Non-Negotiables

• Do not store user passwords.
• Do not change loginSalt after accounts exist.
• Do not weaken guest/account restrictions.
• Do not break main/sandbox origin separation.
• Do not add third-party scripts.
• Do not edit core CryptPad app internals unless a future PRD explicitly authorizes a specific change.
• Do not let pages get stuck at Loading...; verify with a browser.