[hermes-gadget]

Summary

Twelfth block of the 2026-09-05 GPT-6 audit (ROADMAP.md). UX/low-severity fixes:

• U03 (P13: Malformed Markdown can monopolize the UI thread despite size budgets.** [app/src/main/java/com/hermesgadget/talaria/ui/components/SimpleMarkdown.kt:101,756–757,830–831](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/ui/components/SimpleMarkdown.kt:101) reparses in composition and searches the remaining suffix for ]( at every unmatched [ (High audit) #164): notification-settings toggles coalesce writes through one persist() path instead of committing per flip
• U04 (Q04: Inconsistent permanent-close policy.** PTY terminal codes ([app/src/main/java/com/hermesgadget/talaria/core/network/PtyTransportSupervisor.kt:57](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/core/network/PtyTransportSupervisor.kt:57)) omit 1009 while the sidecar includes it; oversized PTY messages therefore trigger repeated reconnects up to exhaustion (Low audit) #158): chat auto-scroll only follows when the reader is near the bottom — reading history is no longer yanked
• U07 (Q08: Compatibility fallback is bypassed by permissive decode defaults.** [app/src/main/java/com/hermesgadget/talaria/feature/connection/ProviderParsing.kt:144–169](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/feature/connection/ProviderParsing.kt:144) tries alias-aware fallback only when typed decoding throws; all-optional/default response models can decode an unsupported/camelCase shape successfully into empty defaults (Low audit) #159): analytics refresh failures show an error banner above stale totals instead of hiding silently
• U08 (P05: Eager sockets for every unfinished session.** [app/src/main/java/com/hermesgadget/talaria/feature/chat/ChatViewModel.kt:1157–1227](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/feature/chat/ChatViewModel.kt:1157) auto-opens a PTY and two sidecar sockets for every nonautomation session lacking end metadata, even idle history (High audit) #162): Command Center Doctor/Backup/Restart buttons deep-link to the specific System tool (system?action=), auto-run once on entry
• U10 (P10: Kanban columns and graph rendering eagerly process large collections.** [app/src/main/java/com/hermesgadget/talaria/feature/manage/kanban/KanbanScreen.kt:477–486](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/feature/manage/kanban/KanbanScreen.kt:477) composes every task in each column using a scrolling Column; [app/src/main/java/com/hermesgadget/talaria/feature/manage/learning/LearningGraphCanvas.kt:191–192](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/feature/manage/learning/LearningGraphCanvas.kt:191) allocates node/edge filtering collections on every draw, and recreates Typeface per node (234) (Medium audit) #172): learning starmap gains a screen-reader summary (visible/connections/memory counts) + explicit Reset view control
• U12 (P07: Artifact decoding/download costs on the wrong path.** [app/src/main/java/com/hermesgadget/talaria/feature/manage/artifacts/ArtifactsViewModel.kt:287–289](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/feature/manage/artifacts/ArtifactsViewModel.kt:287) Base64-decodes up to 16MiB on viewModelScope's main dispatcher before switching to IO (Medium audit) #170): session-admin overflow menu stays usable from Failure.previous; webhook create gets a re-entrancy guard; profile create dialog double-tap guarded
• U13 (P04: Oversized-frame protection happens after allocation.** [app/src/main/java/com/hermesgadget/talaria/core/network/PtyWebSocketSession.kt:175–190](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/core/network/PtyWebSocketSession.kt:175) and [app/src/main/java/com/hermesgadget/talaria/core/network/HermesEventClient.kt:552–566](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/core/network/HermesEventClient.kt:552) check size only inside OkHttp onMessage, which receives an already-materialized complete message (Medium audit) #168): PiP snapshot budget prioritizes streaming text over history; PiP list follows the tail unless scrolled up
• U14 (P08: Share manager monitor can block the main thread for an entire transfer.** [app/src/main/java/com/hermesgadget/talaria/feature/manage/files/ShareFileManager.kt:132–145,257–273](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/feature/manage/files/ShareFileManager.kt:132) holds its synchronized instance lock while reading a remote stream; [app/src/main/java/com/hermesgadget/talaria/feature/manage/files/FilesViewModel.kt:795–800,998–1008](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/feature/manage/files/FilesViewModel.kt:795) synchronously calls deleteOwnedFile on cancel/clear, which needs the same lock (178) (High audit) #163): terminal gains ^C/^D/Tab/^Z quick-action chips; output scroll-follow only when near bottom
• U15 (P02: Cache budget does not bound retained payloads.** [app/src/main/java/com/hermesgadget/talaria/core/data/repo/ResponseCache.kt:238–247](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/core/data/repo/ResponseCache.kt:238) assigns any DTO 256 bytes and clamps aggregate collections/maps to the whole 8 MiB budget (Medium audit) #166): per-agent channel cards deep-link to Android channel settings and show live mute/importance state
• U16 (P09: File metadata and preview processing block main.** [app/src/main/java/com/hermesgadget/talaria/feature/manage/files/FilesViewModel.kt:541,551,571](/home/ben/Talaria/app/src/main/java/com/hermesgadget/talaria/feature/manage/files/FilesViewModel.kt:541) queries ContentResolver before launching IO; 309/321 Base64-decodes up to16MiB on main; 412–419 allocates/encodes edited content there (Medium audit) #171): markdown size caps now surface a visible "content truncated" note

Test plan

• Full unit suite: 594 tests, 0 failures locally
• Compile + lint pass locally; CI pr-gate runs the same suite