Overnight automated review: 98 test-gated fixes (11 bug, 6 risk, 81 quality) - #111

Merged

holkexyz merged 107 commits into

feat/positioning-redesignfrom

overnight-review

May 29, 2026

Commits on May 28, 2026

docs(review): Phase 1 survey findings + CHANGES log

holkexyz
and
claude
committed
74e71aa
docs(changes): restructure CHANGES log to append-only with sentinel

holkexyz
and
claude
committed
ead9d67
fix(context): reject non-http attachment uris in resolveAttachment [bug-001]

holkexyz
and
claude
committed
07e945e
fix(metadata): point OG image to existing certs-hero asset [bug-002]

holkexyz
and
claude
committed
1fc73e3
fix(groups): preserve InvalidSwap discriminator on BFF writes [bug-003]

holkexyz
and
claude
committed
5383a38
fix(profile): await in-flight avatar/banner upload before save [bug-004]

holkexyz
and
claude
committed
d576305
fix(project): resolve location strongRef so it displays [bug-005]

holkexyz
and
claude
committed
fc61e7d
fix(groups): correct audit result pill class allowlist [bug-006]

holkexyz
and
claude
committed
4088805
fix(endorsements): show rejected awards in owner Received inbox [bug-007]

holkexyz
and
claude
committed
18dee15
fix(upload): surface blob upload errors and clear preview [bug-008]

holkexyz
and
claude
committed
a980cc2
fix(profile): self-preview banner pick in BannerUpload [bug-009]

holkexyz
and
claude
committed
b102c82
fix(home-feed): render location MapPin in feed card with period [bug-010]

holkexyz
and
claude
committed
d129b75
fix(use-user-activities): guard loadMore generation + dedup URIs [bug-011]

holkexyz
and
claude
committed
020ef46
fix(xrpc): redact secrets in echoed 4xx upstream messages [risk-001]

holkexyz
and
claude
committed
af20bdc
fix(groups/register): use logSafe on org-limit check failure [risk-002]

holkexyz
and
claude
committed
722bcf5
fix(groups): sanitize handle and validate email at register boundary [risk-004]

holkexyz
and
claude
committed
2d6e42f
fix(profile): reuse minted location rkey on save retry [risk-003]

holkexyz
and
claude
committed
416554d
fix(seo): disallow app-only routes in robots.ts [risk-006]

holkexyz
and
claude
committed
fc7b7fb
fix(project): route save-conflict re-read through authFetch [risk-008]

holkexyz
and
claude
committed
e423835
refactor(feed): delete dead UserFeed component [quality-001]

holkexyz
and
claude
committed
3299ced
docs(changes): log quality-002 BLOCKED [quality-002]

holkexyz
and
claude
committed
6492574

Commits on May 29, 2026

refactor(cert-context): paginate fetchAllCertContext via cursor [quality-003]

holkexyz
and
claude
committed
75895ea
refactor(profile): drop dead EndorseShortcut + inert overlay [quality-005]

holkexyz
and
claude
committed
05a13a2
refactor(workspace): drop dead fetchOrganizationDids exports [quality-011]

holkexyz
and
claude
committed
9dea289
refactor(feed): delete dead CertHeadlineByline component [quality-049]

holkexyz
and
claude
committed
15b8510
refactor(feed): delete dead LocationCard component [quality-050]

holkexyz
and
claude
committed
fafa782
docs(feed): correct FeedLayout JSDoc to real consumers [quality-051]

holkexyz
and
claude
committed
743d110
chore(ci): add ci.yml running lint/tsc/test on PRs [quality-009]

holkexyz
and
claude
committed
5b98701
chore(tsconfig): add tsconfig.test.json + typecheck:test [quality-010]

holkexyz
and
claude
committed
ed186b0
chore(config): pin Node version via engines and .nvmrc [quality-018]

holkexyz
and
claude
committed
73850c3
chore(scripts): add typecheck npm script [quality-019]

holkexyz
and
claude
committed
9fbb21c
chore(lint): drop no-op --ext flag from lint script [quality-020]

holkexyz
and
claude
committed
2ffe2a3
chore(lint): expand lint to eslint . with build-output ignores [quality-021]

holkexyz
and
claude
committed
a8f9c57
fix(scripts): unify audit dev-server port default to 3000 [quality-022]

holkexyz
and
claude
committed
0519f5b
chore(gitignore): anchor core pattern to /core [quality-023]

holkexyz
and
claude
committed
8c6b483
refactor(atproto): constrain saveWithSwap TDrafts to Partial<TSnapshot> [quality-025]

holkexyz
and
claude
committed
d43ed60
refactor(swap): share one array-guarded shallowEqual [quality-026]

holkexyz
and
claude
committed
376983e
fix(badges): sort missing createdAt def to end of canonical pick [quality-027]

