From 8941b2a27de09186613fcff968c968956b9f979f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:07:25 +0000
Subject: [PATCH 01/13] chore: open auto-fix batch
 claude/friendly-maxwell-M5xB6


From 7f1164f7b76d7c147249532b9ffc841f5fc8955a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:11:55 +0000
Subject: [PATCH 02/13] chore(worker): replace println with tracing::info in
 identity

Lib crates use tracing for observability per CLAUDE.md.

Refs #551
---
 crates/worker/src/identity.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/worker/src/identity.rs b/crates/worker/src/identity.rs
index 31f6887e..cacd43f4 100644
--- a/crates/worker/src/identity.rs
+++ b/crates/worker/src/identity.rs
@@ -27,7 +27,7 @@ pub fn load_or_generate(path: &str) -> Result<Identity> {
 /// identify workers when granting permissions.
 pub fn print_peer_id(path: &str) -> Result<()> {
     let identity = load_or_generate(path)?;
-    println!("{}", identity.endpoint_id());
+    tracing::info!(endpoint_id = %identity.endpoint_id(), "worker identity loaded");
     Ok(())
 }
 

From 7e1ebd30832bcd3cce631b54379626d2d99e634c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:21:27 +0000
Subject: [PATCH 03/13] chore: link orphaned TODOs to trackers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Triage of audit F34 (#534): every spec.md-named TODO either cites
a live issue / plan path or describes a closed gate.

- traits.rs:161 — #119 closed before placeholder fixed; cite #561.
- listeners.rs:396 — cite #382 (heads-based delta sync).
- views.rs:95 — cite #563 (multi-grove members plumbing).
- views.rs:600, message.rs:267 + 1125 — cite #562 (WhisperStart wire).
- message.rs:1343 + 1406 — cite #564 (mobile sheet emoji recency
  + full-picker route, distinct from desktop #186).
- views.rs:511 + 700, message.rs:857 + 866, mention.rs:44 — cite
  plan docs/plans/2026-04-21-ui-phase-2c-profile-card.md.
- views.rs:481 + state.rs:142 — rewrite stale doc text; the
  sync-queue gate is closed by Phase 2b
  (docs/plans/2026-04-21-ui-phase-2b-sync-queue.md).

Comment-only changes; no behaviour drift. cargo fmt / clippy
-D warnings / wasm32 check on web + client all clean.

Refs #534
---
 crates/client/src/listeners.rs                |  6 +--
 crates/client/src/state.rs                    | 13 +++---
 crates/client/src/views.rs                    | 41 +++++++++++--------
 crates/network/src/traits.rs                  |  5 ++-
 crates/web/src/components/message.rs          | 39 +++++++++---------
 .../web/src/components/message_row/mention.rs |  3 +-
 6 files changed, 58 insertions(+), 49 deletions(-)

diff --git a/crates/client/src/listeners.rs b/crates/client/src/listeners.rs
index dbea60d6..3ce6c771 100644
--- a/crates/client/src/listeners.rs
+++ b/crates/client/src/listeners.rs
@@ -393,9 +393,9 @@ async fn process_received_message<T: TopicHandle>(
         }
         crate::ops::WireMessage::SyncRequest { state_hash, .. } => {
             let _ = state_hash; // Legacy field — can't filter by state hash in DAG model.
-                                // TODO: Migrate clients to worker's heads-based sync protocol
-                                // (WorkerRequest::Sync { heads }) for efficient delta sync.
-                                // For now, send the first 500 events from topological sort.
+                                // TODO(#382): migrate clients to worker's heads-based sync
+                                // protocol (WorkerRequest::Sync { heads }) for efficient delta
+                                // sync. For now, send the first 500 events from topological sort.
                                 // Receiver will dedup via InsertError::Duplicate.
             let events: Vec<willow_state::Event> = willow_actor::state::select(&ctx.dag, |ds| {
                 ds.managed
diff --git a/crates/client/src/state.rs b/crates/client/src/state.rs
index 398d2bb2..72d19d0e 100644
--- a/crates/client/src/state.rs
+++ b/crates/client/src/state.rs
@@ -137,12 +137,13 @@ pub struct DisplayMessage {
     /// Queue-note state for this row (see [`QueueNote`]).
     ///
     /// Populated by the view projection in
-    /// `views::compute_messages_view`. Today the projection defers the
-    /// real detection to the sync-queue crate and always returns
-    /// `None` — see `TODO(sync-queue.md)` in `views.rs`. The renderer
-    /// is already wired for the full tri-state so the UX will light up
-    /// once detection lands. The grouping predicate in `chat.rs`
-    /// treats any non-`None` variant as a run-break per
+    /// `views::compute_messages_view`. Phase 2b (see
+    /// `docs/plans/2026-04-21-ui-phase-2b-sync-queue.md`) closed the
+    /// original `TODO(sync-queue.md)` gate: the projection now derives
+    /// real `Pending` / `LateArrival` values from `QueueMeta`. The
+    /// renderer is wired for the full tri-state. The grouping
+    /// predicate in `chat.rs` treats any non-`None` variant as a
+    /// run-break per
     /// `docs/specs/2026-04-19-ui-design/message-row.md` §Queue notes.
     pub queue_note: QueueNote,
 }
diff --git a/crates/client/src/views.rs b/crates/client/src/views.rs
index 0181e03a..2ca4d9c0 100644
--- a/crates/client/src/views.rs
+++ b/crates/client/src/views.rs
@@ -92,13 +92,13 @@ impl ServerRegistry {
     /// exposes its full membership — see the multi-grove TODO on
     /// `servers.rs`).
     pub fn shared_groves(&self, _local: &EndpointId, _other: &EndpointId) -> Vec<String> {
-        // TODO(multi-grove): plumb `state.members` into `ServerEntry`
-        // so the intersection can walk every grove the local peer is
-        // in. Until then, the helper returns the active grove's name
-        // when we know both peers are members (check deferred to the
-        // UI which reads `MembersView` for the active server). Return
-        // an empty Vec rather than fabricating a match — the spec's
-        // edge case "no shared groves → omit section" covers this.
+        // TODO(#563): plumb `state.members` into `ServerEntry` so the
+        // intersection can walk every grove the local peer is in. Until
+        // then, the helper returns the active grove's name when we know
+        // both peers are members (check deferred to the UI which reads
+        // `MembersView` for the active server). Return an empty Vec rather
+        // than fabricating a match — the spec's edge case "no shared
+        // groves → omit section" covers this.
         Vec::new()
     }
 }
@@ -477,8 +477,10 @@ impl ClientViewHandle {
 /// Phase 2b: accepts a `queue_meta` snapshot so the projection can
 /// derive real `QueueNote::Pending` / `QueueNote::LateArrival` values
 /// for each row via [`crate::queue::derive_pending`] +
-/// [`crate::queue::derive_late_arrival`]. Closes the
-/// `TODO(sync-queue.md)` gate in this function and in the Phase 2a
+/// [`crate::queue::derive_late_arrival`]. Closes the original
+/// sync-queue gate (see plan
+/// `docs/plans/2026-04-21-ui-phase-2b-sync-queue.md`) in this function
+/// and in the Phase 2a plan
 /// `docs/plans/2026-04-20-ui-phase-2a-message-row.md` at line 490.
 pub fn compute_messages_view(
     events: &Arc<willow_state::ServerState>,
@@ -508,8 +510,9 @@ pub fn compute_messages_view(
     // track a distinct `@handle` (see `profile-card.md` for the target
     // profile data model); as a stand-in we derive a handle from the
     // display name via `display_name.to_lowercase().replace(' ', '.')`.
-    // TODO(profile-card.md): replace the display-name-derived handle
-    // with the real handle field once profile data is plumbed.
+    // TODO(plan: docs/plans/2026-04-21-ui-phase-2c-profile-card.md):
+    // replace the display-name-derived handle with the real handle field
+    // once profile data is plumbed.
     let peer_refs: Vec<PeerRef> = events
         .members
         .keys()
@@ -597,11 +600,11 @@ pub fn compute_messages_view(
             } else {
                 QueueNote::None
             };
-            // TODO(whisper-mode.md): flip via WhisperStart event when
-            // that phase lands. Phase 2a Task 8 reserves the row
-            // styling surface (message--whisper class + whisper-badge)
-            // behind this always-false gate so later work only has to
-            // swap the projection lookup.
+            // TODO(#562): flip via WhisperStart event when that phase
+            // lands. Phase 2a Task 8 reserves the row styling surface
+            // (message--whisper class + whisper-badge) behind this
+            // always-false gate so later work only has to swap the
+            // projection lookup.
             let whisper = false;
             DisplayMessage {
                 id: m.id.to_string(),
@@ -697,8 +700,10 @@ pub fn compute_unread_view(
     let mute = event_state.mute_state.get(&local_peer_id).cloned();
 
