From 60aee6c293014103b812e183511e76d4b580476b Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:28:52 +0000
Subject: [PATCH 01/11] fix: bound relationship definitions and single-file
 entity arrays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An untrusted collection.json's `relationships` record is unbounded and its
keys are `type.field`. Grouping keeps per-entity work proportional to one
type's bucket, but a record whose keys all share the primary type's prefix
collapses into a single bucket, so both the resolve pass and the per-card
rank pass become O(relationships x entities) — a synchronous multi-minute
main-thread freeze on a crafted payload. Cap the honoured relationships at
MAX_RELATIONSHIPS, matching the existing entity-type and entity-id caps.

The single-file entity paths (`{type}s.json` / `{type}.json` served as one
array) mapped an unbounded array, bypassing the MAX_ENTITY_IDS ceiling the
index-driven path enforces and supplying the entity-count multiplier for the
relationship product. Route both through a shared cap.

Assisted-by: Claude:claude-fable-5
---
 src/loaders/collectionLoader.ts            | 42 ++++++++++++-------
 src/loaders/relationshipResolver.ts        | 27 ++++++++++--
 tests/loaders/collectionLoader.test.ts     | 14 +++++++
 tests/loaders/relationshipResolver.test.ts | 48 ++++++++++++++++++++++
 4 files changed, 114 insertions(+), 17 deletions(-)

diff --git a/src/loaders/collectionLoader.ts b/src/loaders/collectionLoader.ts
index 682efc8..f6995fe 100644
--- a/src/loaders/collectionLoader.ts
+++ b/src/loaders/collectionLoader.ts
@@ -198,6 +198,32 @@ function extractEntityIds(data: unknown, pluralType: string): string[] {
  * @param entityType - Type of entities to load (singular form, e.g., "advert")
  * @returns Array of entities
  */
+/**
+ * Parse a single-file entity array into deduplicated entities.
+ *
+ * The index-driven path caps its id list at MAX_ENTITY_IDS, but a collection
+ * can skip index.json and serve `{type}s.json` as one array. Apply the same
+ * ceiling here so an untrusted single file cannot exceed the entity count the
+ * rest of the pipeline (relationship resolution, per-card rendering) is sized
+ * for.
+ */
+function parseEntityArray(data: unknown[], urlLabel: string): Entity[] {
+  let rows = data;
+  if (rows.length > MAX_ENTITY_IDS) {
+    console.warn(
+      `Entity file lists ${String(rows.length)} entities; loading the first ${String(MAX_ENTITY_IDS)}.`
+    );
+    rows = rows.slice(0, MAX_ENTITY_IDS);
+  }
+  return dedupeEntitiesById(
+    rows
+      .map((item, index) =>
+        parseEntityTolerant(item, `${urlLabel}[${String(index)}]`)
+      )
+      .filter((entity): entity is Entity => entity !== null)
+  );
+}
+
 export async function loadEntities(
   basePath: string,
   entityType: string
@@ -270,13 +296,7 @@ export async function loadEntities(
         const data = (await response.json()) as unknown;
 
         if (Array.isArray(data)) {
-          return dedupeEntitiesById(
-            data
-              .map((item, index) =>
-                parseEntityTolerant(item, `${pluralFileUrl}[${String(index)}]`)
-              )
-              .filter((entity): entity is Entity => entity !== null)
-          );
+          return parseEntityArray(data, pluralFileUrl);
         }
 
         const single = parseEntityTolerant(data, pluralFileUrl);
@@ -299,13 +319,7 @@ export async function loadEntities(
         const data = (await response.json()) as unknown;
 
         if (Array.isArray(data)) {
-          return dedupeEntitiesById(
-            data
-              .map((item, index) =>
-                parseEntityTolerant(item, `${singleFileUrl}[${String(index)}]`)
-              )
-              .filter((entity): entity is Entity => entity !== null)
-          );
+          return parseEntityArray(data, singleFileUrl);
         }
 
         // Single entity in file
diff --git a/src/loaders/relationshipResolver.ts b/src/loaders/relationshipResolver.ts
index 6b9d323..cb4bfc5 100644
--- a/src/loaders/relationshipResolver.ts
+++ b/src/loaders/relationshipResolver.ts
@@ -11,6 +11,21 @@ import type {
   RelationshipDefinition,
 } from "@/types/schema";
 
+/**
+ * Upper bound on the number of relationship definitions honoured from an
+ * untrusted collection.json.
+ *
+ * The relationship record is `type.field` keyed and unbounded in the schema.
+ * Grouping keeps the per-entity work proportional to the entries for one type,
+ * but a record where every key shares the primary type's prefix collapses into
+ * a single bucket, so both the resolve pass and the per-card rank pass become
+ * O(relationships x entities) — a synchronous multi-minute main-thread freeze
+ * on a crafted payload. Cap the record the way entity types and ids are
+ * already capped (MAX_ENTITY_TYPES, MAX_ENTITY_IDS). Real collections declare
+ * a handful of relationships, so the ceiling is far above any honest use.
+ */
+export const MAX_RELATIONSHIPS = 200;
+
 /**
  * Context for resolving relationships.
  */
@@ -65,9 +80,15 @@ export function createResolverContext(
     [string, RelationshipDefinition][]
   >();
 
-  for (const [relKey, relDef] of Object.entries(
-    definition.relationships ?? {}
-  )) {
+  const relationshipEntries = Object.entries(definition.relationships ?? {});
+  if (relationshipEntries.length > MAX_RELATIONSHIPS) {
+    console.warn(
+      `Collection declares ${String(relationshipEntries.length)} relationships; ` +
+        `only the first ${String(MAX_RELATIONSHIPS)} are resolved.`
+    );
+  }
+
+  for (const [relKey, relDef] of relationshipEntries.slice(0, MAX_RELATIONSHIPS)) {
     const [relType, fieldName] = relKey.split(".");
     if (!relType || !fieldName) {
       continue;
diff --git a/tests/loaders/collectionLoader.test.ts b/tests/loaders/collectionLoader.test.ts
index b5b0a9f..9e667f9 100644
--- a/tests/loaders/collectionLoader.test.ts
+++ b/tests/loaders/collectionLoader.test.ts
@@ -205,6 +205,20 @@ describe("entity fetch fan-out is bounded", () => {
     expect(entities).toHaveLength(10000);
     expect(console.warn).toHaveBeenCalledWith(expect.stringContaining("10001"));
   });
+
+  it("caps a single-file entity array that exceeds the maximum", async () => {
+    // Skipping index.json and serving one big array must not bypass the id cap
+    // the index-driven path enforces.
+    const rows = Array.from({ length: 10001 }, (_, i) => ({
+      id: `e${String(i)}`,
+    }));
+    stubFetch({ [`${base}/adverts.json`]: rows });
+
+    const entities = await loadEntities(base, "advert");
+
+    expect(entities).toHaveLength(10000);
+    expect(console.warn).toHaveBeenCalledWith(expect.stringContaining("10001"));
+  });
 });
 
 describe("entity-type fan-out is bounded", () => {
diff --git a/tests/loaders/relationshipResolver.test.ts b/tests/loaders/relationshipResolver.test.ts
index b627295..40c80d0 100644
--- a/tests/loaders/relationshipResolver.test.ts
+++ b/tests/loaders/relationshipResolver.test.ts
@@ -9,6 +9,7 @@ import {
   resolveEntityRelationships,
   resolveAllRelationships,
   getEntityRank,
+  MAX_RELATIONSHIPS,
 } from "@/loaders/relationshipResolver";
 import type { CollectionDefinition, Entity } from "@/types/schema";
 
@@ -284,4 +285,51 @@ describe("relationshipResolver with an attacker-scaled definition", () => {
 
     expect(elapsed).toBeLessThan(1500);
   });
+
+  /**
+   * Grouping keeps the per-entity work proportional to one type's bucket, but a
+   * record whose keys all share the primary type's prefix collapses into a
+   * single bucket. Without a cap that bucket is |relationships| entries, so the
+   * resolve and rank passes become O(relationships x entities) again.
+   */
+  function samePrefixDefinition(relationshipCount: number): CollectionDefinition {
+    const relationships: CollectionDefinition["relationships"] = {};
+    for (let i = 0; i < relationshipCount; i++) {
+      relationships[`game.field${String(i)}`] = {};
+    }
+    return {
+      id: "hostile",
+      name: "Hostile",
+      entityTypes: { game: { primary: true, fields: {} } },
+      relationships,
+    };
+  }
+
+  it("caps the relationships honoured for a single entity type", () => {
+    const definition = samePrefixDefinition(MAX_RELATIONSHIPS + 500);
+    const context = createResolverContext(definition, { game: [] });
+
+    const bucket = context.relationshipsByType.get("game") ?? [];
+    expect(bucket.length).toBeLessThanOrEqual(MAX_RELATIONSHIPS);
+  });
+
+  it("resolves a same-prefix relationship flood without super-linear cost", () => {
+    const definition = samePrefixDefinition(20000);
+    const entities: Entity[] = Array.from({ length: 1000 }, (_, i) => ({
+      id: `g${String(i)}`,
+      title: `Game ${String(i)}`,
+    }));
+    const context = createResolverContext(definition, { game: entities });
+
+    const started = Date.now();
+    resolveAllRelationships("game", context);
+    for (const entity of entities) {
+      getEntityRank(entity, "game", context);
+    }
+    const elapsed = Date.now() - started;
+
+    // Pre-fix the "game" bucket held all 20000 entries, so this was
+    // 20000 x 1000 iterations twice over — a multi-second freeze.
+    expect(elapsed).toBeLessThan(1500);
+  });
 });

From 2ec5f5a3b6095d4002268586f2fd2b204b7f8c4b Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:29:53 +0000
Subject: [PATCH 02/11] fix: cap discovered field options in the settings panel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Entity schemas are loose, so an untrusted collection can carry an unbounded
number of keys, all copied onto the display card. useAvailableFields walked
every key of the sampled cards and turned each into an <option> in the sort,
badge and group-by selectors — which render outside the collection error
boundary, so an entity with tens of thousands of matching keys froze or
OOM-killed the tab on a single synchronous commit.

