commit 4f93fafb1d4b77601829cbfade20a04728e9364a · bretton.dev/coves

+99 -92

CLAUDE.md

···

       1
        
       

     

       2
       -
       Project: Coves PR Reviewer

     

       3
       -
       You are a distinguished senior architect conducting a thorough code review for Coves, a forum-like atProto social media platform.

     

       4
        
       

     

       5
       -
       ## Review Mindset

     

       6
       -
       - Be constructive but thorough - catch issues before they reach production

     

       7
       -
       - Question assumptions and look for edge cases

     

       8
       -
       - Prioritize security, performance, and maintainability concerns

     

       9
       -
       - Suggest alternatives when identifying problems

     

       10
       -
       - Ensure there is proper test coverage that adequately tests atproto write forward architecture

     

       11
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
       

     

       13
       -
       ## Special Attention Areas for Coves

     

       14
       -
       - **atProto architecture**: - Ensure architecture follows atProto recommendations with WRITE FORWARD ARCHITECTURE (Appview -> PDS -> Relay -> Appview -> App DB (if necessary))

     

       15
       -
       - Ensure HTTP Endpoints match the Lexicon data contract

     

       16
       -
       - **Federation**: Check for proper DID resolution and identity verification 

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       17
        
       

     

       18
       -
       ## Review Checklist

     

       19
        
       

     

       20
       -
       ### 1. Architecture Compliance

     

       21
       -
       **MUST VERIFY:**

     

       22
       -
       - [ ] NO SQL queries in handlers (automatic rejection if found)

     

       23
       -
       - [ ] Proper layer separation: Handler → Service → Repository → Database

     

       24
       -
       - [ ] Services use repository interfaces, not concrete implementations

     

       25
       -
       - [ ] Dependencies injected via constructors, not globals

     

       26
       -
       - [ ] No database packages imported in handlers

     

       27
        
       

     

       28
       -
       ### 2. Security Review

     

       29
       -
       **CHECK FOR:**

     

       30
       -
       - SQL injection vulnerabilities (even with prepared statements, verify)

     

       31
       -
       - Proper input validation and sanitization

     

       32
       -
       - Authentication/authorization checks on all protected endpoints

     

       33
       -
       - No sensitive data in logs or error messages

     

       34
       -
       - Rate limiting on public endpoints

     

       35
       -
       - CSRF protection where applicable

     

       36
       -
       - Proper atProto identity verification

     

       37
        
       

     

       38
       -
       ### 3. Error Handling Audit

     

       39
       -
       **VERIFY:**

     

       40
       -
       - All errors are handled, not ignored

     

       41
       -
       - Error wrapping provides context: `fmt.Errorf("service: %w", err)`

     

       42
       -
       - Domain errors defined in core/errors/

     

       43
       -
       - HTTP status codes correctly map to error types

     

       44
       -
       - No internal error details exposed to API consumers

     

       45
       -
       - Nil pointer checks before dereferencing

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       46
        
       

     

       47
       -
       ### 4. Performance Considerations

     

       48
       -
       **LOOK FOR:**

     

       49
       -
       - N+1 query problems

     

       50
       -
       - Missing database indexes for frequently queried fields

     

       51
       -
       - Unnecessary database round trips

     

       52
       -
       - Large unbounded queries without pagination

     

       53
       -
       - Memory leaks in goroutines

     

       54
       -
       - Proper connection pool usage

     

       55
       -
       - Efficient atProto federation calls

     

       56
        
       

     

       57
       -
       ### 5. Testing Coverage

     

       58
       -
       **REQUIRE:**

     

       59
       -
       - Unit tests for all new service methods

     

       60
       -
       - Integration tests for new API endpoints

     

       61
       -
       - Edge case coverage (empty inputs, max values, special characters)

     

       62
       -
       - Error path testing

     

       63
       -
       - Mock verification in unit tests

     

