- Fix SSE streams not terminating on successful jobs (C-2)
- Anchor data/session paths to BASE_DIR instead of CWD (C-3)
- Guard TelegramAuthManager state with RLock (H-1)
- Replace millisecond job ids with uuid4 (H-2)
- Always redact api_id/api_hash on export, drop include_secrets (H-3)
- Enforce JSON content-type + same-origin on mutating requests (H-4)
- Rate-limit auth attempts and phone-code requests (H-5)
- Deep-copy StateStore.load() on all paths (H-6)
- Cap FloodWait retries in forward_message (H-7)
- De-duplicate forwarding handler registration (H-8)
- Validate continuous channels at ingest, join scrape thread on account
removal, fix refresh_config status under lock, cap SSE streams and
JSON body size (M-5, M-6, M-17)
- Add regression tests (33 passing) and REVIEW.md
- Chat bubbles with 1px border-radius, angular tail arrows
- Own messages right (blue), others left (dark) via sender_id vs user_id
- Reply preview with left border accent, clickable scroll to original
- Infinite scroll up via IntersectionObserver on scroll-sentinel
- Date separators (Today/Yesterday/date) between messages
- Full-height messages panel with sidebar (channels) + header
- Backend: reply_to_message data in load_messages(), user_id exposed in auth snapshot
- Auto-scroll to bottom on channel load (triple scrollTop fallback)
- history.scrollRestoration = manual to prevent mid-page jumps
- Graceful shutdown: SIGTERM/SIGINT handlers stop continuous scraper,
disconnect Telegram client, drain running jobs with timeout
- Logging: replace print() with logging module throughout web server,
basicConfig in main.py with structured log format
- Streaming: chunked file reads (64KB) instead of loading entire files
into memory; full HTTP Range Request support (206 Partial Content)
for video seeking in the browser
- Cache: TTL-based in-memory cache (1s) for state.json reads in
StateStore, thread-safe with existing RLock
- Bugfix: send_error_json now converts HTTPStatus to int for JSON
forust