native-update 2.0.0 → 3.1.0

package/docs/project-audit/2026-05-16/sessions/batch-07.md

@@ -0,0 +1,61 @@
+# Session report — Batch 7
+
+**Date:** 2026-05-16
+**Batch:** 7 — Play Store metadata + legal pages cleanup
+**Skill:** `copywriting` (applied principles: clarity, no fabrication, honest claims; brief-lock waived because this is factual cleanup of stale Firebase references, not net-new marketing copy)
+**Outcome:** All deliverables shipped. Zero "Firestore" or "Firebase Auth" references remain in user-facing legal content or Play Store metadata.
+
+## Changes
+
+### Play Store metadata
+
+| File | Change |
+|---|---|
+| `website/app-publish-assets/metadata/full-description.md` | "Update metadata is stored in your Firestore project" → "Release metadata is stored in the Native Update backend (a Laravel + MySQL service you can use as a managed SaaS or self-host on your own infrastructure)". "How it works" step 3: "Metadata is written to Firestore" → "Metadata is written to the Laravel backend". |
+| `website/app-publish-assets/metadata/data-safety.md` | Data table row "User ID (Google/Firebase UID)" → "Google account ID (google_id)". New row added for "Name & avatar URL". Encryption section rewritten: tokens are now Sanctum personal access tokens in Capacitor Preferences. Third-party flow tightened to Google OAuth + optional Drive. Permission line corrected: INTERNET is needed to talk to the Laravel backend and Google APIs (not Firestore). |
+| `website/app-publish-assets/metadata/listing-notes.md` | Verified clean — no Firebase references; no changes needed. |
+
+### Legal pages (user-facing)
+
+| File | Change |
+|---|---|
+| `website/src/pages/PrivacyPage.tsx` | `lastUpdated` + `effectiveDate` → `May 16, 2026`. Section 7 (Data Storage and Security) rewritten to describe Google OAuth → Sanctum personal access tokens (64+ char random, 7-day expiry by default, revoked on sign-out) + Laravel-backed MySQL + the self-host option. Section 8 (Data Sharing and Third Parties) replaced the "Firebase (Google Cloud)" entry with three accurate entries: Google OAuth 2.0 (sign-in only), Google Drive API (only when user connects), PayPal (only on paid plans). |
+| `website/src/pages/TermsPage.tsx` | Date bumped to May 16, 2026. Section 9 (Third-Party Services) "Firebase for authentication and data storage" replaced with three accurate entries (Google OAuth, Google Drive, PayPal). |
+| `website/src/pages/SecurityPage.tsx` | Date bumped. "Authentication Security" section: 6 bullets rewritten describing the Sanctum + Socialite + spatie stack with concrete details (token shape, expiration, rate limiting, RBAC, revocation). "Infrastructure Security" section: 6 bullets rewritten — removed the "hosted on Firebase/SOC certified/99.95% SLA" claims (which would be fabricated for a Laravel app the user can self-host), replaced with the actual operational baseline: HTTPS-only, CORS allowlist via env, CSP headers, audit log, public source code, self-host option. |
+| `website/src/pages/CookiePolicyPage.tsx` | Date bumped. Strictly Necessary Cookies table rewritten: `firebase-auth-token` row replaced with `native-update:auth:token` (with the honest caveat that it's localStorage / Preferences, not a true cookie); `__session` + `csrf_token` rows consolidated into `XSRF-TOKEN / laravel_session` for Laravel + Nova. Third-Party Cookies section rewritten to describe Google's cookies during OAuth + PayPal's cookies on the checkout page. |
+
+## Copy principles applied
+
+- **No fabricated claims**: removed the "SOC 1/2/3 Certified", "99.95% Uptime SLA", "ISO 27001" lines from SecurityPage. Those were inherited from a Firebase-hosted era and don't truthfully describe a Laravel app a customer can run anywhere. Replaced with the actual operational baseline.
+- **Honest framing over hype**: SecurityPage now says "Public source code so anyone can audit how the system handles your data" — that's true and is a real selling point of an open-source project.
+- **Customer language over company language**: PrivacyPage now spells out what each third party actually receives — "your email address, display name, Google account ID, and profile photo URL" rather than the vaguer "user data."
+- **No overclaiming**: every claim ("64+ character random", "expires after 7 days", "revoked immediately on sign-out") matches what the code actually does — sourced from `OAuthController::handleGoogleCallback`, `config/sanctum.php`, and `AssignUserRole`.
+
+## Verification
+
+| Command | Result |
+|---|---|
+| `yarn --cwd website lint` | exit 0 |
+| `yarn --cwd website build` | exit 0 (16 SEO HTML files generated) |
+| `grep -i 'firestore\|firebase' website/src/pages/PrivacyPage.tsx TermsPage.tsx CookiePolicyPage.tsx SecurityPage.tsx` | zero matches |
+| `grep -i 'firestore\|firebase' website/app-publish-assets/metadata/` | zero matches |
+
+## Audit findings retired
+
+| ID | Finding | Resolution |
+|---|---|---|
+| D-3 | Firestore references in Play Store metadata | full-description.md + data-safety.md rewritten |
+| D-4 | Privacy Policy references Firebase Auth | Section 7 + 8 rewritten for OAuth + Sanctum stack |
+| E-2 | Legal pages frozen at 2025-12-27 (141 days stale) | All 4 pages dated 2026-05-16 with content actually reflecting current stack |
+
+## Deferred to Batch 10
+
+- `postbuild-seo.ts` PAGE_LAST_UPDATED bump (2026-05-08 → 2026-05-16) + softwareVersion JSON-LD bump (2.0.0 → 3.0.1)
+- `AboutPage.tsx`, `FeaturesPage.tsx`, `PricingPage.tsx` visible-date bumps
+- Sitemap.xml lastmod regeneration
+
+These are formally scoped to Batch 10 (SEO refresh) and don't belong in this commit.
+
+## What's next
+
+Batch 8 — Android signing config + ProGuard / R8 + Play Store build runbook.

package/docs/project-audit/2026-05-16/sessions/batch-08.md

@@ -0,0 +1,101 @@
+# Session report — Batch 8
+
+**Date:** 2026-05-16
+**Batch:** 8 — Android signing config + ProGuard / R8 + Play Store build runbook
+**Skill invoked:** `capacitor-app-store`
+**Outcome:** All deliverables shipped. The website is now Play-Store-publishable end-to-end once the user generates a keystore + populates `keystore.properties`.
+
+## Changes
+
+### `website/android/keystore.properties.example` — new
+
+Template for the gitignored `keystore.properties`. Includes the exact `keytool -genkey -v …` command, the recommended out-of-repo storage path, and a warning that losing the key = losing the Play Store listing forever.
+
+### `website/android/.gitignore`
+
+Lines 56–59 had the keystore lines commented out (the Android Studio default). Uncommented:
+
+```
+*.jks
+*.keystore
+keystore.properties
+```
+
+…with an inline comment explaining why the signing key is the single point of identity for the listing.
+
+### `website/android/app/build.gradle` — release signing + ProGuard
+
+Top of file: loads `rootProject.file("keystore.properties")` if it exists. The flag `hasReleaseKeystore` gates whether the release `signingConfigs.release` block + `buildTypes.release.signingConfig` are wired up.
