From dd20794faa5acd75ca79e51cf9605cb0868e401f Mon Sep 17 00:00:00 2001
From: "russell@unturf.com" <russell@unturf.com>
Date: Mon, 30 Mar 2026 15:17:08 -0400
Subject: [PATCH] undf: assign 859-861; stamp patches;
 element-web-0003/element-web-0004/conduit-0001

---
 UNDF-REGISTRY.json                               |   5 ++++-
 .../conduit-0001-earliest-events-hashset.patch   |   1 +
 defects/conduit/unit/ConduitTest.class           | Bin 0 -> 3773 bytes
 .../element-web-0003-canonical-alias-set.patch   |   1 +
 .../patch/element-web-0004-arraydiff-set.patch   |   1 +
 defects/element-web/unit/ElementWebTest.class    | Bin 0 -> 8891 bytes
 6 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 defects/conduit/unit/ConduitTest.class
 create mode 100644 defects/element-web/unit/ElementWebTest.class

diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json
index fd27d193d..632fd329b 100644
--- a/UNDF-REGISTRY.json
+++ b/UNDF-REGISTRY.json
@@ -856,5 +856,8 @@
   "gitlab-foss-0003": "UNDF-2026-000000855",
   "gitlab-foss-0004": "UNDF-2026-000000856",
   "gitlab-foss-0005": "UNDF-2026-000000857",
-  "proxysql-0001": "UNDF-2026-000000858"
+  "proxysql-0001": "UNDF-2026-000000858",
+  "conduit-0001": "UNDF-2026-000000859",
+  "element-web-0003": "UNDF-2026-000000860",
+  "element-web-0004": "UNDF-2026-000000861"
 }
diff --git a/defects/conduit/patch/conduit-0001-earliest-events-hashset.patch b/defects/conduit/patch/conduit-0001-earliest-events-hashset.patch
index c5eabe444..ba8383cd2 100644
--- a/defects/conduit/patch/conduit-0001-earliest-events-hashset.patch
+++ b/defects/conduit/patch/conduit-0001-earliest-events-hashset.patch
@@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000859
 --- a/src/api/server_server.rs
 +++ b/src/api/server_server.rs
 @@ -1254,6 +1254,9 @@ pub async fn get_missing_events_route(
diff --git a/defects/conduit/unit/ConduitTest.class b/defects/conduit/unit/ConduitTest.class
new file mode 100644
index 0000000000000000000000000000000000000000..239bbb4a355d1e957f90b8e9dd11231cfcdf2b63
