Two production crashes were silently breaking the editor:

1. RangeError "Decorations that replace line breaks may not be specified
   via plugins" — tables.tsx registered Decoration.replace() widgets that
   span multiple lines via ViewPlugin. CodeMirror 6 forbids this; only
   StateField-provided decorations may replace line breaks. Migrated the
   tables WYSIWYG decoration from ViewPlugin.fromClass → StateField:
   - buildTableDecorations now takes EditorState (not EditorView).
   - StateField rebuilds on doc/selection changes, otherwise maps
     decorations through the transaction.
   - Dropped the view.visibleRanges optimization (StateField has no
     viewport). Tables are uncommon enough that processing all of them
     is fine; can be optimized later via StateEffects if needed.

2. TypeError "tags is not iterable" — thrown deep inside
   HighlightStyle.style during syntax tree highlight (not at
   define-time). Suspected cause: a parser extension emits malformed
   tag metadata for a node. We add EditorView.exceptionSink at the head
   of the extension list so plugin crashes are logged (console + Sentry
   if wired) but no longer tear down the editor. Root-cause fix for the
   offending parser is tracked separately — needs runtime repro.

Both errors blocked editor mount in production, leaving users with an
empty note view and "Table WYSIWYG disabled" in the console.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…taged

DX upgrade for the monorepo's git hooks and dead-code detection.

Lefthook over husky:
- Single declarative lefthook.yml at repo root (pre-commit, pre-push,
  commit-msg). No more .husky/_ shadow hooks dir.
- Native binary (per-platform via npm), faster than husky's shell wrappers.
- postinstall: lefthook install (replaces husky's prepare script).
- After pulling this PR, contributors who had husky installed may need to
  unset stale core.hooksPath: `git config --unset core.hooksPath`. The
  README will be updated separately; for now the PR description covers it.

Lint-staged tightened:
- Now runs `eslint --cache --fix --max-warnings 0` on *.{ts,tsx,js}
  staged files in addition to prettier. Previously only prettier ran,
  meaning lint errors only surfaced in CI.
- *.{json,md} continue with prettier-only.

Knip added (warn-only baseline):
- knip.json scopes entry points per workspace.
- `pnpm knip` available locally. NOT wired into CI — first pass on the
  full monorepo surfaces ~28 unused files, ~100 unused exports, and
  ~11 unused deps. Cleanup is its own follow-up effort; this PR only
  makes the tool available and the report reproducible.

Rationale: the audit plan called this out as quick DX wins
(.claude/plans/ultracode-quiero-correr-un-enchanted-platypus.md PR-C).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…tate

Three components destructured the full auth/sync store on mount, causing
the component to re-render on ANY state change in those stores — even
fields the component never read. Migrated each to per-field selectors so
React + Zustand only re-render when the specific subscribed slice changes.

Files:
- components/auth/MagicLinkFlow.tsx — was reading requestMagicLink,
  isAuthenticated, error.
- components/sync/EnableSyncModal.tsx — same trio.
- pages/settings/sections/AccountSection.tsx — was destructuring
  user/isAuthenticated/isLoading/logout/loadSession from auth and
  syncNow/status/lastSyncAt/conflicts from sync. Now uses individual
  selector calls (selectUser, selectStatus, etc.).

All three stores (auth, sync, settings) already exported named selectors
at the bottom of their files — these components just weren't using them.
The audit flagged these stores as missing selectors entirely; the actual
issue was just three consumer files.

No behavior change. typecheck + tests green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Two related changes to give the monorepo a test quality baseline:

1. Smoke tests for @readied/commands (was 0 tests, now 13).
   The package exposes markdown editing commands as pure functions taking
   an EditorView. We can't run a real browser-backed view in vitest, but
   we don't need to — the commands only touch view.state and view.dispatch.
   commands.test.ts fakes a view backed by EditorState.update() so we can
   assert on doc text after each command. Covers: bold/italic/strike/code
   wrap+unwrap, headings, lists, checkbox, quote, code block,
   horizontal rule. Coverage: 78% lines (commands.ts).

2. v8 coverage wired into all 12 vitest configs.
   - New vitest.shared.ts exports a `sharedCoverage` block (provider: v8,
     reporter: text+lcov, src/** included, tests/dist/index excluded).
   - Each vitest.config.ts imports + applies it. No thresholds enforced
     yet — this is baseline measurement. Per-package floors can be added
     once we see real numbers and decide where to start the ratchet.
   - @vitest/coverage-v8 added to root devDeps.
   - Root pnpm test:coverage script forwards --coverage through turbo.
   - coverage/ added to .gitignore.

