From 73b8528c47a2de289b795c08b2f25586f8a2fa53 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 13:49:09 -0700
Subject: [PATCH 01/38] feat(lookup): add the FuzzySearch reverse image search
 client (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Server-only client for api.fuzzysearch.net, plus the pure helpers the lookup
endpoint and the upload UI need: match normalization and banding, post and
profile URL building, source-URL folding, and local-artist matching through
the existing handlesOverlap predicate.

The key resolves like the registry fork key — a FUZZYSEARCH_API_KEY deploy
secret wins, otherwise the D1 raw setting. Neither the key nor the response
body is ever logged.
---
 src/app.d.ts                       |   7 +
 src/lib/server/fuzzysearch.test.ts | 315 ++++++++++++++++++++++++++++
 src/lib/server/fuzzysearch.ts      | 317 +++++++++++++++++++++++++++++
 wrangler.toml.example              |   3 +
 4 files changed, 642 insertions(+)
 create mode 100644 src/lib/server/fuzzysearch.test.ts
 create mode 100644 src/lib/server/fuzzysearch.ts

diff --git a/src/app.d.ts b/src/app.d.ts
index f83ec198..da7c7d4f 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -96,6 +96,13 @@ declare global {
 				 * the site runs entirely on its local artists table.
 				 */
 				REGISTRY_API_KEY?: string;
+				/**
+				 * FuzzySearch API key, enabling "Look up artist" (reverse image search).
+				 * Optional: without it — and without the key saved in Settings →
+				 * Connections, which this secret overrides — the lookup endpoint answers
+				 * `{ enabled: false }` and the button never appears.
+				 */
+				FUZZYSEARCH_API_KEY?: string;
 				/**
 				 * Resend API key. Gates the admin "Forgot password" flow: when unset,
 				 * /admin/forgot silently no-ops (still returns the generic response) and
diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
new file mode 100644
index 00000000..b8d15e3f
--- /dev/null
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -0,0 +1,315 @@
+import { describe, it, expect } from 'vitest';
+import {
+	FUZZYSEARCH_ENDPOINT,
+	FUZZYSEARCH_TIMEOUT_MS,
+	searchImage,
+	normalizeMatches,
+	pickPrefillMatch,
+	strictestRating,
+	normalizeSourceUrl,
+	handleProfileUrl,
+	findLocalArtists,
+	findArtistsByName,
+	type LookupMatch
+} from './fuzzysearch';
+
+// A fetch stand-in that records what the client sent and answers with a fixed
+// response. Injected rather than stubbed globally (the furtrack.test.ts shape).
+function fakeFetch(response: Response | (() => Promise<Response>)) {
+	const calls: Array<{ url: string; init: RequestInit }> = [];
+	const fn = (async (url: string, init?: RequestInit) => {
+		calls.push({ url: String(url), init: init ?? {} });
+		return typeof response === 'function' ? await response() : response;
+	}) as unknown as typeof fetch;
+	return { fn, calls };
+}
+
+function jsonResponse(body: unknown, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { 'content-type': 'application/json' }
+	});
+}
+
+const MIXED_PAYLOAD = [
+	// Dropped: too far away to be a lead.
+	{ site: 'FurAffinity', site_id_str: '999', artists: ['faraway'], distance: 9 },
+	{ site: 'Weasyl', site_id_str: '5150', artists: ['kuttoya'], distance: 2, rating: 'mature' },
+	{
+		site: 'FurAffinity',
+		site_id_str: '12345',
+		artists: ['kuttoya'],
+		distance: 0,
+		rating: 'general',
+		posted_at: '2026-01-02T03:04:05Z'
+	},
+	// Dropped: a site with no post-URL shape and nothing to link to.
+	{ site: 'Unknown', site_id_str: '1', artists: [], distance: 0 },
+	{ site: 'e621', site_id_str: '777', artists: ['kuttoya'], distance: null, rating: 'adult' },
+	{ site: 'Twitter', site_id_str: '160', artists: ['kuttoya'], distance: 2, rating: 'adult' },
+	// Twitter with no artist handle — the status still has a canonical URL.
+	{ site: 'Twitter', site_id_str: '161', artists: [], distance: 5 }
+];
+
+describe('normalizeMatches', () => {
+	const matches = normalizeMatches(MIXED_PAYLOAD);
+
+	it('drops Unknown sites and anything past the distance cap', () => {
+		expect(matches.map((m) => m.siteId)).not.toContain('999');
+		expect(matches.some((m) => (m.site as string) === 'Unknown')).toBe(false);
+		expect(matches).toHaveLength(5);
+	});
+
+	it('sorts closest first, ties by site, nulls last', () => {
+		expect(matches.map((m) => `${m.site}:${m.siteId}`)).toEqual([
+			'FurAffinity:12345',
+			'Twitter:160',
+			'Weasyl:5150',
+			'Twitter:161',
+			'e621:777'
+		]);
+	});
+
+	it('bands the distances', () => {
+		expect(matches[0].band).toBe('exact'); // 0
+		expect(matches[1].band).toBe('strong'); // 2
+		expect(matches[3].band).toBe('possible'); // 5
+		expect(matches[4].band).toBeNull(); // unknown distance
+		expect(matches[4].distance).toBeNull();
+	});
+
+	it('builds a post URL for every site', () => {
+		const byId = Object.fromEntries(matches.map((m) => [m.siteId, m.postUrl]));
+		expect(byId['12345']).toBe('https://www.furaffinity.net/view/12345/');
+		expect(byId['5150']).toBe('https://www.weasyl.com/submission/5150');
+		expect(byId['777']).toBe('https://e621.net/posts/777');
+		expect(byId['160']).toBe('https://twitter.com/kuttoya/status/160');
+		expect(byId['161']).toBe('https://twitter.com/i/status/161');
+	});
+
+	it('keeps the raw handles, the posted date, and a known rating', () => {
+		expect(matches[0].handles).toEqual(['kuttoya']);
+		expect(matches[0].postedAt).toBe('2026-01-02T03:04:05Z');
+		expect(matches[0].rating).toBe('general');
+		expect(matches[3].rating).toBeNull();
+	});
+
+	it('returns nothing for a payload that is not a list', () => {
+		expect(normalizeMatches({ matches: [] })).toEqual([]);
+		expect(normalizeMatches(null)).toEqual([]);
+	});
+});
+
+describe('searchImage — request shape', () => {
+	it('posts the bytes as multipart with the key header and a timeout signal', async () => {
+		const { fn, calls } = fakeFetch(jsonResponse(MIXED_PAYLOAD));
+		const result = await searchImage(new Blob([new Uint8Array([1, 2, 3])]), 'secret-key', fn);
+
+		expect(result).toEqual({ ok: true, matches: normalizeMatches(MIXED_PAYLOAD) });
+		expect(calls).toHaveLength(1);
+		expect(calls[0].url).toBe(FUZZYSEARCH_ENDPOINT);
+		expect(calls[0].init.method).toBe('POST');
+		expect((calls[0].init.headers as Record<string, string>)['x-api-key']).toBe('secret-key');
+		expect(calls[0].init.signal).toBeInstanceOf(AbortSignal);
+		const body = calls[0].init.body as FormData;
+		expect(body).toBeInstanceOf(FormData);
+		const sent = body.get('image');
+		expect(sent).toBeInstanceOf(File);
+		expect((sent as File).name).toBe('image');
+		// The bound the signal was built with, pinned so it can't silently grow.
+		expect(FUZZYSEARCH_TIMEOUT_MS).toBe(8000);
+	});
+
+	it('accepts an ArrayBuffer as well as a Blob', async () => {
+		const { fn, calls } = fakeFetch(jsonResponse([]));
+		const result = await searchImage(new Uint8Array([9, 9]).buffer, 'k', fn);
+		expect(result).toEqual({ ok: true, matches: [] });
+		expect((calls[0].init.body as FormData).get('image')).toBeInstanceOf(File);
+	});
+
+	it('refuses without a key rather than calling out', async () => {
+		const { fn, calls } = fakeFetch(jsonResponse([]));
+		expect(await searchImage(new Blob(['x']), '', fn)).toEqual({ ok: false, reason: 'no_key' });
+		expect(calls).toHaveLength(0);
+	});
+});
+
+describe('searchImage — failure mapping', () => {
+	const cases: Array<[number, string]> = [
+		[401, 'key_refused'],
+		[429, 'rate_limited'],
+		[413, 'too_large'],
+		[500, 'unavailable'],
+		[404, 'unavailable']
+	];
+	for (const [status, reason] of cases) {
+		it(`maps ${status} to ${reason}`, async () => {
+			const { fn } = fakeFetch(new Response('nope', { status }));
+			expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({ ok: false, reason });
+		});
+	}
+
+	it('splits 400 into too_large and invalid_image by body', async () => {
+		const big = fakeFetch(new Response('{"error":"too_large"}', { status: 400 }));
+		expect(await searchImage(new Blob(['x']), 'k', big.fn)).toEqual({
+			ok: false,
+			reason: 'too_large'
+		});
+		const bad = fakeFetch(new Response('{"error":"could not decode"}', { status: 400 }));
+		expect(await searchImage(new Blob(['x']), 'k', bad.fn)).toEqual({
+			ok: false,
+			reason: 'invalid_image'
+		});
+	});
+
+	it('maps a network error or an aborted request to unavailable', async () => {
+		const { fn } = fakeFetch(async () => {
+			throw new DOMException('The operation was aborted.', 'TimeoutError');
+		});
+		expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({
+			ok: false,
+			reason: 'unavailable'
+		});
+	});
+
+	it('maps an unparseable 200 body to unavailable', async () => {
+		const { fn } = fakeFetch(new Response('<html>', { status: 200 }));
+		expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({
+			ok: false,
+			reason: 'unavailable'
+		});
+	});
+});
+
+function match(over: Partial<LookupMatch>): LookupMatch {
+	return {
+		site: 'FurAffinity',
+		siteId: '1',
+		handles: [],
+		distance: 0,
+		band: 'exact',
+		postedAt: null,
+		rating: null,
+		postUrl: 'https://www.furaffinity.net/view/1/',
+		...over
+	};
+}
+
+describe('pickPrefillMatch', () => {
+	it('takes the first exact or strong match in sorted order', () => {
+		const picked = pickPrefillMatch([
+			match({ siteId: 'a', distance: 1, band: 'strong' }),
+			match({ siteId: 'b', distance: 0, band: 'exact' })
+		]);
+		expect(picked?.siteId).toBe('a');
+	});
+
+	it('is null when nothing is closer than possible', () => {
+		expect(pickPrefillMatch([match({ distance: 4, band: 'possible' })])).toBeNull();
+		expect(pickPrefillMatch([match({ distance: null, band: null })])).toBeNull();
+		expect(pickPrefillMatch([])).toBeNull();
+	});
+});
+
+describe('strictestRating', () => {
+	it('takes the strictest rating across confident matches and names its sites', () => {
+		expect(
+			strictestRating([
+				match({ site: 'FurAffinity', rating: 'general' }),
+				match({ site: 'e621', band: 'strong', distance: 2, rating: 'adult' }),
+				match({ site: 'Twitter', band: 'strong', distance: 1, rating: 'adult' }),
+				match({ site: 'Weasyl', rating: 'mature' })
+			])
+		).toEqual({ rating: 'adult', sites: ['e621', 'Twitter'] });
+	});
+
+	it('ignores possible and unknown-distance matches', () => {
+		expect(
+			strictestRating([
+				match({ rating: 'general' }),
+				match({ site: 'e621', band: 'possible', distance: 6, rating: 'adult' }),
+				match({ site: 'Weasyl', band: null, distance: null, rating: 'adult' })
+			])
+		).toEqual({ rating: 'general', sites: ['FurAffinity'] });
+	});
+
+	it('is null when no confident match carries a rating', () => {
+		expect(strictestRating([match({ rating: null })])).toBeNull();
+		expect(strictestRating([])).toBeNull();
+	});
+});
+
+describe('normalizeSourceUrl', () => {
+	it('folds scheme, host case, www, query, fragment, and trailing slash', () => {
+		const canonical = 'furaffinity.net/view/12345';
+		expect(normalizeSourceUrl('https://www.furaffinity.net/view/12345/')).toBe(canonical);
+		expect(normalizeSourceUrl('http://FurAffinity.NET/view/12345')).toBe(canonical);
+		expect(normalizeSourceUrl('https://www.furaffinity.net/view/12345?full=1#c')).toBe(canonical);
+		expect(normalizeSourceUrl('  https://WWW.furaffinity.net/view/12345//  ')).toBe(canonical);
+	});
+
+	it('keeps path case, since some sites are case-sensitive there', () => {
+		expect(normalizeSourceUrl('https://twitter.com/Kuttoya/status/160')).toBe(
+			'twitter.com/Kuttoya/status/160'
+		);
+	});
+
+	it('is empty for blank input', () => {
+		expect(normalizeSourceUrl('')).toBe('');
+		expect(normalizeSourceUrl(null)).toBe('');
+		expect(normalizeSourceUrl(undefined)).toBe('');
+	});
+});
+
+describe('handleProfileUrl', () => {
+	it('builds profile URLs for the sites we hold a column for', () => {
+		expect(handleProfileUrl('FurAffinity', 'kuttoya')).toBe(
+			'https://www.furaffinity.net/user/kuttoya/'
+		);
+		expect(handleProfileUrl('Twitter', '@kuttoya')).toBe('https://twitter.com/kuttoya');
+	});
+
+	it('returns null for sites with no artist column yet, and for a blank handle', () => {
+		expect(handleProfileUrl('Weasyl', 'kuttoya')).toBeNull();
+		expect(handleProfileUrl('e621', 'kuttoya')).toBeNull();
+		expect(handleProfileUrl('FurAffinity', '  ')).toBeNull();
+	});
+});
+
+describe('findLocalArtists', () => {
+	const rows = [
+		{ id: 1, name: 'Kuttoya', furAffinityUrl: 'https://www.furaffinity.net/user/KUTTOYA/' },
+		{ id: 2, name: 'Someone Else', twitterUrl: 'https://x.com/kuttoya' },
+		{ id: 3, name: 'Nobody', furAffinityUrl: '' }
+	];
+
+	it('matches a FurAffinity handle case-insensitively', () => {
+		const found = findLocalArtists(rows, { site: 'FurAffinity', handles: ['kuttoya'] });
+		expect(found.map((r) => r.id)).toEqual([1]);
+	});
+
+	it('matches a Twitter handle across host spellings', () => {
+		const found = findLocalArtists(rows, { site: 'Twitter', handles: ['Kuttoya'] });
+		expect(found.map((r) => r.id)).toEqual([2]);
+	});
+
+	it('returns nothing for sites with no artist column, or with no handles', () => {
+		expect(findLocalArtists(rows, { site: 'Weasyl', handles: ['kuttoya'] })).toEqual([]);
+		expect(findLocalArtists(rows, { site: 'e621', handles: ['kuttoya'] })).toEqual([]);
+		expect(findLocalArtists(rows, { site: 'FurAffinity', handles: [] })).toEqual([]);
+	});
+});
+
+describe('findArtistsByName', () => {
+	const rows = [{ id: 1, name: 'Kuttoya' }, { id: 2, name: 'kuttoya ' }, { id: 3, name: 'Other' }];
+
+	it('matches exactly, ignoring case, surrounding space, and a leading @', () => {
+		expect(findArtistsByName(rows, 'KUTTOYA').map((r) => r.id)).toEqual([1, 2]);
+		expect(findArtistsByName(rows, '@kuttoya').map((r) => r.id)).toEqual([1, 2]);
+	});
+
+	it('does not match on a substring, or on nothing', () => {
+		expect(findArtistsByName(rows, 'kutt')).toEqual([]);
+		expect(findArtistsByName(rows, '  ')).toEqual([]);
+	});
+});
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
new file mode 100644
index 00000000..0e87f332
--- /dev/null
+++ b/src/lib/server/fuzzysearch.ts
@@ -0,0 +1,317 @@
+// Server-only client for FuzzySearch (https://fuzzysearch.net), the reverse
+// image search behind "Look up artist" (SONA-156).
+//
+// Server-only for two reasons: the API key must never reach the browser, and
+// the operator's artwork leaves this app only from a place we control. Every
+// call is operator-initiated — nothing here runs on a render path, and nothing
+// is sent until the operator clicks.
+//
+// The response body is TREATED AS SECRET-ADJACENT: it is never logged, never
+// stored, and never echoed anywhere but the normalized shape below. A 4xx body
+// can carry the key back, and the match list is third-party data about the
+// operator's own art.
+
+import { MAX_REMOTE_BUFFER_BYTES } from './storage/buffer';
+import { getRawSetting } from './settings';
+import { handlesOverlap, SOCIAL_KEY_TO_PLATFORM } from './handle-normalize';
+import type { Database } from './db';
+
+type Env = App.Platform['env'];
+
+/** site_settings keys. Raw rows, like the registry fork key: kept out of the
+ * SiteSettings interface so the key never serializes to the browser. */
+export const FUZZYSEARCH_API_KEY_SETTING = 'fuzzysearchApiKey';
+/** ISO date-time of the last 401 from FuzzySearch, or '' once a call succeeds. */
+export const FUZZYSEARCH_KEY_REFUSED_SETTING = 'fuzzysearchKeyRefusedAt';
+
+export const FUZZYSEARCH_ENDPOINT = 'https://api.fuzzysearch.net/v1/image';
+/** Same 10 MiB bound every other third-party body gets (storage/buffer.ts). */
+export const FUZZYSEARCH_MAX_BYTES = MAX_REMOTE_BUFFER_BYTES;
+export const FUZZYSEARCH_TIMEOUT_MS = 8000;
+/** Hamming distance past which a match is noise rather than a lead. */
+export const FUZZYSEARCH_MAX_DISTANCE = 7;
+
+export type LookupSite = 'FurAffinity' | 'Weasyl' | 'e621' | 'Twitter';
+export type LookupRating = 'general' | 'mature' | 'adult';
+/** 0 → exact, 1-2 → strong, 3-7 → possible, unknown distance → null. */
+export type MatchBand = 'exact' | 'strong' | 'possible' | null;
+
+export interface LookupMatch {
+	site: LookupSite;
+	siteId: string;
+	/** Raw handles as the source site knows them (not normalized). */
+	handles: string[];
+	distance: number | null;
+	band: MatchBand;
+	postedAt: string | null;
+	rating: LookupRating | null;
+	postUrl: string;
+}
+
+export type LookupFailure =
+	| 'no_key'
+	| 'key_refused'
+	| 'rate_limited'
+	| 'too_large'
+	| 'invalid_image'
+	| 'unavailable';
+
+export type LookupResult =
+	| { ok: true; matches: LookupMatch[] }
+	| { ok: false; reason: LookupFailure };
+
+const SITES: readonly LookupSite[] = ['FurAffinity', 'Weasyl', 'e621', 'Twitter'];
+const RATINGS: readonly LookupRating[] = ['general', 'mature', 'adult'];
+
+/** Display order when distances tie: the sites whose matches are most likely to
+ * name an artist we can link locally come first. */
+const SITE_ORDER: Record<LookupSite, number> = {
+	FurAffinity: 0,
+	Twitter: 1,
+	Weasyl: 2,
+	e621: 3
+};
+
+/**
+ * Resolve the FuzzySearch key: a deploy-time `FUZZYSEARCH_API_KEY` secret wins
+ * and short-circuits the DB read, otherwise the D1 raw setting. Same precedence
+ * as the registry fork key, so a fork can connect from the admin UI without a
+ * deploy. Returns null when the integration is not configured.
+ */
+export async function resolveFuzzysearchKey(
+	db: Database,
+	env: Env | undefined
+): Promise<string | null> {
+	const fromEnv = env?.FUZZYSEARCH_API_KEY?.trim();
+	if (fromEnv) return fromEnv;
+	const stored = (await getRawSetting(db, FUZZYSEARCH_API_KEY_SETTING))?.trim();
+	return stored || null;
+}
+
+/** Band for a distance, matching the wording the UI uses about confidence. */
+export function distanceBand(distance: number | null): MatchBand {
+	if (distance === null) return null;
+	if (distance === 0) return 'exact';
+	if (distance <= 2) return 'strong';
+	return 'possible';
+}
+
+/** Public post URL for a match, by site. Built here rather than trusted from
+ * the response so a hostile payload cannot hand the operator an arbitrary link. */
+export function postUrlFor(site: LookupSite, siteId: string, handles: string[]): string {
+	const id = encodeURIComponent(siteId);
+	switch (site) {
+		case 'FurAffinity':
+			return `https://www.furaffinity.net/view/${id}/`;
+		case 'Weasyl':
+			return `https://www.weasyl.com/submission/${id}`;
+		case 'e621':
+			return `https://e621.net/posts/${id}`;
+		case 'Twitter': {
+			const handle = handles[0];
+			// Without a handle Twitter still resolves the status through /i/.
+			return handle
+				? `https://twitter.com/${encodeURIComponent(handle)}/status/${id}`
+				: `https://twitter.com/i/status/${id}`;
+		}
+	}
+}
+
+/** Canonical profile URL for a handle on a site we hold an artist column for.
+ * Weasyl and e621 have no column yet (SONA-219), so they resolve to null. */
+export function handleProfileUrl(site: LookupSite, handle: string): string | null {
+	const h = handle.trim().replace(/^@+/, '');
+	if (!h) return null;
+	if (site === 'FurAffinity') return `https://www.furaffinity.net/user/${h}/`;
+	if (site === 'Twitter') return `https://twitter.com/${h}`;
+	return null;
+}
+
+/**
+ * Normalize a source-post URL for equality checks: lowercase host, no scheme,
+ * no `www.`, no query, no fragment, no trailing slash. Comparing raw strings
+ * would miss `http` vs `https` and the trailing slash FurAffinity adds.
+ */
+export function normalizeSourceUrl(url: string | null | undefined): string {
+	const raw = (url ?? '').trim();
+	if (!raw) return '';
+	let rest = raw.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
+	rest = rest.replace(/[?#].*$/, '');
+	rest = rest.replace(/\/+$/, '');
+	const slash = rest.indexOf('/');
+	const host = (slash === -1 ? rest : rest.slice(0, slash)).toLowerCase().replace(/^www\./, '');
+	const path = slash === -1 ? '' : rest.slice(slash);
+	return host + path;
+}
+
+interface RawMatch {
+	site?: unknown;
+	site_id_str?: unknown;
+	artists?: unknown;
+	distance?: unknown;
+	posted_at?: unknown;
+	rating?: unknown;
+}
+
+function normalizeMatch(raw: RawMatch): LookupMatch | null {
+	const site = SITES.find((s) => s === raw.site);
+	// 'Unknown' (and anything else we have no post-URL shape for) is dropped:
+	// a match we cannot link to is not a lead the operator can act on.
+	if (!site) return null;
+	const siteId = typeof raw.site_id_str === 'string' ? raw.site_id_str : '';
+	if (!siteId) return null;
+
+	const distance =
+		typeof raw.distance === 'number' && Number.isFinite(raw.distance) ? raw.distance : null;
+	if (distance !== null && (distance < 0 || distance > FUZZYSEARCH_MAX_DISTANCE)) return null;
+
+	const handles = Array.isArray(raw.artists)
+		? raw.artists.filter((a): a is string => typeof a === 'string' && a.trim() !== '')
+		: [];
+	const rating = RATINGS.find((r) => r === raw.rating) ?? null;
+
+	return {
+		site,
+		siteId,
+		handles,
+		distance,
+		band: distanceBand(distance),
+		postedAt: typeof raw.posted_at === 'string' ? raw.posted_at : null,
+		rating,
+		postUrl: postUrlFor(site, siteId, handles)
+	};
+}
+
+/** Closest first; an unknown distance sorts last; ties break on site order. */
+function compareMatches(a: LookupMatch, b: LookupMatch): number {
+	const ad = a.distance ?? Number.POSITIVE_INFINITY;
+	const bd = b.distance ?? Number.POSITIVE_INFINITY;
+	if (ad !== bd) return ad - bd;
+	return SITE_ORDER[a.site] - SITE_ORDER[b.site];
+}
+
+/** Normalize + filter + sort a raw v1/image payload. Exported for tests. */
+export function normalizeMatches(payload: unknown): LookupMatch[] {
+	if (!Array.isArray(payload)) return [];
+	return payload
+		.map((entry) => (entry && typeof entry === 'object' ? normalizeMatch(entry as RawMatch) : null))
+		.filter((m): m is LookupMatch => m !== null)
+		.sort(compareMatches);
+}
+
+/**
+ * POST the bytes to FuzzySearch and return normalized matches.
+ *
+ * `fetchFn` is injected so tests drive this without globals. Failures are
+ * returned as typed reasons rather than thrown: the caller maps each to a
+ * status and a localized line, and the remote body never travels with them.
+ */
+export async function searchImage(
+	bytes: Blob | ArrayBuffer,
+	key: string,
+	fetchFn: typeof fetch = fetch
+): Promise<LookupResult> {
+	if (!key) return { ok: false, reason: 'no_key' };
+
+	const blob = bytes instanceof Blob ? bytes : new Blob([bytes]);
+	const form = new FormData();
+	form.append('image', blob, 'image');
+
+	let res: Response;
+	try {
+		res = await fetchFn(FUZZYSEARCH_ENDPOINT, {
+			method: 'POST',
+			headers: { 'x-api-key': key },
+			body: form,
+			signal: AbortSignal.timeout(FUZZYSEARCH_TIMEOUT_MS)
+		});
+	} catch {
+		// Network error or the timeout firing. Deliberately no logging: the error
+		// can carry the request, and the request carries the key header.
+		return { ok: false, reason: 'unavailable' };
+	}
+
+	if (res.status === 401) return { ok: false, reason: 'key_refused' };
+	if (res.status === 429) return { ok: false, reason: 'rate_limited' };
+	if (res.status === 413) return { ok: false, reason: 'too_large' };
+	if (res.status === 400) {
+		// The one 400 worth distinguishing: FuzzySearch says the image is over its
+		// own limit. The body is inspected for that single token and discarded.
+		const body = await res.text().catch(() => '');
+		return { ok: false, reason: body.includes('too_large') ? 'too_large' : 'invalid_image' };
+	}
+	if (!res.ok) return { ok: false, reason: 'unavailable' };
+
+	const payload = await res.json().catch(() => null);
+	if (payload === null) return { ok: false, reason: 'unavailable' };
+	return { ok: true, matches: normalizeMatches(payload) };
+}
+
+/**
+ * The match worth prefilling the form from: the closest exact or strong one.
+ * `normalizeMatches` already sorted by distance then site, so the first
+ * qualifying entry is the best one.
+ */
+export function pickPrefillMatch(matches: LookupMatch[]): LookupMatch | null {
+	return matches.find((m) => m.band === 'exact' || m.band === 'strong') ?? null;
+}
+
+/**
+ * The strictest rating carried by the confident matches, with the sites that
+ * carried it — so the UI can say where an NSFW suggestion came from. Possible
+ * and unknown-distance matches are excluded: a loose match must not flip the
+ * operator's NSFW flag.
+ */
+export function strictestRating(
+	matches: LookupMatch[]
+): { rating: LookupRating; sites: LookupSite[] } | null {
+	const confident = matches.filter((m) => m.band === 'exact' || m.band === 'strong');
+	let best: LookupRating | null = null;
+	for (const m of confident) {
+		if (!m.rating) continue;
+		if (best === null || RATINGS.indexOf(m.rating) > RATINGS.indexOf(best)) best = m.rating;
+	}
+	if (!best) return null;
+	const sites: LookupSite[] = [];
+	for (const m of confident) {
+		if (m.rating === best && !sites.includes(m.site)) sites.push(m.site);
+	}
+	return { rating: best, sites };
+}
+
+/** The artist row key that holds a site's profile URL. */
+const SITE_SOCIAL_KEY: Partial<Record<LookupSite, string>> = {
+	FurAffinity: 'furAffinityUrl',
+	Twitter: 'twitterUrl'
+};
+
+/**
+ * Local artists whose stored socials point at one of a match's handles.
+ * Uses `handlesOverlap`, the app's canonical "same artist" predicate, so this
+ * agrees with the registry import and the artists API on what a match is.
+ * A full scan, like every other handle matcher here — there is no handle index.
+ */
+export function findLocalArtists<T extends Record<string, unknown>>(
+	rows: T[],
+	match: Pick<LookupMatch, 'site' | 'handles'>
+): T[] {
+	const key = SITE_SOCIAL_KEY[match.site];
+	if (!key || !(key in SOCIAL_KEY_TO_PLATFORM)) return [];
+	const probes = match.handles
+		.map((h) => handleProfileUrl(match.site, h))
+		.filter((url): url is string => url !== null)
+		.map((url) => ({ [key]: url }));
+	if (probes.length === 0) return [];
+	return rows.filter((row) => probes.some((probe) => handlesOverlap(row, probe)));
+}
+
+/**
+ * Local artists whose display name equals a handle, case-insensitively. Weaker
+ * evidence than a handle match (names collide), so it feeds the dialog's
+ * "you may already have this artist" guard rather than an automatic link.
+ */
+export function findArtistsByName<T extends { name: string }>(rows: T[], handle: string): T[] {
+	const needle = handle.trim().replace(/^@+/, '').toLowerCase();
+	if (!needle) return [];
+	return rows.filter((row) => row.name.trim().toLowerCase() === needle);
+}
diff --git a/wrangler.toml.example b/wrangler.toml.example
index 75fdad41..f3532f9f 100644
--- a/wrangler.toml.example
+++ b/wrangler.toml.example
@@ -33,6 +33,9 @@ keep_vars = true
 #                        submit/sync). Get one via POST /v1/forks on the registry.
 #   REGISTRY_URL       — optional; override the registry base URL (defaults to the
 #                        public registry, https://registry.sona.fast).
+#   FUZZYSEARCH_API_KEY — optional; enables "Look up artist" (reverse image search
+#                        against FuzzySearch). Overrides the key saved in
+#                        Settings → Connections. Free key: api.fuzzysearch.net/selfserve.
 #   RESEND_API_KEY     — optional; enables the admin "Forgot password" reset email
 #                        (via Resend). Without it, recovery is `npm run reset-password`.
 #   RESEND_FROM        — optional; reset-email sender, format "Name <you@domain>".

From f36d77f0f4f8d46b6338a793871bbe16d9cb523d Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 13:51:24 -0700
Subject: [PATCH 02/38] feat(lookup): add POST /api/admin/artist-lookup
 (SONA-156)

Takes either an uploaded file or a stored image id and returns the normalized
FuzzySearch matches, the local artists those matches point at, and any image
already credited to the same source post.

The id shape resolves the URL in D1 and fetches it through proxyStoredImage,
so a caller-supplied URL is never contacted. A refused key is recorded in
site_settings so Settings can say so; the next success clears the marker.
---
 src/routes/api/admin/artist-lookup/+server.ts | 227 +++++++++++
 .../api/admin/artist-lookup/server.test.ts    | 364 ++++++++++++++++++
 2 files changed, 591 insertions(+)
 create mode 100644 src/routes/api/admin/artist-lookup/+server.ts
 create mode 100644 src/routes/api/admin/artist-lookup/server.test.ts

diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
new file mode 100644
index 00000000..262a0824
--- /dev/null
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -0,0 +1,227 @@
+import { json, error } from '@sveltejs/kit';
+import { eq, isNotNull } from 'drizzle-orm';
+import { getDb } from '$lib/server/db';
+import { images, artists } from '$lib/server/db/schema';
+import { proxyStoredImage } from '$lib/server/image-proxy';
+import { bufferStream, MaxBytesExceededError } from '$lib/server/storage/buffer';
+import { getRawSetting, setRawSetting } from '$lib/server/settings';
+import {
+	FUZZYSEARCH_KEY_REFUSED_SETTING,
+	FUZZYSEARCH_MAX_BYTES,
+	findArtistsByName,
+	findLocalArtists,
+	normalizeSourceUrl,
+	pickPrefillMatch,
+	resolveFuzzysearchKey,
+	searchImage,
+	type LookupFailure,
+	type LookupMatch
+} from '$lib/server/fuzzysearch';
+import type { RequestHandler } from './$types';
+
+// POST /api/admin/artist-lookup  (admin-only via hooks — everything under /api
+// except /api/cron/ requires the admin session).
+//
+// Reverse image search for "who drew this" (SONA-156). Two request shapes:
+//
+//   multipart/form-data with `file`  — the upload page, where the bytes are
+//                                      still in the browser.
+//   application/json { imageId }     — the edit page, where they are not: the
+//                                      CSP's connect-src blocks the browser
+//                                      from reading a stored image's bytes at
+//                                      all (docs/reading-image-bytes.md).
+//
+// The imageId shape looks the URL up in D1 and fetches it server-side through
+// proxyStoredImage, which is what keeps this from being an SSRF hole. A URL
+// from the caller is never accepted, in either shape.
+//
+// Nothing leaves this app until an operator clicks: there is no cron, no
+// render path, and no background call into this endpoint. FuzzySearch's own
+// response body is never logged, stored, or echoed — only the normalized
+// match list below.
+
+/** What the UI gets back for a failed lookup, and the status carrying it. */
+const FAILURE_STATUS: Record<LookupFailure, number> = {
+	no_key: 400,
+	key_refused: 401,
+	rate_limited: 429,
+	too_large: 413,
+	invalid_image: 422,
+	unavailable: 502
+};
+
+/** Multipart framing (boundary lines + part headers) on top of the file cap,
+ * so a file exactly at the cap still passes the declared-length pre-check and
+ * is judged precisely by the exact size check. Mirrors /api/upload. */
+const MULTIPART_SLACK_BYTES = 64 * 1024;
+
+function failure(reason: LookupFailure) {
+	return json({ enabled: true, error: reason }, { status: FAILURE_STATUS[reason] });
+}
+
+/** Artists whose stored socials or display name point at a match, per match. */
+interface ArtistHit {
+	matchIndex: number;
+	artists: Array<{ id: number; name: string }>;
+}
+
+export const POST: RequestHandler = async ({ request, platform, fetch }) => {
+	const db = getDb(platform!.env.DB);
+
+	// No key configured: the integration is off, not broken. The UI hides the
+	// button on this answer instead of showing an error (the registry shape).
+	const key = await resolveFuzzysearchKey(db, platform?.env);
+	if (!key) return json({ enabled: false });
+
+	const contentType = request.headers.get('content-type') ?? '';
+
+	let bytes: Blob;
+	/** Set on the imageId shape: the image being looked up, excluded from its
+	 * own source-URL clash check. */
+	let selfImage: { id: number; parentImageId: number | null } | null = null;
+
+	if (contentType.includes('multipart/form-data')) {
+		// Layer 1 of the size cap: reject a body the client DECLARES oversized
+		// before formData() materializes it. Absent or unparseable header falls
+		// through to the exact check below.
+		const declaredLength = Number(request.headers.get('content-length') ?? NaN);
+		if (Number.isFinite(declaredLength) && declaredLength > FUZZYSEARCH_MAX_BYTES + MULTIPART_SLACK_BYTES) {
+			return failure('too_large');
+		}
+		const form = await request.formData();
+		const file = form.get('file');
+		if (!(file instanceof File)) error(400, 'No file provided');
+		// Layer 2: the exact check, on the file's real size.
+		if (file.size > FUZZYSEARCH_MAX_BYTES) return failure('too_large');
+		bytes = file;
+	} else {
+		const body = (await request.json().catch(() => null)) as { imageId?: unknown } | null;
+		const imageId = Number(body?.imageId);
+		if (!Number.isInteger(imageId) || imageId <= 0) error(400, 'Invalid image id');
+
+		const row = await db
+			.select({ id: images.id, imageUrl: images.imageUrl, parentImageId: images.parentImageId })
+			.from(images)
+			.where(eq(images.id, imageId))
+			.get();
+		if (!row) error(404, 'Image not found');
+		selfImage = { id: row.id, parentImageId: row.parentImageId };
+
+		// Server-side fetch of a URL the SERVER looked up, with the shared
+		// hardening: private and link-local hosts refused, redirects not
+		// followed, image/* content types only.
+		const stored = await proxyStoredImage(row.imageUrl, fetch);
+		if (!stored?.body) return failure('unavailable');
+		if (!(stored.headers.get('content-type') ?? '').startsWith('image/')) {
+			return failure('unavailable');
+		}
+		try {
+			const buffered = await bufferStream(stored.body, FUZZYSEARCH_MAX_BYTES);
+			// bufferStream allocates an exact-size array, so its backing buffer is
+			// the payload with nothing else in it.
+			bytes = new Blob([buffered.buffer as ArrayBuffer]);
+		} catch (e) {
+			if (e instanceof MaxBytesExceededError) return failure('too_large');
+			return failure('unavailable');
+		}
+	}
+
+	const result = await searchImage(bytes, key, fetch);
+
+	if (!result.ok) {
+		// A refused key is the one failure worth remembering: the settings page
+		// tells the operator their key stopped working instead of leaving the
+		// button failing silently.
+		if (result.reason === 'key_refused') {
+			await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, new Date().toISOString());
+		}
+		return failure(result.reason);
+	}
+
+	// The key works — clear a stale refusal marker (only when one is set, so the
+	// happy path costs one read rather than a write).
+	if (await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)) {
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '');
+	}
+
+	const matches = result.matches;
+	const artistRows = await db
+		.select({
+			id: artists.id,
+			name: artists.name,
+			twitterUrl: artists.twitterUrl,
+			furAffinityUrl: artists.furAffinityUrl
+		})
+		.from(artists);
+
+	const localArtists: ArtistHit[] = [];
+	const nameMatches: ArtistHit[] = [];
+	matches.forEach((match, matchIndex) => {
+		const byHandle = findLocalArtists(artistRows, match);
+		if (byHandle.length) {
+			localArtists.push({ matchIndex, artists: byHandle.map((a) => ({ id: a.id, name: a.name })) });
+		}
+		// Weaker evidence, kept separate: a name collision is a "you may already
+		// have this artist" prompt, never an automatic link.
+		const byName = new Map<number, { id: number; name: string }>();
+		for (const handle of match.handles) {
+			for (const a of findArtistsByName(artistRows, handle)) byName.set(a.id, { id: a.id, name: a.name });
+		}
+		if (byName.size) nameMatches.push({ matchIndex, artists: [...byName.values()] });
+	});
+
+	return json({
+		enabled: true,
+		matches,
+		localArtists,
+		nameMatches,
+		sourceClash: await findSourceClash(db, matches, selfImage)
+	});
+};
+
+/** The image (or variant set) already credited to the same source post, so the
+ * UI can warn before the operator uploads a duplicate. */
+async function findSourceClash(
+	db: ReturnType<typeof getDb>,
+	matches: LookupMatch[],
+	selfImage: { id: number; parentImageId: number | null } | null
+) {
+	const prefill = pickPrefillMatch(matches);
+	if (!prefill) return null;
+	const target = normalizeSourceUrl(prefill.postUrl);
+	if (!target) return null;
+
+	const rows = await db
+		.select({
+			id: images.id,
+			title: images.title,
+			parentImageId: images.parentImageId,
+			sourcePostUrl: images.sourcePostUrl
+		})
+		.from(images)
+		.where(isNotNull(images.sourcePostUrl));
+
+	// The image being looked up is not a clash with itself, and neither are its
+	// own variants — they legitimately share one source post.
+	const selfRoot = selfImage ? (selfImage.parentImageId ?? selfImage.id) : null;
+	const clashing = rows
+		.filter((r) => normalizeSourceUrl(r.sourcePostUrl) === target)
+		.filter((r) => selfRoot === null || (r.parentImageId ?? r.id) !== selfRoot)
+		.sort((a, b) => a.id - b.id);
+	if (clashing.length === 0) return null;
+
+	const first = clashing[0];
+	const rootId = first.parentImageId ?? first.id;
+	const root =
+		first.parentImageId === null
+			? { title: first.title }
+			: await db.select({ title: images.title }).from(images).where(eq(images.id, rootId)).get();
+
+	return {
+		imageId: rootId,
+		title: root?.title ?? first.title,
+		isVariant: first.parentImageId !== null,
+		parentImageId: first.parentImageId,
+		variantCount: clashing.length - 1
+	};
+}
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
new file mode 100644
index 00000000..1981a3aa
--- /dev/null
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -0,0 +1,364 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+// better-sqlite3 ships no bundled types and is a dev-only test dependency here.
+// @ts-expect-error - no declaration file for 'better-sqlite3'
+import Database from 'better-sqlite3';
+import { drizzle } from 'drizzle-orm/d1';
+import { isHttpError } from '@sveltejs/kit';
+import * as schema from '$lib/server/db/schema';
+import { setRawSetting, getRawSetting } from '$lib/server/settings';
+import {
+	FUZZYSEARCH_API_KEY_SETTING,
+	FUZZYSEARCH_KEY_REFUSED_SETTING,
+	FUZZYSEARCH_MAX_BYTES,
+	type LookupResult
+} from '$lib/server/fuzzysearch';
+import { makeD1 } from '$lib/server/test/d1';
+import { POST } from './+server';
+
+// Only the outbound call is stubbed: normalization, banding, URL building and
+// the local-artist matching stay real, so the endpoint's own wiring is what
+// these tests exercise.
+const searchImage = vi.hoisted(() =>
+	vi.fn(
+		async (
+			_bytes: Blob | ArrayBuffer,
+			_key: string,
+			_fetchFn?: typeof fetch
+		): Promise<LookupResult> => ({ ok: true, matches: [] })
+	)
+);
+vi.mock('$lib/server/fuzzysearch', async (importOriginal) => {
+	const original = await importOriginal<typeof import('$lib/server/fuzzysearch')>();
+	return { ...original, searchImage };
+});
+
+const DDL = `CREATE TABLE site_settings (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+	CREATE TABLE images (id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, slug TEXT,
+		image_url TEXT NOT NULL, thumbnail_url TEXT, width INTEGER, height INTEGER, file_size INTEGER,
+		md5hash TEXT, nsfw INTEGER NOT NULL DEFAULT 0, published INTEGER NOT NULL DEFAULT 1,
+		source_post_url TEXT, artist_id INTEGER, collection_id INTEGER, commissioned_at TEXT,
+		parent_image_id INTEGER, variant_label TEXT, featured INTEGER NOT NULL DEFAULT 0,
+		featured_order INTEGER, created_at TEXT);
+	CREATE TABLE artists (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, avatar_url TEXT,
+		twitter_url TEXT, bluesky_url TEXT, telegram_url TEXT, furaffinity_url TEXT,
+		deviantart_url TEXT, patreon_url TEXT, instagram_url TEXT, global_id TEXT UNIQUE,
+		registry_version INTEGER, registry_synced_at TEXT, aliases TEXT,
+		avatar_resolved_at TEXT, created_at TEXT NOT NULL);`;
+
+/** A 1×1-ish PNG stand-in — the endpoint never decodes, it only forwards. */
+const IMAGE_BYTES = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 1, 2, 3, 4]);
+
+function makeEnv(env: Record<string, unknown> = {}) {
+	const sqlite = new Database(':memory:');
+	sqlite.exec(DDL);
+	const d1 = makeD1(sqlite);
+	return {
+		sqlite,
+		db: drizzle(d1, { schema }),
+		platform: { env: { DB: d1, ...env } } as unknown as App.Platform
+	};
+}
+
+/** event.fetch, answering with stored image bytes unless told otherwise. */
+function imageFetch(response?: Response) {
+	const calls: string[] = [];
+	const fn = (async (url: string) => {
+		calls.push(String(url));
+		return (
+			response ??
+			new Response(IMAGE_BYTES, { status: 200, headers: { 'content-type': 'image/png' } })
+		);
+	}) as unknown as typeof fetch;
+	return { fn, calls };
+}
+
+function multipartEvent(
+	platform: App.Platform,
+	file: File,
+	fetchFn: typeof fetch = imageFetch().fn
+) {
+	const form = new FormData();
+	form.append('file', file);
+	const request = new Request('http://localhost/api/admin/artist-lookup', {
+		method: 'POST',
+		body: form
+	});
+	return { request, platform, fetch: fetchFn } as never;
+}
+
+function jsonEvent(platform: App.Platform, body: unknown, fetchFn: typeof fetch = imageFetch().fn) {
+	const request = new Request('http://localhost/api/admin/artist-lookup', {
+		method: 'POST',
+		headers: { 'content-type': 'application/json' },
+		body: JSON.stringify(body)
+	});
+	return { request, platform, fetch: fetchFn } as never;
+}
+
+function pngFile(size = 32) {
+	const bytes = new Uint8Array(size);
+	bytes.set(IMAGE_BYTES.slice(0, 4));
+	return new File([bytes], 'a.png', { type: 'image/png' });
+}
+
+async function statusOf(fn: () => unknown): Promise<number> {
+	try {
+		await fn();
+		return 200;
+	} catch (e) {
+		if (isHttpError(e)) return e.status;
+		throw e;
+	}
+}
+
+const FA_EXACT = {
+	site: 'FurAffinity' as const,
+	siteId: '12345',
+	handles: ['kuttoya'],
+	distance: 0,
+	band: 'exact' as const,
+	postedAt: null,
+	rating: 'general' as const,
+	postUrl: 'https://www.furaffinity.net/view/12345/'
+};
+
+beforeEach(() => {
+	searchImage.mockReset();
+	searchImage.mockResolvedValue({ ok: true, matches: [] });
+});
+
+describe('artist-lookup — configuration', () => {
+	it('answers enabled:false with no key, and never calls out', async () => {
+		const { platform } = makeEnv();
+		const res = await POST(multipartEvent(platform, pngFile()));
+		expect(res.status).toBe(200);
+		expect(await res.json()).toEqual({ enabled: false });
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
+	it('prefers the deploy secret over the saved setting', async () => {
+		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'from-env' });
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'from-settings');
+
+		await POST(multipartEvent(platform, pngFile()));
+
+		expect(searchImage.mock.calls[0][1]).toBe('from-env');
+	});
+
+	it('falls back to the saved setting when no secret is deployed', async () => {
+		const { db, platform } = makeEnv();
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'from-settings');
+
+		await POST(multipartEvent(platform, pngFile()));
+
+		expect(searchImage.mock.calls[0][1]).toBe('from-settings');
+	});
+});
+
+describe('artist-lookup — uploaded file', () => {
+	it('forwards the file and returns normalized matches with local artists', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO artists (name, furaffinity_url, created_at)
+			 VALUES ('Kuttoya', 'https://www.furaffinity.net/user/KUTTOYA/', '2026-01-01');
+			 INSERT INTO artists (name, created_at) VALUES ('kuttoya', '2026-01-01');`
+		);
+		searchImage.mockResolvedValue({ ok: true, matches: [FA_EXACT] });
+
+		const res = await POST(multipartEvent(platform, pngFile()));
+		const body = (await res.json()) as {
+			enabled: boolean;
+			matches: unknown[];
+			localArtists: Array<{ matchIndex: number; artists: Array<{ id: number; name: string }> }>;
+			nameMatches: Array<{ matchIndex: number; artists: Array<{ id: number }> }>;
+			sourceClash: unknown;
+		};
+
+		expect(res.status).toBe(200);
+		expect(body.enabled).toBe(true);
+		expect(body.matches).toEqual([FA_EXACT]);
+		expect(body.localArtists).toEqual([{ matchIndex: 0, artists: [{ id: 1, name: 'Kuttoya' }] }]);
+		// Both rows are named for the handle; the name-only one is the weak hit.
+		expect(body.nameMatches[0].artists.map((a) => a.id)).toEqual([1, 2]);
+		expect(body.sourceClash).toBeNull();
+		expect(searchImage.mock.calls[0][0]).toBeInstanceOf(File);
+	});
+
+	it('refuses a file over the remote-body cap on its exact size', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		const res = await POST(multipartEvent(platform, pngFile(FUZZYSEARCH_MAX_BYTES + 1)));
+		expect(res.status).toBe(413);
+		expect(await res.json()).toEqual({ enabled: true, error: 'too_large' });
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
+	it('refuses a declared-oversized body before reading it', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		const request = new Request('http://localhost/api/admin/artist-lookup', {
+			method: 'POST',
+			headers: {
+				'content-type': 'multipart/form-data; boundary=x',
+				'content-length': String(FUZZYSEARCH_MAX_BYTES + 1024 * 1024)
+			},
+			body: '--x--'
+		});
+		const res = await POST({ request, platform, fetch: imageFetch().fn } as never);
+		expect(res.status).toBe(413);
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
+	it('rejects a multipart body with no file', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		const request = new Request('http://localhost/api/admin/artist-lookup', {
+			method: 'POST',
+			body: new FormData()
+		});
+		expect(await statusOf(() => POST({ request, platform, fetch: imageFetch().fn } as never))).toBe(
+			400
+		);
+	});
+});
+
+describe('artist-lookup — stored image by id', () => {
+	it('fetches the URL the server looked up, not one the caller sent', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.png', '2026-01-01');`
+		);
+		const fetcher = imageFetch();
+
+		const res = await POST(
+			jsonEvent(platform, { imageId: 1, imageUrl: 'http://169.254.169.254/latest' }, fetcher.fn)
+		);
+
+		expect(res.status).toBe(200);
+		// The attacker-supplied URL is never contacted; the stored one is.
+		expect(fetcher.calls).toEqual(['https://cdn.example.com/stored.png']);
+		expect(searchImage.mock.calls[0][0]).toBeInstanceOf(Blob);
+	});
+
+	it('rejects a body that carries only a URL', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		const fetcher = imageFetch();
+		expect(
+			await statusOf(() =>
+				POST(jsonEvent(platform, { imageUrl: 'https://evil.example/x.png' }, fetcher.fn))
+			)
+		).toBe(400);
+		expect(fetcher.calls).toEqual([]);
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
+	it('404s an unknown id', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		expect(await statusOf(() => POST(jsonEvent(platform, { imageId: 404 })))).toBe(404);
+	});
+
+	it('reports unavailable when the stored image is not an image', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.png', '2026-01-01');`
+		);
+		const html = new Response('<html>', {
+			status: 200,
+			headers: { 'content-type': 'text/html' }
+		});
+
+		const res = await POST(jsonEvent(platform, { imageId: 1 }, imageFetch(html).fn));
+
+		expect(res.status).toBe(502);
+		expect(await res.json()).toEqual({ enabled: true, error: 'unavailable' });
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+});
+
+describe('artist-lookup — failure mapping and the refused marker', () => {
+	it('records the refusal on a 401 and clears it on the next success', async () => {
+		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		searchImage.mockResolvedValue({ ok: false, reason: 'key_refused' });
+
+		const refused = await POST(multipartEvent(platform, pngFile()));
+		expect(refused.status).toBe(401);
+		expect(await refused.json()).toEqual({ enabled: true, error: 'key_refused' });
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+
+		searchImage.mockResolvedValue({ ok: true, matches: [] });
+		const ok = await POST(multipartEvent(platform, pngFile()));
+		expect(ok.status).toBe(200);
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe('');
+	});
+
+	it('maps each remaining failure to its status without echoing a body', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		const cases = [
+			['rate_limited', 429],
+			['too_large', 413],
+			['invalid_image', 422],
+			['unavailable', 502]
+		] as const;
+		for (const [reason, status] of cases) {
+			searchImage.mockResolvedValue({ ok: false, reason });
+			const res = await POST(multipartEvent(platform, pngFile()));
+			expect(res.status, reason).toBe(status);
+			expect(await res.json()).toEqual({ enabled: true, error: reason });
+		}
+	});
+});
+
+describe('artist-lookup — source-post clash', () => {
+	const clashSetup = (extra = '') => {
+		const env = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		env.sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, source_post_url, parent_image_id, created_at)
+			 VALUES (1, 'Sparky at the beach', 'beach', 'https://cdn/1.png',
+				 'http://FurAffinity.net/view/12345?full=1', NULL, '2026-01-01'),
+				(2, 'Beach variant', 'beach-v', 'https://cdn/2.png',
+				 'https://www.furaffinity.net/view/12345/', 1, '2026-01-02'),
+				(3, 'Unrelated', 'other', 'https://cdn/3.png',
+				 'https://www.furaffinity.net/view/999/', NULL, '2026-01-03');
+			 ${extra}`
+		);
+		searchImage.mockResolvedValue({ ok: true, matches: [FA_EXACT] });
+		return env;
+	};
+
+	it('reports the parent of the set that already carries the source URL', async () => {
+		const { platform } = clashSetup();
+		const res = await POST(multipartEvent(platform, pngFile()));
+		const body = (await res.json()) as { sourceClash: Record<string, unknown> };
+
+		expect(body.sourceClash).toEqual({
+			imageId: 1,
+			title: 'Sparky at the beach',
+			isVariant: false,
+			parentImageId: null,
+			variantCount: 1
+		});
+	});
+
+	it('does not report an image clashing with its own variant set', async () => {
+		const { platform } = clashSetup();
+		const res = await POST(jsonEvent(platform, { imageId: 2 }));
+		const body = (await res.json()) as { sourceClash: unknown };
+		expect(body.sourceClash).toBeNull();
+	});
+
+	it('is null when nothing shares the URL, or when no match is confident', async () => {
+		const { platform } = clashSetup();
+		searchImage.mockResolvedValue({
+			ok: true,
+			matches: [{ ...FA_EXACT, distance: 5, band: 'possible' }]
+		});
+		const loose = await POST(multipartEvent(platform, pngFile()));
+		expect(((await loose.json()) as { sourceClash: unknown }).sourceClash).toBeNull();
+
+		searchImage.mockResolvedValue({
+			ok: true,
+			matches: [{ ...FA_EXACT, siteId: '55555', postUrl: 'https://www.furaffinity.net/view/55555/' }]
+		});
+		const none = await POST(multipartEvent(platform, pngFile()));
+		expect(((await none.json()) as { sourceClash: unknown }).sourceClash).toBeNull();
+	});
+});

