docs: name the admin dashboard's domain terms in CONTEXT.md

Charting #114 introduced four terms the glossary did not carry: Orphan Series (#125), Lane Pass (#117), Forced Poll and Paused Lane (#119). Acquisition's entry is amended because a Forced Poll now replaces a Cover (#120), so establishing one is no longer unique to Acquisition.
Add a gitea skill; point AGENTS.md at it (#126 )
2026-08-19 10:06:09 +07:00 · 2026-08-17 17:52:16 +07:00 · 2026-08-17 13:43:49 +07:00 · 2026-08-17 12:06:14 +07:00 · 2026-08-17 11:43:15 +07:00 · 2026-08-16 22:04:18 +07:00
17 changed files with 923 additions and 58689 deletions
@@ -1,24 +1,5 @@
 {
  "hooks": {
-    "PreToolUse": [
+    "PreToolUse": []
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "CMD=$(python3 -c \"import json,sys; d=json.load(sys.stdin); print(d.get('tool_input',d).get('command',''))\" 2>/dev/null || true); case \"$CMD\" in *grep*|*rg\\ *|*ripgrep*|*find\\ *|*fd\\ *|*ack\\ *|*ag\\ *)   [ -f graphify-out/graph.json ] &&   echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"additionalContext\":\"MANDATORY: graphify-out/graph.json exists. You MUST run `graphify query \\\"<question>\\\"` before grepping raw files. Only grep after graphify has oriented you, or to modify/debug specific lines.\"}}'   || true ;; esac"
          }
        ]
      },
      {
        "matcher": "Read|Glob",
        "hooks": [
          {
            "type": "command",
            "command": "HIT=$(python3 -c \"import json,sys;d=json.load(sys.stdin);t=d.get('tool_input',d);exts=('.py','.js','.ts','.tsx','.jsx','.astro','.vue','.svelte','.go','.rs','.java','.rb','.c','.h','.cpp','.hpp','.cc','.cs','.kt','.swift','.php','.scala','.lua','.sh','.md','.rst','.txt','.mdx');vals=[str(t.get('file_path') or ''),str(t.get('pattern') or ''),str(t.get('path') or '')];j=' '.join(vals).lower().replace(chr(92),'/');tails=[('.'+x.rsplit('.',1)[-1]) for v in vals if v for x in [v.lower().replace(chr(92),'/').rsplit('/',1)[-1]] if '.' in x];sys.stdout.write('1' if 'graphify-out/' not in j and any(tl in exts for tl in tails) else '')\" 2>/dev/null || true); if [ \"$HIT\" = 1 ] && [ -f graphify-out/graph.json ]; then echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"additionalContext\":\"MANDATORY: graphify-out/graph.json exists. You MUST run graphify before reading source files. Use: `graphify query \\\"<question>\\\"` (scoped subgraph), `graphify explain \\\"<concept>\\\"`, or `graphify path \\\"<A>\\\" \\\"<B>\\\"`. Only read raw files after graphify has oriented you, or to modify/debug specific lines. This rule applies to subagents too \u2014 include it in every subagent prompt involving code exploration.\"}}'; fi || true"
          }
        ]
      }
    ]
  }
 }
@@ -0,0 +1,75 @@
 ---
 name: gitea
 description: Use for every forge operation in this repo — read, create, comment on, label, close, or search an issue; create, review, merge, or check out a PR; and whenever `gh`, `issue://`, or `pr://` fails or a ticket number is ambiguous. This repo's forge is self-hosted Gitea driven by `tea`, not GitHub.
 ---
 # Gitea, not GitHub
 `origin` is the self-hosted Gitea instance `gitea.violetcrown.my.id`, repo
 `sulthan/mangaBookmark`. Everything past plain git goes through
 [`tea`](https://gitea.com/gitea/tea) (0.14.2 on this machine).
 **`gh` is not installed**, so the harness's `issue://<n>` and `pr://<n>` URIs
 error out (`GitHub CLI (gh) is not installed`, measured 2026-08-17). There is no
 fallback to add — read tickets with `tea`.
 `tea` infers the repo from `origin`; auth lives in `tea login`, never a
 `GH_TOKEN`. Your Gitea username comes from `tea login list` — `tea` has no `@me`.
 Flags are the environment's job: run `tea <command> --help` rather than trusting
 a remembered flag. This file carries only what `--help` will not tell you.
 ## Commands
 | Job | Command |
 |---|---|
 | Read | `tea issue <n> --comments` / `tea pr <n> --comments` — `--comments` is not optional |
 | List | `tea issue list --state open\|closed\|all -o json --fields index,title,body,labels,state,author` |
 | Search | `tea issue list -k "<keyword>" -L "<label>" -A "<author>"` (`-K all` also searches PRs) |
 | Create | `tea issue create -t "..." -d "..."` (`-L`, `-a` optional) |
 | Comment | `tea comment <n> "..."` |
 | Label | `tea issue edit <n> --add-labels "..."` / `--remove-labels "..."` |
 | Close | `tea issue close <n>` / `tea pr close <n>` |
 | PR | `tea pr create --head <branch> --base main -t "..." -d "..."`, `tea pr checkout <n>`, `tea pr review <n>`, `tea pr merge <n>` |
 ## Traps
 - **A bare read is a truncated read.** Without `--comments`, `tea issue <n>` and
  `tea pr <n>` print the opening body and drop every comment silently — no
  prompt, no marker, no hint that more exists (measured 2026-08-17: issue #123
  prints 40 lines bare, 132 with `--comments`). The comments are where the
  decisions live and the body is usually the stalest part of the ticket, so
  **every read that exists to understand an issue or PR passes `--comments`**,
  and understanding means body plus all comments plus whatever ticket they point
  at. Comment count is `tea issue list --fields index,comments`, so a read that
  shows fewer than that is incomplete. A PR's review comments are a second
  stream: `tea pr review-comments <n>`.
 - **One index space for issues and PRs.** A bare `#42` may be either: try
  `tea pr 42`, fall back to `tea issue 42`. Say which one you found.
 - **Output is rendered boxes**, not plain text. Anything you parse needs
  `-o json`, plus `--fields` to keep the payload small. `tea pr create` prints
  the PR URL on its last line.
 - **`close` takes no `--comment`.** Comment with `tea comment <n>`, then close.
 - **Gitea will not auto-create a label.** `tea labels list` first; missing one
  gets `tea labels create --name "..." --color "#rrggbb"` before the `edit`.
 - **Multi-line bodies go through a heredoc**, never inline escapes:
  ```bash
  tea issue create -t "Title" -d "$(cat <<'EOF'
  body line one
  - acceptance criterion
  EOF
  )"
  ```
 - **No sub-issue and no dependency command.** Gitea's API has issue
  dependencies, `tea` does not expose them, so parentage and blocking live as
  body lines — the shapes are in `docs/agents/issue-tracker.md`.
 ## Conventions this repo layers on top
 Ticket bodies, wayfinding issues, and the PR-as-request-surface flag:
 `docs/agents/issue-tracker.md`. Triage label strings: `docs/agents/triage-labels.md`.
 A label named there still has to exist in the tracker before `--add-labels`.
 Finish a forge action by stating the number you touched and its state after —
 "commented and closed #71" — so the write is checkable without a second query.
@@ -11,8 +11,7 @@ to the tracker. You do not write the implementation — every line of ticket cod
 is written by a `ticket-implementer` subagent in its own git worktree. Reach for
 the editor yourself only for a merge conflict resolution.
-Ticket source and `tea` usage: `docs/agents/issue-tracker.md`. Codebase
+Ticket source and tracker conventions: `docs/agents/issue-tracker.md`. `tea` usage: skill `gitea`.
 questions: `graphify query "<question>"` before grepping.
 ## 1. Collect the tickets
@@ -5,11 +5,6 @@
 backend/server
 backend/backend
 .playwright-mcp/
 # graphify map is committed; only regenerable/local parts are ignored
 graphify-out/cost.json
 graphify-out/cache/
 graphify-out/[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]/
 graphify-out/.rebuild.lock
 plans/
 .scratch/
 docs/superpowers/
@@ -1,6 +1,6 @@
 # AGENTS.md
-Guidance for OpenCode (and Claude Code) working in this repo.
+Repo-wide guidance for coding agents.
 ## What this is
@@ -13,15 +13,18 @@ One backend, one `bookmarks` table: a `kind` column (`manga`|`novel`) splits the
 ## Hard constraints (drive design — don't violate)
 Nothing below is derivable from reading the code — it is why the code looks the
 way it does, plus dated measurements against services we don't control.
 Userscript targets **Violentmonkey**, so `GM_*` APIs available, but stay GM-free where plain web APIs suffice — keeps portability across engines:
 - **Avoid `GM_*` unless needed.** Prefer page `localStorage` over `GM_setValue`/`GM_getValue`, on-page UI over `GM_registerMenuCommand`, plain `fetch()` over `GM_xmlhttpRequest` for cross-origin.
 - Cross-origin `fetch()` work **only** against CORS-enabled backend. Manga sites `https://`, so backend **must be HTTPS** (else mixed-content block).
 - Every site is its **own origin with its own `localStorage`** — a shared remote store is the only way to unify bookmarks. Cloud sync required, not optional.
 - Userscript run in **isolated world**, so embedded API token safe from site's JS.
- Cloudflare's block on manga sites is **per-zone configuration plus request fingerprint, not IP reputation — and not reliably reproducible.** Verified 2026-07-26: plain `curl` from both CGNAT dev machine *and* deployed VPS got clean 200s with real HTML on both asurascans.com and demonicscans.org (homepage, series, chapter pages) — no interactive Turnstile challenge from either IP at test time. Contradicts earlier untested assumption CGNAT dev IP blocked; wasn't, at least this date. Treat "does curl work right now" as live, time-varying fact to re-check, not fixed property of machine — a Site can turn its protection on overnight, which is exactly what comix.to did on 2026-08-12. An earlier version of this line blamed "Cloudflare's bot scoring"; that was wrong. The 1-99 bot score is Enterprise Bot Management only and does not exist for a free-plan zone, and no per-IP request rate is documented as an input to challenge issuance — `docs/research/cloudflare-bot-scoring-and-poll-cadence.md`. Backend fetcher still needs graceful-degrade path for when challenged, and adapters should be **verified against live pages** (Playwright MCP, on-device devtools, direct probe) before finalizing, not assumed from single earlier test.
+- Cloudflare's block on manga sites is **per-zone configuration plus request fingerprint, not IP reputation — and not reliably reproducible.** Verified 2026-07-26: plain `curl` from both CGNAT dev machine *and* deployed VPS got clean 200s with real HTML on both asurascans.com and demonicscans.org (homepage, series, chapter pages) — no interactive Turnstile challenge from either IP at test time. Contradicts earlier untested assumption CGNAT dev IP blocked; wasn't, at least this date. Treat "does curl work right now" as live, time-varying fact to re-check, not fixed property of machine — a Site can turn its protection on overnight, which is exactly what comix.to did on 2026-08-12. An earlier version of this line blamed "Cloudflare's bot scoring"; that was wrong. The 1-99 bot score is Enterprise Bot Management only and does not exist for a free-plan zone, and no per-IP request rate is documented as an input to challenge issuance. Backend fetcher still needs graceful-degrade path for when challenged, and adapters should be **verified against live pages** (Playwright MCP, on-device devtools, direct probe) before finalizing, not assumed from single earlier test.
- **kagane.to, comix.to and novelfull.com are the exception to the above** — all three sit behind a Cloudflare JavaScript challenge no TLS fingerprint clears, so the backend polls them over CDP (`BROWSER_WS_URL`). When that's unset, kagane and comix are skipped entirely (a plain fetch would only retrieve a challenge page) while novelfull pages are still attempted over plain TLS — its challenge is a live time-varying fact and its cover bytes never need the browser. comix turned hostile on 2026-08-12 (#98): its cover host `static.comix.to` is gated too, so its cover bytes go through the browser as well, and its page is read as an in-tab `fetch()` of the series URL rather than a rendered DOM — comix is an SPA, and rendering costs ~65 requests for the same server-rendered HTML one fetch returns. The three other sites poll fine over plain TLS.
+- **kagane.to, comix.to and novelfull.com are the exception to the above** — all three sit behind a Cloudflare JavaScript challenge no TLS fingerprint clears, so the backend polls them over CDP (`BROWSER_WS_URL`). When that's unset, kagane and comix are skipped entirely (a plain fetch would only retrieve a challenge page) while novelfull pages are still attempted over plain TLS — its challenge is a live time-varying fact and its cover bytes never need the browser. comix turned hostile on 2026-08-12: its cover host `static.comix.to` is gated too, so its cover bytes go through the browser as well, and its page is read as an in-tab `fetch()` of the series URL rather than a rendered DOM — comix is an SPA, and rendering costs ~65 requests for the same server-rendered HTML one fetch returns. The three other sites poll fine over plain TLS.
 - **The CDP browser must look like a real browser, and stock headless images don't.** Measured 2026-08-08 against kagane.to, all from the same IP: `chromedp/headless-shell:stable` never cleared the challenge in 90s (`navigator.webdriver` true, empty plugin list, Chromium-branded client hints — suppressing `webdriver` alone changed nothing); `zenika/alpine-chrome` ships Chrome 124, refused outright; real Chrome with the default `--headless=new` UA never cleared, because the UA says `HeadlessChrome`; real Chrome with a stock UA **and** a non-UTC clock zone cleared in ~4s. Hence `chrome/` — a Debian image with `google-chrome-stable`, a version-derived UA, and `TZ`/`BROWSER_TZ`. Chrome reads the zone *name* through ICU from `/etc/localtime`'s symlink target, ignoring the file's contents, so mounting the host's `/etc/localtime` does **not** work; `/etc/timezone` is mounted instead.
- **The browser is not in the API stack and must not be put back.** It's its own compose unit (`chrome/docker-compose.yml`) on a second machine, reached over the tailnet — it held 471 MiB on a 1974 MiB swapless VPS, and a residential egress avoids the cloud-hosting-IP signature Bot Fight Mode documentedly challenges (ADR-0006; not a better "score" — free-plan zones have no score). Consequences that constrain code: `BROWSER_WS_URL` must be a tailnet **IP** (a MagicDNS name 500s at `/json/version`, same trap as the old Docker service name); the CDP port binds to the tailnet address only, since CDP authenticates nothing and that host has a real LAN; and the browser is on-demand (ADR-0005), so an unreachable or asleep one must degrade exactly as an unset `BROWSER_WS_URL` — plain-TLS libraries unaffected, kagane/comix logged and skipped, stored covers still served. Never add `chromedp.NoModifyURL`: discovery per fetch is what makes a restarted Chrome invisible.
+- **The browser is not in the API stack and must not be put back.** It's its own compose unit (`chrome/docker-compose.yml`) on a second machine, reached over the tailnet — it held 471 MiB on a 1974 MiB swapless VPS, and a residential egress avoids the cloud-hosting-IP signature Bot Fight Mode documentedly challenges (not a better "score" — free-plan zones have no score). Consequences that constrain code: `BROWSER_WS_URL` must be a tailnet **IP** (a MagicDNS name 500s at `/json/version`, same trap as the old Docker service name); the CDP port binds to the tailnet address only, since CDP authenticates nothing and that host has a real LAN; and the browser is on-demand, so an unreachable or asleep one must degrade exactly as an unset `BROWSER_WS_URL` — plain-TLS libraries unaffected, kagane/comix logged and skipped, stored covers still served. Never add `chromedp.NoModifyURL`: discovery per fetch is what makes a restarted Chrome invisible.
 - **UTC is the tell, not a country mismatch.** A UTC clock is the datacenter default, and the challenge refuses it; any real zone clears. Measured 2026-08-08, identical container, one Indonesian egress IP: UTC never cleared in 60s (twice), while `Asia/Jakarta` **and** `America/New_York` both cleared in 4s. An earlier note here claimed the zone had to match the egress IP's country — that was wrong, inferred from the host clock (`Asia/Bangkok`) rather than the measured egress. A second earlier claim, that Cloudflare "scores" a UTC clock, was also wrong: the measurement is real but the mechanism is not documented anywhere — Cloudflare publishes no timezone signal, and free-plan zones carry no score at all. `BROWSER_TZ` therefore needs a plausible zone, not a geolocated one.
 - **A challenged page needs the tab kept open.** The interstitial takes seconds to solve and only then writes clearance into the browser's shared cookie jar. Navigate-read-close never clears anything; `BrowserFetcher.run` holds one tab and re-reads until the payload arrives.
@@ -36,7 +39,7 @@ Two Violentmonkey userscripts (isolated world, per-site adapters, localStorage c
                                            on-demand Chrome, separate machine (chrome/)
 ```
-Two deployable units on two machines: the API stack (`docker-compose.yml` + `docker-compose.prod.yml`, on the VPS) and the browser (`chrome/docker-compose.yml`, on the home machine). They share nothing but `BROWSER_WS_URL` and update independently. Backend-specific architecture (packages, endpoints, poller, config env vars) lives in `backend/AGENTS.md`. Userscript-specific structure (adapters, retry queue, UI, live URL shapes) lives in `userscript/AGENTS.md`. Deploy order `DEPLOY.md` (§7 for the browser), redeploy `REDEPLOY.md` (§8 for the browser).
+Two deployable units on two machines: the API stack (`docker-compose.yml` + `docker-compose.prod.yml`, on the VPS) and the browser (`chrome/docker-compose.yml`, on the home machine). They share nothing but `BROWSER_WS_URL` and update independently. Backend-specific detail lives in `backend/AGENTS.md`, userscript-specific detail in `userscript/AGENTS.md`.
 ## Commands
@@ -64,28 +67,22 @@ Smoke test: `curl` endpoints with `Authorization: Bearer <token>`; confirm `OPTI
 ## Forge: Gitea, not GitHub
-`origin` is self-hosted Gitea instance (`gitea.violetcrown.my.id`), so **`gh` don't work here — use `tea` (Gitea CLI) for anything past plain git.** Common ones:
+`origin` is self-hosted Gitea (`gitea.violetcrown.my.id`, repo `sulthan/mangaBookmark`), so **`gh` don't work here and the `issue://`/`pr://` URIs error out — drive the forge with `tea`.** How to run it — commands, traps, JSON output: skill `gitea`. Tracker conventions (ticket bodies, wayfinding, PR-as-request-surface flag): `docs/agents/issue-tracker.md`. Triage label strings: `docs/agents/triage-labels.md`.
 - Open PR: `tea pr create --head <branch> --base main --title "..." --description "..."`
 - List / view / check out: `tea pr list`, `tea pr <n>`, `tea pr checkout <n>`
 - Issues: `tea issue create`, `tea issue list`
 - Auth lives in `tea login`, not `GH_TOKEN` env var.
 `tea` print output as rendered boxes rather than plain text; PR URL lands on last line.
 ## Design system
-Web UI + userscript panel follow **Cinder**, rules in `docs/design-system.md`
+Web UI + userscript panel follow **Cinder**. Tokens are the `:root` block in
-— source of truth Claude Design project `BookmarkManager Web UI`
+`backend/internal/web/static/style.css`; that file, `backend/internal/web/templates/*`,
-(`969ac210-fe02-4c01-ae1b-9a271dcc779a`). Read it before touching
+and the userscript `TEMPLATE`/`CSS` are the only places it is expressed.
-`backend/internal/web/static/style.css`, `backend/internal/web/templates/*`, or userscript
+Source of truth for the visual language is the Claude Design project
-`TEMPLATE`/`CSS`. Core law: **ember means new chapter only** — no other
+`BookmarkManager Web UI` (`969ac210-fe02-4c01-ae1b-9a271dcc779a`).
-state (busy, error, destruction) may use `--ember`; destruction gets
+
-`--danger`. No cards/corners/shadows, one `--measure: 760px` column, tokens
+Core law: **ember means new chapter only** — no other state (busy, error,
-only (never hardcode hex outside `:root`), both colour branches touched
+destruction) may use `--ember`; destruction gets `--danger`. No
-together. Any move that pulls series out of list (archive/finish/remove)
+cards/corners/shadows, one `--measure: 760px` column, tokens only (never
-must be confirm-gated via its own `.confirm-row`; only restore fires
+hardcode hex outside `:root`), both colour branches touched together. Any move
-instantly.
+that pulls a series out of the list (archive/finish/remove) must be
 confirm-gated via its own `.confirm-row`; only restore fires instantly.
 ## Security invariants
@@ -127,13 +124,19 @@ Review gate: auth, CORS, session, crypto, and the fetch gate are security-critic
 ## Comments
 Comment only if code alone can't carry info. Cost per read — must earn spot.
 Wrong comment worse than none: it misleads readers and measurably degrades
 LLM performance on the file. Missing comment costs little. Bias to fewer.
-Write for:
+Docstring on public/exported surface — exception, near-always worth it.
- Why not what. Tradeoffs, non-obvious decisions.
+Contract only: what it takes, returns, throws, mutates; units; pre/post
- Load-bearing detail looking incidental — say so if "simplify" breaks it.
+conditions. Not a restatement of the body. Skip on private/obvious.
 Inline — write for:
 - Why not what. Tradeoffs, non-obvious decisions, rejected alternatives.
 - heavy detail looking incidental — say so if "simplify" breaks it.
 - Non-local consequence, invisible from function alone.
- Wire format / encoding / interface contract — save callers re-deriving.
+- Wire format / encoding / ordering / invariant — save callers re-deriving.
- Gotcha/workaround, with ref if exists.
+- Gotcha/workaround, with ref (issue, RFC, vendor bug) if exists.
 - Domain/business rule not derivable from code.
 Skip:
@@ -142,34 +145,49 @@ Skip:
 - Banners, dividers, `// helpers`.
 - Change narration (`// fix bug`, `// as requested`, `// new impl`) — git's job.
 - Commented-out code — delete.
- TODO without concrete action.
+- TODO without concrete action + owner.
 - Narrating the plan you just reasoned through. Plan in prose or in your head;
 ship the code, not the transcript.
 - Anything restating a name that could be fixed by renaming instead.
-Style: one dense comment over function beats one per line inside. Tight, no worked example unless bug subtle. Wrong comment worse than none — update/delete on change. Default fewer — sparse+high-signal beats comprehensive.
+Staleness filter: if the comment describes something likely to change
 independently of this line, it will rot and start lying. Either anchor it to
 something stable, assert it in a test, or leave it out.
-Test: "competent reader get this from code in few sec?" Yes → skip. Needs detour through another file/spec/git-blame → write it.
+Style: one dense comment over a function beats one per line inside. Tight; no
 worked example unless the bug is subtle. On edit, update or delete stale
 comments in the code you touch — silence beats a lie.
-## Agent skills
+Test: "competent reader get this from code in a few sec?" Yes → skip.
 Needs detour through another file/spec/git-blame/external doc → write it.
-`AGENTS.md` is the single source of truth for agent guidance; every `CLAUDE.md` in this repo is a symlink to the `AGENTS.md` beside it. Edit `AGENTS.md`.
+## Writing an AGENTS.md
-### Issue tracker
+`AGENTS.md` is the single source of truth for agent guidance; every `CLAUDE.md`
 in this repo is a symlink to the `AGENTS.md` beside it. Edit `AGENTS.md`.
-Issues live as Gitea issues on `gitea.violetcrown.my.id` (`sulthan/mangaBookmark`), driven by the `tea` CLI — not `gh`. See `docs/agents/issue-tracker.md`.
+**Cite code, never docs, issues, or plans.** A spec, ADR, plan file, or Gitea
 issue records what was true when it was written and then goes stale silently;
 an agent that follows the pointer reads a decision that may already have been
 reversed. Code is the only source true at read time — cite a package, file,
 symbol, env var, or route. The sole non-code exception is a sibling
 `AGENTS.md`. If a doc holds a fact an agent needs, restate the fact here rather
 than linking to it.
-### Triage labels
+**State a fact in prose only if the code cannot answer it.** Split by
 derivability:
-Default five-role vocabulary, label strings unchanged (`needs-triage`, `needs-info`, `ready-for-agent`, `ready-for-human`, `wontfix`). See `docs/agents/triage-labels.md`.
+- *Structure* — packages, routes, env vars, columns, struct fields. Rots fast,
  cheap to re-read. **Name the symbol, write nothing else.**
 - *Mechanism* — what a function does, how a flow proceeds. **Name the symbol
  plus at most one line of orientation.**
 - *Rationale* — why it is this way, what a "simplify" would break, what was
  tried and rejected. Not in the code and cannot be re-derived. **Write it out.**
 - *Measurement* — an observation against something we don't control. **Write it
  out with the date**; a dated fact is honest, an undated one pretends to be
  permanent.
