v5.0.0 Major Refactor: Move from Vue 3 + JSDoc to Svelte 5 + Typescript

.agents/README.md

@@ -1,7 +1,7 @@
 # .agents index
 
-Agent guidance only. End-user docs: `docs/en/`.
-Entry: root `AGENTS.md`.
+Agent guidance only. End-user docs: docs/en/.
+Entry: root AGENTS.md. Always-on rules: .agents/conventions/core.md and .agents/conventions/reticulum-zen.md.
 
 ## Open by need
 
@@ -11,14 +11,14 @@ Entry: root `AGENTS.md`.
 | Domain to manager / HTTP / WS / tests | [module-ownership.md](module-ownership.md)                   |
 | Mesh Zen gates                        | [conventions/reticulum-zen.md](conventions/reticulum-zen.md) |
 | Always-on standards                   | [conventions/core.md](conventions/core.md)                   |
-| Vue UI                                | [conventions/frontend.md](conventions/frontend.md)           |
+| Frontend (Svelte 5)                   | [conventions/frontend.md](conventions/frontend.md)           |
 | Python / HTTP / SQLite                | [conventions/backend.md](conventions/backend.md)             |
 | Local FS jail                         | [conventions/path-jail.md](conventions/path-jail.md)         |
 | Android WebView                       | [conventions/android.md](conventions/android.md)             |
-| Tests / references / contracts           | [conventions/tests.md](conventions/tests.md)                 |
+| Tests / references / contracts        | [conventions/tests.md](conventions/tests.md)                 |
 | Commit messages                       | [conventions/commits.md](conventions/commits.md)             |
 
-Skills: one file each at `skills/<name>/SKILL.md`. Open the matching skill before coding that surface.
+Skills: one file each at skills/<name>/SKILL.md. Open the matching skill before coding that surface.
 
 ## Skills (trigger to path)
 
@@ -38,7 +38,7 @@ Skills: one file each at `skills/<name>/SKILL.md`. Open the matching skill befor
 | privacy mode / clearnet HTTP             | [privacy-mode-clearnet](skills/privacy-mode-clearnet/SKILL.md)               |
 | new page, toast, i18n                    | [page-toast-tests](skills/page-toast-tests/SKILL.md)                         |
 | nav, tools, commands, WS registry        | [contribution-registries](skills/contribution-registries/SKILL.md)           |
-| Vue mega-page extract                    | [vue-mega-page-split](skills/vue-mega-page-split/SKILL.md)                   |
+| Svelte 5 / feature modules               | [svelte-feature-modules](skills/svelte-feature-modules/SKILL.md)             |
 | HTTP/WS extract from meshchat.py         | [meshchat-orchestration-split](skills/meshchat-orchestration-split/SKILL.md) |
 | identity key vs zip restore              | [identity-restore](skills/identity-restore/SKILL.md)                         |
 | identity switch teardown                 | [identity-switch-teardown](skills/identity-switch-teardown/SKILL.md)         |
@@ -52,7 +52,7 @@ Skills: one file each at `skills/<name>/SKILL.md`. Open the matching skill befor
 | Electron frozen packaging                | [electron-frozen-packaging](skills/electron-frozen-packaging/SKILL.md)       |
 | Android bridge                           | [android-webview-bridge](skills/android-webview-bridge/SKILL.md)             |
 | focused test loops                       | [test-loop](skills/test-loop/SKILL.md)                                       |
-| property / fuzz references                  | [test-oracles](skills/test-oracles/SKILL.md)                                 |
+| property / fuzz references               | [test-oracles](skills/test-oracles/SKILL.md)                                 |
 | exploratory bug hunt                     | [exploratory-testing](skills/exploratory-testing/SKILL.md)                   |
 | releases, tags, immutability             | [release-immutability](skills/release-immutability/SKILL.md)                 |
 | experimental WebTransport live           | [webtransport-experimental](skills/webtransport-experimental/SKILL.md)       |

.agents/conventions/android.md

@@ -1,9 +1,9 @@
 # Android conventions
 
-Applies when editing `android/**/*.{java,kt}`.
+Applies when editing android/**/*.{java,kt}.
 