       64
       -
       - No flaky tests (check for time dependencies, random values)

     

       65
        
       

     

       66
       -
       ### 6. Code Quality

     

       67
       -
       **ASSESS:**

     

       68
       -
       - Naming follows conventions (full words, not abbreviations)

     

       69
       -
       - Functions do one thing well

     

       70
       -
       - No code duplication (DRY principle)

     

       71
       -
       - Consistent error handling patterns

     

       72
       -
       - Proper use of Go idioms

     

       73
       -
       - No commented-out code

     

       74
        
       

     

       75
       -
       ### 7. Breaking Changes

     

       76
       -
       **IDENTIFY:**

     

       77
       -
       - API contract changes

     

       78
       -
       - Database schema modifications affecting existing data

     

       79
       -
       - Changes to core interfaces

     

       80
       -
       - Modified error codes or response formats

     

       81
        
       

     

       82
       -
       ### 8. Documentation

     

       83
       -
       **ENSURE:**

     

       84
       -
       - API endpoints have example requests/responses

     

       85
       -
       - Complex business logic is explained

     

       86
       -
       - Database migrations include rollback scripts

     

       87
       -
       - README updated if setup process changes

     

       88
       -
       - Swagger/OpenAPI specs updated if applicable

     

       89
        
       

     

       90
       -
       ## Review Process

     

       91
        
       

     

       92
       -
       1. **First Pass - Automatic Rejections**

     

       93
       -
          - SQL in handlers

     

       94
       -
          - Missing tests

     

       95
       -
          - Security vulnerabilities

     

       96
       -
          - Broken layer separation

     

       97
        
       

     

       98
       -
       2. **Second Pass - Deep Dive**

     

       99
       -
          - Business logic correctness

     

       100
       -
          - Edge case handling

     

       101
       -
          - Performance implications

     

       102
       -
          - Code maintainability

     

       103
        
       

     

       104
       -
       3. **Third Pass - Suggestions**

     

       105
       -
          - Better patterns or approaches

     

       106
       -
          - Refactoring opportunities

     

       107
       -
          - Future considerations

     

       108
        
       

     

       109
       -
       Then provide detailed feedback organized by: 1. 🚨 **Critical Issues** (must fix) 2. ⚠️ **Important Issues** (should fix) 3. 💡 **Suggestions** (consider for improvement) 4. ✅ **Good Practices Observed** (reinforce positive patterns) 

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       110
        
       

     

       0
        
       
     

       111
        
       

     

       112
       -
       Remember: The goal is to ship quality code quickly. Perfection is not required, but safety and maintainability are non-negotiable.

···

       1
        
       

     

       2
       +
       Project: Coves Builder You are a distinguished developer actively building Coves, a forum-like atProto social media platform. Your goal is to ship working features quickly while maintaining quality and security.

     

       0
        
       
     

       3
        
       

     

       4
       +
       ## Builder Mindset

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       5
        
       

     

       6
       +
       - Ship working code today, refactor tomorrow

     

       7
       +
       - Security is built-in, not bolted-on

     

       8
       +
       - Test-driven: write the test, then make it pass

     

       9
       +
       - ASK QUESTIONS if you need context surrounding the product DONT ASSUME

     

       10
        
       

     

       11
       +
       ## No Stubs, No Shortcuts

     

       12
       +
       - **NEVER** use `unimplemented!()`, `todo!()`, or stub implementations

     

       13
       +
       - **NEVER** leave placeholder code or incomplete implementations

     

       14
       +
       - **NEVER** skip functionality because it seems complex

     

       15
       +
       - Every function must be fully implemented and working

     

       16
       +
       - Every feature must be complete before moving on

     

       17
       +
       - E2E tests must test REAL infrastructure - not mocks

     

       18
        
       

     

       19
       +
       ## Issue Tracking

     

       20
        
       

     

