Lumotia/docs/audit/phase1-lean-pass.md

Phase 1 — Lean-pass (scan-only deliverable)

Read-only deliverable; no code changes applied. Removals and refactors deferred to a review pass.

Date: 2026-05-01. Branch: main @ 7ff7295 (working tree clean at scan start; a parallel agent is committing the Phase 0 §9 Tier A/B/D1 README and Cargo.toml documentation fixes alongside this scan). Status: scan-only.

---

Methodology

This is the find-first half of audit discipline. Every section below is a scan output, lightly categorised. No code was modified to produce this report; remediation gets a separate commit and review pass after Jake walks the findings. The Phase 1 playbook (docs/audit/phases-1-8-playbook.md §Phase 1) calls for cargo machete, cargo udeps, knip, depcheck, dead-code lints per crate, a tech-debt grep, an unwrap/expect panic-surface scan, manual notes on the five files >1k LOC, and jscpd cross-file duplication. All steps were attempted; toolchain gaps are logged in §"Scans deferred".

Severity grades (per playbook): P0 must-fix before any release; P1 must-fix before sale or public beta; P2 worth fixing, not blocking.

---

1. Unused Rust dependencies

cargo machete (v0.9.2, freshly installed, recursive workspace mode) flags 4 unused-dependency hits across 4 crates.

ID	Severity	Crate	Cargo.toml declares	Notes
L1.1	P2	lumotia-cloud-providers	lumotia-core	Crate is 80 LOC of in-memory keystore; no lumotia_core:: imports in source. Likely dead since cartography §3 ("not earning its existence"). Cross-references Phase 0 Tier C4.
L1.2	P2	lumotia-core	async-trait	Not used inside core's own modules. Worth confirming with reverse-grep before removal — async_trait is sometimes pulled in by macro expansion only.
L1.3	P2	lumotia-core	serde_json	Same caveat — many crates pull serde_json for downstream re-export, but core should not need it directly.
L1.4	P2	lumotia-hotkey	lumotia-core	Hotkey crate compiles standalone; only depends on core for shared error types presumably, but the import is not present.
L1.5	P2	lumotia (src-tauri)	lumotia-cloud-providers	The Tauri crate declares the cloud-providers crate, but no lumotia_cloud_providers:: symbol appears in src-tauri/src. Folds into Phase 0 Tier C4 (kill or grow cloud-providers).

Cross-check with cargo udeps: not run. The repo currently has only a stable Rust toolchain installed (rustup toolchain list returned stable-x86_64-unknown-linux-gnu only). cargo udeps requires nightly. Logged under Scans deferred.

Recommended Phase-1 follow-up: before deleting any of these, do a workspace-wide reverse grep for each dep name; macros and re-exports defeat machete. The L1.4 and L1.5 hits in particular suggest lumotia-cloud-providers as a unit is removable (cartography Tier C4 option a — fold into lumotia-core::keystore).

---

2. Unused frontend modules

2.1 npx knip

Files reported as unused (9):

ID	Severity	File	Notes
L2.1	P2	src/app.d.ts	SvelteKit ambient declaration. Knip almost always false-positives on these; keep.
L2.2	P2	src/design-system/colors_and_type.css	Reference design-system, not live code (cartography §2 already excludes the design-system from active LOC). Verify before deletion.
L2.3	P2	src/design-system/ui_kits/DictationPage.jsx	Reference UI kit (JSX in a Svelte project — clearly a sketch, not a build target).
L2.4	P2	src/design-system/ui_kits/OtherPages.jsx	As above.
L2.5	P2	src/design-system/ui_kits/Sidebar.jsx	As above.
L2.6	P2	src/lib/components/VirtualSegmentList.svelte	Possible orphan after a refactor. Worth a grep -r VirtualSegmentList src/ to confirm before removal.
L2.7	P2	src/lib/components/VisualTimer.svelte	Same — verify no dynamic import or string-named lookup.
L2.8	P2	src/lib/shims.d.ts	TypeScript shim. Knip false-positive class; keep.
L2.9	P2	static/pcm-processor.js	AudioWorklet module — loaded by URL string at runtime, not by import. Keep (false positive).

Unused dependencies (3):

ID	Severity	Package	Notes
L2.10	P2	@tauri-apps/plugin-autostart	Likely registered Rust-side in src-tauri/Cargo.toml and configured via tauri.conf.json rather than imported from JS. Verify — if the Rust side uses it, the JS dep can go.
L2.11	P2	@tauri-apps/plugin-global-shortcut	Same — Rust-side registration.
L2.12	P2	@tauri-apps/plugin-opener	Same.

