v2.3.4

Three changes: the deep safety tier gets decisive, the legacy API docs page stops being served, and one alias is reserved.

Auto-blocking works again. The deep tier judged 16 destinations as scams at high confidence over three days and blocked none of them, because the policy required an external feed to agree first, and anything a feed knows has already been blocked upstream. That policy is now confident: a high-confidence verdict blocks on its own. A second bug hid behind the first: only a report could name the links to block, so a sweep-found scam at links scope enforced nothing. It now blocks the judged URL.

Live pages were being called dead. The renderer waited for zero in-flight network requests, so one analytics beacon kept a real page "loading" until it timed out and it was reported as unreachable. It now tries a looser wait, but only when the failure was a wait timeout rather than a dead host. Frameset and meta-refresh targets are surfaced instead of reported as "no content", an anti-bot interstitial is named as missing evidence, and the screenshot the browser already captured now reaches the model.

Coverage sweeps stop paging the operator. A sweep that finds nothing conclusive records its verdict and stays quiet, the rule the screening tier already followed. A proposal to add a service to a list still gets through on any trigger, because it carries something to approve.

Redirector verdicts close the loop. Every redirector_service verdict now proposes the service into either the shorteners list (new links refused) or the redirectors list (resolved only). High-confidence redirectors proposals apply themselves; shorteners proposals wait for a human and are persisted so that tap has something to act on.

The legacy API docs page is gone. spoo.me/api?old=1 still rendered the full pre-Mintlify docs: 81 KB, indexable, its own title, competing with the real docs for the same queries while telling the reader they had moved. Its canonical pointed at /api, itself a 301, which made the signal worse rather than better. The branch is removed and /api redirects like every other docs path.

restore-account is reserved. The frontend serves that path for the account-deletion cancel link and Caddy routes it to Next, so a short link with that alias could never resolve. Reserving it keeps the namespace honest.

What's Changed

• chore: reserve the restore-account alias by @Zingzy in #330
• fix(docs): stop serving the legacy API docs page, drop a redirect hop by @Zingzy in #333
• fix(safety): make L2 decisive, honest about renders, and quiet on sweeps by @Zingzy in #335

Full Changelog: v2.3.3...v2.3.4