handlers: image/reindex/auth via use cases; auth::authenticate replaces ensure_active; check-handler-services guard

Reviewed-on: #26

.dockerignore

@@ -11,3 +11,13 @@ spa/node_modules/
 spa/dist/
 spa/.env
 spa/.env.local
+.sqlx/
+.superpowers/
+.worktrees/
+.claude/
+.github/
+.gitea/
+imgs/
+screenshots/
+test_data/
+*.md

.gitea/workflows/ci.yml

@@ -23,14 +23,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
+        uses: Swatinem/rust-cache@v2
 
       - name: fmt
         run: cargo fmt --all -- --check
@@ -39,7 +32,7 @@ jobs:
         run: cargo clippy --workspace --all-targets -- -D warnings
 
       - name: test
-        run: cargo test
+        run: cargo test --workspace
 
       - name: test (federation off)
         run: cargo test --workspace --no-default-features
@@ -47,4 +40,4 @@ jobs:
       # Layering guards. These live in the Makefile and were previously local-only,
       # so a PR could go green in CI while violating them.
       - name: guards
-        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
+        run: make check-appcontext check-handler-deps check-handler-repos check-handler-services check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-federation-off-deps check-nats-isolated check-no-second-web-stack

.github/workflows/ci.yml

@@ -23,14 +23,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
+        uses: Swatinem/rust-cache@v2
 
       - name: fmt
         run: cargo fmt --all -- --check
@@ -39,7 +32,7 @@ jobs:
         run: cargo clippy --workspace --all-targets -- -D warnings
 
       - name: test
-        run: cargo test
+        run: cargo test --workspace
 
       - name: test (federation off)
         run: cargo test --workspace --no-default-features
@@ -47,7 +40,7 @@ jobs:
       # Layering guards. These live in the Makefile and were previously local-only,
       # so a PR could go green in CI while violating them.
       - name: guards
-        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
+        run: make check-appcontext check-handler-deps check-handler-repos check-handler-services check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-federation-off-deps check-nats-isolated check-no-second-web-stack
 
   docker:
     name: Build & Push Docker Image
@@ -61,6 +54,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
@@ -87,3 +83,5 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: FEATURES=federation
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

