# Phase 7: Hardening + Private Launch - Context

**Gathered:** 2025-10-25
**Status:** Ready for planning

<domain>
## Phase Boundary

The final phase hardens everything phases 1–6 shipped and closes with a checklist-signed private launch: one consolidated privacy-audit tool (zero-telemetry v1, PRIV-02/GEO-03 re-verified end-to-end), PX-04 fullscreen + landscape QA across the full device matrix with a measured battery-drain record (<10%/hr), a consolidated budget record (CPU/subrequests/bundles/KV), all parked review debts paid (the 3 deferred INFOs; /cari re-arm attempt + honest documentation), the known-limitations doc shipped and linked from /help — and the private beta launched to the user's first KL drivers when the checklist signs.

No new product features. This phase hardens outcomes; its empty/error states ARE the polish surface.

</domain>

<decisions>
## Implementation Decisions

### Privacy audit (SC3)
- **D-01:** A **consolidated automated audit script** (`npm run privacy-audit`, repo tool): grep gates over ALL src trees (no storage-API writes outside the platform allowlist — the phase-3 gate's law extended repo-wide; no coordinate/payload logging — the category-only vocabulary verified by schema scan), a KV listing probe (only TTL-keyed namespaces), a bundle scan (**zero telemetry: no analytics, no beacons — the ONLY runtime fetches are OpenFreeMap tiles, the Telegram API, and the app's own Worker endpoints**), plus a **signed written audit record** citing the evidence (PRIV-02/GEO-03 re-verified end-to-end). Reusable by forks (GPL audit tool).
- **D-02:** **Zero telemetry in v1** — opt-in telemetry stays an IDEAS.md aspiration post-validation; nothing to opt into yet, nothing to audit but absence.

### Device matrix + battery (SC1, PX-04)
- **D-03:** **Fullscreen on guidance start** via `requestFullscreen()` behind the 8.0 capability guard (phase-6 guard precedent), with orientation-lock used where available; landscape usability per device in the QA pass; landscape layout fixes are CSS-only media queries (tokens binding; the cockpit/banner/card geometry adapts, the map stays Rams-constant).
- **D-04:** The **battery target is a RECORDED real measurement**: one Android guidance run ≥30 min screen-on, battery % read at start/end (method + caveats written into the gate file); the D-15 distance-throttle is the software half. The <10%/hr target is recorded as measured, never synthesized (no bench harness — over-engineering for one phone).
- **D-05:** The QA pass is **one consolidated walk**: Android + iOS + Desktop + browser × (boot, search→route, guidance, minimize/resume, trip-end, theme flip, landscape/fullscreen) — a single checklist in the phase gate file; user walks once; NOT-RUN legs recorded honestly (the phase 3/4 protocol; iOS legs if the device is available — Phase 4 verified iOS present).

### Budgets + deferred debt (SC4)
- **D-06:** A **consolidated budget record** (`npm run budget-audit` output + written record checked into verification): Worker CPU/subrequests (06-04's measured ladder re-run against the live graph), bundle sizes (BA9 et al.), KV write counts per request class (cron = 0 writes — the free-plan law), asset cache headers. Current numbers vs free-tier limits, in one document.
- **D-07:** **Debts paid here**: (1) 02-REVIEW's 3 deferred INFOs — IN-01 (dead `ParsedInitData` export + unreachable branch + read-helper intent comments), IN-02 (stale wrangler.jsonc comment), IN-03 (exact-900s boundary test — the security-critical comparator pin); (2) the /cari menu: re-run `register-commands.mjs` (scopes were re-armed in phase 4) + record the Telegram non-default-scope defect honestly in the limitations doc; (3) phase 3's stale-fix assumption notes (A1/A3) reviewed and closed or re-pointed. **NOT here**: ALT landmarks (c2) — committed to the v1.x milestone, not this phase.

### Known-limitations doc (SC4)
- **D-08:** `docs/KNOWN-LIMITATIONS.md` in-repo, written for **drivers AND forks**: OSM data gaps (no traffic confidence, no lane guidance, speed limits where mapped), cross-metro CPU degradation (the c3 class), the /cari menu defect + its workaround, beta quality statement, and the roadmap pointers (WASM-router track, ALT, engine B). Surfaced from the bot: `/help` gains one line pointing at the doc (strings-module copy).

