fix(articles): two more from a deeper review pass

[aquie00t]

A second, deeper pass after #133. Two real defects, plus two suspicions I chased and had to drop.

One bad row took down the whole sitemap

handleSitemap is not wrapped in a catch. An article row missing its dates threw while building its entry, and the request failed with a 500 — crawlers lost the sitemap entirely rather than losing one URL's accuracy.

Reproduced with a single row containing nothing but a slug:

TypeError: Cannot read properties of undefined (reading 'slice')

The date helper now tolerates a missing or unparseable value and falls back to today. lastmod is a hint to crawlers, so a slightly wrong one is far cheaper than no sitemap at all. Posts carried the same risk — the entries were built with the same helper — and are covered by the same fix.

The save chain reported a failed follow-up as success

#133 added a follow-up save so an edit typed during an in-flight save is not lost. It fell back to the first save's result when the follow-up failed — so publish saw success and went ahead with text one version behind what the writer was looking at. That is the exact failure the chain was added to prevent, one step further along. The follow-up's result is returned as-is now, and publish's existing guard catches it.

Two things I suspected and measured instead of assuming

Both turned out clean, and I'd rather record that than leave them as open questions:

• A fenced code block's info string. It reaches the DOM as a className, and Tailwind ships plenty of utility classes an author might want to borrow — an overlay smuggled into a code fence would be a neat trick. Measured: only language-<first-word> is ever emitted, so ```fixed inset-0 z-50 becomes the single class language-fixed, which does not exist in the bundle. Not exploitable.
• data: URLs in markdown. Stripped from both images and links by the renderer's default transform — src comes out null, href comes out empty.

Verification

pnpm build, tsc -b, pnpm lint clean. 476 unit tests across 66 files and 29 Playwright tests pass. Both defects have a test that fails on main and passes here.

Still outstanding and not in this PR, since neither is mine to close: a bookmarked article has nowhere to appear (no list endpoint, and BookmarksPage renders only posts and comments), and a comment on an article still cannot link back to it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Hu1QuLxS84vdf1gmzoGtWP

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	tdn-client	22ca165	Commit Preview URL Branch Preview URL	Aug 26 2026, 03:02 AM