[Rinse12]

Closes #217

Summary

Upgrades @pkcprotocol/pkc-js from 0.0.133 to 0.0.134 (exact pin). No CLI code changes.

 update cycle, signing a grandparent comment
   rebuild nested replies from the DB
-    { pages }                 # pageCids dropped, signature fails, cycle throws
+    { pageCids, pages }       # same shape that was signed, signature verifies

The bug (pkcprotocol/pkc-js#477) needs settings.pages with a preloaded nested reply sort next to a non-preloaded one, plus a thread at least three levels deep. Communities on the default sorts never hit it. On affected communities, depths above the failure stop recalculating, and publications waiting on that cycle fail with ERR_COMMENT_UPDATE_SIGNATURE_IS_INVALID.

The same release also covers preloaded flat sorts. Reply rows now store a flat marker, and the post's signature vouches for flat page entries, because those entries were signed with replies the page leaves out.

Evidence

• Before: bug(pages): a nested CommentUpdate with an embedded page and a page-CID sort is rebuilt without pageCids, so its signature fails and the update cycle dies at the grandparent pkcprotocol/pkc-js#477 has the failure and an offline reproduction against a community DB backup. I did not reproduce it from this repo.
• After: npm run build && npm run build:test pass. npm run test:cli: 52 files passed, 451 tests passed, 2 skipped.

The CLI suite only shows the upgrade causes no regressions. The fix itself is covered by the tests added upstream (rebuilt-replies-match-signed, rebuilt-replies-cycle).

Merge Danger

Door: two-way

Reverting the pin restores 0.0.133. There is no DB_VERSION bump, but rows written by 0.0.134 can carry the new flat key. Reading those rows after a downgrade was not tested.

Blast Radius: pages

Limited to reply page generation and CommentUpdate verification in pkc-js. There are no API, dependency or engines changes, and only the pkc-js entries in package-lock.json change.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 20 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 68cdd863-3e33-4ac6-806c-cc8a7f8c4acb

Commits

Reviewing files that changed from the base of the PR and between 3aacdbc and 8d443fe.

Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 1

• package.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T09:05:14.637267Z	8d443fe	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.