Unlisted binaries (1):

ID	Severity	Reference	Notes
L2.13	P2	du in .github/workflows/build.yml	Just a system tool used in CI. Informational; nothing to do.

Unused exports (31) and exported types (28): see /tmp/claude-1000/.../bq57g56il.output for the full list. The high-density file is src/lib/utils/textMeasure.ts (5 exports, none consumed) and src/lib/utils/settingsMigrations.ts (3 exports + 2 types). Treat each as a candidate for either consumption or deletion. Severity P2 across the board — the exports are dead but harmless; their LOC saving is real but the risk of collateral damage is nonzero (they could be imported by name from another package or via dynamic lookup). Manual review per-file in Phase 2.

2.2 npx depcheck

Run with --skip-missing to avoid false positives on dev tooling.

ID	Severity	Package	Notes
L2.14	P2	@tauri-apps/plugin-autostart	Confirms L2.10.
L2.15	P2	@tauri-apps/plugin-global-shortcut	Confirms L2.11.
L2.16	P2	@tauri-apps/plugin-opener	Confirms L2.12.
L2.17	P2	lucide-svelte	Worth investigating. Declared but depcheck found no JS-side import. If icons are inlined as SVG, the dep is genuinely dead. If imported via a wrapper component, false positive.
L2.18	P2	tailwindcss (devDep)	Almost certainly a false positive — Tailwind is wired in via @tailwindcss/vite plugin in vite.config.js rather than a direct import. Keep.

Convergent signal: L2.10/11/12 plus L2.14/15/16 — both tools agree the three Tauri plugins are JS-unused. They are still required Rust-side (the Tauri JS bridge ships separately from the Rust plugins), so the safe pattern is to keep them only if the JS API is invoked from the frontend. Quick grep -r 'autostart\|globalShortcut\|opener' src/ answers it; that is a Phase 2 pass, not a Phase 1 deletion.

---

3. Dead Rust code

Each crate was rebuilt (workspace + --all-targets) with RUSTFLAGS="-W dead_code -W unused" to surface the strictest defaults.

Result: zero warnings emitted across all nine library crates and src-tauri.

This is genuine — both cargo build --workspace and cargo build --workspace --all-targets came back clean with the elevated flags. The codebase does not carry obvious unreachable Rust code, unused imports, or unused private items as scored by rustc's default dead-code detector. Stronger lints (clippy::pedantic, clippy::nursery) are deferred to Phase 3 per the playbook.

Caveat: rustc's dead_code only fires when a pub item has no callers anywhere in the same crate; cross-crate dead pub items (where the only callers are inside a sibling crate that has since stopped using them) require the workspace-wide reverse-grep pass scheduled for Phase 2 step 5 (the lumotia-core 104-public-items audit). The L1.* dependency hits above are early evidence that some inter-crate links are already dormant.

---

4. Tech-debt grep

grep -rnE "TODO|FIXME|HACK|XXX|unimplemented!\(\)|todo!\(\)" --include="*.rs" --include="*.svelte" --include="*.ts" returned 5 hits total — a remarkably low count for a 36k-LOC codebase.

ID	Severity	File:line	Marker	Bucket	Suggested action
L4.1	P2	crates/cloud-providers/src/keystore.rs:13	TODO	(a) genuine reminder	Replace process-local Mutex<HashMap> keystore with keyring crate or platform-native credential storage so secrets persist across sessions. Cross-references Phase 0 Tier C4 (and the Plinth MEMORY.md note about plaintext Foundry secrets — same family of issue). Log to issue tracker.
L4.2	P2	crates/storage/src/database.rs:166	(TODO)	(b) historical comment	Already-resolved TODO referenced in a doc comment ("the rename was a UI-only state change with a TODO never wired up"). Reads as historical narrative; not actionable but cluttery. Optional: shorten the comment in a docs pass.
L4.3	P1	crates/storage/src/database.rs:1124	TODO	(c) silent admission	log_error is implemented but the doc comment states it is not yet wired into Tauri command error paths. Result: every command's error is converted to a String and returned to the JS layer, but the persistent error_log table is never written to from production paths. This is real audit signal: the README and crate surface advertise an error-log capability that is dormant. Wire it into the command-layer ? translations in Phase 3.
L4.4	P2	src/lib/components/MorningTriageModal.svelte:262	TODO	(a) genuine reminder	Promote inline #1a1816 50%-alpha overlay colour to a --color-overlay token in app.css. Cosmetic; safe to action in Phase 8 (docs/style truth) or whenever a token-pass happens.
L4.5	P2	src-tauri/src/commands/transcripts.rs:6	TODO (in narrative comment)	(b) historical	Comment narrates that a previous TODO ("persist to SQLite when update_transcript exists") has been resolved. Like L4.2: historical, not actionable. Optional cleanup.

