[HemSoft]

Summary

Docs-only fixes for three findings from the 2026-11-07 docs audit, each checked against origin/main at 78e91a4 before editing.

Closes #324
Closes #325
Closes #326

#324: Muse Code in the user-facing docs

• README.md: adds Muse Code to the Providers table and as step 13 of Provider setup, and removes the two stray Muse lines that sat under License.
• docs/ACCOUNT_CONFIGURATION.md: adds MuseCode to the providerId list (names::MUSE_CODE = "MuseCode") and a Muse Code row (Command line, one account) to Sign-in methods.
• docs/SUBSCRIPTION_PLANS.md: adds a Muse Code row to Sources and limits, giving allowance.tier as the plan source (muse.rs passes it to with_plan after the text check).
• docs/PRIVACY.md: lists Muse Code among the providers that are off until an account exists (settings.rs is_enabled), and adds a paragraph on what the muse usage --json call does, how its result is cached and what CodexBar keeps, following docs/MUSE_CODE.md.

Decision: ACCOUNT_CONFIGURATION.md said every provider except OpenCode Zen takes several accounts. In catalog.rs, X Subscription and Muse Code are multi_account: false too, and settings_view.rs shows the add button only for multi-account providers. That sentence now names all three.

#325: Node.js prerequisite

README.md now says Node.js 22 or later, matching package.json engines.node >=22 and docs/NPM_ADVISORIES.md. CI uses Node 24 (ci.yml node-version: '24').

#326: Shipped widgets and MSIX in docs/IOS_DIFFERENCES.md

#93, #94 and #95 are closed, and package.ps1 and crates/codexbar-app/src/widgets/ exist. The widgets row now names the Windows 11 Widgets board, from the packaged app with Developer Mode. The distribution row now says a self-signed MSIX package with local-channel updates, or a build from source. Both rows link to docs/PACKAGING.md.

Validation

• npm run lint:md: exit 0
• git diff --check: clean
• Pre-commit hook (fmt, clippy, Rust tests): passed
• No code, test or workflow files changed

🤖 Generated with Claude Code

[HemSoft]

@sfl review

[hemsoft-sfl-reviewer]

✅ Verdict: PASS • Round 1

Confidence: 9/10

Review done by claude-opus-5-5 (same family: same-family: codex gated: codex Weekly 161% SUS 62 🔴 pause, defer)

Docs-only change: it adds Muse Code to the README, ACCOUNT_CONFIGURATION, PRIVACY and SUBSCRIPTION_PLANS, raises the README Node.js prerequisite to 22 and updates the iOS-vs-Windows widget and distribution rows for the shipped MSIX package. I checked every new claim against the exact-SHA implementation and docs and found no defects in the security, accuracy or quality passes.

🔨 Full-Spectrum Review Summary

Effort: high
Review time: 1m 31s
Token count: Unavailable

Pass	🔴 Critical	🟠 High	🟡 Medium	⚪ Low
🔒 Security	0	0	0	0
✅ Accuracy	0	0	0	0
🧰 Quality & Maintainability	0	0	0	0
Total	0	0	0	0

Key Findings

No material defects found.

Coverage

• Files reviewed:
  • README.md
  • docs/ACCOUNT_CONFIGURATION.md
  • docs/IOS_DIFFERENCES.md
  • docs/PRIVACY.md
  • docs/SUBSCRIPTION_PLANS.md
• Context read:
  • docs/MUSE_CODE.md
  • crates/codexbar-providers/src/muse.rs
  • crates/codexbar-providers/fixtures/muse/measured.json
  • crates/codexbar-app/src/catalog.rs
  • crates/codexbar-app/src/settings_view.rs
  • crates/codexbar-store/src/settings.rs
  • crates/codexbar-core/src/account.rs
  • package.json
  • docs/PACKAGING.md
  • docs/NPM_ADVISORIES.md
  • .github/workflows/ci.yml
• Verified:
  • Compare base_commit.sha is 78e91a4fc7245b407a6bd32af47186f3d59321c9, the head commit is 2eaf8038c2bf2e42187614f548c279fecff7c4e9, the merge base equals the base, and the head is ahead by 1 and behind by 0
  • names::MUSE_CODE is "MuseCode" in settings.rs, which matches the new providerId value
  • catalog.rs sets multi_account: false for OPENCODE_ZEN, X_SUBSCRIPTION and MUSE_CODE, and settings_view.rs gates the add button on info.multi_account; this matches the revised several-accounts sentence
  • Settings::is_enabled returns false for MUSE_CODE until an account exists, and Moonshot defaults to off, which matches the PRIVACY first-start list
  • MuseProvider::fetch runs muse usage --json, removes META_API_KEY (and the other MUSE_* variables) from the child environment, and caches a success for 5 minutes or until the earliest reset, which matches PRIVACY
  • parse reads allowance.tier through safe_text (64 chars, charset check) into with_plan, and the measured fixture tier is the Muse Code Power Usage example, which matches the SUBSCRIPTION_PLANS row
  • package.json engines.node is >=22 and NPM_ADVISORIES says Node.js 22 or newer, which matches the README
  • The docs/PACKAGING.md ## Widgets heading exists for the #widgets anchor and describes the Windows 11 Widgets board, Developer Mode for the self-signed package and the App Installer update channel
  • The added table rows keep each table's column count, and README provider-setup numbering continues at 13
• Not verified:
  • Whether issues #93-#95 and #324-#326 are closed: issue state was not queried
  • Rendered Markdown output and the markdown lint result claimed in the PR body
  • Live behavior of the Muse CLI, MSIX install and Widgets board
• Tests run: None. Reviewer execution is disabled.

---

HemSoft full-spectrum review • 3 evidence-based passes • Reviewed head 2eaf8038c2bf2e42187614f548c279fecff7c4e9 • SFL v0