docs(audit): add fix-areas section to Phase 0 + Phases 1-8 playbook

Phase 0 update: replaces the loose "quick wins" list with a structured
Fix Areas section organised into impact tiers (A: high-impact README
truth fixes, B: low-effort self-violation fixes, C: structural smells
deferred to Phase 2, D: hygiene). Each task names the file, the change,
the verification command, and the effort estimate.

New playbook: docs/audit/phases-1-8-playbook.md — step-by-step
acquisition-grade audit procedure for the remaining seven phases. Each
phase has goal, inputs, procedure (with concrete commands), deliverable,
acceptance criteria, and time estimate. Designed to be picked up
independently from any phase.

docs/audit/phase0-cartography.md

@@ -208,27 +208,123 @@ The post-rebrand state: all five handovers were rewritten by today's sweep (line
 
 ---
 
-## 9. Quick wins surfaced (defer to Phase 1, but worth flagging)
+## 9. Fix areas — actionable tasks
 
-1. **Add `description` to `crates/llm/Cargo.toml`** — 1-line fix; closes a self-imposed contribution-rule violation.
-2. **Update README stores list** — replace fiction with reality. See §7.
-3. **Remove or implement Moonshine claim** — README, line 165.
-4. **Update README Tauri commands list** — six modules undocumented. See §7.
-5. **Decide on `magnotia-cloud-providers`** — currently 80 LOC of a keystore that two consumers call. Either fold into `magnotia-core::keystore` (it's not provider-specific) or actually grow it. Right now it's a crate that doesn't earn its existence.
+Each task below is concrete: file, change, verification, effort. Pick any in any order; they don't depend on later phases. Items are grouped by impact tier.
+
+### Tier A — High impact, do first
+
+#### A1. README stores list is fiction
+- **File:** `README.md`, line 202
+- **Current:** `Reactive stores (src/lib/stores/page.svelte.ts): settings, profiles, tasks, history, taskLists, templates, page, toasts, preferences.`
+- **Reality:** stores are `page`, `preferences`, `profiles`, `toasts`, `focusTimer`, `llmStatus`, `nudgeBus`, `implementationIntentions`, `completionStats`, `speaker` — each in its own `*.svelte.ts` file under `src/lib/stores/`.
+- **Fix:** rewrite the bullet to enumerate the actual ten store files, and clarify that `page.svelte.ts` is the central app-state store (transcripts, profiles, taskLists, etc. live as fields on it).
+- **Verify:** `ls src/lib/stores/` matches the README list 1:1.
+- **Effort:** 10 min.
+
+#### A2. Moonshine claim has no implementation
+- **File:** `README.md`, line 165 (`magnotia-core` row in the crate table)
+- **Current:** `model registry (Whisper + Parakeet + Moonshine entries)`
+- **Reality:** `crates/core/src/model_registry.rs` has 6 Whisper + 1 Parakeet entries. Zero Moonshine.
+- **Fix (pick one):**
+  - (a) Remove the Moonshine reference from the README. Cheapest.
+  - (b) Add a `// TODO(moonshine): not yet wired` constant in `model_registry.rs` and a roadmap entry under §Roadmap, so the claim is at least flagged as forthcoming.
+- **Verify:** `grep -ri moonshine crates/ src-tauri/ src/` returns no orphan references.
+- **Effort:** 5 min (option a) / 30 min (option b).
+
+#### A3. Six Tauri command modules undocumented
+- **File:** `README.md`, lines 95-97 (Architecture diagram) and 175-195 (Tauri commands table)
+- **Missing:** `feedback`, `fs`, `intentions`, `nudges`, `rituals`, `tts`
+- **Fix:** add a one-line description for each in the §Tauri commands table; add the names to the Architecture-diagram bullet list.
+- **Verify:** `ls src-tauri/src/commands/*.rs | xargs basename -s .rs | sort` matches the README table 1:1 (excluding `mod`, `power`, `security`, which are utility modules — note that explicitly).
+- **Effort:** 20 min.
+
+### Tier B — Low effort, removes self-violations
+
+#### B1. `crates/llm/Cargo.toml` missing `description`
+- **File:** `crates/llm/Cargo.toml`
+- **Current:** `[package]` block has `name`, `version`, `edition` only.
+- **Reality:** README §Contributing line 362 declares this a hard rule. Self-violation.
+- **Fix:** add `description = "Local LLM engine for Magnotia (Qwen3 via llama-cpp-2). Cleanup, task extraction, content tags."` (or similar). Match the prose style of the other 8 crates' descriptions.
+- **Verify:** `for d in crates/*/Cargo.toml src-tauri/Cargo.toml; do grep -L "^description" "$d"; done` returns empty.
+- **Effort:** 2 min.
+
+#### B2. Stale test-count claim
+- **File:** `README.md`, line 14
+- **Current:** `245 automated lib tests across 10 crates, all passing`
+- **Reality:** 287 tests total (220 lib + 67 src-tauri); 220 lib-only.
+- **Fix:** decide on a number that's automatable, not a snapshot. Either: (a) replace with `220+ lib tests across 9 library crates plus 67 Tauri-app tests`, or (b) drop the absolute number and say `comprehensive automated test floor — see CI for current count`.
+- **Verify:** `grep -rE '#\[(test|tokio::test)\]' crates/*/src/ | wc -l` matches whatever number you ship.
+- **Effort:** 5 min.
+
+#### B3. Crate count claim ambiguity
+- **File:** `README.md`, line 14 ("10 crates")
+- **Reality:** 9 library crates + 1 Tauri app crate. The README's own crate table only documents 9.
+- **Fix:** say "9 library crates plus the Tauri app crate" — or just "9 library crates" and let the Tauri app stand separately, which matches the existing prose.
+- **Effort:** 2 min.
+
+### Tier C — Structural smells (defer to Phase 2 but flag now)
+
+#### C1. `magnotia-core` over-exports
+- **File(s):** `crates/core/src/lib.rs` and the modules it re-exports
+- **Symptom:** 104 public items in a "shared types" crate. High blast radius for any change.
+- **Fix (Phase 2 work, do not touch yet):** audit every `pub` item; demote anything not used outside the crate to `pub(crate)`. The expected outcome is a 30–60% reduction in public surface.
+- **Verify:** after the demotion pass, `cargo +nightly rustdoc` should still succeed and downstream crates should still compile without changes.
+- **Effort:** ~½ day (Phase 2 scope).
+
+#### C2. `magnotia-storage::database.rs` is 2,534 lines
+- **File:** `crates/storage/src/database.rs`
+- **Symptom:** single file holds CRUD for transcripts, tasks, subtasks, profiles, profile-terms, settings, error log, FTS5. No internal module boundaries.
+- **Fix (Phase 2):** split by domain — `database/transcripts.rs`, `database/tasks.rs`, `database/profiles.rs`, etc. Keep the public re-export shape unchanged so callers don't move.
+- **Verify:** `cargo test -p magnotia-storage` still passes; no public-API changes.
+- **Effort:** ~2-4 hours.
+
+#### C3. `SettingsPage.svelte` is 2,250 lines
+- **File:** `src/lib/pages/SettingsPage.svelte`
+- **Symptom:** HANDOVER.md already flags this; `SettingsGroup.svelte` was prepared but the seven-group split was deferred.
+- **Fix (Phase 2):** complete the planned restructure. Pick this up from HANDOVER.md §"9c — Settings (scaled down)".
+- **Effort:** ~½ day.
+
+#### C4. `magnotia-cloud-providers` does not earn its existence
+- **Files:** `crates/cloud-providers/` (80 LOC across 2 files)
+- **Symptom:** crate contains an in-memory keystore with env-var fallback. Not "empty scaffolding" as the README says — but also not provider-specific. No HTTP code, no providers.
+- **Fix (decide, then act):**
+  - (a) **Fold** into `magnotia-core::keystore` (preferred — it's a generic key store, nothing cloud-specific). Drop the crate. README §Architecture and the dependency graph simplify.
+  - (b) **Grow** it: actually implement an OpenAI-compatible STT client and an Anthropic STT client, gated behind a `cloud-stt` feature flag. Earn the boundary.
+- **Verify (option a):** workspace builds with `cloud-providers` removed from `Cargo.toml` members; the two consumers (`commands/llm.rs` and wherever else) re-import from `magnotia-core::keystore`.
+- **Effort:** ~1 hour (option a) / multi-day (option b).
+
+### Tier D — Hygiene (Phase 1 / Phase 8)
+
+#### D1. Five HANDOVER files in repo root
+- **Files:** `HANDOVER.md`, `HANDOVER-2026-04-{17,18,19,24}.md`
+- **Symptom:** root noise; rebrand also rewrote their content so they describe `kon`/`corbie` work but read as `magnotia`.
+- **Fix:**
+  - Move the four dated files under `docs/handovers/`.
+  - Add a one-line italic note at the top of each historical file: *"Originally written when the product was named Kon (and briefly Corbie); references rewritten in the 2026-04-30 rebrand sweep."*
+  - Keep the latest as `HANDOVER.md` in root, or also move under `docs/handovers/HANDOVER-latest.md` with a symlink — pick one.
+- **Effort:** 15 min.
+
+#### D2. Tauri command total count drift
+- **README** says "18 Tauri command modules" (line 117); actual is 22 modules with commands (plus 3 utility modules in the same dir).
+- **Fix:** update line 117 to "22 Tauri command modules + 3 utility modules (`mod`, `power`, `security`)".
+- **Effort:** 1 min — usually folded into A3.
 
