# Coop Stability Audit — Pre-Release

Date: 2026-11-12 · Revision audited: `8fa79aef` (master) · Scope: entire workspace (~35k lines, 18 crates + `desktop` + `web`)

> **Remediation status (2026-11-12, later the same day):** all ten P0 items from §8 have been
> implemented and validated (workspace clippy clean, `cargo fmt --check` clean, 35 tests passing).
> See §9 for the per-fix log. The P1 list (committed as `fd802a88` base) has also been processed —
> see §10.

## 1. Scope and Method

Every crate was audited file-by-file against the project conventions (`AGENTS.md`), Rust best
practices (ownership, error handling, async, API design, anti-patterns), and GPUI lifecycle rules
(entity updates, task/subscription ownership, `ElementId` stability, render purity). Severe claims
were verified against the vendored dependency sources (`gpui-pre 0.3.12`, `gpui-base 0.9.1`,
`gpui-component 0.9.1`, rust-nostr 0.45.6, `gpui-updater-pre 0.2.0`), and the highest-severity
findings were independently re-verified by hand.

Tooling results: `cargo clippy --workspace --all-targets` — **clean, zero warnings**.
`cargo fmt --all --check` — **clean**. `cargo check -p workspace` and `-p person` — pass.

## 2. Executive Summary

**Verdict: not ready for stable release yet.** The codebase is well-structured — clean clippy,
disciplined GPUI entity/subscription hygiene in most crates, good hostile-input handling in the
crypto-adjacent code, and no lock-across-await anywhere. But there are **3 Critical** and
**~27 High** findings that must be addressed first, concentrated in three areas:

1. **Money and key safety** (`nip60`, `state`, `browser-signer-proxy`): a one-event wallet-wipe
   vector, a startup crash loop, a plaintext client key in web `localStorage`, and an
   unauthenticated localhost signing API.
2. **Silent failure paths**: errors from wallet ops, message loads, relay connects, settings
   persistence, and backup/keyring reads are swallowed; several failure states strand data or
   wedge the UI (stuck `loading_more`, permanently-blacklisted profile fetches, dictation dying
   after 30 s).
3. **Wrong results visible to users**: reaction double-counting, multi-line messages flattened to
   one line, contact-list updates that erase relay hints and petnames, stale group state from
   out-of-order relay delivery, duplicate tabs.

### Must fix before stable (P0)

| # | Severity | Location | Issue |
|---|----------|----------|-------|
| 1 | Critical | `nip60/src/lib.rs:420,552` | Spoofed kind:5 deletion from **any** author wipes wallet proofs (operator precedence bug + missing author check in `absorb_deletion`) |
| 2 | Critical | `state/src/lib.rs:117-122` | LMDB open `block_on` + `.expect` → unrecoverable startup crash loop on any DB error |
| 3 | Critical | `state/src/lib.rs:447-449` | Plaintext NIP-46 client secret key persisted to `localStorage` on web |
| 4 | High | `browser-signer-proxy/src/lib.rs:443-571` | Unauthenticated localhost signing API with `Access-Control-Allow-Origin: *`; plaintext theft, request suppression, response forgery |
| 5 | High | `nip60/src/ops.rs:455-488` | Reconcile marks relay proofs `Unspent` unconditionally → resurrects locally-spent proofs (double-spend risk) |
| 6 | High | `nip60/src/ops.rs:381-417` | Publish failure after store commit strands sent/received proofs; no retry path |
| 7 | High | `state/src/file.rs:418-443` | Decrypted-file cache keyed by filename only → user can be served another attachment's contents |
| 8 | High | `chat_ui/src/lib.rs:605-611` | Own reactions counted twice (backup gift-wrap re-delivery, no dedup) |
| 9 | High | `common/src/media_extractor.rs:52-58` | Whitespace collapse destroys line breaks in every message |
| 10 | High | `workspace/src/panels/contact_list.rs:187-191` | Contact-list Update silently strips NIP-02 relay hints and petnames from the published event |
| 11 | High | `nip29/src/lib.rs:541-555` + `group.rs:696-728` | No `created_at` guards: stale relay data resurrects left groups; group state applied last-write-wins |
| 12 | High | `settings/src/lib.rs:403-404,423-438` | Failed settings load silently resets and overwrites the user's file; saves discard errors and race |
| 13 | High | `speech/src/parakeet.rs:134` | Dictation worker exits after 30 s idle → longer dictations silently lost |
| 14 | High | `browser-signer-proxy/src/lib.rs:339-366` | Timed-out signing requests leak plaintext in memory forever |
| 15 | High | `dock/mod.rs:50-73` + `sidebar/rows.rs:54-57` | Tab dedup is dead code (duplicate tabs); "Ignore" screening action dispatches to a handler that can never receive it |
| 16 | High | `nip60_ui/src/wallet.rs:615-726` + `nip60/src/lib.rs:147-185` | Lightning invoice flow broken end-to-end (quotes never rendered or claimable) |
| 17 | High | `state/src/lib.rs:553-554` | Proxy credential write silently discarded (`save.await.ok()`) |
| 18 | High | `person/src/lib.rs:310-333` | One 2 s metadata timeout permanently blacklists those profiles until restart |
| 19 | High | `chat/src/lib.rs:398-403` | Failed-to-decrypt messages are trashed with no UI surface anywhere |
| 20 | High | `chat_ui/src/lib.rs:325-334`, `workspace/src/dialogs/profile.rs:227-235`, `workspace/src/panels/backup.rs:59-76` | Silent failure cluster: room loads, profile URL saves, keyring reads |

The full finding list follows, crate by crate.

## 3. Systemic Patterns (cross-cutting)

**S1 — Task handles accumulate unboundedly (~20 containers, ~48 declaration sites).**
`tasks: Vec<Task<_>>` / `SmallVec<[Task<_>; N]>` fields are pushed on every operation and never
drained; finished `Task` handles held in a container are not reaped by GPUI. Worst offenders:
`nip60/src/lib.rs:79` (a handle per relay event, whole session), `nip4e/src/lib.rs:90` (runs on
every settings change), `chat_ui/src/lib.rs:110`, `nip29/src/lib.rs:90`, `nip29_ui/src/lib.rs:337`,
`person/src/directory.rs:110`, `state/src/lib.rs:95`, plus every workspace dialog. The codebase
already contains the correct patterns: single `Option<Task<_>>` replacement
(`screening.rs`, `greeter.rs`, `debounced_delay.rs`) and reset-on-teardown (`nip29::reset`).
Fix convention-wide: replace-per-spawn for one-shots, `detach_and_log_err` for true fire-and-forget.

**S2 — Silent error discards (~156 `let _ =` / `.ok()` sites outside tests).**
Project rule forbids `let _ =` on fallible ops; `AGENTS.md` requires async errors to reach the UI.
Beyond the P0s above, the recurring case is `_ = this.update(cx, …)` — mostly benign
(entity dropped at shutdown) but should be `.log_err()` for visibility. Files with the most sites:
`dock/tab_panel.rs` (6), `nip60/src/lib.rs` (10), `nip4e/src/lib.rs` (8).

**S3 — `chat_ui` ↔ `nip29_ui` message-panel duplication.**
`ListState` sync + splice bookkeeping (including divergent `ix + 1` vs `ix + 2` offsets),
`rendered_texts_by_id` cache (both share the stale-mention bug), speech reveal + `RevealText`
fallback timer + `end_events` loop, `Speaker` wiring, reaction grouping, `MessageRow` assembly are
near-verbatim copies — and they have already diverged: `nip29_ui` splices at the prepend position
while `chat_ui` always appends (bug 5.7.4). Extract a shared message-panel controller in `ui`.

**S4 — Dialog error-banner + auto-clear timer duplicated four times** with drifted timings
(`restore.rs` 3 s, `import.rs` 3 s, `relays.rs` 2 s, `contact_list.rs` 2 s). One shared
`error: Entity<Option<SharedString>>` helper removes the drift.

**S5 — `DefaultHasher` used for network-persisted IDs.**
`common::EventExt::uniq_id` (`event.rs:12-18`) is hashed into published `r` tags by
`chat/src/lib.rs:1031-1041`; `DefaultHasher`'s algorithm is not stable across Rust versions, so a
toolchain bump silently changes every published room id. Also hand-rolled in three places
(`nip29/protocol.rs:282-286`, `nip29/utils.rs:27-32`). Replace with a stable hash (SHA-256 of
sorted hex pubkeys) in one shared helper.

**S6 — Index-based element ids.** Rows keyed by list index (`sidebar/rows.rs:174+`,
`contact_list.rs:238`, `greeter.rs:226+`, `nip29_ui` reply previews `message.rs:359`) reassign to
different data after mutations; benign today because handlers capture data, but any future
stateful element (hover/focus) in a row will mis-attach. Prefer domain ids (pubkey hex, event id,
room id) as `group_view.rs` already does.

