NetExperts trusted-server usability audit — 25 October 2026

Scope: app-owned overlay notices and plaintext-room gates in the active desktop/web fork. Browser/OS permission controls remain under user/browser control. Required authentication, room permissions and transport TLS are retained.

Central ToastStore and NonUrgentToastStore now render in-flow in NetExpertsActivityPanel. Actions, error text and explicit dismissal remain available. SetupEncryption, unverified-device, backup/recovery, notification-permission and feature-tour entrypoints are gated in the trusted-server profile. Settings' independent Compound notice and RoomList's independent transient notices were separately replaced with in-flow UI. RoomList unread navigation and dismiss actions remain functional. Incoming call action controls use the same central activity surface rather than disappearing. Both vendored Call products replace their independent modal/autodismiss notice renderer with a persistent in-flow status region, preserving content, child actions and dismissal; AST syntax validation and isolated action tests cover both generated outputs.

Plaintext policy: central createRoom cannot request E2EE; server independently rejects encrypted rooms/messages/media descriptors. SDK crypto remains present for call signaling/dependencies; no shared embedded keys. Auth setup, DeviceListener, logout recovery, composer lock warning, NewRoomIntro, room summary unencrypted badge, EncryptionInfo, CreateRoom encryption controls and security-settings E2EE warnings are gated. Existing room membership, join rules/history visibility and HTTPS remain intact. EventTile warnings apply to encrypted rooms, which this profile/server cannot create. Optional integrations and foreign homeserver selection remain disabled.

Files: upload failures show inline Retry and preserve file/room/relation context. Current MBodyTile, older FileBody and message-action-bar download paths now surface errors with Retry; retries refetch rather than reusing a rejected cached promise. Real UI test uploaded4096 deterministic bytes, failed once then retried, checked plaintext m.file without encrypted descriptor, downloaded exact bytes, logged out, signed in from a fresh browser/device, recovered attachment/message history, injected a real media fetch failure at browser-context/service-worker network boundary, retried, and compared SHA256 132c6888fe3ec57ceae64feac6e9a46256129d8e32004379063b08de6d53c3a5. Service-worker authentication is preserved. Earlier test that blocked workers is failed diagnostic evidence, not qualification.

Calls: two distinct users and fresh Chrome contexts joined the bundled iframe client in a private plaintext room through local native LiveKit1.13.4 + lk-jwt-servicev0.7.0. Real Synapse OpenID validation; test-only exact-host resolver mapping avoids global DNS changes. Both clients sent/received audio and video, hundreds of decoded frames. This verifies foreground synthetic-media connectivity; not physical microphone quality, background/mobile behavior, restrictive NAT/TURN, public deployment, screen share, long-duration reliability or crash cleanup. Component alternative has host-policy/unit/style/syntax/action tests; connected-media proof is for the default embedded client. No call encryption requirement was encountered. API test room mirrors app call-member power levels0; ordinary members can join.

Residual runtime integration: production needs discoverable RTC transport, JWT TLS origin, LiveKit WSS/media ports and TURN where needed. Delayed-event/delegated-leave fallback produced errors against the minimal QA server; configure/test server delayed events, SFU webhook and persistent membership cleanup before broader calling rollout. My NetExperts SSO remains a separate backend integration; local password browser acceptance is not an SSO acceptance claim.
