native-update 1.4.9 → 3.1.0

package/docs/tracking/finalization-2026-05-16-tracker.json

@@ -0,0 +1,346 @@
+{
+  "$schema": "native-update-finalization-tracker-2026-05-16",
+  "description": "Resumable tracker for the 2026-05-16 finalization audit (Play Store + backend deploy-ready + plugin polish). The first batch with status 'pending' or 'in_progress' is the next thing to work on.",
+  "module": "native-update-finalization-2026-05-16",
+  "createdAt": "2026-05-16",
+  "lastUpdated": "2026-05-16",
+  "planFile": "docs/project-audit/2026-05-16/00-FINALIZATION-PLAN.md",
+  "batchPlanFile": "docs/project-audit/2026-05-16/01-BATCH-PLAN.md",
+  "findingsFile": "docs/project-audit/2026-05-16/02-AUDIT-FINDINGS.md",
+  "sessionsDir": "docs/project-audit/2026-05-16/sessions/",
+  "overview": "Get native-update production-ready for fresh Play Store listing (website wrapped via Capacitor) + Laravel backend deploy-ready + plugin v3.0.1 polished. 10 batches, ONE commit per batch.",
+  "userDecisions": {
+    "androidTarget": "website wrapped via Capacitor (NEW Play Store listing)",
+    "backendDeployment": "deploy-ready only (user does the actual deploy)",
+    "authVerification": "first batch (Google OAuth + Sanctum + Spatie just swapped on 2026-05-11)",
+    "playConsoleState": "fresh listing — no existing keystore reuse",
+    "iOS": "out of scope this session",
+    "automatedTests": "fix existing failures; add coverage for new auth (explicitly requested)",
+    "devServer": "never start dev/preview servers — user runs them"
+  },
+  "knownRisks": [
+    "Sanctum token expiration config bug means tokens never expire today — must fix before any auth-related batch verifies",
+    "Capacitor Preferences token storage is a behavioural change on web — must keep localStorage fallback",
+    "Replacing app icons across mipmap densities requires PNG generation — must use sharp or document ImageMagick command",
+    "ProGuard/R8 enable may break webview if rules are wrong — must keep Capacitor keep-rules"
+  ],
+  "skillsByBatch": {
+    "batch01": ["laravel-specialist", "security-best-practices"],
+    "batch02": ["react-best-practices", "react-19", "vitest"],
+    "batch03": ["capacitor-best-practices", "capacitor-plugins", "capacitor-offline-first"],
+    "batch04": ["laravel-specialist", "security-best-practices"],
+    "batch05": ["tanstack-query-best-practices", "react-best-practices"],
+    "batch06": [],
+    "batch07": ["copywriting", "web-design-guidelines"],
+    "batch08": ["capacitor-app-store", "capacitor-android", "security-best-practices"],
+    "batch09": ["capacitor-splash-screen", "frontend-design"],
+    "batch10": ["ai-seo", "seo", "stack-audit"]
+  },
+  "batches": [
+    {
+      "id": "batch01",
+      "title": "Auth + critical backend fixes",
+      "status": "completed",
+      "estMinutes": 45,
+      "deliverables": [
+        "config/sanctum.php expiration env-driven",
+        "config/logging.php LOG_LEVEL env-driven",
+        "stale Firebase docblocks removed (AdminController, AppPolicy, BuildPolicy)",
+        "/api/dashboard/me intentional no-gate documented inline",
+        "PRODUCTION-DEPLOY-CHECKLIST.md Firebase→Socialite rewrite",
+        "backend/CLAUDE.md stack table + env section updated"
+      ],
+      "verifyCommands": ["cd backend && php artisan test --without-tty"],
+      "verifyResult": "110 passed (258 assertions), 24.42s",
+      "commitMessage": "fix(backend): Batch 1 — Sanctum expiration, LOG_LEVEL, Firebase reference cleanup",
+      "completedAt": "2026-05-16",
+      "commit": "d71aaa7",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-01.md"
+    },
+    {
+      "id": "batch02",
+      "title": "Website build + plugin test fixes",
+      "status": "completed",
+      "estMinutes": 50,
+      "deliverables": [
+        "8 files converted to useCallback pattern (Admin* + Config + GoogleDrive + Settings + Analytics)",
+        "UploadPage handleSubmit ref-during-render fix",
+        "src/web.ts getLocalStorage() safe-accessor + 6 callsite groups refactored",
+        "All 9 plugin integration tests pass"
+      ],
+      "verifyCommands": [
+        "cd website && yarn lint",
+        "cd website && yarn typecheck",