CONTRIBUTING.md

@@ -26,7 +26,7 @@ cd spa && bun install && bun run dev
 make check     # the full gate; plain `make` runs it too
 ```
 
-`make check` runs, in order: `fmt-check`, `clippy` (workspace, all targets, `-D warnings`), `test`, `test-federation-off` (workspace tests with default features off), then the layering guards (`check-appcontext`, `check-handler-deps`, `check-handler-repos`, `check-http-adapter-deps`, `check-federation-off-social`, `check-sqlite-is-ap-free`, `check-binaries-are-thin`, `check-dockerfile-manifests`). CI runs the same steps.
+`make check` runs, in order: `fmt-check`, `clippy` (workspace, all targets, `-D warnings`), `test`, `test-federation-off` (workspace tests with default features off), then the layering guards (`check-appcontext`, `check-handler-deps`, `check-handler-repos`, `check-handler-services`, `check-http-adapter-deps`, `check-federation-off-social`, `check-sqlite-is-ap-free`, `check-binaries-are-thin`, `check-federation-off-deps`, `check-nats-isolated`, `check-no-second-web-stack`). CI runs the same steps.
 
 For the SPA also run:
 
@@ -57,6 +57,8 @@ spa/           → React SPA (TanStack Router + shadcn/ui)
 
 Cargo features: `federation` (default; ActivityPub) and `nats`. `sqlite` and `sqlite-federation` remain as deprecated aliases so old build commands keep working.
 
+**Dependencies.** Every external crate is declared once in the root `[workspace.dependencies]`, usually with `default-features = false`; member crates write `foo = { workspace = true, features = [...] }` and enable only the features they use. A new crate goes into both `members` and `default-members` in the root `Cargo.toml` (only `tui` is left out of `default-members`). `cargo machete` should stay clean, and each crate must compile on its own (`cargo check -p <crate> --all-targets`), not just through feature unification in the binaries.
+
 ### Adding a new feature
 
 1. **Domain first** — models in `domain/src/models/`, ports in `domain/src/ports/`, events in `domain/src/events.rs`

Cargo.lock

@@ -757,7 +757,7 @@ dependencies = [
  "object-storage",
  "poster-fetcher",
  "reqwest 0.13.3",
- "rss 0.1.0",
+ "rss-adapter",
  "rustls",
  "serde_json",
  "sqlite",
@@ -2022,11 +2022,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -2036,11 +2034,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
  "wasip2",
  "wasip3",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2220,7 +2220,6 @@ dependencies = [
  "tower-http",
  "tracing",
  "utoipa",
- "utoipa-scalar",
  "utoipa-swagger-ui",
  "uuid",
 ]
@@ -2932,9 +2931,9 @@ dependencies = [
 
 [[package]]
 name = "lru-slab"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
 
 [[package]]
 name = "mac"
@@ -3053,6 +3052,7 @@ dependencies = [
  "config",
  "domain",
  "reqwest 0.13.3",
+ "rustls",
  "serde",
 ]
 
@@ -3749,6 +3749,7 @@ dependencies = [
  "config",
  "domain",
  "reqwest 0.13.3",
+ "rustls",
 ]
 
 [[package]]
@@ -3862,9 +3863,9 @@ dependencies = [
 
 [[package]]
 name = "quinn"
-version = "0.11.9"
+version = "0.11.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11"
 dependencies = [
  "bytes",
  "cfg_aliases",
@@ -3882,14 +3883,15 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "bytes",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "lru-slab",
- "rand 0.9.4",
+ "rand 0.10.1",
+ "rand_pcg",
  "ring",
  "rustc-hash",
  "rustls",
@@ -3903,16 +3905,16 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.14"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+checksum = "af66907df18639dcf4db56ca65490cabc4b27a97dbadd96f2926cca73298f016"
 dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4012,6 +4014,15 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "ratatui"
 version = "0.30.0"
@@ -4343,15 +4354,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "rss"
-version = "0.1.0"
-dependencies = [
- "chrono",
- "domain",
- "rss 2.0.13",
-]
-
 [[package]]
 name = "rss"
 version = "2.0.13"
@@ -4363,6 +4365,15 @@ dependencies = [
  "quick-xml 0.39.4",
 ]
 
+[[package]]
+name = "rss-adapter"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "domain",
+ "rss",
+]
+
 [[package]]
 name = "rust-embed"
 version = "8.11.0"
@@ -5456,9 +5467,9 @@ dependencies = [
 
 [[package]]
 name = "thread_local"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
 dependencies = [
  "cfg-if",
 ]
@@ -5530,6 +5541,7 @@ dependencies = [
  "config",
  "domain",
  "reqwest 0.13.3",
+ "rustls",
  "serde",
 ]
 
@@ -6005,18 +6017,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "utoipa-scalar"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59559e1509172f6b26c1cdbc7247c4ddd1ac6560fe94b584f81ee489b141f719"
-dependencies = [
- "axum",
- "serde",
- "serde_json",
- "utoipa",
-]
-
 [[package]]
 name = "utoipa-swagger-ui"
 version = "9.0.2"
@@ -6437,7 +6437,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6547,15 +6547,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -6589,30 +6580,13 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
+ "windows_i686_gnullvm",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -6625,12 +6599,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -6643,12 +6611,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -6661,24 +6623,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -6691,12 +6641,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -6709,12 +6653,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -6727,12 +6665,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -6745,12 +6677,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winnow"
 version = "0.7.15"

Cargo.toml

@@ -1,11 +1,37 @@
 [workspace]
+default-members = [
+    "crates/adapters/auth",
+    "crates/adapters/event-publisher",
+    "crates/adapters/metadata",
+    "crates/adapters/poster-fetcher",
+    "crates/adapters/object-storage",
+    "crates/adapters/rss-adapter",
+    "crates/adapters/sqlite",
+    "crates/adapters/sqlite-federation",
+    "crates/adapters/activitypub",
+    "crates/adapters/export",
+    "crates/adapters/nats",
+    "crates/adapters/tmdb-enrichment",
+    "crates/adapters/image-converter",
+    "crates/adapters/http-axum",
+    "crates/adapters/importer",
+    "crates/adapters/media-server",
+    "crates/event-payload",
+    "crates/api-types",
+    "crates/application",
+    "crates/domain",
+    "crates/bootstrap",
+    "crates/server",
+    "crates/worker",
+    "crates/config",
+]
 members = [
     "crates/adapters/auth",
     "crates/adapters/event-publisher",
     "crates/adapters/metadata",
     "crates/adapters/poster-fetcher",
     "crates/adapters/object-storage",
-    "crates/adapters/rss",
+    "crates/adapters/rss-adapter",
     "crates/adapters/sqlite",
     "crates/adapters/sqlite-federation",
     "crates/adapters/activitypub",
@@ -32,20 +58,20 @@ resolver = "2"
 edition = "2024"
 
 [workspace.dependencies]
-tokio = { version = "1.0", features = ["macros", "net", "rt", "rt-multi-thread", "sync", "time"] }
+tokio = { version = "1.0", default-features = false }
 bytes = "1"
 futures = "0.3"
 async-stream = "0.3"
 dotenvy = "0.15"
-serde = { version = "1.0", features = ["derive"] }
+serde = { version = "1.0", default-features = false, features = ["std"] }
 serde_json = "1.0"
 anyhow = "1.0"
 thiserror = "2.0"
 tracing = "0.1"
-tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
+tracing-subscriber = { version = "0.3.23", default-features = false }
 async-trait = "0.1.92"
-uuid = { version = "1.23.0", features = ["v4", "v5", "serde"] }
-chrono = { version = "0.4", features = ["serde"] }
+uuid = { version = "1.23.0", default-features = false, features = ["std"] }
+chrono = { version = "0.4", default-features = false, features = ["std"] }
 chrono-tz = "0.10"
 sqlx = { version = "0.8.6", default-features = false, features = [
     "runtime-tokio",
@@ -59,10 +85,38 @@ tempfile = "3"
 reqwest = { version = "0.13", default-features = false, features = ["json", "query", "charset", "http2", "system-proxy", "rustls-no-provider"] }
 sha2 = "0.10"
 hex = "0.4"
-object_store = { version = "0.11", features = ["aws"] }
-axum = { version = "0.8.8", features = ["macros", "multipart"] }
+object_store = { version = "0.11", default-features = false, features = ["aws"] }
+axum = { version = "0.8.8", default-features = false }
 csv = "1"
 figment = { version = "0.10", features = ["toml"] }
+rustls = { version = "0.23", default-features = false }
+tower = { version = "0.5", default-features = false }
+tower-http = { version = "0.6.8", default-features = false }
+utoipa = "5.5.0"
+utoipa-swagger-ui = "9.0.2"
+askama = "0.16.0"
+infer = "0.19.0"
+percent-encoding = "2"
+axum-governor = "2"
+email_address = "0.2.9"
+jsonwebtoken = "9"
+argon2 = { version = "0.5", default-features = false }
+rand_core = { version = "0.6", default-features = false }
+async-nats = "0.48.0"
+k-ap = { version = "0.5.1", registry = "gitea" }
+url = "2"
+ammonia = "4"
+calamine = "0.35"
+image = { version = "0.25", default-features = false }
+ravif = { version = "0.11", default-features = false }
+webp = "0.3"
+rss = { version = "2" }
+ratatui = "0.30.0"
+keyring-core = "1.0.0"
+apple-native-keyring-store = { version = "1.0.0", features = ["keychain"] }
+zbus-secret-service-keyring-store = { version = "1.0.0" }
+windows-native-keyring-store = { version = "1.0.0" }
+directories = "6"
 
 api-types = { path = "crates/api-types" }
 domain = { path = "crates/domain" }
@@ -75,7 +129,7 @@ metadata = { path = "crates/adapters/metadata" }
 poster-fetcher = { path = "crates/adapters/poster-fetcher" }
 object-storage = { path = "crates/adapters/object-storage" }
 event-publisher = { path = "crates/adapters/event-publisher" }
-rss = { path = "crates/adapters/rss" }
+rss-adapter = { path = "crates/adapters/rss-adapter" }
 export = { path = "crates/adapters/export" }
 sqlite = { path = "crates/adapters/sqlite" }
 sqlite-federation = { path = "crates/adapters/sqlite-federation" }
@@ -92,3 +146,7 @@ debug = 1                    # line tables only — still debuggable, much faste
 
 [profile.dev.package."*"]
 opt-level = 2                # compile deps faster at runtime; paid once, cached after
+
+[profile.release]
+codegen-units = 1
+strip = true

Dockerfile

@@ -6,67 +6,41 @@ RUN npm ci
 COPY spa/ .
 RUN npm run build
 
-# ----- build -----
-FROM rust:slim-bookworm AS builder
-
-WORKDIR /build
-
-# Cache dependency compilation separately from source
-#
-# Every workspace member's Cargo.toml must be listed here by hand — `cargo fetch`
-# below reads the whole workspace graph, so a missing manifest fails the build with
-# "failed to read .../Cargo.toml". Adding a crate to crates/ means adding a line here.
-COPY Cargo.toml Cargo.lock ./
-COPY .cargo ./.cargo
-COPY crates/adapters/activitypub/Cargo.toml       crates/adapters/activitypub/Cargo.toml
-COPY crates/adapters/auth/Cargo.toml              crates/adapters/auth/Cargo.toml
-COPY crates/event-payload/Cargo.toml              crates/event-payload/Cargo.toml
-COPY crates/adapters/event-publisher/Cargo.toml   crates/adapters/event-publisher/Cargo.toml
-COPY crates/adapters/nats/Cargo.toml              crates/adapters/nats/Cargo.toml
-COPY crates/adapters/metadata/Cargo.toml          crates/adapters/metadata/Cargo.toml
-COPY crates/adapters/poster-fetcher/Cargo.toml    crates/adapters/poster-fetcher/Cargo.toml
-COPY crates/adapters/object-storage/Cargo.toml     crates/adapters/object-storage/Cargo.toml
-COPY crates/adapters/export/Cargo.toml            crates/adapters/export/Cargo.toml
-COPY crates/adapters/importer/Cargo.toml          crates/adapters/importer/Cargo.toml
-COPY crates/adapters/media-server/Cargo.toml      crates/adapters/media-server/Cargo.toml
-COPY crates/adapters/rss/Cargo.toml               crates/adapters/rss/Cargo.toml
-COPY crates/adapters/sqlite/Cargo.toml              crates/adapters/sqlite/Cargo.toml
-COPY crates/adapters/sqlite-federation/Cargo.toml   crates/adapters/sqlite-federation/Cargo.toml
-COPY crates/api-types/Cargo.toml                  crates/api-types/Cargo.toml
-COPY crates/application/Cargo.toml                crates/application/Cargo.toml
-COPY crates/adapters/tmdb-enrichment/Cargo.toml   crates/adapters/tmdb-enrichment/Cargo.toml
-COPY crates/domain/Cargo.toml                     crates/domain/Cargo.toml
-COPY crates/bootstrap/Cargo.toml                   crates/bootstrap/Cargo.toml
-COPY crates/adapters/http-axum/Cargo.toml          crates/adapters/http-axum/Cargo.toml
-COPY crates/server/Cargo.toml                     crates/server/Cargo.toml
-COPY crates/tui/Cargo.toml                        crates/tui/Cargo.toml
-COPY crates/adapters/image-converter/Cargo.toml   crates/adapters/image-converter/Cargo.toml
-COPY crates/worker/Cargo.toml                     crates/worker/Cargo.toml
-COPY crates/config/Cargo.toml                     crates/config/Cargo.toml
-
-# Stub every crate so cargo can resolve and fetch deps
-RUN find crates -name "Cargo.toml" | sed 's|/Cargo.toml||' | \
-    xargs -I{} sh -c 'mkdir -p {}/src && echo "fn main(){}" > {}/src/main.rs && echo "" > {}/src/lib.rs'
-
+# ----- chef base -----
+FROM rust:slim-bookworm AS chef
 # libwebp-dev: required at build time by the `webp` crate (C bindings)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     libwebp-dev \
     pkg-config \
  && rm -rf /var/lib/apt/lists/*
+RUN cargo install cargo-chef --locked --version 0.1.78
+WORKDIR /build
 
-RUN cargo fetch
+FROM chef AS planner
+COPY . .
+RUN cargo chef prepare --recipe-path recipe.json
 
-# Now copy real sources (invalidates cache only on source changes)
-COPY crates ./crates
+# ----- build -----
+FROM chef AS builder
 
-# All sqlx queries use the runtime API (no query! macros), so no database
-# or .sqlx cache is needed at compile time.
-#
 # Features: federation (ActivityPub), nats (EVENT_BUS_BACKEND=nats).
 # Build without federation:  --build-arg FEATURES=
 # To add NATS support:       --build-arg FEATURES=federation,nats
 ARG FEATURES=federation
-RUN cargo build --release -p server -p worker --no-default-features --features "${FEATURES}"
+
+COPY .cargo ./.cargo
+COPY --from=planner /build/recipe.json recipe.json
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
+    cargo chef cook --release -p server -p worker --no-default-features --features "${FEATURES}" --recipe-path recipe.json
+
+# All sqlx queries use the runtime API (no query! macros), so no database
+# or .sqlx cache is needed at compile time.
+COPY Cargo.toml Cargo.lock ./
+COPY crates ./crates
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
+    cargo build --release -p server -p worker --no-default-features --features "${FEATURES}"
 
 # ----- runtime -----
 FROM debian:bookworm-slim

Makefile

@@ -1,6 +1,6 @@
 .DEFAULT_GOAL := check
 
-check: fmt-check clippy test test-federation-off check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
+check: fmt-check clippy test test-federation-off check-appcontext check-handler-deps check-handler-repos check-handler-services check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-federation-off-deps check-nats-isolated check-no-second-web-stack
 	@echo "✅ All checks passed"
 
 check-appcontext:
@@ -30,6 +30,16 @@ check-handler-repos:
 
 HTTP_ADAPTER_ALLOWED_ADAPTERS :=
 
+check-handler-services:
+	@hits=$$(find crates/adapters/http-axum/src -name '*.rs' -not -path '*/tests/*' -not -name tests.rs \
+	    | xargs perl -0ne 'while (/app_ctx\s*\.\s*services\s*\.\s*([a-z_]+)/g) { print "$$ARGV: services.$$1\n" unless $$1 eq "review_logger" }'); \
+	if [ -n "$$hits" ]; then \
+	    echo "❌ http-axum reaches a service port directly (call a use case instead):"; \
+	    echo "$$hits"; \
+	    exit 1; \
+	fi; \
+	echo "✅ No direct service-port calls in http-axum"
+
 check-http-adapter-deps:
 	@deps=$$(awk '/^\[dependencies\]/{f=1;next} /^\[/{f=0} f' crates/adapters/http-axum/Cargo.toml \
 	    | sed -n 's/^\([A-Za-z0-9_-]\{1,\}\)[[:space:]]*=.*/\1/p'); \
@@ -87,21 +97,43 @@ check-sqlite-is-ap-free:
 	fi
 	@echo "✅ sqlite crate depends on no k-ap, activitypub, or *-federation crate"
 
-check-dockerfile-manifests:
-	@members=$$(awk '/^members = \[/{f=1;next} f&&/^\]/{f=0} f' Cargo.toml | sed -n 's/^[[:space:]]*"\(.*\)",\{0,1\}[[:space:]]*$$/\1/p'); \
-	copied=$$(sed -n 's/^COPY \([^[:space:]]*\)\/Cargo\.toml[[:space:]].*/\1/p' Dockerfile | grep -v '^\(Cargo\.toml\|\.\)$$' || true); \
-	bad=""; \
-	for m in $$members; do \
-	    echo "$$copied" | grep -qxF "$$m" || bad="$$bad missing-COPY:$$m"; \
-	done; \
-	for c in $$copied; do \
-	    echo "$$members" | grep -qxF "$$c" || bad="$$bad not-a-member:$$c"; \
-	done; \
-	if [ -n "$$bad" ]; then \
-	    echo "❌ Dockerfile manifest COPY lines out of sync with workspace members:$$bad"; \
+CARGO_TREE_NAMES := cargo tree -p server -p worker -e normal --prefix none
+
+check-federation-off-deps:
+	@tree=$$($(CARGO_TREE_NAMES) --no-default-features) || exit 1; \
+	hits=$$(echo "$$tree" | grep -E '^(k-ap|activitypub_federation|activitypub|sqlite-federation) ' | sort -u); \
+	if [ -n "$$hits" ]; then \
+	    echo "❌ federation-only crates in the --no-default-features server/worker tree:"; \
+	    echo "$$hits"; \
 	    exit 1; \
 	fi; \
-	echo "✅ Dockerfile copies a manifest for every workspace member"
+	echo "✅ federation-off tree has no k-ap, activitypub_federation, activitypub, or sqlite-federation"
+
+check-nats-isolated:
+	@tree=$$($(CARGO_TREE_NAMES)) || exit 1; \
+	nats_tree=$$($(CARGO_TREE_NAMES) --features nats) || exit 1; \
+	if echo "$$tree" | grep -qE '^(async-nats|nats) '; then \
+	    echo "❌ nats crates in the default server/worker tree:"; \
+	    echo "$$tree" | grep -E '^(async-nats|nats) ' | sort -u; \
+	    exit 1; \
+	fi; \
+	if ! echo "$$nats_tree" | grep -qE '^async-nats '; then \
+	    echo "❌ async-nats missing from the --features nats server/worker tree — feature is not wired"; \
+	    exit 1; \
+	fi; \
+	echo "✅ async-nats only appears with --features nats"
+
+check-no-second-web-stack:
+	@for f in "" "--features nats"; do \
+	    tree=$$($(CARGO_TREE_NAMES) $$f) || exit 1; \
+	    hits=$$(echo "$$tree" | grep -E '^(actix|aws-lc)' | sort -u); \
+	    if [ -n "$$hits" ]; then \
+	        echo "❌ actix/aws-lc crates in the server/worker tree ($${f:-default}):"; \
+	        echo "$$hits"; \
+	        exit 1; \
+	    fi; \
+	done; \
+	echo "✅ no actix-* or aws-lc-* in the default or nats server/worker tree"
 
 fmt:
 	cargo fmt
@@ -145,4 +177,4 @@ dev-spa:
 spa-dev:
 	@npm --prefix spa run dev
 
-.PHONY: check fmt fmt-check clippy test test-federation-off fix dev dev-stop dev-worker dev-spa spa-dev check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
+.PHONY: check fmt fmt-check clippy test test-federation-off fix dev dev-stop dev-worker dev-spa spa-dev check-appcontext check-handler-deps check-handler-repos check-handler-services check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-federation-off-deps check-nats-isolated check-no-second-web-stack

README.md

@@ -68,7 +68,7 @@ Open `http://localhost:3000`. The HTTP server and background worker start togeth
 - CSV and JSON diary export
 - File importer: upload CSV, TSV, JSON, or XLSX from any source (Letterboxd, IMDb, etc.), map columns to domain fields via a step-by-step wizard or REST API, save mapping profiles for repeat imports
 - REST API v1 (`/api/v1/`) with full feature parity with the HTML interface
-- OpenAPI documentation at `/docs` (Swagger UI) and `/scalar` (Scalar)
+- OpenAPI documentation at `/docs` (Swagger UI)
 - CSRF protection on all HTML form routes (double-submit cookie, defense-in-depth on top of `SameSite=Strict`)
 - Per-IP rate limiting via token bucket (production-grade, backed by `axum-governor`)
 - Single-page app at `/app/` — React + TanStack Router + shadcn/ui, built with Vite, served from the backend with client-side routing fallback
@@ -100,7 +100,7 @@ application         — use cases (commands + queries), business logic orchestra
 server              — thin HTTP binary (dotenv, config, bootstrap::build_server, axum::serve); features (federation, nats) forward to bootstrap
 worker              — thin worker binary (bootstrap::build_worker, run until ctrl-c)
 adapters/
-  http-axum            — Axum HTTP adapter: JSON API, classic HTML UI (askama templates), OpenAPI spec, Swagger UI + Scalar, federation-gated routes; library crate, no binary of its own
+  http-axum            — Axum HTTP adapter: JSON API, classic HTML UI (askama templates), OpenAPI spec, Swagger UI, federation-gated routes; library crate, no binary of its own
   auth                 — JWT issuance and validation (Argon2 passwords)
   sqlite               — SQLite repositories (one module per aggregate under repositories/), search (FTS5), social graph, durable event queue, connection factory + migrations; the only storage adapter
   metadata             — TMDB / OMDb HTTP client
@@ -174,6 +174,13 @@ Copy `.env.example` to `.env` and set the values you need. Malformed values (a n
 
 Build without federation with `--no-default-features`. `sqlite` and `sqlite-federation` are deprecated aliases kept so old build commands still work.
 
+### Build notes
+
+- `cargo build` / `cargo test` build every crate except the deprecated `tui`, which sits outside `default-members`. Use `-p tui` for it; `make check` and CI use `--workspace`, so it is still linted and tested.
+- Release builds use `codegen-units = 1` and `strip = true` (smaller binaries; thin LTO was measured and made builds slower and binaries larger, so it is off).
+- SQLite is compiled from source (bundled `libsqlite3-sys`), so the first clean build spends about a minute on it; incremental builds and the Docker/CI caches don't repeat that.
+- TLS uses rustls with the `ring` provider only; `aws-lc` and `actix` are kept out of the graph by `make check-no-second-web-stack`.
+
 The `worker` binary must run alongside `server` to process events:
 
 ```bash
@@ -198,7 +205,6 @@ All REST endpoints are under `/api/v1/`. Authentication uses `Authorization: Bea
 Interactive API documentation is available at runtime:
 
 - **Swagger UI** — `http://localhost:3000/docs`
-- **Scalar** — `http://localhost:3000/scalar`
 
 An [Insomnia](https://insomnia.rest/) collection covering all endpoints is included at [`movies-diary.insomnia.json`](movies-diary.insomnia.json). Import it via **File → Import**, set `base_url` and `token` in the environment, and you're ready to go.
 
