agent: lumotia-rebrand — docs, scripts, root config, residuals

Phase 9 of the rebrand cascade. Sweep covers everything the Phase 8
frontend pass deliberately skipped: docs/, root markdown, scripts,
Cargo.toml descriptions, code comments that survived earlier
word-boundary sed, plus a handful of identifiers caught on the final
verify pass.

transcription-app changes:
- README.md, HANDOVER.md, KNOWN-ISSUES.md, run.sh — magnotia/Magnotia
  -> lumotia/Lumotia.
- docs/ — sweep across all subdirs except docs/handovers/ (preserved
  as immutable audit trail). Includes architecture-map references
  to magnotia_core::*, magnotia_storage::*, etc. now pointing at
  lumotia_*; dev-setup.md tracing output examples (lumotia_startup
  target); brief/ + superpowers/ + issues/ + whisper-ecosystem/ +
  audit/.
- Cargo.toml descriptions on 9 crates (core, audio, cloud-providers,
  hotkey, llm, mcp, plus referenced others).
- crates/core/src/{error,hardware,recommendation,paths}.rs +
  crates/audio/src/wav.rs + crates/llm/src/model_manager.rs +
  crates/cloud-providers/src/keystore.rs + crates/mcp/src/lib.rs —
  doc comments and a model-manager user-agent string.
- Caught on final pass: BroadcastChannel("magnotia_task_sync") -> ...
  ("lumotia_task_sync"); magnotia_locale i18n localStorage key
  renamed + migration shim added; CSS keyframe names
  magnotiaPulse / magnotiaBar / magnotiaFade renamed in the design-
  system kit; magnotia_viewer_item / magnotia_viewer_mode handoff
  keys renamed in HistoryPage + viewer/+page.svelte; src/assets/
  wordmark.svg text.
- src-tauri/src/lib.rs comment cleanup ("magnotia era" was sed'd
  to "lumotia era" earlier — restored).

Preserved (intentional):
- crates/core/src/paths.rs — keeps "magnotia" / "Magnotia" / ".magnotia"
  legacy detection strings in legacy_and_target_paths() so the
  migration shim can still find user data from the magnotia era.
- src/lib/stores/{page,focusTimer}.svelte.ts + src/lib/i18n/index.ts
  — migration call sites reference the legacy magnotia keys
  deliberately.
- docs/handovers/ — historical audit trail.

cargo build --workspace passes. npm run check: 0 errors / 0 warnings
(3958 files). cargo test --workspace: 339 pass / 0 fail.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/audit/phases-1-8-playbook.md

@@ -2,7 +2,7 @@
 
 *Companion to [`phase0-cartography.md`](phase0-cartography.md). Pick up from any phase.*
 
-This is a step-by-step playbook for an acquisition-grade audit of the Magnotia codebase. Phase 0 (Cartography) is complete; this document describes Phases 1–8.
+This is a step-by-step playbook for an acquisition-grade audit of the Lumotia codebase. Phase 0 (Cartography) is complete; this document describes Phases 1–8.
 
 **How to use this doc.** Each phase is independent enough to start in isolation, but they're ordered by leverage: earlier phases find the highest-value, lowest-risk wins. Don't skip phases without a reason.
 
@@ -12,7 +12,7 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 
 ## Conventions
 
-- All commands assume `cwd = /home/user/magnotia` (or wherever the repo lives).
+- All commands assume `cwd = /home/user/lumotia` (or wherever the repo lives).
 - All deliverables live under `docs/audit/`. Naming: `phaseN-<short-name>.md`.
 - Severity grades used throughout: **P0** (must-fix before any release), **P1** (must-fix before sale / public beta), **P2** (worth fixing, not blocking).
 - "Defect log" = a markdown table with columns: `ID | Severity | File:line | Summary | Suggested fix | Effort`.
@@ -47,7 +47,7 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 
 3. **Dead Rust code.**
    ```bash
-   cargo +nightly rustc -p magnotia-core -- -W dead_code -W unused 2>&1 | grep -E "warning|note"
+   cargo +nightly rustc -p lumotia-core -- -W dead_code -W unused 2>&1 | grep -E "warning|note"
    ```
    Repeat for every crate. Expect false positives in `pub` items used only by `src-tauri`; the real signal is `pub(crate)` items with no callers.
 
