native-update 2.0.0 → 3.1.0

package/docs/play-store/README.md

@@ -0,0 +1,27 @@
+# Play Store Docs — Native Update
+
+Start here. Every Play Store submission file is linked below.
+
+**App:** Native Update · `com.aoneahsan.nativeupdate` · v3.0.1  
+**Play Store:** https://play.google.com/store/apps/details?id=com.aoneahsan.nativeupdate  
+**Full spec:** `~/.claude/rules/play-store-submission.md`
+
+---
+
+## Files in this folder
+
+| File | Purpose |
+|------|---------|
+| [RELEASE-NOTES.md](./RELEASE-NOTES.md) | **Play Store "What's New" — open this first.** Per-version release notes, latest-first. Copy the latest entry into Play Console. |
+| [STORE-LISTING.md](./STORE-LISTING.md) | App title, short description, full description. |
+| [DECLARATIONS.md](./DECLARATIONS.md) | All 10 Play "App content" declarations (answer key). |
+| [DATA-SAFETY.md](./DATA-SAFETY.md) | Data Safety form answers. |
+| [RELEASE-STEPS.md](./RELEASE-STEPS.md) | User-only build + Play Console upload steps. |
+| [SUBMISSION-CHECKLIST.md](./SUBMISSION-CHECKLIST.md) | Pre-upload checklist. |
+| [ASO-METADATA.md](./ASO-METADATA.md) | Internal brand/ASO reference (not store-facing). |
+
+## Related
+
+- **Raw image assets:** `app-publish-assets/` (icons, feature graphics, screenshots) — _not yet created; see `~/.claude/rules/play-store-submission.md` Phase 5._
+- **Resumable tracker:** `docs/features/play-store-submission/00-tracker.json` — _not yet created._
+- **Developer changelog:** [docs/CHANGELOG.md](../CHANGELOG.md)

package/docs/play-store/RELEASE-NOTES.md

@@ -0,0 +1,99 @@
+# Release Notes — Native Update (Play Store "What's New")
+
+Per-version Play Store release notes, latest-first.
+Single source of truth — copy the latest entry into the Play Console "What's New" field (≤500 chars).
+
+Related: developer changelog at [docs/CHANGELOG.md](../CHANGELOG.md).
+
+---
+
+## v3.1.0 — July 2026
+
+- Faster update checks: server hot path optimized (deferred analytics writes, cached build lookup, covering index).
+- Web platform no longer re-downloads a bundle to validate it after download.
+- Modern package exports map — cleaner imports in every bundler, deep imports still work.
+- Faster website landing page (animation engine now loads in the background).
+- Maintenance: analytics data pruning, dependency/config cleanup, documentation fixes.
+
+---
+
+## v3.0.1 — May 2026
+
+- New public documentation site at docs.nativeupdate.aoneahsan.com (58 pages: SDK reference, CLI, backend, tutorials).
+- Security checklist and performance benchmark docs added.
+- CI workflow now builds, signs, and publishes an example OTA bundle on every GitHub Release.
+- Example app demonstrates App Update, App Review, and Background Update features.
+- Minor website fix: removed a stale example card that linked to a deleted directory.
+
+---
+
+## v3.0.0 — May 2026
+
+- Backend simplified: Firestore backend removed. Plugin now speaks HTTP to a single backend (serverUrl + apiKey).
+- Breaking: apps using the Firestore branch must migrate to serverUrl — see MIGRATION.md.
+- Website dashboard auth migrated to Laravel Socialite (Google OAuth) + Sanctum bearer tokens.
+
+---
+
+## v2.0.0 — April 2026
+
+- Boot-time bundle re-verification: on every cold start the plugin re-hashes the active OTA bundle. Mismatch triggers automatic rollback.
+- Channel-based encryption removed; signature + checksum verification is the integrity model.
+- setUpdateUrl() deprecated (no-op); pass serverUrl to initialize() instead.
+
+---
+
+## v1.4.9 — March 2026
+
+- Firestore-backed manifest reads via backendType: 'firestore'.
+- Secure manifest lookup via apiKeys/{apiKey}/manifests/{channel}.
+- No-cost backend guide: website + Firestore + Google Drive.
+
+---
+
+## v1.4.5 — February 2026
+
+- All dependencies updated to latest versions.
+- Full verification suite passing (81 tests, 0 lint warnings).
+- Android Gradle build verified. Release-ready state confirmed.
+
+---
+
+## v1.0.7 — January 2025
+
+- Fixed critical Android build issues: Google Play app-update library version pinned to 2.1.0.
+- Resolved kotlinVersion resolution errors.
+- All Google Play Services dependencies now use explicit versions.
+
+---
+
+## v1.0.6 — January 2025
+
+- Android build fixes: corrected Play app-update library version, fixed kotlinVersion MissingPropertyException.
+- Documentation corrections: API method signatures, event names, and broken links fixed.
+
+---
+
+## v1.4.0 — January 2025
+
+- Complete TypeScript rewrite with strict typing and modular architecture.
+- Comprehensive error handling, security validation framework, and bundle management.
+- Background update support. Plugin initialization system.
+
+---
+
+## v0.0.2 — December 2024
+
+- Bundle signing and security utilities.
+- CI/CD pipeline with GitHub Actions.
+- Example update-server implementation. TypeScript strict mode. ESLint v9 flat config.
+
+---
+
+## v0.0.1 — January 2024
+
+- Initial release.
+- Live/OTA update: download, bundle management, update strategies (immediate, background, manual), delta updates, automatic rollback, update channels, end-to-end encryption, SHA-256/512 checksums.
+- Native app update: Play Store version checking, immediate and flexible update flows, direct app store navigation.
+- In-app review: native review prompts with smart triggering and rate limiting.
+- iOS (Swift) and Android (Kotlin) implementations. Web fallback.