@@ -273,7 +279,7 @@ docker run -p 3000:3000 --env-file .env -v movies-diary-data:/data movies-diary
 docker run --env-file .env -v movies-diary-data:/data --entrypoint ./worker movies-diary
 ```
 
-Default build enables `federation`; add NATS with `--build-arg FEATURES=federation,nats`. SQLite is the only database backend (see [ADR-0012](docs/adr/0012-sqlite-is-the-only-backend.md)).
+Default build enables `federation`; add NATS with `--build-arg FEATURES=federation,nats`. The Dockerfile uses [cargo-chef](https://github.com/LukeMathWalker/cargo-chef): dependencies are compiled in their own layer keyed on the manifests, so a source-only change rebuilds just the workspace crates. BuildKit cache mounts keep the cargo registry between builds. No Dockerfile edit is needed when a crate is added. SQLite is the only database backend (see [ADR-0012](docs/adr/0012-sqlite-is-the-only-backend.md)).
 
 ## Media Server Integration
 

crates/adapters/activitypub/Cargo.toml

@@ -5,20 +5,22 @@ edition.workspace = true
 
 [dependencies]
 config = { workspace = true }
-k-ap = { version = "0.5.1", registry = "gitea" }
+k-ap = { workspace = true }
 domain = { workspace = true }
 axum = { workspace = true }
-serde = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
-uuid = { workspace = true }
-chrono = { workspace = true }
+uuid = { workspace = true, features = ["v4", "serde"] }
+chrono = { workspace = true, features = ["clock", "serde"] }
 anyhow = { workspace = true }
 tracing = { workspace = true }
 async-trait = { workspace = true }
 
-url = { version = "2", features = ["serde"] }
-ammonia = "4"
+url = { workspace = true, features = ["serde"] }
+ammonia = { workspace = true }
+
+tokio = { workspace = true, features = ["time", "sync"] }
 
 [dev-dependencies]
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["rt", "macros"] }
 domain = { workspace = true, features = ["test-helpers"] }

crates/adapters/activitypub/src/deletion_notifier.rs

@@ -10,11 +10,6 @@ use k_ap::ActivityPubService;
 
 use crate::urls::actor_url;
 
-/// Broadcasts the actor `Delete` to the user's accepted followers.
-///
-/// k-ap only enqueues the per-inbox deliveries; they are signed later from the
-/// tombstoned user row and keypair, which the purge keeps until the tombstone
-/// cleanup (see `AccountPurger`).
 pub struct ApDeletionNotifier {
     service: Arc<ActivityPubService>,
     instance: InstanceIdentity,

crates/adapters/activitypub/src/event_handler.rs

@@ -63,9 +63,6 @@ impl EventHandler for ActivityPubEventHandler {
     }
 
     async fn handle(&self, event: &DomainEvent) -> Result<(), DomainError> {
-        // A deleted account must not speak again: its queued events would
-        // otherwise sign and send from the tombstone after the Delete. Only
-        // the Delete itself (sent by the deletion notifier) goes out.
         if let Some(author) = self.outbound_author(event)
             && self.is_tombstoned(&author).await
         {
@@ -173,8 +170,6 @@ impl EventHandler for ActivityPubEventHandler {
 }
 
 impl ActivityPubEventHandler {
-    /// The local account an outbound activity would be sent as. A queued
-    /// delivery counts unless it is the account's `Delete`.
     fn outbound_author(&self, event: &DomainEvent) -> Option<UserId> {
         match event {
             DomainEvent::ReviewLogged { user_id, .. }

crates/adapters/activitypub/src/remote_review_repository.rs

@@ -14,7 +14,6 @@ pub struct RemoteReviewUpdate<'a> {
     pub spoilers: bool,
 }
 
-/// A remote review to persist, with the events that ride the same write.
 pub struct NewRemoteReview<'a> {
     pub review: &'a Review,
     pub ap_id: &'a str,

crates/adapters/activitypub/src/review_handler.rs

@@ -159,7 +159,6 @@ impl ApObjectHandler for ReviewObjectHandler {
             spoilers: obj.contains_spoilers,
         });
 
-        // The enrichment request rides the review write (one transaction).
         let events: Vec<DomainEvent> = obj
             .external_metadata_id
             .as_ref()

crates/adapters/activitypub/src/social_adapter.rs

@@ -39,7 +39,6 @@ impl CompositeSocialAdapter {
         }
     }
 
-    /// Best-effort publish for writes k_ap owns (no shared transaction).
     async fn announce(&self, events: &[DomainEvent]) {
         for event in events {
             if let Err(e) = self.event_publisher.publish(event).await {
@@ -84,8 +83,6 @@ impl SocialCommand for CompositeSocialAdapter {
                 SocialIdentity::Remote { actor_url } => actor_url.clone(),
             },
         };
-        // Not atomic: k_ap owns the transaction, so the events are published
-        // best-effort after its write succeeds.
         self.ap_service
             .follow(follower.value(), &handle)
             .await
@@ -102,7 +99,6 @@ impl SocialCommand for CompositeSocialAdapter {
     ) -> Result<(), DomainError> {
         match target {
             SocialIdentity::Local(_) => self.local.unfollow(follower, target, events).await,
-            // Not atomic: k_ap owns the transaction.
             SocialIdentity::Remote { .. } => {
                 self.ap_service
                     .unfollow(follower.value(), &self.instance.actor_url_of(target))
@@ -122,7 +118,6 @@ impl SocialCommand for CompositeSocialAdapter {
     ) -> Result<(), DomainError> {
         match requester {
             SocialIdentity::Local(_) => self.local.accept_follow(owner, requester, events).await,
-            // Not atomic: k_ap owns the transaction.
             SocialIdentity::Remote { .. } => {
                 self.ap_service
                     .accept_follower(owner.value(), &self.instance.actor_url_of(requester))
@@ -142,7 +137,6 @@ impl SocialCommand for CompositeSocialAdapter {
     ) -> Result<(), DomainError> {
         match requester {
             SocialIdentity::Local(_) => self.local.reject_follow(owner, requester, events).await,
-            // Not atomic: k_ap owns the transaction.
             SocialIdentity::Remote { .. } => {
                 self.ap_service
                     .reject_follower(owner.value(), &self.instance.actor_url_of(requester))
@@ -162,7 +156,6 @@ impl SocialCommand for CompositeSocialAdapter {
     ) -> Result<(), DomainError> {
         match follower {
             SocialIdentity::Local(_) => self.local.remove_follower(owner, follower, events).await,
-            // Not atomic: k_ap owns the transaction.
             SocialIdentity::Remote { .. } => {
                 self.ap_service
                     .remove_follower(owner.value(), &self.instance.actor_url_of(follower))
@@ -174,7 +167,6 @@ impl SocialCommand for CompositeSocialAdapter {
         }
     }
 
-    /// Not atomic: k_ap owns the transaction.
     async fn block(
         &self,
         blocker: &UserId,
@@ -190,7 +182,6 @@ impl SocialCommand for CompositeSocialAdapter {
         Ok(())
     }
 
-    /// Not atomic: k_ap owns the transaction.
     async fn unblock(
         &self,
         blocker: &UserId,

crates/adapters/activitypub/src/tombstone_gate.rs

@@ -8,9 +8,6 @@ use axum::{
 };
 use domain::{ports::UserRepository, value_objects::UserId};
 
-/// Answers `410 Gone` for the per-user ActivityPub endpoints of a deleted
-/// account. k-ap resolves tombstones so it can sign the account's `Delete`
-/// deliveries; this keeps that from making the actor look alive.
 pub async fn tombstone_gate(
     State(users): State<Arc<dyn UserRepository>>,
     request: Request,
@@ -27,9 +24,6 @@ pub async fn tombstone_gate(
     next.run(request).await
 }
 
-/// The user id in any `/users/{id}/...` path (outbox, inbox, collections,
-/// content objects such as `/users/{id}/reviews/{rid}`). The bare actor path
-/// has its own tombstone response.
 pub fn gated_user(path: &str) -> Option<uuid::Uuid> {
     let rest = path.strip_prefix("/users/")?;
     let (id, endpoint) = rest.split_once('/')?;

crates/adapters/activitypub/src/user_adapter.rs

@@ -64,10 +64,6 @@ impl DomainUserRepoAdapter {
 impl ApUserRepository for DomainUserRepoAdapter {
     async fn find_by_id(&self, id: uuid::Uuid) -> anyhow::Result<Option<ApUser>> {
         let user_id = UserId::from_uuid(id);
-        // A deleted account still resolves here, so k-ap can sign the queued
-        // `Delete` deliveries until the tombstone cleanup. Username lookups
-        // below stay live-only, and the AP endpoints answer 410 for it
-        // (`tombstone_gate`, `actor_document_response`).
         let user = match self.repo.find_by_id(&user_id).await? {
             Some(u) => u,
             None => match self.repo.find_tombstoned_by_id(&user_id).await? {

crates/adapters/activitypub/tests/activity_ids.rs

@@ -1,11 +1,3 @@
-//! Outbound activity ids across a redelivered event, through the real k-ap
-//! `ActivityPubService` (delivery captured via its `EventPublisher` seam).
-//!
-//! k-ap 0.5.0 derives Create ids from the object id (UUIDv5,
-//! `service/broadcast.rs:285-288`) but mints Update/Delete/Move/actor-update ids
-//! randomly (`broadcast.rs:81,129,157,210,321,343,377` -> `url_scheme.rs:53`,
-//! `Uuid::new_v4`) with no override.
-
 use std::sync::Arc;
 use std::time::Duration;
 
@@ -189,8 +181,6 @@ async fn activitypub_is_idempotent_when_run_twice() {
     assert_eq!(first, second, "a redelivered Create keeps its activity id");
 }
 
-/// Characterises the k-ap 0.5.0 limitation recorded in ADR-0015. If k-ap starts
-/// minting deterministic Delete ids this fails: upgrade the ADR and flip it.
 #[tokio::test]
 async fn redelivered_delete_gets_a_fresh_activity_id_known_k_ap_limitation() {
     let mut h = harness().await;
@@ -207,8 +197,6 @@ async fn redelivered_delete_gets_a_fresh_activity_id_known_k_ap_limitation() {
     assert_ne!(first, second);
 }
 
-/// Queued events of a deleted account must not sign and send from its
-/// tombstone; the account's own Delete still goes out.
 #[tokio::test]
 async fn a_deleted_account_sends_nothing_but_its_delete() {
     let mut h = harness().await;
@@ -240,7 +228,6 @@ async fn a_deleted_account_sends_nothing_but_its_delete() {
         signing_actor_id: h.user.value(),
     };
 
-    // The review repository panics if the handler gets past the guard.
     for event in [&logged, &added, &queued] {
         h.handler.handle(event).await.unwrap();
     }

crates/adapters/auth/Cargo.toml

@@ -8,9 +8,9 @@ config = { workspace = true }
 async-trait = { workspace = true }
 domain = { workspace = true }
 anyhow = { workspace = true }
-chrono = { workspace = true }
+chrono = { workspace = true, features = ["clock"] }
 uuid = { workspace = true }
-serde = { workspace = true }
-jsonwebtoken = "9"
-argon2 = { version = "0.5", features = ["std"] }
-rand_core = { version = "0.6", features = ["getrandom"] }
+serde = { workspace = true, features = ["derive"] }
+jsonwebtoken = { workspace = true }
+argon2 = { workspace = true, features = ["std"] }
+rand_core = { workspace = true, features = ["getrandom"] }

crates/adapters/event-publisher/Cargo.toml

@@ -7,5 +7,8 @@ edition.workspace = true
 config = { workspace = true }
 domain      = { workspace = true }
 async-trait = { workspace = true }
-tokio       = { workspace = true }
+tokio = { workspace = true, features = ["sync"] }
 futures     = { workspace = true }
+
+[dev-dependencies]
+tokio = { workspace = true, features = ["rt", "macros"] }

crates/adapters/export/Cargo.toml

@@ -13,4 +13,4 @@ async-stream = { workspace = true }
 [dev-dependencies]
 domain = { workspace = true, features = ["test-helpers"] }
 uuid = { workspace = true }
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["rt", "macros"] }

crates/adapters/http-axum/Cargo.toml

@@ -7,35 +7,33 @@ license = "MIT"
 
 [features]
 default = ["federation"]
-# Enables federation-gated handlers; forwards to application/federation
 federation = ["application/federation"]
 
 [dependencies]
-tower-http = { version = "0.6.8", features = ["cors", "fs", "trace", "tracing"] }
-infer = "0.19.0"
-percent-encoding = "2"
-axum-governor = "2"
+tower-http = { workspace = true, features = ["cors", "fs", "trace", "tracing"] }
+infer = { workspace = true }
+percent-encoding = { workspace = true }
+axum-governor = { workspace = true }
 
-axum = { workspace = true }
-serde = { workspace = true }
+axum = { workspace = true, features = ["macros", "multipart", "http1", "json", "query", "form", "tokio", "matched-path", "original-uri", "tower-log", "tracing"] }
+serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tracing = { workspace = true }
-tokio = { workspace = true }
-uuid = { workspace = true }
-chrono = { workspace = true }
+uuid = { workspace = true, features = ["v4", "serde"] }
+chrono = { workspace = true, features = ["clock", "serde"] }
 chrono-tz = { workspace = true }
 futures = { workspace = true }
 
 api-types = { workspace = true }
 domain = { workspace = true }
 application = { workspace = true }
-askama = { version = "0.16.0" }