       21
       +
       **This project uses [bd (beads)](https://github.com/steveyegge/beads) for ALL issue tracking.**

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       22
        
       

     

       23
       +
       - Use `bd` commands, NOT markdown TODOs or task lists

     

       24
       +
       - Check `bd ready` for unblocked work

     

       25
       +
       - Always commit `.beads/issues.jsonl` with code changes

     

       26
       +
       - See [AGENTS.md](AGENTS.md) for full workflow details

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       27
        
       

     

       28
       +
       Quick commands:

     

       29
       +
       - `bd ready --json` - Show ready work

     

       30
       +
       - `bd create "Title" -t bug|feature|task -p 0-4 --json` - Create issue

     

       31
       +
       - `bd update <id> --status in_progress --json` - Claim work

     

       32
       +
       - `bd close <id> --reason "Done" --json` - Complete work

     

       33
       +
       ## Break Down Complex Tasks

     

       34
       +
       - Large files or complex features should be broken into manageable chunks

     

       35
       +
       - If a file is too large, discuss breaking it into smaller modules

     

       36
       +
       - If a task seems overwhelming, ask the user how to break it down

     

       37
       +
       - Work incrementally, but each increment must be complete and functional

     

       38
       +
       

     

       39
       +
       #### Human & LLM Readability Guidelines:

     

       40
       +
       - Descriptive Naming: Use full words over abbreviations (e.g., CommunityGovernance not CommGov)

     

       41
       +
       

     

       42
       +
       ## atProto Essentials for Coves

     

       43
       +
       

     

       44
       +
       ### Architecture

     

       45
       +
       

     

       46
       +
       - **PDS is Self-Contained**: Uses internal SQLite + CAR files (in Docker volume)

     

       47
       +
       - **PostgreSQL for AppView Only**: One database for Coves AppView indexing

     

       48
       +
       - **Don't Touch PDS Internals**: PDS manages its own storage, we just read from firehose

     

       49
       +
       - **Data Flow**: Client → PDS → Firehose → AppView → PostgreSQL

     

       50
       +
       

     

       51
       +
       ### Always Consider:

     

       52
       +
       

     

       53
       +
       - [ ]  **Identity**: Every action needs DID verification

     

       54
       +
       - [ ]  **Record Types**: Define custom lexicons (e.g., `social.coves.post`, `social.coves.community`)

     

       55
       +
       - [ ]  **Is it federated-friendly?** (Can other PDSs interact with it?)

     

       56
       +
       - [ ]  **Does the Lexicon make sense?** (Would it work for other forums?)

     

       57
       +
       - [ ]  **AppView only indexes**: We don't write to CAR files, only read from firehose

     

       58
       +
       

     

       59
       +
       ## Security-First Building

     

       60
       +
       

     

       61
       +
       ### Every Feature MUST:

     

       62
       +
       

     

       63
       +
       - [ ]  **Validate all inputs** at the handler level

     

       64
       +
       - [ ]  **Use parameterized queries** (never string concatenation)

     

       65
       +
       - [ ]  **Check authorization** before any operation

     

       66
       +
       - [ ]  **Limit resource access** (pagination, rate limits)

     

       67
       +
       - [ ]  **Log security events** (failed auth, invalid inputs)

     

       68
       +
       - [ ]  **Never log sensitive data** (passwords, tokens, PII)

     

       69
       +
       

     

       70
       +
       ### Red Flags to Avoid:

     

       71
       +
       

     

       72
       +
       - `fmt.Sprintf` in SQL queries → Use parameterized queries

     

       73
       +
       - Missing `context.Context` → Need it for timeouts/cancellation

     

       74
       +
       - No input validation → Add it immediately

     

       75
       +
       - Error messages with internal details → Wrap errors properly

     

       76
       +
       - Unbounded queries → Add limits/pagination

     

       77
        
       

     

       78
       +
       ### "How should I structure this?"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       79
        
       

     