Bound discovery at MAX_AVAILABLE_FIELDS (100), stopping the per-card walk
early so a hostile key space cannot make discovery allocate without bound,
matching the MAX_DISPLAYABLE_FIELDS cap on card-detail rows.

Assisted-by: Claude:claude-fable-5
---
 src/hooks/useAvailableFields.ts        | 39 ++++++++++++++++---
 tests/hooks/useAvailableFields.test.ts | 52 ++++++++++++++++++++++++++
 2 files changed, 85 insertions(+), 6 deletions(-)
 create mode 100644 tests/hooks/useAvailableFields.test.ts

diff --git a/src/hooks/useAvailableFields.ts b/src/hooks/useAvailableFields.ts
index 2f4aded..ba136d0 100644
--- a/src/hooks/useAvailableFields.ts
+++ b/src/hooks/useAvailableFields.ts
@@ -20,6 +20,20 @@ import type { FieldOption } from "@/utils/fieldPathResolver";
 const TOP_BADGE_FIELD_NAMES = new Set(["myRank", "myVerdict", "rank", "year"]);
 const TOP_BADGE_FIELD_KEYWORDS = ["verdict", "rating", "score"];
 
+/**
+ * Upper bound on the number of distinct fields discovered for the settings
+ * dropdowns.
+ *
+ * Entity schemas are `.loose()`, so an untrusted collection can carry an
+ * unbounded number of keys, all of which are copied onto the display card.
+ * Every discovered field becomes an `<option>` in the settings panel (sort,
+ * badge and group-by selectors), which renders outside the collection error
+ * boundary — so an entity with tens of thousands of matching keys freezes or
+ * OOMs the tab on a single synchronous commit. Cap discovery the way
+ * MAX_DISPLAYABLE_FIELDS (entityFields.ts) caps the card-detail rows.
+ */
+const MAX_AVAILABLE_FIELDS = 100;
+
 /**
  * Convert camelCase to Title Case.
  */
@@ -63,13 +77,17 @@ function extractFields(
   obj: Record<string, unknown>,
   prefix = "",
   maxDepth = 2,
-  currentDepth = 0
+  currentDepth = 0,
+  limit = Number.POSITIVE_INFINITY,
+  fields: string[] = []
 ): string[] {
-  if (currentDepth >= maxDepth) return [];
-
-  const fields: string[] = [];
+  if (currentDepth >= maxDepth) return fields;
 
   for (const [key, value] of Object.entries(obj)) {
+    // Stop once the caller's ceiling is reached so a hostile entity with a huge
+    // key space cannot make discovery walk (and allocate) without bound.
+    if (fields.length >= limit) break;
+
     // Skip internal/private fields
     if (key.startsWith("_")) continue;
 
@@ -79,7 +97,7 @@ function extractFields(
       fields.push(fieldPath);
     } else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
       // Recurse into nested objects
-      fields.push(...extractFields(value as Record<string, unknown>, fieldPath, maxDepth, currentDepth + 1));
+      extractFields(value as Record<string, unknown>, fieldPath, maxDepth, currentDepth + 1, limit, fields);
     } else if (Array.isArray(value) && value.length > 0) {
       // Check first element of arrays
       const first: unknown = value[0];
@@ -106,15 +124,24 @@ export function useAvailableFields() {
     const fieldSet = new Set<string>();
 
     for (const card of sampleCards) {
-      const fields = extractFields(card as Record<string, unknown>);
+      if (fieldSet.size >= MAX_AVAILABLE_FIELDS) break;
+      const fields = extractFields(
+        card as Record<string, unknown>,
+        "",
+        2,
+        0,
+        MAX_AVAILABLE_FIELDS
+      );
       for (const field of fields) {
         fieldSet.add(field);
+        if (fieldSet.size >= MAX_AVAILABLE_FIELDS) break;
       }
     }
 
     // Convert to sorted array and create FieldOption objects
     const allFields: FieldOption[] = Array.from(fieldSet)
       .sort()
+      .slice(0, MAX_AVAILABLE_FIELDS)
       .map((value) => ({
         value,
         label: generateLabel(value),
diff --git a/tests/hooks/useAvailableFields.test.ts b/tests/hooks/useAvailableFields.test.ts
new file mode 100644
index 0000000..a1d32c9
--- /dev/null
+++ b/tests/hooks/useAvailableFields.test.ts
@@ -0,0 +1,52 @@
+/**
+ * Tests for useAvailableFields field discovery.
+ *
+ * Entity schemas are loose, so an untrusted collection can carry an unbounded
+ * number of keys. Every discovered field becomes an <option> in the settings
+ * panel, which renders outside the collection error boundary, so discovery
+ * must be capped.
+ */
+
+import { describe, it, expect, vi } from "vitest";
+import { renderHook } from "@testing-library/react";
+import type { DisplayCard } from "@/types/card";
+
+const collectionDataState: { cards: DisplayCard[] } = { cards: [] };
+
+vi.mock("@/context/CollectionDataContext", () => ({
+  useCollectionData: () => collectionDataState,
+}));
+
+import { useAvailableFields } from "@/hooks/useAvailableFields";
+
+describe("useAvailableFields", () => {
+  it("caps discovered fields from an entity with a huge key space", () => {
+    // A single hostile entity carrying 5000 badge-matching keys.
+    const hostile: Record<string, unknown> = { id: "x", title: "Hostile" };
+    for (let i = 0; i < 5000; i++) {
+      hostile[`score${String(i)}`] = i;
+    }
+    collectionDataState.cards = [hostile as unknown as DisplayCard];
+
+    const { result } = renderHook(() => useAvailableFields());
+
+    // Pre-fix allFields held 5000+ entries, each becoming a settings <option>.
+    expect(result.current.allFields.length).toBeLessThanOrEqual(100);
+    // The keyword-matched selectors must not exceed the discovered set either.
+    expect(result.current.sortFields.length).toBeLessThanOrEqual(102);
+    expect(result.current.topBadgeFields.length).toBeLessThanOrEqual(102);
+  });
+
+  it("still discovers the ordinary fields of a normal collection", () => {
+    collectionDataState.cards = [
+      { id: "a", title: "A", year: 1994, categoryShort: "SNES" },
+    ] as unknown as DisplayCard[];
+
+    const { result } = renderHook(() => useAvailableFields());
+
+    const values = result.current.allFields.map((f) => f.value);
+    expect(values).toContain("title");
+    expect(values).toContain("year");
+    expect(values).toContain("categoryShort");
+  });
+});

From 7b379089608446ec9fa4ceb4d29df56dce454e58 Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:30:51 +0000
Subject: [PATCH 03/11] fix: cap per-card detail links to bound the sources
 overlay

card.detailUrls was assembled from the untrusted, uncapped detailUrls array
plus one link per entry of the uncapped videos array. The MAX_MEDIA_PER_CARD
cap five lines above applies only to the gallery list, not to this one, so a
hostile entity carrying a huge videos array produced tens of thousands of
DetailLinks. Opening that card's Sources button then mounted one anchor
(plus several URL parses) per link with no windowing, freezing the tab; in
list/compact layouts the CardExpanded memo also filtered the whole list per
card on first paint.

Cap the assembled list at MAX_DETAIL_LINKS_PER_CARD, matching the media cap
at the same choke point.

Assisted-by: Claude:claude-fable-5
---
 src/hooks/useCollection.ts                  | 17 ++++++++++++++-
 tests/hooks/useCollection.untrusted.test.ts | 23 +++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/src/hooks/useCollection.ts b/src/hooks/useCollection.ts
index 8b313db..6b3b213 100644
--- a/src/hooks/useCollection.ts
+++ b/src/hooks/useCollection.ts
@@ -160,6 +160,18 @@ interface CollectionResult {
  */
 const MAX_MEDIA_PER_CARD = 100;
 
+/**
+ * Upper bound on detail links kept per card.
+ *
+ * `card.detailUrls` is assembled from the untrusted, uncapped `detailUrls`
+ * array plus one link per entry of the uncapped `videos` array. It feeds the
+ * sources overlay, which renders one anchor (plus several URL parses) per
+ * entry with no windowing, so a hostile entity carrying a huge `videos`/
+ * `detailUrls` array would freeze the tab when the card's Sources button is
+ * opened. Cap it at the same choke point as the media list.
+ */
+const MAX_DETAIL_LINKS_PER_CARD = 100;
+
 /**
  * Coerce an untrusted entity field to a display string.
  *
@@ -453,7 +465,10 @@ async function loadFreshCollection(
               urls.push({ url, source: "YouTube" });
             }
           }
-          return urls.length > 0 ? urls : undefined;
+          if (urls.length === 0) {
+            return undefined;
+          }
+          return urls.slice(0, MAX_DETAIL_LINKS_PER_CARD);
         })(),
         primaryImage,
         // Category/platform info for expanded view
diff --git a/tests/hooks/useCollection.untrusted.test.ts b/tests/hooks/useCollection.untrusted.test.ts
index c3ab290..c63c676 100644
--- a/tests/hooks/useCollection.untrusted.test.ts
+++ b/tests/hooks/useCollection.untrusted.test.ts
@@ -211,6 +211,29 @@ describe("useCollection — malformed untrusted entities do not crash the load",
     expect(card?.imageUrls.length).toBeLessThanOrEqual(100);
   });
 