Bucket totals: 1 × bucket (a), 2 × bucket (b), 1 × bucket (c, escalated to P1). Zero FIXME, zero HACK, zero XXX, zero unimplemented!(), zero todo!() in the entire active codebase. That last point is itself a strong-positive finding — see §Defect log summary.

---

5. Panic surface (unwrap / expect outside tests)

The raw grep returned 385 hits, but a context-aware Python pass (which tracks #[test], #[tokio::test], and #[cfg(test)] mod) finds that 359 of those are inside test bodies or #[cfg(test)] modules and only 26 sit on production paths. Production list below.

File:line	Context (1 line)	Risk note
crates/mcp/src/lib.rs:230	serde_json::to_string_pretty(&summaries).unwrap()	Serialising a Vec<TranscriptSummary> we just built; cannot fail in practice but the .unwrap() will panic the MCP stdio worker on any bug in the type. Trade for ?.
crates/mcp/src/lib.rs:262	text_content(serde_json::to_string_pretty(&value).unwrap())	Same family — JSON-stringifying a value of our own construction.
crates/mcp/src/lib.rs:294	serde_json::to_string_pretty(&summaries).unwrap()	Same.
crates/mcp/src/lib.rs:319	serde_json::to_string_pretty(&summaries).unwrap()	Same.
crates/llm/src/lib.rs:102	let mut guard = self.inner.lock().unwrap()	Standard Mutex::lock().unwrap() — only panics on poison. Acceptable in practice but a poisoned LLM mutex would panic the whole engine; an explicit expect("LLM engine mutex poisoned") would at least name the failure.
crates/llm/src/lib.rs:137	let mut guard = self.inner.lock().unwrap()	Same.
crates/llm/src/lib.rs:145	self.inner.lock().unwrap().model.is_some()	Same.
crates/llm/src/lib.rs:149	self.inner.lock().unwrap().loaded.clone()	Same.
crates/llm/src/lib.rs:169	NonZeroU32::new(n_ctx).expect("n_ctx must be non-zero")	Construction-time invariant; preceded by a guard that should rule out zero. Fine, but the invariant is not encoded — if a caller bypasses the guard, this panics on engine init. Reasonable to keep with the expect.
crates/llm/src/lib.rs:380	let guard = self.inner.lock().unwrap()	Mutex poison.
crates/transcription/src/streaming/commit_policy.rs:125	self.history.back().expect("history is non-empty here")	The expect string asserts a precondition that is enforced four lines above by if self.history.is_empty() { return … }. Defensible — the panic message even names the invariant. Document in a Phase-3 inline justification rather than refactor.
crates/cloud-providers/src/keystore.rs:18	api_key_store().lock().unwrap()	Mutex poison; same family as the llm ones.
crates/cloud-providers/src/keystore.rs:31	api_key_store().lock().unwrap()	Same.
src-tauri/src/lib.rs:442	.expect("error while running Lumotia")	The Tauri run() call. A panic here is the conventional pattern (no recovery anyway — process exit). Keep.
src-tauri/src/commands/power.rs:61	.unwrap()	Power-assertion mutex lock. Mutex poison.
src-tauri/src/commands/power.rs:103	assertion_registry().lock().unwrap().insert(…)	Mutex poison.
src-tauri/src/commands/power.rs:134	assertion_registry().lock().unwrap().remove(&self.id)	Mutex poison.
src-tauri/src/commands/audio.rs:159	all_samples.lock().unwrap().clear()	Mutex poison.
src-tauri/src/commands/audio.rs:165	*state.wav_writer.lock().unwrap() = Some(writer)	Mutex poison.
src-tauri/src/commands/audio.rs:166	*state.temp_audio_path.lock().unwrap() = Some(temp_path)	Mutex poison.
src-tauri/src/commands/audio.rs:316	let mut all = state.all_samples.lock().unwrap()	Mutex poison.
src-tauri/src/commands/live.rs:330	self.state.resampler.as_mut().expect("resampler just set")	Local invariant immediately after a set — defensible.
src-tauri/src/commands/live.rs:497	let running = live_state.running.lock().unwrap()	Mutex poison.
src-tauri/src/commands/live.rs:581	*live_state.running.lock().unwrap() = Some(RunningLiveSession {…})	Mutex poison.
src-tauri/src/commands/live.rs:600	let running = live_state.running.lock().unwrap().take()	Mutex poison.
src-tauri/src/commands/live.rs:606	*live_state.running.lock().unwrap() = Some(running)	Mutex poison.