-### Domain docs
+Restating mechanism in prose is how these files rot: the code changes, the
-
+paragraph doesn't, and the next agent trusts the paragraph. A pointer degrades
-Single-context: one root `CONTEXT.md` plus `docs/adr/`, both created lazily. See `docs/agents/domain.md`.
+more honestly — and every symbol you name must actually exist, since a dead
-
+pointer is a bug, not a stale sentence.
 ## graphify
 Project has knowledge graph at graphify-out/ with god nodes, community structure, cross-file relationships.
 Rules:
 - For codebase questions and exploration, always first run `graphify query "<question>"` when graphify-out/graph.json exists. Use `graphify path "<A>" "<B>"` for relationships and `graphify explain "<concept>"` for focused concepts. Return scoped subgraph, usually much smaller than GRAPH_REPORT.md or raw grep output.
 - If graphify-out/wiki/index.md exists, use for broad navigation instead of raw source browsing.
 - Read graphify-out/GRAPH_REPORT.md only for broad architecture review or when query/path/explain don't surface enough context.
 - After modifying code, run `graphify update .` to keep graph current (AST-only, no API cost).
@@ -43,6 +43,13 @@ Readers: Progress, Favourite, Lifecycle bucket. Facts about the Series itself be
 to the Series, not here.
 _Avoid_: entry, item, record, subscription
 **Orphan Series**:
 A Series no Reader bookmarks. Removing a Bookmark never removes the Series, so the row
 outlives every relationship to it: nothing reads it, no Poll visits it, and it still owns
 a Cover. A state of the Series, not a Lifecycle bucket — it says how many Readers hold it,
 never anything about a Reader.
 _Avoid_: dangling, unused, dead series, stale
 **Library**:
 One of the two halves of the collection — manga or novel — selected by a Bookmark's
 `kind`. The web UI and the userscripts each address exactly one Library at a time.
@@ -76,6 +83,33 @@ asked. Every Site has exactly one and no Lane can slow, block or borrow from ano
 a Reader never has one and never influences one.
 _Avoid_: worker, queue, scheduler, batch, wave
 **Lane Pass**:
 One sweep of a Poll Lane over the Series due on its Site: what it found waiting, how many it
 read, and whether it declined to work at all. A fact about the Lane rather than about any
 Series — a pass that read nothing is still a pass, and one that declined carries the reason it
 declined, since a Lane resting and a Lane stuck look identical from a count alone. Its record
 outlives the process that made it: "the poller has done nothing for six hours" is only
 answerable by something written down.
 _Avoid_: run, cycle, tick, batch, poll history
 **Forced Poll**:
 A Poll the owner asks for by hand instead of waiting for the Series's turn. It jumps its
 Lane's queue and ignores every waiting rule — the rest between Polls, a Sighting standing
 in for a check, a Series only finished Readers hold — but never overrules a Site that is
 refusing us, the Lane's spacing between fetches, or a Series with no page to fetch. Asked
 for by marking the Series, never by commanding the poller, so it happens on the Lane's
 next pass rather than at the moment of asking.
 It also takes whatever Cover the Site publishes today: asking for one is asking to accept the
 page as it now stands, so it is the only read after Acquisition that can replace a Cover.
 _Avoid_: manual poll, refresh, retry, force refresh
 **Paused Lane**:
 A Poll Lane the owner has stopped for a bounded time. It makes no Polls until the pause
 expires, so its Series stay due and unstamped exactly as they do when a Site cannot be
 reached. Every pause carries an expiry — a Lane cannot be stopped indefinitely — and it
 outlives a restart, being a fact about the Site rather than about the running process.
 _Avoid_: disabled, off, stopped, suspended, kill switch (that is the deploy-time switch)
 **Sighting**:
 What a Reader's browser happened to see of a Series's Latest Chapter while that Reader
 was on the page. It reports the same fact as a Poll but carries none of its authority:
@@ -88,9 +122,9 @@ _Avoid_: client report, user poll, observation, claim
 The single read of a Series page made the moment the Series first exists, giving it
 both its Latest Chapter and its Cover without waiting for the Lane's pace. Distinct
 from a Poll in the two ways that matter: a Reader is present — it is triggered by
-their first Bookmark of that Series — and it is the only read that establishes a
+their first Bookmark of that Series — and it establishes a Cover rather than refreshing
-Cover rather than refreshing facts. It happens once in a Series's life; every later
+facts, which no Poll does unless the owner forces one. It happens once in a Series's
-read of the same page is a Poll.
+life; every later read of the same page is a Poll.
 _Avoid_: initial poll, first fetch, prefetch, warm-up
 **New Chapter**:
@@ -1,274 +1,268 @@
-Guidance for OpenCode (and Claude Code) working under `backend/`. See root `AGENTS.md` for the project-wide architecture diagram, hard constraints, and design system.
+Scope: `backend/`.
- **Backend** (`backend/`): stdlib `net/http` (handful routes, no framework) + Postgres over `jackc/pgx/v5` (pure Go, `CGO_ENABLED=0` -> static binary -> distroless/scratch image). Reverse proxy terminates TLS; Go service listens plain `:8080`.
+Each entry names the code that holds the truth — read that for *what it does*.
-  Single binary, split into packages under `backend/internal/`: `store`
+The prose here is only what code cannot tell you: rationale, rejected
-  (Bookmark type, Postgres persistence, migration runner), `latest` (background
+alternatives, dated measurements, and invariants a plausible refactor would
-  poller, site parsers, TLS fetcher), `session` (cookie signing, login
+silently break.
-  rate limiter), `httpmw` (Auth/Gzip/CORS middleware), `api` (JSON
+
-  bookmark handlers), `userscript` (userscript-serving handler), `web`
+### Layout
-  (browser UI handler + `templates/` + `static/`, `go:embed`-ed).
+
-  `backend/main.go` is the composition root — the only place that wires
+`backend/main.go` → `newRouter` is the composition root, the only place
-  packages together into `newRouter`. Root-level `*_test.go` hold
+packages are wired. Packages under `backend/internal/`: `store`, `latest`,
-  integration tests that exercise the full router; unit tests for a
+`session`, `httpmw`, `api`, `userscript`, `web`, `token`, `pgtest`. Root-level
-  package live beside it under `internal/`.
+`*_test.go` exercise the full router; unit tests live beside their package.
- **Schema is migration-owned.** `internal/store/migrations/*.sql` is
+
-  `go:embed`-ed and applied on every start by `store.migrate`: one numbered
+Not visible from any single file: stdlib `net/http` with no framework,
-  file per change, one transaction each, versions recorded in
+Postgres over `jackc/pgx/v5`, `CGO_ENABLED=0` static binary into a distroless
-  `schema_migrations`. Files are **append-only** — editing an applied one
+image, TLS terminated by the reverse proxy so the service listens plain `:8080`.
-  changes nothing on a database that already ran it. No column probing, no
+
-  data-fixup migrations: both were SQLite-era machinery and are gone.
+### Schema — `internal/store/migrations/*.sql`, run by `store.migrate`
- **Tests need Docker.** `internal/pgtest` starts one `postgres:17-alpine`
+
-  container per test binary (`TestMain` -> `pgtest.Main`) and hands each test
+- Migration files are **append-only**. Editing an applied one changes nothing
-  its own database (`pgtest.URL(t)`). A package whose tests touch the store
+  on a database that already recorded its version in `schema_migrations`, so
-  must have that `TestMain`.
+  the fix silently applies to new deployments only.
- **Reader-owned store, four tables.** `readers` is keyed by Discord user ID
+- No column probing, no data-fixup migrations. Both were SQLite-era machinery
-  and carries the SHA-256 of the Reader's userscript credential plus a
+  and were removed deliberately — don't reintroduce either.
-  `token_epoch` (issue #24). Credentials are derived, never stored: `token.Token(TOKEN_KEY, discord_id, epoch)` (HMAC, `internal/token`), and only its SHA-256 sits in `readers.token_sha256`, so install URLs can be rebuilt after any restart while a database leak yields nothing but hashes. The seed creates the **owner** row at startup; its epoch-0 hash is refreshed on every start **only while the row has never been rotated**, so a restart can never resurrect a rotated-away credential. Every other row is created by that Reader's own first login (`Store.EnsureReader`, idempotent on `discord_id`, and it never rewrites an existing row's hash). Rotation is `Store.RotateToken` (epoch bump + hash rewrite in one transaction), driven by the web UI.
+
-  `series` keyed `(site, series_id)`
+### Tests need Docker — `internal/pgtest`
-  (`asura`|`demonic`|`comix`|`kagane`|`novelfull`|`lightnovelworld`) owns the
+
-  shared facts — title, cover, canonical URL, `kind` (`manga`|`novel`),
+`pgtest.Main` from `TestMain` starts one `postgres:17-alpine` per test binary;
-  Latest Chapter, `latest_checked_at`, and the Sighting pair
+`pgtest.URL` hands each test its own database. A package whose tests touch the
-  `latest_sighted_at`/`latest_raised_by` (issue #103) — and `bookmarks` holds only what
+store must have that `TestMain` or it has no database at all.
-  differs between readers: progress, favourite, lifecycle bucket,
+
-  `updated_at`. A bookmark is keyed `(reader_id, site, series_id)` — no
+### Reader-owned store — `internal/store`, `internal/token`
-  surrogate id; the wire `key` is derived as `site:series_id` on read — and
+
-  every store read/write is scoped to the reader it names. Auth resolves the
+Four tables; shape is in the migrations, behaviour in `Store`'s methods.
-  acting Reader from the presented credential (`httpmw.Auth`) and nothing
+
-  else — there is no unauthenticated-by-Reader route and no global token; the
+- **Credentials are derived, never stored.** `token.Token(TOKEN_KEY, discord_id, epoch)`
-  reader id travels in the request context. Sync **last-write-wins**; the wire format
+  is an HMAC; only its SHA-256 reaches `readers.token_sha256`. So install URLs
-  stays flat (ADR-0004). `Store.Upsert` decomposes one flat body across two
+  can be rebuilt after any restart, and a database leak yields nothing usable.
-  tables and enforces the ownership rule: client `title`/`series_url`/`cover`
+- **The owner's epoch-0 hash is refreshed at startup only while the row has
-  are written only when the series row is new (ADR-0003).
+  never been rotated.** Drop that condition and a restart resurrects a
- **Endpoints:** `GET /bookmarks`, `PUT /bookmarks/{key}` (upsert; see `updated_at` rule below), `DELETE /bookmarks/{key}`, `GET /healthz` (no auth).
+  rotated-away credential.
- **Web UI:** same binary serve the browser UI on a second
+- `Store.EnsureReader` never rewrites an existing row's hash — a returning
-  hostname — `GET /` (list, or login page when no session),
+  Reader's login must not invalidate their installed scripts.
-  `GET /auth/discord` + `GET /auth/discord/callback` (Discord OAuth,
+- **Every read and write is scoped to the acting Reader**, resolved from the
-  ADR-0002), `POST /logout`, `GET /static/*`, htmx fragment endpoints
+  presented credential by `httpmw.Auth` and carried in the request context.
-  under `/ui/*`. Templates + assets `go:embed`-ed under
+  There is no unauthenticated-by-Reader route and no global token.
-  `backend/internal/web/`, so `backend/Dockerfile` must copy the whole
+- **`series` holds what readers share, `bookmarks` only what differs.** A
-  `internal/` tree, not just `*.go`. Sessions are rows in the `sessions`
+  bookmark key is `(reader_id, site, series_id)` with no surrogate id; the wire
-  table: the cookie carries only an opaque id, looked up (and expiry-
+  `key` is derived as `site:series_id` on read.
-  checked) on every request, and deleting the row revokes the session.
+- `Store.Upsert` splits one flat body across both tables and enforces the
-  Guild membership *is* registration (issue #27): `discordCallback` gates on
+  ownership rule: client `title`/`series_url`/`cover` are written **only when
-  membership (and `DISCORD_REQUIRED_ROLE` when set) and then calls
+  the series row is new**, so one reader cannot retitle a shared series.
-  `Store.EnsureReader`, so a refusal creates nothing and a returning Reader
+- Sync is last-write-wins and the wire format stays flat — clients depend on
-  reuses their row. The owner is the only Reader with administrative reach:
+  both; neither is an implementation detail to tidy up.
-  `POST /readers/{id}/revoke` (404 for anyone else) drops that Reader's
+
-  sessions, and the `readers` panel renders only on the owner's page.
+### Web UI — `internal/web`
-  A Reader with no bookmarks at all sees `listView.Fresh`, whose empty state
+
-  offers both install links instead of describing a filter.
+Routes, templates and assets are all in that package; `AdminPatterns()` and
-  UI mutations read-modify-write
+`adminRoutes()` enumerate the privileged ones.
-  through `Store.Get` + `Store.Upsert` so `updated_at` rule stays one
+
-  place. See `docs/superpowers/specs/2026-07-25-web-ui-design.md`.
+- **`backend/Dockerfile` must copy the whole `internal/` tree**, not just
-  **Design-tool caveat:** templates link `/static/style.css` root-absolutely
+  `*.go`: templates and static assets are `go:embed`-ed from
-  (correct — served from `/`), but impeccable detector resolves
+  `internal/web/`.
-  stylesheet href with `path.resolve(fileDir, href)`, drops directory
+- **Guild membership *is* registration.** `discordCallback` gates on membership
-  on leading `/` and silently skip file. Relative href don't help
+  (plus `DISCORD_REQUIRED_ROLE` when set) and only then calls
-  either: template's directory isn't its served path. So
+  `Store.EnsureReader`, so a refusal creates nothing.
-  `detect.mjs backend/internal/web/templates` reports **false clean** —
+- Sessions are rows, not signatures: the cookie carries an opaque id and
-  always pass `backend/internal/web/static` too. One finding there,
+  expiry is checked on lookup, which is what makes deleting the row an instant
-  `overused-font` on "Instrument Serif", deliberate identity choice, not debt.
+  revocation.
- **Every action that moves series out of list is confirm-gated.**
+- UI mutations go through `Store.Get` + `Store.Upsert` so the `updated_at` rule
-  Archive, finish, remove each open own `.confirm-row` disclosure
+  below stays in exactly one place.
-  (`toggleConfirmRow(key, kind)` in `filter.js`, `kind` ∈
+- `listView.Fresh` exists because a Reader with no bookmarks at all needs
-  `archive|finish|remove`); restore fire instantly since it's the reversal.
+  install links, not an empty-filter message.
-  Remove's row wear ember wash, two reversible ones wear `.calm` grey.
+- **Design-tool caveat:** `detect.mjs backend/internal/web/templates` reports a
-  `--ember` stay reserved for new-chapter signal: busy bar and inline
+  **false clean**. Templates link `/static/style.css` root-absolutely (correct —
-  error use `--mute`.
+  it is served from `/`), but the detector resolves hrefs with
- **Latest-chapter poller:** one goroutine per Site (a Poll Lane, issue #100),
+  `path.resolve(fileDir, href)`, which drops the directory on a leading `/` and
-  each re-checking that Site's bookmarked series' newest published chapter from
+  skips the file silently; a relative href doesn't help either, since a
-  backend's own network access, so `latest_chapter` stays fresh when the user
+  template's directory isn't its served path. Always pass
-  isn't browsing. Second, parallel signal — the userscript keeps its own
+  `backend/internal/web/static` too. The one finding there, `overused-font` on
-  `maybeCaptureLatestOnSeriesPage`/`backgroundRefreshLatest` schedule, and its
+  "Instrument Serif", is a deliberate identity choice, not debt.
-  `reportLatestChapter` PUTs every read, unchanged numbers included, because an
+
-  unchanged read is exactly the Sighting worth deferring a Poll on (#103).
+### Confirm gating — `internal/web/static/filter.js`, `toggleConfirmRow(key, kind)`
-  Two independent clocks: per-series rest (`series.latest_checked_at`,
+
-  enforced by `Store.DueForLatestCheck`'s WHERE clause — `now - Rest`) and
+Every action that pulls a series out of the list (`archive|finish|remove`) opens
-  per-Lane gap (the Lane sleeping between fetches, `effectiveGap`). Both live
+its own `.confirm-row`; restore fires instantly because it is the reversal.
-  in the Site registry (`internal/latest/sites.go`), not config: the five env
+Remove wears the ember wash, the two reversible ones wear `.calm` grey.
-  knobs that used to size a shared pace are gone.
+**`--ember` is reserved for the new-chapter signal** — the busy bar and inline
-  The poller walks **Series, not Bookmarks** — a series referenced by several
+errors must use `--mute`, or the one colour that means "something to read"
-  bookmarks is fetched once per cycle, and the due queue orders
+stops meaning it.
-  `reader_count DESC, latest_checked_at ASC` (ADR-0003). Series row stamped
+
-  *before* fetch so broken series wait out the rest instead of retrying
+### Latest-chapter poller — `internal/latest`, Site registry in `sites.go`
-  every tick; found chapter written straight to the series row via
+
-  `Store.SetLatestChapter`, so a bookmark's `updated_at` — and the list
+One goroutine per Site (a Poll Lane) re-checks that Site's bookmarked series
-  order — is never touched.
+from the backend's own network position, so `latest_chapter` stays fresh while
-  **Sightings** (issue #103, ADR-0011) let a Reader's own page read defer a
+nobody is browsing. The userscript's `reportLatestChapter` is a second,
-  Poll: `Store.RecordSighting` — called by the PUT handler *before* the Upsert,
+parallel signal — it PUTs every read, unchanged numbers included, because an
-  because the raise test needs the row as it stands — stamps
+unchanged read is exactly the Sighting worth deferring a Poll on.
-  `series.latest_sighted_at` and, when the report raises the stored number,
+
-  names its Reader in `series.latest_raised_by`. The due query's HAVING clause
+- **Pace lives in the Site registry, not config.** Two clocks: per-series rest
-  is where deferral lives: a Series is skipped only while it has exactly one
+  (`series.latest_checked_at`, enforced in `Store.DueForLatestCheck`'s WHERE)
-  Bookmark, was sighted within one Rest, and is under the ceiling
+  and per-Lane gap (`effectiveGap`). The five env knobs that used to size one
-  (`sightingCeilingRests`, six of that Site's rests) since its last Poll. So a
+  shared pace are gone; don't add them back.
-  shared Series is never deferred, and no Series goes six hours unpolled
+- **The poller walks Series, not Bookmarks** — a series several readers hold is
-  whatever arrives. `checkOne` judges the named Reader off the comparison it
+  fetched once per cycle, and the due queue orders `reader_count DESC,
-  already makes: a lower number is a contradiction (logged with the Reader and
+  latest_checked_at ASC` so the widely-read ones win contention.
-  both numbers), the same number an agreement, a higher number the Site
+- **The series row is stamped *before* the fetch**, so a permanently broken
-  publishing and neither — that last one clears the attribution instead, since
+  series waits out its rest instead of being retried every tick.
-  the value the Poll then stores is its own and a later retraction is not the
+- `Store.SetLatestChapter` is a single-column UPDATE, deliberately not a
-  Reader's fault. Three contradictions
+  read-modify-write of the bookmark: it therefore cannot revert read progress
-  (`store.SightingDisagreementLimit`) stop that Reader deferring — their
+  or move `updated_at`. The old stale-re-read race died with the Get+Upsert
-  reports still write the Latest Chapter — and twenty consecutive agreements
+  flow — don't restore one here.
-  (`store.SightingAgreementsToClear`) forgive them, as does the owner's
+
-  clear-marks control. Deferral is recomputed from live facts every round, so
+**Sightings** (`Store.RecordSighting`, the due query's HAVING clause,
-  nothing needs invalidating when a Series gains a second Bookmark; the one
+`latest.checkOne`) let a Reader's own page read defer a Poll.
-  input read earlier is the Reader's marks, checked when the Sighting is
+
-  recorded, so crossing the threshold or being cleared takes effect from that
+- Recorded by the PUT handler **before** the Upsert, because the raise test
-  Reader's next Sighting and the standing already bought lasts out its rest.
+  needs the row as it stands.
-  Refusals and browser loss are Lane-local: two `errChallengeHeld` in one pass
+- A Series is deferred only while it has exactly one Bookmark, was sighted
-  stop that Site for `refuseBackoff` (15m) while other Lanes continue; an
+  within one Rest, and is under `sightingCeilingRests` since its last Poll — so
-  `errBrowserInterrupted` (remote Chrome restart) sets a shared Poller flag
+  a shared Series is never deferred and nothing goes six hours unpolled
-  that makes the other browser Lanes skip their passes for the same 15m, so a
+  whatever arrives.
-  restarting Chrome doesn't stamp one Series per Lane per pass — after the
+- A *higher* report clears the attribution rather than crediting it: the value
-  window the flag decays and they probe again. Browser Lanes wake Chrome only
+  the Poll then stores is its own, so a later retraction isn't the Reader's
-  when 5+ Series are due or one has waited 15m (ADR-0005 on-demand browser),
+  fault.
-  and cover work (both healing a stored source URL and filling a blank from
+- `store.SightingDisagreementLimit` contradictions stop a Reader deferring —
-  the series page) runs in the background so a slow CDN can't consume a
+  their reports still write the Latest Chapter — and
-  Lane's gap.
+  `store.SightingAgreementsToClear` agreements forgive them, as does the
-  A refusal is only ever the challenge *page*: `isInterstitial` matches the
+  owner's clear-marks control.
-  orchestration path `/cdn-cgi/challenge-platform/h/`, never the bare prefix.
+- Deferral is recomputed from live facts each round, so nothing needs
-  Cloudflare injects `/cdn-cgi/challenge-platform/scripts/jsd/main.js` into
+  invalidating when a Series gains a second Bookmark. The one input read
-  ordinary 200 pages once a zone turns JS detections on, which demonic did on
+  earlier is the Reader's marks, so crossing or clearing a threshold takes
-  2026-08-16 — the prefix match then read every real demonic page as a refusal
+  effect from their next Sighting and the standing already bought lasts out its
-  and parked that Lane in 15m backoff while plain TLS was returning the full
+  rest.
-  series page.
+
-  Fetches use `bogdanfinn/tls-client` with Chrome profile as defence in depth
+**Refusals and browser loss are Lane-local.** Two `errChallengeHeld` in a pass
-  against fingerprint-based blocking; any failure log and skip. kagane, comix
+stop that Site for `refuseBackoff` while other Lanes continue. An
-  and novelfull sit behind Cloudflare JavaScript challenges the TLS client
+`errBrowserInterrupted` (remote Chrome restarted) sets a shared Poller flag so
-  can't clear, so they are fetched over CDP via `BROWSER_WS_URL`; kagane and
+the *other* browser Lanes skip their passes for the same window — otherwise a
-  comix are simply not polled when that's unset, while novelfull falls back to
+restarting Chrome stamps one Series per Lane per pass, burning rests on
-  a plain-TLS attempt — its challenge is a live time-varying fact, and its
+failures. The flag decays and they probe again.
-  cover bytes never need the browser. comix's browser read is an in-tab
+
-  `fetch()` of the Series URL, not a DOM render: it is an SPA, so rendering
+- **`isInterstitial` matches the orchestration path
-  costs ~65 requests for the same server-rendered HTML one fetch returns
+  `/cdn-cgi/challenge-platform/h/`, never the bare prefix.** Cloudflare injects
-  (measured 2026-08-12, issue #98). See
+  `/cdn-cgi/challenge-platform/scripts/jsd/main.js` into ordinary 200 pages
-  `docs/superpowers/specs/2026-07-26-server-latest-chapter-polling-design.md`.
+  once a zone turns JS detections on, which demonic did on 2026-08-16: the
-  The poller's series write is a single-column UPDATE
+  prefix match read every real demonic page as a refusal and parked the Lane in
-  (`Store.SetLatestChapter`), not a read-modify-write of the whole bookmark:
+  backoff while plain TLS was returning full series pages.
-  it cannot revert read progress or move `updated_at`, so the old
+- Fetches use `bogdanfinn/tls-client` with a Chrome profile as defence in depth
-  stale-re-read race is gone with the Get+Upsert flow.
+  against fingerprint blocking; any failure logs and skips.
- **Covers are acquired at creation, then served from our own origin
+- kagane, comix and novelfull sit behind Cloudflare JS challenges the TLS
-  (ADR-0007):** the first Bookmark of a Series fires `Store.OnSeriesCreated`,
+  client can't clear, so they go over CDP (`BROWSER_WS_URL`). kagane and comix
-  which `latest.Acquirer` turns into one series-page fetch yielding both the
+  are simply not polled when it's unset — a plain fetch would only retrieve a
-  Latest Chapter and the cover URL; the bytes then go through
+  challenge page — while novelfull still attempts plain TLS, because its
-  `latest.CoverBytesFetcher` into `Store.SetSeriesCover`. It runs in a
+  challenge is a live time-varying fact and its cover bytes never need a browser.