+        "cd website && yarn build",
+        "yarn lint",
+        "yarn build",
+        "yarn test:run"
+      ],
+      "verifyResult": "website lint+typecheck+build clean (16 SEO HTML files); root lint+build clean; tests 62/62 pass (5.58s)",
+      "commitMessage": "fix(build): Batch 2 — rules-of-hooks fixes + plugin localStorage safe-accessor",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-02.md"
+    },
+    {
+      "id": "batch03",
+      "title": "Auth token via Capacitor Preferences",
+      "status": "completed",
+      "estMinutes": 50,
+      "deliverables": [
+        "auth-token.ts rewritten: in-memory cache + async @capacitor/preferences (native) + localStorage (web) + listener-event API",
+        "AuthContext awaits hydrateAuthToken() before deciding state; subscribes to auth-change for instant 401 reaction",
+        "App.tsx kicks off hydrateAuthToken() in parallel with theme hydration",
+        "CallbackPage trimmed — removed duplicate /me round trip; relies on auth-change listener",
+        "401 → axios interceptor → clearAuthToken() → AuthContext listener → setUser(null) → ProtectedRoute → /login (single render cycle)"
+      ],
+      "verifyCommands": [
+        "cd website && yarn lint",
+        "cd website && yarn typecheck",
+        "cd website && yarn build"
+      ],
+      "verifyResult": "lint+typecheck+build all clean; 16 SEO HTML files generated; 9 discovery files present",
+      "commitMessage": "feat(auth): Batch 3 — Capacitor Preferences token storage + 401 auto-redirect",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-03.md"
+    },
+    {
+      "id": "batch04",
+      "title": "Backend OAuth/Sanctum/Roles tests + FormRequest",
+      "status": "completed",
+      "estMinutes": 60,
+      "deliverables": [
+        "OAuthControllerTest.php (9 cases: redirect, callback create+promote+update+suspend+legacy+throw, logout revoke + 401)",
+        "SanctumTokenTest.php (7 cases: header gate, expiration window, revocation, abilities, config wiring)",
+        "RolesPermissionsTest.php (10 cases: seeder roles+idempotency, role-perm wiring, Gate::before, role-assign command additive+revoke+helpers)",
+        "UpdateBuildRequest.php new",
+        "BuildController@update uses UpdateBuildRequest"
+      ],
+      "verifyCommands": ["cd backend && php artisan test --without-tty"],
+      "verifyResult": "136 passed (314 assertions), 6.67s — +26 over baseline 110",
+      "commitMessage": "test(backend): Batch 4 — OAuth/Sanctum/Roles coverage + UpdateBuildRequest",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-04.md"
+    },
+    {
+      "id": "batch05",
+      "title": "Admin + overview pages → TanStack Query",
+      "status": "completed",
+      "estMinutes": 45,
+      "deliverables": [
+        "AdminUsersPage useQuery + URL-state pagination + debounced search + keepPreviousData",
+        "AdminAppsPage same pattern",
+        "AdminBuildsPage useQuery (server-side pagination + client-side filter pending server q support)",
+        "AdminOverview useQuery with select() camelCase transform",
+        "DashboardOverview + UploadPage — already on useQuery; audit caught stale snapshot"
+      ],
+      "verifyCommands": [
+        "cd website && yarn lint",
+        "cd website && yarn typecheck",
+        "cd website && yarn build"
+      ],
+      "verifyResult": "website lint+typecheck+build all clean; 16 SEO HTML files generated",
+      "commitMessage": "refactor(admin): Batch 5 — admin pages on TanStack Query",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-05.md"
+    },
+    {
+      "id": "batch06",
+      "title": "console.* cleanup + Firebase comment sweep",
+      "status": "completed",
+      "estMinutes": 25,
+      "deliverables": [
+        "lib/env.ts — 7 VITE_FIREBASE_* + 2 legacy keys removed; single VITE_API_URL required",
+        ".env.example + vite-env.d.ts verified clean",
+        "Real console.* violations: zero (audit's matches were template-literal code samples)",
+        "website/CLAUDE.md + AGENTS.md rewritten for Socialite + Sanctum stack",
+        "HomePage step-02 'firebase-backend examples' copy rewritten",
+        "Legal-page Firebase content deferred to Batch 7 (correct ownership)"
