CI run 121 failed at "버전·계약 정본 대조": earlier refactors moved update
gating from UpdateService into update-policy.ts (evaluateUpdateOffer ties
decideUpdate + isWithinRollout), the differential-download switch into
update-adapters.ts, and the Forgejo re-release guard into
lib/immutable-package-guard.mjs (sha256 comparison, abort on conflict).
The checks still looked for the old markers in the old files. They now
verify the same guarantees where the code lives, and the self-test's
negative case targets assertNoImmutableConflicts.
Also clears the lint gate: a control-character regex in Keycap (range now
starts at U+0020) and unused helpers in two red-team tests.
Batch of red-team r3 fixes that were in the working tree before the
2026-09-28 design overhaul, committed as one unit with their tests.
- desktop main: STT timeouts and sidecar, voice recording store, sync
(credentials, audio, knowledge reindex, push gates), runtime
provisioner, update policy, AltGr keybindings, voice-command policy,
dictionary file codec/limits, meeting transcript condensing and a
local recording ledger so interrupted-session recovery only closes
meetings this device recorded (a phone's live meeting is left alone).
- mobile: login CSRF via implicit token callbacks rejected, account
deletion/retention, durable queue retention, knowledge realtime
without unfiltered DELETE, meeting re-record failure paths, cloud STT
client, preferences store/resync.
- core: text chunking splits long unbroken transcripts to fit, template
field policy, dictionary limits, meeting markdown inline handling.
- server: payple webhook policy and cancellation order scope, meeting
document generation quota, team RPC null-role guard, unified LLM
quota in-flight accounting, knowledge chunk vector index, meeting
re-record failure paths (migrations 20260929*).
- ci: portable/runtime feed gates, update-policy schema, Forgejo file
delete and alias planning.
Four older tests are updated to the new contracts rather than the old
behavior: token-pair auth callbacks are rejected, knowledge realtime no
longer subscribes to DELETE, long transcript lines are split, and
meeting recovery requires the local recording ledger for empty rows.
