep `docs/MARKETING_WEBSITE_TRACKER.md` for `[ ]` items that ARE actually rendered as gaps on live pages (not "future feature ideas"). Convert each to a small per-page issue. Examples to look for: missing screenshots in `Screenshots`/`Demo` section, stale code-snippet copy in `DocsPage`, dashboard onboarding flow polish, footer links to non-existent routes. |
+
+**Verification:** depends on what surfaces.
+**Commit message:** `chore(website): close out marketing-tracker rendered-page gaps`
+
+---
+
+## Batch 10 — Final consolidated pass + version bump + portfolio refresh
+
+| ID | Fix |
+|---|---|
+| — | Bump root `package.json` version (3.0.0 → 3.0.1 if all batches done; 3.1.0 if any roadmap features added) per project version-cascade rule |
+| — | Update `docs/CHANGELOG.md` + `website` changelog page + portfolio info file (weekly cadence anyway) |
+| — | Final `yarn lint && yarn typecheck && yarn build && yarn test:run` from root, `cd website && yarn build`, `cd backend && php artisan test`. All clean. |
+| — | Update root `CLAUDE.md` + `AGENTS.md` `Audit Record` table; tracker → `status: complete`, `completed_at`, `next_allowed_run_after = +7 days` |
+| — | One commit + push |
+
+**Verification:** all green.
+**Commit message:** `chore(release): v3.0.1 — production-readiness audit batches 1-9 complete`
+
+---
+
+## Resume rules (also encoded in tracker JSON)
+
+1. On every run of this prompt, the FIRST action is `cat docs/tracking/production-readiness-audit-tracker.json`.
+2. If `last_run.status == "complete"` and `today < last_run.next_allowed_run_after`, SKIP. Tell the user the date and what was completed last time. Don't redo finished work.
+3. If `last_run.status == "in_progress"`, find the lowest-numbered batch with `status != "completed"` and resume there.
+4. After completing each batch: update tracker `batches[N].status = "completed"`, append a `history` entry, commit.
+5. After the final batch: set `last_run.status = "complete"`, `last_run.completed_at = today`, `last_run.next_allowed_run_after = today + 7 days`. ONE final commit.

package/docs/project-audit/MARKETING-WEBSITE-FINDINGS-2026-05-11.md

@@ -0,0 +1,73 @@
+# Marketing Website — Per-Page Findings (Batch 9 sweep)
+
+This document captures the **rendered-on-live-pages gaps** found by sweeping the React marketing+dashboard site at `website/` on 2026-05-11. It is the deliverable for production-readiness audit Batch 9 (item R5).
+
+This is **not** a sweep of `docs/MARKETING_WEBSITE_TRACKER.md` — that file is a stale planning artifact from 2025-12-27 (created before the live site shipped, never updated as features landed; 236 items still marked `[ ]` while the corresponding code is in production). The tracker file is now annotated as superseded — see its header note.
+
+The findings below are grouped by page. Each item names the file, the live URL where the gap would be visible to a user today, and a concrete fix. Trivial issues are fixed inline in the Batch 9 commit; non-trivial items are listed as follow-ups for future maintenance.
+
+Maintained by Ahsan Mahmood. Audit date: 2026-05-11.
+
+## Fixed in this batch (commit alongside this doc)
+
+### `ExamplesPage.tsx` — stale `firebase-backend` example card
+
+- **Live URL**: `https://nativeupdate.aoneahsan.com/examples`
+- **File**: `website/src/pages/ExamplesPage.tsx` lines 189-198 (third entry in the `backendExamples` array)
+- **Problem**: The card advertised an `example-apps/firebase-backend` example with a GitHub source link and an in-app docs link. The underlying directory was removed in v3.0.0 (per audit history 2026-05-04), so the GitHub URL 404s. The description also mentioned "Firestore manifests," contradicting the website's own architecture rule that forbids importing `firebase/firestore` since v3.0.0 (`website/CLAUDE.md`).
+- **Fix applied**: Removed the third entry from the `backendExamples` array. The two canonical v3 examples (React + Capacitor, Node + Express) remain. `Layers` icon import retained — still used elsewhere in the file (line 228).
+- **Risk if left**: Users land on `/examples`, click "View Source on GitHub" for the third card, get a GitHub 404, lose trust.
+
+## Follow-ups (not blocking; track for a future maintenance batch)
+
+### Stale MDX docs files mirrored under `website/public/package-docs/`
+
+- **File path**: `website/public/package-docs/docs/examples/firebase-backend-example.md` (plus copies under `website/dist/`, `website/android/app/...`, `website/ios/App/App/...`)
+- **Problem**: The Markdown file documenting the now-removed Firebase backend example is still present in the static-assets pipeline. It is no longer linked from the live React pages (after this batch's ExamplesPage fix), but it is still served at `/package-docs/docs/examples/firebase-backend-example.md` if someone has a direct link.
