Changelog

The chrome around the site grows up. A new three-group mega menu replaces the row of placeholder text links, the search bar lives in the header now and returns categorised results across four kinds of thing, and the account cluster carries a chevron so it actually looks like a menu.

• Mega-menu navigation in the header: Books, Authors, and Community each open a panel of three destinations. Discover is live; the rest carry a SOON pill until their pages ship.
• Categorised header search. Type a query and see the top three matches across Books, Authors, Lists, and Members in one dropdown, with a "View all" link straight through to the full results page.
• A /search page that now mirrors that split, with Books, Authors, Lists, and Members each in their own section instead of just books.
• Sign in link plus a Sign up button for visitors; avatar, display name, and a chevron for signed-in readers, all opening the same profile menu.
• A mobile drawer with collapsible accordions, one per group, and the search bar pinned at the top.
• A polite "coming soon" page sits behind every placeholder route, so a directly-shared URL never 404s.

Search grows up. Results now carry community ratings and reader counts, fuzzy matching catches author names and accented titles that used to silently fail, and a Google Books outage no longer pretends to be a real empty result.

• A /search results page with a full grid, loading skeleton, and a soft inline notice when Google Books is slow rather than a blank screen.
• Hybrid search: Google Books and local trigram matching run in parallel, merge by book, and rank dual-source hits first so the best results bubble up regardless of which source found them.
• Community signal on every search card and book result: the star rating and reader count pulled from the IBDB catalog.
• Stale book data refreshes itself. A nightly sweep at 03:00 UTC touches the 50 oldest rows; recent searches refresh quietly in the background via Next 16 after() so covers and metadata stay current without blocking anything.
• Search rate limits: 60 searches per minute, keyed to your account or your IP, with no user-visible error on rotation.
• A degraded state that is honest about what happened: when Google Books has a bad moment you see a soft notice and local results rather than a wall of nothing.

Reviews and ratings land. Every book now has a community rating and a stack of reviews under it; every review you write gets a permanent home at /u/<handle>/reviews/<book>.

• A review composer at /books/<volumeId>/review with a WYSIWYG editor that renders bold, italic, quotes, lists, and headings inline as you type.
• Ratings move to a one-to-ten scale, picked from a segmented control. Five stars never had enough resolution for the books you actually want to argue about.
• A short summary line above the review and a longer markdown body underneath, with a soft character counter so you can keep going if you really need to.
• Every review gets a permanent canonical page at /u/<handle>/reviews/<book>, plus a card on /u/<handle>/reviews and on /books/<volumeId>/reviews.
• Book pages now show the IBDB community rating, the latest reviews underneath, and a write-a-review link for readers who have shelved the book as Read.
• Markdown in review bodies, with a sanitiser keeping things safe. No script tags, no rogue javascript: links.

Discovery turns on. Find readers whose taste you trust, follow them with one click, and the next time you visit your home page their reviews and lists are waiting.

• A Follow button on every profile, with a hover-to-Unfollow affordance and an instant toggle.
• /discover lands. Trending books, popular lists, and a rail of people worth following for signed-in readers.
• Onboarding step six fills out: a suggested-people picker replaces the old "coming soon" placeholder so your home page has something to render the day after signup.
• A "from people you follow" block on the authenticated home, showing recent reviews and recently updated lists from the last two weeks.
• Discover joins the site header for both visitors and signed-in readers.

Lists land. Build a stack of any books, for any reason. Reorder by drag, type a position to jump, and add from any book page in two clicks.

• List CRUD with three visibility levels (public, unlisted, private).
• Drag-and-drop reorder with keyboard support, plus a click-to-edit position number on every row.
• Add-to-list popover on every book page, with inline new-list creation.
• Public list pages at /u/<owner>/lists/<slug>, with notes shown inline.
• The profile Lists tab fills out: preview of your six most recent lists, link to the full index.
• "My lists" in the site header to jump straight to your stacks.

Every reader gets a profile worth visiting, and every book gets the little Want / Reading / Read pill that turns browsing into shelving.

• Public profile pages at /u/<username> with five tabs: Lists, Reviews, Read, Reading, Want
• A shelf toggle on every book detail page, with instant feedback and a sign-in nudge for visitors
• /me/edit for keeping your display name and bio current
• Settings tucked under /me/settings where they belong, with the old paths kept as polite redirects
• 107 tests, 33 routes, all green

The first day a real visitor can sign up, become a reader, and land somewhere that knows them.

• Magic-link sign-in (Google and Apple chips queued up next)
• A seven-step onboarding: pick a username, write a bio, choose your genres, add three books you have read, set a pace and a yearly goal, find a few people to follow
• Genre-based recommendations on the homepage for signed-in readers, with a top-rated fallback while the catalogue finds its feet
• Settings split into Account, Privacy, Data, and Reports tabs
• The auth callback routes mid-onboarding readers to whichever step they were on, never sending them back to the start

Quiet, security-first work. Every database table now polices its own rows, with tests that pose as anonymous, signed-in, and admin to prove each role only sees what it should.

• Row-Level Security policies on all 15 tables
• pgTAP suites that run as anon, authenticated, and admin to assert real-world visibility
• An is_admin() helper for the admin routes that ship later
• A new docs/architecture/security.md documenting the policy matrix and the audited list of service-role callers
• Nothing new to look at on the surface, but the layer that keeps every later release safe

Fifteen tables, two views, four helpers. Pure infrastructure with no app changes, but the catalogue, the readers, and their shelves now have somewhere to live.

• Identity tables for profiles, follows, and blocks
• A books catalogue with trigram indexes for fast title and author search
• Shelf items and reviews wired to the reading-state model
• Lists and list items for hand-curated collections
• Two computed views (book_aggregates, trending_books) that summarise community signal on the fly
• A handle_new_user() trigger so a profile row appears the moment someone signs up

The opening page of a long story. Everything we need to build on, with placeholder data where the real catalogue will live.

• Next 16 + React 19 + TypeScript 6 (strict, with noUncheckedIndexedAccess) on Tailwind v4
• Supabase Cloud as the source of truth (no local Docker stack)
• Google Books as the catalogue backbone, with a server-only client and fetch-layer caching
• A mock homepage with hero, search bar, and a trending-curators grid
• The book detail page at /books/[volumeId]
• Magic-link sign-in stubbed in, with an open-redirect guard from day one