[MisonL]

Summary

This branch collects the fixes from a long, careful audit of Petdex — the pet
gallery, the desktop install flow, submission and review, the public API, the
CLI, the three translations, and the self-hosted deployment.

Every change is a small, self-contained commit that says what it fixes and why.
Nothing here is speculative: each one came from reading the code, reproducing
the defect, and leaving the reasoning in the commit message.

208 commits · 435 files. There are no new features except a self-contained
Docker deployment, covered in section 8.

How to review

Commit by commit is the easy path — git log --oneline upstream/main..HEAD —
because each commit is one idea. The sections below regroup them by area if you
would rather review by theme, and the Review rounds section
then lists every audit pass that produced them: what each pass covered, what it
found, which commit fixed it, and what was deliberately left for upstream.

If you would prefer this as several smaller PRs, I can split it. The themes
interleave through the history and share files, so each split would need its own
re-verify, but it is doable — just say the word.

One thing deliberately not here: the CLI's redesigned OAuth login callback
page. That is feature work in the standalone packages/petdex-cli package
rather than a site fix, so it ships as its own PR — #820. Both branches are
cut from the same upstream/main tip (7e327034c) and neither is behind it, so
either can merge first; the two touch three of the same CLI files
(clerk-cli-auth.ts, clerk-cli-auth.test.ts, token-exchange.ts) with
different changes, so whichever merges second needs a trivial rebase.

What is fixed, by area

1. The site reads correctly in all three languages (en / es / zh)

A large share of the branch. The Spanish and Chinese translations are finished
rather than half-done: profiles, notifications, feedback, the request flow, the
facet pages, the Codex theme dialog, the claim banner, the taxonomy labels on
cards and chips, the card footers, and the page metadata titles. The last
hardcoded English strings on live pages are gone, dates and spritesheet copy are
localized instead of formatted once, and the OG copy that never resolved is
fixed. API error surfaces now return translatable codes rather than English
sentences.

2. Fewer errors, and none of them silent

Several routes answered 500 to input a caller could send, and several failures
used to vanish:

• a JSON body of literal null parsed cleanly and then threw on the first
  property read — those routes now answer 400
• a dropped connection during a client action left the button spinning and
  logged nothing; the fetch handlers now catch it and surface a message
• an automated review that could not finish its duplicate check now holds for
  manual review instead of auto-rejecting
• routes gained an error boundary, so a render failure shows a page rather than
  a blank screen
• GET /api/pets/[slug]/codex-theme cached its 404 and 422 branches at the edge
  for the 24h its 200 advertises, so a pet approved — or a colour extracted —
  during that window kept serving the miss; both branches now say no-store,
  like the thumb/wastickers/variants siblings already did
• a second POST /api/collections/[slug]/request for the same pair (a
  double-click) hit the pending-pair unique index and 500'd where the pre-check
  answers alreadyPending; the conflict is now caught and answered
• PATCH /api/profile rejected handle: null with handle_too_short before
  the validator that calls it legal could run, so clearing the field 400'd the
  whole save — a bio-only edit included
• the CLI treated a config file holding a parseable non-object (a literal
  null) as valid and crashed every telemetry command, including
  petdex telemetry on/off, the documented way out; a corrupt credential file
  likewise made every get/set/delete reject, petdex login's own write
  included

3. Writes that could race or half-apply

Multi-statement writes now run in one transaction through the existing
executeAtomicReturning, with the statements kept separate for the reason that
helper documents:

• creating a pet request and its first vote
• resolving a request candidate (the winner, the sibling rejects, and the
  request fulfilment move together, guarded so a lost race reports not_pending
  instead of re-resolving)
• the CLI takedown cleanup
• withdrawing a submission (the guards are repeated in the write's WHERE, so a
  concurrent approve or claim cannot slip between the read and the write)
• claiming an owner and renaming a profile handle repeat their identity checks
  on the write
• a slug collision, which used to 500 after consuming a rate-limit slot, is now
  retried on the unique-constraint error

4. Input validation and trust boundaries

• submission identity and credit still come only from the verified Clerk session
  or the CLI bearer token, never the request body; a verified email is the only
  thing written into owner_email
• request-image edits are gated to their author, and the ownership check is
  repeated on the write
• presign roles and request bodies are validated before use
• the CSRF origin check compares full origins, not prefixes — and the
  Vercel branch of that check compares the scheme too, so an http://
  twin of the deployment's own host no longer passes on a host whose
  VERCEL_* env names it
• the rate limiters key on the platform-set IP header, and the local stack no
  longer fails open
• the Resend webhook body is capped before the signature is verified; email
  subjects are sanitized at the point of interpolation
• the Discord webhook receiver fails closed

