fix: resolve race conditions, security issues, and cleanup configurations

- Fix broadcastMembers TOCTOU race condition in hub.go by using single
  critical section with deferred unlock
- Remove unsafe Math.random() fallback in client ID generation, throw
  explicit error for unsupported browsers
- Add error logging for all sendError() calls in hub.go
- Fix HTML aria-label formatting bug in nav-header.html
- Fix pre-commit hook temporary file concurrency issue using mktemp
- Consolidate duplicate changelog entries (2026-03-09, 2026-03-10)
- Fix TodoWrite tool reference to TaskCreate/TaskUpdate in skill file
- Optimize pages.yml fetch-depth from 0 to 1
- Update client ID test to expect error instead of unsafe fallback

All tests pass: make test, cd web && npm test

Author: shijiashuai

.claude/skills/openspec-propose/SKILL.md

@@ -49,7 +49,7 @@ When ready to implement, run /opsx:apply
 
 4. **Create artifacts in sequence until apply-ready**
 
-   Use the **TodoWrite tool** to track progress through the artifacts.
+   Use the **TaskCreate** and **TaskUpdate tools** to track progress through the artifacts.
 
    Loop through artifacts in dependency order (artifacts with no pending dependencies first):
 

.githooks/pre-commit

@@ -22,11 +22,11 @@ fi
 
 text_files="$(printf '%s\n' "${staged_files}" | rg '\.(md|html|yml|yaml|json)$' || true)"
 if [[ -n "${text_files}" ]]; then
-  if rg -n '\.meta/|/specs/|specs/(product|rfc|api|db|testing|README)' ${text_files} >/tmp/webrtc-hook-legacy-refs.txt 2>/dev/null; then
+  tmpfile=$(mktemp)
+  trap 'rm -f "$tmpfile"' EXIT
+  if rg -n '\.meta/|/specs/|specs/(product|rfc|api|db|testing|README)' ${text_files} >"$tmpfile" 2>/dev/null; then
     echo "pre-commit: legacy /specs/ or .meta/ reference detected in staged files" >&2
-    cat /tmp/webrtc-hook-legacy-refs.txt >&2
-    rm -f /tmp/webrtc-hook-legacy-refs.txt
+    cat "$tmpfile" >&2
     exit 1
   fi
-  rm -f /tmp/webrtc-hook-legacy-refs.txt
 fi

.github/workflows/pages.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
 
       - name: Setup Pages
         uses: actions/configure-pages@v5

_includes/nav-header.html

@@ -68,9 +68,7 @@
       <div class="nav-lang">
         <a href="{{ en_url | relative_url }}"
            class="lang-link{% unless page.url contains '.zh-CN' %} active{% endunless %}"
-           aria-label="English
-
- version"
+           aria-label="English version"
             title="English">
           EN
         </a>

…ive/2026-03-09_stability-and-security.md changelog/archive/2026-03-09.mdchangelog/archive/2026-03-09_stability-and-security.md renamed to changelog/archive/2026-03-09.md changelog/archive/2026-03-09_stability-and-security.md renamed to changelog/archive/2026-03-09.md

@@ -1,10 +1,10 @@
-# 2026-03-09 — Stability & Security
+# 2026-03-09 — Stability, Security & Pages Setup
 
 > Type: `fix` | Impact: High
 
 ## Summary
 
-Critical bug fixes for goroutine lifecycle and resource exhaustion prevention.
+Critical bug fixes for goroutine lifecycle, resource exhaustion prevention, and GitHub Pages setup.
 
 ## Critical Fixes
 
@@ -25,7 +25,29 @@ Critical bug fixes for goroutine lifecycle and resource exhaustion prevention.
 - `MaxRooms = 1000`
 - `MaxClientsPerRoom = 50`
 
-## Improvements
+## Features
+
+### GitHub Pages
+
+- Jekyll configuration with SEO support
+- Custom homepage (`index.md`)
+- Custom 404 page
+- Changelog index page
+
+### Go Backend
+
+- `.golangci.yml` with 11 linters
+- 11 new test cases for edge cases
+
+### CI/CD
+
+- Separate `lint` job
+- Coverage output
+
+### Frontend
+
+- Meta description and theme-color tags
+- SVG emoji favicon
 
 ### WebSocket Auto-reconnection
 
@@ -35,7 +57,15 @@ Critical bug fixes for goroutine lifecycle and resource exhaustion prevention.
 ## Files Changed
 
 - `internal/signal/hub.go`
+- `internal/signal/hub_test.go`
 - `web/app.signaling.js`
+- `web/index.html`
+- `_config.yml`
+- `index.md`
+- `404.md`
+- `CHANGELOG.md`
+- `.golangci.yml`
+- `.github/workflows/ci.yml`
 
 ## Security Impact
 

changelog/archive/2026-03-09_pages-and-quality.md

@@ -0,0 +1,42 @@
+# 2026-03-10 — Workflow Standardization & Pages Optimization
+
+> Type: `chore` | Impact: Low
+
+## Summary
+
+GitHub Actions workflow standardization and GitHub Pages deployment optimizations.
+
+## Changes
+
+### Workflow Standardization
+
+- Renamed CI workflow `go.yml` → `ci.yml`
+- Unified `permissions` and `concurrency` configuration
+- Added `actions/configure-pages@v5` step
+- Added `paths` filter to reduce unnecessary builds
+
+### GitHub Pages Optimization
+
+- CI badge URL fixed from `go.yml` to `ci.yml`
+- Workflow filename updated in project structure docs
+- Removed non-existent logo reference from `_config.yml`
+- Added Jekyll artifacts to `.gitignore`
+- `cancel-in-progress: true` for Pages workflow
+- Expanded path triggers for Pages deployment
+- Pages deployment badge in README
+
+## Files Changed
+
+- `README.md`
+- `README.zh-CN.md`
+- `index.md`
+- `_config.yml`
+- `.gitignore`
+- `.github/workflows/ci.yml`
+- `.github/workflows/pages.yml`
+
+## Benefits
+
+- Consistent workflow naming
+- Reduced CI minutes with path filtering
+- Better concurrency handling