     // Build a PeerRef list once for the mention parser. Mirrors the
-    // build in `compute_messages_view`; TODO(profile-card.md) tracks
-    // swapping display-name-derived handles for real profile handles.
+    // build in `compute_messages_view`; the
+    // TODO(plan: docs/plans/2026-04-21-ui-phase-2c-profile-card.md)
+    // there tracks swapping display-name-derived handles for real
+    // profile handles.
     //
     // `resolve_display_name` needs a `ProfileState` — we only have the
     // event-state profiles here, so fall back to the event-state entry
diff --git a/crates/network/src/traits.rs b/crates/network/src/traits.rs
index 5147d9d8..89cd187b 100644
--- a/crates/network/src/traits.rs
+++ b/crates/network/src/traits.rs
@@ -158,9 +158,10 @@ pub trait Network: Send + Sync + 'static {
     /// Access the blob store.
     fn blobs(&self) -> &dyn BlobStore;
 
-    // TODO(#119): add connection_events() — stream relay up/down and direct
+    // TODO(#561): add connection_events() — stream relay up/down and direct
     // peer connect/disconnect events so the client can surface connectivity
-    // status in the UI.
+    // status in the UI. (#119 was the original tracker, closed before the
+    // placeholder `pending()` impls were replaced — #561 is the live followup.)
 
     /// Reachability of the configured relay, or [`RelayStatus::NotConfigured`]
     /// when none is set. Default impl returns `NotConfigured`; the real
diff --git a/crates/web/src/components/message.rs b/crates/web/src/components/message.rs
index 4da51fb2..c36d6b4d 100644
--- a/crates/web/src/components/message.rs
+++ b/crates/web/src/components/message.rs
@@ -264,9 +264,9 @@ pub fn MessageView(
     let has_queue_note = queue_note != QueueNote::None;
     // Phase 2a Task 8: reserve the whisper surface. `message.whisper`
     // is gated always-false in the projection today (see
-    // `client/src/views.rs` TODO(whisper-mode.md)); once that phase
-    // lands the projection will flip it and the class + badge below
-    // light up automatically.
+    // `client/src/views.rs` TODO(#562)); once that phase lands the
+    // projection will flip it and the class + badge below light up
+    // automatically.
     let is_whisper = message.whisper;
 
     let reply_preview = message.reply_preview.clone();
@@ -854,7 +854,8 @@ pub fn MessageView(
                 // members registry so `@handle` resolves in the row.
                 // The display-name → handle derivation mirrors
                 // `views::compute_messages_view` (see there for the
-                // `profile-card.md` TODO).
+                // profile-card plan TODO —
+                // `docs/plans/2026-04-21-ui-phase-2c-profile-card.md`).
                 use leptos::context::use_context;
                 let app_state = use_context::<crate::state::AppState>();
                 let local_peer_str = app_state
@@ -863,10 +864,10 @@ pub fn MessageView(
                     .unwrap_or_default();
                 let local_peer: Option<willow_identity::EndpointId> =
                     local_peer_str.parse().ok();
-                // TODO(profile-card.md): use real handles when profile
-                // data is plumbed. For now handle ≈ display-name
-                // lowercased with spaces → dots, matching the
-                // client-side projection.
+                // TODO(plan: docs/plans/2026-04-21-ui-phase-2c-profile-card.md):
+                // use real handles when profile data is plumbed. For
+                // now handle ≈ display-name lowercased with spaces →
+                // dots, matching the client-side projection.
                 let peers_vec: Vec<willow_client::mentions::PeerRef> = app_state
                     .as_ref()
                     .map(|a| {
@@ -1122,10 +1123,10 @@ pub fn MessageView(
                                 class="toolbar-btn"
                                 type="button"
                                 aria-label="whisper reply"
-                                // TODO(whisper-mode.md): permission-gated; no-op
-                                // until `WhisperStart` EventKind lands and the
-                                // local peer has permission to send a whisper
-                                // reply to this row's author.
+                                // TODO(#562): permission-gated; no-op until
+                                // `WhisperStart` EventKind lands and the local
+                                // peer has permission to send a whisper reply
+                                // to this row's author.
                                 on:click=move |ev| { ev.stop_propagation(); }
                             >
                                 {icons::icon_ear()}
@@ -1340,9 +1341,9 @@ pub fn MessageView(
                         on:touchend=on_sheet_touchend
                     >
                         // Quick-emoji row — six hit targets from recency.
-                        // TODO(reactions-pins.md): swap `REACTION_EMOJI`
-                        // for the channel-scoped recency list once that
-                        // spec lands. Rendered first so the sheet opens
+                        // TODO(#564): swap `REACTION_EMOJI` for the
+                        // channel-scoped recency list once that spec
+                        // lands. Rendered first so the sheet opens
                         // with the common case one tap away.
                         {if has_react {
                             let cb = react_cb2;
@@ -1403,10 +1404,10 @@ pub fn MessageView(
                         // will route there instead.
                         {has_react.then(|| view! {
                             <button class="sheet-item" on:click=move |ev| {
-                                // TODO(reactions-pins.md): route to the
-                                // full emoji picker here. For now the
-                                // quick-emoji row above is the only
-                                // path, so we keep the sheet open.
+                                // TODO(#564): route to the full emoji
+                                // picker here. For now the quick-emoji
+                                // row above is the only path, so we
+                                // keep the sheet open.
                                 ev.stop_propagation();
                             }>"add reaction"</button>
                         })}
diff --git a/crates/web/src/components/message_row/mention.rs b/crates/web/src/components/message_row/mention.rs
index ad037414..595711c8 100644
--- a/crates/web/src/components/message_row/mention.rs
+++ b/crates/web/src/components/message_row/mention.rs
@@ -41,7 +41,8 @@ pub fn MentionPill(
     };
     let title = full_label.unwrap_or_else(|| label.clone());
     let aria = format!("mention {title}");
-    // TODO(profile-card.md): open the profile popover on click.
+    // TODO(plan: docs/plans/2026-04-21-ui-phase-2c-profile-card.md):
+    // open the profile popover on click.
     view! {
         <button class=class aria-label=aria title=title type="button">
             "@"{label}

From e3623cdb016459b519b64ec679ee039dfa9d569c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:24:19 +0000
Subject: [PATCH 04/13] test(storage): cover set_default_server round-trip

Adds a focused unit test that asserts `set_default_server` actually
takes effect, via the only observable read path (events routed through
`on_event` are queryable under the configured server ID). Verifies the
default value, the post-setter routing, and last-write-wins across
multiple setter calls. Also documents that the field is in-memory only
and not persisted to SQLite.

Closes the audit gap where renaming the field or deleting the
assignment in the setter would have slipped past CI.

