feat(blog): blog v7 contract and client (elected moderation, action fees, timelines, post tombstones)

[PastaPastaPasta]

Summary

Blog v7: the mainnet-ready blog contract from the approved design, and the Yappr client for it. The client takes it on with NEXT_PUBLIC_BLOG_TOPOLOGY=v7. Nothing is registered or broadcast, and /devnet stays on v6 (.env.devnet is unchanged).

Contract (contracts/yappr-blog-contract.json, copied verbatim from the design)

• Moderation: elected, one team per contract. Seats are contestable with a 30-day challenge cool-down, a 7-day join window, a 3-day vote window, maxAddedModerators: 10 and ownerProtected. The file's interim team is the contract owner. Registration picks the network's interim the way social v13 does (feat(contracts): social v13 (mainnet candidate) and the blocks contract #690, withInterim): devnet keeps the owner, and mainnet registers notYetUsable. validate-contract-offline --network mainnet shows the latter.
• Fees: the comment tokenCost is removed. Creates now pay feeMultiplier action fees to the moderators: blog 80M, blogPost 80M, blogComment 16M.
• New indexes:
  • blog.timeline [$createdAt] and blogPost.timeline [$createdAt]
  • blogComment.discussedRecent, a ranked window: 72h range, a new window every 24h
  • blogFollow.followersTrend (72h / 24h / 7-day ttl), replacing followersByDay
• Merged count twins: comment counts move into postAndTime (rangeCountable) and follower counts into followers (rangeCountable, ranked at blogId).
• Dropped: blogPost.ownerAndTime, blogComment.ownerAndTime, blogFollow.following and the all-time comment ranking.
• Post tombstone:
  • deleted flag, and tombstoneIsBlank, which requires comments present-and-off and every content field absent
  • hasBody for live posts
  • deleted frozen once set
  • retractedWhen: {present: "deleted"}
  • slug, blogId and publishedAt survive
• Field rules:
  • publishedNotAhead: publishedAt ≤ $updatedAt + 10 min, with $updatedAt now required
  • the slug pattern matches lib/utils/slug.ts
  • image URLs must be https:// or ipfs://
• scripts/property-constraint-cases.mjs gains the 10 tombstone and publishedAt accept/refuse cases.

Client

• Writes: blog, blogPost and blogComment creates carry the $actionFeeAgreement, the same way social post and reply writes do. The amounts come off the committed contract (lib/blog/blog-contract.ts) through declaredActionFeeFor, which state-transition-service uses for both the agreement and the unpriced-action guard. The YAPP comment payment and its UI now apply to v2–v6 only.
• Discovery:
  • On v7, /blog gets a Blogs / Posts switch.
  • Blogs: Newest pages blog.timeline with Load more; Most followed; Trending (3 days) on followersTrend.
  • Posts: Latest posts pages blogPost.timeline; Most discussed (3 days) on discussedRecent.
  • Explore's blog tab reads the post timeline directly.
• Reads:
  • getFollowedBlogs uses ownerAndBlog on v7.
  • Comment and follower counts read the merged indexes. The query shapes are unchanged: a pin is the prefix total, and grouped in counts still serve a whole list.
  • The unused owner-order post and comment reads are removed; their indexes are dropped on v7.
• Delete: the author dashboard has a Delete action on v7, with a confirmation. It writes the tombstone through tombstoneDocument (new base option): {deleted: true, commentsEnabled: false} plus the kept fields.
• Readers and tombstones:
  • Tombstones drop out of every listing, search, quote and notification, because isPublishedBlogPost now excludes them. Comment notifications on a deleted post are skipped too, and the owner's per-blog count leaves them out.
  • A tombstone's link and embed say the post was deleted.
  • The comment path refuses a tombstone before signing.
• Field limits:
  • blogPostDate mirrors publishedNotAhead (10 minutes past $updatedAt) on posts that store $updatedAt (v7); older cuts date posts exactly as before.
  • A publish refused because the device clock runs more than 10 minutes ahead says so, rather than showing "Failed to publish".
  • Empty image URLs are left out instead of sent as ''.
  • On v7, an http:// image URL is refused before signing, with a message the user sees.
• Paged lists: the blog and post discovery lists share useCursorList. A new sort restarts the list from page one, and a Load more still in flight when the sort changes is dropped instead of appended.
• v1–v6 behavior is unchanged, with one write-shape exception: an empty image URL is now left out (or cleared on edit) instead of written as '', on every cut. Readers treat both the same.