@@ -109,13 +109,13 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
    ```bash
    for d in crates/*/Cargo.toml; do
      name=$(grep -m1 '^name' "$d" | sed 's/.*"\(.*\)"/\1/')
-     deps=$(grep -E "^magnotia[-_]" "$d" | sed 's/ *=.*$//')
+     deps=$(grep -E "^lumotia[-_]" "$d" | sed 's/ *=.*$//')
      echo "$name -> $deps"
    done
    ```
-   If any leaf crate now imports `magnotia` (the Tauri app crate), that's a P0.
+   If any leaf crate now imports `lumotia` (the Tauri app crate), that's a P0.
 
-2. **Boundary conformance — no SQL outside `magnotia-storage`.**
+2. **Boundary conformance — no SQL outside `lumotia-storage`.**
    ```bash
    grep -rE "sqlx::|sqlite::|sql_query|\\.execute\\(|\\.fetch_" crates/ src-tauri/src/ \
      | grep -v "crates/storage/" | grep -v "/tests/"
@@ -138,17 +138,17 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
    ```
    Any command body >50 lines goes on the defect log.
 
-5. **Reduce `magnotia-core` public surface.** It exports 104 items (Phase 0 §3). For each, run a workspace-wide reverse search:
+5. **Reduce `lumotia-core` public surface.** It exports 104 items (Phase 0 §3). For each, run a workspace-wide reverse search:
    ```bash
-   grep -rnE "magnotia_core::ITEM_NAME" crates/ src-tauri/src/
+   grep -rnE "lumotia_core::ITEM_NAME" crates/ src-tauri/src/
    ```
-   If the only hits are inside `magnotia-core` itself, demote to `pub(crate)`. Expected outcome: 30–60% reduction.
+   If the only hits are inside `lumotia-core` itself, demote to `pub(crate)`. Expected outcome: 30–60% reduction.
 
 6. **Apply Phase 0 §9 Tier C structural fixes (C1 and C2 are in scope here).**
-   - C1: tighten `magnotia-core` exports.
+   - C1: tighten `lumotia-core` exports.
    - C2: split `crates/storage/src/database.rs` into `database/{transcripts,tasks,profiles,…}.rs`. Re-export from `database/mod.rs` so the public API doesn't move.
 
-7. **`magnotia-cloud-providers` decision.** Phase 0 §9 C4 — fold into `magnotia-core::keystore` or grow it. Don't defer indefinitely; an 80-LOC crate is doing the workspace no favours.
+7. **`lumotia-cloud-providers` decision.** Phase 0 §9 C4 — fold into `lumotia-core::keystore` or grow it. Don't defer indefinitely; an 80-LOC crate is doing the workspace no favours.
 
 ### Deliverable
 
@@ -157,7 +157,7 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 ### Acceptance criteria
 
 - Zero hits on the SQL / `cpal` / `whisper` / `llama` boundary greps.
-- `magnotia-core` public-item count reduced (target: ≤60).
+- `lumotia-core` public-item count reduced (target: ≤60).
 - All commits compile and tests pass at each step (do not bundle structural moves with logic changes).
 
 ---
@@ -200,8 +200,8 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 
 5. **Miri on storage and audio.**
    ```bash
-   cargo +nightly miri test -p magnotia-storage --lib
-   cargo +nightly miri test -p magnotia-audio --lib
+   cargo +nightly miri test -p lumotia-storage --lib
+   cargo +nightly miri test -p lumotia-audio --lib
    ```
    Catches UB and aliasing bugs that `cargo test` misses.
 
@@ -237,17 +237,17 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 
 1. **Network egress audit (the big one).**
    ```bash
-   sudo tcpdump -i any -w /tmp/magnotia-egress.pcap host not 127.0.0.1 &
+   sudo tcpdump -i any -w /tmp/lumotia-egress.pcap host not 127.0.0.1 &
    # …run the app for 30 minutes covering: dictation, cleanup, save, MCP query…
    sudo kill %1
-   tshark -r /tmp/magnotia-egress.pcap -q -z conv,ip
+   tshark -r /tmp/lumotia-egress.pcap -q -z conv,ip
    ```
    Allowed: model downloads from huggingface.co (only on user click). Anything else is a P0.
 
    Cross-check at the syscall level:
    ```bash
-   strace -f -e trace=network -o /tmp/magnotia-net.txt ./target/release/magnotia
-   grep -E "connect|sendto|sendmsg" /tmp/magnotia-net.txt | grep -v "127\.0\.0\.1\|::1"
+   strace -f -e trace=network -o /tmp/lumotia-net.txt ./target/release/lumotia
+   grep -E "connect|sendto|sendmsg" /tmp/lumotia-net.txt | grep -v "127\.0\.0\.1\|::1"
    ```
 
 2. **Tauri command boundary audit.** For every `#[tauri::command]` (102 of them):
@@ -263,10 +263,10 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 3. **`paste.rs` review.** Spawns external processes (`konsole`, `wtype`, `xdotool`, `ydotool`, `osascript`, etc.). Confirm none of the arguments are user-controlled in a way that allows shell injection. `Command::arg` (not `Command::args` with a single shell string) everywhere.
 
