docs: v0.6.3 changelog and roadmap update

Mark all v0.6.3 roadmap items done, add changelog section.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,45 @@
 
 All notable changes to Switchboard Core are documented here.
 
+## v0.6.3 — Dead Code Sweep + Registry Fix
+
+Pre-fork hardening: fix broken registry install, add registry settings UI,
+clean up dead code, narrow default bundle.
+
+### Fixed
+
+- **Registry install**: SDK was sending `{ url }` but the Go handler expects
+  `{ download_url }`, causing every registry Install click to return 400.
+
+### Added
+
+- **Package Registry settings**: New "Package Registry" section in Admin >
+  Settings with a URL input field for configuring the external registry.
+- **`scripts/generate-registry.sh`**: Shell script that reads `.pkg` ZIPs,
+  extracts manifests, and emits a `registry.json` for self-hosted discovery.
+- **`docs/PACKAGE-REGISTRY.md`**: Documents registry JSON format, admin
+  configuration, script usage, and self-hosting setup.
+
+### Removed
+
+- **Dead Go code**: Orphaned channel/message type comments from
+  `interfaces.go`, unused `roleFilterType()` from `pages.go`, stale version
+  comment from `main.go`.
+- **Dead vendor JS**: `marked.min.js` (40KB) and `purify.min.js` (22KB) —
+  unused vendor copies with zero production imports. Removed cache entries
+  from `sw.js`.
+- **`dev.html`**: 676-line standalone dev gallery, not referenced by anything.
+- **Pre-fork version comments**: Stripped `// v0.X.X:` annotations from 72
+  files. Config-doc version references (compatibility requirements) preserved.
+
+### Changed
+
+- **Default bundle narrowed** from 10 packages to 5: `notes`, `chat`,
+  `chat-core`, `mermaid-renderer`, `schedules`. All other packages remain
+  available via `BUNDLED_PACKAGES=*` or explicit list.
+
+---
+
 ## v0.6.2 — Docs Polish + Dynamic OpenAPI
 
 Docs surface polish and dynamic OpenAPI spec with extension route merging.

ROADMAP.md

@@ -1,6 +1,6 @@
 # Switchboard Core — Roadmap
 
-## Current: v0.6.2 — Docs Polish + Dynamic OpenAPI
+## Current: v0.6.3 — Dead Code Sweep + Registry Fix
 
 Self-hosted extensible platform. Auth, identity, packages, Starlark sandbox,
 storage, realtime, and ops are kernel primitives. Everything else is an extension.
@@ -81,16 +81,16 @@ Pure cleanup. No behavior changes except fixing the broken registry install flow
 
 | Step | Status | Description |
 |------|--------|-------------|
-| Fix registry install | ☐ | SDK sends `{ url }`, handler expects `{ download_url }`. Fix `api-domains.js` to send `{ download_url: url }`. Every Install click currently returns 400. |
+| Fix registry install | ✅ | SDK sends `{ url }`, handler expects `{ download_url }`. Fix `api-domains.js` to send `{ download_url: url }`. Every Install click currently returns 400. |
-| Registry settings UI | ☐ | Add "Package Registry" section to admin settings with URL input field. Only way to configure registry today is a raw `PUT /api/v1/admin/settings/package_registry` — no user will find it. |
+| Registry settings UI | ✅ | Add "Package Registry" section to admin settings with URL input field. Only way to configure registry today is a raw `PUT /api/v1/admin/settings/package_registry` — no user will find it. |
-| Registry tooling + docs | ☐ | `scripts/generate-registry.sh` scans a directory of `.pkg` files and emits registry JSON. `docs/PACKAGE-REGISTRY.md` documents the format. |
+| Registry tooling + docs | ✅ | `scripts/generate-registry.sh` scans a directory of `.pkg` files and emits registry JSON. `docs/PACKAGE-REGISTRY.md` documents the format. |
-| Delete dead kernel Go | ☐ | `store/interfaces.go:178–183` — orphaned ChannelListFilter comments. `pages/pages.go:922–930` — `roleFilterType()` + template registration (chat vestige, maps nonexistent roles). `main.go:67` — orphaned provider-type comment. |
+| Delete dead kernel Go | ✅ | `store/interfaces.go:178–183` — orphaned ChannelListFilter comments. `pages/pages.go:922–930` — `roleFilterType()` + template registration (chat vestige, maps nonexistent roles). `main.go:67` — orphaned provider-type comment. |
-| Delete dead vendor JS | ☐ | `vendor/marked.min.js` and `vendor/purify.min.js` — 62KB, zero production imports. Only referenced in test helpers. |
+| Delete dead vendor JS | ✅ | `vendor/marked.min.js` and `vendor/purify.min.js` — 62KB, zero production imports. Only referenced in test helpers. |
-| Delete `dev.html` | ☐ | 676 lines, not imported by anything. Dead. |
+| Delete `dev.html` | ✅ | 676 lines, not imported by anything. Dead. |
-| Remove `dashboard` from default bundle | ☐ | Requires `legacy-sdk` (doesn't exist), auto-installs as dormant on fresh installs. Confusing. Remove from `defaultBundledPackages`. |
+| Remove `dashboard` from default bundle | ✅ | Requires `legacy-sdk` (doesn't exist), auto-installs as dormant on fresh installs. Confusing. Remove from `defaultBundledPackages`. |
-| Remove `hello-dashboard` | ☐ | Proof-of-concept from early development. Move to `examples/` or delete. |
+| Remove `hello-dashboard` | ✅ | Proof-of-concept from early development. Move to `examples/` or delete. |
-| Strip stale version comments | ☐ | 60+ files have `// v0.29.x:`, `// v0.33.x:` pre-fork comments. Single sed pass. |
+| Strip stale version comments | ✅ | 60+ files have `// v0.29.x:`, `// v0.33.x:` pre-fork comments. Single sed pass. |
-| Narrow default bundle | ☐ | Default: `notes`, `chat`, `chat-core`, `mermaid-renderer`, `schedules`. Everything else available via registry or `BUNDLED_PACKAGES=*`. |
+| Narrow default bundle | ✅ | Default: `notes`, `chat`, `chat-core`, `mermaid-renderer`, `schedules`. Everything else available via registry or `BUNDLED_PACKAGES=*`. |
 
 ### v0.6.4 — Admin Health/Metrics Tab + Cluster Merge