[ael-dev3]

Seen posts were stored only in a browser cache that expired after 30 days or 2,000 posts. This adds durable, private SpacetimeDB reading history and bookmarks, plus a Library with Bookmarks, Likes, Recasts and Seen. Following now defaults to New; For you keeps Hot, and explicit sort choices survive range changes.

Signed-in Home checks bounded remote membership before showing new candidates, including on a fresh device. Foreground dwell records real impressions; already drawn cards retain their position. Library supports pagination, loaded-post filtering, activity times, Back restoration, Mark unread and confirmed cross-device history clearing that preserves bookmarks. Likes and recasts use Hypersnap's retained public reactions.

Cast remains available on Notifications and while Settings is open. A single desktop click or phone tap dismisses Settings and opens compose; keyboard activation also works. Phone post actions retain their full tap targets with room for Save across platform fonts.

The existing attested notification socket carries private caller-scoped metadata, membership and page views. IndexedDB commits the per-account outbox before sending; revision checks, tombstones and clear generations prevent stale offline changes or late account responses from restoring removed state. No chat identity, DM key or Farcaster signing grant is needed to save a post.

Validation: Rust formatting, native/Wasm Clippy and licenses with 707 native tests; isolated module checks with 12 tests; 14 Node tooling/SDK checks; 129 checks against a real SpacetimeDB 2.13 server, including additive migration and 2,105 history rows. Full local browser validation covers 814 functional cases, 70 isolated smoothness cases and 18 static cases, with declared platform skips and no retries. The final change after functional validation is documentation only; all runtime/test files and case identities are identical. Source discovery pins all 959 cases, and the required exact-head PR checks must pass before merge. Back restoration retains its two-pixel limit and exact cached-page assertions.

Rollout: publish the additive database module with the existing attestation key and --delete-data=never before merging the Worker capability flag. Preserve existing notification/chat/DM APIs. Anonymous visits retain the measured JavaScript first-card renderer.