Release 0.11.0: trust device for 30 days

CHANGELOG.md

@@ -23,167 +23,6 @@ skip versions are the composition of each intervening adjacent
 release's steps in order — no A-to-B path is pre-computed beyond
 that.
 
-## 0.15.0 — 2026-05-28
-
-**Minor — no schema migration; one new build-time env var bound via
-`flotilla overlay set`.** This release ships Amplitude Analytics +
-Session Replay instrumentation (roadmap item #13). The frontend
-gains a small wrapper around `@amplitude/unified` that gates SDK
-initialization on the v0.13.0 cookie/privacy consent — the SDK is
-never loaded for visitors who have not granted analytics consent,
-no session is recorded, no network request fires; a later consent
-flip to `denied` calls `setOptOut(true)` so events and session
-replay stop immediately. The wrapper exposes a stable taxonomy of
-nine events (Page Viewed, RFC Viewed, User Signed In / Signed Out,
-RFC Proposed, PR Opened, Comment Posted, Beta Access Requested, Admin
-Permission Decision) wired into the existing routes, the Login flow,
-the propose / open-PR / discussion / PR-review surfaces, and the
-admin grant/revoke action. Event bodies carry only ids and enums; no
-free-text fields (titles, comment bodies, names, emails) are ever
-sent. **Session replay** records sessions at `sampleRate: 1` (100%)
-— vendor-recommended default; gated by the same v0.13.0 analytics
-consent. The Amplitude API key is read from `VITE_AMPLITUDE_API_KEY`
-at build time; when unset, the wrapper logs one console warning and
-no-ops so dev environments without analytics keep working. No backend
-events ship in this release — Amplitude SaaS holds the events,
-nothing lands in our DB, no migration.
-
-### Added
-
-- **Analytics wrapper** (`frontend/src/lib/analytics.js`). Public
-  surface: `track(name, props)`, `identify({ user_id })`,
-  `anonymize()`, the `EVENTS` taxonomy constant, and a
-  `__resetForTests` helper. Internally lazy-imports
-  `@amplitude/unified` and calls `amplitude.initAll(API_KEY,
-  { analytics: { autocapture: true }, sessionReplay: { sampleRate: 1 } })`
-  only after consent is granted; queues pre-init calls and drains
-  them on init resolve; flips `setOptOut(true)` on a granted→denied
-  consent change (stops both analytics events and session replay).
-  The wrapper subscribes to `onConsentChange()` so a freshly-banner-
-  clicked "analytics on" flips the SDK live without a page reload.
-- **Event taxonomy** wired into the app:
-  - `Page Viewed` — fires from `App.jsx` on every route change with
-    `path` (`location.pathname`); the location hook owns the firing
-    and dedupes by path.
-  - `RFC Viewed` — fires from `RFCView.jsx` once per slug load with
-    `rfc_slug` and `rfc_id`.
-  - `User Signed In` — fires from `Login.jsx` with
-    `method ∈ { 'otc', 'passcode', 'trust-device' }` matching the
-    three sign-in paths from v0.7.0 / v0.10.0 / v0.11.0.
-  - `User Signed Out` — fires from `App.jsx`'s "Sign out" click,
-    followed by `anonymize()` to clear the SDK's user binding before
-    the hard nav to `/auth/logout`.
-  - `RFC Proposed` — fires from `ProposeModal.jsx` on submit success
-    with `rfc_slug`.
-  - `PR Opened` — fires from `PRModal.jsx` on submit success with
-    `rfc_slug` and `pr_number`.
-  - `Comment Posted` — fires from `RFCDiscussionPanel.jsx`
-    (`surface: 'discussion'`) and from `PRView.jsx`
-    (`surface: 'pr'`, with `pr_number`) on each post-success.
-  - `Beta Access Requested` — fires from `Login.jsx` capture-profile
-    submit success. No PII in the event.
-  - `Admin Permission Decision` — fires from `Admin.jsx`'s grant /
-    revoke action with `action ∈ { 'grant', 'revoke' }` and
-    `target_user_id` (string).
-- **User binding** (`App.jsx`): when `me.authenticated` lands and a
-  user id is available, the wrapper's `identify({ user_id })` is
-  called with `String(viewer.id)`. The sign-out gesture calls
-  `anonymize()` before the nav. No email, display name, or other PII
-  is passed through the SDK.
-- **`@amplitude/unified`** dependency added to
-  `frontend/package.json` (analytics + session replay in one
-  install). Lockfile updated.
-- **`VITE_AMPLITUDE_API_KEY`** documented in `frontend/.env.example`
-  with the secret-vs-overlay binding caveat (see below).
-
-### Changed
-
-- **`frontend/src/App.jsx`** — adds `useLocation` for the route-change
-  Page Viewed firing, a `lastUserIdRef` memo to call
-  `identify` once per signed-in viewer, and an `onClick` handler on
-  the "Sign out" link that fires `User Signed Out` + `anonymize()`
-  before the hard nav.
-- **`frontend/src/components/Login.jsx`** — fires `User Signed In`
-  with the appropriate `method` at each of the three sign-in points
-  (trust-device cookie path, passcode verify success, OTC verify
-  success), and fires `Beta Access Requested` on capture-profile
-  submit success.
-- **`frontend/src/components/ProposeModal.jsx`** — fires `RFC Proposed`
-  with `rfc_slug` on submit success.
-- **`frontend/src/components/RFCView.jsx`** — fires `RFC Viewed`
-  inside the `getRFC` resolution so the event is keyed on the slug
-  param and includes the loaded `rfc_id`.
-- **`frontend/src/components/PRModal.jsx`** — fires `PR Opened` with
-  `rfc_slug` and `pr_number` on submit success.
-- **`frontend/src/components/RFCDiscussionPanel.jsx`** — fires
-  `Comment Posted` with `surface: 'discussion'` on send-success.
-- **`frontend/src/components/PRView.jsx`** — fires `Comment Posted`
-  with `surface: 'pr'` and `pr_number` on review-comment success.
-- **`frontend/src/components/Admin.jsx`** — fires
-  `Admin Permission Decision` on grant/revoke success.
-
-### Migration
-
-- **No schema migration.** Amplitude SaaS holds the events; the
-  framework's DB is unchanged. Migration slot **015** is unused by
-  this release and remains available for the next minor that needs a
-  schema bump.
-
-### Caveat — overlay binding for `VITE_AMPLITUDE_API_KEY`
-
-Amplitude browser API keys are embedded in the frontend bundle at
-build time and visible to anyone with browser dev tools. They are
-public by design — same nature as the v0.12.0
-`VITE_TURNSTILE_SITE_KEY` (also public, also bundle-embedded,
-explicitly contrasted with `CLOUDFLARE_TURNSTILE_SECRET` which is
-the real secret-half of that pair). The Amplitude installation
-guidance from the vendor shows the key inline as a literal string
-argument to `initAll(…)`, confirming the public framing. This
-release accordingly binds the value via `flotilla overlay set`,
-not `flotilla secret set` — the env-var name is `VITE_AMPLITUDE_API_KEY`
-(Vite-prefix convention, so the build picks it up directly without
-an alias step).
-
-(Roadmap row #13 originally said "new secret: AMPLITUDE_API_KEY";
-that wording predated vendor consultation. Mid-Session-L the
-operator provisioned the Amplitude project, surfaced the vendor's
-recommended init prompt, and the binding settled as overlay. The
-roadmap row will be updated to match when #13 ships.)
-
-### Caveat — session replay scope and consent
-
-This release enables Amplitude Session Replay at `sampleRate: 1`
-(100% of sessions recorded for full-DOM playback). The vendor's
-installation wizard recommends this default for new deployments —
-maximum learning during the early phase. The v0.13.0 single
-"analytics" consent toggle gates session replay together with
-events, so no recording happens without explicit opt-in. A future
-release **MAY** split this into a separate consent category for
-session replay specifically (recording has a meaningfully larger
-privacy footprint than event counters); §19.2 candidate.
-
-### Upgrade steps (from 0.14.0)
-
-- You **MUST** install the new frontend dependency before building:
-  `cd frontend && npm install` picks up `@amplitude/unified` from
-  the updated `frontend/package.json` and the refreshed
-  `package-lock.json`. The lockfile change is committed.
-- You **MUST** rebuild the frontend after upgrading so the analytics
-  wrapper and its consent gate ship to viewers. `frontend/package.json#version`
-  and `VERSION` both move to `0.15.0`. No schema migration; the
-  backend is unchanged for this release.
-- **MUST**: before deploying, the operator runs `/Users/benstull/projects/wiggleverse/ohm-rfc-app-flotilla/.venv/bin/ohm-rfc-app-flotilla overlay set ohm-rfc-app VITE_AMPLITUDE_API_KEY=<key>` to bind the Amplitude project's public API key. (Receiving the value in the conversation is fine — it's bundle-embedded by design, same as `VITE_TURNSTILE_SITE_KEY`.) The deploy **SHOULD NOT** proceed before this binding exists; if the binding is absent, the frontend's analytics wrapper no-ops with a console warning and the rest of the app continues to function — but no events or session replays are sent.
-- You **MAY** leave `VITE_AMPLITUDE_API_KEY` unset in dev environments
-  — the wrapper detects the empty value and no-ops with a single
-  console warning. The app, the consent banner, and every other
-  surface keep working unchanged.
-- You **SHOULD** verify after deploy that the Amplitude dashboard
-  receives events and a session replay when a consenting browser
-  exercises one of the taxonomy events (the easiest probe: open the
-  deployed site in an Incognito window, accept analytics on the
-  consent banner, navigate to an RFC, and watch the project's live
-  event stream + replay panel).
-
 ## 0.14.0 — 2026-05-28
 
 **Minor — no operator action required; new optional env var.** This
@@ -358,150 +197,6 @@ consent infrastructure is wired so item #13 (v0.15.0) can read from
   (because their `cookie_consent` row does not yet exist); their
   current sessions remain valid.
 
-## 0.12.0 — 2026-05-28
-
-**Minor — operator action required (new secret + new overlay).**
-CloudFlare Turnstile gates the email-entry step of the OTC sign-in
-flow against automated abuse (roadmap item #10, SPEC §6.2 / §19.2-
-settled). Since v0.7.0 made `/auth/otc/request` the primary human-
-auth path and v0.8.0 opened the request endpoint to any valid email,
-the OTC dispatch became the natural target for distributed scrapers
-fanning out to harvest "this email is admitted vs. this email is
-not" timing/bounce signals. The per-email cooldown stops the trivial
-back-to-back loop; the Turnstile challenge stops the distributed one
-by costing the attacker a browser-side proof-of-humanness on every
-request. The challenge runs before the bcrypt hash + SMTP send so a
-failed verify spends no rate budget and produces no envelope.
-
-Scope: the widget renders on the email-entry step of `/login` only.
-The OTC verify step (where the user pastes the six-digit code) is
-already bottlenecked on email delivery and protected by the
-five-minute TTL + single-use consume on the row; a second challenge
-there would double the rate budget against the same abuse path
-without measurably more protection. If bots adapt to defeat the
-email-entry challenge specifically — pushing the abuse vector onto
-the verify step — a future release adds the second widget. The
-widget also renders on the passcode step's "Use a code instead"
-fallback dispatch since that route also calls `/auth/otc/request`.
-
-Default policy: `TURNSTILE_REQUIRED=false`. The gate stays open when
-the secret is absent — the dev / test path, and the pre-rollout
-path while the operator is wiring the secret. Once the secret is in
-GCP Secret Manager and the site key is in the overlay, the operator
-**MAY** flip `TURNSTILE_REQUIRED=true` so a future config drift on
-the secret fails loudly (HTTP 500 "auth misconfigured") instead of
-silently disabling abuse defense.
-
-No schema migration — Turnstile siteverify is stateless.
-
-### Added
-
-- **`backend/app/turnstile.py`** — the siteverify caller. POSTs
-  `secret` + `response` (+ optional `remoteip`) to
-  `https://challenges.cloudflare.com/turnstile/v0/siteverify` and
-  returns a `VerifyOutcome` (`ok` boolean + `reason` enum:
-  `ok` / `skipped` / `misconfigured` / `missing-token` / `failed` /
-  `network`). Tunables read from env at call time so tests
-  monkeypatch cleanly: `CLOUDFLARE_TURNSTILE_SECRET`,
-  `TURNSTILE_REQUIRED`, and (test-only) `TURNSTILE_SITEVERIFY_URL`.
-- **`frontend/src/components/TurnstileWidget.jsx`** — the React
-  wrapper around the official CloudFlare Turnstile JS API. Reads the
-  site key from `import.meta.env.VITE_TURNSTILE_SITE_KEY`; renders
-  nothing when the var is unset (the form still submits and the
-  backend's `TURNSTILE_REQUIRED` policy decides admission). Loads
-  the CloudFlare script once per page on first widget mount. Cleans
-  up the widget instance on unmount via `turnstile.remove()` so a
-  remount produces a fresh challenge rather than reusing a stale,
-  already-consumed token.
-- **Backend tests** (`backend/tests/test_turnstile_vertical.py`) —
-  five vertical scenarios: happy path (secret + valid token →
-  admit), siteverify rejects → 400 + no envelope, missing-token →
-  400 + no envelope, missing-secret-soft (default) → admit, and
-  missing-secret-hard (`TURNSTILE_REQUIRED=true`) → 500
-  "misconfigured". All five mock the siteverify HTTP call via
-  `monkeypatch.setattr(turnstile.httpx, "post", …)`; no real
-  CloudFlare keys are ever embedded.
-- **SPEC `§6.2`** — names the Turnstile gate on the OTC dispatch as
-  the v0.12.0 settled shape; the §19.2 candidate from v0.7.0 closes.
-
-### Changed
-
-- **`backend/app/main.py`** — `OtcRequestBody` grows an optional
-  `turnstile_token` field. The `/auth/otc/request` handler calls
-  `turnstile.verify_token` first, before `otc.request_code`, so a
-  failed challenge spends no rate budget and produces no envelope.
-  The handler maps `misconfigured` → HTTP 500, all other failures
-  (`missing-token`, `failed`, `network`) → uniform HTTP 400 so the
-  response does not enumerate which leg of the challenge broke.
-- **`frontend/src/api.js`** — `requestOtc` accepts a second arg
-  `{ turnstileToken }` and threads it into the request body. The
-  positional signature stays backwards-compatible so calls that pass
-  only an email still type-check.
-- **`frontend/src/components/Login.jsx`** — the email step and the
-  passcode step both render `<TurnstileWidget>`. The submit button
-  on the email step is disabled until the widget produces a token
-  (when the widget is enabled at build time); the "Use a code
-  instead" link on the passcode step has the same gate. A 400 from
-  `/auth/otc/request` clears the token and surfaces a "couldn't
-  verify you're human, please retry" status. The fallback-from-
-  passcode path bounces back to the email step on 400 so the user
-  gets a fresh challenge in the natural place.
-- **`backend/.env.example`** — documents `CLOUDFLARE_TURNSTILE_SECRET`
-  and `TURNSTILE_REQUIRED` alongside the existing OTC tunables.
-- **`frontend/.env.example`** — documents `VITE_TURNSTILE_SITE_KEY`
-  with the operator wire-up procedure (dash.cloudflare.com →
-  Turnstile → Add site).
-
-### Upgrade steps (from 0.10.0)
-
-The operator **MUST** create a CloudFlare Turnstile site
-(dash.cloudflare.com → Turnstile → Add site, choose "Managed" widget
-mode), obtain the site key (public) and secret key (private), and:
-
-- You **MUST** `flotilla secret set ohm-rfc-app CLOUDFLARE_TURNSTILE_SECRET`
-  (paste the secret key when prompted) before the v0.12.0 deploy.
-  The framework reads the secret at request time; deploying v0.12.0
-  without the secret leaves the gate in its default soft-fail state
-  (every request admitted regardless of token), which means abuse
-  defense is silently off.
-- You **MUST** `flotilla overlay set ohm-rfc-app VITE_TURNSTILE_SITE_KEY <site-key>`
-  so the frontend build embeds the site key and the widget renders
-  on `/login`. The site key is public — it travels in the bundle and
-  appears in every browser — so this is the overlay (non-secret)
-  layer per the §3 invariant 1 split. Skipping this step leaves
-  `/login` with no widget; even after the operator sets the secret,
-  the backend would refuse every request as `missing-token` once
-  `TURNSTILE_REQUIRED=true` flips.
-- You **MUST** rebuild the frontend and restart the backend after
-  upgrading. `frontend/package.json#version` and `VERSION` both move
-  to `0.12.0`. No schema migration; Turnstile siteverify is
-  stateless. The site-key embed is build-time, so the rebuild after
-  the `flotilla overlay set` is what actually wires the widget into
-  the bundle the deploy serves.
-- You **MAY** `flotilla overlay set ohm-rfc-app TURNSTILE_REQUIRED true`
-  once you've confirmed a real sign-in works end-to-end with the
-  widget. The default (`false`) keeps the gate in soft-fail mode so
-  a missing-secret regression admits requests rather than 500ing
-  every sign-in attempt; flipping to `true` makes a future config
-  drift on the secret fail loudly with HTTP 500 instead of silently
-  disabling abuse defense. The framework's tested path is the
-  flipped-to-true production shape; the default `false` exists for
-  the dev / pre-rollout window only.
-- You **MAY** customize the Turnstile widget mode (Managed /
-  Non-interactive / Invisible) from the dashboard at any time
-  without redeploying — the site key stays the same, and the widget
-  picks up the mode change on the next page load. The framework's
-  tested path is "Managed" because it gives the operator a visible
-  challenge surface to debug against.
-
-If either of the two **MUST** secret/overlay steps is skipped, the
-deploy still boots and `/login` still serves; the failure mode is
-that abuse defense is off (default `TURNSTILE_REQUIRED=false`) or
-every sign-in attempt 500s (`TURNSTILE_REQUIRED=true` flipped while
-the secret is unset). The driver pauses the wave at the secret/
-overlay gesture so the operator confirms both are in place before
-the framework version pin moves.
-
 ## 0.11.0 — 2026-05-28
 
 **Minor — schema migration required; no new env vars.** This release
@@ -615,7 +310,6 @@ candidate walk. The raw token is never logged.
   opt-in on the next sign-in, and a user who never checks the box
   keeps the v0.10.0 behavior verbatim.
 
-
 ## 0.10.0 — 2026-05-28
 
 **Minor — schema migration required; new auth path is additive.**
@@ -756,208 +450,6 @@ v0.7.0. The lockout shape (5 attempts, 15 minutes) and the length
 range (4–20) are hard-coded in `backend/app/passcode.py`. See
 §19.2 for the env-tunable candidate.
 