## 4. Findings by Crate

Severity: **[C]** Critical · **[H]** High · **[M]** Medium · **[L]** Low

### 4.1 `state` — central Nostr registry, signers, persistence, files

- **[C] `lib.rs:117-122` — Startup LMDB open: `block_on` + `.expect` = crash loop.** The
  `block_on` itself is acceptable (runs once before the window opens; `NostrLmdb::open` schedules
  nothing back onto the GPUI executor — add a comment saying so). The real bug: a corrupted or
  unwritable data dir makes **every** launch panic with no dialog and no recovery except manually
  deleting data. The web path already does it right (`web_database.rs:30-33` falls back to memory
  with a logged error). Fix: mirror that on desktop — memory DB fallback + `StateEvent::Error` so
  the UI can tell the user local history is unavailable.
- **[C] `lib.rs:447-449` (+ `credentials.rs:29-38`, `common/web_store.rs:21-25`) — Plaintext
  bunker client key in web `localStorage`.** `import_bunker` embeds a fresh `Keys::generate()` into
  the bunker URI and stores the credential unencrypted on wasm. XSS/malicious extension/shared
  machine = signature capability through the bunker (bunkers commonly auto-approve registered
  clients). Desktop stores it in the OS keyring, which is fine. Fix: on wasm, passphrase-encrypt
  (NIP-49) like `import_nsec` does, or keep the session memory-only.
- **[H] `lib.rs:553-554` — Proxy credential write silently discarded.**
  `cx.background_spawn(async move { save.await.ok() }).detach();` — keyring failure = user silently
  dropped to login next launch. Log + emit `StateEvent::error`.
- **[H] `file.rs:418-443` — Decrypted-file cache collides by filename.** Cache key is
  `sha256(name)` and the `metadata().is_err()` guard skips the write, so two attachments named
  `invoice.pdf` from different chats resolve to the **first** file's path. Fix: include the
  attachment sha256/URL in the key, or always overwrite via the atomic-rename path.
- **[M] `lib.rs:373-386` — Web `ncryptsec` stored with `KeySecurity::Medium` (2¹⁶ PBKDF2).**
  Encrypted, but offline guessing at 2¹⁶ defeats human passphrases. Raise to `Strong` and/or move
  to IndexedDB + session-only keys. Acceptable if documented as a tradeoff.
- **[M] `lib.rs:564-589` — Stale proxy monitor can log out a newer session.** The monitor's guard
  is only `current_user.is_some()`; if the user disconnects the proxy and signs in with nsec/bunker
  before the next 5 s tick, the monitor swaps the **active** signer for `Keys::generate()`. Fix:
  capture the proxy pubkey at spawn and only act if it's still the active signer.
- **[M] `lib.rs:95` — `tasks` vec grows forever** (see S1; `connect_proxy` alone pushes four).
- **[L] `lib.rs:714` `to_bech32().expect("infallible")`; `signer.rs` ×7
  `.expect("RwLock poisoned")`.** Practically unreachable, but a poisoned signer lock is the worst
  failure mode for a signer — prefer `unwrap_or_else(|e| e.into_inner())`.
- **[L] `lib.rs:93` — `passphrase_required` written, never read** (UI learns via
  `StateEvent::PassphraseRequired`). Delete or expose.
- **[L] `file.rs:381-384` — `DownloadedFile::save` (wasm) has no callers.** Remove or wire up.
- **[L] `lib.rs:647-656` — Dead search-relay guard.** Vendored nostr-sdk: `Client::relay()` returns
  `Result<Option<_>>`, so `is_ok()` is always true and the "Failed to add search relay" branch is
  unreachable. Test `is_ok_and(|r| r.is_some())` or drop the check.
- **[L] `file.rs:221-258` — No size limit on pick/upload** (`MAX_FILE_SIZE` enforced only on
  download); a multi-GB pick is read fully into memory. Check size before reading.
- **[L] `file.rs:427-441` — Plaintext decrypted files in `temp_dir()/coop-files`, default
  permissions, never purged.** Consider 0600 + best-effort purge on exit. Also `file.rs:150`
  builds `file://{path}` by string concat (breaks on `#`/`?`/`%`).
- **[L] `file.rs:291` — Blossom rejection classified by `message.contains("415")`** — match the
  HTTP status instead. `file.rs:172` — 16-byte GCM nonce; 12 bytes is the norm.
- **[L] `lib.rs:280-289` — `restore_session` cfg branches compile to empty bodies on wrong
  target**, silently emitting no event. `debug_assert!` or fall through to `NoSigner`.
- **[L] `file.rs:446-451` + `web_file.rs:164-174` — Web blob URLs never revoked** when replaced;
  every decrypted file pins its bytes for the page lifetime.
- **[L] `lib.rs:683-687` — Search results can contain duplicate pubkeys.** Dedupe.

Positives: device key stored only NIP-44-encrypted to self in the local DB; bunker credentials
verified before persisting; `UniversalSigner` clones the inner `Arc` out of the lock before
awaiting (no locks across `.await`); downloads size-capped and hash-verified; `Keys`' vendored
`Debug` hides secrets.

### 4.2 `nip60` — NIP-60 Cashu wallet engine

- **[C] `lib.rs:420` + `lib.rs:552-572` — Spoofed kind:5 deletion can wipe the wallet.**
  `let wallet_event = ours && is_cashu || is_token_deletion(&event);` parses as
  `(ours && is_cashu) || is_token_deletion(&event)` — deletion events from **any** author are
  forwarded, and `absorb_deletion` never checks `event.pubkey == me`. Kind 7375 event ids are
  public on relays; one attacker event removes our tokens, marks them stale, and the Reconcile
  deletes the real proofs from the store (restore-only recovery). Fix:
  `wallet_event = ours && (is_cashu || is_token_deletion(&event))` + author check inside
  `absorb_deletion` for defense in depth.
- **[H] `ops.rs:455-488` (with `proof_info` `ops.rs:601-617`) — Reconcile resurrects spent
  proofs.** Every relay-token proof is added to the store hardcoded `State::Unspent`, ignoring the
  proof's existing store state. After any failed-publish op, reconcile re-adds proofs this device
  itself marked spent/reserved (incl. offline sends the recipient also holds) → bogus balance,
  real double-spend race. Fix: skip `y`s already in the store with non-Unspent state; verify
  unknown proofs against the mint (NUT-08) before adding.
- **[H] `ops.rs:381-417` + `lib.rs:836-843` — Publish failure after store commit strands funds.**
  If `send_event` fails, the confirmed `TokenUpdate` is dropped: for `SendToken` the token string
  is lost (proofs spent locally, recipient never gets it); for `Receive` proofs sit unpublished and
  a retry errors as duplicate. Reconcile only republishes when `mint_unissued_quotes() != 0`
  (`ops.rs:429-432`), so it doesn't heal this. Fix: retain the confirmed update on error; force
  republish whenever the store's unspent set differs from relay state.
- **[H] `ops.rs:420-453` — Quote-minting publish can `del` events whose proofs aren't converged
  yet.** `previous_ids` is the schedule-time relay snapshot; if another device's token was absorbed
  but not yet converged, the published event `del`s the id while omitting its proofs — those proofs
  get pruned everywhere while remaining spendable at the mint. Fix: converge before publish, or
  only `del` when the published proof set fully covers the id.
- **[H] `lib.rs:616,651` + `lib.rs:902-912` — Failed nutzap redemption stuck until restart.**
  `redeeming.insert` happens before scheduling; the `Err` branch never removes the id and
  `absorb_nutzap` skips anything in `redeeming`, and nothing requeues to `pending_nutzaps`. Fix:
  remove + requeue with bounded retries on error.
- **[H] `lib.rs:79` — `tasks` grows by a handle per relay event** (see S1).
- **[H] `lib.rs:147-149,172-185` — `mint_quotes()`/`claim_mint_quote()` dead → created invoices
  are never displayable or claimable.** `Outcome::QuoteCreated` pushes into `self.quotes` and
  nothing ever reads it (workspace-wide grep). Quotes also accumulate forever. Fix with the invoice finding in 4.3 below.
- **[M] `lib.rs:188-215` — `melt()` and `send_token()` unreachable; `WalletEvent::TokenCreated`
  emitted only from the dead path** while `workspace/src/lib.rs:226-236` promises "copy it from
  the wallet panel". Wire into UI or remove; fix the notification text regardless.
- **[M] `lib.rs:285-370` — Concurrent `setup()` can fork the wallet key** (only guarded by
  `loading`); absorption tie-breaks with `created_at >=` on second-granularity timestamps, and
  stores are keyed by wallet pubkey — the losing key orphans its funds. Fix: `setup_in_progress`
  guard; deterministic tie-break (event id).
- **[M] `lib.rs:430-432` — `processed_events.clear()` at 1000 entries** re-delivers a burst;
  evict oldest instead.
- **[M] `lib.rs:615-661` — Nutzap `unit` tag never validated**; a `usd` nutzap passes local
  validation. Require `unit == "sat"` in `Nutzap::from_event`.
- **[L] `lib.rs:301-303,699-701` — Silent no-ops**: `setup()` when mint already listed;
  `ensure_wallets` on unparseable mint URLs forever. Surface feedback.
- **[L] `ops.rs:107` — ClaimQuote history records `quote.amount.unwrap_or_default()`** (0-sat
  inflow when mint omits amount); use the summed proof amount.
- **[L] `Cargo.toml:23` — `tokio` dep unused** (only `gpui_tokio::Tokio` is referenced). Remove.

Positives: store-before-publish enforced via cdk prepare/confirm sagas; all relay-derived content
author-checked before decryption; `keys.rs` secret handling clean (no Debug on `WalletData`, no
secrets in logs, HKDF salt pinned by test); single-flight job queue; `WalletEvent::Error` reaches
notifications even with the panel closed.

### 4.3 `nip60_ui` — wallet panel + dialogs

- **[H] `wallet.rs:615-726` — Invoice button creates an invoice the user can never see or pay.**
  After `create_mint_quote` the bolt11 string lands in `WalletRegistry::quotes`, which nothing
  renders. Receive-via-lightning is broken end-to-end, silently. Fix: render pending quotes
  (request + copy + check/claim) in the dialog/panel, refreshed on `WalletEvent::Updated`.
- **[M] `wallet.rs:765` — `render()` clones the whole history `Vec` every frame** (history is
  unbounded). Snapshot into `Rc` only on `WalletEvent::Updated`. Same for `filtered_contacts`
  (`wallet.rs:542`) — cache on input change.
- **[L] `wallet.rs:206,284,356` — `SendDialog::tasks` accumulates** (see S1).
- **[L] `wallet.rs:262-264` — `load_contacts` gives up silently pre-login**; retry on
  `StateEvent::SignerChanged` (sidebar already does this).
- **[L] `wallet.rs:728-733` vs `lib.rs:28-34` — amount parsing duplicated.** Share `parse_amount`.

