chore: code quality sweep 2026-05-04 / 2026-05-05

General code-quality and robustness pass across the plugin: thread-
safety on IPC state, resource-disposal cleanups, input validation,
defensive null-checks and a few small UX glitches. Compliance docs
(THIRD_PARTY_NOTICES, PRIVACY, COPYRIGHT) refreshed to v1.0.3.

Highlights
- ExtraChat IPC state synchronised across threads
- ChatLogWindow autocomplete no longer leaks the unmanaged
  ImGuiListClipper allocation
- ChatLogWindow + Popout style stack stays balanced when config
  toggles mid-frame
- Retention sweep and privacy cleanup wait for the actual filter
  pass instead of the fire-and-forget Task that started it
- Configuration.LatestVersion bumped to 13 to match the active
  migration path
- GameFunctions placeholder buffer guarded against oversized
  replacement names
- TellTarget.IsSet, ResolveTempInputChannel, InputPreview, IconUtil,
  Lender, Payloads, ExtraPayload all hardened against null / empty /
  EOF / cycle inputs
- FontManager Lodestone download stays in scope for a follow-up
  (timeout + lazy init pending)
- AutoTranslate replaced the msvcrt.dll memcmp P/Invoke with a
  managed Span comparison
- Privacy cleanup worker thread marked IsBackground = true
- Database cleanup now removes both legacy files in one click
- Tell-target name redacted in the verbose debug log

Compliance
- THIRD_PARTY_NOTICES: last-reviewed bumped to v1.0.3, Pidgin 3.5.1,
  SQLitePCLRaw.lib.e_sqlite3 3.50.3 listed as direct dependency with
  CVE-2025-6965 / CVE-2025-7709 rationale
- PRIVACY: last-reviewed bumped to v1.0.3, BetterTTV trigger wording
  clarified (list fetch at startup vs. on-demand image fetch)
- COPYRIGHT: upstream attribution range widened

Build: 0 warnings, 0 errors. No behavioural changes that would alter
existing user configuration or stored chat history.

HellionChat/Ipc/ExtraChat.cs

@@ -20,10 +20,14 @@ public sealed class ExtraChat : IDisposable
 
     internal (string, uint)? ChannelOverride { get; set; }
 
-    private Dictionary<string, uint> ChannelCommandColoursInternal { get; set; } = new();
+    // Volatile reference: IPC callbacks (OnChannelCommandColours/OnChannelNames) fire on a
+    // Dalamud-dispatcher thread while the ImGui thread reads the IReadOnlyDictionary projections.
+    // Reference assignment is atomic on x64, but the JIT (especially Mono on Wine/Linux) needs
+    // the volatile barrier to guarantee visibility across threads. See AUDIT-2026-05-05 [SEC-01].
+    private volatile Dictionary<string, uint> ChannelCommandColoursInternal = new();
     internal IReadOnlyDictionary<string, uint> ChannelCommandColours => ChannelCommandColoursInternal;
 
-    private Dictionary<Guid, string> ChannelNamesInternal { get; set; } = new();
+    private volatile Dictionary<Guid, string> ChannelNamesInternal = new();
     internal IReadOnlyDictionary<Guid, string> ChannelNames => ChannelNamesInternal;
 
     internal ExtraChat()
@@ -40,9 +44,10 @@ public sealed class ExtraChat : IDisposable
             ChannelCommandColoursInternal = ChannelCommandColoursGate.InvokeFunc(null!);
             ChannelNamesInternal = ChannelNamesGate.InvokeFunc(null!);
         }
-        catch (Exception)
+        catch (Exception ex)
         {
-            // no-op
+            // ExtraChat is optional; missing IPC peer is normal when the plugin isn't loaded.
+            Plugin.Log.Verbose(ex, "ExtraChat IPC initial state query failed (peer not loaded?)");
         }
     }