5. Assets and storage

• submission asset URLs are pinned to the pet's own path namespace, and legacy
  hosts are resolved before validation rather than after
• withdraw's R2 cleanup deletes only submission-upload-shaped keys and matches
  references by normalized key — the string-matched guard it shipped with let
  a row point at another pet's live sprite or thumbnail and delete it
• an uploaded asset's real size is verified at registration instead of trusting
  the declared one
• stale public artifacts are stopped, and unbounded asset growth gets a
  scheduled cleanup
• the fetches behind the OG and sticker pipelines are bounded
• in the CLI: command injection is closed, downloads are bounded, and zip
  inflation is capped
• the manifest fetch was the one network read in the package with no byte
  ceiling; a folder submit read its spritesheet with no size check; and
  install wrote its four files straight to their targets, so an interrupted
  install could pair new metadata with a stale image and leave the other
  extension's file shadowing the fresh one in the desktop loader

6. Caching and SEO

• og:url is pinned to the canonical, and contradictory canonicals are gone
• /sitemap.xml no longer renders dynamically; sticker collections are listed
• the desktop-release lookup is cached where revalidate actually applies
  (segment revalidate does not cache a Route Handler that reads
  searchParams, so the 5-minute cache the comment promised never existed and
  every download click walked the GitHub API)
• the leaderboard's per-metric cache is invalidated on approve/reject —
  it shipped with no invalidation at all, so a fresh approval stayed off
  /leaderboard and the profile rank badge for the full 5-minute TTL
• a failed metrics read is no longer cached as an empty index: the compute
  returned [] on a DB error, and an empty array is cacheable, so one
  transient blip pinned "every pet has zero metrics" for the whole TTL on any
  gallery or profile page listing 50+ pets

7. Accessibility

• a skip link, and the header moved out of <main>
• role="status" and aria-live on swaps, toasts, and reply lists so a screen
  reader hears them
• aria-label on fields whose only name was a placeholder that vanishes on the
  first keystroke
• aria-current on the active filter, role="alert" on error paragraphs
• the space bar is no longer hijacked, and the hero subtitle moved off
  amber-on-light (~1.2:1) to the brand color

8. The CLI, the deployment, and the operational scripts

• a self-contained Docker deployment: a multi-stage Dockerfile, a compose file
  with Postgres, Redis and a migrate step, and output: "standalone", so
  docker compose up yields a working site
• the collection re-org script and the three ownership-reassign scripts now
  preview by default and require --apply to write; the re-org script's
  destructive collection drop needs a second --drop-hollow
• the keyword takedown exits non-zero when a removal fails instead of printing
  "Done."
• the CLI's session-title file (the first line of your prompt) is written 0600
  like the rest of ~/.petdex/runtime, not world-readable at the default umask
• whoami/submit/edit no longer report a locked keychain or a failed
  refresh as "Not signed in"; the underlying message is kept. A duplicate-check
  that fails on a 5xx or a timeout now warns instead of silently submitting, so
  it cannot mint a -2 slug the user never chose

9. Keeping CI green

Two test files this branch added broke the app suite on Bun 1.4.2: one replaced
the @/lib/r2 module with a stub (process-wide, and the stub reached
r2.test.ts), and one needed discord.js, which the root install did not
carry. Both are fixed — the stubs now patch the singleton in place, and root
carries discord.js the same way it already carries the CLI's dependencies.

Review rounds

The thematic sections above fold in ~47 passes; the rounds below are the ones
that shipped as discrete, dated audit passes with their own findings, plus the
three-agent re-checks that closed the branch out. Each lists scope, findings,
the commit that fixed them, and anything recorded for upstream instead of
patched.

Round 48 — scripts, workers, discord bot, SEO

• Scope: scripts/, workers/, packages/discord-bot, SEO surface.
• Fixed (7297ed93, 4ae6f378): the bot's /collection and /install
  slugs pinned to the server-side alphabet [a-z0-9-] so caller input cannot
  shape protocol-relative URLs in channel messages (packages/discord-bot/src/index.ts);
  the /install embed hardened with the webhook path's plainEmbedText;
  the three write scripts that ran on a bare invocation (scripts/fix-shrimpy-issue-81.ts,
  scripts/apply-multi-pin.ts, scripts/rescue-failed-submissions.ts) gated
  behind --apply; the assets worker stopped advertising Range support it
  never implemented (workers/petdex-assets).