+      ],
+      "verifyCommands": [
+        "cd website && yarn lint",
+        "cd website && yarn build"
+      ],
+      "verifyResult": "lint+build clean; zero real console.* violations; zero VITE_FIREBASE_* refs",
+      "commitMessage": "chore(website): Batch 6 — drop VITE_FIREBASE_* + Firebase reference sweep",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-06.md"
+    },
+    {
+      "id": "batch07",
+      "title": "Play Store metadata + legal pages cleanup",
+      "status": "completed",
+      "estMinutes": 50,
+      "deliverables": [
+        "full-description.md rewritten — Firestore→Laravel SaaS/self-host narrative",
+        "data-safety.md rewritten — Sanctum tokens, Google OAuth third-party flow, INTERNET-only permissions",
+        "listing-notes.md already clean (no changes)",
+        "PrivacyPage 2026-05-16 + Section 7 (storage/security) + Section 8 (third parties) rewritten end-to-end",
+        "TermsPage 2026-05-16 + Section 9 (third-party services) rewritten",
+        "SecurityPage 2026-05-16 + Authentication Security (6 bullets) + Infrastructure Security (6 bullets) rewritten — removed unverifiable SOC/ISO/SLA claims",
+        "CookiePolicyPage 2026-05-16 + cookies table rewritten (Sanctum token row + Laravel XSRF row) + third-party section rewritten (Google OAuth + PayPal)"
+      ],
+      "verifyCommands": [
+        "cd website && yarn lint",
+        "cd website && yarn build",
+        "grep -i firestore website/src/pages/PrivacyPage.tsx TermsPage.tsx CookiePolicyPage.tsx SecurityPage.tsx",
+        "grep -i firestore website/app-publish-assets/metadata/"
+      ],
+      "verifyResult": "lint+build clean; zero Firestore/Firebase Auth references in legal pages + Play Store metadata",
+      "commitMessage": "docs(legal): Batch 7 — Play Store metadata + Privacy/Terms/Cookies/Security for Sanctum stack",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-07.md"
+    },
+    {
+      "id": "batch08",
+      "title": "Android signing + ProGuard + build guide",
+      "status": "completed",
+      "estMinutes": 55,
+      "deliverables": [
+        "keystore.properties.example template with keytool command + backup advice",
+        "android/.gitignore covers *.jks + *.keystore + keystore.properties",
+        "build.gradle: signingConfigs.release block (env-driven via keystore.properties)",
+        "build.gradle: minifyEnabled=true + shrinkResources=true + proguard-android-optimize.txt",
+        "proguard-rules.pro: Capacitor + WebView JS bridge + cordova + line-number rules",
+        "network_security_config.xml: HTTPS-only prod, localhost cleartext debug",
+        "AndroidManifest: networkSecurityConfig + usesCleartextTraffic=false",
+        "BUILD_FOR_PLAY_STORE.md: 10-section runbook + troubleshooting + file map"
+      ],
+      "verifyCommands": [
+        "cd website && yarn build && npx cap sync android",
+        "cd website/android && ./gradlew help -q"
+      ],
+      "verifyResult": "yarn build + cap sync clean; gradle config parses; assembleDebug deferred (5-10min, runbook covers the user-side commands)",
+      "commitMessage": "feat(android): Batch 8 — signing config + ProGuard + Play Store build runbook",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-08.md"
+    },
+    {
+      "id": "batch09",
+      "title": "App icons + splash + screenshot guide",
+      "status": "completed",
+      "estMinutes": 45,
+      "deliverables": [
+        "15 launcher PNGs rendered from icon-512.svg (5 densities × {ic_launcher, ic_launcher_round, ic_launcher_foreground})",
+        "Adaptive-icon background color flipped from #FFFFFF to brand #1E3A8A",
+        "11 splash PNGs rendered from new splash-master.svg (port + land × 5 densities + root)",
+        "Play Store icon-512.png + icon-1024.png + feature-1024x500.png rendered from SVG sources",
+        "screenshots/CAPTURE-GUIDE.md — 7-section runbook (emulator + real-device workflows, do/don't, file-map)",
+        "npx cap sync android picks up the new assets"
+      ],
+      "verifyCommands": [
+        "cd website && npx cap sync android",
+        "ls website/android/app/src/main/res/mipmap-*/*.png | wc -l"
