Pre-production checklist sweep across two rounds, then a six-stream
multi-model review (4 Claude specialty agents + GPT-5.6 + Kimi K3);
all confirmed findings addressed.

Security hardening:
- Select.svelte: replace {@html option.label} with text interpolation
(mutation-XSS landmine in a shared primitive; labels sourced from
innerText). svelte/no-at-html-tags is now an ESLint error, with
justified disables on the two safe uses (static SVG, DiceBear).
- /api/proxy: CSRF origin validation on all state-changing methods via
enforceSameOrigin() in validate.ts — exported so tests exercise the
shipped gate, not a test-local mirror. New tests incl. Origin:"null".
- /util/* debug routes: 404 in production at both layers (universal
+layout.ts guard + hooks.server.ts edge check).
- hooks.client.ts: log the full error, return only the sanitized
message (was: raw error shown to users, nothing logged).
- theme.svelte.ts: guarded JSON.parse of localStorage with per-entry
theme validation — corrupted or garbage values (incl. themes:[null])
fall back to presets instead of white-screening every visit.
- CSP: base-uri/object-src/frame-ancestors added in svelte.config.js
and the backend Caddyfile (which replaces this header in prod; the
frontend carve-out is documented there for deploy time).
- instance.svelte.ts: exempt `building` from the PUBLIC_INSTANCE_URL
fail-fast so image builds succeed; runtime guarantee unchanged.

Dockerfile/CI:
- node:22-alpine multi-stage (EOL alpine:3.14 dropped), pinned
pnpm@10.28.2 with --frozen-lockfile, pnpm prune --prod,
NODE_ENV=production, non-root user, HEALTHCHECK against a new
dependency-free /healthz endpoint, documented runtime env contract
(ORIGIN, PUBLIC_INSTANCE_URL, PUBLIC_INTERNAL_INSTANCE).
- bun build path removed entirely (bun.lock, adapter, bunstart, CI
target); pnpm-lock.yaml is the single lockfile and CI publishes the
node image as the primary tag.
- .dockerignore: fix Dockerile* typo, exclude .env*.

De-Photonization:
- PWA manifest installs as "Coves" with crab-mascot icons (any +
maskable); Photon hexagon logos, stale favicon.png, and Photon-era
PWA screenshots deleted; app.html favicon/splash use the mascot.
- PUBLIC_XYLIGHT_MODE donation/source UI removed.
- ~97 orphaned i18n keys removed across 21 locales; residual Photon
brand strings in ar/et locale values renamed to Coves.
- /translators page removed; package renamed kelp-coves ->
coves-frontend; root README switched to the pnpm workflow.

Documented decisions:
- PUBLIC_SSR_ENABLED stays unset (CSR-only) until the cross-request
locale race and logged-in hydration flicker are fixed
(.github/README.md; tracked in the issues backlog).
- Production sourcemaps deliberately kept (vite.config.ts).

Tests: 673 passing (17 new: theme corruption recovery, /util gate,
proxy CSRF, Origin:"null"). Verified: pnpm check clean, Docker image
builds, boots healthy, /healthz 200, /util 404 in prod container.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Pre-production hardening addressing all must-fix findings from a
three-agent audit (security, fork remnants, robustness), plus fixes
from a seven-reviewer /second-opinion pass (Claude specialty agents,
pragma:security, GPT-5.6 Codex, Kimi K3).

Changes:
- Remove lemdro.id third-party fallback: prod server fails fast when
PUBLIC_INSTANCE_URL is unset (even if PUBLIC_INTERNAL_INSTANCE is
set, since the browser can only see the public var); API proxy
returns 500 on empty instance
- Stop handleError logging the full request event, which leaked the
session cookie and sealed auth token into server logs; log only
method/path/status/message/stack, pinned by new sanitization tests
- Add AbortSignal timeouts to all server-side fetches: /api/me (10s),
proxy upstream (30s with 504-vs-502 distinction), logout revocation
(10s); proxy signal is created after the client body is read so slow
uploads don't consume the upstream budget
- Scope the prod HTTP opt-in: ALLOW_HTTP_INTERNAL_INSTANCE=true
permits plaintext only to the PUBLIC_INTERNAL_INSTANCE origin (the
Docker-network hop), never session-derived hosts
- Fix markdown link XSS: protocol allowlist (http/https/mailto) via
URL-parser normalization in isSafeHref, closing the java\tscript:
regex-blocklist bypass; extracted to plugins.js with pinning tests
- Surface backend-unreachable state: authError now flows through the
layout to a user-facing toast instead of silently rendering
logged-in users as logged out
- Classify timeout/abort errors by error.name instead of message
substrings; portable (non-DOMException) 504 detection
- Delete dead Lemmy-era components (Subscribe, UserNote,
CommunityFlair, RemoveModal, BanModal) and their modal state
- 404-gate the unmigrated blocked-communities/instances routes; the
blocks page keeps only the Coves-native users tab

Deploy note: prod requires PUBLIC_INSTANCE_URL, PUBLIC_INTERNAL_INSTANCE
(explicit http:// scheme), ALLOW_HTTP_INTERNAL_INSTANCE=true, and ORIGIN.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add the frontend half of the block-level rich text facet work: posts and
comments now render canonical plaintext with byte-range facet annotations
(mention, link, bold, italic, strikethrough, spoiler, blockquote, heading,
code, codeBlock) instead of ignoring record.facets. Records without facets
keep the legacy Markdown path, so bridged pre-facet content is unaffected.
This must land before the tidepool bridge starts stripping markdown
markers, or quoted text would render as unmarked body text.

