LIA

Wave 3 of the full-codebase audit — three boundaries the earlier waves did not touch (the async/event-loop boundary, the network-exposure boundary, the XSS trust boundary) plus four localized performance/correctness fixes. Every item was measured before/after (latency or call count) and driven red-first. Architecture decision: ADR-096.

⚡ Performance

• Event loop no longer frozen by synchronous work. firebase_admin.messaging.send, the Pillow resize pipeline and two sync embedding calls ran inline on the loop, freezing every concurrent coroutine (SSE included) for 251–496 ms; moved off via asyncio.to_thread / native async embeddings → 11–12 ms, guarded by an event-loop stall test.
• Two hot-path scans parallelized: list_active_domains 631 → 63 ms; Gmail search_emails N+1 metadata fetch 331 → 62 ms (bounded asyncio.gather).
• Caching: user display preferences move from one DB query per tool call to a per-worker TTL cache; admin broadcast translations are persisted (0 LLM calls on re-read instead of a re-translation on every view).

🛡️ Security

• The dashboard greeting can no longer execute injected content — LLM output now renders as auto-escaped React children (a booby-trapped event title is inert) behind a new strict Content-Security-Policy.
• Internal services isolated from the LAN (production): the 13 internal service ports (Postgres, Grafana, Prometheus, Loki, Tempo, exporters) are loopback-bound so only the web app is exposed; the Docker/ufw interaction is documented.

🔧 Fixes & admin

• Valid display locales for every language — en-EN/zh-ZH (the latter broke Chinese dates) replaced by a LANGUAGE_TO_LOCALE map.
• The personality translator is now a configurable LLM slot — visible in the admin LLM Configuration and honoring DB overrides.
• Gmail reply body built before MIME construction (hardening; parity with the Apple mail client).

Notes

• One DB migration (admin_broadcasts.message_translations JSONB) + two .env cache keys (USER_PREFERENCES_CACHE_TTL_SECONDS, EMAILS_SEARCH_FETCH_CONCURRENCY), both opt-outable.
• Ruff / Black / MyPy strict clean; backend 8687 unit tests green + agents green; frontend 123 tests green (+3 XSS); i18n key parity across all 6 locales; Docker startup verified healthy (migration applied, CSP active).

Full changelog: CHANGELOG.md