-- WebView `accept` extension tokens are not valid MIME types. Map `.ext` to `application/octet-stream` / `*/*` before `EXTRA_MIME_TYPES`.
-- Set `EXTRA_ALLOW_MULTIPLE` only when the chooser mode is multi-open.
-- Prefer existing bridge patterns in `MainActivity` for storage, file pick, and push.
+- WebView accept extension tokens are not valid MIME types. Map .ext to application/octet-stream / _/_ before EXTRA_MIME_TYPES.
+- Set EXTRA_ALLOW_MULTIPLE only when the chooser mode is multi-open.
+- Prefer existing bridge patterns in MainActivity for storage, file pick, and push.
 - After Android bridge changes, note whether emulator smoke or unit coverage is needed.
-- WebView navigation uses `RemoteBackendUrl.isAllowedShellNavigation` (backend origin only). Deny `data:` and userinfo. Keep file access off and mixed content never-allow. The JS bridge follows every loaded page. See `.agents/skills/url-origin-allowlists/SKILL.md`.
+- WebView navigation uses RemoteBackendUrl.isAllowedShellNavigation (backend origin only). Deny data: and userinfo. Keep file access off and mixed content never-allow. The JS bridge follows every loaded page. See .agents/skills/url-origin-allowlists/SKILL.md.

.agents/conventions/backend.md

@@ -1,23 +1,24 @@
 # Backend conventions
 
-Applies when editing `meshchatx/**/*.py`.
+Applies when editing meshchatx/**/*.py.
 