From 536786fca2d95e449dacc59ecb01d48b0b4ad719 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 13:57:37 -0700
Subject: [PATCH 03/38] feat(settings): add the Artist lookup section to
 Connections (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four states: not connected, connected, confirming removal, and key refused.
The section leads with what leaves the site — Sona sends the image file to
FuzzySearch, an independent service that may keep a copy — so an operator
reads that before pasting a key rather than after.

The key is a raw site_settings row. Only a mask reaches the client, and a key
that came from the FUZZYSEARCH_API_KEY deploy secret sends nothing derived
from itself at all.
---
 messages/en.json                              |  24 +++
 messages/ja.json                              |  24 +++
 src/lib/server/fuzzysearch.ts                 |  11 ++
 src/routes/admin/settings/+page.server.ts     |  53 ++++++
 src/routes/admin/settings/+page.svelte        | 161 ++++++++++++++++++
 src/routes/admin/settings/page.server.test.ts | 124 ++++++++++++++
 6 files changed, 397 insertions(+)

diff --git a/messages/en.json b/messages/en.json
index 9d792723..713f0d4e 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -1182,6 +1182,30 @@
 	"admin_settings_disconnecting": "Disconnecting…",
 	"admin_settings_connect_registry": "Connect to registry",
 	"admin_settings_forkkey_hint": "The fork key is stored in your site's database (not a deploy secret). It's a low-privilege, revocable, submit-only key.",
+	"admin_settings_lookup_heading": "Artist lookup",
+	"admin_settings_lookup_explainer_1": "Find who drew a piece when the post doesn't say. When you click Look up artist on an upload, Sona sends that image file to FuzzySearch. FuzzySearch matches it against its index of FurAffinity, Weasyl, e621, and the Twitter accounts it tracks. Sona sends nothing until you click, and keeps only the values you apply to the form.",
+	"admin_settings_lookup_explainer_2": "FuzzySearch is an independent service, not part of Sona. It may keep a copy or a hash of what you send. Sona has no agreement with it and can't delete anything on your behalf.",
+	"admin_settings_lookup_key_label": "FuzzySearch API key",
+	"admin_settings_lookup_key_placeholder": "Paste your key",
+	"admin_settings_lookup_hint_pre": "You can get a free key at ",
+	"admin_settings_lookup_hint_post": ".",
+	"admin_settings_lookup_save": "Save key",
+	"admin_settings_lookup_saved": "Key saved.",
+	"admin_settings_lookup_error_invalid": "That doesn't look like a key. Paste it exactly as FuzzySearch gave it to you.",
+	"admin_settings_lookup_connected_eyebrow": "CONNECTED",
+	"admin_settings_lookup_saved_key_label": "Saved key",
+	"admin_settings_lookup_replace": "To use a different key, remove this one and save the new one.",
+	"admin_settings_lookup_remove": "Remove key",
+	"admin_settings_lookup_removed": "Key removed.",
+	"admin_settings_lookup_confirm": "Remove the key? Look up artist disappears from upload and edit until you save a new one.",
+	"admin_settings_lookup_confirm_remove": "Remove",
+	"admin_settings_lookup_confirm_keep": "Keep",
+	"admin_settings_lookup_refused_eyebrow": "KEY REFUSED",
+	"admin_settings_lookup_refused_line": "FuzzySearch didn't accept this key on the last lookup ({date}).",
+	"admin_settings_lookup_refused_key_label": "Refused key",
+	"admin_settings_lookup_new_key_label": "New FuzzySearch API key",
+	"admin_settings_lookup_secret_pre": "Set by the ",
+	"admin_settings_lookup_secret_post": " deploy secret. Manage it wherever you set your deploy secrets.",
 	"admin_settings_danger_zone": "Danger Zone",
 	"admin_settings_export_title": "Export data",
 	"admin_settings_export_desc": "Download a full backup of all images, metadata, collections, and tags as a JSON file.",
diff --git a/messages/ja.json b/messages/ja.json
index aee3c372..c47cb66a 100644
--- a/messages/ja.json
+++ b/messages/ja.json
@@ -902,6 +902,30 @@
 	"admin_settings_disconnecting": "切断中…",
 	"admin_settings_connect_registry": "レジストリに接続",
 	"admin_settings_forkkey_hint": "フォークキーはサイトのデータベースに保存されます（デプロイシークレットではありません）。低権限・失効可能・申請専用のキーです。",
+	"admin_settings_lookup_heading": "アーティスト検索",
+	"admin_settings_lookup_explainer_1": "投稿元に記載がない作品でも、描いた人を探せます。アップロードした画像で「アーティストを検索」を押すと、Sonaはその画像ファイルをFuzzySearchに送信します。FuzzySearchは、FurAffinity・Weasyl・e621と、収集対象のTwitterアカウントのインデックスと照合します。押すまでは何も送信されず、フォームに反映した値だけが保存されます。",
+	"admin_settings_lookup_explainer_2": "FuzzySearchはSonaとは無関係の外部サービスです。送信した画像のコピーやハッシュが保管される場合があります。Sonaは同サービスと契約しておらず、あなたに代わってデータを削除することはできません。",
+	"admin_settings_lookup_key_label": "FuzzySearch APIキー",
+	"admin_settings_lookup_key_placeholder": "キーを貼り付け",
+	"admin_settings_lookup_hint_pre": "無料のキーは ",
+	"admin_settings_lookup_hint_post": " で取得できます。",
+	"admin_settings_lookup_save": "キーを保存",
+	"admin_settings_lookup_saved": "キーを保存しました。",
+	"admin_settings_lookup_error_invalid": "キーの形式が違うようです。FuzzySearchから受け取ったとおりに貼り付けてください。",
+	"admin_settings_lookup_connected_eyebrow": "接続済み",
+	"admin_settings_lookup_saved_key_label": "保存済みのキー",
+	"admin_settings_lookup_replace": "別のキーを使うには、このキーを削除してから新しいキーを保存してください。",
+	"admin_settings_lookup_remove": "キーを削除",
+	"admin_settings_lookup_removed": "キーを削除しました。",
+	"admin_settings_lookup_confirm": "キーを削除しますか？新しいキーを保存するまで、アップロード画面と編集画面から「アーティストを検索」がなくなります。",
+	"admin_settings_lookup_confirm_remove": "削除",
+	"admin_settings_lookup_confirm_keep": "そのままにする",
+	"admin_settings_lookup_refused_eyebrow": "キーが拒否されました",
+	"admin_settings_lookup_refused_line": "前回の検索で、FuzzySearchはこのキーを受け付けませんでした（{date}）。",
+	"admin_settings_lookup_refused_key_label": "拒否されたキー",
+	"admin_settings_lookup_new_key_label": "新しいFuzzySearch APIキー",
+	"admin_settings_lookup_secret_pre": "デプロイシークレット ",
+	"admin_settings_lookup_secret_post": " で設定されています。デプロイシークレットを設定している場所で管理してください。",
 	"admin_settings_danger_zone": "危険な操作",
 	"admin_settings_export_title": "データをエクスポート",
 	"admin_settings_export_desc": "すべての画像・メタデータ・コレクション・タグの完全なバックアップをJSONファイルとしてダウンロードします。",
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index 0e87f332..c276f83f 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -88,6 +88,17 @@ export async function resolveFuzzysearchKey(
 	return stored || null;
 }
 
+/**
+ * Masked record of a stored key for the settings card: bullets for everything
+ * but the last four characters, never fewer than eight bullets, so the mask
+ * says nothing about a short key's length. The operator only needs to
+ * recognize which key is saved — the value itself never leaves the server.
+ */
+export function fuzzysearchKeyDisplayRecord(key: string): string {
+	const tail = key.length > 4 ? key.slice(-4) : '';
+	return '•'.repeat(Math.max(8, key.length - tail.length)) + tail;
+}
+
 /** Band for a distance, matching the wording the UI uses about confidence. */
 export function distanceBand(distance: number | null): MatchBand {
 	if (distance === null) return null;
diff --git a/src/routes/admin/settings/+page.server.ts b/src/routes/admin/settings/+page.server.ts
index 9c4c1949..ef72bf5b 100644
--- a/src/routes/admin/settings/+page.server.ts
+++ b/src/routes/admin/settings/+page.server.ts
@@ -54,6 +54,11 @@ import {
 	REGISTRY_API_KEY_SETTING,
 	REGISTRY_URL_SETTING
 } from '$lib/server/registry';
+import {
+	FUZZYSEARCH_API_KEY_SETTING,
+	FUZZYSEARCH_KEY_REFUSED_SETTING,
+	fuzzysearchKeyDisplayRecord
+} from '$lib/server/fuzzysearch';
 import { syncArtists } from '$lib/server/artist-sync';
 import {
 	resolveRefImage,
@@ -266,6 +271,16 @@ export const load: PageServerLoad = async ({ platform, url, locals }) => {
 	// for display. Empty until the first pilot feature is registered.
 	const earlyAccess = earlyAccessActive(now).map((e) => ({ flag: e.flag, gaDate: formatDate(e.gaDate) }));
 
+	// FuzzySearch key (SONA-156) — a raw setting like the registry fork key, so
+	// it never rides along in the client-exposed SiteSettings. Only the MASK
+	// travels, and only for a key saved here: a key that came from the deploy
+	// secret sends nothing derived from it at all. The mask is attached as its
+	// own field rather than folded into a status object, so a later spread
+	// cannot pick the raw key up by accident (the supporter-key precedent).
+	const fuzzysearchKeyFromEnv = !!platform?.env?.FUZZYSEARCH_API_KEY?.trim();
+	const fuzzysearchStoredKey = (await getRawSetting(db, FUZZYSEARCH_API_KEY_SETTING))?.trim() ?? '';
+	const fuzzysearchRefusedAt = (await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)) ?? '';
+
 	// Per-content-type usage (SONA-192) — R2 only: derived from listing the
 	// bucket, so it also counts files D1 never tracked. Reduced to counts and
 	// sums here; raw object keys never leave the server or reach a log line.
@@ -309,6 +324,15 @@ export const load: PageServerLoad = async ({ platform, url, locals }) => {
 		storageStatus,
 		registryEnabled: isRegistryEnabled(renv),
 		registryHasSecret: !!platform?.env?.REGISTRY_API_KEY,
+		fuzzysearchKeySet: fuzzysearchKeyFromEnv || !!fuzzysearchStoredKey,
+		fuzzysearchKeyFromEnv,
+		fuzzysearchKeyRecord: fuzzysearchStoredKey
+			? fuzzysearchKeyDisplayRecord(fuzzysearchStoredKey)
+			: null,
+		// Pre-formatted here, like the early-access GA dates, so the card renders
+		// one date string identically on SSR and after hydration.
+		fuzzysearchKeyRefusedAt:
+			fuzzysearchStoredKey && fuzzysearchRefusedAt ? formatDate(fuzzysearchRefusedAt) : null,
 		// Presence-only flags for the password-reset setup guide. The secret VALUES
 		// are deploy-time env and must never reach the client — only whether they exist.
 		resendKeySet: !!platform?.env?.RESEND_API_KEY,
@@ -686,6 +710,35 @@ export const actions = {
 		return { success: true, registryMessage: 'Disconnected from the shared registry.' };
 	},
 
+	// FuzzySearch key (SONA-156). A raw setting, like the registry fork key, so
+	// the key stays out of the public client payload — and the action returns
+	// only a flag, never the value it just stored.
+	saveFuzzysearchKey: async ({ request, platform }) => {
+		const db = getDb(platform!.env.DB);
+		const data = await request.formData();
+		const raw = data.get('fuzzysearchApiKey');
+		const key = typeof raw === 'string' ? raw.trim() : '';
+		// Shape check only — whether the key WORKS is answered by the first
+		// lookup, which records a refusal the section then surfaces. Printable
+		// ASCII: an API key with a space or a smart quote in it is a bad paste,
+		// and would ride into a request header.
+		if (key.length < 8 || key.length > 200 || !/^[\x21-\x7e]+$/.test(key)) {
+			return fail(400, { fuzzysearchKeyError: 'invalid' });
+		}
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, key);
+		// A new key deserves a clean slate: the old key's refusal says nothing
+		// about this one.
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '');
+		return { fuzzysearchKeySaved: true };
+	},
+
+	removeFuzzysearchKey: async ({ platform }) => {
+		const db = getDb(platform!.env.DB);
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, '');
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '');
+		return { fuzzysearchKeyRemoved: true };
+	},
+
 	saveSecurityEmail: async ({ request, platform }) => {
 		const db = getDb(platform!.env.DB);
 		const data = await request.formData();
diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index 1ee414a7..a84a5b28 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -176,6 +176,11 @@
 	let savingRecoveryEmail = $state(false);
 	let savingSupporterKey = $state(false);
 	let removingSupporterKey = $state(false);
+	let savingFuzzysearchKey = $state(false);
+	let removingFuzzysearchKey = $state(false);
+	// Purely client state: the Remove key button swaps the action row for a
+	// confirmation block rather than opening a dialog over the section.
+	let confirmingFuzzysearchRemove = $state(false);
 
 	// Localized "in early access right now" list, joined for the status line. Empty
 	// until a pilot feature is registered, in which case the "nothing" line shows.
@@ -1388,6 +1393,109 @@
 	</form>
 {/if}
 
+<!-- Artist lookup (SONA-156): the FuzzySearch connection. Four states — not
+     connected, connected, confirming removal, and key refused — all driven by
+     load data except the confirmation, which is client-only. The key itself
+     never reaches this component: only the mask built in load. -->
+<section class="security-section lookup-section" data-tab="connections">
+	<h2>{m.admin_settings_lookup_heading()}</h2>
+	{#if data.fuzzysearchKeyRefusedAt}
+		<div class="key-eyebrow refused">{m.admin_settings_lookup_refused_eyebrow()}</div>
+	{:else if data.fuzzysearchKeySet}
+		<div class="key-eyebrow connected">{m.admin_settings_lookup_connected_eyebrow()}</div>
+	{/if}
+	<!-- Disclosure first, in both connected and unconnected states: the operator
+	     is sending their own art to a third party, and that has to be readable
+	     before the key goes in, not only after. -->
+	<p class="explainer-body">{m.admin_settings_lookup_explainer_1()}</p>
+	<p class="explainer-body">{m.admin_settings_lookup_explainer_2()}</p>
+
+	{#if data.fuzzysearchKeyFromEnv}
+		<p class="status-line">{m.admin_settings_lookup_secret_pre()}<code>FUZZYSEARCH_API_KEY</code>{m.admin_settings_lookup_secret_post()}</p>
+	{:else if data.fuzzysearchKeyRefusedAt}
+		<p class="status-line">{m.admin_settings_lookup_refused_line({ date: data.fuzzysearchKeyRefusedAt })}</p>
+		<dl class="key-dl">
+			<dt class="sr-only">{m.admin_settings_lookup_refused_key_label()}</dt>
+			<dd class="key-record">{data.fuzzysearchKeyRecord}</dd>
+		</dl>
+	{:else if data.fuzzysearchKeySet}
+		<dl class="key-dl">
+			<dt class="sr-only">{m.admin_settings_lookup_saved_key_label()}</dt>
+			<dd class="key-record">{data.fuzzysearchKeyRecord}</dd>
+		</dl>
+		<p class="status-line replace-line">{m.admin_settings_lookup_replace()}</p>
+		{#if confirmingFuzzysearchRemove}
+			<div class="remove-confirm">
+				<p role="alert">{m.admin_settings_lookup_confirm()}</p>
+				<div class="confirm-actions">
+					<form method="POST" action="?/removeFuzzysearchKey" use:enhance={() => {
+						removingFuzzysearchKey = true;
+						return async ({ result, update }) => {
+							await update({ reset: false });
+							removingFuzzysearchKey = false;
+							confirmingFuzzysearchRemove = false;
+							if (result.type === 'success') toast.success(m.admin_settings_lookup_removed());
+						};
+					}}>
+						<button type="submit" class="btn btn-destructive" disabled={removingFuzzysearchKey}>
+							{m.admin_settings_lookup_confirm_remove()}
+						</button>
+					</form>
+					<!-- svelte-ignore a11y_autofocus -->
+					<button
+						type="button"
+						class="btn btn-secondary"
+						autofocus
+						onclick={() => (confirmingFuzzysearchRemove = false)}
+					>{m.admin_settings_lookup_confirm_keep()}</button>
+				</div>
+			</div>
+		{:else}
+			<div class="key-actions">
+				<button type="button" class="btn btn-remove" onclick={() => (confirmingFuzzysearchRemove = true)}>
+					{m.admin_settings_lookup_remove()}
+				</button>
+			</div>
+		{/if}
+	{/if}
+
+	{#if !data.fuzzysearchKeyFromEnv && (!data.fuzzysearchKeySet || data.fuzzysearchKeyRefusedAt)}
+		<form method="POST" action="?/saveFuzzysearchKey" use:enhance={() => {
+			savingFuzzysearchKey = true;
+			return async ({ result, update }) => {
+				await update({ reset: false });
+				savingFuzzysearchKey = false;
+				if (result.type === 'success') toast.success(m.admin_settings_lookup_saved());
+			};
+		}}>
+			<label>
+				<span>{data.fuzzysearchKeyRefusedAt ? m.admin_settings_lookup_new_key_label() : m.admin_settings_lookup_key_label()}</span>
+				<input
+					type="password"
+					class="input"
+					id="fuzzysearch-key"
+					name="fuzzysearchApiKey"
+					autocomplete="off"
+					placeholder={m.admin_settings_lookup_key_placeholder()}
+					aria-invalid={form?.fuzzysearchKeyError ? 'true' : undefined}
+					aria-describedby={form?.fuzzysearchKeyError ? 'fuzzysearch-key-error' : undefined}
+				/>
+			</label>
+			{#if form?.fuzzysearchKeyError}
+				<p class="field-error" id="fuzzysearch-key-error" role="alert">{m.admin_settings_lookup_error_invalid()}</p>
+			{/if}
+			<div class="save-row">
+				<button type="submit" class="btn btn-primary" disabled={savingFuzzysearchKey}>
+					{savingFuzzysearchKey ? m.admin_saving() : m.admin_settings_lookup_save()}
+				</button>
+			</div>
+			{#if !data.fuzzysearchKeyRefusedAt}
+				<p class="hint">{m.admin_settings_lookup_hint_pre()}<a class="link-inline" href="https://api.fuzzysearch.net/selfserve" target="_blank" rel="noopener noreferrer">api.fuzzysearch.net/selfserve<span class="sr-only">{' '}{m.link_opens_new_tab()}</span></a>{m.admin_settings_lookup_hint_post()}</p>
+			{/if}
+		</form>
+	{/if}
+</section>
+
 <section class="danger-zone" data-tab="account">
 	<h2>{m.admin_settings_danger_zone()}</h2>
 	<div class="danger-divider"></div>
@@ -2354,6 +2462,59 @@
 	.key-actions {
 		margin-top: 14px;
 	}
+
+	/* ── Artist lookup / FuzzySearch (SONA-156) ───────────────── */
+	/* The state colour rides the eyebrow, the section's only status surface —
+	   the same convention the supporter card uses for its countdown. */
+	.lookup-section .key-eyebrow.connected {
+		color: var(--status-ok);
+	}
+	.lookup-section .key-eyebrow.refused {
+		color: var(--status-warn);
+	}
+	/* The <dl> exists for the screen-reader label on the mask; it must not add
+	   spacing of its own on top of .key-record. */
+	.lookup-section .key-dl {
+		margin: 14px 0 0;
+	}
+	.lookup-section .key-dl dd {
+		margin: 0;
+	}
+	.lookup-section .replace-line {
+		margin-top: 14px;
+		margin-bottom: 0;
+	}
+	/* Bordered pill, destructive text: removing the key is reversible (paste a
+	   new one) so it doesn't earn a filled destructive button here — the filled
+	   one is on the confirmation, where the action actually happens. */
+	.lookup-section .btn-remove {
+		background: none;
+		border: 1px solid var(--border);
+		color: var(--destructive);
+	}
+	.lookup-section .btn-remove:hover {
+		border-color: var(--destructive);
+	}
+	.lookup-section .remove-confirm {
+		margin-top: 14px;
+		padding: 14px 16px;
+		border: 1px solid var(--border);
+		border-radius: var(--radius-s);
+		background: var(--secondary);
+	}
+	.lookup-section .remove-confirm p {
+		margin: 0 0 14px;
+		font-size: 14px;
+		color: var(--foreground);
+		line-height: 1.55;
+		max-width: 62ch;
+	}
+	.lookup-section .confirm-actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 10px;
+		align-items: center;
+	}
 	.save-row {
 		margin-top: 20px;
 	}
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 96b524f6..39f848bc 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -7,6 +7,11 @@ import { drizzle } from 'drizzle-orm/d1';
 import * as schema from '$lib/server/db/schema';
 import { siteSettings } from '$lib/server/db/schema';
 import { REGISTRY_API_KEY_SETTING } from '$lib/server/registry';
+import {
+	FUZZYSEARCH_API_KEY_SETTING,
+	FUZZYSEARCH_KEY_REFUSED_SETTING,
+	fuzzysearchKeyDisplayRecord
+} from '$lib/server/fuzzysearch';
 import {
 	getRawSetting,
 	setRawSetting,
@@ -1900,3 +1905,122 @@ describe('settings load — storage breakdown (SONA-192)', () => {
 		}
 	});
 });
+
+// Artist lookup (SONA-156). The FuzzySearch key is a raw setting, so the load
+// exposes a MASK and a presence flag, never the key — and the deploy secret,
+// when set, sends nothing derived from itself at all.
+describe('settings — FuzzySearch key', () => {
+	function keyEvent(platform: App.Platform, fields: Record<string, string>) {
+		const body = new FormData();
+		for (const [k, v] of Object.entries(fields)) body.append(k, v);
+		return {
+			platform,
+			url: LOAD_URL,
+			request: new Request('https://taro.surf/admin/settings?/saveFuzzysearchKey', {
+				method: 'POST',
+				body
+			})
+		} as never;
+	}
+
+	it('saves a well-formed key and clears any standing refusal', async () => {
+		const { db, platform } = makeLoadDb();
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T00:00:00.000Z');
+
+		const result = await actions.saveFuzzysearchKey(
+			keyEvent(platform, { fuzzysearchApiKey: '  fs-live-abcdef3k9q  ' })
+		);
+
+		expect(result).toEqual({ fuzzysearchKeySaved: true });
+		expect(await getRawSetting(db, FUZZYSEARCH_API_KEY_SETTING)).toBe('fs-live-abcdef3k9q');
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe('');
+	});
+
+	it('refuses a key that is too short, too long, or not printable ASCII', async () => {
+		const { db, platform } = makeLoadDb();
+		for (const bad of ['short12', 'x'.repeat(201), 'has space here', 'smart“quote”key']) {
+			const result = (await actions.saveFuzzysearchKey(
+				keyEvent(platform, { fuzzysearchApiKey: bad })
+			)) as unknown as { status: number; data: { fuzzysearchKeyError: string } };
+			expect(result.status, bad).toBe(400);
+			expect(result.data.fuzzysearchKeyError).toBe('invalid');
+		}
+		expect(await getRawSetting(db, FUZZYSEARCH_API_KEY_SETTING)).toBeNull();
+	});
+
+	it('removes the key and the refusal marker together', async () => {
+		const { db, platform } = makeLoadDb();
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'fs-live-abcdef3k9q');
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T00:00:00.000Z');
+
+		expect(await actions.removeFuzzysearchKey({ platform } as never)).toEqual({
+			fuzzysearchKeyRemoved: true
+		});
+		expect(await getRawSetting(db, FUZZYSEARCH_API_KEY_SETTING)).toBe('');
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe('');
+	});
+
+	it('exposes a mask and presence, never the key itself', async () => {
+		const { db, platform } = makeLoadDb();
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'fs-live-abcdef3k9q');
+
+		const result = (await load(loadEvent(platform))) as unknown as Record<string, unknown>;
+
+		expect(result.fuzzysearchKeySet).toBe(true);
+		expect(result.fuzzysearchKeyFromEnv).toBe(false);
+		expect(result.fuzzysearchKeyRecord).toBe('••••••••••••••3k9q');
+		expect(JSON.stringify(result)).not.toContain('fs-live-abcdef3k9q');
+	});
+
+	it('reports the deploy secret without deriving anything from it', async () => {
+		const { platform } = makeLoadDb({ FUZZYSEARCH_API_KEY: 'fs-live-fromdeploy' });
+
+		const result = (await load(loadEvent(platform))) as unknown as Record<string, unknown>;
+
+		expect(result.fuzzysearchKeySet).toBe(true);
+		expect(result.fuzzysearchKeyFromEnv).toBe(true);
+		expect(result.fuzzysearchKeyRecord).toBeNull();
+		expect(JSON.stringify(result)).not.toContain('fromdeploy');
+	});
+
+	it('surfaces a formatted refusal date only while a key is saved', async () => {
+		const { db, platform } = makeLoadDb();
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T10:20:30.000Z');
+
+		const orphan = (await load(loadEvent(platform))) as unknown as Record<string, unknown>;
+		expect(orphan.fuzzysearchKeyRefusedAt).toBeNull();
+
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'fs-live-abcdef3k9q');
+		const refused = (await load(loadEvent(platform))) as unknown as Record<string, unknown>;
+		expect(refused.fuzzysearchKeyRefusedAt).toBe('2026.09.01');
+	});
+
+	it('masks a short key to at least eight bullets', () => {
+		expect(fuzzysearchKeyDisplayRecord('abcd1234')).toBe('••••••••1234');
+		expect(fuzzysearchKeyDisplayRecord('abc')).toBe('••••••••');
+	});
+});
+
+// Source pin: the disclosure copy is the point of this section — an operator
+// has to read what leaves their site before they paste a key. Nothing renders
+// Svelte under the pure-TS vitest setup, so grep the file (the #182 pattern).
+describe('artist lookup section markup (SONA-156)', () => {
+	const src = readFileSync(new URL('./+page.svelte', import.meta.url), 'utf8');
+
+	it('renders both disclosure paragraphs', () => {
+		expect(src).toContain('m.admin_settings_lookup_explainer_1()');
+		expect(src).toContain('m.admin_settings_lookup_explainer_2()');
+	});
+
+	it('links the self-serve key page as a safe external link', () => {
+		expect(src).toContain('https://api.fuzzysearch.net/selfserve');
+		const link = src.slice(src.indexOf('https://api.fuzzysearch.net/selfserve'), src.indexOf('https://api.fuzzysearch.net/selfserve') + 200);
+		expect(link).toContain('rel="noopener noreferrer"');
+	});
+
+	it('takes the key in a password field and never renders a stored key', () => {
+		expect(src).toContain('name="fuzzysearchApiKey"');
+		expect(src).toContain('data.fuzzysearchKeyRecord');
+		expect(src).not.toContain('data.fuzzysearchApiKey');
+	});
+});

From 3d7f369feedda659417cef1fd344e24a25b2a72a Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 13:57:40 -0700
Subject: [PATCH 04/38] docs: name FuzzySearch in the architecture diagram and
 README (SONA-156)

Adds the FuzzySearch node and its Admin edge to the external-services
subgraph, extends the optional-integrations sentence, and gives the feature a
README bullet naming the secret that gates it.
---
 README.md            | 4 ++++
 docs/architecture.md | 6 ++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 108fac0d..aeac4aeb 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,10 @@ original deployment it grew out of). The project home is
 - **Sticker packs** — mirror Telegram sticker sets or upload your own; static,
   animated (.tgs→Lottie), and video stickers, with per-sticker artist credit and
   emoji search. *(Telegram import gated by `TELEGRAM_BOT_TOKEN`.)*
+- **Artist lookup** — reverse image search an upload against FuzzySearch to
+  find who drew it, then credit them without leaving the form. *(Optional;
+  keyed off a `FUZZYSEARCH_API_KEY` secret or a key saved in Settings →
+  Connections. Nothing is sent until you click.)*
 - **Conventions** — track the cons you're attending (picked from the
   [cons.fyi](https://cons.fyi) feed, synced from your Bluesky "going" labels, or
   entered manually); upcoming ones show on the About page.
diff --git a/docs/architecture.md b/docs/architecture.md
index 0765f1b9..89342be6 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -41,6 +41,7 @@ graph TB
     subgraph "External services"
         TG[🤖 Telegram Bot API]
         FurTrack[📸 FurTrack]
+        FuzzySearch[🔍 FuzzySearch — reverse image search]
         Resend[✉️ Resend]
         Turnstile[🧩 Cloudflare Turnstile]
         ConsFYI[📅 cons.fyi]
@@ -86,6 +87,7 @@ graph TB
 
     Importers -->|sticker sets| TG
     Importers -->|photo import| FurTrack
+    Admin -->|artist lookup| FuzzySearch
     Auth -->|reset email| Resend
     RateLimit --> Turnstile
     Public -->|convention dates| ConsFYI
@@ -129,8 +131,8 @@ graph TB
 - The cons.fyi feed supplies each convention's IANA timezone as well as its
   dates, which is what lets `/connect` decide "here now" in the event's own
   zone rather than the reader's or UTC.
-- Telegram, FurTrack, Resend, and Turnstile are optional integrations, keyed
-  off secrets or settings (see `wrangler.toml.example` for the full list).
+- Telegram, FurTrack, FuzzySearch, Resend, and Turnstile are optional
+  integrations, keyed off secrets or settings (see `wrangler.toml.example` for the full list).
 - GitHub Actions is part of the runtime, not just delivery: the scheduled
   workflows (`sticker-resync` daily 06:00 UTC, `artist-sync` 06:30,
   `avatar-refresh` 07:00, `cleanup-orphans` weekly, `backfill-animated`

From 9d76e87f25f2ff1a23a28b90897bef4f22f5e9c1 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:25:49 -0700
Subject: [PATCH 05/38] fix(lookup): tighten the FuzzySearch client and
 endpoint (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A 200 whose body isn't the documented array is now `unavailable` rather than
an empty match list — reported as no matches it reads as "your art isn't
indexed", which is a different and wrong answer.

Source URLs fold known host aliases (x.com, sfw.furaffinity.net) and lowercase
the path on the two hosts that ignore its case, so a clash warning survives the
operator having saved the same post under its other name. The variant count
only counts the reported set: two unrelated images sharing a source post are
separate clashes.

Also: handles are percent-encoded into profile URLs, the stored-image path
attaches the validated content type to the part it sends, local-artist matching
compares normalized handles instead of round-tripping through a synthetic URL,
and the unreachable `no_key` failure is gone along with searchImage's
ArrayBuffer arm.
---
 src/lib/server/fuzzysearch.test.ts            | 115 ++++++++++++++---
 src/lib/server/fuzzysearch.ts                 |  77 +++++++----
 src/routes/api/admin/artist-lookup/+server.ts |  22 +++-
 .../api/admin/artist-lookup/server.test.ts    | 120 ++++++++++++++++++
 4 files changed, 285 insertions(+), 49 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index b8d15e3f..4b9bb377 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest';
 import {
 	FUZZYSEARCH_ENDPOINT,
+	FUZZYSEARCH_MAX_DISTANCE,
 	FUZZYSEARCH_TIMEOUT_MS,
 	searchImage,
 	normalizeMatches,
@@ -98,6 +99,57 @@ describe('normalizeMatches', () => {
 		expect(normalizeMatches({ matches: [] })).toEqual([]);
 		expect(normalizeMatches(null)).toEqual([]);
 	});
+
+	// The cap is the line between a lead and noise, so it is pinned rather than
+	// left to whatever the constant happens to be.
+	it('keeps a match at the distance cap and drops the one past it', () => {
+		const at = normalizeMatches([
+			{ site: 'FurAffinity', site_id_str: '7', artists: [], distance: FUZZYSEARCH_MAX_DISTANCE }
+		]);
+		expect(at.map((m) => m.siteId)).toEqual(['7']);
+		expect(at[0].band).toBe('possible');
+		expect(
+			normalizeMatches([
+				{ site: 'FurAffinity', site_id_str: '8', artists: [], distance: FUZZYSEARCH_MAX_DISTANCE + 1 }
+			])
+		).toEqual([]);
+	});
+
+	// Third-party JSON: every field can be the wrong shape, and none of it may
+	// throw or reach the operator as a half-built match.
+	it('survives junk entries — dropping or nulling each without throwing', () => {
+		const junk = normalizeMatches([
+			// Negative distance: not a real Hamming distance, so not a lead.
+			{ site: 'FurAffinity', site_id_str: '1', distance: -1 },
+			// Non-numeric distances read as "unknown", which is allowed.
+			{ site: 'FurAffinity', site_id_str: '2', distance: 'close' },
+			{ site: 'FurAffinity', site_id_str: '3', distance: Number.NaN },
+			// No usable id — nothing to link to.
+			{ site: 'FurAffinity', distance: 0 },
+			{ site: 'FurAffinity', site_id_str: 12345, distance: 0 },
+			// Non-object entries.
+			null,
+			'FurAffinity',
+			42,
+			[{ site: 'FurAffinity', site_id_str: '9' }]
+		]);
+
+		expect(junk.map((m) => m.siteId)).toEqual(['2', '3']);
+		expect(junk.every((m) => m.distance === null && m.band === null)).toBe(true);
+	});
+
+	it('keeps only usable handles, and still builds a Twitter URL without one', () => {
+		const [match] = normalizeMatches([
+			{ site: 'Twitter', site_id_str: '160', artists: ['ok', '', '  ', 42, null], distance: 0 }
+		]);
+		expect(match.handles).toEqual(['ok']);
+
+		const [junkOnly] = normalizeMatches([
+			{ site: 'Twitter', site_id_str: '161', artists: [null, 7], distance: 0 }
+		]);
+		expect(junkOnly.handles).toEqual([]);
+		expect(junkOnly.postUrl).toBe('https://twitter.com/i/status/161');
+	});
 });
 
 describe('searchImage — request shape', () => {
@@ -119,19 +171,6 @@ describe('searchImage — request shape', () => {
 		// The bound the signal was built with, pinned so it can't silently grow.
 		expect(FUZZYSEARCH_TIMEOUT_MS).toBe(8000);
 	});
-
-	it('accepts an ArrayBuffer as well as a Blob', async () => {
-		const { fn, calls } = fakeFetch(jsonResponse([]));
-		const result = await searchImage(new Uint8Array([9, 9]).buffer, 'k', fn);
-		expect(result).toEqual({ ok: true, matches: [] });
-		expect((calls[0].init.body as FormData).get('image')).toBeInstanceOf(File);
-	});
-
-	it('refuses without a key rather than calling out', async () => {
-		const { fn, calls } = fakeFetch(jsonResponse([]));
-		expect(await searchImage(new Blob(['x']), '', fn)).toEqual({ ok: false, reason: 'no_key' });
-		expect(calls).toHaveLength(0);
-	});
 });
 
 describe('searchImage — failure mapping', () => {
@@ -179,6 +218,19 @@ describe('searchImage — failure mapping', () => {
 			reason: 'unavailable'
 		});
 	});
+
+	// A 200 carrying something other than the documented array is a broken
+	// upstream. Reported as no matches it would read as "your art isn't indexed",
+	// which is a different — and wrong — answer.
+	it('maps a 200 whose JSON is not an array to unavailable, not an empty list', async () => {
+		for (const body of [{ matches: [] }, 'ok', 42, null]) {
+			const { fn } = fakeFetch(jsonResponse(body));
+			expect(await searchImage(new Blob(['x']), 'k', fn), JSON.stringify(body)).toEqual({
+				ok: false,
+				reason: 'unavailable'
+			});
+		}
+	});
 });
 
 function match(over: Partial<LookupMatch>): LookupMatch {
@@ -248,9 +300,33 @@ describe('normalizeSourceUrl', () => {
 		expect(normalizeSourceUrl('  https://WWW.furaffinity.net/view/12345//  ')).toBe(canonical);
 	});
 
-	it('keeps path case, since some sites are case-sensitive there', () => {
+	// The same post under the site's other name. Without this fold, an operator
+	// who saved the x.com link gets no clash warning for the twitter.com URL
+	// this client builds.
+	it('folds known host aliases onto one canonical host', () => {
+		expect(normalizeSourceUrl('https://x.com/kuttoya/status/160')).toBe(
+			'twitter.com/kuttoya/status/160'
+		);
+		expect(normalizeSourceUrl('https://mobile.twitter.com/kuttoya/status/160')).toBe(
+			'twitter.com/kuttoya/status/160'
+		);
+		expect(normalizeSourceUrl('https://sfw.furaffinity.net/view/12345/')).toBe(
+			'furaffinity.net/view/12345'
+		);
+	});
+
+	it('lowercases the path on the hosts that treat it case-insensitively', () => {
 		expect(normalizeSourceUrl('https://twitter.com/Kuttoya/status/160')).toBe(
-			'twitter.com/Kuttoya/status/160'
+			'twitter.com/kuttoya/status/160'
+		);
+		expect(normalizeSourceUrl('https://www.furaffinity.net/View/12345/')).toBe(
+			'furaffinity.net/view/12345'
+		);
+	});
+
+	it('keeps path case elsewhere, since most sites are case-sensitive there', () => {
+		expect(normalizeSourceUrl('https://www.weasyl.com/submission/5150/Some-Title')).toBe(
+			'weasyl.com/submission/5150/Some-Title'
 		);
 	});
 
@@ -269,6 +345,15 @@ describe('handleProfileUrl', () => {
 		expect(handleProfileUrl('Twitter', '@kuttoya')).toBe('https://twitter.com/kuttoya');
 	});
 
+	// A handle is third-party text: unescaped, a slash or a '?' in it re-points
+	// the URL at a page the operator did not ask for.
+	it('percent-encodes a handle carrying URL syntax', () => {
+		expect(handleProfileUrl('FurAffinity', 'evil/../../news')).toBe(
+			'https://www.furaffinity.net/user/evil%2F..%2F..%2Fnews/'
+		);
+		expect(handleProfileUrl('Twitter', 'a?b#c')).toBe('https://twitter.com/a%3Fb%23c');
+	});
+
 	it('returns null for sites with no artist column yet, and for a blank handle', () => {
 		expect(handleProfileUrl('Weasyl', 'kuttoya')).toBeNull();
 		expect(handleProfileUrl('e621', 'kuttoya')).toBeNull();
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index c276f83f..679a7b97 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -13,7 +13,7 @@
 
 import { MAX_REMOTE_BUFFER_BYTES } from './storage/buffer';
 import { getRawSetting } from './settings';
-import { handlesOverlap, SOCIAL_KEY_TO_PLATFORM } from './handle-normalize';
+import { normalizeHandle, socialsToHandles, type Platform } from './handle-normalize';
 import type { Database } from './db';
 
 type Env = App.Platform['env'];
@@ -49,7 +49,6 @@ export interface LookupMatch {
 }
 
 export type LookupFailure =
-	| 'no_key'
 	| 'key_refused'
 	| 'rate_limited'
 	| 'too_large'
@@ -133,15 +132,33 @@ export function postUrlFor(site: LookupSite, siteId: string, handles: string[]):
 export function handleProfileUrl(site: LookupSite, handle: string): string | null {
 	const h = handle.trim().replace(/^@+/, '');
 	if (!h) return null;
-	if (site === 'FurAffinity') return `https://www.furaffinity.net/user/${h}/`;
-	if (site === 'Twitter') return `https://twitter.com/${h}`;
+	// Percent-encoded like postUrlFor's ids: a handle is third-party text, and a
+	// slash or a '?' in it would otherwise re-point the URL at another page.
+	const safe = encodeURIComponent(h);
+	if (site === 'FurAffinity') return `https://www.furaffinity.net/user/${safe}/`;
+	if (site === 'Twitter') return `https://twitter.com/${safe}`;
 	return null;
 }
 