Refs #541
---
 crates/storage/src/role.rs | 115 +++++++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)

diff --git a/crates/storage/src/role.rs b/crates/storage/src/role.rs
index e58b0e44..01ff039b 100644
--- a/crates/storage/src/role.rs
+++ b/crates/storage/src/role.rs
@@ -282,6 +282,121 @@ mod tests {
         }
     }
 
+    #[test]
+    fn set_default_server_routes_subsequent_events() {
+        // Focused round-trip test for `set_default_server`.
+        //
+        // The setter mutates an in-memory field (no SQLite persistence — the
+        // field exists only on `StorageRole`, not the `StorageEventStore`),
+        // so we verify the change via the observable read path: `on_event`
+        // routes events through the configured server ID, which `handle_request`
+        // then queries by server ID.
+        //
+        // Asserts:
+        //   1. Default ID is `"default"` (events stored without calling the
+        //      setter are queryable under `"default"`).
+        //   2. After `set_default_server("srv-A")`, new events route to
+        //      `"srv-A"` and are NOT visible under the previous ID.
+        //   3. Last-write-wins: after a second `set_default_server("srv-B")`,
+        //      newer events route to `"srv-B"` and earlier ones remain under
+        //      their original server.
+        let store = StorageEventStore::open(":memory:").unwrap();
+        let mut role = StorageRole::new(store);
+        let id = Identity::generate();
+
+        // (1) Default value — no setter call yet.
+        let e1 = make_message(&id, 1, EventHash::ZERO, "general");
+        role.on_event(&e1);
+
+        let resp = role.handle_request(WorkerRequest::History {
+            server_id: "default".to_string(),
+            channel: Some("general".to_string()),
+            before: None,
+            limit: 10,
+        });
+        match resp {
+            WorkerResponse::HistoryPage { events, .. } => assert_eq!(
+                events.len(),
+                1,
+                "event before set_default_server should land under \"default\""
+            ),
+            _ => panic!("expected HistoryPage"),
+        }
+
+        // (2) Set to "srv-A" and verify routing changes.
+        role.set_default_server("srv-A".to_string());
+        let e2 = make_message(&id, 2, e1.hash, "general");
+        role.on_event(&e2);
+
+        let resp = role.handle_request(WorkerRequest::History {
+            server_id: "srv-A".to_string(),
+            channel: Some("general".to_string()),
+            before: None,
+            limit: 10,
+        });
+        match resp {
+            WorkerResponse::HistoryPage { events, .. } => assert_eq!(
+                events.len(),
+                1,
+                "event after set_default_server(\"srv-A\") should land under \"srv-A\""
+            ),
+            _ => panic!("expected HistoryPage"),
+        }
+
+        // The "default" bucket still has only the first event — proves the
+        // setter took effect rather than aliasing both IDs.
+        let resp = role.handle_request(WorkerRequest::History {
+            server_id: "default".to_string(),
+            channel: Some("general".to_string()),
+            before: None,
+            limit: 10,
+        });
+        match resp {
+            WorkerResponse::HistoryPage { events, .. } => assert_eq!(
+                events.len(),
+                1,
+                "\"default\" bucket should not gain events after switching servers"
+            ),
+            _ => panic!("expected HistoryPage"),
+        }
+
+        // (3) Last-write-wins: switch again to "srv-B".
+        role.set_default_server("srv-B".to_string());
+        let e3 = make_message(&id, 3, e2.hash, "general");
+        role.on_event(&e3);
+
+        let resp = role.handle_request(WorkerRequest::History {
+            server_id: "srv-B".to_string(),
+            channel: Some("general".to_string()),
+            before: None,
+            limit: 10,
+        });
+        match resp {
+            WorkerResponse::HistoryPage { events, .. } => assert_eq!(
+                events.len(),
+                1,
+                "event after second set_default_server should land under \"srv-B\""
+            ),
+            _ => panic!("expected HistoryPage"),
+        }
+
+        // "srv-A" bucket retains its single event.
+        let resp = role.handle_request(WorkerRequest::History {
+            server_id: "srv-A".to_string(),
+            channel: Some("general".to_string()),
+            before: None,
+            limit: 10,
+        });
+        match resp {
+            WorkerResponse::HistoryPage { events, .. } => assert_eq!(
+                events.len(),
+                1,
+                "\"srv-A\" bucket should be unchanged after switching to \"srv-B\""
+            ),
+            _ => panic!("expected HistoryPage"),
+        }
+    }
+
     #[test]
     fn history_for_unknown_channel_returns_empty() {
         let store = StorageEventStore::open(":memory:").unwrap();

From 412f1aa97167c5c20cefc0aa4812bca7e0e5bdb7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:31:52 +0000
Subject: [PATCH 05/13] test(client): cover SearchIndex set_config effect

Audit F42 flagged set_config as a public mutator covered only
indirectly via bootstrap_tests. Add a focused tests/search.rs
module with two assertions:

- set_config_round_trip pins the SetConfig + GetConfig handler
  pair (write c, read c back).
- set_config_changes_rebuild_query_results indexes a two-grove
  corpus, opts grove g1 out via per_grove_enabled, rebuilds, and
  asserts only g0's hit survives. The executor never consults
  config (gating happens at write time in message_allowed), so
  rebuild is the path that exposes the post-set_config delta.

Refs #542
---
 crates/client/src/lib.rs          |   4 +
 crates/client/src/tests/search.rs | 128 ++++++++++++++++++++++++++++++
 2 files changed, 132 insertions(+)
 create mode 100644 crates/client/src/tests/search.rs

diff --git a/crates/client/src/lib.rs b/crates/client/src/lib.rs
index 089e002c..4a47dddd 100644
--- a/crates/client/src/lib.rs
+++ b/crates/client/src/lib.rs
@@ -80,6 +80,10 @@ mod tests_voice;
 #[path = "tests/governance.rs"]
 mod tests_governance;
 
+#[cfg(test)]
+#[path = "tests/search.rs"]
+mod tests_search;
+
 /// How long a typing indicator remains visible after the last typing event, in milliseconds.
 pub const TYPING_INDICATOR_TTL_MS: u64 = 5_000;
 