-  goroutine — the Reader's PUT must neither block on a Site nor fail with one
+- **comix's browser read is an in-tab `fetch()` of the Series URL, not a DOM
-  — and every failure is logged and dropped, leaving the Bookmark intact. The
+  render.** It is an SPA: rendering cost ~65 requests for the same
-  wire's `cover` is the absolute `PUBLIC_BASE_URL + /covers/{sha256}` once
+  server-rendered HTML one fetch returns (measured 2026-08-12).
-  bytes exist and `""` before, never an address that 404s. `GET /covers/{addr}`
+- Browser Lanes wake Chrome only when 5+ Series are due or one has waited 15m,
-  is public and uncredentialed: the userscript renders it on a Site's origin,
+  and cover work runs in the background so a slow CDN can't eat a Lane's gap.
-  where no cookie or token of ours travels. A client-sent `cover` is decoded
+
-  and discarded, permanently (ADR-0004 compatibility).
+### Covers — `Store.OnSeriesCreated`, `latest.Acquirer`, `latest.CoverBytesFetcher`, `Store.SetSeriesCover`
-  Browser-backed Sites join the same pipeline (issue #62, extended to comix by
+
-  #98): kagane and comix pages *and* cover bytes go through the browser sidecar
+Acquired once when the first Bookmark of a Series is created, then served from
-  (nothing falls back to a plain fetch, which would only retrieve a challenge
+our own origin by the public `GET /covers/{addr}`.
-  page), while novelfull needs the browser only for its HTML — the cover URL
+
-  comes out of the browser-fetched page and the bytes go over plain TLS. With
+- Acquisition runs in a goroutine: the Reader's PUT must neither block on a
-  no browser configured, kagane and comix Covers are simply absent; novelfull
+  Site nor fail with one. Every failure is logged and dropped, leaving the
-  still gets one — at creation and on the poll — when its page body happens to
+  Bookmark intact.
-  answer a plain request (the challenge is a live time-varying fact). comix
+- The wire `cover` is the absolute `PUBLIC_BASE_URL + /covers/{sha256}` once
-  cover bytes must arrive by direct navigation, not an in-page fetch: its
+  bytes exist and `""` before — **never an address that 404s**. Absolute
-  Series page sets `cross-origin-embedder-policy: require-corp`, which fails a
+  because the userscript renders it on a Site's origin.
-  page-context fetch of `static.comix.to`. The old kagane-only
+- `GET /covers/{addr}` is public and uncredentialed by design: no cookie or
-  serving path (`/img/kagane/{id}`, template rewrite, `CoverFetcher`) is gone
+  token of ours may travel to a Site's origin.
-  (issue #63): the one public route serves every Site.
+- A client-sent `cover` is decoded and discarded, permanently — wire
- **`updated_at` drives list order, so moves only on real reading progress:** server apply its timestamp when row new or `last_chapter_num` changes, else keep stored value — favouriting series or recording newly published chapter must not reorder list. `PUT` therefore returns row **as stored**, clients must adopt that response rather than own payload. See `plans/2026-07-25-bookmark-list-favorites-design.md` §4.
+  compatibility, not an oversight.
- **Lifecycle buckets:** `status` on each bookmark is `reading` | `archived` |
+- **One route serves all six Sites.** No proxy, no per-Site rewrite, no second
-  `finished`, orthogonal to `favorite`. Archived and finished appear only in
+  place that decides a renderable address: the wire `cover` is it. Templates
-  own tab — not in All, Updated, Favourites, or recent strip. Poller keeps
+  render `.Cover` and nothing else. The old kagane-only serving path
-  checking archived series and skip finished ones. `finished` settable
+  (`/img/kagane/{id}` plus a template rewrite) is gone; don't reintroduce a
-  only from web UI; `PUT /bookmarks/{key}` reject it with 400.
+  per-Site route because one Site's CDN misbehaves.
-  **Empty incoming status means "keep stored one"** — resolved on the
+- The only Site names left in cover code are in `browserOnlyCoverURL`
-  `VALUES` side of `Store.Upsert`, not conflict clause, since
+  (`internal/latest`): kagane answers a plain fetch with a challenge *and*
  `excluded.*` is post-evaluation row and default applied there would
  wipe bucket on every PUT from client that predates column. See
  `docs/superpowers/specs/2026-07-27-status-buckets-design.md`.
 - **Config via env:** `TOKEN_KEY` (derives every Reader's userscript credential;
  required), `OWNER_DISCORD_ID` (seeds the owner Reader — the administrator and
  the owner of every pre-registration bookmark; required),
  `ALLOWED_ORIGINS` (comma list),
  `DATABASE_URL` (Postgres connection URL, required — no default),
  `COVER_DIR` (required filesystem volume for content-addressed Cover bytes),
  `PUBLIC_BASE_URL` (required origin this deployment answers on, trailing
  slash trimmed; every Cover URL on the wire is built from it, absolute
  because the userscript renders on a Site's origin — ADR-0007),
  `PORT` (default `8080`), `DISCORD_CLIENT_ID`/`_CLIENT_SECRET`/`_GUILD_ID`/
  `_REDIRECT_URI` (required; Discord OAuth for the browser UI),
  `DISCORD_REQUIRED_ROLE` (optional role gate, empty by default),
  `DISCORD_API_BASE` (default `https://discord.com/api/v10`),
  `LATEST_CHAPTER_POLL_ENABLED` (background latest-chapter poller kill
  switch, default on). Pace is per Site in the registry (issue #100): every
  Site rests an hour and gaps ten seconds, a Site with more eligible Series
  than 360 tightens its own gap toward the 1s floor, and browser Lanes wake
  Chrome only on demand (ADR-0005). The `_COOLDOWN`/`_BROWSER_COOLDOWN`/
  `_INTERVAL`/`_BATCH`/`_STAGGER` knobs that used to size a shared pace are
  gone. The 1h rest for browser Sites is safe on documented grounds: a
  challenged page costs seconds of a serialized single-tab browser, free-plan
  zones have no bot score and no published per-IP rate input, and
  `cf_clearance` expires in 30 minutes so every cadence at or above 1h
  re-solves anyway —
  `docs/research/cloudflare-bot-scoring-and-poll-cadence.md`.
  `USERSCRIPT_PATH` and `NOVEL_USERSCRIPT_PATH` (files served at
  `/u/{token}/manga-bookmark.user.js` and `/u/{token}/novel-bookmark.user.js`,
  defaults `/userscript/manga-bookmark.user.js` and
  `/userscript/novel-bookmark.user.js`, both supplied by bindmount; the
  `__API_TOKEN__` placeholder inside them is substituted with the requesting
  Reader's credential at serve time).
  `BROWSER_WS_URL` (CDP endpoint of the browser, which runs on a **separate
  machine** and is reached over the tailnet — ADR-0006, `chrome/docker-compose.yml`.
  Used by the poller for kagane, comix and novelfull page fetches and by the
  cover pipeline for kagane's and comix's image bytes (the browser is the only
  route that clears the challenge those two serve their covers behind); unset —
  the default — disables browser polling and leaves kagane and comix Covers
  blank until stored bytes
  exist. Must be a tailnet IP, never a hostname: Chrome's DevTools handler 500s
  `/json/version` for any Host that isn't an IP or `localhost`).
 - **No per-Site cover path (issue #63):** every Cover — all six Sites — is
  served by the one public `GET /covers/{addr}` route from content-addressed
  bytes. There is no proxy, no per-Site rewrite, no second place that decides
  a Cover's renderable address: the wire `cover` is it. The only place a Site
  name still appears in cover code is the extraction module (`latest`), where
  kagane's and comix's image URLs are claimed by `browserOnlyCoverURL` — kagane
  answers a plain fetch with a challenge and
  `cross-origin-resource-policy: same-origin`, and `static.comix.to` answers
-  one with the same Cloudflare challenge its pages serve;
+  with the same challenge its pages serve. Every other Site's CDN answers plain
-  every other Site's CDN answers plain TLS. Templates render `.Cover` — the
+  TLS.
-  wire value — never anything else.
+- **comix cover bytes must arrive by direct navigation, not an in-page fetch:**
- **Web UI also owns:** session-gated `GET /install/{manga,novel}-bookmark.user.js`
+  its Series page sets `cross-origin-embedder-policy: require-corp`, which
-  (renders the bindmounted script with the acting Reader's derived credential
+  fails a page-context fetch of `static.comix.to`.
-  substituted in — the credential never appears in page markup, the address
+- With no browser configured, kagane and comix Covers are simply absent;
-  bar, or a redirect; `?download=1` adds `Content-Disposition: attachment` for
+  novelfull still gets one whenever its page answers a plain request.
-  mobile Violentmonkey, which ignores a `.user.js` navigation) and
+
-  `POST /rotate-token` (atomic epoch bump + hash
+### `updated_at` drives list order — `Store.Upsert`
-  rewrite; invalidates every installed copy, so the panel warns to reinstall
+
-  on all devices).
+The server applies its own timestamp only when the row is new or
- **Owner-only admin page (`internal/web/admin.go`, issue #102):** `GET /admin`
+`last_chapter_num` changes, else it keeps the stored value. **Favouriting a
-  carries the Reader roster (sessions, Sighting counters, `POST
+series, or a newly published chapter arriving, must not reorder the list** —
-  /readers/{id}/revoke` and `POST /readers/{id}/clear-marks`) and Poll Lane
+only real reading progress moves a row. Consequently `PUT` returns the row **as
-  status (`GET /ui/admin/lanes`, self-refreshing every 30s). Every route that
+stored** and clients must adopt that response rather than their own payload.
-  reaches past the acting Reader is listed in `adminRoutes()` and wrapped in
+
-  `requireOwner` at registration — add a route there, not a check inside a
+### Lifecycle buckets — `status` on each bookmark
-  handler; `web.AdminPatterns()` is what the gate test walks. A non-owner gets
+
-  404, never 403. Lane figures come from the running poller through the
+`reading` | `archived` | `finished`, orthogonal to `favorite`. Archived and
-  `web.LaneReporter` seam (`latest.Poller.LaneStatus`), never from a table: a
+finished appear only in their own tab, never in All, Updated, Favourites or the
-  nil reporter or a Lane that has not finished a pass renders "no data yet"
+recent strip. The poller keeps checking archived series and skips finished ones.
-  rather than zeroes. `main.newRouter` takes the reporter as an interface and
+
-  converts a nil `*Poller` to a nil interface — a typed nil would make the page
+- `finished` is settable only from the web UI; `PUT /bookmarks/{key}` rejects
-  claim a poller exists.
+  it with 400.
-  The one owner comparison left outside `requireOwner` is in `index`
+- **An empty incoming status means "keep the stored one"**, and it is resolved
  on the `VALUES` side of `Store.Upsert`, not in the conflict clause:
  `excluded.*` is the post-evaluation row, so a default applied there would
  wipe the bucket on every PUT from a client predating the column.
 ### Config — `Config` / `loadConfig` / `loadLatestPoll` in `backend/main.go`
 That function is the complete list of env vars, their defaults, and which are
 required. What it can't tell you:
 - `PUBLIC_BASE_URL` must be an absolute origin because every Cover URL on the
  wire is built from it and the userscript renders on a Site's origin.
 - `BROWSER_WS_URL` **must be a tailnet IP, never a hostname** — Chrome's
  DevTools handler 500s `/json/version` for any Host that isn't an IP or
  `localhost`. Unset (the default) disables browser polling.
 - `USERSCRIPT_PATH` / `NOVEL_USERSCRIPT_PATH` are bindmounted files; the
  `__API_TOKEN__` placeholder inside them is substituted with the requesting
  Reader's credential at serve time.
 - Pace is per Site in the registry, not env. The
  `_COOLDOWN`/`_BROWSER_COOLDOWN`/`_INTERVAL`/`_BATCH`/`_STAGGER` knobs are
  gone on purpose.
 - The 1h rest for browser Sites is safe on documented grounds: a challenged
  page costs seconds of a serialized single-tab browser, free-plan zones carry
  no bot score and no published per-IP rate input, and `cf_clearance` expires
  in 30 minutes, so every cadence at or above 1h re-solves anyway.
 ### Userscript install & rotation — `internal/userscript`, `internal/token`
 Session-gated `GET /install/{manga,novel}-bookmark.user.js` renders the
 bindmounted script with the acting Reader's derived credential substituted in,
 so the credential never appears in page markup, the address bar, or a redirect.
 `?download=1` adds `Content-Disposition: attachment` for mobile Violentmonkey,
 which ignores a `.user.js` navigation. `POST /rotate-token` is an atomic epoch
 bump plus hash rewrite and invalidates every installed copy — the panel must
 keep warning to reinstall on all devices.
 ### Owner-only admin — `internal/web/admin.go`
 - **Every route reaching past the acting Reader is listed in `adminRoutes()`
  and wrapped in `requireOwner` at registration** — add it there, not as a
  check inside a handler; `web.AdminPatterns()` is what the gate test walks. A
  non-owner gets 404, never 403.
 - The one owner comparison left outside the gate is in `index`
  (`view.Owner = readerID == h.store.OwnerID()`): it gates a link, not an
  endpoint, so it is a rendering decision a registration-time wrapper cannot
-  express — do not "unify" it into the gate.
+  express. Do not "unify" it into the gate.
-  A Lane pass that returns before computing its figures (refusal backoff,
+- Lane figures come through the `web.LaneReporter` seam
-  sidecar down) carries the previous pass's due count and gap forward rather
+  (`latest.Poller.LaneStatus`), never a table. `main.newRouter` takes the
-  than recording zeroes; a Lane that has never reached a pace renders no gap at
+  reporter as an interface and converts a nil `*Poller` to a nil interface — a
-  all. `Checked` next to `Due` is what separates a stopped Lane from a quiet
+  typed nil would make the page claim a poller exists.
-  one, so neither figure may be dropped from the row.
+- A pass that returns before computing figures (refusal backoff, sidecar down)
-  Due-without-Checked is *not* by itself a stall: a browser Lane under both
+  carries the previous pass's numbers forward rather than recording zeroes.
-  wake thresholds sets `LaneState.Asleep` at the on-demand gate and renders
+- **`Checked` next to `Due` is what separates a stopped Lane from a quiet one**,
-  "browser asleep" instead of "not checking", and never counts toward
+  so neither may be dropped from the row.
-  `Attention`. That is the commonest healthy state for kagane, comix and
+- Due-without-Checked is **not** by itself a stall: a browser Lane under both
-  novelfull — one due Series, nothing checked — so spending the stall mark on
+  wake thresholds sets `LaneState.Asleep` and renders "browser asleep", and
-  it would train the owner to ignore the mark that matters.
+  never counts toward `Attention`. That is the commonest healthy state for
  kagane, comix and novelfull, so spending the stall mark on it would train the
  owner to ignore the mark that matters.
@@ -47,6 +47,15 @@ func fetchCoverBytes(ctx context.Context, cover string, browser BrowserCoverFetc
 // inject it to exercise hostile DNS results without touching the live network.
 type CoverResolver func(context.Context, string) ([]netip.Addr, error)
 // maxCoverBytes caps one cover, separately from the series-page maxBodyBytes:
 // a cover is a bounded binary asset, not a text page, and 4 MiB rejected 12%
 // of asurascans covers measured 2026-08-17 (p90 4.52 MB, max 8.57 MB — two of
 // the three over-cap files were JPEGs, not the animated GIF of issue #71).
 // 10 MiB is ~18% headroom over that worst case and matches the GitHub and
 // Discord image limits; see docs/research/gif-maximum-byte-size.md. GIF itself
 // has no maximum size, so this number is policy, not format.
 const maxCoverBytes = 10 << 20
 // TLSCoverFetcher retrieves image bytes with the standard HTTPS client. Unlike
 // TLSFetcher, it does not need a browser fingerprint: cover hosts are public
 // CDNs and the response is accepted only after the destination gate passes.
@@ -152,15 +161,15 @@ func (f *TLSCoverFetcher) Fetch(ctx context.Context, sourceURL string) ([]byte,
 	if !ok {
 		return nil, "", fmt.Errorf("fetch cover: unsupported content type %q", raw)
 	}
-	if resp.ContentLength > maxBodyBytes {
+	if resp.ContentLength > maxCoverBytes {
-		return nil, "", fmt.Errorf("fetch cover: response exceeds %d bytes", maxBodyBytes)
+		return nil, "", fmt.Errorf("fetch cover: response exceeds %d bytes", maxCoverBytes)
 	}
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxBodyBytes+1))
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxCoverBytes+1))
 	if err != nil {
 		return nil, "", fmt.Errorf("read cover: %w", err)
 	}
-	if len(body) > maxBodyBytes {
+	if len(body) > maxCoverBytes {
-		return nil, "", fmt.Errorf("fetch cover: response exceeds %d bytes", maxBodyBytes)
+		return nil, "", fmt.Errorf("fetch cover: response exceeds %d bytes", maxCoverBytes)
 	}
 	return body, contentType, nil
 }
@@ -171,7 +171,7 @@ func TestCoverFetcherRejectsOversizedBody(t *testing.T) {
 	var calls int
 	client := &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
 		calls++
-		response := coverResponse(http.StatusOK, "image/webp", "", bytes.Repeat([]byte("x"), maxBodyBytes+1))
+		response := coverResponse(http.StatusOK, "image/webp", "", bytes.Repeat([]byte("x"), maxCoverBytes+1))
 		response.ContentLength = -1
 		return response, nil
 	})}
@@ -187,6 +187,29 @@ func TestCoverFetcherRejectsOversizedBody(t *testing.T) {
 	}
 }
 // Covers between the series-page cap and the cover cap must be accepted: the
 // 4 MiB page cap rejected 12% of asurascans covers (issue #71).
 func TestCoverFetcherAcceptsCoverOverPageCap(t *testing.T) {
 	body := bytes.Repeat([]byte("x"), maxBodyBytes+1)
 	client := &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
 		return coverResponse(http.StatusOK, "image/gif", "", body), nil
 	})}
 	fetcher := newCoverFetcher(client, func(context.Context, string) ([]netip.Addr, error) {
 		return []netip.Addr{netip.MustParseAddr("198.51.100.10")}, nil
 	})
 	got, contentType, err := fetcher.Fetch(context.Background(), "https://cdn.example/big.gif")
 	if err != nil {
 		t.Fatalf("Fetch rejected a %d-byte cover: %v", len(body), err)
 	}
 	if len(got) != len(body) {
 		t.Fatalf("body = %d bytes, want %d", len(got), len(body))
 	}
 	if contentType != "image/gif" {
 		t.Fatalf("content type = %q, want image/gif", contentType)
 	}
 }
 func TestCoverFetcherRejectsNonImage(t *testing.T) {
 	var calls int
 	client := &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
@@ -0,0 +1,344 @@
 # GIF — maximum byte size of a file
 Research note for Gitea issue #71 (backend `maxBodyBytes` = 4 MiB rejects the
 8,571,192-byte animated cover GIF at
 `https://cdn.asurascans.com/asura-images/covers/a-dragonslayers-peerless-regression.gif`).
 All facts fetched live on **2026-08-17**: the GIF89a spec at
 `https://www.w3.org/Graphics/GIF/spec-gif89a.txt`, Go stdlib `image/gif`
 sources at `/usr/local/go/src/image/gif/reader.go` (Go 1.26.5), Chromium
 `blink/renderer/platform/image-decoders/` sources via
 `chromium.googlesource.com`, Firefox `image/decoders/nsGIFDecoder2.cpp` via
 `hg.mozilla.org`, and cover bytes probed with plain `curl` (desktop Chrome UA;
 `HEAD`/ranged `GET`). **No Cloudflare challenge was encountered on any CDN
 probe** — every request returned real headers, consistent with the AGENTS.md
 note of 2026-07-26 that plain `curl` works against both scan sites from the
 dev machine and the VPS.
 Every claim carries the URL it came from, or a reproducible command.
 Interpretation rather than observation is marked `[INFERENCE]`.
 ---
 ## 1. Summary answer table
 | Question | Answer | Evidence |
 |---|---|---|
 | Does the GIF89a spec define a maximum file size? | **No.** There is no file-size field anywhere in the format; the only numeric ceilings are per-field (16-bit screen/image dimensions, 255-byte sub-blocks, 12-bit LZW codes). | §2 |
 | Maximum logical screen | 65535 × 65535 pixels (unsigned 16-bit width/height). | §2.1 |
 | Number of frames / image descriptors | Unbounded — "An unlimited number of images may be present per Data Stream." | §2.2 |
 | Formal max byte size of any single GIF | None. Single-frame worst case ≈ **6.44 GB** (12-bit LZW, max canvas); animated GIFs are **unbounded** because frames are unbounded. | §3 |
 | Does the backend's decoder (Go `image/gif`) bound size? | **No.** It reads 16-bit dimensions and allocates `width×height` bytes per frame; a 65535² frame forces a ~4 GiB allocation. No total-size or dimension guard. | §4.1 |
 | Do browsers bound on-disk GIF size? | Chromium and Firefox: no on-wire size cap in their GIF readers; Chromium caps *decoded* memory at min(4 B × pixels, platform budget). | §4.3, §4.4 |
 | Real cover sizes (asurascans, n=25) | min 190,410 B · median 1,275,082 B · p90 4,524,788 B · max 8,571,192 B · **3/25 > 4 MiB** (two JPEGs and the animated GIF) | §5 |
 | Real cover sizes (demonicscans/readermc, n=78) | min 13,298 B · median 63,061 B · max 801,200 B · 0/78 > 4 MiB | §5 |
 | Comparable service caps | GitHub: 10 MB for images/GIFs. Discord API: default 10 MiB per file. Wikimedia: 100 MiB upload / 5 GiB host. | §6 |
 | Recommended cover cap for #71 | **10 MiB** (separate from the 4 MiB series-page cap). Covers 100% of the 103 observed covers; matches GitHub/Discord calibration; ≤ 20 MiB worst-case transient per concurrent fetch+serve on a 1974 MiB swapless VPS. | §7 |
 ---
 ## 2. What the GIF89a specification actually bounds
 Source: `https://www.w3.org/Graphics/GIF/spec-gif89a.txt` (fetched 2026-08-17).
 ### 2.1 Fixed-width fields — the only hard ceilings
 The format is a stream of fixed-width blocks; the numeric fields that *do*
 have a ceiling are all 16-bit unsigned, little-endian ("multi-byte numeric
 fields are ordered Least Significant Byte first", §4 of the spec):
 - **Logical Screen Width / Height** — "Unsigned" 2-byte fields (§18, Logical
  Screen Descriptor) → maximum **65535 × 65535** pixels.
 - **Image Left / Top Position, Image Width / Height** — "Unsigned" 2-byte
  fields (§20, Image Descriptor). Each image "must fit within the boundaries
  of the Logical Screen" (§20a), so an image cannot exceed the 65535² canvas
  even though its own fields would allow it.
 - **Data sub-blocks** — "A data sub-block may contain from 0 to 255 data
  bytes" (§15); each sub-block is preceded by a 1-byte size field and the
  stream is terminated by a 0x00 Block Terminator (§16). This bounds a
  *chunk*, not the stream.
 - **Global/Local Color Tables** — optional, "3 x 2^(Size of Global Color
  Table+1)" bytes with a 3-bit size field → at most 3 × 2⁸ = **768 bytes**
  each (§19, §21).
 - **LZW codes** — "The output codes are of variable length, starting at
  <code size>+1 bits per code, **up to 12 bits per code**. This defines a
  maximum code value of 4095 (0xFFF)" (Appendix F, COMPRESSION, rule 4).
 - **Trailer** — a single byte, fixed value 0x3B, "indicating the end of the
  GIF Data Stream" (§27).
 ### 2.2 What is unbounded
 - **Number of images (frames).** §20a, verbatim: "This block is REQUIRED for
  an image. Exactly one Image Descriptor must be present per image in the
  Data Stream. **An unlimited number of images may be present per Data
  Stream.**"
 - **The Data Stream itself.** The grammar in Appendix B is
  `<GIF Data Stream> ::= Header <Logical Screen> <Data>* Trailer`, and the
  spec states "the entity Data … may be repeated any number of times,
  including 0 times." There is **no field anywhere that carries a file size,
  byte count, frame count, or total-length value**. §13 (Block Sizes) only
  defines sizes *within* blocks.
 ### 2.3 Verdict
 **The GIF89a specification defines no maximum file size.** The only hard
 bounds are per-field: 65535×65535 pixels per screen/image, 255 bytes per
 sub-block, 12 bits per LZW code, and one trailer byte. A compliant decoder
 must process whatever stream the blocks describe. Any byte ceiling a
 particular GIF actually hits is therefore *implicit* — 16-bit dimensions,
 LZW code width, decoder memory, or an external policy — never something the
 format itself enforces. `[INFERENCE]` This is why real-world GIFs cap out at
 "a few GB at most" and every service that wants a bound has to impose one
 itself (see §6; Wikimedia explicitly documents that a 4 GiB host limit was a
 storage-representation artifact of 32-bit integers, `phab:T191805`, not a
 format limit).