Pattern summary. The 26 production unwraps cluster into three categories:

• Mutex poison (19 occurrences): Mutex::lock().unwrap(). The well-known Rust idiom; only fails if a thread panicked while holding the lock. Acceptable but inconsistent: every site should at minimum carry an expect("&str describing what") so a poison-panic crash log names the lock. Phase 3 task: standardise.
• Self-built JSON serialisation (4 occurrences in lumotia-mcp): serde_json::to_string_pretty(&value).unwrap(). Cannot fail for our own types in practice, but the playbook's "prove it can't panic on user data" rule says these should become ? or carry explicit expects. Phase 3 task.
• Locally-enforced invariants (3 occurrences in commit_policy, live, lib.rs): the line above the unwrap/expect enforces the precondition. These are the most defensible; Phase 3 should add an inline // SAFETY: … comment naming the invariant rather than rewrite.

Severity: all P2 in isolation. Collectively → P1 to standardise before sale; an acquirer reading this list will want the convention named.

---

6. Largest-file duplicate-logic notes

6.1 src/lib/pages/SettingsPage.svelte — 2,250 LOC

Confirmed seven <SettingsGroup> top-level groups (lines 972, 1020, 1379, 1569, 1808, 1947, 2119) corresponding to the planned seven-group split documented in HANDOVER.md §"9c — Settings (scaled down)". The structural decomposition is already in source — what remains is the file split: each top-level <SettingsGroup> should move to its own *.svelte file under src/lib/pages/settings/. The page-level component then becomes a slim shell ~200 LOC.

Inline observations:

• 49 <button> elements in a single component is a smell — many will share handlers via prop drilling that a per-section split would localise.
• 57 declared function / async function blocks at the top level. Most are single-section helpers (model download, vocab management, audio device polling) and would migrate cleanly with their owning <SettingsGroup>.
• let visibleAudioDevices = $derived(buildVisibleDevices(audioDevices)) (line 142) and the buildVisibleDevices helper (lines 96-142) are pure-functional and worth lifting into src/lib/utils/audioDevices.ts for unit-testing.

Severity: P2 structural. Cross-references Phase 0 Tier C3.

6.2 crates/storage/src/database.rs — 2,534 LOC

Function inventory confirms cartography §9 Tier C2: this file holds CRUD for eight domains (transcripts, transcript-search/FTS5, tasks, subtasks, profiles, profile-terms, settings, error-log, feedback, implementation-rules) plus seven row-mapping helpers (transcript_row_from, profile_row_from, profile_term_row_from, task_row_from, implementation_rule_row_from). No internal module boundaries; one flat namespace.

Duplicate-logic candidates:

• The *_row_from functions are mechanically similar; a FromRow trait or sqlx FromRow derive would collapse them. Not strictly duplicate but rhyming.
• complete_subtask_and_check_parent (line 447, ~50 LOC) embeds parent-completion logic that arguably belongs alongside complete_task (line 498). Extract candidate.

Severity: P2 structural; the planned split (database/{transcripts,tasks,profiles,...}.rs) is the right answer per Phase 0 Tier C2.