diff --git a/crates/client/src/tests/search.rs b/crates/client/src/tests/search.rs
new file mode 100644
index 00000000..1eec3de9
--- /dev/null
+++ b/crates/client/src/tests/search.rs
@@ -0,0 +1,128 @@
+//! Focused contract tests for [`SearchIndexHandle::set_config`] —
+//! audit F42 (issue #542).
+//!
+//! Prior to this file the only direct coverage of `set_config` lived in
+//! `crates/client/src/search/tests.rs::handle_tests`, where each test
+//! exercised one *side* of the contract (insert gating, recents gating,
+//! grove opt-out gating). The audit asked for a focused test that locks
+//! in `set_config` itself, independently of Effect wiring or the
+//! `Insert` handler's own gating logic.
+//!
+//! Two complementary assertions live here:
+//!
+//! 1. [`set_config_round_trip`] — the minimum contract: after
+//!    `set_config(c)`, a subsequent `config().await` returns exactly
+//!    `c`. This pins the read/write symmetry of the actor's `SetConfig`
+//!    + `GetConfig` handler pair.
+//!
+//! 2. [`set_config_changes_rebuild_query_results`] — the only path by
+//!    which `set_config` produces an *observable query-result delta*
+//!    against a previously-indexed corpus is via a subsequent
+//!    `rebuild`, because the executor itself does not consult config
+//!    (gating happens at write time in `SearchActor::message_allowed`).
+//!    This test indexes a two-grove corpus, asserts both groves are
+//!    queryable, then opts grove `g1` out via `set_config`, rebuilds,
+//!    and asserts `g1`'s message no longer appears while `g0`'s still
+//!    does. That sequence proves `set_config` actually mutated the
+//!    actor's config snapshot in a way the next `rebuild` observes.
+//!
+//! Why not assert a query-result delta directly after `set_config`
+//! without a rebuild? Because the executor in
+//! `crates/client/src/search/execute.rs` reads only the index and the
+//! query — never the config. Asserting an immediate delta would
+//! require either changing production behaviour (queries consulting
+//! config) or testing a contract the code doesn't make. We pick the
+//! existing contract instead: rebuild reflects the latest config.
+
+use willow_actor::System;
+use willow_identity::Identity;
+
+use crate::search::{
+    parse_query, IndexableMessage, SearchIndexConfig, SearchIndexHandle, SearchScope,
+};
+
+fn mk(id: &str, body: &str, grove: &str) -> IndexableMessage {
+    IndexableMessage {
+        message_id: id.into(),
+        channel_id: format!("c-{grove}"),
+        channel_name: "general".into(),
+        grove_id: Some(grove.into()),
+        letter_id: None,
+        author_peer_id: Identity::generate().endpoint_id(),
+        author_handle: "mira".into(),
+        author_display_name: "Mira".into(),
+        timestamp_ms: 100,
+        body: body.into(),
+        has_image: false,
+        has_file: false,
+        has_link: false,
+    }
+}
+
+/// Round-trip: writing a config and reading it back returns the same
+/// value. Pins the `SetConfig` + `GetConfig` handler pair as a single
+/// atomic read-after-write.
+#[tokio::test]
+async fn set_config_round_trip() {
+    let sys = System::new();
+    let h = SearchIndexHandle::new_in_memory(&sys.handle());
+
+    let mut per_grove_enabled = std::collections::HashMap::new();
+    per_grove_enabled.insert("g-quiet".into(), false);
+    per_grove_enabled.insert("g-loud".into(), true);
+    let cfg = SearchIndexConfig {
+        enabled: false,
+        horizon_days: 30,
+        remember_recents: false,
+        per_grove_enabled,
+    };
+
+    h.set_config(cfg.clone());
+    assert_eq!(h.config().await, cfg);
+}
+
+/// `set_config` followed by `rebuild` must reflect the new config in
+/// query results: a grove opted out via `per_grove_enabled` after the
+/// initial index build disappears from queries once the index is
+/// rebuilt against the same corpus.
+#[tokio::test]
+async fn set_config_changes_rebuild_query_results() {
+    let sys = System::new();
+    let h = SearchIndexHandle::new_in_memory(&sys.handle());
+
+    // Two messages, one per grove, both containing the term `signal`.
+    let corpus = vec![
+        mk("m-keep", "signal here", "g0"),
+        mk("m-drop", "signal there", "g1"),
+    ];
+    h.rebuild(corpus.clone()).await;
+
+    // Baseline: both groves visible.
+    let q = parse_query("signal");
+    let pre = h.query(&q, &SearchScope::AllGrovesAndLetters).await;
+    let pre_ids: Vec<_> = pre.iter().map(|r| r.message_id.clone()).collect();
+    assert_eq!(
+        pre.len(),
+        2,
+        "baseline must surface both groves: {pre_ids:?}"
+    );
+    assert!(pre_ids.contains(&"m-keep".into()));
+    assert!(pre_ids.contains(&"m-drop".into()));
+
+    // Opt grove `g1` out, then rebuild against the same corpus.
+    let mut cfg = h.config().await;
+    cfg.per_grove_enabled.insert("g1".into(), false);
+    h.set_config(cfg);
+    h.rebuild(corpus).await;
+
+    // Post-rebuild the opted-out grove's message is gone; the kept
+    // grove's message still hits.
+    let post = h.query(&q, &SearchScope::AllGrovesAndLetters).await;
+    let post_ids: Vec<_> = post.iter().map(|r| r.message_id.clone()).collect();
+    assert_eq!(
+        post.len(),
+        1,
+        "after set_config + rebuild only g0 must remain: {post_ids:?}"
+    );
+    assert_eq!(post[0].message_id, "m-keep");
+}

From 7e79ab364e1494dfccc8bd1106e75e023c54b484 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:35:45 +0000
Subject: [PATCH 06/13] fix(agent): use OsRng for bearer token RNG

Swap rand::thread_rng() for rand::rngs::OsRng so the agent
crate's auth module stays portable to wasm32 targets, per
CLAUDE.md's WASM-portability guidance for lib crates.

Refs #546
---
 crates/agent/src/auth.rs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/crates/agent/src/auth.rs b/crates/agent/src/auth.rs
index 505e0d8c..07760d85 100644
--- a/crates/agent/src/auth.rs
+++ b/crates/agent/src/auth.rs
@@ -4,16 +4,15 @@
 //! Stdio transport skips auth (process isolation). SSE/HTTP transports
 //! require a bearer token in the `Authorization` header.
 
-use rand::Rng;
+use rand::{rngs::OsRng, RngCore};
 
 /// Token prefix for Willow agent tokens.
 const TOKEN_PREFIX: &str = "wlw_";
 
 /// Generate a 256-bit random bearer token with `wlw_` prefix.
 pub fn generate_token() -> String {
-    let mut rng = rand::thread_rng();
     let mut bytes = [0u8; 32];
-    rng.fill(&mut bytes);
+    OsRng.fill_bytes(&mut bytes);
     format!("{}{}", TOKEN_PREFIX, hex::encode(&bytes))
 }
 

From c4f4de9f51b3bb1aa2a3c4e885298c2dc14209f3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:44:23 +0000
Subject: [PATCH 07/13] feat(state): add Display impl for Permission

Permission variants previously leaked into role lists and other UI
surfaces via `format!("{p:?}")`, which prints variant identifiers
(`SyncProvider`, `ManageChannels`). Debug is non-stable for UI and
forces wording changes to grep across multiple call sites.

Add `impl Display for Permission` returning user-facing strings:
  SyncProvider   -> "Sync provider"
  ManageChannels -> "Manage channels"
  ManageRoles    -> "Manage roles"
  SendMessages   -> "Send messages"
  CreateInvite   -> "Create invite"
  __UnknownLegacy -> "Unknown"  (sentinel; should never reach UI)

Switch the role-list render paths in `crates/web/src/state.rs` and
`crates/client/src/views.rs` from `{p:?}` to `{p}`. Migrate the
permission toggle list in `crates/web/src/components/roles.rs` from
the parallel `PERMISSION_NAMES: &[&str]` constant to a typed
`TOGGLABLE_PERMISSIONS: &[Permission]`, eliminating the
string-round-trip via `Permission::from_name` and centralising the
labels behind Display. Lock the strings in a unit test.

Refs #550
---
 crates/client/src/views.rs         |  2 +-
 crates/state/src/event.rs          | 37 +++++++++++++++++++++
 crates/web/src/components/roles.rs | 52 ++++++++++++++----------------
 crates/web/src/state.rs            |  3 +-
 4 files changed, 64 insertions(+), 30 deletions(-)

diff --git a/crates/client/src/views.rs b/crates/client/src/views.rs
index 2ca4d9c0..d456976d 100644
--- a/crates/client/src/views.rs
+++ b/crates/client/src/views.rs
@@ -794,7 +794,7 @@ pub fn compute_roles_view(events: &Arc<willow_state::ServerState>) -> RolesView
         .map(|role| RoleEntry {
             id: role.id.clone(),
             name: role.name.clone(),
-            permissions: role.permissions.iter().map(|p| format!("{p:?}")).collect(),
+            permissions: role.permissions.iter().map(|p| p.to_string()).collect(),
         })
         .collect();
     roles.sort_by(|a, b| a.name.cmp(&b.name));
diff --git a/crates/state/src/event.rs b/crates/state/src/event.rs
index 653dc9f1..c4304475 100644
--- a/crates/state/src/event.rs
+++ b/crates/state/src/event.rs
@@ -86,6 +86,30 @@ impl Permission {
     }
 }
 