 ---
 ## 3. Theoretical worst case
 ### 3.1 Single frame, maximal canvas, 8-bit pixels
 | Quantity | Value | Derivation |
 |---|---|---|
 | Max pixels | 4,294,836,225 | 65535 × 65535 |
 | Raw 8-bit palette-index raster | 4,294,836,225 B ≈ **4.29 GB / 4.00 GiB** | 1 byte per pixel (Table Based Image Data, §22; Go's `image.Paletted` uses exactly 1 byte/pixel) |
 | LZW worst case | ≈ **6.44 GB / 6.00 GiB** | codes ≤ 12 bits each (Appendix F), at most ~1 code per pixel for incompressible data → ≤ 12 bits/px = 1.5 B/px → 4,294,836,225 × 1.5 B |
 | Sub-block overhead | ≈ +25.3 MB | every ≤255-byte chunk carries a 1-byte size field (§15): ⌈6,442,254,338 / 255⌉ ≈ 25,263,743 size bytes, + 1 block terminator |
 | Fixed overhead | ≈ +1.6 KB | header 6 B (§17) + logical screen descriptor 7 B (§18) + global color table ≤ 768 B (§19) + image descriptor 10 B (§20) + local color table ≤ 768 B (§21) + LZW minimum code size 1 B (§22) |
 So a **single maximal-frame GIF cannot exceed ≈ 6.47 GB on the wire**
 (12-bit LZW bound), and LZW being lossless means the real byte count depends
 entirely on image content — the same canvas can be a few KB (flat color) or
 ~6 GB (noise).
 Two caveats, both marked `[INFERENCE]`:
 - The "1.5 B/px" figure assumes ~one emitted code per pixel. An encoder is
  permitted to emit a Clear code at any point (Appendix F: "The Clear code
  can appear at any point in the image data stream"), so a
  pathological-but-compliant encoder emitting clear+pixel per pixel reaches
  ~24 bits/px ≈ 12.9 GB for the max canvas. Real encoders do not do this;
  12-bit/px is the practical bound.
 - The spec's deferred-clear note (cover sheet) explicitly allows an encoder
  to keep using a full table at 12-bit codes without clearing, so the 12-bit
  cap holds for the whole stream, it cannot "grow" past 12 bits.
 ### 3.2 Animated GIFs: unbounded
 Every frame is one Image Descriptor, each bounded by the 65535² canvas, but
 the *count* of frames is unbounded (§2.2). Total bytes = sum over frames —
 therefore **there is no finite maximum byte size for an animated GIF** in
 the format. The only thing that stops a real one is decoder memory, a
 service cap, or disk space. `[INFERENCE]` This is the category the issue #71
 cover falls into: it is an animated GIF (NETSCAPE2.0 loop extension found at
 offset 0x310 of the file, verified 2026-08-17 by a ranged GET), and its
 8,571,192 bytes are ~2.04× the current 4 MiB backend cap.
 ---
 ## 4. Decoder-side real limits
 ### 4.1 Go `image/gif` (the backend's decoder path, stdlib)
 Source: `/usr/local/go/src/image/gif/reader.go`, Go 1.26.5.
 - Dimensions are read as little-endian uint16 — `left/top/width/height :=
  int(d.tmp[N]) + int(d.tmp[N+1])<<8` (reader.go:490-493) — so the format
  ceiling 65535 applies, and nothing smaller is enforced.
 - The only geometric check is that each frame fits inside the logical
  screen: `if left+width > d.width || top+height > d.height` →
  `errors.New("gif: frame bounds larger than image bounds")` (reader.go:512-513).
 - **There is no file-size, byte-count, frame-count, or pixel-count guard.**
  Each frame allocates `image.NewPaletted(...)` (reader.go:515) — a
  `[]byte` of width×height — so decoding one legal 65535² frame attempts a
  **~4.29 GB allocation**. `DecodeAll` (reader.go:603-605) additionally
  retains every frame's `Pix` slice for the lifetime of the returned `*GIF`.
 - `[INFERENCE]` On the 1974 MiB swapless VPS (root AGENTS.md), decoding such
  a file would OOM rather than error cleanly; nothing in stdlib protects
  the process. This matters for §7: the backend stores cover bytes without
  decoding them (see §5.3), so the fetch path never triggers this — but any
  future "validate/re-encode server-side" scheme would.
 - Grep for `MaxInt|limit|too large|bounds` in reader.go: the only hits are
  the frame-bounds check above and the `tmp [1024]byte` scratch buffer
  (reader.go:109); no size caps exist.
 ### 4.2 giflib / libgif
 **Not verified from source.** On 2026-08-17 the giflib sources were not
 reachable from this network: `github.com/giflib/giflib` returns 404 (repo
 gone/moved), `gitlab.com/giflib/giflib/-/raw/...` answers a Cloudflare
 "Just a moment…" challenge, and the SourceForge project download path
 404s. No limit claim about giflib is made here. `[INFERENCE]` giflib is
 widely known to be allocation-driven with no dimension cap, but that is not
 checked against source and is not needed for issue #71 (the backend uses Go
 stdlib, not giflib).
 ### 4.3 Chromium (browser behaviour, first-party source)
 - `third_party/blink/renderer/platform/image-decoders/gif/gif_image_reader.cc`
  (via `chromium.googlesource.com/chromium/src/+/main/...`, fetched
  2026-08-17): **no GIF byte-size or dimension cap found** — grep for
  `max|limit|too large|dimension|65535|overflow` matches only license text.
 - The base `ImageDecoder` caps *decoded memory*, not transfer size:
  `CalculateMaxDecodedBytes` computes `min(4 * num_pixels, platform_max_decoded_bytes)`
  (8 bytes/pixel for high-bit-depth), and the header comment says "Ignoring
  this limit can cause excessive memory use or even crashes on low-memory
  devices"
  (`image_decoder.cc:94-117`, `image_decoder.h:545-549`). The GIF reader
  itself is untouched by this — it is a decoded-buffer budget.
 - Practical consequence `[INFERENCE]`: a browser will happily download and
  store a multi-GB GIF from its own cache perspective; Chromium only limits
  what it *decodes* into pixels.
 ### 4.4 Firefox
 `image/decoders/nsGIFDecoder2.cpp` (via `hg.mozilla.org/mozilla-central/
 raw-file/tip/...`, fetched 2026-08-17): **no dimension or size limit**; the
 only guards are on LZW code width (`MAX_BITS` = 12, "maximum codeword size
 of 12 bits") and the decode stack. Nothing bounds the on-disk byte size.
 ### 4.5 Summary
 No mainstream decoder enforces a byte-size ceiling; they stop at the 16-bit
 dimension ceiling (Go, by construction) or at decoded-memory budgets
 (Chromium) or nowhere (Firefox). A GIF's byte size is policed only by
 *storage* policies — which is what §6 calibrates and §7 sets.
 ---
 ## 5. Practical distribution — what real manga covers weigh
 Probed **2026-08-17** with `curl -sI` (HEAD) and ranged GETs, desktop Chrome
 UA. No Cloudflare block on any request. Sample = covers *as the backend
 would fetch them* (the `og:image`/page-listed cover URL), not thumbnails we
 chose by hand.
 ### 5.1 Exact commands
 ```sh
 # asurascans.com — harvest cover URLs from the homepage, then HEAD each
 curl -s -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/126.0" https://asurascans.com/ -o home.html
 grep -oE 'https://cdn\.asurascans\.com/asura-images/covers/[^"&\\< ]+\.(webp|gif|jpg|jpeg|png)' home.html \
  | sort -u | grep -v '\-400\.' | head -25 > sample.txt        # one full-res cover per series, no -400 thumbs
 while read -r u; do curl -s -A "…Chrome/126.0" -I "$u" | tr -d '\r' \
  | grep -iE '^content-length:'; done < sample.txt
 # demonicscans.org — covers live on readermc.org (ADR-0007), URLs contain spaces/UTF-8
 curl -s -A "…Chrome/126.0" https://demonicscans.org/ -o demonic.html
 grep -oE 'src="https://readermc\.org/images/thumbnails/[^"]+"' demonic.html | tr -d 'src="' > demonic.txt
 # …plus og:image from 5 manga pages (Catastrophic-Necromancer, Magic-Emperor, …)
 # each URL percent-encoded per path segment (urllib.parse.quote, safe=':/') before HEAD
 ```
 ### 5.2 asurascans — 25 full-res covers (mixed formats)
 Homepage fetched 200 (664,700 B). All 25 returned `200` with a real
 `Content-Length`. Distribution:
 | Statistic | Bytes |
 |---|---|
 | n | 25 |
 | min | 190,410 |
 | median | 1,275,082 |
 | p90 | 4,524,788 |
 | max | 8,571,192 |
 | mean | 1,943,651 |
 | **> 4 MiB (4,194,304)** | **3 (12%)** — `a-dragonslayers-peerless-regression.gif` 8,571,192 (the issue #71 cover, animated: NETSCAPE2.0 at 0x310, 550×733, 256 colors); `bad-born-blood.3008f6.webp` 4,524,788 `image/jpeg`; `ending-maker.cfbf53.webp` 4,619,303 `image/jpeg` |
 Notes: the CDN serves `Content-Type` by stored bytes, not by URL extension
 (the `.webp` URLs return `image/png`, `image/jpeg`, or `image/webp` — the
 sample spans all four of `png/jpeg/webp/gif`). Two of the three over-cap
 files are **not GIFs**, so the current 4 MiB cap already silently drops 12%
 of asura covers of any format. p90 itself (4.52 MB) exceeds the cap.
 ### 5.3 demonicscans — 78 covers on readermc.org
 78 unique cover URLs (73 from the homepage's `/images/thumbnails/` plus 5
 `og:image` values from manga pages — demonicscans publishes the thumbnail
 file as the full cover, so that is exactly what the backend would fetch).
 **78/78 returned 200 with a real Content-Length** (spaces and UTF-8 in the
 filenames were percent-encoded per path segment; the homepage's raw HTML
 carries `â€™`-style mojibake for curly quotes, which was repaired by
 latin-1→utf-8 re-encoding before probing).
 | Statistic | Bytes |
 |---|---|
 | n | 78 |
 | min | 13,298 |
 | median | 63,061 |
 | p90 | 206,994 |
 | max | 801,200 |
 | mean | 110,038 |
 | > 4 MiB | 0 |
 ### 5.4 Reading
 `[INFERENCE]` asurascans covers are the heavy tail (median 1.3 MB, top
 decile > 4 MiB, occasional ~5–9 MB), demonicscans covers are tiny (all
 < 0.8 MB). A cover cap must be chosen against the *asura* distribution —
 the 8.57 MB animated GIF is not a freak one-off outlier; the 90th
 percentile already crosses 4 MiB and two JPEGs sit between 4.5–4.7 MB.
 ---
 ## 6. Comparable documented byte caps (first-party docs only)
 | Service | Cap | Source (fetched 2026-08-17) |
 |---|---|---|
 | GitHub (issues/PR comments) | **10 MB for images and gifs**; 25 MB other files; 10/100 MB video | `https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/attaching-files` — "The maximum file size is: 10MB for images and gifs … 25MB for all other files" |
 | Discord (API uploads) | default **10 MiB per file**, higher with Nitro / boost tier | `https://discord.com/developers/docs/reference#uploading-files` — "The file upload size limit applies to each file in a request. The default limit is `10 MiB` for all users" (help-center article `support.discord.com/hc/en-us/articles/115002935588` exists but answered 403 from this network on the probe date, so its figures were not verified here) |
 | Wikimedia Commons | **100 MiB** upload limit; hosting up to **5 GiB**; GIF thumbnails limited to **100 megapixels**; prior 4 GiB host cap was a 32-bit storage artifact (phab:T191805) | `https://commons.wikimedia.org/wiki/Commons:Maximum_file_size` |
 | MDN | nothing — MDN documents no byte-size limit for images; browsers impose none (see §4.3–4.4) | `[INFERENCE]` from absence in the platform docs read in §4 |
 Calibration takeaway: two major platforms independently land on **~10 MB**
 as the ceiling for an uploadable image/GIF (GitHub exactly 10 MB, Discord
 exactly 10 MiB), with Wikimedia the outlier at 100 MiB/5 GiB because it is a
 media *archive*. A 10 MiB cover cap is therefore squarely inside industry
 normal.
 ---
 ## 7. Recommendation for issue #71
 **Raise the cover cap to 10 MiB (10,485,760 B) — as a separate constant, not
 by moving the shared one.**
 Why:
 - **Fits the measured reality.** The largest observed cover is 8,571,192 B
  (the issue's animated GIF) = 82% of 10 MiB; 10 MiB covers **100% of the
  103 sampled covers** and the *entire* asura distribution, including its
  heavy tail. 4 MiB rejects 12% of asura covers (two of them plain JPEGs).
 - **Matches industry calibration** (§6): GitHub 10 MB images/GIFs, Discord
  10 MiB default. A 10 MiB cap is a number every engineer recognizes, and
  it leaves ~18% headroom over the current worst observed file.
 - **Costs little on the target hardware.** The backend buffers cover bytes
  whole during fetch (`backend/internal/latest/cover.go`: `ContentLength >
  maxBodyBytes` rejection at :155, then `io.ReadAll(io.LimitReader(…,
  maxBodyBytes+1))` at :158) and loads the full body per `GET /covers/…`
  (`backend/internal/api/handlers.go`, `Cover` → `w.Write(body)`). Worst
  case per concurrent fetch **+** serve is therefore 2 × cap = 20 MiB; even
  ten of each concurrently is ~200 MiB of a 1974 MiB swapless VPS (~10%),
  and the browser unit (471 MiB, root AGENTS.md) is no longer on that box.
  The 4 MiB series-page cap is *not* the issue — measured pages run
  100 KB–1.2 MB (`backend/internal/latest/fetch.go` comment) — so keep it.
 - **The cap is a separate knob.** Today one `const maxBodyBytes = 4 << 20`
  (`backend/internal/latest/fetch.go:17`) gates *both* series pages and
  covers (`cover.go` references it). Raising it wholesale would loosen the
  page-side memory guard for no benefit; a cover-specific constant (e.g.
  `maxCoverBytes = 10 << 20`) keeps the two policies independent. The fetch
  already double-checks `ContentLength` and the post-`LimitReader` length,
  so a larger constant changes nothing else.
 Alternatives and their costs:
 | Option | Cost |
 |---|---|
 | Keep 4 MiB | 12% of asura covers (incl. non-GIF JPEGs) never stored — current bug, silent missing covers. |
 | 16 MiB cap | 2× headroom over the observed max for future GIFs; +60% worst-case transient memory vs 10 MiB; diverges from the GitHub/Discord 10 MB calibration. |
 | Server-side re-encode / downscale covers | Requires decoding → Go `image/gif` allocates width×height per frame with **no guard** (§4.1); a legal 65535² GIF forces a ~4.29 GB allocation on a 1974 MiB swapless box — OOM, not an error. Also mutates bytes, which the store treats as immutable/content-addressed (ADR-0007). Highest risk, no upside at this scale. |
 | No cap | Unbounded transient memory and disk; rejected outright. |
 Decision is the user's; on the evidence, **10 MiB for covers, 4 MiB for
 pages** is the defensible middle.
@@ -1,219 +0,0 @@
 {
  "0": "HTMX Library Internals",
  "1": "Cover Fetch Test Helpers",
  "2": "Manga Userscript Adapters",
  "3": "Novel Userscript Adapters",
  "4": "Series Acquisition Tests",
  "5": "Bookmarks API Tests",
  "6": "Storage Choice ADR",
  "7": "Cover & Acquire Internals",
  "8": "System Architecture Concepts",
  "9": "Session Middleware",
  "10": "Go Test Helpers",
  "11": "Store Tests",
  "12": "Bookmarks API Handler",
  "13": "displayChapter",
  "14": "Go Error Handling",
  "16": "Cloudflare bot scoring and poll cadence — what is actually documented",
  "17": "Go Code Style Guide",
  "18": "Agent Skills",
  "19": "Store",
  "20": "I/O Performance Patterns",
  "21": "CPU Optimization",
  "22": "Caching Patterns",
  "23": "Browser Entrypoint",
  "24": "Memory Allocation & GC",
  "25": "Cover Fetcher Tests",
  "26": "Open",
  "27": "Find Skills Guide",
  "28": "Allocation Patterns",
  "29": "Observability & Alerting",
  "30": "AGENTS.md",
  "32": "Open",
  "33": "Go Testing Guide",
  "34": "Session Store",
  "35": "Web UI Filter Logic",
  "36": "Userscript Test Harness",
  "37": "Product & Security Context",
  "38": "novel-logic.test.js",
  "39": "UI Critique 2026-07-26A",
  "40": "UI Critique 2026-07-26B",
  "41": "Handler",
  "43": "Issue Tracker & Triage",
  "44": "Ticket Workflow",
  "45": "Go Perf Alert Rules",
  "46": "Userscript Display Logic",
  "47": "Go Perf Skill Docs",
  "48": "Login Page Art",
  "49": "BookmarkManager Logo",
  "50": "Skills CLI",
  "51": "Skills Leaderboard",
  "52": "Complex Condition Extraction",
  "53": "Sentinel Errors",
  "54": "errors.As Patterns",
  "55": "errors.Is Patterns",
  "56": "errors.Join Patterns",
  "57": "Error Wrapping",
  "58": "Single Error Handling",
  "59": "SIMD Optimizations",
  "60": "GOGC Tuning",
  "61": "GOMEMLIMIT",
  "62": "Bottleneck Decision Tree",
  "63": "pprof Profiling",
  "64": "Test Timeout Helper",
  "65": "httptest Patterns",
  "66": "testify Suite Pattern",
  "67": "go:embed Fixtures",
  "68": "clockwork Time Mocking",
  "69": "testify Mocking",
  "70": "t.ArtifactDir Helper",
  "71": "Subtests Pitfall",
  "72": "golang-benchmark Skill",
  "73": "golang-concurrency Skill",
  "74": "golang-ci Skill",
  "75": "golang-database Skill",
  "76": "golang-lint Skill",
  "77": "testify Skill",
  "78": "Build Tag Integration Tests",
  "79": "Test Naming Convention",
  "80": "UI Critique A Finding",
  "81": "UI Critique B Finding",
  "82": "P0 Overflow Bug",
  "83": "P1 hx-indicator Gap",
  "84": "golang-benchmark Skill (ext)",
  "85": "golang-concurrency Skill (ext)",
  "86": "golang-ci Skill (ext)",
  "87": "golang-data-structures Skill (ext)",
  "88": "golang-database Skill (ext)",
  "89": "golang-design-patterns Skill (ext)",
  "90": "golang-documentation Skill (ext)",
  "91": "golang-gopls Skill (ext)",
  "92": "golang-lint Skill (ext)",
  "93": "golang-naming Skill (ext)",
  "94": "golang-observability Skill (ext)",
  "95": "golang-refactoring Skill (ext)",
  "96": "golang-safety Skill (ext)",
  "97": "golang-samber-oops Skill (ext)",
  "98": "golang-samber-slog Skill (ext)",
  "99": "golang-structs-interfaces Skill (ext)",
  "100": "golang-troubleshooting Skill (ext)",
  "101": "promql-cli Skill",
  "102": "Backend Module",
  "103": "bookmark-api Service",
  "104": "AGENTS.md",
  "105": "reviewer.md",
  "106": "Redeploy runbook",
  "107": "1. Backend",
  "108": "Deployment",
  "109": "Cinder — BookmarkManager design system",
  "110": "Implement tickets",
  "111": "SQLite → Postgres cutover runbook",
  "112": "Testing the userscript",
  "113": "ADR-0007: The backend hosts every Site's Cover bytes",
  "114": "Issue tracker: Gitea (`tea` CLI)",
  "115": "ADR-0006: The browser runs on the home machine, over the tailnet",
  "116": "ADR-0008: A Series identity is discovered from the Site's links, never derived from an address",
  "117": "Domain Docs",
  "118": "ticket-implementer.md",
  "119": "implementer.md",
  "120": "Series is a shared entity, and only the Poll may update it",
  "121": "Postgres replaces SQLite as the primary datastore",
  "122": "Identity comes from Discord OAuth; we store no passwords and send no email",
  "123": "The wire format stays flat and deliberately does not mirror the schema",
  "124": "ADR-0005: On-demand browser sidecar",
  "126": "Bookmark Manager",
  "127": "triage-labels.md",
  "128": "Cross-Ticket Contract",
  "129": "Implement Tickets Skill",
  "130": "Orchestrator Role",
  "131": "resolving-merge-conflicts Skill",
  "132": "tdd Skill",
  "133": "Ticket Wave Batching",
  "134": "Four-Object Browser Stub",
  "135": "Module Export Hook",
  "136": "logic.test.js Test Harness",
  "137": "manga-bookmark.user.js",
  "138": "stripBuildHash",
  "139": "Testing the Userscript Skill",
  "140": "cr-spec Agent",
  "141": "cr-standards Agent",
  "142": "Escalate Rather Than Guess",
  "143": "Status Contract",
  "144": "Ticket Implementer Agent",
  "145": "Worktree Isolation",
  "146": "Escalate Rather Than Guess (opencode)",
  "147": "Implementer Subagent (opencode)",
  "148": "Subagent-Driven Development",
  "149": "Code Quality Review",
  "150": "Reviewer Subagent (opencode)",
  "151": "Finding Severity Rubric",
  "152": "Spec Compliance Review",
  "154": "ADR-0011: Sightings — a Reader report defers a Poll where being wrong hurts only them",
  "156": "ResponseWriter",
  "161": "Why Use samber/oops",
  "162": "singleflight Cache Stampede Prevention",
  "163": "Struct Field Alignment",
  "164": "testing/synctest Deterministic Goroutine Testing",
  "177": "Backend CLAUDE.md Guidance",
  "178": "Graphify Knowledge Graph (graphify-out/)",
  "179": "CLAUDE.md (Symlink to AGENTS.md)",
  "192": "ADR-0001 (Drop modernc.org/sqlite)",
  "193": "ADR-0003 (Split Shared Series Facts)",
  "194": "SQLite-to-Postgres Cutover Runbook",
  "195": "Import SQL Generation Rules",
  "196": "Throwaway Import Generator",
  "206": "Real scaling limit is the poller outbound fetch budget",
  "207": "PostgreSQL (jackc/pgx/v5)",
  "208": "SQLite (modernc.org/sqlite)",
  "209": "Postgres chosen for future supportability, not concurrency",
  "210": "Per-Reader bearer token for userscripts",
  "211": "Discord OAuth2 (authorization code grant)",
  "212": "ADR-0002: Discord OAuth, no passwords, no email",
  "213": "Discord snowflake is the sole identity (lock-in)",
  "214": "Bookmark (per-Reader state: Progress, Favourite, Lifecycle)",
  "215": "Deduplicate polling per Series (reader_count DESC queue)",
  "216": "ADR-0003: Series is shared, only the Poll updates it",
  "217": "Only the Poll writes Series fields (security boundary)",
  "218": "Series (shared entity keyed site+series_id)",
  "219": "ADR-0004: Wire format stays flat, does not mirror schema",
  "220": "Flat wire shape is a contract, not an implementation detail",
  "221": "Installed userscripts must keep working (14-day grace window)",
  "222": "CDP (Chrome DevTools Protocol) endpoint",
  "223": "headless-shell service (socat-fronted CDP)",
  "224": "Start Chrome on first CDP connection, reap after 300s idle",
  "225": "BROWSER_WS_URL configuration seam",
  "226": "ADR-0006: Browser runs on the home machine over the tailnet",
  "227": "Browser moved home: VPS memory pressure, no requests served",
  "228": "Tailnet (Tailscale network)",
  "229": "Content-addressed filesystem storage (SHA-256 of source URL)",
  "230": "Cover (Series image bytes)",
  "231": "Deny-class destination control for outbound fetch",
  "232": "ADR-0007: Backend hosts every Site's Cover bytes",
  "233": "kagane CORP same-origin cover restriction",
  "234": "Backend acquires, stores, serves every Cover (uniformity)",
  "235": "a[aria-label='All Chapter'] anchor pointer",
  "236": "Series identity is discovered from the Site's links",
  "237": "ADR-0008: Series identity discovered, never derived",
  "238": "Chapter slug vs series slug divergence (~7% measured)",
  "239": "Scan truncated at first wpd-threads marker",
  "240": "Surface ADR conflicts explicitly rather than silently overriding",
  "241": "Domain docs: single-context layout guidance",
  "242": "/domain-modeling skill (lazy CONTEXT.md creation)",
  "243": "CONTEXT.md glossary (ubiquitous language)",
  "244": "Gitea (tea CLI, gitea.violetcrown.my.id)",
  "245": "wayfinder map/ticket mechanism",
  "246": "Triage labels: canonical roles to tracker labels",
  "247": "Canonical triage role labels (needs-triage ... wontfix)",
  "252": "a[aria-label='All Chapter'] priority pointer",
  "253": "Research: lightnovelworld chapter slug vs series slug",
  "254": "Gitea issue #77 (chapter vs series slug)",
  "255": "Slug divergence measurements (3/41 diverge, 1 split)",
  "256": "Unscoped chapter regex is SAFE, truncated at wpd-threads",
  "257": "BookmarkManager",
  "258": "Bromite (Primary Device)",
  "259": "Dark-First Design Constraint",
  "260": "Discord Guild Membership",
  "261": "Reader Isolation Invariant",
  "273": "AGENTS.md",
  "279": "Userscript CLAUDE guidance"
 }
@@ -1 +0,0 @@
 .
