[ael-dev3]

Private mute and block across sessions

Readers can mute or block another account from its profile or hover card, then undo either choice in Settings. Allthing hides whole posts and notification groups involving that account, including known mentions, links, quotes and reply/recast provenance. Remote changes remove matching content from open views and previews while preserving editable drafts. Accessible hover, keyboard and touch help explains the scope, sync behavior and recognition limits. Profile cards keep their View profile link visible and tappable while longer details scroll.

Preferences use a private SpacetimeDB table and caller-scoped view on the existing verified connection. Independent revisions, retained clear tombstones, a committed IndexedDB outbox and account-switch fences prevent stale offline writes from restoring an undone choice. Signed-in content waits for private state. Connection bookkeeping leaves mounted posts and editors intact, and explicit Retry recovers failed local storage reads. Block additionally rejects new encrypted Allthing DMs in both directions using verified FIDs; existing ciphertext is retained. Public Farcaster data and other clients are unaffected.

Validation:

• Rust formatting, native/Wasm/static Clippy, 735 tests and licenses.
• SpacetimeDB module: 17 tests, both lint targets, release Wasm and licenses; 35 real local additive-migration/privacy/realtime/DM checks.
• Node tooling: 17 tests.
• Final affected Chromium batch: 176 passed, three existing declared skips, retries disabled. Covers account switches, denied-storage recovery, offline reload, lost acknowledgements, notifications, mentions beyond excerpts, independent Undo, media, drafts, private Messages and the status contract.
• Static host: 18 passed and 19 existing declared skips, retries disabled.
• Original strict phone and desktop smoothness suite: 70 passed and two existing skips, with zero retries and unchanged budgets.
• Poll security fixtures: three passed with unchanged origin, address, HMAC and vote-count assertions; local D1 queries are awaited so they do not block the test runner.
• Normal full PR CI and first normal main performance checks remain mandatory. Earlier failures are retained; no retry-to-green or skip/budget relaxation.

Publish the module additively with the unchanged attestation pin and --delete-data=never before the Worker advertises the new private view.