diff --git a/TECH_DEBT_AUDIT.md b/TECH_DEBT_AUDIT.md
new file mode 100644
index 00000000..9f2da73a
--- /dev/null
+++ b/TECH_DEBT_AUDIT.md
@@ -0,0 +1,131 @@
+# Fast Messenger Tech Debt Audit
+
+## Critical
+
+### `core/network/src/main/kotlin/dev/meloda/fast/network/interceptor/Error14HandlingInterceptor.kt`
+- captcha flow is built around `wait/notify`, a raw executor, and shared mutable state.
+- risk: deadlocks, leaked jobs, hard-to-reproduce auth hangs.
+- fix: rewrite as suspend-based flow with timeout and explicit cancellation.
+
+### `core/domain/src/main/kotlin/dev/meloda/fast/domain/LongPollEventParser.kt`
+- file mixes parsing, dispatching, IO loading, and concurrency orchestration.
+- risk: regressions when VK event format changes.
+- fix: split by event family and add parser tests.
+
+### `feature/messageshistory/src/main/kotlin/dev/meloda/fast/messageshistory/MessagesHistoryViewModelImpl.kt`
+- view model is doing too much: loaders, navigation, selection, long poll hooks, read peers, dialog flow.
+- risk: brittle state transitions and untestable branching.
+- fix: extract coordinators/handlers per concern.
+
+### `app/src/main/kotlin/dev/meloda/fast/MainViewModel.kt`
+- root bootstrap handles auth, locale, long poll, permissions, profile, and start destination in one class.
+- risk: startup bugs and hidden coupling between flows.
+- fix: move startup/permission orchestration into dedicated controllers.
+
+### `app/src/main/kotlin/dev/meloda/fast/presentation/RootScreen.kt`
+- root composable owns too many top-level flows and dialogs.
+- risk: UI orchestration drift and hard-to-read navigation logic.
+- fix: split dialogs, bootstrap, and navigation concern into smaller composables.
+
+## High
+
+### `core/domain/src/main/kotlin/dev/meloda/fast/domain/LongPollEventParser.kt`
+- uses many `Log.d` calls and large `when` branches.
+- fix: reduce logging noise and add structured tracing only where needed.
+
+### `core/network/src/main/kotlin/dev/meloda/fast/network/ResponseConverterFactory.kt`
+- double-parsing response bodies and only logging malformed payloads.
+- risk: opaque failures and harder debugging.
+- fix: normalize error conversion and surface typed failures.
+
+### `feature/profile/src/main/kotlin/dev/meloda/fast/profile/ProfileViewModel.kt`
+- `loadAccountInfo()` has an empty error branch.
+- risk: profile can fail silently.
+- fix: set `baseError` and show fallback UI.
+
+### `feature/messageshistory/src/main/kotlin/dev/meloda/fast/messageshistory/presentation/attachments/Attachments.kt`
+- attachment preview logic still sits in UI layer and mixes fallback behavior.
+- risk: silent drops of unsupported attachments.
+- fix: move preview mapping to domain/ui-model layer.
+
+### `feature/messageshistory/src/main/kotlin/dev/meloda/fast/messageshistory/presentation/Link.kt`
+- title handling is nullable and duplicated with preview logic.
+- fix: create a small UI model for link rendering.
+
+### `feature/messageshistory/src/main/kotlin/dev/meloda/fast/messageshistory/presentation/File.kt`
+- preview extraction is inline and branches on raw model internals.
+- fix: extract to mapper/UI model.
+
+### `feature/messageshistory/src/main/kotlin/dev/meloda/fast/messageshistory/presentation/MessagesList.kt`
+- message-item interaction is dense and repeated.
+- fix: normalize scroll/reply handlers and reduce nested callbacks.
+
+## Medium
+
+### `core/data/src/main/kotlin/dev/meloda/fast/data/VkUsersMap.kt`
+- lookup helpers were using unsafe assumptions on external data.
+- status: already improved, but should stay covered by tests.
+
+### `core/data/src/main/kotlin/dev/meloda/fast/data/VkGroupsMap.kt`
+- same risk profile as users map.
+- status: already improved, still needs tests.
+
+### `core/domain/src/main/kotlin/dev/meloda/fast/domain/OAuthUseCaseImpl.kt`
+- auth success mapping used forced unwraps on server data.
+- status: already improved, but auth contract should be validated.
+
+### `app/src/main/kotlin/dev/meloda/fast/presentation/MainActivity.kt`
+- service lifecycle now respects config changes, but app exit semantics should be documented.
+- fix: keep explicit separation of app-close vs config-change behavior.
+
+### `build-logic/convention/src/main/kotlin/dev/meloda/fast/KotlinAndroid.kt`
+- build-tools are pinned to the local environment.
+- risk: portable builds may drift between machines.
+- fix: prefer SDK-managed consistency or document required SDK version.
+
+### `app/src/main/kotlin/dev/meloda/fast/presentation/RootErrorDialog.kt`
+- currently hardcodes English strings for some errors.
+- fix: localize all texts through resources.
+
+### `app/src/main/kotlin/dev/meloda/fast/presentation/RootScreen.kt`
+- root-level error dialog is better, but some orchestration still remains in the root composable.
+- fix: split into smaller root flows over time.
+
+## Low
+
+### `core/ui/src/main/kotlin/dev/meloda/fast/ui/components/AnimatedDots.kt`
+- marked TODO rewrite.
+- fix when touching related loading UI.
+
+### `core/ui/src/main/kotlin/dev/meloda/fast/ui/theme/AppTheme.kt`
+- color picker TODO suggests unfinished theme customization.
+
+### `core/model/src/main/kotlin/dev/meloda/fast/model/api/data/LongPollUpdates.kt`
+- `List<List<Any>>` is a weakly typed API boundary.
+- fix: introduce explicit event DTOs.
+
+### `core/model/src/main/kotlin/dev/meloda/fast/model/api/domain/VkMessage.kt`
+- attachment persistence is still a TODO area.
+
+### `core/model/src/main/kotlin/dev/meloda/fast/model/database/VkMessageEntity.kt`
+- attachment storage/restoration is unresolved.
+
+### `core/common/src/main/kotlin/dev/meloda/fast/common/model/LongPollState.kt`
+- Android 15 support TODO.
+
+### `feature/messageshistory/src/main/kotlin/dev/meloda/fast/messageshistory/MessagesHistoryViewModelImpl.kt`
+- large commented-out legacy block should be removed once upload flow is reimplemented.
+
+### `feature/auth/src/main/kotlin/dev/meloda/fast/auth/login/LoginViewModel.kt`
+- debug/auth token acquisition TODO indicates unfinished auth path.
+
+## What To Do First
+1. Rewrite captcha interceptor.
+2. Split `LongPollEventParser`.
+3. Extract `MessagesHistoryViewModelImpl` orchestration.
+4. Localize `RootErrorDialog` strings.
+5. Add tests for auth, long poll parsing, and attachment mapping.
+
+## Note
+- Current code is already better on crash-prone nullable handling and service lifecycle.
+- Remaining work is mostly structural and testability-focused.