Record the static-analysis triage All 190 findings gone through rather than counted. The four error-severity alerts and the 117 broad-catch notes are accounted for: two real defects came out of them, and the rest are documented cleanup paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013M9nbxEabdG7NSs8WYzsAp
Correct the severity claimed for the SKRoundRect finding The page described it as an OOM-class leak. An A/B soak with the leaky build rebuilt as a negative control could not distinguish the two: both are flat after warm-up, and the leaky arm's RSS went down in 7 of 25 intervals. A real leak never decreases. Thousands of small managed wrappers a second is heavy gen0 pressure, so finalizers run and the native memory is reclaimed. The leak that actually killed the editor was fewer, larger native allocations that never triggered a collection. Object count is not the danger; the ratio of native bytes to managed pressure is. The fix still ships - it is a real defect and the non-allocating overload is free - but the severity was asserted from a static finding and published before anything measured it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013M9nbxEabdG7NSs8WYzsAp
Record CI, determinism and the leak CodeQL found States the reproducibility position precisely: builds are deterministic on one toolchain and CI asserts that every push, but a CI build and a workstation build of the same commit still differ, because a self-contained publish bundles a runtime whose version tracks the installed SDK patch. The weaker claim - verifiable if you match the toolchain - is what is made. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013M9nbxEabdG7NSs8WYzsAp
Add a hardening page and screenshots Records what the systemd unit actually restricts, the three directives that improved its score and had to be reverted because the service would not start under them, and the five faults the review found. Also states plainly what is not done: releases are unsigned, there is no CI, builds are not reproducible, and the application cannot be confined by a portal because it needs raw hidraw and uinput access. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013M9nbxEabdG7NSs8WYzsAp