@@ -1,556 +0,0 @@
 # Graph Report - mangaBookmark  (2026-08-16)
 ## Corpus Check
 - 119 files · ~291,777 words
 - Verdict: corpus is large enough that graph structure adds value.
 ## Summary
 - 1739 nodes · 3610 edges · 217 communities (67 shown, 150 thin omitted)
 - Extraction: 90% EXTRACTED · 10% INFERRED · 0% AMBIGUOUS · INFERRED: 363 edges (avg confidence: 0.78)
 - Token cost: 0 input · 0 output
 ## Graph Freshness
 - Built from commit: `20fff588`
 - Run `git rev-parse HEAD` and compare to check if the graph is stale.
 - Run `graphify update .` after code changes (no API cost).
 ## Community Hubs (Navigation)
 - [[_COMMUNITY_HTMX Library Internals|HTMX Library Internals]]
 - [[_COMMUNITY_Cover Fetch Test Helpers|Cover Fetch Test Helpers]]
 - [[_COMMUNITY_Manga Userscript Adapters|Manga Userscript Adapters]]
 - [[_COMMUNITY_Novel Userscript Adapters|Novel Userscript Adapters]]
 - [[_COMMUNITY_Series Acquisition Tests|Series Acquisition Tests]]
 - [[_COMMUNITY_Bookmarks API Tests|Bookmarks API Tests]]
 - [[_COMMUNITY_Storage Choice ADR|Storage Choice ADR]]
 - [[_COMMUNITY_Cover & Acquire Internals|Cover & Acquire Internals]]
 - [[_COMMUNITY_System Architecture Concepts|System Architecture Concepts]]
 - [[_COMMUNITY_Session Middleware|Session Middleware]]
 - [[_COMMUNITY_Go Test Helpers|Go Test Helpers]]
 - [[_COMMUNITY_Store Tests|Store Tests]]
 - [[_COMMUNITY_Bookmarks API Handler|Bookmarks API Handler]]
 - [[_COMMUNITY_displayChapter|displayChapter]]
 - [[_COMMUNITY_Go Error Handling|Go Error Handling]]
 - [[_COMMUNITY_Cloudflare bot scoring and poll cadence — what is actually documented|Cloudflare bot scoring and poll cadence — what is actually documented]]
 - [[_COMMUNITY_Go Code Style Guide|Go Code Style Guide]]
 - [[_COMMUNITY_Agent Skills|Agent Skills]]
 - [[_COMMUNITY_Store|Store]]
 - [[_COMMUNITY_IO Performance Patterns|I/O Performance Patterns]]
 - [[_COMMUNITY_CPU Optimization|CPU Optimization]]
 - [[_COMMUNITY_Caching Patterns|Caching Patterns]]
 - [[_COMMUNITY_Browser Entrypoint|Browser Entrypoint]]
 - [[_COMMUNITY_Memory Allocation & GC|Memory Allocation & GC]]
 - [[_COMMUNITY_Cover Fetcher Tests|Cover Fetcher Tests]]
 - [[_COMMUNITY_Open|Open]]
 - [[_COMMUNITY_Find Skills Guide|Find Skills Guide]]
 - [[_COMMUNITY_Allocation Patterns|Allocation Patterns]]
 - [[_COMMUNITY_Observability & Alerting|Observability & Alerting]]
 - [[_COMMUNITY_AGENTS|AGENTS.md]]
 - [[_COMMUNITY_Go Testing Guide|Go Testing Guide]]
 - [[_COMMUNITY_Session Store|Session Store]]
 - [[_COMMUNITY_Web UI Filter Logic|Web UI Filter Logic]]
 - [[_COMMUNITY_Userscript Test Harness|Userscript Test Harness]]
 - [[_COMMUNITY_Product & Security Context|Product & Security Context]]
 - [[_COMMUNITY_novel-logic.test.js|novel-logic.test.js]]
 - [[_COMMUNITY_UI Critique 2026-07-26A|UI Critique 2026-07-26A]]
 - [[_COMMUNITY_UI Critique 2026-07-26B|UI Critique 2026-07-26B]]
 - [[_COMMUNITY_Handler|Handler]]
 - [[_COMMUNITY_Issue Tracker & Triage|Issue Tracker & Triage]]
 - [[_COMMUNITY_Ticket Workflow|Ticket Workflow]]
 - [[_COMMUNITY_Go Perf Alert Rules|Go Perf Alert Rules]]
 - [[_COMMUNITY_Userscript Display Logic|Userscript Display Logic]]
 - [[_COMMUNITY_Go Perf Skill Docs|Go Perf Skill Docs]]
 - [[_COMMUNITY_Login Page Art|Login Page Art]]
 - [[_COMMUNITY_BookmarkManager Logo|BookmarkManager Logo]]
 - [[_COMMUNITY_Skills CLI|Skills CLI]]
 - [[_COMMUNITY_Skills Leaderboard|Skills Leaderboard]]
 - [[_COMMUNITY_Complex Condition Extraction|Complex Condition Extraction]]
 - [[_COMMUNITY_Sentinel Errors|Sentinel Errors]]
 - [[_COMMUNITY_errors.As Patterns|errors.As Patterns]]
 - [[_COMMUNITY_errors.Is Patterns|errors.Is Patterns]]
 - [[_COMMUNITY_errors.Join Patterns|errors.Join Patterns]]
 - [[_COMMUNITY_Error Wrapping|Error Wrapping]]
 - [[_COMMUNITY_Single Error Handling|Single Error Handling]]
 - [[_COMMUNITY_SIMD Optimizations|SIMD Optimizations]]
 - [[_COMMUNITY_GOGC Tuning|GOGC Tuning]]
 - [[_COMMUNITY_GOMEMLIMIT|GOMEMLIMIT]]
 - [[_COMMUNITY_Bottleneck Decision Tree|Bottleneck Decision Tree]]
 - [[_COMMUNITY_pprof Profiling|pprof Profiling]]
 - [[_COMMUNITY_Test Timeout Helper|Test Timeout Helper]]
 - [[_COMMUNITY_httptest Patterns|httptest Patterns]]
 - [[_COMMUNITY_testify Suite Pattern|testify Suite Pattern]]
 - [[_COMMUNITY_goembed Fixtures|go:embed Fixtures]]
 - [[_COMMUNITY_clockwork Time Mocking|clockwork Time Mocking]]
 - [[_COMMUNITY_testify Mocking|testify Mocking]]
 - [[_COMMUNITY_t.ArtifactDir Helper|t.ArtifactDir Helper]]
 - [[_COMMUNITY_Subtests Pitfall|Subtests Pitfall]]
 - [[_COMMUNITY_golang-benchmark Skill|golang-benchmark Skill]]
 - [[_COMMUNITY_golang-concurrency Skill|golang-concurrency Skill]]
 - [[_COMMUNITY_golang-ci Skill|golang-ci Skill]]
 - [[_COMMUNITY_golang-database Skill|golang-database Skill]]
 - [[_COMMUNITY_golang-lint Skill|golang-lint Skill]]
 - [[_COMMUNITY_testify Skill|testify Skill]]
 - [[_COMMUNITY_Build Tag Integration Tests|Build Tag Integration Tests]]
 - [[_COMMUNITY_Test Naming Convention|Test Naming Convention]]
 - [[_COMMUNITY_UI Critique A Finding|UI Critique A Finding]]
 - [[_COMMUNITY_UI Critique B Finding|UI Critique B Finding]]
 - [[_COMMUNITY_P0 Overflow Bug|P0 Overflow Bug]]
 - [[_COMMUNITY_P1 hx-indicator Gap|P1 hx-indicator Gap]]
 - [[_COMMUNITY_golang-benchmark Skill (ext)|golang-benchmark Skill (ext)]]
 - [[_COMMUNITY_golang-concurrency Skill (ext)|golang-concurrency Skill (ext)]]
 - [[_COMMUNITY_golang-ci Skill (ext)|golang-ci Skill (ext)]]
 - [[_COMMUNITY_golang-data-structures Skill (ext)|golang-data-structures Skill (ext)]]
 - [[_COMMUNITY_golang-database Skill (ext)|golang-database Skill (ext)]]
 - [[_COMMUNITY_golang-design-patterns Skill (ext)|golang-design-patterns Skill (ext)]]
 - [[_COMMUNITY_golang-documentation Skill (ext)|golang-documentation Skill (ext)]]
 - [[_COMMUNITY_golang-gopls Skill (ext)|golang-gopls Skill (ext)]]
 - [[_COMMUNITY_golang-lint Skill (ext)|golang-lint Skill (ext)]]
 - [[_COMMUNITY_golang-naming Skill (ext)|golang-naming Skill (ext)]]
 - [[_COMMUNITY_golang-observability Skill (ext)|golang-observability Skill (ext)]]
 - [[_COMMUNITY_golang-refactoring Skill (ext)|golang-refactoring Skill (ext)]]
 - [[_COMMUNITY_golang-safety Skill (ext)|golang-safety Skill (ext)]]
 - [[_COMMUNITY_golang-samber-oops Skill (ext)|golang-samber-oops Skill (ext)]]
 - [[_COMMUNITY_golang-samber-slog Skill (ext)|golang-samber-slog Skill (ext)]]
 - [[_COMMUNITY_golang-structs-interfaces Skill (ext)|golang-structs-interfaces Skill (ext)]]
 - [[_COMMUNITY_golang-troubleshooting Skill (ext)|golang-troubleshooting Skill (ext)]]
 - [[_COMMUNITY_promql-cli Skill|promql-cli Skill]]
 - [[_COMMUNITY_Backend Module|Backend Module]]
 - [[_COMMUNITY_bookmark-api Service|bookmark-api Service]]
 - [[_COMMUNITY_AGENTS|AGENTS.md]]
 - [[_COMMUNITY_reviewer|reviewer.md]]
 - [[_COMMUNITY_Redeploy runbook|Redeploy runbook]]
 - [[_COMMUNITY_1. Backend|1. Backend]]
 - [[_COMMUNITY_Deployment|Deployment]]
 - [[_COMMUNITY_Cinder — BookmarkManager design system|Cinder — BookmarkManager design system]]
 - [[_COMMUNITY_Implement tickets|Implement tickets]]
 - [[_COMMUNITY_SQLite → Postgres cutover runbook|SQLite → Postgres cutover runbook]]
 - [[_COMMUNITY_Testing the userscript|Testing the userscript]]
 - [[_COMMUNITY_ADR-0007 The backend hosts every Site's Cover bytes|ADR-0007: The backend hosts every Site's Cover bytes]]
 - [[_COMMUNITY_Issue tracker Gitea (`tea` CLI)|Issue tracker: Gitea (`tea` CLI)]]
 - [[_COMMUNITY_ADR-0006 The browser runs on the home machine, over the tailnet|ADR-0006: The browser runs on the home machine, over the tailnet]]
 - [[_COMMUNITY_ADR-0008 A Series identity is discovered from the Site's links, never derived from an address|ADR-0008: A Series identity is discovered from the Site's links, never derived from an address]]
 - [[_COMMUNITY_Domain Docs|Domain Docs]]
 - [[_COMMUNITY_ticket-implementer|ticket-implementer.md]]
 - [[_COMMUNITY_implementer|implementer.md]]
 - [[_COMMUNITY_Series is a shared entity, and only the Poll may update it|Series is a shared entity, and only the Poll may update it]]
 - [[_COMMUNITY_Postgres replaces SQLite as the primary datastore|Postgres replaces SQLite as the primary datastore]]
 - [[_COMMUNITY_Identity comes from Discord OAuth; we store no passwords and send no email|Identity comes from Discord OAuth; we store no passwords and send no email]]
 - [[_COMMUNITY_The wire format stays flat and deliberately does not mirror the schema|The wire format stays flat and deliberately does not mirror the schema]]
 - [[_COMMUNITY_ADR-0005 On-demand browser sidecar|ADR-0005: On-demand browser sidecar]]
 - [[_COMMUNITY_Bookmark Manager|Bookmark Manager]]
 - [[_COMMUNITY_triage-labels|triage-labels.md]]
 - [[_COMMUNITY_Cross-Ticket Contract|Cross-Ticket Contract]]
 - [[_COMMUNITY_Implement Tickets Skill|Implement Tickets Skill]]
 - [[_COMMUNITY_Orchestrator Role|Orchestrator Role]]
 - [[_COMMUNITY_resolving-merge-conflicts Skill|resolving-merge-conflicts Skill]]
 - [[_COMMUNITY_tdd Skill|tdd Skill]]
 - [[_COMMUNITY_Ticket Wave Batching|Ticket Wave Batching]]
 - [[_COMMUNITY_Four-Object Browser Stub|Four-Object Browser Stub]]
 - [[_COMMUNITY_Module Export Hook|Module Export Hook]]
 - [[_COMMUNITY_logic.test.js Test Harness|logic.test.js Test Harness]]
 - [[_COMMUNITY_manga-bookmark.user.js|manga-bookmark.user.js]]
 - [[_COMMUNITY_stripBuildHash|stripBuildHash]]
 - [[_COMMUNITY_Testing the Userscript Skill|Testing the Userscript Skill]]
 - [[_COMMUNITY_cr-spec Agent|cr-spec Agent]]
 - [[_COMMUNITY_cr-standards Agent|cr-standards Agent]]
 - [[_COMMUNITY_Escalate Rather Than Guess|Escalate Rather Than Guess]]
 - [[_COMMUNITY_Status Contract|Status Contract]]
 - [[_COMMUNITY_Ticket Implementer Agent|Ticket Implementer Agent]]
 - [[_COMMUNITY_Worktree Isolation|Worktree Isolation]]
 - [[_COMMUNITY_Escalate Rather Than Guess (opencode)|Escalate Rather Than Guess (opencode)]]
 - [[_COMMUNITY_Implementer Subagent (opencode)|Implementer Subagent (opencode)]]
 - [[_COMMUNITY_Subagent-Driven Development|Subagent-Driven Development]]
 - [[_COMMUNITY_Code Quality Review|Code Quality Review]]
 - [[_COMMUNITY_Reviewer Subagent (opencode)|Reviewer Subagent (opencode)]]
 - [[_COMMUNITY_Finding Severity Rubric|Finding Severity Rubric]]
 - [[_COMMUNITY_Spec Compliance Review|Spec Compliance Review]]
 - [[_COMMUNITY_ADR-0011 Sightings — a Reader report defers a Poll where being wrong hurts only them|ADR-0011: Sightings — a Reader report defers a Poll where being wrong hurts only them]]
 - [[_COMMUNITY_ResponseWriter|ResponseWriter]]
 - [[_COMMUNITY_Why Use samberoops|Why Use samber/oops]]
 - [[_COMMUNITY_singleflight Cache Stampede Prevention|singleflight Cache Stampede Prevention]]
 - [[_COMMUNITY_Struct Field Alignment|Struct Field Alignment]]
 - [[_COMMUNITY_testingsynctest Deterministic Goroutine Testing|testing/synctest Deterministic Goroutine Testing]]
 - [[_COMMUNITY_Backend CLAUDE.md Guidance|Backend CLAUDE.md Guidance]]
 - [[_COMMUNITY_Graphify Knowledge Graph (graphify-out)|Graphify Knowledge Graph (graphify-out/)]]
 - [[_COMMUNITY_CLAUDE.md (Symlink to AGENTS.md)|CLAUDE.md (Symlink to AGENTS.md)]]
 - [[_COMMUNITY_ADR-0001 (Drop modernc.orgsqlite)|ADR-0001 (Drop modernc.org/sqlite)]]
 - [[_COMMUNITY_ADR-0003 (Split Shared Series Facts)|ADR-0003 (Split Shared Series Facts)]]
 - [[_COMMUNITY_SQLite-to-Postgres Cutover Runbook|SQLite-to-Postgres Cutover Runbook]]
 - [[_COMMUNITY_Import SQL Generation Rules|Import SQL Generation Rules]]
 - [[_COMMUNITY_Throwaway Import Generator|Throwaway Import Generator]]
 - [[_COMMUNITY_Real scaling limit is the poller outbound fetch budget|Real scaling limit is the poller outbound fetch budget]]
 - [[_COMMUNITY_PostgreSQL (jackcpgxv5)|PostgreSQL (jackc/pgx/v5)]]
 - [[_COMMUNITY_SQLite (modernc.orgsqlite)|SQLite (modernc.org/sqlite)]]
 - [[_COMMUNITY_Postgres chosen for future supportability, not concurrency|Postgres chosen for future supportability, not concurrency]]
 - [[_COMMUNITY_Per-Reader bearer token for userscripts|Per-Reader bearer token for userscripts]]
 - [[_COMMUNITY_Discord OAuth2 (authorization code grant)|Discord OAuth2 (authorization code grant)]]
 - [[_COMMUNITY_ADR-0002 Discord OAuth, no passwords, no email|ADR-0002: Discord OAuth, no passwords, no email]]
 - [[_COMMUNITY_Discord snowflake is the sole identity (lock-in)|Discord snowflake is the sole identity (lock-in)]]
 - [[_COMMUNITY_Bookmark (per-Reader state Progress, Favourite, Lifecycle)|Bookmark (per-Reader state: Progress, Favourite, Lifecycle)]]
 - [[_COMMUNITY_Deduplicate polling per Series (reader_count DESC queue)|Deduplicate polling per Series (reader_count DESC queue)]]
 - [[_COMMUNITY_ADR-0003 Series is shared, only the Poll updates it|ADR-0003: Series is shared, only the Poll updates it]]
 - [[_COMMUNITY_Only the Poll writes Series fields (security boundary)|Only the Poll writes Series fields (security boundary)]]
 - [[_COMMUNITY_Series (shared entity keyed site+series_id)|Series (shared entity keyed site+series_id)]]
 - [[_COMMUNITY_ADR-0004 Wire format stays flat, does not mirror schema|ADR-0004: Wire format stays flat, does not mirror schema]]
 - [[_COMMUNITY_Flat wire shape is a contract, not an implementation detail|Flat wire shape is a contract, not an implementation detail]]
 - [[_COMMUNITY_Installed userscripts must keep working (14-day grace window)|Installed userscripts must keep working (14-day grace window)]]
 - [[_COMMUNITY_CDP (Chrome DevTools Protocol) endpoint|CDP (Chrome DevTools Protocol) endpoint]]
 - [[_COMMUNITY_headless-shell service (socat-fronted CDP)|headless-shell service (socat-fronted CDP)]]
 - [[_COMMUNITY_Start Chrome on first CDP connection, reap after 300s idle|Start Chrome on first CDP connection, reap after 300s idle]]
 - [[_COMMUNITY_BROWSER_WS_URL configuration seam|BROWSER_WS_URL configuration seam]]
 - [[_COMMUNITY_ADR-0006 Browser runs on the home machine over the tailnet|ADR-0006: Browser runs on the home machine over the tailnet]]
 - [[_COMMUNITY_Browser moved home VPS memory pressure, no requests served|Browser moved home: VPS memory pressure, no requests served]]
 - [[_COMMUNITY_Tailnet (Tailscale network)|Tailnet (Tailscale network)]]
 - [[_COMMUNITY_Content-addressed filesystem storage (SHA-256 of source URL)|Content-addressed filesystem storage (SHA-256 of source URL)]]
 - [[_COMMUNITY_Cover (Series image bytes)|Cover (Series image bytes)]]
 - [[_COMMUNITY_Deny-class destination control for outbound fetch|Deny-class destination control for outbound fetch]]
 - [[_COMMUNITY_ADR-0007 Backend hosts every Site's Cover bytes|ADR-0007: Backend hosts every Site's Cover bytes]]
 - [[_COMMUNITY_kagane CORP same-origin cover restriction|kagane CORP same-origin cover restriction]]
 - [[_COMMUNITY_Backend acquires, stores, serves every Cover (uniformity)|Backend acquires, stores, serves every Cover (uniformity)]]
 - [[_COMMUNITY_aaria-label='All Chapter' anchor pointer|a[aria-label='All Chapter'] anchor pointer]]
 - [[_COMMUNITY_Series identity is discovered from the Site's links|Series identity is discovered from the Site's links]]
 - [[_COMMUNITY_ADR-0008 Series identity discovered, never derived|ADR-0008: Series identity discovered, never derived]]
 - [[_COMMUNITY_Chapter slug vs series slug divergence (~7% measured)|Chapter slug vs series slug divergence (~7% measured)]]
 - [[_COMMUNITY_Scan truncated at first wpd-threads marker|Scan truncated at first wpd-threads marker]]
 - [[_COMMUNITY_Surface ADR conflicts explicitly rather than silently overriding|Surface ADR conflicts explicitly rather than silently overriding]]
 - [[_COMMUNITY_Domain docs single-context layout guidance|Domain docs: single-context layout guidance]]
 - [[_COMMUNITY_domain-modeling skill (lazy CONTEXT.md creation)|/domain-modeling skill (lazy CONTEXT.md creation)]]
 - [[_COMMUNITY_CONTEXT.md glossary (ubiquitous language)|CONTEXT.md glossary (ubiquitous language)]]
 - [[_COMMUNITY_Gitea (tea CLI, gitea.violetcrown.my.id)|Gitea (tea CLI, gitea.violetcrown.my.id)]]
 - [[_COMMUNITY_wayfinder mapticket mechanism|wayfinder map/ticket mechanism]]
 - [[_COMMUNITY_Triage labels canonical roles to tracker labels|Triage labels: canonical roles to tracker labels]]
 - [[_COMMUNITY_Canonical triage role labels (needs-triage ... wontfix)|Canonical triage role labels (needs-triage ... wontfix)]]
 - [[_COMMUNITY_aaria-label='All Chapter' priority pointer|a[aria-label='All Chapter'] priority pointer]]
 - [[_COMMUNITY_Research lightnovelworld chapter slug vs series slug|Research: lightnovelworld chapter slug vs series slug]]
 - [[_COMMUNITY_Gitea issue 77 (chapter vs series slug)|Gitea issue #77 (chapter vs series slug)]]
 - [[_COMMUNITY_Slug divergence measurements (341 diverge, 1 split)|Slug divergence measurements (3/41 diverge, 1 split)]]
 - [[_COMMUNITY_Unscoped chapter regex is SAFE, truncated at wpd-threads|Unscoped chapter regex is SAFE, truncated at wpd-threads]]
 - [[_COMMUNITY_BookmarkManager|BookmarkManager]]
 - [[_COMMUNITY_Bromite (Primary Device)|Bromite (Primary Device)]]
 - [[_COMMUNITY_Dark-First Design Constraint|Dark-First Design Constraint]]
 - [[_COMMUNITY_Discord Guild Membership|Discord Guild Membership]]
 - [[_COMMUNITY_Reader Isolation Invariant|Reader Isolation Invariant]]
 - [[_COMMUNITY_AGENTS|AGENTS.md]]
 - [[_COMMUNITY_Userscript CLAUDE guidance|Userscript CLAUDE guidance]]
 ## God Nodes (most connected - your core abstractions)
 1. `newTestStore()` - 62 edges
 2. `testConfig()` - 55 edges
 3. `newWebTestServer()` - 49 edges
 4. `newTestStore()` - 44 edges
 5. `e()` - 33 edges
 6. `Store` - 31 edges
 7. `Open()` - 31 edges
 8. `newTestPoller()` - 30 edges
 9. `Handler` - 29 edges
 10. `ne()` - 28 edges
 ## Surprising Connections (you probably didn't know these)
 - `el()` --indirect_call--> `c()`  [INFERRED]
  userscript/manga-bookmark.user.js → backend/internal/web/static/htmx.min.js
 - `el()` --indirect_call--> `c()`  [INFERRED]
  userscript/novel-bookmark.user.js → backend/internal/web/static/htmx.min.js
 - `latestChapterFromAnchors()` --indirect_call--> `re()`  [INFERRED]
  userscript/manga-bookmark.user.js → backend/internal/web/static/htmx.min.js
 - `el()` --indirect_call--> `k()`  [INFERRED]
  userscript/manga-bookmark.user.js → backend/internal/web/static/htmx.min.js
 - `el()` --indirect_call--> `k()`  [INFERRED]
  userscript/novel-bookmark.user.js → backend/internal/web/static/htmx.min.js
 ## Import Cycles
 - None detected.
