feat(userblocks): add user-to-user blocking with feed/comment filtering

Implement one-directional user blocking following the atProto write-forward
pattern. Blocks are written to the blocker's PDS repo and indexed via the
Jetstream firehose consumer into a new user_blocks table.

Changes:
- Add social.coves.actor.block lexicon and DB migration (029)
- Add userblocks domain package (service, repository, interfaces, errors)
- Add XRPC endpoints: blockUser, unblockUser, getBlockedUsers
- Extend Jetstream consumer to index block create/delete events
- Filter blocked users' posts from timeline, discover, and community feeds
- Filter blocked users' comments from comment threads
- Hydrate viewer.blocking on profile responses for authenticated viewers
- Refactor test helpers: DRY PDS client factories, atomic counters

Co-Authored-By: Claude Opus 4.6 <[e-mail]>

.claude/settings.json

···
 {
+  "env": {
+    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
+  },
   "hooks": {
     "PostToolUse": [
       {

cmd/server/main.go

···
 	"Coves/internal/core/timeline"
 	"Coves/internal/core/unfurl"
 	"Coves/internal/core/adminreports"
+	"Coves/internal/core/userblocks"
 	"Coves/internal/core/users"
 	"Coves/internal/core/votes"
 
···
 			"repo:social.coves.actor.profile?action=create&action=update&action=delete",
 			// Votes
 			"repo:social.coves.feed.vote?action=create&action=delete",
+			// User blocks
+			"repo:social.coves.actor.block?action=create&action=delete",
 		},
 		DevMode:         isDevMode,
 		AllowPrivateIPs: isDevMode, // Allow private IPs only in dev mode
···
 	// Start Jetstream consumer for read-forward user indexing
 	jetstreamURL := os.Getenv("JETSTREAM_URL")
 	if jetstreamURL == "" {
-		jetstreamURL = "wss://jetstream2.us-east.bsky.network/subscribe?wantedCollections=social.coves.actor.profile"
+		jetstreamURL = "wss://jetstream2.us-east.bsky.network/subscribe?wantedCollections=social.coves.actor.profile&wantedCollections=social.coves.actor.block"
 	}
 
 	pdsFilter := os.Getenv("JETSTREAM_PDS_FILTER") // Optional: filter to specific PDS
···
 		consumerOpts = append(consumerOpts, jetstream.WithSessionHandleUpdater(sessionUpdater))
 		log.Println("✅ OAuth session handle sync enabled for identity changes")
 	}
+
+	// Wire user block repo into user consumer for indexing social.coves.actor.block events
+	userBlockRepo := postgresRepo.NewUserBlockRepository(db)
+	consumerOpts = append(consumerOpts, jetstream.WithUserBlockRepo(userBlockRepo))
+
 	userConsumer := jetstream.NewUserEventConsumer(userService, identityResolver, jetstreamURL, pdsFilter, consumerOpts...)
 	ctx := context.Background()
 	go func() {
···
 	commentService := comments.NewCommentService(commentRepo, userRepo, postRepo, communityRepo, oauthClient, oauthStore, nil)
 	log.Println("✅ Comment service initialized (with author/community hydration and write support)")
 
+	// Initialize user block service (user-to-user blocking)
+	// userBlockRepo already created above for the Jetstream consumer
+	userBlockService := userblocks.NewService(userBlockRepo, nil, oauthClient, oauthStore, nil)
+	log.Println("✅ User block service initialized (with OAuth authentication)")
+
 	// Initialize admin report service (off-protocol reporting for serious content issues)
 	adminReportRepo := postgresRepo.NewAdminReportRepository(db)
 	adminReportService := adminreports.NewService(adminReportRepo)
···
 	log.Println("  - Updating: Post comment counts and comment reply counts atomically")
 