package/docs/play-store/RELEASE-STEPS.md

@@ -0,0 +1,6 @@
+# Release Steps — Native Update (User-Only)
+
+Populate via `~/.claude/rules/play-store-submission.md` (Phase 6) when preparing a release.
+
+This file lists user-only build + Play Console upload steps (commands and clicks, not release-note text).
+The agent prepares all data, copy, and assets; the user performs the signed AAB build + Play Console upload.

package/docs/play-store/STORE-LISTING.md

@@ -0,0 +1,7 @@
+# Store Listing — Native Update
+
+Populate via `~/.claude/rules/play-store-submission.md` (Phase 3) when preparing a release.
+
+Includes: app name (≤30 chars), short description (≤80 chars), full description, and a link to RELEASE-NOTES.md for "What's New".
+
+See [RELEASE-NOTES.md](./RELEASE-NOTES.md) for the latest "What's New" entry.

package/docs/play-store/SUBMISSION-CHECKLIST.md

@@ -0,0 +1,5 @@
+# Submission Checklist — Native Update
+
+Populate via `~/.claude/rules/play-store-submission.md` (Phase 7) when preparing a release.
+
+Pre-upload checklist covering: permissions, store listing, declarations, assets, legal pages, and release build.

package/docs/production-readiness.md

@@ -29,7 +29,7 @@
 >    - Private key management (for bundle signing)
 >    - Encryption key management (for encrypted bundles)
 >
-> **GETTING STARTED**: See the example backends in `/example-apps/node-express` and `/example-apps/firebase-backend` for reference implementations.
+> **GETTING STARTED**: For reference implementations see [`/example-apps/node-express`](../example-apps/node-express) (lean Node.js / Express reference) and [`/backend`](../backend) (Laravel 13 + Nova canonical SaaS backend powering the hosted Native Update service — usable as managed or self-hosted).
 
 This comprehensive checklist ensures your Capacitor Native Update implementation is ready for production deployment. Follow these guidelines to deliver a secure, reliable, and performant update system.
 