+      ],
+      "verifyResult": "cap sync clean (3 plugins detected); 15 mipmap PNGs + 11 splash PNGs + 3 Play Store graphics all rendered",
+      "commitMessage": "feat(android): Batch 9 — branded icons + splash + screenshot capture guide",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-09.md"
+    },
+    {
+      "id": "batch10",
+      "title": "SEO refresh + final verification + audit closure",
+      "status": "completed",
+      "estMinutes": 50,
+      "deliverables": [
+        "postbuild-seo.ts: 3× 'Last updated 2026-05-08' → '2026-05-16'",
+        "postbuild-seo.ts: softwareVersion '2.0.0' → '3.0.1' (matches package.json)",
+        "AboutPage + FeaturesPage + PricingPage PAGE_LAST_UPDATED bumped",
+        "sitemap.xml + feed.xml regenerated via yarn build",
+        "Stack-audit verification: banned-package grep clean; stack detection matches expected (Radix, TanStack Query, Capacitor, RHF, no Firebase)",
+        "CLAUDE.md Audit Record: 2026-05-16 row added with full batch summary",
+        "CLAUDE.md + AGENTS.md Last Updated bumped",
+        "Tracker last_run.status flipped to complete; cooldown 2026-05-23"
+      ],
+      "verifyCommands": [
+        "cd website && yarn build",
+        "cd website && npx cap sync android",
+        "yarn build && yarn test:run",
+        "cd backend && php artisan test --without-tty",
+        "grep banned-packages package.json website/package.json"
+      ],
+      "verifyResult": "website build clean (16 SEO HTML); cap sync clean (3 plugins); plugin tests 62/62; backend tests 136/136; banned-package grep zero hits",
+      "commitMessage": "chore(release): Batch 10 — SEO date refresh + audit closure (next allowed run 2026-05-23)",
+      "completedAt": "2026-05-16",
+      "commit": "PENDING_COMMIT_SHA",
+      "sessionReport": "docs/project-audit/2026-05-16/sessions/batch-10.md"
+    }
+  ],
+  "runHistory": [
+    {
+      "date": "2026-05-16",
+      "batch": "batch01",
+      "summary": "Auth-stack cleanup: Sanctum expiration now env-driven (was null → tokens never expired); LOG_LEVEL prod default flipped from debug→warning; Firebase docblocks across AdminController + AppPolicy + BuildPolicy rewritten to spatie/laravel-permission language; deploy checklist firebase env-vars replaced with Sanctum + Google OAuth + ADMIN_EMAILS; backend/CLAUDE.md stack table + env section refreshed. php artisan test → 110/110 still passing.",
+      "commit": "d71aaa7"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch02",
+      "summary": "Website build fixes: 8 dashboard/admin/analytics files migrated to useCallback pattern (audit found 4, lint surfaced 11 errors across 7 files); UploadPage onClick ref-during-render replaced with arrow-wrapped handleSubmit. Plugin tests: src/web.ts gained getLocalStorage() safe-accessor; 6 callsite groups refactored. All 9 previously-failing integration tests now pass. Website lint+typecheck+build clean; root lint+build clean; plugin test:run 62/62 pass.",
+      "commit": "dc9f21f"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch03",
+      "summary": "Auth token storage rewritten: in-memory cache + async Capacitor Preferences (native) / localStorage (web) + listener-event API. AuthContext awaits hydration on boot and subscribes to auth-change events. App.tsx hydrates auth + theme in parallel. CallbackPage simplified (removed duplicate /me round trip). End-to-end 401 → /login redirect now happens automatically in a single render cycle. Lint + typecheck + build all clean.",
+      "commit": "a85a9c1"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch04",
+      "summary": "Backend test coverage for the auth swap: OAuthControllerTest (9), SanctumTokenTest (7), RolesPermissionsTest (10) — 26 new tests, all passing. UpdateBuildRequest FormRequest extracted; BuildController@update now uses it. Mid-batch discovered a config:cache from Batch 1 was masking phpunit.xml env overrides — cleared bootstrap/cache/*. Full suite: 136 passed (314 assertions), 6.67s.",
+      "commit": "df94b7e"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch05",