 	// Register XRPC routes
-	routes.RegisterUserRoutes(r, userService, authMiddleware, oauthClient.ClientApp)
+	routes.RegisterUserRoutesWithOptions(r, userService, authMiddleware, oauthClient.ClientApp, &routes.UserRouteOptions{
+		UserBlockRepo: userBlockRepo,
+	})
 	log.Println("User XRPC endpoints registered")
-	log.Println("  - GET /xrpc/social.coves.actor.getprofile (public)")
+	log.Println("  - GET /xrpc/social.coves.actor.getprofile (public, OptionalAuth for viewer.blocking)")
 	log.Println("  - POST /xrpc/social.coves.actor.signup (public)")
 	log.Println("  - POST /xrpc/social.coves.actor.deleteAccount (requires OAuth)")
 	log.Println("  - POST /xrpc/social.coves.actor.updateProfile (requires OAuth)")
···
 
 	routes.RegisterVoteRoutes(r, voteService, authMiddleware)
 	log.Println("Vote XRPC endpoints registered with OAuth authentication")
+
+	routes.RegisterUserBlockRoutes(r, userBlockService, authMiddleware)
+	log.Println("User block XRPC endpoints registered with OAuth authentication")
+	log.Println("  - POST /xrpc/social.coves.actor.blockUser")
+	log.Println("  - POST /xrpc/social.coves.actor.unblockUser")
+	log.Println("  - GET /xrpc/social.coves.actor.getBlockedUsers")
 
 	// Register comment write routes (create, update, delete)
 	routes.RegisterCommentRoutes(r, commentService, authMiddleware)

internal/api/handlers/communityFeed/get_community.go

···
 	"strconv"
 
 	"Coves/internal/api/handlers/common"
+	"Coves/internal/api/middleware"
 	"Coves/internal/core/blueskypost"
 	"Coves/internal/core/communityFeeds"
 	"Coves/internal/core/posts"
···
 // parseRequest parses query parameters into GetCommunityFeedRequest
 func (h *GetCommunityHandler) parseRequest(r *http.Request) (communityFeeds.GetCommunityFeedRequest, error) {
 	req := communityFeeds.GetCommunityFeedRequest{}
+
+	// Extract viewer DID from OptionalAuth context for block filtering
+	req.ViewerDID = middleware.GetUserDID(r)
 
 	// Required: community
 	req.Community = r.URL.Query().Get("community")

internal/api/handlers/discover/get_discover.go

···
 	"strconv"
 
 	"Coves/internal/api/handlers/common"
+	"Coves/internal/api/middleware"
 	"Coves/internal/core/blueskypost"
 	"Coves/internal/core/discover"
 	"Coves/internal/core/posts"
···
 // parseRequest parses query parameters into GetDiscoverRequest
 func (h *GetDiscoverHandler) parseRequest(r *http.Request) discover.GetDiscoverRequest {
 	req := discover.GetDiscoverRequest{}
+
+	// Extract viewer DID from OptionalAuth context for block filtering
+	req.ViewerDID = middleware.GetUserDID(r)
 
 	// Optional: sort (default: hot)
 	req.Sort = r.URL.Query().Get("sort")