-utoipa = { version = "5.5.0", features = ["axum_extras", "uuid"] }
-utoipa-scalar = { version = "0.3.0", features = ["axum"], default-features = false }
-utoipa-swagger-ui = { version = "9.0.2", features = ["axum", "vendored"] }
+askama = { workspace = true }
+utoipa = { workspace = true, features = ["axum_extras", "uuid"] }
+utoipa-swagger-ui = { workspace = true, features = ["axum", "vendored"] }
 
 [dev-dependencies]
 bytes = { workspace = true }
 futures = { workspace = true }
-tower = { version = "0.5", features = ["util"] }
+tower = { workspace = true, features = ["util"] }
+tokio = { workspace = true, features = ["rt", "macros"] }
 domain = { workspace = true, features = ["test-helpers"] }

crates/adapters/http-axum/src/api/mod.rs

@@ -16,9 +16,6 @@ use axum::{Router, routing};
 
 use crate::state::AppState;
 
-/// JSON API routes (mounted under `/api/v1`), minus the webhook ingestion
-/// endpoints ([`webhook_router`], separately rate limited) and the
-/// federation-gated admin endpoints (`federation::api_routes`).
 pub fn router() -> Router<AppState> {
     let base = Router::new()
         .route("/diary", routing::get(diary::get_diary))
@@ -150,7 +147,6 @@ pub fn router() -> Router<AppState> {
     base.merge(social_routes())
 }
 
-/// Media-server webhook ingestion endpoints (mounted under `/api/v1`).
 pub fn webhook_router() -> Router<AppState> {
     Router::new()
         .route(

crates/adapters/http-axum/src/api/search.rs

@@ -163,8 +163,9 @@ pub async fn post_reindex_search(
     State(state): State<AppState>,
     _admin: crate::extractors::AdminApiUser,
 ) -> impl IntoResponse {
-    let event = domain::events::DomainEvent::SearchReindexRequested;
-    match state.app_ctx.services.event_publisher.publish(&event).await {
+    match application::search::request_reindex::execute(&state.app_ctx.deps.search.request_reindex)
+        .await
+    {
         Ok(()) => StatusCode::ACCEPTED.into_response(),
         Err(e) => {
             tracing::error!("failed to publish reindex event: {:?}", e);

crates/adapters/http-axum/src/errors.rs

@@ -14,7 +14,6 @@ pub const CONFLICT: &str = "CONFLICT";
 pub const RATE_LIMITED: &str = "RATE_LIMITED";
 pub const INTERNAL: &str = "INTERNAL";
 
-/// The only constructor of JSON error bodies in this crate.
 pub fn refuse(status: StatusCode, code: &'static str, message: impl Into<String>) -> Response {
     (
         status,

crates/adapters/http-axum/src/extractors/json.rs

@@ -1,5 +1,3 @@
-//! JSON API extractors whose rejections are refused in the one error shape.
-
 use axum::{
     extract::{
         FromRequest, FromRequestParts, Multipart, Path, Query, Request,
@@ -13,10 +11,6 @@ use serde::de::DeserializeOwned;
 
 use crate::errors::{INTERNAL, INVALID_INPUT, refuse};
 
-/// Malformed request (bad JSON, query or path), refused as `INVALID_INPUT`.
-/// Status follows axum: 400 syntax, 415 content type, 422 data errors, 413 size.
-/// A rejection with a 5xx status is a server-side fault (e.g. a route that
-/// declares no path parameter), refused as `INTERNAL`.
 pub struct MalformedRequest {
     status: StatusCode,
     message: String,
@@ -69,7 +63,6 @@ impl From<MultipartRejection> for MalformedRequest {
     }
 }
 
-/// `axum::extract::Multipart` with refusals in the one error shape.
 pub struct Upload(pub Multipart);
 
 impl<S> FromRequest<S> for Upload
@@ -83,7 +76,6 @@ where
     }
 }
 
-/// `axum::Json` with refusals in the one error shape.
 pub struct Body<T>(pub T);
 
 impl<S, T> FromRequest<S> for Body<T>
@@ -99,7 +91,6 @@ where
     }
 }
 
-/// `axum::extract::Query` with refusals in the one error shape.
 pub struct Params<T>(pub T);
 
 impl<S, T> FromRequestParts<S> for Params<T>
@@ -115,7 +106,6 @@ where
     }
 }
 
-/// `axum::extract::Path` with refusals in the one error shape.
 pub struct PathId<T>(pub T);
 
 impl<S, T> FromRequestParts<S> for PathId<T>

crates/adapters/http-axum/src/extractors/mod.rs

@@ -10,9 +10,8 @@ use domain::{errors::DomainError, value_objects::UserId};
 
 use crate::{errors::ApiError, state::AppState};
 
-async fn ensure_active(state: &AppState, user_id: &UserId) -> Result<(), DomainError> {
-    application::users::ensure_active::execute(&state.app_ctx.deps.users.ensure_active, user_id)
-        .await
+async fn authenticate(state: &AppState, token: &str) -> Result<UserId, DomainError> {
+    application::auth::authenticate::execute(&state.app_ctx.deps.auth.authenticate, token).await
 }
 
 pub struct AuthenticatedUser(pub UserId);
@@ -36,13 +35,7 @@ where
                     "Missing or invalid auth token".into(),
                 ))
             })?;
-        let user_id = app_state
-            .app_ctx
-            .services
-            .auth
-            .validate_token(token)
-            .await?;
-        ensure_active(&app_state, &user_id).await?;
+        let user_id = authenticate(&app_state, token).await?;
         Ok(AuthenticatedUser(user_id))
     }
 }
@@ -74,24 +67,14 @@ where
         let Some(token) = extract_token_from_cookie(parts) else {
             return Ok(OptionalCookieUser(None));
         };
-        let user_id = app_state
-            .app_ctx
-            .services
-            .auth
-            .validate_token(&token)
-            .await
-            .ok();
-        let user_id = match user_id {
-            Some(id) => match ensure_active(&app_state, &id).await {
-                Ok(()) => Some(id),
-                Err(e) => {
-                    if e.is_transient() {
-                        tracing::warn!("ensure_active failed, treating as anonymous: {e:?}");
-                    }
-                    None
+        let user_id = match authenticate(&app_state, &token).await {
+            Ok(id) => Some(id),
+            Err(e) => {
+                if e.is_transient() {
+                    tracing::warn!("authenticate failed, treating as anonymous: {e:?}");
                 }
-            },
-            None => None,
+                None
+            }
         };
         Ok(OptionalCookieUser(user_id))
     }
@@ -108,14 +91,7 @@ where
         let app_state = AppState::from_ref(state);
         let token = extract_token_from_cookie(parts)
             .ok_or_else(|| Redirect::to("/login").into_response())?;
-        let user_id = app_state
-            .app_ctx
-            .services
-            .auth
-            .validate_token(&token)
-            .await
-            .map_err(|_| Redirect::to("/login").into_response())?;
-        ensure_active(&app_state, &user_id)
+        let user_id = authenticate(&app_state, &token)
             .await
             .map_err(|e| match e {
                 DomainError::InfrastructureError(_) => {
@@ -146,7 +122,6 @@ where
         )
         .await
         .map_err(ApiError)?
-        // `None` only if the account vanished between `ensure_active` and here.
         .ok_or_else(|| ApiError(DomainError::NotFound("user not found".into())))?;
         if is_admin {
             Ok(AdminApiUser(user_id))
@@ -175,7 +150,6 @@ where
         )
         .await
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR.into_response())?
-        // `None` only if the account vanished between `ensure_active` and here.
         .ok_or_else(|| StatusCode::UNAUTHORIZED.into_response())?;
         if is_admin {
             Ok(AdminUser(user_id))

crates/adapters/http-axum/src/federation/mod.rs

@@ -1,7 +1,3 @@
-//! Federation-only HTTP surface. This is the one module that decides, per
-//! build, whether federation routes exist: both builds expose the same
-//! functions, so `router.rs` and the api/html modules stay free of `cfg`.
-
 #[cfg(feature = "federation")]
 pub(crate) mod blocklist_api;
 #[cfg(feature = "federation")]
@@ -18,7 +14,6 @@ use axum::{Router, routing};
 
 use crate::state::AppState;
 
-/// Classic-UI routes that only exist with federation (AP collections, admin pages).
 #[cfg(feature = "federation")]
 pub fn html_routes() -> Router<AppState> {
     Router::new()
@@ -53,7 +48,6 @@ pub fn html_routes() -> Router<AppState> {
         )
 }
 
-/// JSON API routes that only exist with federation (blocklist administration).
 #[cfg(feature = "federation")]
 pub fn api_routes() -> Router<AppState> {
     Router::new()
@@ -80,8 +74,6 @@ pub fn api_routes() -> Router<AppState> {
         )
 }
 
-/// Without federation the follower/following collection URLs fall back to the
-/// classic list pages.
 #[cfg(not(feature = "federation"))]
 pub fn html_routes() -> Router<AppState> {
     Router::new()
@@ -108,8 +100,6 @@ pub fn api_routes() -> Router<AppState> {
     Router::new()
 }
 
-/// ActivityPub content negotiation for `GET /users/{id}`: federation builds
-/// answer AP clients with the actor document, others always render HTML.
 #[cfg(not(feature = "federation"))]
 pub async fn actor_document_response(
     _state: &AppState,

crates/adapters/http-axum/src/federation/negotiation.rs

@@ -6,8 +6,6 @@ use uuid::Uuid;
 
 use crate::state::AppState;
 
-/// Answers ActivityPub clients (`Accept: application/activity+json` or
-/// `application/ld+json`) with the actor document; `None` means "render HTML".
 pub async fn actor_document_response(
     state: &AppState,
     headers: &HeaderMap,

crates/adapters/http-axum/src/html/csrf.rs

@@ -19,7 +19,6 @@ pub fn extract_from_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
         })
 }
 
-/// Router state for [`csrf_middleware`]: whether cookies carry the `Secure` attribute.
 #[derive(Clone, Copy)]
 pub struct SecureCookies(pub bool);
 

crates/adapters/http-axum/src/html/images.rs

@@ -12,7 +12,8 @@ pub async fn get_image(
     if key.starts_with("http://") || key.starts_with("https://") {
         return axum::response::Redirect::temporary(&key).into_response();
     }
-    match state.app_ctx.services.object_storage.get(&key).await {
+    match application::images::get_image::execute(&state.app_ctx.deps.images.get_image, &key).await
+    {
         Ok(bytes) => {
             let mime = infer::get(&bytes)
                 .map(|t| t.mime_type())

crates/adapters/http-axum/src/html/mod.rs

@@ -23,8 +23,6 @@ use axum::{Router, routing};
 
 use crate::state::AppState;
 
-/// Classic server-rendered UI routes, minus the rate-limited auth forms
-/// ([`auth_router`]) and the federation-gated pages (`federation::html_routes`).
 pub fn router() -> Router<AppState> {
     let base = Router::new()
         .route("/", routing::get(diary::get_activity_feed_html))
@@ -127,7 +125,6 @@ pub fn router() -> Router<AppState> {
     base.merge(social_routes())
 }
 
-/// Login, logout and registration forms; the caller adds the auth rate limiter.
 pub fn auth_router() -> Router<AppState> {
     Router::new()
         .route(

crates/adapters/http-axum/src/html/users.rs

@@ -233,11 +233,8 @@ pub async fn post_delete_user(
     let target_id = UserId::from_uuid(target);
     let own = actor == target_id;
     match delete_account(&state, actor, target_id, &form.password).await {
-        // An admin removing their own account ends their own session too.
         Ok(()) if own => super::auth::get_logout(State(state)).await.into_response(),
         Ok(()) => axum::response::Redirect::to("/users").into_response(),
-        // Same as other forbidden classic actions: a plain 403, not a redirect
-        // to a page that would not show the error.
         Err(e @ DomainError::Forbidden(_)) => crate::errors::domain_error_response(e),
         Err(e) => axum::response::Redirect::to(&format!(
             "/users/{target}?error={}",

crates/adapters/http-axum/src/openapi/mod.rs

@@ -16,7 +16,6 @@ use utoipa::{
     Modify, OpenApi,
     openapi::security::{Http, HttpAuthScheme, SecurityScheme},
 };
-use utoipa_scalar::{Scalar, Servable};
 use utoipa_swagger_ui::SwaggerUi;
 
 struct SecurityAddon;
@@ -62,9 +61,7 @@ pub fn spec() -> utoipa::openapi::OpenApi {
 }
 
 pub fn serve(router: Router) -> Router {
-    tracing::info!("API docs at /docs (Swagger) and /scalar");
+    tracing::info!("API docs at /docs (Swagger)");
     let spec = spec();
-    router
-        .merge(SwaggerUi::new("/docs").url("/openapi.json", spec.clone()))
-        .merge(Scalar::with_url("/scalar", spec))
+    router.merge(SwaggerUi::new("/docs").url("/openapi.json", spec))
 }

crates/adapters/http-axum/src/router.rs

@@ -48,7 +48,6 @@ async fn health_handler() -> axum::Json<serde_json::Value> {
     axum::Json(serde_json::json!({ "status": "ok" }))
 }
 
-/// JSON API rate-limit refusals use the one error shape.
 fn slow_down(reason: RejectionReason) -> axum::response::Response {
     match reason {
         RejectionReason::QuotaExceeded { .. } => refuse(
@@ -64,7 +63,6 @@ fn slow_down(reason: RejectionReason) -> axum::response::Response {
     }
 }
 
-/// Every `/api/v1` limiter is built here so its refusals use the one error shape.
 fn api_governor(quota: Quota) -> axum_governor::GovernorConfig<std::net::IpAddr> {
