Verified headless: dispatched a paste into the composer with a DataTransfer carrying the PNG plus text/html `<img src="https://evil.example/tracking/pic.png?utm_source=x" alt="Secret alt…
Verified the paths first:
- Voice-room prescreen — has the camera toggle in view (and it's disabled unless Join with Camera On is enabled), so it's already obvious.
- **Sidebar second-click…
Done in 33e16e85. On deafen the participant set is snapshotted; on undeafen it is diffed and — only if it changed and you were deafened ≥ 10 s — one auto-dismissing toast: "While you were…
Done in f23b215e. createPttHoldWatchdog (unit-tested with fake timers) is armed on press and disarmed on release in both the DOM path and the desktop-global hotkey path; at 5 minutes…
Done in edb46247 — Room Settings → General → Privacy → "Your messages in this room" (kept on the settings page rather than the member panel so it's one click from where people already…