+/** Hosts that are the same site under two names. Without folding these, an
+ * operator who saved an `x.com` link gets no clash warning for the `twitter.com`
+ * URL this client builds. */
+const HOST_ALIASES: Record<string, string> = {
+	'x.com': 'twitter.com',
+	'mobile.twitter.com': 'twitter.com',
+	'sfw.furaffinity.net': 'furaffinity.net',
+	'd.furaffinity.net': 'furaffinity.net'
+};
+
+/** Hosts whose paths are case-insensitive, so `/View/12345` and `/view/12345`
+ * are one post. Left alone elsewhere — most sites' paths are case-sensitive. */
+const CASE_INSENSITIVE_PATH_HOSTS = new Set(['twitter.com', 'furaffinity.net']);
+
 /**
  * Normalize a source-post URL for equality checks: lowercase host, no scheme,
- * no `www.`, no query, no fragment, no trailing slash. Comparing raw strings
- * would miss `http` vs `https` and the trailing slash FurAffinity adds.
+ * no `www.`, no query, no fragment, no trailing slash, and known host aliases
+ * folded together. Comparing raw strings would miss `http` vs `https`, the
+ * trailing slash FurAffinity adds, and `x.com` against `twitter.com`.
  */
 export function normalizeSourceUrl(url: string | null | undefined): string {
 	const raw = (url ?? '').trim();
@@ -150,8 +167,10 @@ export function normalizeSourceUrl(url: string | null | undefined): string {
 	rest = rest.replace(/[?#].*$/, '');
 	rest = rest.replace(/\/+$/, '');
 	const slash = rest.indexOf('/');
-	const host = (slash === -1 ? rest : rest.slice(0, slash)).toLowerCase().replace(/^www\./, '');
-	const path = slash === -1 ? '' : rest.slice(slash);
+	let host = (slash === -1 ? rest : rest.slice(0, slash)).toLowerCase().replace(/^www\./, '');
+	host = HOST_ALIASES[host] ?? host;
+	let path = slash === -1 ? '' : rest.slice(slash);
+	if (CASE_INSENSITIVE_PATH_HOSTS.has(host)) path = path.toLowerCase();
 	return host + path;
 }
 
@@ -218,15 +237,12 @@ export function normalizeMatches(payload: unknown): LookupMatch[] {
  * status and a localized line, and the remote body never travels with them.
  */
 export async function searchImage(
-	bytes: Blob | ArrayBuffer,
+	bytes: Blob,
 	key: string,
 	fetchFn: typeof fetch = fetch
 ): Promise<LookupResult> {
-	if (!key) return { ok: false, reason: 'no_key' };
-
-	const blob = bytes instanceof Blob ? bytes : new Blob([bytes]);
 	const form = new FormData();
-	form.append('image', blob, 'image');
+	form.append('image', bytes, 'image');
 
 	let res: Response;
 	try {
@@ -254,7 +270,10 @@ export async function searchImage(
 	if (!res.ok) return { ok: false, reason: 'unavailable' };
 
 	const payload = await res.json().catch(() => null);
-	if (payload === null) return { ok: false, reason: 'unavailable' };
+	// A 200 that isn't the documented array is a broken upstream, not a search
+	// with no hits — reporting it as "no matches" would tell the operator their
+	// art is unindexed when nobody actually looked.
+	if (!Array.isArray(payload)) return { ok: false, reason: 'unavailable' };
 	return { ok: true, matches: normalizeMatches(payload) };
 }
 
@@ -290,30 +309,32 @@ export function strictestRating(
 	return { rating: best, sites };
 }
 
-/** The artist row key that holds a site's profile URL. */
-const SITE_SOCIAL_KEY: Partial<Record<LookupSite, string>> = {
-	FurAffinity: 'furAffinityUrl',
-	Twitter: 'twitterUrl'
+/** The platform a site's handles live on, for the sites we hold a column for. */
+const SITE_PLATFORM: Partial<Record<LookupSite, Platform>> = {
+	FurAffinity: 'furaffinity',
+	Twitter: 'twitter'
 };
 
 /**
  * Local artists whose stored socials point at one of a match's handles.
- * Uses `handlesOverlap`, the app's canonical "same artist" predicate, so this
- * agrees with the registry import and the artists API on what a match is.
+ * Compares through `normalizeHandle` and `socialsToHandles`, the same pair
+ * `handlesOverlap` is built on, so this agrees with the registry import and the
+ * artists API on what a match is.
  * A full scan, like every other handle matcher here — there is no handle index.
  */
 export function findLocalArtists<T extends Record<string, unknown>>(
 	rows: T[],
 	match: Pick<LookupMatch, 'site' | 'handles'>
 ): T[] {
-	const key = SITE_SOCIAL_KEY[match.site];
-	if (!key || !(key in SOCIAL_KEY_TO_PLATFORM)) return [];
-	const probes = match.handles
-		.map((h) => handleProfileUrl(match.site, h))
-		.filter((url): url is string => url !== null)
-		.map((url) => ({ [key]: url }));
-	if (probes.length === 0) return [];
-	return rows.filter((row) => probes.some((probe) => handlesOverlap(row, probe)));
+	const platform = SITE_PLATFORM[match.site];
+	if (!platform) return [];
+	const wanted = new Set(
+		match.handles.map((h) => normalizeHandle(platform, h)).filter((h) => h !== '')
+	);
+	if (wanted.size === 0) return [];
+	return rows.filter((row) =>
+		socialsToHandles(row).some((h) => h.platform === platform && wanted.has(h.handleNorm))
+	);
 }
 
 /**
diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index 262a0824..f76f980f 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -42,7 +42,6 @@ import type { RequestHandler } from './$types';
 
 /** What the UI gets back for a failed lookup, and the status carrying it. */
 const FAILURE_STATUS: Record<LookupFailure, number> = {
-	no_key: 400,
 	key_refused: 401,
 	rate_limited: 429,
 	too_large: 413,
@@ -83,7 +82,12 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 	if (contentType.includes('multipart/form-data')) {
 		// Layer 1 of the size cap: reject a body the client DECLARES oversized
 		// before formData() materializes it. Absent or unparseable header falls
-		// through to the exact check below.
+		// through to the exact check below — a chunked body carries no
+		// content-length, so for that shape the exact check on file.size is the
+		// only cap, and formData() buffers the part first. Accepted: this is an
+		// admin-only route behind the session, so a buffered oversized part costs
+		// the operator's own memory, and pre-counting the stream would mean
+		// re-implementing multipart parsing for a caller we already trust.
 		const declaredLength = Number(request.headers.get('content-length') ?? NaN);
 		if (Number.isFinite(declaredLength) && declaredLength > FUZZYSEARCH_MAX_BYTES + MULTIPART_SLACK_BYTES) {
 			return failure('too_large');
@@ -112,14 +116,17 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		// followed, image/* content types only.
 		const stored = await proxyStoredImage(row.imageUrl, fetch);
 		if (!stored?.body) return failure('unavailable');
-		if (!(stored.headers.get('content-type') ?? '').startsWith('image/')) {
+		const storedType = (stored.headers.get('content-type') ?? '').split(';')[0].trim();
+		if (!storedType.startsWith('image/')) {
 			return failure('unavailable');
 		}
 		try {
 			const buffered = await bufferStream(stored.body, FUZZYSEARCH_MAX_BYTES);
 			// bufferStream allocates an exact-size array, so its backing buffer is
-			// the payload with nothing else in it.
-			bytes = new Blob([buffered.buffer as ArrayBuffer]);
+			// the payload with nothing else in it. The validated type rides along so
+			// the multipart part FuzzySearch receives from the edit page looks like
+			// the one the upload page sends (a File carries its own type).
+			bytes = new Blob([buffered.buffer as ArrayBuffer], { type: storedType });
 		} catch (e) {
 			if (e instanceof MaxBytesExceededError) return failure('too_large');
 			return failure('unavailable');
@@ -222,6 +229,9 @@ async function findSourceClash(
 		title: root?.title ?? first.title,
 		isVariant: first.parentImageId !== null,
 		parentImageId: first.parentImageId,
-		variantCount: clashing.length - 1
+		// Only the reported set's own rows. Two unrelated images that happen to
+		// carry the same source URL are separate clashes, and counting them here
+		// would tell the operator this one image has variants it doesn't have.
+		variantCount: clashing.filter((r) => (r.parentImageId ?? r.id) === rootId).length - 1
 	};
 }
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index 1981a3aa..892f98fe 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -255,6 +255,73 @@ describe('artist-lookup — stored image by id', () => {
 		expect(await statusOf(() => POST(jsonEvent(platform, { imageId: 404 })))).toBe(404);
 	});
 
+	it('sends the stored image with the content type the proxy validated', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.jpg', '2026-01-01');`
+		);
+		const jpeg = new Response(IMAGE_BYTES, {
+			status: 200,
+			headers: { 'content-type': 'image/jpeg; charset=binary' }
+		});
+
+		await POST(jsonEvent(platform, { imageId: 1 }, imageFetch(jpeg).fn));
+
+		// The upload page forwards a File, which carries its own type; the edit
+		// page has to attach one or FuzzySearch sees an untyped part.
+		expect((searchImage.mock.calls[0][0] as Blob).type).toBe('image/jpeg');
+	});
+
+	it('reports unavailable when the proxy refuses the stored URL', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/gone.png', '2026-01-01'),
+				(2, 'Internal', 'int', 'http://169.254.169.254/latest/meta-data', '2026-01-01');`
+		);
+
+		// Upstream 404: proxyStoredImage answers null, so there are no bytes.
+		const missing = imageFetch(new Response('nope', { status: 404 }));
+		const gone = await POST(jsonEvent(platform, { imageId: 1 }, missing.fn));
+		expect(gone.status).toBe(502);
+		expect(await gone.json()).toEqual({ enabled: true, error: 'unavailable' });
+
+		// A link-local host stored in the row is refused before any fetch.
+		const internal = imageFetch();
+		const blocked = await POST(jsonEvent(platform, { imageId: 2 }, internal.fn));
+		expect(blocked.status).toBe(502);
+		expect(internal.calls).toEqual([]);
+
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
+	it('refuses a stored image whose body runs past the cap', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Huge', 'huge', 'https://cdn.example.com/huge.png', '2026-01-01');`
+		);
+		// Streamed in 1 MiB chunks rather than allocated whole: bufferStream aborts
+		// mid-stream, which is the behaviour being pinned.
+		const chunk = new Uint8Array(1024 * 1024);
+		let sent = 0;
+		const body = new ReadableStream<Uint8Array>({
+			pull(controller) {
+				if (sent > FUZZYSEARCH_MAX_BYTES) return controller.close();
+				sent += chunk.length;
+				controller.enqueue(chunk);
+			}
+		});
+		const huge = new Response(body, { status: 200, headers: { 'content-type': 'image/png' } });
+
+		const res = await POST(jsonEvent(platform, { imageId: 1 }, imageFetch(huge).fn));
+
+		expect(res.status).toBe(413);
+		expect(await res.json()).toEqual({ enabled: true, error: 'too_large' });
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
 	it('reports unavailable when the stored image is not an image', async () => {
 		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 		sqlite.exec(
@@ -290,6 +357,17 @@ describe('artist-lookup — failure mapping and the refused marker', () => {
 		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe('');
 	});
 
+	it('writes nothing on a clean success with no marker standing', async () => {
+		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+
+		const res = await POST(multipartEvent(platform, pngFile()));
+
+		expect(res.status).toBe(200);
+		// Null, not '': the happy path costs one read, and never a write that
+		// would put a row in site_settings for every lookup.
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBeNull();
+	});
+
 	it('maps each remaining failure to its status without echoing a body', async () => {
 		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 		const cases = [
@@ -338,6 +416,48 @@ describe('artist-lookup — source-post clash', () => {
 		});
 	});
 
+	// The URL can sit on a VARIANT only — a set whose parent row carries no
+	// source URL. The clash is still the whole set, so the operator is pointed at
+	// the parent they can actually open, titled from the parent's own row.
+	it('reports the parent when only a variant carries the source URL', async () => {
+		const env = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		env.sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, source_post_url, parent_image_id, created_at)
+			 VALUES (10, 'Sparky at the beach', 'beach', 'https://cdn/10.png', NULL, NULL, '2026-01-01'),
+				(11, 'Beach variant', 'beach-v', 'https://cdn/11.png',
+				 'https://www.furaffinity.net/view/12345/', 10, '2026-01-02');`
+		);
+		searchImage.mockResolvedValue({ ok: true, matches: [FA_EXACT] });
+
+		const res = await POST(multipartEvent(env.platform, pngFile()));
+		const body = (await res.json()) as { sourceClash: Record<string, unknown> };
+
+		expect(body.sourceClash).toEqual({
+			imageId: 10,
+			title: 'Sparky at the beach',
+			isVariant: true,
+			parentImageId: 10,
+			// One row in the set carries the URL, and it is the row being reported.
+			variantCount: 0
+		});
+	});
+
+	// Two unrelated images can carry the same source post (a two-piece
+	// commission, say). They are separate clashes, not variants of the one
+	// reported — counting them would claim variants this image does not have.
+	it('counts only the reported set when unrelated images share the URL', async () => {
+		const env = clashSetup(
+			`INSERT INTO images (id, title, slug, image_url, source_post_url, parent_image_id, created_at)
+			 VALUES (4, 'Same post, different piece', 'other-piece', 'https://cdn/4.png',
+				 'https://www.furaffinity.net/view/12345/', NULL, '2026-01-04');`
+		);
+
+		const res = await POST(multipartEvent(env.platform, pngFile()));
+		const body = (await res.json()) as { sourceClash: Record<string, unknown> };
+
+		expect(body.sourceClash).toMatchObject({ imageId: 1, variantCount: 1 });
+	});
+
 	it('does not report an image clashing with its own variant set', async () => {
 		const { platform } = clashSetup();
 		const res = await POST(jsonEvent(platform, { imageId: 2 }));

From bca3ef062ad2f018e8501dd01804f7cab365eb03 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:25:57 -0700
Subject: [PATCH 06/38] fix(settings): make the Artist lookup section reachable
 and readable (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Focus is moved by hand across the removal confirmation: into Keep when it
opens, back to Remove key when Keep closes it, and to the key field once the
key is gone. Every button involved unmounts as the state changes, so a bare
`autofocus` left a keyboard user at the top of the page. Keep also gets a
visible boundary — .btn-secondary's fill is the confirmation panel's own
background, so it had no edge at all.

The section had no vertical rhythm: the two disclosure paragraphs and the
field label ran together as one block. The refusal line moves up under the
eyebrow in the lapsed-line voice, the masked record gets a visible "Refused
key" label there, and the refused state offers removal instead of only
overwriting. The key hint moves above the Save button, and the replace line
steps aside while the confirmation is open.

A refusal recorded against the deploy secret no longer surfaces: there is no
key on this page to remove or replace, so the state would be a dead end.

Adds tests/e2e/fuzzysearch-key.spec.ts for the states and the two client-side
transitions. It submits its own save and remove and leaves the key removed.
---
 messages/en.json                              |   5 +-
 messages/ja.json                              |   1 +
 src/routes/admin/settings/+page.server.ts     |  10 +-
 src/routes/admin/settings/+page.svelte        | 100 ++++++++++++----
 src/routes/admin/settings/page.server.test.ts |  55 +++++++++
 tests/e2e/fuzzysearch-key.spec.ts             | 111 ++++++++++++++++++
 6 files changed, 258 insertions(+), 24 deletions(-)
 create mode 100644 tests/e2e/fuzzysearch-key.spec.ts

diff --git a/messages/en.json b/messages/en.json
index 713f0d4e..5da8bfd4 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -1192,7 +1192,8 @@
 	"admin_settings_lookup_save": "Save key",
 	"admin_settings_lookup_saved": "Key saved.",
 	"admin_settings_lookup_error_invalid": "That doesn't look like a key. Paste it exactly as FuzzySearch gave it to you.",
-	"admin_settings_lookup_connected_eyebrow": "CONNECTED",
+	"admin_settings_lookup_connected_eyebrow": "Connected",
+	"admin_settings_lookup_key_ending": "ending {tail}",
 	"admin_settings_lookup_saved_key_label": "Saved key",
 	"admin_settings_lookup_replace": "To use a different key, remove this one and save the new one.",
 	"admin_settings_lookup_remove": "Remove key",
@@ -1200,7 +1201,7 @@
 	"admin_settings_lookup_confirm": "Remove the key? Look up artist disappears from upload and edit until you save a new one.",
 	"admin_settings_lookup_confirm_remove": "Remove",
 	"admin_settings_lookup_confirm_keep": "Keep",
-	"admin_settings_lookup_refused_eyebrow": "KEY REFUSED",
+	"admin_settings_lookup_refused_eyebrow": "Key refused",
 	"admin_settings_lookup_refused_line": "FuzzySearch didn't accept this key on the last lookup ({date}).",
 	"admin_settings_lookup_refused_key_label": "Refused key",
 	"admin_settings_lookup_new_key_label": "New FuzzySearch API key",
diff --git a/messages/ja.json b/messages/ja.json
index c47cb66a..a77c17d3 100644
--- a/messages/ja.json
+++ b/messages/ja.json
@@ -913,6 +913,7 @@
 	"admin_settings_lookup_saved": "キーを保存しました。",
 	"admin_settings_lookup_error_invalid": "キーの形式が違うようです。FuzzySearchから受け取ったとおりに貼り付けてください。",
 	"admin_settings_lookup_connected_eyebrow": "接続済み",
+	"admin_settings_lookup_key_ending": "末尾 {tail}",
 	"admin_settings_lookup_saved_key_label": "保存済みのキー",
 	"admin_settings_lookup_replace": "別のキーを使うには、このキーを削除してから新しいキーを保存してください。",
 	"admin_settings_lookup_remove": "キーを削除",
diff --git a/src/routes/admin/settings/+page.server.ts b/src/routes/admin/settings/+page.server.ts
index ef72bf5b..312758fe 100644
--- a/src/routes/admin/settings/+page.server.ts
+++ b/src/routes/admin/settings/+page.server.ts
@@ -330,9 +330,15 @@ export const load: PageServerLoad = async ({ platform, url, locals }) => {
 			? fuzzysearchKeyDisplayRecord(fuzzysearchStoredKey)
 			: null,
 		// Pre-formatted here, like the early-access GA dates, so the card renders
-		// one date string identically on SSR and after hydration.
+		// one date string identically on SSR and after hydration. Only for a key
+		// saved HERE: a refusal recorded against the deploy secret has no remedy
+		// on this page (no key to remove, no date to trust), so the refused state
+		// would be a dead end. The marker still gets written — it costs nothing
+		// and becomes meaningful again if the secret is ever dropped.
 		fuzzysearchKeyRefusedAt:
-			fuzzysearchStoredKey && fuzzysearchRefusedAt ? formatDate(fuzzysearchRefusedAt) : null,
+			!fuzzysearchKeyFromEnv && fuzzysearchStoredKey && fuzzysearchRefusedAt
+				? formatDate(fuzzysearchRefusedAt)
+				: null,
 		// Presence-only flags for the password-reset setup guide. The secret VALUES
 		// are deploy-time env and must never reach the client — only whether they exist.
 		resendKeySet: !!platform?.env?.RESEND_API_KEY,
diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index a84a5b28..2d03b70b 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { tick } from 'svelte';
 	import { applyAction, enhance } from '$app/forms';
 	import { afterNavigate, invalidateAll, replaceState } from '$app/navigation';
 	import { page } from '$app/stores';
@@ -181,6 +182,19 @@
 	// Purely client state: the Remove key button swaps the action row for a
 	// confirmation block rather than opening a dialog over the section.
 	let confirmingFuzzysearchRemove = $state(false);
+	// Focus is moved by hand across the swap: every button involved UNMOUNTS as
+	// the state changes, so without this a keyboard user lands back on <body> and
+	// restarts from the top of a long page. (A bare `autofocus` doesn't do it —
+	// the document already has a focused element when the panel opens.)
+	let fuzzysearchKeepButton = $state<HTMLButtonElement | null>(null);
+	let fuzzysearchRemoveButton = $state<HTMLButtonElement | null>(null);
+	let fuzzysearchKeyInput = $state<HTMLInputElement | null>(null);
+	$effect(() => {
+		if (confirmingFuzzysearchRemove) fuzzysearchKeepButton?.focus();
+	});
+	// The mask's bullet run is read out one bullet at a time, so it is hidden from
+	// the accessibility tree and the part that identifies the key is spoken instead.
+	const fuzzysearchKeyTail = $derived(data.fuzzysearchKeyRecord?.replace(/^•+/, '') ?? '');
 
 	// Localized "in early access right now" list, joined for the status line. Empty
 	// until a pilot feature is registered, in which case the "nothing" line shows.
@@ -1401,6 +1415,10 @@
 	<h2>{m.admin_settings_lookup_heading()}</h2>
 	{#if data.fuzzysearchKeyRefusedAt}
 		<div class="key-eyebrow refused">{m.admin_settings_lookup_refused_eyebrow()}</div>
+		<!-- Directly under the eyebrow, in the supporter card's lapsed-line voice:
+		     this one sentence is the whole reason the refused state exists, and in
+		     the muted status voice further down it read as more boilerplate. -->
+		<p class="lapsed-line">{m.admin_settings_lookup_refused_line({ date: data.fuzzysearchKeyRefusedAt })}</p>
 	{:else if data.fuzzysearchKeySet}
 		<div class="key-eyebrow connected">{m.admin_settings_lookup_connected_eyebrow()}</div>
 	{/if}
@@ -1412,18 +1430,26 @@
 
 	{#if data.fuzzysearchKeyFromEnv}
 		<p class="status-line">{m.admin_settings_lookup_secret_pre()}<code>FUZZYSEARCH_API_KEY</code>{m.admin_settings_lookup_secret_post()}</p>
-	{:else if data.fuzzysearchKeyRefusedAt}
-		<p class="status-line">{m.admin_settings_lookup_refused_line({ date: data.fuzzysearchKeyRefusedAt })}</p>
-		<dl class="key-dl">
-			<dt class="sr-only">{m.admin_settings_lookup_refused_key_label()}</dt>
-			<dd class="key-record">{data.fuzzysearchKeyRecord}</dd>
-		</dl>
 	{:else if data.fuzzysearchKeySet}
 		<dl class="key-dl">
-			<dt class="sr-only">{m.admin_settings_lookup_saved_key_label()}</dt>
-			<dd class="key-record">{data.fuzzysearchKeyRecord}</dd>
+			<!-- Visible in the refused state, where the record sits above a "New
+			     FuzzySearch API key" field and would otherwise be an unlabelled pill;
+			     the connected state's surrounding copy already names it. -->
+			<dt class={data.fuzzysearchKeyRefusedAt ? 'record-label' : 'sr-only'}>
+				{data.fuzzysearchKeyRefusedAt
+					? m.admin_settings_lookup_refused_key_label()
+					: m.admin_settings_lookup_saved_key_label()}
+			</dt>
+			<dd class="key-record">
+				<span aria-hidden="true">{data.fuzzysearchKeyRecord}</span>
+				{#if fuzzysearchKeyTail}
+					<span class="sr-only">{m.admin_settings_lookup_key_ending({ tail: fuzzysearchKeyTail })}</span>
+				{/if}
+			</dd>
 		</dl>
-		<p class="status-line replace-line">{m.admin_settings_lookup_replace()}</p>
+		{#if !data.fuzzysearchKeyRefusedAt && !confirmingFuzzysearchRemove}
+			<p class="status-line replace-line">{m.admin_settings_lookup_replace()}</p>
+		{/if}
 		{#if confirmingFuzzysearchRemove}
 			<div class="remove-confirm">
 				<p role="alert">{m.admin_settings_lookup_confirm()}</p>
@@ -1435,24 +1461,36 @@
 							removingFuzzysearchKey = false;
 							confirmingFuzzysearchRemove = false;
 							if (result.type === 'success') toast.success(m.admin_settings_lookup_removed());
+							// Both buttons are gone now — send focus to the field that
+							// replaced them rather than dropping it on <body>.
+							await tick();
+							fuzzysearchKeyInput?.focus();
 						};
 					}}>
 						<button type="submit" class="btn btn-destructive" disabled={removingFuzzysearchKey}>
 							{m.admin_settings_lookup_confirm_remove()}
 						</button>
 					</form>
-					<!-- svelte-ignore a11y_autofocus -->
 					<button
 						type="button"
-						class="btn btn-secondary"
-						autofocus
-						onclick={() => (confirmingFuzzysearchRemove = false)}
+						class="btn btn-outline"
+						bind:this={fuzzysearchKeepButton}
+						onclick={async () => {
+							confirmingFuzzysearchRemove = false;
+							await tick();
+							fuzzysearchRemoveButton?.focus();
+						}}
 					>{m.admin_settings_lookup_confirm_keep()}</button>
 				</div>
 			</div>
 		{:else}
 			<div class="key-actions">
-				<button type="button" class="btn btn-remove" onclick={() => (confirmingFuzzysearchRemove = true)}>
+				<button
+					type="button"
+					class="btn btn-remove"
+					bind:this={fuzzysearchRemoveButton}
+					onclick={() => (confirmingFuzzysearchRemove = true)}
+				>
 					{m.admin_settings_lookup_remove()}
 				</button>
 			</div>
@@ -1476,6 +1514,7 @@
 					id="fuzzysearch-key"
 					name="fuzzysearchApiKey"
 					autocomplete="off"
+					bind:this={fuzzysearchKeyInput}
 					placeholder={m.admin_settings_lookup_key_placeholder()}
 					aria-invalid={form?.fuzzysearchKeyError ? 'true' : undefined}
 					aria-describedby={form?.fuzzysearchKeyError ? 'fuzzysearch-key-error' : undefined}
@@ -1484,14 +1523,16 @@
 			{#if form?.fuzzysearchKeyError}
 				<p class="field-error" id="fuzzysearch-key-error" role="alert">{m.admin_settings_lookup_error_invalid()}</p>
 			{/if}
+			<!-- Above the save row, like the registry section's token hint: an
+			     operator without a key needs the link before the button. -->
+			{#if !data.fuzzysearchKeyRefusedAt}
+				<p class="hint">{m.admin_settings_lookup_hint_pre()}<a class="link-inline" href="https://api.fuzzysearch.net/selfserve" target="_blank" rel="noopener noreferrer">api.fuzzysearch.net/selfserve<span class="sr-only">{' '}{m.link_opens_new_tab()}</span></a>{m.admin_settings_lookup_hint_post()}</p>
+			{/if}
 			<div class="save-row">
 				<button type="submit" class="btn btn-primary" disabled={savingFuzzysearchKey}>
 					{savingFuzzysearchKey ? m.admin_saving() : m.admin_settings_lookup_save()}
 				</button>
 			</div>
-			{#if !data.fuzzysearchKeyRefusedAt}
-				<p class="hint">{m.admin_settings_lookup_hint_pre()}<a class="link-inline" href="https://api.fuzzysearch.net/selfserve" target="_blank" rel="noopener noreferrer">api.fuzzysearch.net/selfserve<span class="sr-only">{' '}{m.link_opens_new_tab()}</span></a>{m.admin_settings_lookup_hint_post()}</p>
-			{/if}
 		</form>
 	{/if}
 </section>
@@ -2472,14 +2513,30 @@
 	.lookup-section .key-eyebrow.refused {
 		color: var(--status-warn);
 	}
-	/* The <dl> exists for the screen-reader label on the mask; it must not add
-	   spacing of its own on top of .key-record. */
+	/* .explainer-body carries no margin of its own (the supporter card renders a
+	   single paragraph), so the rhythm is set here: paragraph to paragraph, and
+	   prose to whatever the state puts next — a field label, the key record, or
+	   the secret note — all get the section's 14px step. */
+	.lookup-section .explainer-body {
+		margin: 0 0 14px;
+	}
+	.lookup-section form {
+		margin-top: 14px;
+	}
+	/* The <dl> holds the label for the mask; it must not add spacing of its own
+	   on top of .key-record. */
 	.lookup-section .key-dl {
 		margin: 14px 0 0;
 	}
 	.lookup-section .key-dl dd {
 		margin: 0;
 	}
+	/* Visible only in the refused state, where the record needs naming. */
+	.lookup-section .record-label {
+		font-size: 13px;
+		color: var(--muted-foreground);
+		margin-bottom: 6px;
+	}
 	.lookup-section .replace-line {
 		margin-top: 14px;
 		margin-bottom: 0;
@@ -2487,9 +2544,12 @@
 	/* Bordered pill, destructive text: removing the key is reversible (paste a
 	   new one) so it doesn't earn a filled destructive button here — the filled
 	   one is on the confirmation, where the action actually happens. */
+	/* The boundary is mixed toward --foreground rather than left on --border,
+	   which measures under 1.5:1 against the page and fails SC 1.4.11 as a
+	   control edge (the treatment .btn-outline already uses on hover). */
 	.lookup-section .btn-remove {
 		background: none;
-		border: 1px solid var(--border);
+		border: 1px solid color-mix(in srgb, var(--border) 60%, var(--foreground));
 		color: var(--destructive);
 	}
 	.lookup-section .btn-remove:hover {
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 39f848bc..6de25a52 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -1936,6 +1936,17 @@ describe('settings — FuzzySearch key', () => {
 		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe('');
 	});
 
+	it('accepts the shortest and longest keys the shape check allows', async () => {
+		const { db, platform } = makeLoadDb();
+		for (const ok of ['12345678', 'x'.repeat(200)]) {
+			expect(
+				await actions.saveFuzzysearchKey(keyEvent(platform, { fuzzysearchApiKey: ok })),
+				String(ok.length)
+			).toEqual({ fuzzysearchKeySaved: true });
+			expect(await getRawSetting(db, FUZZYSEARCH_API_KEY_SETTING)).toBe(ok);
+		}
+	});
+
 	it('refuses a key that is too short, too long, or not printable ASCII', async () => {
 		const { db, platform } = makeLoadDb();
 		for (const bad of ['short12', 'x'.repeat(201), 'has space here', 'smart“quote”key']) {
@@ -1995,6 +2006,20 @@ describe('settings — FuzzySearch key', () => {
 		expect(refused.fuzzysearchKeyRefusedAt).toBe('2026.09.01');
 	});
 
+	// A refusal recorded against the DEPLOY SECRET has no remedy on this page:
+	// there is no key here to remove or replace. Surfacing it would render a
+	// "Key refused" state with nothing the operator could do about it.
+	it('never reports a refusal for a key that came from the deploy secret', async () => {
+		const { db, platform } = makeLoadDb({ FUZZYSEARCH_API_KEY: 'fs-live-fromdeploy' });
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'fs-live-abcdef3k9q');
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T10:20:30.000Z');
+
+		const result = (await load(loadEvent(platform))) as unknown as Record<string, unknown>;
+
+		expect(result.fuzzysearchKeyFromEnv).toBe(true);
+		expect(result.fuzzysearchKeyRefusedAt).toBeNull();
+	});
+
 	it('masks a short key to at least eight bullets', () => {
 		expect(fuzzysearchKeyDisplayRecord('abcd1234')).toBe('••••••••1234');
 		expect(fuzzysearchKeyDisplayRecord('abc')).toBe('••••••••');
@@ -2023,4 +2048,34 @@ describe('artist lookup section markup (SONA-156)', () => {
 		expect(src).toContain('data.fuzzysearchKeyRecord');
 		expect(src).not.toContain('data.fuzzysearchApiKey');
 	});
+
+	// The confirmation's safe choice needs a boundary of its own: .btn-secondary
+	// is filled with var(--secondary), which is also the panel's background, so
+	// Keep would sit at a 1.0:1 edge inside it (SC 1.4.11).
+	it('gives the Keep button a visible boundary, not the panel fill', () => {
+		const panel = src.slice(src.indexOf('class="remove-confirm"'));
+		const keep = panel.slice(0, panel.indexOf('admin_settings_lookup_confirm_keep'));
+		expect(keep).toContain('btn-outline');
+		expect(keep).not.toContain('btn-secondary');
+	});
+
+	// Every button in the confirmation unmounts as it is used, so focus is moved
+	// by hand: into Keep when the panel opens, back to Remove key when it closes,
+	// and to the key field once the key is gone. A bare autofocus does none of it.
+	it('drives focus across the confirmation rather than relying on autofocus', () => {
+		const panel = src.slice(src.indexOf('class="remove-confirm"'));
+		expect(panel.slice(0, panel.indexOf('</section>'))).not.toContain('autofocus');
+		expect(src).toContain('bind:this={fuzzysearchKeepButton}');
+		expect(src).toContain('fuzzysearchKeepButton?.focus()');
+		expect(src).toContain('fuzzysearchRemoveButton?.focus()');
+		expect(src).toContain('fuzzysearchKeyInput?.focus()');
+	});
+
+	// The bullet run is announced one bullet at a time, so it is hidden and the
+	// part that identifies the key is spoken instead.
+	it('hides the mask from screen readers and names its ending', () => {
+		const record = src.slice(src.indexOf('<dd class="key-record">'));
+		expect(record.slice(0, 400)).toContain('aria-hidden="true"');
+		expect(src).toContain('m.admin_settings_lookup_key_ending(');
+	});
 });
diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
new file mode 100644
index 00000000..cb162648
--- /dev/null
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -0,0 +1,111 @@
+import { test, expect, type Page } from '@playwright/test';
+import { adminLogin } from './admin-login';
+
+// Artist lookup key settings (SONA-156), driven in a real browser: the four
+// states of the section on the Connections tab, and the two transitions that
+// only exist client-side — the removal confirmation opening, and Keep putting
+// the connected state back. Nothing renders Svelte under vitest, so the unit
+// suite can only grep the source for these (page.server.test.ts does); whether
+// the states actually swap is only answerable here.
+//
+// Mutating, and deliberately narrow about it: this spec submits exactly two
+// actions, saveFuzzysearchKey and removeFuzzysearchKey, and ends with the key
+// removed — which is the seeded state every other spec sees. The invalid-key
+// submission below persists nothing (it fails the shape check server-side).
+
+// Matches ADMIN_PASSWORD in tests/e2e/wrangler.e2e.toml (throwaway local value).
+const PASSWORD = 'e2e-admin-password';
+
+// Printable ASCII, over eight characters: passes the action's shape check. Not
+// a real FuzzySearch key — nothing here calls out.
+const FAKE_KEY = 'e2e-fuzzysearch-key-8901';
+
+const section = (page: Page) => page.locator('section.lookup-section');
+const keyInput = (page: Page) => page.locator('input[name="fuzzysearchApiKey"]');
+const saveButton = (page: Page) =>
+	page.locator('form[action="?/saveFuzzysearchKey"] button[type="submit"]');
+const removeButton = (page: Page) => section(page).locator('button.btn-remove');
+const confirmPanel = (page: Page) => section(page).locator('.remove-confirm');
+const keyRecord = (page: Page) => section(page).locator('.key-record');
+
+// The connections sections are hidden by CSS until the tab is active, and the
+// toggle is client JS — so the click only "takes" once hydrated (the
+// supporter-key spec's retry shape).
+async function openConnectionsTab(page: Page) {
+	await expect(async () => {
+		await page.getByRole('tab', { name: 'Connections', exact: true }).click();
+		await expect(section(page)).toBeVisible({ timeout: 1500 });
+	}).toPass();
+}
+
+// Serial: the two tests below share one settings row, and the second one's
+// starting point is the state the seed leaves behind.
+test.describe.configure({ mode: 'serial' });
+
+test.describe('admin settings artist lookup key', () => {
+	test.beforeEach(async ({ page }) => {
+		await adminLogin(page, PASSWORD);
+		await page.goto('/admin/settings');
+		await openConnectionsTab(page);
+	});
+
+	test('the unconnected state discloses what leaves the site and takes a key', async ({
+		page
+	}) => {
+		// The disclosure is the reason the section leads with prose: an operator
+		// has to read what gets sent before pasting a key.
+		await expect(section(page)).toContainText('sends that image file to FuzzySearch');
+		await expect(section(page)).toContainText('independent service, not part of Sona');
+		await expect(keyInput(page)).toBeVisible();
+		// Nothing saved yet: no masked record, no removal action.
+		await expect(keyRecord(page)).toHaveCount(0);
+		await expect(removeButton(page)).toHaveCount(0);
+		// The link to a key comes before the button that wants one.
+		const hint = section(page).locator('.hint');
+		await expect(hint).toContainText('api.fuzzysearch.net/selfserve');
+	});
+
+	test('a malformed key is refused with the error wired to the field', async ({ page }) => {
+		await keyInput(page).fill('nope');
+		await saveButton(page).click();
+
+		const error = section(page).locator('.field-error#fuzzysearch-key-error');
+		await expect(error).toHaveText(/That doesn't look like a key\./);
+		await expect(keyInput(page)).toHaveAttribute('aria-invalid', 'true');
+		await expect(keyInput(page)).toHaveAttribute('aria-describedby', 'fuzzysearch-key-error');
+		// Rejected before the write: the section is still the unconnected one.
+		await expect(keyRecord(page)).toHaveCount(0);
+	});
+
+	test('saving connects, Keep backs out of removal, and Remove disconnects', async ({ page }) => {
+		await keyInput(page).fill(FAKE_KEY);
+		await saveButton(page).click();
+
+		// Connected: the eyebrow, and the mask — never the key itself.
+		await expect(section(page).locator('.key-eyebrow.connected')).toBeVisible();
+		await expect(keyRecord(page)).toContainText('8901');
+		await expect(keyRecord(page)).not.toContainText('e2e-fuzzysearch');
+		await expect(keyInput(page)).toHaveCount(0);
+
+		// Removal asks first, and moves focus onto the safe choice — every button
+		// involved unmounts as the panel opens, so without that a keyboard user
+		// lands back on <body>.
+		await removeButton(page).click();
+		await expect(confirmPanel(page)).toBeVisible();
+		const keep = confirmPanel(page).getByRole('button', { name: 'Keep', exact: true });
+		await expect(keep).toBeFocused();
+
+		// Keep restores the connected state and hands focus back.
+		await keep.click();
+		await expect(confirmPanel(page)).toHaveCount(0);
+		await expect(keyRecord(page)).toContainText('8901');
+		await expect(removeButton(page)).toBeFocused();
+
+		// Remove, confirmed, clears the key and returns the section to its
+		// unconnected state — the state the seed hands every other spec.
+		await removeButton(page).click();
+		await confirmPanel(page).getByRole('button', { name: 'Remove', exact: true }).click();
+		await expect(keyRecord(page)).toHaveCount(0);
+		await expect(keyInput(page)).toBeVisible();
+	});
+});

From 02fd9586c9a0c77f929b05b174e80912a7efba51 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:47:30 -0700
Subject: [PATCH 07/38] fix(settings): keep focus and contrast through the
 lookup key states (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Keep button's edge sat at 1.0:1 against the confirmation panel, which is
the same hex as --border in two dark themes, so it gets its own boundary mixed
toward --foreground. A successful save unmounted the form along with the
focused Save button, dropping a keyboard user on <body>; it now hands focus to
the Remove key button, the way the removal path already does. Both in-flight
buttons swap to aria-busy instead of disabled for the same reason, and Remove
gains a pending label.

The removal row moves below the save row so the refused state reads as record,
paste a replacement, then disconnect, and the confirmation question is wired to
both buttons with aria-describedby rather than a role="alert" that a screen
reader drops when focus moves in the same tick.

A bare `.lookup-section form` also matched the confirmation's inner form and
pushed Remove below Keep, so the save form takes a class. One derived local
replaces seven reads of the refusal marker.