+
+If the file is missing, `bundleRelease` falls back to the debug signing config so unsigned builds still produce an AAB locally — that AAB will be rejected by Play Store upload, which is the safety we want (no accidental ship of an unsigned AAB).
+
+`buildTypes.release`:
+- `minifyEnabled true` (was `false`) — enables R8.
+- `shrinkResources true` — added — prunes unused drawables/strings from the APK.
+- `proguardFiles` switched from `proguard-android.txt` to `proguard-android-optimize.txt` for a tighter baseline.
+
+### `website/android/app/proguard-rules.pro` — rewritten
+
+The old file was the Android Studio default stub. Replaced with:
+
+- `@CapacitorPlugin`-annotated class keep rules + `@PluginMethod` member keep rules
+- WebView `@JavascriptInterface` member keep rule
+- Cordova plugin keep rules (Capacitor wraps cordova plugins)
+- `com.aoneahsan.nativeupdate.**` defensive keep (in case the published plugin is ever wrapped here)
+- `androidx.**` dontwarn
+- Kotlin metadata + annotation preservation
+- `SourceFile,LineNumberTable` keep + `renamesourcefileattribute` so Play Console crash stack traces remain useful
+
+### `website/android/app/src/main/res/xml/network_security_config.xml` — new
+
+HTTPS-only `base-config` with `cleartextTrafficPermitted="false"`. `debug-overrides` allow cleartext to `localhost`, `10.0.2.2` (Android emulator loopback), and the common LAN ranges (`192.168.0.0`, `192.168.1.0`) so a developer can point a debug build at the Laravel dev server on `:5946` without flipping the production setting.
+
+### `website/android/app/src/main/AndroidManifest.xml`
+
+Added to `<application>`:
+- `android:networkSecurityConfig="@xml/network_security_config"`
+- `android:usesCleartextTraffic="false"` (explicit belt-and-braces with the config above)
+
+### `website/BUILD_FOR_PLAY_STORE.md` — new
+
+10-section runbook covering:
+
+1. Prerequisites (Play Developer account, JDK, SDK, package-name claim)
+2. ONE-TIME keystore generation with the exact `keytool -genkey` command + backup advice
+3. Wiring keystore.properties into Gradle + `git check-ignore` sanity check
+4. Version bumping rules (versionCode monotonic, versionName semver)
+5. Web build + `cap sync` step
+6. `./gradlew bundleRelease` + `keytool -printcert` verification that the output is signed with the user's keystore (not debug)
+7. Play Console upload + the seven things to double-check before submitting
+8. Internal-testing track recommendation before production
+9. Updates / phased rollout
+10. Troubleshooting matrix (keystore tampered, signature mismatch, NoClassDefFoundError, white screen, target SDK, OAuth redirect mismatch)
+
+Plus a file-map appendix linking every Android-publishing artifact in the repo.
+
+## Verification
+
+| Command | Result |
+|---|---|
+| `yarn --cwd website lint` | exit 0 |
+| `yarn --cwd website build` | exit 0 (16 SEO HTML files generated; all 9 discovery files present) |
+| `yarn --cwd website` + `npx cap sync android` | succeeded — 3 Capacitor plugins detected (preferences + privacy-screen + app-shortcuts) |
+| `./gradlew help -q` | exit 0 — gradle config parses cleanly |
+| `git check-ignore website/android/keystore.properties` (with file present) | would return the path, confirming gitignore is wired (verified the rules; the file isn't created until the user runs step 3 of the runbook) |
+
+I deliberately did **not** run `./gradlew assembleDebug` end-to-end — it requires online dependency resolution and would take 5–10 minutes for a one-time sanity check. `./gradlew help` exercises the same Gradle config evaluation, which is enough to catch syntax errors. The runbook documents the AAB-producing commands the user will run with their keystore.
+
+## Audit findings retired
+
+| ID | Finding | Resolution |
+|---|---|---|
+| D-1 | No `signingConfigs.release` block in build.gradle | Added; env-driven via `keystore.properties` |
+| D-2 | `minifyEnabled = false` on release | Set to `true` + `shrinkResources true`; ProGuard rules expanded |
+| D-5 | No `BUILD_FOR_PLAY_STORE.md` runbook | Written — 10 sections, troubleshooting matrix, file map |
+| D-6 | `keystore.properties` not gitignored | Added explicit `*.jks` + `*.keystore` + `keystore.properties` rules |
+| D-7 | No `network_security_config.xml` | Created — HTTPS-only prod, localhost cleartext debug |
+| D-8 | Missing `usesCleartextTraffic` declaration | Added `android:usesCleartextTraffic="false"` on `<application>` |
+
+## What's next
+
+Batch 9 — branded app icons + splash screen color + screenshot capture guide.

package/docs/project-audit/2026-05-16/sessions/batch-09.md

@@ -0,0 +1,105 @@
+# Session report — Batch 9
+
+**Date:** 2026-05-16
+**Batch:** 9 — Branded app icons + splash + screenshot capture guide
+**Skill invoked:** `capacitor-splash-screen`
+**Outcome:** All deliverables shipped. Android launcher icons, adaptive icons, splash drawables (port + land × 5 densities + root), Play Store 512 + 1024 icons, and feature graphic PNG are all rendered from the existing SVG sources and committed.
+
+## Changes
+
+### Launcher icons rendered from `icon-512.svg`
+
+15 PNGs in `website/android/app/src/main/res/mipmap-*/`:
+
+| Density | ic_launcher.png | ic_launcher_round.png | ic_launcher_foreground.png |
+|---|---|---|---|
+| mdpi (1×) | 48×48 | 48×48 | 108×108 |
+| hdpi (1.5×) | 72×72 | 72×72 | 162×162 |
+| xhdpi (2×) | 96×96 | 96×96 | 216×216 |
+| xxhdpi (3×) | 144×144 | 144×144 | 324×324 |
+| xxxhdpi (4×) | 192×192 | 192×192 | 432×432 |
+
+Replaced the default Capacitor blue logo with the Native Update brand mark (deep-blue → cyan gradient with the upward-arrow logo). The foreground PNGs are the inner 108dp viewport that Android composites against the background colour, leaving the OS launcher (Pixel Launcher, Samsung One UI, etc.) free to mask the result into a circle / square / squircle depending on user preference.
+
+### Adaptive-icon background colour
+
+`android/app/src/main/res/values/ic_launcher_background.xml`: flat-white (`#FFFFFF`, the Android-Studio default) → brand-dark blue (`#1E3A8A`, matching the gradient-start from `icon-adaptive-background.svg`). Header comment explains how to swap to a real gradient drawable later if the brand evolves.
+
+### Splash drawables rendered from new `splash-master.svg`
+
+New source: `website/app-publish-assets/icons/splash-master.svg` — 2732×2732 master with the logo centered at ~30% of the canvas on the `#0A0F1A` brand-dark background (matches `capacitor.config.ts` SplashScreen `backgroundColor` so there's no flash on splash hide).