GIT binary patch
literal 3773
zcma)9TU1on8U8kNIcE+hfTIHpsF_4ih!^k@&>6HMVnji0hDyMu<}h=FBg4#O<_un%
z#H6K7W74#ZZB0ybDNSoH=|j`C6m|8oR-fuxdF@NzyH;0U`q0$}SEK#*IR|DCR$5@4
zef#&n|Nr~H|KFRt_iz6mKreo+p$a|)ejNb>1?tWkGe$?o$WC+|A3tlRY=K~pm9^}B
z0=~BPlL}OU)s9ffwlW>Pg@SQm&??#*6lhXOwLr9Ouq@G+%Vem>%4HMnC#96H8a1d@
zP^V)R!U8pAS*b|CU$ico&T#`$bd8P(>N%b;xfp31Xm_<&7@1JexWx9PU9hqfa(9!C
zW~>!ZQ@N~dSlOafv0Op>m=s>G<54N>Gty}dkKu6z8+5dwm7B^|mOY}fkU5>V9Rviz
zZJuckG}4(wH8!D5LA#D8uvy@dvX&tuFQC(><AsCf8Kab;bGuitYz14FPf6pq>ez-3
z#*4=HW-^}>hA{=(1y+@9IcyXslO|)>39TBt(4^qWCB||wOulsM*o{2`4b#Sy*_X?v
z412_~C)q37M%H$)T@oHQ4h&CX*?II|LmWO8q*kaUW7uZVKHV9HKzEp=?3U0S(9tJx
z^W{slt{;aKJf-6>29`$qLeVy-8RM*x%?(@AE_se<IEq09LpqM(xIi_{OqVQsnCFng
zM1IIB7D<!-8I!i3G*bdQE1ByA(8anO(26lVNDQ<O$YZ{!<7s)uGOYwIM7xJ|d<iG%
zN3J9}>?*Nx9VbXrn;@CSbV9{50==ZEG;(WaXXo~KY{pFOZQZu>Ofgn8ZLe1_m`v<%
zKl7)nv9|ubt?4bXw3)Xj*=ujj275pK)MTun;mded!B=#g#&b*XI+!bsX9$uqV`NI^
z@iQ_d4pwHBE0EAIj+BD5)If2UFizSHWNmZ8EC|#uO-FB@J0~!yz|wIRQws%SslOy@
zUV6{ddn#$~QRdWgl6w{|Rg(x2{%IXq<akbtQ7oDTS!{|2t)f9M(*j~FxL*Ro9|h!S
zqeFbhkKP6G{z4&F2*Zbxr1;D-L_DiB6mVWvxeHQa1rtxI_$rY)(VI-hDnls&c~Qqp
zxJ1|;zcbl~RCq_oB6$?A==hqf$F(vmJmN}9sF)?sdj|(&@(2yz#H$LvrQ<bRrf}J@
zz6_CIc+zIkDwyd-Ka;j$m$<-MKE_JhmrFCSwS!jHJXV?>Hw(iOGp0V}Qd1<jHx4DO
zi7a;(xOU~?9O<dR!E<6?!kt^poBt)lqgD|4f0XQ#IVhm@pHDFfWaJgRwLm#1$crm<
zc$!y$WNjtA7J(<SJ*kX$+iA&MsgN=cSrU)BirTSFqRgoSxtv|J3r2p(v?p`vqKa!Q
zGA*W2$XK$J2^Bx0T`i_8FQ>(6L&f`*<8c)q3N-hh&+~dT)3JR!&c}**(@dB0TVfMA
zJ0@y_nA7kRe5Bx~l9oRcXeo!-%Fg7b%nsLj+Q(vi$Vl0_0=fBiB{w}m*UZC4Hk~nx
zErYq-R4MO;$$`m(p(2<|HV$9Nn=6P{0_naO5|x$2Q_*K+GD*uec@5|T*{oS`_-Qg!
zzYu6$=F>{1D)^Pa`p*|-O>zC=-F=jI2q5YjWock9$cu$f9DZNtXdPR@Ht@tvh~G#-
zyx|D}I#hXOP=OTvj8#End+838QHqD+e%ZSTJs$9N1$|vgBpCJI!XpB67>fp+-nuy)
zkNP9QTUcF%KcXS7&MIPaRK10072ZK;HYlz?xEl?~nRQhd*%DRf5xa$rK1$cbLs5S;
zbPHR!;z)iNQ9h;#RgRGdP{)1)jcUYdL{X0>ew%rDuf;yB=d12f3?fDc9^<XFf!9DQ
zGT4Y2UZ@w)h8NI|Z&O1Hd=I!$RZ!#nZ4z!z5Sag9w}OUylzh`U_dA4yH=GNJs3j!T
zoWEQNN$2S1o7fQ#EPx}C@pY*YWf7cHQQ|?E2+j$Dqb!0GnpFj{pvOC1bQGfV=V(yQ
zxafo`(b0&G=Ak1cKZvMhbPn-V3G5&`JF$junRR%QSacDGZaz15^YO5U+=ycY35=l!