internal/api/handlers/userblock/block.go

···
+package userblock
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"time"
+
+	"Coves/internal/api/middleware"
+	"Coves/internal/core/userblocks"
+)
+
+// BlockHandler handles user-to-user blocking operations
+type BlockHandler struct {
+	service userblocks.Service
+}
+
+// NewBlockHandler creates a new user block handler
+func NewBlockHandler(service userblocks.Service) *BlockHandler {
+	if service == nil {
+		panic("userblock: NewBlockHandler requires a non-nil service")
+	}
+	return &BlockHandler{
+		service: service,
+	}
+}
+
+// blockRequest is the input for block/unblock operations.
+type blockRequest struct {
+	Subject string `json:"subject"`
+}
+
+// blockResponse is the output for a successful block operation.
+type blockResponse struct {
+	Block blockRecord `json:"block"`
+}
+
+type blockRecord struct {
+	RecordURI string `json:"recordUri"`
+	RecordCID string `json:"recordCid"`
+}
+
+// unblockResponse is the output for a successful unblock operation.
+type unblockResponse struct {
+	Success bool `json:"success"`
+}
+
+// blockedUsersResponse is the output for the get-blocked-users endpoint.
+type blockedUsersResponse struct {
+	Blocks []blockedUserEntry `json:"blocks"`
+}
+
+type blockedUserEntry struct {
+	BlockedDID string    `json:"blockedDid"`
+	RecordURI  string    `json:"recordUri"`
+	RecordCID  string    `json:"recordCid"`
+	BlockedAt  time.Time `json:"blockedAt"`
+}
+
+// HandleBlock blocks a user
+// POST /xrpc/social.coves.actor.blockUser
+//
+// Request body: { "subject": "did-or-handle" }
+// The subject can be a DID (did:plc:xxx) or a handle.
+func (h *BlockHandler) HandleBlock(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 10*1024)
+
+	var req blockRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")
+		return
+	}
+
+	if req.Subject == "" {
+		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject is required")
+		return
+	}
+
+	session := middleware.GetOAuthSession(r)
+	if session == nil {
+		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")
+		return
+	}
+
+	result, err := h.service.BlockUser(r.Context(), session, req.Subject)
+	if err != nil {
+		handleServiceError(w, err)
+		return
+	}
+
+	writeJSON(w, http.StatusOK, blockResponse{
+		Block: blockRecord{
+			RecordURI: result.RecordURI,
+			RecordCID: result.RecordCID,
+		},
+	})
+}
+
+// HandleUnblock unblocks a user
+// POST /xrpc/social.coves.actor.unblockUser
+//
+// Request body: { "subject": "did-or-handle" }
+func (h *BlockHandler) HandleUnblock(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 10*1024)
+
+	var req blockRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")
+		return
+	}
+
+	if req.Subject == "" {
+		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject is required")
+		return
+	}
+
+	session := middleware.GetOAuthSession(r)
+	if session == nil {
+		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")
+		return
+	}
+
+	err := h.service.UnblockUser(r.Context(), session, req.Subject)
+	if err != nil {
+		handleServiceError(w, err)
+		return
+	}
+
+	writeJSON(w, http.StatusOK, unblockResponse{Success: true})
+}
+
+// HandleGetBlocked returns the list of users blocked by the authenticated user
+// GET /xrpc/social.coves.actor.getBlockedUsers?limit=50&offset=0
+func (h *BlockHandler) HandleGetBlocked(w http.ResponseWriter, r *http.Request) {
+	session := middleware.GetOAuthSession(r)
+	if session == nil {
+		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")
+		return
+	}
+
+	limit := 50
+	offset := 0
+
+	if limitStr := r.URL.Query().Get("limit"); limitStr != "" {
+		parsed, err := strconv.Atoi(limitStr)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "InvalidRequest", fmt.Sprintf("invalid limit parameter: %q", limitStr))
+			return
+		}
+		limit = parsed
+	}
+
+	if offsetStr := r.URL.Query().Get("offset"); offsetStr != "" {
+		parsed, err := strconv.Atoi(offsetStr)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "InvalidRequest", fmt.Sprintf("invalid offset parameter: %q", offsetStr))
+			return
+		}
+		offset = parsed
+	}
+
+	userDID := session.AccountDID.String()
+
+	blocks, err := h.service.GetBlockedUsers(r.Context(), userDID, limit, offset)
+	if err != nil {
+		handleServiceError(w, err)
+		return
+	}
+
+	entries := make([]blockedUserEntry, 0, len(blocks))
+	for _, b := range blocks {
+		entries = append(entries, blockedUserEntry{
+			BlockedDID: b.BlockedDID,
+			RecordURI:  b.RecordURI,
+			RecordCID:  b.RecordCID,
+			BlockedAt:  b.BlockedAt,
+		})
+	}
+
+	writeJSON(w, http.StatusOK, blockedUsersResponse{Blocks: entries})
+}
+
+// writeJSON encodes the response to a buffer first, then writes headers and body.
+// This avoids sending a 200 status with a broken/empty body if encoding fails.
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	var buf bytes.Buffer
+	if err := json.NewEncoder(&buf).Encode(v); err != nil {
+		slog.Error("Failed to encode response", "error", err)
+		writeError(w, http.StatusInternalServerError, "InternalServerError", "An internal error occurred")
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if _, err := w.Write(buf.Bytes()); err != nil {
+		slog.Error("Failed to write response", "error", err)
+	}
+}