+  it("caps card.detailUrls for an entity listing a huge number of videos", async () => {
+    const hugeVideoList = Array.from(
+      { length: 5000 },
+      (_, i) => `https://www.youtube.com/watch?v=vid${String(i)}`
+    );
+    setResolvedEntities([
+      { id: "g1", title: "Game One", videos: hugeVideoList },
+    ]);
+
+    const { result } = renderHook(
+      () => useLocalCollection({ basePath: SOURCE_URL }),
+      { wrapper: createWrapper() }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isSuccess).toBe(true);
+    });
+    const card = result.current.data?.cards[0];
+    // The sources overlay renders one anchor (and several URL parses) per link
+    // with no windowing, so detailUrls must be bounded well below 5000.
+    expect(card?.detailUrls?.length ?? 0).toBeLessThanOrEqual(100);
+  });
+
   it("coerces object-typed platform summary/year in categoryInfo", async () => {
     setResolvedEntities([
       {

From 68c812e7f92e3f6f1f73825086a589b03c09bf6f Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:33:05 +0000
Subject: [PATCH 04/11] fix: cap untrusted rank-placeholder and UI label length
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A collection's forced `rankPlaceholderText` (settings.json) and its v2
`uiLabels.rankPlaceholder` are rendered once per unranked card with no
virtualisation, so an unbounded string is amplified by the entity count into
a tab-freezing layout pass — and the forced value persists into global
settings, reproducing on reload before the user can reach the settings panel.

Cap the forced value at ingress (MAX_LABEL_LENGTH) alongside the existing
searchFields/maxVisibleCards bounds, and truncate the v2 UI labels in the
schema. Truncation (not rejection) keeps an honest author's one long label
from denying the whole collection load, since validateCollectionDefinition
throws on a schema failure.

Assisted-by: Claude:claude-fable-5
---
 src/loaders/settingsLoader.ts        | 20 ++++++++++++++++--
 src/schemas/v2/collection.schema.ts  | 31 +++++++++++++++++++++-------
 tests/loaders/settingsLoader.test.ts | 19 +++++++++++++++++
 tests/schemas/collection.v2.test.ts  | 20 ++++++++++++++++++
 4 files changed, 80 insertions(+), 10 deletions(-)

diff --git a/src/loaders/settingsLoader.ts b/src/loaders/settingsLoader.ts
index b152db4..49cf684 100644
--- a/src/loaders/settingsLoader.ts
+++ b/src/loaders/settingsLoader.ts
@@ -37,6 +37,18 @@ const MAX_VISIBLE_CARDS = 10;
  */
 const MAX_SEARCH_FIELDS = 32;
 
+/**
+ * Upper bound on the length of a forced free-text label such as
+ * `rankPlaceholderText`.
+ *
+ * The value is written into persisted global settings and rendered once per
+ * card (every unranked card shows the rank placeholder), with no virtualisation
+ * — so an unbounded string is amplified by the entity count into a huge layout
+ * pass that freezes or OOMs the tab, and it reproduces on reload before the
+ * user can reach the settings panel. A short bound covers every real label.
+ */
+const MAX_LABEL_LENGTH = 120;
+
 /**
  * Load collection settings from a collection directory.
  *
@@ -179,9 +191,13 @@ function validateForcedSettings(raw: Record<string, unknown>): ForcedSettings {
     forced.showDeviceBadge = raw.showDeviceBadge;
   }
 
-  // String fields
+  // String fields. `rankPlaceholderText` is rendered once per unranked card,
+  // so an unbounded value is amplified by the card count; cap the length.
   if (typeof raw.rankPlaceholderText === "string") {
-    forced.rankPlaceholderText = raw.rankPlaceholderText;
+    forced.rankPlaceholderText = raw.rankPlaceholderText.slice(
+      0,
+      MAX_LABEL_LENGTH
+    );
   }
 
   // Field mapping — validate each value, not just the container. Field paths
diff --git a/src/schemas/v2/collection.schema.ts b/src/schemas/v2/collection.schema.ts
index 702952d..5546346 100644
--- a/src/schemas/v2/collection.schema.ts
+++ b/src/schemas/v2/collection.schema.ts
@@ -225,15 +225,30 @@ export type DisplayConfigSchema = z.infer<typeof displayConfigSchema>;
 // UI Labels Schema
 // ============================================================================
 
+/**
+ * Upper bound on an untrusted UI label. `rankPlaceholder` is rendered once per
+ * unranked card with no virtualisation, so an unbounded value is amplified by
+ * the card count into a tab-freezing layout pass; the sibling labels are all
+ * untrusted free text too. Real labels are a few words.
+ *
+ * Truncate rather than reject: a length rejection would throw out of
+ * validateCollectionDefinition and deny the whole collection load, punishing an
+ * honest author for one long label.
+ */
+const MAX_LABEL_LENGTH = 120;
+const labelText = z
+  .string()
+  .transform((value) => value.slice(0, MAX_LABEL_LENGTH));
+
 export const uiLabelsSchema = z.object({
-  moreButton: z.string().optional(),
-  platformLabel: z.string().optional(),
-  acknowledgementButton: z.string().optional(),
-  imageSourceLabel: z.string().optional(),
-  sourceButtonDefault: z.string().optional(),
-  rankPlaceholder: z.string().optional(),
-  wikipediaLabel: z.string().optional(),
-  closeLabel: z.string().optional(),
+  moreButton: labelText.optional(),
+  platformLabel: labelText.optional(),
+  acknowledgementButton: labelText.optional(),
+  imageSourceLabel: labelText.optional(),
+  sourceButtonDefault: labelText.optional(),
+  rankPlaceholder: labelText.optional(),
+  wikipediaLabel: labelText.optional(),
+  closeLabel: labelText.optional(),
 });
 
 export type UILabelsSchema = z.infer<typeof uiLabelsSchema>;
diff --git a/tests/loaders/settingsLoader.test.ts b/tests/loaders/settingsLoader.test.ts
index 1253b93..33e505e 100644
--- a/tests/loaders/settingsLoader.test.ts
+++ b/tests/loaders/settingsLoader.test.ts
@@ -98,6 +98,25 @@ describe("loadCollectionSettings allowlist", () => {
     });
   });
 
+  it("caps the length of a forced rankPlaceholderText", async () => {
+    // Rendered once per unranked card, so an unbounded value is amplified by
+    // the card count into a tab-freezing layout pass, and it persists globally.
+    const hostile = "A".repeat(50000);
+    fetchMock.mockResolvedValue({
+      ok: true,
+      headers: { get: () => "application/json" },
+      json: async () => ({
+        version: 1,
+        forced: { rankPlaceholderText: hostile },
+      }),
+    });
+
+    const result = await loadCollectionSettings("/data/collections/demo");
+
+    expect(result?.forced?.rankPlaceholderText).toBeDefined();
+    expect(result?.forced?.rankPlaceholderText?.length).toBeLessThanOrEqual(120);
+  });
+
   it("accepts valid forced cardBackStyle and titleDisplayMode enum values", async () => {
     // These allowlists were previously inverted: they admitted only out-of-enum
     // values and silently dropped every legitimate one, so an honest author's
diff --git a/tests/schemas/collection.v2.test.ts b/tests/schemas/collection.v2.test.ts
index a1d24f7..9a70eaa 100644
--- a/tests/schemas/collection.v2.test.ts
+++ b/tests/schemas/collection.v2.test.ts
@@ -6,6 +6,7 @@ import { describe, it, expect } from "vitest";
 import {
   imageSchema,
   entitySchema,
+  uiLabelsSchema,
 } from "@/schemas/v2/collection.schema";
 import { getPrimaryImage, type Image } from "@/types/image";
 
@@ -60,6 +61,25 @@ describe("entitySchema", () => {
   });
 });
 
+describe("uiLabelsSchema", () => {
+  it("truncates an over-long label instead of rejecting the collection", () => {
+    // rankPlaceholder is rendered once per unranked card, so an unbounded value
+    // is amplified by the card count. Truncating (rather than failing) keeps an
+    // honest author's over-long label from denying the whole collection load.
+    const result = uiLabelsSchema.safeParse({
+      rankPlaceholder: "Z".repeat(50000),
+    });
+    expect(result.success).toBe(true);
+    expect(result.data?.rankPlaceholder?.length).toBeLessThanOrEqual(120);
+  });
+
+  it("passes an ordinary label through unchanged", () => {
+    const result = uiLabelsSchema.safeParse({ moreButton: "Show more" });
+    expect(result.success).toBe(true);
+    expect(result.data?.moreButton).toBe("Show more");
+  });
+});
+
 describe("getPrimaryImage", () => {
   it("prefers a boxart image over untyped images when no isPrimary flag is set", () => {
     const images: Image[] = [

From 3e09b1d365abd958044f200765bb2a1dcc7d5bde Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:34:43 +0000
Subject: [PATCH 05/11] fix: bound searchFields and label length on the
 settings-import path

The settings-import schema accepted an unbounded searchFields array and an
unbounded rankPlaceholderText, the same values the collection loader already
caps (MAX_SEARCH_FIELDS, MAX_LABEL_LENGTH). Both persist into global settings
and follow the visitor to later collections, so an imported file could freeze
every later search (searchFields resolved per card per query) or every card
render (rank placeholder per unranked card) with no UI to undo it. Cap both
on import, matching the auto-load path.

