# Core Checklist Status (Web + API)

Legend:
- `DONE` - implemented and works in current web flow.
- `PARTIAL` - implemented partly, limited UX/coverage, or needs hardening.
- `TODO` - not implemented yet.

## Modules

1. Account - `DONE` (email auth, JWT, refresh, logout, reset, sessions; web handles `/verify-email?token=...` links with auth-page feedback; integration tests cover resend-verification replacement, password-reset login flow, and `check-email` status transitions)
2. User Profile - `DONE` (username, name, avatar, bio, update)
3. User Status - `PARTIAL` (online/last seen/offline; web now formats `just now/today/yesterday/recently`, backend-side presence heuristics still limited)
4. Contacts - `PARTIAL` (list/search/add/remove/block/unblock; `add by email` flow covered by integration tests including `success/not found/blocked conflict`; web now surfaces specific add-by-email errors (`not found` vs `blocked`); UX moved to menu; Contacts panel now includes inline `Block/Unblock` actions per user)
5. Chat List - `DONE` (all/pinned/archive/sort/unread; saved-messages delete behavior covered: clear history without deleting chat; regression test covers `GET /chats/{saved_id}` detail response)
6. Chat Types - `DONE` (private/group/channel)
7. Chat Creation - `DONE` (private/group/channel)
8. Messages (base) - `DONE` (send/read/edit/delete/delete for all; 7-day edit window enforced and covered by integration tests; group UI shows sender names over bubbles + sender avatars on incoming message clusters)
9. Message Types - `PARTIAL` (text/photo/video/docs/audio/voice/circle; GIF/stickers via dedicated system missing)
10. Reply/Quote/Threads - `PARTIAL` (reply + quote-like UI + thread panel with nested replies; web thread panel now supports direct `Jump in chat` navigation to any thread message; dedicated full standalone thread route is still pending)
11. Forwarding - `DONE` (single + bulk + without author)
12. Pinning - `DONE` (message/chat pin-unpin)
13. Reactions - `DONE`
14. Delivery Status - `DONE` (sent/delivered/read + reconnect reconciliation after backend restarts)
15. Typing Realtime - `DONE` (web: typing start/stop + recording voice start/stop; `recording_video_*` remains for mobile circle-video clients)
16. Media & Attachments - `DONE` (upload/preview/download/gallery; sticker/GIF inline media no longer opens photo viewer on click; Chat Info and message context menus now have consistent `Open/Download/Copy` behavior with menu auto-close and download toasts)
17. Voice Messages - `PARTIAL` (record/send/play/seek + global speed 1x/1.5x/2x; recorder uses improved mime priority for better duration metadata; backend media allowlist includes `audio/mp4`/`audio/x-m4a`; audio store tracks duration via `durationchange/seekable` fallback; websocket send/recorder stop race on fast chat switch is guarded; UX still being polished)
18. Circle Video Messages - `PARTIAL` (mobile-priority only: backend type/realtime supported; web composer intentionally does not send circles)
19. Stickers - `PARTIAL` (web sticker picker with preset pack + favorites)
20. GIF - `PARTIAL` (web GIF picker with Tenor search + preset fallback + favorites)
21. Message History/Search - `DONE` (history/pagination/chat+global search)
22. Text Formatting - `PARTIAL` (bold/italic/underline/spoiler/mono/links + strikethrough + quote/code block; web composer now supports keyboard shortcuts `Ctrl/Cmd+B/I/U/K`, `Ctrl/Cmd+Shift+X`, `Ctrl/Cmd+Shift+\``; toolbar still evolving)
23. Groups - `PARTIAL` (create/add/remove/invite link; join-by-invite and invite permissions covered by integration tests; members API now returns profile fields (`username/name/avatar_url`) and web Chat Info consumes them to avoid extra per-member profile requests; add-member search also shows avatars; advanced moderation still partial)
24. Roles - `DONE` (owner/admin/member)
25. Admin Rights - `PARTIAL` (delete/pin/edit info + explicit ban APIs for groups/channels including ban list endpoint; web Chat Info now shows searchable `Banned users` with both inline and right-click `Unban` actions for owner/admin, member search, avatars in moderation lists, invite-link copy/regenerate actions, ban metadata (`who banned/when`), explicit member action button for touch/trackpad UX, `@username`-friendly moderation filters, and resilient profile hydration (`allSettled`) for partially missing users; add-member and banned-filters now show explicit empty-state hints; moderation actions (`add/remove/ban/unban/promote/demote/transfer owner`) now force full panel refresh to keep members/bans/counters in sync without manual reopen; integration tests cover channel member read-only, channel admin full-delete, channel message delete-for-all permissions, group profile edit permissions, owner-only role management rules, and admin-visible/member-forbidden ban-list access; remaining UX moderation tools limited)
26. Channels - `PARTIAL` (create/post/edit/delete/subscribe/unsubscribe; integration tests now also cover invite-link permissions (member forbidden, admin allowed); web Chat Info now differentiates destructive actions by role for both groups/channels (`Delete ... for all` for owner/admin, `Leave` for members) and blocks invalid owner-leave action when members remain; app auto-join by invite token is now single-shot with toast errors (no retry spam on invalid/expired links); remaining UX edge-cases still polishing)
27. Channel Types - `DONE` (public/private)
28. Notifications - `PARTIAL` (browser notifications + mute/settings; chat mute is propagated in chat list payload, honored by web realtime notifications with mention override, and mute toggle now syncs instantly in chat store; backend now emits `chat_updated` after notification mute/unmute for cross-tab consistency; notification click deep-link (`/?chat=..&message=..`) now restores chat/message focus after auth; no mobile push infra)
29. Archive - `DONE`
30. Blacklist - `DONE`
31. Privacy - `DONE` (avatar/last-seen/group-invites + PM policy `everyone|contacts|nobody`; API + web settings support all matrix values; integration tests cover PM policy matrix, group-invite policy matrix, private chat counterpart visibility `nobody/contacts/everyone`, and avatar visibility in search `everyone/contacts/nobody`)
32. Security - `DONE` (sessions + revoke + 2FA + access-session visibility; integration tests cover single-session revoke, revoke-all invalidation/force-disconnect, 2FA setup guard, recovery-code normalization/lifecycle, and disable-2FA cleanup; web auth supports recovery-code login; settings provides recovery-code warning/copy/download)
33. Realtime Events - `DONE` (connect/disconnect/send/receive/typing/read/delivered/online/offline + chat/message updates + chat_deleted)
34. Sync - `DONE` (cross-device via backend state + realtime; reconciliation for loaded chats/messages; `chat_updated` covers profile/membership/delete-for-self/archive/unarchive/pin/unpin/mute/clear and create-chat fanout to members; full-chat delete emits `chat_deleted`; web Chat Info also has 15s polling fallback to self-heal missed realtime updates; integration tests cover user-scoped archive/pin, member-side visibility after create, and user-scoped clear behavior; chat list and migration `0026_deduplicate_saved_chats` handle historical duplicate Saved Messages)
35. Additional - `PARTIAL` (drafts/link preview partial/autoload media basic)

## Current Focus beyond P1

1. Finalize media messaging UX parity (voice/circle controls, unified attachment behaviors).
2. Expand message types ecosystem (GIF/stickers/thread UX + formatting polish).
3. Continue raising test coverage for realtime/media edge cases.
4. Close remaining PARTIAL items to reach stable 80%+ coverage.