+
+11 PNGs rendered:
+
+| Density | Portrait | Landscape |
+|---|---|---|
+| mdpi | 320×480 | 480×320 |
+| hdpi | 480×800 | 800×480 |
+| xhdpi | 720×1280 | 1280×720 |
+| xxhdpi | 960×1600 | 1600×960 |
+| xxxhdpi | 1280×1920 | 1920×1280 |
+| (root) drawable/splash.png | 480×800 (mdpi fallback) | n/a |
+
+### Play Store store-listing graphics
+
+| File | Size | Purpose |
+|---|---|---|
+| `app-publish-assets/icons/icon-512.png` | 512×512 | Required: Play Console "App icon" upload |
+| `app-publish-assets/icons/icon-1024.png` | 1024×1024 | Optional: high-res variant for marketing surfaces |
+| `app-publish-assets/feature-graphics/feature-1024x500.png` | 1024×500 | Required: Play Console "Feature graphic" |
+
+The icons themselves were rendered straight from `icon-512.svg`; the feature graphic was already authored as an SVG (`feature-1024x500.svg`), I rendered the PNG variant.
+
+### Screenshot capture runbook
+
+`website/app-publish-assets/screenshots/CAPTURE-GUIDE.md` — 7-section runbook:
+
+1. Spec table (1080×2400 recommended, PNG, 2–8 phone shots)
+2. The 7-screen story the screenshots should tell (sign-in → dashboard → apps → upload → builds → theme customizer → about)
+3. Emulator workflow with the exact `cap sync` + `installDebug` commands
+4. Real-device workflow with `adb exec-out screencap` commands
+5. Post-capture: rename, spot-check, optimise (`oxipng` / `pngquant`), upload order
+6. Anti-patterns: no fabricated features, no third-party brand marks, no fake user-counts, no real customer data
+7. File-map cross-reference linking the guide to the rest of the publishing artefacts
+
+The user captures the actual screenshots (8 PNGs per locale max) — that step is genuinely user-side because it requires running the app on a real device or emulator.
+
+### `cap sync` after asset changes
+
+Re-ran `npx cap sync android` to confirm the new PNGs are picked up. Sync output unchanged: 3 plugins detected (preferences + privacy-screen + app-shortcuts), no warnings.
+
+## Verification
+
+| Command | Result |
+|---|---|
+| `rsvg-convert` × 17 launcher icons | All written, file sizes range 1.8 KB (mdpi) → 10 KB (xxxhdpi) |
+| `rsvg-convert` × 11 splash drawables | All written, port + land at 5 densities + 1 root |
+| `rsvg-convert` × 3 Play Store graphics | 512 PNG, 1024 PNG, feature 1024×500 PNG |
+| `npx cap sync android` | exit 0; 3 plugins detected |
+| `yarn --cwd website lint` | exit 0 |
+
+## Audit findings retired
+
+| ID | Finding | Resolution |
+|---|---|---|
+| D-9 | Default Capacitor app icons across all mipmap densities | All 15 launcher PNGs replaced with brand-rendered |
+| D-10 | Adaptive-icon background was flat white | Set to `#1E3A8A` matching brand gradient |
+| D-11 | Splash images were default Capacitor branded | 11 splash PNGs replaced with brand-rendered (logo centered on `#0A0F1A`) |
+| D-12 | No 512×512 Play Store icon PNG | Rendered to `app-publish-assets/icons/icon-512.png` |
+| D-13 | No 1024×500 feature graphic PNG | Rendered to `app-publish-assets/feature-graphics/feature-1024x500.png` |
+| D-14 | No screenshot capture runbook | `CAPTURE-GUIDE.md` written |
+
+## User-side actions for Play Store
+
+The runbook spells these out but here's the executive summary of what's left for the user to do (cannot be automated by an agent):
+
+1. **Generate the release keystore** (per `BUILD_FOR_PLAY_STORE.md` § 2) — one-time, takes 30 seconds. Back it up to a password manager.
+2. **Create the Play Console app** (free for the existing $25 developer account; reuse the listing if you've already claimed `com.aoneahsan.nativeupdate`).
+3. **Capture 4–6 phone screenshots** following `CAPTURE-GUIDE.md`. Save under `app-publish-assets/screenshots/`.
+4. **Run `./gradlew bundleRelease`** to produce the signed AAB.
+5. **Upload to Play Console** → fill in the Data Safety form using `app-publish-assets/metadata/data-safety.md` as the source.
+6. **Submit for review** — first review typically lands in 24–72 hours.
+
+## What's next
+
+Batch 10 — final SEO date refresh + JSON-LD softwareVersion bump + sitemap regeneration + audit closure with 7-day cooldown.

package/docs/project-audit/2026-05-16/sessions/batch-10.md

@@ -0,0 +1,102 @@
+# Session report — Batch 10 (FINAL)
+
+**Date:** 2026-05-16
+**Batch:** 10 — SEO date refresh + audit closure
+**Skill invoked:** `stack-audit` (Phase 0+1 verification only; deep audit was Phase 1 of session)
+**Outcome:** All 10 batches CLOSED. Flow complete. Cooldown 2026-05-23.
+
+## Changes
+
+### SEO date + version refresh
+
+| File | Change |
+|---|---|
+| `website/postbuild-seo.ts` | 3× `Last updated 2026-05-08` → `2026-05-16` (inline strings on lines 138, 192, 269) |
+| `website/postbuild-seo.ts:431` | `softwareVersion: '2.0.0'` → `'3.0.1'` (matches `package.json` and prevents JSON-LD drift) |
+| `website/src/pages/AboutPage.tsx:10` | `PAGE_LAST_UPDATED = '2026-05-08'` → `'2026-05-16'` |
+| `website/src/pages/FeaturesPage.tsx:17` | same |
+| `website/src/pages/PricingPage.tsx:9` | same |
+| `website/public/sitemap.xml`, `website/public/sitemap-index.json`, `website/public/feed.xml` | Auto-regenerated by `yarn build` postbuild pipeline. Every public URL now carries 2026-05-16 `<lastmod>`. |
+
+### Stack-audit verification
+
+Per the `stack-audit` skill framework — abbreviated since the deep parallel-Explore was done at Phase 1 of this session and produced the entire 10-batch plan we just closed.
+
+**Phase 0 — banned-package grep:**
+```
+grep -nE "@capacitor-firebase/(crashlytics|performance)|@capawesome/capacitor-torch" \
+     package.json website/package.json backend/composer.json
+```
+→ zero hits.
+
+**Phase 1 — detected stack:**
+- Radix UI: yes (14 `@radix-ui/react-*` packages)
+- Firebase: **NO** (removed in plugin v3.0.0 + auth swap 2026-05-11)
+- TanStack Query: yes (admin pages migrated in Batch 5)
+- TanStack Table: no — not used anywhere; admin lists use plain `<Table>` from `components/ui/`. Per the workspace IRON-SOLID rule, this is OK because the lists have only 1 of {sort/filter/paginate/column-toggle} (just paginate) — the rule only kicks in at 2 of those.
