docs(audit): fix stale Deferred entries for metadata editing + PO-token auto-mint

Both shipped (ROADMAP.md Phase L/P) but CODE-AUDIT.md's Deferred section
still listed them as pending.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
2026-07-02 17:08:20 -04:00
parent d8df5ea7c8
commit 3623418fe3
+4 -2
View File
@@ -2546,8 +2546,10 @@ Security & correctness audit (2026-06-23):
- Designed app icon before v1.0 (placeholder shipped). - Designed app icon before v1.0 (placeholder shipped).
- Migrate JSON stores to better-sqlite3 if a user indexes many large channels. - Migrate JSON stores to better-sqlite3 if a user indexes many large channels.
- Metadata editing (`--parse-metadata`/`--replace-in-metadata`) — held pending a live recipe. - ~~Metadata editing (`--parse-metadata`/`--replace-in-metadata`)~~done: `--replace-in-metadata` in
- PO-token WebView auto-minting — only the `--extractor-args` plumbing shipped. `DownloadOptionsForm.tsx` (ROADMAP.md "Metadata editing before download").
- ~~PO-token WebView auto-minting~~ — done: [poToken.ts](src/main/poToken.ts) opens a hardened
BrowserWindow on the shared login session and mints the token automatically (ROADMAP.md "Reliability").
- ~~Taskbar overlay badge (needs a drawn `NativeImage`)~~ — done (W11): [badge.ts](src/main/badge.ts). - ~~Taskbar overlay badge (needs a drawn `NativeImage`)~~ — done (W11): [badge.ts](src/main/badge.ts).
- i18n — deliberately deferred (note: UI strings are hard-coded throughout). - i18n — deliberately deferred (note: UI strings are hard-coded throughout).
- Code signing — **non-goal**: no certificate will be purchased, so builds ship unsigned and the SmartScreen - Code signing — **non-goal**: no certificate will be purchased, so builds ship unsigned and the SmartScreen