 ## Hyperedges (group relationships)
 - **Batch Ticket Implementation Pipeline** — _claude_skills_implement_tickets_skill_implement_tickets, _omp_agents_ticket_implementer_ticket_implementer, _omp_agents_ticket_implementer_cr_spec, _omp_agents_ticket_implementer_cr_standards [INFERRED 0.85]
 - **Subagent-Driven Development Pipeline** — _opencode_agent_implementer_implementer, _opencode_agent_reviewer_reviewer, _opencode_agent_implementer_subagent_driven_development [INFERRED 0.85]
 - **Backend owns the truth (single-writer ownership of shared facts)** — docs_adr_0003_series_shared_and_poll_owned_poll_owned_writes, docs_adr_0004_wire_format_does_not_mirror_the_schema_flat_wire_contract, docs_adr_0007_backend_hosts_cover_bytes_server_side_covers [INFERRED 0.85]
 - **Headless browser infrastructure (sidecar, on-demand, home deployment)** — docs_adr_0005_on_demand_browser_headless_shell, docs_adr_0005_on_demand_browser_cdp, docs_adr_0005_on_demand_browser_on_demand_start, docs_adr_0006_browser_on_the_home_machine_home_machine_rationale [INFERRED 0.85]
 - **lightnovelworld series-identity investigation and fix** — docs_research_lightnovelworld_chapter_vs_series_slug_issue_77, docs_research_lightnovelworld_chapter_vs_series_slug_unscoped_regex, docs_adr_0008_series_identity_is_discovered_not_derived_discovered_identity [INFERRED 0.85]
 ## Communities (217 total, 150 thin omitted)
 ### Community 0 - "HTMX Library Internals"
 Cohesion: 0.08
 Nodes (101): A(), ae(), an(), at(), B(), be(), bn(), bt() (+93 more)
 ### Community 1 - "Cover Fetch Test Helpers"
 Cohesion: 0.09
 Nodes (88): floatPtr(), testConfig(), getCover(), Cookie, Handler, ResponseRecorder, T, TestListRendersAcquiredCover() (+80 more)
 ### Community 2 - "Manga Userscript Adapters"
 Cohesion: 0.06
 Nodes (77): adapterFor(), anchorsFromDocument(), anchorsFromHTML(), apiDelete(), apiGet(), apiPut(), applyFabPos(), armDwell() (+69 more)
 ### Community 3 - "Novel Userscript Adapters"
 Cohesion: 0.06
 Nodes (78): adapterFor(), anchorsFromDocument(), anchorsFromHTML(), apiDelete(), apiGet(), apiPut(), applyFabPos(), applyLnwStaleRowRepair() (+70 more)
 ### Community 4 - "Series Acquisition Tests"
 Cohesion: 0.07
 Nodes (103): bookmarkNewKaganeSeries(), bookmarkNewNovelfullSeries(), bookmarkNewSeries(), Context, Store, T, newAcquirer(), readBookmark() (+95 more)
 ### Community 5 - "Bookmarks API Tests"
 Cohesion: 0.11
 Nodes (54): auth(), getBookmarks(), Handler, Request, Store, T, newTestServer(), newTestStore() (+46 more)
 ### Community 7 - "Cover & Acquire Internals"
 Cohesion: 0.08
 Nodes (31): fakeLanes, Context, Store, WaitGroup, isInterstitial(), fetchCoverBytes(), browserWakeDue(), fetcherFor() (+23 more)
 ### Community 8 - "System Architecture Concepts"
 Cohesion: 0.15
 Nodes (15): Confirm Row (Archive/Finish/Remove), card.html — Series Card Template, htmx /ui/* Mutation Endpoints, chrome.html — Out-of-Band Regions, Action Key, Brand Mark SVG, Continue Reading Strip, icons.html — Icon Sprite Template (+7 more)
 ### Community 9 - "Session Middleware"
 Cohesion: 0.08
 Nodes (35): ClearCookie(), ClientIP(), Duration, Mutex, Request, ResponseWriter, Time, isHTTPS() (+27 more)
 ### Community 10 - "Go Test Helpers"
 Cohesion: 0.05
 Nodes (39): Test Helpers, Test Timeout, Basic Handler Test, HTTP Handler Testing, Query Parameters and Headers, Docker Compose Fixture, Integration Testing, SQL Schema Fixture (+31 more)
 ### Community 11 - "Store Tests"
 Cohesion: 0.07
 Nodes (81): M, TestMain(), M, TestMain(), M, Main(), start(), URL() (+73 more)
 ### Community 12 - "Bookmarks API Handler"
 Cohesion: 0.08
 Nodes (32): Handler, Request, ResponseWriter, Store, Healthz(), writeJSON(), Auth(), compressible() (+24 more)
 ### Community 13 - "displayChapter"
 Cohesion: 0.09
 Nodes (36): Addr, Config, NewBrowserFetcher(), defaultCoverResolver(), Client, Context, NewCoverFetcher(), NewCoverFetcherWithResolver() (+28 more)
 ### Community 14 - "Go Error Handling"
 Cohesion: 0.06
 Nodes (33): Creating Errors, Custom Error Types, Custom types that wrap other errors, Decision table: which error strategy to use, Error Creation, Error String Conventions, Errors as Values, `errors.New` — static error messages (+25 more)
 ### Community 16 - "Cloudflare bot scoring and poll cadence — what is actually documented"
 Cohesion: 0.06
 Nodes (33): 1.1 The score itself, 1.2 The detection engines (Enterprise Bot Management), 1.3 Rate limiting is a separate product, 1. What a bot score is and what feeds it, 2.1 What each plan gets, 2.2 Bot Fight Mode specifics (the Free-plan product), 2.3 Does the free tier "score" continuously?, 2. The free-plan reality (+25 more)
 ### Community 17 - "Go Code Style Guide"
 Cohesion: 0.08
 Nodes (23): Code Style Details, Extract Complex Conditions, Value vs Pointer Arguments, Code Organization Within Files, Complex Conditions & Init Scope, Composite Literals, Control Flow, Cross-References (+15 more)
 ### Community 19 - "Store"
 Cohesion: 0.33
 Nodes (5): ADR-0010: Poll Lanes — one independent Poll stream per Site, Constraints preserved, Decision, Tradeoffs and rejections, Why
 ### Community 20 - "I/O Performance Patterns"
 Cohesion: 0.11
 Nodes (18): Avoid io.ReadAll for large payloads, Batch Operations, Buffered I/O, Cgo Overhead, Channel: batch processing from a stream, Concurrent Multi-Stage Pipelines, Connection pooling, Database: batch inserts over row-by-row (+10 more)
 ### Community 21 - "CPU Optimization"
 Cohesion: 0.13
 Nodes (15): Cache Locality, Contiguous 2D allocation, CPU Optimization, False Sharing, Function Inlining, Handling CPU-specific instruction sets, Instruction-Level Parallelism, Monotonic Time (+7 more)
 ### Community 22 - "Caching Patterns"
 Cohesion: 0.13
 Nodes (14): Algorithmic Complexity, Avoid iterator chains, Caching Patterns, Compiled Pattern Caching, Early returns and short-circuit loops, LRU caches, Map lookups over slice scanning, Precomputed lookup tables (+6 more)
 ### Community 23 - "Browser Entrypoint"
 Cohesion: 0.35
 Nodes (14): browser_alive(), connection(), connection_signal(), finish_connection(), has_connections(), lock(), reaper(), entrypoint.sh script (+6 more)
 ### Community 24 - "Memory Allocation & GC"
 Cohesion: 0.13
 Nodes (15): Allocation Rate Reduction, Ballast pattern (pre-Go 1.19), Garbage Collector Tuning, GC pacing, GC Profiling and Diagnostics, GODEBUG=gctrace=1, GOGC (default: 100), GOMAXPROCS in Containers (+7 more)
 ### Community 25 - "Cover Fetcher Tests"
 Cohesion: 0.33
 Nodes (12): coverResponse(), Request, T, TestCoverFetcherCanonicalisesJpgAlias(), TestCoverFetcherFetchesPublicHTTPSImage(), TestCoverFetcherRefusesUnsafeDestinationsBeforeRequest(), TestCoverFetcherRejectsNonImage(), TestCoverFetcherRejectsOversizedBody() (+4 more)
 ### Community 26 - "Open"
 Cohesion: 0.06
 Nodes (57): awaitPromise(), browserConnectionLost(), classifyBrowserError(), comixRead(), comixSeriesPageURL(), Action, Context, Mutex (+49 more)
 ### Community 27 - "Find Skills Guide"
 Cohesion: 0.14
 Nodes (13): Common Skill Categories, Find Skills, How to Help Users Find Skills, Step 1: Understand What They Need, Step 2: Check the Leaderboard First, Step 3: Search for Skills, Step 4: Verify Quality Before Recommending, Step 5: Present Options to the User (+5 more)
 ### Community 28 - "Allocation Patterns"
 Cohesion: 0.14
 Nodes (14): Allocation Patterns, Backing Array Leaks, Direct indexing vs append, Eliminate redundant map lookups, Interface boxing, Map never shrinks, Map size hints, Memory Optimization (+6 more)
 ### Community 29 - "Observability & Alerting"
 Cohesion: 0.22
 Nodes (9): Alerting rules (examples), CPU saturation, GC pressure, Goroutine leaks, Grafana Dashboards, Memory leaks, Prometheus Metrics for Go, PromQL Queries for Performance Diagnosis (+1 more)
 ### Community 30 - "AGENTS.md"
 Cohesion: 0.40
 Nodes (5): Map of pointers for large, frequently updated structs, Memory Layout, Pointer receivers for large structs, Struct field alignment, Zero-size field at end of struct
 ### Community 33 - "Go Testing Guide"
 Cohesion: 0.20
 Nodes (10): CI Regression Detection, Common Mistakes, Core Philosophy, Cross-References, Decision Tree: Where Is Time Spent?, Deep Dives, Go Performance Optimization, Iterative Optimization Methodology (+2 more)
 ### Community 34 - "Session Store"
 Cohesion: 0.28
 Nodes (4): Duration, Store, Time, Session
 ### Community 35 - "Web UI Filter Logic"
 Cohesion: 0.31
 Nodes (5): closeCardPanels(), setActiveTab(), toggleChapterForm(), toggleConfirmRow(), togglePanel()
 ### Community 37 - "Product & Security Context"
 Cohesion: 0.17
 Nodes (11): Accessibility & Inclusion, Brand Commitments, Capabilities and Constraints, Evidence on Hand, Operating Context, Platform, Positioning, Product (+3 more)
 ### Community 38 - "novel-logic.test.js"
 Cohesion: 0.33
 Nodes (5): ADR-0009: A Site answers fixed questions; an unusual Site owns its own fetch, Consequences, Considered options, Decision, Why
 ### Community 39 - "UI Critique 2026-07-26A"
 Cohesion: 0.29
 Nodes (6): Design Health Score, Design Specificity Verdict, Minor Observations, Persona Red Flags, Priority Issues, Questions to Consider
 ### Community 40 - "UI Critique 2026-07-26B"
 Cohesion: 0.29
 Nodes (6): Design Health Score, Design Specificity Verdict, Minor Observations, Persona Red Flags, Priority Issues, Questions to Consider
 ### Community 41 - "Handler"
 Cohesion: 0.05
 Nodes (25): coverRelativePath(), coverSourceAddress(), displayChapter(), Store, scanSeries(), currentLib(), currentTab(), filterBookmarks() (+17 more)
 ### Community 45 - "Go Perf Alert Rules"
 Cohesion: 0.50
 Nodes (4): Prometheus Alerting Rules (Go Performance), GoroutineLeak Alert, HighGCPauseTime Alert, MemoryNearLimit Alert
 ### Community 46 - "Userscript Display Logic"
 Cohesion: 0.07
 Nodes (27): 1. Summary answer table, 2. The two reference pages, 3. Chapter page → series URL: every in-page pointer, in priority order, 4.1 Sample method, 4.2 Divergence results, 4.3 Is there a derivable rule? **No.**, 4.4 The split case — a slug can change *mid-series*, 4. The reverse direction, and how common divergence is (+19 more)
 ### Community 47 - "Go Perf Skill Docs"
 Cohesion: 0.22
 Nodes (5): Continuous Profiling, Production Observability for Performance, Pyroscope pull mode (via Grafana Alloy), Pyroscope push mode, Real-Time Visualization (Development)
 ### Community 48 - "Login Page Art"
 Cohesion: 0.67
 Nodes (3): Fantasy Sword, Fiery Volcanic Scene, Login Art: Sword in Volcanic Rock
 ### Community 49 - "BookmarkManager Logo"
 Cohesion: 1.00
 Nodes (3): Mirrored Double Bookmark Mark, Ember Flame Accent, BookmarkManager Logo
 ### Community 103 - "bookmark-api Service"
 Cohesion: 0.32
 Nodes (8): Browser Sidecar Service, CDP Endpoint (Tailnet-Bound :9222), Persistent Chrome Profile Volume, chrome/docker-compose.yml — Browser Deployable Unit, bookmark-api Prod Override, CDP Never on Shared Proxy Network, docker-compose.prod.yml — Production Override, Traefik Reverse Proxy Labels
 ### Community 104 - "AGENTS.md"
 Cohesion: 0.12
 Nodes (14): Agent skills, Architecture, Commands, Comments, Design system, Domain docs, Forge: Gitea, not GitHub, graphify (+6 more)
 ### Community 105 - "reviewer.md"
 Cohesion: 0.12
 Nodes (15): Assessment, Calibration, Critical (Must Fix), Do Not Trust the Report, Important (Should Fix), Inputs, Issues, Method (+7 more)
 ### Community 106 - "Redeploy runbook"
 Cohesion: 0.12
 Nodes (15): 0. Preflight, 1. Back up the database, 2. Pull the new code, 3. Rebuild and restart, 4. Verify the deploy, 5. Smoke-test the full loop, 6. Rollback, 7. The whole thing, as one block (+7 more)
 ### Community 107 - "1. Backend"
 Cohesion: 0.13
 Nodes (14): 1. Backend, 2. Userscript, Adapter reference (verified live 2026-07-24), Config (env), Deploy behind your reverse proxy, Desktop iteration (optional), Develop / test, Endpoints (+6 more)
 ### Community 108 - "Deployment"
 Cohesion: 0.14
 Nodes (13): 0. Prerequisites, 1. Configure `.env`, 1b. Web UI, 2. Build + start, 3. Verify over HTTPS, 4. Configure the userscript, 5. Install on Bromite, 6. Smoke-test the full loop (+5 more)
 ### Community 109 - "Cinder — BookmarkManager design system"
 Cohesion: 0.20
 Nodes (9): 1. The one idea, 2. Tokens, 3. Type, 4. Components (web UI), 5. Components (userscript panel), 6. Motion, 7. Accessibility floor (not negotiable), 8. Adding something new — checklist (+1 more)
 ### Community 110 - "Implement tickets"
 Cohesion: 0.22
 Nodes (8): 1. Collect the tickets, 2. Plan the batch, 3. Get the plan approved, 4. Run a wave, 5. Land the wave, 6. Close the batch, Implement tickets, Ticket #<n> — <title>
 ### Community 111 - "SQLite → Postgres cutover runbook"
 Cohesion: 0.22
 Nodes (8): 0. The generator is throwaway, 1. Stop the old API and take a fresh export, 2. Bring up Postgres with the schema and the owner Reader, 3. Generate the import SQL, 4. Review it by eye, 5. Apply it, 6. Afterwards, SQLite → Postgres cutover runbook
 ### Community 112 - "Testing the userscript"
 Cohesion: 0.29
 Nodes (6): Adding a test, Commands, Gotchas, How the harness works, Testing the userscript, What is NOT testable here
 ### Community 113 - "ADR-0007: The backend hosts every Site's Cover bytes"
 Cohesion: 0.29
 Nodes (6): ADR-0007: The backend hosts every Site's Cover bytes, Consequences, Considered options, Decision, Two deliberate relaxations, Why a future reader will find this surprising
 ### Community 114 - "Issue tracker: Gitea (`tea` CLI)"
 Cohesion: 0.29
 Nodes (6): Conventions, Issue tracker: Gitea (`tea` CLI), Pull requests as a triage surface, Wayfinding operations, When a skill says "fetch the relevant ticket", When a skill says "publish to the issue tracker"
 ### Community 115 - "ADR-0006: The browser runs on the home machine, over the tailnet"
 Cohesion: 0.33
 Nodes (5): ADR-0006: The browser runs on the home machine, over the tailnet, Consequences, Constraints, Decision, Why
 ### Community 116 - "ADR-0008: A Series identity is discovered from the Site's links, never derived from an address"
 Cohesion: 0.33
 Nodes (5): ADR-0008: A Series identity is discovered from the Site's links, never derived from an address, Consequences, Considered options, Decision, Why
 ### Community 117 - "Domain Docs"
 Cohesion: 0.33
 Nodes (5): Before exploring, read these, Domain Docs, File structure, Flag ADR conflicts, Use the glossary's vocabulary
 ### Community 118 - "ticket-implementer.md"
 Cohesion: 0.33
 Nodes (5): Escalate rather than guess, Order of work, Report, Review, The worktree is your whole world
 ### Community 119 - "implementer.md"
 Cohesion: 0.33
 Nodes (5): Before You Begin, Report Format, Self-Review Before Reporting, When You're in Over Your Head, Your Job
 ### Community 120 - "Series is a shared entity, and only the Poll may update it"
 Cohesion: 0.40
 Nodes (4): Consequences, Only the Poll writes Series fields, Series is a shared entity, and only the Poll may update it, Why
 ### Community 121 - "Postgres replaces SQLite as the primary datastore"
 Cohesion: 0.50
 Nodes (3): Consequences, Considered options, Postgres replaces SQLite as the primary datastore
 ### Community 122 - "Identity comes from Discord OAuth; we store no passwords and send no email"
 Cohesion: 0.50
 Nodes (3): Consequences, Considered options, Identity comes from Discord OAuth; we store no passwords and send no email
 ### Community 123 - "The wire format stays flat and deliberately does not mirror the schema"
 Cohesion: 0.50
 Nodes (3): Consequence, The wire format stays flat and deliberately does not mirror the schema, Why a future reader will find this surprising
 ### Community 124 - "ADR-0005: On-demand browser sidecar"
 Cohesion: 0.50
 Nodes (3): ADR-0005: On-demand browser sidecar, Constraints, Decision
 ### Community 154 - "ADR-0011: Sightings — a Reader report defers a Poll where being wrong hurts only them"
 Cohesion: 0.33
 Nodes (5): ADR-0011: Sightings — a Reader report defers a Poll where being wrong hurts only them, Constraints preserved, Decision, Tradeoffs and rejections, Why
 ### Community 156 - "ResponseWriter"
 Cohesion: 0.18
 Nodes (13): AdminPatterns(), HandlerFunc, Request, ResponseWriter, Time, Handler, readerPathID(), since() (+5 more)
 ### Community 273 - "AGENTS.md"
 Cohesion: 0.50
 Nodes (3): Live URL shapes (verified 2026-07-26, may drift — re-check against live pages before trust), Second script: `novel-bookmark.user.js`, Userscript structure (single IIFE, `manga-bookmark.user.js`)
 ## Knowledge Gaps
 - **524 isolated node(s):** `bookmarkmanager/backend`, `ctxKey`, `loginView`, `ctxKey`, `test` (+519 more)
  These have ≤1 connection - possible missing edges or undocumented components.
 - **150 thin communities (<3 nodes) omitted from report** — run `graphify query` to explore isolated nodes.