internal/api/handlers/userblock/errors.go

···
+package userblock
+
+import (
+	"Coves/internal/atproto/pds"
+	"Coves/internal/core/userblocks"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+)
+
+// XRPCError represents an XRPC error response
+type XRPCError struct {
+	Error   string `json:"error"`
+	Message string `json:"message"`
+}
+
+// writeError writes an XRPC error response
+func writeError(w http.ResponseWriter, status int, errCode, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(XRPCError{
+		Error:   errCode,
+		Message: message,
+	}); err != nil {
+		slog.Error("Failed to encode error response", "error", err)
+	}
+}
+
+// handleServiceError converts user block service errors to appropriate HTTP responses
+func handleServiceError(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, userblocks.ErrBlockNotFound):
+		writeError(w, http.StatusNotFound, "NotFound", err.Error())
+	case errors.Is(err, userblocks.ErrBlockAlreadyExists):
+		writeError(w, http.StatusConflict, "AlreadyExists", err.Error())
+	case errors.Is(err, userblocks.ErrCannotBlockSelf):
+		writeError(w, http.StatusBadRequest, "InvalidRequest", "cannot block yourself")
+	// PDS-specific errors
+	case errors.Is(err, pds.ErrUnauthorized), errors.Is(err, pds.ErrForbidden):
+		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required or session expired")
+	case errors.Is(err, pds.ErrBadRequest):
+		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request to PDS")
+	case errors.Is(err, pds.ErrNotFound):
+		writeError(w, http.StatusNotFound, "NotFound", "Record not found on PDS")
+	case errors.Is(err, pds.ErrConflict):
+		writeError(w, http.StatusConflict, "Conflict", "Record was modified by another operation")
+	case errors.Is(err, pds.ErrRateLimited):
+		writeError(w, http.StatusTooManyRequests, "RateLimitExceeded", "Too many requests, please try again later")
+	case errors.Is(err, pds.ErrPayloadTooLarge):
+		writeError(w, http.StatusRequestEntityTooLarge, "PayloadTooLarge", "Request payload exceeds size limit")
+	default:
+		slog.Error("XRPC user block handler error", "error", err)
+		writeError(w, http.StatusInternalServerError, "InternalServerError", "An internal error occurred")
+	}
+}

internal/api/routes/user.go

···
 import (
 	"Coves/internal/api/handlers/user"
 	"Coves/internal/api/middleware"
+	"Coves/internal/core/userblocks"
 	"Coves/internal/core/users"
 	"encoding/json"
 	"errors"
···
 
 // UserHandler handles user-related XRPC endpoints
 type UserHandler struct {
-	userService users.UserService
+	userService    users.UserService
+	userBlockRepo  userblocks.Repository // Optional: for hydrating viewer.blocking on profiles
 }
 
 // NewUserHandler creates a new user handler
···
 	return &UserHandler{
 		userService: userService,
 	}
+}
+
+// SetUserBlockRepo sets the user block repository for profile viewer state hydration.
+// When set, GetProfile will include viewer.blocking in the response for authenticated viewers.
+func (h *UserHandler) SetUserBlockRepo(repo userblocks.Repository) {
+	h.userBlockRepo = repo
 }
 
 // UserRouteOptions contains optional configuration for user routes.
···
 	// If nil, uses OAuth with DPoP (production behavior).
 	// Set this in E2E tests to use password-based authentication.
 	PDSClientFactory user.PDSClientFactory
+
+	// UserBlockRepo provides access to user block data for profile viewer state hydration.
+	// When set, GetProfile includes viewer.blocking in the response for authenticated viewers.
+	UserBlockRepo userblocks.Repository
 }
 