-## 0.9.0 — 2026-05-28
-
-**Minor — no schema migration; reuses v0.8.0 columns and existing
-SMTP.** This release ships the admin user-management surface at
-`/admin/users` and the new-beta-request notifications that feed
-it (roadmap item #7, SPEC §6.1 / §15 / §17). The two halves
-compose: admins receive an inbox + email signal the moment a
-pending user submits the v0.8.0 capture form; clicking through
-lands on the page where they Grant or Revoke access.
-
-The page consumes the v0.8.0 schema columns
-(`permission_state`, `first_name`, `last_name`,
-`beta_request_reason`, `permission_decided_by`,
-`permission_decided_at`) without adding new ones — migration
-slot 016 stays reserved for a future release. The single new
-write endpoint, `POST /api/admin/users/<id>/permission`,
-replaces v0.8.0's documented manual `UPDATE users SET
-permission_state='granted'` gesture with an audited UI flip.
-
-Admin notifications ride the existing §15 chokepoint — the
-`new_beta_request` event_kind is added to the enum with
-category `admin-actionable`, fan-out is to every owner / admin
-minus the requester themselves, and the §15.4 email dispatch
-only reaches recipients whose `email_admin_actionable` toggle
-is on (the default for owners + admins). The event is the
-framework's first non-RFC-scoped notification — `rfc_slug` is
-NULL and the email deep-link points `/admin/users` instead of
-`/rfc/<slug>`.
-
-Decision on `/admin/allowlist`: the surface stays as a
-sibling sub-tab, not folded into `/admin/users`. The two have
-different keys (allowlist by email pre-sign-up, user list by
-user_id post-sign-up) and a union row would be confusing
-rather than clarifying. The allowlist's fast-path-bypass role
-from v0.8.0 is unchanged; retiring the table outright is
-deferred to a later session (see §19.2).
-
-### Upgrade steps (from 0.10.0)
-
-1. **MAY** rebuild the frontend. The build is the same shape
-   as v0.10.0; the lockfile pins to `0.9.0` so `npm install`
-   in `frontend/` updates it cleanly. No new env vars on the
-   frontend; the existing `VITE_APP_NAME` requirement carries
-   over.
-2. **MAY** restart the backend. No schema migration runs in
-   this release — every v0.9.0 column is from
-   `014_beta_access.sql` (v0.8.0). Restart only if you want
-   the new endpoints registered in this version's binary.
-3. **SHOULD** verify SMTP can reach the deployment's admin
-   inbox before the first pending user submits the capture
-   form. v0.9.0 reuses the v0.7.0 SMTP configuration
-   (`SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`,
-   `SMTP_STARTTLS`, `EMAIL_FROM`, `EMAIL_FROM_NAME`); a
-   misconfigured deployment will still write the inbox row,
-   but the admin won't hear about it through email. No new
-   env var is required — the framework reuses the existing
-   admin-user list (role IN ('owner', 'admin')) as the
-   notification recipients.
-4. **SHOULD** announce the surface to existing admins. Wording
-   suggestion: "There's now a Users tab in /admin where you can
-   Grant or Revoke beta access — and you'll get an email +
-   inbox row when a fresh request lands. The manual SQL gesture
-   from v0.8.0 still works but is no longer the documented
-   path."
-5. **MAY** drain the existing pending queue through the new UI.
-   If your deployment carried pending users through the v0.8.0
-   manual-UPDATE window, the Pending bucket on `/admin/users`
-   surfaces all of them with their captured profile. Granting
-   from the UI stamps `permission_decided_by` /
-   `permission_decided_at`, which any prior manual UPDATE
-   gestures may have left NULL (no harm done — the v0.8.0
-   contract didn't require those stamps).
-
-### Added
-
-- **`POST /api/admin/users/<id>/permission`** — body
-  `{state: 'pending'|'granted'|'revoked'}`. Flips the column,
-  stamps `permission_decided_by` + `permission_decided_at`,
-  and writes a `permission_events` row with event_kind in
-  `{permission_granted, permission_revoked,
-  permission_repended}`. Refuses 422 on self-flip (symmetric
-  to `set_mute` / `set_role` self-action refusals) and 422
-  on invalid state. Returns `{ok, permission_state, changed}`
-  where `changed=false` indicates a no-op (the requested
-  state already matched).
-- **Widened `GET /api/admin/users` response** carrying
-  `permission_state`, `first_name`, `last_name`,
-  `beta_request_reason`, `created_at`,
-  `permission_decided_at`, plus joined
-  `permission_decided_by_login` /
-  `permission_decided_by_display`. Sort order surfaces
-  `pending` rows first (the admin queue), then `granted`,
-  then `revoked`; within a bucket, owners precede admins
-  precede contributors, with recency as the tiebreaker.
-- **`new_beta_request` event_kind** in the §15.1 enum. Fired
-  by `notify.fan_out_new_beta_request` from the first
-  successful `POST /api/auth/me/beta-request` (re-submits
-  from the same pending user don't re-fire — the row's
-  first-time-complete check guards against carpet-bombing).
-  Recipients: every owner + admin minus the requester
-  themselves. Category: `admin-actionable`. Deep-link:
-  `/admin/users`. Actor: the requester per §15.9.
-- **`/admin/users` page enhancements** in `Admin.jsx`. The
-  Users tab gains a state filter chip row (All / Pending /
-  Granted / Revoked with counts), a Grant / Revoke control
-  column, a Permission state badge, and an expandable
-  "why they want access" row beneath each pending user.
-  Sign-up timestamp surfaces in a new column.
-- **`frontend/src/api.js#setUserPermission`** — client for
-  the new endpoint, neighboring `setUserMute` and
-  `setUserRole`.
-- **`/beta-pending` copy update** in `BetaPending.jsx`. The
-  "your request is in review" page now honestly references
-  the admin-email signal v0.9.0 ships and admits the
-  framework does not commit to an SLA — turnaround depends
-  on operator availability, and the deployment operator is
-  the right person to ask if a wait runs long. No
-  deployment-specific text is baked in; per-deployment copy
-  lives in §13 of the deployment's repo, not in the
-  framework.
-- **`backend/tests/test_admin_users_vertical.py`** — 10 new
-  tests covering: a beta-request submission fans
-  notifications to every admin + owner (and not to the
-  requester or to contributors); the requester's profile
-  fields land in the notification payload; re-submitting
-  the capture form does not re-fan; the `admin-actionable`
-  category mapping is wired; the `/api/admin/users`
-  listing carries the v0.8.0 columns with `pending` rows
-  sorted first; the permission-flip endpoint promotes
-  pending → granted with the right audit shape; the
-  endpoint promotes granted → revoked; the endpoint
-  refuses self-flip with 422; the endpoint refuses
-  non-admin callers with 403 and anonymous callers with
-  401; the endpoint refuses invalid states with 422; a
-  state-already-matches flip returns `changed=false`
-  without writing an audit row.
-
-### Changed
-
-- **`backend/app/api.py`** — the `POST /api/auth/me/beta-request`
-  handler now calls `notify.fan_out_new_beta_request` after the
-  capture UPDATE lands, gated on the row not previously having
-  all three profile fields populated (so re-submits don't
-  re-fan).
-- **`backend/app/api_admin.py`** — the `list_users` query joins
-  against `users d ON d.id = u.permission_decided_by` for the
-  deciding-admin handle. The new `set_permission` endpoint
-  lives alongside `set_role` / `set_mute`.
-- **`backend/app/notify.py`** — adds
-  `CATEGORY_ADMIN_ACTIONABLE`, the `fan_out_new_beta_request`
-  helper, and the `new_beta_request` arm in `render_summary`.
-- **`backend/app/email.py`** — the `_EVENT_TO_CATEGORY` map
-  carries `new_beta_request → admin-actionable`, and
-  `_deep_link` routes framework-scoped admin signals to
-  `/admin/users` instead of `/rfc/<slug>`.
-- **`frontend/src/components/Admin.jsx`** — the `UsersTab`
-  component is rewritten with state filter chips, a per-row
-  `UserRow` + `PermissionCell` decomposition, and a
-  `useMemo`-cached counts table. The pending-row reason
-  blockquote renders as a secondary `<tr>` beneath the user
-  row when present.
-- **`frontend/src/components/BetaPending.jsx`** — pending-state
-  copy revised to reference the admin email signal honestly.
-- **`frontend/src/App.css`** — new admin-chip / permission-badge
-  / user-row-reason rules.
-- **`SPEC.md`** §6 opening, §15.1 event-kinds enum, §17 admin
-  endpoints, §19.2 candidates list — per §19.3 rule-2.
-- **`VERSION`** → `0.9.0`. `frontend/package.json#version` and
-  the lockfile mirror.
-
-### Environment variables
-
-None new. The release reuses the v0.7.0 SMTP configuration
-(`SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`,
-`SMTP_STARTTLS`, `EMAIL_FROM`, `EMAIL_FROM_NAME`,
-`EMAIL_ENABLED`, `EMAIL_BUNDLE_THRESHOLD`) and the existing
-admin-user list (role IN ('owner', 'admin')) as the
-notification recipients. A deployment whose SMTP is misconfigured
-will still see the inbox rows; only the email channel is muted.
-
-### Deferred to later releases
-
-- **Grant / revoke notification to the user** — symmetric
-  signal: when an admin grants or revokes access, fire a
-  `personal-direct` notification (event_kind
-  `permission_change_affecting_me`, already in the §15.1
-  enum) so the affected user sees the state change in
-  their inbox and email. v0.9.0 audits the gesture in
-  `permission_events` but does not yet escape the
-  app-internal log to the user. See §19.2.
-- **Decline-with-reason on revoke** — the current Revoke
-  gesture takes only a confirmation; a follow-up release
-  may capture a free-text reason in
-  `permission_events.details`. See §19.2.
-- **Allowlist deprecation** — the `/admin/allowlist` sub-tab
-  stays in place in v0.9.0 (the two surfaces have different
-  keys and a union row would be confusing). Retiring the
-  table outright is deferred to a session that can re-read
-  the post-v0.9.0 operator experience and decide whether
-  the fast-path-bypass role is still pulling weight. See
-  §19.2.
-
 ## 0.8.0 — 2026-05-28
 
 **Minor — schema migration required; admission semantics shift.**

SPEC.md

@@ -425,23 +425,9 @@ endpoints accept the user. The capture-fields step (first name,
 last name, free-text "why I should be included in the beta") feeds
 the admin's triage queue. The `allowed_emails` table stays in the
 schema as a fast-path bypass — the v0.3.0 admin UI still manages
-it — but the OTC request path no longer consults it. v0.9.0
-(roadmap item #7) shipped the user-management surface that
-consumes the `permission_state` column: `/admin/users` carries
-every user with their state, profile, and sign-up reason, plus
-Grant / Revoke controls that flip the column and write a
-`permission_events` audit row. The capture-form submission also
-fans a `new_beta_request` notification out to every admin/owner
-through the §15 substrate, so the queue surfaces in the inbox +
-email channels admins already have.
-
-The `/admin/allowlist` sub-tab stays in place alongside
-`/admin/users` rather than merging: the two surfaces have
-different keys (allowlist by email pre-sign-up, user list by
-user_id post-sign-up) and a union row would be confusing rather
-than clarifying. The allowlist's role narrowed to "fast-path
-bypass for known-good emails" with the v0.8.0 admission shift;
-v0.9.0 retains that role unchanged.
+it — but the OTC request path no longer consults it. v0.9.0's
+admin user-management page replaces the allowlist UI and ships the
+pending-queue triage surface.
 
 ### 6.1 Four roles, each a strict superset of the one below
 
@@ -2327,14 +2313,8 @@ signal taxonomy this section commits to. The starting set:
 `graduation_complete`, `graduation_rolled_back`, `rfc_withdrawn`,
 `rfc_reopened`, `claim_opened`, `claim_merged`,
 `permission_change_affecting_me`, `app_wide_mute_set`,
-`app_wide_mute_lifted`, `new_beta_request`, `digest_emitted`.
-The enum is extensible; the build session adjusts as new gestures
-are wired in. The `new_beta_request` event (v0.9.0, roadmap item
-#7) is framework-scoped rather than RFC-scoped — the row's
-`rfc_slug` is NULL and the deep-link points `/admin/users`
-instead of `/rfc/<slug>` — but otherwise rides the standard
-fan-out chokepoint with category `admin-actionable` so the §15.4
-email gate only reaches owners/admins.
+`app_wide_mute_lifted`, `digest_emitted`. The enum is extensible; the
+build session adjusts as new gestures are wired in.
 
 ### 15.2 The inbox
 
@@ -2788,19 +2768,9 @@ The follow-up session will refine this. A minimal starting set:
   silently if the email wasn't on the `allowed_emails` list (the
   v0.3.0 admission gate); v0.8.0 (item #6) removed that check —
   admission moved to `permission_state` on the freshly-provisioned
-  `users` row, asserted at the contributor gate. v0.12.0 (item #10)
-  gates this endpoint behind a CloudFlare Turnstile siteverify call:
-  the body carries an optional `turnstile_token` field, the server
-  POSTs `secret` + `response` to `challenges.cloudflare.com/turnstile/
-  v0/siteverify` before the bcrypt hash + SMTP send, and a failed
-  challenge refuses with HTTP 400 spending no rate budget. Two env
-  vars drive the policy: `CLOUDFLARE_TURNSTILE_SECRET` (Secret
-  Manager) and `TURNSTILE_REQUIRED` (overlay, default `false`). When
-  the secret is unset and `TURNSTILE_REQUIRED=false`, the gate is
-  open (the dev / pre-rollout path); when the secret is unset and
-  `TURNSTILE_REQUIRED=true`, the endpoint refuses with HTTP 500
-  "auth misconfigured" so a future config drift fails loudly
-  instead of silently disabling abuse defense.
+  `users` row, asserted at the contributor gate. Per §19.2's
+  expected next session, this endpoint is the lead-up to the
+  Cloudflare-Turnstile abuse-mitigation overlay.
 - `POST /auth/otc/verify` — unauthenticated. Body carries `email` and
   `code`. Validates the bcrypt hash against the most-recent unconsumed
   non-expired row for the email, marks the row consumed, provisions
@@ -3024,15 +2994,8 @@ The follow-up session will refine this. A minimal starting set:
 - `POST /api/rfcs/<slug>/prs/<pr_number>/withdraw` — withdraw per §10.8.
 - `POST /api/rfcs/<slug>/prs/<pr_number>/resolution-branch` — cut a
   fresh resolution branch and replay per §10.9.
-- `GET  /api/admin/users` — list users for the §6 / Slice 7 admin
-  surface. v0.9.0 (roadmap item #7) widened the payload to carry
-  `permission_state`, `first_name`, `last_name`, `beta_request_reason`,
-  `created_at`, `permission_decided_at`, and the joined
-  `permission_decided_by_login` / `permission_decided_by_display`
-  for the user-management page. Sort order surfaces `pending` rows
-  first (the daily admin queue), then `granted`, then `revoked`;
-  within a bucket, owners precede admins precede contributors,
-  with recency as the tiebreaker.
+- `GET  /api/admin/users` — list users with role and write-mute state,
+  for the §6 / Slice 7 admin surface.
 - `POST /api/admin/users/<id>/role` — set role. Only owners may grant
   or revoke `owner`; admins may flip contributor ↔ admin freely. An
   owner-self-demotion is refused on this endpoint; owner succession
@@ -3041,16 +3004,6 @@ The follow-up session will refine this. A minimal starting set:
   write-mute (not the §15.8 notification mutes). Refused on owners
   and admins — for them, the role-change channel is the right
   refusal. Writes a `permission_events` row.
-- `POST /api/admin/users/<id>/permission` — v0.9.0 (roadmap item #7).
-  Flip `permission_state` between `pending`, `granted`, and `revoked`.
-  Stamps `permission_decided_by` + `permission_decided_at` on the
-  row and writes a `permission_events` row with event_kind in
-  `{permission_granted, permission_revoked, permission_repended}`.
-  Refuses with 422 if the admin tries to flip their own row
-  (symmetric to the `set_mute` / `set_role` self-action refusals).
-  v0.8.0 shipped the column shape with no admin UI — operators ran
-  a manual `UPDATE users` to grant access; v0.9.0 retires the
-  manual gesture.
 - `GET  /api/admin/audit` — paged read of the `actions` log with
   filters `action_kind`, `actor_user_id`, `rfc_slug`, plus `before_id`
   for the page boundary. Returns the joined actor login/display so
@@ -3890,64 +3843,56 @@ on every other page until an admin grants. v0.8.0 (roadmap item
 Candidates surfaced during v0.8.0 (open beta-access request flow,
 §6.1 / §14.1, item #6):
 
-- **Admin user-management page** (`/admin/users`). *Shipped in
-  v0.9.0 (roadmap item #7).* The listing surfaces every user with
-  permission_state, profile fields, sign-up reason, and a Grant /
-  Revoke control set; the `POST /api/admin/users/<id>/permission`
-  endpoint flips the column and writes a `permission_events` row.
-  v0.9.0 left the `/admin/allowlist` sub-tab in place rather than
-  merging (see allowlist deprecation below). The grant/revoke
-  notify-the-user surface is deferred (see the new candidate
-  below).
-- **Allowlist deprecation.** *Decision deferred past v0.9.0.*
-  v0.9.0 considered merging `/admin/allowlist` into the new
-  `/admin/users` page but kept the surface as a sibling sub-tab:
-  the two have different keys (allowlist by email pre-sign-up,
-  user list by user_id post-sign-up) and a union row would be
-  confusing rather than clarifying. The fast-path-bypass role
-  the allowlist has carried since v0.8.0 stays intact; the
-  cutover to retire the table outright is a later session.
-  Decision points unchanged from v0.8.0: drop the table outright
-  (a schema migration) or leave it as a non-functional surface
-  and remove only the UI (a frontend-only change); how to handle
-  existing `allowed_emails` rows at the cutover (probably: walk
-  them into the pending queue with `permission_state='granted'`
-  for any matching `users` row, leave unmatched rows as a no-op
-  since v0.8.0 doesn't consult them anymore). Earns its session
-  once the v0.9.0 admin queue has run long enough to confirm the
-  allowlist's bypass role is no longer pulling weight.
-- **Admin notification on new beta request.** *Shipped in v0.9.0
-  (roadmap item #7).* The `POST /api/auth/me/beta-request`
-  handler now calls `notify.fan_out_new_beta_request`, which
-  fans a `new_beta_request` event (category `admin-actionable`,
-  rfc_slug NULL) out to every owner / admin. The §15 chokepoint
-  handles the SSE broadcast and the §15.4 email dispatch; the
-  email reaches only recipients whose `email_admin_actionable`
-  toggle is on (the default for owners + admins).
-- **Grant / revoke notification to the user.** *Surfaced by
-  v0.9.0.* The new flip endpoint stamps `permission_decided_by` +
-  writes a `permission_events` row but does not yet signal the
-  affected user that their state changed. A future release could
-  fire a `personal-direct` notification (event_kind
-  `permission_change_affecting_me`, already in the §15.1 enum) so
-  a granted user sees "Your beta-access request was approved" in
-  their inbox and email, and a revoked user sees a parallel
-  refusal notice. Decision points: does revocation include a
-  reason field (probably yes — symmetric with §9.3's decline
-  comment); does grant carry a welcome message (probably no —
-  the existing welcome surfaces are sufficient); does the
-  notification escape the §15.8 mute path (probably yes — it's
-  a personal-direct admission state change). Earns its session
-  as a follow-up to the v0.9.0 page.
-- **Decline-with-reason on permission revoke.** *Surfaced by
-  v0.9.0.* The current Revoke gesture takes only a confirmation;
-  there is no audit-visible reason captured. A future release
-  could add a free-text reason input that lands in the
-  `permission_events.details` JSON column (no schema change
-  needed — the column is already JSON-shaped). This is the
-  symmetric companion to the §9.3 proposal-decline contract.
-  Earns its session alongside the grant/revoke notification
-  candidate above.
+- **Admin user-management page** (`/admin/users`). *Surfaced by
+  v0.8.0 — the release ships the pending-state column but no
+  admin UI to triage it.* For v0.8.0, the admin gesture is an
+  out-of-band `UPDATE users SET permission_state='granted' WHERE
+  email=?`. v0.9.0 (roadmap item #7) is expected to ship the
+  triage queue: a list of `permission_state='pending'` rows
+  sorted by `created_at`, each showing the captured first /
+  last / why fields, with Grant and Revoke buttons that stamp
+  `permission_decided_by` and `permission_decided_at` (schema
+  slots already in place per `migrations/014_beta_access.sql`).
+  The page composes naturally with the existing `/admin/allowlist`
+  surface — both are admission-control gestures — so v0.9.0 may
+  fold the allowlist UI into this page (see next candidate).
+  Decision points: do grants / revokes also fire email
+  notifications to the user (probably yes — the notifications
+  layer from v0.6.0 has the personal-direct channel for it); is
+  there a "decline with reason" gesture that surfaces in the
+  user's view (probably yes — symmetric with §9.3's
+  proposal-decline shape); does the page support bulk grants
+  (probably no for v0.9.0 — the queue volume is operator-scale,
+  not user-scale). Earns its session as the v0.9.0 design pass.
+- **Allowlist deprecation.** *Surfaced by v0.8.0 — the
+  `allowed_emails` table stays in the schema but the OTC
+  request path no longer consults it.* v0.8.0 left the table
+  and the `/admin/allowlist` UI in place as a fast-path bypass
+  for deployments that want to pre-mark known-good emails (the
+  v0.8.0 contract is that those emails still go through the
+  pending-grant flow; the table itself is no longer a gate). A
+  future release retires both — probably v0.9.0 alongside the
+  admin user-management page, since the two surfaces are
+  functionally redundant once the pending queue lands.
+  Decision points: drop the table outright (a schema migration)
+  or leave it as a non-functional surface and remove only the
+  UI (a frontend-only change); how to handle existing
+  `allowed_emails` rows at the cutover (probably: walk them
+  into the pending queue with `permission_state='granted'` for
+  any matching `users` row, leave unmatched rows as a no-op
+  since v0.8.0 doesn't consult them anymore). Earns its
+  session as a sub-topic of the v0.9.0 admin user-management
+  pass.
+- **Admin notification on new beta request.** *Surfaced by
+  v0.8.0 — the capture endpoint writes to the row but does
+  not signal admins.* v0.9.0 candidate (item #7 again): when a
+  `POST /api/auth/me/beta-request` lands, fire an `admin-actionable`
+  notification (per §15.4's category set) to every owner / admin
+  so the queue doesn't go stale. The §15 infrastructure already
+  supports the category; the open question is whether the
+  notification is per-request (one email per submission) or
+  digested (a daily summary). Earns its session alongside the
+  admin user-management page.
 - **Removing the Gitea OAuth fallback.** *Surfaced by v0.7.0.*
   v0.7.0 keeps `/auth/callback` functional and links to it as a
   "Sign in with Gitea (fallback)" affordance on the new `/login`
@@ -4007,32 +3952,24 @@ Candidates surfaced during v0.8.0 (open beta-access request flow,
   hard-coding — name the tunable when a deployment wants it
   different rather than shipping a knob that has no operator
   asking for it.
-- **Cloudflare Turnstile on `/auth/otc/request`.** *Settled in
-  v0.12.0 (roadmap item #10).* The OTC request endpoint is now
-  gated behind a Turnstile siteverify call: the frontend renders
-  the official widget on the `/login` email-entry step (and on the
-  passcode step for the "Use a code instead" fallback dispatch),
-  the captured token rides in the request body as
-  `turnstile_token`, and the backend POSTs `secret` + `response`
-  to `challenges.cloudflare.com/turnstile/v0/siteverify` before
-  the bcrypt hash + SMTP send. The widget renders only on the
-  email-entry / passcode-fallback dispatch points — the OTC
-  verify step is bottlenecked on email delivery and protected by
-  the five-minute TTL + single-use row consume, so a second
-  challenge there would double the rate budget against the same
-  abuse path without measurably more protection (revisit if bots
-  adapt to the email-entry challenge specifically). Configured
-  via `CLOUDFLARE_TURNSTILE_SECRET` (Secret Manager) and
-  `VITE_TURNSTILE_SITE_KEY` (frontend build-time overlay); a
-  third var `TURNSTILE_REQUIRED` (default `false`) lets the
-  operator flip from "soft-fail when secret unset" (the dev /
-  pre-rollout shape) to "fail-closed when secret unset" (HTTP 500
-  "auth misconfigured", the production-locked shape). Tests mock
-  the siteverify HTTP call at the `httpx.post` boundary in
-  `app.turnstile`. The hCaptcha / reCAPTCHA alternatives noted in
-  the v0.7.0 surfacing are still viable substitutes for a future
-  deployment that wants them but the framework's tested path is
-  Turnstile.
+- **Cloudflare Turnstile (or equivalent) on `/auth/otc/request`.**
+  *Surfaced by v0.7.0 — the endpoint is now the new abuse hot
+  path.* Per-email cooldown stops the trivial loop; what it
+  doesn't stop is a distributed scrape that fans out across a
+  large invitee list to harvest the "this email is admitted vs.
+  this email is not" signal indirectly (timing differences, SMTP
+  bounce-rate observation). The roadmap item-#10 candidate gates
+  the request endpoint behind a one-step browser-side challenge
+  before the bcrypt hash + SMTP send. Open questions: which
+  provider (Turnstile is the default since it's free and
+  privacy-respecting; hCaptcha and reCAPTCHA are also viable);
+  how the deployment configures it (`TURNSTILE_SITE_KEY` +
+  `TURNSTILE_SECRET_KEY` env vars, gated by `if
+  config.turnstile_site_key:` at the handler so existing
+  deployments don't break); whether the verify endpoint also
+  gets a challenge (probably yes for parity); and how the test
+  harness mocks the challenge. Earns its session as the v0.12.0
+  design pass.
 