+      "summary": "Admin pages on TanStack Query: AdminUsersPage, AdminAppsPage, AdminBuildsPage, AdminOverview migrated from useState+useEffect to useQuery with hierarchical query keys (['admin', <entity>, filters]) + URL-synced pagination + debounced search + keepPreviousData. DashboardOverview + UploadPage were already on useQuery (audit caught stale snapshot). Website lint+typecheck+build all clean.",
+      "commit": "90d399e"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch06",
+      "summary": "VITE_FIREBASE_* env wiring removed from lib/env.ts (7 firebase keys + 2 legacy admin keys); .env.example and vite-env.d.ts were already clean. Real console.* violations turned out to be zero — audit's matches were inside template-literal code samples. website/CLAUDE.md + AGENTS.md auth references rewritten end-to-end for Socialite + Sanctum + spatie. HomePage step-02 'firebase-backend examples' copy replaced. Legal pages held for Batch 7. Build clean.",
+      "commit": "a436581"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch07",
+      "summary": "Play Store metadata + legal pages rewritten for the Sanctum stack. full-description.md + data-safety.md + 4 legal pages (Privacy, Terms, Cookies, Security) updated end-to-end: dates bumped to 2026-05-16, Firestore + Firebase Auth content replaced with accurate Google OAuth + Sanctum + Laravel descriptions, SecurityPage's unverifiable SOC/ISO/SLA claims removed in favour of the actual operational baseline (HTTPS, CORS env allowlist, CSP, audit log, open source, self-host option). Zero Firestore/Firebase Auth refs remain. Build clean.",
+      "commit": "73f429b"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch08",
+      "summary": "Android publishing-readiness: signingConfigs.release block (env-driven via keystore.properties), minifyEnabled=true + shrinkResources=true, ProGuard rules expanded for Capacitor + WebView JS bridge + cordova + line numbers, network_security_config.xml (HTTPS-only prod / localhost cleartext debug), AndroidManifest networkSecurityConfig + usesCleartextTraffic=false. keystore.properties.example template + .gitignore tightened. BUILD_FOR_PLAY_STORE.md 10-section runbook with troubleshooting matrix + file map. yarn build + cap sync + gradle help all clean.",
+      "commit": "1865228"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch09",
+      "summary": "Branded assets across the Android wrap: 15 launcher PNGs (mipmap-* × 5 densities × {ic_launcher, ic_launcher_round, ic_launcher_foreground}) rendered from icon-512.svg + icon-adaptive-foreground.svg via rsvg-convert. Adaptive-icon background colour changed from flat #FFFFFF to brand #1E3A8A. 11 splash PNGs (port + land × 5 densities + root drawable) rendered from new splash-master.svg matching capacitor.config.ts splash bg #0A0F1A. Play Store store-listing icons: icon-512.png, icon-1024.png, feature-1024x500.png rendered from SVG sources. screenshots/CAPTURE-GUIDE.md 7-section runbook for the 2–8 phone screenshots the user captures. cap sync clean.",
+      "commit": "be828b1"
+    },
+    {
+      "date": "2026-05-16",
+      "batch": "batch10",
+      "summary": "Final closure: postbuild-seo.ts dates 2026-05-08→2026-05-16 + softwareVersion JSON-LD 2.0.0→3.0.1, AboutPage + FeaturesPage + PricingPage visible dates bumped. Stack-audit Phase 0 verified zero banned packages. Final verification all green: website lint+build clean (16 SEO HTML), cap sync clean (3 plugins), root plugin tests 62/62, backend tests 136/136 (+26 over baseline 110). Root CLAUDE.md Audit Record row added; CLAUDE.md + AGENTS.md Last Updated bumped. Tracker last_run.status='complete'; next_allowed_run_after=2026-05-23 (7-day cooldown).",
+      "commit": "PENDING_COMMIT_SHA"
+    }
+  ],
+  "lastRun": {
+    "status": "complete",
+    "startedAt": "2026-05-16",
+    "completedAt": "2026-05-16",
+    "nextAllowedRunAfter": "2026-05-23",
+    "summary": "10/10 batches complete. Website is Play-Store-publishable (user runs BUILD_FOR_PLAY_STORE.md steps with their keystore); backend is deploy-ready (PRODUCTION-DEPLOY-CHECKLIST.md current); plugin v3.0.1 polished with 62/62 tests; backend 136/136 tests (+26 over baseline). Override conditions for early re-run: broken build/tests, production incident, new high-severity CVE in a dep, major API change, explicit user bypass."