Round 49 — takedown ownership, free-text bounds, search NUL

• Fixed (b2e1938d): owner self-service takedown restates owner_id = actorId
  inside every statement (ownerScoped, src/lib/takedown.ts), closing a
  claim-race where the route's pre-flight 403 read a snapshot the batch could
  not see; the two free-text fields every sibling capped but these skipped are
  bounded (owner takedown reason, anonymous feedback email → 254); NUL
  bytes stripped from the search query before it reaches the Postgres ILIKE
  pattern (src/lib/pet-search.ts — ?q=%00 was a deterministic 500).

Round 50 — client error text, desktop Zig UB

• Fixed (ed6b6656): submit/request error paths no longer render raw
  exception text ("Failed to fetch", zip-library messages with file paths) —
  new generic copy in en/es/zh (src/components/pets/pet-submit-form.tsx,
  request flow, three message files). 274da9f2: desktop settings reads that
  cast arbitrary finite floats through @intFromFloat now range-check first —
  a persisted 1e300 was a permanent boot crash and UB in ReleaseFast
  (packages/petdex-desktop-native/src/main.zig).

Round 51 — CLI scheme and echo, locale 404 CTAs

• Fixed (f3788633): the CLI requires https for PETDEX_URL (the base
  URL that ships the bearer token had no scheme check; packages/petdex-cli/src/petdex-url.ts,
  now result-returning checkPetdexUrl) and strips control characters from
  manifest displayName/submittedBy before they echo to the terminal
  (packages/petdex-cli/src/manifest.ts); the locale 404 page and error
  boundary route their CTAs through withLocale (src/app/[locale]/not-found.tsx,
  error.tsx — Next passes no props to not-found, locale comes from
  getLocale()), and the locale switcher preserves the URL hash.

Round 52 — vibe cursor cap, like GET gate, metrics visibility

• Fixed (f5cdacd5): the vibe-search offset caps at VIBE_MAX_CURSOR = 600
  (src/lib/pet-search.ts:750) — the path materializes LIMIT = cursor + limit
  rows for its JS-side slice, so a hand-set cursor of 1e9 was a one-request
  billion-row Postgres materialization on an uncacheable endpoint; the
  anonymous like-counter GET reuses the publicCatalog IP limiter and slug
  validation its POST already had; /api/pets/[slug]/metrics answers 404 for
  non-approved slugs (src/app/api/pets/[slug]/metrics/route.ts).

Round 53 — presign ceiling, docs; gallery order and rename sync

• Fixed (f26ee579): pet-request reference images are HEAD-verified
  against the presign ceiling before the row lands (src/app/api/pet-requests/route.ts)
  — the requests/ prefix sits outside every GC shape, so an oversized upload
  was a permanent public object nobody reclaims; .env.example documents the
  runtime switches. 24e4c9c6: gallery-order now implements its own contract —
  unlisted pets sorted ahead of the reordered block because the CASE's ELSE was
  dead behind its WHERE (src/lib/collection-order.ts); a slug rename through
  the admin edit path migrates collection member rows and covers in one batch
  (src/lib/submission-decisions.ts).
• Recorded: a presigned PUT stays valid for its whole TTL, so a compliant
  small upload can be replayed into a large one between verification and
  publication — closing it needs an upload-session design, not a patch; the
  member-count cap is checked against a pre-lock snapshot, so two racing
  PATCHes can exceed MAX_COLLECTION_PETS.

Round 54 — counters and pagination consistency

• Fixed (51cdad4a): the vibe path no longer publishes a total that
  grows with the cursor (it was the fetch window's length); the like recount
  runs inside the same transaction as the write (src/app/api/pets/[slug]/like/route.ts);
  my-pets dates use the site locale; og:locale/og:locale:alternate ride
  the OG tags; one untranslated es fragment fixed.
• Recorded: the batches facet excludes discover pets while the main query
  does not, and profile summaries include them while the leaderboard excludes
  them — two source-universe splits that need product decisions.

Round 55 — admin imports, sharp decode gates

• Fixed (38282209): admin imports run the same keyword/URL blocklists the
  submission path always did, via a shared gateImportText (src/lib/import-gate.ts,
  scripts/admin-import-pet.ts) with an explicit --skip-blocklist escape
  hatch — --approve still skips human review, but not the security baseline;
  the four opengraph-image.tsx routes apply the sprite decode-dimension gate
  publish/color-extract/dhash already had — they were the last request paths
  reaching sharp on an 8MB buffer with no pixel check, on public
  cache-refreshable URLs.
• Recorded: credit_url matching is the documented claim pathway (an import
  with a wrong credit URL hands the pet to whoever owns that GitHub profile);
  admin operations log to stdout only.