z&l0l<d;#aMAFmL*SscKte04~KHc5mwAoLJIyEt}1+OrHKR&5ugsy7jmff83%iGL;P
zcJ!>;RJYf|=9sU`AMrQMp<!#pf1Ad^^>fxwZ~lG<ak8tYf@aY`c&{rF-Wzuqr!>!@
ze*tMVN|bNY2TzSV+`l;V6G`%{*M|{LE*>NuuRpl6ph1Z$TYU@Ra8Ke)Qy}xuoYcgy
zNlo)O*sc1yw1`Ik=CC>%*c$b(oyU=pS&gdy!S#C8?AAOvJ)$p_J25h=SIFu0+U0uv
za&Aw}CrE}z)Zd|M)W^9s7|qS&RC3hM)x|-evBsGUHqFCGjw;Qvxq&kypCEG$&5bo{
zkiYsK!go*@ZLGNs8@P#ce~_v#-oOho;oV$%pD_kG;l}_U2S>>2LFUvDGwB##>_g0{
zr^%NjIWf$Y5uCs?80GIcx$`_u;bmsm8|2UrIR7r5!$&Z1gR6Iu!e3zFuY3Ug4O93h
z+kayk_xVimAunq1yl7;*o)40ZD2WcfIeKwUOtQ`3ytvF4##^}Pu&^JY2TbyS5HdlT
zoc9oYfXDftm@}bZlf%yjXXUB;IKZJ_+(W}>sP)<@zYpJ~qkh)8?~#{R@O_u1*us_@
zq0i%G3D4I(c-(qe!$b#O<o6{)bE!gyN|zUk=`KeDuqu4?2EK6(ivK$NzTYBK##xHW
x!YZ>WfGT}IpCI@l2UWO=x7jw)wjWdI9q0S5^L@|xet_#-*SPj`{1P7{`d`$Ok81z`

literal 0
HcmV?d00001

diff --git a/defects/element-web/patch/element-web-0003-canonical-alias-set.patch b/defects/element-web/patch/element-web-0003-canonical-alias-set.patch
index 943a48a8d..56406a4a4 100644
--- a/defects/element-web/patch/element-web-0003-canonical-alias-set.patch
+++ b/defects/element-web/patch/element-web-0003-canonical-alias-set.patch
@@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000860
 --- a/apps/web/src/TextForEvent.tsx
 +++ b/apps/web/src/TextForEvent.tsx
 @@ -394,8 +394,11 @@ function textForCanonicalAliasEvent(ev: MatrixEvent): (() => string) | null {
diff --git a/defects/element-web/patch/element-web-0004-arraydiff-set.patch b/defects/element-web/patch/element-web-0004-arraydiff-set.patch
index 2462cf9b1..7351530ce 100644
--- a/defects/element-web/patch/element-web-0004-arraydiff-set.patch
+++ b/defects/element-web/patch/element-web-0004-arraydiff-set.patch
@@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000861
 --- a/apps/web/src/utils/arrays.ts
 +++ b/apps/web/src/utils/arrays.ts
