release: v1.7.9 — Phase 1 critical+high fixes (17/18)

Housekeeping:
- Bump VERSION to 1.7.9
- CHANGELOG entry for all Phase 1 fixes
- Mark Phase 1 as completed in development plan

CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 1.7.9 (2026-08-07)
+
+### Bug Fixes (Phase 1 — VNCmailgraph audit)
+
+- **Mail**: Network transport failures now throw `TransportError` instead of returning empty results, so offline/network-down is distinguishable from an empty folder (#C1)
+- **Mail**: Push handler now refreshes contacts and files on remote state changes (#H1)
+- **Calendar**: Recurrence expansion IDs use `::occurrence::` delimiter to prevent collision with shared-event prefixes (#C2)
+- **Calendar**: Cross-account event aggregation now deduplicates by UID + recurrenceId, preventing phantom duplicates (#C3)
+- **Calendar**: `calendarTasksEnabled` admin policy now enforced at runtime, not just in settings UI (#H13)
+- **Tasks**: All task mutations (update, delete, toggle) now have error handling with store error state (#H14)
+- **Settings**: `updateSetting()` now checks admin policy lock before writing; `force` opt-in for legitimate bypassers (#C7)
+- **Settings**: `autoSelectReplyIdentity` now defaults to `true` — auto-identity selection on by default (#H18)
+- **Templates**: HTML template bodies are now sanitized with DOMPurify on import to prevent stored XSS (#H7)
+- **Auth**: User authentication endpoints now rate-limited — 10 attempts per (IP + username) per 15 minutes (#H3)
+- **Auth**: Admin sessions now support token revocation via JTI blacklist on logout (#C4)
+- **Auth**: Secure cookie flag now derived from `x-forwarded-proto`, not `NODE_ENV` (#H8)
+- **Auth**: OAuth token exchange error logs no longer leak `access_token` (#H4)
+- **Auth**: `isHashed()` no longer accepts bcrypt prefixes — scrypt-only, preventing lockout from bcrypt passwords (#H9)
+- **Push**: WS→SSE fallback now awaits state snapshot before reconciliation to prevent missed deliveries (#H2)
+- **Push**: Offline event handler added — push transports pause when browser goes offline, reconnect on online (#C8)
+- **Index**: FTS5 schema-drop now logs a warning so operators know a rebuild is needed (#C6)
+
+---
+
 ## 1.7.8 (2026-07-22)
 
 ### Features

VERSION

@@ -1 +1 @@
-1.7.8
+1.7.9

runs/2026-08-07-v1.7.8-baseline/DEVELOPMENT-PLAN.md

@@ -506,8 +506,8 @@
 ### Deploy Flow
 Per policy: P1 → deploy to `dev` → QA → fix → promote to `main`. Then P2 → dev → QA → main. Repeat for P3, P4.
 
-### First Sprint Scope
+### Phase 1 — COMPLETED 2026-08-07
-**Phase 1 only** — ship all 8 CRITICAL + 10 HIGH fixes (~32h). This brings health from 7.2 to ~8.5/10 and addresses the most impactful user-facing bugs before adding new features.
+**Shipped as v1.7.9.** 17 of 18 fixes deployed to `main`. All 2527 tests pass (161 test files). One item deferred: P1.3 (C5 auth localStorage encryption) — requires custom Zustand persist adapter, planned for Phase 3.
 
 ---