Round 56 — ISR purge, sticker sitemap tag, docs copy

• Fixed (dca721d4): owner takedowns purge the full-route /pets/[slug]
  ISR entries through revalidatePetPagePaths (src/lib/pet-page-revalidate.ts)
  — data-cache tags never reached force-static route shells, so a deleted
  pet's page kept serving broken sprite references for its 24h window; the
  sticker sitemap's cache tag is now actually invalidated (src/lib/sticker-sitemap.ts).
  265224a7: the docs page claimed CLI v0.1 (it is 1.4.0), walked users into
  the retired doctor command, and the download metadata said macOS-only —
  corrected across en/es/zh.
• Recorded: home and facet pages have no page-level purge at all (new
  approvals lag 24h); facet pages cap at 60 pets with no pagination while
  their count label reports the true total.

Round 57 — telemetry UTC, dead override, seam sweep

• Fixed (bac096d4): telemetry day buckets pin AT TIME ZONE 'UTC' like
  the month buckets elsewhere (src/lib/telemetry.ts); the never-passed
  caughtSlugs server-override prop on PetGallery is gone. The seam sweep
  otherwise came back clean: 956 sampled t() literal keys resolve in all
  three locales, prop wiring has no drift, each env boolean has one parsing
  convention.

Round 58 — adversarial re-review of our own recent fixes (4 real regressions)

• Found & fixed (296551a0): the not-found page's params declaration
  made every 404 a 500 (Next passes no props to that element; reproduced
  locally, zh/es CTAs still localized); the like recount's transaction wrapped
  only the count while the write stayed outside — write + recount now share one
  batch in all three branches (src/app/api/pets/[slug]/like/route.ts); the
  slug-rename sync missed likes/metrics/requests/featured lists and ran
  non-atomically — all six slug-keyed tables move in one batch
  (src/lib/submission-decisions.ts); the vibe cursor clamp disagreed with
  hasNext/nextCursor, serving a duplicate page across the cap
  (src/lib/pet-search.ts).
• Closed later: the like GET's non-approved 404 gap it recorded — 72789ccf.

Round 59 — regression tests for the defenses; deploy re-verified

• Fixed (b6d3bd1b): five of this branch's defenses shipped without a
  regression test and now have one — the admin-import blocklist gate
  (src/lib/import-gate.test.ts), the OG sprite loader's decode gate
  (src/app/[locale]/pets/[slug]/opengraph-image.test.ts), a mangled-origin
  matrix for requireSameOrigin (src/lib/same-origin.test.ts), the
  VIBE_MAX_CURSOR resource bound (src/lib/pet-search-nul-strip.test.ts),
  the metrics route's visibility contract (src/app/api/pets/[slug]/metrics/route.test.ts),
  plus the CLI's PETDEX_URL gate (packages/petdex-cli/src/petdex-url.test.ts).
  Two of these tests are mutation-checked: reverting the fix makes them fail.

Round 60 — closure sweep and docs contradictions

• Verified: the branch's final state is self-consistent across all
  multi-revised areas (like, not-found, vibe each touched 2–3 times — no later
  round silently undid an earlier fix).
• Fixed (25870863): an .env.example note claimed nothing reads
  AI_GATEWAY_API_KEY when the review/tag/sound model strings resolve through
  the gateway provider that reads only that key (contradicting AGENTS.md);
  AGENTS.md's integration-suite count was self-inconsistent while omitting the
  seventh process-wide-mocking suite.

Round 62 — black-box + container + adversarial recheck (3 agents)

• Scope: the deployed stack (black-box), the running containers, and an
  adversarial recheck of the branch's own recent commits.
• Found: b6d3bd1's metrics suite registered three bare mock.module
  factories (@/lib/ratelimit, @/lib/same-origin, @/lib/db/metrics) — a
  bare replacement is process-wide, so when it ran before the like/withdraw
  suites in one process their imports died with Export named 'setLikeCount' not found (same leak class the r2 stub caused in section 9).
• Fixed (7d928655): all three factories spread the real module
  (src/app/api/pets/[slug]/metrics/route.test.ts), resolved via dynamic
  import after the server-only stub registers — a static import hoists above
  the mocks and the real module tree throws. Also restores the
  URL_BLOCKED_REASON explanation the gateImportText extraction dropped from
  the admin-import URL rejection (scripts/admin-import-pet.ts).
• Container findings: none — no bind mounts, no .env baked into the
  image, migrate logs carry no credentials.
• Recorded: presign-PUT replay inside the TTL, MAX_COLLECTION_PETS guard
  inside the lock, a csrf_blocked contract assertion, ownerScoped takedown
  integration coverage.