 @@ -189,8 +189,12 @@ export function arrayHasOrderChange(a: any[], b: any[]): boolean {
diff --git a/defects/element-web/unit/ElementWebTest.class b/defects/element-web/unit/ElementWebTest.class
new file mode 100644
index 0000000000000000000000000000000000000000..6bc14d1f0b76664b14adf89c6f6863e109344b7d
GIT binary patch
literal 8891
zcmcgy3wT^rwf=YJab_|nq?t5nrVl#MmL^ToCTU6AB(x1}kYXAtDUIc!Ofx6xw3C@I
zGwDOTzHa1V!55%N<)Ia=a<9nCHfeZ>cojvs_lh7QdI3QmauwgbwQc<OK4)^yB-5tF
zPrt9<IeX4td+oK>Uh7|L?equ74n72+Rp^B%fJ=j0hX-DPDO)4kBa7mZMDL;tH*Yn%
zGXmb0SR$5LA>gX4+Ni-NP^yRqGO_rg)>JC8t38&^6heb5fB<w2MLJGHvA}6Iog@+P
zbte;<NGy>SD64EAzg2V9C6Ymjj-XuaibSItrV31RvPo<+qUT4_TRIJHSt_@jh7t`G
z0!22Nn$$2|Dm6nOWbLISUY(4`saGtSXqM{C%F($qlZqvJgEY--9bufo&HEzTjMd3R
zcO=sl%WUB&orxqeN`tjk4js&;&4rkQxf<r_I1BS>g0{HPXCyLR#^w!%G(lO^hz|6}
zW8`OCoHkNvWkG>um6uLrmgkeTrBX#2Rc%<MV}abQbUbrqh#J&tSg2zW>bSpcCEF6z
z#+^>4C|;@4REmGqMn6?*(6JaxI6pU%rqt4W={2!*WOLkz3J7&@jXIXfgYz0!4n*Q<
z4a)^8>_cwNE^JGsk|`gW1*#&_eZrAMG@Ldv;l6=%CfuJ&MhCi$a5~awga^1+IIi4l
z8P1W%Nk7c%IvWeI3auK>)v+3Dau0P^I%D+F`x22vazm`oP_BG|p9{{@@eZ8N-^l@a
zHs%S$l8e^U4Kh4YBhuIG!vzA3hIx*)JB-b>b#-<1O<^VbIrA1S?nz7Otx+mM+i+ap
z^XN_U65iG)o-pW5C`1P?)UaO1yKqsCbZe3WG@^jEJrW-<F6@!|t#LY*Nx*a7fQvP3
z)X{}^XJar|RGPkD3Qis^&hWBa)9FoSa5r1~<g#h@u9_=l2IElRG8qV$Pms#u>BD<D
zwZ65pGd$ixQs9V=&FH3bO0IZ9vYF`SRU2j88#;Q>%VUaV3|cXn5-6{9y8Bw|dvgFW
zY}K$$M;tuYpzYFG67IMqlI}2e@>B_1bk7))I{I-XJw2g5PtEdnfL*f&hC+$WZwzTt
zm@bh<4-zhC%NXCOV;A1X%@f9s_^$P_M8b%!O+<~I@&p?uM3Jeq9kouq#=`jhI{roS
zJk7zA5$wYU1;R0t`B<>@M>1Q|X2?W(Q-<NghlwKN4xynbyKXW^T{Sg(<Stz1!_~(*
z)rKJ4rU5>tW49ExJZ1DHw;R#ccr21O(rXjl@qwt3mNvRh$Hyf}NiK;}>5~G}t<T|z
zxzwSIT>WVs*UQyYnFsQ+zfs3$Btfy0Krz3Gz@t9qVeP}s0?WtQX|c4EDflFY^5OHx
zG0kEPw@z@Lb&>u;+ya*mUl8ypnF830FKM_#$CvSyoU}z^x@*6LqGir7v4YhRIJx2L
z^k5&pO6RvM8zf*VZ~b>2|ADVlIt5y5Vm&?Ca}uaOC1<6KD&>4b$K8^nKE{!jm#W>X