 Candidates surfaced during v0.10.0 (user-set passcodes, §6.2 /
 roadmap item #8):

VERSION

@@ -1 +1 @@
-0.15.0
+0.11.0

backend/.env.example

@@ -92,21 +92,3 @@ OTC_TTL_MINUTES=10
 # loud-failure shape so the abuse path is visible). Set to 0 to
 # disable the cooldown — useful for tests but never in production.
 OTC_REQUEST_COOLDOWN_SECONDS=60
-
-# --- v0.12.0: CloudFlare Turnstile gate on OTC dispatch (§6.2, item #10) ---
-# Provision a Turnstile site at dash.cloudflare.com → Turnstile → Add
-# site. The site key (public) goes in `frontend/.env` as
-# VITE_TURNSTILE_SITE_KEY. The secret key (private) goes here and is
-# what the backend POSTs to /siteverify alongside the user's response
-# token. Leave both unset for dev/test paths; the gate stays open when
-# the secret is absent AND TURNSTILE_REQUIRED=false (the default).
-CLOUDFLARE_TURNSTILE_SECRET=
-
-# When `true`, /auth/otc/request fails closed (HTTP 500 "auth
-# misconfigured") if CLOUDFLARE_TURNSTILE_SECRET is unset. When `false`
-# (the default), a missing secret skips verification — useful in dev
-# and during the pre-rollout window when the operator hasn't wired
-# the secret yet. Flip to `true` once the secret is wired so a future
-# config drift surfaces as a loud 500 rather than a silent abuse-
-# defense disablement.
-TURNSTILE_REQUIRED=false

backend/app/api.py

@@ -32,7 +32,6 @@ from . import (
     cache,
     funder,
     health,
-    notify,
     philosophy,
     providers as providers_mod,
 )
@@ -239,18 +238,6 @@ def make_router(
                 user.user_id,
             ),
         )
-        # v0.9.0 (roadmap item #7): notify every admin/owner of the
-        # fresh request. Only the first submission is the
-        # "newly-pending" gesture — re-submits from the same user
-        # would otherwise carpet the admin inbox. We fire only when
-        # this is the row's first time getting all three fields
-        # populated (the prior row carried at least one NULL).
-        prior = row  # captured before the UPDATE above
-        was_already_complete = bool(
-            prior["first_name"] and prior["last_name"] and prior["beta_request_reason"]
-        )
-        if not was_already_complete:
-            notify.fan_out_new_beta_request(requester_user_id=user.user_id)
         return {"ok": True}
 
     # ---------------------------------------------------------------

backend/app/api_admin.py

@@ -50,16 +50,6 @@ class MuteBody(BaseModel):
     muted: bool
 
 
-class PermissionStateBody(BaseModel):
-    # v0.9.0: the admin flip from the user-management page (roadmap
-    # item #7). `pending` is not surfaceable from the admin UI —
-    # only the OTC verify path lands a row in `pending` — but we
-    # accept it in the pattern in case a future restore-to-queue
-    # gesture wants to re-pend a granted user; today the UI only
-    # exposes `granted` and `revoked`.
-    state: str = Field(pattern="^(pending|granted|revoked)$")
-
-
 class AllowlistAddBody(BaseModel):
     email: str = Field(min_length=3, max_length=320)
     note: str | None = Field(default=None, max_length=200)
@@ -78,41 +68,13 @@ def make_router(config: Config) -> APIRouter:
 
     @router.get("/api/admin/users")
     async def list_users(request: Request) -> dict[str, Any]:
-        """v0.9.0: the user-management surface (roadmap item #7).
-
-        The listing carries every column the admin queue needs to triage
-        pending beta-access requests alongside the existing role/mute
-        affordances. Sort order surfaces pending requests first (so the
-        admin lands on the inbox shape), then granted, then revoked;
-        within a state, ownership/role and recency are the tiebreakers
-        so the legacy ordering (owner first, then admin, then by name)
-        is preserved inside the granted bucket.
-
-        `permission_decided_by_login` joins the deciding admin row so
-        the UI can render "granted by @ben" without a second round-trip.
-        """
         auth.require_admin(request)
         rows = db.conn().execute(
             """
-            SELECT u.id, u.gitea_login, u.display_name, u.email, u.role, u.muted,
-                   u.created_at, u.last_seen_at,
-                   u.permission_state, u.first_name, u.last_name,
-                   u.beta_request_reason,
-                   u.permission_decided_by, u.permission_decided_at,
-                   d.gitea_login AS decided_by_login,
-                   d.display_name AS decided_by_display
-              FROM users u
-         LEFT JOIN users d ON d.id = u.permission_decided_by
-             ORDER BY
-                CASE u.permission_state
-                  WHEN 'pending' THEN 0
-                  WHEN 'granted' THEN 1
-                  WHEN 'revoked' THEN 2
-                  ELSE 3
-                END,
-                u.role = 'owner' DESC, u.role = 'admin' DESC,
-                COALESCE(u.last_seen_at, u.created_at) DESC,
-                u.display_name COLLATE NOCASE
+            SELECT id, gitea_login, display_name, email, role, muted,
+                   created_at, last_seen_at
+              FROM users
+             ORDER BY role = 'owner' DESC, role = 'admin' DESC, display_name COLLATE NOCASE
             """
         ).fetchall()
         return {
@@ -126,13 +88,6 @@ def make_router(config: Config) -> APIRouter:
                     "muted": bool(r["muted"]),
                     "created_at": r["created_at"],
                     "last_seen_at": r["last_seen_at"],
-                    "permission_state": r["permission_state"] or "granted",
-                    "first_name": r["first_name"] or "",
-                    "last_name": r["last_name"] or "",
-                    "beta_request_reason": r["beta_request_reason"] or "",
-                    "permission_decided_at": r["permission_decided_at"],
-                    "permission_decided_by_login": r["decided_by_login"],
-                    "permission_decided_by_display": r["decided_by_display"],
                 }
                 for r in rows
             ]
@@ -181,74 +136,6 @@ def make_router(config: Config) -> APIRouter:
         )
         return {"ok": True, "role": body.role, "changed": True}
 
-    # ----- Permission state (§6.1, v0.9.0 roadmap item #7) -----
-
-    @router.post("/api/admin/users/{user_id}/permission")
-    async def set_permission(user_id: int, body: PermissionStateBody, request: Request) -> dict[str, Any]:
-        """Flip a user's `permission_state` between pending/granted/revoked.
-
-        v0.8.0 wired the column shape but shipped no admin UI for it —
-        the grant gesture was a manual `UPDATE users` against the DB.
-        v0.9.0 (roadmap item #7) lands the admin user-management page;
-        this endpoint is its single write surface.
-
-        Audit shape: every flip writes a `permission_events` row with
-        event_kind in {'permission_granted', 'permission_revoked',
-        'permission_repended'} so §6.5's log carries the change. The
-        `permission_decided_by` / `permission_decided_at` columns on
-        the user row are co-stamped so the user listing can render
-        "granted by @ben at <date>" without a second join through
-        the audit table.
-
-        Refuses with 422 if the admin tries to flip their own row
-        (no self-grant / self-revoke; symmetric to set_mute's
-        self-mute refusal and set_role's self-downgrade refusal).
-        """
-        viewer = auth.require_admin(request)
-        target = db.conn().execute(
-            "SELECT id, role, permission_state FROM users WHERE id = ?",
-            (user_id,),
-        ).fetchone()
-        if target is None:
-            raise HTTPException(404, "User not found")
-        if target["id"] == viewer.user_id:
-            raise HTTPException(422, "You cannot change your own permission state")
-
-        before = target["permission_state"] or "granted"
-        after = body.state
-        if before == after:
-            return {"ok": True, "permission_state": after, "changed": False}
-
-        db.conn().execute(
-            """
-            UPDATE users
-               SET permission_state = ?,
-                   permission_decided_by = ?,
-                   permission_decided_at = datetime('now')
-             WHERE id = ?
-            """,
-            (after, viewer.user_id, user_id),
-        )
-        event_kind = {
-            "granted": "permission_granted",
-            "revoked": "permission_revoked",
-            "pending": "permission_repended",
-        }[after]
-        db.conn().execute(
-            """
-            INSERT INTO permission_events
-                (actor_user_id, subject_user_id, event_kind, details)
-            VALUES (?, ?, ?, ?)
-            """,
-            (
-                viewer.user_id,
-                user_id,
-                event_kind,
-                json.dumps({"before": before, "after": after}),
-            ),
-        )
-        return {"ok": True, "permission_state": after, "changed": True}
-
     # ----- Write-mute (§6.2) -----
 
     @router.post("/api/admin/users/{user_id}/mute")

backend/app/email.py

@@ -139,10 +139,6 @@ _EVENT_TO_CATEGORY: dict[str, str] = {
     "graduation_complete": "personal-direct",
     "super_draft_graduation_ready": "admin-actionable",
     "claim_opened": "structural",
-    # v0.9.0: roadmap item #7. A fresh beta-access request lands as
-    # an admin-actionable signal so it consults `email_admin_actionable`
-    # and reaches owners/admins only.
-    "new_beta_request": "admin-actionable",
 }
 
 
@@ -289,13 +285,6 @@ def _deep_link(payload: dict, cfg: EmailConfig) -> str:
     slug = payload.get("rfc_slug")
     pr = payload.get("pr_number")
     branch = payload.get("branch_name")
-    event_kind = payload.get("event_kind")
-    # v0.9.0: framework-scoped admin signals link to the admin
-    # surface, not /rfc/... The `new_beta_request` event is the
-    # canonical example; future framework-scoped admin events
-    # may reuse the same branch.
-    if event_kind == "new_beta_request":
-        return f"{cfg.app_url}/admin/users"
     if slug and pr:
         return f"{cfg.app_url}/rfc/{slug}/pr/{pr}"
     if slug and branch:

backend/app/main.py

@@ -27,7 +27,6 @@ from . import (
     otc,
     passcode as passcode_mod,
     providers as providers_mod,
-    turnstile,
     webhooks,
 )
 from .bot import Bot
@@ -40,14 +39,6 @@ log = logging.getLogger("rfc_app")
 
 class OtcRequestBody(BaseModel):
     email: str = Field(min_length=3, max_length=320)
-    # v0.12.0 / roadmap item #10: CloudFlare Turnstile token from the
-    # frontend widget. Optional in the body so a deployment that has
-    # not yet wired the Turnstile site key (or a dev environment with
-    # the widget intentionally skipped) still routes through the same
-    # endpoint; the backend turnstile.verify_token call decides whether
-    # to admit the request based on `TURNSTILE_REQUIRED` + presence of
-    # the secret.
-    turnstile_token: str | None = Field(default=None, max_length=4096)
 
 
 class OtcVerifyBody(BaseModel):
@@ -224,27 +215,7 @@ def _oauth_router(config) -> APIRouter:
     # ---------------------------------------------------------------
 
     @router.post("/auth/otc/request")
-    async def otc_request(body: OtcRequestBody, request: Request):
-        # v0.12.0 / roadmap item #10: gate the request on a successful
-        # Turnstile siteverify before the bcrypt hash + SMTP send. The
-        # check runs first so a failed challenge spends no rate budget
-        # and produces no envelope. When the operator has not wired the
-        # secret AND TURNSTILE_REQUIRED=false (the default), the gate
-        # opens — see `backend/app/turnstile.py` for the full matrix.
-        client_ip = request.client.host if request.client else None
-        ts = turnstile.verify_token(body.turnstile_token, client_ip=client_ip)
-        if not ts.ok:
-            if ts.reason == "misconfigured":
-                # TURNSTILE_REQUIRED=true but the secret is unset. This
-                # is an operator/config problem, not a client problem;
-                # surface as 500 so the operator notices in their logs
-                # rather than blaming the user's browser.
-                raise HTTPException(500, "auth misconfigured")
-            # missing-token / failed / network → uniform 400 so the
-            # response does not enumerate which leg of the challenge
-            # broke. The reason is in the server logs.
-            raise HTTPException(400, "verification failed")
-
+    async def otc_request(body: OtcRequestBody):
         outcome = otc.request_code(body.email)
         if outcome.reason == "cooldown":
             # Loud failure per the rate-limit primitive — the abuse

backend/app/notify.py

@@ -64,7 +64,6 @@ log = logging.getLogger(__name__)
 CATEGORY_PERSONAL = "personal-direct"
 CATEGORY_STRUCTURAL = "structural"
 CATEGORY_CHURN = "churn"
-CATEGORY_ADMIN_ACTIONABLE = "admin-actionable"
 
 # Action kinds whose actor's first interaction with a slug triggers
 # auto-watch per §15.6. The substantive-gesture list in the spec is
@@ -209,67 +208,6 @@ def fan_out_from_action(
             )
 
 
-def fan_out_new_beta_request(
-    *,
-    requester_user_id: int,
-) -> None:
-    """v0.9.0 (roadmap item #7): announce a fresh beta-access request to
-    every admin/owner.
-
-    Called from `POST /api/auth/me/beta-request` after the row's
-    first/last/why fields are populated. Fan-out shape mirrors the §15
-    chokepoint contract: one row per recipient, written via `_emit_one`
-    so the SSE broadcast + email dispatch run through the same surface
-    every other notification uses. The event has no rfc_slug (it is
-    framework-scoped, not RFC-scoped); the deep-link payload points
-    `/admin/users` instead of `/rfc/<slug>`.
-
-    Actor is the requester per §15.9 (the underlying user, never the
-    bot). Category is `admin-actionable` so the §15.4 email gate
-    consults `email_admin_actionable` (owners/admins-only by
-    construction) and the digest exclusion rules treat it identically
-    to other admin-actionable signals (graduation_ready et al).
-
-    Recipients are owners + admins minus the requester themselves
-    (a self-promotion shouldn't reach the requester's own inbox). The
-    requester is never in the role set in practice — the endpoint
-    refuses 'granted'/'revoked' callers and a fresh OTC user lands
-    `contributor`+`pending` — but we filter regardless so the call
-    is robust to future changes in the auth gate.
-    """
-    requester = db.conn().execute(
-        "SELECT first_name, last_name, email, display_name FROM users WHERE id = ?",
-        (requester_user_id,),
-    ).fetchone()
-    if requester is None:
-        return
-    first = (requester["first_name"] or "").strip()
-    last = (requester["last_name"] or "").strip()
-    email = requester["email"] or ""
-    display = requester["display_name"] or email or "a new user"
-    full_name = (f"{first} {last}").strip() or display
-    details = {
-        "requester_user_id": requester_user_id,
-        "requester_first_name": first,
-        "requester_last_name": last,
-        "requester_email": email,
-        "requester_display": full_name,
-    }
-    for recipient_id in _admin_user_ids():
-        if recipient_id == requester_user_id:
-            continue
-        _emit_one(
-            recipient_user_id=recipient_id,
-            event_kind="new_beta_request",
-            category=CATEGORY_ADMIN_ACTIONABLE,
-            actor_user_id=requester_user_id,
-            rfc_slug=None,
-            branch_name=None,
-            pr_number=None,
-            details=details,
-        )
-
-
 def fan_out_chat_message(
     *,
     actor_user_id: int,
@@ -769,16 +707,6 @@ def render_summary(event_kind: str, actor_display: str | None, rfc_title: str |
         return f"{actor} began graduating {title}."
     if event_kind == "pr_conflict_with_main":
         return f"{actor} started a resolution branch on {title}."
-    if event_kind == "new_beta_request":
-        # v0.9.0: framework-scoped, not RFC-scoped. The actor (the
-        # requester) and the captured full name + email read as
-        # one self-contained sentence; the inbox row and the email
-        # body share this text per §15.4.
-        full_name = extras.get("requester_display") or actor
-        email_addr = extras.get("requester_email") or ""
-        if email_addr:
-            return f"New beta-access request from {full_name} ({email_addr})."
-        return f"New beta-access request from {full_name}."
     return f"{event_kind} on {title}"
 
