main

sync: drop upstream's subscribeRepos rate limit

Reverts upstream 8fd032f ("Rate limit subscribeRepos", in v0.7.0), which limited com.atproto.sync.subscribeRepos to 5 connections per 60s per IP. Ana asked for the fork to run without it. Every other rate limit is kept. No test covered the limit (the test env sets DISABLE_RATE_LIMITING), so no tests change. Upstream's CHANGELOG entry for it is left as history.

wisp/device-retention

oauth: forget sign-in devices of deleted accounts and idle ones

oauth_device keeps the IP address and user agent of every browser that signed in, but nothing ever deleted a row: account deletion cascaded only the oauth_account_device link, so the device row outlived the account, and the tranquil-store backend kept the link too. Every account deletion path (delete_account_complete, the admin one and delete_account_with_firehose; tranquil-store's shared delete path) now deletes, in the same transaction or write batch, the devices only that account is linked to. Devices another account also signs in on keep their row and just lose the link. A sweep on the scheduled delete-check tick removes devices unused for scheduled.oauth_device_retention_secs (OAUTH_DEVICE_RETENTION_SECS, default 90 days, 0 disables), and unlinked devices after a day: they are created when a sign-in starts, before any account is linked. Use is the newest of the device's last_seen_at, its account links' updated_at (bumped on every sign-in on it) and, on postgres, the updated_at of tokens issued through it (bumped on refresh); tokens in tranquil-store don't record their device. Devices still trusted for 2FA are kept until the trust ends. last_seen_at was never refreshed before; the authorize endpoints now bump it whenever they read the device cookie, and a cookie naming a swept device is treated as no cookie, so a sign-in can't hit the oauth_device foreign keys with a dead id. oauth_token.device_id and oauth_authorization_request.device_id are ON DELETE SET NULL, so deleting a device never ends a session. Tests: store_parity covers all three deletion paths and the sweep on both backends, plus postgres-only trust and token-refresh cases; a tranquil-store unit test covers the sweep with backdated links and a trusted device.

lt/llm-talk

docs: impromptu LLM-talk and other small touches

Lewis: May this revision serve well! <did:plc:3fwecdnvtcscjnrx2p4n7alz>

lt/comms-locale-template

comms: typed locale templates, single-pass render

Lewis: May this revision serve well! <did:plc:3fwecdnvtcscjnrx2p4n7alz>

push-mlyormwoxyzn

fix(api): dont do rotation key validation in signPlcOperation as it blocks migrations

push-luotlruqmzxm

feat(docs): explain our definition of "correct PDS implementation"

push-lvllowrtytqy

feat(config): add more default crawlers/relays

push-mmlouqxtnnpm

fix(api): dont verify signature or DID during importRepo

fix/zombie-websocket-connections

feat(test): test that websockets get closed

feat/tranquil-store-initial-ver

feat(tranquil-store): gc and hardening

Lewis: May this revision serve well! <lu5a@proton.me>