Assisted-by: Claude:claude-fable-5
---
 src/schemas/settingsExport.schema.ts | 21 +++++++++++++++++++--
 tests/schemas/settingsExport.test.ts | 22 ++++++++++++++++++++++
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/src/schemas/settingsExport.schema.ts b/src/schemas/settingsExport.schema.ts
index a816ec1..4fcb19d 100644
--- a/src/schemas/settingsExport.schema.ts
+++ b/src/schemas/settingsExport.schema.ts
@@ -10,6 +10,23 @@ import { z } from "zod";
 // Current settings store version (matches settingsStore)
 export const SETTINGS_EXPORT_VERSION = 26;
 
+/**
+ * Upper bound on `searchFields` on the settings-import path. Search resolves
+ * every field on every card for each settled query, so an unbounded list
+ * scales that product with attacker-chosen input and freezes the tab. The
+ * value persists globally and follows the visitor to later collections. Mirrors
+ * MAX_SEARCH_FIELDS in settingsLoader, which caps the same setting on the
+ * collection auto-load path.
+ */
+const MAX_SEARCH_FIELDS = 32;
+
+/**
+ * Upper bound on an imported free-text label such as `rankPlaceholderText`,
+ * which is rendered once per unranked card. Mirrors MAX_LABEL_LENGTH in
+ * settingsLoader.
+ */
+const MAX_LABEL_LENGTH = 120;
+
 // ============================================================================
 // Colour Validation
 // ============================================================================
@@ -114,7 +131,7 @@ export const exportableSettingsSchema = z.object({
   cardBackBackground: z.string().optional(),
   showRankBadge: z.boolean().optional(),
   showDeviceBadge: z.boolean().optional(),
-  rankPlaceholderText: z.string().optional(),
+  rankPlaceholderText: z.string().max(MAX_LABEL_LENGTH).optional(),
   defaultCardFace: defaultCardFaceSchema.optional(),
 
   // Behaviour settings
@@ -151,7 +168,7 @@ export const exportableSettingsSchema = z.object({
   usePlaceholderImages: z.boolean().optional(),
 
   // Search & filter settings
-  searchFields: z.array(z.string()).optional(),
+  searchFields: z.array(z.string()).max(MAX_SEARCH_FIELDS).optional(),
   searchScope: searchScopeSchema.optional(),
   groupByField: z.string().nullable().optional(),
 
diff --git a/tests/schemas/settingsExport.test.ts b/tests/schemas/settingsExport.test.ts
index b0d8cea..5da3f62 100644
--- a/tests/schemas/settingsExport.test.ts
+++ b/tests/schemas/settingsExport.test.ts
@@ -86,6 +86,28 @@ describe("settingsExport schema", () => {
       expect(resultTooHigh.success).toBe(false);
     });
 
+    it("bounds searchFields to the same cap as the collection loader", () => {
+      const withinCap = exportableSettingsSchema.safeParse({
+        searchFields: Array.from({ length: 32 }, (_, i) => `f${String(i)}`),
+      });
+      expect(withinCap.success).toBe(true);
+
+      // An unbounded searchFields list makes every search resolve the whole
+      // list per card and persists globally; the import path must reject it
+      // like the collection loader caps it.
+      const overCap = exportableSettingsSchema.safeParse({
+        searchFields: Array.from({ length: 5000 }, (_, i) => `f${String(i)}`),
+      });
+      expect(overCap.success).toBe(false);
+    });
+
+    it("bounds an imported rankPlaceholderText", () => {
+      const overLong = exportableSettingsSchema.safeParse({
+        rankPlaceholderText: "A".repeat(50000),
+      });
+      expect(overLong.success).toBe(false);
+    });
+
     it("validates boolean fields", () => {
       const result = exportableSettingsSchema.safeParse({
         shuffleOnLoad: true,

From 470af75dafb49af46a92a1ebfa330b207a5ddeb8 Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:40:35 +0000
Subject: [PATCH 06/11] fix: align the platform and genre filters with their
 option fields

The filter dropdown offered Platform options collected from a card's short
title but matched them against the full categoryTitle, so selecting any
platform emptied the grid whenever the two differed (the normal case, e.g.
"Switch" vs "Nintendo Switch"). The Genre filter listed every genre but
matched only each card's first one, silently dropping cards whose matching
genre sat at a later index.

Move the field names, option source and match predicate into one module
(filterMatch) so the two sides cannot drift, match array-valued fields by
membership, and collect platform options from the same categoryShort field
the filter now matches on.

Assisted-by: Claude:claude-fable-5
---
 src/components/CardGrid/CardGrid.tsx     | 17 +++---
 src/components/SearchBar/FilterChips.tsx | 26 +++++----
 src/utils/filterMatch.ts                 | 61 ++++++++++++++++++++
 tests/utils/filterMatch.test.ts          | 72 ++++++++++++++++++++++++
 4 files changed, 158 insertions(+), 18 deletions(-)
 create mode 100644 src/utils/filterMatch.ts
 create mode 100644 tests/utils/filterMatch.test.ts

diff --git a/src/components/CardGrid/CardGrid.tsx b/src/components/CardGrid/CardGrid.tsx
index 0763bf4..ff5e5e9 100644
--- a/src/components/CardGrid/CardGrid.tsx
+++ b/src/components/CardGrid/CardGrid.tsx
@@ -17,6 +17,7 @@ import { useMechanicContext, useMechanicCardActions } from "@/mechanics";
 import { createFieldSortComparator, resolveFieldPath } from "@/utils/fieldPathResolver";
 import { shuffle } from "@/utils/shuffle";
 import { capFilterOptions } from "@/utils/filterOptions";
+import { cardMatchesFilter } from "@/utils/filterMatch";
 import { LoadingSkeleton } from "@/components/LoadingSkeleton";
 import { springPresets, getItemDelay } from "@/config/animationPresets";
 import type { CardDisplayConfig } from "@/types/display";
@@ -281,12 +282,12 @@ export function CardGrid() {
     // Apply active filters
     for (const filter of activeFilters) {
       if (filter.values.length === 0) continue;
-      result = result.filter((card) => {
-        const value = resolveFieldPath(card as unknown as Record<string, unknown>, filter.field);
-        if (value === null || value === undefined) return false;
-        const strValue = typeof value === "object" ? JSON.stringify(value) : String(value as string | number | boolean);
-        return filter.values.includes(strValue);
-      });
+      result = result.filter((card) =>
+        cardMatchesFilter(
+          card as unknown as Record<string, unknown>,
+          filter
+        )
+      );
     }
 
     return result;
@@ -605,7 +606,9 @@ export function CardGrid() {
     const genres = new Set<string>();
 
     for (const card of sourceCards) {
-      const platformValue = resolveFieldPath(card as unknown as Record<string, unknown>, "platform.shortTitle");
+      // Collect from the same field the Platform filter matches on
+      // (FILTER_FIELD_DEFS), so offered options cannot fail to match.
+      const platformValue = resolveFieldPath(card as unknown as Record<string, unknown>, "categoryShort");
       if (platformValue && typeof platformValue === "string") platforms.add(platformValue);
 
       const yearValue = resolveFieldPath(card as unknown as Record<string, unknown>, "year");
diff --git a/src/components/SearchBar/FilterChips.tsx b/src/components/SearchBar/FilterChips.tsx
index 6d8f2ce..945c320 100644
--- a/src/components/SearchBar/FilterChips.tsx
+++ b/src/components/SearchBar/FilterChips.tsx
@@ -7,6 +7,7 @@
 
 import { useState, useCallback, useRef, useEffect } from "react";
 import { useSettingsStore } from "@/stores/settingsStore";
+import { FILTER_FIELD_DEFS } from "@/utils/filterMatch";
 import styles from "./FilterChips.module.css";
 
 interface FilterChipsProps {
@@ -80,12 +81,10 @@ function FilterChip({
   values: string[];
   onRemove: () => void;
 }) {
-  // Map field names to display labels
-  const fieldLabels: Record<string, string> = {
-    categoryTitle: "Platform",
-    year: "Year",
-    "genres[0]": "Genre",
-  };
+  // Map field names to display labels (single source of truth: FILTER_FIELD_DEFS)
+  const fieldLabels: Record<string, string> = Object.fromEntries(
+    FILTER_FIELD_DEFS.map((d) => [d.field, d.label])
+  );
 
   const label = fieldLabels[field] ?? field;
   const valueText = values.length > 1 ? `${String(values.length)} selected` : values[0];
@@ -165,11 +164,16 @@ function AddFilterDropdown({
 
   if (!filterOptions) return null;
 