-- Prefer `uv run` / `task` for pytest and ruff.
-- HTTP handlers: return 400 for `ValueError` / bad input, 503 for retryable SQLite/Landlock unavailability, 500 only for unexpected failures.
-- Thin HTTP handlers live under `meshchatx/src/backend/http/routes/`. Parse the request, call a manager or app method, map errors. Do not add new business logic in route modules.
-- Shared HTTP helpers: `backend/http/errors.py`, `backend/http/context.py`, `backend/http/middleware.py`, `backend/http/register.py`, `backend/http/uploads.py`. Wire constants (`API_V1_PREFIX`, `WsInboundType`) live in `backend/constants.py`.
-- JSON error responses go through `errors.py` helpers (`http_bad_request` / `http_unavailable` / `http_not_found` / `http_error_from_exception` ...). Canonical payload is `{"error", "code", "message"}`; the contract test `test_http_error_shape_contract.py` enforces it.
-- In `except` blocks use `http_error_from_exception(exc)` instead of reflecting `str(exc)`; it maps PathJailError reasons to 400/403/404 and keeps OSError internals server-side. Pass `key=`/`extra=` to preserve route payload shapes.
-- Client-supplied bodies and multipart fields must flow through `uploads.py` (`read_json_limited` for JSON bodies, `read_field_limited`/`read_field_text_limited` for multipart fields, `write_field_to_path` for streamed uploads) with an explicit per-endpoint byte cap from the `UPLOAD_LIMITS` table or a feature-owned constant.
-- When splitting or moving handlers among `routes/<domain>.py`, follow `.agents/skills/meshchat-orchestration-split/SKILL.md` and `.agents/module-ownership.md`. Mechanical moves only (no behaviour change in the same change).
+- Prefer uv run / task for pytest and ruff.
+- HTTP handlers: return 400 for ValueError / bad input, 503 for retryable SQLite/Landlock unavailability, 500 only for unexpected failures.
+- Thin HTTP handlers live under meshchatx/src/backend/http/routes/. Parse the request, call a manager or app method, map errors. Do not add new business logic in route modules.
+- Shared HTTP helpers: backend/http/errors.py, backend/http/context.py, backend/http/middleware.py, backend/http/register.py, backend/http/uploads.py, backend/http/meshchat_names.py. Wire constants (API_V1_PREFIX, WsInboundType) live in backend/constants.py.
+- errors.py and context.py are intentional scaffolding. Adopt http_bad_request / http_unavailable / http_unexpected only when a handler is already thin. Do not refactor fat handlers only to call them.
+- JSON error responses go through errors.py helpers (http_bad_request / http_unavailable / http_not_found / http_error_from_exception ...). Canonical payload is {"error", "code", "message"}; the contract test test_http_error_shape_contract.py enforces it.
+- In except blocks use http_error_from_exception(exc) instead of reflecting str(exc); it maps PathJailError reasons to 400/403/404 and keeps OSError internals server-side. Pass key=/extra= to preserve route payload shapes.
+- Client-supplied bodies and multipart fields must flow through uploads.py (read_json_limited for JSON bodies, read_field_limited/read_field_text_limited for multipart fields, write_field_to_path for streamed uploads) with an explicit per-endpoint byte cap from the UPLOAD_LIMITS table or a feature-owned constant.
+- When splitting or moving handlers among routes/<domain>.py, follow .agents/skills/meshchat-orchestration-split/SKILL.md and .agents/module-ownership.md. Mechanical moves only (no behaviour change in the same change).
 - Multipart parsers must not assume field order.
-- SQLite worker connections must set `temp_store=MEMORY` in `DatabaseProvider` (Landlock-safe).
+- SQLite worker connections must set temp_store=MEMORY in DatabaseProvider (Landlock-safe).
 - Under Landlock, memory-pressure must not force FILE temp for conversation queries.
-- Subprocess or user-local CLI features must remain usable under Landlock. Extend `landlock_sandbox.py` read/RW roots and add a probe in `tests/backend/test_landlock_integration_surfaces.py` (see `landlock-sqlite` skill).
-- Keep conversation list queries slim: truncate content, derive attachment flags in SQL, avoid shipping full `fields` blobs.
+- Subprocess or user-local CLI features must remain usable under Landlock. Extend landlock_sandbox.py read/RW roots and add a probe in tests/backend/test_landlock_integration_surfaces.py (see landlock-sqlite skill).
+- Keep conversation list queries slim: truncate content, derive attachment flags in SQL, avoid shipping full fields blobs.
 - Identity restore validates size and empty payloads. Preserve existing identity metadata on re-import.
 - No backticks in code comments. Prefer plain words or quoted identifiers.
-- RRC / LXMF / LXST changes: open the matching skill under `.agents/skills/` and run reference-style tests when behaviour changes.
-- Local filesystem browse/upload/download/delete: follow `.agents/conventions/path-jail.md` and `.agents/skills/path-jail-local-fs/SKILL.md`.
-- File persistence: write via `atomic_write_bytes`/`atomic_write_text` or `json_store.save_json`; read state via `json_store.load_json` (default on corrupt/missing) or `load_json_required` (raise). Do not hand-roll mkstemp+os.replace or bare open+json.load.
-- Manager result envelopes use `backend/results.py` (`ok_result`, `err_result`, `err_result_from`); never return `str(exc)` from OSError to clients.
+- RRC / LXMF / LXST changes: open the matching skill under .agents/skills/ and run oracle-style tests when behaviour changes.
+- Local filesystem browse/upload/download/delete: follow .agents/conventions/path-jail.md and .agents/skills/path-jail-local-fs/SKILL.md.
+- File persistence: write via atomic_write_bytes/atomic_write_text or json_store.save_json; read state via json_store.load_json (default on corrupt/missing) or load_json_required (raise). Do not hand-roll mkstemp+os.replace or bare open+json.load.
+- Manager result envelopes use backend/results.py (ok_result, err_result, err_result_from); never return str(exc) from OSError to clients.

.agents/conventions/commits.md

@@ -1,6 +1,6 @@
 # Commit message conventions
 
-MeshChatX uses [Conventional Commits](https://www.conventionalcommits.org/) for git history on GitHub. LXMF patch contributors can use any short message in their local commit before `git format-patch`.
+MeshChatX uses [Conventional Commits](https://www.conventionalcommits.org/) for git history on GitHub. LXMF patch contributors can use any short message in their local commit before git format-patch.
 