+/// Human-readable permission labels for UI surfaces.
+///
+/// Centralising the strings here keeps UX wording in one place and
+/// avoids leaking the `Debug`-derived variant identifiers (e.g.
+/// `SyncProvider`) into role lists, settings panes, or MCP resources.
+/// `Debug` remains available for logs and developer-facing output.
+impl std::fmt::Display for Permission {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let label = match self {
+            Self::SyncProvider => "Sync provider",
+            Self::ManageChannels => "Manage channels",
+            Self::ManageRoles => "Manage roles",
+            Self::SendMessages => "Send messages",
+            Self::CreateInvite => "Create invite",
+            // Sentinel from a future/unknown client. Should never reach
+            // a UI render path in practice — `apply_event` drops these
+            // before they enter any role's permission set — but Display
+            // must be total, so emit a clearly-flagged placeholder.
+            Self::__UnknownLegacy => "Unknown",
+        };
+        f.write_str(label)
+    }
+}
+
 impl<'de> Deserialize<'de> for Permission {
     /// Custom deserialize that accepts both the enum form (default for
     /// any format — bincode emits a u32 discriminant, JSON emits the
@@ -553,4 +577,17 @@ mod tests {
         event.author = id_b.endpoint_id();
         assert!(!event.verify());
     }
+
+    #[test]
+    fn permission_display_strings() {
+        // UI surfaces (role lists, settings, MCP resources) render
+        // permissions via Display. Locking these strings here keeps the
+        // wording stable and surfaces wording changes as test diffs.
+        assert_eq!(Permission::SyncProvider.to_string(), "Sync provider");
+        assert_eq!(Permission::ManageChannels.to_string(), "Manage channels");
+        assert_eq!(Permission::ManageRoles.to_string(), "Manage roles");
+        assert_eq!(Permission::SendMessages.to_string(), "Send messages");
+        assert_eq!(Permission::CreateInvite.to_string(), "Create invite");
+        assert_eq!(Permission::__UnknownLegacy.to_string(), "Unknown");
+    }
 }
diff --git a/crates/web/src/components/roles.rs b/crates/web/src/components/roles.rs
index 8db97e4a..fb4809c1 100644
--- a/crates/web/src/components/roles.rs
+++ b/crates/web/src/components/roles.rs
@@ -1,16 +1,22 @@
 use leptos::prelude::*;
+use willow_state::Permission;
 
 use crate::app::WebClientHandle;
 use crate::components::{ConfirmDialog, ToastStack};
 use crate::state::AppState;
 
-/// List of all permission names that can be toggled on a role.
-const PERMISSION_NAMES: &[&str] = &[
-    "SyncProvider",
-    "ManageChannels",
-    "ManageRoles",
-    "SendMessages",
-    "CreateInvite",
+/// All non-sentinel permissions that can be toggled on a role.
+///
+/// Order is the order they appear in the UI. The
+/// [`Permission::__UnknownLegacy`] sentinel is intentionally excluded —
+/// it represents a value emitted by an unknown future client and must
+/// never be presented as a togglable option.
+const TOGGLABLE_PERMISSIONS: &[Permission] = &[
+    Permission::SyncProvider,
+    Permission::ManageChannels,
+    Permission::ManageRoles,
+    Permission::SendMessages,
+    Permission::CreateInvite,
 ];
 
 /// A single role entry: (role_id, role_name, set of granted permission strings).
@@ -183,15 +189,15 @@ pub fn RoleManager(
                                     let hp = handle_perm.clone();
                                     let rid = role_id_perms.clone();
                                     let perms = permissions.clone();
-                                    PERMISSION_NAMES.iter().map(|perm_name| {
-                                        let perm = perm_name.to_string();
-                                        let perm_label = perm.clone();
-                                        let perm_check = perm.clone();
-                                        let perm_toggle = perm.clone();
+                                    TOGGLABLE_PERMISSIONS.iter().copied().map(|perm| {
+                                        // The role view layer renders permissions
+                                        // via `Display`, so membership compares
+                                        // against the same `Display` string.
+                                        let perm_label = perm.to_string();
+                                        let checked = perms.contains(&perm_label);
                                         let rid_t = rid.clone();
                                         let hp_t = hp.clone();
                                         let oc_t = oc;
-                                        let checked = perms.contains(&perm_check);
                                         view! {
                                             <label class="permission-toggle">
                                                 <input
@@ -202,22 +208,14 @@ pub fn RoleManager(
                                                         let granted = event_target_checked(&ev);
                                                         let h = hp_t.clone();
                                                         let rid = rid_t.clone();
-                                                        let perm = perm_toggle.clone();
                                                         let toasts = use_context::<ToastStack>();
                                                         wasm_bindgen_futures::spawn_local(async move {
-                                                            // Names come from PERMISSION_NAMES which is
-                                                            // kept in sync with willow_state::Permission;
-                                                            // an unparsed name is a bug, not user input.
-                                                            if let Some(parsed) =
-                                                                willow_state::Permission::from_name(&perm)
-                                                            {
-                                                                if let Err(e) = h.set_permission(&rid, parsed, granted).await {
-                                                                    crate::handlers::warn_and_toast_with(
-                                                                        "set permission",
-                                                                        &e,
-                                                                        toasts.as_ref(),
-                                                                    );
-                                                                }
+                                                            if let Err(e) = h.set_permission(&rid, perm, granted).await {
+                                                                crate::handlers::warn_and_toast_with(
+                                                                    "set permission",
+                                                                    &e,
+                                                                    toasts.as_ref(),
+                                                                );
                                                             }
                                                         });
                                                     }
diff --git a/crates/web/src/state.rs b/crates/web/src/state.rs
index 96eb5e47..fa4d7234 100644
--- a/crates/web/src/state.rs
+++ b/crates/web/src/state.rs
@@ -863,8 +863,7 @@ pub fn wire_derived_signals<N: willow_network::Network>(
         es.roles
             .iter()
             .map(|(id, role)| {
-                let perms: Vec<String> =
-                    role.permissions.iter().map(|p| format!("{p:?}")).collect();
+                let perms: Vec<String> = role.permissions.iter().map(|p| p.to_string()).collect();
                 (id.clone(), role.name.clone(), perms)
             })
             .collect::<Vec<_>>()

From 8fa46add47bc8a2e5b906e407dc734daefeb0dcd Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:48:02 +0000
Subject: [PATCH 08/13] docs(web): mark mutex use sites with lock-ok
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CLAUDE.md requires `// state: lock-ok — <reason>` at each lock use
site. Both `WebTrustStore` and `DerivedStateActor::cached` already
carry struct-level rationale, but the `.lock()` call sites lacked
the inline marker pointing readers there.

Audit F44 prescribed migrating `trust_store.rs` to `Rc<RefCell<>>`,
but that doesn't compile on the dual-target (native + wasm32) crate
— the existing `Mutex<Inner>` is the correct primitive. Residual
gap was just the missing inline markers; no behaviour change, panic
policy preserved (trust state is security-critical; silent
degradation would be unsafe).

Refs #544
---
 crates/web/src/state_bridge.rs | 2 ++
 crates/web/src/trust_store.rs  | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/crates/web/src/state_bridge.rs b/crates/web/src/state_bridge.rs
index 1ddbfd1c..a0d6d508 100644
--- a/crates/web/src/state_bridge.rs
+++ b/crates/web/src/state_bridge.rs
@@ -48,6 +48,7 @@ impl<T: Send + Sync + 'static, U: PartialEq + Clone + Send + Sync + 'static> Act
         async move {
             let snapshot = source.get().await;
             let result = selector(&snapshot);
+            // state: lock-ok — see `DerivedStateActor::cached` doc; mailbox serializes handlers, no contention.
             *cached.lock().expect("cached mutex poisoned") = Some(result.clone());
             (*write).set(result);
         }
@@ -70,6 +71,7 @@ impl<T: Send + Sync + 'static, U: PartialEq + Clone + Send + Sync + 'static> Han
         async move {
             let snapshot = source.get().await;
             let result = selector(&snapshot);
+            // state: lock-ok — see `DerivedStateActor::cached` doc; mailbox serializes handlers, no contention.
             let mut guard = cached.lock().expect("cached mutex poisoned");
             let changed = match &*guard {
                 Some(old) => old != &result,
diff --git a/crates/web/src/trust_store.rs b/crates/web/src/trust_store.rs
index 3c0c972f..cd392d9e 100644
--- a/crates/web/src/trust_store.rs
+++ b/crates/web/src/trust_store.rs
@@ -87,6 +87,7 @@ impl WebTrustStore {
 
 impl TrustStore for WebTrustStore {
     fn get(&self, peer_id: &str) -> PeerTrust {
+        // state: lock-ok — see `WebTrustStore::inner` doc; panic-on-poison intentional (trust state security-critical).
         self.inner
             .lock()
             .expect("WebTrustStore mutex poisoned")
@@ -97,6 +98,7 @@ impl TrustStore for WebTrustStore {
     }
 
     fn set(&self, peer_id: &str, trust: PeerTrust) {
+        // state: lock-ok — see `WebTrustStore::inner` doc; panic-on-poison intentional (trust state security-critical).
         let mut guard = self.inner.lock().expect("WebTrustStore mutex poisoned");
         if matches!(trust, PeerTrust::Unknown) {
             guard.peers.remove(peer_id);
@@ -111,6 +113,7 @@ impl TrustStore for WebTrustStore {
     }
 
     fn snapshot(&self) -> Vec<(String, PeerTrust)> {
+        // state: lock-ok — see `WebTrustStore::inner` doc; panic-on-poison intentional (trust state security-critical).
         self.inner
             .lock()
             .expect("WebTrustStore mutex poisoned")
@@ -121,6 +124,7 @@ impl TrustStore for WebTrustStore {
     }
 
     fn version(&self) -> u64 {
+        // state: lock-ok — see `WebTrustStore::inner` doc; panic-on-poison intentional (trust state security-critical).
         self.inner
             .lock()
             .expect("WebTrustStore mutex poisoned")

From 74f01ad1a7e3f9dd482071b71b7cbff23967119a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:50:56 +0000
Subject: [PATCH 09/13] fix(web): prefer Display for error formatting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch user-visible error formatting from Debug ({e:?}) to Display
({e}) on the five sites called out by audit F50. Display is
preferable for end-user-facing strings; Debug exposes type internals.