### Launch definition
- **D-09:** **Private launch = checklist-signed private beta**: the user's chosen first drivers (friends/family/testers in KL) receive the bot link; word-of-mouth distribution. No app store, no marketing, no landing page (post-v1 idea). The launch checklist: known-limitations shipped · privacy audit signed · budget record green · full device matrix walked · `/help` + `/privacy` accurate · repo pushed public under GPL-3.0. **The milestone completes when the checklist is signed** — the launch act itself is the user's, not the workflow's.

### OpenCode's Discretion
- Audit script file layout (scripts/ + test/ split), gate vocabulary, exit codes
- Battery recording method details; landscape media-query breakpoints within tokens
- INFO-fix mechanics; the boundary test's fixture form
- Known-limitations doc structure/tone; the /help one-liner copy (en/ms)

</decisions>

<specifics>
## Specific Ideas

- The audit tool doubles as the fork's own onboarding check — a fork runs `npm run privacy-audit` before their first driver.
- The limitations doc is honest engineering prose, not a legal page — the clinical tone extends to it.
- The launch checklist lives in the phase gate file and is signed there; STATE.md records the milestone completion.

</specifics>

<canonical_refs>
## Canonical References

**Downstream agents MUST read these before planning or implementing.**

### Phase scope + decisions
- `.planning/ROADMAP.md` §Phase 7 — goal, 4 success criteria, launch framing
- `.planning/REQUIREMENTS.md` §PX-04 (+ PRIV-02/GEO-03 re-verification; the v1.x deferred table)
- `.planning/phases/02-bot-skeleton-initdata-security/02-REVIEW.md` — the 3 INFO findings (IN-01/02/03)
- `.planning/phases/03-mini-app-shell-geolocation/03-CONTEXT.md` — the privacy law's origin (D-07) + storage-gate precedent
- `.planning/phases/06-turn-by-turn-guidance-live-driving/06-CONTEXT.md` — c3 class + A1 escalation + cron laws being audited

### Codebase
- `bot/src/kv/` — the TTL-only surfaces the audit probes
- `bot/src/webhook.ts` — the log vocabulary + route table the audit scans
- `web/test/no-storage.test.mjs` + `bot/test/route-privacy.test.mjs` — the gate lineage the audit script consolidates
- `routing/scripts/measure-route-cpu.mjs` — the CPU measurement the budget record re-runs
- `bot/scripts/register-commands.mjs` — the /cari re-arm tool
- `docs/CONFIGURATION.md` — the docs dir the limitations doc joins

</canonical_refs>

<code_context>
## Existing Code Insights

### Reusable Assets
- Storage/privacy gates (no-storage.test.mjs, route-privacy.test.mjs, PG1/PG2) — consolidated into the audit tool
- measure-route-cpu.mjs — the budget record's engine half
- Device-gate files (03/04/06) — the consolidated QA walk inherits their checklist shapes
- register-commands.mjs — the /cari re-arm

### Established Patterns
- Gate suites as data (named vectors); hand-rolled runners; device-gate honesty protocol
- TTL-only KV; category-only logs; zero-telemetry posture
- Docs dir (docs/CONFIGURATION.md precedent)

### Integration Points
- `requestFullscreen`/`orientation lock` → capability-guarded webapp wrapper (homescreen.ts precedent)
- /help strings → the limitations pointer line
- STATE.md → the milestone completion record

</code_context>

<deferred>
## Deferred Ideas

- ALT landmark preprocessing (c2) — v1.x milestone lever (measured decision, phase 6)
- Engine B (fully client-side webview router) — the static-hosted endgame track
- WASM-router OSS project — backend #2's standalone evolution
- Opt-in telemetry — post-validation (IDEAS.md)
- Voice guidance, live trip share, toll toggle, speed-limit display, traffic ETA — v1.x table
- Bitmap map snapshots in turn-cards — v1.x
- Public launch (landing page, marketing, app-store presence) — post-v1

</deferred>

---

*Phase: 07-hardening-private-launch*
*Context gathered: 2025-10-25*