Fixes from an MVP-readiness audit (three independent reviewers across composer/queue, accounts/login, and shell/analytics/actions). Grouped into reviewable commits.
Batch 1 — the root-cause feedback bug (highest impact)
Provider + toast helper scripts load as deferred type="module" after the page content, but inline scripts captured window.postlineToast / window.postlineBluesky eagerly at parse time → undefined on every full page load / refresh / OAuth-redirect-back. Composer + Queue silently dropped all feedback to console.log; Accounts showed a connected Bluesky as "Not connected". Fixed by resolving the helpers at call time + gating Bluesky's initial fetch on DOMContentLoaded (mirroring the LinkedIn/Twitter cards). Plus: Queue delete confirmation, and removed the dead /blog keyboard shortcut (404'd).
Batch 2a — register safety + mobile + small wins
- login: Confirm-password field (register mode only) so a first-run typo can't create the sole-owner account with no recovery; name required in register.
- accounts: provider cards stack on mobile instead of crushing the text column; aria-labels on the placeholder-only Mastodon inputs.
- queue: "View" resolves any stored
http(s)permalink (not just Bluesky); item action row wraps on mobile; calendar scrolls horizontally instead of squishing.
Batch 2b — analytics no longer hangs
A failed metrics fetch used to leave the dashboard stuck on "Loading…" forever. Now renders an inline error banner + Retry; Retry re-fetches and restores on success.
Verification
pickierclean ·bun run typecheckexit 0 ·bun test74/0- ⚠️ Not browser-exercised — Postline's own dev server wasn't running locally (another app occupied its ports), so these are lint-and-read verified. A click-through on the next
buddy devis recommended before merge.
Still queued (safe wins, next batch)
Client-side validation gates (over-limit / past-schedule / IG-needs-image) · OAuth callback toasts (defer the post-redirect confirmation) · aria-pressed/aria-current on mode/view/theme toggles.