     GovernorConfigBuilder::default()
         .with_extractor(PeerIp::default())

crates/adapters/http-axum/src/support.rs

@@ -1,5 +1,3 @@
-//! Request/response helpers shared by the JSON API and the classic HTML UI.
-
 use crate::state::AppState;
 use domain::models::import::DomainField;
 

crates/adapters/http-axum/src/test_support.rs

@@ -1,5 +1,3 @@
-//! Fixtures shared by the in-crate mapper tests.
-
 use domain::value_objects::{SocialActor, SocialIdentity, UserId};
 
 pub(crate) fn local_actor(uid: &UserId) -> SocialActor {

crates/adapters/image-converter/Cargo.toml

@@ -9,12 +9,12 @@ domain      = { workspace = true }
 async-trait = { workspace = true }
 anyhow      = { workspace = true }
 tracing     = { workspace = true }
-tokio       = { workspace = true }
-image       = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp"] }
-ravif       = { version = "0.11", default-features = false }
-webp        = "0.3"
+tokio = { workspace = true, features = ["rt"] }
+image       = { workspace = true, features = ["jpeg", "png", "webp"] }
+ravif       = { workspace = true }
+webp        = { workspace = true }
 
 [dev-dependencies]
 object-storage = { workspace = true }
 object_store = { workspace = true }
-uuid = { workspace = true }
+uuid = { workspace = true, features = ["v4"] }

crates/adapters/image-converter/src/handler.rs

@@ -45,9 +45,6 @@ impl EventHandler for ImageConversionHandler {
             return Ok(());
         }
 
-        // `get` falls back to `{key}.webp` / `{key}.avif`, which would re-encode
-        // an already converted image on redelivery. Probe the exact key first:
-        // once the original is gone, an earlier delivery finished the conversion.
         if !self.storage.exists(&key).await? {
             tracing::warn!(%key, "original image already gone, treating conversion as done");
             return Ok(());

crates/adapters/image-converter/tests/conversion_handler_test.rs

@@ -181,7 +181,6 @@ async fn image_conversion_is_idempotent_when_run_twice() {
 
         handler.handle(&event).await.unwrap();
         let converted = storage.get(&new_key).await.unwrap();
-        // Redelivery after the original was swapped and deleted.
         handler.handle(&event).await.unwrap();
 
         assert_eq!(image_ref.swaps().len(), 1, "one swap");

crates/adapters/importer/Cargo.toml

@@ -10,4 +10,4 @@ xlsx = ["dep:calamine"]
 domain = { workspace = true }
 serde_json = { workspace = true }
 csv = { workspace = true }
-calamine = { version = "0.35", optional = true }
+calamine = { workspace = true, optional = true }

crates/adapters/media-server/Cargo.toml

@@ -5,5 +5,5 @@ edition.workspace = true
 
 [dependencies]
 domain = { workspace = true }
-serde = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }

crates/adapters/metadata/Cargo.toml

@@ -8,5 +8,6 @@ config = { workspace = true }
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 reqwest = { workspace = true }
-serde = { workspace = true }
+rustls = { workspace = true, features = ["ring", "std"] }
+serde = { workspace = true, features = ["derive"] }
 domain = { workspace = true }

crates/adapters/metadata/src/omdb.rs

@@ -16,6 +16,7 @@ pub(crate) struct OmdbProvider {
 
 impl OmdbProvider {
     pub(crate) fn new(api_key: String) -> Self {
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Self {
             client: reqwest::Client::new(),
             api_key,

crates/adapters/metadata/src/tmdb.rs

@@ -15,6 +15,7 @@ pub(crate) struct TmdbProvider {
 
 impl TmdbProvider {
     pub(crate) fn new(api_key: String) -> Self {
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Self {
             client: reqwest::Client::new(),
             api_key,

crates/adapters/metadata/tests/client_tls_omdb.rs

@@ -0,0 +1,4 @@
+#[test]
+fn omdb_client_builds_without_bootstrap() {
+    let _ = metadata::MetadataClientImpl::new_omdb("key".into());
+}

crates/adapters/metadata/tests/client_tls_tmdb.rs

@@ -0,0 +1,4 @@
+#[test]
+fn tmdb_client_builds_without_bootstrap() {
+    let _ = metadata::MetadataClientImpl::new_tmdb("key".into());
+}

crates/adapters/nats/Cargo.toml

@@ -5,7 +5,7 @@ edition.workspace = true
 
 [dependencies]
 config = { workspace = true }
-async-nats = "0.48.0"
+async-nats = { workspace = true }
 
 domain = { workspace = true }
 event-payload = { workspace = true }
@@ -13,7 +13,7 @@ async-trait = { workspace = true }
 anyhow = { workspace = true }
 tracing = { workspace = true }
 serde_json = { workspace = true }
-uuid = { workspace = true }
-chrono = { workspace = true }
-tokio = { workspace = true }
+uuid = { workspace = true, features = ["serde"] }
+chrono = { workspace = true, features = ["serde"] }
+tokio = { workspace = true, features = ["rt", "sync"] }
 futures = { workspace = true }

crates/adapters/nats/src/config.rs

@@ -11,7 +11,6 @@ pub struct NatsConfig {
     pub subject_prefix: String,
     pub stream_name: String,
     pub consumer_name: String,
-    /// JetStream redelivery bound, same as the DB queue's attempt limit.
     pub max_deliver: i64,
 }
 

crates/adapters/nats/src/consumer.rs

@@ -25,11 +25,8 @@ struct NatsJetStreamAckHandle {
     max_deliver: i64,
 }
 
-/// How to nak a failed delivery: the same backoff schedule as the SQLite
-/// queue, keyed by JetStream's delivery count (1 on first delivery).
 struct NakPlan {
     delay: std::time::Duration,
-    /// This was the last delivery `max_deliver` allows.
     exhausted: bool,
 }
 
@@ -82,9 +79,6 @@ impl AckHandle for NatsJetStreamAckHandle {
             .map_err(|e| DomainError::InfrastructureError(e.to_string()))
     }
 
-    /// JetStream counts every redelivery toward `max_deliver`, deferrals
-    /// included. The delay is at least the remaining claim lease, so the
-    /// deliveries allowed by `max_deliver` still span more than one lease.
     async fn defer(&self, delay: std::time::Duration) -> Result<(), DomainError> {
         self.message
             .ack_with(AckKind::Nak(Some(delay)))
@@ -159,20 +153,10 @@ fn consume_from_rx(rx: EnvelopeRx) -> BoxStream<'static, Result<EventEnvelope, D
     }))
 }
 
-/// How long JetStream remembers `Nats-Msg-Id`s. A row re-relayed within this
-/// window (crash between publish and mark-done, or a lease reclaim) is dropped
-/// by the broker; a duplicate arriving later is caught by the processed-event
-/// ledger, which keeps its rows for 30 days. Set explicitly so it does not
-/// silently follow the server default.
 const DEDUP_WINDOW: std::time::Duration = std::time::Duration::from_secs(60 * 60);
 
 const ACK_WAIT: std::time::Duration = std::time::Duration::from_secs(600);
 
-/// `Some(updated)` when an existing stream's config differs from what this
-/// build needs. `get_or_create_stream` only applies config on creation, so a
-/// stream created by an older build would otherwise keep the server default
-/// duplicate window (2 minutes). Only the fields this code owns are changed;
-/// everything else the operator set is preserved.
 fn stream_config_update(existing: &StreamConfig) -> Option<StreamConfig> {
     (existing.duplicate_window != DEDUP_WINDOW).then(|| StreamConfig {
         duplicate_window: DEDUP_WINDOW,
@@ -180,10 +164,6 @@ fn stream_config_update(existing: &StreamConfig) -> Option<StreamConfig> {
     })
 }
 
-/// `Some(updated)` when an existing durable consumer disagrees on `max_deliver`
-/// or `ack_wait`. The update is a clone of the existing config with only those
-/// two fields changed, so operator-set fields survive and immutable ones
-/// (durable name, filter subject, deliver policy) cannot mismatch.
 fn consumer_config_update(
     existing: &jetstream::consumer::Config,
     desired_max_deliver: i64,

crates/adapters/nats/src/lib.rs

@@ -12,8 +12,6 @@ use std::sync::Arc;
 
 use domain::ports::{EventConsumer, EventRelaySink};
 
-/// The worker's NATS side: where handlers read events from, and where the
-/// outbox relay writes them to.
 pub async fn create_bus(
     cfg: NatsConfig,
 ) -> anyhow::Result<(Arc<dyn EventConsumer>, Arc<dyn EventRelaySink>)> {
@@ -29,7 +27,6 @@ pub async fn create_bus(
                 Arc::new(NatsRelaySink::new_core(client, cfg.subject_prefix)),
             )
         }
-        // The consumer creates the stream the relay publishes into.
         NatsMode::JetStream => (
             Arc::new(NatsJetStreamConsumer::create(&cfg, client.clone()).await?),
             Arc::new(NatsRelaySink::new_jetstream(client, cfg.subject_prefix)),

crates/adapters/nats/src/relay.rs

@@ -9,13 +9,9 @@ use event_payload::EventPayload;
 
 use crate::{payload::NatsEventMessage, subject::event_to_subject};
 
-/// What goes on the wire for one outbox row. Built purely from the row, so
-/// relaying it again (after a crash between publish and mark-done) yields the
-/// same `Nats-Msg-Id` and JetStream drops the duplicate.
 pub(crate) struct RelayMessage {
     pub subject: String,
     pub payload: Vec<u8>,
-    /// `None` for rows queued before identities existed: those get no dedup.
     pub msg_id: Option<String>,
 }
 
@@ -42,8 +38,6 @@ enum Transport {
     JetStream(jetstream::Context),
 }
 
-/// Publishes outbox rows to NATS. JetStream mode waits for the broker ack and
-/// sets `Nats-Msg-Id`; core mode is fire-and-forget with no broker-side dedup.
 pub struct NatsRelaySink {
     transport: Transport,
     subject_prefix: String,

crates/adapters/object-storage/Cargo.toml

@@ -14,5 +14,5 @@ futures = { workspace = true }
 object_store = { workspace = true }
 
 [dev-dependencies]
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["rt", "macros"] }
 uuid = { workspace = true }

crates/adapters/poster-fetcher/Cargo.toml

@@ -8,4 +8,5 @@ config = { workspace = true }
 domain = { workspace = true }
 async-trait = { workspace = true }
 reqwest = { workspace = true }
+rustls = { workspace = true, features = ["ring", "std"] }
 anyhow = { workspace = true }

crates/adapters/poster-fetcher/src/lib.rs

@@ -16,6 +16,7 @@ pub struct ReqwestPosterFetcher {
 
 impl ReqwestPosterFetcher {
     pub fn new(config: PosterFetcherConfig) -> anyhow::Result<Self> {
+        let _ = rustls::crypto::ring::default_provider().install_default();
         let client = reqwest::Client::builder()
             .timeout(Duration::from_secs(config.timeout_seconds))
             .build()?;

crates/adapters/poster-fetcher/tests/client_tls.rs

@@ -0,0 +1,6 @@
+use poster_fetcher::{PosterFetcherConfig, ReqwestPosterFetcher};
+
+#[test]
+fn poster_fetcher_builds_without_bootstrap() {
+    ReqwestPosterFetcher::new(PosterFetcherConfig { timeout_seconds: 5 }).expect("client builds");
+}

crates/adapters/rss-adapter/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
-name = "rss"
+name = "rss-adapter"
 version = "0.1.0"
 edition.workspace = true
 
 [dependencies]
-rss-feed = { package = "rss", version = "2", features = ["atom"] }
+rss = { workspace = true, features = ["atom"] }
 domain = { workspace = true }
 
 [dev-dependencies]

crates/adapters/rss-adapter/src/lib.rs

@@ -1,8 +1,8 @@
 use domain::errors::DomainError;
 use domain::models::DiaryEntry;
 use domain::ports::{FeedChannel, RssFeedRenderer};
-use rss_feed::extension::atom::{self, AtomExtensionBuilder, Link};
-use rss_feed::{ChannelBuilder, GuidBuilder, ItemBuilder};
+use rss::extension::atom::{self, AtomExtensionBuilder, Link};
+use rss::{ChannelBuilder, GuidBuilder, ItemBuilder};
 
 pub struct RssAdapter {
     base_url: String,

crates/adapters/rss-adapter/tests/rss_adapter_test.rs

@@ -3,7 +3,7 @@ use domain::models::ReviewEdit;
 use domain::ports::{FeedChannel, RssFeedRenderer};
 use domain::testing::{test_movie_with_year, test_review};
 use domain::value_objects::{Comment, UserId};
-use rss::RssAdapter;
+use rss_adapter::RssAdapter;
 
 fn channel<'a>(title: &'a str) -> FeedChannel<'a> {
     FeedChannel {

crates/adapters/sqlite-federation/Cargo.toml

@@ -6,17 +6,17 @@ edition.workspace = true
 [dependencies]
 sqlx = { workspace = true }
 activitypub = { workspace = true }
-k-ap = { version = "0.5.1", registry = "gitea" }
+k-ap = { workspace = true }
 sqlite = { workspace = true }
 domain = { workspace = true }
 anyhow = { workspace = true }
 serde_json = { workspace = true }
-uuid = { workspace = true }
-chrono = { workspace = true }
+uuid = { workspace = true, features = ["v4", "serde"] }
+chrono = { workspace = true, features = ["clock", "serde"] }
 tracing = { workspace = true }
 async-trait = { workspace = true }
 
 [dev-dependencies]
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["rt", "macros"] }
 domain = { workspace = true, features = ["test-helpers"] }
 uuid = { workspace = true }

crates/adapters/sqlite-federation/tests/federation/remote_review_test.rs

@@ -1,5 +1,3 @@
-//! A remote review and the enrichment request it triggers commit together.
-
 use activitypub::{NewRemoteReview, RemoteReviewRepository};
 use domain::{
     events::DomainEvent,