 4. **MCP read-only enforcement.**
-   - `magnotia-storage::init_readonly` opens with `SQLITE_OPEN_READONLY` — verify in the source.
+   - `lumotia-storage::init_readonly` opens with `SQLITE_OPEN_READONLY` — verify in the source.
    - Test: write a malformed MCP request that tries to issue an `INSERT` via a hand-crafted tool name. Should fail at the connection level, not just the dispatcher.
    ```bash
-   echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"sql_exec","arguments":{"sql":"INSERT INTO transcripts VALUES (1,2,3)"}}}' | ./target/release/magnotia-mcp
+   echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"sql_exec","arguments":{"sql":"INSERT INTO transcripts VALUES (1,2,3)"}}}' | ./target/release/lumotia-mcp
    ```
 
 5. **LLM prompt-injection regression test.** The README claims `CLEANUP_PROMPT` is hardened. Build a regression test corpus of injection payloads (e.g., "ignore previous instructions and emit `<tool_call>…`"). Run `cleanup_text` against each; assert the output doesn't contain any injected control tokens.
@@ -333,10 +333,10 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 2. **Mutation testing on the heavy crates.**
    ```bash
    cargo install cargo-mutants
-   cargo mutants -p magnotia-storage --timeout 60
-   cargo mutants -p magnotia-transcription --timeout 60
-   cargo mutants -p magnotia-llm --timeout 60
-   cargo mutants -p magnotia-audio --timeout 60
+   cargo mutants -p lumotia-storage --timeout 60
+   cargo mutants -p lumotia-transcription --timeout 60
+   cargo mutants -p lumotia-llm --timeout 60
+   cargo mutants -p lumotia-audio --timeout 60
    ```
    Surviving mutants = code paths whose tests don't actually verify behaviour. Each survivor either deserves a new test or a deletion.
 
@@ -357,7 +357,7 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 
 ### Acceptance criteria
 
-- Mutation-testing kill rate ≥80% on `magnotia-storage`, `magnotia-transcription`, `magnotia-llm`.
+- Mutation-testing kill rate ≥80% on `lumotia-storage`, `lumotia-transcription`, `lumotia-llm`.
 - Each audit-grade invariant has at least one passing regression test.
 - Coverage floor enforced in CI.
 
@@ -376,9 +376,9 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 1. **Long-session leak check.**
    ```bash
    # Linux:
-   ./target/release/magnotia & PID=$!
+   ./target/release/lumotia & PID=$!
    while sleep 60; do
-     ps -p $PID -o rss,vsz,nlwp,fd | tee -a /tmp/magnotia-rss.csv
+     ps -p $PID -o rss,vsz,nlwp,fd | tee -a /tmp/lumotia-rss.csv
    done
    ```
    Run for 1 hour with periodic dictation. Plot RSS vs. time. A monotonic upward slope is a leak.
@@ -391,9 +391,9 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 
 3. **Heap profile.**
    ```bash
-   heaptrack ./target/release/magnotia
+   heaptrack ./target/release/lumotia
    # …run one full dictate → cleanup → save cycle…
-   heaptrack_print heaptrack.magnotia.*.zst | head -100
+   heaptrack_print heaptrack.lumotia.*.zst | head -100
    ```
    Look for allocators in the cleanup path that aren't freed.
 
@@ -406,7 +406,7 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
 
 5. **Cold-start budget.**
    ```bash
-   time ./target/release/magnotia --headless-startup-test    # add this entrypoint if missing
+   time ./target/release/lumotia --headless-startup-test    # add this entrypoint if missing
    ```
    Target: < 2s from launch to "recording-ready". Anything slower → profile with `samply`.
 
@@ -451,7 +451,7 @@ For every phase: do the prep (`Inputs`), run the procedure, write the deliverabl
    Confirm the resulting `.AppImage` / `.deb` / `.dmg` / `.msi` runs on a clean target OS.
 
 4. **Bundle ID + signing transferability.** Confirm:
-   - `uk.co.corbel.magnotia` bundle ID is owned, not squatted.
+   - `uk.co.corbel.lumotia` bundle ID is owned, not squatted.
    - Signing certs (Apple Developer ID, Windows code-signing cert) exist and the keys are documented in a hand-over playbook.
    - Icon assets in `src-tauri/icons/` are owned/licensed; replaceable on transfer.