# Add the work plan for the code review fixes

Branch: `review-fixes-plan` → `main`

## What changed

New `docs/review-fixes-plan.md`: the plan for fixing the findings of the 2026-11-12 source code review, written so an agent can pick up one PR at a time.

- **Decisions** settled on 2026-11-12: a 512 MB decompression limit, the S4 change to bound paths, "A1" pad labels everywhere, 0.5.2 then 0.5.3 as releases, no CI, and the current PR record layout.
- **Guidelines for agents:** branch and PR flow on Gogs, PR records, the checks to run before every push, code rules, and release tagging.
- **Nine PRs** in order, each with its branch name, the findings it fixes, tasks and done criteria. PRs 1-4 ship the security fixes as 0.5.2; PRs 5-9 ship the hardening work as 0.5.3.
- **Backlog:** findings not yet scheduled.

No code changes and no version change.

## Notes

- PR 8 asks whether to keep `minimum-release-age` in `.npmrc` for pnpm; npm 11 warns about it on every install.
- PR 4 needs Go 1.27.4 (GO-2026-6859). The VPS repositories offered only 1.27.3 on 2026-11-12.

## Testing

Documentation only. `go test ./...` passes on the server.