-  const filterFields = [
-    { field: "categoryTitle", label: "Platform", options: filterOptions.platforms },
-    { field: "year", label: "Year", options: filterOptions.years.map(String) },
-    { field: "genres[0]", label: "Genre", options: filterOptions.genres },
-  ].filter((f) => f.options.length > 0);
+  const optionsByKey = {
+    platforms: filterOptions.platforms,
+    years: filterOptions.years.map(String),
+    genres: filterOptions.genres,
+  };
+  const filterFields = FILTER_FIELD_DEFS.map((d) => ({
+    field: d.field,
+    label: d.label,
+    options: optionsByKey[d.optionsKey],
+  })).filter((f) => f.options.length > 0);
 
   if (filterFields.length === 0) return null;
 
diff --git a/src/utils/filterMatch.ts b/src/utils/filterMatch.ts
new file mode 100644
index 0000000..e109fb5
--- /dev/null
+++ b/src/utils/filterMatch.ts
@@ -0,0 +1,61 @@
+/**
+ * Shared definitions for the search-bar filters.
+ *
+ * The filter field a card is matched against MUST be the same field the filter
+ * options were collected from. Keeping the field names, the option source and
+ * the match predicate in one module stops the two sides drifting apart — a past
+ * bug where the Platform filter offered `shortTitle` values but matched on the
+ * full `categoryTitle`, and the Genre filter listed every genre but matched
+ * only each card's first one.
+ */
+
+import { resolveFieldPath } from "@/utils/fieldPathResolver";
+
+/** The option group a filter field draws its selectable values from. */
+export type FilterOptionsKey = "platforms" | "years" | "genres";
+
+export interface FilterFieldDef {
+  /** Field path used both to collect options and to match cards. */
+  field: string;
+  /** Human-readable chip/dropdown label. */
+  label: string;
+  /** Which option group in the computed filter options feeds this field. */
+  optionsKey: FilterOptionsKey;
+}
+
+/**
+ * Single source of truth for the filter fields. `field` is what both the
+ * option collection and the match predicate resolve, so they cannot diverge.
+ */
+export const FILTER_FIELD_DEFS: readonly FilterFieldDef[] = [
+  { field: "categoryShort", label: "Platform", optionsKey: "platforms" },
+  { field: "year", label: "Year", optionsKey: "years" },
+  { field: "genres", label: "Genre", optionsKey: "genres" },
+] as const;
+
+export interface ActiveFilter {
+  field: string;
+  values: string[];
+}
+
+/**
+ * Decide whether a card satisfies an active filter.
+ *
+ * An array-valued field (e.g. `genres`) matches when any of its members is
+ * selected, not only its first element.
+ */
+export function cardMatchesFilter(
+  card: Record<string, unknown>,
+  filter: ActiveFilter
+): boolean {
+  const value = resolveFieldPath(card, filter.field);
+  if (value === null || value === undefined) return false;
+  if (Array.isArray(value)) {
+    return value.some((v) => filter.values.includes(String(v)));
+  }
+  const strValue =
+    typeof value === "object"
+      ? JSON.stringify(value)
+      : String(value as string | number | boolean);
+  return filter.values.includes(strValue);
+}
diff --git a/tests/utils/filterMatch.test.ts b/tests/utils/filterMatch.test.ts
new file mode 100644
index 0000000..553f5f0
--- /dev/null
+++ b/tests/utils/filterMatch.test.ts
@@ -0,0 +1,72 @@
+/**
+ * Tests for the shared search-bar filter definitions and match predicate.
+ *
+ * The filter field a card is matched against must be the same field its
+ * options are collected from. These tests pin that contract: the Platform
+ * filter matches on a card's short title (not the full title), and the Genre
+ * filter matches any of a card's genres (not only the first).
+ */
+
+import { describe, it, expect } from "vitest";
+import {
+  FILTER_FIELD_DEFS,
+  cardMatchesFilter,
+} from "@/utils/filterMatch";
+
+function defFor(label: string) {
+  const def = FILTER_FIELD_DEFS.find((d) => d.label === label);
+  if (!def) throw new Error(`no filter def for ${label}`);
+  return def;
+}
+
+describe("cardMatchesFilter", () => {
+  it("matches the Platform filter against the card's short title", () => {
+    // Options are collected from the short title ("Switch"); pre-fix the filter
+    // matched the full categoryTitle ("Nintendo Switch"), so it never matched.
+    const card = {
+      id: "a",
+      categoryShort: "Switch",
+      categoryTitle: "Nintendo Switch",
+    };
+    const platform = defFor("Platform");
+
+    expect(
+      cardMatchesFilter(card, { field: platform.field, values: ["Switch"] })
+    ).toBe(true);
+  });
+
+  it("matches a genre that is not the card's first genre", () => {
+    // Pre-fix the filter resolved genres[0] ("Action") only, so a card whose
+    // matching genre sat at a later index was silently dropped.
+    const card = { id: "a", genres: ["Action", "RPG"] };
+    const genre = defFor("Genre");
+
+    expect(
+      cardMatchesFilter(card, { field: genre.field, values: ["RPG"] })
+    ).toBe(true);
+  });
+
+  it("does not match a genre the card lacks", () => {
+    const card = { id: "a", genres: ["Action", "RPG"] };
+    const genre = defFor("Genre");
+
+    expect(
+      cardMatchesFilter(card, { field: genre.field, values: ["Puzzle"] })
+    ).toBe(false);
+  });
+
+  it("matches a scalar year field", () => {
+    const card = { id: "a", year: 1994 };
+    const year = defFor("Year");
+
+    expect(
+      cardMatchesFilter(card, { field: year.field, values: ["1994"] })
+    ).toBe(true);
+  });
+
+  it("returns false when the field is absent", () => {
+    expect(
+      cardMatchesFilter({ id: "a" }, { field: "genres", values: ["RPG"] })
+    ).toBe(false);
+  });
+});

From 7cd92e71dc8ce938560f229e0e85f58a9c4da8b1 Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:46:33 +0000
Subject: [PATCH 07/11] fix: migrate persisted sources across store version
 bumps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The source store declares a persist version (already bumped 1->2->3 across
releases) but no migrate function, so when the persisted version differs
zustand hands `undefined` to merge. merge dereferenced `persisted.sources`
on its first line and threw; the throw was swallowed (no onRehydrateStorage),
so every source the user had configured silently vanished on the upgrade —
and every future bump would repeat it.

Add a migrate that carries the persisted state forward (letting merge's
existing dedup/legacy-cleanup run as the real migration) and make merge
undefined-safe so a fresh load no longer throws either.

Assisted-by: Claude:claude-fable-5
---
 src/stores/sourceStore.ts                | 10 +++-
 tests/stores/sourceStore.persist.test.ts | 65 ++++++++++++++++++++++++
 2 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 tests/stores/sourceStore.persist.test.ts

diff --git a/src/stores/sourceStore.ts b/src/stores/sourceStore.ts
index 248093d..2bbad04 100644
--- a/src/stores/sourceStore.ts
+++ b/src/stores/sourceStore.ts
@@ -328,8 +328,16 @@ export const useSourceStore = create<SourceState>()(
         activeSourceId: state.activeSourceId,
         defaultSourceId: state.defaultSourceId,
       }),
+      // Without a migrate, a persisted `version` older than STORE_VERSION makes
+      // zustand hand `undefined` to `merge`, which then threw dereferencing
+      // `.sources` — the throw was swallowed and the user's configured sources
+      // silently vanished on every store-version bump. Carry the persisted
+      // state forward so `merge` can normalise it (the dedup/legacy-cleanup
+      // logic below is exactly the cross-version migration this enables).
+      migrate: (persisted) => persisted as SourceState,
       merge: (persisted, current) => {
-        const persistedState = persisted as Partial<SourceState>;
+        // `merge` is also called with `undefined` on a fresh load, so guard it.
+        const persistedState = (persisted ?? {}) as Partial<SourceState>;
 
         // Start with persisted sources
         let sources = persistedState.sources ?? current.sources;
diff --git a/tests/stores/sourceStore.persist.test.ts b/tests/stores/sourceStore.persist.test.ts
new file mode 100644
index 0000000..bdd0593
--- /dev/null
+++ b/tests/stores/sourceStore.persist.test.ts
@@ -0,0 +1,65 @@
+/**
+ * Persistence-migration tests for the source store.
+ *
+ * A store-version bump with no `migrate` made zustand hand `undefined` to the
+ * store's `merge`, which threw dereferencing `.sources`; the throw was
+ * swallowed, so every configured source silently vanished on the upgrade.
+ *
+ * The global test setup stubs localStorage with inert vi.fn()s. The store's
+ * persist captured that object by reference at import, so giving those stubs a
+ * real backing map here makes the store read and write the same storage.
+ */
+
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { useSourceStore } from "@/stores/sourceStore";
+
+const STORAGE_KEY = "itemdeck-sources";
+
+describe("sourceStore persistence migration", () => {
+  let backing: Record<string, string>;
+
+  beforeEach(async () => {
+    backing = {};
+    const ls = localStorage as unknown as Record<string, ReturnType<typeof vi.fn>>;
+    ls.getItem.mockImplementation((k: string) =>
+      k in backing ? backing[k] : null
+    );
+    ls.setItem.mockImplementation((k: string, v: string) => {
+      backing[k] = String(v);
+    });
+    ls.removeItem.mockImplementation((k: string) => {
+      delete backing[k];
+    });
+    ls.clear.mockImplementation(() => {
+      backing = {};
+    });
+
+    // Flush the import-time hydration so its trailing write cannot race the
+    // payload we install below.
+    await useSourceStore.persist.rehydrate();
+  });
+
+  it("keeps configured sources when the persisted version is older", async () => {
+    const custom = {
+      id: "src_custom",
+      url: "https://cdn.jsdelivr.net/gh/user/repo@main/data/collections/demo",
+      name: "My Collection",
+      addedAt: new Date(0).toISOString(),
+    };
+    backing[STORAGE_KEY] = JSON.stringify({
+      state: {
+        sources: [custom],
+        activeSourceId: "src_custom",
+        defaultSourceId: "src_custom",
+      },
+      // Older than the current STORE_VERSION.
+      version: 2,
+    });
+
+    await useSourceStore.persist.rehydrate();
+
+    const state = useSourceStore.getState();
+    expect(state.sources.find((s) => s.id === "src_custom")).toBeDefined();
+    expect(state.activeSourceId).toBe("src_custom");
+  });
+});

From 7817c3dd500538088fbe59f9911f64fafe40b89f Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:48:11 +0000
Subject: [PATCH 08/11] fix: preserve the collection-defaults source marker
 across replace import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The round-7/8 fix preserved hasAppliedCollectionDefaults across a replace-mode
settings import but not appliedCollectionDefaultsSourceId, the marker
applyCollectionSettings compares against the active source to gate a
collection's settings.json defaults. resetToDefaults() nulls it, so after a
replace import the next load of the still-active collection saw the guard open
again and re-applied its defaults over the just-imported values — the same
silent discard the original fix targeted, on the settings.json path.