package/docs/project-audit/2026-05-16/00-FINALIZATION-PLAN.md

@@ -0,0 +1,123 @@
+# Native Update — Project Finalization Plan
+
+**Date opened:** 2026-05-16
+**Goal:** Get the Native Update repo (plugin + website + backend + Android wrap) production-ready for a fresh Google Play Store listing of the website wrapped via Capacitor, with the marketing site live, the Laravel SaaS backend deploy-ready, and the NPM plugin shippable.
+
+**Audit owner:** Claude (Opus 4.7) in continuous-batch mode under the user's `01-code` workspace rules.
+
+---
+
+## What the user asked for
+
+1. **Audit the entire project**, ignoring the previous audit's 7-day cooldown.
+2. **Fix everything** that's wrong, missing, or partial — no TODOs, no "coming soon", no deferred items.
+3. **Complete every feature** end-to-end across web, Android, backend, and plugin.
+4. **Polish UI/UX** for the website + admin/dashboard so the Android wrap feels native.
+5. **Confirm SEO/AEO** + static content quality on the marketing site.
+6. **Comply with the Generic Project Rules master prompt** at `~/Documents/ahsan-notebook/static/assets/txt-files-important/generic-project-rules.md` where they apply to this project.
+7. **Batch the work** at 40–60 minutes per batch with 1–3 tasks each, validation + verification + commit + push per batch.
+8. **Resume-safe** with markdown plans + JSON tracker + per-batch session reports.
+9. **Use the right skills** at every batch boundary (planning, working, validating).
+
+## Key user-confirmed constraints
+
+| Constraint | Value |
+|---|---|
+| Android publish target | **The website wrapped via Capacitor** (NEW Play Store listing, fresh keystore). NOT example-apps. |
+| Backend deployment | **Deploy-ready only** — code complete, runbook clean, user does the actual deploy. |
+| Auth verification | **First batch** — Google OAuth + Sanctum + Spatie RBAC was just swapped (commit 8eaf4de, 2026-05-11). Verify end-to-end. |
+| Play Console state | **Fresh listing** — no existing keystore reuse. |
+
+---
+
+## Scope: what's in / out
+
+### IN scope this run
+
+- **`backend/`** (Laravel 11 + Nova 5 + Sanctum + Spatie + Socialite) — deploy-readiness fixes, tests for the new auth, FormRequest consistency, stale Firebase reference cleanup.
+- **`website/`** (React + Vite + Radix + TanStack Query + Capacitor 8.3.1) — ESLint hooks-rules fixes, Capacitor Preferences token storage, admin page TanStack-Query migration, console.* cleanup, Play-Store metadata cleanup, signing config + ProGuard, branded icons, SEO date refresh, legal page refresh.
+- **Root plugin (`src/`, `android/`, `ios/`)** — integration test localStorage fix, version + JSON-LD sync.
+- **Play Store launch assets** under `website/app-publish-assets/` — Firestore references purged, screenshots-capture runbook documented.
+- **Master CLAUDE.md + AGENTS.md** synchronisation at root and `website/`.
+
+### OUT of scope this run
+
+- Actual `firebase deploy` of the website (user does it after batches close).
+- Actual production-host SSH deploy of Laravel (deploy-ready only).
+- Generating real screenshot PNGs (user captures from a running emulator/device).
+- Generating a release keystore file (user does that locally with `keytool`).
+- iOS publishing (Android is the only platform requested this session).
+- Docs site at `native-update-docs/` (closed-out 2026-05-11, separate cooldown).
+
+---
+
+## Batch summary
+
+10 batches, each 40–60 min, 1–4 concrete tasks. Full task list with file paths in [`01-BATCH-PLAN.md`](./01-BATCH-PLAN.md).
+
+| # | Batch | Focus | Verification |
+|---|---|---|---|
+| 1 | Auth + critical backend fixes | Sanctum expiry, `/me` gating, LOG_LEVEL, stale Firebase comments | `php artisan test` green |
+| 2 | Website build fixes | 4 ESLint hooks-rules errors + 9 plugin test failures | `yarn build` + `yarn lint` + `yarn test:run` green |
+| 3 | Auth token via Capacitor Preferences | Token storage swap, 401 auto-redirect | yarn typecheck + manual auth walkthrough |