Round 63 — black-box + container audit + adversarial recheck (3 agents)

• Found: all five then-latest commits held up; the same-shape leftovers
  were track-zip answering errors without the family Cache-Control: no-store
  header, and the deploy stack's four base-image tags floating.
• Fixed (446bb509): src/app/api/pets/[slug]/track-zip/route.ts adds
  no-store to its 429/400/404 (a POST is not edge-cached anyway, so this is
  contract uniformity, not a reachable bug); Dockerfile and
  docker-compose.deploy.yml pin all four base images to digests.
• Recorded: /zh/%00 is normalized away by Next's router and falls back
  to a 200 locale homepage — no security impact, not worth fixing.

Round 64 — deep black-box + CLI/bot/scripts first pass (3 agents)

• Findings: zero defects, no code changes. The full method matrix over 15
  endpoints produced no 500s; Content-Type confusion converges to clean 4xx;
  concurrent like/track-zip counting stays idempotent; error bodies never leak
  internals. The pinned digests verified as multi-arch manifest lists. The
  CLI↔app API contract matches field-for-field; the Discord bot sanitizes user
  input down to the mention-injection edge case; all 83 one-off scripts have no
  credential logging, no unscoped writes, no dead imports (CLI suite 202 pass,
  bot 12 pass).
• Recorded: the pet_approved/collection_featured webhook events the
  Discord bot receives have no sender anywhere in this repo — the
  showcase-broadcast trigger lives outside the codebase or the link is broken.

Recorded for upstream

Deliberately not patched here — each needs a design decision or touches
main-only code, listed so nothing silently disappears:

1. Presign-PUT replay inside the TTL — a compliant small upload can be
   replayed larger between verification and publication; needs an upload-session
   design.
2. MAX_COLLECTION_PETS checked against a pre-lock snapshot — two racing
   PATCHes can exceed the cap; needs an in-statement guard like the
   owner-collection cap has.
3. Facet/profile/leaderboard source-universe splits — batches facet vs main
   query, profile summaries vs leaderboard (discover pets), and facet pages
   capped at 60 with no pagination.
4. Home and facet pages have no page-level ISR purge — new approvals lag
   the cache window.
5. credit_url claim pathway — an admin import with a wrong credit URL hands
   the pet to whoever owns that GitHub profile.
6. Discord-bot showcase webhooks have no in-repo sender (Round 64).
7. /zh/%00 router normalization falls back to a 200 homepage (cosmetic).

Verification

• bun run check (Biome) — clean
• bunx tsc --noEmit — clean (app-ci runs this; there is no root script)
• bun run i18n:check — in sync
• bun run test — verified on Bun 1.4.2 (the version CI installs); CI is green
  on the head commit 446bb509 across all 16 checks
• every commit is signed
• the Docker deployment was rebuilt from the head commit and smoke-verified
  (three locales, localized 404, %00 slug rejection, metrics/like/track-zip
  error contracts)

Boundaries — what I did not verify

Stated plainly so nothing here is assumed to be more checked than it is:

• the client-side accessibility changes are covered by the unit suite only; they
  were not walked through in a real browser
• executeAtomicReturning's Neon-HTTP batch path (production) applies every
  statement in one transaction per Neon's documentation, which is not
  verified locally — the local drivers take the callback-transaction path.
  This is noted in AGENTS.md
• the rate-limit key's header trust is verified for Vercel's guarantee, not for
  the Cloudflare-in-front topology this app deploys behind (noted in code)
• two groups of exports in src/lib are currently unreferenced — the admin
  candidate-review half of request-candidates.ts and the telemetry read side.
  Their races were hardened, but the missing UI or route that would call them is
  your decision, not something this branch invents
• eight date renders still format without an explicit timeZone, so a browser
  in a non-UTC zone can hydrate a different string than the server rendered.
  This predates the branch (upstream main has the same calls) and is left
  alone rather than swept in here
• the CLI's atomic install and extension cleanup are verified at the code level
  only; the webp↔png switch was not watched on a running desktop build

The collection-request test deliberately stubs the db so its pre-check misses
and the insert itself raises the conflict — seeding a pending row would let the
assertion pass with the fix reverted.

