docs: refresh agents.md debt ledger from the full audit

agents.md

@@ -59,26 +59,66 @@ Real and verified:
   on `/api/auth/*` (5/min for OTP email routes).
 - Space accent: stored, synced, rendered (sidebar glyph), user-settable
   via `>space-accent #RRGGBB`; new spaces rotate a palette.
+- Idle archive: policy sweeps every 30 min (`shell/timers.rs`) plus the
+  manual Run Now; per-(space,profile) active-tab memory survives
+  background-tab closes; shortcuts bind only the current platform's keys;
+  sync-owner publish is first-claim-wins on every platform.
 
 Deferred deliberately (do NOT fake; ship with their subsystem):
 - Updates settings page — returns with a real updater.
 - Diagnostics reporting toggle — returns with a real telemetry reporter
   (worker route `/api/telemetry/events` already exists and is tested).
-- Advanced settings page — folded into owning sections.
+- Advanced settings page — folded into owning sections; the decorative
+  appearance accent row is gone (accent is Space-scoped).
 
-Known structural debt (next big items, in order):
+Known structural debt (next big items, in order; full ranked audit with
+file:line evidence lives in the 2026-07-10 bug-sweep report):
 1. Sync merge model is snapshot-clobber: no tombstones (deletes can
-   resurrect), non-transactional apply, remote-wins. Needs record-level
+   resurrect — closed tabs reopen everywhere), non-transactional apply
-   merge + tombstones + Conflict Center (PRD §9). Do not "quick-fix".
+   (one bad record wedges sync at `state/sync_apply.rs`), remote-wins
-2. Session fidelity in local persistence: back/forward stacks, splits,
+   overwrite (back/forward stacks rebuilt empty at `state/sync.rs:302`,
-   tab groups, archived tabs, downloads, settings values are not yet in
+   revoked site permissions re-granted, foreign records re-homed into the
-   `local-state.json` (extend `LOCAL_STATE_REV`).
+   active profile at `state/sync.rs:395`), spaces converge by name not id,
-3. Download pause/resume/cancel are UI-only; `ely://auth/callback` code
+   idle devices churn (byte-exact AlreadyCurrent + Vec-order serialization).
-   exchange and save-page commands are unimplemented.
+   Needs record-level merge + tombstones + Conflict Center (PRD §9). Do
-4. Integration tests litter the real data root with `profile_*` dirs
+   not "quick-fix"; fix before any multi-device testing.
+2. Privacy: private-profile tabs are visible in the standard sidebar and
+   Ctrl+Tab cycles into them (`state.rs` visible_tabs filters by space
+   only; `tab_selection.rs`) — violates PRD §8.11.
+3. Settings scalars are not persisted (search engine, new-tab
+   destination, appearance, policies, the 9 sync toggles — a paused sync
+   toggle silently re-enables on restart, privacy-relevant) and session
+   fidelity is partial (stacks, splits, groups, archived tabs, downloads
+   not yet in `local-state.json`; extend the local-state document).
+4. Site permissions: only 5 of 16 features are enforced through Servo
+   (`runtime_permissions.rs:153`); the other 11 rows are placebo toggles —
+   trim the UI to enforced features until the engine covers them.
+5. Engine/webview: redirect or pushState leaves tab state "loading"
+   forever and pins stale pixels (`ely_servo_host/src/runtime_webview.rs`
+   requested-vs-current URL reconciliation); persistent-profile sidecars
+   are never reclaimed while the app runs; sidecar stderr is nulled;
+   final URLs >32KiB cause a reload loop.
+6. Downloads engine: pause/resume/cancel/retry are UI-only, progress
+   never updates, checksum runs on the UI thread, open/reveal hardcode
+   `/usr/bin/open`; `ely://auth/callback` exchange and save-page commands
+   are unimplemented.
+7. Smaller confirmed papercuts: several synced mutations never schedule
+   an upload (splits, group toggles, deletions), trash_space leaks split
+   layouts, reload of the current URL is a no-op (crashed tabs can't
+   reload in place), mid-Vec tab inserts skip sort normalization, Esc
+   doesn't close the command overlay, "Switch workspace" palette entry
+   mislabels its action, Profiles page cannot create/delete profiles,
+   vault rotation silently skips devices without wrapping keys,
+   SyncStatus counters are hardcoded, second in-process Servo host panics
+   (upstream OnceLock).
+8. Integration tests litter the real data root with `profile_*` dirs
    (`~/Library/Application Support/com.elydora.ELY-Browser/profiles/`);
    tests should take an overridable data root.
 
+Upstream watch: Servo's permission request lacks the requesting principal
+and some DOM paths bypass the embedder broker — that upstream change is
+the trigger to ungate clipboard/geolocation/notification/webrtc prefs.
+
 ## Conventions
 
 - One problem per commit; full gate battery before each; push after.