+| 4 | Backend coverage tests | OAuth, Sanctum, Roles tests + UpdateBuildRequest FormRequest | `php artisan test` higher count, all green |
+| 5 | Admin pages → TanStack Query | 3 admin pages + 2 dashboard pages | yarn build clean, query keys consistent |
+| 6 | Console.* cleanup | 2 ExamplesPage call sites + Firebase comment sweep | grep proves zero real violations |
+| 7 | Play Store metadata + legal pages | Strip Firestore refs, refresh Privacy/Terms/Cookies/Security | grep zero "firestore" in metadata + legal |
+| 8 | Android signing + ProGuard + build guide | build.gradle signing block, minifyEnabled, BUILD_FOR_PLAY_STORE.md | `./gradlew assembleDebug` clean |
+| 9 | App icons + splash + screenshot guide | Branded mipmap-* icons, splash bg, screenshot capture runbook | `cap sync` + visual check |
+| 10 | SEO refresh + final verification + audit closure | Dates bump, JSON-LD version sync, sitemap regen, CLAUDE.md update | All 3 build commands green |
+
+---
+
+## Skills invoked per phase
+
+Per RULE #0 (highest priority), the matching skill is invoked **before** any code edits in each phase:
+
+| Phase | Skills |
+|---|---|
+| Planning (this doc) | `writing-plans`, `stack-audit` |
+| Batch 1 — auth + backend | `laravel-specialist`, `firebase-auth-basics` (legacy ref check), `security-best-practices` |
+| Batch 2 — build fixes | `react-best-practices`, `react-19` (rules-of-hooks), `vitest` |
+| Batch 3 — Capacitor Preferences | `capacitor-best-practices`, `capacitor-plugins`, `capacitor-offline-first` |
+| Batch 4 — backend tests | `laravel-specialist`, `security-best-practices` |
+| Batch 5 — TanStack migration | `tanstack-query-best-practices`, `react-best-practices` |
+| Batch 6 — console cleanup | (trivial — covered by file-edit pre-check) |
+| Batch 7 — metadata + legal | `copywriting`, `web-design-guidelines` |
+| Batch 8 — Android signing | `capacitor-app-store`, `capacitor-android`, `security-best-practices` |
+| Batch 9 — icons + splash | `capacitor-splash-screen`, `frontend-design` |
+| Batch 10 — SEO closure | `ai-seo`, `seo`, `stack-audit` |
+
+---
+
+## Resume contract
+
+If this conversation is compacted or restarted:
+
+1. Read `docs/tracking/finalization-2026-05-16-tracker.json` (single source of truth for resume state).
+2. Find the lowest-numbered batch with `status != "completed"` in `batches[]`. That's where we resume.
+3. Read this plan (`00-FINALIZATION-PLAN.md`) + the batch plan (`01-BATCH-PLAN.md`) + the matching session report under `sessions/`.
+4. Invoke the matching skills for the batch domain (per the table above).
+5. Apply the batch's fixes per `01-BATCH-PLAN.md`.
+6. Run that batch's verification command list.
+7. ONE commit per batch with the message specified in the batch plan.
+8. Update the tracker (`status: "completed"`, `completed_at: today`, append `runHistory[]` row with commit SHA + 2–3 line summary).
+9. Write the session report under `docs/project-audit/2026-05-16/sessions/batch-NN.md`.
+
+Do **NOT** redo batches that are already `status: "completed"`. The tracker is authoritative — trust it.
+
+---
+
+## Definition of done (whole audit)
+
+- All 10 batches `status: "completed"` in the tracker
+- `yarn build` (root + website) returns exit 0 with no warnings beyond the documented 3rd-party suppressions
+- `yarn lint` (root + website) returns exit 0
+- `yarn test:run` (root) returns all-green
+- `php artisan test` (backend) returns all-green with strictly more tests than the baseline
+- `./gradlew assembleDebug` (website/android) returns success
+- A signed `app-release.aab` can be produced by following `website/BUILD_FOR_PLAY_STORE.md` (user runs this step)
+- Zero `console.*` calls outside `src/utils/logger.ts` / `src/lib/logger.ts` (excluding doc code blocks)
+- Zero `Firestore` / `Firebase Auth` references in `app-publish-assets/` and current legal pages
+- Updated portfolio info file, CLAUDE.md + AGENTS.md, and tracker close-out
+- ONE commit per batch, all pushed to `main`