Positives: `cx.notify()` on all mutating paths; per-key hex ElementIds; stored subscriptions;
history list windowed via `uniform_list`.

### 4.4 `browser-signer-proxy` — NIP-46 localhost bridge

- **[H] `lib.rs:443-571` — Unauthenticated API + `ACAO: *`.** Every response sends
  `Access-Control-Allow-Origin: *` (verified at :556, :588, :607, :631); no `Host`/`Origin` checks.
  Consequences: (1) `GET /api/pending` returns full `sign_event`/`nip44_encrypt` params (message
  plaintext) readable by any web page in Firefox-family browsers and by DNS rebinding anywhere;
  (2) `:516-517` clears the queue on read → third party can steal requests so the real extension
  page never sees them; (3) `POST /api/response` accepts any `{id, result}` → forged
  `get_public_key` substitutes an attacker pubkey as "the user". Fix: drop CORS entirely (the
  served page is same-origin), reject non-`127.0.0.1:7400` Host, gate `/api/*` on a per-session
  random token embedded in the served page.
- **[H] `lib.rs:339-366` — Timed-out requests leak forever.** The `RequestData` and oneshot sender
  stay in the maps after the 30 s timeout — plaintext retained for the session, re-served to
  whoever polls next, map grows unboundedly. Remove entries on timeout (self-removing guard or
  id-returning `request`).
- **[M] `lib.rs:374-380` — `_sign_event` verifies the signature but not the event.** Nothing checks
  the returned event matches the requested `UnsignedEvent` (pubkey/content/tags/kind/created_at);
  a compromised signer page can substitute content. Compare before accepting.
- **[M] `lib.rs:538` — Decrypted plaintext debug-logged.** `tracing::debug!("Received response …
  {message:?}")` leaks `nip44_decrypt` output and event content the moment anyone runs with
  `RUST_LOG=debug`. Log id + method only.
- **[M] `lib.rs:447,465-480,523` — Unbounded reads/allocations**: header line grows unbounded;
  `vec![0u8; content_length]` trusts `Content-Length` (4 GiB reservation from one POST); no
  connection timeout. Cap header block (16 KiB), cap body (1 MiB), add idle timeout.
- **[L] `lib.rs:650-678` — `race_timeout` reports channel-closed as timeout.** Distinguish.
- **[L] `lib.rs:574-638` — Three near-identical response writers**; one function with a header
  options struct (also makes the CORS removal enforceable in one place).
- **[L] `lib.rs:546,563,593,612,636` — bare `let _ =` on writes**; centralize the
  best-effort-write rationale in the helper.

Positives: loopback-only bind, graceful shutdown tied to handle lifetime, per-request timeouts,
UUID ids, bounded channels.

### 4.5 `nip4e` — per-device keys

- **[M] `lib.rs:1036,774-860` — Approval button wedged + double-clickable.** `loading.set(true)`
  without `cx.notify()` keeps the old button enabled (double-click sends the secret in two 4455
  events); on failure `loading` is never reset and the notification isn't removed. Notify after
  setting, reset on error, rebuild the notification on both outcomes.
- **[M] `lib.rs:403-405` — Rotation skips archiving silently, then overwrites the key.** If the DB
  read/decrypt fails transiently, `archive_key` is skipped but `set_keys` still overwrites → old
  chats permanently undecryptable. Make archive failure abort rotation (or log loudly).
- **[M] `lib.rs:175-206` — Relay listener can die silently.** `tx.send_async(...).await?` aborts on
  full bounded(100) channel or dead consumer; the task's `Err` is never inspected. All 4e event
  processing stops until the next signer change. Log and handle backpressure.
- **[M] `lib.rs:90` — `tasks` grows on every settings change** (`get_announcement` runs per
  settings mutation) — see S1.
- **[M] `lib.rs:177,184` — `processed_events` inserts **every** relay event** (insert precedes the
  kind filter) and grows unbounded. Filter first; bound the set.
- **[L] `lib.rs:303-309` — Desktop key backup file written 0644** (subject to umask); use 0600.
- **[L] `lib.rs:178` — `current_user` snapshotted per listener**; events between signer change and
  `get_public_key_async()` resolving are dropped, and a stale snapshot can briefly forward one
  account's events to the next handler. Re-check per event.
- **[L] `storage.rs:29-32` — Malformed stored `created_at` silently resets the rotation
  interval.** Log the fallback.
- **[L] Zeroization gaps** (`app_keys`, decrypted secrets in `decrypt_approval`/`approve`): Low —
  the nostr stack itself doesn't zeroize; note as defense-in-depth.
- **[L] `lib.rs:141,246,426,458,845,854,894,1041` — `.ok()` discards** (see S2); `lib.rs:479`
  single-letter `n`.
- **[L] `lib.rs:136,241,888,914` — `cx.windows().first()` targets an arbitrary window** (matters
  only if multi-window ever lands).

Positives: secret never published/logged; transfer encrypted to a fresh one-time keypair;
approvals re-validated against the live announcement; stale requests dropped by age; bounded
archive; account switch wipes pending state.

### 4.6 `chat` — chat registry + rooms

- **[H] `lib.rs:331-338` + `message.rs:203-220` — Failed-to-decrypt messages silently trashed;
  nothing renders `trash`.** The `trash: Entity<BTreeSet<FailedMessage>>` is written, cleared, and
  reprocessed, but has **no reader or renderer workspace-wide**. A user whose incoming message
  can't be decrypted gets zero feedback — core E2EE UX gap. Emit a `ChatEvent` or render an
  indicator.
- **[M] `lib.rs:284,327,620-635,726,733,854,892` — `RwLock` `.read().unwrap()`/`.write().unwrap()`
  poisoning crash loop.** `search.write()` runs on a background thread; one panic while holding it
  turns every later foreground read into a panic. These maps are reconstructible heuristics — use
  the tolerant `poisoned.into_inner()` pattern the codebase already has
  (`person/src/directory.rs:226-233`).
- **[M] `lib.rs:779-780` — Off-by-one index stored in `room_map`** (`rooms.len()` after push).
  Currently unreachable (batch rooms come from an id-keyed set) but any future reader panics at
  `self.rooms[index]`. Store `len() - 1`, or drop the never-usefully-read index bookkeeping.
- **[M] `lib.rs:440-443,454-461,825-833` — Discarded subscribe result + `unwrap_or_default()`.**
  `_ = client.subscribe(...)` (rule violation); a DB error becomes "not found" → false
  "Messaging Relays not found" retry prompt, and a contacts DB error classifies peer rooms as
  `Request` instead of `Ongoing` (wrong trust classification). Distinguish errors from empty.
- **[M] `lib.rs:110,199,232-358,362-414` — Stored task results never inspected** (see S1/S2); a
  dead notification listener silently stops message delivery — at least `detach_and_log_err`.
- **[L] `room.rs:637-646` — `deliver<S>` generic has one implementation**; inline it.
- **[L] `lib.rs:867` — `max_by_key().unwrap()`** relies on an invariant three lines up;
  `let Some(...) else { continue }` documents it.
- **[L] `lib.rs:332-338` — Empty-tags rumor is both trashed and delivered** (appears as failure
  entry *and* rendered message until reprocess). Pick one path.
- **[L] `room.rs:350` — `self.members[0]` safe only via a cross-crate invariant**
  (`extract_public_keys` always appends the author). Add `debug_assert!` or a comment.
- **[L] `Cargo.toml:28-29` — `smol` unused.** Remove.
- **[L] `lib.rs:182-186` — `let _ = entity.update(...)`** in deferred init; `.log_err()`.

Positives: signal batching bounds per-update work; wasm yield loop; gift-wrap dedup; seal
verification; `WeakEntity` room handles; `ChatEvent::Error`/`Loaded`/`Ping` genuinely surfaced.