+- **Recommended action**: Delete the source file at `website/public/package-docs/docs/examples/firebase-backend-example.md`. The `dist/` and platform-mirror copies regenerate from `public/` on every build, so deleting the source clears them downstream. Verify after deletion that the docs-routing index in `DocsMarkdownPage.tsx` doesn't return a broken card for the missing file.
+- **Why deferred**: Touching `public/package-docs/` requires re-running the docs-content sync that produced those files, plus regenerating the Android / iOS asset bundles. That's a larger blast radius than fits in Batch 9.
+
+### HomePage has no Screenshots / Demo section
+
+- **Live URL**: `https://nativeupdate.aoneahsan.com/`
+- **File**: `website/src/pages/HomePage.tsx`
+- **Observation**: The 393-line HomePage renders Hero → Features → How-It-Works → CTA. There is no `Screenshots` or `Demo` section. Zero `<img>` or `<video>` tags in the entire file.
+- **Why this is a gap**: The marketing site is selling a UI-heavy product (a dashboard, OTA progress on a device). Visitors who don't already know what the dashboard looks like leave without seeing the actual product surface. This pattern is the single highest-converting block on competitive SaaS landing pages.
+- **Recommended action**: Add a "See it in action" section between How-It-Works and CTA. Three SVG-only mockup tiles is enough: a dashboard "uploads" view, a device showing the in-app update prompt, and a Nova admin panel snapshot. SVG keeps file sizes small and avoids the PNG/JPG-screenshot maintenance treadmill that breaks on every UI tweak.
+- **Why deferred**: Building three good-looking SVG mockup tiles is a half-day of design work, not a Batch 9 inline fix. Logging as a follow-up so it's not lost.
+
+### `DocsPage.tsx` is 1,406 lines
+
+- **Live URL**: `https://nativeupdate.aoneahsan.com/docs`
+- **File**: `website/src/pages/DocsPage.tsx`
+- **Observation**: The file violates the project-wide "Max 500 lines/file" rule from the global CLAUDE.md. Most of the content is large code-snippet string literals — ~10 large snippets embedded inline rather than imported from separate files.
+- **Recommended action**: Extract code-snippet strings into `website/src/data/docs-snippets/` (one file per snippet). The page then becomes a thin renderer over the data. This reduces churn on the page when snippets change.
+- **Why deferred**: Not a rendered-page gap — visitors don't see the line count. Pure maintainability concern; lower priority than the user-facing items above.
+
+## Items reviewed and confirmed healthy (no action needed)
+
+The sweep also confirmed the following are NOT gaps:
+
+| Surface | Status |
+|---|---|
+| Header.tsx internal links | All 4 `<Link to=...>` targets (`/dashboard`, `/login`, `/signup`) resolve to registered routes in `src/router.tsx`. |
+| Footer.tsx internal links | All 19 `<Link to=...>` targets resolve to registered routes. Includes `/sitemap`, `/feed`, `/security`, `/permissions`, `/data-deletion`, `/cookies`, `/privacy`, `/terms` — every legal page is wired up. |
+| Dashboard empty states | 6 dashboard pages (AppsPage, AppDetailPage, DashboardOverview, ConfigPage, UploadPage) have explicit empty-state UI with "create your first app" / "upload your first build" copy. Onboarding flow exists. |
+| `firebase-backend` references in user-facing copy | Only one remaining in `AboutPage.tsx` line 57-58 — a FAQ entry "Why build another OTA solution? What about CodePush?" mentioning CodePush, not firebase-backend. Correct (CodePush is a real third-party reference, not a deleted internal example). |
+| CodePush references | All current and contextually correct (the migration story is part of the marketing message; CodePush's March 2025 retirement is fact). |
+| Version strings in JSON-LD | Audit Record entry 2026-05-02 confirms softwareVersion was bumped to current. |
+| `console.*` calls in src/ | Audit Record entry 2026-05-02 confirms migration to `src/lib/logger.ts`. |
+
+## How to use this doc
+
+This is a snapshot. Re-run the per-page sweep when:
+
+- A new public page ships (re-check footer + sitemap coverage)
+- A feature is removed (re-grep for any references that point at it)
+- Before a major release (it pairs with the [Pre-Launch Pentest Checklist](/home/ahsan/Documents/01-code/projects/native-update/docs/security/PRE-LAUNCH-PENTEST-CHECKLIST.md))
+
+The findings format intentionally avoids GitHub issue creation here — when the project goes public, items in the "Follow-ups" section above are good first issues to open against the public repo.
+
+## Authored by
+
+Ahsan Mahmood — author and maintainer of `native-update`.