package/docs/project-audit/2026-05-16/01-BATCH-PLAN.md

@@ -0,0 +1,227 @@
+# Batch Plan — 2026-05-16 Finalization
+
+Each batch: 40–60 min, 1–4 tasks, one commit, verification commands, session report under `sessions/batch-NN.md`.
+
+---
+
+## Batch 1: Auth + critical backend fixes
+
+**Skills:** `laravel-specialist`, `security-best-practices`
+
+| # | File | Change |
+|---|---|---|
+| 1.1 | `backend/config/sanctum.php:53` | `'expiration' => null` → `'expiration' => env('SANCTUM_TOKEN_EXPIRATION', 10080)` |
+| 1.2 | `backend/routes/api.php:119` | Verify `/api/dashboard/me` GET intentionally has no `can:` gate (any authenticated user reads own profile) — add inline comment documenting this is by design |
+| 1.3 | `backend/config/logging.php:64,71` | Default log level `'debug'` → `env('LOG_LEVEL', 'warning')` for both `single` and `daily` channels |
+| 1.4 | `backend/app/Http/Controllers/Admin/AdminController.php:8` | Replace "Firebase `admin: true` claim" docblock with "Spatie super-admin role via spatie/laravel-permission" |
+| 1.5 | `backend/app/Policies/AppPolicy.php:11` + `backend/app/Policies/BuildPolicy.php:4` | Same Firebase → Spatie docblock fix |
+| 1.6 | `backend/app/Policies/AppPolicy.php:15` | Add `?bool` return type to `before(User $user, string $ability)` |
+| 1.7 | `backend/.env.example` | Add inline comments above `ADMIN_EMAILS=` explaining first-signer auto-promotion behaviour |
+| 1.8 | `docs/deployment/PRODUCTION-DEPLOY-CHECKLIST.md:34–35, 137` | Replace Firebase env var references with `GOOGLE_CLIENT_ID`/`GOOGLE_CLIENT_SECRET`/`GOOGLE_REDIRECT_URI`/`ADMIN_EMAILS` |
+
+**Verify:** `cd backend && php artisan test --without-tty` — all green (baseline 110/110). Then `php artisan config:clear && php artisan route:list` to confirm no booted-config errors.
+
+**Commit:** `fix(backend): Batch 1 — Sanctum expiration, LOG_LEVEL, Firebase reference cleanup`
+
+---
+
+## Batch 2: Website build + plugin test fixes
+
+**Skills:** `react-best-practices`, `react-19`, `vitest`
+
+| # | File | Change |
+|---|---|---|
+| 2.1 | `website/src/pages/dashboard/ConfigPage.tsx:~43` | Move async `loadApps()` declaration above the `useEffect` that calls it OR wrap in `useCallback` and add to deps array properly |
+| 2.2 | `website/src/pages/dashboard/GoogleDrivePage.tsx:~37` | Same pattern fix for `loadData()` |
+| 2.3 | `website/src/pages/dashboard/SettingsPage.tsx:~72` | Same pattern fix for `loadUserData()` |
+| 2.4 | `website/src/pages/dashboard/UploadPage.tsx:~363` | Fix ref usage — don't pass a ref-created callback into `handleSubmit()` during render; declare the submit handler with `useCallback` or hoist it |
+| 2.5 | `src/__tests__/integration.test.ts` (root plugin) | Add `beforeEach` localStorage polyfill OR move `loadStoredData()` out of constructor / make it idempotent / guard `typeof window === 'undefined'` |
+
+**Verify:**
+- `cd website && yarn lint` → exit 0 (currently 11 errors)
+- `cd website && yarn typecheck` → exit 0
+- `cd website && yarn build` → exit 0
+- `yarn test:run` (root) → 62/62 passing (currently 53/62)
+
+**Commit:** `fix(build): Batch 2 — rules-of-hooks fixes + plugin test localStorage polyfill`
+
+---
+
+## Batch 3: Auth token via Capacitor Preferences
+
+**Skills:** `capacitor-best-practices`, `capacitor-plugins`, `capacitor-offline-first`
+
+| # | File | Change |
+|---|---|---|
+| 3.1 | `website/src/lib/auth-token.ts` | Refactor to async API backed by `@capacitor/preferences` with `localStorage` fallback on web. Replace synchronous getters with async or boot-time hydrated cache. |
+| 3.2 | `website/src/lib/api.ts` | Update axios/fetch interceptor to read token from new async helper; cache token in memory for sync access during requests |
+| 3.3 | `website/src/context/AuthContext.tsx` | On boot, hydrate token from Preferences before flipping `loading=false` so the BootLoader keeps showing |
