Cycle 38: member listing, settings modal shell, reliability fixes

PRODUCT_PLAN.md

@@ -1,6 +1,6 @@
 # Cove Product Plan
 
-> Last updated: 2026-07-03 | Cycle: 38 | Phase: 2b — Polish & Identity | Build health: verified; 308 tests passing (126 core + 144 web + 24 contracts + 14 desktop); strict TypeScript clean
+> Last updated: 2026-07-04 | Cycle: 39 | Phase: 2b — Polish & Identity | Build health: verified; 330 tests passing (131 core + 161 web + 24 contracts + 14 desktop); strict TypeScript clean
 >
 > Current objective: Build an app you and your friends actually want to use. Phase 2b pivots from platform infrastructure to product feel — landing page, UI bug fixes, custom server emoji, user profiles, rich embeds, file upload previews, and appearance customization. Deploying to cove.demonbox360.net on Oracle Cloud via Caddy. Migrating monorepo from npm to pnpm.
 >
@@ -241,14 +241,14 @@ Native mobile, supported self-hosting, federation, knowledge channels, curated d
 | Area             | Current     | Notes                                                                                                                                                                                                                             |
 | ---------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Install          | in-progress | Migrating from npm to pnpm (queued Cycle 35+, not started). pnpm install will replace npm install across monorepo.                                                                                                                |
-| Unit tests       | verified    | 308 total: 126 core + 144 web + 24 contracts + 14 desktop, confirmed Cycle 38 (2026-07-03). Rate-limit tests, ChannelTopicPanel, NotificationPreferencePanel, AttachmentApprovalPanel, MessageAttachment suites added this cycle. |
+| Unit tests       | verified    | 330 total: 131 core + 161 web + 24 contracts + 14 desktop, confirmed Cycle 38→39 (2026-07-04). Member-list endpoint tests, CommunitySettingsModal and DmConversationList suites, attention-persistence and operator-auth test updates added this cycle. |
 | Type safety      | verified    | All five workspaces pass strict TypeScript (confirmed Cycle 30).                                                                                                                                                                  |
 | Production build | verified    | 215 kB gzip JS (livekit-client bundled) / 5.09 kB gzip CSS; multi-stage non-root container present.                                                                                                                               |
 | API integration  | verified    | All Phase 1–2 endpoints covered. Cycle 30 added snapshot persistence (`SNAPSHOT_FILE`). Operator endpoints auth guard in progress (Codex Cycle 30).                                                                               |
-| Frontend UX      | partial     | Community switching, reactions, replies, WS reconnect, error toasts now wired. Attention panel, create/join modal, loading state still missing (P0 queue).                                                                        |
+| Frontend UX      | partial     | Community switching, reactions, replies, WS reconnect, error toasts, attention panel, channel creation, member list, and appearance settings now wired (2026-07-04). Still unwired: emoji picker, message-list/composer/sidebar extraction, voice panel, passkey flow, user profile panel, channel topic panel, notification preferences, attachment approval, pinned messages, community settings modal, DM conversation list — see WORKLOG.md. |
 | Accessibility    | partial     | Semantic UI tests exist; real-browser review blocked.                                                                                                                                                                             |
 | Performance      | partial     | Electron renderer 2.392 s; 464 MB working-set risk noted. PTT/soak unmeasured (session-blocked).                                                                                                                                  |
-| Security         | partial     | CSP, headers, runtime schemas, exact-origin CORS, 0 production vulns. Operator endpoint auth guard in progress. 5 high build-time `tar` findings via electron-rebuild (no fix available).                                         |
+| Security         | partial     | CSP, headers, runtime schemas, exact-origin CORS, 0 production vulns. Operator backup/restore now fails closed (503) by default when `OPERATOR_KEY` is unset (2026-07-04). 5 high build-time `tar` findings via electron-rebuild (no fix available).                                         |
 | Reliability      | partial     | WS reconnects with backoff (Cycle 30). Snapshot persistence for local dev (Cycle 30). Container execution and deployment SLO validation environment-blocked.                                                                      |
 | Cost             | modelled    | Initial cost model exists; real-world telemetry pending.                                                                                                                                                                          |