### 4.7 `chat_ui` — chat panel

- **[H] `lib.rs:605-611` — Your own reactions count twice.** `insert_reaction` pushes
  unconditionally (keyed only by target id); with `backup: true` (default) the reaction comes back
  as your own backup gift wrap → inserted again → "👍 2". Text messages are dedup'd by
  `binary_search`; reactions aren't. The dormant `RoomEvent::Reload` path double-counts too.
  Track seen reaction event ids.
- **[H] `lib.rs:325-334` (+ `272-277`) — Room message-load and connect failures swallowed.** The
  stored task's `Result` is never inspected: user sees an empty room with no error; relay
  subscription failures invisible. Push a notification on error.
- **[M] `lib.rs:557-581` — Bulk load is O(n²) on the foreground thread.** Per-event
  binary-search + index rebuild + splice inside one `update`; multi-second stall on big rooms.
  Add a bulk variant (sort once, rebuild index once, splice once).
- **[M] `lib.rs:569-570` — Insert position and `ListState::splice` disagree.** Messages are
  binary-inserted by `created_at` but the list always appends at `len..len`; mid-`Vec` arrivals
  shift rows while the list state learns "appended one" → stale height caches, scroll jumps.
  `nip29_ui/src/lib.rs:516` does it right: `splice(pos + 1..pos + 1, 1)`.
- **[M] `lib.rs:1183-1198` — `rendered_texts_by_id` caches mention names forever** (same defect as
  `nip29_ui` 4.8). A message rendered before the profile loaded shows `@npub1…` all session.
  Key the cache on directory generation or drop the resolved-text cache.
- **[M] `lib.rs:50-51,395-398` — `\p{Emoji}` matches plain digits: typing "2" while replying to
  exactly one message sends a "2" reaction instead of a message.** Require
  `[\p{Emoji_Presentation}\p{Extended_Pictographic}\u{200D}\u{FE0F}\u{20E3}]`.
- **[M] `lib.rs:110` — `tasks: Vec<Task>` grows without bound** (see S1).
- **[M] `lib.rs:547-549,618,623` — `reports_by_id: Arc<RwLock<...>>` nothing else shares.** Plain
  `BTreeMap` field; removes the poisoning risk for zero benefit.
- **[L] `lib.rs:499` — `rumor.id.expect("rumor must have an id")`** — invariant holds today, but
  degrade + notify instead of panic per house style (also `to_bech32().unwrap()` at 652, 1072).
- **[L] `lib.rs:362-370,797-802` — `.ok()` discards `room.update`** (subject change, retry action).
- **[L] `lib.rs:722-727` — `encrypted` snapshotted before the file-picker await**; typing while the
  picker is open classifies the file by stale input state. Re-read after the await.
- **[L] `lib.rs:1170-1178` — `load_file` invoked from the render path** (guarded, but render should
  be pure — move to a subscription).
- **[L] `lib.rs:147-221` — Summary comments** ("Define input state", …) violate the comment rule.

### 4.8 `nip29` — NIP-29 registry + protocol

- **[H] `lib.rs:541-555` (merge), `582-607` (absorb_list) — Stale group-list events resurrect left
  groups and get republished.** The kind 10004 list is absorbed without comparing `created_at` and
  `merge` never removes entries absent from older snapshots; a relay still holding the pre-leave
  version re-adds the left group, `ensure()` re-creates subscription, and the next
  `refresh_entry`/`publish_list` republishes the left group to all write relays (privacy angle).
  Track the last accepted list event's `created_at`; ignore older.
- **[H] `group.rs:696-728` (absorb_state) — Group state applied last-write-wins, no ordering
  guard.** Out-of-order relay delivery (newest-first is common) leaves the *oldest*
  metadata/members/admins/roles/pins displayed indefinitely. Cache hydration is safe (sorted
  ascending at `group.rs:507`); the live path is not. Keep `created_at` per state kind (the
  `forks` map at `lib.rs:669-675` shows the pattern).
- **[M] `lib.rs:173-174,189` — Join published optimistically; refusal classified by relay error
  prose** (`reason.starts_with("duplicate")`); a refused join stays in the public list. Drop the
  entry on refusal; detect duplicates via a stable marker.
- **[M] `lib.rs:173,825-834` — Rejoin flips a private list entry to public** (`join_key` hardcodes
  `private: false`, `upsert` replaces the whole entry). Preserve the existing flag.
- **[M] `group.rs:418-448` + `lib.rs:383-397,1146-1159` — Failed page load leaves `loading_more`
  stuck true forever** (subscribe error path emits no signal; guard then permanently blocks
  pagination for the session). Route a synthetic settle on error.
- **[M] `lib.rs:308-330` + `discovery.rs:253,267,274,281` — Network failures silently produce
  "empty" results** (`and_connect().await.ok()`, discarded sync errors): browse shows zero
  candidates, discovery silently stale. Surface `GroupsEvent::Error`.
- **[M] `discovery.rs:240-252,264-267` — Empty contact list → `Filter::authors(∅)` serializes as
  absent → the sync reconciles **every user's** list, and the pool-wide sweep (kinds
  `[GroupMetadata, GroupMembers]`, no ids/limit) pulls all NIP-29 state from all relays.**
  Early-return when `authors.is_empty()`; constrain the sweep.
- **[M] `group.rs:457-511` + `lib.rs:906-941,1042-1071` — Every live event triggers a full
  unlimited `load_envelopes` reload** (re-query + JSON-decode + sort of entire group history per
  message) and every event is cached forever. Use the single-event absorb path live; cap/prune the
  cache.
- **[M] `lib.rs:90` — `tasks: SmallVec<[Task; 2]>` accumulates per incoming event** (see S1).
- **[L] `protocol.rs:389-399,534,650,964` — One malformed optional tag fails the whole parse**
  (one bad `supported_kinds` value blanks a group's metadata display). Skip + log instead.
- **[L] `protocol.rs:24` — Custom kind 9010 not in rust-nostr 0.45.6's NIP-29 range**; confirm
  against target relay implementations before stable.
- **[L] `group.rs:602-611` — `previous` mismatch only logs a warning**; an empty `previous` tag
  counts as fully verified (`protocol.rs:1046-1056`). Align comment with behavior or escalate.
- **[L] `protocol.rs:995-1016` — `TimelineWindow.seen` grows unbounded** (u32/event, never pruned).
- **[L] `lib.rs:582-607,661-677` — No client-side author re-check on list/fork subscriptions.**
  Mitigated by `verify_subscriptions(true)` + `ban_relay_on_mismatch(true)`; note the residual
  NIP-29 trust model rests on relay admission policy.
- **[L] `lib.rs:860-904` — Concurrent `publish_list` can complete out of order** (each snapshots at
  call time; older snapshot can win). Serialize publishes.
- **[L] `lib.rs:1225-1230` — Negentropy/foreign-EOSE cross-talk** fires spurious `Synced` signals
  from unrelated subscriptions.
- **[L] `utils.rs:24,31,35` — Subscription ids truncate the digest to 32 bits**; collision would
  cross-wire routes. Negligible at this cardinality; use the full digest anyway.
- **[L] `lib.rs:1198-1200` — `processed` dedup wholesale-cleared at 10k**; evict oldest instead.
- **[L] `lib.rs:723-736` — `previews` grow unbounded per session** (entity + subscription each).
- **[L] `group.rs:197-202` — `Group::message(id)` O(n) scan** called per reply preview in render
  paths → O(n²) timelines. Build an id→row map.
- **[L] `Cargo.toml:14` — `person` dep unused.** Remove.
- **[L] `lib.rs:1208-1229` — `.ok()` on signal sends** (benign; log or comment per rule).
- **[L] `lib.rs:358,949,975` — Inline global-handle chains** (rule: bind to a local).

Positives: zero reachable panics; tag parsing consistently `get`/`skip`/`first`;
`saturating_sub` timestamp math; tasks/subscriptions stored; `WeakEntity` spawns; membership
derivation order-independent; strong publish-error propagation.

### 4.9 `nip29_ui` — group panel + dialogs

- **[H] `lib.rs:1053-1067` — `rendered_texts_by_id` bakes mention names in permanently.**
  Computed once per `EventId`; when the profile arrives later the body keeps `@npub1ab…` (the
  header recovers via re-render, the body doesn't). Key on directory generation or don't cache the
  resolved text (only the markdown source needs caching).
- **[M] `lib.rs:337` — `tasks` accumulates** from every send/upload/react/delete/pin (see S1).
- **[M] `lib.rs:1068` — Content `TextView` keyed by row index.** Prepending shifts every index →
  every visible `TextViewState` re-parses markdown in one frame ("Load earlier messages" jank).
  Use the message id as element id.
- **[M] `message.rs:359` + `lib.rs:1068` — Sibling ElementId collision: reply previews use bare
  reply index as sibling of the row-index TextView**; when `replies.count > row_index` both sides
  share `…/[N]/[N]`. Latent today, breaks silently when element types coincide. Namespaced ids.
- **[L] `message.rs:192,227,238` — `let _ = panel.update_in(...)`** where sibling call sites log
  (`log::warn!` at 110-160). Mirror the logged pattern.
- **[L] `lib.rs:630` — File-picker failure silently swallowed** (task result never inspected).
- **[L] `lib.rs:436-445` — Utterance-end loop clears the reveal unconditionally**; interrupted
  utterances still fire `on_utterance_end` on many backends, cancelling B's reveal while B's audio
  plays. Guard with the session id like `message.rs:144` does.
- **[L] `message.rs:97,130,168-180` — Per-frame per-row allocations** (`preview()` computed twice
  per row per frame, custom-emoji `Vec` rebuilt + cloned into the submenu closure every render —
  and gpui-pre redraws the window on every keystroke). Compute once per render.
- **[L] `lib.rs:677,956` — Inline global chains** (rule).
- **[L] `lib.rs:407-419` — Subscribe + observe both run `sync` + `track_participants`** (events
  and notifies fire together) → double O(rows) scan per change.
- **[L] `message.rs:322` — Empty role list renders "is now "** (trailing space, no roles). Emit
  "now a regular member" for the empty case.

### 4.10 `common` — shared utilities

- **[H] `media_extractor.rs:52-58` — Every message body has all whitespace collapsed, destroying
  line breaks.** `cleanup_text`'s `\s+ → " "` runs on the entire remaining text unconditionally,
  so multi-line messages render as one line in both chat and groups (via `chat/message.rs:99-103`).
  Normalize only around removed URLs; never touch `\n` in untouched regions.
- **[M] `media_extractor.rs:15-18,56,62-65` — Regexes compiled per message** (the cache struct's
  own entry point defeats it). `static LazyLock<Regex>`.
- **[M] `parser.rs:240,254,260` — `NostrParserIter::next` recurses per token; depth is
  attacker-controlled** (~9 bytes/token of crafted `nostr:` URIs). Desktop's 8 MB stack survives;
  the wasm32 web build can crash the tab. Rewrite as a loop.
- **[M] `event.rs:12-18` — `uniq_id` uses `DefaultHasher` and is persisted to published events**
  (see S5).
- **[M] `paths.rs:7,14,23,31` — `expect()` on `dirs::download_dir()` etc.** — legitimately `None`
  on Linux without XDG user-dirs → panic on export (`workspace/src/lib.rs:405`). Return `Option`
  and handle.
- **[L] `display.rs:18,20,39` — `as i64` on relay-controlled timestamps** (contained by
  `LocalResult`); fallback magic strings `"9999"`/`"1m"`.
- **[L] `event.rs:12-53` — `Event`/`UnsignedEvent` impls duplicate the same logic with drift**
  (one sorts, one doesn't). Factor into one helper — same helper fixes S5.
- **[L] `debounced_delay.rs:33` — `_ = channel.send(())`** explicit silent discard (harmless;
  satisfy the rule with a comment + `if let Err`).