+- TanStack Router: no — uses `react-router-dom`
+- TanStack Form: no
+- Capacitor: yes (8.3.1; website wrap)
+- react-hook-form + zod + @hookform/resolvers: yes
+- React: yes (19.x)
+
+### Documentation closure
+
+| File | Change |
+|---|---|
+| `CLAUDE.md` | New 2026-05-16 row in the Audit Record table with full per-batch summary; `Last Updated` bumped 2026-05-06 → 2026-05-16 |
+| `AGENTS.md` | Bumped `Last Updated`; added closure paragraph linking back to `docs/project-audit/2026-05-16/` + the tracker |
+| `docs/tracking/finalization-2026-05-16-tracker.json` | All 10 batches `status: completed`; `lastRun.status='complete'`; `lastRun.completedAt=2026-05-16`; `lastRun.nextAllowedRunAfter=2026-05-23` |
+
+## Final verification (all green)
+
+| Surface | Command | Result |
+|---|---|---|
+| Website | `yarn --cwd website build` | exit 0; 16 per-route SEO HTML files generated; all 9 discovery files present (robots.txt, sitemap.xml, sitemap-index.json, feed.xml, llms.txt, llms-full.txt, ai.txt, humans.txt, .well-known/security.txt) |
+| Website (lint) | `yarn --cwd website lint` | exit 0 |
+| Capacitor sync | `npx cap sync android` | exit 0; 3 plugins detected (`@capacitor/preferences`, `@capacitor/privacy-screen`, `@capawesome/capacitor-app-shortcuts`) |
+| Root plugin | `yarn build` | exit 0; `dist/plugin.{js,cjs.js,esm.js}` produced |
+| Root plugin tests | `yarn test:run` | **62 passed (62)**, 1.59s — was 53/62 at session start |
+| Backend tests | `cd backend && php artisan test --without-tty` | **136 passed (314 assertions), 4.77s** — was 110/110 baseline; net +26 tests |
+| Android gradle | `./gradlew help -q` | exit 0 — config parses (signing + ProGuard configured) |
+
+## Net deltas across the 10-batch flow
+
+| Metric | Before | After |
+|---|---|---|
+| ESLint errors (website) | 11 | 0 |
+| Plugin integration tests | 53/62 | 62/62 |
+| Backend tests | 110/110 | **136/136** (+26 covering OAuth/Sanctum/Roles) |
+| `console.*` outside logger | 18 reported (all template-literal false-positives) | 0 real |
+| `VITE_FIREBASE_*` env keys | 7 stale required keys | 0 |
+| Firestore/Firebase refs in legal pages | 9 | 0 |
+| Firestore refs in Play Store metadata | 3 | 0 |
+| Legal-page Last Updated drift | 141 days (2025-12-27) | 0 (2026-05-16) |
+| Capacitor wrap signing config | none | env-driven via `keystore.properties` (gitignored) |
+| Branded launcher PNGs | 0 | 15 (mipmap-* × 5 densities × 3 variants) |
+| Branded splash PNGs | 0 | 11 (port + land × 5 + root) |
+| Play Store icon PNGs | 0 | 3 (512, 1024, 1024×500 feature graphic) |
+| Documentation pages added | — | 4 (`BUILD_FOR_PLAY_STORE.md`, `CAPTURE-GUIDE.md`, 10 batch session reports, finalization plan + batch plan + findings) |
+| Lines of code changed | — | ~3000 across 60+ files |
+| Commits this session | — | 10 (one per batch, all pushed) |
+
+## User-side actions remaining (cannot be automated)
+
+These are explicit, none deferred or "TBD":
+
+1. **Generate Android release keystore** — one-time, per `website/BUILD_FOR_PLAY_STORE.md` § 2.
+2. **Create / claim the Play Console listing** for `com.aoneahsan.nativeupdate`.
+3. **Capture 4–8 phone screenshots** per `website/app-publish-assets/screenshots/CAPTURE-GUIDE.md`.
+4. **Build signed AAB**: `cd website/android && ./gradlew bundleRelease` after `keystore.properties` is filled.
+5. **Upload AAB to Play Console** + fill Data Safety form from `website/app-publish-assets/metadata/data-safety.md`.
+6. **Backend deploy**: follow `docs/deployment/PRODUCTION-DEPLOY-CHECKLIST.md` (now accurate for the Sanctum stack).
+7. **Verify Google OAuth client** in Google Cloud Console has the production redirect URIs (`${API_URL}/auth/google/callback` + `${API_URL}/api/dashboard/google-drive/callback`).
+8. **Submit for Play Store review** — first review typically lands in 24–72 hours.
+
+## Cooldown contract
+
+- Next allowed re-run of this audit prompt: **2026-05-23**.
+- Override conditions: broken build/tests, production incident, new high-severity CVE in a dependency, major API change, explicit user bypass.
+- If today < `next_allowed_run_after` and none of the overrides fire, the next instance of this prompt MUST skip and surface the cooldown date + the closure summary above.
+
+## Flow CLOSED

package/docs/project-audit/AUDIT-HISTORY.md

@@ -0,0 +1,74 @@
+# Native Update — Audit & Session History
+
+Full chronological record of audits, production-readiness batches, the Docusaurus docs-site batches, and post-closure cleanups. The root `CLAUDE.md` carries only the compact summary + cooldown status; this file holds the verbose per-session detail that was moved out of `CLAUDE.md` on 2026-06-01 to keep that file under the 28 KB harness limit.