The tree builder (src/lib/app/richtext/facets.ts) is a pure, dependency-
free module implementing the lexicon's reader conventions for untrusted
network input: unknown $types degrade to plain text (open union), malformed
or out-of-range byte slices are dropped or clamped, offsets snap inward to
UTF-8 codepoint boundaries (no U+FFFD from mid-emoji ranges), block ranges
extend to line boundaries, quote-in-quote containment is dropped while
cross-type containment (codeBlock inside blockquote) nests, and the
backend's schema caps (200 facets / 20 features) are enforced client-side
against uncapped federated data.

Changes:
- facets.ts: buildRichText() tree builder with layered inline resolution
(spoiler > link/mention > marks), typed render tree whose nesting rules
are enforced structurally (LinkSpan children exclude links, blockquote
children exclude blockquotes), http(s)-only link hrefs, isValidDID-gated
mention routes to /u/<did> and /c/<did>
- RichText.svelte: snippet-based renderer matching the markdown renderers'
styling; text-bearing elements stay single-line so pre-wrap paragraphs
never show formatter whitespace
- RichTextSpoiler.svelte: blur-until-clicked reveal; concealed content is
inert (hidden links unclickable/unfocusable), plain span once revealed
- RichTextCodeBlock.svelte: language label + copy button with awaited
clipboard write and failure toast
- Comment.svelte / PostBody.svelte / Post.svelte: switch to RichText when
record.facets is non-empty; comment edits drop facets when content
changed (stale byte offsets silently corrupt annotations; the backend
only rejects out-of-bounds ones) and mirror the sent value locally
- facets.test.ts: 55 behavioral cases covering the malformed-input matrix,
UTF-8 offsets, mid-codepoint snapping, overlap splitting, block
containment rules, hostile-input caps, and a bridged-Lemmy conformance
fixture asserting full text preservation

Reviewed via multi-model second opinion (6 specialty agents + GPT-5.6 +
Kimi K3); all Critical/Important findings fixed and re-verified end-to-end
against the live dev stack.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Review agents persist local scratch state under .claude/agent-memory/;
keep it out of the repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The "N more" button under truncated comment trees used
stats.replyCount, which the backend defines as *direct* children only
(COUNT WHERE parent_uri = X). In a deep linear chain the node at the
inline-depth cutoff has one direct reply, so a thread with many more
descendants below showed "1 more" — technically accurate but
misleading. Showing a true subtree total would require a new
descendant_count on the backend, so instead the label drops the number
entirely, which stays honest without any API change.

Changes:
- CommentTree.svelte: render $t('comment.more') without the count param
- en.json: "{{comments:number}} more" -> "Load more"
- Translate the count-free label in the 13 other locales carrying the
counted string (bg, de, es, fi, fr, he, ja, nl, pl, pt, ru, tr,
zh-Hans); no locale keeps a dangling {{comments:number}} placeholder

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Three small UI fixes to post rendering surfaced during dev QA:

Changes:
- PostMeta: the CommunityLink anchor is a direct grid child, so it
stretched to fill the entire header column and its hover/click
target extended far past the text. justify-self-start sizes it to
its content; long handles still ellipsize at the track edge.
- Post page: the Material card wrapped the post with padding="none",
leaving the avatar, embed, and action bar flush against the card
border. px-4 insets content horizontally (vertical inset already
comes from the article's py-5).
- UserLink: when a user has no displayName the primary text falls
back to the handle, and the instance suffix rendered it a second
time ("mari.dev@mari.dev"). The suffix now renders only when the
shown name differs from the handle.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Genericize the tracked QA runbook for public consumption: the dev
test-account credentials, backend checkout path, and dated per-section
status log now live in docs/QA_LOOP.local.md, which is gitignored via a
new *.local.md pattern. Also ignore .idea for JetBrains users.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The blocks list read the legacy Lemmy my_user shape (always undefined)
so it could never show a block, and unblock called the dead Lemmy
endpoint. Wire social.coves.actor.getBlockedUsers into the client,
hydrate each blocked DID's profile in parallel (degrading to a DID-only
row so unblock always stays reachable), and unblock via the Coves API
with in-place list removal. Also fix the block/unblock toasts referencing
nonexistent i18n keys. Verified end-to-end against the fixed backend:
block → indexed → listed → feed filtered → unblock → feed restored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>