Positives: `web_store.rs` error handling exemplary; parser char-boundary-safe throughout;
`DebouncedDelay` cancellation correct; time formatting degrades gracefully.

### 4.11 `person` — profiles + web of trust

- **[H] `lib.rs:310-333` + `204-245` — One failed metadata batch permanently blacklists those
  pubkeys.** `in_flight` removal happens only on metadata arrival; `get_metadata` uses
  `TIMEOUT = 2 s` (tight for bootstrap relays + EOSE) and on failure keys stay in `in_flight`
  forever → those people show truncated-pubkey placeholders until restart. Return failed keys on
  error and release them; raise the request timeout independently of the batching window.
- **[M] `lib.rs:175` — Malformed metadata wipes a good profile.**
  `Metadata::from_json(...).unwrap_or_default()` replaces previously-loaded data with a default
  `Person`; content is attacker-influenceable (anyone can publish metadata for any key). Skip on
  parse failure.
- **[M] `directory.rs:110` (+ `lib.rs:255-262`) — Task handles accumulate per `track`** (see S1).
- **[M] `directory.rs:161-172` — `person()` performs side effects (lock write + network fetch) from
  a render-time getter.** Deduped via `pending`, but order-dependent render behavior; consider an
  explicit `ensure_tracked` from update paths.
- **[L] `wot.rs:100,343` — DB errors silently become empty results**; add `log::warn`.
- **[L] `wot.rs:150-153` — `let _ = this.update(...)`** (commented, periodic; noted for the rule).
- **[L] `person.rs:23-47` — `PartialEq/Eq/PartialOrd/Ord/Hash` for `Person` unused
  workspace-wide**; the `Ord` impl clones `Metadata` twice per comparison. Delete.
- **[L] `person.rs:66-68,124-138` — `metadata()` clones per call; `name()` calls it twice** per
  invocation → 2+ clones per avatar/name row per frame. Borrow or cache.
- **[L] `person.rs:166-177` — `shorten_pubkey` doc example doesn't match output; panics if
  `len ≥ 63`** (callers use 4/8 today). Note: the `let Ok(...) =` pattern compiles only because
  `ToBech32::Err = Infallible` — worth a comment since it looks like a compile error.

Positives: WoT builder caps hostile publishers; poisoning-tolerant lock helpers; bounded dispatch
channel; `limit(1)` newest-event lookups verified correct against nostr-lmdb ordering.

### 4.12 `speech` — dictation + TTS

- **[H] `parakeet.rs:134` — Inference worker exits after 30 s idle, permanently disabling
  dictation.** `recv_timeout(30s)` kills the thread; the `OnceLock` sender survives, so after
  that every `send` fails — and `send_or_log` (`:200-204`) logs at **debug** and drops. A
  `MAX_SECONDS = 120` dictation records fine, then `finish()`'s `Transcribe` goes into the void;
  gpui-kit's 180 s `stop_timeout` then force-ends with an **empty** transcript. Net: dictations
  longer than 30 s silently lost after up to a 3-minute hang. Fix: block on `recv()` (an `Unload`
  command already exists for explicit retirement), and make `finish()` surface send failure via
  `sink.error`.
- **[M] `parakeet.rs:63-68` — Audio past 120 s silently discarded** mid-sentence with no
  indication. Surface once or stop capture at the cap.
- **[M] `parakeet.rs:119-128` — Worker-spawn failure leaves a permanently dead channel** (receiver
  dropped, sender cached in the `OnceLock` forever). Don't cache on failure.
- **[M] `speaker.rs:36-53` — `Tts::default()` constructed lazily inside `speak()` invoked from
  render paths**; first-use engine init can take tens-to-hundreds of ms on the UI thread
  mid-render. Initialize eagerly at panel creation or on the background executor.
- **[L] `model.rs:82-97` — `status()` does filesystem I/O per call** while the settings dialog
  polls every 500 ms on the foreground. Cache status in the state mutex.
- **[L] `model.rs:183` — `let _unused = fs::remove_file(...)`**; log per rule.
- **[L] `web.rs:23-25` — `is_available` hardcodes `true`**; mic button renders enabled in browsers
  without `SpeechRecognition`. Reflect actual support.
- **[L] `web.rs:200,218` — `let _ignored` abort/stop** — commented, best-effort; fine.

Positives: `catch_unwind` isolation around model load/transcribe; staged download with SHA-256 +
size cap + atomic rename; dedicated threads for inference/download; all other fallible paths
reach `sink.error`.

### 4.13 `settings` — persistence + themes

- **[H] `lib.rs:403-404` + `311-314` — Failed load silently resets settings and destroys the saved
  file.** `unwrap_or(Settings::default())` swallows I/O and JSON errors; the observer then
  immediately writes defaults over the user's file (losing `trusted_relays`, pins, wallet prefs)
  with no log. Log, keep defaults in memory, but don't persist until a real user change.
- **[H] `lib.rs:423-438` — Saves discard errors and race each other.** `.await.ok()` hides
  disk-full/permission failures; every change detaches a new concurrent write to the same path —
  last-completion-wins can overwrite newer snapshots and interleaved truncate/write can corrupt
  the file (font-size input ticks each trigger a save). Single writer slot + temp-file + rename +
  `log_err`.
- **[L] `lib.rs:425` — Serialization failure silently skips saving**; log.
- **[L] `lib.rs:596-639,671-683` — `apply_persisted_theme` re-reads and re-parses the settings
  file four times.** Parse once.
- **[L] `lib.rs:211,408` — `Url::parse(DEFAULT_FILE_SERVER).unwrap()`**; `OnceLock` or a reasoned
  `expect`.

Positives: accessor macros keep 20 settings consistent; serde default/alias migration fields with
tests covering old formats; wasm path handled.

### 4.14 `workspace` — core + dock + sidebar

- **[H] `dock/mod.rs:50-73` + `lib.rs:309-320` — Tab dedup is unreachable; repeated opens stack
  duplicate tabs.** `find_panel` matches on `PanelId`, which is always `PanelId::from(entity_id())`
  of a panel created in the same statement — so it can never match (verified against gpui-base
  0.9.1 `add_panel_inner`, which inserts without dedup). Clicking the same chat row twice opens
  two live panels for one room; ShowInbox/Browse/Contacts/Backup multiply tabs. Key panels by
  domain identity (singleton entities per panel name, or room/group key). The ~55 lines of
  `find_panel`/`move_panel` are dead until then.
- **[H] `sidebar/rows.rs:54-57` — "Ignore" dispatches `ClosePanel` where it can never be handled.**
  The only handler is on the tab-group frame; the alert dialog holds focus at that moment, and
  dispatch resolves along the focus node's ancestor path — the dock tree isn't on it. Clicking
  "Ignore" is a silent no-op for a destructive-intent action. Close the room via the dock handle
  already in scope, or restore focus first.
- **[H] `sidebar/header.rs:38,236-268` — Updater buttons render stale status.** Nothing observes
  the `AutoUpdater` entity (gpui-pre has no read-tracking); a staged update can sit invisible on
  an idle window indefinitely. Add `cx.observe(&updater, …)`.
- **[M] `sidebar/mod.rs:192-206` + `search.rs:70-117` — Full message-index scan on the foreground
  thread for every keystroke.** Only the *global* search is debounced; local search synchronously
  scans every indexed message, sorts the entire match set, then truncates. Debounce + background
  spawn + partial top-`limit` select.
- **[M] `sidebar/list.rs:41,178-248` + `group_view.rs:88-136` — Row model rebuilt on every sidebar
  render** (clone + partition + pin-tag scans ×visible rows; sidebar re-renders on 500 ms ticks,
  keystrokes, group updates). Cache the row model in state, refresh on registry events.
- **[M] `sidebar/search.rs:152-155` — Global search failure renders as "No profiles found".**
  Surface the error state.
- **[M] `lib.rs:410-421` — Save-dialog failure silently cancels the backup** (`Err(_) => return`):
  indistinguishable from user cancel; user believes the key was backed up. Split arms + notify.
- **[M] `sidebar/mod.rs:139-142` — Whole-sidebar re-render on every `GroupsEvent::Updated`**
  (acknowledged TODO; compounds the row-rebuild cost). Gate on visibility.
- **[L] `dock/skin.rs:25,35-37,55` — `toggle_button_visible: Cell<bool>` is write-once** (set true
  in ctor, never elsewhere) → dead state + dead branch at `tab_panel.rs:212`. Delete.
- **[L] `sidebar/rows.rs:174-374` — Index-based row ids** (see S6).
- **[L] `dock/tab_panel.rs` ×6, `skin.rs:262`, `sidebar/search.rs:164,178`, `lib.rs:641` — `let _ =
`/`.ok()` on fallible updates** (see S2); `lib.rs:641` is pre-destructive-reset — make it visible.
- **[L] `rows.rs:220-222,346-351`, `list.rs:53-55` — Inline global chains** (rule).
- **[L] `lib.rs:84`, `sidebar/mod.rs:99`, `sidebar/inbox.rs:68,118` — `tasks` accumulate** (see S1).
- **[L] `lib.rs:54` — Typo: `DeviceNotifcation`.**

Positives: careful `WeakEntity` hygiene; virtualized lists via `uniform_list` + `Rc` snapshots;
`InvalidPanel` preserves unknown panels across load/save; `theme_name_at` maps the palette's
original `IndexPath` correctly; `cargo check -p workspace` passes.