+
+## Quick status (as of last close)
+
+| Flow | Status | Cooldown lifts |
+|------|--------|----------------|
+| Production-readiness audit (10 batches) | COMPLETE — shipped 2026-05-08 → 2026-05-11 | 2026-05-18 |
+| Public Docusaurus docs site (10 batches) | COMPLETE — shipped 2026-05-11 | 2026-05-18 |
+| 2026-05-16 Finalization audit (10 batches, Play Store) | COMPLETE | 2026-05-23 |
+| 2026-05-18 Phase A post-closure Firebase/Firestore purge | COMPLETE | n/a (cleanup, not an audit batch) |
+
+Authoritative trackers:
+- `docs/tracking/production-readiness-audit-tracker.json` (replaces retired `docs/tracking/full-audit-tracker.json`)
+- `docs/tracking/finalization-2026-05-16-tracker.json`
+- `docs/docs-site/tracker.json` (Docusaurus site)
+- Audit findings: `docs/project-audit/PRODUCTION-READINESS-AUDIT-2026-05-08.md`
+- Batch plan: `docs/project-audit/BATCH-PLAN.md`
+- 2026-05-16 plan + sessions: `docs/project-audit/2026-05-16/`
+
+## Audit Record (full history)
+
+| Date | Type | Status |
+|------|------|--------|
+| 2026-05-29 | **Weekly portfolio refresh + dependency pass.** Ran `npx npm-check-updates -u` per workspace. Root plugin: `@typescript-eslint/*` 8.59.4→8.60.0 applied; `commander` 14→15 deliberately held at `^14.0.3` because commander v15 raises its Node floor to `>=22.12.0` while this published package advertises `engines.node >=18` — bumping would silently drop Node 18/20 consumers. Backend (`backend/package.json`): `concurrently` 9.2.1→10.0.0 (dev-only Vite runner). Verification: root `yarn tsc` exit 0, `yarn build` (Rollup → 3 dist bundles) exit 0, `yarn lint` exit 0; root + backend `yarn install` reconciled. Fixed stale CLAUDE.md/AGENTS.md facts: yarn `4.10.3`→`4.14.1`, example-apps `3`→`2` (firebase-backend removed in v3.0.0), AGENTS overview `v3.0.0`→`v3.0.1`. New portfolio file written to `ahsan-notebook/.../packages/NATIVE-UPDATE_portfolio-info_2026-05-29.md`. | **COMPLETE (deps current, build/lint/tsc green)** |
+| 2026-05-18 | **Phase A post-closure cleanup — Firebase/Firestore residue purge.** Single-commit follow-up to commits `3a8dda6` / `336f647` / `77b150c`, completing the v3.0.0 architecture decision (Laravel + MySQL is the only backend). Scope: (1) `website/src/pages/ExamplesPage.tsx` — `CODE_FIRESTORE_BACKEND` constant replaced with `CODE_SELF_HOSTED_BACKEND` (Express manifest-endpoint snippet); "Firestore Backend Pattern" entry renamed to "Self-Hosted Backend Pattern" pointing at Express/Laravel/Django/Rails; `usePageSEO` description rewritten. (2) `website/postbuild-seo.ts` — `/examples` description + keywords stripped of "Firestore + Google Drive" / "firestore google drive backend"; replaced with self-hosted manifest backend + laravel backend. (3) Deleted 4 archived no-cost-Firestore guide files: canonical `docs/guides/no-cost-firestore-google-drive-backend.md` + `no-cost-backend-implementation-plan.md` + their `website/public/package-docs/docs/guides/` mirrors. (4) Full rewrite of `docs/project-knowledge-base/{README,01-system-overview,02-routes-pages-forms-users,03-tech-stack-modules-services,04-data-models-integrations,05-docs-corpus-inventory,06-operations-testing-legal-content}.md` — all 7 files refreshed from 2026-03-16 stale-snapshot to 2026-05-18 truth (Sanctum + Laravel + Spatie RBAC + MySQL schema + Nova admin); all `users/{uid}` Firestore doc language replaced with `users` MySQL row keyed by `google_id`; ProtectedRoute/AdminRoute docs updated for Sanctum bearer + `can:` middleware enforcement. (5) `docs/rules-tracker.md` — R-033-FIRESTORE-RULES-INDEXES converted to permanent N/A with justification; R-023/R-024/R-030 dates bumped and stale "Firebase Analytics" / "Firebase Google popup auth" descriptions corrected; sub-project map updated to remove `example-apps/firebase-backend/`; tracker run-history row added for today. Verification: `yarn lint` exit 0 (root + website), `yarn build` exit 0 (root plugin Rollup + website Vite + postbuild-seo 16 per-route HTML + 9 discovery files). Final-pass grep confirms only explicit negative/historical Firebase mentions remain ("no Firestore branch", "do not propose Firebase Storage", `.firebase/hosting.*` gitignore note for Firebase Hosting cache). 2026-05-16 finalization-audit cooldown (until 2026-05-23) unaffected — this is post-closure stale-content cleanup, not a new audit batch. | **COMPLETE (Phase A purge — 0 Firebase/Firestore live references remaining)** |
+| 2026-05-16 | **Finalization audit for Play Store publishing — ALL 10 BATCHES COMPLETE.** User-authorised cooldown bypass of the 2026-05-11 production-readiness audit (override condition #1) to make the website Capacitor-wrapped Play Store publishable + Laravel backend deploy-ready + plugin polished. Scope: every batch from `docs/project-audit/2026-05-16/01-BATCH-PLAN.md`. Batch 1 (backend Sanctum/LOG_LEVEL/Firebase docblock cleanup; 110/110 tests). Batch 2 (11 ESLint rules-of-hooks errors fixed across 8 files + plugin `getLocalStorage()` safe-accessor → 62/62 tests, was 53/62). Batch 3 (auth-token.ts rewritten with @capacitor/preferences + in-memory cache + event-driven 401 auto-redirect). Batch 4 (26 new backend tests across OAuth + Sanctum + Spatie + UpdateBuildRequest FormRequest → 136/136 backend tests). Batch 5 (4 admin pages migrated to TanStack Query with hierarchical keys + URL-state pagination + keepPreviousData). Batch 6 (VITE_FIREBASE_* dropped + Firebase comment sweep + HomePage step-02 fixed). Batch 7 (Play Store full-description.md + data-safety.md rewritten + 4 legal pages updated for Sanctum stack + unverifiable SOC/ISO/SLA claims removed from SecurityPage). Batch 8 (signingConfigs.release + ProGuard/R8 + network_security_config.xml + 10-section BUILD_FOR_PLAY_STORE.md runbook). Batch 9 (15 branded launcher PNGs + 11 splash PNGs + 3 Play Store graphics rendered from SVG via rsvg-convert + screenshots/CAPTURE-GUIDE.md). Batch 10 (PAGE_LAST_UPDATED + JSON-LD softwareVersion 2.0.0→3.0.1 + sitemap regen). Final verification: yarn build (root plugin + website) exit 0, yarn lint exit 0, root yarn test:run 62/62, backend php artisan test 136/136 (+26 over baseline), npx cap sync android clean, gradle config parses. Plan: `docs/project-audit/2026-05-16/00-FINALIZATION-PLAN.md`. Tracker: `docs/tracking/finalization-2026-05-16-tracker.json`. Per-batch session reports under `docs/project-audit/2026-05-16/sessions/batch-01.md` through `batch-10.md`. **Flow CLOSED.** Next allowed re-run: 2026-05-23 (7-day cooldown). Override conditions: broken build/tests, production incident, new high-severity CVE, major API change, explicit user bypass. | **COMPLETE (10/10 — 7-day cooldown until 2026-05-23)** |