+| 3.4 | `website/src/pages/auth/CallbackPage.tsx` | Write token via new async helper, await before navigating |
+| 3.5 | `website/src/lib/api.ts` (401 handler) | On 401, clear token + push a global event/store flag that `AuthContext` listens to → redirect to `/login` automatically |
+
+**Verify:**
+- `cd website && yarn typecheck && yarn build` → clean
+- Read-only manual review: trace the login → callback → API → 401 path for completeness
+
+**Commit:** `feat(auth): Batch 3 — Capacitor Preferences token storage + 401 auto-redirect`
+
+---
+
+## Batch 4: Backend OAuth/Sanctum/Roles tests + FormRequest
+
+**Skills:** `laravel-specialist`, `security-best-practices`
+
+| # | File | Change |
+|---|---|---|
+| 4.1 | `backend/tests/Feature/OAuthControllerTest.php` (new) | Test cases: redirect issues correct Socialite URL; callback creates new user with `user` role; callback assigns `super-admin` if email in `ADMIN_EMAILS`; callback returns redirect to frontend with `?token=...`; existing user re-login refreshes attributes; token has expected abilities |
+| 4.2 | `backend/tests/Feature/SanctumTokenTest.php` (new) | Test cases: protected route rejects no token; protected route accepts valid token; expired token is rejected (use `Carbon::setTestNow`); abilities are honoured; `tokenCan()` works correctly |
+| 4.3 | `backend/tests/Feature/RolesPermissionsTest.php` (new) | Test cases: seeder is idempotent (run twice → same state); super-admin bypass works via Gate::before; admin cannot bypass; user lacks admin permissions |
+| 4.4 | `backend/app/Http/Requests/UpdateBuildRequest.php` (new) | Extract validation from `BuildController@update` into FormRequest |
+| 4.5 | `backend/app/Http/Controllers/Dashboard/BuildController.php` | Replace inline `$request->validate(...)` with `UpdateBuildRequest $request` |
+
+**Verify:** `cd backend && php artisan test --without-tty` — strictly more tests than baseline 110, all green.
+
+**Commit:** `test(backend): Batch 4 — OAuth/Sanctum/Roles coverage + UpdateBuildRequest`
+
+---
+
+## Batch 5: Admin pages → TanStack Query
+
+**Skills:** `tanstack-query-best-practices`, `react-best-practices`
+
+| # | File | Change |
+|---|---|---|
+| 5.1 | `website/src/pages/admin/AdminUsersPage.tsx:29–46` | Replace `useEffect`+`useState` with `useQuery` (queryKey `['admin','users',page,perPage,q]`), URL-state pagination, optimistic invalidation on role-change mutation |
+| 5.2 | `website/src/pages/admin/AdminAppsPage.tsx:24–41` | Same pattern: `useQuery` with `['admin','apps',page,perPage]` |
+| 5.3 | `website/src/pages/admin/AdminBuildsPage.tsx:24–41` | Same pattern: `useQuery` with `['admin','builds',page,perPage,status]` |
+| 5.4 | `website/src/pages/dashboard/DashboardOverview.tsx:20–34` | Replace `fetchRecentBuilds` raw Promise.all with `useQuery` |
+| 5.5 | `website/src/pages/dashboard/UploadPage.tsx:49–63` | Replace raw apps-list fetch with `useQuery` |
+
+**Verify:**
+- `cd website && yarn typecheck && yarn lint && yarn build` clean
+- Confirm React Query Devtools (already wired) show consistent query keys
+
+**Commit:** `refactor(admin): Batch 5 — admin + overview pages on TanStack Query`
+
+---
+
+## Batch 6: console.* cleanup + Firebase comment sweep
+
+**Skills:** (trivial pre-check sufficient)
+
+| # | File | Change |
+|---|---|---|
+| 6.1 | `website/src/pages/ExamplesPage.tsx:63,67` | Replace `console.*` with `logger.debug/error` |
+| 6.2 | `website/src/pages/dashboard/SettingsPage.tsx:78–87` | Remove stale Firebase terminology in comments |
+| 6.3 | `website/src/pages/dashboard/ConfigPage.tsx` | Remove stale Firebase comment headers / unused imports |
+| 6.4 | `website/src/lib/env.ts` | Drop `VITE_FIREBASE_*` keys (Firebase Auth removed per CLAUDE.md). Keep only what code still consumes. |
