Platform Updates

Repositories: partners-api, moderation.furries.ph

Status: Local implementation only; hosted authorization and release validation remain required

What’s Changed

• Moderation administrators can manually load four 30-day system-wide totals: open cases, cases opened, accepted appeals, and declined appeals.
• The feature is deliberately count-only. It does not expose members, reporters, staff, case IDs, evidence, content, or staff-performance ranking, and it is not part of moderation polling.

Validation

• The five-assertion analytics contract, API type-check, and moderation SPA type-check/production build pass locally.

Repositories: partners.furries.ph, partners-api

Status: Local implementation only; legal-operation review, migration publication, and hosted multi-administrator validation remain required

What’s Changed

• A break-glass FPH administrator can place a preservation hold on one exact moderation case. A different break-glass administrator must record any release, and both actions appear in the case audit trail.
• This adds no browser deletion, automated purge, or retention job. It is a preservation control only, not a claim that legal retention is operational.

Validation

• The five-assertion legal-hold contract and API type-check pass locally.

Repositories: partners.furries.ph, partners-api, moderation.furries.ph

Status: Local implementation only; migration publication and hosted independent-review validation remain required

What’s Changed

• Each Social moderation appeal now has a server-owned seven-day review target. The manual appeal queue prioritizes the nearest targets and clearly marks an overdue review.
• A passed target is not an automatic decision: it does not accept, decline, close, reopen, restore, or notify anyone. A reviewer still claims the appeal and records the independent outcome.

Validation

• The six-assertion appeal-target contract, API type-check, and moderation SPA tests/type-check/production build pass locally. This is not hosted review or production policy evidence.

Repositories: partners.furries.ph, partners-api, moderation.furries.ph

Status: Local implementation only; Git-connected release and hosted role validation remain required

What’s Changed

• Authorized moderation administrators can now download the newest 500 audit metadata receipts from the moderation dashboard. The export is deliberately limited to audit ID, case ID, recorded actor, action, reason, and timestamp.
• It excludes report details, reporter identity, case evidence, private notes, member-notice bodies, raw media locations, and other sensitive fields. The CSV is private/no-store and protects cells from spreadsheet formula handling.
• Opening an authorized case now records a metadata-only access receipt before its protected evidence or current action context is returned. If that record cannot be written, the case detail stays unavailable rather than creating an unaccounted-for view.
• After an export result is prepared, the API records a separate immutable operational receipt containing only the authorized actor, export action, dashboard surface, 500-row cap, and returned count. It retains no CSV contents or sensitive moderation material, and an unavailable receipt blocks the download.
• The existing manual Audit screen also shows the newest 100 aggregate-control access receipts below case history. Reading that list is itself recorded; it adds no poll, direct database connection, Pages Function, background job, or additional Worker.

Impact

• Audit review can be shared for an approved operational purpose without turning the static dashboard into a database client or adding a Cloudflare Pages Function, a new Worker, or background export job.

Upgrade Notes

• The existing audit.view permission remains required. Release only from the connected Git repositories after hosted authorization and operational retention/export handling are validated.

Validation

• The 16-assertion audit-export/operational-access and 13-assertion evidence-access contracts, plus API TypeScript and moderation SPA type/build checks, pass locally. This is not production export or case-access evidence.

Repositories: partners.furries.ph, partners-api, social.furries.ph, moderation.furries.ph

Status: Local implementation only; migration reconciliation and Git-connected release remain required

What’s Changed

• New Social moderation cases for current posts, profiles, and Pages now keep a privacy-minimized snapshot of the public state that opened the case. The dashboard presents it separately from current Social status used for a later action, so an edit, archive, hide, or deletion cannot silently replace the original review context.
• The snapshot keeps only what a reviewer needs: public rendered content or profile/Page description, target identity, relevant visibility/lifecycle, distinct report categories, a bounded post attachment count, and an explicit marker that reporter identity is protected. It excludes reporter identity or narrative, raw media/Sanity locations, checksums, private account data, Page memberships, and Furries PH event, partner, or Rego records.
• Existing cases receive a clearly labelled baseline captured when the staged migration is applied. They are not represented as historical opening snapshots when their earlier content can no longer be reconstructed.

Impact

• Moderators can distinguish the preserved opening evidence from live action context while working a case. No member action, additional Cloudflare service, Pages Function, or dashboard secret is introduced.

Upgrade Notes

• Release only through the connected Git repositories after the existing migration ledger is reconciled. The additive database migration remains unapplied; hosted database/RLS and authenticated multi-role evidence checks are still required.

Validation

• The 12-assertion immutable-evidence contract, API TypeScript check, moderation SPA typecheck/build, and a synthetic fixture-backed visual review pass locally. They do not prove a hosted database migration or production moderator exercise.