holkexyz
and
claude
committed
dcd6756
refactor(atproto): location.ts uses shared strict parseAtUri [quality-028]

holkexyz
and
claude
committed
e762ab9
refactor(notifications): validate load-bearing edge fields [quality-029]

holkexyz
and
claude
committed
0954187
fix(atproto): validate resolveHandle alsoKnownAs is a handle [quality-030]

holkexyz
and
claude
committed
c219186
refactor(hooks): add module-level cache to useOrgProfile [quality-006]

holkexyz
and
claude
committed
fde4b18
docs(changes): log quality-037 SKIPPED [quality-037]

holkexyz
and
claude
committed
4529435
fix(home-feed): track INVALID_CURSOR recovery controller [quality-031]

holkexyz
and
claude
committed
0386675
fix(hooks): abort focus-revalidate fetches via ref'd controller [quality-032]

holkexyz
and
claude
committed
e45219b
docs(changes): log quality-033 BLOCKED [quality-033]

holkexyz
and
claude
committed
542fe29
refactor(hooks): read live lists in useEndorsementLists mutations [quality-034]

holkexyz
and
claude
committed
1abb7da
refactor(explore): tie loadMore fetch to generation signal [quality-035]

holkexyz
and
claude
committed
f5a19a8
fix(profile): revoke promoted avatar/banner blob URL after save [quality-036]

holkexyz
and
claude
committed
d25a3d3
fix(hooks): usePendingAwardsCount returns null when logged out [quality-038]

holkexyz
and
claude
committed
91f29bc
refactor(hooks): reset bottom-sheet viewport styles on cleanup [quality-039]

holkexyz
and
claude
committed
763d9d8
fix(hooks): clear bottom-sheet dismiss timeout on unmount [quality-040]

holkexyz
and
claude
committed
f726a82
fix(hooks): clear in-flight dedupe on useOrgMarker refresh [quality-041]

holkexyz
and
claude
committed
1a3933c
refactor(profile): extract shared PersonCard + name-cache hook [quality-012]

holkexyz
and
claude
committed
fe30617
fix(profile-lists): show fallback row when a project fails to load [quality-043]

holkexyz
and
claude
committed
87b36e5
refactor(profile): use useClickOutsideClose for endorsement dropdowns [quality-044]

holkexyz
and
claude
committed
9d8cdd5
docs(changes): log quality-045 BLOCKED [quality-045]

holkexyz
and
claude
committed
515a1c2
fix(profile): stable createdAt sort in endorsement lists [quality-046]

holkexyz
and
claude
committed
6ead1da
refactor(profile-lists): use row index for checkbox aria-label [quality-047]

holkexyz
and
claude
committed
52c6ee0
refactor(profile): keep optimistic endorse on list-append failure [quality-048]

holkexyz
and
claude
committed
8079ad2
test(sanitize): add unit tests for stripInvisible/sanitizeEmail/sanitizeHandle [quality-007]

holkexyz
and
claude
committed
4edb194
refactor(search-actors): route catch log through logSafe [quality-014]

holkexyz
and
claude
committed
f1ec9f8
refactor(notifications): drop response body from upstream error log [quality-015]

holkexyz
and
claude
committed
aaa4ef1
fix(xrpc): clamp upstream status to valid HTTP range [quality-016]

holkexyz
and
claude
committed
18c48fd
fix(indexer): enforce 32KB body cap in bytes not UTF-16 units [quality-017]

holkexyz
and
claude
committed
d573291
refactor(popover): use --z-popover token instead of z-[40] [quality-008]

holkexyz
and
claude
committed
9266ad8
refactor(onboarding): revoke step-profile preview object URLs [quality-013]

holkexyz
and
claude
committed
f66c4f1
fix(feed): reset imageFailed when ActivityCard imageUrl changes [quality-052]

holkexyz
and
claude
committed
f1d47db
refactor(feed): memoize ActivityCard to avoid loadMore re-renders [quality-055]

holkexyz
and
claude
committed
7e376fc
refactor(right-rail): key news images by thumb URL not index [quality-053]

holkexyz
and
claude
committed
38245a2
refactor(feed): make expanded locations map height viewport-relative [quality-054]

holkexyz
and
claude
committed
6fbdab9
fix(auth): match safeRedirect http: gate to module's !==production [quality-056-auth-redirect-1]

holkexyz
and
claude
committed
8a24feb
docs(auth): note swallowed deleteSession is not session fixation [quality-056-auth-session-fixation-1]

holkexyz
and
claude
committed
ea0a318
docs(csrf): document deliberate missing-Origin-AND-Referer reject [quality-056-auth-csrf-doc-1]

holkexyz
and
claude
committed
3479605
docs(agents): correct ALLOWED_WRITE_COLLECTIONS count to eleven [quality-056-api-trust-5]