+| 6.5 | `website/.env.example` | Sync `.env.example` with `env.ts` — remove VITE_FIREBASE_* rows |
+| 6.6 | `website/src/vite-env.d.ts` | Drop VITE_FIREBASE_* type declarations |
+
+**Verify:**
+- `grep -rEn "\\bconsole\\.(log|info|debug|trace|warn|error|table|time|timeEnd|group|groupCollapsed|groupEnd)\\(" website/src --include="*.ts" --include="*.tsx" | grep -v "/lib/logger.ts" | grep -v "/pages/DocsPage.tsx"` → zero matches
+- `grep -rEn "firebase|firestore" website/src --include="*.ts" --include="*.tsx" -i | grep -v "// historical"` → zero non-historical matches
+
+**Commit:** `chore(website): Batch 6 — console.* via logger + Firebase reference cleanup`
+
+---
+
+## Batch 7: Play Store metadata + legal pages cleanup
+
+**Skills:** `copywriting`, `web-design-guidelines`
+
+| # | File | Change |
+|---|---|---|
+| 7.1 | `website/app-publish-assets/metadata/full-description.md` | Replace "Firestore project" prose with accurate "self-hosted Laravel + Sanctum backend (or our managed SaaS)" description |
+| 7.2 | `website/app-publish-assets/metadata/data-safety.md` | Strip Firestore reference (line 34); declare Laravel backend + Google Drive + FilesHub storage truthfully |
+| 7.3 | `website/app-publish-assets/metadata/listing-notes.md` | Refresh; remove Firebase Auth language; describe Google OAuth flow accurately |
+| 7.4 | `website/src/pages/PrivacyPage.tsx` | Update content + lastUpdated date to 2026-05-16; describe Google OAuth + Sanctum + Spatie correctly; remove Firebase Auth references |
+| 7.5 | `website/src/pages/TermsPage.tsx` | Update lastUpdated to 2026-05-16; minor content refresh |
+| 7.6 | `website/src/pages/CookiePolicyPage.tsx` | Update lastUpdated; verify cookies list is accurate (no Firebase cookies anymore) |
+| 7.7 | `website/src/pages/SecurityPage.tsx` | Update lastUpdated; verify security architecture description matches current backend |
+
+**Verify:**
+- `grep -rEn -i "firestore" website/app-publish-assets/` → zero matches
+- `grep -rEn -i "firebase auth|firebase.auth" website/src/pages/PrivacyPage.tsx website/src/pages/TermsPage.tsx` → zero matches
+
+**Commit:** `docs(legal): Batch 7 — Play Store metadata + Privacy/Terms refresh for Laravel backend`
+
+---
+
+## Batch 8: Android signing + ProGuard + build guide
+
+**Skills:** `capacitor-app-store`, `capacitor-android`, `security-best-practices`
+
+| # | File | Change |
+|---|---|---|
+| 8.1 | `website/android/keystore.properties.example` (new) | Template file showing required keys: `storeFile`, `storePassword`, `keyAlias`, `keyPassword` |
+| 8.2 | `website/android/.gitignore` | Ensure `keystore.properties` and `*.keystore` / `*.jks` are excluded |
+| 8.3 | `website/android/app/build.gradle` | Add `signingConfigs.release` block reading from `../keystore.properties` if present, falling back to debug keystore for dev; reference it from `buildTypes.release` |
+| 8.4 | `website/android/app/build.gradle:21` | `minifyEnabled false` → `minifyEnabled true` for release; add `shrinkResources true` |
+| 8.5 | `website/android/app/proguard-rules.pro` | Verify Capacitor + WebView rules are present (add `-keep class com.getcapacitor.** { *; }` and similar baseline rules) |
+| 8.6 | `website/android/app/src/main/res/xml/network_security_config.xml` (new) | Production-friendly config; allows cleartext only on debug for localhost ranges |
+| 8.7 | `website/android/app/src/main/AndroidManifest.xml` | Reference network_security_config + ensure `android:usesCleartextTraffic="false"` on application |
+| 8.8 | `website/BUILD_FOR_PLAY_STORE.md` (new) | Full runbook: keytool keystore generation, keystore.properties setup, `yarn build && cap sync && ./gradlew bundleRelease` walkthrough, where to find AAB, signing-key backup advice |
+
+**Verify:**
+- `cd website/android && ./gradlew assembleDebug` → BUILD SUCCESSFUL