crates/adapters/sqlite/Cargo.toml

@@ -12,11 +12,11 @@ event-payload = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 anyhow = { workspace = true }
-uuid = { workspace = true }
-chrono = { workspace = true }
+uuid = { workspace = true, features = ["v4", "serde"] }
+chrono = { workspace = true, features = ["clock", "serde"] }
 tracing = { workspace = true }
 async-trait = { workspace = true }
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["rt", "sync", "time", "macros", "rt-multi-thread"] }
 futures = { workspace = true }
 async-stream = { workspace = true }
 

crates/adapters/sqlite/src/event_queue/mod.rs

@@ -16,9 +16,6 @@ use tokio::sync::{Mutex, mpsc};
 use crate::shared::enqueue_events;
 pub(crate) use payload::DbEventPayload;
 
-/// How long a claim holds a row. A worker that dies between claim and
-/// ack/nack strands its rows in `processing`; once the lease lapses the claim
-/// query takes them again. Must exceed the slowest handler.
 pub(crate) const CLAIM_LEASE_SECONDS: i64 = 600;
 
 pub struct DbEventQueueConfig {
@@ -140,9 +137,6 @@ struct QueueRow {
     claimed_at: Option<String>,
 }
 
-/// Claims a batch in one atomic statement. A read-then-write transaction can
-/// fail with SQLITE_BUSY_SNAPSHOT (517) when another connection commits in
-/// between, which `busy_timeout` cannot retry.
 async fn claim_batch(
     pool: &SqlitePool,
     config: &DbEventQueueConfig,
@@ -168,13 +162,10 @@ async fn claim_batch(
         .await
         .map_err(|e| DomainError::InfrastructureError(format!("claim batch: {e}")))?;
 
-    // RETURNING order is unspecified; deliver oldest first.
     rows.sort_by(|a, b| (&a.next_attempt_at, a.id).cmp(&(&b.next_attempt_at, b.id)));
     Ok(rows)
 }
 
-/// A row that cannot be decoded can never succeed, and has no ack handle to
-/// settle it with; park it so it is neither retried forever nor left claimed.
 async fn dead_letter_undecodable(pool: &SqlitePool, row_id: i64, error: &DomainError) {
     tracing::error!(
         row_id,
@@ -223,14 +214,10 @@ struct DbAckHandle {
     row_id: i64,
     attempts: i32,
     max_attempts: i32,
-    /// The claim this handle belongs to. Settling is conditional on it, so a
-    /// worker whose lease lapsed and was reclaimed cannot flip the new claim's row.
     claimed_at: Option<String>,
 }
 
 impl DbAckHandle {
-    /// Runs a settle statement whose last two binds are the row id and claim
-    /// stamp. Zero rows changed means the claim is no longer ours.
     async fn settle<'q>(
         &self,
         what: &str,

crates/adapters/sqlite/src/event_queue/tests.rs

@@ -1,7 +1,3 @@
-//! Inline (not under `tests/`) because `claim_batch` is private and the race
-//! only shows on its claim path; two pools on a file-backed WAL database are
-//! needed, as in production.
-
 use std::str::FromStr;
 
 use sqlx::SqlitePool;
@@ -73,7 +69,6 @@ async fn claiming_while_another_connection_writes_does_not_fail() {
             .await
             .expect("claim must not fail while another connection writes");
         if batch.is_empty() {
-            // an empty UPDATE still takes the write lock; don't starve the writer
             tokio::task::yield_now().await;
         }
         claimed += batch.len();
@@ -315,8 +310,6 @@ mod stale_handle {
     use super::{claim_batch, config};
     use crate::event_queue::{CLAIM_LEASE_SECONDS, SqliteEventQueue};
 
-    /// Claims a row, lets its lease lapse, and has another worker reclaim it.
-    /// Returns the first (now stale) worker's envelope.
     async fn reclaimed() -> (sqlx::SqlitePool, EventEnvelope) {
         let pool = sqlx::sqlite::SqlitePoolOptions::new()
             .max_connections(1)
@@ -340,8 +333,6 @@ mod stale_handle {
             .await
             .unwrap();
         assert_eq!(claim_batch(&pool, &config(10)).await.unwrap().len(), 1);
-        // Real reclaims happen a lease later, so their timestamp differs from
-        // the stale handle's; the claim clock has only second resolution.
         let second_claim = (chrono::Utc::now() - chrono::Duration::seconds(5))
             .format("%Y-%m-%dT%H:%M:%SZ")
             .to_string();

crates/adapters/sqlite/src/lib.rs

@@ -20,8 +20,6 @@ pub use repositories::{
     create_federated_profile_query, create_image_ref, create_person_adapter, create_search_adapter,
 };
 
-/// Row helpers shared with the `sqlite-federation` crate (which cannot live
-/// here because it depends on `activitypub`/`k-ap`).
 pub mod persistence {
     pub use crate::shared::{datetime_to_str, enqueue_events};
 }
@@ -79,7 +77,6 @@ pub async fn wire(database_url: &str) -> anyhow::Result<SqliteWireOutput> {
     wire_pool(pool).await
 }
 
-/// Migrates an already-connected pool and builds every repository on it.
 pub async fn wire_pool(pool: SqlitePool) -> anyhow::Result<SqliteWireOutput> {
     use anyhow::Context;
 

crates/adapters/sqlite/src/migrations.rs

@@ -3,10 +3,6 @@ use std::time::Duration;
 use domain::errors::DomainError;
 use sqlx::SqlitePool;
 
-/// Server and worker both migrate at startup, so two processes can race on the
-/// same database. The loser's migration fails (e.g. duplicate column) because
-/// the winner already applied it; re-running re-reads `_sqlx_migrations` and
-/// skips what is done. Only an error that persists across all retries is returned.
 const RETRY_BACKOFFS: [Duration; 5] = [
     Duration::from_millis(100),
     Duration::from_millis(250),

crates/adapters/sqlite/src/repositories/account_purge/mod.rs

@@ -9,10 +9,6 @@ use crate::shared::map_sqlx_error;
 
 const TIMESTAMP_FORMAT: &str = "%Y-%m-%dT%H:%M:%SZ";
 
-/// Every table the purge empties for the account, with the column that holds
-/// the user id. `reviews` is further restricted to the user's own (non-remote)
-/// rows. A guard test compares this list with the schema, so a new
-/// user-owned table cannot be forgotten.
 pub const PURGED_USER_TABLES: &[(&str, &str)] = &[
     ("reviews", "user_id"),
     ("watchlist_entries", "user_id"),
@@ -30,13 +26,8 @@ pub const PURGED_USER_TABLES: &[(&str, &str)] = &[
     ("blocked_actors", "local_user_id"),
 ];
 
-/// Tables that reference a user but are kept until the tombstone cleanup:
-/// the keypair is needed to sign queued federation deliveries.
 pub const RETAINED_USER_TABLES: &[&str] = &["ap_local_actors"];
 
-/// Columns that identify the user by actor or content URL rather than by id.
-/// The purge matches rows on them; the guard test asserts each still exists so
-/// a rename cannot silently stop the purge from clearing them.
 pub const URL_KEYED_USER_COLUMNS: &[(&str, &str)] = &[
     ("ap_announces", "object_url"),
     ("ap_announces", "actor_url"),
@@ -44,9 +35,6 @@ pub const URL_KEYED_USER_COLUMNS: &[(&str, &str)] = &[
     ("ap_following", "remote_actor_url"),
 ];
 
-/// Columns holding serialized events and activities that carry the user's id
-/// (the outbox log keeps finished rows, including authored activity JSON) and
-/// the global wrap-up reports, whose `most_active_user` names a member.
 pub const PAYLOAD_KEYED_USER_COLUMNS: &[(&str, &str)] = &[
     ("event_queue", "payload"),
     ("wrap_up_records", "report_json"),
@@ -95,8 +83,6 @@ impl AccountPurger for SqliteAccountPurger {
         let base = self.instance.base_url().to_string();
         let mut tx = self.pool.begin().await.map_err(map_sqlx_error)?;
 
-        // Strip first: it claims the purge. Only a tombstoned, not yet purged
-        // account matches, so a live account (or a re-run) changes nothing.
         let claimed = sqlx::query(
             "UPDATE users SET email = 'deleted-' || id || '@deleted.invalid',
                  password_hash = '!purged', display_name = NULL, bio = NULL,
@@ -113,7 +99,6 @@ impl AccountPurger for SqliteAccountPurger {
             return Ok(());
         }
 
-        // Announces of the user's content, matched before the reviews go.
         sqlx::query(
             "DELETE FROM ap_announces
              WHERE object_url IN (
@@ -130,11 +115,6 @@ impl AccountPurger for SqliteAccountPurger {
         .await
         .map_err(map_sqlx_error)?;
 
-        // The outbox log: finished events and activities authored as, or
-        // mentioning, this user. Unfinished rows are never touched (they
-        // belong to other users' work too and finish or dead-letter on their
-        // own); the tombstone cleanup removes their history later. The
-        // `UserDeleted` row that triggered this run stays until then as well.
         sqlx::query(
             "DELETE FROM event_queue
              WHERE instr(payload, ?1) > 0
@@ -146,8 +126,6 @@ impl AccountPurger for SqliteAccountPurger {
         .await
         .map_err(map_sqlx_error)?;
 
-        // Global wrap-up reports name their most active member; redact it
-        // (the type allows none) and keep the rest of the report.
         sqlx::query(
             "UPDATE wrap_up_records
              SET report_json = json_set(report_json, '$.most_active_user', NULL)
@@ -159,7 +137,6 @@ impl AccountPurger for SqliteAccountPurger {
         .await
         .map_err(map_sqlx_error)?;
 
-        // Other accounts' follows of this one.
         for table in ["ap_followers", "ap_following"] {
             sqlx::query(&format!("DELETE FROM {table} WHERE remote_actor_url = ?"))
                 .bind(&actor_url)
@@ -201,9 +178,6 @@ impl AccountPurger for SqliteAccountPurger {
     ) -> Result<u64, DomainError> {
         let cutoff = cutoff.format(TIMESTAMP_FORMAT).to_string();
         let mut tx = self.pool.begin().await.map_err(map_sqlx_error)?;
-        // A tombstone whose id is still named by an unfinished event waits for
-        // the next run: that event may yet be handled, and its history row
-        // must be erased with the rest.
         let expiring: Vec<String> = sqlx::query_scalar(
             "SELECT id FROM users u
              WHERE purged_at IS NOT NULL AND purged_at < ?
@@ -217,15 +191,11 @@ impl AccountPurger for SqliteAccountPurger {
         .await
         .map_err(map_sqlx_error)?;
         for id in &expiring {
-            // Includes the `UserDeleted` row and the `Delete` deliveries.
             sqlx::query("DELETE FROM event_queue WHERE instr(payload, ?) > 0")
                 .bind(id)
                 .execute(&mut *tx)
                 .await
                 .map_err(map_sqlx_error)?;
-            // A Follow arriving on the shared inbox after the purge can leave
-            // a late row for the tombstone; delete it explicitly rather than
-            // rely on the foreign-key cascade of the final `users` delete.
             for table in ["ap_followers", "ap_following"] {
                 sqlx::query(&format!("DELETE FROM {table} WHERE local_user_id = ?"))
                     .bind(id)

crates/adapters/sqlite/src/repositories/diary/query.rs

@@ -131,8 +131,6 @@ impl DiaryQuery for SqliteDiaryRepository {
             FeedSortBy::RatingAsc => "r.rating ASC, r.watched_at ASC",
         };
 
-        // Tombstoned local authors vanish from the feed; remote and orphan
-        // rows have no `users` match, so `deleted_at` is NULL for them.
         where_parts.push("u.deleted_at IS NULL".to_string());
 
         let where_clause = where_parts.join(" AND ");

crates/adapters/sqlite/src/repositories/image_ref/mod.rs

@@ -26,8 +26,6 @@ pub fn create_image_ref(pool: SqlitePool) -> (Arc<dyn ImageRefCommand>, Arc<dyn
 
 #[async_trait]
 impl ImageRefCommand for SqliteImageRefAdapter {
-    // Tombstoned users (`deleted_at` set) are intentionally included: their
-    // avatar stays referenced, and so protected from GC, until the purge.
     async fn swap(&self, old_key: &str, new_key: &str) -> Result<(), DomainError> {
         let mut tx = self
             .pool
@@ -54,8 +52,6 @@ impl ImageRefCommand for SqliteImageRefAdapter {
 
 #[async_trait]
 impl ImageRefQuery for SqliteImageRefAdapter {
-    // Tombstoned users are intentionally visible here until the purge removes
-    // the row, so their avatar is not garbage-collected early.
     async fn list_keys(&self) -> Result<Vec<String>, DomainError> {
         let rows: Vec<(String,)> = sqlx::query_as(
             "SELECT avatar_path FROM users WHERE avatar_path IS NOT NULL

crates/adapters/sqlite/src/repositories/movie_dedup/mod.rs

@@ -37,8 +37,6 @@ impl MovieDeduplicator for SqliteMovieDeduplicator {
             .await
             .map_err(crate::shared::map_sqlx_error)?;
 
-        // The old row still holds the external id (it is deleted last); release it
-        // so the canonical upsert does not violate UNIQUE(external_metadata_id).
         sqlx::query("UPDATE movies SET external_metadata_id = NULL WHERE id = ?")
             .bind(&old)
             .execute(&mut *tx)

crates/adapters/sqlite/src/repositories/processed_events/mod.rs

@@ -6,7 +6,6 @@ use domain::{
 };
 use sqlx::SqlitePool;
 