The e2e spec now restores the shared seeded row in afterAll — without it a
failure mid-cycle leaves the key saved for every later spec and the CI retry
fails on the wrong test — and asserts focus after the removal. The markup pins
cover the refused state, which e2e cannot reach, and drop the greps for bound
variable names that the e2e spec now proves behaviorally.
---
 messages/en.json                              |   1 +
 messages/ja.json                              |   1 +
 src/routes/admin/settings/+page.svelte        | 140 +++++++++++-------
 src/routes/admin/settings/page.server.test.ts |  49 ++++--
 tests/e2e/fuzzysearch-key.spec.ts             |  23 +++
 5 files changed, 150 insertions(+), 64 deletions(-)

diff --git a/messages/en.json b/messages/en.json
index 5da8bfd4..73c0b657 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -1200,6 +1200,7 @@
 	"admin_settings_lookup_removed": "Key removed.",
 	"admin_settings_lookup_confirm": "Remove the key? Look up artist disappears from upload and edit until you save a new one.",
 	"admin_settings_lookup_confirm_remove": "Remove",
+	"admin_settings_lookup_removing": "Removing…",
 	"admin_settings_lookup_confirm_keep": "Keep",
 	"admin_settings_lookup_refused_eyebrow": "Key refused",
 	"admin_settings_lookup_refused_line": "FuzzySearch didn't accept this key on the last lookup ({date}).",
diff --git a/messages/ja.json b/messages/ja.json
index a77c17d3..93b82767 100644
--- a/messages/ja.json
+++ b/messages/ja.json
@@ -920,6 +920,7 @@
 	"admin_settings_lookup_removed": "キーを削除しました。",
 	"admin_settings_lookup_confirm": "キーを削除しますか？新しいキーを保存するまで、アップロード画面と編集画面から「アーティストを検索」がなくなります。",
 	"admin_settings_lookup_confirm_remove": "削除",
+	"admin_settings_lookup_removing": "削除中…",
 	"admin_settings_lookup_confirm_keep": "そのままにする",
 	"admin_settings_lookup_refused_eyebrow": "キーが拒否されました",
 	"admin_settings_lookup_refused_line": "前回の検索で、FuzzySearchはこのキーを受け付けませんでした（{date}）。",
diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index 2d03b70b..6bb92c07 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -195,6 +195,9 @@
 	// The mask's bullet run is read out one bullet at a time, so it is hidden from
 	// the accessibility tree and the part that identifies the key is spoken instead.
 	const fuzzysearchKeyTail = $derived(data.fuzzysearchKeyRecord?.replace(/^•+/, '') ?? '');
+	// The refusal marker drives the state selector, a label and a class in the
+	// section below; one local keeps the state machine readable in one place.
+	const fuzzysearchKeyRefused = $derived(!!data.fuzzysearchKeyRefusedAt);
 
 	// Localized "in early access right now" list, joined for the status line. Empty
 	// until a pilot feature is registered, in which case the "nothing" line shows.
@@ -1413,12 +1416,12 @@
      never reaches this component: only the mask built in load. -->
 <section class="security-section lookup-section" data-tab="connections">
 	<h2>{m.admin_settings_lookup_heading()}</h2>
-	{#if data.fuzzysearchKeyRefusedAt}
+	{#if fuzzysearchKeyRefused}
 		<div class="key-eyebrow refused">{m.admin_settings_lookup_refused_eyebrow()}</div>
 		<!-- Directly under the eyebrow, in the supporter card's lapsed-line voice:
 		     this one sentence is the whole reason the refused state exists, and in
 		     the muted status voice further down it read as more boilerplate. -->
-		<p class="lapsed-line">{m.admin_settings_lookup_refused_line({ date: data.fuzzysearchKeyRefusedAt })}</p>
+		<p class="lapsed-line">{m.admin_settings_lookup_refused_line({ date: data.fuzzysearchKeyRefusedAt ?? '' })}</p>
 	{:else if data.fuzzysearchKeySet}
 		<div class="key-eyebrow connected">{m.admin_settings_lookup_connected_eyebrow()}</div>
 	{/if}
@@ -1435,8 +1438,8 @@
 			<!-- Visible in the refused state, where the record sits above a "New
 			     FuzzySearch API key" field and would otherwise be an unlabelled pill;
 			     the connected state's surrounding copy already names it. -->
-			<dt class={data.fuzzysearchKeyRefusedAt ? 'record-label' : 'sr-only'}>
-				{data.fuzzysearchKeyRefusedAt
+			<dt class={fuzzysearchKeyRefused ? 'record-label' : 'sr-only'}>
+				{fuzzysearchKeyRefused
 					? m.admin_settings_lookup_refused_key_label()
 					: m.admin_settings_lookup_saved_key_label()}
 			</dt>
@@ -1447,12 +1450,66 @@
 				{/if}
 			</dd>
 		</dl>
-		{#if !data.fuzzysearchKeyRefusedAt && !confirmingFuzzysearchRemove}
+		{#if !fuzzysearchKeyRefused && !confirmingFuzzysearchRemove}
 			<p class="status-line replace-line">{m.admin_settings_lookup_replace()}</p>
 		{/if}
+	{/if}
+
+	{#if !data.fuzzysearchKeyFromEnv && (!data.fuzzysearchKeySet || fuzzysearchKeyRefused)}
+		<form class="save-form" method="POST" action="?/saveFuzzysearchKey" use:enhance={() => {
+			savingFuzzysearchKey = true;
+			return async ({ result, update }) => {
+				await update({ reset: false });
+				savingFuzzysearchKey = false;
+				if (result.type === 'success') {
+					toast.success(m.admin_settings_lookup_saved());
+					// The form unmounts on a successful save, taking the focused Save
+					// button with it — hand focus to the button that replaces it.
+					await tick();
+					fuzzysearchRemoveButton?.focus();
+				}
+			};
+		}}>
+			<label>
+				<span>{fuzzysearchKeyRefused ? m.admin_settings_lookup_new_key_label() : m.admin_settings_lookup_key_label()}</span>
+				<input
+					type="password"
+					class="input"
+					id="fuzzysearch-key"
+					name="fuzzysearchApiKey"
+					autocomplete="off"
+					bind:this={fuzzysearchKeyInput}
+					placeholder={m.admin_settings_lookup_key_placeholder()}
+					aria-invalid={form?.fuzzysearchKeyError ? 'true' : undefined}
+					aria-describedby={form?.fuzzysearchKeyError ? 'fuzzysearch-key-error' : undefined}
+				/>
+			</label>
+			{#if form?.fuzzysearchKeyError}
+				<p class="field-error" id="fuzzysearch-key-error" role="alert">{m.admin_settings_lookup_error_invalid()}</p>
+			{/if}
+			<!-- Above the save row, like the registry section's token hint: an
+			     operator without a key needs the link before the button. -->
+			{#if !fuzzysearchKeyRefused}
+				<p class="hint">{m.admin_settings_lookup_hint_pre()}<a class="link-inline" href="https://api.fuzzysearch.net/selfserve" target="_blank" rel="noopener noreferrer">api.fuzzysearch.net/selfserve<span class="sr-only">{' '}{m.link_opens_new_tab()}</span></a>{m.admin_settings_lookup_hint_post()}</p>
+			{/if}
+			<div class="save-row">
+				<!-- aria-busy, not disabled: disabling the button that holds focus
+				     drops the keyboard user on <body> for the length of the request. -->
+				<button type="submit" class="btn btn-primary" aria-busy={savingFuzzysearchKey}>
+					{savingFuzzysearchKey ? m.admin_saving() : m.admin_settings_lookup_save()}
+				</button>
+			</div>
+		</form>
+	{/if}
+
+	<!-- Below the save row on purpose: in the refused state the operator almost
+	     always wants to paste a replacement, and disconnecting is the rarer exit.
+	     Guarded on the key being SET, not on the state being connected — a refused
+	     key the operator cannot remove would be a dead end. -->
+	{#if !data.fuzzysearchKeyFromEnv && data.fuzzysearchKeySet}
 		{#if confirmingFuzzysearchRemove}
 			<div class="remove-confirm">
-				<p role="alert">{m.admin_settings_lookup_confirm()}</p>
+				<p id="fuzzysearch-remove-confirm">{m.admin_settings_lookup_confirm()}</p>
 				<div class="confirm-actions">
 					<form method="POST" action="?/removeFuzzysearchKey" use:enhance={() => {
 						removingFuzzysearchKey = true;
@@ -1467,13 +1524,21 @@
 							fuzzysearchKeyInput?.focus();
 						};
 					}}>
-						<button type="submit" class="btn btn-destructive" disabled={removingFuzzysearchKey}>
-							{m.admin_settings_lookup_confirm_remove()}
+						<button
+							type="submit"
+							class="btn btn-destructive"
+							aria-busy={removingFuzzysearchKey}
+							aria-describedby="fuzzysearch-remove-confirm"
+						>
+							{removingFuzzysearchKey
+								? m.admin_settings_lookup_removing()
+								: m.admin_settings_lookup_confirm_remove()}
 						</button>
 					</form>
 					<button
 						type="button"
 						class="btn btn-outline"
+						aria-describedby="fuzzysearch-remove-confirm"
 						bind:this={fuzzysearchKeepButton}
 						onclick={async () => {
 							confirmingFuzzysearchRemove = false;
@@ -1487,7 +1552,7 @@
 			<div class="key-actions">
 				<button
 					type="button"
-					class="btn btn-remove"
+					class="btn btn-outline btn-remove"
 					bind:this={fuzzysearchRemoveButton}
 					onclick={() => (confirmingFuzzysearchRemove = true)}
 				>
@@ -1496,45 +1561,6 @@
 			</div>
 		{/if}
 	{/if}
-
-	{#if !data.fuzzysearchKeyFromEnv && (!data.fuzzysearchKeySet || data.fuzzysearchKeyRefusedAt)}
-		<form method="POST" action="?/saveFuzzysearchKey" use:enhance={() => {
-			savingFuzzysearchKey = true;
-			return async ({ result, update }) => {
-				await update({ reset: false });
-				savingFuzzysearchKey = false;
-				if (result.type === 'success') toast.success(m.admin_settings_lookup_saved());
-			};
-		}}>
-			<label>
-				<span>{data.fuzzysearchKeyRefusedAt ? m.admin_settings_lookup_new_key_label() : m.admin_settings_lookup_key_label()}</span>
-				<input
-					type="password"
-					class="input"
-					id="fuzzysearch-key"
-					name="fuzzysearchApiKey"
-					autocomplete="off"
-					bind:this={fuzzysearchKeyInput}
-					placeholder={m.admin_settings_lookup_key_placeholder()}
-					aria-invalid={form?.fuzzysearchKeyError ? 'true' : undefined}
-					aria-describedby={form?.fuzzysearchKeyError ? 'fuzzysearch-key-error' : undefined}
-				/>
-			</label>
-			{#if form?.fuzzysearchKeyError}
-				<p class="field-error" id="fuzzysearch-key-error" role="alert">{m.admin_settings_lookup_error_invalid()}</p>
-			{/if}
-			<!-- Above the save row, like the registry section's token hint: an
-			     operator without a key needs the link before the button. -->
-			{#if !data.fuzzysearchKeyRefusedAt}
-				<p class="hint">{m.admin_settings_lookup_hint_pre()}<a class="link-inline" href="https://api.fuzzysearch.net/selfserve" target="_blank" rel="noopener noreferrer">api.fuzzysearch.net/selfserve<span class="sr-only">{' '}{m.link_opens_new_tab()}</span></a>{m.admin_settings_lookup_hint_post()}</p>
-			{/if}
-			<div class="save-row">
-				<button type="submit" class="btn btn-primary" disabled={savingFuzzysearchKey}>
-					{savingFuzzysearchKey ? m.admin_saving() : m.admin_settings_lookup_save()}
-				</button>
-			</div>
-		</form>
-	{/if}
 </section>
 
 <section class="danger-zone" data-tab="account">
@@ -2520,7 +2546,10 @@
 	.lookup-section .explainer-body {
 		margin: 0 0 14px;
 	}
-	.lookup-section form {
+	/* The save form only: a bare `form` selector also matches the removal
+	   confirmation's inner form, which is a centered flex item, so the margin
+	   pushed Remove below Keep. */
+	.lookup-section .save-form {
 		margin-top: 14px;
 	}
 	/* The <dl> holds the label for the mask; it must not add spacing of its own
@@ -2543,13 +2572,14 @@
 	}
 	/* Bordered pill, destructive text: removing the key is reversible (paste a
 	   new one) so it doesn't earn a filled destructive button here — the filled
-	   one is on the confirmation, where the action actually happens. */
+	   one is on the confirmation, where the action actually happens. It rides
+	   .btn-outline so the section's two bordered buttons behave alike; only the
+	   label colour and the boundary differ. */
 	/* The boundary is mixed toward --foreground rather than left on --border,
 	   which measures under 1.5:1 against the page and fails SC 1.4.11 as a
 	   control edge (the treatment .btn-outline already uses on hover). */
 	.lookup-section .btn-remove {
-		background: none;
-		border: 1px solid color-mix(in srgb, var(--border) 60%, var(--foreground));
+		border-color: color-mix(in srgb, var(--border) 60%, var(--foreground));
 		color: var(--destructive);
 	}
 	.lookup-section .btn-remove:hover {
@@ -2569,6 +2599,12 @@
 		line-height: 1.55;
 		max-width: 62ch;
 	}
+	/* Inside the panel the outline button's own --border edge sits at 1.0-1.3:1
+	   against --secondary (identical hex in two dark themes), so the boundary is
+	   mixed toward --foreground here: 5.4-7.6:1 on the panel. SC 1.4.11. */
+	.lookup-section .remove-confirm .btn-outline {
+		border-color: color-mix(in srgb, var(--border) 30%, var(--foreground));
+	}
 	.lookup-section .confirm-actions {
 		display: flex;
 		flex-wrap: wrap;
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 6de25a52..f7e18f65 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2057,18 +2057,9 @@ describe('artist lookup section markup (SONA-156)', () => {
 		const keep = panel.slice(0, panel.indexOf('admin_settings_lookup_confirm_keep'));
 		expect(keep).toContain('btn-outline');
 		expect(keep).not.toContain('btn-secondary');
-	});
-
-	// Every button in the confirmation unmounts as it is used, so focus is moved
-	// by hand: into Keep when the panel opens, back to Remove key when it closes,
-	// and to the key field once the key is gone. A bare autofocus does none of it.
-	it('drives focus across the confirmation rather than relying on autofocus', () => {
-		const panel = src.slice(src.indexOf('class="remove-confirm"'));
-		expect(panel.slice(0, panel.indexOf('</section>'))).not.toContain('autofocus');
-		expect(src).toContain('bind:this={fuzzysearchKeepButton}');
-		expect(src).toContain('fuzzysearchKeepButton?.focus()');
-		expect(src).toContain('fuzzysearchRemoveButton?.focus()');
-		expect(src).toContain('fuzzysearchKeyInput?.focus()');
+		// var(--border) against the panel's var(--secondary) fill is 1.0:1 in two
+		// dark themes, so the edge inside the panel is overridden on its own.
+		expect(src).toContain('.lookup-section .remove-confirm .btn-outline');
 	});
 
 	// The bullet run is announced one bullet at a time, so it is hidden and the
@@ -2078,4 +2069,38 @@ describe('artist lookup section markup (SONA-156)', () => {
 		expect(record.slice(0, 400)).toContain('aria-hidden="true"');
 		expect(src).toContain('m.admin_settings_lookup_key_ending(');
 	});
+
+	// The refused state is the one a broken key actually lands in, and e2e cannot
+	// reach it: only a real 401 from FuzzySearch writes the marker.
+	it('keeps Remove key reachable in the refused state', () => {
+		// Guarded on the key being SET, never narrowed by the refusal — a refused
+		// key the operator cannot remove would be a dead end.
+		const guard = '{#if !data.fuzzysearchKeyFromEnv && data.fuzzysearchKeySet}';
+		expect(src).toContain(guard);
+		const block = src.slice(src.indexOf(guard) + guard.length);
+		const actions = block.slice(0, block.indexOf('</section>'));
+		expect(actions).toContain('m.admin_settings_lookup_remove()');
+		expect(actions).not.toContain('fuzzysearchKeyRefused');
+	});
+
+	it('renders the refused eyebrow, the lapsed line, and a labelled record', () => {
+		expect(src).toContain('const fuzzysearchKeyRefused = $derived(!!data.fuzzysearchKeyRefusedAt)');
+		const refused = src.slice(src.indexOf('{#if fuzzysearchKeyRefused}'));
+		const branch = refused.slice(0, refused.indexOf('{:else if data.fuzzysearchKeySet}'));
+		expect(branch).toContain('m.admin_settings_lookup_refused_eyebrow()');
+		expect(branch).toContain('class="lapsed-line"');
+		expect(branch).toContain('m.admin_settings_lookup_refused_line(');
+		// The mask's <dt> is visible only here, where the record sits above a "New
+		// FuzzySearch API key" field and would otherwise be an unlabelled pill.
+		expect(src).toContain("<dt class={fuzzysearchKeyRefused ? 'record-label' : 'sr-only'}>");
+		expect(src).toContain('m.admin_settings_lookup_refused_key_label()');
+	});
+
+	it('renames the key field and drops the self-serve hint when refused', () => {
+		expect(src).toContain(
+			'{fuzzysearchKeyRefused ? m.admin_settings_lookup_new_key_label() : m.admin_settings_lookup_key_label()}'
+		);
+		const hint = src.slice(0, src.indexOf('m.admin_settings_lookup_hint_pre()'));
+		expect(hint.slice(-200)).toContain('{#if !fuzzysearchKeyRefused}');
+	});
 });
diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index cb162648..574e5740 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -107,5 +107,28 @@ test.describe('admin settings artist lookup key', () => {
 		await confirmPanel(page).getByRole('button', { name: 'Remove', exact: true }).click();
 		await expect(keyRecord(page)).toHaveCount(0);
 		await expect(keyInput(page)).toBeVisible();
+		// Both confirmation buttons are gone, so focus has to land on the field
+		// that replaced them rather than on <body>.
+		await expect(keyInput(page)).toBeFocused();
 	});
 });
+
+// The save above writes to the SHARED seeded DB. If anything between it and the
+// final Remove fails, the key stays saved: the CI retry restarts this serial
+// block at the unconnected-state test, which then fails for the wrong reason,
+// and every later spec sees a connected section. Put the row back the way this
+// file found it (legal.spec.ts carries the same guard for privacyPolicy).
+test.afterAll(async ({ browser }) => {
+	const page = await browser.newPage();
+	try {
+		await adminLogin(page, PASSWORD);
+		await page.goto('/admin/settings');
+		await openConnectionsTab(page);
+		if ((await removeButton(page).count()) === 0) return;
+		await removeButton(page).click();
+		await confirmPanel(page).getByRole('button', { name: 'Remove', exact: true }).click();
+		await expect(keyRecord(page)).toHaveCount(0);
+	} finally {
+		await page.close();
+	}
+});

From 6df227dd9591f50aede4deb28d4bece4292605b4 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:47:40 -0700
Subject: [PATCH 08/38] fix(lookup): compare tweets by status id and read host
 aliases safely (SONA-156)

A Twitter match with no artist handle gets the /i/status/{id} URL, so it never
equalled a stored twitter.com/{handle}/status/{id} and the duplicate-source
warning stayed quiet for the same tweet. Both spellings now reduce to the /i/
form before comparison.

HOST_ALIASES becomes a Map: the object lookup answered `constructor` and
`__proto__` with an inherited member rather than a miss, which normalized those
hosts to garbage. The two aliases that cannot name a submission page,
mobile.twitter.com and d.furaffinity.net, are gone.

Media types are case-insensitive, so an upstream answering `Image/PNG` was
demoted to a download by the proxy and then refused as a non-image. Both ends
of that path compare lowercased now.
---
 src/lib/server/fuzzysearch.test.ts            | 33 +++++++++++++++----
 src/lib/server/fuzzysearch.ts                 | 19 ++++++-----
 src/lib/server/image-proxy.ts                 |  5 ++-
 src/routes/api/admin/artist-lookup/+server.ts |  7 +++-
 .../api/admin/artist-lookup/server.test.ts    | 18 ++++++++++
 5 files changed, 65 insertions(+), 17 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 4b9bb377..2373cde3 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -305,20 +305,32 @@ describe('normalizeSourceUrl', () => {
 	// this client builds.
 	it('folds known host aliases onto one canonical host', () => {
 		expect(normalizeSourceUrl('https://x.com/kuttoya/status/160')).toBe(
-			'twitter.com/kuttoya/status/160'
-		);
-		expect(normalizeSourceUrl('https://mobile.twitter.com/kuttoya/status/160')).toBe(
-			'twitter.com/kuttoya/status/160'
+			'twitter.com/i/status/160'
 		);
 		expect(normalizeSourceUrl('https://sfw.furaffinity.net/view/12345/')).toBe(
 			'furaffinity.net/view/12345'
 		);
 	});
 
+	// A match with no artist handle gets the /i/ URL this client builds, and the
+	// operator's saved link carries the handle. Same tweet, so both must reduce
+	// to the same string or the duplicate-source warning never fires.
+	it('reduces a tweet to its status id, with or without the handle', () => {
+		const canonical = 'twitter.com/i/status/160';
+		expect(normalizeSourceUrl('https://twitter.com/i/status/160')).toBe(canonical);
+		expect(normalizeSourceUrl('https://twitter.com/kuttoya/status/160')).toBe(canonical);
+		expect(normalizeSourceUrl('https://x.com/kuttoya/status/160')).toBe(canonical);
+	});
+
+	// A host that names an inherited Object member must be a lookup miss, not
+	// whatever the prototype carries under that key.
+	it('does not read host aliases through Object.prototype', () => {
+		expect(normalizeSourceUrl('http://constructor/view/1')).toBe('constructor/view/1');
+		expect(normalizeSourceUrl('http://__proto__/view/1')).toBe('__proto__/view/1');
+	});
+
 	it('lowercases the path on the hosts that treat it case-insensitively', () => {
-		expect(normalizeSourceUrl('https://twitter.com/Kuttoya/status/160')).toBe(
-			'twitter.com/kuttoya/status/160'
-		);
+		expect(normalizeSourceUrl('https://twitter.com/Kuttoya')).toBe('twitter.com/kuttoya');
 		expect(normalizeSourceUrl('https://www.furaffinity.net/View/12345/')).toBe(
 			'furaffinity.net/view/12345'
 		);
@@ -378,6 +390,13 @@ describe('findLocalArtists', () => {
 		expect(found.map((r) => r.id)).toEqual([2]);
 	});
 
+	// Twitter is where an @-prefixed handle actually arrives, and the stripping
+	// moved into normalizeHandle when this matcher was rewritten.
+	it('matches a Twitter handle that arrives with its @', () => {
+		const found = findLocalArtists(rows, { site: 'Twitter', handles: ['@Kuttoya'] });
+		expect(found.map((r) => r.id)).toEqual([2]);
+	});
+
 	it('returns nothing for sites with no artist column, or with no handles', () => {
 		expect(findLocalArtists(rows, { site: 'Weasyl', handles: ['kuttoya'] })).toEqual([]);
 		expect(findLocalArtists(rows, { site: 'e621', handles: ['kuttoya'] })).toEqual([]);
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index 679a7b97..214ffcc3 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -142,13 +142,12 @@ export function handleProfileUrl(site: LookupSite, handle: string): string | nul
 
 /** Hosts that are the same site under two names. Without folding these, an
  * operator who saved an `x.com` link gets no clash warning for the `twitter.com`
- * URL this client builds. */
-const HOST_ALIASES: Record<string, string> = {
-	'x.com': 'twitter.com',
-	'mobile.twitter.com': 'twitter.com',
-	'sfw.furaffinity.net': 'furaffinity.net',
-	'd.furaffinity.net': 'furaffinity.net'
-};
+ * URL this client builds. A Map, not an object literal: a plain lookup answers
+ * `constructor` and `__proto__` with an inherited member rather than a miss. */
+const HOST_ALIASES = new Map<string, string>([
+	['x.com', 'twitter.com'],
+	['sfw.furaffinity.net', 'furaffinity.net']
+]);
 
 /** Hosts whose paths are case-insensitive, so `/View/12345` and `/view/12345`
  * are one post. Left alone elsewhere — most sites' paths are case-sensitive. */
@@ -168,9 +167,13 @@ export function normalizeSourceUrl(url: string | null | undefined): string {
 	rest = rest.replace(/\/+$/, '');
 	const slash = rest.indexOf('/');
 	let host = (slash === -1 ? rest : rest.slice(0, slash)).toLowerCase().replace(/^www\./, '');
-	host = HOST_ALIASES[host] ?? host;
+	host = HOST_ALIASES.get(host) ?? host;
 	let path = slash === -1 ? '' : rest.slice(slash);
 	if (CASE_INSENSITIVE_PATH_HOSTS.has(host)) path = path.toLowerCase();
+	// A tweet is identified by its status id alone: `/kuttoya/status/160` and the
+	// handle-less `/i/status/160` this client builds for a match with no artist
+	// are the same post, so both reduce to the `/i/` spelling before comparison.
+	if (host === 'twitter.com') path = path.replace(/^\/[^/]+\/status\//, '/i/status/');
 	return host + path;
 }
 
diff --git a/src/lib/server/image-proxy.ts b/src/lib/server/image-proxy.ts
index bda0dd8b..1733a565 100644
--- a/src/lib/server/image-proxy.ts
+++ b/src/lib/server/image-proxy.ts
@@ -90,9 +90,12 @@ export async function proxyStoredImage(
 	if (!upstream.ok || !upstream.body) return null;
 
 	const contentType = upstream.headers.get('content-type') ?? '';
+	// Media types are case-insensitive, so an upstream answering `Image/PNG` is
+	// still an image and must not be demoted to a download.
+	const isImage = contentType.toLowerCase().startsWith('image/');
 	return new Response(upstream.body, {
 		headers: {
-			'Content-Type': contentType.startsWith('image/') ? contentType : 'application/octet-stream',
+			'Content-Type': isImage ? contentType : 'application/octet-stream',
 			'Content-Disposition': 'inline',
 			'Cache-Control': 'private, no-store'
 		}
diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index f76f980f..eaa42f43 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -116,7 +116,12 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		// followed, image/* content types only.
 		const stored = await proxyStoredImage(row.imageUrl, fetch);
 		if (!stored?.body) return failure('unavailable');
-		const storedType = (stored.headers.get('content-type') ?? '').split(';')[0].trim();
+		// Lowercased: media types are case-insensitive, so an `Image/PNG` header
+		// must pass the same check as `image/png`.
+		const storedType = (stored.headers.get('content-type') ?? '')
+			.split(';')[0]
+			.trim()
+			.toLowerCase();
 		if (!storedType.startsWith('image/')) {
 			return failure('unavailable');
 		}
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index 892f98fe..7e601761 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -273,6 +273,24 @@ describe('artist-lookup — stored image by id', () => {
 		expect((searchImage.mock.calls[0][0] as Blob).type).toBe('image/jpeg');
 	});
 
+	// Media types are case-insensitive. An upstream spelling it `Image/JPEG` was
+	// demoted to a download by the proxy and then refused here as a non-image.
+	it('accepts a stored content type whatever its case', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.jpg', '2026-01-01');`
+		);
+		const jpeg = new Response(IMAGE_BYTES, {
+			status: 200,
+			headers: { 'content-type': 'Image/JPEG; charset=binary' }
+		});
+
+		await POST(jsonEvent(platform, { imageId: 1 }, imageFetch(jpeg).fn));
+
+		expect((searchImage.mock.calls[0][0] as Blob).type).toBe('image/jpeg');
+	});
+
 	it('reports unavailable when the proxy refuses the stored URL', async () => {
 		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 		sqlite.exec(

From 1b44be0c7c9e6b7483e780b70749005d34f53491 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 15:34:59 -0700
Subject: [PATCH 09/38] fix(lookup): restore the mobile.twitter.com alias and
 fold tweet permalinks (SONA-156)

Round 2 dropped mobile.twitter.com from HOST_ALIASES on the reading that only
twitter.com and x.com reach the fold. Stored rows disagree: the mobile host was
Twitter's own spelling for years, and normalizeSourceUrl strips www. but nothing
else before the lookup, so those rows missed the case fold and the status-id
fold too. The alias and its assertion are back.

The status-id fold now truncates instead of substituting, so the /photo/1
permalink Twitter's UI hands out for a tweet image compares equal to the tweet.

proxyStoredImage gets its own tests: three routes share it and only the
artist-lookup endpoint pinned the content-type fold, so a regression would have
turned avatar and ref-image responses into downloads without failing anything.
---
 src/lib/server/fuzzysearch.test.ts |  5 ++++
 src/lib/server/fuzzysearch.ts      |  5 +++-
 src/lib/server/image-proxy.test.ts | 45 +++++++++++++++++++++++++++++-
 3 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 2373cde3..6b73f209 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -307,6 +307,9 @@ describe('normalizeSourceUrl', () => {
 		expect(normalizeSourceUrl('https://x.com/kuttoya/status/160')).toBe(
 			'twitter.com/i/status/160'
 		);
+		expect(normalizeSourceUrl('https://mobile.twitter.com/kuttoya/status/160')).toBe(
+			'twitter.com/i/status/160'
+		);
 		expect(normalizeSourceUrl('https://sfw.furaffinity.net/view/12345/')).toBe(
 			'furaffinity.net/view/12345'
 		);
@@ -320,6 +323,8 @@ describe('normalizeSourceUrl', () => {
 		expect(normalizeSourceUrl('https://twitter.com/i/status/160')).toBe(canonical);
 		expect(normalizeSourceUrl('https://twitter.com/kuttoya/status/160')).toBe(canonical);
 		expect(normalizeSourceUrl('https://x.com/kuttoya/status/160')).toBe(canonical);
+		// The address Twitter's UI hands out for a tweet's image.
+		expect(normalizeSourceUrl('https://x.com/kuttoya/status/160/photo/1')).toBe(canonical);
 	});
 
 	// A host that names an inherited Object member must be a lookup miss, not
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index 214ffcc3..f06ae56b 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -146,6 +146,7 @@ export function handleProfileUrl(site: LookupSite, handle: string): string | nul
  * `constructor` and `__proto__` with an inherited member rather than a miss. */
 const HOST_ALIASES = new Map<string, string>([
 	['x.com', 'twitter.com'],
+	['mobile.twitter.com', 'twitter.com'],
 	['sfw.furaffinity.net', 'furaffinity.net']
 ]);
 
@@ -173,7 +174,9 @@ export function normalizeSourceUrl(url: string | null | undefined): string {
 	// A tweet is identified by its status id alone: `/kuttoya/status/160` and the
 	// handle-less `/i/status/160` this client builds for a match with no artist
 	// are the same post, so both reduce to the `/i/` spelling before comparison.
-	if (host === 'twitter.com') path = path.replace(/^\/[^/]+\/status\//, '/i/status/');
+	// Anything after the id goes too, so the `/photo/1` permalink Twitter's own
+	// UI hands out compares equal to the bare tweet.
+	if (host === 'twitter.com') path = path.replace(/^\/[^/]+\/status\/(\d+).*$/, '/i/status/$1');
 	return host + path;
 }
 
diff --git a/src/lib/server/image-proxy.test.ts b/src/lib/server/image-proxy.test.ts
index 7647335c..b65214c8 100644
--- a/src/lib/server/image-proxy.test.ts
+++ b/src/lib/server/image-proxy.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { isPrivateHost, isSameOriginUrl } from './image-proxy';
+import { isPrivateHost, isSameOriginUrl, proxyStoredImage } from './image-proxy';
 
 // The guard both byte proxies rely on. Driven directly rather than through a
 // route, because the boundaries are the whole point and a route test only ever
@@ -91,3 +91,46 @@ describe('isSameOriginUrl', () => {
 		expect(isSameOriginUrl('http://fork.example/img/x.png', origin)).toBe(false);
 	});
 });
+
+// The response the proxy builds. Three callers share this file (artist-lookup,
+// avatar, ref-image) and only one of them pins the content-type fold, so a
+// regression here would silently turn the other two's images into downloads.
+describe('proxyStoredImage', () => {
+	function fetcherAnswering(contentType: string): typeof fetch {
+		return (async () =>
+			new Response('bytes', { headers: { 'content-type': contentType } })) as unknown as typeof fetch;
+	}
+
+	async function proxy(contentType: string): Promise<Response> {
+		const res = await proxyStoredImage('https://cdn.example/img.png', fetcherAnswering(contentType));
+		if (!res) throw new Error('proxyStoredImage returned null');
+		return res;
+	}
+
+	// Media types are case-insensitive, so the upstream's own spelling is echoed
+	// back rather than demoted to a download.
+	it('passes an image content type through whatever its case', async () => {
+		expect((await proxy('Image/PNG')).headers.get('content-type')).toBe('Image/PNG');
+		expect((await proxy('image/png')).headers.get('content-type')).toBe('image/png');
+	});
+
+	it('demotes a non-image content type to a download', async () => {
+		expect((await proxy('text/html')).headers.get('content-type')).toBe('application/octet-stream');
+	});
+
+	it('serves inline and never caches', async () => {
+		const res = await proxy('image/png');
+		expect(res.headers.get('content-disposition')).toBe('inline');
+		expect(res.headers.get('cache-control')).toBe('private, no-store');
+	});
+
+	it('refuses a private host without fetching', async () => {
+		let called = false;
+		const fetcher = (async () => {
+			called = true;
+			return new Response('bytes', { headers: { 'content-type': 'image/png' } });
+		}) as unknown as typeof fetch;
+		expect(await proxyStoredImage('http://127.0.0.1/img.png', fetcher)).toBeNull();
+		expect(called).toBe(false);
+	});
+});

From a08c3cfbb177292d4b6d5ad0b5b35c6d6dfaf6fd Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 15:35:10 -0700
Subject: [PATCH 10/38] fix(settings): hold Remove key's hover contrast and pin
 the pending contract (SONA-156)

Adopting .btn-outline for Remove key also adopted its hover fill, a color-mix of
--background 88% toward white or black. The label is overridden to --destructive,
which on that mix reads 3.59:1 to 4.42:1 on five of the six themes. The fill is
pinned back to --background and the border keeps carrying the hover signal.
theme-contrast.test.ts asserts both halves: --destructive on --background clears
4.5:1 everywhere, and the rule still names the token.

aria-busy on a button is a region attribute most screen readers skip, so the
pending sentence also rides an sr-only live region that stays mounted. Each
enhance callback now cancels a second activation while its own request is in
flight, which disabled used to do before it was dropped for the focus bug.

Tests: the e2e spec asserts focus lands on Remove key after a successful save,
and the markup pin covers the three element refs, the three focus calls,
aria-busy on both submit buttons, and no disabled binding on either. The
refused-state pins now assert classes and message keys rather than verbatim
template expressions, which have been rewritten in each of the last two rounds.

Also: one derived local for the deploy-secret guard the three sibling blocks
repeated, the refusal date rather than a flag (dropping a fallback for a state
that cannot occur), and a wider step between Save key and the Remove row so the
refused state stops reading as one button group.
---
 src/lib/theme-contrast.test.ts                | 36 +++++++++++++
 src/routes/admin/settings/+page.svelte        | 50 ++++++++++++++-----
 src/routes/admin/settings/page.server.test.ts | 42 ++++++++++++----
 tests/e2e/fuzzysearch-key.spec.ts             |  3 ++
 4 files changed, 109 insertions(+), 22 deletions(-)

diff --git a/src/lib/theme-contrast.test.ts b/src/lib/theme-contrast.test.ts
index 63502fdd..896a65a2 100644
--- a/src/lib/theme-contrast.test.ts
+++ b/src/lib/theme-contrast.test.ts
@@ -916,3 +916,39 @@ describe('no accent-color override on form controls (SONA-172)', () => {
 		}
 	});
 });
+
+// The Artist lookup "Remove key" button rides .btn-outline but overrides its
+// label to --destructive. .btn-outline's hover fill mixes --background 88%
+// toward white or black, and --destructive on that mix falls to 3.6-4.4:1 on
+// five of the six themes, so the component pins the fill back to --background
+// and lets the border carry the hover signal (SONA-156). Two halves: the token
+// pairing has to clear AA, and the rule has to keep using it.
+describe('SONA-156 Remove-key label on its pinned hover fill', () => {
+	const blocks = THEMES.flatMap(({ id }) =>
+		id === 'default'
+			? [
+					{ name: 'default dark', sel: ':root' },
+					{ name: 'default light', sel: "[data-theme='light']" }
+				]
+			: [
+					{ name: `${id} dark`, sel: `[data-theme-id='${id}']` },
+					{ name: `${id} light`, sel: `[data-theme-id='${id}'][data-theme='light']` }
+				]
+	);
+
+	for (const { name, sel } of blocks) {
+		it(`${name}: destructive text on the page background meets 4.5:1`, () => {
+			expect(contrast(blockToken(sel, 'destructive'), blockToken(sel, 'background'))).toBeGreaterThanOrEqual(4.5);
+		});
+	}
+
+	it('.lookup-section .btn-remove:hover pins the fill to var(--background)', () => {
+		const source = readFileSync(
+			fileURLToPath(new URL('../routes/admin/settings/+page.svelte', import.meta.url)),
+			'utf8'
+		);
+		const body = source.match(/^\s*\.lookup-section \.btn-remove:hover\s*\{([^}]*)\}/m)?.[1];
+		if (!body) throw new Error('.lookup-section .btn-remove:hover rule not found');
+		expect(body).toMatch(/background-color:\s*var\(--background\)\s*;/);
+	});
+});
diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index 6bb92c07..7168e734 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -197,7 +197,13 @@
 	const fuzzysearchKeyTail = $derived(data.fuzzysearchKeyRecord?.replace(/^•+/, '') ?? '');
 	// The refusal marker drives the state selector, a label and a class in the
 	// section below; one local keeps the state machine readable in one place.
-	const fuzzysearchKeyRefused = $derived(!!data.fuzzysearchKeyRefusedAt);
+	// The date itself, not a flag: the branch that renders it is guarded on this
+	// value, so keeping it here saves a fallback for a state that cannot occur.
+	const fuzzysearchKeyRefusedAt = $derived(data.fuzzysearchKeyRefusedAt);
+	// A key staged as a deploy secret owns the whole section: nothing in it is
+	// editable from the browser. Named once so the three blocks below cannot
+	// drift apart one guard at a time.
+	const fuzzysearchKeyEditable = $derived(!data.fuzzysearchKeyFromEnv);
 
 	// Localized "in early access right now" list, joined for the status line. Empty
 	// until a pilot feature is registered, in which case the "nothing" line shows.
@@ -1416,12 +1422,18 @@
      never reaches this component: only the mask built in load. -->
 <section class="security-section lookup-section" data-tab="connections">
 	<h2>{m.admin_settings_lookup_heading()}</h2>
-	{#if fuzzysearchKeyRefused}
+	<!-- aria-busy on a button is a region attribute most screen readers ignore, so
+	     the in-flight state gets its own live region here, mounted for the life of
+	     the section (StickerPackForm's pattern). The outcome is the Toaster's. -->
+	<span class="sr-only" role="status">
+		{#if savingFuzzysearchKey}{m.admin_saving()}{:else if removingFuzzysearchKey}{m.admin_settings_lookup_removing()}{/if}
+	</span>
+	{#if fuzzysearchKeyRefusedAt}
 		<div class="key-eyebrow refused">{m.admin_settings_lookup_refused_eyebrow()}</div>
 		<!-- Directly under the eyebrow, in the supporter card's lapsed-line voice:
 		     this one sentence is the whole reason the refused state exists, and in
 		     the muted status voice further down it read as more boilerplate. -->
-		<p class="lapsed-line">{m.admin_settings_lookup_refused_line({ date: data.fuzzysearchKeyRefusedAt ?? '' })}</p>
+		<p class="lapsed-line">{m.admin_settings_lookup_refused_line({ date: fuzzysearchKeyRefusedAt })}</p>
 	{:else if data.fuzzysearchKeySet}
 		<div class="key-eyebrow connected">{m.admin_settings_lookup_connected_eyebrow()}</div>
 	{/if}
@@ -1438,8 +1450,8 @@
 			<!-- Visible in the refused state, where the record sits above a "New
 			     FuzzySearch API key" field and would otherwise be an unlabelled pill;
 			     the connected state's surrounding copy already names it. -->
-			<dt class={fuzzysearchKeyRefused ? 'record-label' : 'sr-only'}>
-				{fuzzysearchKeyRefused
+			<dt class={fuzzysearchKeyRefusedAt ? 'record-label' : 'sr-only'}>
+				{fuzzysearchKeyRefusedAt
 					? m.admin_settings_lookup_refused_key_label()
 					: m.admin_settings_lookup_saved_key_label()}
 			</dt>
@@ -1450,13 +1462,16 @@
 				{/if}
 			</dd>
 		</dl>
-		{#if !fuzzysearchKeyRefused && !confirmingFuzzysearchRemove}
+		{#if !fuzzysearchKeyRefusedAt && !confirmingFuzzysearchRemove}
 			<p class="status-line replace-line">{m.admin_settings_lookup_replace()}</p>
 		{/if}
 	{/if}
 
-	{#if !data.fuzzysearchKeyFromEnv && (!data.fuzzysearchKeySet || fuzzysearchKeyRefused)}
-		<form class="save-form" method="POST" action="?/saveFuzzysearchKey" use:enhance={() => {
+	{#if fuzzysearchKeyEditable && (!data.fuzzysearchKeySet || fuzzysearchKeyRefusedAt)}
+		<form class="save-form" method="POST" action="?/saveFuzzysearchKey" use:enhance={({ cancel }) => {
+			// aria-busy replaced `disabled`, so a second activation while the first
+			// request is in flight would otherwise run a second handler.
+			if (savingFuzzysearchKey) return cancel();
 			savingFuzzysearchKey = true;
 			return async ({ result, update }) => {
 				await update({ reset: false });
@@ -1471,7 +1486,7 @@
 			};
 		}}>
 			<label>
-				<span>{fuzzysearchKeyRefused ? m.admin_settings_lookup_new_key_label() : m.admin_settings_lookup_key_label()}</span>
+				<span>{fuzzysearchKeyRefusedAt ? m.admin_settings_lookup_new_key_label() : m.admin_settings_lookup_key_label()}</span>
 				<input
 					type="password"
 					class="input"
@@ -1489,7 +1504,7 @@
 			{/if}
 			<!-- Above the save row, like the registry section's token hint: an
 			     operator without a key needs the link before the button. -->
-			{#if !fuzzysearchKeyRefused}
+			{#if !fuzzysearchKeyRefusedAt}
 				<p class="hint">{m.admin_settings_lookup_hint_pre()}<a class="link-inline" href="https://api.fuzzysearch.net/selfserve" target="_blank" rel="noopener noreferrer">api.fuzzysearch.net/selfserve<span class="sr-only">{' '}{m.link_opens_new_tab()}</span></a>{m.admin_settings_lookup_hint_post()}</p>
 			{/if}
 			<div class="save-row">
@@ -1506,12 +1521,13 @@
 	     always wants to paste a replacement, and disconnecting is the rarer exit.
 	     Guarded on the key being SET, not on the state being connected — a refused
 	     key the operator cannot remove would be a dead end. -->
-	{#if !data.fuzzysearchKeyFromEnv && data.fuzzysearchKeySet}
+	{#if fuzzysearchKeyEditable && data.fuzzysearchKeySet}
 		{#if confirmingFuzzysearchRemove}
 			<div class="remove-confirm">
 				<p id="fuzzysearch-remove-confirm">{m.admin_settings_lookup_confirm()}</p>
 				<div class="confirm-actions">
-					<form method="POST" action="?/removeFuzzysearchKey" use:enhance={() => {
+					<form method="POST" action="?/removeFuzzysearchKey" use:enhance={({ cancel }) => {
+						if (removingFuzzysearchKey) return cancel();
 						removingFuzzysearchKey = true;
 						return async ({ result, update }) => {
 							await update({ reset: false });
@@ -2582,9 +2598,19 @@
 		border-color: color-mix(in srgb, var(--border) 60%, var(--foreground));
 		color: var(--destructive);
 	}
+	/* The fill is pinned back to --background: .btn-outline's hover mixes it 88%
+	   toward white or black, and --destructive on that mix drops to 3.6-4.4:1 in
+	   five of the six themes (SC 1.4.3). The hover signal rides the border. */
 	.lookup-section .btn-remove:hover {
+		background-color: var(--background);
 		border-color: var(--destructive);
 	}
+	/* The refused state stacks "Save key" over "Remove key"; at the section's
+	   14px step they read as one button group, so the destructive exit gets a
+	   wider gap from the form it does not belong to. */
+	.lookup-section .save-form + .key-actions {
+		margin-top: 24px;
+	}
 	.lookup-section .remove-confirm {
 		margin-top: 14px;
 		padding: 14px 16px;
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index f7e18f65..12b8edcb 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2075,32 +2075,54 @@ describe('artist lookup section markup (SONA-156)', () => {
 	it('keeps Remove key reachable in the refused state', () => {
 		// Guarded on the key being SET, never narrowed by the refusal — a refused
 		// key the operator cannot remove would be a dead end.
-		const guard = '{#if !data.fuzzysearchKeyFromEnv && data.fuzzysearchKeySet}';
+		const guard = '{#if fuzzysearchKeyEditable && data.fuzzysearchKeySet}';
 		expect(src).toContain(guard);
 		const block = src.slice(src.indexOf(guard) + guard.length);
 		const actions = block.slice(0, block.indexOf('</section>'));
 		expect(actions).toContain('m.admin_settings_lookup_remove()');
-		expect(actions).not.toContain('fuzzysearchKeyRefused');
+		expect(actions).not.toContain('fuzzysearchKeyRefusedAt');
 	});
 
 	it('renders the refused eyebrow, the lapsed line, and a labelled record', () => {
-		expect(src).toContain('const fuzzysearchKeyRefused = $derived(!!data.fuzzysearchKeyRefusedAt)');
-		const refused = src.slice(src.indexOf('{#if fuzzysearchKeyRefused}'));
+		const refused = src.slice(src.indexOf('{#if fuzzysearchKeyRefusedAt}'));
 		const branch = refused.slice(0, refused.indexOf('{:else if data.fuzzysearchKeySet}'));
 		expect(branch).toContain('m.admin_settings_lookup_refused_eyebrow()');
 		expect(branch).toContain('class="lapsed-line"');
 		expect(branch).toContain('m.admin_settings_lookup_refused_line(');
 		// The mask's <dt> is visible only here, where the record sits above a "New
 		// FuzzySearch API key" field and would otherwise be an unlabelled pill.
-		expect(src).toContain("<dt class={fuzzysearchKeyRefused ? 'record-label' : 'sr-only'}>");
-		expect(src).toContain('m.admin_settings_lookup_refused_key_label()');
+		const dt = src.slice(src.indexOf('<dl class="key-dl">'));
+		const dtBlock = dt.slice(0, dt.indexOf('</dt>'));
+		expect(dtBlock).toContain('record-label');
+		expect(dtBlock).toContain('sr-only');
+		expect(dtBlock).toContain('m.admin_settings_lookup_refused_key_label()');
 	});
 
 	it('renames the key field and drops the self-serve hint when refused', () => {
-		expect(src).toContain(
-			'{fuzzysearchKeyRefused ? m.admin_settings_lookup_new_key_label() : m.admin_settings_lookup_key_label()}'
-		);
+		const label = src.slice(src.indexOf('m.admin_settings_lookup_new_key_label()'));
+		expect(label.slice(0, 120)).toContain('m.admin_settings_lookup_key_label()');
 		const hint = src.slice(0, src.indexOf('m.admin_settings_lookup_hint_pre()'));
-		expect(hint.slice(-200)).toContain('{#if !fuzzysearchKeyRefused}');
+		expect(hint.slice(-200)).toContain('{#if !fuzzysearchKeyRefusedAt}');
+	});
+
+	// Both submit buttons unmount on success, so the section hands focus on by
+	// hand and can never use `disabled` (disabling the focused button drops the
+	// keyboard user on <body>). A revert to disabled={saving} would reintroduce
+	// the focus loss with both suites green, so the wiring is pinned here.
+	it('drives focus by hand and marks pending with aria-busy, never disabled', () => {
+		const section = src.slice(src.indexOf('class="security-section lookup-section"'));
+		const markup = section.slice(0, section.indexOf('</section>'));
+		for (const ref of ['fuzzysearchKeepButton', 'fuzzysearchRemoveButton', 'fuzzysearchKeyInput']) {
+			expect(src, ref).toContain(`bind:this={${ref}}`);
+			expect(src, ref).toContain(`${ref}?.focus()`);
+		}
+		// The save form and the confirm-remove form: both report pending state to
+		// assistive tech without taking the control away.
+		expect(markup).toContain('aria-busy={savingFuzzysearchKey}');
+		expect(markup).toContain('aria-busy={removingFuzzysearchKey}');
+		expect(markup).not.toContain('disabled=');
+		// aria-busy is not reliably announced on a button, so the pending sentence
+		// also rides a live region that stays mounted for the life of the section.
+		expect(markup).toContain('role="status"');
 	});
 });
diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index 574e5740..0393d0fb 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -86,6 +86,9 @@ test.describe('admin settings artist lookup key', () => {
 		await expect(keyRecord(page)).toContainText('8901');
 		await expect(keyRecord(page)).not.toContainText('e2e-fuzzysearch');
 		await expect(keyInput(page)).toHaveCount(0);
+		// The save form unmounts and takes the focused Save button with it, so the
+		// button that replaces it has to pick focus up.
+		await expect(removeButton(page)).toBeFocused();
 
 		// Removal asks first, and moves focus onto the safe choice — every button
 		// involved unmounts as the panel opens, so without that a keyboard user

From 13fa96baf99d4674d13b989e29a875e32e571f60 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 15:58:20 -0700
Subject: [PATCH 11/38] fix(settings): hold the lookup block steady when the
 confirmation opens (SONA-156)

Opening the removal confirmation dropped the "To use a different key" line at
the same moment the button row was swapped, pulling the block up 34px at 1280
and 54px at 390. The destructive Remove then sat on the pixel Remove key was
clicked, so a double click removed the key without the question being read.