 ## Suggested Questions
 _Questions this graph is uniquely positioned to answer:_
 - **Why does `Open()` connect `Store Tests` to `Cover Fetch Test Helpers`, `Series Acquisition Tests`, `Bookmarks API Tests`, `Handler`, `displayChapter`?**
  _High betweenness centrality (0.057) - this node is a cross-community bridge._
 - **Why does `New()` connect `Series Acquisition Tests` to `Bookmarks API Tests`, `Cover & Acquire Internals`, `Handler`, `Session Middleware`, `Store Tests`, `displayChapter`, `ResponseWriter`?**
  _High betweenness centrality (0.051) - this node is a cross-community bridge._
 - **Why does `newRouter()` connect `Bookmarks API Tests` to `Cover Fetch Test Helpers`, `Series Acquisition Tests`, `Bookmarks API Handler`, `displayChapter`, `ResponseWriter`?**
  _High betweenness centrality (0.031) - this node is a cross-community bridge._
 - **Are the 25 inferred relationships involving `newTestStore()` (e.g. with `TestAcquireDoesNotBlockTheWrite()` and `TestAcquireFailureLeavesTheBookmarkIntact()`) actually correct?**
  _`newTestStore()` has 25 INFERRED edges - model-reasoned connections that need verification._
 - **Are the 48 inferred relationships involving `testConfig()` (e.g. with `TestListRendersAcquiredCover()` and `TestPublicCoverNeverEchoesNonImage()`) actually correct?**
  _`testConfig()` has 48 INFERRED edges - model-reasoned connections that need verification._
 - **Are the 8 inferred relationships involving `newWebTestServer()` (e.g. with `TestListRendersAcquiredCover()` and `TestPublicCoverRejectsUnknownAddress()`) actually correct?**
  _`newWebTestServer()` has 8 INFERRED edges - model-reasoned connections that need verification._
 - **What connects `bookmarkmanager/backend`, `ctxKey`, `loginView` to the rest of the system?**
  _556 weakly-connected nodes found - possible documentation gaps or missing edges._
@@ -1,677 +0,0 @@
 {
  ".agents/skills/golang-code-style/evals/evals.json": {
    "mtime": 1784884678.6627614,
    "ast_hash": "bec0e12446e7af3cd05de9b6d42badd8",
    "semantic_hash": "bec0e12446e7af3cd05de9b6d42badd8"
  },
  ".agents/skills/golang-error-handling/evals/evals.json": {
    "mtime": 1784884678.6655047,
    "ast_hash": "275d710b774fba1e1d0bc098d3646c6d",
    "semantic_hash": "275d710b774fba1e1d0bc098d3646c6d"
  },
  ".agents/skills/golang-performance/evals/evals.json": {
    "mtime": 1784884678.6688662,
    "ast_hash": "4f06df87f90aa0e4f6deaa318b47689f",
    "semantic_hash": "4f06df87f90aa0e4f6deaa318b47689f"
  },
  ".agents/skills/golang-testing/evals/evals.json": {
    "mtime": 1784884678.6721346,
    "ast_hash": "60a821bbfd20c6fe8bba996b8b540dd4",
    "semantic_hash": "60a821bbfd20c6fe8bba996b8b540dd4"
  },
  "backend/go.mod": {
    "mtime": 1786216141.668644,
    "ast_hash": "dac242903b0e98c3e4395159d609e08e",
    "semantic_hash": "dac242903b0e98c3e4395159d609e08e"
  },
  "backend/main.go": {
    "mtime": 1786886056.023822,
    "ast_hash": "d5a50b03438d7c120079d40cc578462b",
    "semantic_hash": ""
  },
  "skills-lock.json": {
    "mtime": 1784884678.6842625,
    "ast_hash": "4a94ac85bad6bce330d085bcc0ae3ffd",
    "semantic_hash": "4a94ac85bad6bce330d085bcc0ae3ffd"
  },
  "userscript/manga-bookmark.user.js": {
    "mtime": 1786886056.0389624,
    "ast_hash": "4e79684942234b26f4a1fb03fccd6d35",
    "semantic_hash": ""
  },
  ".agents/skills/find-skills/SKILL.md": {
    "mtime": 1784884338.760326,
    "ast_hash": "62b297abdee9aea84c577ab2e04e1974",
    "semantic_hash": "62b297abdee9aea84c577ab2e04e1974"
  },
  ".agents/skills/golang-code-style/SKILL.md": {
    "mtime": 1784884678.6623824,
    "ast_hash": "d6a01e6f64550a5c8d59dac2e948000e",
    "semantic_hash": "d6a01e6f64550a5c8d59dac2e948000e"
  },
  ".agents/skills/golang-code-style/references/details.md": {
    "mtime": 1784884678.6627865,
    "ast_hash": "19891e396a986f1b24bf34b7a2854fcb",
    "semantic_hash": "19891e396a986f1b24bf34b7a2854fcb"
  },
  ".agents/skills/golang-error-handling/SKILL.md": {
    "mtime": 1784884678.665052,
    "ast_hash": "8b7970f472adb240e5bc4bde863d43a6",
    "semantic_hash": "8b7970f472adb240e5bc4bde863d43a6"
  },
  ".agents/skills/golang-error-handling/references/error-creation.md": {
    "mtime": 1784884678.665524,
    "ast_hash": "248dbf75492c68faef2334b8d83bd080",
    "semantic_hash": "248dbf75492c68faef2334b8d83bd080"
  },
  ".agents/skills/golang-error-handling/references/error-handling.md": {
    "mtime": 1784884678.6655412,
    "ast_hash": "c2424ee3999b05963b199e0100727aa3",
    "semantic_hash": "c2424ee3999b05963b199e0100727aa3"
  },
  ".agents/skills/golang-error-handling/references/error-wrapping.md": {
    "mtime": 1784884678.6655717,
    "ast_hash": "4a15d9266a1ea0c8bb1951e6b9c0f586",
    "semantic_hash": "4a15d9266a1ea0c8bb1951e6b9c0f586"
  },
  ".agents/skills/golang-performance/SKILL.md": {
    "mtime": 1784884678.667833,
    "ast_hash": "35a15fd129c5bedaada3fd4df0b6ba8c",
    "semantic_hash": "35a15fd129c5bedaada3fd4df0b6ba8c"
  },
  ".agents/skills/golang-performance/assets/prometheus-alerts.yml": {
    "mtime": 1784884678.668527,
    "ast_hash": "fa9357ffa87c4f894fc21afa9707c4db",
    "semantic_hash": "fa9357ffa87c4f894fc21afa9707c4db"
  },
  ".agents/skills/golang-performance/references/caching.md": {
    "mtime": 1784884678.6690567,
    "ast_hash": "807c42a82994e5548dbf7eb6e30c71e0",
    "semantic_hash": "807c42a82994e5548dbf7eb6e30c71e0"
  },
  ".agents/skills/golang-performance/references/cpu.md": {
    "mtime": 1784884678.669087,
    "ast_hash": "6d52e532ef51a35cc4134694c944517d",
    "semantic_hash": "6d52e532ef51a35cc4134694c944517d"
  },
  ".agents/skills/golang-performance/references/io-networking.md": {
    "mtime": 1784884678.6691036,
    "ast_hash": "95c5dd51f728fd69c945a92ff021d766",
    "semantic_hash": "95c5dd51f728fd69c945a92ff021d766"
  },
  ".agents/skills/golang-performance/references/memory.md": {
    "mtime": 1784884678.6691158,
    "ast_hash": "3b2108df06b4cfb3980fa80bbd9ebcff",
    "semantic_hash": "3b2108df06b4cfb3980fa80bbd9ebcff"
  },
  ".agents/skills/golang-performance/references/observability.md": {
    "mtime": 1784884678.6691446,
    "ast_hash": "0aa8a498e8d55ccdd4990ad187bae828",
    "semantic_hash": "0aa8a498e8d55ccdd4990ad187bae828"
  },
  ".agents/skills/golang-performance/references/runtime.md": {
    "mtime": 1784884678.669426,
    "ast_hash": "26386c33b3a3794aaef0556713bf8f3a",
    "semantic_hash": "26386c33b3a3794aaef0556713bf8f3a"
  },
  ".agents/skills/golang-testing/SKILL.md": {
    "mtime": 1784884678.6716368,
    "ast_hash": "0a9b9793bba2a239db94e980272a393e",
    "semantic_hash": "0a9b9793bba2a239db94e980272a393e"
  },
  ".agents/skills/golang-testing/references/helpers.md": {
    "mtime": 1784884678.6722167,
    "ast_hash": "0aecb7cfbeb9b374bf61c52e324d9d3f",
    "semantic_hash": "0aecb7cfbeb9b374bf61c52e324d9d3f"
  },
  ".agents/skills/golang-testing/references/http-testing.md": {
    "mtime": 1784884678.67225,
    "ast_hash": "9111110c28a7fbbffc3537aad786b390",
    "semantic_hash": "9111110c28a7fbbffc3537aad786b390"
  },
  ".agents/skills/golang-testing/references/integration-testing.md": {
    "mtime": 1784884678.67225,
    "ast_hash": "fcf9861bc36ae56e3fb7a1c18aa0e77f",
    "semantic_hash": "fcf9861bc36ae56e3fb7a1c18aa0e77f"
  },
  ".agents/skills/golang-testing/references/mocking.md": {
    "mtime": 1784884678.6722653,
    "ast_hash": "3a08979e4603aae5c32a58d5b6c39765",
    "semantic_hash": "3a08979e4603aae5c32a58d5b6c39765"
  },
  "CLAUDE.md": {
    "mtime": 1786857336.6414917,
    "ast_hash": "c79e49f912d7852f9832565a5f9a1c39",
    "semantic_hash": ""
  },
  "DEPLOY.md": {
    "mtime": 1786861012.026504,
    "ast_hash": "b7c2f813aded562ee9291c9baed795ad",
    "semantic_hash": ""
  },
  "README.md": {
    "mtime": 1786861012.026504,
    "ast_hash": "81af12a0a2d43e791efd030b5f4d6cbc",
    "semantic_hash": ""
  },
  "docker-compose.prod.yml": {
    "mtime": 1786292465.8305523,
    "ast_hash": "0751998a532297b8ac507a01ec48dc31",
    "semantic_hash": "0751998a532297b8ac507a01ec48dc31"
  },
  "docker-compose.yml": {
    "mtime": 1786861012.026504,
    "ast_hash": "d3b53a8f42a8e0acb4fc4306ea42c093",
    "semantic_hash": ""
  },
  ".claude/settings.json": {
    "mtime": 1784951973.1869545,
    "ast_hash": "e51077b6a7f1f67afc748f1a32a1557d",
    "semantic_hash": "e51077b6a7f1f67afc748f1a32a1557d"
  },
  "backend/web_test.go": {
    "mtime": 1786891437.925184,
    "ast_hash": "74aed7f5a5b196d2b860cd6a34266ec6",
    "semantic_hash": ""
  },
  "backend/main_test.go": {
    "mtime": 1786863966.7091317,
    "ast_hash": "0a5d4dbdc770b40c329ccccc899b59f4",
    "semantic_hash": ""
  },
  ".claude/settings.local.json": {
    "mtime": 1785697645.350201,
    "ast_hash": "9a1ac6369f968e8df4be9dcff0948f70",
    "semantic_hash": "9a1ac6369f968e8df4be9dcff0948f70"
  },
  "PRODUCT.md": {
    "mtime": 1786216141.660644,
    "ast_hash": "c52072d1978286060087fa0686f9c7f9",
    "semantic_hash": "c52072d1978286060087fa0686f9c7f9"
  },
  "backend/.impeccable/critique/2026-07-26T15-50-42Z__backend-templates-app-html.md": {
    "mtime": 1785128576.2412457,
    "ast_hash": "d08627c27f22d453125db6c1ab4b71ec",
    "semantic_hash": "d08627c27f22d453125db6c1ab4b71ec"
  },
  "backend/.impeccable/critique/2026-07-26T17-08-41Z__backend-templates-app-html.md": {
    "mtime": 1785128576.2452524,
    "ast_hash": "e69a8340a371579ca3ea689660f7d7bd",
    "semantic_hash": "e69a8340a371579ca3ea689660f7d7bd"
  },
  "AGENTS.md": {
    "mtime": 1786857336.6414917,
    "ast_hash": "c79e49f912d7852f9832565a5f9a1c39",
    "semantic_hash": ""
  },
  "userscript/test/logic.test.js": {
    "mtime": 1786499529.779988,
    "ast_hash": "80d512bfe6fa8b847f3ba6169c321a74",
    "semantic_hash": ""
  },
  ".claude/skills/testing-the-userscript/SKILL.md": {
    "mtime": 1786363889.5489495,
    "ast_hash": "8f3c0132eb4787a2c8736eb99f7689af",
    "semantic_hash": "8f3c0132eb4787a2c8736eb99f7689af"
  },
  "REDEPLOY.md": {
    "mtime": 1786857336.6414917,
    "ast_hash": "e5e910f0244a040e2ccdc669b17eb4db",
    "semantic_hash": ""
  },
  "docs/design-system.md": {
    "mtime": 1786886056.0313923,
    "ast_hash": "3bd39932997c8e245508874194db4e49",
    "semantic_hash": ""
  },
  "backend/api_test.go": {
    "mtime": 1786886056.016252,
    "ast_hash": "b64372df5429fb14e48b37b3bab10402",
    "semantic_hash": ""
  },
  "backend/cover_test.go": {
    "mtime": 1786886056.016252,
    "ast_hash": "fd6b3f6ef46bd17b0241d104b6e5bdf6",
    "semantic_hash": ""
  },
  "backend/internal/api/handlers.go": {
    "mtime": 1786886056.016252,
    "ast_hash": "ae4f3b961450f06a06e0632eb273a5b2",
    "semantic_hash": ""
  },
  "backend/internal/httpmw/middleware.go": {
    "mtime": 1786216141.672644,
    "ast_hash": "385b36f58488b7e6d93eb6d6034e9ee3",
    "semantic_hash": "385b36f58488b7e6d93eb6d6034e9ee3"
  },
  "backend/internal/latest/browser.go": {
    "mtime": 1786889854.5578685,
    "ast_hash": "b65f3693db77c69ef0a6247fd75118bc",
    "semantic_hash": ""
  },
  "backend/internal/latest/browser_test.go": {
    "mtime": 1786889854.5578685,
    "ast_hash": "118aba3d794b9faf893c45e58298e11a",
    "semantic_hash": ""
  },
  "backend/internal/latest/fetch.go": {
    "mtime": 1786499529.7688599,
    "ast_hash": "3e20ad86aa46783e9aa95c2b746551ee",
    "semantic_hash": ""
  },
  "backend/internal/latest/poller.go": {
    "mtime": 1786891405.415882,
    "ast_hash": "54f6eec9d2090c7713f502c8553063a2",
    "semantic_hash": ""
  },
  "backend/internal/latest/poller_test.go": {
    "mtime": 1786891462.5665002,
    "ast_hash": "512806a9c6e15036a75f01bf5577c20b",
    "semantic_hash": ""
  },
  "backend/internal/latest/sites.go": {
    "mtime": 1786886056.0200372,
    "ast_hash": "5786000dd0dfd5b4b3bd2b87b1fc100b",
    "semantic_hash": ""
  },
  "backend/internal/latest/sites_test.go": {
    "mtime": 1786857336.6414917,
    "ast_hash": "0db2028a6073f342fee61ad15c2e5f0f",
    "semantic_hash": ""
  },
  "backend/internal/latest/smoke_image_test.go": {
    "mtime": 1786363889.5602942,
    "ast_hash": "db068cb59575f8c82669acbaf84bcaed",
    "semantic_hash": "db068cb59575f8c82669acbaf84bcaed"
  },
  "backend/internal/pgtest/pgtest.go": {
    "mtime": 1786216141.6766438,
    "ast_hash": "f60372d41516e66f7aaeb272da227d6e",
    "semantic_hash": "f60372d41516e66f7aaeb272da227d6e"
  },
  "backend/internal/session/session.go": {
    "mtime": 1786216141.6766438,
    "ast_hash": "9952474ffb22c825d6f075b866ee26f4",
    "semantic_hash": "9952474ffb22c825d6f075b866ee26f4"
  },
  "backend/internal/session/session_test.go": {
    "mtime": 1786216141.680644,
    "ast_hash": "37ffd00964e7a67350c68ed50c6503c5",
    "semantic_hash": "37ffd00964e7a67350c68ed50c6503c5"
  },
  "backend/internal/store/migrations/0001_bookmarks.sql": {
    "mtime": 1786216141.680644,
    "ast_hash": "f87ccfb2c25c43f93021177ced0bfae4",
    "semantic_hash": "f87ccfb2c25c43f93021177ced0bfae4"
  },
  "backend/internal/store/migrations/0002_series.sql": {
    "mtime": 1786216141.6820722,
    "ast_hash": "5dc98771e0c0f6e8416b434c280b0efb",
    "semantic_hash": "5dc98771e0c0f6e8416b434c280b0efb"
  },
  "backend/internal/store/migrations/0003_reader.sql": {
    "mtime": 1786216141.6820722,
    "ast_hash": "444a97799f38f6222f87d4e9fb2d6258",
    "semantic_hash": "444a97799f38f6222f87d4e9fb2d6258"
  },
  "backend/internal/store/migrations/0004_owner_bookmarks.sql": {
    "mtime": 1786216141.684644,
    "ast_hash": "e4fa900cc223865d3ecd4c60c5707a65",
    "semantic_hash": "e4fa900cc223865d3ecd4c60c5707a65"
  },
  "backend/internal/store/migrations/0005_sessions.sql": {
    "mtime": 1786216141.684644,
    "ast_hash": "5158887ebc57cf8c16a7b821b61cd760",
    "semantic_hash": "5158887ebc57cf8c16a7b821b61cd760"
  },
  "backend/internal/store/migrations/0006_reader_token_epoch.sql": {
    "mtime": 1786216141.684644,
    "ast_hash": "3093cc1c3aae0cd9643d04105d045402",
    "semantic_hash": "3093cc1c3aae0cd9643d04105d045402"
  },
  "backend/internal/store/sessions.go": {
    "mtime": 1786216141.684644,
    "ast_hash": "eee3510cc6172ef4b1da820474c26b01",
    "semantic_hash": "eee3510cc6172ef4b1da820474c26b01"
  },
  "backend/internal/store/sessions_test.go": {
    "mtime": 1786216141.684644,
    "ast_hash": "0b6764a0ee20f5cb7748eecd31a1d220",
    "semantic_hash": "0b6764a0ee20f5cb7748eecd31a1d220"
  },
  "backend/internal/store/store.go": {
    "mtime": 1786886056.0200372,
    "ast_hash": "34f55617b7409f03f02e925bec92fac0",
    "semantic_hash": ""
  },
  "backend/internal/store/store_test.go": {
    "mtime": 1786886056.0200372,
    "ast_hash": "16f69d97eb63bcec7409294466642411",
    "semantic_hash": ""
  },
  "backend/internal/userscript/userscript.go": {
    "mtime": 1786216141.692644,
    "ast_hash": "aa13a71b1c9eefe4930fd31f27722328",
    "semantic_hash": "aa13a71b1c9eefe4930fd31f27722328"
  },
  "backend/internal/userscript/userscript_test.go": {
    "mtime": 1786216141.692644,
    "ast_hash": "6c050968d7b8b67956da1a3136d2c3c7",
    "semantic_hash": "6c050968d7b8b67956da1a3136d2c3c7"
  },
  "backend/internal/web/discord.go": {
    "mtime": 1786216141.692644,
    "ast_hash": "69e4959c65fa67d7491aedf6a71bb575",
    "semantic_hash": "69e4959c65fa67d7491aedf6a71bb575"
  },
  "backend/internal/web/oauth_test.go": {
    "mtime": 1786216141.692644,
    "ast_hash": "a3bddeb70dd8d7eb14139da808723ea8",
    "semantic_hash": "a3bddeb70dd8d7eb14139da808723ea8"
  },
  "backend/internal/web/static/filter.js": {
    "mtime": 1786022513.9473197,
    "ast_hash": "b4ee3306201bfd88b148b96801972617",
    "semantic_hash": "b4ee3306201bfd88b148b96801972617"
  },
  "backend/internal/web/static/htmx.min.js": {
    "mtime": 1785873769.5512016,
    "ast_hash": "19a573773be4ca22570ca2f8543120c5",
    "semantic_hash": "19a573773be4ca22570ca2f8543120c5"
  },
  "backend/internal/web/web.go": {
    "mtime": 1786886056.023822,
    "ast_hash": "b051f2de214c4b253ee09fbbdb8ebb60",
    "semantic_hash": ""
  },
  "backend/reader_credential_test.go": {
    "mtime": 1786886056.023822,
    "ast_hash": "0c93de387af595901c43b6bdb3bed8cc",
    "semantic_hash": ""
  },
  "chrome/entrypoint.sh": {
    "mtime": 1786363889.5678573,
    "ast_hash": "8008a187690764436540fab47ba0cfcc",
    "semantic_hash": "8008a187690764436540fab47ba0cfcc"
  },
  "userscript/novel-bookmark.user.js": {
    "mtime": 1786886056.0389624,
    "ast_hash": "36c81462919719f0e053ca5d633a243a",
    "semantic_hash": ""
  },
  "userscript/test/novel-logic.test.js": {
    "mtime": 1786499529.779988,
    "ast_hash": "b25a7377af210dd0aff8284501fd0252",
    "semantic_hash": ""
  },
  ".opencode/agent/implementer.md": {
    "mtime": 1785873769.5402634,
    "ast_hash": "000de469c18d68352027e10c8ce8acfb",
    "semantic_hash": "000de469c18d68352027e10c8ce8acfb"
  },
  ".opencode/agent/reviewer.md": {
    "mtime": 1785873769.5416775,
    "ast_hash": "e44a2f6f624db044e19508bc5ab05592",
    "semantic_hash": "e44a2f6f624db044e19508bc5ab05592"
  },
  "CONTEXT.md": {
    "mtime": 1786861012.022683,
    "ast_hash": "4aafbce0b046e6e34734fb414df818ce",
    "semantic_hash": ""
  },
  "CUTOVER.md": {
    "mtime": 1786216141.660644,
    "ast_hash": "6c6f3e4c4c2f57867894280bce728c50",
    "semantic_hash": "6c6f3e4c4c2f57867894280bce728c50"
  },
  "backend/AGENTS.md": {
    "mtime": 1786891513.6486945,
    "ast_hash": "b4233ebc5ff905b701ded9427277ad8c",
    "semantic_hash": ""
  },
  "backend/CLAUDE.md": {
    "mtime": 1786891513.6486945,
    "ast_hash": "b4233ebc5ff905b701ded9427277ad8c",
    "semantic_hash": ""
  },
  "backend/internal/web/templates/app.html": {
    "mtime": 1786886056.023822,
    "ast_hash": "99d3e1139042d0eb61627155dddb3843",
    "semantic_hash": ""
  },
  "backend/internal/web/templates/card.html": {
    "mtime": 1786363889.5678573,
    "ast_hash": "ab83ae0dbb34fd40c146a7cc1263173e",
    "semantic_hash": "ab83ae0dbb34fd40c146a7cc1263173e"
  },
  "backend/internal/web/templates/chrome.html": {
    "mtime": 1786363889.5678573,
    "ast_hash": "d80b27cf3bd9d131075c485dd169dfcc",
    "semantic_hash": "d80b27cf3bd9d131075c485dd169dfcc"
  },
  "backend/internal/web/templates/icons.html": {
    "mtime": 1785873769.553139,
    "ast_hash": "8e10c507c32934a92463b4bca9e34fe6",
    "semantic_hash": "8e10c507c32934a92463b4bca9e34fe6"
  },
  "backend/internal/web/templates/list.html": {
    "mtime": 1786216141.696644,
    "ast_hash": "365548aace8c06559a1f66db0ae47256",
    "semantic_hash": "365548aace8c06559a1f66db0ae47256"
  },
  "backend/internal/web/templates/login.html": {
    "mtime": 1786216141.696644,
    "ast_hash": "bcc3101498a66cf8b79f9d97c6c9cd6b",
    "semantic_hash": "bcc3101498a66cf8b79f9d97c6c9cd6b"
  },
  "backend/internal/web/templates/readers.html": {
    "mtime": 1786886056.023822,
    "ast_hash": "2b1cbb24d6185e48561966db1af04ba4",
    "semantic_hash": ""
  },
  "backend/internal/web/templates/setup.html": {
    "mtime": 1786216141.696644,
    "ast_hash": "72e93c0b827414063596f7338987d879",
    "semantic_hash": "72e93c0b827414063596f7338987d879"
  },
  "docs/adr/0001-postgresql-over-sqlite.md": {
    "mtime": 1786216141.704644,
    "ast_hash": "abfb08754cee58be67311377904f8ca4",
    "semantic_hash": "abfb08754cee58be67311377904f8ca4"
  },
  "docs/adr/0002-discord-oauth-no-passwords-no-email.md": {
    "mtime": 1786216141.7071996,
    "ast_hash": "852a04d86659385085da6ffc8b489933",
    "semantic_hash": "852a04d86659385085da6ffc8b489933"
  },
  "docs/adr/0003-series-shared-and-poll-owned.md": {
    "mtime": 1786501942.7367291,
    "ast_hash": "6138b113340693e0cc667d1ecbb75f72",
    "semantic_hash": ""
  },
  "docs/adr/0004-wire-format-does-not-mirror-the-schema.md": {
    "mtime": 1786216141.7071996,
    "ast_hash": "a6ea2770dec2156f78a65b35ba06902a",
    "semantic_hash": "a6ea2770dec2156f78a65b35ba06902a"
  },
  "docs/agents/domain.md": {
    "mtime": 1786216141.7071996,
    "ast_hash": "6f99318ac6cb9825b613bfde55d76091",
    "semantic_hash": "6f99318ac6cb9825b613bfde55d76091"
  },
  "docs/agents/issue-tracker.md": {
    "mtime": 1786216141.7087462,
    "ast_hash": "1342e66ccb84a84fd579fb6dc0b8243a",
    "semantic_hash": "1342e66ccb84a84fd579fb6dc0b8243a"
  },
  "docs/agents/triage-labels.md": {
    "mtime": 1786216141.7087462,
    "ast_hash": "69114d07ed792d6bb1d13758ba5435e1",
    "semantic_hash": "69114d07ed792d6bb1d13758ba5435e1"
  },
  "userscript/AGENTS.md": {
    "mtime": 1786499529.7762787,
    "ast_hash": "e276ffe9a6e7b55fd3235466a1995c22",
    "semantic_hash": ""
  },
  "userscript/CLAUDE.md": {
    "mtime": 1786499529.7762787,
    "ast_hash": "e276ffe9a6e7b55fd3235466a1995c22",
    "semantic_hash": ""
  },
  "backend/internal/web/static/login-art.png": {
    "mtime": 1786022513.9585779,
    "ast_hash": "05d7863cba344a946256719a0c9ef959",
    "semantic_hash": "05d7863cba344a946256719a0c9ef959"
  },
  "backend/internal/web/static/logo.svg": {
    "mtime": 1786022513.9585779,
    "ast_hash": "d0d34d0f08a25b53176cc55989b7babe",
    "semantic_hash": "d0d34d0f08a25b53176cc55989b7babe"
  },
  "backend/internal/store/migrations/0007_covers.sql": {
    "mtime": 1786262323.6964688,
    "ast_hash": "6033ce0701be1236ed175362363bd96c",
    "semantic_hash": "6033ce0701be1236ed175362363bd96c"
  },
  "docs/adr/0005-on-demand-browser.md": {
    "mtime": 1786292465.8305523,
    "ast_hash": "8cf2fb8c0a66c2c7d82ae433b99ca42b",
    "semantic_hash": "8cf2fb8c0a66c2c7d82ae433b99ca42b"
  },
  "chrome/docker-compose.yml": {
    "mtime": 1786292465.8305523,
    "ast_hash": "5605599395a3f085904e78a2bfec1e58",
    "semantic_hash": "5605599395a3f085904e78a2bfec1e58"
  },
  "docs/adr/0006-browser-on-the-home-machine.md": {
    "mtime": 1786501942.7367291,
    "ast_hash": "bfcaf39b6c7e96610a7caa00eeb36533",
    "semantic_hash": ""
  },
  "docs/adr/0007-backend-hosts-cover-bytes.md": {
    "mtime": 1786292465.8305523,
    "ast_hash": "b19e38045b3dcda7dd59634ed9227a68",
    "semantic_hash": "b19e38045b3dcda7dd59634ed9227a68"
  },
  "backend/internal/store/migrations/0008_filesystem_covers.sql": {
    "mtime": 1786363889.5602942,
    "ast_hash": "46cf7822d4f667e3cab36b547abe5e97",
    "semantic_hash": "46cf7822d4f667e3cab36b547abe5e97"
  },
  "backend/internal/latest/cover.go": {
    "mtime": 1786857336.6414917,
    "ast_hash": "d5f2248c3d11de74bf5a3977651b17c2",
    "semantic_hash": ""
  },
  "backend/internal/latest/cover_fetch_test.go": {
    "mtime": 1786363889.5565126,
    "ast_hash": "60d9eb7c59a3751baf4f31c7655217e7",
    "semantic_hash": "60d9eb7c59a3751baf4f31c7655217e7"
  },
  "backend/internal/latest/acquire.go": {
    "mtime": 1786861012.026504,
    "ast_hash": "d605e3c94a62fc7787efbc139696b9d2",
    "semantic_hash": ""
  },
  "backend/internal/latest/acquire_test.go": {
    "mtime": 1786363889.5565126,
    "ast_hash": "7bd9f41814f6bf59d8998dfb81cf990a",
    "semantic_hash": "7bd9f41814f6bf59d8998dfb81cf990a"
  },
  "backend/internal/store/migrations/0009_series_cover_address.sql": {
    "mtime": 1786363889.5602942,
    "ast_hash": "4c1f6328b2e1a95828fad6d88d474c2d",
    "semantic_hash": "4c1f6328b2e1a95828fad6d88d474c2d"
  },
  ".claude/skills/implement-tickets/SKILL.md": {
    "mtime": 1786417841.7117643,
    "ast_hash": "3060e32e19cc571d91871a98f18afe53",
    "semantic_hash": "3060e32e19cc571d91871a98f18afe53"
  },
  ".omp/agents/ticket-implementer.md": {
    "mtime": 1786417841.7163916,
    "ast_hash": "0150a46c0d21c572b71b3d87d21ac925",
    "semantic_hash": "0150a46c0d21c572b71b3d87d21ac925"
  },
  "docs/adr/0008-series-identity-is-discovered-not-derived.md": {
    "mtime": 1786417841.7163916,
    "ast_hash": "3ce6d64ef6a8a39f27c257b39065389e",
    "semantic_hash": "3ce6d64ef6a8a39f27c257b39065389e"
  },
  "docs/research/lightnovelworld-chapter-vs-series-slug.md": {
    "mtime": 1786417841.7163916,
    "ast_hash": "74a4e538875f0a7e8ca3d5dc48c0bb53",
    "semantic_hash": "74a4e538875f0a7e8ca3d5dc48c0bb53"
  },
  "backend/internal/latest/smoke_lnw_test.go": {
    "mtime": 1786499529.7725692,
    "ast_hash": "2d65da8a081759172918fdf159760f45",
    "semantic_hash": ""
  },
  "docs/adr/0009-a-site-answers-questions-its-own-way.md": {
    "mtime": 1786499529.7725692,
    "ast_hash": "8039012a5b6de2359ff1a47079f51b66",
    "semantic_hash": ""
  },
  "backend/internal/latest/read.go": {
    "mtime": 1786861012.026504,
    "ast_hash": "9f039cc3ad74f803d7621f7ef4157bf2",
    "semantic_hash": ""
  },
  "docs/research/cloudflare-bot-scoring-and-poll-cadence.md": {
    "mtime": 1786501942.7367291,
    "ast_hash": "1aa17575ab20f2f36583602999a6a60f",
    "semantic_hash": ""
  },
  "backend/internal/latest/smoke_comix_test.go": {
    "mtime": 1786857336.6414917,
    "ast_hash": "111fdbb75fc68ac2ab1013bc916063cf",
    "semantic_hash": ""
  },
  "docs/adr/0010-poll-lanes-per-site-pace.md": {
    "mtime": 1786861012.026504,
    "ast_hash": "dc19d75f034ca920d93b9c71e6ca28e6",
    "semantic_hash": ""
  },
  "backend/internal/latest/status.go": {
    "mtime": 1786891396.3216066,
    "ast_hash": "5893c77b117a5bcec3a4583aa51e7f42",
    "semantic_hash": ""
  },
  "backend/internal/store/migrations/0010_reader_sightings.sql": {
    "mtime": 1786886056.0200372,
    "ast_hash": "a72c08c63fad530df3c793d16edfa385",
    "semantic_hash": ""
  },
  "backend/internal/web/admin.go": {
    "mtime": 1786891411.0618205,
    "ast_hash": "e02249496b57096cf1929f9cd0e35c3e",
    "semantic_hash": ""
  },
  "backend/internal/web/templates/admin.html": {
    "mtime": 1786886056.023822,
    "ast_hash": "f04ea1cb01369d53053eac489e796faa",
    "semantic_hash": ""
  },
  "backend/internal/web/templates/lanes.html": {
    "mtime": 1786891416.6118941,
    "ast_hash": "0e96f66560bac29713a71ec31139d25e",
    "semantic_hash": ""
  },
  "backend/internal/latest/sighting_test.go": {
    "mtime": 1786886056.0200372,
    "ast_hash": "3b1372bbeeb538b73f86f57da210b4cc",
    "semantic_hash": ""
  },
  "backend/internal/store/migrations/0011_series_sightings.sql": {
    "mtime": 1786886056.0200372,
    "ast_hash": "d0ade928a6e951eb179e4d0255cca526",
    "semantic_hash": ""
  },
  "docs/adr/0011-sighting-deferral-trust-model.md": {
    "mtime": 1786886056.0313923,
    "ast_hash": "0b6ca704f62185c9d629320f2d8475b5",
    "semantic_hash": ""
  }
 }
@@ -1,93 +1,103 @@
-Guidance for OpenCode (and Claude Code) working under `userscript/`. See root `AGENTS.md` for the project-wide architecture diagram, hard constraints, and design system.