Battery (scripts/verify-blog.mjs), self-test only

• Priced creates carry the agreement. createBattery takes an agreementFor(sdk, docType) hook, and verify-blog passes seed-lib's feeAgreementFor with the blog schemas. attemptCreate sends the hand-built batch, and a case can name its own agreement or opt out.
• The 40132/40133 matchers now live once, in social-battery-lib (verify-v8 and verify-v10 import them).
• The YAPP pre-flight and accounting are removed.
• Changed cases:
  • b3c: a comment with no agreement is refused (40132)
  • b9: a comment agreeing to the wrong amount is refused (40133)
  • counts and rankings now read the merged indexes and the 72h windows
• New cases:
  • b22: the author's tombstone, using the shared refused shapes; checks that deleted and publishedAt are frozen and that the slug stays taken
  • b23: a banned author can retract its own post and do nothing else
  • b24: a comment on a tombstone is refused
• selfTestV7 pins the v7 shape: elected moderation, no tokenCost, the fees, the timelines, the dropped indexes and retractedWhen.

Merged with #689 and #690

staging is merged in (no rebase). #689's getNewestBlogs gains the v7 branch: on v7 it returns the head of blog.timeline and is always complete. v1–v6 keep #689's capped, cached scan. Explore, search and discovery all go through it, and v7 discovery still pages getBlogTimelinePage. Discovery's "newest among the first N blogs" notice is kept on v1–v6.

Follow-ups (not in this PR)

• lib/transition-agreements.ts now pulls the blog contract JSON (~15 KB) into the write path's bundle so the fee amounts cannot drift. The social contract JSONs are already bundled the same way. A generated constants module would trim it.
• scripts/seed/non-social/blog.mjs still seeds the v6 shape (YAPP comments, commentCount). It needs the agreement plumbing before it can seed a v7 contract.
• Registering v7, running the live battery, and cutting /devnet over to NEXT_PUBLIC_BLOG_TOPOLOGY=v7.

Test plan

• node scripts/validate-contract-offline.mjs contracts/yappr-blog-contract.json --network mainnet --cost: parses under both validators; create size ~7,010 B signed; documentCreateCost (new index values) is blog 248.5M, blogPost 492.6M, blogComment 90.6M, blogFollow 72.6M
• node scripts/validate-contract-offline.mjs --constraints: every case passes, including the 10 new blog v7 cases
• node scripts/verify-blog.mjs --self-test, plus the storefront, pollr and v10 battery self-tests
• npm run lint: eslint with the worktree's own config (the nested-worktree config clash is a known gotcha)
• npm run test: 1980 tests after the staging merge; specs added for content-utils, blog-contract/fees, post/blog/follow/stats/comment services, the real tombstone payload and the notification filter
• code review and simplification passes (findings applied in the last two commits)
• npm run build
• npm run lint:dead
• npm run build:testing && npm run test:e2e (smoke): 24 passed, 4 skipped
• Live battery against a registered v7 contract (needs registration, which is out of scope here)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fbec38ad-ca83-40fe-8d52-dfef24cde313

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

🔍 Review in progress — actively reviewing now (commit 6e199a0) · triage: critical · Phase 2 only (no Phase 1 for this repository)
████████░░░░░░░░░░░░ 38% · about 10 min left · running for 4 min
✅ triage → ⏭️ Phase 1 → ✅ Phase 2 → ✅ verify 2 → ⏳ fresh Phase 2 (0/1 lanes) → ▫️ publish
_{Estimated from recent reviews of this tier · updated 05:29 UTC · live progress}

[cloudflare-workers-and-pages]

Deploying yappr with    Cloudflare Pages

Latest commit:	6e199a0
Status:	✅  Deploy successful!
Preview URL:	https://6a1e77d2.yappr.pages.dev
Branch Preview URL:	https://feat-blog-v7.yappr.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying yappr-v2 with    Cloudflare Pages

Latest commit:	6e199a0
Status:	✅  Deploy successful!
Preview URL:	https://06916b16.yappr-v2.pages.dev
Branch Preview URL:	https://feat-blog-v7.yappr-v2.pages.dev

View logs

[thepastaclaw]

Final validation — Phase 2 only (no Phase 1 for this repository)

Verified the supplied findings against exact head 625daee and consolidated the duplicate reviewer reports into three in-scope blockers: two discovery regressions and a battery timeout-reconciliation failure. This was a static review; the supplied CI snapshot reports successful lint, type checks, unit/component tests, builds, and dead-code checks, while standard E2E was skipped and non-blocking devnet E2E remained in progress.