Keep the replace line rendered while confirming, and give the confirmation
panel the same 24px step after the save form that the row it replaces has. The
e2e spec now clicks Remove key at its own centre and asserts the confirm Remove
does not cover that point, at 1280 and 390.
---
 src/routes/admin/settings/+page.svelte | 11 +++++---
 tests/e2e/fuzzysearch-key.spec.ts      | 35 ++++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index 7168e734..d448bdde 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -1462,7 +1462,10 @@
 				{/if}
 			</dd>
 		</dl>
-		{#if !fuzzysearchKeyRefusedAt && !confirmingFuzzysearchRemove}
+		<!-- Kept rendered while the confirmation is open: dropping it at the same
+		     moment the button row is swapped pulled the block up by 34-54px, which
+		     put the destructive Remove under the pixel Remove key was clicked. -->
+		{#if !fuzzysearchKeyRefusedAt}
 			<p class="status-line replace-line">{m.admin_settings_lookup_replace()}</p>
 		{/if}
 	{/if}
@@ -2607,8 +2610,10 @@
 	}
 	/* The refused state stacks "Save key" over "Remove key"; at the section's
 	   14px step they read as one button group, so the destructive exit gets a
-	   wider gap from the form it does not belong to. */
-	.lookup-section .save-form + .key-actions {
+	   wider gap from the form it does not belong to. The confirmation panel takes
+	   the same step, since it replaces that row in place. */
+	.lookup-section .save-form + .key-actions,
+	.lookup-section .save-form + .remove-confirm {
 		margin-top: 24px;
 	}
 	.lookup-section .remove-confirm {
diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index 0393d0fb..92f2128b 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -28,6 +28,30 @@ const removeButton = (page: Page) => section(page).locator('button.btn-remove');
 const confirmPanel = (page: Page) => section(page).locator('.remove-confirm');
 const keyRecord = (page: Page) => section(page).locator('.key-record');
 
+// Opening the confirmation must not move the destructive button under the
+// pointer: while the block's top edge shifted up on the swap, the confirm
+// Remove landed on the pixel Remove key was just clicked, so a double click or
+// an impatient second tap removed the key without the question being read.
+// Clicks Remove key at its own centre and asks where that point ends up.
+async function openConfirmClearOfThePointer(page: Page) {
+	const box = await removeButton(page).boundingBox();
+	if (!box) throw new Error('Remove key has no bounding box');
+	const point = { x: box.x + box.width / 2, y: box.y + box.height / 2 };
+	await removeButton(page).click();
+	await expect(confirmPanel(page)).toBeVisible();
+	const confirm = confirmPanel(page).getByRole('button', { name: 'Remove', exact: true });
+	const after = await confirm.boundingBox();
+	if (!after) throw new Error('Remove (confirm) has no bounding box');
+	const covers =
+		point.x >= after.x &&
+		point.x <= after.x + after.width &&
+		point.y >= after.y &&
+		point.y <= after.y + after.height;
+	expect(covers, `confirm Remove covers the clicked point at ${page.viewportSize()?.width}px`).toBe(
+		false
+	);
+}
+
 // The connections sections are hidden by CSS until the tab is active, and the
 // toggle is client JS — so the click only "takes" once hydrated (the
 // supporter-key spec's retry shape).
@@ -93,8 +117,7 @@ test.describe('admin settings artist lookup key', () => {
 		// Removal asks first, and moves focus onto the safe choice — every button
 		// involved unmounts as the panel opens, so without that a keyboard user
 		// lands back on <body>.
-		await removeButton(page).click();
-		await expect(confirmPanel(page)).toBeVisible();
+		await openConfirmClearOfThePointer(page);
 		const keep = confirmPanel(page).getByRole('button', { name: 'Keep', exact: true });
 		await expect(keep).toBeFocused();
 
@@ -104,6 +127,14 @@ test.describe('admin settings artist lookup key', () => {
 		await expect(keyRecord(page)).toContainText('8901');
 		await expect(removeButton(page)).toBeFocused();
 
+		// Again at 390, where the block is taller and the shift used to be larger.
+		const desktop = page.viewportSize();
+		await page.setViewportSize({ width: 390, height: 844 });
+		await openConfirmClearOfThePointer(page);
+		await confirmPanel(page).getByRole('button', { name: 'Keep', exact: true }).click();
+		await expect(confirmPanel(page)).toHaveCount(0);
+		if (desktop) await page.setViewportSize(desktop);
+
 		// Remove, confirmed, clears the key and returns the section to its
 		// unconnected state — the state the seed hands every other spec.
 		await removeButton(page).click();

From 6a07c1300974841e771482448fc8098bf1cd84aa Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 15:58:25 -0700
Subject: [PATCH 12/38] test(settings): pin the cancel() double-submit guard
 and the live region (SONA-156)

Without `disabled` on either submit button, cancel() is the only thing between
a double activation and two in-flight writes, and nothing tested it. Slice each
use:enhance handler out of the section and assert it destructures cancel and
returns cancel() on its own pending flag.

The live region gets its own pin too: it has to sit outside every conditional
branch, since a region that mounts with its text already in place is never
announced. Drop the bound-identifier greps the e2e spec already proves for
real, and reuse theme-contrast's hoisted THEME_BLOCKS.
---
 src/lib/theme-contrast.test.ts                | 14 +--------
 src/routes/admin/settings/page.server.test.ts | 30 ++++++++++++++++---
 2 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/src/lib/theme-contrast.test.ts b/src/lib/theme-contrast.test.ts
index 896a65a2..95e73984 100644
--- a/src/lib/theme-contrast.test.ts
+++ b/src/lib/theme-contrast.test.ts
@@ -924,19 +924,7 @@ describe('no accent-color override on form controls (SONA-172)', () => {
 // and lets the border carry the hover signal (SONA-156). Two halves: the token
 // pairing has to clear AA, and the rule has to keep using it.
 describe('SONA-156 Remove-key label on its pinned hover fill', () => {
-	const blocks = THEMES.flatMap(({ id }) =>
-		id === 'default'
-			? [
-					{ name: 'default dark', sel: ':root' },
-					{ name: 'default light', sel: "[data-theme='light']" }
-				]
-			: [
-					{ name: `${id} dark`, sel: `[data-theme-id='${id}']` },
-					{ name: `${id} light`, sel: `[data-theme-id='${id}'][data-theme='light']` }
-				]
-	);
-
-	for (const { name, sel } of blocks) {
+	for (const { name, sel } of THEME_BLOCKS) {
 		it(`${name}: destructive text on the page background meets 4.5:1`, () => {
 			expect(contrast(blockToken(sel, 'destructive'), blockToken(sel, 'background'))).toBeGreaterThanOrEqual(4.5);
 		});
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 12b8edcb..279ecc35 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2112,10 +2112,6 @@ describe('artist lookup section markup (SONA-156)', () => {
 	it('drives focus by hand and marks pending with aria-busy, never disabled', () => {
 		const section = src.slice(src.indexOf('class="security-section lookup-section"'));
 		const markup = section.slice(0, section.indexOf('</section>'));
-		for (const ref of ['fuzzysearchKeepButton', 'fuzzysearchRemoveButton', 'fuzzysearchKeyInput']) {
-			expect(src, ref).toContain(`bind:this={${ref}}`);
-			expect(src, ref).toContain(`${ref}?.focus()`);
-		}
 		// The save form and the confirm-remove form: both report pending state to
 		// assistive tech without taking the control away.
 		expect(markup).toContain('aria-busy={savingFuzzysearchKey}');
@@ -2124,5 +2120,31 @@ describe('artist lookup section markup (SONA-156)', () => {
 		// aria-busy is not reliably announced on a button, so the pending sentence
 		// also rides a live region that stays mounted for the life of the section.
 		expect(markup).toContain('role="status"');
+		// Without `disabled`, cancel() is the only thing between a double
+		// activation and two in-flight writes, so each handler is pinned to it.
+		const handler = (action: string) => {
+			const start = markup.indexOf(`action="?/${action}" use:enhance=`);
+			expect(start, action).toBeGreaterThan(-1);
+			return markup.slice(start, markup.indexOf('}}>', start));
+		};
+		const save = handler('saveFuzzysearchKey');
+		expect(save).toContain('({ cancel })');
+		expect(save).toContain('if (savingFuzzysearchKey) return cancel();');
+		const remove = handler('removeFuzzysearchKey');
+		expect(remove).toContain('({ cancel })');
+		expect(remove).toContain('if (removingFuzzysearchKey) return cancel();');
+	});
+
+	// A live region that mounts with its text already in place is not announced,
+	// so this one sits outside every conditional branch — moving it inside
+	// {#if savingFuzzysearchKey} would leave the presence check above green.
+	it('mounts the live region ahead of every conditional branch', () => {
+		const section = src.slice(src.indexOf('class="security-section lookup-section"'));
+		const markup = section.slice(0, section.indexOf('</section>'));
+		expect(markup.indexOf('role="status"')).toBeLessThan(markup.indexOf('{#if'));
+		const region = markup.slice(markup.indexOf('role="status"'));
+		const body = region.slice(0, region.indexOf('</span>'));
+		expect(body).toContain('m.admin_saving()');
+		expect(body).toContain('m.admin_settings_lookup_removing()');
 	});
 });

From e2e3a6ee9109a3393575538cede2333b2fa44d25 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 16:27:15 -0700
Subject: [PATCH 13/38] test(settings): pin the lookup confirmation's layout
 and guards by contract (SONA-156)

---
 src/routes/admin/settings/page.server.test.ts |  8 +++--
 tests/e2e/fuzzysearch-key.spec.ts             | 35 ++++++++++++++++---
 2 files changed, 37 insertions(+), 6 deletions(-)

diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 279ecc35..ceeaf639 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2127,12 +2127,16 @@ describe('artist lookup section markup (SONA-156)', () => {
 			expect(start, action).toBeGreaterThan(-1);
 			return markup.slice(start, markup.indexOf('}}>', start));
 		};
+		// Shape, not spelling: any early return through cancel() on the pending
+		// flag counts, however it is braced or wrapped.
+		const guardsOn = (flag: string) =>
+			new RegExp(`if\\s*\\(\\s*${flag}\\s*\\)\\s*\\{?\\s*return\\s+cancel\\(\\s*\\)`);
 		const save = handler('saveFuzzysearchKey');
 		expect(save).toContain('({ cancel })');
-		expect(save).toContain('if (savingFuzzysearchKey) return cancel();');
+		expect(save).toMatch(guardsOn('savingFuzzysearchKey'));
 		const remove = handler('removeFuzzysearchKey');
 		expect(remove).toContain('({ cancel })');
-		expect(remove).toContain('if (removingFuzzysearchKey) return cancel();');
+		expect(remove).toMatch(guardsOn('removingFuzzysearchKey'));
 	});
 
 	// A live region that mounts with its text already in place is not announced,
diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index 92f2128b..aa2ff5e7 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -27,29 +27,56 @@ const saveButton = (page: Page) =>
 const removeButton = (page: Page) => section(page).locator('button.btn-remove');
 const confirmPanel = (page: Page) => section(page).locator('.remove-confirm');
 const keyRecord = (page: Page) => section(page).locator('.key-record');
+const replaceLine = (page: Page) => section(page).locator('.replace-line');
 
 // Opening the confirmation must not move the destructive button under the
 // pointer: while the block's top edge shifted up on the swap, the confirm
 // Remove landed on the pixel Remove key was just clicked, so a double click or
 // an impatient second tap removed the key without the question being read.
 // Clicks Remove key at its own centre and asks where that point ends up.
+// Both boxes are read in one coordinate frame: the button is centred in the
+// viewport first and the click goes through page.mouse at that exact point,
+// because locator.click() scrolls the button into view itself — after which the
+// "before" box belongs to a frame the confirm button was never measured in, and
+// at 390px the button's centre sits under the bottom tab bar, so the click that
+// "worked" was a click at some other pixel entirely.
 async function openConfirmClearOfThePointer(page: Page) {
+	await removeButton(page).evaluate((el) => el.scrollIntoView({ block: 'center' }));
 	const box = await removeButton(page).boundingBox();
 	if (!box) throw new Error('Remove key has no bounding box');
 	const point = { x: box.x + box.width / 2, y: box.y + box.height / 2 };
-	await removeButton(page).click();
+	// The pixel has to belong to Remove key itself, or the click below opens the
+	// panel from somewhere else and the comparison proves nothing.
+	const owner = await page.evaluate(
+		({ x, y }) => document.elementFromPoint(x, y)?.closest('button')?.className ?? '',
+		point
+	);
+	expect(owner, `the clicked pixel is Remove key at ${page.viewportSize()?.width}px`).toContain(
+		'btn-remove'
+	);
+	const frame = await page.evaluate(() => window.scrollY);
+	await page.mouse.click(point.x, point.y);
 	await expect(confirmPanel(page)).toBeVisible();
+	// The mechanism that holds the block still: the replace line stays rendered
+	// while the confirmation is open, so the swap does not pull the block up.
+	await expect(replaceLine(page)).toBeVisible();
 	const confirm = confirmPanel(page).getByRole('button', { name: 'Remove', exact: true });
 	const after = await confirm.boundingBox();
 	if (!after) throw new Error('Remove (confirm) has no bounding box');
+	// Both boxes are viewport-relative, which is the frame the pointer lives in:
+	// focusing Keep can scroll the page, and whatever that scroll brings under
+	// the pointer is exactly what a second click would hit. So the shift is
+	// reported, not corrected for.
+	const scrolled = (await page.evaluate(() => window.scrollY)) - frame;
 	const covers =
 		point.x >= after.x &&
 		point.x <= after.x + after.width &&
 		point.y >= after.y &&
 		point.y <= after.y + after.height;
-	expect(covers, `confirm Remove covers the clicked point at ${page.viewportSize()?.width}px`).toBe(
-		false
-	);
+	expect(
+		covers,
+		`confirm Remove covers the clicked point at ${page.viewportSize()?.width}px (page scrolled ${scrolled}px)`
+	).toBe(false);
 }
 
 // The connections sections are hidden by CSS until the tab is active, and the

From 931b1aab45dc51a43a14bde4d5cb2cbc28901d0b Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:10:54 -0700
Subject: [PATCH 14/38] fix(lookup): report a rejected stored fetch and fold
 more source URLs (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A stored-image fetch that rejects rather than answering — DNS failure, reset
connection, TLS error — escaped the artist-lookup endpoint as a 500. It now
reports the same 502 `unavailable` the null branch does.

Alongside it, three smaller corrections on the same path:

- `postUrlFor` strips a leading `@` from a Twitter handle before encoding it,
  the way `handleProfileUrl` already did. FuzzySearch spells handles both
  ways, and the '@' built a 404 for every tweet. A handle that is nothing but
  decoration falls back to the `/i/status/{id}` spelling.
- `normalizeSourceUrl` folds FurAffinity's `/full/{id}` onto `/view/{id}` and
  e621's `/post/show/{id}` onto `/posts/{id}`, so an operator who saved either
  spelling still gets the duplicate-source warning.
- The settings load reads the two raw lookup rows in one query instead of two
  sequential ones.
---
 src/lib/server/fuzzysearch.test.ts            | 35 +++++++++++++++++++
 src/lib/server/fuzzysearch.ts                 | 12 ++++++-
 src/routes/admin/settings/+page.server.ts     | 11 ++++--
 src/routes/api/admin/artist-lookup/+server.ts | 10 +++++-
 .../api/admin/artist-lookup/server.test.ts    | 20 +++++++++++
 5 files changed, 84 insertions(+), 4 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 6b73f209..88820514 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -8,6 +8,7 @@ import {
 	pickPrefillMatch,
 	strictestRating,
 	normalizeSourceUrl,
+	postUrlFor,
 	handleProfileUrl,
 	findLocalArtists,
 	findArtistsByName,
@@ -347,6 +348,20 @@ describe('normalizeSourceUrl', () => {
 		);
 	});
 
+	// Each site's other spelling of one submission: FurAffinity's full-size view
+	// and e621's old post path both name the post this client builds a canonical
+	// URL for.
+	it('folds the alternate post paths on FurAffinity and e621', () => {
+		expect(normalizeSourceUrl('https://www.furaffinity.net/full/12345/')).toBe(
+			'furaffinity.net/view/12345'
+		);
+		expect(normalizeSourceUrl('https://e621.net/post/show/160')).toBe('e621.net/posts/160');
+		// Only the bare id form folds: a deeper path is a different page.
+		expect(normalizeSourceUrl('https://www.furaffinity.net/full/12345/extra')).toBe(
+			'furaffinity.net/full/12345/extra'
+		);
+	});
+
 	it('is empty for blank input', () => {
 		expect(normalizeSourceUrl('')).toBe('');
 		expect(normalizeSourceUrl(null)).toBe('');
@@ -354,6 +369,26 @@ describe('normalizeSourceUrl', () => {
 	});
 });
 
+describe('postUrlFor', () => {
+	// FuzzySearch hands Twitter handles back spelled either way, and the '@' is
+	// not part of the path — left in, it builds a 404 for every tweet.
+	it('strips a leading @ from the Twitter handle', () => {
+		expect(postUrlFor('Twitter', '160', ['@kuttoya'])).toBe(
+			'https://twitter.com/kuttoya/status/160'
+		);
+		expect(postUrlFor('Twitter', '160', ['kuttoya'])).toBe(
+			'https://twitter.com/kuttoya/status/160'
+		);
+	});
+
+	// Nothing left after stripping is the same as no handle at all.
+	it('falls back to the /i/ spelling when the handle is only decoration', () => {
+		expect(postUrlFor('Twitter', '160', ['@'])).toBe('https://twitter.com/i/status/160');
+		expect(postUrlFor('Twitter', '160', ['  '])).toBe('https://twitter.com/i/status/160');
+		expect(postUrlFor('Twitter', '160', [])).toBe('https://twitter.com/i/status/160');
+	});
+});
+
 describe('handleProfileUrl', () => {
 	it('builds profile URLs for the sites we hold a column for', () => {
 		expect(handleProfileUrl('FurAffinity', 'kuttoya')).toBe(
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index f06ae56b..8f89c1a1 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -118,7 +118,10 @@ export function postUrlFor(site: LookupSite, siteId: string, handles: string[]):
 		case 'e621':
 			return `https://e621.net/posts/${id}`;
 		case 'Twitter': {
-			const handle = handles[0];
+			// Handles arrive spelled either way; the '@' is not part of the path.
+			// Stripped like handleProfileUrl does, and a handle that was nothing
+			// but decoration falls through to the handle-less spelling.
+			const handle = (handles[0] ?? '').trim().replace(/^@+/, '');
 			// Without a handle Twitter still resolves the status through /i/.
 			return handle
 				? `https://twitter.com/${encodeURIComponent(handle)}/status/${id}`
@@ -177,6 +180,13 @@ export function normalizeSourceUrl(url: string | null | undefined): string {
 	// Anything after the id goes too, so the `/photo/1` permalink Twitter's own
 	// UI hands out compares equal to the bare tweet.
 	if (host === 'twitter.com') path = path.replace(/^\/[^/]+\/status\/(\d+).*$/, '/i/status/$1');
+	// The same submission under each site's other spelling: FurAffinity's
+	// full-size view (`/full/12345`) is the post this client builds as
+	// `/view/12345`, and e621's old post path (`/post/show/160`) is today's
+	// `/posts/160`. An operator who saved either gets no clash warning without
+	// the fold.
+	if (host === 'furaffinity.net') path = path.replace(/^\/full\/(\d+)$/, '/view/$1');
+	if (host === 'e621.net') path = path.replace(/^\/post\/show\/(\d+)$/, '/posts/$1');
 	return host + path;
 }
 
diff --git a/src/routes/admin/settings/+page.server.ts b/src/routes/admin/settings/+page.server.ts
index 312758fe..7047f762 100644
--- a/src/routes/admin/settings/+page.server.ts
+++ b/src/routes/admin/settings/+page.server.ts
@@ -6,6 +6,7 @@ import {
 	getSettings,
 	saveSettings,
 	getRawSetting,
+	getRawSettings,
 	setRawSetting,
 	clearSettingsCache,
 	clearSupporterKeyStatusCache,
@@ -278,8 +279,14 @@ export const load: PageServerLoad = async ({ platform, url, locals }) => {
 	// own field rather than folded into a status object, so a later spread
 	// cannot pick the raw key up by accident (the supporter-key precedent).
 	const fuzzysearchKeyFromEnv = !!platform?.env?.FUZZYSEARCH_API_KEY?.trim();
-	const fuzzysearchStoredKey = (await getRawSetting(db, FUZZYSEARCH_API_KEY_SETTING))?.trim() ?? '';
-	const fuzzysearchRefusedAt = (await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)) ?? '';
+	// Both rows in one query: load already spends its subrequest budget on the
+	// D1 reads above, and these two keys are always read together.
+	const fuzzysearchRaw = await getRawSettings(db, [
+		FUZZYSEARCH_API_KEY_SETTING,
+		FUZZYSEARCH_KEY_REFUSED_SETTING
+	]);
+	const fuzzysearchStoredKey = fuzzysearchRaw[FUZZYSEARCH_API_KEY_SETTING]?.trim() ?? '';
+	const fuzzysearchRefusedAt = fuzzysearchRaw[FUZZYSEARCH_KEY_REFUSED_SETTING] ?? '';
 
 	// Per-content-type usage (SONA-192) — R2 only: derived from listing the
 	// bucket, so it also counts files D1 never tracked. Reduced to counts and
diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index eaa42f43..78dba1d4 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -114,7 +114,15 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		// Server-side fetch of a URL the SERVER looked up, with the shared
 		// hardening: private and link-local hosts refused, redirects not
 		// followed, image/* content types only.
-		const stored = await proxyStoredImage(row.imageUrl, fetch);
+		let stored: Response | null;
+		try {
+			stored = await proxyStoredImage(row.imageUrl, fetch);
+		} catch {
+			// A DNS failure, a reset connection or a TLS error rejects rather than
+			// answering — the stored image is as unreachable as when the proxy
+			// refuses it outright, so it reports the same way.
+			return failure('unavailable');
+		}
 		if (!stored?.body) return failure('unavailable');
 		// Lowercased: media types are case-insensitive, so an `Image/PNG` header
 		// must pass the same check as `image/png`.
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index 7e601761..a890471a 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -314,6 +314,26 @@ describe('artist-lookup — stored image by id', () => {
 		expect(searchImage).not.toHaveBeenCalled();
 	});
 
+	// A fetch that REJECTS rather than answering — DNS failure, reset connection,
+	// TLS error. Unwrapped it escapes as a 500 with a stack, instead of the same
+	// answer the null branch gives.
+	it('reports unavailable when the stored fetch rejects', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.png', '2026-01-01');`
+		);
+		const rejecting = (async () => {
+			throw new TypeError('fetch failed');
+		}) as unknown as typeof fetch;
+
+		const res = await POST(jsonEvent(platform, { imageId: 1 }, rejecting));
+
+		expect(res.status).toBe(502);
+		expect(await res.json()).toEqual({ enabled: true, error: 'unavailable' });
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
 	it('refuses a stored image whose body runs past the cap', async () => {
 		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 		sqlite.exec(

From e6b09b7ab9ff8a009bcbec7e017a2ce79fa58217 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:10:59 -0700
Subject: [PATCH 15/38] fix(image-proxy): pass through only the stored raster
 types (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The proxy echoed any `image/*` content type back inline, which includes
`image/svg+xml` — an image type that carries script, and one the storage
layer itself refuses. An upstream is free to label a response whatever it
likes, so the check now reuses `isAllowedImageType`, the same raster
allowlist stored uploads pass. Anything else comes back as
`application/octet-stream` with `Content-Disposition: attachment`, and every
response carries `Content-Security-Policy: sandbox` as a second, redundant
layer.

This widens to the avatar and ref-image routes, which share the proxy. Both
only ever serve rasters, so real data behaves as before.
---
 src/lib/server/image-proxy.test.ts | 24 ++++++++++++++++++++++--
 src/lib/server/image-proxy.ts      | 18 +++++++++++++-----
 2 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/src/lib/server/image-proxy.test.ts b/src/lib/server/image-proxy.test.ts
index b65214c8..b6043e8c 100644
--- a/src/lib/server/image-proxy.test.ts
+++ b/src/lib/server/image-proxy.test.ts
@@ -114,8 +114,21 @@ describe('proxyStoredImage', () => {
 		expect((await proxy('image/png')).headers.get('content-type')).toBe('image/png');
 	});
 
-	it('demotes a non-image content type to a download', async () => {
-		expect((await proxy('text/html')).headers.get('content-type')).toBe('application/octet-stream');
+	// The type parameters an upstream may attach are not part of the media type.
+	it('passes an allowed type through with its parameters', async () => {
+		const res = await proxy('Image/JPEG; charset=binary');
+		expect(res.headers.get('content-type')).toBe('Image/JPEG; charset=binary');
+		expect(res.headers.get('content-disposition')).toBe('inline');
+	});
+
+	// Narrower than image/*: SVG is an image type that carries script, so it is
+	// demoted exactly like a text/html payload wearing an image URL.
+	it('demotes svg and non-image types to a download', async () => {
+		for (const type of ['image/svg+xml', 'text/html']) {
+			const res = await proxy(type);
+			expect(res.headers.get('content-type'), type).toBe('application/octet-stream');
+			expect(res.headers.get('content-disposition'), type).toBe('attachment');
+		}
 	});
 
 	it('serves inline and never caches', async () => {
@@ -124,6 +137,13 @@ describe('proxyStoredImage', () => {
 		expect(res.headers.get('cache-control')).toBe('private, no-store');
 	});
 
+	// A second, redundant layer: even a response a browser decided to render
+	// gets an opaque origin with scripts off.
+	it('sandboxes the response', async () => {
+		expect((await proxy('image/png')).headers.get('content-security-policy')).toBe('sandbox');
+		expect((await proxy('text/html')).headers.get('content-security-policy')).toBe('sandbox');
+	});
+
 	it('refuses a private host without fetching', async () => {
 		let called = false;
 		const fetcher = (async () => {
diff --git a/src/lib/server/image-proxy.ts b/src/lib/server/image-proxy.ts
index 1733a565..97572a52 100644
--- a/src/lib/server/image-proxy.ts
+++ b/src/lib/server/image-proxy.ts
@@ -12,9 +12,12 @@
  * Callers pass a URL the SERVER looked up (a stored row, a setting), never one
  * the client supplied, which is what keeps this from being an SSRF hole. On top
  * of that: private and link-local hosts are refused, redirects are not
- * followed, and only image/* content types are echoed back.
+ * followed, and only the raster types the storage layer itself accepts are
+ * echoed back inline.
  */
 
+import { isAllowedImageType } from './storage/allowlist';
+
 // Loopback / unspecified / RFC1918 / link-local / ULA hosts a stored URL must
 // never point the server-side fetch at.
 export function isPrivateHost(hostname: string): boolean {
@@ -90,13 +93,18 @@ export async function proxyStoredImage(
 	if (!upstream.ok || !upstream.body) return null;
 
 	const contentType = upstream.headers.get('content-type') ?? '';
-	// Media types are case-insensitive, so an upstream answering `Image/PNG` is
-	// still an image and must not be demoted to a download.
-	const isImage = contentType.toLowerCase().startsWith('image/');
+	// The same raster allowlist stored uploads pass, rather than the whole of
+	// `image/*`: SVG is an image type that carries script, and an upstream is
+	// free to label anything it likes. isAllowedImageType is case-insensitive
+	// and ignores parameters, so `Image/JPEG; charset=binary` still passes.
+	// Anything else is handed back as an opaque download that no browser will
+	// render, with a sandbox CSP as a second, redundant layer in case one does.
+	const isImage = isAllowedImageType(contentType);
 	return new Response(upstream.body, {
 		headers: {
 			'Content-Type': isImage ? contentType : 'application/octet-stream',
-			'Content-Disposition': 'inline',
+			'Content-Disposition': isImage ? 'inline' : 'attachment',
+			'Content-Security-Policy': 'sandbox',
 			'Cache-Control': 'private, no-store'
 		}
 	});

From bb47b6dee98a96f6656841c8ab18ab4198b42825 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:25:07 -0700
Subject: [PATCH 16/38] refactor(lookup): fold the rejected fetch into the
 proxy and share one allowlist (SONA-156)

proxyStoredImage now catches a rejected fetch and answers null, the same as it
does for a non-ok response, so the avatar and ref-image routes report an
unreachable stored image instead of a 500. The artist-lookup endpoint drops its
own try/catch and checks the proxy's raster allowlist by name rather than
re-testing image/*, which had let an SVG the proxy already demoted through.

Also folds the three copies of leading-@ stripping in fuzzysearch.ts into one
helper, and lets the e621 fold tolerate the tag string the old post path carried
after the id.
---
 src/lib/server/fuzzysearch.test.ts            |  8 ++++++-
 src/lib/server/fuzzysearch.ts                 | 24 ++++++++++++-------
 src/lib/server/image-proxy.test.ts            | 10 ++++++++
 src/lib/server/image-proxy.ts                 | 11 ++++++++-
 src/routes/api/admin/artist-lookup/+server.ts | 21 +++++++---------
 .../api/admin/artist-lookup/server.test.ts    | 21 ++++++++++++++++
 6 files changed, 73 insertions(+), 22 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 88820514..8d16e68b 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -356,7 +356,13 @@ describe('normalizeSourceUrl', () => {
 			'furaffinity.net/view/12345'
 		);
 		expect(normalizeSourceUrl('https://e621.net/post/show/160')).toBe('e621.net/posts/160');
-		// Only the bare id form folds: a deeper path is a different page.
+		// e621's old path carried the tag string after the id, and that is still
+		// the same post — folded like a tweet's trailing segment.
+		expect(normalizeSourceUrl('https://e621.net/post/show/160/canine%20solo')).toBe(
+			'e621.net/posts/160'
+		);
+		// Only the bare id form folds on FurAffinity: a deeper path is a different
+		// page there.
 		expect(normalizeSourceUrl('https://www.furaffinity.net/full/12345/extra')).toBe(
 			'furaffinity.net/full/12345/extra'
 		);
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index 8f89c1a1..db0f9983 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -106,6 +106,13 @@ export function distanceBand(distance: number | null): MatchBand {
 	return 'possible';
 }
 
+/** A handle as the rest of this file wants it: trimmed, with the '@' decoration
+ * off. Handles arrive spelled either way, and one that was nothing but
+ * decoration comes back empty for the caller to fall back on. */
+function cleanHandle(handle: string): string {
+	return handle.trim().replace(/^@+/, '');
+}
+
 /** Public post URL for a match, by site. Built here rather than trusted from
  * the response so a hostile payload cannot hand the operator an arbitrary link. */
 export function postUrlFor(site: LookupSite, siteId: string, handles: string[]): string {
@@ -118,10 +125,9 @@ export function postUrlFor(site: LookupSite, siteId: string, handles: string[]):
 		case 'e621':
 			return `https://e621.net/posts/${id}`;
 		case 'Twitter': {
-			// Handles arrive spelled either way; the '@' is not part of the path.
-			// Stripped like handleProfileUrl does, and a handle that was nothing
-			// but decoration falls through to the handle-less spelling.
-			const handle = (handles[0] ?? '').trim().replace(/^@+/, '');
+			// The '@' is not part of the path, and a handle that was nothing but
+			// decoration falls through to the handle-less spelling.
+			const handle = cleanHandle(handles[0] ?? '');
 			// Without a handle Twitter still resolves the status through /i/.
 			return handle
 				? `https://twitter.com/${encodeURIComponent(handle)}/status/${id}`
@@ -133,7 +139,7 @@ export function postUrlFor(site: LookupSite, siteId: string, handles: string[]):
 /** Canonical profile URL for a handle on a site we hold an artist column for.
  * Weasyl and e621 have no column yet (SONA-219), so they resolve to null. */
 export function handleProfileUrl(site: LookupSite, handle: string): string | null {
-	const h = handle.trim().replace(/^@+/, '');
+	const h = cleanHandle(handle);
 	if (!h) return null;
 	// Percent-encoded like postUrlFor's ids: a handle is third-party text, and a
 	// slash or a '?' in it would otherwise re-point the URL at another page.
@@ -184,9 +190,11 @@ export function normalizeSourceUrl(url: string | null | undefined): string {
 	// full-size view (`/full/12345`) is the post this client builds as
 	// `/view/12345`, and e621's old post path (`/post/show/160`) is today's
 	// `/posts/160`. An operator who saved either gets no clash warning without
-	// the fold.
+	// the fold. e621's old path also carried the tag string as a trailing
+	// segment (`/post/show/160/canine`), which is the same post; FurAffinity's
+	// stays anchored, since nothing follows the id there.
 	if (host === 'furaffinity.net') path = path.replace(/^\/full\/(\d+)$/, '/view/$1');
-	if (host === 'e621.net') path = path.replace(/^\/post\/show\/(\d+)$/, '/posts/$1');
+	if (host === 'e621.net') path = path.replace(/^\/post\/show\/(\d+)(?:\/.*)?$/, '/posts/$1');
 	return host + path;
 }
 
@@ -359,7 +367,7 @@ export function findLocalArtists<T extends Record<string, unknown>>(
  * "you may already have this artist" guard rather than an automatic link.
  */
 export function findArtistsByName<T extends { name: string }>(rows: T[], handle: string): T[] {
-	const needle = handle.trim().replace(/^@+/, '').toLowerCase();
+	const needle = cleanHandle(handle).toLowerCase();
 	if (!needle) return [];
 	return rows.filter((row) => row.name.trim().toLowerCase() === needle);
 }
diff --git a/src/lib/server/image-proxy.test.ts b/src/lib/server/image-proxy.test.ts
index b6043e8c..c727ca4a 100644
--- a/src/lib/server/image-proxy.test.ts
+++ b/src/lib/server/image-proxy.test.ts
@@ -153,4 +153,14 @@ describe('proxyStoredImage', () => {
 		expect(await proxyStoredImage('http://127.0.0.1/img.png', fetcher)).toBeNull();
 		expect(called).toBe(false);
 	});
+
+	// A fetch that REJECTS rather than answering — DNS failure, reset connection,
+	// TLS error. Handled here rather than in each route, so all three callers
+	// report the stored image as unreachable instead of throwing a 500.
+	it('answers null when the fetch rejects', async () => {
+		const rejecting = (async () => {
+			throw new TypeError('fetch failed');
+		}) as unknown as typeof fetch;
+		expect(await proxyStoredImage('https://cdn.example/img.png', rejecting)).toBeNull();
+	});
 });
diff --git a/src/lib/server/image-proxy.ts b/src/lib/server/image-proxy.ts
index 97572a52..2988cd3e 100644
--- a/src/lib/server/image-proxy.ts
+++ b/src/lib/server/image-proxy.ts
@@ -89,7 +89,16 @@ export async function proxyStoredImage(
 
 	// A storage host answering with a redirect is unexpected — treat it as an
 	// upstream error rather than following it to an arbitrary location.
-	const upstream = await fetcher(imageUrl, { redirect: 'manual' });
+	let upstream: Response;
+	try {
+		upstream = await fetcher(imageUrl, { redirect: 'manual' });
+	} catch {
+		// A DNS failure, a reset connection or a TLS error rejects rather than
+		// answering. The stored image is as unreachable as it is on a non-ok
+		// response, so it reports the same way — every caller already handles null,
+		// and none of them has to answer 500 to a network blip.
+		return null;
+	}
 	if (!upstream.ok || !upstream.body) return null;
 
 	const contentType = upstream.headers.get('content-type') ?? '';
diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index 78dba1d4..6478f502 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -3,6 +3,7 @@ import { eq, isNotNull } from 'drizzle-orm';
 import { getDb } from '$lib/server/db';
 import { images, artists } from '$lib/server/db/schema';
 import { proxyStoredImage } from '$lib/server/image-proxy';
+import { isAllowedImageType } from '$lib/server/storage/allowlist';
 import { bufferStream, MaxBytesExceededError } from '$lib/server/storage/buffer';
 import { getRawSetting, setRawSetting } from '$lib/server/settings';
 import {
@@ -112,17 +113,10 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		selfImage = { id: row.id, parentImageId: row.parentImageId };
 
 		// Server-side fetch of a URL the SERVER looked up, with the shared
-		// hardening: private and link-local hosts refused, redirects not
-		// followed, image/* content types only.
-		let stored: Response | null;
-		try {
-			stored = await proxyStoredImage(row.imageUrl, fetch);
-		} catch {
-			// A DNS failure, a reset connection or a TLS error rejects rather than
-			// answering — the stored image is as unreachable as when the proxy
-			// refuses it outright, so it reports the same way.
-			return failure('unavailable');
-		}
+		// hardening: private and link-local hosts refused, redirects not followed,
+		// only the stored raster types echoed back inline. A refusal, an upstream
+		// error and a rejected fetch all arrive here as null.
+		const stored = await proxyStoredImage(row.imageUrl, fetch);
 		if (!stored?.body) return failure('unavailable');
 		// Lowercased: media types are case-insensitive, so an `Image/PNG` header
 		// must pass the same check as `image/png`.
@@ -130,7 +124,10 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 			.split(';')[0]
 			.trim()
 			.toLowerCase();
-		if (!storedType.startsWith('image/')) {
+		// The same allowlist the proxy applies, named rather than re-guessed: the
+		// proxy hands anything outside it back as application/octet-stream, and
+		// `image/*` would also let through the SVG it deliberately demoted.
+		if (!isAllowedImageType(storedType)) {
 			return failure('unavailable');
 		}
 		try {
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index a890471a..9158f2aa 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -377,6 +377,27 @@ describe('artist-lookup — stored image by id', () => {
 		expect(await res.json()).toEqual({ enabled: true, error: 'unavailable' });
 		expect(searchImage).not.toHaveBeenCalled();
 	});
+
+	// SVG is an image type, so an `image/*` check would have sent it on. It is
+	// not one of the raster types storage accepts, the proxy demotes it to a
+	// download, and nothing is uploaded to FuzzySearch.
+	it('reports unavailable when the stored image is an svg', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.svg', '2026-01-01');`
+		);
+		const svg = new Response('<svg/>', {
+			status: 200,
+			headers: { 'content-type': 'image/svg+xml' }
+		});
+
+		const res = await POST(jsonEvent(platform, { imageId: 1 }, imageFetch(svg).fn));
+
+		expect(res.status).toBe(502);
+		expect(await res.json()).toEqual({ enabled: true, error: 'unavailable' });
+		expect(searchImage).not.toHaveBeenCalled();
+	});
 });
 
 describe('artist-lookup — failure mapping and the refused marker', () => {

From bf3f2f2dc1e0d26e6d685a9c872b62b2d2fd82eb Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:25:13 -0700
Subject: [PATCH 17/38] fix(con-card): fall back when the avatar proxy answers
 a non-image type (SONA-156)

The byte proxy hands anything outside the stored raster allowlist back as
application/octet-stream, and a data URI built from that never draws: the card
saved with an empty ring and told the operator nothing. embedAvatar now checks
the response content type through isEmbeddableAvatarType and treats a refusal
like any other avatar failure, so the card falls back to the initial in the ring
and says the avatar could not be embedded.
---
 src/lib/components/ConCard.svelte |  7 +++++++
 src/lib/con-card.test.ts          | 21 +++++++++++++++++++++
 src/lib/con-card.ts               | 15 +++++++++++++++
 3 files changed, 43 insertions(+)

diff --git a/src/lib/components/ConCard.svelte b/src/lib/components/ConCard.svelte
index 94501815..de511476 100644
--- a/src/lib/components/ConCard.svelte
+++ b/src/lib/components/ConCard.svelte
@@ -6,6 +6,7 @@
 		conCardFaceSvg,
 		conCardPrintSheetSvg,
 		conCardFileBase,
+		isEmbeddableAvatarType,
 		CON_CARD_WIDTH,
 		CON_CARD_HEIGHT,
 		type ConCardColor,
@@ -173,6 +174,12 @@
 		try {
 			const response = await fetch(avatarSrc);
 			if (!response.ok) throw new Error(`avatar ${response.status}`);
+			// The proxy answers octet-stream for anything outside the raster
+			// allowlist, and a data URI made from that draws nothing. Treated as a
+			// failed avatar so the card falls back to the initial in the ring and
+			// says so, rather than saving a blank one.
+			const type = response.headers.get('content-type');
+			if (!isEmbeddableAvatarType(type)) throw new Error(`avatar type ${type}`);
 			const blob = await response.blob();
 			avatarData = await new Promise<string>((resolve, reject) => {
 				const reader = new FileReader();
diff --git a/src/lib/con-card.test.ts b/src/lib/con-card.test.ts
index 01f683f1..8a823915 100644
--- a/src/lib/con-card.test.ts
+++ b/src/lib/con-card.test.ts
@@ -6,6 +6,7 @@ import {
 	conCardFaceSvg,
 	conCardPrintSheetSvg,
 	conCardFileBase,
+	isEmbeddableAvatarType,
 	CON_CARD_WIDTH,
 	CON_CARD_HEIGHT,
 	CON_CARD_SHEET_WIDTH,
@@ -618,3 +619,23 @@ describe('conCardFileBase', () => {
 		expect(conCardFileBase('')).toBe('con-card');
 	});
 });
+
+// The card embeds the avatar as a data URI, and the byte proxy in front of it
+// hands anything outside the stored raster allowlist back as a download. A URI
+// built from one of those draws nothing, so the type decides whether the card
+// keeps the face or falls back to the initial in the ring.
+describe('isEmbeddableAvatarType', () => {
+	it('takes the raster types the gallery stores, whatever their spelling', () => {
+		for (const type of ['image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/avif']) {
+			expect(isEmbeddableAvatarType(type), type).toBe(true);
+		}
+		expect(isEmbeddableAvatarType('Image/PNG; charset=binary')).toBe(true);
+	});
+
+	it('refuses the proxy download type, svg, and a missing header', () => {
+		const refused = ['application/octet-stream', 'image/svg+xml', 'text/html', '', null, undefined];
+		for (const type of refused) {
+			expect(isEmbeddableAvatarType(type), String(type)).toBe(false);
+		}
+	});
+});
diff --git a/src/lib/con-card.ts b/src/lib/con-card.ts
index ff8965d7..75ffb3f9 100644
--- a/src/lib/con-card.ts
+++ b/src/lib/con-card.ts
@@ -1,3 +1,4 @@
+import { GALLERY_ACCEPT } from '$lib/config';
 import { qrSvg } from '$lib/qr';
 import { SOCIAL_ICON_ART, type SocialIconArt } from '$lib/social-icon-paths';
 import { SOCIAL_PLATFORM_NAMES, type SocialPlatform } from '$lib/social-label';
@@ -620,6 +621,20 @@ export function conCardPrintSheetSvg(opts: Omit<ConCardOptions, 'variant'>): str
 		.join('');
 }
 
+/**
+ * Whether a fetched avatar response can be embedded in a saved card. The
+ * same-origin byte proxy hands anything outside the stored raster allowlist back
+ * as `application/octet-stream` with a download disposition, and a data URI
+ * built from that never draws: the card would save with an empty ring and no
+ * word to the operator. Read off GALLERY_ACCEPT so this and the server's
+ * allowlist can't drift apart.
+ */
+export function isEmbeddableAvatarType(contentType: string | null | undefined): boolean {
+	if (!contentType) return false;
+	const type = contentType.split(';')[0].trim().toLowerCase();
+	return GALLERY_ACCEPT.split(',').includes(type);
+}
+
 /** Filename stem for a downloaded card: `taro-con-card`. */
 export function conCardFileBase(name: string): string {
 	const slug = name

From aba70b3f2a7896c28c7c34bc2c81b3ef637a6393 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:31:33 -0700
Subject: [PATCH 18/38] test(con-card): pin the avatar proxy type guard at its
 call site (SONA-156)

---
 src/lib/components/con-card-markup.test.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/lib/components/con-card-markup.test.ts b/src/lib/components/con-card-markup.test.ts
index 9b405f13..4a5e675c 100644
--- a/src/lib/components/con-card-markup.test.ts
+++ b/src/lib/components/con-card-markup.test.ts
@@ -67,6 +67,17 @@ describe('ConCard download paths', () => {
 		expect(source).toMatch(/avatarFailed = true;[\s\S]*?return null;/);
 	});
 
+	it('checks the proxy answered an image before it builds the data URI', () => {
+		// isEmbeddableAvatarType is unit-tested in con-card.test.ts; what has to be
+		// pinned here is that the fetch path actually calls it, on the response's
+		// own content-type, and throws instead of reaching the FileReader — a data
+		// URI made from an octet-stream body draws nothing and would be saved as a
+		// blank avatar with no message.
+		expect(source).toMatch(
+			/embedAvatar\(\)[\s\S]*?const type = response\.headers\.get\('content-type'\);\s*if \(!isEmbeddableAvatarType\(type\)\) throw[\s\S]*?readAsDataURL/
+		);
+	});
+
 	it('separates "saved without your avatar" from "nothing saved"', () => {
 		// avatarFailed is the embed path's alone; a raster failure must never claim
 		// a file was saved. Both save paths route their catch to rasterFailed.

From 13655441916452901d5b8714c849f5fd165e54c4 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:47:39 -0700
Subject: [PATCH 19/38] fix(artist-lookup): treat 403 as a refused key and gate
 uploads on raster bytes (SONA-156)

A revoked or suspended FuzzySearch key answers 403, which fell through to
"unavailable" and never lit the refused state the settings card can act on.
Map it alongside 401, the pair the registry client already treats as auth.

The multipart branch forwarded whatever the browser declared, so an SVG or a
PDF reached FuzzySearch. Apply the raster allowlist and the magic-byte sniff
/api/upload uses, and answer 422 invalid_image without contacting anyone.

Record which key a refusal belongs to. The marker is one global row but the
settings card only shows it for a key saved there, so a refusal against the
deploy secret could later be blamed on a stored key that was never turned
away. The marker now reads "<iso>|env" or "<iso>|stored" and the card checks
the source.