 

backend/app/turnstile.py

@@ -1,148 +0,0 @@
-"""§6.2 / v0.12.0 / roadmap item #10: CloudFlare Turnstile siteverify.
-
-The OTC request endpoint (`/auth/otc/request`) is the abuse hot path
-of the auth surface since v0.7.0 — the per-email cooldown stops the
-trivial back-to-back loop, but it does not stop a distributed scraper
-that fans out across a large invitee list to harvest the "this email
-is admitted vs. this email is not" signal indirectly (timing
-differences, SMTP bounce-rate observation). v0.12.0 gates the request
-endpoint behind a one-step browser-side Turnstile challenge before the
-bcrypt hash + SMTP send.
-
-Stateless: no DB writes, no schema change. The siteverify call to
-CloudFlare lives entirely in this module; the endpoint handler in
-`main.py` thin-wraps `verify_token`.
-
-Tunables (read at call time so tests can monkeypatch):
-
-  * `CLOUDFLARE_TURNSTILE_SECRET`  — the operator-provisioned secret
-    key from the Turnstile dashboard. Lives in GCP Secret Manager in
-    production; absent in tests (which monkeypatch the siteverify
-    transport). When unset, the behavior depends on `TURNSTILE_REQUIRED`:
-      - `TURNSTILE_REQUIRED=true`  → fail closed (`misconfigured`).
-      - `TURNSTILE_REQUIRED=false` (default) → skip verification entirely
-        and admit the request. This is the dev/test path and the
-        "operator hasn't wired the secret yet" path; production
-        deployments **should** set `TURNSTILE_REQUIRED=true` once the
-        secret is in place so a regression in the secret wiring fails
-        loudly instead of silently disabling abuse defense.
-
-  * `TURNSTILE_REQUIRED`           — `true` / `false` (default `false`).
-    When `false` and the secret is absent, the gate is open. When
-    `true` and the secret is absent, the endpoint refuses with a
-    misconfigured-auth shape rather than silently letting requests
-    through.
-
-  * `TURNSTILE_SITEVERIFY_URL`     — points at the real CloudFlare
-    endpoint by default. Override in tests to redirect at a mock
-    URL when `httpx.MockTransport` isn't ergonomic for the case.
-
-The siteverify contract is documented at
-https://developers.cloudflare.com/turnstile/get-started/server-side-validation/.
-We POST `secret` + `response` (and optionally `remoteip`) as form
-fields and read back `{"success": true|false, ...}`. Any network /
-parse failure on the siteverify call is treated as a verification
-failure (`network`) — the abuse path is to skip the challenge, so
-"can't reach CloudFlare" defaults to "refuse the request" when
-`TURNSTILE_REQUIRED=true`, and "admit" when `TURNSTILE_REQUIRED=false`.
-"""
-from __future__ import annotations
-
-import logging
-import os
-from dataclasses import dataclass
-
-import httpx
-
-log = logging.getLogger(__name__)
-
-
-SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify"
-
-
-def _secret() -> str:
-    return os.environ.get("CLOUDFLARE_TURNSTILE_SECRET", "").strip()
-
-
-def _required() -> bool:
-    raw = os.environ.get("TURNSTILE_REQUIRED", "").strip().lower()
-    return raw in ("1", "true", "yes", "on")
-
-
-def _siteverify_url() -> str:
-    return os.environ.get("TURNSTILE_SITEVERIFY_URL", "").strip() or SITEVERIFY_URL
-
-
-@dataclass
-class VerifyOutcome:
-    """Result of a Turnstile siteverify call.
-
-    `ok`: the request **may proceed**. True both for "siteverify said
-    success" and for "no secret configured AND not required" (the
-    dev/test soft-fail path).
-
-    `reason`: one of
-      * 'ok'             — siteverify returned success.
-      * 'skipped'        — no secret configured, TURNSTILE_REQUIRED=false.
-                            The gate is open; the endpoint admits the request.
-      * 'misconfigured'  — TURNSTILE_REQUIRED=true but no secret in env.
-                            The endpoint fails closed with 500.
-      * 'missing-token'  — the client did not send a token at all and
-                            verification is required.
-      * 'failed'         — siteverify returned success=false. The
-                            endpoint refuses with 400.
-      * 'network'        — siteverify call raised. Treated as a failure
-                            under TURNSTILE_REQUIRED=true.
-    """
-    ok: bool
-    reason: str
-
-
-def verify_token(token: str | None, *, client_ip: str | None = None) -> VerifyOutcome:
-    """Validate a Turnstile token against CloudFlare's siteverify endpoint.
-
-    Returns a VerifyOutcome describing whether the calling endpoint
-    should proceed. The endpoint maps `ok=False` to an HTTP status per
-    the `reason`:
-
-      * 'misconfigured' → 500 "auth misconfigured"
-      * 'missing-token' / 'failed' / 'network' → 400 "verification failed"
-
-    Tests monkeypatch `httpx.post` (or set `TURNSTILE_SITEVERIFY_URL`
-    + a MockTransport client) to avoid touching the real CloudFlare
-    endpoint. No real keys are ever embedded in tests.
-    """
-    secret = _secret()
-    required = _required()
-
-    if not secret:
-        if required:
-            log.warning("Turnstile required but CLOUDFLARE_TURNSTILE_SECRET is unset; failing closed")
-            return VerifyOutcome(ok=False, reason="misconfigured")
-        # Dev/test/soft-fail path: no secret, not required → gate is open.
-        return VerifyOutcome(ok=True, reason="skipped")
-
-    if not token or not token.strip():
-        # Secret is set, so verification is in force. A missing token
-        # is a hard refuse — the frontend should have rendered the
-        # widget and collected one.
-        return VerifyOutcome(ok=False, reason="missing-token")
-
-    data = {"secret": secret, "response": token.strip()}
-    if client_ip:
-        data["remoteip"] = client_ip
-
-    try:
-        response = httpx.post(_siteverify_url(), data=data, timeout=10.0)
-        payload = response.json()
-    except Exception as exc:  # network, JSON parse, etc.
-        log.warning("Turnstile siteverify call failed: %s", exc)
-        return VerifyOutcome(ok=False, reason="network")
-
-    if payload.get("success") is True:
-        return VerifyOutcome(ok=True, reason="ok")
-
-    # `error-codes` is a list of strings on failure; we log the codes
-    # for the operator without surfacing them to the client.
-    log.info("Turnstile siteverify rejected token: %s", payload.get("error-codes"))
-    return VerifyOutcome(ok=False, reason="failed")

backend/tests/test_admin_users_vertical.py

@@ -1,425 +0,0 @@
-"""End-to-end integration tests for v0.9.0's admin user-management page
-and new-beta-request notifications (roadmap item #7, §6.1 / §15).
-
-The release lands two halves of the same surface:
-
-  * **Admin notification on new beta request.** When a pending user
-    submits `POST /api/auth/me/beta-request`, every owner/admin
-    receives a `new_beta_request` notification (the §15 substrate
-    insert lands the row; the §15.4 email path dispatches subject to
-    the recipient's `email_admin_actionable` toggle).
-
-  * **Admin user-management surface** at `/admin/users`. The
-    `GET /api/admin/users` listing carries every user with their
-    permission_state, profile fields, sign-up reason, and decision
-    audit. The new `POST /api/admin/users/<id>/permission` endpoint
-    flips the column and writes a `permission_events` row.
-
-The tests prove:
-
-  * The first beta-request submission fans a `new_beta_request`
-    row out to every admin/owner (and not to the requester
-    themselves). The row carries the captured profile in
-    `payload.extras`.
-  * Re-submitting the form from the same pending user doesn't
-    re-fan (we only notify on the row's first complete state).
-  * `GET /api/admin/users` carries the v0.9.0 columns
-    (permission_state, first/last/reason, decided_by).
-  * `POST /api/admin/users/<id>/permission` flips the state,
-    stamps decided_by/at, and writes a `permission_events` row.
-  * The endpoint refuses self-flip (422) and refuses non-admin
-    callers (403).
-  * The endpoint accepts only the three valid states (422 on
-    anything else).
-"""
-from __future__ import annotations
-
-from test_propose_vertical import (  # noqa: F401 — fixtures land via import
-    FakeGitea,
-    app_with_fake_gitea,
-    provision_user_row,
-    sign_in_as,
-    tmp_env,
-)
-
-
-def _reset_outbound():
-    from app import email as email_mod
-    email_mod.reset_sent_envelopes()
-
-
-def _outbound_otc_codes(to_address: str | None = None) -> list[str]:
-    from app import email as email_mod
-    out = []
-    for env in email_mod.sent_envelopes():
-        if env.get("kind") != "otc":
-            continue
-        if to_address is not None and env["to"] != to_address:
-            continue
-        for line in env["body"].splitlines():
-            tok = line.strip()
-            if tok.isdigit() and len(tok) == 6:
-                out.append(tok)
-                break
-    return out
-
-
-def _provision_pending_user(client, email: str) -> int:
-    """Sign in a fresh OTC user (lands `pending`) and return their user_id."""
-    from app import db
-    _reset_outbound()
-    client.post("/auth/otc/request", json={"email": email})
-    code = _outbound_otc_codes(email)[-1]
-    client.post("/auth/otc/verify", json={"email": email, "code": code})
-    row = db.conn().execute(
-        "SELECT id FROM users WHERE email = ? COLLATE NOCASE", (email,)
-    ).fetchone()
-    return row["id"]
-
-
-# ---------------------------------------------------------------------------
-# Admin notification on beta-request submission
-# ---------------------------------------------------------------------------
-
-
-def test_beta_request_submission_notifies_every_admin(app_with_fake_gitea):
-    """First-time submission of a beta-request fans a notification out
-    to every owner and admin. The requester themselves never receives
-    a row (filtered out by user_id even if they happened to be in the
-    admin set, which they aren't in practice — fresh OTC users are
-    `contributor`+`pending`)."""
-    from fastapi.testclient import TestClient
-    from app import db
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        # Provision two admins and one owner so the fan-out has multiple
-        # targets. The OWNER_GITEA_LOGIN-derived ownership doesn't fire
-        # here (no OAuth round-trip in this path); we seed the role
-        # directly.
-        provision_user_row(user_id=10, login="ownerzero", role="owner")
-        provision_user_row(user_id=11, login="admin_one", role="admin")
-        provision_user_row(user_id=12, login="admin_two", role="admin")
-        provision_user_row(user_id=13, login="contrib_one", role="contributor")
-
-        # Sign in a fresh OTC user → permission_state='pending'.
-        requester_id = _provision_pending_user(client, "newbie@example.com")
-
-        # Capture-form submit.
-        r = client.post(
-            "/api/auth/me/beta-request",
-            json={
-                "first_name": "Newt",
-                "last_name": "Newcomer",
-                "beta_request_reason": "I want to write the Human RFC.",
-            },
-        )
-        assert r.status_code == 200, r.text
-
-        # Every owner + admin gets a `new_beta_request` notification.
-        # The contributor (id=13) does not. The requester (whoever id
-        # they got) does not.
-        rows = db.conn().execute(
-            """
-            SELECT recipient_user_id, event_kind, actor_user_id, payload
-              FROM notifications
-             WHERE event_kind = 'new_beta_request'
-            """
-        ).fetchall()
-        recipients = sorted(r["recipient_user_id"] for r in rows)
-        assert recipients == [10, 11, 12], f"unexpected recipients: {recipients}"
-        # Actor is the requester (§15.9: never the bot).
-        for r in rows:
-            assert r["actor_user_id"] == requester_id
-            import json as _json
-            extras = _json.loads(r["payload"])
-            assert extras["requester_first_name"] == "Newt"
-            assert extras["requester_last_name"] == "Newcomer"
-            assert extras["requester_email"] == "newbie@example.com"
-
-
-def test_beta_request_resubmit_does_not_re_notify(app_with_fake_gitea):
-    """Once a user has completed the capture form, re-submitting it
-    (the endpoint is idempotent for pending users) must not re-fan a
-    fresh notification to every admin — that would carpet-bomb the
-    inbox on every typo correction."""
-    from fastapi.testclient import TestClient
-    from app import db
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        provision_user_row(user_id=20, login="adminzero", role="admin")
-        _provision_pending_user(client, "carpet@example.com")
-
-        body = {
-            "first_name": "Carpet",
-            "last_name": "Bomb",
-            "beta_request_reason": "first draft",
-        }
-        r1 = client.post("/api/auth/me/beta-request", json=body)
-        assert r1.status_code == 200
-
-        # Re-submit with edited reason — endpoint accepts (idempotent
-        # update), but the admin inbox stays at one row.
-        body2 = dict(body, beta_request_reason="cleaner final draft")
-        r2 = client.post("/api/auth/me/beta-request", json=body2)
-        assert r2.status_code == 200
-
-        rows = db.conn().execute(
-            "SELECT COUNT(*) AS n FROM notifications WHERE event_kind = 'new_beta_request'"
-        ).fetchone()
-        assert rows["n"] == 1
-
-
-def test_beta_request_notification_is_admin_actionable_category(app_with_fake_gitea):
-    """The §15.4 category mapping must route `new_beta_request` to the
-    admin-actionable bucket so the email gate consults
-    `email_admin_actionable` (and skips for non-admin recipients).
-    """
-    from app import email as email_mod
-
-    assert email_mod.category_for("new_beta_request", "structural") == "admin-actionable"
-
-
-# ---------------------------------------------------------------------------
-# /api/admin/users — listing carries the v0.9.0 columns
-# ---------------------------------------------------------------------------
-
-
-def test_admin_users_listing_carries_permission_columns(app_with_fake_gitea):
-    """The Users tab consumes this shape — confirm every required
-    column is on the response."""
-    from fastapi.testclient import TestClient
-    from app import db
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        # Seed an admin and a pending user with all the v0.8.0 columns
-        # populated. Direct-DB insert avoids the OTC dance (which would
-        # overwrite the cookie); the test above proves the capture
-        # pathway end-to-end and this one just exercises the listing
-        # surface's shape.
-        provision_user_row(user_id=30, login="ben", role="owner")
-        db.conn().execute(
-            """
-            INSERT INTO users (id, gitea_id, gitea_login, email,
-                               display_name, avatar_url, role,
-                               permission_state, first_name, last_name,
-                               beta_request_reason)
-            VALUES (31, NULL, NULL, 'pendinguser@example.com',
-                    'pendinguser', '', 'contributor',
-                    'pending', 'Penn', 'Ding', 'I want in.')
-            """
-        )
-
-        sign_in_as(
-            client, user_id=30, gitea_login="ben",
-            display_name="Ben", role="owner",
-        )
-
-        r = client.get("/api/admin/users")
-        assert r.status_code == 200
-        items = r.json()["items"]
-        assert isinstance(items, list)
-        pending = next(
-            (i for i in items if i["email"] == "pendinguser@example.com"), None,
-        )
-        assert pending is not None
-        assert pending["permission_state"] == "pending"
-        assert pending["first_name"] == "Penn"
-        assert pending["last_name"] == "Ding"
-        assert pending["beta_request_reason"] == "I want in."
-        assert pending["permission_decided_at"] is None
-        assert pending["permission_decided_by_login"] is None
-        # Pending bucket is listed first (sort order).
-        assert items[0]["permission_state"] == "pending"
-
-
-# ---------------------------------------------------------------------------
-# /api/admin/users/<id>/permission — the flip endpoint
-# ---------------------------------------------------------------------------
-
-
-def test_permission_flip_grant_promotes_pending_to_granted(app_with_fake_gitea):
-    """The end-to-end gesture: a fresh OTC user lands pending, an admin
-    flips them to granted via the endpoint, the row reflects the new
-    state + decided_by/at, and a `permission_events` audit row lands."""
-    from fastapi.testclient import TestClient
-    from app import db
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        # Pending user.
-        pending_id = _provision_pending_user(client, "flip@example.com")
-
-        # Admin acting on them.
-        provision_user_row(user_id=40, login="adminflipper", role="admin")
-        sign_in_as(
-            client, user_id=40, gitea_login="adminflipper",
-            display_name="Admin Flipper", role="admin",
-        )
-
-        r = client.post(
-            f"/api/admin/users/{pending_id}/permission",
-            json={"state": "granted"},
-        )
-        assert r.status_code == 200, r.text
-        body = r.json()
-        assert body["permission_state"] == "granted"
-        assert body["changed"] is True
-
-        # Row reflects the new state + decision stamp.
-        row = db.conn().execute(
-            "SELECT permission_state, permission_decided_by, permission_decided_at "
-            "FROM users WHERE id = ?",
-            (pending_id,),
-        ).fetchone()
-        assert row["permission_state"] == "granted"
-        assert row["permission_decided_by"] == 40
-        assert row["permission_decided_at"] is not None
-
-        # Audit row landed in permission_events.
-        events = db.conn().execute(
-            """
-            SELECT actor_user_id, subject_user_id, event_kind
-              FROM permission_events
-             WHERE event_kind = 'permission_granted'
-            """
-        ).fetchall()
-        assert len(events) == 1
-        assert events[0]["actor_user_id"] == 40
-        assert events[0]["subject_user_id"] == pending_id
-
-
-def test_permission_flip_revoke_promotes_granted_to_revoked(app_with_fake_gitea):
-    """Revoke is the symmetric gesture. Used when an account earned a
-    grant then later lost it (§6.1 / `revoked` state)."""
-    from fastapi.testclient import TestClient
-    from app import db
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        provision_user_row(user_id=50, login="goner", role="contributor")
-        # Default permission_state is 'granted' via the column default.
-        provision_user_row(user_id=51, login="adminrevoker", role="admin")
-        sign_in_as(
-            client, user_id=51, gitea_login="adminrevoker",
-            display_name="Admin Revoker", role="admin",
-        )
-
-        r = client.post(
-            "/api/admin/users/50/permission",
-            json={"state": "revoked"},
-        )
-        assert r.status_code == 200, r.text
-
-        row = db.conn().execute(
-            "SELECT permission_state FROM users WHERE id = 50"
-        ).fetchone()
-        assert row["permission_state"] == "revoked"
-
-        events = db.conn().execute(
-            "SELECT event_kind FROM permission_events "
-            "WHERE event_kind = 'permission_revoked' AND subject_user_id = 50"
-        ).fetchall()
-        assert len(events) == 1
-
-
-def test_permission_flip_refuses_self(app_with_fake_gitea):
-    """Symmetric to set_mute / set_role: an admin can't self-flip.
-    The state-change channel for one's own grant is somebody else's
-    hand."""
-    from fastapi.testclient import TestClient
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        provision_user_row(user_id=60, login="selfflipper", role="admin")
-        sign_in_as(
-            client, user_id=60, gitea_login="selfflipper",
-            display_name="Self Flipper", role="admin",
-        )
-        r = client.post(
-            "/api/admin/users/60/permission",
-            json={"state": "revoked"},
-        )
-        assert r.status_code == 422
-
-
-def test_permission_flip_refuses_non_admin(app_with_fake_gitea):
-    """The endpoint is admin-only (§17 admin/* requires require_admin).
-    A contributor caller is refused 403; an anonymous caller 401."""
-    from fastapi.testclient import TestClient
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        provision_user_row(user_id=70, login="target", role="contributor")
-        provision_user_row(user_id=71, login="contrib", role="contributor")
-        sign_in_as(
-            client, user_id=71, gitea_login="contrib",
-            display_name="Contrib", role="contributor",
-        )
-        r = client.post(
-            "/api/admin/users/70/permission",
-            json={"state": "granted"},
-        )
-        assert r.status_code == 403
-
-        client.cookies.clear()
-        r = client.post(
-            "/api/admin/users/70/permission",
-            json={"state": "granted"},
-        )
-        assert r.status_code == 401
-
-
-def test_permission_flip_refuses_invalid_state(app_with_fake_gitea):
-    """Pydantic regex pattern refuses anything outside the three
-    canonical states with 422."""
-    from fastapi.testclient import TestClient
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        provision_user_row(user_id=80, login="targetx", role="contributor")
-        provision_user_row(user_id=81, login="adminx", role="admin")
-        sign_in_as(
-            client, user_id=81, gitea_login="adminx",
-            display_name="Admin X", role="admin",
-        )
-        r = client.post(
-            "/api/admin/users/80/permission",
-            json={"state": "banished"},
-        )
-        assert r.status_code == 422
-
-
-def test_permission_flip_no_op_when_state_already_matches(app_with_fake_gitea):
-    """An admin flipping a granted user to granted gets 200 with
-    `changed: false` — no audit row, no decided_at update."""
-    from fastapi.testclient import TestClient
-    from app import db
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        provision_user_row(user_id=90, login="alreadygranted", role="contributor")
-        provision_user_row(user_id=91, login="adminN", role="admin")
-        sign_in_as(
-            client, user_id=91, gitea_login="adminN",
-            display_name="Admin N", role="admin",
-        )
-
-        before_events = db.conn().execute(
-            "SELECT COUNT(*) AS n FROM permission_events"
-        ).fetchone()["n"]
-
-        r = client.post(
-            "/api/admin/users/90/permission",
-            json={"state": "granted"},
-        )
-        assert r.status_code == 200
-        body = r.json()
-        assert body["changed"] is False
-
-        after_events = db.conn().execute(
-            "SELECT COUNT(*) AS n FROM permission_events"
-        ).fetchone()["n"]
-        assert after_events == before_events