6.3 src-tauri/src/commands/live.rs — 1,737 LOC

Two #[tauri::command] functions at the top (start_live_transcription_session at 485, stop_live_transcription_session at 592). The remainder is pure helpers:

• Session lifecycle: run_live_session, open_wav_writer, finalize_wav_writer, append_resampled_audio (lines 646-722).
• Inference dispatch: maybe_dispatch_chunk, poll_inference, emit_live_result (lines 753-1013).
• Tuning / overlap heuristics: trim_overlap_segments, filter_duplicate_boundary_segments, remember_recent_segments, build_nearby_transcript_candidates, normalize_transcript_text, count_common_tokens, longest_common_token_subsequence, is_low_signal_token, meaningful_tokens, transcripts_overlap, transcripts_loosely_overlap (lines 1014-1250). This is a self-contained de-duplication subsystem that has no business living in a Tauri command file — it belongs in lumotia-transcription/src/streaming/dedup.rs (or similar) where it can be unit-tested without the Tauri runtime.
• Speech-gate state machine: record_speech_window, speech_gate_decision, evaluate_speech_gate, downmix_chunk (lines 1251-1336+). Likewise audio-domain logic; belongs in lumotia-audio or lumotia-transcription.

Recommendation (Phase 2): the file should be cut roughly in thirds. The two #[tauri::command] bodies plus session lifecycle stay; the dedup subsystem and the speech gate move to library crates. Estimated LOC for the resulting live.rs: ~600.

Severity: P1 structural. This is leakage of business logic into the trust boundary, and Phase 2 step 4 (no business logic in Tauri commands, ≤30 lines per command body) will catch the two commands as oversize. Logging here so Phase 2 has a starting point.

6.4 crates/storage/src/migrations.rs — 1,185 LOC

Inventory: 15 sequential, append-only migrations (versions 1 through 15) declared in a single MIGRATIONS constant (line 7). Each is a (i64, &str, &str) triple. The runner is run_migrations_slice (line 546), which:

1. Creates schema_version if absent.
2. Looks up MAX(version).
3. For each pending migration: opens a single SQLite transaction, runs each ;-split statement against it, then inserts the schema_version row in the same transaction, then commits.

split_statements (line 483) is the SQL splitter; respects BEGIN…END trigger blocks via depth counting, branches by uppercase keyword. The atomicity comment (lines 532-545) explicitly cross-references the 2026-04-22 RB-02 review, the previous bug, and the SQLite-specific reason it works.

No duplicate logic found. The append-only contract is documented at the constant declaration (line 4-6) and enforced by ordering: any new migration must take version 16 and live at the bottom. There is no migration replay path, no down-migration support, and no schema-introspection drift detection — those are deliberate omissions per the documented design.

Severity: zero issues. This file is the audit-friendliest artefact in the repo.

6.5 src/lib/pages/DictationPage.svelte — 1,081 LOC

32 declared function / async function blocks. The structural smell is concentration, not duplication — the file owns the entire dictate → cleanup → save → emit cycle:

• Recording lifecycle: toggleRecording, startRecording, stopRecording, cleanup (lines 295-442).
• Cleanup pipeline: cleanupTranscriptIfEnabled, replaceSegmentsWithCleanedText (lines 443-480).
• Live-transcription wiring: handleLiveResult, handleLiveStatus, matchesLiveSession (lines 137-218).
• Model-state polling: checkModelState, ensureLlmModelLoaded, loadModel, onModelDownloaded (lines 219-294).

Each cluster is a candidate child component. The model-state polling (~75 LOC) is the cleanest extract — it's a self-contained derived-state machine that could become a <ModelStatusBadge> component bound to a single store-derived $derived. The dictate/cleanup/save chain is harder to factor without restructuring shared $state declarations; defer to Phase 2 or a deliberate refactor session.

Severity: P2 structural. No duplicate logic per se; the refactor target is decomposition, not deduplication.

---

7. Cross-file duplication (jscpd)

npx jscpd --min-tokens 50 src/ src-tauri/src/ crates/ reports 32 clones, 362 duplicated lines, 3,540 duplicated tokens, 1.62% overall duplicate ratio. By format: Rust 2.15% (29 clones), TypeScript 0.42% (3 clones), zero in JSON / Svelte / CSS / JSX / Markdown.

Top cross-file pairs (≥10 lines, sorted by length):