+  },
+  "resumeInstructions": "1) Read this tracker (you are here). 2) Find first 'pending' or 'in_progress' batch in batches[]. 3) Read 00-FINALIZATION-PLAN.md and 01-BATCH-PLAN.md for context. 4) Invoke skills listed under skillsByBatch[batchId]. 5) Do the batch deliverables. 6) Run all verifyCommands and report green/red. 7) ONE commit per batch with the commitMessage. 8) Update tracker: set status='completed', completedAt=today, commit=<sha>. 9) Append a runHistory[] entry: date, batch id, summary, commit sha. 10) Write the per-batch session report at docs/project-audit/2026-05-16/sessions/batch-NN.md."
+}

package/docs/tracking/full-audit-tracker.json

@@ -0,0 +1,121 @@
+{
+  "$schema_version": "1.0.0",
+  "_SUPERSEDED": "This tracker was retired on 2026-05-08. Replaced by docs/tracking/production-readiness-audit-tracker.json which covers the same scope plus multi-batch resumeable execution. Do NOT update this file going forward — only the new tracker. Retained on disk as historical record of audit runs prior to 2026-05-08.",
+  "tracker_purpose": "[RETIRED 2026-05-08] Authoritative record of full-codebase audit runs (code review + SEO + AEO + content) for the native-update monorepo. Used to enforce a 7-day cooldown so the same audit prompt is not re-run prematurely.",
+  "project": "native-update",
+  "scope": [
+    "Code review (real blocker issues, not nice-to-have)",
+    "SEO (technical + on-page + sitemaps + robots + structured data)",
+    "AEO / AIO (LLM discoverability — llms.txt, ai.txt, schema, FAQ blocks, freshness dates)",
+    "Content (marketing copy, in-app text, landing pages, dashboard pages, docs pages)"
+  ],
+  "subprojects_in_scope": [
+    "/ (root plugin)",
+    "src/ (plugin TS source)",
+    "android/ (Kotlin native)",
+    "ios/ (Swift native)",
+    "cli/ (Node CLI)",
+    "backend/ (Laravel 11 + Nova primary backend)",
+    "website/ (Vite React marketing + dashboard)",
+    "example-apps/ (react-capacitor, node-express, firebase-backend)",
+    "docs/"
+  ],
+
+  "policy": {
+    "cooldown_days": 7,
+    "rule": "If 'last_run.completed_at' is within the last 7 days AND 'last_run.status' is 'complete', do NOT re-run the audit. Only update this tracker if a new run is performed.",
+    "override_conditions": [
+      "User explicitly asks to bypass cooldown",
+      "Build is broken (yarn build / yarn test:run / typecheck failing) — fix-only run is allowed",
+      "Production incident requires immediate audit",
+      "New CVE in a critical dependency"
+    ],
+    "on_skip": "Tell the user the date of the last run, the next allowed run date, and a one-line summary of what that run fixed. Do NOT do read-only re-audit work for show.",
+    "fresh_run_steps": [
+      "1. Set 'last_run.status' = 'in_progress' and 'last_run.started_at' = today",
+      "2. Invoke matching skills per RULE #0 (stack-audit, code-reviewer, seo-audit, ai-seo, web-design-guidelines, copywriting, simplify, fix)",
+      "3. Run code review pass — find real blockers across all sub-projects",
+      "4. Run SEO pass — sitemaps, robots, meta, structured data, freshness dates, broken links",
+      "5. Run AEO pass — llms.txt, ai.txt, llms-full.txt, schema.org, FAQ, citation-friendly content",
+      "6. Run content pass — marketing copy, dashboard copy, error messages, empty states, CTAs",
+      "7. Fix every issue found (no 'should I fix?' questions)",
+      "8. Verify yarn build, yarn test:run, yarn lint all pass",
+      "9. Set 'last_run.completed_at' = today, 'last_run.status' = 'complete'",
+      "10. Append a row to 'history' with summary",
+      "11. Update CLAUDE.md + AGENTS.md audit record",
+      "12. ONE commit at the end (per project rule)"
+    ]
+  },
+
+  "last_run": {
+    "started_at": "2026-05-02",
+    "completed_at": "2026-05-02",
+    "completed_by": "Claude Code (Opus 4.7, 1M context)",
+    "status": "complete",
+    "head_commit_after": "847c4b4",
+    "next_allowed_run_after": "2026-05-09",
+    "cooldown_basis": "Git history (commit 847c4b4 on 2026-05-02) plus root CLAUDE.md Audit Record entry for 2026-05-02; this tracker file did not exist before today (2026-05-03) so the previous run was reconstructed from those sources.",
+    "summary": "Full audit pass — code + SEO/AEO + content fixes. See history[0] for details."