The audit flagged 5 packages as "no tests" (ai-assistant, commands,
licensing, mcp-server, product-config). On inspection, only commands
actually had no tests — the other 4 already had test suites. So this PR
fills the one real gap and adds coverage infrastructure so future gaps
are visible.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Two changes flagged by the audit, both in packages/mcp-server/src/index.ts:

1. server.tool() → server.registerTool() (MCP SDK 1.29 API).
   All 7 call sites migrated:
   - readied_list_notes
   - readied_read_note
   - readied_create_note
   - readied_update_note
   - readied_search_notes
   - readied_list_notebooks
   - readied_trash_note

   The old tool() overload is deprecated in @modelcontextprotocol/sdk
   (TS6387 noisy diagnostics in the IDE). registerTool takes a config
   object { description?, inputSchema?, outputSchema?, annotations?,
   _meta? } instead of positional args, so future evolution (output
   schemas, annotations) is additive.

2. read_note title search now uses FTS5 with bm25 ranking; LIKE is
   a fallback for empty-index cases (post-restore, fresh installs).
   The previous query did `title LIKE '%' || ? || '%'` which:
   - is slower than FTS5 (no index can be used on a wildcard-prefix LIKE),
   - and doesn't rank by relevance.

   New flow: build the FTS5 query via prepareFtsQuery() (same path
   used by readied_search_notes), bm25-rank, take the top hit. If
   FTS returns nothing (index rebuild in progress, freshly restored
   DB, etc.), fall back to the parameterized LIKE on the live table
   so the tool still works.

Build + 5 existing tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The previous restore handler trusted the backup file blindly: it copied
it over the live db, reopened it, ran migrations, and swapped the
reference. If the backup was corrupt, the user lost their working
database with no clear failure mode — they'd hit cryptic SQLite errors
on the next read.

New restore flow in apps/desktop/src/main/handlers/dataHandlers.ts:

1. Close current db.
2. copyFileSync(backup, live) via existing restoreBackup (this also
   writes a `.pre-restore` safety copy of the previous live db).
3. Open the restored db.
4. PRAGMA integrity_check — must return 'ok'.
5. Run migrations (no schema change here — they were already run
   before, but kept as belt-and-suspenders for older backups).
6. Swap the db reference and delete the safety copy.

Any failure between steps 3-5 rolls back to the safety copy and returns
a clear error message describing which step failed. The user is never
left with a corrupt or partially-migrated live database.

Audit refinements:

- B10 (missing index on notes.needs_sync) — already fixed in migration
  011_sync_tracking: `CREATE INDEX IF NOT EXISTS idx_notes_needs_sync
  ON notes(needs_sync) WHERE needs_sync = 1`. Auditor's note was based
  on stale snapshot. No change here.
- B11 (FTS5 triggers don't share an explicit txn) — false: SQLite
  triggers are atomic with their parent statement by default. If the
  trigger throws, the parent INSERT/UPDATE rolls back. No change here.
- B12 (backup restore has no integrity check) — addressed by this PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Scoped slice of PR-F. This adds the foundation; the rest of PR-F
(keychain, HMAC license) and the migration of the remaining 12 handler
modules become follow-up PRs once the pattern is reviewed.

What this PR introduces:

- apps/desktop/src/main/ipc/registry.ts — defineIpcHandler({channel, args, handler})
  wraps ipcMain.handle with Zod tuple validation. Renderer-supplied args
  are validated BEFORE business logic runs. An invalid payload throws
  IpcValidationError at the boundary, surfacing as a structured error
  to the renderer instead of a confusing downstream crash.
- apps/desktop/src/main/handlers/aiKeyHandlers.ts — migrated as the
  proof. Provider names are now constrained to alphanumeric (with _ or -),
  max 64 chars. API keys are bounded at 4096 chars. These are
  conservative defenses against accidental large payloads and obviously
  bogus inputs, not a substitute for the credential-at-rest hardening
  that's coming separately (keychain integration is the next slice of
  PR-F).
- apps/desktop/package.json — adds zod ^4.4.3 as a direct dep (it was
  already in 4 workspace packages but not exposed to desktop main).