ID	Severity	Lines	File pair (locations)	Notes
L7.1	P1	37	src-tauri/src/commands/transcription.rs 377-413 ↔ 187-223	The Whisper vs. Parakeet path duplication. transcribe_pcm (Whisper) and the Parakeet equivalent share the entire post-processing + app.emit block. 37-line clone. Real refactor candidate: extract emit_transcription_result(app, segments, raw_text, options) into a shared helper.
L7.2	P1	22	same file, 308-329 ↔ 187-208	Same family, different start point. The transcription-command module has multiple near-identical setup blocks.
L7.3	P1	19	same file, 249-267 ↔ 155-173	Same.
L7.4	P2	19	src-tauri/src/commands/paste.rs 567-585 ↔ 529-547	Per-tool subprocess error-handling. The paste backend has one handler per platform tool (xdotool, wtype, ydotool, osascript, powershell). Each clones the success/exit/stderr-format pattern. Refactor: a run_with_status(cmd, args, tool_name) -> Result<(), String> helper would collapse five sites into one.
L7.5	P2	18	src-tauri/src/commands/paste.rs 219-236 ↔ 103-120	Same family.
L7.6	P2	16	src-tauri/src/commands/paste.rs 618-633 ↔ 598-613	Same — macOS osascript path.
L7.7	P2	16	src-tauri/src/commands/paste.rs 664-679 ↔ 643-658	Same — Windows powershell path.
L7.8	P2	15	crates/llm/tests/content_tags_smoke.rs 16-30 ↔ crates/llm/tests/smoke.rs 18-32	Test harness boilerplate — model load + engine init. Acceptable test duplication, but a tests/common/mod.rs helper would be cleaner.
L7.9	P1	15	crates/llm/src/model_manager.rs 178-192 ↔ crates/transcription/src/model_manager.rs 25-39	Cross-crate clone. Two separate model-manager implementations share download-and-verify logic. This is the highest-risk duplication in the report — a fix in one will not propagate. Phase 2 candidate: extract a shared lumotia-core::model_download (or grow lumotia-cloud-providers into a real "model fetcher" crate; cf. cartography Tier C4).
L7.10	P2	15	src-tauri/src/commands/windows.rs 183-197 ↔ 66-80	Window-management command duplication. Likely the show/hide variants of the same logic.
L7.11	P2	15	src-tauri/src/commands/paste.rs 421-435 ↔ 392-406	Per-tool paste fallback.
L7.12	P2	14	src-tauri/src/commands/transcription.rs 360-373 ↔ 160-173	Continuation of L7.1-L7.3 family.
L7.13	P2	12	crates/mcp/src/lib.rs 276-287 ↔ 209-220	MCP tool-handler boilerplate. Each tools/call arm rebuilds the result envelope.
L7.14	P2	12	src-tauri/src/commands/transcription.rs 347-358 ↔ 149-160	Continuation.
L7.15	P2	11	crates/transcription/src/model_manager.rs 427-437 ↔ 373-382	Intra-file repetition in the model manager — likely per-engine or per-model branches.
L7.16	P1	11	crates/llm/src/model_manager.rs 415-425 ↔ crates/transcription/src/model_manager.rs 381-391	Second cross-crate model-manager clone — same family as L7.9.
L7.17	P2	11	src-tauri/src/commands/paste.rs 202-212 ↔ 75-85	More paste-backend boilerplate.

Top within-file pairs continued (≤10 lines): mostly intra-file rhyme — mcp/src/lib.rs lines 299-308 ↔ 209-218; crates/audio/src/decode.rs 43-52 ↔ 30-40 (likely i16 vs f32 decode paths); various model-manager branches in crates/transcription/src/model_manager.rs.

TypeScript clones (3):

ID	Severity	Lines	Pair	Notes
L7.18	P2	5	src/lib/utils/time.ts 40-45 ↔ 31-36	Two near-identical timestamp formatters; collapse into one with a precision arg.
L7.19	P2	8	src/lib/stores/page.svelte.ts 441-448 ↔ 418-425	Task-row update + toast pair. Helper extract candidate.
L7.20	P2	5	src/lib/stores/implementationIntentions.svelte.ts 25-30 ↔ src/lib/stores/nudgeBus.svelte.ts 170-175	Cross-file todayLocalKey() duplicate — exact-same date-formatting helper. Move to src/lib/utils/time.ts.

Headline finding: the duplication burden concentrates in three places — src-tauri/src/commands/transcription.rs (Whisper/Parakeet path clones, L7.1-L7.3, L7.12, L7.14), src-tauri/src/commands/paste.rs (per-platform/per-tool clones, L7.4-L7.7, L7.11, L7.17), and the cross-crate model-manager pair crates/llm/src/model_manager.rs ↔ crates/transcription/src/model_manager.rs (L7.9, L7.16). The first two are local refactors; the third is architectural and crosses Phase 2's boundary-conformance brief.

---

Defect log summary

Total findings: 87 across the seven scans (counting each L#.# entry above as one finding).