+- `git check-ignore website/android/keystore.properties` → file ignored (path returned)
+- AAB build is documented but NOT run (requires user-provided keystore)
+
+**Commit:** `feat(android): Batch 8 — signing config + ProGuard + Play Store build runbook`
+
+---
+
+## Batch 9: App icons + splash + screenshot guide
+
+**Skills:** `capacitor-splash-screen`, `frontend-design`
+
+| # | File | Change |
+|---|---|---|
+| 9.1 | `website/app-publish-assets/icons/icon-1024.png` (new) | Render 1024×1024 from `icon-512.svg` (use a Node script with `sharp` OR document the user-side ImageMagick command) |
+| 9.2 | `website/android/app/src/main/res/mipmap-*/ic_launcher*.png` | Replace default Capacitor icons with rendered native-update branding across all densities (mdpi/hdpi/xhdpi/xxhdpi/xxxhdpi) |
+| 9.3 | `website/android/app/src/main/res/drawable*/splash.png` (or vector equivalent) | Replace splash with branded splash matching `#0A0F1A` BG + logo |
+| 9.4 | `website/capacitor.config.ts` | Verify SplashScreen plugin config — `backgroundColor`, `launchShowDuration` set correctly |
+| 9.5 | `website/app-publish-assets/screenshots/CAPTURE-GUIDE.md` (new) | Step-by-step user runbook: run app on emulator → capture 4–8 screenshots (login, dashboard overview, apps list, upload form, bundle detail, settings, theme customizer, sitemap page) at 1080×1920 minimum |
+
+**Verify:**
+- `cd website && yarn build && npx cap sync android` → success
+- `find website/android/app/src/main/res/mipmap-* -name "*.png" -exec ls -la {} \;` → all branded, non-zero sizes
+- Visual eyeball of `mipmap-xxxhdpi/ic_launcher.png` confirms branding
+
+**Commit:** `feat(android): Batch 9 — branded icons + splash + screenshot capture guide`
+
+---
+
+## Batch 10: SEO refresh + final verification + audit closure
+
+**Skills:** `ai-seo`, `seo`, `stack-audit`
+
+| # | File | Change |
+|---|---|---|
+| 10.1 | `website/postbuild-seo.ts:17` | `PAGE_LAST_UPDATED` → `'2026-05-16'` |
+| 10.2 | `website/postbuild-seo.ts:431` | `softwareVersion: '2.0.0'` → `'3.0.1'` |
+| 10.3 | `website/src/pages/AboutPage.tsx`, `FeaturesPage.tsx`, `PricingPage.tsx` | Bump visible `Last updated` date strings to 2026-05-16 |
+| 10.4 | `website/public/sitemap.xml` | Regenerate or hand-edit `<lastmod>` for refreshed routes (legal, features, pricing, about, sitemap, feed, home) to `2026-05-16` |
+| 10.5 | `website/public/feed.xml` | Bump `<lastBuildDate>` to current date (postbuild-seo.ts may already do this — verify) |
+| 10.6 | `docs/tracking/finalization-2026-05-16-tracker.json` | Mark all 10 batches `completed`, set top-level `last_run.status=complete`, `completed_at=2026-05-16`, `next_allowed_run_after=2026-05-23` |
+| 10.7 | `CLAUDE.md` + `AGENTS.md` (root) | Append new audit record row + bump `Last Updated` |
+| 10.8 | `website/CLAUDE.md` + `website/AGENTS.md` | Same |
+| 10.9 | `docs/rules-tracker.md` | Bump Generic Project Rules apply dates for rules that were re-verified during this audit |
+| 10.10 | `docs/project-audit/2026-05-16/sessions/batch-10.md` (new) | Session report |
+
+**Verify (final gate):**
+- `cd backend && php artisan test --without-tty` → green
+- `yarn build && yarn lint && yarn test:run` (root plugin) → green
+- `cd website && yarn typecheck && yarn lint && yarn build` → green
+- `cd website/android && ./gradlew assembleDebug` → BUILD SUCCESSFUL
+- `grep -rEn -i "firestore" website/app-publish-assets/` → zero
+- `git status` → clean after final commit + push
+
+**Commit:** `chore(release): Batch 10 — SEO date refresh + audit closure (next allowed run 2026-05-23)`
+
+---
+
+## Override conditions
+
+If something blocks a batch (test failure, missing file, dependency that needs `yarn install`), STOP at that batch and surface the blocker in the session report. Do not skip ahead. The user prefers visible blockers to silent skips.