 // RegisterUserRoutes registers user-related XRPC endpoints on the router
···
 // Use opts to inject test dependencies like custom PDS client factories.
 func RegisterUserRoutesWithOptions(r chi.Router, service users.UserService, authMiddleware *middleware.OAuthAuthMiddleware, oauthClient *oauth.ClientApp, opts *UserRouteOptions) {
 	h := NewUserHandler(service)
+
+	// Wire optional dependencies from options
+	if opts != nil && opts.UserBlockRepo != nil {
+		h.SetUserBlockRepo(opts.UserBlockRepo)
+	}
 
 	// /api/me - returns the authenticated user's own profile (cookie or Bearer)
 	meHandler := user.NewMeHandler(service)
 	r.With(authMiddleware.RequireAuth).Get("/api/me", meHandler.HandleMe)
 
-	// social.coves.actor.getprofile - query endpoint (public)
-	r.Get("/xrpc/social.coves.actor.getprofile", h.GetProfile)
+	// social.coves.actor.getprofile - query endpoint (public, OptionalAuth for viewer state)
+	r.With(authMiddleware.OptionalAuth).Get("/xrpc/social.coves.actor.getprofile", h.GetProfile)
 
 	// social.coves.actor.signup - procedure endpoint (public)
 	r.Post("/xrpc/social.coves.actor.signup", h.Signup)
···
 		log.Printf("Failed to get profile for %s: %v", did, err)
 		writeXRPCError(w, "InternalError", "failed to get profile", http.StatusInternalServerError)
 		return
+	}
+
+	// Hydrate viewer state (blocking) when authenticated
+	viewerDID := middleware.GetUserDID(r)
+	if viewerDID != "" && viewerDID != did && h.userBlockRepo != nil {
+		block, blockErr := h.userBlockRepo.GetBlock(ctx, viewerDID, did)
+		if blockErr == nil && block != nil {
+			profile.Viewer = &users.ProfileViewerState{
+				Blocking: &block.RecordURI,
+			}
+		} else if blockErr != nil && !userblocks.IsNotFound(blockErr) {
+			// Log unexpected DB errors (connection timeout, pool exhaustion, etc.)
+			// but don't fail the profile request — viewer.blocking is best-effort
+			log.Printf("WARNING: failed to check block state for viewer %s on profile %s: %v", viewerDID, did, blockErr)
+		}
 	}
 
 	// Marshal to bytes first to avoid partial writes on encoding errors

internal/api/routes/userblock.go

···
+package routes
+
+import (
+	"Coves/internal/api/handlers/userblock"
+	"Coves/internal/api/middleware"
+	"Coves/internal/core/userblocks"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// RegisterUserBlockRoutes registers user-to-user blocking XRPC endpoints on the router
+// Implements social.coves.actor.blockUser, unblockUser, and getBlockedUsers
+func RegisterUserBlockRoutes(r chi.Router, service userblocks.Service, authMiddleware *middleware.OAuthAuthMiddleware) {
+	handler := userblock.NewBlockHandler(service)
+
+	// Procedure endpoints (POST) - require authentication
+	// social.coves.actor.blockUser - block a user
+	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.actor.blockUser", handler.HandleBlock)
+
+	// social.coves.actor.unblockUser - unblock a user
+	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.actor.unblockUser", handler.HandleUnblock)
+
+	// Query endpoints (GET) - require authentication (viewing own blocks)
+	// social.coves.actor.getBlockedUsers - list blocked users
+	r.With(authMiddleware.RequireAuth).Get("/xrpc/social.coves.actor.getBlockedUsers", handler.HandleGetBlocked)
+}

internal/atproto/jetstream/user_consumer.go

···
 
 import (
 	"Coves/internal/atproto/identity"
+	"Coves/internal/atproto/utils"
+	"Coves/internal/core/userblocks"
 	"Coves/internal/core/users"
 	"context"
 	"encoding/json"
···
 	"fmt"
 	"log"
 	"log/slog"
+	"strings"
 	"sync"
 	"time"
 