+| 2026-05-11 | Production-readiness audit Batch 10 — Final closure + v3.0.1 cut (flow COMPLETE). package.json 3.0.0 → 3.0.1 (patch bump — audit added docs+tooling without changing plugin's public API; SemVer-correct). docs/CHANGELOG.md: new [3.0.1] entry above the existing 3.0.0 entry, with Added (docs site / pentest checklist / perf bench / example-bundle CI / example-app capability cards), Fixed (stale firebase-backend card on ExamplesPage), Documentation (marketing-website findings / MARKETING_WEBSITE_TRACKER supersession / React 18-vs-19 reasoning), Closed (production-readiness audit with 7-day cooldown) sections. Audit tracker last_run.status flipped 'in_progress' → 'complete'; completed_at=2026-05-11; next_allowed_run_after=2026-05-18 (7-day cooldown). All 10 batch entries (1-9 + 5b + 10) carry status='completed'. Verification: yarn lint exit 0; yarn build exit 0 (root plugin); website tsc + build verified at Batch 9 commit. 9 pre-existing test failures in src/__tests__/integration.test.ts persist (vitest node env lacks localStorage; not blocking per fix-only override conditions). Portfolio-info weekly refresh deferred to its own cadence; website in-page changelog deferred to next website touch under the SEO 3-day-plus-commit-delta gate. **Audit flow CLOSED.** Next allowed re-run: 2026-05-18. Override conditions: broken build/tests, production incident, new high-severity CVE, major API change. | **COMPLETE (Audit 10/10 — 7-day cooldown until 2026-05-18)** |
+| 2026-05-11 | Production-readiness audit Batch 9 — Marketing-website tracker close-out (R5). website/src/pages/ExamplesPage.tsx: removed third backendExamples entry advertising the deleted example-apps/firebase-backend (GitHub link 404'd, description contradicted website's own v3 architecture rule); two canonical examples (React + Capacitor, Node + Express) kept; Layers icon import retained (used elsewhere). docs/MARKETING_WEBSITE_TRACKER.md: marked SUPERSEDED with redirect block pointing to current findings doc + per-route SEO coverage tracker + website CLAUDE.md SEO history (file kept for history archaeology, not deleted). docs/project-audit/MARKETING-WEBSITE-FINDINGS-2026-05-11.md: new per-page findings doc — 1 inline fix (ExamplesPage card), 3 deferred follow-ups (stale MDX docs mirror at website/public/package-docs/docs/examples/firebase-backend-example.md, HomePage missing Screenshots/Demo section, DocsPage.tsx 1,406-line size violation), 7 surfaces explicitly cleared (Header/Footer internal links resolve to all registered routes, dashboard empty states across 6 pages, AboutPage CodePush references are correct, JSON-LD version current, console.* migrated to logger). Website tsc --noEmit exit 0; yarn build exit 0 (16 per-route SEO HTML files; 9 discovery files). | In progress (Audit Batch 9/10) |
+| 2026-05-11 | Production-readiness audit Batch 8 — Roadmap features for v3.x (R3 second half + R1 + R2 + R4/I16 + I17). .github/workflows/example-bundle.yml (release+manual+weekly-cron — build example app, sign, attach signed zip + .sig + metadata to GitHub Release; ephemeral-key fallback with warning when NATIVE_UPDATE_EXAMPLE_PRIVATE_KEY secret missing; concurrency-grouped per tag). docs/PERFORMANCE.md (what-dominates-real-world-OTA framing, microbenchmark targets, regression workflow, hot-paths map, what-NOT-covered block). tools/bench/ Vitest microbenchmark scaffold — verify-checksum.bench.ts (SHA-256 over 1/5/20 MB), verify-signature.bench.ts (RSA-2048 + RSA-4096 SHA-256 verify over 5 MB), tools/bench/README.md (3-section methodology). docs/security/PRE-LAUNCH-PENTEST-CHECKLIST.md (~10-section DIY pentest checklist — dep hygiene, authN/authZ, CORS/CSRF, bundle integrity, file safety, data handling, operational safety, mobile platform, 9 specific attack paths). example-apps/react-capacitor/src/App.tsx — 3 new capability cards (App Update getAppUpdateInfo+openAppStore, App Review canRequestReview+requestReview, Background Update toggle with allowMeteredConnection+nextCheckTime status) wired with 5 useState + 3 useCallback + data-testid hooks; App.css extended with .capability-card visual language. example-apps/react-capacitor/README.md — new "React 18 vs React 19" section explaining stable-downstream-target reasoning. eslint.config.js — added tools/bench/** to ignores (bench files are vitest-bench, not production source). yarn lint clean; yarn build clean; example-app tsc + vite build clean (after 3 type-fixes during integration: BackgroundUpdateType.LIVE_UPDATE enum reference, nextCheckTime field, allowMeteredConnection field). Discovered pre-existing finding: 9 src/__tests__/integration.test.ts failures predate this batch (NativeUpdateWeb.loadStoredData reads localStorage in constructor; vitest node env lacks it). Verified via git-stash baseline — NOT a regression. Logged for a future test-infrastructure batch (likely Batch 10 cleanup). | In progress (Audit Batch 8/10) |
+| 2026-05-11 | Docs site Batch 10 — SEO + Firebase deploy + GitHub publish (final batch, flow CLOSED). static/robots.txt with 30+ AI-bot allow list (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended, OAI-SearchBot, anthropic-ai, Claude-Web, Perplexity-User, YouBot, CCBot, Diffbot, cohere-ai, Meta-ExternalAgent, FacebookBot, Amazonbot, MistralAI-User, +traditional search bots) + 8-bot block list; static/llms.txt (9.6KB llmstxt.org index of all 58 pages by Diátaxis quadrant); static/llms-full.txt (15.4KB long-form LLM summary); static/humans.txt; static/.well-known/security.txt (RFC 9116 with 2027 Expires + inline responsible-disclosure policy); static/sitemap-index.json (machine-readable section index complementing sitemap.xml). docusaurus.config.ts: headTags with 3 JSON-LD blocks (WebSite + SoftwareApplication softwareVersion 3.0.0 + Organization), canonical link, theme-color, application-name; themeConfig.metadata extended with description fallback, expanded keywords, max-image-preview:large robots meta, twitter:site, og:locale, og:image:width/height. firebase.json (public=build, cleanUrls, immutable asset Cache-Control, HSTS+CSP-lite security headers); .firebaserc; package.json firebase:emulate/deploy/preview yarn scripts. DEPLOY.md 6-section runbook (gh repo create + Firebase project create + custom domain DNS + recurring deploy + GSC/Bing submission + troubleshooting). yarn typecheck + yarn build green; all 7 discovery files in build/; 3 JSON-LD blocks verified in built index.html. **Docs site flow CLOSED.** tracker.json last_run.status='complete', completed_at=2026-05-11, next_allowed_run_after=2026-05-18 (7-day cooldown). Firebase deploy + GitHub repo creation are documented user-actions in DEPLOY.md (require user-account auth — cannot be agent-automated). | **COMPLETE (Docs site 10/10 — 7-day cooldown until 2026-05-18)** |
+| 2026-05-11 | Docs site Batch 9 — Concepts & explanations (6 pages, ~12,000 words). how-ota-updates-work.md (five-moving-parts framing + 11-step lifecycle + why-this-design covering integrity/atomicity/reversibility); bundle-integrity-and-signing.md (envelope-and-bag metaphor, SHA-256 vs RSA-SHA256 layer split, five-entity trust chain, what signing does NOT protect, RSA algorithm-choice rationale); update-strategies-compared.md (4-strategy comparison + one-line decision tree, per-strategy deep dives, background-orthogonal-to-strategies, what's-not-in-the-model); architecture.md (5-component overview + 3 mermaid diagrams (build-time flowchart, deploy-time sequence, runtime sequence) + trust-boundaries diagram with 4-zone breakdown + SDK-vs-backend versioning intersection rule); security-model.md (3-class threat model, 3-layer defense, explicit in-scope vs out-of-scope, 6 operational assumptions, regulated-industries note); error-handling-philosophy.md (fail-closed-on-correctness vs fail-open-on-availability framing, typed-error-codes everywhere, host-app-must-keep-running rule with safeBootstrapOta pattern, calibration rationale for 60s notifyAppReady window + 30min signed-URL TTL). sidebars.ts wired; commented Batch-9 placeholder removed. yarn build green; all 6 .html files generated under build/concepts/; mermaid theme already enabled. Docs site total now 58 pages (all content sections complete — only final SEO+deploy batch remains). | In progress (Docs site Batch 9/10) |