Also cancel the proxied body when a stored image's type is refused, so the
subrequest stream is released instead of held open for the invocation.
---
 src/lib/server/fuzzysearch.test.ts            | 30 +++++++
 src/lib/server/fuzzysearch.ts                 | 45 +++++++++--
 src/routes/admin/settings/+page.server.ts     | 19 +++--
 src/routes/admin/settings/page.server.test.ts | 25 +++++-
 src/routes/api/admin/artist-lookup/+server.ts | 29 +++++--
 .../api/admin/artist-lookup/server.test.ts    | 78 ++++++++++++++++++-
 6 files changed, 202 insertions(+), 24 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 8d16e68b..c0ba1714 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -12,6 +12,8 @@ import {
 	handleProfileUrl,
 	findLocalArtists,
 	findArtistsByName,
+	fuzzysearchRefusedMarker,
+	parseFuzzysearchRefusedMarker,
 	type LookupMatch
 } from './fuzzysearch';
 
@@ -177,6 +179,9 @@ describe('searchImage — request shape', () => {
 describe('searchImage — failure mapping', () => {
 	const cases: Array<[number, string]> = [
 		[401, 'key_refused'],
+		// A revoked or suspended key answers 403, not 401; both are the refused
+		// state the settings card can act on.
+		[403, 'key_refused'],
 		[429, 'rate_limited'],
 		[413, 'too_large'],
 		[500, 'unavailable'],
@@ -463,3 +468,28 @@ describe('findArtistsByName', () => {
 		expect(findArtistsByName(rows, '  ')).toEqual([]);
 	});
 });
+
+describe('the refused marker', () => {
+	it('round-trips the date and the key source', () => {
+		const marker = fuzzysearchRefusedMarker('env', new Date('2026-09-01T10:00:00.000Z'));
+		expect(marker).toBe('2026-09-01T10:00:00.000Z|env');
+		expect(parseFuzzysearchRefusedMarker(marker)).toEqual({
+			at: '2026-09-01T10:00:00.000Z',
+			source: 'env'
+		});
+		expect(parseFuzzysearchRefusedMarker(fuzzysearchRefusedMarker('stored'))?.source).toBe('stored');
+	});
+
+	it('reads a cleared or missing marker as no refusal', () => {
+		expect(parseFuzzysearchRefusedMarker('')).toBeNull();
+		expect(parseFuzzysearchRefusedMarker(null)).toBeNull();
+		expect(parseFuzzysearchRefusedMarker(undefined)).toBeNull();
+	});
+
+	it('reads a marker with no source as a refusal of the stored key', () => {
+		expect(parseFuzzysearchRefusedMarker('2026-09-01T10:00:00.000Z')).toEqual({
+			at: '2026-09-01T10:00:00.000Z',
+			source: 'stored'
+		});
+	});
+});
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index db0f9983..d0a20e4a 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -21,7 +21,8 @@ type Env = App.Platform['env'];
 /** site_settings keys. Raw rows, like the registry fork key: kept out of the
  * SiteSettings interface so the key never serializes to the browser. */
 export const FUZZYSEARCH_API_KEY_SETTING = 'fuzzysearchApiKey';
-/** ISO date-time of the last 401 from FuzzySearch, or '' once a call succeeds. */
+/** `<iso date-time>|<key source>` for the last refusal from FuzzySearch, or ''
+ * once a call succeeds. See `fuzzysearchRefusedMarker`. */
 export const FUZZYSEARCH_KEY_REFUSED_SETTING = 'fuzzysearchKeyRefusedAt';
 
 export const FUZZYSEARCH_ENDPOINT = 'https://api.fuzzysearch.net/v1/image';
@@ -71,20 +72,49 @@ const SITE_ORDER: Record<LookupSite, number> = {
 	e621: 3
 };
 
+/** Where the key in use came from: the deploy secret, or the admin settings. */
+export type FuzzysearchKeySource = 'env' | 'stored';
+
 /**
  * Resolve the FuzzySearch key: a deploy-time `FUZZYSEARCH_API_KEY` secret wins
  * and short-circuits the DB read, otherwise the D1 raw setting. Same precedence
  * as the registry fork key, so a fork can connect from the admin UI without a
- * deploy. Returns null when the integration is not configured.
+ * deploy. Returns null when the integration is not configured. The source
+ * travels with the key so a refusal can be recorded against the key it refused.
  */
 export async function resolveFuzzysearchKey(
 	db: Database,
 	env: Env | undefined
-): Promise<string | null> {
+): Promise<{ key: string; source: FuzzysearchKeySource } | null> {
 	const fromEnv = env?.FUZZYSEARCH_API_KEY?.trim();
-	if (fromEnv) return fromEnv;
+	if (fromEnv) return { key: fromEnv, source: 'env' };
 	const stored = (await getRawSetting(db, FUZZYSEARCH_API_KEY_SETTING))?.trim();
-	return stored || null;
+	return stored ? { key: stored, source: 'stored' } : null;
+}
+
+/**
+ * The value written to FUZZYSEARCH_KEY_REFUSED_SETTING: when the refusal
+ * happened and WHICH key was refused. The source has to be stored alongside
+ * the date because the settings card only offers a remedy for a key saved
+ * there — without it, a refusal recorded while the deploy secret was in use
+ * would later be shown against a stored key that was never refused.
+ */
+export function fuzzysearchRefusedMarker(
+	source: FuzzysearchKeySource,
+	at: Date = new Date()
+): string {
+	return `${at.toISOString()}|${source}`;
+}
+
+/** Read a refusal marker back. '' (the cleared value) and anything without a
+ * date come back null; a value carrying no source reads as 'stored', the state
+ * the settings card can act on. */
+export function parseFuzzysearchRefusedMarker(
+	raw: string | null | undefined
+): { at: string; source: FuzzysearchKeySource } | null {
+	const [at, source] = (raw ?? '').trim().split('|');
+	if (!at) return null;
+	return { at, source: source === 'env' ? 'env' : 'stored' };
 }
 
 /**
@@ -282,7 +312,10 @@ export async function searchImage(
 		return { ok: false, reason: 'unavailable' };
 	}
 
-	if (res.status === 401) return { ok: false, reason: 'key_refused' };
+	// 403 alongside 401, the pair the registry client already treats as an auth
+	// failure: a revoked or suspended key answers 403, and without it the
+	// operator would never see the refused state for the one case they can fix.
+	if (res.status === 401 || res.status === 403) return { ok: false, reason: 'key_refused' };
 	if (res.status === 429) return { ok: false, reason: 'rate_limited' };
 	if (res.status === 413) return { ok: false, reason: 'too_large' };
 	if (res.status === 400) {
diff --git a/src/routes/admin/settings/+page.server.ts b/src/routes/admin/settings/+page.server.ts
index 7047f762..d4d75eea 100644
--- a/src/routes/admin/settings/+page.server.ts
+++ b/src/routes/admin/settings/+page.server.ts
@@ -58,7 +58,8 @@ import {
 import {
 	FUZZYSEARCH_API_KEY_SETTING,
 	FUZZYSEARCH_KEY_REFUSED_SETTING,
-	fuzzysearchKeyDisplayRecord
+	fuzzysearchKeyDisplayRecord,
+	parseFuzzysearchRefusedMarker
 } from '$lib/server/fuzzysearch';
 import { syncArtists } from '$lib/server/artist-sync';
 import {
@@ -286,7 +287,9 @@ export const load: PageServerLoad = async ({ platform, url, locals }) => {
 		FUZZYSEARCH_KEY_REFUSED_SETTING
 	]);
 	const fuzzysearchStoredKey = fuzzysearchRaw[FUZZYSEARCH_API_KEY_SETTING]?.trim() ?? '';
-	const fuzzysearchRefusedAt = fuzzysearchRaw[FUZZYSEARCH_KEY_REFUSED_SETTING] ?? '';
+	const fuzzysearchRefused = parseFuzzysearchRefusedMarker(
+		fuzzysearchRaw[FUZZYSEARCH_KEY_REFUSED_SETTING]
+	);
 
 	// Per-content-type usage (SONA-192) — R2 only: derived from listing the
 	// bucket, so it also counts files D1 never tracked. Reduced to counts and
@@ -338,13 +341,13 @@ export const load: PageServerLoad = async ({ platform, url, locals }) => {
 			: null,
 		// Pre-formatted here, like the early-access GA dates, so the card renders
 		// one date string identically on SSR and after hydration. Only for a key
-		// saved HERE: a refusal recorded against the deploy secret has no remedy
-		// on this page (no key to remove, no date to trust), so the refused state
-		// would be a dead end. The marker still gets written — it costs nothing
-		// and becomes meaningful again if the secret is ever dropped.
+		// saved HERE, and only when THAT key is the one that was refused: a
+		// refusal recorded against the deploy secret has no remedy on this page
+		// (no key to remove), and showing it after the secret is dropped would
+		// blame a stored key that FuzzySearch never turned away.
 		fuzzysearchKeyRefusedAt:
-			!fuzzysearchKeyFromEnv && fuzzysearchStoredKey && fuzzysearchRefusedAt
-				? formatDate(fuzzysearchRefusedAt)
+			!fuzzysearchKeyFromEnv && fuzzysearchStoredKey && fuzzysearchRefused?.source === 'stored'
+				? formatDate(fuzzysearchRefused.at)
 				: null,
 		// Presence-only flags for the password-reset setup guide. The secret VALUES
 		// are deploy-time env and must never reach the client — only whether they exist.
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index ceeaf639..b09ec2b9 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -10,6 +10,7 @@ import { REGISTRY_API_KEY_SETTING } from '$lib/server/registry';
 import {
 	FUZZYSEARCH_API_KEY_SETTING,
 	FUZZYSEARCH_KEY_REFUSED_SETTING,
+	fuzzysearchRefusedMarker,
 	fuzzysearchKeyDisplayRecord
 } from '$lib/server/fuzzysearch';
 import {
@@ -1996,7 +1997,11 @@ describe('settings — FuzzySearch key', () => {
 
 	it('surfaces a formatted refusal date only while a key is saved', async () => {
 		const { db, platform } = makeLoadDb();
-		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T10:20:30.000Z');
+		await setRawSetting(
+			db,
+			FUZZYSEARCH_KEY_REFUSED_SETTING,
+			fuzzysearchRefusedMarker('stored', new Date('2026-09-01T10:20:30.000Z'))
+		);
 
 		const orphan = (await load(loadEvent(platform))) as unknown as Record<string, unknown>;
 		expect(orphan.fuzzysearchKeyRefusedAt).toBeNull();
@@ -2020,6 +2025,24 @@ describe('settings — FuzzySearch key', () => {
 		expect(result.fuzzysearchKeyRefusedAt).toBeNull();
 	});
 
+	// The marker is global, the card is not: a refusal recorded while the deploy
+	// secret was in use must not be shown against a stored key once the secret
+	// is dropped — that key was never turned away.
+	it('never reports a refusal recorded against the secret once it is gone', async () => {
+		const { db, platform } = makeLoadDb();
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'fs-live-abcdef3k9q');
+		await setRawSetting(
+			db,
+			FUZZYSEARCH_KEY_REFUSED_SETTING,
+			fuzzysearchRefusedMarker('env', new Date('2026-09-01T10:20:30.000Z'))
+		);
+
+		const result = (await load(loadEvent(platform))) as unknown as Record<string, unknown>;
+
+		expect(result.fuzzysearchKeyFromEnv).toBe(false);
+		expect(result.fuzzysearchKeyRefusedAt).toBeNull();
+	});
+
 	it('masks a short key to at least eight bullets', () => {
 		expect(fuzzysearchKeyDisplayRecord('abcd1234')).toBe('••••••••1234');
 		expect(fuzzysearchKeyDisplayRecord('abc')).toBe('••••••••');
diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index 6478f502..1ca12b0d 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -5,12 +5,15 @@ import { images, artists } from '$lib/server/db/schema';
 import { proxyStoredImage } from '$lib/server/image-proxy';
 import { isAllowedImageType } from '$lib/server/storage/allowlist';
 import { bufferStream, MaxBytesExceededError } from '$lib/server/storage/buffer';
+import { sniffImageType } from '$lib/server/storage/sniff';
+import { SNIFF_BYTES } from '$lib/server/storage/scrub-metadata';
 import { getRawSetting, setRawSetting } from '$lib/server/settings';
 import {
 	FUZZYSEARCH_KEY_REFUSED_SETTING,
 	FUZZYSEARCH_MAX_BYTES,
 	findArtistsByName,
 	findLocalArtists,
+	fuzzysearchRefusedMarker,
 	normalizeSourceUrl,
 	pickPrefillMatch,
 	resolveFuzzysearchKey,
@@ -70,8 +73,8 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 
 	// No key configured: the integration is off, not broken. The UI hides the
 	// button on this answer instead of showing an error (the registry shape).
-	const key = await resolveFuzzysearchKey(db, platform?.env);
-	if (!key) return json({ enabled: false });
+	const resolved = await resolveFuzzysearchKey(db, platform?.env);
+	if (!resolved) return json({ enabled: false });
 
 	const contentType = request.headers.get('content-type') ?? '';
 
@@ -98,6 +101,14 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		if (!(file instanceof File)) error(400, 'No file provided');
 		// Layer 2: the exact check, on the file's real size.
 		if (file.size > FUZZYSEARCH_MAX_BYTES) return failure('too_large');
+		// The same raster gate /api/upload applies, and for the same reason the
+		// imageId branch names the allowlist: an SVG or a PDF is not the
+		// operator's artwork, and it is not something to hand a third party. The
+		// declared type is the browser's word, so the leading bytes are checked
+		// against the allowlist too (SNIFF_BYTES window, as in /api/upload).
+		if (!isAllowedImageType(file.type)) return failure('invalid_image');
+		const head = new Uint8Array(await file.slice(0, SNIFF_BYTES).arrayBuffer());
+		if (!isAllowedImageType(sniffImageType(head))) return failure('invalid_image');
 		bytes = file;
 	} else {
 		const body = (await request.json().catch(() => null)) as { imageId?: unknown } | null;
@@ -128,6 +139,9 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		// proxy hands anything outside it back as application/octet-stream, and
 		// `image/*` would also let through the SVG it deliberately demoted.
 		if (!isAllowedImageType(storedType)) {
+			// Release the subrequest's stream: nothing reads this body, and an
+			// unread one keeps the connection open for the rest of the invocation.
+			await stored.body.cancel().catch(() => {});
 			return failure('unavailable');
 		}
 		try {
@@ -143,14 +157,19 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		}
 	}
 
-	const result = await searchImage(bytes, key, fetch);
+	const result = await searchImage(bytes, resolved.key, fetch);
 
 	if (!result.ok) {
 		// A refused key is the one failure worth remembering: the settings page
 		// tells the operator their key stopped working instead of leaving the
-		// button failing silently.
+		// button failing silently. The marker records WHICH key was refused, so a
+		// refusal against the deploy secret is never shown against a stored one.
 		if (result.reason === 'key_refused') {
-			await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, new Date().toISOString());
+			await setRawSetting(
+				db,
+				FUZZYSEARCH_KEY_REFUSED_SETTING,
+				fuzzysearchRefusedMarker(resolved.source)
+			);
 		}
 		return failure(result.reason);
 	}
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index 9158f2aa..40fcb868 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -45,8 +45,9 @@ const DDL = `CREATE TABLE site_settings (key TEXT PRIMARY KEY, value TEXT NOT NU
 		registry_version INTEGER, registry_synced_at TEXT, aliases TEXT,
 		avatar_resolved_at TEXT, created_at TEXT NOT NULL);`;
 
-/** A 1×1-ish PNG stand-in — the endpoint never decodes, it only forwards. */
-const IMAGE_BYTES = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 1, 2, 3, 4]);
+/** A PNG stand-in — the endpoint never decodes, but it does sniff the leading
+ * bytes of an uploaded file, so the signature has to be the real one. */
+const IMAGE_BYTES = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
 
 function makeEnv(env: Record<string, unknown> = {}) {
 	const sqlite = new Database(':memory:');
@@ -97,7 +98,7 @@ function jsonEvent(platform: App.Platform, body: unknown, fetchFn: typeof fetch
 
 function pngFile(size = 32) {
 	const bytes = new Uint8Array(size);
-	bytes.set(IMAGE_BYTES.slice(0, 4));
+	bytes.set(IMAGE_BYTES);
 	return new File([bytes], 'a.png', { type: 'image/png' });
 }
 
@@ -207,6 +208,36 @@ describe('artist-lookup — uploaded file', () => {
 		expect(searchImage).not.toHaveBeenCalled();
 	});
 
+	// SVG and PDF are not the raster types storage accepts, and neither is the
+	// operator's artwork to hand a third party. Refused on the declared type
+	// alone, before anything leaves this app.
+	it('refuses a non-raster upload without contacting FuzzySearch', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		const cases = [
+			new File(['<svg/>'], 'a.svg', { type: 'image/svg+xml' }),
+			new File(['%PDF-1.7'], 'a.pdf', { type: 'application/pdf' })
+		];
+		for (const file of cases) {
+			const res = await POST(multipartEvent(platform, file));
+			expect(res.status, file.type).toBe(422);
+			expect(await res.json()).toEqual({ enabled: true, error: 'invalid_image' });
+		}
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
+	// The declared type is the browser's word for it. A PDF renamed to .png is
+	// caught by the leading bytes, the same check /api/upload applies.
+	it('refuses an upload whose bytes are not the type it declares', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		const spoofed = new File(['%PDF-1.7 not a png'], 'a.png', { type: 'image/png' });
+
+		const res = await POST(multipartEvent(platform, spoofed));
+
+		expect(res.status).toBe(422);
+		expect(await res.json()).toEqual({ enabled: true, error: 'invalid_image' });
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
 	it('rejects a multipart body with no file', async () => {
 		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 		const request = new Request('http://localhost/api/admin/artist-lookup', {
@@ -378,6 +409,29 @@ describe('artist-lookup — stored image by id', () => {
 		expect(searchImage).not.toHaveBeenCalled();
 	});
 
+	// Nothing reads the body of a refused type, and an unread subrequest stream
+	// holds its connection open for the rest of the invocation.
+	it('cancels the proxied body when the stored type is refused', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.svg', '2026-01-01');`
+		);
+		const canceled = vi.fn();
+		const body = new ReadableStream<Uint8Array>({
+			pull(controller) {
+				controller.enqueue(new Uint8Array([1]));
+			},
+			cancel: canceled
+		});
+		const svg = new Response(body, { status: 200, headers: { 'content-type': 'image/svg+xml' } });
+
+		const res = await POST(jsonEvent(platform, { imageId: 1 }, imageFetch(svg).fn));
+
+		expect(res.status).toBe(502);
+		expect(canceled).toHaveBeenCalled();
+	});
+
 	// SVG is an image type, so an `image/*` check would have sent it on. It is
 	// not one of the raster types storage accepts, the proxy demotes it to a
 	// download, and nothing is uploaded to FuzzySearch.
@@ -408,7 +462,11 @@ describe('artist-lookup — failure mapping and the refused marker', () => {
 		const refused = await POST(multipartEvent(platform, pngFile()));
 		expect(refused.status).toBe(401);
 		expect(await refused.json()).toEqual({ enabled: true, error: 'key_refused' });
-		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+		// The source rides along with the date: this refusal was the deploy
+		// secret's, and the settings card must not blame a stored key for it.
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toMatch(
+			/^\d{4}-\d{2}-\d{2}T.*\|env$/
+		);
 
 		searchImage.mockResolvedValue({ ok: true, matches: [] });
 		const ok = await POST(multipartEvent(platform, pngFile()));
@@ -416,6 +474,18 @@ describe('artist-lookup — failure mapping and the refused marker', () => {
 		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe('');
 	});
 
+	it('records a refusal of the saved key against that key, not the secret', async () => {
+		const { db, platform } = makeEnv();
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'from-settings');
+		searchImage.mockResolvedValue({ ok: false, reason: 'key_refused' });
+
+		await POST(multipartEvent(platform, pngFile()));
+
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toMatch(
+			/^\d{4}-\d{2}-\d{2}T.*\|stored$/
+		);
+	});
+
 	it('writes nothing on a clean success with no marker standing', async () => {
 		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 

From b721d1239c076249159f9e08136693755157e951 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 18:04:18 -0700
Subject: [PATCH 20/38] fix(artist-lookup): clear the refusal marker per key
 source and separate refusal from the admin 401 (SONA-156)

- Clear the FuzzySearch refusal marker only when the key that succeeded is the
  one that was refused, so a deploy-secret success no longer reports
  "Connected" for a stored key FuzzySearch still refuses.
- Answer key_refused with 502 instead of 401: the admin gate uses 401 with a
  plain-text body, so an expired session read as a refused key and the caller's
  res.json() threw.
- Treat a missing content-type as embeddable in the con card avatar guard; only
  a present, non-raster type is a failure.
- Close the FuzzySearch remove confirmation only on success; a failed removal
  now says so and leaves the panel open with focus on Keep.
- Mask a stored key with exactly eight bullets, so a long key no longer reveals
  its length.
---
 src/lib/components/ConCard.svelte             |  4 +-
 src/lib/con-card.test.ts                      | 14 +++++-
 src/lib/con-card.ts                           |  8 ++--
 src/lib/server/fuzzysearch.test.ts            | 15 ++++++
 src/lib/server/fuzzysearch.ts                 | 10 ++--
 src/routes/admin/settings/+page.svelte        | 21 +++++---
 src/routes/admin/settings/page.server.test.ts | 24 +++++++++-
 src/routes/api/admin/artist-lookup/+server.ts | 18 +++++--
 .../api/admin/artist-lookup/server.test.ts    | 48 ++++++++++++++++++-
 9 files changed, 137 insertions(+), 25 deletions(-)

diff --git a/src/lib/components/ConCard.svelte b/src/lib/components/ConCard.svelte
index de511476..aa72d6e3 100644
--- a/src/lib/components/ConCard.svelte
+++ b/src/lib/components/ConCard.svelte
@@ -177,7 +177,9 @@
 			// The proxy answers octet-stream for anything outside the raster
 			// allowlist, and a data URI made from that draws nothing. Treated as a
 			// failed avatar so the card falls back to the initial in the ring and
-			// says so, rather than saving a blank one.
+			// says so, rather than saving a blank one. A response with no
+			// content-type at all is a direct same-origin avatar, not a refusal, so
+			// it still embeds.
 			const type = response.headers.get('content-type');
 			if (!isEmbeddableAvatarType(type)) throw new Error(`avatar type ${type}`);
 			const blob = await response.blob();
diff --git a/src/lib/con-card.test.ts b/src/lib/con-card.test.ts
index 8a823915..1937d93b 100644
--- a/src/lib/con-card.test.ts
+++ b/src/lib/con-card.test.ts
@@ -632,10 +632,20 @@ describe('isEmbeddableAvatarType', () => {
 		expect(isEmbeddableAvatarType('Image/PNG; charset=binary')).toBe(true);
 	});
 
-	it('refuses the proxy download type, svg, and a missing header', () => {
-		const refused = ['application/octet-stream', 'image/svg+xml', 'text/html', '', null, undefined];
+	it('refuses the proxy download type and svg', () => {
+		const refused = ['application/octet-stream', 'image/svg+xml', 'text/html'];
 		for (const type of refused) {
 			expect(isEmbeddableAvatarType(type), String(type)).toBe(false);
 		}
 	});
+
+	// The guard also runs on the direct same-origin avatar URL, and the proxy
+	// always sets a content-type. Only a PRESENT, non-raster type is a refusal —
+	// treating a missing header as one drops a perfectly good avatar to the
+	// initial.
+	it('takes a response with no content-type at all', () => {
+		for (const type of ['', null, undefined]) {
+			expect(isEmbeddableAvatarType(type), String(type)).toBe(true);
+		}
+	});
 });
diff --git a/src/lib/con-card.ts b/src/lib/con-card.ts
index 75ffb3f9..9c3741cd 100644
--- a/src/lib/con-card.ts
+++ b/src/lib/con-card.ts
@@ -626,11 +626,13 @@ export function conCardPrintSheetSvg(opts: Omit<ConCardOptions, 'variant'>): str
  * same-origin byte proxy hands anything outside the stored raster allowlist back
  * as `application/octet-stream` with a download disposition, and a data URI
  * built from that never draws: the card would save with an empty ring and no
- * word to the operator. Read off GALLERY_ACCEPT so this and the server's
- * allowlist can't drift apart.
+ * word to the operator. Only a PRESENT, non-raster type is a failure — the
+ * proxy always sets a content-type, so a response without one is a direct
+ * same-origin avatar and stays embeddable. Read off GALLERY_ACCEPT so this and
+ * the server's allowlist can't drift apart.
  */
 export function isEmbeddableAvatarType(contentType: string | null | undefined): boolean {
-	if (!contentType) return false;
+	if (!contentType) return true;
 	const type = contentType.split(';')[0].trim().toLowerCase();
 	return GALLERY_ACCEPT.split(',').includes(type);
 }
diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index c0ba1714..a545237a 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -12,6 +12,7 @@ import {
 	handleProfileUrl,
 	findLocalArtists,
 	findArtistsByName,
+	fuzzysearchKeyDisplayRecord,
 	fuzzysearchRefusedMarker,
 	parseFuzzysearchRefusedMarker,
 	type LookupMatch
@@ -469,6 +470,20 @@ describe('findArtistsByName', () => {
 	});
 });
 
+describe('fuzzysearchKeyDisplayRecord', () => {
+	// Always eight bullets: a run sized to the key would tell anyone reading the
+	// settings card exactly how long the saved key is.
+	it('masks with a fixed bullet run whatever the key length', () => {
+		expect(fuzzysearchKeyDisplayRecord('abcdefgh1234')).toBe('••••••••1234');
+		expect(fuzzysearchKeyDisplayRecord('a'.repeat(64) + 'wxyz')).toBe('••••••••wxyz');
+		expect(fuzzysearchKeyDisplayRecord('abcde')).toBe('••••••••bcde');
+	});
+
+	it('shows no tail for a key too short to have one', () => {
+		expect(fuzzysearchKeyDisplayRecord('abcd')).toBe('••••••••');
+	});
+});
+
 describe('the refused marker', () => {
 	it('round-trips the date and the key source', () => {
 		const marker = fuzzysearchRefusedMarker('env', new Date('2026-09-01T10:00:00.000Z'));
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index d0a20e4a..bb646840 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -118,14 +118,14 @@ export function parseFuzzysearchRefusedMarker(
 }
 
 /**
- * Masked record of a stored key for the settings card: bullets for everything
- * but the last four characters, never fewer than eight bullets, so the mask
- * says nothing about a short key's length. The operator only needs to
- * recognize which key is saved — the value itself never leaves the server.
+ * Masked record of a stored key for the settings card: exactly eight bullets
+ * plus the last four characters, so the mask says nothing about the key's
+ * length. The operator only needs to recognize which key is saved — the value
+ * itself never leaves the server.
  */
 export function fuzzysearchKeyDisplayRecord(key: string): string {
 	const tail = key.length > 4 ? key.slice(-4) : '';
-	return '•'.repeat(Math.max(8, key.length - tail.length)) + tail;
+	return '•'.repeat(8) + tail;
 }
 
 /** Band for a distance, matching the wording the UI uses about confidence. */
diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index d448bdde..305e6181 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -1535,12 +1535,21 @@
 						return async ({ result, update }) => {
 							await update({ reset: false });
 							removingFuzzysearchKey = false;
-							confirmingFuzzysearchRemove = false;
-							if (result.type === 'success') toast.success(m.admin_settings_lookup_removed());
-							// Both buttons are gone now — send focus to the field that
-							// replaced them rather than dropping it on <body>.
-							await tick();
-							fuzzysearchKeyInput?.focus();
+							if (result.type === 'success') {
+								confirmingFuzzysearchRemove = false;
+								toast.success(m.admin_settings_lookup_removed());
+								// Both buttons are gone now — send focus to the field that
+								// replaced them rather than dropping it on <body>.
+								await tick();
+								fuzzysearchKeyInput?.focus();
+							} else {
+								// The key is still stored: closing the panel here would look
+								// exactly like pressing Keep. Say it failed, leave the
+								// confirmation open, and put focus back on Keep.
+								toast.error(m.admin_something_wrong());
+								await tick();
+								fuzzysearchKeepButton?.focus();
+							}
 						};
 					}}>
 						<button
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index b09ec2b9..500920e2 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -1980,7 +1980,7 @@ describe('settings — FuzzySearch key', () => {
 
 		expect(result.fuzzysearchKeySet).toBe(true);
 		expect(result.fuzzysearchKeyFromEnv).toBe(false);
-		expect(result.fuzzysearchKeyRecord).toBe('••••••••••••••3k9q');
+		expect(result.fuzzysearchKeyRecord).toBe('••••••••3k9q');
 		expect(JSON.stringify(result)).not.toContain('fs-live-abcdef3k9q');
 	});
 
@@ -2043,8 +2043,9 @@ describe('settings — FuzzySearch key', () => {
 		expect(result.fuzzysearchKeyRefusedAt).toBeNull();
 	});
 
-	it('masks a short key to at least eight bullets', () => {
+	it('masks every key to the same eight bullets, whatever its length', () => {
 		expect(fuzzysearchKeyDisplayRecord('abcd1234')).toBe('••••••••1234');
+		expect(fuzzysearchKeyDisplayRecord('fs-live-abcdef3k9q')).toBe('••••••••3k9q');
 		expect(fuzzysearchKeyDisplayRecord('abc')).toBe('••••••••');
 	});
 });
@@ -2162,6 +2163,25 @@ describe('artist lookup section markup (SONA-156)', () => {
 		expect(remove).toMatch(guardsOn('removingFuzzysearchKey'));
 	});
 
+	// A failed removal left the key in place, so closing the panel would look
+	// exactly like pressing Keep and the operator would never learn it failed.
+	it('closes the confirmation only on success, and reports a failure', () => {
+		const start = src.indexOf('action="?/removeFuzzysearchKey" use:enhance=');
+		expect(start).toBeGreaterThan(-1);
+		const handler = src.slice(start, src.indexOf('}}>', start));
+		const success = handler.slice(handler.indexOf("if (result.type === 'success')"));
+		const branch = success.slice(0, success.indexOf('} else {'));
+		expect(branch).toContain('confirmingFuzzysearchRemove = false;');
+		expect(branch).toContain('m.admin_settings_lookup_removed()');
+		// Exactly one close, and it is the one inside the success branch.
+		expect(handler.match(/confirmingFuzzysearchRemove = false;/g)).toHaveLength(1);
+		// The failure path says so and puts focus back on the Keep button, which
+		// is still mounted.
+		const failed = success.slice(success.indexOf('} else {'));
+		expect(failed).toContain('toast.error(m.admin_something_wrong())');
+		expect(failed).toContain('fuzzysearchKeepButton?.focus()');
+	});
+
 	// A live region that mounts with its text already in place is not announced,
 	// so this one sits outside every conditional branch — moving it inside
 	// {#if savingFuzzysearchKey} would leave the presence check above green.
diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index 1ca12b0d..4f6c1d40 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -15,6 +15,7 @@ import {
 	findLocalArtists,
 	fuzzysearchRefusedMarker,
 	normalizeSourceUrl,
+	parseFuzzysearchRefusedMarker,
 	pickPrefillMatch,
 	resolveFuzzysearchKey,
 	searchImage,
@@ -46,7 +47,11 @@ import type { RequestHandler } from './$types';
 
 /** What the UI gets back for a failed lookup, and the status carrying it. */
 const FAILURE_STATUS: Record<LookupFailure, number> = {
-	key_refused: 401,
+	// 502, not 401: the admin gate answers an expired session with its own 401
+	// and a plain-text body, so a 401 here would read as a refused key and the
+	// caller's res.json() would throw. The body's `error` field is what tells
+	// key_refused apart from unavailable.
+	key_refused: 502,
 	rate_limited: 429,
 	too_large: 413,
 	invalid_image: 422,
@@ -174,9 +179,14 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		return failure(result.reason);
 	}
 
-	// The key works — clear a stale refusal marker (only when one is set, so the
-	// happy path costs one read rather than a write).
-	if (await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)) {
+	// The key works — clear a stale refusal marker, but only the marker for the
+	// key that just succeeded (a marker against the other source stays: a deploy
+	// secret succeeding says nothing about the stored key FuzzySearch refused).
+	// Read first, so the happy path costs one read rather than a write.
+	const refusedMarker = parseFuzzysearchRefusedMarker(
+		await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)
+	);
+	if (refusedMarker && refusedMarker.source === resolved.source) {
 		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '');
 	}
 
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index 40fcb868..ecd493ba 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -455,12 +455,15 @@ describe('artist-lookup — stored image by id', () => {
 });
 
 describe('artist-lookup — failure mapping and the refused marker', () => {
-	it('records the refusal on a 401 and clears it on the next success', async () => {
+	// 502, not 401: the admin gate answers an expired session with its own 401
+	// and a plain-text body, so a 401 here would be indistinguishable from a
+	// logged-out admin and the caller's res.json() would throw.
+	it('records the refusal on a 502 and clears it on the next success', async () => {
 		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 		searchImage.mockResolvedValue({ ok: false, reason: 'key_refused' });
 
 		const refused = await POST(multipartEvent(platform, pngFile()));
-		expect(refused.status).toBe(401);
+		expect(refused.status).toBe(502);
 		expect(await refused.json()).toEqual({ enabled: true, error: 'key_refused' });
 		// The source rides along with the date: this refusal was the deploy
 		// secret's, and the settings card must not blame a stored key for it.
@@ -486,6 +489,47 @@ describe('artist-lookup — failure mapping and the refused marker', () => {
 		);
 	});
 
+	// A success by the deploy secret says nothing about the stored key
+	// FuzzySearch refused: clearing that marker would show "Connected" for a key
+	// still being refused once the secret is dropped again.
+	it('leaves a marker for the other key source standing on success', async () => {
+		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T00:00:00.000Z|stored');
+		searchImage.mockResolvedValue({ ok: true, matches: [] });
+
+		const res = await POST(multipartEvent(platform, pngFile()));
+
+		expect(res.status).toBe(200);
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe(
+			'2026-09-01T00:00:00.000Z|stored'
+		);
+	});
+
+	it('clears the marker when the key that succeeded is the refused one', async () => {
+		const { db, platform } = makeEnv();
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'from-settings');
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T00:00:00.000Z|stored');
+		searchImage.mockResolvedValue({ ok: true, matches: [] });
+
+		const res = await POST(multipartEvent(platform, pngFile()));
+
+		expect(res.status).toBe(200);
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe('');
+	});
+
+	// A marker written before the source was recorded reads as 'stored', so a
+	// stored-key success still clears it.
+	it('clears a legacy bare-date marker on a stored-key success', async () => {
+		const { db, platform } = makeEnv();
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'from-settings');
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T00:00:00.000Z');
+		searchImage.mockResolvedValue({ ok: true, matches: [] });
+
+		await POST(multipartEvent(platform, pngFile()));
+
+		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBe('');
+	});
+
 	it('writes nothing on a clean success with no marker standing', async () => {
 		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 

From 3b04fdf4b2bbec45d36f0660fcf6e49d6d5f1583 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 18:29:05 -0700
Subject: [PATCH 21/38] test(e2e): make the artist-lookup key save step survive
 a pre-hydration click (SONA-156)

---
 tests/e2e/fuzzysearch-key.spec.ts | 38 +++++++++++++++++++++++++++----
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index aa2ff5e7..d6730d5d 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -129,11 +129,41 @@ test.describe('admin settings artist lookup key', () => {
 	});
 
 	test('saving connects, Keep backs out of removal, and Remove disconnects', async ({ page }) => {
-		await keyInput(page).fill(FAKE_KEY);
-		await saveButton(page).click();
+		// Save is hydration-sensitive the same way the tab is: a click that lands
+		// before use:enhance is attached posts the form natively, and the reload
+		// resets the tab — the connected eyebrow is then in the DOM but hidden, so
+		// every assertion below fails and the key stays saved in the shared seeded
+		// DB. Retry until the save goes through the enhanced path: the marker only
+		// survives if the page never reloaded.
+		await expect(async () => {
+			// A native post left the page on a fresh load with the tab reset, so
+			// reopen it before reading the section's state.
+			await openConnectionsTab(page);
+			if ((await removeButton(page).count()) > 0) {
+				// The aborted attempt saved the key: put the section back to
+				// unconnected before trying again.
+				await removeButton(page).click();
+				await confirmPanel(page).getByRole('button', { name: 'Remove', exact: true }).click();
+				await expect(keyInput(page)).toBeVisible();
+				await openConnectionsTab(page);
+			}
+			await page.evaluate(() => {
+				(window as unknown as Record<string, boolean>).__sonaSaveMarker = true;
+			});
+			await keyInput(page).fill(FAKE_KEY);
+			await saveButton(page).click();
+			// Connected: the eyebrow, and the mask — never the key itself.
+			await expect(section(page).locator('.key-eyebrow.connected')).toBeVisible({
+				timeout: 1500
+			});
+			expect(
+				await page.evaluate(
+					() => (window as unknown as Record<string, boolean>).__sonaSaveMarker === true
+				),
+				'Save posted through use:enhance rather than reloading the page'
+			).toBe(true);
+		}).toPass();
 
-		// Connected: the eyebrow, and the mask — never the key itself.
-		await expect(section(page).locator('.key-eyebrow.connected')).toBeVisible();
 		await expect(keyRecord(page)).toContainText('8901');
 		await expect(keyRecord(page)).not.toContainText('e2e-fuzzysearch');
 		await expect(keyInput(page)).toHaveCount(0);

From 79f6d491deee8b9bc369a277005b55fd30314209 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 18:37:11 -0700
Subject: [PATCH 22/38] test(e2e): start each artist-lookup key save attempt
 from a fresh settings page (SONA-156)

---
 tests/e2e/fuzzysearch-key.spec.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index d6730d5d..e584e3af 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -136,8 +136,10 @@ test.describe('admin settings artist lookup key', () => {
 		// DB. Retry until the save goes through the enhanced path: the marker only
 		// survives if the page never reloaded.
 		await expect(async () => {
-			// A native post left the page on a fresh load with the tab reset, so
-			// reopen it before reading the section's state.
+			// Start every attempt from a known page: a retry that died with the
+			// removal confirmation open would otherwise never see the Remove
+			// button (it lives in the panel's else branch) and spin to the timeout.
+			await page.goto('/admin/settings');
 			await openConnectionsTab(page);
 			if ((await removeButton(page).count()) > 0) {
 				// The aborted attempt saved the key: put the section back to

From 8608dcb944d7c6176a66f767d78a43039798f56d Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 19:05:23 -0700
Subject: [PATCH 23/38] fix(fuzzysearch): fold Weasyl title slugs and pin the
 timeout signal (SONA-156)

---
 src/lib/server/fuzzysearch.test.ts            | 50 +++++++++++++++++--
 src/lib/server/fuzzysearch.ts                 |  7 ++-
 .../api/admin/artist-lookup/server.test.ts    | 26 ++++++++++
 3 files changed, 77 insertions(+), 6 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index a545237a..026009a4 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 import {
 	FUZZYSEARCH_ENDPOINT,
 	FUZZYSEARCH_MAX_DISTANCE,
@@ -175,6 +175,33 @@ describe('searchImage — request shape', () => {
 		// The bound the signal was built with, pinned so it can't silently grow.
 		expect(FUZZYSEARCH_TIMEOUT_MS).toBe(8000);
 	});
+
+	// `instanceof AbortSignal` passes for a signal that never fires, so the one
+	// handed to fetch is driven on fake timers: still live a tick before the
+	// bound, aborted a tick after. AbortSignal.timeout stands in as a
+	// controller on a plain setTimeout, which fake timers can advance.
+	it('hands fetch a signal that aborts at the timeout, not one that never fires', async () => {
+		vi.useFakeTimers();
+		const timeout = vi.spyOn(AbortSignal, 'timeout').mockImplementation((ms: number) => {
+			const controller = new AbortController();
+			setTimeout(() => controller.abort(new DOMException('timed out', 'TimeoutError')), ms);
+			return controller.signal;
+		});
+		try {
+			const { fn, calls } = fakeFetch(jsonResponse([]));
+			await searchImage(new Blob(['x']), 'k', fn);
+
+			expect(timeout).toHaveBeenCalledWith(FUZZYSEARCH_TIMEOUT_MS);
+			const signal = calls[0].init.signal as AbortSignal;
+			vi.advanceTimersByTime(FUZZYSEARCH_TIMEOUT_MS - 1);
+			expect(signal.aborted).toBe(false);
+			vi.advanceTimersByTime(2);
+			expect(signal.aborted).toBe(true);
+		} finally {
+			timeout.mockRestore();
+			vi.useRealTimers();
+		}
+	});
 });
 
 describe('searchImage — failure mapping', () => {
@@ -349,9 +376,7 @@ describe('normalizeSourceUrl', () => {
 	});
 
 	it('keeps path case elsewhere, since most sites are case-sensitive there', () => {
-		expect(normalizeSourceUrl('https://www.weasyl.com/submission/5150/Some-Title')).toBe(
-			'weasyl.com/submission/5150/Some-Title'
-		);
+		expect(normalizeSourceUrl('https://www.weasyl.com/~Kuttoya')).toBe('weasyl.com/~Kuttoya');
 	});
 
 	// Each site's other spelling of one submission: FurAffinity's full-size view
@@ -374,6 +399,23 @@ describe('normalizeSourceUrl', () => {
 		);
 	});
 
+	// Weasyl hangs the title slug off the submission path, and this client builds
+	// the bare spelling — both are the one submission, so an operator who saved
+	// the slugged link still gets the clash warning.
+	it('folds a Weasyl title slug off the submission path', () => {
+		const canonical = 'weasyl.com/submission/5150';
+		expect(normalizeSourceUrl(postUrlFor('Weasyl', '5150', []))).toBe(canonical);
+		expect(normalizeSourceUrl('https://www.weasyl.com/submission/5150')).toBe(canonical);
+		expect(normalizeSourceUrl('https://www.weasyl.com/submission/5150/Some-Title')).toBe(canonical);
+		expect(normalizeSourceUrl('https://www.weasyl.com/submission/5150/some-title/')).toBe(
+			canonical
+		);
+		// A different Weasyl page, not a submission under another spelling.
+		expect(normalizeSourceUrl('https://www.weasyl.com/submissions/5150')).toBe(
+			'weasyl.com/submissions/5150'
+		);
+	});
+
 	it('is empty for blank input', () => {
 		expect(normalizeSourceUrl('')).toBe('');
 		expect(normalizeSourceUrl(null)).toBe('');
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index bb646840..60f77db4 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -221,10 +221,13 @@ export function normalizeSourceUrl(url: string | null | undefined): string {
 	// `/view/12345`, and e621's old post path (`/post/show/160`) is today's
 	// `/posts/160`. An operator who saved either gets no clash warning without
 	// the fold. e621's old path also carried the tag string as a trailing
-	// segment (`/post/show/160/canine`), which is the same post; FurAffinity's
-	// stays anchored, since nothing follows the id there.
+	// segment (`/post/show/160/canine`), and Weasyl hangs the title slug off the
+	// submission path (`/submission/5150/some-title`) — both still the same post;
+	// FurAffinity's stays anchored, since nothing follows the id there.
 	if (host === 'furaffinity.net') path = path.replace(/^\/full\/(\d+)$/, '/view/$1');
 	if (host === 'e621.net') path = path.replace(/^\/post\/show\/(\d+)(?:\/.*)?$/, '/posts/$1');
+	if (host === 'weasyl.com')
+		path = path.replace(/^\/submission\/(\d+)(?:\/.*)?$/, '/submission/$1');
 	return host + path;
 }
 
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index ecd493ba..771f31d4 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -631,6 +631,32 @@ describe('artist-lookup — source-post clash', () => {
 		expect(body.sourceClash).toMatchObject({ imageId: 1, variantCount: 1 });
 	});
 
+	// The saved link carries Weasyl's title slug while this client builds the bare
+	// submission URL. One post either way, so the warning still has to fire.
+	it('reports a clash when the stored Weasyl URL carries a title slug', async () => {
+		const env = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		env.sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, source_post_url, parent_image_id, created_at)
+			 VALUES (20, 'Sparky at the beach', 'beach', 'https://cdn/20.png',
+				 'https://www.weasyl.com/submission/5150/sparky-at-the-beach', NULL, '2026-01-01');`
+		);
+		searchImage.mockResolvedValue({
+			ok: true,
+			matches: [
+				{
+					...FA_EXACT,
+					site: 'Weasyl' as const,
+					siteId: '5150',
+					postUrl: 'https://www.weasyl.com/submission/5150'
+				}
+			]
+		});
+
+		const res = await POST(multipartEvent(env.platform, pngFile()));
+		const body = (await res.json()) as { sourceClash: Record<string, unknown> };
+		expect(body.sourceClash).toMatchObject({ imageId: 20, title: 'Sparky at the beach' });
+	});
+
 	it('does not report an image clashing with its own variant set', async () => {
 		const { platform } = clashSetup();
 		const res = await POST(jsonEvent(platform, { imageId: 2 }));

From 423286d07f66fab2af0ee6f066a5630367162568 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 19:21:11 -0700
Subject: [PATCH 24/38] fix(settings): ignore a reflex second click on the
 artist-lookup remove confirmation (SONA-156)

The lookup section is the last block on the Connections tab, so the page has
no scroll slack there. When the confirmation opens and focus moves to Keep,
the browser scrolls the page up under a stationary pointer, and one more
wrapped line in the confirmation sentence puts confirm Remove on the pixel
Remove key was just clicked. A double click or a second tap then removed the
key with the question unread.

Geometry cannot be made safe for every line wrap, so the activation is
guarded instead: Remove key records when the panel opened, and the remove
form's use:enhance cancels a submission that arrives within 500 ms. The
button stays enabled and looks the same, and the Keep-focus effect is
unchanged.