Sites touched:
- crates/web/src/test_hooks/dispatcher.rs:66 — serde_wasm_bindgen
  ::Error implements Display; direct {e} swap.
- crates/web/src/test_hooks/dispatcher.rs:89, 121, 134 — JsValue
  has no Display impl; fall back to e.as_string().unwrap_or_else
  (|| format!("{e:?}")) so string-typed JS errors render cleanly
  while non-string values still degrade to Debug.
- crates/web/src/voice.rs:60 — JsValue from AudioContext::new();
  same as_string fallback. This Result<_, String> is the path that
  can surface in user-facing UI, motivating the swap.

Internal tracing::warn!/error! sites with {e:?} are intentionally
left untouched per the audit (internal-only logs).

Refs #549
---
 crates/web/src/test_hooks/dispatcher.rs | 24 ++++++++++++++++++------
 crates/web/src/voice.rs                 |  8 ++++++--
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/crates/web/src/test_hooks/dispatcher.rs b/crates/web/src/test_hooks/dispatcher.rs
index ce00c422..320a90d1 100644
--- a/crates/web/src/test_hooks/dispatcher.rs
+++ b/crates/web/src/test_hooks/dispatcher.rs
@@ -62,9 +62,7 @@ pub fn install_push_dispatcher(mut rx: EventReceiver) -> DispatcherHandle {
             let js = match serde_wasm_bindgen::to_value(&wire) {
                 Ok(v) => v,
                 Err(e) => {
-                    web_sys::console::error_1(
-                        &format!("test-hooks: serialize failed: {e:?}").into(),
-                    );
+                    web_sys::console::error_1(&format!("test-hooks: serialize failed: {e}").into());
                     continue;
                 }
             };
@@ -86,7 +84,13 @@ fn dispatch_or_buffer(js: JsValue) {
     if let Ok(callback) = js_sys::Reflect::get(&window, &"__willowEvent".into()) {
         if let Some(func) = callback.dyn_ref::<js_sys::Function>() {
             if let Err(e) = func.call1(&JsValue::NULL, &js) {
-                web_sys::console::warn_1(&format!("test-hooks: __willowEvent threw: {e:?}").into());
+                web_sys::console::warn_1(
+                    &format!(
+                        "test-hooks: __willowEvent threw: {}",
+                        e.as_string().unwrap_or_else(|| format!("{e:?}"))
+                    )
+                    .into(),
+                );
             }
             return;
         }
@@ -118,7 +122,11 @@ fn drain_buffer_into_callback() {
         let item = arr.shift();
         if let Err(e) = func.call1(&JsValue::NULL, &item) {
             web_sys::console::warn_1(
-                &format!("test-hooks: __willowEvent (drain) threw: {e:?}").into(),
+                &format!(
+                    "test-hooks: __willowEvent (drain) threw: {}",
+                    e.as_string().unwrap_or_else(|| format!("{e:?}"))
+                )
+                .into(),
             );
         }
     }
@@ -131,7 +139,11 @@ fn push_into_buffer(window: &web_sys::Window, js: JsValue) {
             let arr = js_sys::Array::new();
             if let Err(e) = js_sys::Reflect::set(window, &"__willowEventBuffer".into(), &arr) {
                 web_sys::console::error_1(
-                    &format!("test-hooks: failed to install __willowEventBuffer: {e:?}").into(),
+                    &format!(
+                        "test-hooks: failed to install __willowEventBuffer: {}",
+                        e.as_string().unwrap_or_else(|| format!("{e:?}"))
+                    )
+                    .into(),
                 );
             }
             arr.into()
diff --git a/crates/web/src/voice.rs b/crates/web/src/voice.rs
index e0933187..18157689 100644
--- a/crates/web/src/voice.rs
+++ b/crates/web/src/voice.rs
@@ -56,8 +56,12 @@ impl SpeakingDetector {
     /// The `AudioContext` is created immediately (caller must ensure a user
     /// gesture has already occurred so the browser allows it).
     pub fn new(on_change: impl Fn(HashSet<String>) + 'static) -> Result<Self, String> {
-        let audio_context =
-            AudioContext::new().map_err(|e| format!("AudioContext::new failed: {e:?}"))?;
+        let audio_context = AudioContext::new().map_err(|e| {
+            format!(
+                "AudioContext::new failed: {}",
+                e.as_string().unwrap_or_else(|| format!("{e:?}"))
+            )
+        })?;
         // Resume the context in case it was created in a suspended state.
         let _ = audio_context.resume();
         Ok(Self {

From de44bb25c435f1f098b6599110c64be2c6c1d6ad Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 08:54:38 +0000
Subject: [PATCH 10/13] fix(messaging): clamp HLC remote ts forward-drift

Without an upper bound on `remote.millis`, a single malicious or buggy
peer could broadcast `millis = u64::MAX - k` and permanently poison
every receiver's HLC, saturating subsequent `bump_counter` calls and
breaking ordering + "now"-based UIs forever.

Adopt Kulkarni's recommendation: clamp remote `millis` to
`wall + MAX_FORWARD_DRIFT_MS` (24h) and emit a `warn!` so ops can
surface peers that consistently exceed the cap. Counter is unaffected
since it resets when millis advances.

Rejected alternatives:
- Hard-reject (drop the receive update): silently desyncs HLC from
  legitimately drifted peers, leaving message ordering inconsistent.
- Clamp without warn: loses the telemetry signal for buggy peers.

Tests: receive_clamps_far_future_remote, receive_accepts_within_drift,
receive_clamps_at_exact_boundary.

Refs #516

https://claude.ai/code/session_01LjdWEgoELvKBf7YGbUCdsY
---
 Cargo.lock                  |   1 +
 crates/messaging/Cargo.toml |   1 +
 crates/messaging/src/hlc.rs | 123 +++++++++++++++++++++++++++++++++++-
 3 files changed, 122 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ccf03abd..65bd21f4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6167,6 +6167,7 @@ dependencies = [
  "serde",
  "thiserror 2.0.18",
  "tokio",
+ "tracing",
  "uuid",
  "willow-identity",
  "willow-transport",
diff --git a/crates/messaging/Cargo.toml b/crates/messaging/Cargo.toml
index de3b7088..3c44b4c1 100644
--- a/crates/messaging/Cargo.toml
+++ b/crates/messaging/Cargo.toml
@@ -13,6 +13,7 @@ serde = { workspace = true }
 chrono = { workspace = true }
 uuid = { workspace = true }
 thiserror = { workspace = true }
+tracing = { workspace = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 js-sys = "0.3"
diff --git a/crates/messaging/src/hlc.rs b/crates/messaging/src/hlc.rs
index f56007cd..5d3d3f82 100644
--- a/crates/messaging/src/hlc.rs
+++ b/crates/messaging/src/hlc.rs
@@ -72,6 +72,18 @@ impl std::fmt::Display for HlcTimestamp {
     }
 }
 