Snapshot and restore both markers (adding the missing
setAppliedCollectionDefaultsSourceId action).

Assisted-by: Claude:claude-fable-5
---
 src/stores/settingsStore.ts        |  5 +++++
 src/utils/settingsExport.ts        | 24 +++++++++++++++++-------
 tests/utils/settingsExport.test.ts | 24 ++++++++++++++++++++++++
 3 files changed, 46 insertions(+), 7 deletions(-)

diff --git a/src/stores/settingsStore.ts b/src/stores/settingsStore.ts
index ddfbd6d..626da97 100644
--- a/src/stores/settingsStore.ts
+++ b/src/stores/settingsStore.ts
@@ -595,6 +595,7 @@ interface SettingsState {
   setShowDragIcon: (show: boolean) => void;
   setCustomThemeUrl: (url: string | null) => void;
   setHasAppliedCollectionDefaults: (applied: boolean) => void;
+  setAppliedCollectionDefaultsSourceId: (sourceId: string | null) => void;
   applyCollectionDefaults: (config: CollectionConfigForDefaults) => void;
   setRandomSelectionEnabled: (enabled: boolean) => void;
   setRandomSelectionCount: (count: number) => void;
@@ -885,6 +886,10 @@ export const useSettingsStore = create<SettingsState>()(
         set({ hasAppliedCollectionDefaults });
       },
 
+      setAppliedCollectionDefaultsSourceId: (appliedCollectionDefaultsSourceId) => {
+        set({ appliedCollectionDefaultsSourceId });
+      },
+
       setRandomSelectionEnabled: (randomSelectionEnabled) => {
         set({ randomSelectionEnabled });
       },
diff --git a/src/utils/settingsExport.ts b/src/utils/settingsExport.ts
index 8c0967c..1dabe4f 100644
--- a/src/utils/settingsExport.ts
+++ b/src/utils/settingsExport.ts
@@ -196,13 +196,19 @@ function migrateSettings(
 function applySettings(settings: ExportableSettings, mode: ImportMode): void {
   const store = useSettingsStore.getState();
 
-  // Preserve the one-time "collection defaults applied" marker across a replace
-  // reset. resetToDefaults() clears it to false, which makes the
-  // CollectionDataContext effect re-fire and re-apply the active collection's
+  // Preserve BOTH one-time "collection defaults applied" markers across a
+  // replace reset. resetToDefaults() clears them, which makes the
+  // CollectionDataContext effects re-fire and re-apply the active collection's
   // defaults over the values being imported (silently discarding the user's
-  // backup for those fields). The marker is internal state, not a user-facing
-  // setting, so importing settings must not disturb it.
+  // backup for those fields). `hasAppliedCollectionDefaults` gates the config
+  // defaults; `appliedCollectionDefaultsSourceId` (compared against the active
+  // source in applyCollectionSettings) gates the settings.json defaults —
+  // restoring only the former still let the active collection's settings.json
+  // clobber the import on the next load. Both are internal state, not
+  // user-facing settings, so importing settings must not disturb them.
   const hadAppliedCollectionDefaults = store.hasAppliedCollectionDefaults;
+  const hadAppliedCollectionDefaultsSourceId =
+    store.appliedCollectionDefaultsSourceId;
 
   // Reset to defaults first if replace mode
   if (mode === "replace") {
@@ -290,10 +296,14 @@ function applySettings(settings: ExportableSettings, mode: ImportMode): void {
     }
   }
 
-  // Restore the collection-defaults marker cleared by resetToDefaults, so the
-  // just-imported values are not overwritten by the active collection.
+  // Restore the collection-defaults markers cleared by resetToDefaults, so the
+  // just-imported values are not overwritten by the active collection (either
+  // via its config defaults or its settings.json defaults).
   if (mode === "replace") {
     store.setHasAppliedCollectionDefaults(hadAppliedCollectionDefaults);
+    store.setAppliedCollectionDefaultsSourceId(
+      hadAppliedCollectionDefaultsSourceId
+    );
   }
 }
 
diff --git a/tests/utils/settingsExport.test.ts b/tests/utils/settingsExport.test.ts
index 3167536..6dfa1cb 100644
--- a/tests/utils/settingsExport.test.ts
+++ b/tests/utils/settingsExport.test.ts
@@ -145,6 +145,30 @@ describe("settingsExport", () => {
       expect(state.maxVisibleCards).toBe(2); // Default value
     });
 
+    it("preserves both collection-defaults markers across a replace import", async () => {
+      // Simulate a collection whose config and settings.json defaults have
+      // already been applied for the active source.
+      const store = useSettingsStore.getState();
+      store.setHasAppliedCollectionDefaults(true);
+      store.setAppliedCollectionDefaultsSourceId("src_active");
+
+      const importData = {
+        version: SETTINGS_EXPORT_VERSION,
+        exportedAt: "2025-12-29T10:30:00.000Z",
+        settings: { layout: "list" },
+      };
+
+      const file = createMockFile(JSON.stringify(importData));
+      await importSettingsFromFile(file, "replace");
+
+      const state = useSettingsStore.getState();
+      // Both markers must survive the replace reset; clearing the source-id
+      // marker to null would re-arm the active collection's settings.json
+      // defaults to clobber the just-imported values on the next load.
+      expect(state.hasAppliedCollectionDefaults).toBe(true);
+      expect(state.appliedCollectionDefaultsSourceId).toBe("src_active");
+    });
+
     it("preserves unspecified settings in merge mode", async () => {
       // Set a custom value
       const store = useSettingsStore.getState();

From c8482d1e87e2731c4cd92d63fc3dd0937d434aff Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:48:43 +0000
Subject: [PATCH 09/11] docs: record round 9 in the decisions log