backend/tests/test_turnstile_vertical.py

@@ -1,220 +0,0 @@
-"""End-to-end integration tests for the v0.12.0 CloudFlare Turnstile
-gate on `/auth/otc/request` (§6.2 / roadmap item #10).
-
-The release gates the OTC request endpoint behind a one-step
-browser-side Turnstile challenge before the bcrypt hash + SMTP send.
-The tests prove:
-
-  * Happy path: with the secret set, a valid token admits the request
-    and the OTC envelope lands.
-  * Failure path: with the secret set, a token siteverify rejects
-    refuses the request with 400 and produces no envelope.
-  * Missing-token: with the secret set, a request without a token
-    refuses with 400.
-  * Missing-secret-soft: with the secret unset AND
-    `TURNSTILE_REQUIRED=false` (the v0.12.0 default), the request
-    admits — this is the dev / "operator hasn't wired it yet" path.
-  * Missing-secret-hard: with the secret unset AND
-    `TURNSTILE_REQUIRED=true`, the request refuses with 500
-    "auth misconfigured" — the production fail-closed path once
-    the operator has flipped the policy.
-
-The Turnstile siteverify call is mocked at the `httpx.post` boundary
-inside `app.turnstile` so no real keys are needed and no real
-CloudFlare call is made. The Gitea fakes from `test_propose_vertical`
-remain in scope so the rest of the app boots cleanly.
-"""
-from __future__ import annotations
-
-from types import SimpleNamespace
-
-import pytest
-
-from test_propose_vertical import (  # noqa: F401
-    FakeGitea,
-    app_with_fake_gitea,
-    tmp_env,
-)
-
-
-def _reset_outbound():
-    from app import email as email_mod
-    email_mod.reset_sent_envelopes()
-
-
-def _outbound_otc_envelopes(to_address: str | None = None) -> list[dict]:
-    from app import email as email_mod
-    out = []
-    for env in email_mod.sent_envelopes():
-        if env.get("kind") != "otc":
-            continue
-        if to_address is not None and env["to"] != to_address:
-            continue
-        out.append(env)
-    return out
-
-
-def _patch_siteverify(monkeypatch, *, success: bool, error_codes: list[str] | None = None):
-    """Replace `httpx.post` inside `app.turnstile` with a stub that
-    returns the requested success shape. The stub does not touch the
-    real CloudFlare endpoint and never sees a real secret.
-    """
-    captured = {}
-
-    def fake_post(url, *, data=None, timeout=None, **kwargs):
-        captured["url"] = url
-        captured["data"] = data
-        body = {"success": bool(success)}
-        if error_codes is not None:
-            body["error-codes"] = error_codes
-        return SimpleNamespace(json=lambda: body)
-
-    from app import turnstile as turnstile_mod
-    monkeypatch.setattr(turnstile_mod.httpx, "post", fake_post)
-    return captured
-
-
-# ---------------------------------------------------------------------------
-# Happy path: secret set, token valid → admit + OTC envelope lands
-# ---------------------------------------------------------------------------
-
-
-def test_otc_request_admits_when_turnstile_token_is_valid(app_with_fake_gitea, monkeypatch):
-    from fastapi.testclient import TestClient
-
-    monkeypatch.setenv("CLOUDFLARE_TURNSTILE_SECRET", "test-secret-not-real")
-    monkeypatch.setenv("TURNSTILE_REQUIRED", "true")
-    captured = _patch_siteverify(monkeypatch, success=True)
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        _reset_outbound()
-        r = client.post(
-            "/auth/otc/request",
-            json={"email": "alice@example.com", "turnstile_token": "fake-token-abc"},
-        )
-        assert r.status_code == 200, r.text
-        # The siteverify call was made with the secret + the token we sent.
-        assert captured["data"]["secret"] == "test-secret-not-real"
-        assert captured["data"]["response"] == "fake-token-abc"
-        # And the OTC dispatch ran — exactly one envelope to the address.
-        envs = _outbound_otc_envelopes("alice@example.com")
-        assert len(envs) == 1
-
-
-# ---------------------------------------------------------------------------
-# Failure path: secret set, siteverify says success=false → 400 + no envelope
-# ---------------------------------------------------------------------------
-
-
-def test_otc_request_refuses_when_turnstile_siteverify_fails(app_with_fake_gitea, monkeypatch):
-    from fastapi.testclient import TestClient
-
-    monkeypatch.setenv("CLOUDFLARE_TURNSTILE_SECRET", "test-secret-not-real")
-    monkeypatch.setenv("TURNSTILE_REQUIRED", "true")
-    _patch_siteverify(monkeypatch, success=False, error_codes=["invalid-input-response"])
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        _reset_outbound()
-        r = client.post(
-            "/auth/otc/request",
-            json={"email": "alice@example.com", "turnstile_token": "fake-bad-token"},
-        )
-        assert r.status_code == 400, r.text
-        # The OTC bcrypt + SMTP path did not run — no envelope was buffered.
-        assert _outbound_otc_envelopes("alice@example.com") == []
-
-
-# ---------------------------------------------------------------------------
-# Missing-token: secret set, no token → 400 + no envelope
-# ---------------------------------------------------------------------------
-
-
-def test_otc_request_refuses_when_turnstile_token_is_missing(app_with_fake_gitea, monkeypatch):
-    from fastapi.testclient import TestClient
-
-    monkeypatch.setenv("CLOUDFLARE_TURNSTILE_SECRET", "test-secret-not-real")
-    monkeypatch.setenv("TURNSTILE_REQUIRED", "true")
-    # Even though we patch httpx.post, the missing-token check fires
-    # before the siteverify call — so the patch is here only as a
-    # safety net in case the implementation regresses to making the
-    # network call anyway.
-    _patch_siteverify(monkeypatch, success=False)
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        _reset_outbound()
-        r = client.post(
-            "/auth/otc/request",
-            json={"email": "alice@example.com"},  # no turnstile_token field at all
-        )
-        assert r.status_code == 400, r.text
-        assert _outbound_otc_envelopes("alice@example.com") == []
-
-
-# ---------------------------------------------------------------------------
-# Missing-secret-soft: no secret, TURNSTILE_REQUIRED=false (default) → admit
-# ---------------------------------------------------------------------------
-
-
-def test_otc_request_admits_when_secret_unset_and_not_required(app_with_fake_gitea, monkeypatch):
-    """v0.12.0 default: the operator has not yet wired the Turnstile
-    secret and has not enabled `TURNSTILE_REQUIRED`. The gate stays
-    open — this is the dev / test / pre-rollout path. Once the
-    operator confirms the secret is in place and flips
-    `TURNSTILE_REQUIRED=true`, missing-secret becomes fail-closed
-    (covered in test_otc_request_refuses_when_required_but_secret_unset).
-    """
-    from fastapi.testclient import TestClient
-
-    monkeypatch.delenv("CLOUDFLARE_TURNSTILE_SECRET", raising=False)
-    monkeypatch.delenv("TURNSTILE_REQUIRED", raising=False)
-    # The httpx.post inside turnstile must not be called in this path —
-    # patch it to a sentinel that explodes if it ever runs.
-    from app import turnstile as turnstile_mod
-
-    def must_not_be_called(*a, **kw):
-        raise AssertionError("siteverify should not run when no secret is configured")
-
-    monkeypatch.setattr(turnstile_mod.httpx, "post", must_not_be_called)
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        _reset_outbound()
-        r = client.post(
-            "/auth/otc/request",
-            json={"email": "alice@example.com"},
-        )
-        assert r.status_code == 200, r.text
-        # The OTC path ran end-to-end — one envelope to the address.
-        assert len(_outbound_otc_envelopes("alice@example.com")) == 1
-
-
-# ---------------------------------------------------------------------------
-# Missing-secret-hard: no secret, TURNSTILE_REQUIRED=true → 500 "misconfigured"
-# ---------------------------------------------------------------------------
-
-
-def test_otc_request_refuses_when_required_but_secret_unset(app_with_fake_gitea, monkeypatch):
-    """Once the operator has flipped `TURNSTILE_REQUIRED=true` to lock
-    down production, a missing secret stops being a soft-fail and
-    becomes a fail-closed 500. This is the regression-detection shape
-    the §20.4 upgrade-steps MAY block calls out — flip the flag once
-    the secret is wired so a future config drift fails loudly instead
-    of silently disabling abuse defense.
-    """
-    from fastapi.testclient import TestClient
-
-    monkeypatch.delenv("CLOUDFLARE_TURNSTILE_SECRET", raising=False)
-    monkeypatch.setenv("TURNSTILE_REQUIRED", "true")
-
-    app, _fake = app_with_fake_gitea
-    with TestClient(app) as client:
-        _reset_outbound()
-        r = client.post(
-            "/auth/otc/request",
-            json={"email": "alice@example.com", "turnstile_token": "doesnt-matter"},
-        )
-        assert r.status_code == 500, r.text
-        assert _outbound_otc_envelopes("alice@example.com") == []

frontend/.env.example

@@ -49,39 +49,3 @@ VITE_PRIVACY_POLICY_URL=
 # Examples:
 #   VITE_COOKIES_POLICY_URL=https://wiggleverse.org/cookies
 VITE_COOKIES_POLICY_URL=
-
-# v0.12.0 / roadmap item #10: CloudFlare Turnstile site key (public).
-# Provision a Turnstile site at dash.cloudflare.com → Turnstile → Add
-# site. The site key (this var) is embedded into the frontend bundle at
-# build time and rendered by the Turnstile widget on the /login email-
-# entry step. The secret key (private) lives in the backend env as
-# CLOUDFLARE_TURNSTILE_SECRET — see backend/.env.example. Leave unset
-# in dev to skip the widget; the backend's TURNSTILE_REQUIRED policy
-# decides what happens to a tokenless request.
-#
-# Examples:
-#   VITE_TURNSTILE_SITE_KEY=0x4AAAAAAA...
-VITE_TURNSTILE_SITE_KEY=
-
-# v0.15.0 / roadmap item #13: Amplitude project API key (public).
-# Embedded in the frontend bundle at build time and used by the
-# analytics wrapper (`frontend/src/lib/analytics.js`) — which loads
-# `@amplitude/unified` (Analytics + Session Replay) when the user
-# has granted analytics consent (v0.13.0 cookie banner). Provision
-# an Amplitude project at app.amplitude.com → Projects → New, copy
-# the API key.
-#
-# Public by design: Amplitude browser keys are bundle-embedded
-# (visible in dev tools), same nature as VITE_TURNSTILE_SITE_KEY
-# (also public; the truly-secret half of that Turnstile pair is
-# CLOUDFLARE_TURNSTILE_SECRET on the backend). For deployments
-# behind flotilla, bind via `flotilla overlay set <deployment>
-# VITE_AMPLITUDE_API_KEY=<key>` — NOT `flotilla secret set`. The
-# vendor's installation wizard shows the key inline as a literal
-# string in the init call, confirming the public framing. Leave
-# unset in dev; the wrapper logs one console warning and no-ops
-# (the app continues to work).
-#
-# Examples:
-#   VITE_AMPLITUDE_API_KEY=01234567890abcdef01234567890abcd
-VITE_AMPLITUDE_API_KEY=