Audit linkage:

- B2 (IPC handlers accept raw strings without validation): partially
  addressed for the AI-key surface. The 12 other handler modules will
  follow the same defineIpcHandler({channel, args, handler}) shape in
  subsequent PRs so each migration is small enough to review.
- B3 (AI keys stored unencrypted via keytar) and B4 (license HMAC) are
  deliberately NOT in this PR. They each need keytar integration with
  electron-builder, a one-time migration on first launch, and reviewer
  attention — separate PRs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

PR-F4 — applies the typed IPC registry pattern from #272 to six handler
modules. ~30 channels validated at the boundary now.

Files:
- logHandlers.ts: log:write, log:getPath. LogLevel enum, message capped
  at 16 KiB, context schema is z.record(z.string(), z.unknown()).
- shareHandlers.ts: share:create, share:delete. Note content capped at
  1 MiB; tags/backlinks have count caps.
- updateHandlers.ts: updates:checkNow, updates:startDownload. The
  installNow handler is intentionally kept as raw ipcMain.handle —
  it triggers a synchronous quit + window destruction and we don't
  want the registry's async wrapper interfering with the shutdown path.
- licenseHandlers.ts: license:getState, refreshSubscription, startTrial,
  openSubscribe. Optional plan enum on openSubscribe.
- localServerHandlers.ts: localServer:start/stop/status/getToken.
  Port range bounded at 1–65535 by schema (was a defensive check
  inside the handler).
- pluginHandlers.ts: 11 channels — pluginConfig:get/set/getAll/clear,
  plugins:scan/isEnabled/setEnabled/listState/readInitScript/
  install/installFromUrl/uninstall. plugins:requestReload uses
  ipcMain.on (fire-and-forget, not invoke) and stays raw.

PluginId schema mirrors the regex enforced at install time
(/^[a-zA-Z0-9_-]+$/, max 128 chars) so the boundary catches the same
shape as the install-time check.

What did NOT change:
- The internal "https only" check in installFromUrl stays as defense
  in depth even though the schema's .startsWith('https://') already
  blocks it — clearer error message for the renderer.
- Auto-updater event listeners stay raw — they're not IPC, they're
  electron-updater event subscriptions.

PR-F5 (note, notebook, data, git, authSync — the heavy data CRUD
modules with ~96 handlers) is the next slice.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

PR-F5 — completes the migration started in PR-F1 (#272) and continued in
PR-F4 (#273). Five remaining handler modules, ~97 channels, now run
through the typed IPC registry. The full IPC surface of the desktop app
is now validated at the boundary.

Files:
- notebookHandlers.ts (15 channels): notebooks CRUD + git-per-notebook
  settings. Common `serialize(nb)` helper extracted to avoid 6 copies
  of the same object spread.
- gitHandlers.ts (9 channels): all git ops bounded — short-SHA accepted
  (>=7 hex chars), commit message ≤8 KiB, note file content ≤1 MiB.
- dataHandlers.ts (7 of 8 channels): backup/list/export/exportNote/
  import/paths/openFolder migrated. `data:backup:restore` stays raw
  ipcMain.handle because the integrity-check + rollback state machine
  from PR-I doesn't fit the registry's async wrapper cleanly.
- noteHandlers.ts (32 channels): notes CRUD, tags, links, embeds, stats.
  EmbedTargetSchema is regex-constrained to filename-safe characters
  (no slashes, no path traversal) at the boundary in addition to the
  `join(dataPaths.assets, noteId, target)` guard. ArrayBuffer validated
  via z.instanceof(ArrayBuffer) for embeds:saveAsset.
- authSyncHandlers.ts (33 channels): auth/magic-link, sync (pull/push/
  syncNow/conflicts/auto-sync/history), E2EE key management (setup/
  unlock/migrate/changePassphrase/export/import), subscription portal,
  device list/rename/revoke. SyncChangeSchema is a discriminator-free
  z.object with the operation enum — it's the most complex schema in
  this PR.

After this PR every ipcMain.handle in apps/desktop/src/main/handlers/
either goes through defineIpcHandler with a Zod tuple guarding the args,
or has an explanatory comment for the few exceptions:
- `updates:installNow` (sync quit + window destruction path)
- `plugins:requestReload` (uses ipcMain.on — fire-and-forget, not invoke)
- `data:backup:restore` (integrity-check rollback state machine from #271)

Test plan:
- pnpm -r typecheck — green.
- pnpm test — 17/17 packages.
- Manual: exercise each affected flow for valid inputs; try a malformed
  payload via DevTools (e.g. window.readied.sync.push('not-an-array'))
  and expect an IpcValidationError.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…errors

The audit listed B3 ("AI keys stored unencrypted") as a gap, but
aiKeyStorage.ts has been using Electron safeStorage since it was
introduced — keys are already OS-encrypted (Keychain / DPAPI / libsecret).

