From 02089cf60e43e8d5fd3ce0221020c060656410a9 Mon Sep 17 00:00:00 2001 From: Jared Vititoe Date: Fri, 24 Jul 2026 19:41:40 -0400 Subject: [PATCH] docs(todo): mark encrypted-search cache size-cap finding fixed (fff811cb) Co-Authored-By: Claude Opus 4.8 --- LOTUS_TODO.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LOTUS_TODO.md b/LOTUS_TODO.md index 8f413bbf8..46d1aac8d 100644 --- a/LOTUS_TODO.md +++ b/LOTUS_TODO.md @@ -98,7 +98,7 @@ Per-slice bug hunt (5 agents: theming · calls · messaging · threads/presence/ **Embeds / URL previews** - [x] **[Med] Desktop (Tauri) CSP `frame-src` was missing `store.steampowered.com`, `www.mixcloud.com`, `widget.deezer.com`** → the Steam widget (shipped) + new Mixcloud/Deezer embeds were silently blocked (blank iframe) **in the desktop app**. **FIXED** (`cinny-desktop` `daba59b`): all three added to `frame-src` (no `connect-src` — these don't do a client oEmbed fetch). Web was always fine (`frame-src 'self' https:`). Needs desktop-app QA to confirm the widgets render. -- [ ] **[Low]** `searchCache.ts` encrypted-search index has no size/count cap — unbounded on-disk growth (mitigated by the manual "Clear cached index" + logout wipe). +- [x] **[Low]** `searchCache.ts` encrypted-search index has no size/count cap — unbounded on-disk growth (mitigated by the manual "Clear cached index" + logout wipe). **FIXED** (`fff811cb`): per-room cap of 5000 rows, oldest-by-ts evicted on write via a self-chaining IDB cursor + pure unit-tested `evictCount`. IDB-spec correctness (cursor delete/continue, tx liveness, range bracketing) confirmed by 2 review agents since CI can't run IndexedDB. - [ ] **[Low]** `MsgTypeRenderers.tsx` `MLocation` OSM permalink uses raw `geo:` lat/lon substrings, not the validated floats — harmless (URL context, malformed input only). **Voice / video calls**