frontend/package-lock.json

@@ -1,14 +1,13 @@
 {
   "name": "rfc-app-frontend",
-  "version": "0.15.0",
+  "version": "0.11.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "rfc-app-frontend",
-      "version": "0.15.0",
+      "version": "0.11.0",
       "dependencies": {
-        "@amplitude/unified": "^1.1.9",
         "@codemirror/commands": "^6.10.3",
         "@codemirror/lang-markdown": "^6.5.0",
         "@codemirror/language": "^6.12.3",
@@ -31,360 +30,6 @@
         "vite": "^8.0.12"
       }
     },
-    "node_modules/@amplitude/analytics-browser": {
-      "version": "2.42.4",
-      "resolved": "https://registry.npmjs.org/@amplitude/analytics-browser/-/analytics-browser-2.42.4.tgz",
-      "integrity": "sha512-q1XUlaKQkLq2CFx8xsVEc+uekOwHlnDYyaMBzlQDf2vcEaPaQDb7LzJ7z4CFs4Jn9FyBGDNo4w3IYjv9L6xjGA==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "@amplitude/plugin-autocapture-browser": "1.27.2",
-        "@amplitude/plugin-custom-enrichment-browser": "0.1.9",
-        "@amplitude/plugin-event-property-attribution-browser": "0.2.1",
-        "@amplitude/plugin-network-capture-browser": "1.10.1",
-        "@amplitude/plugin-page-url-enrichment-browser": "0.7.11",
-        "@amplitude/plugin-page-view-tracking-browser": "2.11.1",
-        "@amplitude/plugin-web-vitals-browser": "1.1.33",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/analytics-client-common": {
-      "version": "2.4.48",
-      "resolved": "https://registry.npmjs.org/@amplitude/analytics-client-common/-/analytics-client-common-2.4.48.tgz",
-      "integrity": "sha512-jdRvu8ux3aIf74FvTDZuSFR1mutzdrIg1ebXYqpKizs9upXz1AJnHClkldSw9i4yu924AJ2wudxq6dccHWlNiA==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-connector": "^1.4.8",
-        "@amplitude/analytics-core": "2.48.2",
-        "@amplitude/analytics-types": "2.11.1",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/analytics-connector": {
-      "version": "1.6.4",
-      "resolved": "https://registry.npmjs.org/@amplitude/analytics-connector/-/analytics-connector-1.6.4.tgz",
-      "integrity": "sha512-SpIv0IQMNIq6SH3UqFGiaZyGSc7PBZwRdq7lvP0pBxW8i4Ny+8zwI0pV+VMfMHQwWY3wdIbWw5WQphNjpdq1/Q==",
-      "license": "MIT"
-    },
-    "node_modules/@amplitude/analytics-core": {
-      "version": "2.48.2",
-      "resolved": "https://registry.npmjs.org/@amplitude/analytics-core/-/analytics-core-2.48.2.tgz",
-      "integrity": "sha512-r9O+hsTnTsDa1p6QdyC0KbBPXupzoWz9053RQB9XQz8078LM+5KCMbCKYOrSYniH4DH/OM2kOUEdJlwdxIl/IA==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-connector": "^1.6.4",
-        "@types/zen-observable": "0.8.3",
-        "safe-json-stringify": "1.2.0",
-        "tslib": "^2.4.1",
-        "zen-observable": "0.10.0"
-      }
-    },
-    "node_modules/@amplitude/analytics-types": {
-      "version": "2.11.1",
-      "resolved": "https://registry.npmjs.org/@amplitude/analytics-types/-/analytics-types-2.11.1.tgz",
-      "integrity": "sha512-wFEgb0t99ly2uJKm5oZ28Lti0Kh5RecR5XBkwfUpDzn84IoCIZ8GJTsMw/nThu8FZFc7xFDA4UAt76zhZKrs9A==",
-      "license": "MIT"
-    },
-    "node_modules/@amplitude/engagement-browser": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@amplitude/engagement-browser/-/engagement-browser-1.0.9.tgz",
-      "integrity": "sha512-zvPr0L5aLlOS3nG8scIkEEDMVK2y3MaMbgjYhMfYruhMpfsC/U0apov22nEc1RRrTwve2awEXruPRKf1TysqrQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-types": "^2.0.0"
-      }
-    },
-    "node_modules/@amplitude/experiment-core": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/@amplitude/experiment-core/-/experiment-core-0.13.1.tgz",
-      "integrity": "sha512-ZHvR0dxTltasp8MiMcQ6qKsY20mWnODoy3oebGad6qaRR1ywpUi8IuLf5AwLTM35ZwgzEUTn9TEIWKLHpDwHMw==",
-      "license": "MIT",
-      "dependencies": {
-        "js-base64": "^3.7.5"
-      }
-    },
-    "node_modules/@amplitude/experiment-js-client": {
-      "version": "1.21.1",
-      "resolved": "https://registry.npmjs.org/@amplitude/experiment-js-client/-/experiment-js-client-1.21.1.tgz",
-      "integrity": "sha512-chE/4qQG/5Cgl93Wqj1NEdgOL5LkqySLlfk1EN0f+7bJa52HpkGFALA2FeCNYf31Z5CglEeKX6dUMgL7y33SIw==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-connector": "^1.6.4",
-        "@amplitude/experiment-core": "^0.13.1",
-        "@amplitude/ua-parser-js": "^0.7.31",
-        "base64-js": "1.5.1",
-        "unfetch": "4.1.0"
-      }
-    },
-    "node_modules/@amplitude/plugin-autocapture-browser": {
-      "version": "1.27.2",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-autocapture-browser/-/plugin-autocapture-browser-1.27.2.tgz",
-      "integrity": "sha512-UTA/0IDw/f2nnK+S1XILqoI5pgUgMTEZokDS6+pC4wuYtmOS9uNAgKuyajzjW12uobybMHRpv7xLjCJ5khKGAg==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/plugin-custom-enrichment-browser": {
-      "version": "0.1.9",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-custom-enrichment-browser/-/plugin-custom-enrichment-browser-0.1.9.tgz",
-      "integrity": "sha512-wemh2Tw3zgQ7sa7MUNyMGz9OR6VjTG4tlAMrLlDKbQ4tVkgNI3oAwOF7+0BA8qzgeMXX6iw+CEKaE+EC/okkuQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/plugin-event-property-attribution-browser": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-event-property-attribution-browser/-/plugin-event-property-attribution-browser-0.2.1.tgz",
-      "integrity": "sha512-xqBCZe0DYsKyQ1eELN2LM8adXwRE2eOi3SnvSu9SkS0GDXBYWinuPCuLqyc/3uD5hY2FLACWvakpU0tr7GDJgg==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/plugin-experiment-browser": {
-      "version": "1.0.0-beta.28",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-experiment-browser/-/plugin-experiment-browser-1.0.0-beta.28.tgz",
-      "integrity": "sha512-NQz267zLi7vl2G2lx10yUrEoGOCe5K9iqcPSIjbTavGu/XGvsmqLDqBHhg+EkdEMAPwypoXnmtPEs3RMhX+1MA==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "@amplitude/experiment-js-client": "^1.15.5"
-      }
-    },
-    "node_modules/@amplitude/plugin-network-capture-browser": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-network-capture-browser/-/plugin-network-capture-browser-1.10.1.tgz",
-      "integrity": "sha512-jROIAkUDPd25A/t8W5MpmsTiBat2qoJbCMoNBKKxLMNEaE8VYbheflByWLkm4enbHgWS7OveWy0i3Oc7uPCfAg==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/plugin-page-url-enrichment-browser": {
-      "version": "0.7.11",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-page-url-enrichment-browser/-/plugin-page-url-enrichment-browser-0.7.11.tgz",
-      "integrity": "sha512-u9JhUP/VenJifCSbdTz2YZZiXAphs3efzd+qx1SRAIU6d1swPh0g/GVw3sTwvH+4MZtw3SwVC1OFxmz+f2QVyA==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/plugin-page-view-tracking-browser": {
-      "version": "2.11.1",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-page-view-tracking-browser/-/plugin-page-view-tracking-browser-2.11.1.tgz",
-      "integrity": "sha512-tfXg6Uir6X1XuWsOOXE/EgZ9NvM7i2ktDdagydSrFN6OyVkMvqdjPKUZSSUPuHtOoomboi3WaZsTUfq1jkWP3w==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/plugin-session-replay-browser": {
-      "version": "1.31.0",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-session-replay-browser/-/plugin-session-replay-browser-1.31.0.tgz",
-      "integrity": "sha512-b7kyYVEdW3EMR6cPXCfld+h8nQsuAR5o6vum8Glu+ofhFDfG4wj/mTJ0ITEaNbsJCfXniKQ3kFgTe6hTtxSFGQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-client-common": "2.4.48",
-        "@amplitude/analytics-core": "2.48.2",
-        "@amplitude/analytics-types": "2.11.1",
-        "@amplitude/rrweb-plugin-console-record": "2.0.0-alpha.40",
-        "@amplitude/rrweb-record": "2.0.0-alpha.40",
-        "@amplitude/session-replay-browser": "1.44.0",
-        "idb-keyval": "^6.2.1",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/plugin-web-vitals-browser": {
-      "version": "1.1.33",
-      "resolved": "https://registry.npmjs.org/@amplitude/plugin-web-vitals-browser/-/plugin-web-vitals-browser-1.1.33.tgz",
-      "integrity": "sha512-33FzxMH1Lr2lhvr5DDy3xD1HHWEI4KPLQsMUXqDTldkLl/ENNeBWcsljQTTDJipmRdS32I79KJhuHRNaoXd6fg==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-core": "2.48.2",
-        "tslib": "^2.4.1",
-        "web-vitals": "5.1.0"
-      }
-    },
-    "node_modules/@amplitude/rrdom": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrdom/-/rrdom-2.1.0.tgz",
-      "integrity": "sha512-2dAtxXL02usBV2CSOnScLd3WoVqWaeiGpxN8LuXJ0r/NpLJkW1k876v2tRKAz5NrxPwSdjihsMmwCIXHpJhHfA==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/rrweb-snapshot": "^2.1.0"
-      }
-    },
-    "node_modules/@amplitude/rrweb": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb/-/rrweb-2.1.1.tgz",
-      "integrity": "sha512-6uA+5VE/VHumaXPXTTLGRogd/K9MDwd01jGteppeLzsX0PvqlDyY5aIi35yh9+q1iS6ciPBn/2NRg0lg4cFIlw==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/rrdom": "^2.1.0",
-        "@amplitude/rrweb-snapshot": "^2.1.0",
-        "@amplitude/rrweb-types": "^2.1.0",
-        "@amplitude/rrweb-utils": "^2.1.0",
-        "@types/css-font-loading-module": "0.0.7",
-        "@xstate/fsm": "^1.4.0",
-        "base64-arraybuffer": "^1.0.1",
-        "mitt": "^3.0.0"
-      }
-    },
-    "node_modules/@amplitude/rrweb-packer": {
-      "version": "2.0.0-alpha.40",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb-packer/-/rrweb-packer-2.0.0-alpha.40.tgz",
-      "integrity": "sha512-Btb6b9pS1IvDMbvyYxpUdTk9NRJugSoJjRCl7R6jP/iSlPWXoveJIwHaNFAS9ZmWUEK7HhyBJ8bKGFN3giUsDg==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/rrweb-types": "^2.0.0-alpha.40",
-        "fflate": "^0.4.4"
-      }
-    },
-    "node_modules/@amplitude/rrweb-plugin-console-record": {
-      "version": "2.0.0-alpha.40",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb-plugin-console-record/-/rrweb-plugin-console-record-2.0.0-alpha.40.tgz",
-      "integrity": "sha512-vtY7T/kGFl62nC1u7ZUXQvU7ulB70cZGVHPRN/SO9fzVfsY7y6rCmBfoc2jS5KmISdlgkVzMjY2r/EE2Gk9AQA==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@amplitude/rrweb": "^2.0.0-alpha.40"
-      }
-    },
-    "node_modules/@amplitude/rrweb-record": {
-      "version": "2.0.0-alpha.40",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb-record/-/rrweb-record-2.0.0-alpha.40.tgz",
-      "integrity": "sha512-5cJhQwzhymJWX5/XOtpWK0h2NLq9+t2YiO6ub0cdZ9F5AZizaRbsVH88int07DfX0YiXTKWbISezVuduCLqgSQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/rrweb": "^2.0.0-alpha.40",
-        "@amplitude/rrweb-types": "^2.0.0-alpha.40"
-      }
-    },
-    "node_modules/@amplitude/rrweb-snapshot": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb-snapshot/-/rrweb-snapshot-2.1.0.tgz",
-      "integrity": "sha512-xYQvOW73ig+5M7caqilA8j0S6MHWUULLeJNK+2VVvUqv8mr4FMT2DUAQiVBGCImNlb9Gu2rLUfCScMnVxn+EDg==",
-      "license": "MIT",
-      "dependencies": {
-        "postcss": "^8.4.38"
-      }
-    },
-    "node_modules/@amplitude/rrweb-types": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb-types/-/rrweb-types-2.1.0.tgz",
-      "integrity": "sha512-S73tBI/04A6HCHgnrUNeeVOvnDTEoQnNrmZGyrZncJwRlTIX+6BQSYtBFofMag8GnAy9gA+NtC0TL0CnluOWBw==",
-      "license": "MIT"
-    },
-    "node_modules/@amplitude/rrweb-utils": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb-utils/-/rrweb-utils-2.1.0.tgz",
-      "integrity": "sha512-dTCDnSiMMHZ10utYHJ8dSd/xkjFgdF67y74PkOzAPcCKW1rLxyJYcFOA3uPL2b7cIVVmoel/5NTp5eflaUaJfQ==",
-      "license": "MIT"
-    },
-    "node_modules/@amplitude/session-replay-browser": {
-      "version": "1.44.0",
-      "resolved": "https://registry.npmjs.org/@amplitude/session-replay-browser/-/session-replay-browser-1.44.0.tgz",
-      "integrity": "sha512-8Ruep2TTDMcfVMKurSpBbVclBK/v8Lb3aSHFsYd/xOQ1E3CaKoAu39pplli28NWoUcW7unyVE7khkOa2zzn0Lw==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-client-common": "2.4.48",
-        "@amplitude/analytics-core": "2.48.2",
-        "@amplitude/analytics-types": "2.11.1",
-        "@amplitude/experiment-core": "0.7.2",
-        "@amplitude/rrweb-packer": "2.0.0-alpha.40",
-        "@amplitude/rrweb-plugin-console-record": "2.0.0-alpha.40",
-        "@amplitude/rrweb-record": "2.0.0-alpha.40",
-        "@amplitude/rrweb-types": "2.0.0-alpha.40",
-        "@amplitude/rrweb-utils": "2.0.0-alpha.40",
-        "@amplitude/targeting": "0.2.0",
-        "@rollup/plugin-replace": "^6.0.1",
-        "idb": "8.0.0",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/session-replay-browser/node_modules/@amplitude/experiment-core": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/@amplitude/experiment-core/-/experiment-core-0.7.2.tgz",
-      "integrity": "sha512-Wc2NWvgQ+bLJLeF0A9wBSPIaw0XuqqgkPKsoNFQrmS7r5Djd56um75In05tqmVntPJZRvGKU46pAp8o5tdf4mA==",
-      "license": "MIT",
-      "dependencies": {
-        "js-base64": "^3.7.5"
-      }
-    },
-    "node_modules/@amplitude/session-replay-browser/node_modules/@amplitude/rrweb-types": {
-      "version": "2.0.0-alpha.40",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb-types/-/rrweb-types-2.0.0-alpha.40.tgz",
-      "integrity": "sha512-rP7CBDkzXupxOA7ukvC+zDYLuCtsz54TuJKC4+5O72Jsz4YdokLznKZRG34P6zXozfhGU0261qckk87lLY6mKQ==",
-      "license": "MIT"
-    },
-    "node_modules/@amplitude/session-replay-browser/node_modules/@amplitude/rrweb-utils": {
-      "version": "2.0.0-alpha.40",
-      "resolved": "https://registry.npmjs.org/@amplitude/rrweb-utils/-/rrweb-utils-2.0.0-alpha.40.tgz",
-      "integrity": "sha512-i1CCt6MCjlqoeNc+1Hse5bz+ZbASaWaIJ0WdJZvnQjUCHH29Xy/QFouyOuor73RZ+UWX4s2tYSrUIdmBepXk3w==",
-      "license": "MIT"
-    },
-    "node_modules/@amplitude/targeting": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/@amplitude/targeting/-/targeting-0.2.0.tgz",
-      "integrity": "sha512-/50ywTrC4hfcfJVBbh5DFbqMPPfaIOivZeb5Gb+OGM03QrA+lsUqdvtnKLNuWtceD4H6QQ2KFzPJ5aAJLyzVDA==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-client-common": ">=1 <3",
-        "@amplitude/analytics-core": ">=1 <3",
-        "@amplitude/analytics-types": ">=1 <3",
-        "@amplitude/experiment-core": "0.7.2",
-        "idb": "^8.0.0",
-        "tslib": "^2.4.1"
-      }
-    },
-    "node_modules/@amplitude/targeting/node_modules/@amplitude/experiment-core": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/@amplitude/experiment-core/-/experiment-core-0.7.2.tgz",
-      "integrity": "sha512-Wc2NWvgQ+bLJLeF0A9wBSPIaw0XuqqgkPKsoNFQrmS7r5Djd56um75In05tqmVntPJZRvGKU46pAp8o5tdf4mA==",
-      "license": "MIT",
-      "dependencies": {
-        "js-base64": "^3.7.5"
-      }
-    },
-    "node_modules/@amplitude/ua-parser-js": {
-      "version": "0.7.33",
-      "resolved": "https://registry.npmjs.org/@amplitude/ua-parser-js/-/ua-parser-js-0.7.33.tgz",
-      "integrity": "sha512-wKEtVR4vXuPT9cVEIJkYWnlF++Gx3BdLatPBM+SZ1ztVIvnhdGBZR/mn9x/PzyrMcRlZmyi6L56I2J3doVBnjA==",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/ua-parser-js"
-        },
-        {
-          "type": "paypal",
-          "url": "https://paypal.me/faisalman"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/@amplitude/unified": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@amplitude/unified/-/unified-1.1.9.tgz",
-      "integrity": "sha512-YPgQbp/vDQ92GshHs2hfUxoeRnR3rRBWCoQ6wXgFjXQ1uiJf2tP0CBZWdrCStSDuhcpo2rsCz/Ek2LGq5J6SIQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@amplitude/analytics-browser": "2.42.4",
-        "@amplitude/analytics-core": "2.48.2",
-        "@amplitude/engagement-browser": "^1.0.3",
-        "@amplitude/plugin-experiment-browser": "1.0.0-beta.28",
-        "@amplitude/plugin-session-replay-browser": "1.31.0"
-      }
-    },
     "node_modules/@antfu/install-pkg": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-1.1.0.tgz",
@@ -619,12 +264,6 @@
         "import-meta-resolve": "^4.2.0"
       }
     },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "license": "MIT"
-    },
     "node_modules/@lezer/common": {
       "version": "1.5.2",
       "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.5.2.tgz",
@@ -1018,49 +657,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@rollup/plugin-replace": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-replace/-/plugin-replace-6.0.3.tgz",
-      "integrity": "sha512-J4RZarRvQAm5IF0/LwUUg+obsm+xZhYnbMXmXROyoSE1ATJe3oXSb9L5MMppdxP2ylNSjv6zFBwKYjcKMucVfA==",
-      "license": "MIT",
-      "dependencies": {
-        "@rollup/pluginutils": "^5.0.1",
-        "magic-string": "^0.30.3"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@rollup/pluginutils": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.3.0.tgz",
-      "integrity": "sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.0",
-        "estree-walker": "^2.0.2",
-        "picomatch": "^4.0.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@tiptap/core": {
       "version": "3.23.6",
       "resolved": "https://registry.npmjs.org/@tiptap/core/-/core-3.23.6.tgz",
@@ -1513,12 +1109,6 @@
         "tslib": "^2.4.0"
       }
     },
-    "node_modules/@types/css-font-loading-module": {
-      "version": "0.0.7",
-      "resolved": "https://registry.npmjs.org/@types/css-font-loading-module/-/css-font-loading-module-0.0.7.tgz",
-      "integrity": "sha512-nl09VhutdjINdWyXxHWN/w9zlNCfr60JUqJbd24YXUuCwgeL0TpFSdElCwb6cxfB6ybE19Gjj4g0jsgkXxKv1Q==",
-      "license": "MIT"
-    },
     "node_modules/@types/d3": {
       "version": "7.4.3",
       "resolved": "https://registry.npmjs.org/@types/d3/-/d3-7.4.3.tgz",
@@ -1772,12 +1362,6 @@
         "@types/d3-selection": "*"
       }
     },
-    "node_modules/@types/estree": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
-      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
-      "license": "MIT"
-    },
     "node_modules/@types/geojson": {
       "version": "7946.0.16",
       "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz",
@@ -1815,12 +1399,6 @@
       "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
       "license": "MIT"
     },
-    "node_modules/@types/zen-observable": {
-      "version": "0.8.3",
-      "resolved": "https://registry.npmjs.org/@types/zen-observable/-/zen-observable-0.8.3.tgz",
-      "integrity": "sha512-fbF6oTd4sGGy0xjHPKAt+eS2CrxJ3+6gQ3FGcBoIJR2TLAyCkCyI8JqZNy+FeON0AhVgNJoUumVoZQjBFUqHkw==",
-      "license": "MIT"
-    },
     "node_modules/@upsetjs/venn.js": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/@upsetjs/venn.js/-/venn.js-2.0.0.tgz",
@@ -1857,41 +1435,6 @@
         }
       }
     },
-    "node_modules/@xstate/fsm": {
-      "version": "1.6.5",
-      "resolved": "https://registry.npmjs.org/@xstate/fsm/-/fsm-1.6.5.tgz",
-      "integrity": "sha512-b5o1I6aLNeYlU/3CPlj/Z91ybk1gUsKT+5NAJI+2W4UjvS5KLG28K9v5UvNoFVjHV8PajVZ00RH3vnjyQO7ZAw==",
-      "license": "MIT"
-    },
-    "node_modules/base64-arraybuffer": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz",
-      "integrity": "sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6.0"
-      }
-    },
-    "node_modules/base64-js": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/commander": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
@@ -2478,12 +2021,6 @@
         "benchmarks"
       ]
     },
-    "node_modules/estree-walker": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
-      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
-      "license": "MIT"
-    },
     "node_modules/fast-equals": {
       "version": "5.4.0",
       "resolved": "https://registry.npmjs.org/fast-equals/-/fast-equals-5.4.0.tgz",
@@ -2511,12 +2048,6 @@
         }
       }
     },
-    "node_modules/fflate": {
-      "version": "0.4.8",
-      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.4.8.tgz",
-      "integrity": "sha512-FJqqoDBR00Mdj9ppamLa/Y7vxm+PRmNWA67N846RvsoYVMKB4q3y/de5PA7gUmRMYK/8CMz2GDZQmCRN1wBcWA==",
-      "license": "MIT"
-    },
     "node_modules/fsevents": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
@@ -2550,18 +2081,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/idb": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/idb/-/idb-8.0.0.tgz",
-      "integrity": "sha512-l//qvlAKGmQO31Qn7xdzagVPPaHTxXx199MhrAFuVBTPqydcPYBWjkrbv4Y0ktB+GmWOiwHl237UUOrLmQxLvw==",
-      "license": "ISC"
-    },
-    "node_modules/idb-keyval": {
-      "version": "6.2.4",
-      "resolved": "https://registry.npmjs.org/idb-keyval/-/idb-keyval-6.2.4.tgz",
-      "integrity": "sha512-D/NzHWUmYJGXi++z67aMSrnisb9A3621CyRK5G89JyTlN13C8xf0g04DLxUKMufPem3e3L2JAXR6Z00OWy183Q==",
-      "license": "Apache-2.0"
-    },
     "node_modules/import-meta-resolve": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/import-meta-resolve/-/import-meta-resolve-4.2.0.tgz",
@@ -2581,12 +2100,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/js-base64": {
-      "version": "3.7.8",
-      "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-3.7.8.tgz",
-      "integrity": "sha512-hNngCeKxIUQiEUN3GPJOkz4wF/YvdUdbNL9hsBcMQTkKzboD7T/q3OYOuuPZLUE6dBxSGpwhk5mwuDud7JVAow==",
-      "license": "BSD-3-Clause"
-    },
     "node_modules/katex": {
       "version": "0.16.47",
       "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
@@ -2908,15 +2421,6 @@
       "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
       "license": "MIT"
     },
-    "node_modules/magic-string": {
-      "version": "0.30.21",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
-      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.5"
-      }
-    },
     "node_modules/marked": {
       "version": "18.0.4",
       "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.4.tgz",
@@ -2970,16 +2474,11 @@
         "node": ">= 20"
       }
     },
-    "node_modules/mitt": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/mitt/-/mitt-3.0.1.tgz",
-      "integrity": "sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==",
-      "license": "MIT"
-    },
     "node_modules/nanoid": {
       "version": "3.3.12",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
       "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -3016,12 +2515,14 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
       "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
       "license": "ISC"
     },
     "node_modules/picomatch": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -3050,6 +2551,7 @@
       "version": "8.5.15",
       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
       "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "dev": true,
       "funding": [
         {
           "type": "opencollective",
@@ -3326,12 +2828,6 @@
       "integrity": "sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ==",
       "license": "BSD-3-Clause"
     },
-    "node_modules/safe-json-stringify": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/safe-json-stringify/-/safe-json-stringify-1.2.0.tgz",
-      "integrity": "sha512-gH8eh2nZudPQO6TytOvbxnuhYBOvDBBLW52tz5q6X58lJcd/tkmqFR+5Z9adS8aJtURSXWThWy/xJtJwixErvg==",
-      "license": "MIT"
-    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -3354,6 +2850,7 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
       "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -3410,13 +2907,9 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/unfetch": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/unfetch/-/unfetch-4.1.0.tgz",
-      "integrity": "sha512-crP/n3eAPUJxZXM9T80/yv0YhkTEx2K1D3h7D1AJM6fzsWZrxdyRuLN0JH/dkZh1LNH8LxCnBzoPFCPbb2iGpg==",
-      "license": "MIT"
+      "dev": true,
+      "license": "0BSD",
+      "optional": true
     },
     "node_modules/use-sync-external-store": {
       "version": "1.6.0",
@@ -3523,18 +3016,6 @@
       "resolved": "https://registry.npmjs.org/w3c-keyname/-/w3c-keyname-2.2.8.tgz",
       "integrity": "sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==",
       "license": "MIT"
-    },
-    "node_modules/web-vitals": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/web-vitals/-/web-vitals-5.1.0.tgz",
-      "integrity": "sha512-ArI3kx5jI0atlTtmV0fWU3fjpLmq/nD3Zr1iFFlJLaqa5wLBkUSzINwBPySCX/8jRyjlmy1Volw1kz1g9XE4Jg==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/zen-observable": {
-      "version": "0.10.0",
-      "resolved": "https://registry.npmjs.org/zen-observable/-/zen-observable-0.10.0.tgz",
-      "integrity": "sha512-iI3lT0iojZhKwT5DaFy2Ce42n3yFcLdFyOh01G7H0flMY60P8MJuVFEoJoNwXlmAyQ45GrjL6AcZmmlv8A5rbw==",
-      "license": "MIT"
     }
   }
 }

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rfc-app-frontend",
   "private": true,
-  "version": "0.15.0",
+  "version": "0.11.0",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -9,7 +9,6 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@amplitude/unified": "^1.1.9",
     "@codemirror/commands": "^6.10.3",
     "@codemirror/lang-markdown": "^6.5.0",
     "@codemirror/language": "^6.12.3",

frontend/src/App.css

@@ -1948,54 +1948,6 @@
   display: inline-flex; align-items: center; gap: 6px;
   font-size: 13px; cursor: pointer;
 }
-
-/* v0.9.0 — admin user-management surface (roadmap item #7). */
-.admin-filter-chips {
-  display: flex; gap: 6px; margin-bottom: 16px; flex-wrap: wrap;
-}
-.admin-chip {
-  display: inline-flex; align-items: center; gap: 6px;
-  background: #fff; border: 1px solid #d1d5db; border-radius: 999px;
-  padding: 4px 12px; font-size: 12px; color: #374151; cursor: pointer;
-}
-.admin-chip:hover { background: #f9fafb; }
-.admin-chip.active {
-  background: #111; color: #fff; border-color: #111;
-}
-.admin-chip-count {
-  font-size: 11px; opacity: 0.7;
-}
-.admin-users-table td { vertical-align: top; padding-top: 10px; padding-bottom: 10px; }
-.permission-cell { display: flex; flex-direction: column; gap: 4px; }
-.permission-actions { display: flex; gap: 6px; }
-.permission-badge {
-  display: inline-block;
-  font-size: 11px; font-weight: 600;
-  padding: 2px 8px; border-radius: 999px;
-  text-transform: uppercase; letter-spacing: 0.04em;
-  width: max-content;
-}
-.permission-badge-pending {
-  background: #fef3c7; color: #92400e;
-}
-.permission-badge-granted {
-  background: #dcfce7; color: #166534;
-}
-.permission-badge-revoked {
-  background: #fee2e2; color: #991b1b;
-}
-.permission-decided { font-size: 11px; }
-.user-row-reason td {
-  background: #fffbeb; border-top: none !important;
-  padding: 0 16px 12px !important;
-}
-.user-reason-block {
-  border-left: 3px solid #f59e0b;
-  padding: 8px 12px; font-size: 13px;
-  background: #fffbeb;
-}
-.user-reason-block strong { display: block; margin-bottom: 4px; color: #92400e; }
-.user-reason-block p { margin: 0; white-space: pre-wrap; color: #374151; }
 .grad-queue { list-style: none; padding: 0; margin: 8px 0 24px; }
 .grad-queue li { padding: 8px 0; border-bottom: 1px solid #f3f4f6; }
 .grad-queue-link { color: #111; text-decoration: none; font-size: 14px; }

frontend/src/App.jsx

@@ -1,7 +1,6 @@
-import { useEffect, useRef, useState } from 'react'
-import { Routes, Route, Link, useLocation, useNavigate } from 'react-router-dom'
+import { useEffect, useState } from 'react'
+import { Routes, Route, Link, useNavigate } from 'react-router-dom'
 import { getMe, subscribeToNotifications } from './api'
-import { anonymize, EVENTS, identify, track } from './lib/analytics'
 import Catalog from './components/Catalog.jsx'
 import Inbox from './components/Inbox.jsx'
 import RFCView from './components/RFCView.jsx'
@@ -35,36 +34,6 @@ export default function App() {
   // event that bumps this.
   const [consentReopenTick, setConsentReopenTick] = useState(0)
   const navigate = useNavigate()
-  const location = useLocation()
-  // v0.15.0 — Page Viewed event taxonomy. We fire on every
-  // route change; the analytics wrapper itself decides whether
-  // anything ships out (consent + key check). The first fire is
-  // also covered because `location` is set on mount.
-  const lastPathRef = useRef(null)
-  useEffect(() => {
-    const path = location.pathname + (location.search || '')
-    if (lastPathRef.current === path) return
-    lastPathRef.current = path
-    track(EVENTS.PAGE_VIEWED, { path: location.pathname })
-  }, [location.pathname, location.search])
-
-  // v0.15.0 — bind the authenticated user id to the analytics
-  // session when sign-in lands; reset on sign-out (viewer flips to
-  // null). The wrapper queues these calls until consent + init
-  // resolve, so the order is safe even on a cold load.
-  const lastUserIdRef = useRef(null)
-  useEffect(() => {
-    const uid = me?.authenticated ? me.user?.id : null
-    if (uid != null && lastUserIdRef.current !== uid) {
-      lastUserIdRef.current = uid
-      identify({ user_id: String(uid) })
-    } else if (uid == null && lastUserIdRef.current != null) {
-      // Sign-out edge — App-level reset is handled separately by the
-      // sign-out gesture that fires User Signed Out. Clear our local
-      // memo so a fresh sign-in re-fires identify.
-      lastUserIdRef.current = null
-    }
-  }, [me?.authenticated, me?.user?.id])
 
   useEffect(() => {
     const handler = () => setConsentReopenTick(t => t + 1)
@@ -172,20 +141,7 @@ export default function App() {
             <>
               <span className="user-name">{viewer.display_name}</span>
               <span className={`user-role-badge role-${viewer.role}`}>{viewer.role}</span>
-              <a
-                className="btn-link"
-                href="/auth/logout"
-                onClick={() => {
-                  // v0.15.0 — fire the sign-out event before the
-                  // hard nav. The wrapper's track() is sync-enqueue;
-                  // the underlying SDK flush is best-effort across
-                  // navigation. anonymize() clears the user binding
-                  // so any post-nav anonymous events on the next
-                  // page aren't attributed to the prior user.
-                  track(EVENTS.USER_SIGNED_OUT)
-                  anonymize()
-                }}
-              >Sign out</a>
+              <a className="btn-link" href="/auth/logout">Sign out</a>
             </>
           ) : (
             <Link className="btn-signin-header" to="/login" title="Private beta — only invited emails can sign in">

frontend/src/api.js

@@ -31,19 +31,11 @@ export async function getMe() {
 // migration — the new UI just no longer points at it primarily. These
 // two helpers drive the Login.jsx surface.
 