The real bug surfaced while reviewing this file: any failure in
safeStorage.decryptString() or JSON.parse() triggered clearAll() and
returned an empty map. On macOS, the keychain becomes temporarily
inaccessible after sleep/wake, which would silently delete the user's
stored AI keys on the next read. The keys were not actually corrupt —
they were simply unreadable for a few seconds.

New error contract:

- ENOENT on read       → return {}            (no keys yet, safe)
- isEncryptionAvailable() → false → throw AiKeyEncryptionUnavailableError
- safeStorage.decryptString throws → throw AiKeyDecryptionError
- JSON.parse fails               → throw AiKeyDecryptionError
- Top-level shape wrong          → throw AiKeyDecryptionError

The encrypted file is NEVER auto-deleted by a read path now. The only
delete sites are explicit removeKey() / clearAll-equivalent paths and
the case where the last key is removed.

Errors propagate to the IPC layer, where defineIpcHandler from #272
wraps them in a structured response for the renderer.

PR-F2 in the audit stack. PR-F3 (Ed25519 license verification — server
signs, client verifies with embedded public key, NOT HMAC) is next.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds the asymmetric verification primitive the desktop needs so the
license server can sign subscription state and the client can verify it
without holding any signing secret. No live wiring yet — those follow
once the server emits signed envelopes.

The wire format:

  {
    payload: {
      payloadVersion: 1,
      subscription: SubscriptionInfo,
      issuedAt: ISO8601,
      ttlSeconds?: number,
    },
    signature: base64(Ed25519(canonicalJson(payload), serverPrivateKey)),
  }

What this PR ships:

- `canonicalJson(value)` — deterministic sorted-key JSON used as the
  signed message. Client and server MUST canonicalize identically;
  JSON.stringify is non-deterministic across runtimes.
- `signSubscriptionPayload(payload, privateKeyHex)` — server-side helper
  using @noble/ed25519 (already a dep for the legacy LicenseFile path).
- `verifySubscriptionSignature(envelope, config)` — client-side check.
  Performs shape/version/signature/age checks plus the existing subscription
  field/expiry validation via verifySubscription. Injectable clock for tests.
- `SignedSubscriptionPayload` and `SignedSubscriptionEnvelope` types,
  exported through the package index.
- 18 new tests in __tests__/subscriptionSignature.test.ts covering
  roundtrip, key mismatch, tampering, version mismatch, replay window
  (both client-supplied and envelope-supplied TTL), future timestamps,
  and inactive subscriptions.
- packages/licensing/README.md documenting the wire format, the server
  signing flow, the embedded public key contract, key rotation, and
  why trial.json deliberately is NOT signed.

The DEFAULT_SUBSCRIPTION_PUBLIC_KEY placeholder is all zeros — calls
that fall back to it will fail until it's replaced with the real
server public key. Every internal consumer passes config.publicKey
explicitly, so the placeholder is a footgun only for new naive callers.

Audit linkage:
- B4 (license files unsigned, "trivial tamper") — addressed for the
  subscription path. HMAC was rejected as you noted: a client that
  can verify a symmetric MAC can also forge it. Ed25519 is correct.
- Trial state remains unsigned by design — see README "What is NOT
  signed".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Lands the infrastructure for end-to-end testing the desktop app, plus
two initial specs and a Linux CI job. The CI job is marked
continue-on-error: true while we stabilize the suite — flip the flag off
in a follow-up once it's reliably green on develop.

Setup:
- apps/desktop/playwright.config.ts: serial workers (Electron app
  state is shared), generous timeouts, retain-on-failure trace/video.
- apps/desktop/e2e/fixtures.ts: launchApp() helper that spins up a
  fresh Electron instance with an isolated userData directory per
  test, so the SQLite DB, settings, license cache, etc. don't leak
  between runs. Uses Playwright's _electron.launch.
- apps/desktop/e2e/tsconfig.json: dedicated tsconfig so the specs
  don't pull in renderer/main types they don't need.
- apps/desktop/package.json: adds @playwright/test devDep, e2e +
  e2e:headed scripts, typecheck:e2e step folded into typecheck.
- apps/desktop/e2e/README.md: how to run locally, what's tested,
  what's deliberately out of scope.

