# S009 — BFF server (`linji serve`)

The backend-for-frontend (mvp.dj decision 2): the browser never does
DPoP; the S003 OAuth implementation is the only one.

## What landed

- `linji serve --port --base --pds --web`: hosts the OAuth client
  metadata + callback itself; cookie sessions map to accounts in the
  store; static `--web` dir with SPA fallback to index.html.
- JSON API: `/api/login|logout|me|space|thread|post|edit|delete|move|
  export`. Dev shortcut: scripted login with the account password for
  headless flows.

## Bugs the server exposed (CLI had hidden them)

1. **Dangling store slices.** `oauth.login`/`refresh`/nonce-rotation
   duped account strings into the *caller's* arena; the server freed
   them per request and the next `store.find` segfaulted. Fixed at the
   source: `Store.upsert` re-dupes everything into `store.allocator`;
   refresh/nonce rotation do the same.
2. **`req.arena` corruption.** httpz's per-request arena does not
   survive core's parse+deinit cycles. Rule now: `req.arena` is for
   response data only; core calls get a private page_allocator arena
   per request (same pattern as zds handlers).

## Verification

`zig build scenario-serve` (curl-driven) — 25 checkpoints, PASS;
unit + scenario-space green.