### 4.15 `workspace` — dialogs + panels

- **[H] `panels/contact_list.rs:187-191` — "Update" republishes the contact list with relay hints
  and petnames stripped.** `load()` keeps only `tags.public_keys()`; `update()` rebuilds every
  entry as `Contact::new(*public_key)` (`relay_url: None, alias: None`) while the UI reports
  success. Silent NIP-02 data loss on relays. Carry the original `Contact`s through.
- **[H] `dialogs/new_chat.rs:60-64` — Contact list doesn't re-filter while typing.** No
  `InputEvent::Change` handling; the input renders its own state entity so typing doesn't notify
  `NewChat`; results stay stale until an unrelated click/Enter. `cx.notify()` on Change. Same
  pattern, cosmetic: `profile.rs:320-326`.
- **[H] `panels/backup.rs:59-76` — Keyring read failures silently swallowed**; backup panel just
  shows empty inputs. Log + surface.
- **[H] `dialogs/profile.rs:227-235` — Invalid avatar/website URLs silently dropped on save** while
  "Profile updated successfully" shows. Validate both up front; inline error.
- **[M] `dialogs/screening.rs:52-55` — `on_release_in` calls `window.close_all_dialogs(cx)`**,
  nuking unrelated stacked dialogs (including the mutual-contacts dialog this view opens). Close
  just the hosting dialog / cancel tasks only.
- **[M] `dialogs/screening.rs:126-168` — DB-fallback "mutual contacts" has different semantics than
  the WoT list** (followers vs. your-contacts-who-follow). Intersect or relabel.
- **[M] `dialogs/screening.rs:211-232` — NIP-05 network errors render as "address does not
  match"** (`unwrap_or(false)` asserts infrastructure failure as fact about the person). Tri-state.
- **[M] `dialogs/screening.rs:250-282` — Report submit gives no failure feedback.**
- **[M] `dialogs/import.rs:129-185` — Enter bypasses the loading guard** (no in-method guard; all
  three `PressEnter` subscriptions call `login()` directly) → concurrent double import. Same class:
  `contact_list.rs:176-228`, `relays.rs:377,521`.
- **[M] `dialogs/import.rs:31-40` — Unlock dialog is inescapable** (no cancel/logout path for a
  forgotten passphrase). Add a "start over" escape hatch for stable.
- **[M] `panels/browse.rs:484-493,316-348` — Card list recomputed per render *and* per visible
  row** (O(n) clone + registry reads ×(rows+1) per frame during scroll). Compute once per render
  (`new_chat.rs`'s `Rc<Vec>` pattern).
- **[M] `panels/greeter.rs:127-137` — Every refresh fetches the full message history of every room
  to take `.last()`.** Query latest-per-room instead.
- **[M] `dialogs/new_chat.rs:138-160,388` — Filter allocates per contact per keystroke-scale
  render** (`to_hex().to_lowercase()` per contact). Cache lowercase names / filter once per change.
- **[M] `dialogs/settings.rs:124-148` — Speech-model errors can be consumed before the status
  change check** and dropped. Check `error` before the equality early-return.
- **[M] `new_chat.rs:282-315` vs `profile.rs:274-313` — Duplicated room-open logic with divergent
  dedup.** Unify on find-or-create.
- **[L] `panels/contact_list.rs:238,259` + `greeter.rs:226-402` — HashSet/index-based element ids**
  (see S6).
- **[L] `panels/contact_list.rs:288` — Copy bug: contacts panel says "Please add some relays."**
- **[L] `dialogs/new_group.rs:392` — `let _ = this.update(...)`** (see S2; `relays.rs:623-629` is
  the correct logged pattern).
- **[L] `panels/backup.rs:66,70` — `.unwrap()` on bech32** (infallible today; still banned pattern).
- **[L] `dialogs/restore.rs:52-62`, `contact_list.rs:130`, `relays.rs:352-355,497-500` — Untrimmed
  paste input fails parse** ("trailing newline = invalid key"); `relays` has a weak
  `starts_with("ws")` check.
- **[L] `dialogs/relays.rs:124-140,360-366` — Relay metadata can never be reset; duplicate add is a
  silent no-op** that can't update metadata.
- **[L] `dialogs/settings.rs:517-543` — Toggles compute `!rendered_value` instead of the switch's
  `checked`**; two fast clicks collapse into one. Match `onboarding.rs:398-399`.
- **[L] Dialog `tasks` fields never pruned** (`import.rs:63`, `restore.rs:24`, `relays.rs:45,57`,
  `contact_list.rs:52`, `profile.rs:55`, `new_chat.rs:50`, `new_group.rs:94`) — see S1;
  `screening.rs`/`greeter.rs` show the right patterns.
- **[L] `new_chat.rs:93-95`, `profile.rs:278-280`, `screening.rs:90-92` — Signed-out paths return
  silently**; no retry when login completes later.
- **[L] Dialogs can be stacked repeatedly** — no `has_active_dialog` checks in any `open()`.
- **[L] `new_group.rs:137-140` — `GroupsEvent::Created { warning, .. }` discards the non-fatal
  warning.**

Positives: `limit(1)` newest-event pattern verified correct on both backends; entities created
before `open_dialog` per gpui-kit contract; `new_group.rs` has a solid error lifecycle; heavy work
consistently on background; no unused deps in the crate.

### 4.16 `ui` — shared components

- **[M] `avatar.rs:128-186` — `PixelAvatar` regenerates the full pattern every frame** (FNV-1a +
  xorshift 64-cell grid + ~50 child divs per avatar; ~30 visible avatars, redrawn on every
  keystroke) — the biggest hot-path cost in the main view. Memoize the deterministic pattern
  (seed → `[u8; 64]` cache); hoist `FALLBACK_SEED` to a `&'static str` path.
- **[L] `text.rs:11-38` — `InlineReplacement` is `pub` but unreachable externally**; same for
  `RUN_WINDOW_SECS` (`message.rs:28`). `pub(crate)` or document as extension points.
- **[L] `message.rs:766` — `RevealText::new` is the only public constructor without a doc line.**
- **[L] `message.rs:775-796` — `RevealText` re-splits text into a `Vec<SharedString>` every
  animation frame**; split once in `new`.
- **[L] `text.rs:89-95` — Non-web, non-nevent Nostr links are silently dead** (`npub`/`nprofile`
  clicks do nothing). Route to a profile view or drop the link markup.
- **[L] `Cargo.toml:15,19` — `web-time` and `uuid` unused.** Remove.

Positives: consistent `RenderOnce` + `Styled` builder pattern; `#[must_use]` builders; documented
public items; char-boundary-safe slicing; truncating casts provably bounded.

### 4.17 `auto_update`

- **[M] `lib.rs:92` — Checksum-only verification; no signing key configured.** SHA256SUMS comes
  from the same host as the artifact — protects against corruption, not a compromised release
  host/account. The engine already supports minisign/Ed25519; publish a sidecar signature and pin
  the public key before stable.
- **Verified non-issue:** the `futures::executor::block_on` in `source.rs:152,170` runs on the GPUI
  **background** executor (verified through `gpui-updater-pre 0.2.0`'s `Updater::check` →
  `engine.check()` → `fetch_latest` call chain) — no UI freeze. Severity Low: it parks one
  background thread up to ~60 s during a check. Optional tidy-up only.
- **[L] `source.rs:156-163,180-183` — Asset URLs not scheme-checked**; assert `https://`.
- **[L] `lib.rs:119-131,145-147` — A failed check shows for 5 s then reports "Up to date"**
  (`error_revert` → `Idle`, and `Idle` counts as up-to-date). Distinct "check failed" state.
- **[L] `lib.rs:103,128` — `.ok()` on entity updates** (see S2).
- **[L] `lib.rs:134-139` — Auto-download/stage ~2 min after startup without a prompt**; fine on
  unmetered, worth a setting.

Positives: strict `latest > current` gate (no downgrades); drafts/prereleases skipped; 30 s
timeouts; defensive checksum parsing; good tests.

### 4.18 `gpui_tokio`

- **[L] `lib.rs:14` — `.expect("Failed to initialize Tokio")`**; per the no-panic rule, `init`
  returning `Result` would be more in keeping (realistically unreachable).
- **[L] `lib.rs:38` — `pub struct Tokio {}`** namespace struct; `pub struct Tokio;` or free
  functions.

Positives: the `defer`-guard cancellation pattern is correct in both completion and drop cases;
`shutdown_background()` avoids blocking exit; `spawn_result` maps `JoinError` into `anyhow`.
No deadlock risk across the two runtimes (verified: nothing waits on GPUI from tokio or holds a
lock across the boundary).