+  },
+
+  "current_run": {
+    "started_at": "2026-05-03",
+    "completed_at": "2026-05-03",
+    "completed_by": "Claude Code (Opus 4.7, 1M context)",
+    "status": "skipped_cooldown",
+    "skip_reason": "Last full audit ran on 2026-05-02 (yesterday, commit 847c4b4). Within the user-set 7-day cooldown window. Per the tracker policy, no new audit work performed. This run only created the tracker file itself and wired it into root CLAUDE.md + AGENTS.md so future runs can self-check the cooldown without rebuilding context from git history.",
+    "files_touched_this_run": [
+      "docs/tracking/full-audit-tracker.json (new)",
+      "CLAUDE.md (audit record updated to point at tracker)",
+      "AGENTS.md (audit record added pointing at tracker)"
+    ],
+    "next_allowed_run_after": "2026-05-09"
+  },
+
+  "history": [
+    {
+      "run_id": 1,
+      "started_at": "2026-05-02",
+      "completed_at": "2026-05-02",
+      "head_commit_after": "847c4b4",
+      "summary": "Full audit pass — code + SEO/AEO + content fixes",
+      "fixes": {
+        "code": [
+          "Firestore disconnectDrive atomicity issue resolved",
+          "console.* → centralized logger across services + dashboard pages (no-console rule enforced)"
+        ],
+        "seo_aeo_content": [
+          "ExamplesPage route + nav + sitemap wiring added",
+          "Dead GitHub link fixed",
+          "Stale dates refreshed across humans.txt, llms-full.txt, security.txt, robots.txt",
+          "Broken icon refs fixed in index.html + manifest.json",
+          "Stale 1.4.9 → 2.0.0 corrected in JSON-LD softwareVersion"
+        ],
+        "verifications": [
+          "yarn build — 0 errors",
+          "TypeScript — 0 errors",
+          "Vitest — 89/89 passing",
+          "Features — all complete",
+          "TODOs — none found"
+        ]
+      },
+      "commits": [
+        "847c4b4 — fix: full audit pass — code + SEO/AEO + content fixes"
+      ]
+    },
+    {
+      "run_id": 0,
+      "started_at": "2026-05-03",
+      "completed_at": "2026-05-03",
+      "status": "skipped_cooldown",
+      "summary": "Tracker initialization run. No audit performed (within 7-day cooldown). Created this file and wired it into CLAUDE.md + AGENTS.md.",
+      "commits": []
+    }
+  ],
+
+  "notes": [
+    "This tracker is the SINGLE source of truth for the 7-day cooldown on the full-codebase audit prompt.",
+    "Other narrower trackers (e.g. website/docs/tracking/seo-url-coverage.json, docs/rules-tracker.md) have their own cadences and are not superseded by this one — but if THIS audit is in cooldown, do not re-run those either as part of the same prompt.",
+    "When updating this file, also update root CLAUDE.md + AGENTS.md 'Audit Record' sections to keep dates in sync."
+  ]
+}