-export async function requestOtc(email, { turnstileToken } = {}) {
-  // v0.12.0 / roadmap item #10: when the Turnstile widget has produced
-  // a token, send it alongside the email so the backend can siteverify
-  // before the OTC dispatch. The backend treats a missing token as
-  // either soft-fail (no secret wired AND TURNSTILE_REQUIRED=false)
-  // or hard-fail (verification required) — the frontend stays
-  // uninvolved in the policy.
-  const body = { email }
-  if (turnstileToken) body.turnstile_token = turnstileToken
+export async function requestOtc(email) {
   const res = await fetch('/auth/otc/request', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body),
+    body: JSON.stringify({ email }),
   })
   return jsonOrThrow(res)
 }
@@ -703,19 +695,6 @@ export async function setUserMute(userId, muted) {
   }))
 }
 
-// v0.9.0 — roadmap item #7. Flip a user's permission_state between
-// 'pending', 'granted', and 'revoked'. The Users tab on the admin
-// page wires Grant / Revoke buttons against this endpoint; the
-// returned `changed` flag is false when the requested state already
-// matched the row.
-export async function setUserPermission(userId, state) {
-  return jsonOrThrow(await fetch(`/api/admin/users/${userId}/permission`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ state }),
-  }))
-}
-
 export async function listAuditLog({ actionKind, actorUserId, rfcSlug, beforeId, limit } = {}) {
   const params = new URLSearchParams()
   if (actionKind) params.set('action_kind', actionKind)

frontend/src/components/Admin.jsx

@@ -16,7 +16,6 @@ import {
   listAdminUsers,
   setUserRole,
   setUserMute,
-  setUserPermission,
   listAuditLog,
   listPermissionEvents,
   listGraduationQueue,
@@ -24,7 +23,6 @@ import {
   addAllowlistEmail,
   removeAllowlistEmail,
 } from '../api.js'
-import { EVENTS, track } from '../lib/analytics.js'
 
 const TABS = [
   { path: 'users', label: 'Users' },
@@ -70,26 +68,12 @@ export default function Admin({ viewer }) {
   )
 }
 
-// ── Users + role + write-mute + permission grant/revoke (§6.1 / §6.2) ──────
-//
-// v0.9.0 (roadmap item #7) lands the user-management surface. The table
-// shows every user with their permission_state, sign-up reason (when
-// pending), role, write-mute, and Grant / Revoke controls. State filter
-// chips above the table narrow to one bucket — the "Pending" chip is the
-// admin's daily inbox shape.
-
-const STATE_CHIPS = [
-  { value: 'all', label: 'All' },
-  { value: 'pending', label: 'Pending' },
-  { value: 'granted', label: 'Granted' },
-  { value: 'revoked', label: 'Revoked' },
-]
+// ── Users + role + write-mute (§6.1 / §6.2) ────────────────────────────────
 
 function UsersTab() {
   const [users, setUsers] = useState(null)
   const [busy, setBusy] = useState({})
   const [error, setError] = useState(null)
-  const [stateFilter, setStateFilter] = useState('all')
 
   async function refresh() {
     setError(null)
@@ -129,199 +113,68 @@ function UsersTab() {
     }
   }
 
-  async function flipPermission(userId, state) {
-    setBusy(b => ({ ...b, [userId]: true }))
-    setError(null)
-    try {
-      await setUserPermission(userId, state)
-      // v0.15.0 — analytics: fire on a successful §6.1 grant/revoke.
-      // action collapses the {pending → granted, revoked → granted}
-      // edges onto `grant`, and `granted → revoked` onto `revoke`,
-      // matching the roadmap's two-arm taxonomy.
-      const action = state === 'granted' ? 'grant' : 'revoke'
-      track(EVENTS.ADMIN_PERMISSION_DECISION, { action, target_user_id: String(userId) })
-      // Refresh the full row so permission_decided_{at,by_*} update too.
-      await refresh()
-    } catch (e) {
-      setError(e.message)
-    } finally {
-      setBusy(b => ({ ...b, [userId]: false }))
-    }
-  }
-
-  const counts = useMemo(() => {
-    const c = { all: 0, pending: 0, granted: 0, revoked: 0 }
-    if (users) {
-      c.all = users.length
-      for (const u of users) {
-        const s = u.permission_state || 'granted'
-        if (s in c) c[s] += 1
-      }
-    }
-    return c
-  }, [users])
-
   if (users == null) return <p className="muted">Loading users…</p>
 
-  const filtered = stateFilter === 'all'
-    ? users
-    : users.filter(u => (u.permission_state || 'granted') === stateFilter)
-
   return (
     <div className="admin-tab">
       <header className="admin-tab-header">
         <h2>Users</h2>
         <p className="muted">
-          The pending bucket is the beta-access review queue (§6.1 /
-          v0.8.0). Grant or revoke writes to <code>permission_events</code>
-          and stamps <code>permission_decided_by</code> +{' '}
-          <code>permission_decided_at</code>. Role and write-mute controls
-          retain their v0.7.0 semantics — promote to admin to remove a
-          user's ability to write without silencing them.
+          Role changes write to <code>permission_events</code>. The §6.2
+          write-mute applies to contributors only — promote to admin to
+          remove a user's ability to write without silencing them.
         </p>
       </header>
       {error && <p className="settings-note warning">{error}</p>}
-
-      <div className="admin-filter-chips">
-        {STATE_CHIPS.map(chip => (
-          <button
-            key={chip.value}
-            type="button"
-            className={`admin-chip${stateFilter === chip.value ? ' active' : ''}`}
-            onClick={() => setStateFilter(chip.value)}
-          >
-            {chip.label} <span className="admin-chip-count">{counts[chip.value] ?? 0}</span>
-          </button>
-        ))}
-      </div>
-
-      {filtered.length === 0 ? (
-        <p className="muted">No users in this bucket.</p>
-      ) : (
-        <table className="admin-table admin-users-table">
-          <thead>
-            <tr>
-              <th>User</th>
-              <th>State</th>
-              <th>Role</th>
-              <th>Write-muted</th>
-              <th>Signed up</th>
-              <th>Last seen</th>
+      <table className="admin-table">
+        <thead>
+          <tr>
+            <th>User</th>
+            <th>Role</th>
+            <th>Write-muted</th>
+            <th>Last seen</th>
+          </tr>
+        </thead>
+        <tbody>
+          {users.map(u => (
+            <tr key={u.id}>
+              <td>
+                <div className="user-cell">
+                  <span className="user-handle">@{u.gitea_login}</span>
+                  <span className="muted">{u.display_name}</span>
+                </div>
+              </td>
+              <td>
+                <select
+                  value={u.role}
+                  onChange={e => changeRole(u.id, e.target.value)}
+                  disabled={!!busy[u.id]}
+                >
+                  <option value="contributor">Contributor</option>
+                  <option value="admin">Admin</option>
+                  <option value="owner">Owner</option>
+                </select>
+              </td>
+              <td>
+                {u.role === 'contributor' ? (
+                  <label className="mute-toggle">
+                    <input
+                      type="checkbox"
+                      checked={!!u.muted}
+                      onChange={e => toggleMute(u.id, e.target.checked)}
+                      disabled={!!busy[u.id]}
+                    />
+                    {u.muted ? 'Muted' : 'Active'}
+                  </label>
+                ) : (
+                  <span className="muted">N/A</span>
+                )}
+              </td>
+              <td className="muted">{u.last_seen_at}</td>
             </tr>
-          </thead>
-          <tbody>
-            {filtered.map(u => (
-              <UserRow
-                key={u.id}
-                user={u}
-                busy={!!busy[u.id]}
-                onChangeRole={role => changeRole(u.id, role)}
-                onToggleMute={muted => toggleMute(u.id, muted)}
-                onFlipPermission={state => flipPermission(u.id, state)}
-              />
-            ))}
-          </tbody>
-        </table>
-      )}
-    </div>
-  )
-}
-
-function UserRow({ user: u, busy, onChangeRole, onToggleMute, onFlipPermission }) {
-  const state = u.permission_state || 'granted'
-  const fullName = [u.first_name, u.last_name].filter(Boolean).join(' ').trim()
-  const handle = u.gitea_login ? `@${u.gitea_login}` : (u.email || u.display_name)
-  return (
-    <>
-      <tr>
-        <td>
-          <div className="user-cell">
-            <span className="user-handle">{handle}</span>
-            <span className="muted">
-              {fullName || u.display_name}
-              {u.email ? ` · ${u.email}` : ''}
-            </span>
-          </div>
-        </td>
-        <td>
-          <PermissionCell user={u} busy={busy} onFlipPermission={onFlipPermission} />
-        </td>
-        <td>
-          <select
-            value={u.role}
-            onChange={e => onChangeRole(e.target.value)}
-            disabled={busy}
-          >
-            <option value="contributor">Contributor</option>
-            <option value="admin">Admin</option>
-            <option value="owner">Owner</option>
-          </select>
-        </td>
-        <td>
-          {u.role === 'contributor' ? (
-            <label className="mute-toggle">
-              <input
-                type="checkbox"
-                checked={!!u.muted}
-                onChange={e => onToggleMute(e.target.checked)}
-                disabled={busy}
-              />
-              {u.muted ? 'Muted' : 'Active'}
-            </label>
-          ) : (
-            <span className="muted">N/A</span>
-          )}
-        </td>
-        <td className="muted">{u.created_at || '—'}</td>
-        <td className="muted">{u.last_seen_at || '—'}</td>
-      </tr>
-      {state === 'pending' && u.beta_request_reason ? (
-        <tr className="user-row-reason">
-          <td colSpan={6}>
-            <div className="user-reason-block">
-              <strong>Why they want access:</strong>
-              <p>{u.beta_request_reason}</p>
-            </div>
-          </td>
-        </tr>
-      ) : null}
-    </>
-  )
-}
-
-function PermissionCell({ user: u, busy, onFlipPermission }) {
-  const state = u.permission_state || 'granted'
-  const decidedSuffix = u.permission_decided_at
-    ? ` · by ${u.permission_decided_by_login ? '@' + u.permission_decided_by_login : '—'} at ${u.permission_decided_at}`
-    : ''
-  return (
-    <div className="permission-cell">
-      <span className={`permission-badge permission-badge-${state}`}>{state}</span>
-      <div className="permission-actions">
-        {state !== 'granted' && (
-          <button
-            type="button"
-            className="btn-link-quiet"
-            disabled={busy}
-            onClick={() => onFlipPermission('granted')}
-          >Grant</button>
-        )}
-        {state === 'granted' && (
-          <button
-            type="button"
-            className="btn-link-quiet"
-            disabled={busy}
-            onClick={() => {
-              if (confirm(`Revoke access for ${u.display_name || u.email}?`)) {
-                onFlipPermission('revoked')
-              }
-            }}
-          >Revoke</button>
-        )}
-      </div>
-      {decidedSuffix && (
-        <div className="permission-decided muted">{decidedSuffix.replace(/^ · /, '')}</div>
-      )}
+          ))}
+        </tbody>
+      </table>
     </div>
   )
 }

frontend/src/components/BetaPending.jsx

@@ -27,11 +27,8 @@ export default function BetaPending({ viewer }) {
         {isPending ? (
           <>
             <p>
-              Thanks for telling us a bit about yourself. The deployment's
-              admins are notified by email as soon as a request lands;
-              we don't commit to a fixed SLA — turnaround depends on
-              operator availability — and the deployment operator is
-              the right person to ask if a wait runs long.
+              Thanks for telling us a bit about yourself. An admin will
+              review your request and get back to you as soon as we can.
             </p>
             <p>
               While you wait, the catalog on the left lists every super-draft

frontend/src/components/Login.jsx

@@ -1,17 +1,7 @@
-// Login.jsx — the composed sign-in surface (§6.2) after the v0.12.0
-// (CloudFlare Turnstile gate on OTC dispatch, roadmap item #10) /
-// v0.10.0 (passcodes, roadmap item #8) rebase onto v0.8.0
-// (beta-access-request capture, §6.1 / §14.1, roadmap item #6). v0.7.0
-// (roadmap item #5) established the email + OTC scaffolding the later
-// releases extended.
-//
-// v0.12.0: the email-entry step renders a Turnstile widget. The token
-// it produces is sent to `/auth/otc/request` alongside the email. The
-// passcode step also renders a widget for the "Use a code instead"
-// fallback dispatch (same backend endpoint, same gate). When the
-// `VITE_TURNSTILE_SITE_KEY` build var is unset, the widget renders
-// nothing — the form still submits and the backend's TURNSTILE_REQUIRED
-// policy decides admission.
+// Login.jsx — the composed sign-in surface (§6.2) after the v0.10.0
+// (passcodes, roadmap item #8) rebase onto v0.8.0 (beta-access-request
+// capture, §6.1 / §14.1, roadmap item #6). v0.7.0 (roadmap item #5)
+// established the email + OTC scaffolding both releases extended.
 //
 // Four-to-six-step flow (most users see three; the longest path is
 // pending-user with no passcode, who never sees the passcode steps):
@@ -84,8 +74,6 @@ import {
   setPasscode as apiSetPasscode,
   startDeviceTrust,
 } from '../api'
-import TurnstileWidget, { turnstileEnabled } from './TurnstileWidget'
-import { EVENTS, track } from '../lib/analytics'
 
 export default function Login() {
   // Steps: 'email' → 'passcode' or 'code' → (on the OTC path, after
@@ -110,18 +98,6 @@ export default function Login() {
   const [reason, setReason] = useState('')
   const [status, setStatus] = useState('')
   const [busy, setBusy] = useState(false)
-  // v0.12.0: Turnstile token captured by the widget. `null` means no
-  // challenge solved yet (or the site key is unset, in which case the
-  // widget surfaces null on mount). The token is single-use; we clear
-  // it back to null right after we send it so a second request on the
-  // same form remount re-challenges. `turnstileReady` is true once the
-  // widget has produced a token OR the widget is not configured at
-  // build time (no site key) — the submit button reads from it so the
-  // form locks up when the operator has wired Turnstile but the user
-  // hasn't solved the challenge yet.
-  const [turnstileToken, setTurnstileToken] = useState(null)
-  const turnstileOn = turnstileEnabled()
-  const turnstileReady = !turnstileOn || !!turnstileToken
   const emailRef = useRef(null)
   const codeRef = useRef(null)
   const passcodeRef = useRef(null)
@@ -151,12 +127,7 @@ export default function Login() {
     ;(async () => {
       try {
         await startDeviceTrust()
-        if (!cancelled) {
-          // v0.15.0 — analytics: device-trust cookie path is one of
-          // three sign-in methods the taxonomy distinguishes.
-          track(EVENTS.USER_SIGNED_IN, { method: 'trust-device' })
-          window.location.assign('/')
-        }
+        if (!cancelled) window.location.assign('/')
       } catch (_) {
         // No trusted device — fall through to the email step.
       }
@@ -178,22 +149,13 @@ export default function Login() {
         setStep('passcode')
         setStatus('')
       } else {
-        await requestOtc(email.trim(), { turnstileToken })
-        // v0.12.0: the token is single-use; drop it so a re-request
-        // from the code step (via "Use a different email" → back to
-        // email) starts with a fresh challenge.
-        setTurnstileToken(null)
+        await requestOtc(email.trim())
         setStep('code')
         setStatus('Check your inbox — a six-digit code is on the way.')
       }
     } catch (err) {
-      // Any failure consumes the token from CloudFlare's side; clear
-      // so the widget re-renders a fresh challenge on retry.
-      setTurnstileToken(null)
       if (err.status === 429) {
         setStatus('Slow down — wait a minute before requesting another code.')
-      } else if (err.status === 400) {
-        setStatus("Couldn't verify you're human. Please retry the challenge.")
       } else {
         setStatus(err.message || 'Could not start sign-in. Try again.')
       }
@@ -212,10 +174,6 @@ export default function Login() {
     setStatus('')
     try {
       await verifyPasscode(email.trim(), passcode.trim(), { trustDevice })
-      // v0.15.0 — analytics: passcode is the second of three
-      // sign-in methods. trust-device gets credited separately when
-      // the cookie-driven path fires above.
-      track(EVENTS.USER_SIGNED_IN, { method: 'passcode' })
       // Reload so App.jsx's getMe() picks up the fresh session. A
       // returning passcode user is by definition already past the
       // §6.1 capture step (they couldn't have set a passcode while
@@ -228,29 +186,17 @@ export default function Login() {
         // fresh code in the user's inbox immediately.
         setPasscode('')
         try {
-          // v0.12.0: pass whatever token the widget on the passcode
-          // step has produced. If the operator has Turnstile required
-          // and the user hasn't solved the passcode-step widget, the
-          // backend refuses and we bounce them back to email-entry
-          // with a clear status (see catch below).
-          await requestOtc(email.trim(), { turnstileToken })
-          setTurnstileToken(null)
+          await requestOtc(email.trim())
           setStep('code')
           setStatus(
             'Too many failed attempts. We sent a one-time code to your email — use it to sign in.',
           )
         } catch (e2) {
-          setTurnstileToken(null)
           if (e2.status === 429) {
             setStep('code')
             setStatus(
               'Too many failed attempts. Wait a minute, then request a one-time code to sign in.',
             )
-          } else if (e2.status === 400) {
-            setStep('email')
-            setStatus(
-              'Too many failed attempts. Solve the challenge below to receive a one-time code.',
-            )
           } else {
             setStatus(
               'Too many failed attempts. Use the "Use a code instead" link to sign in via email.',
@@ -274,11 +220,6 @@ export default function Login() {
     setStatus('')
     try {
       await verifyOtc(email.trim(), code.trim(), { trustDevice })
-      // v0.15.0 — analytics: OTC is the third sign-in method.
-      // We fire it here regardless of whether the user then lands
-      // in capture-profile or offer-passcode — sign-in has happened
-      // server-side either way.
-      track(EVENTS.USER_SIGNED_IN, { method: 'otc' })
       // OTC verified — the server has signed in the user. Fetch the
       // canonical /api/auth/me to decide where to land:
       //   * needs_profile  → §6.1 capture (then /beta-pending).
@@ -335,11 +276,6 @@ export default function Login() {
         last_name: ln,
         beta_request_reason: why,
       })
-      // v0.15.0 — analytics: a successful capture-profile submit is
-      // the moment a beta-access request lands. No PII in the event
-      // body (no name, no reason text); the count + timestamp is
-      // what the funnel needs.
-      track(EVENTS.BETA_ACCESS_REQUESTED)
       // Hard-load so App.jsx re-fetches /api/auth/me and picks up
       // the captured fields. The user stays permission_state='pending'
       // until an admin grants access — the next thing they should
@@ -408,27 +344,17 @@ export default function Login() {
 
   async function fallbackToOtc() {
     // Manual "Use a code instead" from the passcode step. Same shape
-    // as the email-step OTC dispatch. v0.12.0: pass through whatever
-    // Turnstile token the passcode-step widget has produced (or null
-    // when the widget is disabled at build time).
+    // as the email-step OTC dispatch.
     setBusy(true)
     setStatus('')
     try {
-      await requestOtc(email.trim(), { turnstileToken })
-      setTurnstileToken(null)
+      await requestOtc(email.trim())
       setPasscode('')
       setStep('code')
       setStatus('Check your inbox — a six-digit code is on the way.')
     } catch (err) {
-      setTurnstileToken(null)
       if (err.status === 429) {
         setStatus('Slow down — wait a minute before requesting another code.')
-      } else if (err.status === 400) {
-        // v0.12.0: the widget rejected or no token was sent. Bounce
-        // the user back to the email step so they get a fresh
-        // challenge alongside the email input.
-        setStep('email')
-        setStatus("Couldn't verify you're human. Please retry the challenge.")
       } else {
         setStatus(err.message || 'Could not request a code. Try again.')
       }
@@ -461,18 +387,7 @@ export default function Login() {
               required
               disabled={busy}
             />
-            {/*
-              v0.12.0: CloudFlare Turnstile widget. Renders nothing
-              when VITE_TURNSTILE_SITE_KEY is unset (and turnstileReady
-              defaults to true in that case so the submit gate doesn't
-              lock up). On every challenge the widget calls onToken
-              with the fresh token; we feed it to /auth/otc/request.
-            */}
-            <TurnstileWidget onToken={setTurnstileToken} />
-            <button
-              type="submit"
-              disabled={busy || !email.trim() || !turnstileReady}
-            >
+            <button type="submit" disabled={busy || !email.trim()}>
               {busy ? 'Checking…' : 'Continue'}
             </button>
           </form>
@@ -506,17 +421,6 @@ export default function Login() {
               />
               <span>Trust this device for 30 days</span>
             </label>
-            {/*
-              v0.12.0: a second Turnstile widget for the
-              "Use a code instead" fallback dispatch. The passcode
-              verify path does not consume a Turnstile token (it has
-              its own 5-attempt lockout shape from v0.10.0), but if
-              the user falls back to OTC the same /auth/otc/request
-              endpoint runs and needs a token. We render the widget
-              on this step too so the fallback works without bouncing
-              back to email-entry first.
-            */}
-            <TurnstileWidget onToken={setTurnstileToken} />
             <div className="otc-actions">
               <button type="submit" disabled={busy || !passcode.trim()}>
                 {busy ? 'Signing in…' : 'Sign in'}
@@ -525,7 +429,7 @@ export default function Login() {
                 type="button"
                 className="btn-link-quiet"
                 onClick={fallbackToOtc}
-                disabled={busy || !turnstileReady}
+                disabled={busy}
               >
                 Use a code instead
               </button>

frontend/src/components/PRModal.jsx

@@ -10,7 +10,6 @@
 
 import { useEffect, useState } from 'react'
 import { draftPRText, openPR } from '../api'
-import { EVENTS, track } from '../lib/analytics'
 
 export default function PRModal({ slug, branch, branchIsPrivate, onClose, onOpened }) {
   const [title, setTitle] = useState('')
@@ -40,9 +39,6 @@ export default function PRModal({ slug, branch, branchIsPrivate, onClose, onOpen
     setError(null)
     try {
       const { pr_number } = await openPR(slug, branch, { title: title.trim(), description: description.trim() })
-      // v0.15.0 — analytics: fire on §10.2 PR-open success. slug
-      // and pr_number are the join keys; title/description stay out.
-      track(EVENTS.PR_OPENED, { rfc_slug: slug, pr_number })
       onOpened?.(pr_number)
     } catch (e) {
       setError(e.message)

frontend/src/components/PRView.jsx

@@ -22,7 +22,6 @@ import {
   startResolutionBranch,
   withdrawPR,
 } from '../api'
-import { EVENTS, track } from '../lib/analytics'
 
 export default function PRView({ viewer }) {
   const { slug, prNumber: prNumberParam } = useParams()
@@ -136,10 +135,6 @@ export default function PRView({ viewer }) {
         anchorPayload: reviewDraft?.anchorPayload || {},
         quote: reviewDraft?.quote || null,
       })
-      // v0.15.0 — analytics: fire on §10.4 review-comment success.
-      // surface=pr distinguishes this from RFC discussion comments.
-      // No body text or quote material in the event.
-      track(EVENTS.COMMENT_POSTED, { rfc_slug: slug, pr_number: prNumber, surface: 'pr' })
       setReviewText('')
       setReviewDraft(null)
       await refresh()

frontend/src/components/ProposeModal.jsx

@@ -11,7 +11,6 @@
 
 import { useEffect, useState } from 'react'
 import { proposeRFC } from '../api'
-import { EVENTS, track } from '../lib/analytics'
 
 function slugify(title) {
   return title
@@ -53,10 +52,6 @@ export default function ProposeModal({ viewer, onClose, onSubmitted }) {
         pitch: pitch.trim(),
         tags,
       })
-      // v0.15.0 — analytics: fire on the §9.1 propose-RFC submit.
-      // Slug is a stable, low-cardinality identifier (kebab-case
-      // ascii); title and pitch stay out of the event body.
-      track(EVENTS.RFC_PROPOSED, { rfc_slug: slug })
       onSubmitted?.(result)
     } catch (err) {
       setError(err.message || 'Submission failed.')