Assisted-by: Claude:claude-fable-5
---
 .abcd/work/DECISIONS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.abcd/work/DECISIONS.md b/.abcd/work/DECISIONS.md
index 9a78369..9d274c2 100644
--- a/.abcd/work/DECISIONS.md
+++ b/.abcd/work/DECISIONS.md
@@ -10,3 +10,4 @@ Dated, one-line summaries of each autonomous security-hardening round.
 - 2026-08-06 — Round 6: fixed 7 confirmed defects — (1) collection `forced` settings now snapshot the user's own displaced values per source and restore them when the active source changes, with crash recovery via `onRehydrateStorage` (mirroring `_mechanicOverridesBackup`); previously viewing one hostile allowlisted-CDN source once, reachable via a single unconfirmed `/gh/<user>/` link, permanently overwrote the visitor's global display config with no revert path (`clearCollectionForcedSettings` had zero callers) — the dead action is repurposed into `restoreCollectionForcedSettings`; (2) untrusted entity text fields (`summary`, resolved platform `title`/`shortTitle`/`summary`/`year`) are coerced to strings at the `useCollection` source instead of cast, so an object-typed field (e.g. an i18n `{en: "…"}` value) can no longer reach JSX as a child and crash the whole collection view — the device badge sink fires on first paint in the default grid; (3) `computeCollectionStats` computes min/max in a single pass instead of spreading a per-card array into `Math.min`/`Math.max`, so a large untrusted collection no longer throws `RangeError` in `CollectionToast`, which renders outside the collection error boundary and would blank the app; (4) `loadCollection` caps the untrusted `entityTypes` count (`MAX_ENTITY_TYPES`) and loads types through a fixed-size pool, closing a per-type fetch multiplier that amplified one collection load into ~80k CDN requests plus GitHub-quota exhaustion; (5) `useMyPlausibleMeDiscovery` caps discovered collections (`MAX_DISCOVERED_COLLECTIONS`) and pools metadata fetches, closing a zero-click CDN request flood triggerable via an attacker `/gh/<user>/` URL on the startup picker; (6) `card.imageUrls` (images + videos) is capped per card (`MAX_MEDIA_PER_CARD`), bounding the gallery dot buttons and the load-time image preloader against an entity listing a huge media array; (7) the hard reset runs its three IndexedDB cleanups independently via `Promise.allSettled` and `deleteDB` gained an `onblocked` handler, so a blocked or failed app-DB delete no longer hangs the dialog or silently leaves cached collections and the plugin DB on disk while reporting a complete "delete everything". 19 reproduction tests added. Refuted: `applyMechanicOverrides` second-activation backup clobber (unreachable — the Start Game overlay is gated on `!activeMechanic`, so overrides only apply when no mechanic is active and every deactivation restores first) and the write-only `collectionForcedSettings` mid-session revert (TanStack Query structural sharing keeps `data.settings` identity stable, so the apply effect does not re-fire; folded into the S1 fix). Nitpicks noted (not fixed): TruffleHog pre-commit `--since-commit HEAD` empty-range scan, gitleaks checksum not provenance-anchored, `build:analyse` writing `stats.html` into the deploy root, forced `cardBackStyle`/`titleDisplayMode` enum mismatch vs the store types, and the `getDB()` in-flight dedup that makes the delete-blocked path reachable.
 - 2026-08-07 — Round 7: fixed 11 confirmed defects — (1) `settings.json` `maxVisibleCards` tested its lower bound before flooring and had no finiteness check, so `0.5` stored `0` and `1e400` stored `Infinity` (which serialises to `null`), either of which makes `CardGrid` discard every card on flip and persists globally beyond the collection that supplied it; bounded after the floor and capped at the settings-panel maximum. (2) `settings.json` `searchFields` was type-filtered but uncapped, and search resolves every field on every card per settled query; capped at 32. (3) `DetailLink.source`/`label` were never type-checked (the entity schema is loose and only the URL was validated), so a non-string `source` threw while the sources overlay lowercased it and an object-valued `source`/`label` reached JSX as a child, replacing the whole card grid with the error boundary two clicks after load; both coerced at the normalisation choke point. (4) duplicate entity ids survived the loader and defeated `CardGrid`'s random-selection guard, which proves "every selected id still exists" by comparing counts — a duplicate makes the count match while an id is absent, throwing during render; duplicates also produced duplicate React keys in every view and made one flip toggle several cards. Ids and single-file entity arrays are now deduplicated at load, which also drops the redundant fetch per repeat. (5) quiz wrong-answer selection scanned the correct-answer array linearly per candidate value, and both dimensions are collection-sized, so a 7.4MB payload froze the main thread for 168s and the emitted question carried one rendered option per alternative; matched against a `Set` and capped the offered alternatives, in `relationshipToName` and `fillTheBlank`. (6) Snap Ranking built its card-value map as a plain object literal, so a card id of `"__proto__"` stored nothing (the inherited setter ignores primitives) and the `undefined` guard read back `Object.prototype` — the card was dealt but could never be scored, and rendered as `[object Object]`. (7) the relationship resolver rebuilt the entire relationship record for every entity in both the resolve and the rank pass, with neither the record nor the entity list capped, so cost grew with the square of the payload (10000 relationships × 1000 entities: 11.9s, now 44ms); relationships are grouped by entity type once in `createResolverContext`. (8) image preloading had no aggregate cap and probed the cache one URL at a time, emitting its first progress tick only after the whole probe loop, and the loading overlay clears only at 100% with no skip while the active source persists — a lockout across reloads rather than a slow load; the list is capped and the cached URL set read once. (9) `imageCache.set` recomputed the cache totals with a full store scan, so caching N images cost N(N+1)/2 record reads and eviction added a second scan; admission, eviction and the write now happen in one transaction over both stores (800 stores: 5.0s to under 0.4s). The first pre-merge review caught that an intermediate version still read the totals in a snapshot taken before the write transaction opened, so the preloader's five concurrent writes each judged admission from the same stale state — reproduced as a budget overshoot to 140% of the maximum. (10) the filter dropdown mounts one checkbox per option and re-reconciles the whole list on every toggle, and `genres` is an uncapped per-entity array while platform and year were bounded only by the 10000-entity loader cap, so no field had a usable ceiling; all three are capped where the lists are assembled, since many entities contributing a few values each reach the same total. (11) a stored "never cache" preference only suppressed the consent prompt while preloading still fetched and persisted every image, making "Never cache" weaker than declining once; caching permission is now a rule separate from whether to ask. 41 reproduction tests added (944 → 985). Deferred (confirmed, own dedicated round): entity edits are stored in one flat source-unscoped map, so switching collections bleeds one collection's private notes onto another's cards and silently overwrites them — refuted as a security finding (no exfiltration path) but a real data-integrity defect, and every correct fix changes the persisted shape of a store that has no `version` or `migrate`, plus a product decision about provenance-less existing edits. Also deferred: "Import Collection" writes an unvalidated, unbounded blob to a localStorage key nothing reads, so the feature is inert while reporting success — the correct fix is to remove the button or implement the feature, both product calls. Refuted: forced `cardBackStyle`/`titleDisplayMode` enum mismatch re-raised as substantive (the claimed CSS impact is false — the `--card-title-*` custom properties are defined but never read, and `cardBackStyle` has no renderer at all; it remains the round-6 nitpick). Logged for a future round (confirmed by a pre-merge reviewer, not fixed here): `evictLRU` does not persist corrected totals when its scan fallback runs but nothing needs evicting, so a poisoned metadata record would survive — unreachable today because the method has no callers; and `readTotals` heals downward drift only, so its comment claims more than it delivers. Dependency review: `npm audit --omit=dev` reports 0 advisories in the production tree; all 25 advisories are devDependency-only and no dependency was changed.
 - 2026-08-13 — Round 8: fixed 5 confirmed defects — (1) the startup collection picker rendered discovered `collection.json` metadata (`name`/`description`/`itemCount`) straight into JSX as React children while `fetchCollectionMetadata` only checked `typeof data === "object"`, and the picker sits above every error boundary, so an attacker `/gh/<user>/` link (discovery auto-runs with no click) serving a non-primitive `name`/`description`/`itemCount` threw "Objects are not valid as a React child" and blanked the whole app, with the poisoned `name` also persisting into the source store; the discovery boundary now coerces all three to primitives. (2) `getDisplayableFields` and the platform `additionalFields` copy emitted one DOM row per entity key with no ceiling (the entity schema is `.loose()`), so a single entity carrying ~100k scalar keys mounted ~300k DOM nodes in one synchronous commit when its "More" overlay opened — both paths are now capped at 100, matching `MAX_MEDIA_PER_CARD`. (3) `validateForcedSettings` guarded `cardBackStyle` and `titleDisplayMode` against inverted allowlists (`plain|pattern|gradient` and `always|hover|never`) that matched neither the real `CardBackStyle` (`bitmap|svg|colour`) nor `TitleDisplayMode` (`truncate|wrap`) enums, so every honest author's forced value was silently dropped while out-of-enum values were accepted, persisted globally, and then rejected wholesale by the settings-export schema on reimport — bricking the user's own backup; the allowlists now match the real enums (this fixes the round-6/7 mismatch on its genuine grounds — the correctness drop plus the export-brick self-DoS — not the previously-refuted CSS-clamping claim, which remains inert). (4) a "replace"-mode settings import called `resetToDefaults()`, which cleared the one-time `hasAppliedCollectionDefaults` marker to false and re-armed the `CollectionDataContext` effect, so the active untrusted collection's `defaults` (including `fieldMapping`) immediately overwrote seven just-imported fields while the UI reported success; the marker is now preserved across the replace reset. (5) imported edits typed field values as `z.unknown()` and merged them raw over the source card, which is rendered as a React child, so an "edits backup" with an object/array-valued `title` threw on every grid render and persisted across reloads and collections; the import boundary now restricts edit field values to JSON primitives (the only shape the edit form produces). 9 reproduction tests added (985 → 994). Refuted: the `?reset=1` settings wipe (a documented, in-app-surfaced self-service reset that clears only the `itemdeck-settings` key — edits/themes/sources/plugins survive — and whose substring match has no realistic colliding URL) and the unbounded `collection.json` `maxVisibleCards` (`z.number().int().positive()` already blocks the harmful non-finite/`<1`/float inputs, and the sole consumer uses the value only as a downward cap min'd against the real card count, so a large value is inert rather than a DoS). Nitpicks/defence-in-depth noted (not fixed): the `?reset=1` substring test and the missing `.max()` on the v2 `maxVisibleCards` schema are minor hardening items; plus the previously-logged raw `edits[card.id]` inherited-key lookup, dead discovery/theme-loader code, and the dev-only `migrate-collection.ts` `parseInt`→`null` / hardcoded-licence correctness bugs. Dependency review: `npm audit --omit=dev` reports 0 advisories in the production tree; no dependency was changed.
+- 2026-08-13 — Round 9: fixed 9 confirmed defects — (1) an untrusted `collection.json` `relationships` record is unbounded and `type.field` keyed, so a record whose keys all share the primary type's prefix collapsed into one bucket and made both the resolve pass and the per-card rank pass `O(relationships × entities)` again (the round-7 grouping bounded only the per-entity rebuild); capped at `MAX_RELATIONSHIPS`, and the single-file entity-array paths (`{type}s.json`/`{type}.json`) now share the `MAX_ENTITY_IDS` ceiling the index path already enforced, removing the entity-count multiplier. (2) `useAvailableFields` walked every key of the sampled cards and turned each into an `<option>` in the settings sort/badge/group-by selectors, which render outside the collection error boundary, so a `.loose()` entity with tens of thousands of keys froze or OOM-killed the tab; discovery is capped at `MAX_AVAILABLE_FIELDS` and stops the per-card walk early. (3) `card.detailUrls` escaped `MAX_MEDIA_PER_CARD` — it was built from the uncapped `detailUrls` array plus one link per entry of the uncapped `videos` array — so a hostile entity produced tens of thousands of `DetailLink`s that the sources overlay mounted one anchor (and several URL parses) per, freezing the tab; capped at `MAX_DETAIL_LINKS_PER_CARD`. (4) a collection's forced `rankPlaceholderText` (settings.json) and its v2 `uiLabels.rankPlaceholder` are rendered once per unranked card with no virtualisation, so an unbounded string was amplified by the card count into a tab-freezing layout pass (and the forced value persisted globally); the forced value is capped at ingress and the v2 UI labels are truncated in the schema (truncation, not rejection, so one long label cannot deny the whole collection load). (5) the settings-import schema accepted an unbounded `searchFields` array and an unbounded `rankPlaceholderText`, the same values the collection loader already caps and which persist globally and follow the visitor to later collections; both are now bounded on import. (6) the source store declares a persist version (already bumped 1→2→3 across releases) but no `migrate`, so a version mismatch handed `undefined` to `merge`, which threw dereferencing `.sources`; the swallowed throw silently discarded every configured source on the upgrade — added a `migrate` that carries the persisted state forward (letting `merge`'s existing dedup/legacy-cleanup run as the real migration) and made `merge` undefined-safe. (7) the Platform filter offered options collected from a card's short title but matched them against the full `categoryTitle`, so selecting any platform emptied the grid whenever the two differed, and the Genre filter listed every genre but matched only each card's first one; the field names, option source and match predicate now live in one module (`filterMatch`) so the two sides cannot drift, array-valued fields match by membership, and platform options are collected from the same `categoryShort` field the filter matches on. (8) a replace-mode settings import preserved `hasAppliedCollectionDefaults` but not `appliedCollectionDefaultsSourceId`, the marker `applyCollectionSettings` compares against the active source, so the active collection's settings.json defaults re-armed to clobber the just-imported values on the next load (the settings.json sibling of the round-8 config-defaults fix); both markers are now snapshotted and restored (adding the missing `setAppliedCollectionDefaultsSourceId` action). Each fix carries a reproduction test observed failing before and passing after. Refuted/downgraded to nitpick: the `tsc -b`-emitted `vite.config.js` shadowing `vite.config.ts` (production build is a clean checkout, so the shipped config never diverges — a local-dev staleness wart), committed Playwright `test-results/` artefacts (hygiene, no PII/secrets in the tracked files and no binary-trace channel on developer machines), the `?reset=1` substring collision (latent — no `preset` query param exists or is planned; documented settings-only reset), the imported-collection localStorage write (self-inflicted, deliberate-action-gated dead-code, DoS reframing unsubstantiated), the provider `..` collection-path traversal spoof (twice — grants nothing the design-intended `?collection=` public-CDN route does not already grant; the loading-screen even renders the traversal string), and snap-ranking mixed number/string badge values (real but low-likelihood, graceful categorical degradation, coincident value still winnable). Dependency review: `npm audit --omit=dev` reports 0 advisories in the production tree; no dependency was changed.

