# Audit Fixes — Session 2 (2026-05-19)

## Session Context
- Model: glm-5.1 via OpenCode Go
- Starting state: 6 compile errors (from incomplete Cursor Opus fix pass)
- Cursor spend cap hit — all fixes done manually, no delegation

## Compile Errors Fixed (6 → 0)
1. **DebridTokenStorage**: `store()`, `retrieve()`, `delete()` called suspend functions from non-suspend context → changed to `storeBlocking()`, `retrieveBlocking()`, added `deleteBlocking()` to SecureTokenStore
2. **OnboardingViewModel**: broken `import displayName` removed, `provider.displayName()` → `provider.displayName` (property, not function)

## Runtime Crash Fixes (C3)
3 **NavHost routes** were missing composable entries — navigating to them caused `IllegalStateException`:
- `Screen.SeeAll` (HomeScreen "See All") → created `SeeAllScreen.kt` stub + NavHost entry
- `Screen.AllSources` (DetailsScreen "See All Sources") → created `AllSourcesScreen.kt` stub + NavHost entry
- `Screen.Profiles` (SettingsScreen) → added route pointing to existing `ProfileSelectScreen`

## Data Loss Fix (C5)
- **PlayerViewModel.onCleared()**: `saveProgress()` was called in `viewModelScope.launch` which is cancelled by the time `onCleared()` runs → progress never saved. Fixed by using independent `CoroutineScope(SupervisorJob() + Dispatchers.IO)` that survives ViewModel teardown. `playerManager.release()` moved to `finally` block.

## Hardcoded profileId Fix
All instances of `profileId = 0` or `profileId = 1` replaced with `preferencesManager.activeProfileId.first()`:
- PlayerViewModel.saveProgress() + onCleared() final save
- SettingsViewModel.syncTraktNow()
- OnboardingViewModel.launchImportSync()
- HistoryViewModel (4 instances)
- WatchlistViewModel (2 instances)

New dependency injections: `PreferencesManager` added to HistoryViewModel and WatchlistViewModel constructors.

## Room Migration Safety (C7)
- Added `.fallbackToDestructiveMigrationFrom(0)` to `LocalDataModule.provideDatabase()`
- Only allows destructive migration on fresh installs (version 0 → 1)
- Added migration template comment to `NexStreamDatabase.kt`

## Security Verification (C8-C10)
All three security findings confirmed already addressed in codebase:
- C8: `usesCleartextTraffic="false"`, `allowBackup="false"`, HTTPS-only `network_security_config.xml`
- C9: `android:allowBackup="false"`, `android:fullBackupContent="false"`, `android:usesCleartextTraffic="false"`
- C10: Tokens in `SecureTokenStore` (AES-256/GCM Keystore), PINs PBKDF2 100K + salt, no plaintext

## Remaining (Medium Priority)
- SeeAllScreen + AllSourcesScreen are stubs — need ViewModels wired to AddonRepository
- SettingsViewModel 65-flow `combine()` runs on Main thread — should use `Dispatchers.IO` + `stateIn`
- PlayerManager.scope leak (SupervisorJob never cancelled) — noted in skill gotcha #12