mrhid6andClaude Opus 5
6a3e0a29a4
Everything checkable without a browser, against scratch databases: - All five Go modules and the adminsite production build compile clean. - Scoping holds: own instance 200, another account's 404, nonexistent 404 -- indistinguishable, so no existence oracle -- and a customer session on the staff API gets 401 where staff gets 200. - max_relinks comes from the API (3), not a constant mirrored in TypeScript. - The inline blob and the download endpoint return byte-identical content, so the fallback is faithful rather than approximate. - ADMIN_API_URL really is baked at build time: 9999 in the deliberately broken image, 8083 in the good one. - The served stylesheet carries site/'s tokens with matching values, plus prefers-color-scheme and both data-theme overrides. - With admin stopped the control plane still reports valid and mutations still succeed -- instances never call admin. - Admin touched only the three licence fields on instances; every other control-plane collection is as the control plane left it. Caught one stale-image bug doing this: the running admin predated the customer blob change, so the licence response had no blob field at all. Rebuilt and re-verified. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>