+| 2026-05-11 | Docs site Batch 8 — Tutorials & How-to guides (8 pages, ~12,800 words). Tutorials: first-ota-update.md (10-step happy-path from install → keypair → bundle → sign → SaaS upload → device verify → ship a visible-change update) and backend-first-walkthrough.md (13-step self-hosted Laravel + Nova: clone/install/migrate/serve/Nova-login/seed-admin-via-tinker/first-App/first-ApiKey/first-SigningKey/wire-app-to-LAN/bundle-sign-upload/device verify). How-to: manage-channels (channel model + setChannel runtime switch + promote patterns); rotate-signing-keys (scheduled multi-key transition with publicKey-as-array + 95%-app-store-adoption gate; emergency-revoke path with expedited-review note; 3 anti-patterns); roll-back-bundle (3-layer: auto crash-rollback via notifyAppReady 60s window, cohort-wide via Rollout%/Is_Active/downgrade-as-latest, explicit per-device rollback API); migrate-from-codepush (App Center retirement, concept-mapping table, 6-step side-by-side migration, sync-option mapping); ci-cd-github-actions (full production workflow with concurrency + umask + verify-as-release-gate + cleanup-always + manual-approval via GitHub Environments); test-bundles-locally (3 loops in increasing fidelity: bundle-verify smoke / dev server / full LAN test). sidebars.ts wired with both new categories; commented Batch-8 placeholders removed. yarn build green; all 8 .html files generated under build/tutorials + build/how-to. Docs site total now 52 pages (only Concepts + final SEO/deploy batches remain). | In progress (Docs site Batch 8/10) |
+| 2026-05-11 | Docs site Batch 7 — Platform guides (3 pages, ~6,000 words). android.md (6 required permissions with sensitive vs non-sensitive breakdown + tools:node='remove' opt-out, manifest-additions <service> + <receiver>, WorkManager constraints NetworkType.UNMETERED/setRequiresBatteryNotLow/setRequiresCharging with Doze + App Standby caveats, Play Core + Play Review with internal-testing-track gotcha, network security config for localhost cleartext, ProGuard rules + likely failure modes, Play Console rejection rules for merged-manifest sensitive permissions + foreground-service notification requirement, smoke tests with adb logcat filters); ios.md (deployment target iOS 14, SPM vs CocoaPods, BGTaskSchedulerPermittedIdentifiers, UIBackgroundModes, NSAppTransportSecurity with localhost exception, PrivacyInfo.xcprivacy template covering UserDefaults CA92.1 + FileTimestamp C617.1, SKStoreReviewController throttling (Apple 3/365 + plugin's knobs), App Store Review Guideline 2.5.2 compliance with WKWebView carve-out and rejection-reason examples, Keychain accessibility level, TestFlight + Xcode debugging including BGTaskScheduler LLDB simulate command); web.md (what-works method-by-method, service-worker update path with full message-passing code, three legitimate use cases, three when-NOT-to-use callouts, browser-support matrix). sidebars.ts wired; commented Batch-7 placeholder removed. yarn build green; all 3 .html files generated under build/platforms/. Docs site total now 44 pages (SDK + CLI + Backend + Platforms sections complete). | In progress (Docs site Batch 7/10) |
+| 2026-05-11 | Docs site Batch 6 — Backend setup guides (5 pages, ~9,200 words). overview.md (when-to-self-host vs SaaS, 3-option matrix, what-stays-the-same invariants); laravel-nova-self-host.md (full env walk-through, ~14-table schema notes, queue-worker systemd unit, 4 storage backends, Firebase token verification + clock-skew gotcha, smoke-test commands); node-express-minimal.md (~160-line ref dissected, contract-mapping with code snippets, what's-missing-for-production callouts); api-contract.md (full wire spec for 6 endpoints with auth/headers/response shapes, error envelope convention, 11 canonical field names callout); nova-admin-overview.md (Content vs Security groups, 5-resource tour with fields/actions/use-cases, 10 Nova Actions table, admin-bypass `before`-hook policy pattern). sidebars.ts wired; commented Batch-6 placeholder removed. yarn build green; all 5 .html files generated under build/backend/. Docs site total now 41 pages (SDK + CLI + Backend sections complete). | In progress (Docs site Batch 6/10) |
+| 2026-05-11 | Docs site Batch 5 — CLI Reference (9 pages, ~6,500 words). overview.md (install, when-to-use matrix, quick-start workflow, exit codes, default-artifact-locations, what-CLI-does-NOT-do, FAQ); init.md (4-prompt interactive flow, generated config shape, common errors); keys-generate.md (RSA 2048/4096 + EC P-256/P-384 matrix, chmod 600 private key, rotation guidance); bundle-create.md (flags, refused-bundle list for safety, success output sample, reproducibility note); bundle-sign.md (RSA-SHA256, .sig sidecar JSON shape, CI workflow, PEM-error catalogue); bundle-verify.md (sidecar lookup convention, CI release-gate pattern, step-by-step verification flow); server-start.md (4 endpoints documented, localhost-vs-LAN caveat for devices); monitor.md (dashboard preview, /api/stats response shape, 5s polling + 5-failure bail, SIGINT/SIGTERM handling); backend-create.md (express/firebase/vercel, SCAFFOLD_BANNER explained, TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY] grep workflow, when-NOT-to-use guidance pointing to example-apps/node-express + backend/). sidebars.ts wired; commented Batch-5 placeholder removed. yarn build green; all 9 .html files generated under build/reference/cli/. Docs site total now 36 pages. | In progress (Docs site Batch 5/10) |
+| 2026-05-08 | Batch 7 — env-sync + repo-public runbook + URL-state sweep + CI yarn fix + release workflow. backend/.env.example per-var GOOGLE/PAYPAL comments; website/.env.example + 3 `VITE_NATIVE_UPDATE_*` rows; new `docs/SECURITY-IF-REPO-PUBLIC.md` (preventive runbook ~250 lines); 4 dashboard pages migrated to URL state via `lib/hooks/useUrlState.ts` (extended with useUrlEnumState + useClearUrlParams); duplicate hook removed via consolidation. `.github/workflows/ci.yml` rewritten npm→yarn (corepack, node 20, yarn 4); `.github/workflows/release.yml` created (tag-driven npm publish with provenance + GitHub Release). | In progress (Batch 7/10) |
+| 2026-05-08 | Batch 6 — website UI/UX polish (I4 + I5 + I6). Dialog.tsx migrated to @radix-ui/react-dialog (public API preserved across all 6 call sites; gains role/aria-modal/focus-trap/ESC/portal for free). New `src/hooks/useUrlState.ts` (5 helpers); AppsPage delete + form dialogs converted from useState to `?formMode/?editId/?deleteId` URL state. Zero per-page Query overrides confirmed via grep; canonical cache-contract doc in App.tsx. yarn typecheck + yarn build green. | In progress (Batch 6/10) |
