The first pass dropped 8 gap-audit findings "to keep it tight" — but those
ARE forgotten cases, so they belong in the plan. Add them with full context
(scenario → expected, file:line, defect caught):
- TC-DICT-12 encodeWavPcm16 WAV header/clipping (unit)
- TC-EMBED-05 getEmbedUrlAndProvider 11-provider URL parsing (unit+manual)
- TC-LINK-03 sanitizeUrl/isInternalFileUrl XSS gate (unit+manual, security)
- TC-SPACE-12 space slug @IsAlphanumeric rejects hyphen/underscore/unicode [BUG?]
- TC-ATT-DEDUP-01 diagram attachmentId overwrite authorization
- TC-STOR-DIV-01 local vs S3 missing-file behavior divergence
- TC-LIMIT-QUOTA-01 no per-workspace storage quota (verify-only)
- TC-CMT-09 realtime commentCreated appends only to last loaded page
Docs-only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1f5f2b60a8