-/// Matches the column default in migration 0101, so string comparison orders rows by time.
 const TIMESTAMP_FORMAT: &str = "%Y-%m-%dT%H:%M:%SZ";
 const CLAIM_FORMAT: &str = "%Y-%m-%dT%H:%M:%S%.3fZ";
 
@@ -23,8 +22,6 @@ impl SqliteProcessedEventLedger {
         )
     }
 
-    /// A shorter lease than production's, so lease takeover can be tested
-    /// without waiting half an hour.
     pub fn with_lease(pool: SqlitePool, lease: std::time::Duration) -> Self {
         Self {
             pool,
@@ -37,7 +34,6 @@ fn stamp(at: chrono::NaiveDateTime) -> String {
     at.format(TIMESTAMP_FORMAT).to_string()
 }
 
-/// Millisecond precision, so two claims taken in one second have distinct tokens.
 fn claim_stamp(at: chrono::NaiveDateTime) -> String {
     at.format(CLAIM_FORMAT).to_string()
 }
@@ -51,13 +47,9 @@ fn parse_claim_stamp(value: &str) -> Option<chrono::NaiveDateTime> {
 #[async_trait]
 impl ProcessedEventLedger for SqliteProcessedEventLedger {
     async fn begin(&self, id: &EventId, handler: &str) -> Result<Begin, DomainError> {
-        // Retried once: the row can vanish (released) between the claim attempt
-        // and the state lookup.
         for _ in 0..2 {
             let now = chrono::Utc::now().naive_utc();
             let started = claim_stamp(now);
-            // One statement, so two workers cannot both win: insert if absent,
-            // or take over an in_progress claim past its lease.
             let claimed = sqlx::query(
                 "INSERT INTO processed_events (event_id, handler, status, started_at, processed_at)
                  VALUES (?, ?, 'in_progress', ?, ?)
@@ -214,7 +206,6 @@ mod tests {
         token(ledger.begin(&id, "b").await.unwrap());
         token(ledger.begin(&EventId::new(), "a").await.unwrap());
 
-        // The blocked delivery is told to come back when the lease runs out.
         let lease = std::time::Duration::from_secs(HANDLER_LEASE_SECONDS as u64);
         assert!(retry_after <= lease && retry_after > lease - std::time::Duration::from_secs(5));
     }
@@ -260,7 +251,6 @@ mod tests {
         insert(&pool, &id, "in_progress", "2020-01-01T00:00:00Z").await;
 
         token(ledger.begin(&id, "h").await.unwrap());
-        // The takeover refreshed the lease, so a third delivery is blocked.
         blocked(ledger.begin(&id, "h").await.unwrap());
         let processed_at: String = sqlx::query_scalar("SELECT processed_at FROM processed_events")
             .fetch_one(&pool)
@@ -295,7 +285,6 @@ mod tests {
         ledger.release(&id, "a", &lapsed).await.unwrap();
         ledger.complete(&id, "a", &lapsed).await.unwrap();
 
-        // Still the new owner's live claim: neither call touched it.
         blocked(ledger.begin(&id, "a").await.unwrap());
         ledger.complete(&id, "a", &owner).await.unwrap();
         assert_eq!(ledger.begin(&id, "a").await.unwrap(), Begin::AlreadyDone);

crates/adapters/sqlite/src/repositories/users/mod.rs

@@ -169,9 +169,6 @@ impl UserRepository for SqliteUserRepository {
             .begin()
             .await
             .map_err(crate::shared::map_sqlx_error)?;
-        // The last-admin guard lives in this single statement, so two admins
-        // deleting each other concurrently cannot both pass it: the write lock
-        // serialises them and the loser sees the winner's tombstone.
         let stamped = sqlx::query(
             "UPDATE users SET deleted_at = ?1 WHERE id = ?2 AND deleted_at IS NULL
              AND (role != 'admin' OR EXISTS (
@@ -283,8 +280,6 @@ impl UserRepository for SqliteUserRepository {
 }
 
 impl SqliteUserRepository {
-    /// Uniqueness check over every row, tombstones included: a deleted
-    /// account keeps its email and username until the purge removes the row.
     async fn row_exists(&self, column: &str, value: &str) -> Result<bool, DomainError> {
         sqlx::query_scalar::<_, i64>(&format!(
             "SELECT EXISTS(SELECT 1 FROM users WHERE {column} = ?)"

crates/adapters/sqlite/src/repositories/watchlist/mod.rs

@@ -52,7 +52,6 @@ impl WatchlistRepository for SqliteWatchlistRepository {
         .map_err(crate::shared::map_sqlx_error)?
         .rows_affected()
             > 0;
-        // A repeat add changed nothing, so it announces nothing.
         if inserted {
             enqueue_events(&mut tx, events).await?;
         }

crates/adapters/sqlite/src/shared.rs

@@ -10,9 +10,6 @@ use domain::{
     },
 };
 
-/// THE outbox write path: inserts one `event_queue` row per event, each with a
-/// fresh `EventId`, inside the caller's transaction so a change and the events
-/// announcing it commit or roll back together.
 pub async fn enqueue_events(
     tx: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
     events: &[domain::events::DomainEvent],

crates/adapters/sqlite/tests/account_purge_test.rs

@@ -1,6 +1,3 @@
-//! The purge removes every row a deleted account owns, strips the user row to
-//! a data-free tombstone, and the cleanup later drops the tombstone itself.
-
 use std::collections::BTreeSet;
 use std::str::FromStr;
 
@@ -69,8 +66,6 @@ struct Seeded {
     movie_id: String,
 }
 
-/// Alice owns a row in every table; bob has a little of everything, including
-/// a follow of alice and an announce of his own review, which must survive.
 async fn seed(pool: &SqlitePool, parts: &sqlite::SqliteWireOutput) -> Seeded {
     let alice = test_user("alice");
     let bob = test_user("bob");
@@ -205,7 +200,6 @@ async fn seed(pool: &SqlitePool, parts: &sqlite::SqliteWireOutput) -> Seeded {
                     follower_actor_url: REMOTE_ACTOR.into(),
                     status: FollowStatus::Accepted,
                 },
-                // bob follows alice, and alice follows bob
                 FollowWrite::AddFollow {
                     follower_id: b.value(),
                     target_actor_url: alice_actor.clone(),
@@ -221,7 +215,6 @@ async fn seed(pool: &SqlitePool, parts: &sqlite::SqliteWireOutput) -> Seeded {
         )
         .await
         .unwrap();
-    // A remote review attributed to the same account id is not the user's.
     exec(
         pool,
         "INSERT INTO reviews (id, movie_id, user_id, rating, comment, watched_at, created_at, remote_actor_url)
@@ -234,7 +227,6 @@ async fn seed(pool: &SqlitePool, parts: &sqlite::SqliteWireOutput) -> Seeded {
         ],
     )
     .await;
-    // Announces of alice's review and goal, of bob's review, and one by alice.
     let alice_review: String =
         sqlx::query_scalar("SELECT id FROM reviews WHERE user_id = ? AND remote_actor_url IS NULL")
             .bind(&a_str)
@@ -352,7 +344,6 @@ async fn purge_removes_every_user_owned_row() {
     purger(&pool).purge(&s.user).await.unwrap();
 
     for (table, column) in PURGED_USER_TABLES {
-        // Reviews: only the remote one, asserted below, is left.
         let left = if *table == "reviews" { 1 } else { 0 };
         assert_eq!(
             count_for(&pool, table, column, &s.user).await,
@@ -406,14 +397,12 @@ async fn purge_removes_every_user_owned_row() {
         "finished rows mentioning the user are gone; pending/processing rows (incl. other users' events about her) and bob's own rows stay"
     );
 
-    // The other account is untouched.
     for (table, column) in PURGED_USER_TABLES {
         assert!(
             count_for(&pool, table, column, &s.other).await > 0,
             "{table} of the other user must survive"
         );
     }
-    // The keypair stays for queued deliveries.
     for table in RETAINED_USER_TABLES {
         assert_eq!(count_for(&pool, table, "user_id", &s.user).await, 1);
     }
@@ -458,8 +447,6 @@ async fn the_purge_table_lists_cover_every_user_referencing_column_in_the_schema
             "{t} has a foreign key to users but is not in the purge lists"
         );
     }
-    // Columns the purge matches by URL or payload must still exist, so a
-    // rename fails here instead of silently leaving rows behind.
     for (table, column) in URL_KEYED_USER_COLUMNS
         .iter()
         .chain(PAYLOAD_KEYED_USER_COLUMNS)
@@ -474,9 +461,6 @@ async fn the_purge_table_lists_cover_every_user_referencing_column_in_the_schema
     }
 }
 
-/// `ap_activities` (k-ap's inbound dedup) holds only remote activity ids and a
-/// timestamp: nothing in it is attributable to a local user. If it ever grows a
-/// column, the purge must start clearing it.
 #[tokio::test]
 async fn ap_activities_holds_nothing_attributable_to_a_local_user() {
     let pool = migrated_pool().await;
@@ -555,7 +539,6 @@ async fn purge_strips_the_user_row_but_keeps_the_username_and_state() {
             .await
             .unwrap()
     );
-    // Images stay referenced until the objects are gone.
     let mut keys = p.owned_image_keys(&s.user).await.unwrap();
     keys.sort();
     assert_eq!(keys, vec!["avatars/a.webp", "banners/a.webp"]);
@@ -571,8 +554,6 @@ async fn purging_twice_is_a_no_op() {
     parts.user.mark_deleted(&s.user, &[]).await.unwrap();
     let p = purger(&pool);
     p.purge(&s.user).await.unwrap();
-    // New data cannot appear for a purged account, but a re-run must not
-    // touch anything else or fail.
     let before: i64 = count(&pool, "SELECT COUNT(*) FROM reviews").await;
     let stamp: String = sqlx::query_scalar("SELECT purged_at FROM users WHERE id = ?")
         .bind(s.user.value().to_string())
@@ -589,7 +570,6 @@ async fn purging_twice_is_a_no_op() {
         .await
         .unwrap();
     assert_eq!(stamp, again);
-    // And an id that never existed is fine too.
     p.purge(&UserId::generate()).await.unwrap();
 }
 
@@ -666,7 +646,6 @@ async fn tombstone_cleanup_removes_rows_older_than_retention_and_keeps_younger_o
     )
     .await;
 
-    // Younger than the cutoff: kept.
     let removed = p
         .purge_expired_tombstones(now - chrono::Duration::days(9))
         .await
@@ -674,9 +653,6 @@ async fn tombstone_cleanup_removes_rows_older_than_retention_and_keeps_younger_o
     assert_eq!(removed, 0);
     assert_eq!(count_for(&pool, "users", "id", &s.user).await, 1);
 
-    // Unfinished events still name the user (the pending Delete, bob's
-    // pending FollowRequested, a processing row): the tombstone waits and no
-    // unfinished row is ever deleted.
     let alice = s.user.value().to_string();
     let unfinished = || async {
         sqlx::query_scalar::<_, i64>(
@@ -696,7 +672,6 @@ async fn tombstone_cleanup_removes_rows_older_than_retention_and_keeps_younger_o
     assert_eq!(count_for(&pool, "users", "id", &s.user).await, 1);
     assert_eq!(unfinished().await, before);
 
-    // A Follow that reached the shared inbox after the purge left a row.
     exec(
         &pool,
         "INSERT INTO ap_followers (local_user_id, remote_actor_url, status, created_at)
@@ -704,7 +679,6 @@ async fn tombstone_cleanup_removes_rows_older_than_retention_and_keeps_younger_o
         &[&alice],
     )
     .await;
-    // Once they finish, the cleanup takes the tombstone and the history.
     exec(&pool, "UPDATE event_queue SET status = 'done'", &[]).await;
     let removed = p
         .purge_expired_tombstones(now - chrono::Duration::days(7))

crates/adapters/sqlite/tests/cascade_test.rs

@@ -1,7 +1,3 @@
-//! Real-database counterpart of the `InMemoryStore` cascade tests in the domain
-//! crate. Both iterate the same table lists (`domain::testing::*_CASCADE_TABLES`),
-//! so the fake and the schema cannot drift apart unnoticed.
-
 use std::collections::BTreeSet;
 use std::str::FromStr;
 
@@ -28,8 +24,6 @@ use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions};
 
 const REMOTE_ACTOR: &str = "https://remote.example/users/ann";
 
-/// Private in-memory database with plain `SqliteConnectOptions`; relies on
-/// sqlx's default `foreign_keys = ON`, which production also depends on.
 async fn migrated_pool() -> SqlitePool {
     let opts = SqliteConnectOptions::from_str("sqlite::memory:").unwrap();
     let pool = SqlitePoolOptions::new()
@@ -202,7 +196,6 @@ async fn seed_user_with_dependents(
         )
         .await
         .unwrap();
-    // No repository in this crate owns these two tables (federation crate).
     sqlx::query("INSERT INTO blocked_actors (local_user_id, remote_actor_url, blocked_at) VALUES (?, ?, 'now')")
         .bind(user_id.value().to_string())
         .bind(REMOTE_ACTOR)

crates/adapters/sqlite/tests/repositories/movie_dedup_test.rs

@@ -46,8 +46,6 @@ async fn insert_review(pool: &SqlitePool, movie: &MovieId) {
     .unwrap();
 }
 
-/// Mirrors what `application::movies::merge_duplicates` builds when the
-/// canonical row does not exist.
 fn canonical_from(old: &Movie, canonical_id: MovieId) -> Movie {
     Movie::from_persistence(
         canonical_id,

crates/adapters/sqlite/tests/repositories/outbox_support.rs

@@ -1,5 +1,3 @@
-//! Shared helpers for the transactional-outbox repository tests.
-
 use std::str::FromStr;
 
 use sqlx::{