frontend/src/components/RFCDiscussionPanel.jsx

@@ -18,7 +18,6 @@ import {
   postDiscussionMessage,
   resolveDiscussionThread,
 } from '../api'
-import { EVENTS, track } from '../lib/analytics'
 
 export default function RFCDiscussionPanel({ slug, viewer }) {
   const [threads, setThreads] = useState([])
@@ -101,10 +100,6 @@ export default function RFCDiscussionPanel({ slug, viewer }) {
         void message_id
       }
       setComposer('')
-      // v0.15.0 — analytics: fire on a successful discussion post.
-      // surface=discussion distinguishes this from PR review comments
-      // which fire from PRView with surface=pr. No body text.
-      track(EVENTS.COMMENT_POSTED, { rfc_slug: slug, surface: 'discussion' })
     } catch (err) {
       setError(err.message)
     } finally {

frontend/src/components/RFCView.jsx

@@ -44,7 +44,6 @@ import ChangePanel, { diffWords } from './ChangePanel.jsx'
 import PRModal from './PRModal.jsx'
 import GraduateDialog from './GraduateDialog.jsx'
 import { claimOwnership } from '../api'
-import { EVENTS, track } from '../lib/analytics'
 
 const MANUAL_IDLE_MS = 5 * 60 * 1000   // §8.6 idle window; exact value is impl detail.
 const MANUAL_DEBOUNCE_MS = 800
@@ -122,15 +121,7 @@ export default function RFCView({ viewer }) {
   const [drawerOpen, setDrawerOpen] = useState(false)
 
   useEffect(() => {
-    getRFC(slug).then(entry => {
-      setEntry(entry)
-      // v0.15.0 — analytics: fire RFC Viewed once per slug load.
-      // We key on the slug param rather than the loaded entry so a
-      // re-render doesn't double-fire; the slug is the stable
-      // identifier. id is included for join-friendliness in the
-      // Amplitude dashboard.
-      track(EVENTS.RFC_VIEWED, { rfc_slug: slug, rfc_id: entry?.id })
-    }).catch(err => setError(err.message))
+    getRFC(slug).then(setEntry).catch(err => setError(err.message))
     listModels(slug)
       .then(({ models, default: def }) => {
         setModels(models || [])

frontend/src/components/TurnstileWidget.jsx

@@ -1,120 +0,0 @@
-// TurnstileWidget.jsx — v0.12.0 / roadmap item #10.
-//
-// Renders the CloudFlare Turnstile JS widget on the email-entry step of
-// `/login`. Reads the site key from `import.meta.env.VITE_TURNSTILE_SITE_KEY`
-// (Vite convention — VITE_* prefix is build-time embedded). When the
-// site key is unset/empty, this component renders nothing and reports
-// a `null` token through `onToken` so the parent form can still submit.
-// The backend's `TURNSTILE_REQUIRED` policy decides what happens to a
-// request that arrives without a token; the frontend is intentionally
-// not in that loop. See `backend/app/turnstile.py` for the matrix.
-//
-// The CloudFlare script is loaded once per page on first widget mount.
-// Subsequent mounts (e.g. user goes back to email-entry after a failed
-// OTC request) reuse the script tag and re-render the widget on the
-// fresh container `div`. Unmounting removes the widget instance via
-// `turnstile.remove(widgetId)` so a remount produces a new challenge
-// rather than reusing a stale, already-consumed token.
-//
-// Turnstile contract:
-//   * `data-callback` fires with the token string on a successful
-//     challenge; the token is single-use and expires after ~5 minutes.
-//   * `data-error-callback` fires on a failed challenge (network,
-//     blocked, etc.); we surface a `null` token so the parent shows
-//     a retry hint.
-//   * `data-expired-callback` fires when the token times out before
-//     submission; we also drop to `null` and re-render so the user
-//     gets a fresh challenge on retry.
-//
-// We do **not** import the CloudFlare script at build time; loading it
-// dynamically here keeps the bundle clean of an external request the
-// page may not need (anonymous viewers reading RFCs never see Login).
-
-import { useEffect, useRef } from 'react'
-
-const TURNSTILE_SCRIPT_URL = 'https://challenges.cloudflare.com/turnstile/v0/api.js'
-const SITE_KEY = import.meta.env.VITE_TURNSTILE_SITE_KEY || ''
-
-// Promise-keyed: only one script tag, only one resolution chain.
-let scriptLoadPromise = null
-
-function loadTurnstileScript() {
-  if (typeof window === 'undefined') return Promise.resolve(null)
-  if (window.turnstile) return Promise.resolve(window.turnstile)
-  if (scriptLoadPromise) return scriptLoadPromise
-
-  scriptLoadPromise = new Promise((resolve, reject) => {
-    const existing = document.querySelector(`script[src="${TURNSTILE_SCRIPT_URL}"]`)
-    if (existing) {
-      existing.addEventListener('load', () => resolve(window.turnstile))
-      existing.addEventListener('error', reject)
-      return
-    }
-    const script = document.createElement('script')
-    script.src = TURNSTILE_SCRIPT_URL
-    script.async = true
-    script.defer = true
-    script.addEventListener('load', () => resolve(window.turnstile))
-    script.addEventListener('error', reject)
-    document.head.appendChild(script)
-  })
-  return scriptLoadPromise
-}
-
-export function turnstileEnabled() {
-  return !!SITE_KEY
-}
-
-export default function TurnstileWidget({ onToken, theme = 'auto' }) {
-  const containerRef = useRef(null)
-  const widgetIdRef = useRef(null)
-
-  useEffect(() => {
-    if (!SITE_KEY) {
-      // No site key configured → surface a null token immediately so
-      // the parent form's submit-disabled gate doesn't lock up
-      // waiting on a challenge that will never arrive. The backend
-      // decides whether a tokenless request is admitted.
-      onToken?.(null)
-      return undefined
-    }
-
-    let cancelled = false
-    loadTurnstileScript()
-      .then(turnstile => {
-        if (cancelled || !turnstile || !containerRef.current) return
-        widgetIdRef.current = turnstile.render(containerRef.current, {
-          sitekey: SITE_KEY,
-          theme,
-          callback: token => onToken?.(token),
-          'error-callback': () => onToken?.(null),
-          'expired-callback': () => onToken?.(null),
-        })
-      })
-      .catch(() => {
-        // Script load failure — surface null so the parent can decide
-        // what to do (today: still let submit through; the backend
-        // policy decides admission).
-        if (!cancelled) onToken?.(null)
-      })
-
-    return () => {
-      cancelled = true
-      if (widgetIdRef.current && window.turnstile) {
-        try {
-          window.turnstile.remove(widgetIdRef.current)
-        } catch (_) {
-          // Already gone or never registered — nothing to clean up.
-        }
-        widgetIdRef.current = null
-      }
-    }
-    // We intentionally do not list `onToken` in the dependency array;
-    // a parent re-rendering with a fresh closure should not tear down
-    // and rebuild the widget (which would consume a fresh challenge).
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [])
-
-  if (!SITE_KEY) return null
-  return <div ref={containerRef} className="turnstile-widget" />
-}

frontend/src/lib/analytics.js

@@ -1,287 +0,0 @@
-// analytics.js — v0.15.0 / roadmap item #13.
-//
-// Wrapper around `@amplitude/unified` (Amplitude Analytics +
-// Session Replay) that gates SDK initialization on the user's
-// cookie/privacy consent (v0.13.0, `frontend/src/lib/consent.js`,
-// SPEC §14.5). The wrapper presents a stable surface to the rest
-// of the app:
-//
-//     import { track, identify, anonymize } from './lib/analytics'
-//
-//     track('RFC Viewed', { rfc_slug: 'open-human-model' })
-//     identify({ user_id: 'u_123' })
-//     anonymize()  // call on sign-out
-//
-// At first import the wrapper:
-//   1. Calls `bootstrap()` once, which reads `getConsent()` and
-//      subscribes to `onConsentChange()`. If consent.analytics is
-//      true, it lazily imports the Amplitude SDK and calls
-//      `amplitude.initAll(API_KEY, { analytics: { autocapture: true },
-//                                     sessionReplay: { sampleRate: 1 } })`.
-//      If consent.analytics is false (or undecided), the SDK is
-//      not loaded — no network request, no cookies, no session
-//      replay recording. A later consent change to `true` triggers
-//      init at that moment.
-//   2. The wrapper queues `track()` and `identify()` calls made
-//      before init finishes (lazy import + consent grant), and
-//      drains the queue when init completes.
-//   3. If the user later flips consent from granted → denied, the
-//      wrapper calls `amplitude.setOptOut(true)` so subsequent
-//      events are dropped client-side and session replay stops
-//      recording (the SDK is still loaded — we cannot unload a
-//      script — but it stops firing).
-//
-// Consent precedence ladder:
-//
-//     consent.analytics === true   → init + track
-//     consent.analytics === false  → no init; or if already init,
-//                                    setOptOut(true)
-//     consent.recorded_at === null → treat as denied (banner is up;
-//                                    the user has not yet chosen)
-//
-// Session replay scope: this release ships session replay at
-// `sampleRate: 1` (100% of sessions are recorded for full-DOM
-// playback). That is the vendor-recommended default for new
-// Amplitude deployments. The v0.13.0 consent banner's single
-// "analytics" toggle gates both events and session replay together —
-// a separate consent category for session-replay specifically is a
-// §19.2 follow-up.
-//
-// API key resolution:
-//
-//     The build-time env var `VITE_AMPLITUDE_API_KEY` carries the
-//     Amplitude project's API key. When it is unset/empty, the
-//     wrapper logs one console warning and no-ops — every public
-//     function becomes a deterministic no-op so dev environments
-//     (and deployments that intentionally don't ship analytics)
-//     keep working. The deploy gesture wires the key via flotilla's
-//     `overlay set` verb (see CHANGELOG for the operator gesture):
-//     Amplitude browser keys are bundle-embedded by design (visible
-//     to anyone with dev tools, same nature as the v0.12.0
-//     `VITE_TURNSTILE_SITE_KEY`), so the binding is overlay, not
-//     secret.
-//
-// PII discipline:
-//
-//     `identify({ user_id })` SHOULD pass only the opaque server-
-//     side user id (the `viewer.id` integer or string). DO NOT pass
-//     email, display name, IP, or any other PII through the SDK.
-//     Event properties SHOULD likewise stay limited to ids and
-//     enums; free-text fields (titles, comment bodies) MUST NOT be
-//     sent.
-//
-// Event taxonomy: defined in `EVENTS` below. Callers SHOULD use
-// one of these names rather than firing arbitrary strings — that
-// keeps the Amplitude dashboard coherent over time.
-
-import { getConsent, onConsentChange } from './consent.js'
-
-const API_KEY = import.meta.env.VITE_AMPLITUDE_API_KEY || ''
-
-// Public taxonomy. Keep this short and stable — new entries should
-// land via a release, not ad-hoc. The strings match the Amplitude
-// dashboard names exactly (Title Case, spaces, no punctuation).
-export const EVENTS = Object.freeze({
-  PAGE_VIEWED: 'Page Viewed',
-  RFC_VIEWED: 'RFC Viewed',
-  USER_SIGNED_IN: 'User Signed In',
-  USER_SIGNED_OUT: 'User Signed Out',
-  RFC_PROPOSED: 'RFC Proposed',
-  PR_OPENED: 'PR Opened',
-  COMMENT_POSTED: 'Comment Posted',
-  BETA_ACCESS_REQUESTED: 'Beta Access Requested',
-  ADMIN_PERMISSION_DECISION: 'Admin Permission Decision',
-})
-
-// Internal state.
-let _bootstrapped = false
-let _amplitude = null       // The dynamically imported SDK module.
-let _initPromise = null     // Pending init (lazy import + sdk.init).
-let _initialized = false    // True after sdk.init has resolved.
-let _warnedNoKey = false
-let _pendingUserId = null   // identify() called before init resolves.
-const _queue = []           // {kind: 'track'|'identify'|'anonymize', ...}
-
-function warnNoKey() {
-  if (_warnedNoKey) return
-  _warnedNoKey = true
-  // eslint-disable-next-line no-console
-  console.warn(
-    '[analytics] VITE_AMPLITUDE_API_KEY is unset; analytics events ' +
-    'and session replay will not be sent. This is expected in dev; ' +
-    'in production it means the operator has not yet run ' +
-    '`flotilla overlay set <deployment> VITE_AMPLITUDE_API_KEY=<key>`.',
-  )
-}
-
-function consentGranted() {
-  const c = getConsent()
-  return !!(c && c.recorded_at && c.analytics)
-}
-
-// Drain the queue. Called once init resolves.
-function drainQueue() {
-  if (!_initialized || !_amplitude) return
-  if (_pendingUserId != null) {
-    try { _amplitude.setUserId(_pendingUserId) } catch (_) {}
-    _pendingUserId = null
-  }
-  while (_queue.length > 0) {
-    const item = _queue.shift()
-    try {
-      if (item.kind === 'track') {
-        _amplitude.track(item.name, item.props || {})
-      } else if (item.kind === 'identify') {
-        if (item.user_id != null) _amplitude.setUserId(item.user_id)
-      } else if (item.kind === 'anonymize') {
-        _amplitude.reset()
-      }
-    } catch (_) {
-      // SDK errors are non-fatal; analytics is best-effort.
-    }
-  }
-}
-
-// Lazy import + init. Resolves once the SDK is ready to take events.
-// Idempotent: subsequent calls return the same promise.
-async function initSdk() {
-  if (_initPromise) return _initPromise
-  if (!API_KEY) {
-    warnNoKey()
-    // Resolve immediately with a no-op shape; the wrapper's public
-    // functions check API_KEY and short-circuit, so this never
-    // actually runs SDK code.
-    _initPromise = Promise.resolve(null)
-    return _initPromise
-  }
-  _initPromise = (async () => {
-    try {
-      const mod = await import('@amplitude/unified')
-      // The unified package exposes `initAll`, `track`,
-      // `setUserId`, `reset`, `setOptOut` as named functions.
-      // We hold the module so the queue drainer can call them
-      // by name.
-      _amplitude = mod
-      // initAll wires up both Analytics and Session Replay in one
-      // call. Vendor-recommended init shape from the Amplitude
-      // installation wizard:
-      //   - analytics.autocapture: true — auto-instruments page
-      //     views, session start/end, clicks, and form interactions.
-      //     Our explicit `track('Page Viewed', …)` etc. layer on top
-      //     for app-specific names that survive renames.
-      //   - sessionReplay.sampleRate: 1 — record 100% of sessions
-      //     for full-DOM playback. Gated by the v0.13.0 consent
-      //     banner just like the rest of the SDK; never starts
-      //     recording without explicit analytics opt-in.
-      const ret = mod.initAll(API_KEY, {
-        analytics: { autocapture: true },
-        sessionReplay: { sampleRate: 1 },
-      })
-      // initAll returns an AmplitudeReturn with a `.promise` accessor
-      // (consistent with the legacy `init`). Some unified builds
-      // resolve synchronously; await defensively.
-      if (ret && ret.promise) await ret.promise
-      _initialized = true
-      drainQueue()
-    } catch (err) {
-      // Init failure is non-fatal; keep the wrapper alive so future
-      // calls no-op. Log once for the operator.
-      // eslint-disable-next-line no-console
-      console.warn('[analytics] Amplitude init failed:', err)
-      _initialized = false
-    }
-    return _amplitude
-  })()
-  return _initPromise
-}
-
-// Bootstrap is called lazily on first track/identify. It wires the
-// consent subscription so a later flip from denied→granted triggers
-// init at that moment, and granted→denied flips the opt-out.
-function bootstrap() {
-  if (_bootstrapped) return
-  _bootstrapped = true
-  if (consentGranted()) {
-    // Fire-and-forget; the queue catches any events that arrive
-    // before init resolves.
-    initSdk()
-  }
-  onConsentChange(snapshot => {
-    const allowed = !!(snapshot && snapshot.recorded_at && snapshot.analytics)
-    if (allowed && !_initPromise) {
-      initSdk()
-    } else if (allowed && _initialized && _amplitude) {
-      // Re-enable in case we previously opted out.
-      try { _amplitude.setOptOut(false) } catch (_) {}
-    } else if (!allowed && _initialized && _amplitude) {
-      // Granted → denied. Stop firing. We cannot unload the script
-      // tag; setOptOut is the SDK's contract for "drop subsequent
-      // events client-side".
-      try { _amplitude.setOptOut(true) } catch (_) {}
-    }
-  })
-}
-
-/** Fire a track event. Safe to call before consent / init resolve;
- *  the call is queued and drained once both are true. Drops the
- *  event silently if API_KEY is empty (with a one-shot warn) or
- *  consent.analytics is false. */
-export function track(name, props) {
-  if (!API_KEY) { warnNoKey(); return }
-  bootstrap()
-  if (!consentGranted()) return
-  if (_initialized && _amplitude) {
-    try { _amplitude.track(name, props || {}) } catch (_) {}
-    return
-  }
-  _queue.push({ kind: 'track', name, props })
-}
-
-/** Attach an authenticated user id. Pass `{ user_id: '<opaque-id>' }`.
- *  DO NOT pass email or display name. Idempotent — subsequent calls
- *  with the same id are cheap. */
-export function identify({ user_id } = {}) {
-  if (!API_KEY) { warnNoKey(); return }
-  if (user_id == null) return
-  bootstrap()
-  if (!consentGranted()) {
-    // Hold the id for when consent lands; identify-on-sign-in is a
-    // common race with the consent banner choice.
-    _pendingUserId = user_id
-    return
-  }
-  if (_initialized && _amplitude) {
-    try { _amplitude.setUserId(user_id) } catch (_) {}
-    return
-  }
-  _pendingUserId = user_id
-  _queue.push({ kind: 'identify', user_id })
-}
-
-/** Reset the user binding. Call this on sign-out so the next page
- *  navigations are attributed to a fresh anonymous device id. Has
- *  no effect when analytics is disabled. */
-export function anonymize() {
-  if (!API_KEY) { warnNoKey(); return }
-  _pendingUserId = null
-  bootstrap()
-  if (!consentGranted()) return
-  if (_initialized && _amplitude) {
-    try { _amplitude.reset() } catch (_) {}
-    return
-  }
-  _queue.push({ kind: 'anonymize' })
-}
-
-/** Test helper — exposed for unit tests, not for app code.
- *  Resets module-level state so a fresh bootstrap cycle can be
- *  exercised. */
-export function __resetForTests() {
-  _bootstrapped = false
-  _amplitude = null
-  _initPromise = null
-  _initialized = false
-  _warnedNoKey = false
-  _pendingUserId = null
-  _queue.length = 0
-}