### 4.19 `desktop` / `web` / `assets` entries

- **[M] `desktop/src/main.rs:20-26,153-170` — Secret key accepted as a CLI argument.** `--sec
  nsec1…` puts the master key in the process list (`ps`, `/proc`, shell history); the parse-error
  path echoes the raw (near-)key to stderr. Read from stdin/env; print error kind only, never the
  input.
- **[L] `desktop/src/main.rs:131-150` — Seven startup unwraps on embedded assets.** Deterministic,
  but one corrupt font aborts launch; skip bad fonts with a warning and fail only if zero loaded.
  `open_window().expect` is fair (genuinely unrecoverable). The startup `block_on` for fonts
  (main.rs:135) is intentional and acceptable — noted so it isn't confused with the anti-pattern.
- **[L] `web/src/lib.rs:122` — `expect("Failed to open window…")` aborts the wasm module** (blank
  page + console error; `panic = "abort"`). A DOM-level error would be kinder.
- **[L] `web/src/lib.rs:43` — `.ok()` on console-log init** (justified; noted for completeness).
- **[L] `desktop/Cargo.toml:37` + `web/Cargo.toml:13` — `ui` dep unused in both entries.** Remove
  unless it exists to force feature unification (then comment why).
- **[L] `assets/Cargo.toml:9` — `anyhow` unused** (code uses `gpui::Result`). Remove.

Positives: `web` opens IndexedDB before `run()`, panic hook + both logging stacks via `OnceLock`;
`assets` ships the theme-schema test.

## 5. Tooling Validation

| Check | Result |
|---|---|
| `cargo clippy --workspace --all-targets` | clean — zero warnings |
| `cargo fmt --all --check` | clean |
| `cargo check -p workspace`, `-p person` | pass |
| `let _ =` / `.ok()` sites (non-test) | ~156 — mostly entity-update-expected-error cases; see S2 |
| `tasks:` container declarations | ~48 sites across 20 owners — see S1 |
| Startup `block_on` sites | 3 (`state` DB open, `desktop` fonts — both acceptable-at-startup; `auto_update` — background thread, non-issue) |

## 6. Verified Non-Issues (checked, do not re-flag)

- `auto_update/source.rs` `block_on`: background executor only (verified through the
  `gpui-updater-pre 0.2.0` call chain) — no UI freeze.
- `nip29/src/protocol.rs:1072` `block_on`: test-only.
- No locks held across `.await` anywhere in the workspace (all audited crates).
- `person.rs:170` `let Ok(pubkey) = to_bech32()` — irrefutable (`Err = Infallible`).
- `stored_contact_list`'s `limit(1)` + `.next()` — correct: nostr-lmdb orders by `created_at`
  descending.
- `nip60`/`nip60_ui` have zero non-test `unwrap`/`expect`/`let _ =`; indexing is guarded; no
  truncating casts.
- `nip29_ui`'s `sync()` splice math traced against `ListState` semantics — correct (it's `chat_ui`
'  that has the mismatch).
- gpui-pre's entity read-tracking re-renders panels on `Directory`/`SpeechState` notifications —
  the missing-`cx.notify()` suspicion in speech handlers is fine; the stale-cache bugs above are
  real, the observation isn't.
- `nip60::init` startup ordering is sound for normal flows; the CLI-key path fires `SignerChanged`
  before wallet subscription exists (app-wide init-order caveat, affects all registries equally).
- `nip60` melt double-spend paths are latent (dead API), not live.

## 7. What's Done Well

- **Clippy-clean, fmt-clean workspace** with no reachable panics in `nip29`, `nip60`, `ui`,
  `nip29_ui`, `person` production paths; hostile-input discipline in the WoT builder, speech
  downloads (SHA-256 + size cap + atomic rename), and auto-update (fail-closed checksums, no
  downgrades).
- **`verify_subscriptions(true)` + `ban_relay_on_mismatch(true)`** in `state` is the single most
  valuable client-side trust boundary, and it's on.
- **Entity/subscription hygiene is strong overall**: subscriptions stored in `_subscriptions`,
  `WeakEntity` used for room/group/dock back-references, no strong entity cycles found anywhere,
  no dropped-subscription bugs.
- **Secrets discipline**: no secret is ever logged or published in `nip4e`/`nip60`/`state` desktop
  paths (verified against every log call); `Keys`' vendored `Debug` hides secrets.
- **Errors generally do reach the UI** where it matters most (group writes via `util::report`,
  wallet events, speech errors, import/restore flows) — the gaps are enumerated above.

## 8. Recommended Remediation Order

**P0 — before any release candidate (blocks release):**
1. nip60 deletion spoofing (4.2 #1) — one-line precedence fix + author check.
2. browser-signer-proxy auth/CORS/token + timeout cleanup (4.4 #1-2).
3. state startup DB fallback (4.1 #1) and web localStorage encryption (4.1 #2).
4. nip60 reconcile/republish money-safety trio (4.2 #2-4) + stuck `redeeming` (4.2 #5).
5. state file-cache collision (4.1 #4) — wrong-file disclosure.
6. chat_ui reaction double-count (4.7 #1) and common whitespace collapse (4.10 #1).
7. contact-list Update data loss (4.15 #1).
8. speech parakeet worker lifetime (4.12 #1).
9. settings load/save durability (4.13 #1-2).
10. nip29 `created_at` guards (4.8 #1-2).

**P1 — fix during the release cycle:**
Dock panel identity + "Ignore" dispatch (4.14 #1-2); updater observation (4.14 #3); invoice flow
or removal (4.3 #1); person `in_flight` release (4.11 #1); chat trash UI (4.6 #1); chat_ui load
errors + splice + quadratic insert (4.7 #2-4); profile URL validation, backup keyring surfacing,
new_chat re-filter, screening dialog cluster (4.15); parser recursion for wasm (4.10 #3);
`DefaultHasher` → stable hash before more room ids ship (S5); nip4e approval button + rotation
archive + listener death (4.5 #1-3); proxy plaintext leak + event-substitution check (4.4 #3-4).

**P2 — hygiene, in one mechanical sweep:**
S1 (`tasks` containers → replace-per-spawn / `detach_and_log_err`), S2 (`let _ =`/`.ok()` →
`.log_err()`), S6 (domain-keyed element ids), unused deps (`chat`: smol; `nip29`: person;
`nip60`: tokio; `ui`: web-time, uuid; `assets`: anyhow; entries: ui), dead code
(`nip60` melt/send/quotes decision, `state::passphrase_required`, `DownloadedFile::save`,
`dock::find_panel` fix-or-delete, `skin.rs` write-once flag, `Person` trait impls), avatar
memoization, sidebar row-model caching, rename `DeviceNotifcation`, summary-comment cleanup.

---

*Method note: every crate's sources were read in full by a dedicated audit pass; GPUI/fork API
claims were verified against the vendored `gpui-pre 0.3.12`, `gpui-base 0.9.1`,
`gpui-component 0.9.1`, and rust-nostr sources; the Critical and top-High findings were
independently re-verified by hand against the working tree at `8fa79aef`. No files were modified
during the audit.*

## 9. P0 Remediation Log (2026-11-12)

All ten P0 items fixed. Validation after the full batch: `cargo clippy --workspace --all-targets`
zero warnings, `cargo fmt --all --check` clean, `cargo test --workspace` 35 passed / 0 failed.
Diff: 15 files, +816/−273.

1. **nip60 deletion spoofing** — `nip60/src/lib.rs`: precedence fixed to
   `ours && (is_cashu || is_token_deletion(..))`; `absorb`/`absorb_deletion` now take `me` and
   reject foreign-authored kind 5 events (defense in depth; the live notification gate was the
   only protection before, and `absorb_deletion` had no author check). The DB load path was
   already author-filtered and is unchanged.
2. **browser-signer-proxy hardening** — per-session UUID token generated at startup, embedded in
   the served page (`inject_session_token`), required on `/api/*` (403 otherwise); exact `Host`
   match (DNS-rebinding defense); all CORS headers and the OPTIONS preflight removed;
   `cancel_request` removes timed-out requests from both maps so plaintext is dropped;
   centralized best-effort `write_response`. `proxy.js` authenticates all three fetches. Token
   never appears in the URL the app opens.
3. **state startup crash loop** — `NostrLmdb::open` failure now logs and falls back to
   `MemoryDatabase::unbounded()` (nostr-memory added to the desktop deps), emitting
   `StateEvent::error` via the existing deferred path; the `block_on` stays (safe: the LMDB open
   schedules nothing back onto the GPUI executor — now commented).
4. **state web localStorage key** — `import_bunker` on wasm32 no longer persists the bunker
   credential (session is memory-only; desktop keyring unchanged); `restore_session` degrades to
   `NoSigner` when nothing is stored (verified). **Known behavior change: web users re-enter their
   bunker URI after each reload.**
5. **state file-cache collision** — cache filename now derived from the decrypted content's
   sha256 instead of the filename; the metadata guard is gone and every store goes through
   temp-write + atomic rename.
6. **nip60 reconcile money-safety** — `ops.rs::reconcile` rewritten: relay tokens are converged
   into the store BEFORE any publish (closes the `del`-before-converge race); relay proofs already
   tracked locally (unspent or in-flight Pending/Reserved/PendingSpent) are never re-added, and
   unseen proofs are checked against the mint (NUT-08 `check_proofs_spent`, best-effort) before
   being accepted as Unspent; when a prior job errored after mutating the store
   (`publish_failed` flag), reconcile republishes the store's unspent set instead of trusting
   relay state — healing stranded sends/receives; without the flag the relay-trust removal path
   (cross-device spend convergence) is preserved. A failing Reconcile does not reschedule itself
   (no infinite loop).
7. **nip60 stuck nutzap redemptions** — `apply_outcome` now receives the failed job; on
   `RedeemNutzap` error the id is removed from `redeeming` and requeued up to
   `MAX_REDEEM_ATTEMPTS = 3` (cleared on success, reset on signer change), so transient mint
   failures no longer wedge redemptions until restart.
8. **Reactions double-count** — `chat_ui::insert_reaction` replaces per (author, target) per
   NIP-25, making the backup gift-wrap echo idempotent (verified: optimistic rumor and the
   re-delivered seal carry the same event id) and history reloads non-duplicating.
9. **Whitespace collapse** — `common/media_extractor.rs` rewritten: whitespace is tidied only at
   URL-removal boundaries; line breaks in untouched regions survive; regex hoisted to
   `LazyLock`; 9 unit tests added (multi-line preservation, URL-only messages, digit/emoji edges).
10. **Contact-list data loss** — `contact_list.rs` now parses the stored event into full
    `nostr::nips::nip02::Contact` values (relay hint + alias preserved through load → add/remove
    → republish); new contacts still get `Contact::new`.
11. **Speech worker lifetime** — `parakeet.rs`: the `OnceLock<Sender>` became a resettable
    `Mutex<Option<Sender>>`; a dead worker (30 s idle exit) is detected via `is_disconnected`, the
    slot cleared, and a replacement thread spawned lazily on the next command; spawn failure no
    longer caches a dead sender; failures surface through `sink.error` / returned `Err` instead
    of a debug-level swallow (one retry covers the liveness-check/send race).
12. **Settings durability** — a failed load logs and keeps defaults in memory without
    persisting (`suppress_next_save`, consumed by the next real change); fresh-install NotFound is
    no longer conflated with read/parse failures; saves are serialized through a single
    `save_task` slot (chained, FIFO order) with temp-file + atomic rename; serialization and
    write failures are logged.
13. **nip29 ordering guards** — shared `is_newer_event` (strict `(created_at, id)` total order):
    `Group::absorb_state` keeps a per-kind stamp (written only after a successful apply, so a
    malformed newer event can't poison the guard) and rejects stale replays while ascending cache
    hydration still applies; the registry's `list_stamp` seeds from the cached list event at
    startup, is checked in `merge` before applying, updated by `publish_list` (closing the
    leave→resurrect window), and reset on signer change. 3 new tests across protocol/group.
14. **nip60_ui invoice flow** — *not* in this batch: it is P1 (the audit lists it as High but the
    P0 list ranks it 16th via `nip60_ui/wallet.rs`); `mint_quotes()`/`claim_mint_quote()` remain
    dead until the P1 UI work lands. No other P0 code paths depend on it.