From d4ac470567561fb0440fd38e41cf658797dde058 Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:58:28 +0000
Subject: [PATCH 10/11] fix: show each filter's own option count in the
 add-filter dropdown

The round-9 filter refactor renamed the Platform filter field from
categoryTitle to categoryShort but left a stale field-name branch in the
dropdown count badge, so the Platform row showed the genre count (or 0)
instead of the platform count. Drive the badge off the filter field's own
options array, matching the single-source-of-truth the refactor intended.

Assisted-by: Claude:claude-fable-5
---
 src/components/SearchBar/FilterChips.tsx |  4 +--
 tests/components/FilterChips.test.tsx    | 36 ++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 tests/components/FilterChips.test.tsx

diff --git a/src/components/SearchBar/FilterChips.tsx b/src/components/SearchBar/FilterChips.tsx
index 945c320..29e567b 100644
--- a/src/components/SearchBar/FilterChips.tsx
+++ b/src/components/SearchBar/FilterChips.tsx
@@ -202,7 +202,7 @@ function AddFilterDropdown({
             // Field selection
             <div className={styles.dropdownSection}>
               <div className={styles.dropdownHeader}>Filter by</div>
-              {filterFields.map(({ field, label }) => (
+              {filterFields.map(({ field, label, options }) => (
                 <button
                   key={field}
                   type="button"
@@ -211,7 +211,7 @@ function AddFilterDropdown({
                 >
                   {label}
                   <span className={styles.dropdownCount}>
-                    {filterOptions[field === "categoryTitle" ? "platforms" : field === "year" ? "years" : "genres"].length}
+                    {options.length}
                   </span>
                 </button>
               ))}
diff --git a/tests/components/FilterChips.test.tsx b/tests/components/FilterChips.test.tsx
new file mode 100644
index 0000000..4e49120
--- /dev/null
+++ b/tests/components/FilterChips.test.tsx
@@ -0,0 +1,36 @@
+/**
+ * Tests for the add-filter dropdown counts.
+ *
+ * Each filter row shows the number of options for its own field. A stale
+ * field-name branch previously made the Platform row show the genre count.
+ */
+
+import { describe, it, expect } from "vitest";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { FilterChips } from "@/components/SearchBar/FilterChips";
+
+describe("FilterChips add-filter dropdown", () => {
+  it("shows each filter's own option count, not another field's", async () => {
+    render(
+      <FilterChips
+        filterOptions={{
+          platforms: ["Switch"],
+          years: [1994],
+          genres: ["RPG", "Action", "Puzzle"],
+        }}
+      />
+    );
+
+    await userEvent.click(screen.getByTitle("Add filter"));
+
+    // Platform has 1 option; the genre count is 3. The Platform row must show
+    // its own count, so its text is "Platform1" (label + count), not
+    // "Platform3".
+    const platformRow = screen.getByRole("button", { name: /Platform/ });
+    expect(platformRow.textContent).toBe("Platform1");
+
+    const genreRow = screen.getByRole("button", { name: /Genre/ });
+    expect(genreRow.textContent).toBe("Genre3");
+  });
+});

From 766ae2843c8efa936c948abbde4dea0be2f753e1 Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Thu, 13 Aug 2026 19:01:08 +0000
Subject: [PATCH 11/11] fix: cap platform-overlay detail links too
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The round-9 detail-link cap covered only the card's own detailUrls/videos,
not the platform overlay's categoryInfo.detailUrls, which is built from the
untrusted platform entity's detailUrls with no bound. deduplicateLinksBySource
keys on source/label/url, so a hostile platform carrying tens of thousands of
distinct-source links survives dedup and mounts one anchor (plus several URL
parses) each in one synchronous commit — the same freeze, reachable by moving
the payload from entity.videos to platform.detailUrls. Slice the platform
links at the same MAX_DETAIL_LINKS_PER_CARD choke point.

Assisted-by: Claude:claude-fable-5
---
 src/hooks/useCollection.ts                  |  6 ++++-
 tests/hooks/useCollection.untrusted.test.ts | 30 +++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/src/hooks/useCollection.ts b/src/hooks/useCollection.ts
index 6b3b213..425ee63 100644
--- a/src/hooks/useCollection.ts
+++ b/src/hooks/useCollection.ts
@@ -518,13 +518,17 @@ async function loadFreshCollection(
                   : typeof platform.title === "number"
                     ? String(platform.title)
                     : "";
+              // Cap the untrusted platform detail links at the same choke
+              // point as the card's own, so the platform overlay (one anchor +
+              // several URL parses per link) cannot be flooded via
+              // `platform.detailUrls` instead of the card's `videos`.
               let platformDetailUrls = normaliseDetailUrls(
                 platform.detailUrls as
                   | string
                   | { url: string }
                   | { url: string }[]
                   | undefined
-              );
+              ).slice(0, MAX_DETAIL_LINKS_PER_CARD);
 
               // Auto-generate Wikipedia URL if no detailUrls specified
               if (platformDetailUrls.length === 0 && platformTitle) {
diff --git a/tests/hooks/useCollection.untrusted.test.ts b/tests/hooks/useCollection.untrusted.test.ts
index c63c676..c3e128b 100644
--- a/tests/hooks/useCollection.untrusted.test.ts
+++ b/tests/hooks/useCollection.untrusted.test.ts
@@ -234,6 +234,36 @@ describe("useCollection — malformed untrusted entities do not crash the load",
     expect(card?.detailUrls?.length ?? 0).toBeLessThanOrEqual(100);
   });
 
+  it("caps categoryInfo.detailUrls for a platform listing a huge number of links", async () => {
+    const hugeLinks = Array.from({ length: 5000 }, (_, i) => ({
+      url: `https://en.wikipedia.org/wiki/p${String(i)}`,
+      // Distinct source strings so dedup-by-source cannot collapse them.
+      source: `source-${String(i)}`,
+    }));
+    setResolvedEntities([
+      {
+        id: "g1",
+        title: "Game One",
+        _resolved: {
+          platform: { id: "p1", title: "Platform", detailUrls: hugeLinks },
+        },
+      },
+    ]);
+
+    const { result } = renderHook(
+      () => useLocalCollection({ basePath: SOURCE_URL }),
+      { wrapper: createWrapper() }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isSuccess).toBe(true);
+    });
+    const categoryInfo = result.current.data?.cards[0]?.categoryInfo;
+    // The platform overlay renders one anchor (and several URL parses) per link
+    // with no windowing, so the list must be bounded like the card's own.
+    expect(categoryInfo?.detailUrls?.length ?? 0).toBeLessThanOrEqual(100);
+  });
+
   it("coerces object-typed platform summary/year in categoryInfo", async () => {
     setResolvedEntities([
       {