By severity:

• P0: 0
• P1: 5 (L4.3 dormant log_error; L6.3 live.rs business-logic leakage; L7.1/L7.9/L7.16 Whisper-Parakeet and cross-crate model-manager clones)
• P2: 82

By scan:

Scan	Findings	Top severity
§1 unused Rust deps	5	P2
§2 unused frontend modules	18	P2
§3 dead Rust code	0	—
§4 tech-debt grep	5	P1 (one)
§5 panic surface	26	P2 (cluster → P1)
§6 largest-file duplicate-logic notes	5	P1 (one)
§7 jscpd cross-file dup	28	P1 (three)

Recommended Phase-2 escalations (beyond the playbook's planned scope):

1. L4.3 — wire log_error into command error paths. Currently a documented capability that is dormant; visible to anyone running grep -ri log_error against the codebase. Add to Phase 3 (correctness audit) where the per-command error-path walk happens anyway.
2. L6.3 — extract live.rs dedup + speech-gate subsystems into lumotia-transcription (or a new sibling). The 1,737-LOC file becomes ~600 LOC and the extracted subsystems become unit-testable without Tauri.
3. L7.9 / L7.16 — collapse the cross-crate model-manager duplication. A shared model_download module (in lumotia-core or a grown lumotia-cloud-providers) replaces both per-crate copies. This compounds with cartography Tier C4 (the cloud-providers decision).
4. §5 cluster — name every Mutex::lock().unwrap() site. Cosmetic but uniform. Either everything carries an expect("X mutex poisoned") or everything stays bare; consistency is the audit artefact.

Surprising positives worth noting in §Acceptance gate:

• Zero dead-code warnings on a workspace-wide build with RUSTFLAGS="-W dead_code -W unused" and --all-targets. Suggests previous deletion passes have been thorough.
• Five tech-debt markers in 36k LOC. Zero unimplemented!(), zero todo!(), zero FIXME, zero HACK. The codebase carries almost no silent debt.
• 26 production unwraps, of which 19 are the standard Mutex::lock().unwrap() idiom. Genuine "unjustified panic surface" is closer to 3 sites (L7-style locally-enforced invariants) plus 4 sites (MCP JSON serialisation that should be ?).

---

Acceptance gate (per playbook)

The playbook's Phase 1 acceptance criteria are written for the apply-then-deliver flow; this is a scan-only deliverable, so the build/test gates apply but the LOC-reduction target does not.

cargo build --workspace — passes.

Finished `dev` profile [unoptimized + debuginfo] target(s) in 4m 07s   (with RUSTFLAGS="-W dead_code -W unused")
Finished `dev` profile [unoptimized + debuginfo] target(s) in 24.96s   (with --all-targets, no warnings)

cargo test --workspace — passes. 283 passed, 0 failed, 1 ignored across 26 test binaries. (Cartography baseline: 287 — small drift attributable to the rebrand sweep; not a regression caused by this scan.)

npm run check — 1 ERROR, 0 WARNINGS in 4080 files. The single error is pre-existing (the parallel agent's branch did not introduce it):

vite.config.js:5:1  Unused '@ts-expect-error' directive.

The directive sits above const host = process.env.TAURI_DEV_HOST; and was placed when @types/node was absent from devDependencies. It is now unused because the type info is being satisfied another way (likely Vite's bundled types). Logged as L8.1 — P2. Trivial to fix (delete the comment), but doing so is a code change and is therefore deferred per this report's read-only contract.

LOC-reduction target — deferred. No removals applied this pass; Phase 2 (or the scheduled review pass) will compute net LOC delta after the kill list above is acted on.

---

Scans deferred (toolchain gaps)

Scan	Reason	Recommended unblock
cargo +nightly udeps --workspace --all-targets	Only stable-x86_64-unknown-linux-gnu is installed (rustup toolchain list).	rustup toolchain install nightly && cargo install cargo-udeps --locked. Re-run inside Phase 2.
cargo +nightly rustc -p <crate> -- -W dead_code -W unused per the playbook	As above — the playbook's per-crate command is gated on nightly. Mitigated by running stable cargo build --workspace --all-targets with RUSTFLAGS="-W dead_code -W unused" instead, which produced the §3 zero-warning result.	Optional re-run on nightly to surface any nightly-only lint variants.

---

End of Phase 1 lean-pass scan deliverable. Next action: Jake reviews findings tonight; remediation pass produces a separate commit / PR after sign-off.