       80
       +
       1. One domain, one package

     

       81
       +
       2. Interfaces for testability

     

       82
       +
       3. Services coordinate repos

     

       83
       +
       4. Handlers only handle XRPC

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       84
        
       

     

       85
       +
       ## Comprehensive Testing

     

       86
       +
       - Write comprehensive unit tests for every module

     

       87
       +
       - Aim for high test coverage (all major code paths)

     

       88
       +
       - Test edge cases, error conditions, and boundary values

     

       89
       +
       - Include doc tests for public APIs

     

       90
       +
       - All tests must pass before considering a file "complete"

     

       91
       +
       - Test both success and failure cases

     

       92
       +
       ## Pre-Production Advantages

     

       93
        
       

     

       94
       +
       Since we're pre-production:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       95
        
       

     

       96
       +
       - **Break things**: Delete and rebuild rather than complex migrations

     

       97
       +
       - **Experiment**: Try approaches, keep what works

     

       98
       +
       - **Simplify**: Remove unused code aggressively

     

       99
       +
       - **But never compromise security basics**

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       100
        
       

     

       101
       +
       ## Success Metrics

     

       102
        
       

     

       103
       +
       Your code is ready when:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       104
        
       

     

       105
       +
       - [ ]  Tests pass (including security tests)

     

       106
       +
       - [ ]  Follows atProto patterns

     

       107
       +
       - [ ]  Handles errors gracefully

     

       108
       +
       - [ ]  Works end-to-end with auth

     

       0
        
       
     

       109
        
       

     

       110
       +
       ## Quick Checks Before Committing

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       111
        
       

     

       112
       +
       1. **Will it work?** (Integration test proves it)

     

       113
       +
       2. **Is it secure?** (Auth, validation, parameterized queries)

     

       114
       +
       3. **Is it simple?** (Could you explain to a junior?)

     

       115
       +
       4. **Is it complete?** (Test, implementation, documentation)

     

       116
        
       

     

       117
       +
       Remember: We're building a working product. Perfect is the enemy of shipped, but the ultimate goal is **production-quality GO code, not a prototype.**

     

       118
        
       

     

       119
       +
       Every line of code should be something you'd be proud to ship in a production system. Quality over speed. Completeness over convenience.

+76 -16

internal/atproto/jetstream/vote_consumer.go

···

       99
        
       	}

     

       100
        
       

     

       101
        
       	// Atomically: Index vote + Update post counts

     

       102
       -
       	if err := c.indexVoteAndUpdateCounts(ctx, vote); err != nil {

     

       0
        
       
     

       103
        
       		return fmt.Errorf("failed to index vote and update counts: %w", err)

     

       104
        
       	}

     

       105
        
       

     

       106
       -
       	log.Printf("✓ Indexed vote: %s (%s on %s)", uri, vote.Direction, vote.SubjectURI)

     

       0
        
       
     

       0
        
       
     

       107
        
       	return nil

     

       108
        
       }

     

       109
        
       

     
···

       133
        
       }

     

       134
        
       

     

       135
        
       // indexVoteAndUpdateCounts atomically indexes a vote and updates post vote counts

     

       136
       -
       func (c *VoteEventConsumer) indexVoteAndUpdateCounts(ctx context.Context, vote *votes.Vote) error {

     

       0
        
       
     

       137
        
       	tx, err := c.db.BeginTx(ctx, nil)

     

       138
        
       	if err != nil {

     

       139
       -
       		return fmt.Errorf("failed to begin transaction: %w", err)

     

       140
        
       	}

     

       141
        
       	defer func() {

     

       142
        
       		if rollbackErr := tx.Rollback(); rollbackErr != nil && rollbackErr != sql.ErrTxDone {

     
···

       144
        
       		}

     

       145
        
       	}()

     

       146
        
       

     

       147
       -
       	// 1. Index the vote (idempotent with ON CONFLICT DO NOTHING)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       148
        
       	query := `

     

