wtclaude
fce3444c6c
Revision 1 ended in five open questions. All are now answered, plus the domain and Gitea-registration facts, so the plan states decisions instead of asking. New section 5 holds the twelve decisions of record. Sections 6-9 design against them: the Astro + Node adapter runtime, branding resolved out of a bind mount against baked defaults, the Android closed-beta signup, and the legal pages the beta cannot ship without. Re-verified every version against the Gitea API and corrected three things revision 1 got wrong: the bundle manifests live at the root of the bundles branch rather than under bundles/, the website publishes no releases at all, and the Android app targets no server of ours - the user enters the address, which is load-bearing for the privacy policy. Phase 0 grows from the four operator-facing documentation fixes to all ten conflicts, plus retiring the personal Gmail that SECURITY.md publishes as the public vulnerability contact. Two design notes worth flagging. Play does not notify testers on the email-list path either, so a site that sends no mail looked blocked - but the closed-testing opt-in URL only works for addresses already on the list, so it is safe to publish on the confirmation screen, with Discord carrying the announcement. And the CSV export is a CLI against the bind mount rather than an admin page, so the site keeps no authenticated surface at all. The demo instance is recorded as planned and out of scope: a Proxmox VM running the full stack including ServUO, restricted and reset hourly. The site reserves its slot now so it costs one line in a bind-mounted file later. Co-Authored-By: Claude <noreply@anthropic.com>