Specs:
- smoke.spec.ts: app launches, main window renders, IPC bridge is
  present, no uncaught console errors during initial mount. This is
  the regression catch for #266 (editor mount crashes that produced
  blank windows).
- notes.spec.ts: notes IPC contract — create / list / get roundtrip,
  FTS5 search returns freshly-created notes. We drive the preload
  bridge (window.readied.notes.*) rather than the editor UI on
  purpose: selectors churn, contracts are stable.

CI:
- .github/workflows/ci.yml: new `e2e` job, ubuntu-latest, xvfb,
  uploads playwright-report artifact on failure. continue-on-error:
  true initially.
- .gitignore: excludes test-results/, playwright-report/,
  playwright/.cache/
- knip.json: registers playwright.config.ts + e2e/**/*.ts so they
  don't show up as unused.

What is deliberately NOT in this PR:
- Editor UI interactions (typing, formatting, hotkeys) — CodeMirror
  surface is too prone to flake; revisit once the editor is split.
- AI panel streaming — better as a vitest test against ai-core.
- Sync flows — need a fake server.

I scaffolded all of this but could not execute the suite end-to-end
against a real Electron build in this session (no display attached,
no built bundle in this branch). The CI's continue-on-error gate and
the local README acknowledge that the first verifier on a real machine
may need to tweak the specs once they meet a real renderer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

First scoped slice of the PR-G "split god files" effort.

apps/desktop/src/main/index.ts goes from 1065 -> 950 lines (-11%).
No behavior change. All extractions are self-contained and surface-area
preserving:

- services/fileLicenseStorage.ts — was embedded in index.ts at lines
  146-216. The three readJsonOrNull helpers fold the repeated
  try/catch/return-null pattern into one private function. The TODO
  about signed subscription envelopes points back at PR-F3 so the
  next step is unambiguous.

- services/windowState.ts — was at lines 218-254 of index.ts.
  Comment now explicitly documents why the file I/O is sync (called
  during BrowserWindow construction before the renderer mounts and
  during close where handlers don't await).

What this PR DELIBERATELY does NOT touch:

- packages/storage-sqlite/src/repositories/SQLiteNoteRepository.ts
  (1121 lines). Splitting this into NoteCrudRepository +
  NoteTagRepository + NoteArchiveRepository + NoteSyncRepository
  needs runtime verification against a real DB and risks merge
  conflicts with every other PR in flight. Separate effort.
- apps/desktop/src/renderer/components/MarkdownEditor.tsx (724
  lines). The CodeMirror surface area is too entangled to split
  without an E2E suite to catch regressions. Defer until PR-E
  (#277) is stabilized and we can refactor under test coverage.

Validates:
- pnpm -r typecheck — green
- pnpm test — 17/17 packages
- pnpm --filter @readied/desktop typecheck — green (includes e2e
  tsconfig)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Knip surfaced 28 unused files in #267. After per-file verification,
12 were genuinely orphaned. Deleting them:

apps/desktop:
- src/renderer/analytics.ts          — no imports anywhere
- src/renderer/hooks/useTheme.ts     — no imports anywhere
- src/renderer/settings.tsx          — no imports anywhere
- src/renderer/ui/patterns/Modal.tsx — only its sibling index.ts
- src/renderer/ui/patterns/index.ts  — barrel that nothing imports
- src/renderer/ui/patterns/Modal.module.css + .gitkeep — left over

packages:
- plugin-api/src/editor/types.ts     — not re-exported by index.ts
- storage-core/src/interfaces/index.ts \
- storage-core/src/migrations/index.ts  \
- storage-core/src/repositories/index.ts \  — main package index imports
- storage-core/src/types/index.ts        /   directly from concrete files,
- storage-sqlite/src/repositories/index.ts/   not these barrels

scripts:
- scripts/bump-version.js            — not in any package.json script
                                       and not referenced by any CI workflow

Kept (Knip false positives — auto-discovered files Knip can't see):
- vite-env.d.ts                      (vite reference declaration)
- css-modules.d.ts                   (TypeScript module shim)
- turndown-plugin-gfm.d.ts           (TypeScript module shim)
- apps/web/mdx-components.tsx        (Next.js MDX convention, no import)

Kept (Knip wrong — barrel that IS used):
- renderer/pages/settings/components/controls/{NumberInput,Select,TextInput,Toggle}.tsx
  All four are imported by EditorSection / AiSection / UpdatesSection
  through the controls/index.ts barrel.

