Improvement candidates — markpost — August 30th, 2026

[grimicorn-agent]

Automated weekly scan. Check the boxes for the improvements you want turned into tracked issues, then close this issue when you're done triaging — closing it is the go signal. On its next run the agent creates the checked items as real issues (unassigned, labelled by priority) and leaves this digest closed; unchecked items are dismissed and won't be re-proposed. While this stays open nothing happens, so take as long as you need.

• markpost-pr232-1 Serve RFC 9728 metadata + page Markdown from buildAppUrl() — protectedResource.ts and agentContent.ts still derive resource/resource_documentation and page Markdown base URLs from a hardcoded SITE_URL, advertising a stale origin on custom domains. (suggested: P2, effort: M, from PR Serve openapi.json/llms.txt/sitemap.xml from the configured app URL #232)
• markpost-pr224-2 Populate sourceType on create/patch responses — Join/re-read sources on POST/PATCH/bulk-PATCH so write responses carry the resolved type instead of a documented null. (suggested: P3, effort: M, from PR Key record source icon/label off the real source type #224)
• markpost-20260830-1 Records can't be deleted or bulk-actioned from the inbox UI — The web app never wires the existing bulk delete and bulk status-update endpoints, so a user cannot delete an errored or unwanted record from the inbox. (suggested: P3, effort: M)
• markpost-pr225-2 DB-level ok-event dedup — Add a partial unique index on events(record_uuid, kind) plus onConflictDoNothing so ok/err event dedup is exact under concurrency instead of best-effort check-then-act. (suggested: P3, effort: M, from PR Make webhook side effects idempotent (source stats + ok event) #225)
• markpost-pr234-1 Cap tag count and per-tag length — A string field mapped to tags expands an arbitrarily large comma body into unbounded tags; add named MAX_TAGS/MAX_TAG_LENGTH limits in coerceTagsValue. (suggested: P3, effort: S, from PR Extend tag field mapping to comma-strings and object arrays #234)

Rationale

• markpost-pr232-1: server/utils/protectedResource.ts and agentContent.ts still derive the protected-resource resource/resource_documentation URLs and the / and /docs Markdown base URL from a hardcoded SITE_URL, so a custom-domain deploy advertises the stale origin.
• markpost-pr224-2: Join/re-read sources on POST/PATCH/bulk-PATCH so write responses carry the resolved type instead of a documented null. (evidence: server/api/records/index.post.ts, [uuid].patch.ts, index.patch.ts)
• markpost-20260830-1: server/api/records/index.delete.ts (user-scoped bulk delete, batch up to 100) and server/api/records/index.patch.ts (bulk status update) both exist and are tested, but app/composables/useRecords.ts exposes no delete/select/patch and app/pages/inbox.vue has no per-record or multi-select action UI — endpoints are reachable only by the CLI.
• markpost-pr225-2: Add a partial unique index on events(record_uuid, kind) plus onConflictDoNothing so ok/err event dedup is exact under concurrency instead of best-effort check-then-act (server/utils/eventWriter.ts).
• markpost-pr234-1: A string field mapped to tags expands an arbitrarily large comma body into unbounded tags that flow into records.tags jsonb and one YAML frontmatter line; add named MAX_TAGS/MAX_TAG_LENGTH limits in coerceTagsValue (server/utils/fieldMapper.ts).

[grimicorn-agent]

Promoted: #240, #241, #242, #243, #244. Dismissed: 0 unchecked.