+/// Maximum forward drift, in milliseconds, that a remote HLC timestamp may
+/// have over the local wall clock before it is clamped in [`HLC::receive`].
+///
+/// Without this cap a single malicious or buggy peer could broadcast one
+/// message with `millis = u64::MAX - k`, permanently poisoning every
+/// receiver's HLC and saturating the counter on subsequent local events
+/// (Kulkarni et al., 2014, §V — recommended forward-drift bound).
+///
+/// 24h is generous enough to absorb realistic NTP skew, mobile sleep, and
+/// timezone-misconfigured peers while still bounding worst-case poisoning.
+pub const MAX_FORWARD_DRIFT_MS: u64 = 24 * 60 * 60 * 1000;
+
 // ───── HLC state machine ────────────────────────────────────────────────────
 
 /// Returns the current wall-clock time in milliseconds since Unix epoch.
@@ -169,15 +181,36 @@ impl HLC {
     ///
     /// Returns a new local timestamp that is strictly greater than both the
     /// local clock and the remote timestamp.
+    ///
+    /// The remote `millis` value is clamped to
+    /// `wall_clock + MAX_FORWARD_DRIFT_MS` before being folded into the
+    /// `max` chain. This prevents a single peer with a far-future timestamp
+    /// from permanently poisoning the local HLC (see
+    /// [`MAX_FORWARD_DRIFT_MS`]). A clamp event emits a `warn!` so ops can
+    /// surface peers that consistently exceed the drift bound.
     pub fn receive(&mut self, remote: HlcTimestamp) -> HlcTimestamp {
         let wall = wall_clock_ms();
-        let millis = wall.max(self.latest.millis).max(remote.millis);
 
-        let (millis, counter) = if millis == self.latest.millis && millis == remote.millis {
+        let max_allowed = wall.saturating_add(MAX_FORWARD_DRIFT_MS);
+        let clamped_remote_millis = if remote.millis > max_allowed {
+            tracing::warn!(
+                remote_millis = remote.millis,
+                wall_ms = wall,
+                max_allowed,
+                "HLC remote timestamp exceeded forward-drift cap; clamping"
+            );
+            max_allowed
+        } else {
+            remote.millis
+        };
+
+        let millis = wall.max(self.latest.millis).max(clamped_remote_millis);
+
+        let (millis, counter) = if millis == self.latest.millis && millis == clamped_remote_millis {
             bump_counter(millis, self.latest.counter.max(remote.counter))
         } else if millis == self.latest.millis {
             bump_counter(millis, self.latest.counter)
-        } else if millis == remote.millis {
+        } else if millis == clamped_remote_millis {
             bump_counter(millis, remote.counter)
         } else {
             (millis, 0)
@@ -414,6 +447,90 @@ mod tests {
         assert!(t2 > t1);
     }
 
+    #[test]
+    fn receive_clamps_far_future_remote() {
+        // A malicious peer broadcasting `u64::MAX - 1000` must not be able to
+        // poison the local HLC. After the call, `latest.millis` must sit
+        // within roughly `wall + MAX_FORWARD_DRIFT_MS` (plus a tiny epsilon
+        // for the wall-clock tick between calls).
+        let wall_before = wall_clock_ms();
+        let mut clock = HLC::new();
+
+        let attack = HlcTimestamp {
+            millis: u64::MAX - 1000,
+            counter: 0,
+        };
+        let result = clock.receive(attack);
+
+        let upper_bound = wall_before
+            .saturating_add(MAX_FORWARD_DRIFT_MS)
+            .saturating_add(1_000); // 1s slack for wall-clock advance
+        assert!(
+            result.millis <= upper_bound,
+            "receive() must clamp far-future remote (got {}, bound {upper_bound})",
+            result.millis,
+        );
+
+        // Subsequent now() calls must still produce reasonable timestamps,
+        // not anywhere near u64::MAX.
+        let next = clock.now();
+        assert!(
+            next.millis <= upper_bound.saturating_add(1_000),
+            "now() after clamp must remain near wall clock (got {})",
+            next.millis,
+        );
+        assert!(next > result, "monotonicity must still hold");
+    }
+
+    #[test]
+    fn receive_accepts_within_drift() {
+        // A remote timestamp 1 hour in the future is well within the 24h
+        // drift cap and must be adopted unchanged.
+        let wall = wall_clock_ms();
+        let mut clock = HLC::new();
+
+        let one_hour_ms: u64 = 60 * 60 * 1000;
+        let remote = HlcTimestamp {
+            millis: wall + one_hour_ms,
+            counter: 0,
+        };
+        let result = clock.receive(remote);
+
+        // The HLC should adopt the remote's millis (since it dominates wall
+        // and latest), not clamp it.
+        assert_eq!(
+            result.millis, remote.millis,
+            "remote within drift bound must be adopted unchanged",
+        );
+        assert!(result > remote);
+    }
+
+    #[test]
+    fn receive_clamps_at_exact_boundary() {
+        // The boundary check is strict (`>`), so a remote exactly one ms over
+        // the cap must clamp, while the cap itself is still accepted.
+        let wall = wall_clock_ms();
+        let mut clock = HLC::new();
+
+        let remote = HlcTimestamp {
+            millis: wall + MAX_FORWARD_DRIFT_MS + 1,
+            counter: 0,
+        };
+        let result = clock.receive(remote);
+
+        // After clamping the remote down to `wall + MAX_FORWARD_DRIFT_MS`,
+        // the new latest must equal that cap (possibly +1 if the wall clock
+        // ticked between the two reads; assert with a small slack window).
+        let lower = wall.saturating_add(MAX_FORWARD_DRIFT_MS);
+        let upper = wall.saturating_add(MAX_FORWARD_DRIFT_MS).saturating_add(50);
+        assert!(
+            (lower..=upper).contains(&result.millis),
+            "receive() must clamp to wall + MAX_FORWARD_DRIFT_MS \
+             (got {}, expected in [{lower}, {upper}])",
+            result.millis,
+        );
+    }
+
     #[test]
     fn receive_when_local_is_ahead_of_remote() {
         let mut clock = HLC::new();

From 6170d06f93a70bc78a8231cd6e55b63edd51ac2b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 09:01:26 +0000
Subject: [PATCH 11/13] fix(state): graceful bincode fail in event verify
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Primary fix: Event::verify() (crates/state/src/event.rs) now matches on
bincode::serialize() instead of expect()-ing. On Err it logs a warn and
returns false so a malformed attacker-controlled `kind` (e.g. a String
produced via unsafe with non-UTF-8 bytes) cannot panic the verify hot
path. Defense-in-depth — bincode of owned Vec/String/integers should
not realistically fail, but verify() runs on every received event from
untrusted peers, so a panic here is a DoS vector.

Snapshot::new() (crates/state/src/sync.rs): kept expect() but tightened
the panic message to document the invariant ("...should be unreachable
post-validation"). Option C from the plan. Option A (no change) was the
runner-up; chose C to leave breadcrumbs for future readers about why
the panic is safe here. Option B (return Result) was rejected — it
would ripple through every Snapshot::new() call site, far out of scope
for a defense-in-depth tightening. Snapshot input is locally
materialized state which already passed apply_incremental's validation,
so this path is not attacker-influenced in the same way verify() is.

Event::new() (crates/state/src/event.rs:450) deliberately untouched.
That path is local authorship — we construct the event ourselves from
already-validated input, so a serialization panic would indicate a
real bug in our own code, not an attacker-induced DoS. Catching it
would only hide bugs.

Test: added verify_returns_false_on_garbage_event in event.rs tests.
The bincode-failure branch itself is unreachable from safe Rust on
the current owned types, so the test exercises the adjacent
hash/sig-mismatch path to confirm verify() returns gracefully on
adversarial input. Documented in the test that the bincode-error
arm is defense-in-depth standing without a direct test, reachable
only via attacker-side `unsafe` we cannot reproduce in safe Rust.

Local gate: cargo fmt --check, clippy -p willow-state -D warnings,
test -p willow-state, check --target wasm32 -p willow-state. Pre-
existing failure tests_materialize::non_admin_set_profile_is_accepted
remains (baseline rot, out of scope).