 ## Format
 
@@ -12,7 +12,7 @@ MeshChatX uses [Conventional Commits](https://www.conventionalcommits.org/) for
 [optional footer]
 ```
 
-- **type**: one of `feat`, `fix`, `refactor`, `chore`, `docs`, `test`, `ci`, `build`, `perf`, `style`, `revert`
+- **type**: one of feat, fix, refactor, chore, docs, test, ci, build, perf, style, revert
 - **subject**: imperative, lowercase after the colon, no trailing period, max 120 characters for the full header
 - **body**: wrap at 72 characters when you need context. Mention AI tooling here if required by CONTRIBUTING.md
 
@@ -36,15 +36,15 @@ This repo's local git config signs with rngcs (Reticulum identity, SSH signature
 
 ## Validation
 
-- **manual**: `task check:commits` or `./node_modules/.bin/commitlint --from origin/master --to HEAD`
-- **CI**: `task check:commits` on pull requests
+- **manual**: task check:commits or ./node_modules/.bin/commitlint --from origin/master --to HEAD
+- **CI**: task check:commits on pull requests
 
 ## Related commands
 
-| Command       | Purpose                                           |
-| ------------- | ------------------------------------------------- |
-| `task format` | Format the full tree (Prettier, ESLint fix, Ruff) |
-| `task lint`   | Full lint gate (same as CI lint job)              |
-| `task check`  | format, lint, and test before push                |
+| Command     | Purpose                                           |
+| ----------- | ------------------------------------------------- |
+| task format | Format the full tree (Prettier, ESLint fix, Ruff) |
+| task lint   | Full lint gate (same as CI lint job)              |
+| task check  | format, lint, and test before push                |
 
-Config: `commitlint.config.cjs`.
+Config: commitlint.config.cjs.

.agents/conventions/core.md

@@ -1,12 +1,15 @@
 # Core conventions
 
-Progressive load: root `AGENTS.md`, then one skill and one surface convention. Full index: `.agents/README.md`.
+Progressive load: root AGENTS.md, then one skill and one surface convention. Full index: .agents/README.md.
 
-- Architecture / storage / security / env: `.agents/overview.md` (only when needed).
-- Mesh-facing work: `.agents/conventions/reticulum-zen.md` then `.agents/skills/reticulum-design-gates/SKILL.md`.
-- Prefer Taskfile targets (`format`, `lint`, `test:quick`, `test:backend`, `test:frontend`).
-- Commit messages on GitHub: `.agents/conventions/commits.md`.
-- Minimal diffs. Match nearby style. Keep SPDX headers on new project files (`0BSD` unless file already differs).
+- Architecture / storage / security / env: .agents/overview.md (only when needed).
+- Mesh-facing work: .agents/conventions/reticulum-zen.md then .agents/skills/reticulum-design-gates/SKILL.md.
+- Prefer Taskfile targets (format, lint, test:quick, test:backend, test:frontend).
+- Commit messages on GitHub: .agents/conventions/commits.md.
+
+Hard rules below are always on.
+
+- Minimal diffs. Match nearby style. Keep SPDX headers on new project files (0BSD unless file already differs).
 - No emojis in repo text or agent replies. No emoji arrows or decorative unicode arrows at all.
 - No TODO/FIXME comment noise.
 - No emdashes or semicolons in comments or docs you write.
@@ -16,13 +19,15 @@ Progressive load: root `AGENTS.md`, then one skill and one surface convention. F
 - Do not commit/push unless asked.
 - User-visible UI strings: i18n keys. Action feedback: ToastUtils.
 - Do not invent install/run flows when Taskfile already covers them.
-- Do not create markdown docs unless asked (except agent guidance under `.agents/` when requested).
+- Do not create markdown docs unless asked (except agent guidance under .agents/ when requested).
 - Do not generate exploit PoCs, malware, or attack tooling.
 
 ## Prose
 
-Before writing or editing prose, read `.agents/skills/no-ai-slop/SKILL.md` and self-check against `.agents/skills/no-ai-slop/references/ai-writing-detection.md`. The 24 rules are in `.agents/skills/no-ai-slop/references/rules.md`.
+Before writing or editing prose, read .agents/skills/no-ai-slop/SKILL.md and self-check against .agents/skills/no-ai-slop/references/ai-writing-detection.md. The 24 rules are in .agents/skills/no-ai-slop/references/rules.md.
 
 Say what the thing is. Headings name the section contents. Every claim ends on a checkable detail (a path, an API, a status code, a measured quantity). Do not invent numbers, quotes, or incidents.
 
-Load `.agents/skills/rossmann-voice/SKILL.md` only when the user asks for that voice. Do not rewrite MeshChatX technical docs into that voice by default.
+When editing CHANGELOG.md, use the current CHANGELOG.md as the style reference: terse bullets, **Area**: detail, imperative mood, and specific checkable facts.
+
+Load .agents/skills/rossmann-voice/SKILL.md only when the user asks for that voice. Do not rewrite MeshChatX technical docs into that voice by default.