+Scope: `userscript/`.
-### Userscript structure (single IIFE, `manga-bookmark.user.js`)
+Each entry names the code that holds the truth. The prose is only what the code
 cannot tell you: rationale, invariants a refactor would break, and dated
 observations about sites we don't control.
-1. **Site adapters** — one per host, `detect(location, document)` return page `type` + IDs. Identify type/IDs from **URL regex** (most stable); pull `title` from **`og:title`** (or the page heading where a site ships no og: tags), not CSS classes. **No adapter reads a cover**: the backend acquires, stores and serves every Cover from its own origin (ADR-0007), the wire's `cover` is already an address on our origin, and `apiPut` strips any `cover` off an outgoing body.
+### Structure — single IIFE, `manga-bookmark.user.js`
 2. **API client** — `apiGet/apiPut/apiDelete` with bearer header; `localStorage` key `bmgr:manga:cache` for instant render + offline fallback.
 3. **Progress logic** — auto-upsert `last_chapter` only when `chapterNum >= stored last_chapter_num` (re-reading old chapters must not regress progress; unparseable -> set current). Manual panel override forces any value.
 4. **Retry queue** — every write go through `pushBookmark`/`pushDelete`, so
   failed mutation park in `localStorage` (`bmgr:manga:queue`) and replayed on
   next navigation, reconnect, or `refresh()`. Entries are markers
   (`{key, op, sendStatus, attempts}`), never payloads — body read from
   cache at send time, so one entry per key give ordering and coalescing for
   free. `sendStatus` is **sticky**: while archive pending, later writes to
   that key keep carrying bucket, which stop successful
   in-between write from silently un-archiving series. `refresh()` drains
   before it fetches and overlays anything still pending, so list never
   flaps. 400 drops entry, 401 abort pass and keep queue, and
   transient failures retry to cap of 10. Latest-chapter writes deliberately
   stay out of queue. See
   `docs/superpowers/specs/2026-07-27-offline-retry-queue-design.md`.
 5. **UI** — rendered inside **Shadow DOM** root to isolate from site CSS
   (critical on mobile). Three tabs (All / Favourites / Archived) and row of
   link chips to web UI and both manga sites; `WEB_BASE` sits in CONFIG
   block next to `API_BASE`. FAB is `7 × 44` edge tab whose *hit* area
   widened to `28 × 72` by invisible `#hit` child; `#fab` must keep
   `touch-action: none` and must **not** regain `overflow: hidden`. Since
   `touch-action` resolved at gesture start, strip can't be both
   browser-scrolled and script-dragged, so `makeDraggable` splits by intent: swipe
   from `#hit` scrolls via `window.scrollBy`, hold of `ARM_MS` arms
   reposition drag, visible sliver drags with no hold. See
   `docs/superpowers/specs/2026-07-28-edge-tab-hitbox-design.md`.
 6. **SPA navigation** — Asura is Astro, client-routed on comic/chapter pages: patch `history.pushState`/`replaceState` + listen `popstate`, re-run `detect()` on URL change so auto-update fire without reload. Demonic uses classic reloads (initial `document-idle` run suffice).
-### Live URL shapes (verified 2026-07-26, may drift — re-check against live pages before trust)
+Six parts, in file order: site adapters, API client, progress logic, retry
 queue, UI, SPA navigation.
- **asurascans.com**: series `/comics/<slug>` (slug carries trailing
+**Site adapters** — one per host, `detect(location, document)` returning page
-  site-wide build-hash suffix, e.g. `-059befe1`, that **rotates on every
+`type` + IDs.
-  redeploy**), chapter `/comics/<slug>/chapter/<n>`. `seriesId` must strip
+
-  hash (`/-[0-9a-f]{8}$/`, `stripBuildHash` in userscript,
+- Identify type and IDs from **URL regex**, which is the most stable surface a
-  `asuraBuildHash` in backend); URLs keep full slug — stale-hash
+  site exposes; take `title` from **`og:title`** (or the page heading where a
-  URLs 302 to current ones. Astro-rendered; chapter links present in raw
+  site ships no og: tags), never CSS classes.
-  server HTML.
+- **No adapter reads a cover.** The backend acquires, stores and serves every
- **demonicscans.org**: series `/manga/<slug>` (slug may URL-encode punctuation, e.g. `%2527` for `'`), chapter `/title/<slug>/chapter/<n>/<page>` (older `chaptered.php?manga=<id>&chapter=<n>` form still exists as redirect, what series-page chapter-list anchors link through).
+  Cover from its own origin, the wire `cover` is already an address there, and
-  Encodings (incl. triple-encoded punctuation like `%25252D`) identical
+  `apiPut` strips any `cover` off an outgoing body.
-  on /manga/ and /title/ pages, so decode-once seriesIds match — verified
+
-  2026-07-28.
+**Progress logic** — auto-upsert `last_chapter` only when
- **comix.to**: series `/title/<id>-<slug>`, chapter
+`chapterNum >= stored last_chapter_num`; unparseable sets the current value.
-  `/title/<id>-<slug>/<uploadId>-chapter-<n>`. Only the leading `<id>` is
+Re-reading an old chapter must not regress progress. A manual panel override
-  identity — the slug re-renders when a series is renamed (`comixSeriesId`).
+forces any value.
-  An SPA that **never rewrites `og:title`**: the server-rendered head keeps
+
-  whatever document loaded first, so on a cold load `og:title` is the homepage's
+**Retry queue** — every write goes through `pushBookmark`/`pushDelete`.
-  "Comix — Read Comics online for free" and after an in-page hop it is the
+
-  *previous* series' name. `document.title` is the one thing client routing does
+- Entries are markers (`{key, op, sendStatus, attempts}`), **never payloads**:
-  update, so titles come from there, with the chapter page's `" · Ch.<n>"` tail
+  the body is read from cache at send time, so one entry per key gives ordering
-  stripped. It publishes no `og:image` either, which is one of the reasons cover
+  and coalescing for free.
 - `sendStatus` is **sticky** — while an archive is pending, later writes to that
  key keep carrying the bucket. Without it a successful in-between write
  silently un-archives the series.
 - `refresh()` drains before it fetches and overlays anything still pending, so
  the list never flaps.
 - 400 drops the entry, 401 aborts the pass and keeps the queue, transient
  failures retry to a cap. Latest-chapter writes deliberately stay out of the
  queue.
 **UI** — rendered inside a **Shadow DOM** root to isolate it from site CSS,
 which is critical on mobile.
 - The FAB's *hit* area is widened by an invisible `#hit` child. `#fab` must keep
  `touch-action: none` and must **not** regain `overflow: hidden`.
 - `touch-action` is resolved at gesture start, so the strip cannot be both
  browser-scrolled and script-dragged. `makeDraggable` therefore splits by
  intent: a swipe from `#hit` scrolls via `window.scrollBy`, a hold of `ARM_MS`
  arms a reposition drag, and the visible sliver drags with no hold.
 **SPA navigation** — Asura is Astro and client-routes on comic/chapter pages, so
 `history.pushState`/`replaceState` are patched and `popstate` listened to, and
 `detect()` re-runs on URL change. Demonic uses classic reloads, where the
 initial `document-idle` run suffices.
 ### Live URL shapes
 Encoded in the adapters; the notes below are the parts a reader of the regex
 would get wrong. **Verified 2026-07-26 unless dated otherwise — sites drift, so
 re-check against a live page before trusting any of it.**
 - **asurascans.com** — the series slug carries a site-wide build-hash suffix
  (e.g. `-059befe1`) that **rotates on every redeploy**, so `seriesId` must
  strip it (`stripBuildHash` here, `asuraBuildHash` in the backend) while URLs
  keep the full slug — stale-hash URLs 302 to current ones.
 - **demonicscans.org** — slugs may URL-encode punctuation, and the older
  `chaptered.php?manga=<id>&chapter=<n>` form still exists as a redirect, which
  is what series-page chapter-list anchors link through. Encodings (including
  triple-encoded punctuation like `%25252D`) are identical on `/manga/` and
  `/title/` pages, so decode-once seriesIds match (verified 2026-07-28).
 - **comix.to** — only the leading `<id>` is identity; the slug re-renders when a
  series is renamed (`comixSeriesId`). It is an SPA that **never rewrites
  `og:title`**: the server-rendered head keeps whatever document loaded first,
  so on a cold load `og:title` is the homepage's name and after an in-page hop
  it is the *previous* series'. `document.title` is the one thing client routing
  updates, hence titles come from there with the chapter page's `" · Ch.<n>"`
  tail stripped. It publishes no `og:image` either, one of the reasons cover
  acquisition moved to the backend.
- **kagane.to**: series `/series/<uuid>`, reader
+- **kagane.to** — reader URLs carry no chapter number, so the number comes out
-  `/series/<uuid>/reader/<bookUuid>`. Reader URLs carry no chapter number, so
+  of `og:title`. Two shapes exist, `"<Series> - Chapter <n>[ - Episode <n>]"`
-  the number comes out of `og:title`. Two shapes exist: `"<Series> - Chapter
+  and `"<Series> - Volume <v> Chapter <n>"`; both must yield a bare series
-  <n>[ - Episode <n>]"` and, for volume-numbered series, `"<Series> - Volume <v>
+  title, or the volume tail lands in the bookmark's title. Its covers are
-  Chapter <n>"` with no episode name — both must yield a bare series title, or
+  challenge- and CORP-protected, so nothing outside kagane.to can load one —
-  the volume tail lands in the bookmark's title.
+  the panel renders the backend's cover address like every other Site.
-  Its covers are challenge- and CORP-protected, so nothing outside kagane.to can
+- **novelfull.com** (novel script) — no `og:*` tags at all, so the title comes
-  load one directly; the panel renders the backend's own cover address like every
+  from `h3.title` (series) or `a.truyen-title` (chapter).
-  other Site. Behind a Cloudflare JS challenge, so the backend polls it
+- **lightnovelworld.net** (novel script) — chapter paths are flat at the site
-  through the headless browser.
+  root and their slug is a **Chapter Slug, not an identity**: a Series may
- **novelfull.com** (novel script): series `/<slug>.html`, chapter
+  publish under several. The Series address is read off the page's
  `/<slug>/chapter-<n>[-<title-slug>].html`. No `og:*` tags at all — title from
  `h3.title` (series) or `a.truyen-title` (chapter); the script reads no cover.
  Behind a Cloudflare JS challenge no TLS fingerprint
  clears, so the backend polls it through the headless browser.
 - **lightnovelworld.net** (novel script): series `/novel/<slug>/`, chapter
  `/<slug>-chapter-<n>/` — flat, at the site root. The chapter path's slug is a
  Chapter Slug, not an identity: the Series address is read off the page's
  `a[aria-label='All Chapter']` (fallback: the BreadcrumbList's second crumb),
-  and a Series may publish under several Chapter Slugs. A chapter page with no
+  and a chapter page with no pointer resolves to `other` so no Bookmark is
-  pointer resolves to `other`, so no Bookmark is offered. `h1.entry-title` is
+  offered. The client runs **no latest-chapter scan** for this Site —
-  the clean title on a series page and `<Title> Chapter <n>` on a chapter page.
+  `computeLatestChapter` yields null and `backgroundRefreshLatest` skips it
-  Its series page lists every chapter with an
+  before any fetch — because the backend Poll's one-hour cooldown dominates the
-  absolute href, so the backend polls it with the plain TLS client.
+  client's four-hour throttle, so a scan would add no freshness while having to
-  The client performs no latest-chapter scan for this Site: the Poll's
+  truncate at the page's wpdiscuz thread, a public write surface.
  one-hour cooldown dominates the client's four-hour throttle, so a scan
  would add no freshness, and the page's wpdiscuz thread is a public write
  surface a scan would have to truncate at. `computeLatestChapter` yields
  null here and `backgroundRefreshLatest` skips the Site before any fetch.
-### Second script: `novel-bookmark.user.js`
+### Second script — `novel-bookmark.user.js`
 A copy of the manga script with two adapters, `LIBRARY = "novel"` and
-`STORE_PREFIX = "bmgr:novel:"`. No migration loop (this script has no previous
+`STORE_PREFIX = "bmgr:novel:"`. No migration loop, because this script has no
-installation to carry keys over from). Installed alongside the manga script;
+previous installation to carry keys over from. Installed alongside the manga
-both write to the same backend with the same `LIBRARY` column discriminating
+script; both write to the same backend, discriminated by `LIBRARY`.
 them.
Author	SHA1	Message	Date
sulthan	7b5534c1a5	docs: name the admin dashboard's domain terms in CONTEXT.md Charting #114 introduced four terms the glossary did not carry: Orphan Series (#125), Lane Pass (#117), Forced Poll and Paused Lane (#119). Acquisition's entry is amended because a Forced Poll now replaces a Cover (#120), so establishing one is no longer unique to Acquisition.	2026-08-19 10:06:09 +07:00
sulthan	f5d3fe58ec	Add a gitea skill; point AGENTS.md at it (#126 ) Forge usage lived in three places (`AGENTS.md`, `docs/agents/issue-tracker.md`, and habit). This moves the how-to-run-`tea` half into a model-invoked skill that fires on any issue/PR task, and reduces `AGENTS.md` to identity plus pointers. - new `.claude/skills/gitea/SKILL.md` — command table plus the traps `tea <cmd> --help` will not tell you. - `AGENTS.md` — Forge section is now one line: Gitea not GitHub, `gh` and the `issue://`/`pr://` URIs fail, then pointers to the skill, `docs/agents/issue-tracker.md`, and `docs/agents/triage-labels.md`. - `.claude/skills/implement-tickets/SKILL.md` — pointer split: tracker conventions to the doc, `tea` usage to the skill. Both `docs/agents/` files are untouched; the skill cites them instead of restating them. Facts in the skill are measured against `tea` 0.14.2 on 2026-08-17, not remembered: - `gh` is not installed, so `read issue://71` errors — there is no fallback to add. - A bare read is a truncated read. Without `--comments`, `tea issue <n>` drops every comment silently, with no prompt under a non-TTY: issue #123 prints 40 lines bare, 132 with the flag. The skill makes `--comments` mandatory for any read meant to understand a ticket, with `tea issue list --fields index,comments` as the checkable count. - Issues and PRs share one index space; output is rendered boxes so parsing needs `-o json`; `close` takes no `--comment`; labels never auto-create; multi-line bodies need a heredoc; `tea` exposes neither sub-issues nor dependencies. Unmeasured and marked as such: whether `--comments` covers a PR's review-comment stream — no PR in this repo has comments, so `tea pr review-comments <n>` is named without a claim about overlap. Reviewed-on: #126 Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com> Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>	2026-08-17 17:52:16 +07:00
sulthan	766aa8f00d	docs: make every AGENTS.md cite code, not docs or issues (#113 ) Every `AGENTS.md` now cites code and nothing else. ## Why Two rot mechanisms, same symptom — an agent confidently follows a stale statement: 1. Non-code citations. A spec, ADR, plan file, or issue records what was true when it was written. Nothing updates it when the decision reverses. 2. Prose restating mechanism. The code changes, the paragraph doesn't, and the next reader trusts the paragraph. Code is the only source true at read time. ## What changed All three files: removed every ADR ref, spec/plan pointer (`docs/superpowers/specs/`, `plans/`, `docs/research/`), `DEPLOY.md`/`REDEPLOY.md`, `docs/agents/`, and issue number. Facts those links carried are restated inline — the `tea` command set and the five triage label strings now live in the root Forge section. `### Domain docs` is deleted: it pointed only at `CONTEXT.md` and `docs/adr/`, neither of which exists. `backend/` and `userscript/`: rewritten around derivability. \| Class \| In code? \| Treatment \| \|---\|---\|---\| \| Structure — packages, routes, env vars, columns \| yes \| name the symbol, nothing else \| \| Mechanism — what a function does \| yes \| symbol + one line \| \| Rationale — why, what a "simplify" breaks \| no \| written out \| \| Measurement — observation against a service we don't control \| no \| written out, dated \| `backend/AGENTS.md` 20578 → 15512 bytes, `userscript/AGENTS.md` 7129 → 5912. Root grows 16905 → 19292: the cost of inlining the `docs/agents/` facts plus the new rule. Rule* recorded in root as `## Writing an AGENTS.md`. Sole non-code exception is a sibling `AGENTS.md`. Closing clause: every symbol named must exist, since a dead pointer is a bug rather than a stale sentence. Harness-agnostic: dropped the `Guidance for OpenCode (and Claude Code)` openers for plain scope lines. ## Verification Applied the new rule to itself — extracted all 118 backticked identifiers across the three files and checked each against every `.go`, `.js`, `.sql`, `.html` and `.css` source. Zero repo symbols missing; the 8 non-matches are external (`GM_setValue`, `navigator.webdriver`, `HeadlessChrome`, `curl`, …). That check caught a claim that was already lying on `main`: the cover section said `CoverFetcher` was gone, but `NewCoverFetcher`, `TLSCoverFetcher` and `BrowserCoverFetcher` are all live in `internal/latest`. Now names only the genuinely dead `/img/kagane/{id}` route. Exactly the failure the rule exists to prevent. No code touched — documentation only, nothing to test. Reviewed-on: #113 Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com> Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>	2026-08-17 13:43:49 +07:00
sulthan	550b258c59	fix: give covers their own 10 MiB byte cap (#71 ) (#112 ) Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com> Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>	2026-08-17 12:06:14 +07:00
sulthan	3ac865cd08	chore: remove graphify (#111 ) Removes the graphify integration. It was measured against this repo rather than assumed. ## Why `graphify query` returns a keyword-seeded BFS neighbourhood, not a location. Asked where CORS origin reflection is implemented, it returned 73 nodes — mostly `api_test.go` helpers, plus a `Reflection and Type Assertions` section from `.agents/skills/golang-performance/references/cpu.md` matched on the word "reflection" — and never named `httpmw/middleware.go:135` or `main.go:121`. `grep` returned both in 39ms. Same shape asking how the poller skips kagane: 145 nodes, top hits `poller_test.go` helpers and two nodes named `T`. `graphify explain "BrowserFetcher"` is sound (`browser.go L52`, 9 `EXTRACTED` edges), but that is what `lsp references` already answers, against live files instead of a snapshot. Staleness was never the problem — `graph.json` rebuilt 5s after `f568fb5`, so the git hooks worked. Retrieval quality was. ## What it cost - Two `PreToolUse` hooks injecting a "MANDATORY: run graphify query first" paragraph into context on every grep/find and every source-file read. - 685k input tokens across 5 build runs (`cost.json`). - 3.4MB of `graph.json` + `graph.html` tracked, across 11 commits of map-refresh churn. `AGENTS.md` is the stronger orientation artifact for a repo this size: it carries the CDP constraints, the UTC-clock finding, the per-site adapter list, and the security invariants — none of which an AST graph derives. Graphify earns its keep on repos too large to grep coherently and without curated docs; not this one. ## Changes - Delete the committed map (`graphify-out/`, -58k lines). - Drop the `## graphify` rules block from `AGENTS.md` (`CLAUDE.md` is a symlink, so both). - Drop the five `graphify-out/` entries from `.gitignore`. - Empty the two `PreToolUse` hooks in `.claude/settings.json`. - Remove the stale `graphify query` instruction from `.claude/skills/implement-tickets/SKILL.md` — it pointed dispatched ticket-implementer agents at a binary that no longer exists. Uninstalled outside the tree (not in this diff): the `graphifyy` CLI, `~/.claude/skills/graphify/`, the global `~/.claude/CLAUDE.md` block, the `Bash(graphify query )` permission in the git-ignored `.claude/settings.local.json`, and the `post-commit` / `post-checkout` git hooks. ## Verification `grep -ri graphify` over the worktree is clean; remaining hits are inside `.git/` (commit messages, two stale branch configs). No code touched — backend and userscript are untouched, so `go test ./...` is unaffected. Reviewed-on: #111 Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com> Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>	2026-08-17 11:43:15 +07:00
sulthan	f568fb5e8c	fix: an asleep browser Lane is not a stalled one on the admin page (#110 ) Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com> Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>	2026-08-16 22:04:18 +07:00