The e2e helper now performs the hazard rather than measuring it: it clicks
the same pixel again straight away and asserts the key survived, reporting
the scroll and whether the confirm covered the point for diagnosis.
---
 src/routes/admin/settings/+page.svelte        | 15 +++-
 src/routes/admin/settings/page.server.test.ts | 22 ++++++
 tests/e2e/fuzzysearch-key.spec.ts             | 78 ++++++++++++-------
 3 files changed, 85 insertions(+), 30 deletions(-)

diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index 305e6181..8a2863b4 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -182,6 +182,10 @@
 	// Purely client state: the Remove key button swaps the action row for a
 	// confirmation block rather than opening a dialog over the section.
 	let confirmingFuzzysearchRemove = $state(false);
+	// When the panel opened, and how long confirm Remove ignores a click.
+	// Not reactive: only the enhance callback below reads it.
+	let fuzzysearchRemoveOpenedAt = 0;
+	const FUZZYSEARCH_REMOVE_REFLEX_MS = 500;
 	// Focus is moved by hand across the swap: every button involved UNMOUNTS as
 	// the state changes, so without this a keyboard user lands back on <body> and
 	// restarts from the top of a long page. (A bare `autofocus` doesn't do it —
@@ -1531,6 +1535,12 @@
 				<div class="confirm-actions">
 					<form method="POST" action="?/removeFuzzysearchKey" use:enhance={({ cancel }) => {
 						if (removingFuzzysearchKey) return cancel();
+						// The section is last on the tab, so focusing Keep scrolls the page
+						// up under a stationary pointer and confirm Remove can land on the
+						// pixel Remove key was just clicked. A click that soon after the
+						// panel opened is a reflex, not a decision — ignore it.
+						if (performance.now() - fuzzysearchRemoveOpenedAt < FUZZYSEARCH_REMOVE_REFLEX_MS)
+							return cancel();
 						removingFuzzysearchKey = true;
 						return async ({ result, update }) => {
 							await update({ reset: false });
@@ -1582,7 +1592,10 @@
 					type="button"
 					class="btn btn-outline btn-remove"
 					bind:this={fuzzysearchRemoveButton}
-					onclick={() => (confirmingFuzzysearchRemove = true)}
+					onclick={() => {
+						fuzzysearchRemoveOpenedAt = performance.now();
+						confirmingFuzzysearchRemove = true;
+					}}
 				>
 					{m.admin_settings_lookup_remove()}
 				</button>
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 500920e2..93c88756 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2163,6 +2163,28 @@ describe('artist lookup section markup (SONA-156)', () => {
 		expect(remove).toMatch(guardsOn('removingFuzzysearchKey'));
 	});
 
+	// The panel opens where the pointer already is: the section is last on the
+	// tab, so focusing Keep scrolls the page up and confirm Remove can land on
+	// the pixel Remove key was just clicked. Losing this guard would let a double
+	// click remove the key with the question unread, and no geometry assertion
+	// can cover every line-wrap of the confirmation sentence.
+	it('ignores a confirm click that lands inside the reflex window', () => {
+		// Remove key records when the panel opened, next to setting the flag.
+		const opens = src.indexOf('confirmingFuzzysearchRemove = true');
+		expect(opens).toBeGreaterThan(-1);
+		expect(src.slice(opens - 120, opens)).toContain(
+			'fuzzysearchRemoveOpenedAt = performance.now()'
+		);
+		// The remove handler cancels the submission inside that window.
+		const start = src.indexOf('action="?/removeFuzzysearchKey" use:enhance=');
+		const handler = src.slice(start, src.indexOf('}}>', start));
+		expect(handler).toContain('fuzzysearchRemoveOpenedAt');
+		expect(handler).toMatch(/FUZZYSEARCH_REMOVE_REFLEX_MS[\s\S]{0,60}return\s+cancel\(\s*\)/);
+		// Half a second: long enough to swallow a double click, short enough that
+		// a deliberate second click still goes through.
+		expect(src).toContain('const FUZZYSEARCH_REMOVE_REFLEX_MS = 500;');
+	});
+
 	// A failed removal left the key in place, so closing the panel would look
 	// exactly like pressing Keep and the operator would never learn it failed.
 	it('closes the confirmation only on success, and reports a failure', () => {
diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index e584e3af..9613312f 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -29,18 +29,27 @@ const confirmPanel = (page: Page) => section(page).locator('.remove-confirm');
 const keyRecord = (page: Page) => section(page).locator('.key-record');
 const replaceLine = (page: Page) => section(page).locator('.replace-line');
 
-// Opening the confirmation must not move the destructive button under the
-// pointer: while the block's top edge shifted up on the swap, the confirm
-// Remove landed on the pixel Remove key was just clicked, so a double click or
-// an impatient second tap removed the key without the question being read.
-// Clicks Remove key at its own centre and asks where that point ends up.
-// Both boxes are read in one coordinate frame: the button is centred in the
-// viewport first and the click goes through page.mouse at that exact point,
-// because locator.click() scrolls the button into view itself — after which the
-// "before" box belongs to a frame the confirm button was never measured in, and
-// at 390px the button's centre sits under the bottom tab bar, so the click that
-// "worked" was a click at some other pixel entirely.
-async function openConfirmClearOfThePointer(page: Page) {
+// The confirmation ignores a click for the first half second it is open, so
+// every deliberate confirm in this file waits the guard out first.
+const REFLEX_GUARD_MS = 550;
+async function confirmRemoval(page: Page) {
+	await page.waitForTimeout(REFLEX_GUARD_MS);
+	await confirmPanel(page).getByRole('button', { name: 'Remove', exact: true }).click();
+}
+
+// Opening the confirmation can put the destructive button under the pointer:
+// the section is the last block on the tab, so focusing Keep scrolls the page
+// up under a stationary pointer, and one more wrapped line in the confirmation
+// sentence is enough for confirm Remove to land on the pixel Remove key was
+// just clicked. Geometry cannot be made safe for every wrap, so what is proved
+// here is the guard: a second click at that same pixel, straight away, removes
+// nothing.
+// The click goes through page.mouse at a point measured after centring the
+// button, because locator.click() scrolls the button into view itself — after
+// which the point belongs to a frame nothing else was measured in, and at 390px
+// the button's centre sits under the bottom tab bar, so the click that "worked"
+// was a click at some other pixel entirely.
+async function openConfirmAndReflexClick(page: Page) {
 	await removeButton(page).evaluate((el) => el.scrollIntoView({ block: 'center' }));
 	const box = await removeButton(page).boundingBox();
 	if (!box) throw new Error('Remove key has no bounding box');
@@ -60,23 +69,36 @@ async function openConfirmClearOfThePointer(page: Page) {
 	// The mechanism that holds the block still: the replace line stays rendered
 	// while the confirmation is open, so the swap does not pull the block up.
 	await expect(replaceLine(page)).toBeVisible();
+	// Checked here rather than after the click below, which takes focus off Keep
+	// wherever it lands: every button involved unmounts as the panel opens, so
+	// without this a keyboard user is back on <body>.
+	await expect(confirmPanel(page).getByRole('button', { name: 'Keep', exact: true })).toBeFocused();
 	const confirm = confirmPanel(page).getByRole('button', { name: 'Remove', exact: true });
 	const after = await confirm.boundingBox();
 	if (!after) throw new Error('Remove (confirm) has no bounding box');
 	// Both boxes are viewport-relative, which is the frame the pointer lives in:
 	// focusing Keep can scroll the page, and whatever that scroll brings under
-	// the pointer is exactly what a second click would hit. So the shift is
-	// reported, not corrected for.
+	// the pointer is exactly what a second click would hit. Reported for
+	// diagnosis only — whether the confirm covers the point varies with the
+	// font metrics that decide how the sentence wraps, and either way the key
+	// has to survive the click below.
 	const scrolled = (await page.evaluate(() => window.scrollY)) - frame;
 	const covers =
 		point.x >= after.x &&
 		point.x <= after.x + after.width &&
 		point.y >= after.y &&
 		point.y <= after.y + after.height;
-	expect(
-		covers,
-		`confirm Remove covers the clicked point at ${page.viewportSize()?.width}px (page scrolled ${scrolled}px)`
-	).toBe(false);
+	const where = `at ${page.viewportSize()?.width}px (page scrolled ${scrolled}px, confirm Remove ${covers ? 'covers' : 'clears'} the clicked point)`;
+
+	// The reflex second click: same pixel, no pause.
+	await page.mouse.click(point.x, point.y);
+	// Asserted after the guard window, not before it: an unguarded removal takes
+	// a moment to come back, and checking too early passes while it is in flight.
+	// The wait doubles as the one the caller needs before clicking for real.
+	await page.waitForTimeout(REFLEX_GUARD_MS);
+	await expect(confirmPanel(page), `the confirmation stayed open ${where}`).toBeVisible();
+	await expect(keyRecord(page), `the key was not removed ${where}`).toContainText('8901');
+	await expect(replaceLine(page), `the block held still ${where}`).toBeVisible();
 }
 
 // The connections sections are hidden by CSS until the tab is active, and the
@@ -145,7 +167,7 @@ test.describe('admin settings artist lookup key', () => {
 				// The aborted attempt saved the key: put the section back to
 				// unconnected before trying again.
 				await removeButton(page).click();
-				await confirmPanel(page).getByRole('button', { name: 'Remove', exact: true }).click();
+				await confirmRemoval(page);
 				await expect(keyInput(page)).toBeVisible();
 				await openConnectionsTab(page);
 			}
@@ -173,15 +195,13 @@ test.describe('admin settings artist lookup key', () => {
 		// button that replaces it has to pick focus up.
 		await expect(removeButton(page)).toBeFocused();
 
-		// Removal asks first, and moves focus onto the safe choice — every button
-		// involved unmounts as the panel opens, so without that a keyboard user
-		// lands back on <body>.
-		await openConfirmClearOfThePointer(page);
-		const keep = confirmPanel(page).getByRole('button', { name: 'Keep', exact: true });
-		await expect(keep).toBeFocused();
+		// Removal asks first, moves focus onto the safe choice, and swallows the
+		// reflex second click at the pixel Remove key was on (both checked in the
+		// helper).
+		await openConfirmAndReflexClick(page);
 
 		// Keep restores the connected state and hands focus back.
-		await keep.click();
+		await confirmPanel(page).getByRole('button', { name: 'Keep', exact: true }).click();
 		await expect(confirmPanel(page)).toHaveCount(0);
 		await expect(keyRecord(page)).toContainText('8901');
 		await expect(removeButton(page)).toBeFocused();
@@ -189,7 +209,7 @@ test.describe('admin settings artist lookup key', () => {
 		// Again at 390, where the block is taller and the shift used to be larger.
 		const desktop = page.viewportSize();
 		await page.setViewportSize({ width: 390, height: 844 });
-		await openConfirmClearOfThePointer(page);
+		await openConfirmAndReflexClick(page);
 		await confirmPanel(page).getByRole('button', { name: 'Keep', exact: true }).click();
 		await expect(confirmPanel(page)).toHaveCount(0);
 		if (desktop) await page.setViewportSize(desktop);
@@ -197,7 +217,7 @@ test.describe('admin settings artist lookup key', () => {
 		// Remove, confirmed, clears the key and returns the section to its
 		// unconnected state — the state the seed hands every other spec.
 		await removeButton(page).click();
-		await confirmPanel(page).getByRole('button', { name: 'Remove', exact: true }).click();
+		await confirmRemoval(page);
 		await expect(keyRecord(page)).toHaveCount(0);
 		await expect(keyInput(page)).toBeVisible();
 		// Both confirmation buttons are gone, so focus has to land on the field
@@ -219,7 +239,7 @@ test.afterAll(async ({ browser }) => {
 		await openConnectionsTab(page);
 		if ((await removeButton(page).count()) === 0) return;
 		await removeButton(page).click();
-		await confirmPanel(page).getByRole('button', { name: 'Remove', exact: true }).click();
+		await confirmRemoval(page);
 		await expect(keyRecord(page)).toHaveCount(0);
 	} finally {
 		await page.close();

From 227bbd2514bcbb48bb26f076728ba865f6aba4fb Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 19:31:08 -0700
Subject: [PATCH 25/38] fix(fuzzysearch): fold Weasyl user permalinks and
 compare their paths case-insensitively (SONA-156)

---
 src/lib/server/fuzzysearch.test.ts |  9 ++++++++-
 src/lib/server/fuzzysearch.ts      | 15 +++++++++++----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 026009a4..0bb6b029 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -373,10 +373,11 @@ describe('normalizeSourceUrl', () => {
 		expect(normalizeSourceUrl('https://www.furaffinity.net/View/12345/')).toBe(
 			'furaffinity.net/view/12345'
 		);
+		expect(normalizeSourceUrl('https://www.weasyl.com/~Kuttoya')).toBe('weasyl.com/~kuttoya');
 	});
 
 	it('keeps path case elsewhere, since most sites are case-sensitive there', () => {
-		expect(normalizeSourceUrl('https://www.weasyl.com/~Kuttoya')).toBe('weasyl.com/~Kuttoya');
+		expect(normalizeSourceUrl('https://e621.net/users/Kuttoya')).toBe('e621.net/users/Kuttoya');
 	});
 
 	// Each site's other spelling of one submission: FurAffinity's full-size view
@@ -410,6 +411,12 @@ describe('normalizeSourceUrl', () => {
 		expect(normalizeSourceUrl('https://www.weasyl.com/submission/5150/some-title/')).toBe(
 			canonical
 		);
+		// Weasyl's own permalink names the artist ahead of the id, with the slug
+		// optional and the username's case free to differ.
+		expect(normalizeSourceUrl('https://www.weasyl.com/~kuttoya/submissions/5150')).toBe(canonical);
+		expect(normalizeSourceUrl('https://www.weasyl.com/~Kuttoya/submissions/5150/some-title')).toBe(
+			canonical
+		);
 		// A different Weasyl page, not a submission under another spelling.
 		expect(normalizeSourceUrl('https://www.weasyl.com/submissions/5150')).toBe(
 			'weasyl.com/submissions/5150'
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index 60f77db4..954cdc8d 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -190,8 +190,10 @@ const HOST_ALIASES = new Map<string, string>([
 ]);
 
 /** Hosts whose paths are case-insensitive, so `/View/12345` and `/view/12345`
- * are one post. Left alone elsewhere — most sites' paths are case-sensitive. */
-const CASE_INSENSITIVE_PATH_HOSTS = new Set(['twitter.com', 'furaffinity.net']);
+ * are one post. Weasyl is here for the username in its permalinks: `/~User/` and
+ * `/~user/` are the same artist, and what the fold below leaves is numeric. Left
+ * alone elsewhere — most sites' paths are case-sensitive. */
+const CASE_INSENSITIVE_PATH_HOSTS = new Set(['twitter.com', 'furaffinity.net', 'weasyl.com']);
 
 /**
  * Normalize a source-post URL for equality checks: lowercase host, no scheme,
@@ -223,11 +225,16 @@ export function normalizeSourceUrl(url: string | null | undefined): string {
 	// the fold. e621's old path also carried the tag string as a trailing
 	// segment (`/post/show/160/canine`), and Weasyl hangs the title slug off the
 	// submission path (`/submission/5150/some-title`) — both still the same post;
-	// FurAffinity's stays anchored, since nothing follows the id there.
+	// FurAffinity's stays anchored, since nothing follows the id there. Weasyl's
+	// own permalink names the artist as well (`/~kuttoya/submissions/5150/title`),
+	// and that is the submission this client builds as `/submission/5150`; a
+	// `/submissions/5150` with no user segment is another page, so it stays put.
 	if (host === 'furaffinity.net') path = path.replace(/^\/full\/(\d+)$/, '/view/$1');
 	if (host === 'e621.net') path = path.replace(/^\/post\/show\/(\d+)(?:\/.*)?$/, '/posts/$1');
 	if (host === 'weasyl.com')
-		path = path.replace(/^\/submission\/(\d+)(?:\/.*)?$/, '/submission/$1');
+		path = path
+			.replace(/^\/submission\/(\d+)(?:\/.*)?$/, '/submission/$1')
+			.replace(/^\/~[^/]+\/submissions\/(\d+)(?:\/.*)?$/, '/submission/$1');
 	return host + path;
 }
 

From fadd84a780a1365709779cc559b8627c89b7f3c2 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 19:33:02 -0700
Subject: [PATCH 26/38] fix(settings): scope the remove-confirmation reflex
 guard to pointer clicks (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The guard was modality-blind: it cancelled any submission that arrived within
500 ms of the confirmation opening, so a keyboard user who Shift+Tabbed from
Keep onto confirm Remove and pressed Enter was silently ignored. The keyboard
is the one modality that cannot suffer the hazard the guard exists for — the
pointer never moved, so nothing scrolled under it.

The check now lives on the confirm button's own onclick and only blocks a
click that carries a positive detail, which a keyboard-synthesized click does
not. The enhance callback keeps only the in-flight cancel(). The button stays
enabled with no aria-disabled and looks the same.

The e2e spec now presses Enter on confirm Remove with no pause and expects the
key to go, then saves it back so the deliberate pointer removal still has
something to remove.
---
 src/routes/admin/settings/+page.svelte        | 23 ++++++++++++-------
 src/routes/admin/settings/page.server.test.ts | 21 +++++++++++++----
 tests/e2e/fuzzysearch-key.spec.ts             | 21 +++++++++++++++++
 3 files changed, 52 insertions(+), 13 deletions(-)

diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index 8a2863b4..07aae3dc 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -182,8 +182,8 @@
 	// Purely client state: the Remove key button swaps the action row for a
 	// confirmation block rather than opening a dialog over the section.
 	let confirmingFuzzysearchRemove = $state(false);
-	// When the panel opened, and how long confirm Remove ignores a click.
-	// Not reactive: only the enhance callback below reads it.
+	// When the panel opened, and how long confirm Remove ignores a pointer click.
+	// Not reactive: only the confirm button's onclick below reads it.
 	let fuzzysearchRemoveOpenedAt = 0;
 	const FUZZYSEARCH_REMOVE_REFLEX_MS = 500;
 	// Focus is moved by hand across the swap: every button involved UNMOUNTS as
@@ -1535,12 +1535,6 @@
 				<div class="confirm-actions">
 					<form method="POST" action="?/removeFuzzysearchKey" use:enhance={({ cancel }) => {
 						if (removingFuzzysearchKey) return cancel();
-						// The section is last on the tab, so focusing Keep scrolls the page
-						// up under a stationary pointer and confirm Remove can land on the
-						// pixel Remove key was just clicked. A click that soon after the
-						// panel opened is a reflex, not a decision — ignore it.
-						if (performance.now() - fuzzysearchRemoveOpenedAt < FUZZYSEARCH_REMOVE_REFLEX_MS)
-							return cancel();
 						removingFuzzysearchKey = true;
 						return async ({ result, update }) => {
 							await update({ reset: false });
@@ -1567,6 +1561,19 @@
 							class="btn btn-destructive"
 							aria-busy={removingFuzzysearchKey}
 							aria-describedby="fuzzysearch-remove-confirm"
+							onclick={(event) => {
+								// Pointer only. The section is last on the tab, so focusing Keep
+								// scrolls the page up under a stationary pointer and this button can
+								// land on the pixel Remove key was just clicked; a click that soon
+								// after the panel opened is a reflex, not a decision. A keyboard
+								// activation carries detail 0 and cannot hit that hazard, so Enter
+								// straight after Shift+Tab still removes the key.
+								if (
+									event.detail > 0 &&
+									performance.now() - fuzzysearchRemoveOpenedAt < FUZZYSEARCH_REMOVE_REFLEX_MS
+								)
+									event.preventDefault();
+							}}
 						>
 							{removingFuzzysearchKey
 								? m.admin_settings_lookup_removing()
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 93c88756..9ec0d30a 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2167,19 +2167,30 @@ describe('artist lookup section markup (SONA-156)', () => {
 	// tab, so focusing Keep scrolls the page up and confirm Remove can land on
 	// the pixel Remove key was just clicked. Losing this guard would let a double
 	// click remove the key with the question unread, and no geometry assertion
-	// can cover every line-wrap of the confirmation sentence.
-	it('ignores a confirm click that lands inside the reflex window', () => {
+	// can cover every line-wrap of the confirmation sentence. The guard is
+	// pointer-only: a keyboard user who Shift+Tabs from Keep and presses Enter
+	// cannot have suffered the hazard, and their activation must go through.
+	it('ignores a confirm pointer click that lands inside the reflex window', () => {
 		// Remove key records when the panel opened, next to setting the flag.
 		const opens = src.indexOf('confirmingFuzzysearchRemove = true');
 		expect(opens).toBeGreaterThan(-1);
 		expect(src.slice(opens - 120, opens)).toContain(
 			'fuzzysearchRemoveOpenedAt = performance.now()'
 		);
-		// The remove handler cancels the submission inside that window.
 		const start = src.indexOf('action="?/removeFuzzysearchKey" use:enhance=');
+		expect(start).toBeGreaterThan(-1);
+		const form = src.slice(start, src.indexOf('</form>', start));
+		// The button's own onclick blocks the submit, and only for a click that
+		// carries a positive detail — a keyboard-synthesized click carries 0.
+		const click = form.slice(form.indexOf('onclick='));
+		expect(click).toMatch(/event\.detail\s*>\s*0/);
+		expect(click).toMatch(
+			/FUZZYSEARCH_REMOVE_REFLEX_MS[\s\S]{0,60}event\.preventDefault\(\s*\)/
+		);
+		// The enhance callback keeps only the in-flight guard: no time check there,
+		// or a keyboard Enter would be swallowed again.
 		const handler = src.slice(start, src.indexOf('}}>', start));
-		expect(handler).toContain('fuzzysearchRemoveOpenedAt');
-		expect(handler).toMatch(/FUZZYSEARCH_REMOVE_REFLEX_MS[\s\S]{0,60}return\s+cancel\(\s*\)/);
+		expect(handler).not.toContain('fuzzysearchRemoveOpenedAt');
 		// Half a second: long enough to swallow a double click, short enough that
 		// a deliberate second click still goes through.
 		expect(src).toContain('const FUZZYSEARCH_REMOVE_REFLEX_MS = 500;');
diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index 9613312f..6d9c226a 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -214,6 +214,27 @@ test.describe('admin settings artist lookup key', () => {
 		await expect(confirmPanel(page)).toHaveCount(0);
 		if (desktop) await page.setViewportSize(desktop);
 
+		// The guard is pointer-only, and the keyboard is the one modality that
+		// cannot suffer the hazard: Shift+Tab from Keep onto confirm Remove and
+		// press Enter with no pause at all — the key goes.
+		await removeButton(page).click();
+		await expect(
+			confirmPanel(page).getByRole('button', { name: 'Keep', exact: true })
+		).toBeFocused();
+		await page.keyboard.press('Shift+Tab');
+		const confirmRemove = confirmPanel(page).getByRole('button', { name: 'Remove', exact: true });
+		await expect(confirmRemove).toBeFocused();
+		await page.keyboard.press('Enter');
+		await expect(keyRecord(page)).toHaveCount(0);
+		await expect(keyInput(page)).toBeVisible();
+
+		// Put the key back so the deliberate pointer removal below still has
+		// something to remove. The page is hydrated by now (every click above went
+		// through the enhanced path), so this needs no retry.
+		await keyInput(page).fill(FAKE_KEY);
+		await saveButton(page).click();
+		await expect(keyRecord(page)).toContainText('8901');
+
 		// Remove, confirmed, clears the key and returns the section to its
 		// unconnected state — the state the seed hands every other spec.
 		await removeButton(page).click();

From 559c9b21fb23791560f9423f035ac1ba4b5566b6 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 19:41:08 -0700
Subject: [PATCH 27/38] fix(settings): only swallow a reflex click near where
 Remove key was clicked, and pin it by the request (SONA-156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pointer guard was still wider than the hazard it exists for: any click
anywhere on confirm Remove within the window was swallowed, including a
deliberate one at the far end of the button. The hazard is specific — the
panel opens under a pointer that has not moved — so the guard now records
where Remove key was clicked and blocks only a click within 24 px of that
point on both axes. A pointer that moved is a decision and goes through at
once; the keyboard exemption from the previous commit is untouched.

The e2e reflex helper now watches for the removal POST across the reflex
window and asserts none went out, which pins the guard at the wire instead
of inferring it from what the page looks like after the sleep. The sleep
stays: the deliberate confirms still need it.
---
 src/routes/admin/settings/+page.svelte        | 32 +++++++++++++------
 src/routes/admin/settings/page.server.test.ts | 21 +++++++++---
 tests/e2e/fuzzysearch-key.spec.ts             | 17 ++++++++--
 3 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index 07aae3dc..e5bb2476 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -182,10 +182,14 @@
 	// Purely client state: the Remove key button swaps the action row for a
 	// confirmation block rather than opening a dialog over the section.
 	let confirmingFuzzysearchRemove = $state(false);
-	// When the panel opened, and how long confirm Remove ignores a pointer click.
-	// Not reactive: only the confirm button's onclick below reads it.
+	// When and where the panel opened, and how long and how near confirm Remove
+	// ignores a pointer click. Not reactive: only the confirm button's onclick
+	// below reads them.
 	let fuzzysearchRemoveOpenedAt = 0;
+	let fuzzysearchRemoveOpenedX = 0;
+	let fuzzysearchRemoveOpenedY = 0;
 	const FUZZYSEARCH_REMOVE_REFLEX_MS = 500;
+	const FUZZYSEARCH_REMOVE_REFLEX_PX = 24;
 	// Focus is moved by hand across the swap: every button involved UNMOUNTS as
 	// the state changes, so without this a keyboard user lands back on <body> and
 	// restarts from the top of a long page. (A bare `autofocus` doesn't do it —
@@ -1562,15 +1566,21 @@
 							aria-busy={removingFuzzysearchKey}
 							aria-describedby="fuzzysearch-remove-confirm"
 							onclick={(event) => {
-								// Pointer only. The section is last on the tab, so focusing Keep
-								// scrolls the page up under a stationary pointer and this button can
-								// land on the pixel Remove key was just clicked; a click that soon
-								// after the panel opened is a reflex, not a decision. A keyboard
-								// activation carries detail 0 and cannot hit that hazard, so Enter
-								// straight after Shift+Tab still removes the key.
+								// Pointer only, and only the reflex. The section is last on the tab,
+								// so focusing Keep scrolls the page up under a stationary pointer and
+								// this button can land on the pixel Remove key was just clicked; a
+								// click that soon after the panel opened AND that near where the
+								// pointer already was is a reflex, not a decision. A click elsewhere
+								// on the button means the pointer moved, so it goes through at once.
+								// A keyboard activation carries detail 0 and cannot hit that hazard,
+								// so Enter straight after Shift+Tab still removes the key.
 								if (
 									event.detail > 0 &&
-									performance.now() - fuzzysearchRemoveOpenedAt < FUZZYSEARCH_REMOVE_REFLEX_MS
+									performance.now() - fuzzysearchRemoveOpenedAt < FUZZYSEARCH_REMOVE_REFLEX_MS &&
+									Math.abs(event.clientX - fuzzysearchRemoveOpenedX) <=
+										FUZZYSEARCH_REMOVE_REFLEX_PX &&
+									Math.abs(event.clientY - fuzzysearchRemoveOpenedY) <=
+										FUZZYSEARCH_REMOVE_REFLEX_PX
 								)
 									event.preventDefault();
 							}}
@@ -1599,8 +1609,10 @@
 					type="button"
 					class="btn btn-outline btn-remove"
 					bind:this={fuzzysearchRemoveButton}
-					onclick={() => {
+					onclick={(event) => {
 						fuzzysearchRemoveOpenedAt = performance.now();
+						fuzzysearchRemoveOpenedX = event.clientX;
+						fuzzysearchRemoveOpenedY = event.clientY;
 						confirmingFuzzysearchRemove = true;
 					}}
 				>
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 9ec0d30a..80e1126f 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2170,13 +2170,16 @@ describe('artist lookup section markup (SONA-156)', () => {
 	// can cover every line-wrap of the confirmation sentence. The guard is
 	// pointer-only: a keyboard user who Shift+Tabs from Keep and presses Enter
 	// cannot have suffered the hazard, and their activation must go through.
+	// It is also place-bound: only a click near where Remove key was clicked is
+	// the reflex, so a deliberate click elsewhere on the button is not swallowed.
 	it('ignores a confirm pointer click that lands inside the reflex window', () => {
-		// Remove key records when the panel opened, next to setting the flag.
+		// Remove key records when and where the panel opened, next to the flag.
 		const opens = src.indexOf('confirmingFuzzysearchRemove = true');
 		expect(opens).toBeGreaterThan(-1);
-		expect(src.slice(opens - 120, opens)).toContain(
-			'fuzzysearchRemoveOpenedAt = performance.now()'
-		);
+		const records = src.slice(opens - 240, opens);
+		expect(records).toContain('fuzzysearchRemoveOpenedAt = performance.now()');
+		expect(records).toContain('fuzzysearchRemoveOpenedX = event.clientX');
+		expect(records).toContain('fuzzysearchRemoveOpenedY = event.clientY');
 		const start = src.indexOf('action="?/removeFuzzysearchKey" use:enhance=');
 		expect(start).toBeGreaterThan(-1);
 		const form = src.slice(start, src.indexOf('</form>', start));
@@ -2184,8 +2187,16 @@ describe('artist lookup section markup (SONA-156)', () => {
 		// carries a positive detail — a keyboard-synthesized click carries 0.
 		const click = form.slice(form.indexOf('onclick='));
 		expect(click).toMatch(/event\.detail\s*>\s*0/);
+		// ...and only for one that landed within the reflex distance of the
+		// recorded point, on both axes.
+		expect(click).toMatch(
+			/Math\.abs\(\s*event\.clientX - fuzzysearchRemoveOpenedX\s*\)\s*<=\s*FUZZYSEARCH_REMOVE_REFLEX_PX/
+		);
+		expect(click).toMatch(
+			/Math\.abs\(\s*event\.clientY - fuzzysearchRemoveOpenedY\s*\)\s*<=\s*FUZZYSEARCH_REMOVE_REFLEX_PX/
+		);
 		expect(click).toMatch(
-			/FUZZYSEARCH_REMOVE_REFLEX_MS[\s\S]{0,60}event\.preventDefault\(\s*\)/
+			/FUZZYSEARCH_REMOVE_REFLEX_MS[\s\S]{0,300}event\.preventDefault\(\s*\)/
 		);
 		// The enhance callback keeps only the in-flight guard: no time check there,
 		// or a keyboard Enter would be swallowed again.
diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index 6d9c226a..b1c98c04 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -1,4 +1,4 @@
-import { test, expect, type Page } from '@playwright/test';
+import { test, expect, type Page, type Request } from '@playwright/test';
 import { adminLogin } from './admin-login';
 
 // Artist lookup key settings (SONA-156), driven in a real browser: the four
@@ -90,12 +90,25 @@ async function openConfirmAndReflexClick(page: Page) {
 		point.y <= after.y + after.height;
 	const where = `at ${page.viewportSize()?.width}px (page scrolled ${scrolled}px, confirm Remove ${covers ? 'covers' : 'clears'} the clicked point)`;
 
-	// The reflex second click: same pixel, no pause.
+	// The reflex second click: same pixel, no pause. The listener pins the guard
+	// at the wire rather than through the sleep — a swallowed click never submits,
+	// so no removal POST may leave the page while the window is open.
+	const removePosts: string[] = [];
+	const watchRemovePosts = (request: Request) => {
+		if (
+			request.method() === 'POST' &&
+			decodeURIComponent(request.url()).includes('?/removeFuzzysearchKey')
+		)
+			removePosts.push(request.url());
+	};
+	page.on('request', watchRemovePosts);
 	await page.mouse.click(point.x, point.y);
 	// Asserted after the guard window, not before it: an unguarded removal takes
 	// a moment to come back, and checking too early passes while it is in flight.
 	// The wait doubles as the one the caller needs before clicking for real.
 	await page.waitForTimeout(REFLEX_GUARD_MS);
+	page.off('request', watchRemovePosts);
+	expect(removePosts, `the reflex click submitted nothing ${where}`).toEqual([]);
 	await expect(confirmPanel(page), `the confirmation stayed open ${where}`).toBeVisible();
 	await expect(keyRecord(page), `the key was not removed ${where}`).toContainText('8901');
 	await expect(replaceLine(page), `the block held still ${where}`).toBeVisible();

From e4aebf36acb957040b8600eca7968b8fe3cd156c Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 19:47:37 -0700
Subject: [PATCH 28/38] fix(settings): widen the reflex box for coarse pointers
 (SONA-156)

---
 src/routes/admin/settings/+page.svelte        | 14 ++++++++++----
 src/routes/admin/settings/page.server.test.ts | 10 ++++++++--
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index e5bb2476..e5c6a7c0 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -190,6 +190,7 @@
 	let fuzzysearchRemoveOpenedY = 0;
 	const FUZZYSEARCH_REMOVE_REFLEX_MS = 500;
 	const FUZZYSEARCH_REMOVE_REFLEX_PX = 24;
+	const FUZZYSEARCH_REMOVE_REFLEX_COARSE_PX = 64;
 	// Focus is moved by hand across the swap: every button involved UNMOUNTS as
 	// the state changes, so without this a keyboard user lands back on <body> and
 	// restarts from the top of a long page. (A bare `autofocus` doesn't do it —
@@ -1574,13 +1575,18 @@
 								// on the button means the pointer moved, so it goes through at once.
 								// A keyboard activation carries detail 0 and cannot hit that hazard,
 								// so Enter straight after Shift+Tab still removes the key.
+								// A finger is not a mouse: an impatient second tap lands a couple of
+								// dozen pixels off the first, so a coarse pointer gets a wider box,
+								// and a browser without matchMedia is treated as coarse.
+								const reflexPx =
+									(window.matchMedia?.('(pointer: coarse)').matches ?? true)
+										? FUZZYSEARCH_REMOVE_REFLEX_COARSE_PX
+										: FUZZYSEARCH_REMOVE_REFLEX_PX;
 								if (
 									event.detail > 0 &&
 									performance.now() - fuzzysearchRemoveOpenedAt < FUZZYSEARCH_REMOVE_REFLEX_MS &&
-									Math.abs(event.clientX - fuzzysearchRemoveOpenedX) <=
-										FUZZYSEARCH_REMOVE_REFLEX_PX &&
-									Math.abs(event.clientY - fuzzysearchRemoveOpenedY) <=
-										FUZZYSEARCH_REMOVE_REFLEX_PX
+									Math.abs(event.clientX - fuzzysearchRemoveOpenedX) <= reflexPx &&
+									Math.abs(event.clientY - fuzzysearchRemoveOpenedY) <= reflexPx
 								)
 									event.preventDefault();
 							}}
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 80e1126f..3b59c992 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2190,11 +2190,17 @@ describe('artist lookup section markup (SONA-156)', () => {
 		// ...and only for one that landed within the reflex distance of the
 		// recorded point, on both axes.
 		expect(click).toMatch(
-			/Math\.abs\(\s*event\.clientX - fuzzysearchRemoveOpenedX\s*\)\s*<=\s*FUZZYSEARCH_REMOVE_REFLEX_PX/
+			/Math\.abs\(\s*event\.clientX - fuzzysearchRemoveOpenedX\s*\)\s*<=\s*reflexPx/
 		);
 		expect(click).toMatch(
-			/Math\.abs\(\s*event\.clientY - fuzzysearchRemoveOpenedY\s*\)\s*<=\s*FUZZYSEARCH_REMOVE_REFLEX_PX/
+			/Math\.abs\(\s*event\.clientY - fuzzysearchRemoveOpenedY\s*\)\s*<=\s*reflexPx/
 		);
+		// That distance is pointer-dependent, decided at click time: a fine
+		// pointer gets the narrow box, a coarse one the wide box that survives
+		// touch jitter.
+		expect(click).toContain("window.matchMedia?.('(pointer: coarse)')");
+		expect(click).toContain('FUZZYSEARCH_REMOVE_REFLEX_COARSE_PX');
+		expect(click).toContain('FUZZYSEARCH_REMOVE_REFLEX_PX');
 		expect(click).toMatch(
 			/FUZZYSEARCH_REMOVE_REFLEX_MS[\s\S]{0,300}event\.preventDefault\(\s*\)/
 		);

From 237afc0315ecc9b4819b9baa2ca04353391a3450 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 19:52:00 -0700
Subject: [PATCH 29/38] test(e2e): note that the artist-lookup key spec cannot
 be stress-run in parallel (SONA-156)

---
 tests/e2e/fuzzysearch-key.spec.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/e2e/fuzzysearch-key.spec.ts b/tests/e2e/fuzzysearch-key.spec.ts
index b1c98c04..3c70ead7 100644
--- a/tests/e2e/fuzzysearch-key.spec.ts
+++ b/tests/e2e/fuzzysearch-key.spec.ts
@@ -12,6 +12,9 @@ import { adminLogin } from './admin-login';
 // actions, saveFuzzysearchKey and removeFuzzysearchKey, and ends with the key
 // removed — which is the seeded state every other spec sees. The invalid-key
 // submission below persists nothing (it fails the shape check server-side).
+// Because every copy shares that one row, stress-running this file with
+// --repeat-each needs --workers=1; parallel copies race each other over the
+// key and fail for that reason alone. CI runs it once.
 
 // Matches ADMIN_PASSWORD in tests/e2e/wrangler.e2e.toml (throwaway local value).
 const PASSWORD = 'e2e-admin-password';

From 207499afc163eef48cfbffe487a3a94b11526266 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:18:09 -0700
Subject: [PATCH 30/38] fix(artist-lookup): bound the proxy header wait, cancel
 failed upstream bodies, and make the refusal marker best effort (SONA-156)

- proxyStoredImage aborts a fetch that never answers with headers
  (PROXY_HEADERS_TIMEOUT_MS), and clears the timer once they land so the
  body still streams unbounded.
- searchImage cancels the unread body on every non-OK path.
- The refused-key marker's write and its clear-on-success are best effort:
  a failed settings write no longer costs the caller its typed answer.
- isEmbeddableAvatarType trims the accept-list tokens.
- Loosened the embedAvatar markup pin to the order that matters, and
  measured the Remove-key hover contrast against the rule's own fill
  instead of its spelling.
---
 src/lib/components/con-card-markup.test.ts    |  6 +-
 src/lib/con-card.test.ts                      | 24 +++++++-
 src/lib/con-card.ts                           |  7 ++-
 src/lib/server/fuzzysearch.test.ts            | 22 ++++++++
 src/lib/server/fuzzysearch.ts                 | 35 ++++++++++--
 src/lib/server/image-proxy.test.ts            | 55 ++++++++++++++++++-
 src/lib/server/image-proxy.ts                 | 24 ++++++--
 src/lib/theme-contrast.test.ts                | 49 +++++++++++++----
 src/routes/api/admin/artist-lookup/+server.ts | 41 ++++++++++----
 .../api/admin/artist-lookup/server.test.ts    | 39 +++++++++++++
 src/routes/api/admin/ref-image/server.test.ts |  9 ++-
 11 files changed, 271 insertions(+), 40 deletions(-)

diff --git a/src/lib/components/con-card-markup.test.ts b/src/lib/components/con-card-markup.test.ts
index 4a5e675c..8322571a 100644
--- a/src/lib/components/con-card-markup.test.ts
+++ b/src/lib/components/con-card-markup.test.ts
@@ -72,9 +72,11 @@ describe('ConCard download paths', () => {
 		// pinned here is that the fetch path actually calls it, on the response's
 		// own content-type, and throws instead of reaching the FileReader — a data
 		// URI made from an octet-stream body draws nothing and would be saved as a
-		// blank avatar with no message.
+		// blank avatar with no message. Only the order matters — the header read,
+		// then the guard, then the reader — so renaming the local or moving a
+		// comment between them doesn't fail this.
 		expect(source).toMatch(
-			/embedAvatar\(\)[\s\S]*?const type = response\.headers\.get\('content-type'\);\s*if \(!isEmbeddableAvatarType\(type\)\) throw[\s\S]*?readAsDataURL/
+			/embedAvatar\(\)[\s\S]*?headers\.get\(['"]content-type['"]\)[\s\S]*?isEmbeddableAvatarType\([\s\S]*?throw[\s\S]*?readAsDataURL/
 		);
 	});
 
diff --git a/src/lib/con-card.test.ts b/src/lib/con-card.test.ts
index 1937d93b..3beee855 100644
--- a/src/lib/con-card.test.ts
+++ b/src/lib/con-card.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 import { qrSvg } from './qr';
 import { SOCIAL_ICON_ART, type SocialIconArt } from './social-icon-paths';
 import { SOCIAL_PLATFORM_NAMES, type SocialPlatform } from './social-label';
@@ -648,4 +648,26 @@ describe('isEmbeddableAvatarType', () => {
 			expect(isEmbeddableAvatarType(type), String(type)).toBe(true);
 		}
 	});
+
+	// GALLERY_ACCEPT has no spaces today, and an accept list is just as valid
+	// written with them. Read literally, a single space would drop the avatar to
+	// the initial for a type the server's own allowlist stores.
+	it('reads an accept list written with spaces after the commas', async () => {
+		vi.resetModules();
+		vi.doMock('$lib/config', async () => {
+			const actual = await vi.importActual<typeof import('./config')>('./config');
+			return { ...actual, GALLERY_ACCEPT: 'image/jpeg, image/png, image/webp' };
+		});
+		try {
+			const spaced = await import('./con-card');
+			expect(spaced.isEmbeddableAvatarType('image/png')).toBe(true);
+			expect(spaced.isEmbeddableAvatarType('image/webp')).toBe(true);
+			// Not in the stubbed list, so a false here also proves the stub is the
+			// list being read rather than the real constant.
+			expect(spaced.isEmbeddableAvatarType('image/gif')).toBe(false);
+		} finally {
+			vi.doUnmock('$lib/config');
+			vi.resetModules();
+		}
+	});
 });
diff --git a/src/lib/con-card.ts b/src/lib/con-card.ts
index 9c3741cd..98c64239 100644
--- a/src/lib/con-card.ts
+++ b/src/lib/con-card.ts
@@ -634,7 +634,12 @@ export function conCardPrintSheetSvg(opts: Omit<ConCardOptions, 'variant'>): str
 export function isEmbeddableAvatarType(contentType: string | null | undefined): boolean {
 	if (!contentType) return true;
 	const type = contentType.split(';')[0].trim().toLowerCase();
-	return GALLERY_ACCEPT.split(',').includes(type);
+	// Tokens are trimmed: an accept list written with a space after the comma is
+	// the same list to an <input accept>, and reading it literally here would
+	// refuse a type the server's allowlist takes.
+	return GALLERY_ACCEPT.split(',')
+		.map((t) => t.trim())
+		.includes(type);
 }
 
 /** Filename stem for a downloaded card: `taro-con-card`. */
diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 0bb6b029..46ce42a4 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -222,6 +222,28 @@ describe('searchImage — failure mapping', () => {
 		});
 	}
 
+	// The body of a failure is never read, and a subrequest stream left unread
+	// holds the connection open until the runtime reaps it.
+	it('cancels the unread body on every failure status', async () => {
+		for (const status of [...cases.map(([s]) => s), 400]) {
+			const response = new Response('nope', { status });
+			const cancel = vi.spyOn(response.body as ReadableStream, 'cancel');
+			const { fn } = fakeFetch(response);
+			await searchImage(new Blob(['x']), 'k', fn);
+			expect(cancel, String(status)).toHaveBeenCalled();
+		}
+	});
+
+	// The ok path reads the payload instead — cancelling it would throw away the
+	// matches the operator asked for.
+	it('does not cancel the body of a 200 it is about to read', async () => {
+		const response = jsonResponse([]);
+		const cancel = vi.spyOn(response.body as ReadableStream, 'cancel');
+		const { fn } = fakeFetch(response);
+		expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({ ok: true, matches: [] });
+		expect(cancel).not.toHaveBeenCalled();
+	});
+
 	it('splits 400 into too_large and invalid_image by body', async () => {
 		const big = fakeFetch(new Response('{"error":"too_large"}', { status: 400 }));
 		expect(await searchImage(new Blob(['x']), 'k', big.fn)).toEqual({
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index 954cdc8d..18f5e815 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -293,6 +293,20 @@ export function normalizeMatches(payload: unknown): LookupMatch[] {
 		.sort(compareMatches);
 }
 
+/**
+ * Drop the body of a response nobody is going to read. An unread stream holds
+ * the subrequest open until the runtime reaps it, and on a failure path there
+ * is nothing in the body worth keeping. Cancelling one that a `text()` already
+ * drained throws, which is as harmless as the cancel itself.
+ */
+async function discardBody(res: Response): Promise<void> {
+	try {
+		await res.body?.cancel();
+	} catch {
+		// already read, already cancelled, or never had a body
+	}
+}
+
 /**
  * POST the bytes to FuzzySearch and return normalized matches.
  *
@@ -325,16 +339,29 @@ export async function searchImage(
 	// 403 alongside 401, the pair the registry client already treats as an auth
 	// failure: a revoked or suspended key answers 403, and without it the
 	// operator would never see the refused state for the one case they can fix.
-	if (res.status === 401 || res.status === 403) return { ok: false, reason: 'key_refused' };
-	if (res.status === 429) return { ok: false, reason: 'rate_limited' };
-	if (res.status === 413) return { ok: false, reason: 'too_large' };
+	if (res.status === 401 || res.status === 403) {
+		await discardBody(res);
+		return { ok: false, reason: 'key_refused' };
+	}
+	if (res.status === 429) {
+		await discardBody(res);
+		return { ok: false, reason: 'rate_limited' };
+	}
+	if (res.status === 413) {
+		await discardBody(res);
+		return { ok: false, reason: 'too_large' };
+	}
 	if (res.status === 400) {
 		// The one 400 worth distinguishing: FuzzySearch says the image is over its
 		// own limit. The body is inspected for that single token and discarded.
 		const body = await res.text().catch(() => '');
+		await discardBody(res);
 		return { ok: false, reason: body.includes('too_large') ? 'too_large' : 'invalid_image' };
 	}
-	if (!res.ok) return { ok: false, reason: 'unavailable' };
+	if (!res.ok) {
+		await discardBody(res);
+		return { ok: false, reason: 'unavailable' };
+	}
 
 	const payload = await res.json().catch(() => null);
 	// A 200 that isn't the documented array is a broken upstream, not a search
diff --git a/src/lib/server/image-proxy.test.ts b/src/lib/server/image-proxy.test.ts
index c727ca4a..aa15e21c 100644
--- a/src/lib/server/image-proxy.test.ts
+++ b/src/lib/server/image-proxy.test.ts
@@ -1,5 +1,10 @@
-import { describe, it, expect } from 'vitest';
-import { isPrivateHost, isSameOriginUrl, proxyStoredImage } from './image-proxy';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import {
+	isPrivateHost,
+	isSameOriginUrl,
+	proxyStoredImage,
+	PROXY_HEADERS_TIMEOUT_MS
+} from './image-proxy';
 