Refs #520
---
 crates/state/src/event.rs | 27 ++++++++++++++++++++++++++-
 crates/state/src/sync.rs  |  9 ++++++++-
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/crates/state/src/event.rs b/crates/state/src/event.rs
index c4304475..e939f2ba 100644
--- a/crates/state/src/event.rs
+++ b/crates/state/src/event.rs
@@ -473,7 +473,17 @@ impl Event {
             kind: &self.kind,
             timestamp_hint_ms: self.timestamp_hint_ms,
         };
-        let bytes = bincode::serialize(&signable).expect("event serialization should not fail");
+        // Defense-in-depth: bincode of owned Vec/String/integers shouldn't
+        // fail in practice, but `kind` is attacker-controlled. A malformed
+        // String produced via `unsafe` could in theory fail to serialize.
+        // Reject the event instead of panicking on the hot verify path.
+        let bytes = match bincode::serialize(&signable) {
+            Ok(b) => b,
+            Err(e) => {
+                tracing::warn!(error = %e, "event verify: bincode serialize failed; rejecting");
+                return false;
+            }
+        };
 
         // Verify hash matches content.
         if self.hash != EventHash::from_bytes(&bytes) {
@@ -578,6 +588,21 @@ mod tests {
         assert!(!event.verify());
     }
 
+    #[test]
+    fn verify_returns_false_on_garbage_event() {
+        // Defense-in-depth: verify() should never panic on adversarial
+        // input, even if the hash and signature are obviously bogus.
+        // The bincode-failure branch in verify() is unreachable from safe
+        // Rust on the current types (owned Vec/String/integers), so this
+        // test exercises the adjacent hash/sig mismatch path to confirm
+        // the function returns gracefully instead of panicking.
+        let id = Identity::generate();
+        let mut event = make_event(&id, test_kind());
+        event.hash = EventHash::from_bytes(b"not-the-real-hash");
+        event.sig = Signature::from_bytes(&[0u8; 64]);
+        assert!(!event.verify());
+    }
+
     #[test]
     fn permission_display_strings() {
         // UI surfaces (role lists, settings, MCP resources) render
diff --git a/crates/state/src/sync.rs b/crates/state/src/sync.rs
index bae4624f..f88fe1e7 100644
--- a/crates/state/src/sync.rs
+++ b/crates/state/src/sync.rs
@@ -92,7 +92,14 @@ impl Snapshot {
             state: &state,
             heads: sorted_heads,
         };
-        let bytes = bincode::serialize(&input).expect("snapshot serialization should not fail");
+        // `state` is locally materialized via `apply_incremental`, which
+        // rejects malformed events before they enter the DAG. Any failure
+        // here would indicate an invariant violation, not attacker input.
+        // Returning Result would ripple through every call site; keep the
+        // panic but document the invariant.
+        let bytes = bincode::serialize(&input).expect(
+            "snapshot serialization invariant violated; should be unreachable post-validation",
+        );
         let hash = EventHash::from_bytes(&bytes);
         Self { state, heads, hash }
     }

From df17da3f200c7f9e514c2c4bcc7dce4e60cf1726 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 3 May 2026 09:04:40 +0000
Subject: [PATCH 12/13] docs(skill): re-verify dismissed baseline failures
 every run
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prior PR #511 lessons dismissed
`willow-state::tests_materialize::non_admin_set_profile_is_accepted` as
a sandbox-side flake. This run reproduced it cleanly on coordinator
HEAD post-PR #505 (which added the SetProfile membership gate) — the
"flake" was a real regression all along, just exposed once the gating
PR landed. Filed #565.

Strengthen the implementer-flagged-rot section: always re-verify on
coordinator HEAD; don't rely on a prior dismissal alone. Rot
accumulates between runs; a previously-flaky symptom can become a real
regression as PRs merge.

Refs auto-fix batch claude/friendly-maxwell-M5xB6.
---
 .claude/skills/resolving-issues/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.claude/skills/resolving-issues/SKILL.md b/.claude/skills/resolving-issues/SKILL.md
index 99ee970f..5f4a1543 100644
--- a/.claude/skills/resolving-issues/SKILL.md
+++ b/.claude/skills/resolving-issues/SKILL.md
@@ -215,6 +215,7 @@ Coordinator owns this check (metadata work, allowed under "coordinator never cod
 ### Implementer-flagged out-of-scope rot
 - When the implementer surfaces pre-existing rot it intentionally doesn't fix (e.g. unrelated wasm break under `--all-features`, dead-code warnings in untouched files), the coordinator files a follow-up GH issue using `mcp__github__issue_write` (metadata work, allowed under the Coordinator-never-codes rule). Cite the discovery context (which dispatch surfaced it, which commit + gate step) so the next run has full provenance.
 - This is the same shape as the "implementer files follow-up" rule — coordinator just does the filing because the implementer is single-task and exits after commit.
+- **Always reproduce the failure on coordinator HEAD before filing OR dismissing.** A prior run dismissing the same shape as a "sandbox-side flake" doesn't mean it stays a flake — rot accumulates as PRs merge, and a previously-flaky symptom can become a real regression once a related change lands. Run the failing command in the coordinator's checkout (single shot, no retry loops); if it reproduces, file the follow-up with the exact assertion + the git history that exposed it (e.g. `git log --oneline <last-fix-attempt>..HEAD -- <relevant-paths>` to find the PR that flipped flake → real). If it doesn't reproduce, don't file — but note the dismissal in the run-end Lessons Learned so the next run has the audit trail. Never rely on a prior dismissal alone; always re-verify.
 
 ### Fresh agent per issue
 - New implementer each issue. No state leak.

From baeee4391e29655a5d9a985898f1d2effd7cacb6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 4 May 2026 09:39:12 +0000
Subject: [PATCH 13/13] test(state): fix membership-gate causal linkage

The `non_admin_set_profile_is_accepted` test emitted alice's
SetProfile via `do_emit` (deps: vec![]), so topological_sort
ordering depended on hash. When alice's SetProfile sorted before
admin's GrantPermission, the post-#505 membership gate at
materialize.rs:548-555 silently rejected it and the assertion
failed only when the full suite ran.

Mirror the existing pattern at tests/materialize.rs:388-398:
capture the grant hash and use `dag.create_event` directly with
explicit `deps: vec![grant.hash]` so the SetProfile causally
follows the grant under any topological ordering.

Production-side fix (membership-pending buffer in `apply_event`)
is the larger refactor explicitly deferred per #565.

Audit confirms no other test currently relies on lucky topo-sort
to land a non-genesis-author gated event: stress.rs's
non-admin SetProfile loops only assert determinism / sort cost,
not application; permissions.rs uses ManagedDag's incremental
apply path; all SetProfile/UpdateProfile/Pin/Unpin/ChannelRevive
sites in materialize.rs use the genesis author (admin/owner) who
is already a member.

Refs #565
---
 crates/state/src/tests/materialize.rs | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/crates/state/src/tests/materialize.rs b/crates/state/src/tests/materialize.rs
index 134f884e..389d2c18 100644
--- a/crates/state/src/tests/materialize.rs
+++ b/crates/state/src/tests/materialize.rs
@@ -46,7 +46,7 @@ fn non_admin_set_profile_is_accepted() {
     let alice = Identity::generate();
 
     // Grant SendMessages so alice is a member.
-    do_emit(
+    let grant = do_emit(
         &mut dag,
         &admin,
         EventKind::GrantPermission {
@@ -54,14 +54,19 @@ fn non_admin_set_profile_is_accepted() {
             permission: Permission::SendMessages,
         },
     );
-    // Alice sets her own profile (no admin needed).
-    do_emit(
-        &mut dag,
+    // Alice sets her own profile (no admin needed). Explicit causal
+    // dep on `grant` so topological_sort always applies the grant
+    // before the SetProfile — otherwise hash ordering can flip the
+    // order and the post-#505 membership gate silently rejects.
+    let set_profile = dag.create_event(
         &alice,
         EventKind::SetProfile {
             display_name: "Alice".to_string(),
         },
+        vec![grant.hash],
+        0,
     );
+    dag.insert(set_profile).unwrap();
 
     let state = materialize(&dag);
     assert_eq!(