• WebSockets: permessage-deflate without context takeover compresses each broadcast once for all subscribers. Decoded messages remain identical.
• CSRF: Sec-Fetch-Site replaces tokens. Writes accept same-origin and same-site, reject cross-site and missing headers over HTTPS with 422, and retain the Origin check. Plain HTTP accepts missing headers with SameSite=Lax cookies. Pages omit CSRF tags and fields; old tabs still work, but HTTPS forms require a browser that sends the header (Safari 16.4 or newer).
• Jobs: Redis and Resque are replaced by in-process queues with JOB_CONCURRENCY workers per job kind. Queued pushes and webhooks are lost on a crash; slow webhooks don't block pushes.
• Push: invalid VAPID keys disable push at boot. Subscriptions survive TLS/configuration failures and are deleted only on 404/410 or an invalid subscription P-256 key. Notification bodies are truncated with an ellipsis at 3 KB and titles at 256 bytes. VAPID_SUBJECT is configurable. Delivery timeouts are 10 seconds per connect/read and 30 seconds overall.
• Cookies: sessions are written only on change and deleted when empty; last_room only on change. session_token is re-signed on the hourly activity refresh, retaining its rolling 20-year expiry. Other authenticated reads avoid the database writer.
• Caching: room, messages and search ETags hash cached page parts rather than the body. Copy-link buttons cache paths and resolve them against the page URL; bot JSON is cached per base URL, preventing a request's Host from changing other users' links.
• SQLite: boot adds index_messages_on_room_id_and_created_at if missing. It remains compatible with Rails. Memory mapping is disabled; reads use SQLite's page cache.
• Media formats: libvips 8.16.1 and ffmpeg 7.1.5 use the Rails image's Debian sources, with byte-identical thumbnails, posters and metadata for supported formats. libvips omits loaders Rails already blocks. ffmpeg omits external-library-only formats: tracker modules, game-console music, JPEG XL/SVG frames, codec2, teletext and DASH/IMF. Tracker/game-console uploads lack duration and bit rate. Unused encoders, muxers, hardware and network support are omitted.
• Media processing: message uploads are copied and checksummed before saving their rows, then deleted if saving fails. The redundant MD5 reread is skipped; analysis, variants, posters and client direct-upload checksums still validate files. At most four media jobs run off the database writer. Variants/posters are saved already analyzed; concurrent transforms keep the first saved result and delete duplicates. ffmpeg posters time out at 60 seconds, ffprobe at 30.
• Request limits: non-file-upload bodies and direct uploads are capped at 16 MiB (413). Nonnumeric direct-upload sizes and oversized QR codes return 422. Page numbers cap at a billion.
• Cable limits: 64 subscriptions per connection, 4 KiB identifiers and 1 MiB messages. Clients that don't read for 30 seconds disconnect. Banning/deactivating a user closes their connections after commit.
• Unfurling: 10 seconds overall, 5 per connect/read, at most 16 concurrent unfurls, and only the first 256 attributes of a meta tag are read. Timed-out pages unfurl nothing.
• Webhooks: 60 seconds overall, 7 per connect/read. Replies over 100 MB after decompression fail delivery without posting a response.
• Front server: TARGET_PORT binds loopback and enforces front-server timeouts and MAX_REQUEST_BODY. Cache keys count toward CACHE_SIZE, preserve raw paths/queries, skip URIs over 2 KB and forward range requests. Idle HTTP/1 connections close at the shorter of HTTP_IDLE_TIMEOUT and HTTP_READ_TIMEOUT until request headers arrive (30 seconds with defaults, 60 with image settings); HTTP/2 uses the idle timeout. Response header lines containing DEL are omitted.
• Passwords: bcrypt runs outside database connections/transactions. Unknown emails still perform one bcrypt check.
• JSON: floats use the shortest equivalent digits. The web app manifest properly JSON-escapes account names and URLs.
• Search: words are literal full-text terms, including NOT, AND, OR and NEAR.
• Routes and UI: /rooms/directs/:id redirects to the room; infinite Accept q-values sort first or last by sign; EdgeHTML install instructions include the missing image; the new-ping picker requests JSON so suggestions appear.
• Rich text attributes: autolinking escapes </> in attributes to prevent stored XSS. Sanitization drops name attributes to prevent DOM clobbering. Styles retain only color and background-color with plain keyword/hex/RGB/HSL values or CSS variables in bot/webhook HTML; message pages drop styles.
• Rich text attachments: content attachments nest at most eight levels; deeper content is empty. Deleted-user mentions render ☒ and are omitted in the editor. Active Storage attachments embedded in message bodies, which the composer can't create, render ☒.
• Malformed rich text: plain-text extraction failures are logged and use empty text or an attachment filename; messages are still indexed, pushed, broadcast and sent to bots. Bodies beyond 400 nesting levels or 400 attributes per element are stored unchanged with empty plain text. These messages render as unrenderable.
• Not ported: Active Storage streaming's duplicate session_token cookie or legacy AES-CBC cookies; Campfire uses AES-GCM.

HTTP-01 ACME validation is only unit-tested; TLS-ALPN-01 is tested end to end against a local ACME server. Rich text is checked against Rails on 658 cases, including 400 fuzzed cases.