# Changelog

## Score

- CAI 66 → 67 (+1.2)
- Rubric changed (rubric-2026.09.9 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 82 → 82 (+0.0)
- Architecture 100 → 89 (-11.0)
- Maturity 64 → 64 (+0.2)
- Readiness 59 → 62 (+2.8)
- Security 65 → 71 (+5.5)
- Event Sourcing 100 → 100 (+0.0)
- Performance 85 (new)

## Resolved (9)

- Documentation: no usage examples (README.md)
- Hotspot: spotify_player/src/cli/client.rs (spotify_player/src/cli/client.rs)
- Hotspot: spotify_player/src/cli/handlers.rs (spotify_player/src/cli/handlers.rs)
- Hotspot: spotify_player/src/client/handlers.rs (spotify_player/src/client/handlers.rs)
- Hotspot: spotify_player/src/config/theme.rs (spotify_player/src/config/theme.rs)
- Hotspot: spotify_player/src/event/window.rs (spotify_player/src/event/window.rs)
- Hotspot: spotify_player/src/media_control.rs (spotify_player/src/media_control.rs)
- Hotspot: spotify_player/src/state/ui/page.rs (spotify_player/src/state/ui/page.rs)
- Off-boarding risk: anonymized user #1

## New (6)

- Ambiguous overlap between search and retrieval. 'search_songs' implies finding metadata/links, while 'get_lyric' implies fetching the content. However, both accept a raw string query. It is unclear if 'get_lyric' performs a search internally and then fetches, or if it expects a specific format. More critically, 'retrieve_lyric' exists which takes a URL, suggesting a separation of concerns (Search -> Retrieve) that 'get_lyric' bypasses or duplicates without clear distinction.
- Dependency hygiene PARTLY measured — Cargo dependencies read, dependency currency not (crates.io unreachable)
- Low cohesion: AppConfig (LCOM4 4) (spotify_player/src/config/mod.rs)
- Medium vulnerability: RUSTSEC-2026-0285 (Cargo.lock)
- Off-boarding risk: anonymized user #1
- Projects may be oversized for their cohesion

## Changes since last survey

- 1 commits — 0 feature/other, 1 fixes

## By area

- (root) — 1 commit

## Notable commits

- fix: Add TLS backend features (rustls-tls / native-tls) — fixes auth panic on Termux (#1060)