 // The guard both byte proxies rely on. Driven directly rather than through a
 // route, because the boundaries are the whole point and a route test only ever
@@ -163,4 +168,50 @@ describe('proxyStoredImage', () => {
 		}) as unknown as typeof fetch;
 		expect(await proxyStoredImage('https://cdn.example/img.png', rejecting)).toBeNull();
 	});
+
+	// The bound is on the HEADERS only. A host that accepts the connection and
+	// then says nothing would otherwise hold the operator's request open until
+	// the platform kills it; a big image that answers promptly must still be
+	// allowed to stream for as long as it takes.
+	describe('the wait for upstream headers', () => {
+		beforeEach(() => vi.useFakeTimers());
+		afterEach(() => vi.useRealTimers());
+
+		it('gives up on a fetcher that never answers', async () => {
+			let signal: AbortSignal | undefined;
+			const silent = ((_url: string, init?: RequestInit) => {
+				signal = init?.signal ?? undefined;
+				// Rejects the way a real fetch does when its signal aborts.
+				return new Promise<Response>((_resolve, reject) => {
+					init?.signal?.addEventListener('abort', () =>
+						reject(new DOMException('aborted', 'AbortError'))
+					);
+				});
+			}) as unknown as typeof fetch;
+
+			const pending = proxyStoredImage('https://cdn.example/img.png', silent);
+			await vi.advanceTimersByTimeAsync(PROXY_HEADERS_TIMEOUT_MS - 1);
+			expect(signal?.aborted).toBe(false);
+			await vi.advanceTimersByTimeAsync(2);
+			expect(signal?.aborted).toBe(true);
+			expect(await pending).toBeNull();
+		});
+
+		it('clears the timer once the headers land, so the body streams unbounded', async () => {
+			let signal: AbortSignal | undefined;
+			const answering = ((_url: string, init?: RequestInit) => {
+				signal = init?.signal ?? undefined;
+				return Promise.resolve(
+					new Response('bytes', { headers: { 'content-type': 'image/png' } })
+				);
+			}) as unknown as typeof fetch;
+
+			const res = await proxyStoredImage('https://cdn.example/img.png', answering);
+			expect(res?.headers.get('content-type')).toBe('image/png');
+			// Long past the bound: nothing is left to fire at a body still arriving.
+			await vi.advanceTimersByTimeAsync(PROXY_HEADERS_TIMEOUT_MS * 10);
+			expect(signal?.aborted).toBe(false);
+			expect(vi.getTimerCount()).toBe(0);
+		});
+	});
 });
diff --git a/src/lib/server/image-proxy.ts b/src/lib/server/image-proxy.ts
index 2988cd3e..b4a79184 100644
--- a/src/lib/server/image-proxy.ts
+++ b/src/lib/server/image-proxy.ts
@@ -18,6 +18,15 @@
 
 import { isAllowedImageType } from './storage/allowlist';
 
+/**
+ * How long the upstream has to answer with HEADERS. The bound covers the wait
+ * for the response only — once the headers land the timer is cleared, so a
+ * large image streams for as long as it needs. Without it a host that accepts
+ * the connection and then says nothing holds the request open until the
+ * platform kills it, and the operator sees a spinner with no end.
+ */
+export const PROXY_HEADERS_TIMEOUT_MS = 10_000;
+
 // Loopback / unspecified / RFC1918 / link-local / ULA hosts a stored URL must
 // never point the server-side fetch at.
 export function isPrivateHost(hostname: string): boolean {
@@ -90,14 +99,21 @@ export async function proxyStoredImage(
 	// A storage host answering with a redirect is unexpected — treat it as an
 	// upstream error rather than following it to an arbitrary location.
 	let upstream: Response;
+	const controller = new AbortController();
+	const headersTimer = setTimeout(() => controller.abort(), PROXY_HEADERS_TIMEOUT_MS);
 	try {
-		upstream = await fetcher(imageUrl, { redirect: 'manual' });
+		upstream = await fetcher(imageUrl, { redirect: 'manual', signal: controller.signal });
 	} catch {
 		// A DNS failure, a reset connection or a TLS error rejects rather than
-		// answering. The stored image is as unreachable as it is on a non-ok
-		// response, so it reports the same way — every caller already handles null,
-		// and none of them has to answer 500 to a network blip.
+		// answering, and so does the abort above. The stored image is as
+		// unreachable as it is on a non-ok response, so it reports the same way —
+		// every caller already handles null, and none of them has to answer 500 to
+		// a network blip.
 		return null;
+	} finally {
+		// The headers are in (or the fetch is over): the body streams unbounded
+		// from here, so the timer must not fire mid-download.
+		clearTimeout(headersTimer);
 	}
 	if (!upstream.ok || !upstream.body) return null;
 
diff --git a/src/lib/theme-contrast.test.ts b/src/lib/theme-contrast.test.ts
index 95e73984..0cb4bf73 100644
--- a/src/lib/theme-contrast.test.ts
+++ b/src/lib/theme-contrast.test.ts
@@ -921,22 +921,47 @@ describe('no accent-color override on form controls (SONA-172)', () => {
 // label to --destructive. .btn-outline's hover fill mixes --background 88%
 // toward white or black, and --destructive on that mix falls to 3.6-4.4:1 on
 // five of the six themes, so the component pins the fill back to --background
-// and lets the border carry the hover signal (SONA-156). Two halves: the token
-// pairing has to clear AA, and the rule has to keep using it.
-describe('SONA-156 Remove-key label on its pinned hover fill', () => {
-	for (const { name, sel } of THEME_BLOCKS) {
-		it(`${name}: destructive text on the page background meets 4.5:1`, () => {
-			expect(contrast(blockToken(sel, 'destructive'), blockToken(sel, 'background'))).toBeGreaterThanOrEqual(4.5);
-		});
-	}
-
-	it('.lookup-section .btn-remove:hover pins the fill to var(--background)', () => {
+// and lets the border carry the hover signal (SONA-156). Asserted the way the
+// #103 hover tests are: resolve the rule's own fill in each theme block and
+// measure the label against it, so any fill that clears AA passes and any that
+// doesn't fails, whatever it is spelled as.
+describe('SONA-156 Remove-key label on its hover fill', () => {
+	/** The `background-color` the hovered button actually paints, as written. */
+	function removeHoverFill(): string {
 		const source = readFileSync(
 			fileURLToPath(new URL('../routes/admin/settings/+page.svelte', import.meta.url)),
 			'utf8'
 		);
 		const body = source.match(/^\s*\.lookup-section \.btn-remove:hover\s*\{([^}]*)\}/m)?.[1];
 		if (!body) throw new Error('.lookup-section .btn-remove:hover rule not found');
-		expect(body).toMatch(/background-color:\s*var\(--background\)\s*;/);
-	});
+		const fill = body.match(/background-color:\s*([^;]+);/)?.[1].trim();
+		// No fill of its own means the button inherits .btn-outline's hover mix,
+		// which is the pairing this block exists to keep it away from.
+		if (!fill) throw new Error('.lookup-section .btn-remove:hover sets no background-color');
+		return fill;
+	}
+
+	// A token, or a srgb color-mix of one toward black, white or another token —
+	// the two shapes the app's hover fills use. Anything else throws rather than
+	// passing unmeasured.
+	function resolveFill(value: string, sel: string): string {
+		const token = value.match(/^var\(--([\w-]+)\)$/);
+		if (token) return blockToken(sel, token[1]);
+		const mixed = value.match(
+			/^color-mix\(in srgb,\s*var\(--([\w-]+)\)\s*(\d+)%,\s*(black|white|var\(--[\w-]+\))\)$/
+		);
+		if (!mixed) throw new Error(`cannot resolve the hover fill "${value}" to a color`);
+		const base = blockToken(sel, mixed[1]);
+		const pct = Number(mixed[2]);
+		const toward = mixed[3];
+		if (toward === 'black' || toward === 'white') return mixSrgb(base, pct, toward);
+		return mix2(base, pct, blockToken(sel, toward.slice('var(--'.length, -1)));
+	}
+
+	for (const { name, sel } of THEME_BLOCKS) {
+		it(`${name}: destructive label on the hovered fill meets 4.5:1`, () => {
+			const fill = resolveFill(removeHoverFill(), sel);
+			expect(contrast(blockToken(sel, 'destructive'), fill)).toBeGreaterThanOrEqual(4.5);
+		});
+	}
 });
diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index 4f6c1d40..c8e0f69f 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -169,12 +169,22 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		// tells the operator their key stopped working instead of leaving the
 		// button failing silently. The marker records WHICH key was refused, so a
 		// refusal against the deploy secret is never shown against a stored one.
+		// The marker is a convenience for the settings page, not part of the
+		// answer: a failed write must not turn a typed 502 into a 500 the caller
+		// can't read. Nothing about the write's error names the body or the key.
 		if (result.reason === 'key_refused') {
-			await setRawSetting(
-				db,
-				FUZZYSEARCH_KEY_REFUSED_SETTING,
-				fuzzysearchRefusedMarker(resolved.source)
-			);
+			try {
+				await setRawSetting(
+					db,
+					FUZZYSEARCH_KEY_REFUSED_SETTING,
+					fuzzysearchRefusedMarker(resolved.source)
+				);
+			} catch (e) {
+				console.warn(
+					'artist-lookup: refused-key marker not written',
+					e instanceof Error ? e.message : e
+				);
+			}
 		}
 		return failure(result.reason);
 	}
@@ -182,12 +192,21 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 	// The key works — clear a stale refusal marker, but only the marker for the
 	// key that just succeeded (a marker against the other source stays: a deploy
 	// secret succeeding says nothing about the stored key FuzzySearch refused).
-	// Read first, so the happy path costs one read rather than a write.
-	const refusedMarker = parseFuzzysearchRefusedMarker(
-		await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)
-	);
-	if (refusedMarker && refusedMarker.source === resolved.source) {
-		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '');
+	// Read first, so the happy path costs one read rather than a write. Best
+	// effort for the same reason as the write above: a settings row that won't
+	// clear must not cost the operator the matches they asked for.
+	try {
+		const refusedMarker = parseFuzzysearchRefusedMarker(
+			await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)
+		);
+		if (refusedMarker && refusedMarker.source === resolved.source) {
+			await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '');
+		}
+	} catch (e) {
+		console.warn(
+			'artist-lookup: refused-key marker not cleared',
+			e instanceof Error ? e.message : e
+		);
 	}
 
 	const matches = result.matches;
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index 771f31d4..a5cb56ee 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -32,6 +32,19 @@ vi.mock('$lib/server/fuzzysearch', async (importOriginal) => {
 	return { ...original, searchImage };
 });
 
+// The real write by default; a test that needs the settings row to fail makes
+// this reject for that one call. The endpoint's answer must not depend on it.
+const setRawSettingSpy = vi.hoisted(() =>
+	vi.fn<(...args: never[]) => Promise<unknown>>()
+);
+vi.mock('$lib/server/settings', async (importOriginal) => {
+	const original = await importOriginal<typeof import('$lib/server/settings')>();
+	setRawSettingSpy.mockImplementation(
+		original.setRawSetting as unknown as (...args: never[]) => Promise<unknown>
+	);
+	return { ...original, setRawSetting: setRawSettingSpy };
+});
+
 const DDL = `CREATE TABLE site_settings (key TEXT PRIMARY KEY, value TEXT NOT NULL);
 	CREATE TABLE images (id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, slug TEXT,
 		image_url TEXT NOT NULL, thumbnail_url TEXT, width INTEGER, height INTEGER, file_size INTEGER,
@@ -541,6 +554,32 @@ describe('artist-lookup — failure mapping and the refused marker', () => {
 		expect(await getRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING)).toBeNull();
 	});
 
+	// The marker is a convenience for the settings card, not the answer. A D1
+	// write that fails must not turn the typed 502 into a 500 whose body the
+	// caller's res.json() can't read, nor cost a successful lookup its matches.
+	it('still answers key_refused when the marker cannot be written', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		searchImage.mockResolvedValue({ ok: false, reason: 'key_refused' });
+		setRawSettingSpy.mockRejectedValueOnce(new Error('D1_ERROR: no such table'));
+
+		const res = await POST(multipartEvent(platform, pngFile()));
+
+		expect(res.status).toBe(502);
+		expect(await res.json()).toEqual({ enabled: true, error: 'key_refused' });
+	});
+
+	it('still answers the matches when the marker cannot be cleared', async () => {
+		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		await setRawSetting(db, FUZZYSEARCH_KEY_REFUSED_SETTING, '2026-09-01T00:00:00.000Z|env');
+		searchImage.mockResolvedValue({ ok: true, matches: [FA_EXACT] });
+		setRawSettingSpy.mockRejectedValueOnce(new Error('D1_ERROR: no such table'));
+
+		const res = await POST(multipartEvent(platform, pngFile()));
+
+		expect(res.status).toBe(200);
+		expect((await res.json()).matches).toHaveLength(1);
+	});
+
 	it('maps each remaining failure to its status without echoing a body', async () => {
 		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 		const cases = [
diff --git a/src/routes/api/admin/ref-image/server.test.ts b/src/routes/api/admin/ref-image/server.test.ts
index f500c71d..35c59163 100644
--- a/src/routes/api/admin/ref-image/server.test.ts
+++ b/src/routes/api/admin/ref-image/server.test.ts
@@ -56,9 +56,12 @@ describe('GET /api/admin/ref-image — by-ID image proxy', () => {
 
 		// Fetched the DB-stored URL — never a caller-supplied one — and never
 		// follows a redirect away from it.
-		expect(vi.mocked(fetchMock)).toHaveBeenCalledWith('https://cdn.x/ref.png', {
-			redirect: 'manual'
-		});
+		expect(vi.mocked(fetchMock)).toHaveBeenCalledWith(
+			'https://cdn.x/ref.png',
+			// The proxy also bounds the wait for headers, so the init carries its
+			// abort signal alongside the redirect mode.
+			expect.objectContaining({ redirect: 'manual' })
+		);
 		expect(res.status).toBe(200);
 		expect(res.headers.get('content-type')).toBe('image/png');
 		expect(res.headers.get('content-disposition')).toBe('inline');

From 52182198ffec4a27ecd60e552ec367a2dead0187 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:24:04 -0700
Subject: [PATCH 31/38] fix(fuzzysearch): bound how much of a FuzzySearch
 response is read (SONA-156)

The 400 branch read the whole third-party body with res.text() to look for
one token, and the 200 branch read the whole body with res.json(). Both now
go through bufferStream with a cap: 4 KiB for an error body, 1 MiB for a
payload. Past the cap the rest is cancelled and the response falls through to
invalid_image or unavailable.
---
 src/lib/server/fuzzysearch.test.ts | 85 ++++++++++++++++++++++++++++++
 src/lib/server/fuzzysearch.ts      | 47 +++++++++++++++--
 2 files changed, 127 insertions(+), 5 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 46ce42a4..fcda4511 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -3,6 +3,8 @@ import {
 	FUZZYSEARCH_ENDPOINT,
 	FUZZYSEARCH_MAX_DISTANCE,
 	FUZZYSEARCH_TIMEOUT_MS,
+	FUZZYSEARCH_ERROR_BODY_BYTES,
+	FUZZYSEARCH_RESPONSE_BYTES,
 	searchImage,
 	normalizeMatches,
 	pickPrefillMatch,
@@ -36,6 +38,24 @@ function jsonResponse(body: unknown, status = 200) {
 	});
 }
 
+// A response whose body arrives chunk by chunk, recording how much was pulled
+// and whether the rest was cancelled — the way to see that a body past the byte
+// cap is never read to the end.
+function chunkedResponse(chunks: string[], status = 200) {
+	const state = { pulled: 0, cancelled: false };
+	const encoder = new TextEncoder();
+	const body = new ReadableStream<Uint8Array>({
+		pull(controller) {
+			if (state.pulled >= chunks.length) return controller.close();
+			controller.enqueue(encoder.encode(chunks[state.pulled++]));
+		},
+		cancel() {
+			state.cancelled = true;
+		}
+	});
+	return { response: new Response(body, { status }), state };
+}
+
 const MIXED_PAYLOAD = [
 	// Dropped: too far away to be a lead.
 	{ site: 'FurAffinity', site_id_str: '999', artists: ['faraway'], distance: 9 },
@@ -289,6 +309,71 @@ describe('searchImage — failure mapping', () => {
 	});
 });
 
+// FuzzySearch is a third party: how many bytes of its answer this isolate holds
+// is our decision, not theirs.
+describe('searchImage — bounded response reads', () => {
+	it('stops reading a 400 body at the cap and reports invalid_image', async () => {
+		// The token sits in the last chunk, well past the cap it would have to be
+		// inside to count.
+		const chunks = [...Array(9).fill('a'.repeat(1024)), '{"error":"too_large"}'];
+		const { response, state } = chunkedResponse(chunks, 400);
+		const { fn } = fakeFetch(response);
+		expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({
+			ok: false,
+			reason: 'invalid_image'
+		});
+		expect(state.cancelled).toBe(true);
+		// Enough chunks to cross the cap (plus the one the stream reads ahead),
+		// nowhere near the whole body.
+		expect(state.pulled).toBeLessThanOrEqual(FUZZYSEARCH_ERROR_BODY_BYTES / 1024 + 2);
+		expect(state.pulled).toBeLessThan(chunks.length);
+	});
+
+	it('still finds the too_large token inside the cap', async () => {
+		const { response } = chunkedResponse(['{"error":"too_large"}'], 400);
+		const { fn } = fakeFetch(response);
+		expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({
+			ok: false,
+			reason: 'too_large'
+		});
+	});
+
+	it('maps a 200 body past the cap to unavailable without reading it all', async () => {
+		const chunk = 'x'.repeat(64 * 1024);
+		const chunks = Array(Math.ceil(FUZZYSEARCH_RESPONSE_BYTES / chunk.length) + 4).fill(chunk);
+		const { response, state } = chunkedResponse(chunks);
+		const { fn } = fakeFetch(response);
+		expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({
+			ok: false,
+			reason: 'unavailable'
+		});
+		expect(state.cancelled).toBe(true);
+		expect(state.pulled).toBeLessThan(chunks.length);
+	});
+
+	it('reads a 200 payload that fits, chunked', async () => {
+		const { response } = chunkedResponse(['[{"site":"FurAffinity",', '"site_id_str":"12345"}]']);
+		const { fn } = fakeFetch(response);
+		expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({
+			ok: true,
+			matches: [normalizeMatches([{ site: 'FurAffinity', site_id_str: '12345' }])[0]]
+		});
+	});
+
+	// Some responses (and some test doubles) carry no stream at all; text() is
+	// then the only way in.
+	it('falls back to text() when the response has no body stream', async () => {
+		const bodiless = {
+			status: 200,
+			ok: true,
+			body: null,
+			text: async () => '[]'
+		} as unknown as Response;
+		const { fn } = fakeFetch(bodiless);
+		expect(await searchImage(new Blob(['x']), 'k', fn)).toEqual({ ok: true, matches: [] });
+	});
+});
+
 function match(over: Partial<LookupMatch>): LookupMatch {
 	return {
 		site: 'FurAffinity',
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index 18f5e815..a8a5362e 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -11,7 +11,7 @@
 // can carry the key back, and the match list is third-party data about the
 // operator's own art.
 
-import { MAX_REMOTE_BUFFER_BYTES } from './storage/buffer';
+import { bufferStream, MAX_REMOTE_BUFFER_BYTES } from './storage/buffer';
 import { getRawSetting } from './settings';
 import { normalizeHandle, socialsToHandles, type Platform } from './handle-normalize';
 import type { Database } from './db';
@@ -28,6 +28,14 @@ export const FUZZYSEARCH_KEY_REFUSED_SETTING = 'fuzzysearchKeyRefusedAt';
 export const FUZZYSEARCH_ENDPOINT = 'https://api.fuzzysearch.net/v1/image';
 /** Same 10 MiB bound every other third-party body gets (storage/buffer.ts). */
 export const FUZZYSEARCH_MAX_BYTES = MAX_REMOTE_BUFFER_BYTES;
+/** How much of a 4xx body the 400 branch reads before giving up on it: the
+ * token it looks for sits in a short JSON error object, and nothing past 4 KiB
+ * is evidence. */
+export const FUZZYSEARCH_ERROR_BODY_BYTES = 4096;
+/** How much of a 200 body is read: a match list runs to a few KB, so a MiB is
+ * already generous, and past it the response is a broken or hostile upstream
+ * rather than a search result. */
+export const FUZZYSEARCH_RESPONSE_BYTES = 1024 * 1024;
 export const FUZZYSEARCH_TIMEOUT_MS = 8000;
 /** Hamming distance past which a match is noise rather than a lead. */
 export const FUZZYSEARCH_MAX_DISTANCE = 7;
@@ -307,6 +315,24 @@ async function discardBody(res: Response): Promise<void> {
 	}
 }
 
+/**
+ * Read at most `max` bytes of a response body as text. A body that runs past
+ * the cap is cancelled and comes back null: a third party does not get to
+ * decide how much of this isolate's memory its answer occupies, and neither the
+ * 400 token nor the match list is anywhere near the caps above. An unreadable
+ * body reads as null the same way. `res.body` is null on some responses (and
+ * some test doubles), where `text()` is the only way in.
+ */
+async function readBounded(res: Response, max: number): Promise<string | null> {
+	if (!res.body) return await res.text().catch(() => null);
+	try {
+		return new TextDecoder().decode(await bufferStream(res.body, max));
+	} catch {
+		// Over the cap (bufferStream cancelled the rest), or the stream errored.
+		return null;
+	}
+}
+
 /**
  * POST the bytes to FuzzySearch and return normalized matches.
  *
@@ -353,17 +379,28 @@ export async function searchImage(
 	}
 	if (res.status === 400) {
 		// The one 400 worth distinguishing: FuzzySearch says the image is over its
-		// own limit. The body is inspected for that single token and discarded.
-		const body = await res.text().catch(() => '');
+		// own limit. Only the first FUZZYSEARCH_ERROR_BODY_BYTES are inspected for
+		// that single token, and the body is discarded; one that runs past the cap
+		// is not evidence of anything, so it falls through to invalid_image.
+		const body = await readBounded(res, FUZZYSEARCH_ERROR_BODY_BYTES);
 		await discardBody(res);
-		return { ok: false, reason: body.includes('too_large') ? 'too_large' : 'invalid_image' };
+		return { ok: false, reason: body?.includes('too_large') ? 'too_large' : 'invalid_image' };
 	}
 	if (!res.ok) {
 		await discardBody(res);
 		return { ok: false, reason: 'unavailable' };
 	}
 
-	const payload = await res.json().catch(() => null);
+	// Bounded like the error body above: `res.json()` would buffer whatever the
+	// remote sends. Over the cap, unreadable, or unparsable all land on the
+	// non-array path below.
+	const text = await readBounded(res, FUZZYSEARCH_RESPONSE_BYTES);
+	let payload: unknown = null;
+	try {
+		if (text !== null) payload = JSON.parse(text);
+	} catch {
+		payload = null;
+	}
 	// A 200 that isn't the documented array is a broken upstream, not a search
 	// with no hits — reporting it as "no matches" would tell the operator their
 	// art is unindexed when nobody actually looked.

From b7da9c454c51abc4bf000cc5ab0b6062e561e6eb Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:25:07 -0700
Subject: [PATCH 32/38] test(artist-lookup): re-arm the settings spy before
 each case (SONA-156)

---
 src/routes/api/admin/artist-lookup/server.test.ts | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index a5cb56ee..8d1ec066 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -37,11 +37,16 @@ vi.mock('$lib/server/fuzzysearch', async (importOriginal) => {
 const setRawSettingSpy = vi.hoisted(() =>
 	vi.fn<(...args: never[]) => Promise<unknown>>()
 );
+// The real implementation, kept so beforeEach can re-arm the spy after a reset:
+// a once-queued rejection a test failed to consume must not reject the next
+// test's first write.
+const realSetRawSetting = vi.hoisted(() => ({
+	fn: null as null | ((...args: never[]) => Promise<unknown>)
+}));
 vi.mock('$lib/server/settings', async (importOriginal) => {
 	const original = await importOriginal<typeof import('$lib/server/settings')>();
-	setRawSettingSpy.mockImplementation(
-		original.setRawSetting as unknown as (...args: never[]) => Promise<unknown>
-	);
+	realSetRawSetting.fn = original.setRawSetting as unknown as (...args: never[]) => Promise<unknown>;
+	setRawSettingSpy.mockImplementation(realSetRawSetting.fn);
 	return { ...original, setRawSetting: setRawSettingSpy };
 });
 
@@ -139,6 +144,8 @@ const FA_EXACT = {
 beforeEach(() => {
 	searchImage.mockReset();
 	searchImage.mockResolvedValue({ ok: true, matches: [] });
+	setRawSettingSpy.mockReset();
+	if (realSetRawSetting.fn) setRawSettingSpy.mockImplementation(realSetRawSetting.fn);
 });
 
 describe('artist-lookup — configuration', () => {

From b2b6eadd45b2ddd1baa86fc888335559ce97bd44 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:29:04 -0700
Subject: [PATCH 33/38] test(fuzzysearch): give the bounded-read chunk
 allowance room for stream read-ahead (SONA-156)

---
 src/lib/server/fuzzysearch.test.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index fcda4511..8a779861 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -323,9 +323,10 @@ describe('searchImage — bounded response reads', () => {
 			reason: 'invalid_image'
 		});
 		expect(state.cancelled).toBe(true);
-		// Enough chunks to cross the cap (plus the one the stream reads ahead),
-		// nowhere near the whole body.
-		expect(state.pulled).toBeLessThanOrEqual(FUZZYSEARCH_ERROR_BODY_BYTES / 1024 + 2);
+		// Enough chunks to cross the cap plus a little read-ahead (how much the
+		// stream pulls ahead is the platform's choice, so leave it room), nowhere
+		// near the whole body.
+		expect(state.pulled).toBeLessThanOrEqual(FUZZYSEARCH_ERROR_BODY_BYTES / 1024 + 4);
 		expect(state.pulled).toBeLessThan(chunks.length);
 	});
 

From ea3e8faeec1f11f75d5e5cf9634c23830a2bbb01 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:46:29 -0700
Subject: [PATCH 34/38] fix(fuzzysearch): never follow a redirect with the API
 key, and pin the key field as a password input (SONA-156)

---
 src/lib/server/fuzzysearch.test.ts            | 4 ++++
 src/lib/server/fuzzysearch.ts                 | 4 ++++
 src/routes/admin/settings/page.server.test.ts | 8 ++++++++
 3 files changed, 16 insertions(+)

diff --git a/src/lib/server/fuzzysearch.test.ts b/src/lib/server/fuzzysearch.test.ts
index 8a779861..656b53d4 100644
--- a/src/lib/server/fuzzysearch.test.ts
+++ b/src/lib/server/fuzzysearch.test.ts
@@ -187,6 +187,8 @@ describe('searchImage — request shape', () => {
 		expect(calls[0].init.method).toBe('POST');
 		expect((calls[0].init.headers as Record<string, string>)['x-api-key']).toBe('secret-key');
 		expect(calls[0].init.signal).toBeInstanceOf(AbortSignal);
+		// Following a redirect would replay the key header at the Location host.
+		expect(calls[0].init.redirect).toBe('manual');
 		const body = calls[0].init.body as FormData;
 		expect(body).toBeInstanceOf(FormData);
 		const sent = body.get('image');
@@ -230,6 +232,8 @@ describe('searchImage — failure mapping', () => {
 		// A revoked or suspended key answers 403, not 401; both are the refused
 		// state the settings card can act on.
 		[403, 'key_refused'],
+		// Nothing follows the redirect, so the 3xx itself is the answer.
+		[302, 'unavailable'],
 		[429, 'rate_limited'],
 		[413, 'too_large'],
 		[500, 'unavailable'],
diff --git a/src/lib/server/fuzzysearch.ts b/src/lib/server/fuzzysearch.ts
index a8a5362e..2580289f 100644
--- a/src/lib/server/fuzzysearch.ts
+++ b/src/lib/server/fuzzysearch.ts
@@ -354,6 +354,10 @@ export async function searchImage(
 			method: 'POST',
 			headers: { 'x-api-key': key },
 			body: form,
+			// Never follow a redirect: fetch would replay the key header at
+			// whatever host the Location points to. A 3xx falls through to
+			// `!res.ok` and reads as unavailable.
+			redirect: 'manual',
 			signal: AbortSignal.timeout(FUZZYSEARCH_TIMEOUT_MS)
 		});
 	} catch {
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index 3b59c992..b80c6737 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -2069,6 +2069,14 @@ describe('artist lookup section markup (SONA-156)', () => {
 
 	it('takes the key in a password field and never renders a stored key', () => {
 		expect(src).toContain('name="fuzzysearchApiKey"');
+		// The name alone would still pass if the field became a text input, which
+		// puts the key on screen and into the browser's autofill store.
+		const field = src.slice(
+			src.lastIndexOf('<input', src.indexOf('name="fuzzysearchApiKey"')),
+			src.indexOf('/>', src.indexOf('name="fuzzysearchApiKey"'))
+		);
+		expect(field).toContain('type="password"');
+		expect(field).toContain('autocomplete="off"');
 		expect(src).toContain('data.fuzzysearchKeyRecord');
 		expect(src).not.toContain('data.fuzzysearchApiKey');
 	});

From f65010fe51f1dcebe9ba4c2a0191f882131eef0b Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:52:08 -0700
Subject: [PATCH 35/38] fix(artist-lookup): answer a refused key with 424 so it
 stays out of the error rollup (SONA-156)

---
 src/routes/api/admin/artist-lookup/+server.ts | 18 ++++++++----
 .../api/admin/artist-lookup/server.test.ts    | 29 +++++++++++++++----
 2 files changed, 36 insertions(+), 11 deletions(-)

diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index c8e0f69f..6c149727 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -47,14 +47,22 @@ import type { RequestHandler } from './$types';
 
 /** What the UI gets back for a failed lookup, and the status carrying it. */
 const FAILURE_STATUS: Record<LookupFailure, number> = {
-	// 502, not 401: the admin gate answers an expired session with its own 401
-	// and a plain-text body, so a 401 here would read as a refused key and the
-	// caller's res.json() would throw. The body's `error` field is what tells
+	// Anything >= 500 is counted into the operator's error rollup
+	// (src/hooks.server.ts), so only a genuine server fault belongs up there: a
+	// key FuzzySearch refuses is configuration, and an operator who saved a bad
+	// key would otherwise see server errors on the observability panel with
+	// every click. 424 (Failed Dependency) says the request depended on
+	// FuzzySearch accepting the key. Not 401: the admin gate answers an expired
+	// session with its own 401 and a plain-text body, so a 401 here would read
+	// as a refused key and the caller's res.json() would throw. The gate emits
+	// only 401 and 400, never 424. The body's `error` field is what tells
 	// key_refused apart from unavailable.
-	key_refused: 502,
+	key_refused: 424,
 	rate_limited: 429,
 	too_large: 413,
 	invalid_image: 422,
+	// 502 deliberately: an upstream that failed IS a server fault and belongs in
+	// the error rollup.
 	unavailable: 502
 };
 
@@ -170,7 +178,7 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		// button failing silently. The marker records WHICH key was refused, so a
 		// refusal against the deploy secret is never shown against a stored one.
 		// The marker is a convenience for the settings page, not part of the
-		// answer: a failed write must not turn a typed 502 into a 500 the caller
+		// answer: a failed write must not turn a typed 424 into a 500 the caller
 		// can't read. Nothing about the write's error names the body or the key.
 		if (result.reason === 'key_refused') {
 			try {
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index 8d1ec066..4ba03bfa 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -475,15 +475,17 @@ describe('artist-lookup — stored image by id', () => {
 });
 
 describe('artist-lookup — failure mapping and the refused marker', () => {
-	// 502, not 401: the admin gate answers an expired session with its own 401
+	// 424, not 401: the admin gate answers an expired session with its own 401
 	// and a plain-text body, so a 401 here would be indistinguishable from a
-	// logged-out admin and the caller's res.json() would throw.
-	it('records the refusal on a 502 and clears it on the next success', async () => {
+	// logged-out admin and the caller's res.json() would throw. And not a 5xx,
+	// which hooks.server.ts counts into the operator's error rollup — see the
+	// status-floor test below.
+	it('records the refusal on a 424 and clears it on the next success', async () => {
 		const { db, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
 		searchImage.mockResolvedValue({ ok: false, reason: 'key_refused' });
 
 		const refused = await POST(multipartEvent(platform, pngFile()));
-		expect(refused.status).toBe(502);
+		expect(refused.status).toBe(424);
 		expect(await refused.json()).toEqual({ enabled: true, error: 'key_refused' });
 		// The source rides along with the date: this refusal was the deploy
 		// secret's, and the settings card must not blame a stored key for it.
@@ -562,7 +564,7 @@ describe('artist-lookup — failure mapping and the refused marker', () => {
 	});
 
 	// The marker is a convenience for the settings card, not the answer. A D1
-	// write that fails must not turn the typed 502 into a 500 whose body the
+	// write that fails must not turn the typed 424 into a 500 whose body the
 	// caller's res.json() can't read, nor cost a successful lookup its matches.
 	it('still answers key_refused when the marker cannot be written', async () => {
 		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
@@ -571,7 +573,7 @@ describe('artist-lookup — failure mapping and the refused marker', () => {
 
 		const res = await POST(multipartEvent(platform, pngFile()));
 
-		expect(res.status).toBe(502);
+		expect(res.status).toBe(424);
 		expect(await res.json()).toEqual({ enabled: true, error: 'key_refused' });
 	});
 
@@ -602,6 +604,21 @@ describe('artist-lookup — failure mapping and the refused marker', () => {
 			expect(await res.json()).toEqual({ enabled: true, error: reason });
 		}
 	});
+
+	// hooks.server.ts counts EVERY response with status >= 500 into the
+	// operator's error rollup, so a misconfigured key must not answer 5xx: it
+	// would fill the observability panel with server errors on every click.
+	it('keeps a refused key out of the error rollup', async () => {
+		const { platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		searchImage.mockResolvedValue({ ok: false, reason: 'key_refused' });
+
+		const res = await POST(multipartEvent(platform, pngFile()));
+
+		expect(res.status).toBeLessThan(500);
+		// Still distinguishable from the admin gate's own 401 and 400.
+		expect(res.status).not.toBe(401);
+		expect(res.status).not.toBe(400);
+	});
 });
 
 describe('artist-lookup — source-post clash', () => {

From 11ca46708981ca79a55ca587e8fed6ab56549742 Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 21:49:50 -0700
Subject: [PATCH 36/38] test(theme-contrast): measure the lookup remove hover
 against the rule's own foreground (SONA-156)

---
 src/lib/theme-contrast.test.ts | 49 +++++++++++++++++++++++++---------
 1 file changed, 37 insertions(+), 12 deletions(-)

diff --git a/src/lib/theme-contrast.test.ts b/src/lib/theme-contrast.test.ts
index 0cb4bf73..20f1aa28 100644
--- a/src/lib/theme-contrast.test.ts
+++ b/src/lib/theme-contrast.test.ts
@@ -926,31 +926,55 @@ describe('no accent-color override on form controls (SONA-172)', () => {
 // measure the label against it, so any fill that clears AA passes and any that
 // doesn't fails, whatever it is spelled as.
 describe('SONA-156 Remove-key label on its hover fill', () => {
-	/** The `background-color` the hovered button actually paints, as written. */
-	function removeHoverFill(): string {
+	/** The body of a `.lookup-section .btn-remove` rule, as written. */
+	function removeRule(suffix: string): string {
 		const source = readFileSync(
 			fileURLToPath(new URL('../routes/admin/settings/+page.svelte', import.meta.url)),
 			'utf8'
 		);
-		const body = source.match(/^\s*\.lookup-section \.btn-remove:hover\s*\{([^}]*)\}/m)?.[1];
-		if (!body) throw new Error('.lookup-section .btn-remove:hover rule not found');
-		const fill = body.match(/background-color:\s*([^;]+);/)?.[1].trim();
+		const body = source.match(
+			new RegExp(`^\\s*\\.lookup-section \\.btn-remove${suffix}\\s*\\{([^}]*)\\}`, 'm')
+		)?.[1];
+		if (!body) throw new Error(`.lookup-section .btn-remove${suffix} rule not found`);
+		return body;
+	}
+
+	/** The `background-color` the hovered button actually paints, as written. */
+	function removeHoverFill(): string {
+		const fill = removeRule(':hover')
+			.match(/background-color:\s*([^;]+);/)?.[1]
+			.trim();
 		// No fill of its own means the button inherits .btn-outline's hover mix,
 		// which is the pairing this block exists to keep it away from.
 		if (!fill) throw new Error('.lookup-section .btn-remove:hover sets no background-color');
 		return fill;
 	}
 
+	/**
+	 * The label color the hovered button paints. The hover rule may set its own
+	 * `color`; when it doesn't, the base rule's `color` still applies, so the
+	 * measurement follows whichever one the button actually wears.
+	 */
+	function removeHoverColor(): string {
+		const declared = (body: string) =>
+			body
+				.match(/(?:^|[;{\s])color:\s*([^;]+);/)?.[1]
+				.trim();
+		const color = declared(removeRule(':hover')) ?? declared(removeRule(''));
+		if (!color) throw new Error('.lookup-section .btn-remove declares no color');
+		return color;
+	}
+
 	// A token, or a srgb color-mix of one toward black, white or another token —
-	// the two shapes the app's hover fills use. Anything else throws rather than
-	// passing unmeasured.
-	function resolveFill(value: string, sel: string): string {
+	// the two shapes the app's hover fills and labels use. Anything else throws
+	// rather than passing unmeasured.
+	function resolveColor(value: string, sel: string): string {
 		const token = value.match(/^var\(--([\w-]+)\)$/);
 		if (token) return blockToken(sel, token[1]);
 		const mixed = value.match(
 			/^color-mix\(in srgb,\s*var\(--([\w-]+)\)\s*(\d+)%,\s*(black|white|var\(--[\w-]+\))\)$/
 		);
-		if (!mixed) throw new Error(`cannot resolve the hover fill "${value}" to a color`);
+		if (!mixed) throw new Error(`cannot resolve "${value}" to a color`);
 		const base = blockToken(sel, mixed[1]);
 		const pct = Number(mixed[2]);
 		const toward = mixed[3];
@@ -959,9 +983,10 @@ describe('SONA-156 Remove-key label on its hover fill', () => {
 	}
 
 	for (const { name, sel } of THEME_BLOCKS) {
-		it(`${name}: destructive label on the hovered fill meets 4.5:1`, () => {
-			const fill = resolveFill(removeHoverFill(), sel);
-			expect(contrast(blockToken(sel, 'destructive'), fill)).toBeGreaterThanOrEqual(4.5);
+		it(`${name}: the label on the hovered fill meets 4.5:1`, () => {
+			const fill = resolveColor(removeHoverFill(), sel);
+			const label = resolveColor(removeHoverColor(), sel);
+			expect(contrast(label, fill)).toBeGreaterThanOrEqual(4.5);
 		});
 	}
 });

From f20ad6bdc24372ff5e494a838f639355956a419e Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Tue, 8 Sep 2026 00:59:28 -0700
Subject: [PATCH 37/38] fix(artist-lookup): sniff stored image bytes before
 sending them to FuzzySearch (SONA-156)

---
 src/routes/api/admin/artist-lookup/+server.ts | 18 +++++++++-
 .../api/admin/artist-lookup/server.test.ts    | 36 +++++++++++++++++++
 2 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/src/routes/api/admin/artist-lookup/+server.ts b/src/routes/api/admin/artist-lookup/+server.ts
index 6c149727..08915760 100644
--- a/src/routes/api/admin/artist-lookup/+server.ts
+++ b/src/routes/api/admin/artist-lookup/+server.ts
@@ -75,6 +75,14 @@ function failure(reason: LookupFailure) {
 	return json({ enabled: true, error: reason }, { status: FAILURE_STATUS[reason] });
 }
 
+/** Whether the leading bytes ARE one of the raster types on the allowlist.
+ * Both request shapes get their type from someone else's word for it — the
+ * browser's file.type, the upstream's Content-Type — so both hold the bytes
+ * themselves to the same gate before anything reaches FuzzySearch. */
+function hasAllowedImageBytes(head: Uint8Array): boolean {
+	return isAllowedImageType(sniffImageType(head));
+}
+
 /** Artists whose stored socials or display name point at a match, per match. */
 interface ArtistHit {
 	matchIndex: number;
@@ -121,7 +129,7 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		// against the allowlist too (SNIFF_BYTES window, as in /api/upload).
 		if (!isAllowedImageType(file.type)) return failure('invalid_image');
 		const head = new Uint8Array(await file.slice(0, SNIFF_BYTES).arrayBuffer());
-		if (!isAllowedImageType(sniffImageType(head))) return failure('invalid_image');
+		if (!hasAllowedImageBytes(head)) return failure('invalid_image');
 		bytes = file;
 	} else {
 		const body = (await request.json().catch(() => null)) as { imageId?: unknown } | null;
@@ -159,6 +167,14 @@ export const POST: RequestHandler = async ({ request, platform, fetch }) => {
 		}
 		try {
 			const buffered = await bufferStream(stored.body, FUZZYSEARCH_MAX_BYTES);
+			// The header above is only the upstream's claim, the same way file.type
+			// is the browser's, so the bytes get the same sniff the multipart branch
+			// gives them: a response labelled image/png carrying a PDF is refused
+			// here rather than uploaded to a third party. invalid_image, not
+			// unavailable — the fetch worked, the content is what's wrong.
+			if (!hasAllowedImageBytes(buffered.subarray(0, SNIFF_BYTES))) {
+				return failure('invalid_image');
+			}
 			// bufferStream allocates an exact-size array, so its backing buffer is
 			// the payload with nothing else in it. The validated type rides along so
 			// the multipart part FuzzySearch receives from the edit page looks like
diff --git a/src/routes/api/admin/artist-lookup/server.test.ts b/src/routes/api/admin/artist-lookup/server.test.ts
index 4ba03bfa..448d1140 100644
--- a/src/routes/api/admin/artist-lookup/server.test.ts
+++ b/src/routes/api/admin/artist-lookup/server.test.ts
@@ -472,6 +472,42 @@ describe('artist-lookup — stored image by id', () => {
 		expect(await res.json()).toEqual({ enabled: true, error: 'unavailable' });
 		expect(searchImage).not.toHaveBeenCalled();
 	});
+
+	// The upstream Content-Type is its own word for the bytes, so an origin (or
+	// a stored URL pointed somewhere else) can label a PDF image/png. The bytes
+	// get the same sniff an uploaded file gets, and nothing is sent.
+	it('refuses a stored image whose bytes are not the type the upstream declares', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.png', '2026-01-01');`
+		);
+		const spoofed = new Response('%PDF-1.7 not a png', {
+			status: 200,
+			headers: { 'content-type': 'image/png' }
+		});
+
+		const res = await POST(jsonEvent(platform, { imageId: 1 }, imageFetch(spoofed).fn));
+
+		expect(res.status).toBe(422);
+		expect(await res.json()).toEqual({ enabled: true, error: 'invalid_image' });
+		expect(searchImage).not.toHaveBeenCalled();
+	});
+
+	// The other side of the sniff: real PNG bytes behind a valid header still go
+	// out, so the check above can't be satisfied by refusing everything.
+	it('sends a stored image whose bytes match the declared type', async () => {
+		const { sqlite, platform } = makeEnv({ FUZZYSEARCH_API_KEY: 'k' });
+		sqlite.exec(
+			`INSERT INTO images (id, title, slug, image_url, created_at)
+			 VALUES (1, 'Ref', 'ref', 'https://cdn.example.com/stored.png', '2026-01-01');`
+		);
+
+		const res = await POST(jsonEvent(platform, { imageId: 1 }));
+
+		expect(res.status).toBe(200);
+		expect((searchImage.mock.calls[0][0] as Blob).type).toBe('image/png');
+	});
 });
 
 describe('artist-lookup — failure mapping and the refused marker', () => {

From 4f47d713db7da5b5452874a7d44a4725d822dbef Mon Sep 17 00:00:00 2001
From: Sparky <1609870+sparkyfen@users.noreply.github.com>
Date: Tue, 8 Sep 2026 03:04:20 -0700
Subject: [PATCH 38/38] fix(settings): keep the stored key's mask off the page
 while a deploy secret is in use (SONA-156)

---
 src/routes/admin/settings/+page.server.ts     | 11 ++++++++---
 src/routes/admin/settings/page.server.test.ts | 16 ++++++++++++++++
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/src/routes/admin/settings/+page.server.ts b/src/routes/admin/settings/+page.server.ts
index d4d75eea..9ad54af2 100644
--- a/src/routes/admin/settings/+page.server.ts
+++ b/src/routes/admin/settings/+page.server.ts
@@ -336,9 +336,14 @@ export const load: PageServerLoad = async ({ platform, url, locals }) => {
 		registryHasSecret: !!platform?.env?.REGISTRY_API_KEY,
 		fuzzysearchKeySet: fuzzysearchKeyFromEnv || !!fuzzysearchStoredKey,
 		fuzzysearchKeyFromEnv,
-		fuzzysearchKeyRecord: fuzzysearchStoredKey
-			? fuzzysearchKeyDisplayRecord(fuzzysearchStoredKey)
-			: null,
+		// The deploy secret wins, and while it does the card shows the secret's own
+		// line instead of a mask — so the stored key's last four have no reader and
+		// no business in the payload. Gated here rather than in the markup: a field
+		// the page never renders still ships in the SSR data blob.
+		fuzzysearchKeyRecord:
+			!fuzzysearchKeyFromEnv && fuzzysearchStoredKey
+				? fuzzysearchKeyDisplayRecord(fuzzysearchStoredKey)
+				: null,
 		// Pre-formatted here, like the early-access GA dates, so the card renders
 		// one date string identically on SSR and after hydration. Only for a key
 		// saved HERE, and only when THAT key is the one that was refused: a
diff --git a/src/routes/admin/settings/page.server.test.ts b/src/routes/admin/settings/page.server.test.ts
index b80c6737..fc55e1a0 100644
--- a/src/routes/admin/settings/page.server.test.ts
+++ b/src/routes/admin/settings/page.server.test.ts
@@ -1995,6 +1995,22 @@ describe('settings — FuzzySearch key', () => {
 		expect(JSON.stringify(result)).not.toContain('fromdeploy');
 	});
 
+	it('keeps the stored key out of the payload while the deploy secret is in use', async () => {
+		const { db, platform } = makeLoadDb({ FUZZYSEARCH_API_KEY: 'fs-live-fromdeploy' });
+		await setRawSetting(db, FUZZYSEARCH_API_KEY_SETTING, 'fs-live-abcdef3k9q');
+
+		const result = (await load(loadEvent(platform))) as unknown as Record<string, unknown>;
+
+		expect(result.fuzzysearchKeyFromEnv).toBe(true);
+		// Nothing derived from the dormant stored key travels — not the mask, not
+		// its last four — but the page still knows a key exists here.
+		expect(result.fuzzysearchKeyRecord).toBeNull();
+		expect(result.fuzzysearchKeySet).toBe(true);
+		const payload = JSON.stringify(result);
+		expect(payload).not.toContain('3k9q');
+		expect(payload).not.toContain('fromdeploy');
+	});
+
 	it('surfaces a formatted refusal date only while a key is saved', async () => {
 		const { db, platform } = makeLoadDb();
 		await setRawSetting(