🔴 3 blocking

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: general); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: critical by gpt-6.1-sol (effort low) — This large, intricate diff changes consensus-enforced moderation, document constraints and fee allocation in contracts/yappr-blog-contract.json, and changes funds-payment agreements and pre-signing fee guards in lib/services/state-transition-service.ts.
• Phase 1 reviewers: not run (disabled for this repository)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer
• Model comparison: every Phase-2 reviewer also ran on gpt-6-astra; the verifier weighed both sets without knowing which model wrote which

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `app/explore/page.tsx`:
- [BLOCKING] app/explore/page.tsx:117-120: Continue past filtered timeline pages in Explore
  `getLatestPosts({ limit: 20 })` limits the raw timeline documents before filtering drafts and tombstones, and returns `nextCursor` when more documents may remain. This branch discards that cursor and finishes loading immediately. If the newest 20 documents are drafts or tombstones, Explore displays “No blog posts yet” even when published articles exist on the next page, and provides no continuation control. The previous `getRecentPosts` path refilled past drafts; the new Posts discovery also reads beyond empty filtered pages and preserves its continuation. Follow the cursor to obtain public posts, or expose continuation and distinguish a filtered page from an exhausted timeline.

In `lib/blog/content-utils.ts`:
- [BLOCKING] lib/blog/content-utils.ts:343-344: Exclude posts whose parent blog has been removed
  The contract permits moderators to remove a `blog`, while its child posts remain valid through their `moderatedDocument` reference to the removal record. Those published posts can still appear in the new cross-blog timeline or discussed ranking, but `blogService.getMany` omits the removed parent. This helper nevertheless returns every original post, so Explore and Posts discovery render article cards whose links fail with “Blog not found”: `app/blog/page.tsx` requires the parent blog before fetching the post. The previous Explore path started from existing blogs and therefore excluded these orphaned articles. Filter against the resolved parent blogs before returning the hydrated posts, or implement an intentional readable route for posts with removed parents.

In `scripts/battery-lib.mjs`:
- [BLOCKING] scripts/battery-lib.mjs:317-321: Retain the derived document ID when an agreed create times out
  The new agreement branch calls `createWithAgreement`, which derives the exact document ID before broadcasting but returns it only after `broadcastAndWait` succeeds. If the transition lands and confirmation throws a 504, `attemptWrite` receives no result, leaving `storedById` dependent on `findRecentByValues`. Both query variants in that fallback require `$ownerId`, but v7 removes the owner indexes from `blogPost` and `blogComment`, so the fallback cannot find either document type. Successfully committed fixture writes are consequently reported as failures; a timed-out b1 post can abort the battery with “fixture posts unavailable.” Expose and retain the derived ID before waiting so reconciliation can fetch by ID even when confirmation throws, or reconcile through the surviving document-type-specific indexes.

[thepastaclaw]

Re-review — Final validation — Phase 2 only (no Phase 1 for this repository)

Verified the supplied Phase-2 findings against head 6dea5f5: timeout ID preservation and removed-parent filtering are fixed, but Explore still presents a capped, filtered timeline as empty without continuation. Current CI passes lint, type checking, unit tests, browser-component tests, build, dead-code checking, App, and Engine checks; devnet E2E and Cloudflare deployment remain pending, and standard E2E is skipped. Verification was static; no local builds or tests were run.

🔴 1 blocking

1 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: critical by gpt-6.1-sol (effort low) — This large, cross-cutting diff changes funds movement through moderator action fees in contracts/yappr-blog-contract.json and the corresponding fee agreements and guards in lib/services/state-transition-service.ts, alongside intricate moderation and tombstone behavior.
• Phase 1 reviewers: not run (disabled for this repository)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `app/explore/page.tsx`:
- [BLOCKING] app/explore/page.tsx:119-121: Continue past filtered timeline pages in Explore
  (existing thread: https://github.com/PastaPastaPasta/yappr/pull/692#discussion_r4202933678)
  The bounded reader fixes an empty first page, but Explore still discards `nextCursor` when the scan reaches its cap. With 100 newest documents consisting of drafts or tombstones and a published article immediately behind them, this call reads five 20-document pages and returns no posts with a valid continuation cursor. Explore then finishes loading and renders “No blog posts yet” / “Be the first to publish an article!” without a way to continue. The page-cap regression spec confirms that the reader preserves the cursor at this boundary; Posts discovery already retains it, distinguishes a partial-empty result, and offers Load more. Keep the bounded scan, but preserve its continuation and distinguish a filtered result from an exhausted timeline, with a continuation control or a link to paged Posts discovery.