···
 // NOTE: This constant is intentionally duplicated in internal/api/handlers/user/update_profile.go
 // to avoid circular dependencies between packages. Keep both definitions in sync.
 const CovesProfileCollection = "social.coves.actor.profile"
+
+// CovesActorBlockCollection is the atProto collection for user-to-user blocks.
+// Records live in the blocker's repository at at://blocker_did/social.coves.actor.block/{tid}
+const CovesActorBlockCollection = "social.coves.actor.block"
 
 // SessionHandleUpdater is an interface for updating OAuth session handles
 // when identity changes occur. This keeps active sessions in sync with
···
 type UserEventConsumer struct {
 	userService          users.UserService
 	identityResolver     identity.Resolver
-	sessionHandleUpdater SessionHandleUpdater // Optional: updates OAuth sessions on handle change
+	sessionHandleUpdater SessionHandleUpdater    // Optional: updates OAuth sessions on handle change
+	userBlockRepo        userblocks.Repository   // Optional: indexes user-to-user blocks
 	wsURL                string
 	pdsFilter            string // Optional: only index users from specific PDS
 }
···
 func WithSessionHandleUpdater(updater SessionHandleUpdater) ConsumerOption {
 	return func(c *UserEventConsumer) {
 		c.sessionHandleUpdater = updater
+	}
+}
+
+// WithUserBlockRepo sets the user block repository for indexing user-to-user blocks
+// from the Jetstream firehose. If not set, block events will be ignored.
+func WithUserBlockRepo(repo userblocks.Repository) ConsumerOption {
+	return func(c *UserEventConsumer) {
+		c.userBlockRepo = repo
 	}
 }
 
···
 	}
 }
 
-// HandleIdentityEventPublic is a public wrapper for testing
+// HandleEvent processes a Jetstream event for user-related records.
+// This is the public entry point used by tests and external callers.
+func (c *UserEventConsumer) HandleEvent(ctx context.Context, event *JetstreamEvent) error {
+	switch event.Kind {
+	case "identity":
+		return c.handleIdentityEvent(ctx, event)
+	case "account":
+		return c.handleAccountEvent(ctx, event)
+	case "commit":
+		return c.handleCommitEvent(ctx, event)
+	default:
+		return nil
+	}
+}
+
+// Deprecated: HandleIdentityEventPublic is superseded by HandleEvent which routes
+// all event kinds. Use HandleEvent for new code; this remains for existing tests.
 func (c *UserEventConsumer) HandleIdentityEventPublic(ctx context.Context, event *JetstreamEvent) error {
 	return c.handleIdentityEvent(ctx, event)
 }
···
 	return nil
 }
 
-// handleCommitEvent processes commit events for user profile updates
-// Only handles social.coves.actor.profile collection for users already in our database.
-// This syncs profile data (displayName, bio, avatar, banner) from Coves profiles.
+// handleCommitEvent processes commit events for user-related collections.
+// Routes to appropriate handler based on collection:
+// - social.coves.actor.profile: Profile updates for users in our database
+// - social.coves.actor.block: User-to-user block create/delete events
 func (c *UserEventConsumer) handleCommitEvent(ctx context.Context, event *JetstreamEvent) error {
 	if event.Commit == nil {
 		slog.Warn("received nil commit in handleCommitEvent (malformed event)", slog.String("did", event.Did))
 		return nil
 	}
 
-	// Only handle social.coves.actor.profile collection
-	if event.Commit.Collection != CovesProfileCollection {
+	switch event.Commit.Collection {
+	case CovesProfileCollection:
+		return c.handleProfileCommit(ctx, event)
+	case CovesActorBlockCollection:
+		return c.handleUserBlock(ctx, event.Did, event.Commit)
+	default:
+		return nil
+	}
+}
+
+// handleProfileCommit processes profile commit events for users already in our database.
+// This syncs profile data (displayName, bio, avatar, banner) from Coves profiles.
+func (c *UserEventConsumer) handleProfileCommit(ctx context.Context, event *JetstreamEvent) error {
+	// Profile handling requires userService
+	if c.userService == nil {
 		return nil
 	}
 