Repositories: partners-api, social.furries.ph, moderation.furries.ph

Status: Local implementation only; migration reconciliation and Git-connected release remain required

What’s Changed

• A moderator opening the dashboard from a current Social post, profile, or Page now receives a short-lived, single-use continuation that is bound to that same moderator. Another account cannot redeem it.
• Opening the dashboard creates a case-timeline entry, and redeeming it creates a second entry. The resulting case offers Return to Social, which uses only the original safe relative Social route. The opaque pointer is removed from the dashboard address before the case opens.
• The continuation carries no staff credential, reporter identity, internal target ID, evidence URL, or Social content in the browser address or audit record. The existing partners-api remains the only dynamic service; no Pages Function, extra Worker, browser database connection, or live interrupt was added.

Impact

• Moderators can move from an in-context current target into the focused dashboard and back without losing their Social location. This currently covers post, profile, and Page cases; additional object types remain separate feature work.

Upgrade Notes

• No member action or new dashboard secret is required. Release only through the connected Git repositories after the migration ledger is reconciled and authenticated multi-role redemption testing is complete.

Validation

• The nine-assertion handoff continuity contract, 104-assertion Page contract, API TypeScript check, moderation SPA typecheck/tests/build, and fixture-backed browser rendering pass locally. The staged migration is not applied; hosted database/RLS and Git-connected release evidence remain pending.

Repositories: partners.furries.ph, partners-api, social.furries.ph

Status: Local implementation only; reviewed migration and Git-connected release remain required

What’s Changed

• Signed-in Social members can save, reuse, and reset up to five explicitly chosen interest topics and one coarse country while browsing public events.
• Choosing Use saved choices fills the existing public filters only when the member asks. The catalogue stays deterministic: it does not rank, reorder, infer, or reveal anything from friends, attendance, registration, RSVP activity, follows, feedback, device location, or precise location.
• The record is private to the canonical account and handled only by the existing API service. The static Pages site has no Pages Function, separate Worker, browser database connection, or secret.

Validation

• Local Worker route/migration contract, TypeScript checks, Social unit tests, production build, and fixture-backed browser rendering pass. The additive migration is deliberately not applied because the existing remote migration history needs controlled recovery first; production RLS and hosted release evidence therefore remain pending.

Repositories: social.furries.ph, moderation.furries.ph

Status: Local implementation only; authenticated handoff and Git-connected release remain required

What’s Changed

• Authorized moderators now see the existing Open moderation dashboard control on local topic-feed posts, including cards that show a poll, media, quote, reactions, and topic tags.
• The control opens the post’s existing short-lived, single-use dashboard continuation. Polls, media, reactions, quotes, and topic labels retain that one canonical post case instead of creating duplicate moderation records.
• The browser address still contains no internal target identifier, reporter detail, media address, or staff credential. This adds no new endpoint, background polling, Pages Function, Worker, or direct database access.

Validation

• Social’s focused route contract and full unit suite pass locally. A fixture-backed browser capture confirms the control appears in the rendered topic card. Hosted authentication, handoff redemption, and Git-connected Cloudflare Pages release evidence remain pending.

Repositories: partners.furries.ph, partners-api, moderation.furries.ph, social.furries.ph

Status: Local implementation only; migration/RLS and Git-connected release remain required

What’s Changed

• Manual Social moderation actions now stage one immutable policy-version reference with the existing reason, notice decision, rationale, and idempotent action receipt. This applies consistently to generic enforcement, exact post-content warnings, and timed restrictions.
• The API, rather than the moderation dashboard, selects the current active policy version during the receipt write. A completed action cannot be rebound later, and a restricted audit entry records which policy version governed it.
• The static moderation dashboard adds no request, polling work, browser credential, Pages Function, or direct database access for this behavior.

Validation

• The nine-assertion policy-binding contract, API TypeScript check, and local migration inventory pass. Earlier Social migrations are not applied locally, so database/RLS execution and Git-connected release proof remain pending.

Repositories: partners-api, rego.furries.ph, social.furries.ph

Status: Local implementation only; migration/RLS and Git-connected release remain required

What’s Changed

• A new friend request now creates the same private in-app confirmation for the requester and notification for the recipient, whether it begins in Social or Regosite.
• The recipient e-mail follows their existing Social notification preference. Retrying a request after a lost response uses its existing receipt and does not create duplicate notices or e-mail.
• The shared path reads only the two relevant member contact records. It does not expose registrations, attendance, posts, follows, safety controls, or moderation information between the products.

Validation

• The seven-assertion request-notification contract, related canonical friendship contracts, and API TypeScript check pass locally. Paired-account, database/RLS, and Git-connected release evidence remain pending.