holkexyz
and
claude
committed
ea16a22
refactor(utils): extract countGraphemes helper [quality-056-cert-5]

holkexyz
and
claude
committed
d4b05fb
refactor(project): extract own-certs quick-pick into useOwnCerts [quality-056-cert-6]

holkexyz
and
claude
committed
657dd36
docs(project): document activity-only meta reads in project-detail [quality-056-cert-7]

holkexyz
and
claude
committed
1aa685a
refactor(map): drop dead theme reactivity in base tiles [quality-056-map-3]

holkexyz
and
claude
committed
c3cb71e
refactor(geocode): delete dead forwardGeocode export [quality-056-map-4]

holkexyz
and
claude
committed
d684e3c
refactor(map): tokenize leaflet embed bg; justify JS hex [quality-056-map-5]

holkexyz
and
claude
committed
b4b151b
refactor(ui): tokenize ProviderRedirectOverlay z-index [quality-056-ui-primitives-2]

holkexyz
and
claude
committed
d913f1f
fix(ui): skeleton text variant aria-hidden + honor width [quality-056-ui-primitives-3]

holkexyz
and
claude
committed
bd27181
fix(ui): hide icon child while loading + default button type [quality-056-ui-primitives-4]

holkexyz
and
claude
committed
576b2b9
refactor(explore): delete dead ?attrs= filter never set by any UI [quality-056-explore-1]

holkexyz
and
claude
committed
ea35ea2
fix(explore): add aria-haspopup to sort + quality popover triggers [quality-056-explore-3]

holkexyz
and
claude
committed
f685bf8
refactor(groups): use ConfirmDialog for Leave Group modal [quality-056-groups-3]

holkexyz
and
claude
committed
54321da
refactor(groups): delete dead AddOrgModal + MembershipSyncModal [quality-056-groups-4]

holkexyz
and
claude
committed
5c86eda
docs(changes): log quality-056-groups-5 SKIPPED [quality-056-groups-5]

holkexyz
and
claude
committed
672549c
fix(test): use renderHook in safe-redirect test to clear lint error [quality-056-auth-redirect-1]

holkexyz
and
claude
committed
34f6954
fix(groups): re-stage only failed members on partial add [quality-056-groups-6]

holkexyz
and
claude
committed
bcb4f20
docs(changes): log quality-056-profile-edit-2 SKIPPED [quality-056-profile-edit-2]

holkexyz
and
claude
committed
561caf9
test(profile): link edit-form inputs to error text via aria-describedby [quality-056-profile-edit-3]

holkexyz
and
claude
committed
e234749
refactor(profile): derive BannerUpload label from displayed image [quality-056-profile-edit-5]

holkexyz
and
claude
committed
b2c5c45
refactor(profile): tokenize avatar overlay colors [quality-056-profile-edit-4]

holkexyz
and
claude
committed
aaa0869
refactor(landing): delete dead orbiting-logos component [quality-056-landing-deadcode-1]

holkexyz
and
claude
committed
0d55605
refactor(legal): theme-aware link/text tokens for dark mode [quality-056-landing-darkmode-1]

holkexyz
and
claude
committed
abb79c6
refactor(global-error): radius 6px to 2px + token comment [quality-056-approot-global-error-tokens]

holkexyz
and
claude
committed
6adb271
docs(agents): sync §2 tech-stack versions with package.json [quality-056-approot-agents-dep-version-drift]

holkexyz
and
claude
committed
0ba95a2
refactor(groups): derive role allowlists from one ORG_ROLES source [quality-056-authz-repo-3]

holkexyz
and
claude
committed
9f75429
perf(groups/register): early-exit member walk on self-added hit [quality-056-authz-repo-4]

holkexyz
and
claude
committed
acd6447
refactor(notifications): use shared truncateDid + getInitials [quality-056-notif-row-1]

holkexyz
and
claude
committed
a2d25d9
refactor(labeller): drop dead exports pickKnownLabel/FilterValue/ALL_LABELS [quality-056-deadcode-4]

holkexyz
and
claude
committed
b5d5dd3
refactor(lib): drop dead exports getBlobRefLinkFromBlob/clearRecentlyViewed/ORG_PROFILE_COLLECTION [quality-056-deadcode-6]

holkexyz
and
claude
committed
74cd8ce
test(utils): cover did.ts isValidDid/isDid validators [quality-056-utils-tests-2]

holkexyz
and
claude
committed
ff0a189
test(utils): cover bounded-cache, format-date, ip, recently-viewed [quality-056-utils-tests-3]

holkexyz
and
claude
committed
317c2f6
docs(changes): finalize Phase 2 summary, held list, and follow-ups

holkexyz
and
claude
committed
abac1ee