···
 	log.Printf("Cleared profile for user %s", did)
 	return nil
 }
+
+// handleUserBlock processes user-to-user block create/delete events.
+// CREATE operation = user blocked another user
+// DELETE operation = user unblocked another user
+func (c *UserEventConsumer) handleUserBlock(ctx context.Context, userDID string, commit *CommitEvent) error {
+	if c.userBlockRepo == nil {
+		slog.Warn("user block event ignored: userBlockRepo not configured (WithUserBlockRepo not called)",
+			slog.String("user_did", userDID),
+			slog.String("operation", commit.Operation))
+		return nil
+	}
+
+	switch commit.Operation {
+	case "create":
+		return c.createUserBlock(ctx, userDID, commit)
+	case "delete":
+		return c.deleteUserBlock(ctx, userDID, commit)
+	default:
+		// Update operations shouldn't happen on blocks, but ignore gracefully
+		log.Printf("Ignoring unexpected operation on user block: %s (userDID=%s, rkey=%s)",
+			commit.Operation, userDID, commit.RKey)
+		return nil
+	}
+}
+
+// createUserBlock indexes a new user-to-user block from the firehose.
+func (c *UserEventConsumer) createUserBlock(ctx context.Context, userDID string, commit *CommitEvent) error {
+	if commit.Record == nil {
+		return fmt.Errorf("user block create event missing record data")
+	}
+
+	// Validate userDID format (untrusted firehose data)
+	if !strings.HasPrefix(userDID, "did:") {
+		return fmt.Errorf("invalid blocker DID format from firehose: %s", userDID)
+	}
+
+	// Extract blocked user DID from record's subject field
+	blockedDID, ok := commit.Record["subject"].(string)
+	if !ok {
+		return fmt.Errorf("user block record missing subject field")
+	}
+
+	// Validate blockedDID format (untrusted firehose data)
+	if !strings.HasPrefix(blockedDID, "did:") {
+		return fmt.Errorf("invalid blocked DID format from firehose: %s", blockedDID)
+	}
+
+	// Validate rkey is non-empty before building AT-URI
+	if commit.RKey == "" {
+		return fmt.Errorf("user block create event missing rkey")
+	}
+
+	// Build AT-URI for the block record (lives in the blocker's repository)
+	uri := fmt.Sprintf("at://%s/social.coves.actor.block/%s", userDID, commit.RKey)
+
+	// Parse createdAt from record to preserve chronological ordering during replays
+	block := &userblocks.UserBlock{
+		BlockerDID: userDID,
+		BlockedDID: blockedDID,
+		BlockedAt:  utils.ParseCreatedAt(commit.Record),
+		RecordURI:  uri,
+		RecordCID:  commit.CID,
+	}
+
+	// Index the block (idempotent via ON CONFLICT DO UPDATE)
+	_, err := c.userBlockRepo.BlockUser(ctx, block)
+	if err != nil {
+		if userblocks.IsConflict(err) {
+			log.Printf("User block already indexed: %s -> %s", userDID, blockedDID)
+			return nil
+		}
+		return fmt.Errorf("failed to index user block: %w", err)
+	}
+
+	log.Printf("Indexed user block: %s -> %s", userDID, blockedDID)
+	return nil
+}
+
+// deleteUserBlock removes a user-to-user block from the index.
+// DELETE operations don't include record data, so we look up the block by its URI.
+func (c *UserEventConsumer) deleteUserBlock(ctx context.Context, userDID string, commit *CommitEvent) error {
+	// Validate rkey is non-empty before building AT-URI
+	if commit.RKey == "" {
+		return fmt.Errorf("user block delete event missing rkey")
+	}
+
+	// Build AT-URI from the rkey
+	uri := fmt.Sprintf("at://%s/social.coves.actor.block/%s", userDID, commit.RKey)
+
+	// Look up the block to get the blocked DID
+	block, err := c.userBlockRepo.GetBlockByURI(ctx, uri)
+	if err != nil {
+		if userblocks.IsNotFound(err) {
+			// Already deleted - this is fine (idempotency)
+			log.Printf("User block already deleted: %s", uri)
+			return nil
+		}
+		return fmt.Errorf("failed to find user block for deletion: %w", err)
+	}
+
+	// Remove the block from the index
+	err = c.userBlockRepo.UnblockUser(ctx, userDID, block.BlockedDID)
+	if err != nil {
+		if userblocks.IsNotFound(err) {
+			log.Printf("User block already removed: %s -> %s", userDID, block.BlockedDID)
+			return nil
+		}
+		return fmt.Errorf("failed to remove user block: %w", err)
+	}
+
+	log.Printf("Removed user block: %s -> %s", userDID, block.BlockedDID)
+	return nil
+}

