fixes

docs/ARCHITECTURE.md

@@ -108,7 +108,10 @@ exists: key = account id (`/cdn/avatar/<id>.png`), ownership enforced.
 tesseract binary, availability probed at boot). `POST /api/tools/ocr` takes
 raw image bytes (5 MB, magic-verified, 20 jobs/hour/account) and returns
 `{ text, truncated, chars }` — transcription happens server-side with
-per-driver-style stdout logging; a missing binary yields a clean 501. Text
+per-driver-style stdout logging; a missing binary yields a clean 501.
+`sanitizeOcrText` strips engine noise (control/format/private-use code
+points, U+FFFD markers, form-feeds) while keeping legitimate text
+(accents, CJK, emoji). Text
 attachments use the `text` CDN namespace (500 KB, UTF-8 validated). The model
 only ever sees reviewed text blocks, never raw files.
 

docs/FRONTEND.md

@@ -78,8 +78,9 @@ No router library — a tiny history wrapper (`lib/route.ts`: `navigate()`,
   (`{ title, topic, model, authorName, authorAvatarUrl, archived, sharedAt, messages }`);
   user messages render the author's avatar via `Avatar` (URL or initials);
   an "Archived" pill shows when the source conversation is archived.
-- `Markdown.tsx` — `react-markdown` + GFM; code blocks get a language label and
-  a copy button.
+- `Markdown.tsx` — `react-markdown` + GFM; code blocks get a language label, a
+  copy button and dependency-free syntax highlighting (`lib/highlight.tsx` —
+  regex tokenizer, no highlight.js, so the Nix offline lockfile is untouched).
 
 ## Theming
 

docs/OPERATIONS.md

@@ -171,9 +171,13 @@ UUID, same pattern as share links).
   (ticket bearer — pushes `access_message` + `access_status` for that ticket)
   and `GET /api/admin/ws?token=…` (admin Bearer in query string, browsers
   can't set WS headers — pushes `access_message` + `access_status` +
-  `access_created` for every ticket, driving the AdminCenter badge and the
-  triage list). Clients ping every 25 s (`{"type":"ping"}` → `{"type":"pong"}`)
-  and resync over HTTP on every (re)connect.
+  `access_created` for every ticket plus `report_created` + `report_status`,
+  driving the AdminCenter badges and the triage lists). Every event carries
+  its full payload (`access_created` bundles the ticket, its first message
+  and the message count), so clients apply it straight to state — HTTP
+  resync only happens on (re)connect to cover the offline gap. Clients ping
+  every 25 s (`{"type":"ping"}` → `{"type":"pong"}`) with a pong watchdog
+  that redials half-dead sockets.
 
 ## Content reports (flagged AI responses)