@@ -25,8 +23,6 @@ pub async fn count(pool: &SqlitePool, table: &str) -> i64 {
         .unwrap()
 }
 
-/// Makes every later `event_queue` insert abort, so a write whose own row
-/// already landed inside the transaction must be rolled back with it.
 pub async fn fail_event_inserts(pool: &SqlitePool) {
     sqlx::query(
         "CREATE TRIGGER fail_event_insert BEFORE INSERT ON event_queue \

crates/adapters/sqlite/tests/repositories/outbox_writes_test.rs

@@ -1,5 +1,3 @@
-//! Goal, watchlist and profile writes commit with their events or not at all.
-
 use domain::{
     events::DomainEvent,
     models::{ProfileField, UserProfile, WatchlistEntry},
@@ -796,8 +794,6 @@ async fn a_failing_follow_write_rolls_back_the_rows_already_applied() {
     use domain::ports::{FollowCommand, FollowWrite};
     let (pool, user) = pool_with_user().await;
     let mut writes = follow_writes(user.id());
-    // An unknown local user violates the ap_following foreign key after the
-    // follower row was already written.
     writes.push(FollowWrite::AddFollow {
         follower_id: uuid::Uuid::new_v4(),
         target_actor_url: "https://md.example/users/other".into(),

crates/adapters/sqlite/tests/repositories/user_repository_test.rs

@@ -120,7 +120,6 @@ async fn marking_a_user_deleted_hides_them_from_every_lookup() {
     repo.save(&admin).await.unwrap();
     let other = test_user("other");
     repo.save(&other).await.unwrap();
-    // A second admin, so the first is not the last one standing.
     sqlx::query("UPDATE users SET role = 'admin' WHERE id = ?")
         .bind(other.id().value().to_string())
         .execute(&pool)
@@ -145,7 +144,6 @@ async fn marking_a_user_deleted_hides_them_from_every_lookup() {
     assert!(emails.contains(&other.email().value()));
     assert!(!emails.contains(&admin.email().value()));
     assert_eq!(repo.count_active_admins().await.unwrap(), 1);
-    // The purge can still read the tombstone; a live user is not one.
     assert!(
         repo.find_tombstoned_by_id(admin.id())
             .await

crates/adapters/tmdb-enrichment/Cargo.toml

@@ -7,6 +7,7 @@ edition.workspace = true
 config = { workspace = true }
 domain      = { workspace = true }
 reqwest     = { workspace = true }
-serde       = { workspace = true }
+rustls      = { workspace = true, features = ["ring", "std"] }
+serde       = { workspace = true, features = ["derive"] }
 async-trait = { workspace = true }
 chrono      = { workspace = true }

crates/adapters/tmdb-enrichment/src/client.rs

@@ -12,6 +12,7 @@ impl TmdbEnrichmentClient {
             .tmdb_api_key
             .clone()
             .ok_or_else(|| DomainError::InfrastructureError("TMDB_API_KEY is not set".into()))?;
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Ok(Self {
             api_key,
             http: reqwest::Client::new(),

crates/adapters/tmdb-enrichment/tests/client_tls.rs

@@ -0,0 +1,10 @@
+use tmdb_enrichment::TmdbEnrichmentClient;
+
+#[test]
+fn tmdb_enrichment_builds_without_bootstrap() {
+    let cfg = config::MetadataConfig {
+        tmdb_api_key: Some("key".into()),
+        ..Default::default()
+    };
+    TmdbEnrichmentClient::from_config(&cfg).expect("client builds");
+}

crates/api-types/Cargo.toml

@@ -4,9 +4,9 @@ version = "0.1.0"
 edition.workspace = true
 
 [dependencies]
-serde = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
 uuid = { workspace = true }
-utoipa = { version = "5.5.0", features = ["axum_extras", "uuid"] }
+utoipa = { workspace = true, features = ["axum_extras", "uuid"] }
 domain = { workspace = true }
 
 [dev-dependencies]

crates/api-types/src/common.rs

@@ -22,11 +22,8 @@ pub type WatchlistResponse = PaginatedResponse<crate::watchlist::WatchlistEntryD
 pub type PaginatedMovieHits = PaginatedResponse<crate::search::MovieSearchHitDto>;
 pub type PaginatedPersonHits = PaginatedResponse<crate::search::PersonSearchHitDto>;
 
-/// The one body every JSON API refusal carries.
 #[derive(Debug, Clone, Serialize, Deserialize, utoipa::ToSchema)]
 pub struct ErrorResponse {
-    /// Human-readable message.
     pub error: String,
-    /// Stable machine-readable code, e.g. `NOT_FOUND`.
     pub code: String,
 }

crates/api-types/src/mappers/mod.rs

@@ -1,4 +1,3 @@
-//! Pure domain -> DTO mappers (depend only on `domain` and this crate).
 mod diary;
 mod goals;
 mod movies;

crates/api-types/src/users.rs

@@ -126,7 +126,6 @@ pub struct UserProfileResponse {
     pub goals: Option<Vec<GoalDto>>,
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
     pub is_federated: bool,
-    /// The instance's service account: never deletable, so UIs hide the action.
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
     pub is_service_account: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -156,7 +155,6 @@ pub struct UpdateProfileFieldsRequest {
     pub fields: Vec<ProfileFieldDto>,
 }
 
-/// Proof of intent for account deletion: the acting user's own password.
 #[derive(Debug, Clone, Deserialize, utoipa::ToSchema)]
 pub struct DeleteAccountRequest {
     pub password: String,

crates/application/Cargo.toml

@@ -7,11 +7,11 @@ edition.workspace = true
 async-trait = { workspace = true }
 domain = { workspace = true }
 config = { workspace = true }
-uuid = { workspace = true }
-chrono = { workspace = true }
+uuid = { workspace = true, features = ["v4"] }
+chrono = { workspace = true, features = ["clock"] }
 tracing = { workspace = true }
 futures = { workspace = true }
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["rt", "sync", "time", "macros"] }
 sha2 = { workspace = true }
 rand = { workspace = true }
 hex = { workspace = true }
@@ -22,5 +22,5 @@ xlsx = []
 federation = []
 
 [dev-dependencies]
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["rt-multi-thread"] }
 domain = { workspace = true, features = ["test-helpers"] }

crates/application/src/auth/authenticate.rs

@@ -0,0 +1,11 @@
+use domain::{errors::DomainError, value_objects::UserId};
+
+use crate::auth::deps::AuthenticateDeps;
+
+pub async fn execute(deps: &AuthenticateDeps, token: &str) -> Result<UserId, DomainError> {
+    let user_id = deps.auth.validate_token(token).await?;
+    match deps.user.find_by_id(&user_id).await? {
+        Some(_) => Ok(user_id),
+        None => Err(DomainError::Unauthorized("account is not active".into())),
+    }
+}

crates/application/src/auth/deps.rs

@@ -32,6 +32,11 @@ pub struct RegisterAndLoginDeps {
     pub config: AppSettings,
 }
 
+pub struct AuthenticateDeps {
+    pub auth: Arc<dyn AuthService>,
+    pub user: Arc<dyn UserRepository>,
+}
+
 pub struct LogoutDeps {
     pub refresh_session: Arc<dyn RefreshSessionRepository>,
 }

crates/application/src/auth/mod.rs

@@ -1,3 +1,4 @@
+pub mod authenticate;
 pub mod commands;
 pub mod deps;
 pub mod login;

crates/application/src/deps.rs

@@ -2,12 +2,15 @@ use std::sync::Arc;
 
 use domain::ports::{EventPublisher, MediaServerParser, ObjectStorage, PersonEnrichmentClient};
 
-use crate::auth::deps::{LoginDeps, LogoutDeps, RefreshDeps, RegisterAndLoginDeps, RegisterDeps};
+use crate::auth::deps::{
+    AuthenticateDeps, LoginDeps, LogoutDeps, RefreshDeps, RegisterAndLoginDeps, RegisterDeps,
+};
 use crate::diary::deps::{
     DeleteReviewDeps, EditReviewDeps, ExportDiaryDeps, GetActivityFeedDeps, GetDiaryDeps,
     GetMovieSocialPageDeps, GetReviewHistoryDeps, GetUserFeedDeps,
 };
 use crate::goals::deps::{GoalCommandDeps, GoalQueryDeps};
+use crate::images::deps::GetImageDeps;
 use crate::import::deps::{
     ApplyMappingDeps, ApplyProfileAndMapDeps, ApplyProfileDeps, CreateSessionDeps,
     DeleteImportProfileDeps, ExecuteImportDeps, GetMappingStageDeps, GetPreviewStageDeps,
@@ -23,10 +26,10 @@ use crate::movies::deps::{
 };
 use crate::movies::merge_duplicates::MergeDuplicatesDeps;
 use crate::person::deps::{EnrichPersonDeps, GetPersonDeps};
-use crate::search::deps::SearchDeps;
+use crate::search::deps::{RequestReindexDeps, SearchDeps};
 use crate::social::deps::{SocialCommandDeps, SocialQueryDeps};
 use crate::users::deps::{
-    AuthorizeAdminDeps, EnsureActiveDeps, GetCurrentProfileDeps, GetFederatedProfileDeps,
+    AuthorizeAdminDeps, GetCurrentProfileDeps, GetFederatedProfileDeps,
     GetFederatedProfileStatsDeps, GetLocalProfileDeps, GetPageViewerDeps, GetProfileSettingsDeps,
     GetSettingsDeps, GetUsersListDeps, RequestAccountDeletionDeps, ResolveUsernameDeps,
     UpdateProfileDeps, UpdateProfileFieldsDeps, UpdateSettingsDeps,
@@ -46,6 +49,7 @@ pub struct AuthGroup {
     pub refresh: RefreshDeps,
     pub register_and_login: RegisterAndLoginDeps,
     pub logout: LogoutDeps,
+    pub authenticate: AuthenticateDeps,
 }
 
 pub struct DiaryGroup {
@@ -64,6 +68,10 @@ pub struct GoalsGroup {
     pub query: GoalQueryDeps,
 }
 
+pub struct ImagesGroup {
+    pub get_image: GetImageDeps,
+}
+
 pub struct ImportGroup {
     pub create_session: CreateSessionDeps,
     pub apply_mapping: ApplyMappingDeps,
@@ -109,6 +117,7 @@ pub struct PersonGroup {
 
 pub struct SearchGroup {
     pub execute: SearchDeps,
+    pub request_reindex: RequestReindexDeps,
 }
 
 pub struct SocialGroup {
@@ -125,7 +134,6 @@ pub struct UsersGroup {
     pub get_users_list: GetUsersListDeps,
     pub update_profile: UpdateProfileDeps,
     pub request_account_deletion: RequestAccountDeletionDeps,
-    pub ensure_active: EnsureActiveDeps,
     pub get_current_profile: GetCurrentProfileDeps,
     pub update_profile_fields: UpdateProfileFieldsDeps,
     pub get_settings: GetSettingsDeps,
@@ -163,6 +171,7 @@ pub struct Deps {
     pub auth: AuthGroup,
     pub diary: DiaryGroup,
     pub goals: GoalsGroup,
+    pub images: ImagesGroup,
     pub import: ImportGroup,
     pub insights: InsightsGroup,
     pub integrations: IntegrationsGroup,

crates/application/src/diary/delete_review.rs

@@ -20,7 +20,6 @@ pub async fn execute(deps: &DeleteReviewDeps, cmd: DeleteReviewCommand) -> Resul
     }
 
     let movie_id = review.movie_id().clone();
-    // Read before the write: the orphan event carries the poster to clean up.
     let poster_path = deps
         .diary
         .get_review_history(&movie_id)
@@ -29,7 +28,6 @@ pub async fn execute(deps: &DeleteReviewDeps, cmd: DeleteReviewCommand) -> Resul
         .poster_path()
         .cloned();
 
-    // One write: the review, plus its movie when this was the last review.
     deps.review
         .delete_review_and_orphaned_movie(
             &review_id,

crates/application/src/diary/review_logger.rs

@@ -76,7 +76,6 @@ impl ReviewLogger for DefaultReviewLogger {
             watched_at: *review.watched_at(),
         };
 
-        // Events ride the review save (the decisive write) so they commit with it.
         let mut events = Vec::with_capacity(2);
         if let Some(ext_id) = movie.external_metadata_id() {
             events.push(DomainEvent::MovieEnrichmentRequested {
@@ -87,7 +86,6 @@ impl ReviewLogger for DefaultReviewLogger {
         events.push(review_event);
         self.review_repo.save_review(&review, &events).await?;
 
-        // The removal event is recorded only if an entry was actually removed.
         self.watchlist_repo
             .remove_if_present(
                 review.user_id(),

crates/application/src/goals/create.rs

@@ -29,7 +29,6 @@ pub async fn execute(
         cmd.target_count,
         GoalType::Movies,
     )?;
-    // Reads that can fail happen before the write, so an error never follows a commit.
     let current_count = deps.stats.count_reviews_in_year(&user_id, cmd.year).await?;
     let event = DomainEvent::GoalCreated {
         goal_id: g.id().clone(),

crates/application/src/goals/update.rs

@@ -17,7 +17,6 @@ pub async fn execute(
         .ok_or_else(|| DomainError::NotFound(format!("Goal for year {}", cmd.year)))?;
 
     g.update_target(cmd.target_count)?;
-    // Reads that can fail happen before the write, so an error never follows a commit.
     let current_count = deps.stats.count_reviews_in_year(&user_id, cmd.year).await?;
     let event = DomainEvent::GoalUpdated {
         goal_id: g.id().clone(),

crates/application/src/images/deps.rs

@@ -0,0 +1,7 @@
+use std::sync::Arc;
+
+use domain::ports::ObjectStorage;
+
+pub struct GetImageDeps {
+    pub object_storage: Arc<dyn ObjectStorage>,
+}

crates/application/src/images/get_image.rs

@@ -0,0 +1,7 @@
+use domain::errors::DomainError;
+
+use crate::images::deps::GetImageDeps;
+
+pub async fn execute(deps: &GetImageDeps, key: &str) -> Result<Vec<u8>, DomainError> {
+    deps.object_storage.get(key).await
+}

crates/application/src/images/mod.rs

@@ -0,0 +1,2 @@
+pub mod deps;
+pub mod get_image;

crates/application/src/import/execute.rs

@@ -88,7 +88,6 @@ pub async fn execute(
     })
 }
 
-/// Row-level validation failures keep their bare message in the summary.
 fn import_error_message(e: DomainError) -> String {
     match e {
         DomainError::ValidationError(msg) => msg,