docs: record 1.7.8 device/member/dependency work

AGENTS.md

@@ -1518,6 +1518,16 @@ session with **no other memory of this project**. So:
     `~/.config/skatespots/community-state.json` (600). Never commit/print either.
   - **Copy:** `communityUi.*` (en/es + all 24; 100%); bot rows are labeled
     "Community bot" by pubkey, no profile event required.
+- **Cordn native devices/members/benchmark (2026-10-28):** a new device can
+  publish a key package and show a `cordn-device:` QR; an existing member scans
+  it (`QRScannerModal`), calls `addMemberByIdentifier(gid, kpRef)`, and the new
+  device's `checkInvite` accepts the Welcome — no join request/founder round
+  trip. Member leaves can be removed by `leafIndex` (`removeMemberFromGroup` →
+  `createCommit` with `defaultProposalTypes.remove`); the founder gets an
+  **Edit Crew** link for admin-role changes. Messages have copy/reply actions
+  (reply is quoted text; reactions/delete are still open). Live benchmark
+  (`scripts/cordn-benchmark.ts`, 30 msgs): ~489ms/send, ~20ms/fetch, snapshot
+  ~13.8KB (~460 B/message) — fine for hundreds of messages.
 - **Map site-links strip (2026-10-05):** the desktop footer is hidden on the map
   (full-bleed), so `components/MapFooterStrip.tsx` surfaces the same links
   (Newsletter/License/Privacy/Collaborators + "not sponsored by OpenSats") as an
@@ -2335,6 +2345,13 @@ Rules:
       users are not prompted behind their back); quiet request polling never
       toggles the composer. APK sha256 `009dcf41…`, versionCode 10707. Web
       forced live.
+    - **1.7.8 (2026-10-28):** two-device QR handoff (new device publishes a key
+      package; an existing member scans and adds it without a join request),
+      MLS member removal, founder link to Edit Crew for admin roles, message
+      copy/reply, and a live Cordn benchmark. Dependency overrides pin
+      `protobufjs@7.6.3` and `sharp@0.35.5`; `npm audit` is now **0 critical,
+      1 high (write-only xlsx)**, 9 dev-only moderate. APK sha256 `960052b8…`,
+      versionCode 10708. Web forced live.
 
 ### Relay archive (dataset backup)
 - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**
@@ -3197,19 +3214,15 @@ Skip-to-content is a button that focuses `<main>` (HashRouter-safe).
 keeps `stateRef` in sync cross-tab; the backup flag is per-account
 (`lib/backup.ts`). Listing detail / Events render `ErrorState` on outage.
 
-**2026-10-28 audit tail.** `npm audit` reports 11 advisories (5 high, 1
-critical). The critical/high tail is **`protobufjs` via
-`onnxruntime-web`/`onnx-proto`** (translation model parsing; models come only
-from our HTTPS model host and the translation guard blocks every other origin —
-no user-supplied ONNX), **`sharp`** (Node-only transformers dependency; not used
-by the browser worker), and **`xlsx`** (write-only; parse CVEs do not apply).
-The rest are dev-only (`@capacitor/cli`/xcode/uuid, Tailwind
-typography/postcss). No safe automatic fix without crossing the ONNX
-Runtime/transformers major; revisit with that upgrade. AI-generated itinerary
-links now go through `sanitizeUrl`; every `target="_blank"` has
-`rel=noopener noreferrer`; no `javascript:`/raw user HTML paths found. Auth is
-now app-wide via `AuthDialogContext` so signup survives card/page unmounts, and
-all internal nav links match a route.
+**2026-10-28 audit tail.** `npm audit` is now **10 advisories (0 critical, 1
+high, 9 moderate)**. The remaining high is **`xlsx`**, which is write-only in
+this app (parse CVEs do not apply). Overrides pin `protobufjs@7.6.3` (the
+critical ONNX model-parsing path) and `sharp@0.35.5` (Node-only transformers
+dependency). The moderates are dev-only (`@capacitor/cli`/xcode/uuid, Tailwind
+typography/postcss). AI-generated itinerary links go through `sanitizeUrl`;
+every `target="_blank"` has `rel=noopener noreferrer`; no `javascript:`/raw user
+HTML paths found. Auth is app-wide via `AuthDialogContext` so signup survives
+card/page unmounts, and all internal nav links match a route.
 
 **Deferred (documented, NOT fixed).**
 - `H1` — **PARTIAL**: `claim-from` now stores the original **coordinate**