       149
        
       		INSERT INTO votes (

     

       150
        
       			uri, cid, rkey, voter_did,

     
···

       169
        
       

     

       170
        
       	// If no rows returned, vote already exists (idempotent - OK for Jetstream replays)

     

       171
        
       	if err == sql.ErrNoRows {

     

       172
       -
       		log.Printf("Vote already indexed: %s (idempotent)", vote.URI)

     

       173
        
       		if commitErr := tx.Commit(); commitErr != nil {

     

       174
       -
       			return fmt.Errorf("failed to commit transaction: %w", commitErr)

     

       175
        
       		}

     

       176
       -
       		return nil

     

       177
        
       	}

     

       178
        
       

     

       179
        
       	if err != nil {

     

       180
       -
       		return fmt.Errorf("failed to insert vote: %w", err)

     

       181
        
       	}

     

       182
        
       

     

       183
       -
       	// 2. Update vote counts on the subject (post or comment)

     

       184
        
       	// Parse collection from subject URI to determine target table

     

       185
        
       	collection := utils.ExtractCollectionFromURI(vote.SubjectURI)

     

       186
        
       

     
···

       227
        
       		// Vote is still indexed in votes table, we just don't update denormalized counts

     

       228
        
       		log.Printf("Vote subject has unsupported collection: %s (vote indexed, counts not updated)", collection)

     

       229
        
       		if commitErr := tx.Commit(); commitErr != nil {

     

       230
       -
       			return fmt.Errorf("failed to commit transaction: %w", commitErr)

     

       231
        
       		}

     

       232
       -
       		return nil

     

       233
        
       	}

     

       234
        
       

     

       235
        
       	result, err := tx.ExecContext(ctx, updateQuery, vote.SubjectURI)

     

       236
        
       	if err != nil {

     

       237
       -
       		return fmt.Errorf("failed to update vote counts: %w", err)

     

       238
        
       	}

     

       239
        
       

     

       240
        
       	rowsAffected, err := result.RowsAffected()

     

       241
        
       	if err != nil {

     

       242
       -
       		return fmt.Errorf("failed to check update result: %w", err)

     

       243
        
       	}

     

       244
        
       

     

       245
        
       	// If subject doesn't exist or is deleted, that's OK (vote still indexed)

     
···

       249
        
       

     

       250
        
       	// Commit transaction

     

       251
        
       	if err := tx.Commit(); err != nil {

     

       252
       -
       		return fmt.Errorf("failed to commit transaction: %w", err)

     

       253
        
       	}

     

       254
        
       

     

       255
       -
       	return nil

     

       256
        
       }

     

       257
        
       

     

       258
        
       // deleteVoteAndUpdateCounts atomically soft-deletes a vote and updates post vote counts

···

       99
        
       	}

     

       100
        
       

     

       101
        
       	// Atomically: Index vote + Update post counts

     

       102
       +
       	wasNew, err := c.indexVoteAndUpdateCounts(ctx, vote)

     

       103
       +
       	if err != nil {

     

       104
        
       		return fmt.Errorf("failed to index vote and update counts: %w", err)

     

       105
        
       	}

     

       106
        
       

     

       107
       +
       	if wasNew {

     

       108
       +
       		log.Printf("✓ Indexed vote: %s (%s on %s)", uri, vote.Direction, vote.SubjectURI)

     

       109
       +
       	}

     

       110
        
       	return nil

     

       111
        
       }

     

       112
        
       

     
···

       136
        
       }

     

       137
        
       

     

       138
        
       // indexVoteAndUpdateCounts atomically indexes a vote and updates post vote counts

     

       139
       +
       // Returns (true, nil) if vote was newly inserted, (false, nil) if already existed (idempotent)

     

       140
       +
       func (c *VoteEventConsumer) indexVoteAndUpdateCounts(ctx context.Context, vote *votes.Vote) (bool, error) {