z<38L^J$eo5aaJBZoZx0DqG3M|+KxLrHTf_^PZ`@JY#yu16qef`6qsqxXMM`1kiPVQ
zjt8ZygcRZ01d$|d76Dm1NUDc*e9QDWnU<VX%B#Me-N-rPa9SU}Bd}teXDz9X(%L8O
zUO{+e_<c`c^#n#lc2n$A;HF7#KRAxZE|E(AP{$Lp@(X5IpR|otD>BE)>HpI4-}$E-
z<n)hpJe7ZXv7CNd$20k-m-z53vA(svJuI_FA)dp}G(4~4=MvJ3?XqEYoD~OQhL{pd
z5eKqWL}w<F8IXm`>SUDZv$#E$FggbMHXEr8vMOO<k)nGW{Z;+e@Dh`zGX+{1Ou*k6
z>rIeZii_IcW*OGv2u_Rf3KlqpZ9BV-epM}Lcr}}~RlJVP2qeZwU|w$HQb=B!@o6P5
zk-(?_Asf=vdG<RQv8AcpeQXS5%FlB~RU7FlE!}ae5h?6U4y3w`^J4OtOKqQ(74|~u
zIV`ZwO(rwxOe)g9&d6*@M$<n0j_|ii7L=l?FTy&1=fY&F*M~nas@rz<6Ag@Lctw5P
z&TzWlkTrTuxHp*z3m^VOK%HxBXBE#Me-W5rlb=12`u`b9b5usl-RG~Y&Qi%_-+RgA
zC`;dbOu{|Mlv!6wh#nJQlpuX#awj5L%Zj~16p8}j(gd5ku<!`XwWBJQ*q+>GEHYiy
zY;VqsbhGH%CGa^XW?O`&70+j-9yii++mp#{1O3etectgUXW@oj{YD;g=TYZLX%>ss
zk$Ak5MIoI;U&}fxr69pbYl6M#ya_tx6IG)raQcZ!c|N9IID^Plz;Z}TsgPX{N2M%;
z*&p-y3;vqLx8U2e-~hxuk`VvPr<?}L;ghW&8A#H{`PTT}Is$Fe0r=M~=%{_D(d}yV
zlzGbBdoicB%+t{1tqFODQCNUI(A98C0lEe~V&CZV)u%{bb2oP@Q1YBfNq`xA&cx{y
zx`FRyn9WWk%&L4gw%|;>K#KYBj-mu!4KJ#H0X_v)2_J&z7<}rN9OIXY^~+?)Zqrim
zPPmkUmyV#63YLvmu)?8Wc~+}e$7z+HNSdtX07AA#viJn8>*MydsKiC6QX0&IJ4b_Q
zmIj9~BdY+14*8k!O!>ty{3zlH`b%7|HBWyKGu!23oomIc>3cD|de*Fiv>iHYX3d)J
ziC<y<7<BPuUaGDc!kHcNS=r>S9YS@;&Bwi{--C+Ukb4+s%kwN6!Lm)krUPhscnB+(
zdR&cKnO1_w_M%uZ=o-|>?6;gN_ZUkxi^gB(w`nT72K^2if4R21+`l`yJa8}Cf@{4G
zqF|GY-=^Z7$sw%k+~nr$*bh%dKz`hh&Mqa|jEcZiY`W=I1f^gVfrGddkkUzJ@7a$l
zq(7Vf(}NJlwY2#{8fg*lbm~xsdfKA_)g0HOkq!S+te{t&i{<R3o9I{PpqF1hfR(r!
zt+<vmd)blSi8hvn=ixs|^$WgVl3h2}5(_U-C)fbrD5k(Iln1`Zxx)w_MV$tEW8f$>
zw>XT_qbRoCm%Ckfh0?hhbHAcLuotr&au?qo&a{k0+%R}W(NQ~$Edn=V9tX@b-@?o$
zH;>E?I}T;o?Hhg85kuvQ*M;0+Jwf4J)b=83*{NhMhKm9z31jmQb6Yb$UL!HvI7^)C
z7$07WbN&cYo2m~Wv(A#MV}X*Z$t`72lAR?-mS~=ukY^YJ3K44M&=l>NT00n~E52Pk
zns+mLH}QZjp`kCOaW7Ni1>rh|kOl?=Z5XS{m5@c9DWUkD6#>&^1X#kgXN_mZ!Tf55
z!FIqDqs9t_u@5R9o|EppL&d{Ylg7gbju#I*P9h$zI#E1)=<USAN1X96Xvf1x^Tfjy