Behavior changes to be aware of when testing:
- Web: bunker credentials are no longer persisted (re-connect after each reload).
- Desktop: a corrupted/unreadable local database now starts with an empty in-memory history and
  shows an error event instead of crash-looping; relays re-sync as before.
- nip60: reconcile now performs one NUT-08 mint round-trip when unseen relay proofs appear.
- Reactions render per NIP-25 replace semantics (one reaction per author per target).
- Messages keep their line breaks; only URL-adjacent whitespace is tidied.

## 10. P1 Remediation Log (2026-11-12)

All eleven P1 items from §8 fixed on top of the P0 commit (`fd802a88`). Validation after the
full batch: `cargo clippy --workspace --all-targets` zero warnings, `cargo fmt --all --check`
clean, `cargo test --workspace` 38 passed / 0 failed. Diff: 25 files, +1072/−247.

1. **Dock panel dedup made real** (`workspace/src/dock/mod.rs`, `lib.rs`, `skin.rs`):
   `PanelKey` — `Named(panel_name)` for singletons, `Room(room_id)` for chat panels — recovered
   from docked panels via `PanelHandle::of` + downcasts; `add_panel` now focuses the existing
   tab (reopening a collapsed dock first) instead of stacking a duplicate; group panels dedupe
   through `Workspace.group_panels: HashMap<GroupKey, PanelId>` (group identity is not readable
   off a `GroupPanel`), with stale ids pruned via `area.panel(id)` validation. The dead
   `find_panel`/`move_panel`/`InsertTarget` machinery is deleted, along with `skin.rs`'s
   write-once `toggle_button_visible`. Known residual: the panel opened by the new-group dialog
   (`dialogs/new_group.rs`, still plain `add_panel_to`) isn't registered — P2.
2. **"Ignore" screening action** (`sidebar/rows.rs`, `dock/mod.rs`): closes the request room's
   tab via `dock::close_room_panel` (find by room key → `DockArea::remove_panel`) instead of
   dispatching `ClosePanel` into a focus path that can never reach its handler.
3. **Updater observation** (`sidebar/mod.rs`, `sidebar/header.rs`, `auto_update/src/lib.rs`):
   `AutoUpdater` now exposes `UpdateDisplay` (`up_to_date`, `staged`, `status` text) via
   `display()`; the Sidebar mirrors it into a small `Entity<Option<UpdateDisplay>>`, updating it
   only when a rendered fact actually changes, and the header renders from that snapshot (the
   restart click fetches the global entity at click time). Observing the whole updater and
   notifying the entire cached sidebar was rejected as too blunt: download-progress ticks would
   have invalidated the panel on every byte.
4. **Wallet invoice flow** (`nip60_ui/wallet.rs`, `nip60/src/lib.rs`): pending mint quotes render
   in the panel (amount, mint, bolt11 with middle-ellipsis, copy via the house `Clipboard`
   component, check/claim wired to the existing `Job::ClaimQuote` path, per-quote dismiss via the
   new `dismiss_mint_quote`); claim results refresh through the existing `WalletEvent::Updated`;
   an unpaid check emits "Invoice is not paid yet" (gated on `ClaimQuote` — flagged behavior
   change). Receive-via-lightning is functional end-to-end.
5. **Person fetch blacklisting** (`person/src/lib.rs`): `in_flight` is now shared
   (`Arc<RwLock<HashSet<_>>>`) with the batching task; all three duplicated `get_metadata` error
   arms factored into `flush_batch`, which releases the whole batch for retry on failure and
   logs. A 2 s timeout now costs a retry, not a session-long placeholder.
6. **Chat trash surfaced** (`chat/src/lib.rs`): the signal consumer counts *freshly* trashed
   messages (BTreeSet insert dedupes reprocess attempts) and emits one batched
   `ChatEvent::Error` ("N messages could not be decrypted"), which the workspace already renders
   as an error notification.
7. **chat_ui list fixes** (`chat_ui/src/lib.rs`): room connect/load failures now push persistent
   error notifications (`notify_failure`, `.autohide(false)`) instead of silently empty rooms;
   message inserts splice at the real row (`pos + 1`, welcome row accounted for — append case is
   byte-identical to the old behavior); bulk loads are O(n log n) sort-merge with a single splice
   and one index rebuild, preserving the old first-arrival-wins timestamp dedup exactly.
8. **Dialog fixes** (`workspace/src/dialogs/{profile,new_chat,screening}.rs`, `panels/backup.rs`):
   profile validates avatar/website URLs before publishing (inline error banner; empty still
   means "keep saved value"); backup surfaces keyring/decode failures in-panel and its bech32
   `unwrap`s are gone; new_chat re-filters on `InputEvent::Change` (and profile's avatar preview
   tracks typing); screening no longer closes all stacked dialogs on release, NIP-05 verification
   is tri-state (pending/verified/mismatched/failed — network failure no longer asserts "does not
   match"), and report submission shows failures.
9. **Parser recursion** (`common/src/parser.rs`): `NostrParserIter::next` is a loop; the
   pending-match fields are gone (provably passthrough); 50,000 consecutive malformed `nostr:`
   URIs now cost loop iterations, not stack frames (regression tests added) — wasm tab-crash
   vector closed.
10. **Stable room ids** (`common/src/event.rs`, `nip29`): `DefaultHasher` replaced by SHA-256
    (`common::stable_id` 128-bit hex, `stable_id_u64` for u64-keyed consumers); `Event` and
    `UnsignedEvent` `uniq_id` impls factored into one `pubkey_set_uniq_id` helper; nip29's
    `GroupKey::uniq_id` and `browse_subscription` unified (verified session-local). **Room id
    values change** (new hash domain) — existing cached groupings regroup per session as rumors
    re-arrive; release notes should mention it. Follow-up if 128-bit ids are wanted: chat's id
    fields are u64-typed; migrating to `String` ids is mechanical.
11. **nip4e lifecycle** (`nip4e/src/lib.rs`): approval has an `approving` re-entry guard (the
    device secret can no longer be double-sent), toast lifecycle is correct on both outcomes
    (success clears only the matching request; failure rebuilds the toast with a fresh enabled
    button); rotation aborts before overwrite when load/archive fails (surfaces via
    `DeviceEvent::error`); the relay listener logs dropped events and its own death instead of
    stopping silently.
12. **Proxy hardening round 2** (`browser-signer-proxy/src/lib.rs`): signed events are checked
    for correspondence (`event.compute_id()` vs returned id — proves field equality, covers
    stale ids), closing the event-substitution hole; the response log carries id + ok/error only,
    never values; request lines/headers are capped (16 KiB → 400), `Content-Length` capped
    (1 MiB → 413), invalid UTF-8 → 400, and connections are dropped after 30 s (slowloris
    bound).

### P1 behavior changes to be aware of when testing

- Opening an already-open room/group/panel focuses the existing tab; the "Ignore" action closes
  the request room's tab.
- Wallet panel shows a "Pending invoices" section; unpaid checks report "Invoice is not paid
  yet"; quotes are dismissable.
- Room groupings regenerate under a new id scheme — first launch after this change rebuilds
  rooms from cached rumors (history is kept; grouping self-heals).
- Profile saves with an invalid URL now stop with an inline error instead of silently dropping
  the field; NIP-05 shows "could not be verified" on network failure instead of "does not
  match"; undecryptable messages and room load/connect failures produce visible notifications.
- First message-send/receive after the room-id change republishes `r` tags under the new ids.