---

Round 65 (Codex, via Orca — full 202-commit re-review, 360 commands, gpt-6.1-sol at max effort, read-only, report preserved in the branch's working notes): 0 blocking / 6 important / 3 nit. The branch's five most recent commits were re-verified, the two upstream commits were confirmed conflict-free (merge-tree clean), and six substantive findings came back — three of them in this branch's own fixes, all now fixed in 9166e93b and 0107908d:

1. The slug rename committed the main row before migrating its references. submitted_pets was updated as its own statement, then the six slug-keyed tables were migrated in a second batch; a failure between them left a renamed pet with collections/likes/metrics still on the old slug, and a collection holding both slugs tripped its composite primary key. The main-row UPDATE is now the batch's first statement, and the migration gains the table the list always skipped — pet_requests.fulfilled_pet_slug — so a fulfilled request follows its pet. Covered by a new PGlite suite that drives the real SQL both ways.
2. The withdraw reference guard could never match. keyFromR2PublicUrl() yields pets/... while the SQL that reduces the stored URL column keeps /pets/...; an IN between the two shapes is always false, so the guard was silent and the cleanup could delete an object another row referenced. Both sides now compare after ltrim, and the rendered SQL is asserted.
3. The metadata duplicate check never reported a truncated scan. Exact/visual/semantic each hold the review when their scan is incomplete; metadata's 2,000-row window did not, so a larger catalog could auto-approve a duplicate outside the window. It now probes limit+1 and the reviewer holds.

Also fixed: a request reference image whose object does not exist passed the size check (checkR2ObjectSize now answers ok with a missing flag; the size-guard callers keep their lenient retry semantics and the request route refuses missing objects); the Discord bot with no DISCORD_GUILD_ID in more than one guild announced into whichever server held the first channel of the name (fails closed now, single-guild bots unaffected); the feedback-reply endpoint String()-coerced a non-string body into the reply store and the notification email; the deploy compose pinned migrate to the built-in Postgres while its own comments told you to repoint the app's DATABASE_URL (both services now share PETDEX_DEPLOY_DATABASE_URL), and its PETDEX_MOCK_AUTH build arg now warns that the Clerk alias is baked in at build time — swapping in real keys at runtime does not restore authentication; and the CLI's install stages all four temp files before renaming any of them, so the two install directories commit back-to-back.

---

Round 68 (layer-3 adversarial recheck of the five fix commits + black-box old-vs-new stack comparison + first-pass sweep of the never-audited corners, 3 agents): no remaining defects. The layer-3 pass found only two drifts, fixed in b68a06f6 — the metadata duplicate match list could return hundreds of entries where the visual branch caps at SUBMISSION_SIMILARITY_MAX_RESULTS (the decision reads only the length, but the evidence JSON grew unbounded), and the rename comment claimed the batch's own rows were the existence signal when the code discards them and re-reads. Everything else is recorded, not patched: the getTableColumns key cast bypasses the compiler (a future patch key missing from the schema would fail at runtime), the post-batch re-read has a rename race that stays unreachable until a production edit route exists, and the CLI's interrupted-install cleanup skips the other-extension rm — plus three upstream questions from the corners sweep (the SETUP.md-promised /api/discord/webhook has no in-repo implementation, the assets worker still serves its retired workers.dev subdomain, and patch-native-packager.sh has no caller). The black-box agent rebuilt the pre-fix image, reproduced the [object Object] reply bug live on it, then verified the rebuilt stack answers 400 invalid_body — the deploy stack now runs b68a06f6 with all baseline probes green.

🤖 Generated with Claude Code

[vercel]

@MisonL is attempting to deploy a commit to the Crafter Station Team on Vercel.

A member of the Team first needs to authorize it.

[MisonL]

The build windows leg failed with the same hidden-codex-hook race on two consecutive runs (9050f2b6 docs-only and an empty re-trigger commit) — neither touches packages/petdex-desktop-native. This matches the Oct 13 analysis below: the runner subprocess exits after writing the request without reading a response, and slow Windows runners land in that window. Merging #822 (the bounded wait) should clear it; until then this leg is flaky independent of the PR's contents. All other 15 checks are green.

[vercel]

Deployment failed for project petdex with the following error:

Creating the Deployment Timed Out.