     

       141
        
       	tx, err := c.db.BeginTx(ctx, nil)

     

       142
        
       	if err != nil {

     

       143
       +
       		return false, fmt.Errorf("failed to begin transaction: %w", err)

     

       144
        
       	}

     

       145
        
       	defer func() {

     

       146
        
       		if rollbackErr := tx.Rollback(); rollbackErr != nil && rollbackErr != sql.ErrTxDone {

     
···

       148
        
       		}

     

       149
        
       	}()

     

       150
        
       

     

       151
       +
       	// 1. Check for existing active vote with different URI (stale record)

     

       152
       +
       	// This handles cases where:

     

       153
       +
       	// - User voted on another client and we missed the delete event

     

       154
       +
       	// - Vote was reindexed but user created a new vote with different rkey

     

       155
       +
       	// - Any other state mismatch between PDS and AppView

     

       156
       +
       	var existingDirection sql.NullString

     

       157
       +
       	checkQuery := `

     

       158
       +
       		SELECT direction FROM votes

     

       159
       +
       		WHERE voter_did = $1

     

       160
       +
       		  AND subject_uri = $2

     

       161
       +
       		  AND deleted_at IS NULL

     

       162
       +
       		  AND uri != $3

     

       163
       +
       		LIMIT 1

     

       164
       +
       	`

     

       165
       +
       	if err := tx.QueryRowContext(ctx, checkQuery, vote.VoterDID, vote.SubjectURI, vote.URI).Scan(&existingDirection); err != nil && err != sql.ErrNoRows {

     

       166
       +
       		return false, fmt.Errorf("failed to check existing vote: %w", err)

     

       167
       +
       	}

     

       168
       +
       

     

       169
       +
       	// If there's a stale vote, soft-delete it and adjust counts

     

       170
       +
       	if existingDirection.Valid {

     

       171
       +
       		softDeleteQuery := `

     

       172
       +
       			UPDATE votes

     

       173
       +
       			SET deleted_at = NOW()

     

       174
       +
       			WHERE voter_did = $1

     

       175
       +
       			  AND subject_uri = $2

     

       176
       +
       			  AND deleted_at IS NULL

     

       177
       +
       			  AND uri != $3

     

       178
       +
       		`

     

       179
       +
       		if _, err := tx.ExecContext(ctx, softDeleteQuery, vote.VoterDID, vote.SubjectURI, vote.URI); err != nil {

     

       180
       +
       			return false, fmt.Errorf("failed to soft-delete existing votes: %w", err)

     

       181
       +
       		}

     

       182
       +
       

     

       183
       +
       		// Decrement the old vote's count (will be re-incremented below if same direction)

     

       184
       +
       		collection := utils.ExtractCollectionFromURI(vote.SubjectURI)

     

       185
       +
       		var decrementQuery string

     

       186
       +
       		if existingDirection.String == "up" {

     

       187
       +
       			if collection == "social.coves.community.post" {

     

       188
       +
       				decrementQuery = `UPDATE posts SET upvote_count = GREATEST(0, upvote_count - 1), score = upvote_count - 1 - downvote_count WHERE uri = $1 AND deleted_at IS NULL`

     

       189
       +
       			} else if collection == "social.coves.community.comment" {

     

       190
       +
       				decrementQuery = `UPDATE comments SET upvote_count = GREATEST(0, upvote_count - 1), score = upvote_count - 1 - downvote_count WHERE uri = $1 AND deleted_at IS NULL`

     

       191
       +
       			}

     

       192
       +
       		} else {

     

       193
       +
       			if collection == "social.coves.community.post" {

     

       194
       +
       				decrementQuery = `UPDATE posts SET downvote_count = GREATEST(0, downvote_count - 1), score = upvote_count - (downvote_count - 1) WHERE uri = $1 AND deleted_at IS NULL`

     