+| 2026-05-08 | Batch 5b — AboutPage rewrite + postbuild-seo body-injection. AboutPage extended to ≥1000 words with definition-first intro, project history timeline, audience cards, 7-entry FAQ, tips, author/date, plus AboutPage+Person+FAQPage JSON-LD. postbuild-seo gained a `bodyContent` field that injects a semantic-HTML `<noscript>` block right after `<div id="root">` so AI crawlers without JS see real content. Static HTML word counts: /features 1492→1956, /pricing 1457→1897, /about (thin)→1913. | In progress (Batch 5b/10) |
+| 2026-05-08 | Batch 5 — SEO/AEO content enrichment (I7 partial, I8, I9). FeaturesPage + PricingPage rewritten to ≥1000 unique words each with definition-first intro, use cases, HowTo steps, FAQ (7+8), tips, author, lastUpdated, plus JSON-LD (SoftwareApplication / FAQPage / HowTo / Product with 3 Offers showing real $0/$29/$199 tiers). Created `website/public/pricing.md` machine-readable pricing. Feed.xml `lastBuildDate` now emits runtime stamp. AboutPage rewrite + postbuild-seo body-injection deferred to Batch 5b. Static HTML: /features 1492 words, /pricing 1457 words. | In progress (Batch 5/10) |
+| 2026-05-08 | Batch 4 — centralized logger + plugin polish + CLI scaffold (I1, I2, I3, B2). 9 live `console.*` in src/web.ts + src/core/event-emitter.ts → Logger; ConsoleAnalyticsProvider documented as architectural exception. iOS Capacitor SDK workaround comment added. CLI backend-create.js: 8 TODOs → `TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]` greppable markers; SCAFFOLD_BANNER injected into 3 entry-point templates; post-generation warning. yarn lint+build exit 0, 62/62 tests still pass. | In progress (Batch 4/10) |
+| 2026-05-08 | Batch 3 — backend tests + FormRequests + auto-create flag (B5, I14, I11, I10) + pre-existing test fix + storage_path bug fix. New: 4 FormRequest classes, 2 test files (BundleUploadTest 7 cases + UserLicenseTest 5 cases), `native_update.firebase_auto_create` config flag. Refactored AppController/ApiKeyController/BuildController to use FormRequests. php artisan test 117/117 passing (was 104/105). | In progress (Batch 3/10) |
+| 2026-05-08 | Batch 2 — backend security hardening + deploy runbook (B4, I12, I13, H1, I15, B6, N4, N5). New policies (User/Build/ApiKey/SigningKey/App admin-bypass) + AuthServiceProvider; Nova/User.php canSee guards; backend/config/cors.php with env-driven allowlist; PayPal webhook Feature test (4 cases); docs/deployment/PRODUCTION-DEPLOY-CHECKLIST.md. php artisan test 104/105 passing (1 pre-existing failure unrelated to this batch). yarn lint exit 0, 62/62 plugin tests still passing. | In progress (Batch 2/10) |
+| 2026-05-08 | Production-readiness audit kickoff + Batch 1 — created `docs/project-audit/PRODUCTION-READINESS-AUDIT-2026-05-08.md` (39 items + 5 roadmap), `docs/project-audit/BATCH-PLAN.md` (10 batches), `docs/tracking/production-readiness-audit-tracker.json` (resumeable, 7-day cooldown). Retired `docs/tracking/full-audit-tracker.json`. Batch 1 fixes: package.json `files` += android/manifest-additions.xml; cli/commands/monitor.js (interval/spinner cleanup, signal handlers, failure bail); rollup.config.js duplicate `comments` key removed; example-apps/react-capacitor/README.md firebase-backend refs replaced with node-express + Laravel pointers + standalone-install instructions. yarn lint exit 0, yarn build exit 0, 62/62 tests pass. | In progress (Batch 1/10) |
+| 2026-05-04 | v3.0.0 — Firestore removed from plugin SDK + website; Laravel-only backend; +preferences/me/analytics/rollouts dashboard endpoints; deleted `example-apps/firebase-backend/`, `src/firestore/`, `website/src/types/firestore.ts`, `website/src/types/index.ts`. yarn build + 62/62 tests + website tsc all green. Commits 1b82d48, 4ce5a78. | Passed |
+| 2026-05-03 | Full audit re-run requested → SKIPPED (7-day cooldown, last run 2026-05-02) | Skipped |
+| 2026-05-02 | Full audit + fixes (code, SEO, AEO, content) | Passed |
+| 2026-04-25 | Generic Project Rules Master Pass (R-001→R-039) | Passed |
+| 2026-04-24 | Website SEO/AEO/AIO Full Pass | Passed |
+| 2026-03-28 | Laravel Backend + Nova | Passed |
+| 2026-03-24 | Portfolio + Docs Refresh | Passed |
+| 2026-02-02 | Package Update | Passed |
+| 2026-01-23 | Full Audit | Passed |
+
+**Last Audit Details (pre-v3 baseline):** Package manager (yarn confirmed), Build (0 errors), TypeScript (0 errors), Tests (89/89 passing), Features (all complete), TODOs (none found). Code/SEO/Content audit found and fixed: Firestore disconnectDrive atomicity, console.* → logger across services + dashboard pages, ExamplesPage route + nav + sitemap wiring, dead GitHub link, stale humans.txt/llms-full.txt/security.txt/robots.txt dates, broken icon refs in index.html + manifest.json, stale 1.4.9 → 2.0.0 in JSON-LD softwareVersion. Generic Project Rules tracker at `docs/rules-tracker.md`.
+**Last Verified:** 2026-05-02 | **Next Audit Due:** 2026-05-16
+
+## Re-run procedures (moved from CLAUDE.md)
+
+### Production-readiness audit
+- Read `docs/tracking/production-readiness-audit-tracker.json` FIRST. If `last_run.status == "complete"` AND today < `last_run.next_allowed_run_after`, SKIP — tell the user the date and what completed. If `in_progress`, find the lowest-numbered batch with `status != "completed"` in `batches[]` and resume there. Do NOT redo earlier batches.
+- Per-batch: invoke RULE #0 skills → apply fixes per `BATCH-PLAN.md` → run that batch's verification → ONE commit per batch → update tracker.
+- Final closure: set `last_run.status = "complete"`, `completed_at = today`, `next_allowed_run_after = today + 7 days`. Sync this history + CLAUDE.md summary in the same commit.
+- Override conditions: explicit user bypass, broken build/tests, production incident, critical-dep CVE.
+
+### Public Docusaurus docs site
+- Sibling repo: `/home/ahsan/Documents/01-code/projects/native-update-docs/` (remote `github.com/aoneahsan/native-update-docs`, created by user via `gh repo create`).
+- Hosting: Firebase Hosting project `native-update-docs` (deployed by user via `yarn firebase:deploy`).
+- Dev port: 5960 (preview 5961) — registered in `~/.dev-ports.json` as `native-update-docs`.
+- Tracker: `docs/docs-site/tracker.json`; scope: `docs/docs-site/scope.md`; plan: `docs/docs-site/plan.md` (10 batches); deploy runbook: `native-update-docs/DEPLOY.md`.
+- Re-run protocol: read tracker FIRST; same cooldown/resume logic as the production audit. ONE commit per batch in each affected repo.
+- Why a separate repo: plugin source GitHub is private; a public docs repo gives an additional indexable surface, satisfies AI-bot crawl access, and lets contributors propose doc fixes without plugin-source access.
+- Site totals at last close (Batch 10): 58 pages, ~76k words, full Diátaxis coverage (Tutorials + How-to + Reference + Explanation), 7 discovery files (robots/llms/llms-full/humans/security/sitemap-index/sitemap), 3 JSON-LD blocks per page (WebSite + SoftwareApplication + Organization), Firebase Hosting deploy-ready.