z^tlM+y~b2@6I7zaAp^@fUdc;_Hf%*Zw$WSSxEOuBap=bYuEcdn;YMWWe*^5Bwqpo8
z@d&;4DLTrVe7}XO#A$fHD5vYZKzC8`P_E)Z27ro(%2S93w&s=t{v+byBXse9WjqWr
z9zM!=xO%d9U?YD#ajK6Wo(oPgJa<!^Ybnlk6zAg<=M$5O!&`}eQg~j^;JSg~c_YK~
zGYrqqGCXfOiSXpbMm`ByaM%E1TJG-!kk3=XTPWeJl<+o6csnKh!bwQTw$GHXpoJWY
znL@iJ0g!(i4<KV7Yyi1N0m!wJ0>~#MfJnsoRFg-(ZfNp`JTeD+vpF~v^2nmfk%T{+
z1s%=Rm`$){a`81?ijxT|ugg@d8B6^#6_YYh7Eq~JQC_PkZ|E8fFd=6t1I)MO0Vd=k
znL|Hk0gxjHyE*Gf$VKB4a?w=S09164Q8kv3_v8T3^^o_ncMyQSOaS@{0calq=&J;v
zuMvRu5rDo<0J@6+^bG>g-2|X}2tW5>2kvJ={w70qKdvF~J8+OIM)>ssjviz#9Km<-
zFrFkNJ%w*GK|hL@@g2Ou@mriZgvVG9eqWUGCZUG!Iy^2q@I$eYHwO}|n&BU1-7AxK
zUa;cLm?MjatSrv=_$<ylD$DCft+aV_HW8gVOq^Vvt(M8vth}9hb_BPun!Qa1SMc_l
zVSLerE)Msxcrb@{9&X@S06!uIJw*)qF)`?AV$d@ze13u}@GL?9r#yk@@FDz+DD^xc
z;OEL}GvUoCAI5$-GWF}^%4;^$D58NzktO~8vX-!*z$_{{EM-~Jm{o;Gs->!m`Eq1c
z6=t8Is*0kJTZV^ORy>_u?y-szubi`%b7U>oYD1b;loT<#I38PWT8qnqw@c7gHu47d
z$-T|7ZLcO4lE8}ujhFZbhF{WyU#9oI!nWjBEU;c>74sUC<LgB7H}EO^nkn;5`uqRU
zmw%(|RwLV$IkH`mPNnJ_tHc2o97e%WOi|xs@`qKENjvfa&~mP~lM-*1of$PdUWxd7
z?(heS^+%rnpLqU%R<fR;MC47QCC=YlB2qM`>rN;U57X3tCBh#e!XG8VA0xt#D)CNS
zBJ$?Wl+bk}Ih3(2=$-`OzcwD>$3EByf2TtDyPDk6=W2tu596K!BG5P4=rz%63Ey%;
zhMjYUo^^a+KOlkKWVg?`NDHx_%CgIu@r8UgJ1ykP$rHob+%nSSmx<w_ros@jL3OCm
zUgHlH=B#-nn_B{|#-g$!yLr2_Yp^KWyakM<#Qv2_NmE=_Y}4G;HCXJRDK0PCU0%$5
zQX=!oqgFmCvQvngvyOaHGA^H#IP*!#LH1lKpIAGWmX+E&k8}-|I(E)VmqYVVF3p&9
zrBb@@PAXmLIO$5A(v=>>V|KRteonT#7d0#@Tudu&=)%MQ3E<@)^EFhmX<W|nN};1o
z6rr7kvmuK4N3tpW+e``n_7KFA%vEo&nEsuZhC`x)7j7Y5g-sWyi&<h0pG{)6I9Hq@
z-XYEu@8OpoF;67LS>nTDzSzU}ZK6^<AgaY9qDDL`YQ+m;k$6Sai6f%Ez%3RR6p1AT
zv&Gp3%lK{)jRlv8Wd)nXaurm)D4v)NN7<NZR({m5SN)Ul1x93tiDXBSn<sO--6LGi
z4)_R)&DZ75{?|{a{I!K9t$edxK-mx;AHtJE_@5#CSRU0+EbE$=RjPXwEpUl*ctO7c
zezB5PUPUXn<}}uC5(La!uO*5tP!gQ8A3xp0mV6)FuKQ4L-xy?Xz+T|~9u(-S_-7y@
xx4cmJ4Svfv+ZxIy@RoZ1UOoS)o_|))L+W{0J&&m8F`l&i^SKb3@QVOKe*>PbvlIXT

literal 0
HcmV?d00001