docs(todo): add P6 post-audit batches (desktop parity, EC DOM-hack retirement, web UX, hygiene)

macOS explicitly out of scope; Linux is the parity target.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

LOTUS_TODO.md

@@ -509,6 +509,44 @@ Check back after each Synapse upgrade — re-run `/matrix/client/versions` and `
 
 ---
 
+## Priority 6 — Post-audit batches (2026-07)
+
+Buildable follow-ups surfaced by the deep-audit wave. Web Push (N107) deliberately deferred. **macOS is out of scope for all of these — Linux is the parity target (Windows already has most native features).**
+
+### [ ] P6-1 · Desktop — cross-platform parity (Linux + Windows; NO macOS)
+
+From the desktop audit. Round out the native app now that the full Rust stack compiles:
+
+- **No-sleep during calls on Linux** — `power.rs` is Windows-only (`SetThreadExecutionState`); add a Linux inhibitor (`org.freedesktop.login1.Manager.Inhibit` / ScreenSaver inhibit via zbus/D-Bus) so the display/system doesn't sleep mid-call.
+- **Taskbar/launcher unread badge on Linux** — `set_badge_count` is Windows-only; add Unity/`com.canonical.Unity.LauncherEntry` (D-Bus) count where supported.
+- **Launch-on-login** — add `tauri-plugin-autostart` (cross-platform) + a Settings/tray toggle.
+- **Tray "Do Not Disturb" toggle** — the tray menu is Open/Quit only; add a DND item (reuses the Focus-Assist suppression atom path) so users can silence notifications from the tray.
+  CI-compile-verified (Windows + Linux runners); no local Rust.
+
+### [ ] P6-2 · Element Call fork — retire the remaining DOM hacks
+
+Replace cinny's fragile iframe-`contentDocument` reaches with proper `io.lotus.*` widget actions in the fork (`LotusGuild/element-call`), which break on EC re-renders/version bumps:
+
+- **Deafen / screenshare-audio-mute** → an `io.lotus` action that mutes/attenuates `RemoteAudioTrack`s at the LiveKit source (replaces `CallControl.ts` `setSound`/`applyScreenshareAudioMuted` DOM `.muted` poking).
+- **UI-toggle actions** (screenshare/spotlight/reactions/settings) → replace the `.click()`-by-`data-testid` calls.
+- Retire the `useCallSpeakers` DOM-scrape fallback once `io.lotus.call_state` is verified.
+  Fork commits are local (coordinator); publishing needs the user's npm token.
+
+### [ ] P6-3 · Web UX wins (from the audit ADD list)
+
+- **Forward to multiple rooms** — multi-select (checkbox + "Send to N") in `ForwardMessageDialog` (currently one room per open, capped at 60).
+- **Live bookmark previews** — `BookmarksPanel` shows a stale snapshot captured at save time; resolve live from the event when cached (edits/redactions), fall back to the snapshot.
+- Other small paper-cuts as scoped.
+
+### [ ] P6-4 · Hygiene sweep
+
+- `patch-folds.mjs` (edits `node_modules` directly) → `patch-package`.
+- `contrib/nginx` + `contrib/caddy`: security headers (HSTS/CSP), `try_files` over rewrites, fix the caddy placeholder path.
+- `types/matrix/` drift (mirrors SDK types) — spot-fix the highest-risk.
+- Build-config: streamline `lotusDenoise` sequential `fs` work + redundant `viteStaticCopy` renames.
+
+---
+
 ## 📚 Implementation Reference
 
 Exhaustive, low-level implementation details for backlog items. Follow these patterns to ensure code is "Lotus-perfect" (idiomatic, performant, and TDS-compliant).