Skipped (out of audit scope):
- apps/web/components/magicui/*, NavDropdown, ui/separator

Validates:
- pnpm -r typecheck — green
- pnpm test — 17/17 packages, all cached except plugin-api which ran
  fresh after the editor/types.ts deletion.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Knip flagged 11 unused dependencies in #267. After per-dep verification
(grep + transitive-dep audit), 6 are genuinely unused in scope. Removing
them shrinks the lockfile by ~120 lines.

apps/desktop production deps removed:
- highlight.js          — rehype-highlight uses lowlight, not highlight.js
- pino-roll             — logger.ts uses createWriteStream directly, no roll
- react-resizable-panels — no imports anywhere
- unist-util-visit      — no imports anywhere

apps/desktop dev deps removed:
- @types/mdast          — no imports anywhere
- pino-pretty           — logger.ts doesn't pipe through a transport

packages/sync-core: drop @readied/core dependency
- src/* has no imports of @readied/core; the workspace link was stale

packages/wikilinks: drop unified
- src/* uses unist-util-visit directly (kept) but never imports unified

Skipped (apps/web — out of audit scope):
- @radix-ui/react-separator
- next-themes
- tailwindcss-animate

Validates:
- pnpm install --ignore-scripts — succeeds; pre-existing peer warnings
  about electron-builder + electron-vite are unrelated
- pnpm -r typecheck — green
- pnpm test — 17/17 packages

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ge layer

Wires the verification primitive added in #276 into the desktop's
FileLicenseStorage. The path from server → disk → in-memory now has a
real verification step at read time, with lenient fallthrough during the
migration window.

Changes:

1. packages/licensing/src/types.ts
   - StoredSubscriptionData now allows an optional `signedEnvelope`
     alongside the existing `subscription` field. Both can be present
     during migration; long-term the unsigned `subscription` becomes
     a derived view of the envelope payload.

2. apps/desktop/src/main/services/fileLicenseStorage.ts
   - readSubscriptionData now branches on envelope presence:
     - envelope present + signature valid → return cache as-is
     - envelope present + signature invalid → log error, REFUSE the
       cache (return null). Next caller fetches fresh from the API.
     - envelope absent → log warning, accept the cache (lenient
       migration mode)
   - SUBSCRIPTION_PUBLIC_KEY constant added at the top of the file
     with a REPLACE BEFORE SHIPPING note. The all-zeros placeholder
     means any real envelope will fail verification — which is the
     correct failure mode while the placeholder is in place: we fall
     through to the "no envelope" branch and the lenient log fires.

What's NOT in this PR (still pending the server team):
- ApiClient.getSubscriptionStatus does not yet return an envelope.
  When it does, mapApiToSubscriptionData in licenseHandlers.ts grows
  one more field (signedEnvelope) and writeSubscriptionData persists
  it. That change is one-liner plumbing, blocked only on the API
  contract being updated.
- The placeholder public key gets swapped for the real server key in
  the release that first ships signed envelopes.

Validates:
- pnpm -r typecheck — green
- pnpm test — 17/17 packages (the 18 signature tests added in #276 cover
  the verify path; the storage layer just calls into them)

Behavior verification (manual):
- Empty subscription.json → null returned, no warning (normal cold start)
- subscription.json with old shape (no envelope) → warning logged,
  cache accepted (existing users keep working)
- subscription.json with a forged or stale envelope → error logged,
  cache refused, API refetch happens
- subscription.json with a real envelope signed by the matching server
  key → silent acceptance

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…Repository

Phase 1 of the SQLiteNoteRepository split. Pure helpers come out to
their own file so future sub-repos (sync, tag, archive) can reuse them
without inheriting from the 1000-line class.

SQLiteNoteRepository.ts: 1121 -> 1038 lines (-7%).
noteMapping.ts: new (133 lines).