 ---
 
 ## 10. Phase 1 entry plan
 
-Based on this cartography, Phase 1 (Lean-pass) should target — in this order — the highest-value, lowest-risk wins:
+Tier A and Tier B fixes above (≈45 min total) bring the README back into truth and close the self-imposed Cargo.toml rule. Do these as a warm-up before Phase 1 proper; they make every subsequent phase' "what does the README say?" comparison cheaper.
+
+Phase 1 (Lean-pass) — see [`phases-1-8-playbook.md`](phases-1-8-playbook.md) — should then target, in order:
 
 1. `cargo machete` + `cargo udeps` workspace-wide → unused deps kill list.
 2. `knip` on the frontend → unused TS/Svelte modules.
 3. Manual review of the **5 files >1k LOC** for duplicate logic (`SettingsPage.svelte`, `database.rs`, `live.rs`, `migrations.rs`, `DictationPage.svelte`).
 4. Grep audit of `TODO` / `FIXME` / `unimplemented!` / `unwrap()` outside tests → tech-debt log.
-5. Reconcile the §7 README drifts.
+5. Apply the Tier C structural smells if Phase 2 is being done immediately afterwards.
 
-Estimated time: **1 working day** to deliver Phase 1 in full.
+Estimated time: **1 working day** for Phase 1 in full, plus ~45 min of Tier A/B fixes.
 
 ---