All deployments

The ECB chains to a Sectigo root missing from Debian bookworm's CA
bundle, so ship it with the app. Each source also converts right after
it syncs, and one failing currency no longer blocks the others.

The entrypoint only ran db:prepare for "./bin/rails server", but the
container starts "./bin/thrust ./bin/rails server", so new migrations
never ran and Solid Queue crashed Puma on missing tables.

Tailwind skipped arbitrary classes inside ERB conditionals; a new test
checks every admin class is in the built CSS.

Net proceeds in DKK from both Stripe accounts, App Store and Google Play,
synced nightly by Solid Queue running inside Puma.

Own admin layout, restyled posts, projects and files pages, and resized
WebP images with preloaded attachments so admin pages load fast.

Build with Kamal's remote builder on the server so the BuildKit cache
persists, and drop CI steps that are no longer needed

• The web comment form and "ask for this item" now honour blocks, and the

rule lives in the model (Donation#open_to?, a Comment validation), so any
future path is covered as well.

• The web comment controller hides drafts like the donation page does.


• Reports of a draft listing, or of a comment on one, 404 for anyone but

the owner, so they can't be used to find out that a draft exists.

What App Review guideline 1.2 asks of an app with user content:

• Reports of listings, comments and people (POST /api/reports), emailed to

support straight away.

• Blocks (/api/blocks): a blocked person's listings, comments and activity

are hidden, their requests are withdrawn, and they can no longer ask for
or comment on the blocker's things.

• A whole-word filter (config/content_filter.yml) on listing titles,

descriptions and comments, in all seven languages.

• App users must accept the terms (POST /api/me/accept_terms) before they

post, comment or ask for things.
The privacy policy now names every service that handles data (Hetzner,
Resend, OpenAI for photo suggestions, the sign-in providers), how long data
is kept and how to delete an account; the terms state zero tolerance for
objectionable content and how reports are handled. Both are now in all
seven languages instead of English only.
Maps use OpenStreetMap's tiles, with the attribution they require, instead
of Carto.