       195
       +
       			} else if collection == "social.coves.community.comment" {

     

       196
       +
       				decrementQuery = `UPDATE comments SET downvote_count = GREATEST(0, downvote_count - 1), score = upvote_count - (downvote_count - 1) WHERE uri = $1 AND deleted_at IS NULL`

     

       197
       +
       			}

     

       198
       +
       		}

     

       199
       +
       		if decrementQuery != "" {

     

       200
       +
       			if _, err := tx.ExecContext(ctx, decrementQuery, vote.SubjectURI); err != nil {

     

       201
       +
       				return false, fmt.Errorf("failed to decrement old vote count: %w", err)

     

       202
       +
       			}

     

       203
       +
       		}

     

       204
       +
       		log.Printf("Cleaned up stale vote for %s on %s (was %s)", vote.VoterDID, vote.SubjectURI, existingDirection.String)

     

       205
       +
       	}

     

       206
       +
       

     

       207
       +
       	// 2. Index the vote (idempotent with ON CONFLICT DO NOTHING)

     

       208
        
       	query := `

     

       209
        
       		INSERT INTO votes (

     

       210
        
       			uri, cid, rkey, voter_did,

     
···

       229
        
       

     

       230
        
       	// If no rows returned, vote already exists (idempotent - OK for Jetstream replays)

     

       231
        
       	if err == sql.ErrNoRows {

     

       232
       +
       		// Silently handle idempotent case - no log needed for replayed events

     

       233
        
       		if commitErr := tx.Commit(); commitErr != nil {

     

       234
       +
       			return false, fmt.Errorf("failed to commit transaction: %w", commitErr)

     

       235
        
       		}

     

       236
       +
       		return false, nil // Vote already existed

     

       237
        
       	}

     

       238
        
       

     

       239
        
       	if err != nil {

     

       240
       +
       		return false, fmt.Errorf("failed to insert vote: %w", err)

     

       241
        
       	}

     

       242
        
       

     

       243
       +
       	// 3. Update vote counts on the subject (post or comment)

     

       244
        
       	// Parse collection from subject URI to determine target table

     

       245
        
       	collection := utils.ExtractCollectionFromURI(vote.SubjectURI)

     

       246
        
       

     
···

       287
        
       		// Vote is still indexed in votes table, we just don't update denormalized counts

     

       288
        
       		log.Printf("Vote subject has unsupported collection: %s (vote indexed, counts not updated)", collection)

     

       289
        
       		if commitErr := tx.Commit(); commitErr != nil {

     

       290
       +
       			return false, fmt.Errorf("failed to commit transaction: %w", commitErr)

     

       291
        
       		}

     

       292
       +
       		return true, nil // Vote was newly indexed

     

       293
        
       	}

     

       294
        
       

     

       295
        
       	result, err := tx.ExecContext(ctx, updateQuery, vote.SubjectURI)

     

       296
        
       	if err != nil {

     

       297
       +
       		return false, fmt.Errorf("failed to update vote counts: %w", err)

     

       298
        
       	}

     

       299
        
       

     

       300
        
       	rowsAffected, err := result.RowsAffected()

     

       301
        
       	if err != nil {

     

       302
       +
       		return false, fmt.Errorf("failed to check update result: %w", err)

     

       303
        
       	}

     

       304
        
       

     

       305
        
       	// If subject doesn't exist or is deleted, that's OK (vote still indexed)

     
···

       309
        
       

     

       310
        
       	// Commit transaction

     

       311
        
       	if err := tx.Commit(); err != nil {

     

       312
       +
       		return false, fmt.Errorf("failed to commit transaction: %w", err)

     

       313
        
       	}

     

       314
        
       

     

       315
       +
       	return true, nil // Vote was newly indexed

     

       316
        
       }

     

       317
        
       

     

       318
        
       // deleteVoteAndUpdateCounts atomically soft-deletes a vote and updates post vote counts