[Lucrona]

Summary

• Add Markdown to Admin > Changelog and the News body, with Bold, Italic, Link, Bullet list, Code, Line break and Paragraph tools.
• Use one server renderer for live previews and public News / Changelog output. Single newlines make line breaks; blank lines make paragraphs. Blank lines between list items do not add empty bullets.
• Keep existing content in its original plain-text mode. Reading or previewing old entries does not rewrite them; metadata-only edits retain that mode. Editing the body opts it into Markdown.

Safety

Markdown is parsed with pulldown-cmark and cleaned with ammonia. Only paragraphs, breaks, emphasis, links, lists, code and blockquotes survive. Raw HTML is escaped, images are stripped, and script/data/vbscript links and event/style attributes cannot execute. The browser never parses Markdown or places textarea input into HTML. News excerpts are plain text.

The preview endpoint is Admin-only, rate-limited, private, no-store, and makes no database or audit writes. Tests cover XSS, forged HTML, permissions, preview/public parity, legacy snapshots, and blank list lines.

Migration / rollout

0064_content_markdown.sql adds nullable, checked content_format columns to news_posts and changelog_entries. No defaults, data backfills, rewrites, deletes, or changes to characters / hours. NULL keeps the old renderer; new edited content is marked markdown.

Review only: no pull request merged or deployed, and no live DB writes performed. Deploy the server migration/API and static Admin/public assets together after approval. Existing content needs no resave.

Validation

• cargo fmt --all -- --check: passed.
• cargo clippy -p fraglink-core -p fraglink-sync -p fraglink-server --all-targets -- -D warnings: passed.
• Markdown integration tests: 3 passed against an isolated box Postgres (no live connection).
• Full core/sync/server regression suite: 347 passed, 0 failed, 3 pre-existing ignored tests (49 test/doc-test executables), using isolated box Postgres.
• node --test apps/site-web/tests/*.test.cjs: 31 passed (8 new Markdown UI tests). Added these to Linux CI.
• Linux and Windows CI are both green for f29272c3e3248681028d21a31e1ddb870f484bea: https://github.com/Lucrona/fraglink/actions/runs/42894307584. Linux passed whole-workspace fmt, strict clippy, Rust tests, UI tests and the simulation smoke run; Windows passed strict clippy, core/sync tests and the installer build.

Fixture preview

/workspace/pr-markdown-preview/editor.html and editor.png: fixture-only static rendered mock using the real toolbar markup and real server-rendered sanitized output. No live data. This is not a browser screenshot or an end-to-end browser interaction test.

Migration collision fix

Updated by a normal merge of wow-played 2978f1b6b1dec918ad8984ef05ac2c7a296a9f07 after PR 38 merged. PR 38 keeps 0063_wow_forever_rulesets.sql; content Markdown now uses 0064_content_markdown.sql. The stylesheet conflict retains PR 38 popup-avatar sizing unchanged and appends only Markdown styles.

Published history is preserved: merge commit 2160f6c incorporates wow-played, then f29272c renumbers the migration. git diff --exit-code 02ea9fcba02d9bf3c874bfb11041a87ac296374f HEAD passed: the final tree exactly matches the tested preparation candidate. Pushed normally, without force.