Extracted:
- NoteRow / TagRow / TagWithColorRow / BacklinkInfo  — row types
- rowToNote(row, tags) -> Note                       — pure mapper
- prepareFtsQuery(input) -> string                   — FTS5 query escaper
- archivedConditionSql(filter, alias) -> string      — SQL fragment helper

Call sites swapped from `this.<helper>()` to plain function imports.
The public class signature is unchanged; `BacklinkInfo` is re-exported
so external consumers (apps/desktop/handlers/types.ts) keep working.

What this PR DELIBERATELY does NOT do:

- Extract sync methods (getPendingChanges through getSyncHistory ~430
  lines) into a SQLiteNoteSyncRepository. Those share state (tag
  queries, transactions, FTS sync triggers) with the main class in
  ways that need real-DB integration coverage to refactor safely. The
  helpers extracted here are the foundation: a follow-up PR can build
  the sync sub-repo on top of them without touching the helpers again.
- Extract tag methods (setManualTags, renameTag, getAllTagsWithColors,
  etc.) for the same reason.

Validates:
- pnpm -r typecheck — green
- pnpm test — 17/17 packages (storage-sqlite tests skipped per repo
  policy; helpers are pure and trivially exercised by the desktop's
  integration tests)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Phase 1 of the MarkdownEditor split. Pure CSS-variable-based theme and
markdown HighlightStyle move to their own file so further extractions
(extensions array, keymap bindings) can ride on top without merging
against a churn-prone component shell.

MarkdownEditor.tsx: 737 -> 612 lines (-17%).
editorTheme.ts: new (139 lines).

Extracted:
- SCROLL_PAST_END_PADDING constant
- createEditorTheme(fontSize, fontFamily, lineHeight) — EditorView.theme(...)
- markdownHighlighting — HighlightStyle.define([...]) for markdown tags

Imports cleaned up:
- Drop the explicit HighlightStyle import from @codemirror/language (still
  consumed transitively, but not referenced in this file anymore)
- Drop the `tags` import from @lezer/highlight (moved to editorTheme.ts)

What this PR DELIBERATELY does NOT do:
- Extract the extensions array (lines 348-444 today). The array closes
  over user settings (lineNumbersCompartment etc.) and mixes
  context-coupled values like `wikilinkAutocomplete` from a hook; safely
  pulling that out requires either passing the closure context in via a
  builder, or moving the whole `useMemo` into a hook of its own. Better
  done under Playwright coverage (PR-E #277) so renderer regressions
  surface.
- Extract the keymap. Same reason — the bindings reference
  view-imperatives + the command-registry which are constructed inside
  the React tree.

Validates:
- pnpm -r typecheck — green (renderer + e2e tsconfigs)
- pnpm test — 17/17 packages

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replaces the all-zeros placeholder from #281 with the actual Ed25519
public key. The matching private key lives only on the licensing
server — never the repo.

Behavior change:
- Before: any real signed envelope failed verification (placeholder
  doesn't match any private key), so the lenient "no envelope" branch
  was the only working path.
- After: envelopes signed by the matching private key verify and pass
  through; forged or tampered envelopes are refused and the cache is
  re-fetched on next read.

The lenient branch (no envelope on disk → warning log + accept) is
unchanged. Existing users without a cached envelope are unaffected.

Rotation procedure now lives in the constant's doc comment — generate
keypair on a trusted machine, ship desktop release with new public
key, then flip the server.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds the server-side counterpart of the public key set in the previous
commit. The api worker needs LICENSE_SIGNING_PRIVATE_KEY in its
Cloudflare secrets to sign SignedSubscriptionEnvelope payloads via
@readied/licensing#signSubscriptionPayload.

What this commit adds:
- packages/api/.dev.vars: placeholder line + generation snippet so
  contributors know what the env var is, where the matching public
  key lives, and how to mint a fresh pair. The .dev.vars file is
  tracked (it's a template); real values go in .dev.vars.local
  (gitignored).
- packages/api/wrangler.toml: adds LICENSE_SIGNING_PRIVATE_KEY to the
  "Required secrets" comment block alongside the existing TURSO/JWT/
  RESEND/STRIPE entries.

What this commit does NOT do:
- Actually set the secret in Cloudflare. That requires `wrangler login`
  in an authenticated session, which has to happen on a maintainer's
  machine. Run:
    cd packages/api
    echo "<hex>" | npx wrangler secret put LICENSE_SIGNING_PRIVATE_KEY --env production
    echo "<hex>" | npx wrangler secret put LICENSE_SIGNING_PRIVATE_KEY --env staging
  See PR #284 description for the matching public key.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>