docs: what this week's review left open, and a harness that lies

§15.3 gains the items the review found and did not close, each as what it is
rather than as a plan: the packaged install that has never been installed, QUIC
serving content outside every cap it does not implement, a relay registry
nothing calls, an unmetered third-party search, disk I/O on the node's event
loop, unbounded node announcements, and a migration chain exercised on a
database it does not ship on.

They are in the design rather than in a tracker because each is a sentence about
what the system currently is, and §15.3 is where the document already keeps
those. The seven that were closed this week are in §13.5b as AV20–AV25 and in
the sections they belong to.

CLAUDE.md gains the Firefox harness, which is the other kind of entry: eleven
errors at setup that look exactly like a regression, are not, and cost a full
diagnosis to place. `HOME` isolates the profile and not snap's single instance,
so any running Firefox blocks the headless probe, `--no-remote` and
`--new-instance` do not help, and a failed run leaves a process that blocks the
next. The chrome half covers the same geometry meanwhile.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UMxEQadpzPkYLFf5CYKhpW

1 files changed, 7 insertions, 0 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 68b9fa9..32d688b 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -2771,6 +2771,13 @@ account recovery, and the Windows port through packaging.
 | Forward secrecy in group chat | **Given up deliberately and on the record** (§4.5). If it becomes a requirement it belongs in 1:1 DM |
 | Metadata at the hub | Membership, and who posted in which group and when. A known leak, not a solved problem (§7.1) |
 | The exact-hash content check | Structural, not functional (§7.5) |
+| **The packaged install** | Built and never installed. `build-packages.sh` produces four `.deb` that carry the migrations and a relocatable entry point, and no machine has been taken from those packages to a running hub and node. Every packaging defect found so far was found the first time somebody tried |
+| **QUIC** | Off by default, and **not at parity**: it serves the index and file chunks with no transfer lease, no leaseless ceiling and no root-availability check, does its file I/O on the event loop, and returns exception text to the peer (**L3**). No client speaks it. Either it comes to parity or it goes; until then §5.1's "chat is the only gap" is the one sentence here that overstates the code |
+| **The relay registry** | `/v1/relays` register/list/approve exist and nothing in the tree calls them, node or client — and §11.1 measured two ISPs with no TURN relay needed. Kept code that nothing calls is what **L7** says not to keep |
+| **Free-text third-party search** | `tmdb_search_req` takes a member's query and spends the operator's per-credential quota with no rate limit and no per-member bound, where link previews carry both. §6.5's standing rule — a bound and a named adversary in the same commit — was not applied here |
+| **Disk I/O on the node's event loop** | A chunk read-and-encrypt and every upload chunk write run in the message handler. On a spun-down or network-mounted root that stalls every group, every stream and the hub socket, which is `AV9`'s lesson with the disk in place of the mail server |
+| **Node announcements are not bounded** | One account may announce unlimited distinct node keys, each a row plus an IP-log row under a one-year retention. Proof of possession is checked (**M8**); the count is not |
+| **Migrations run on SQLite only** | The chain reaches head and agrees with the models there (§12), which is not where it ships. A default or a constraint PostgreSQL refuses would still reach a deploy |
 
 ---