internal/atproto/lexicon/social/coves/actor/block.json

···
+{
+  "lexicon": 1,
+  "id": "social.coves.actor.block",
+  "defs": {
+    "main": {
+      "type": "record",
+      "description": "Record declaring a block relationship against another user. Blocks are public and one-directional: only the blocker's view is affected.",
+      "key": "tid",
+      "record": {
+        "type": "object",
+        "required": ["subject"],
+        "properties": {
+          "subject": {
+            "type": "string",
+            "format": "did",
+            "description": "DID of the user being blocked"
+          },
+          "createdAt": {
+            "type": "string",
+            "format": "datetime",
+            "description": "When the block was created"
+          }
+        }
+      }
+    }
+  }
+}

internal/core/comments/comment_service.go

···
 
 	// 3. Fetch top-level comments with pagination
 	// Uses repository's hot rank sorting and cursor-based pagination
+	var viewerDIDStr string
+	if req.ViewerDID != nil {
+		viewerDIDStr = *req.ViewerDID
+	}
 	topComments, nextCursor, err := s.commentRepo.ListByParentWithHotRank(
 		ctx,
 		req.PostURI,
···
 		req.Timeframe,
 		req.Limit,
 		req.Cursor,
+		viewerDIDStr,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch top-level comments: %w", err)
···
 
 	// Batch load all replies for this level in a single query
 	if len(parentsWithReplies) > 0 {
+		var batchViewerDID string
+		if viewerDID != nil {
+			batchViewerDID = *viewerDID
+		}
 		repliesByParent, err := s.commentRepo.ListByParentsBatch(
 			ctx,
 			parentsWithReplies,
 			sort,
 			DefaultRepliesPerParent,
+			batchViewerDID,
 		)
+
+		if err != nil {
+			slog.Error("failed to batch load replies (nested replies will be missing)",
+				"error", err,
+				"parent_count", len(parentsWithReplies),
+				"sort", sort)
+		}
 
 		// Process replies if batch query succeeded
 		if err == nil {

internal/core/comments/comment_service_test.go

···
 	timeframe string,
 	limit int,
 	cursor *string,
+	viewerDID string,
 ) ([]*Comment, *string, error) {
 	if m.listByParentWithHotRankFunc != nil {
 		return m.listByParentWithHotRankFunc(ctx, parentURI, sort, timeframe, limit, cursor)
···
 	parentURIs []string,
 	sort string,
 	limitPerParent int,
+	viewerDID string,
 ) (map[string][]*Comment, error) {
 	if m.listByParentsBatchFunc != nil {
 		return m.listByParentsBatchFunc(ctx, parentURIs, sort, limitPerParent)

internal/core/comments/interfaces.go

···
 	// ListByParentWithHotRank retrieves direct replies to a post or comment with sorting and pagination
 	// Supports hot, top, and new sorting with cursor-based pagination
 	// Returns comments with author info hydrated and next page cursor
+	// viewerDID is optional — when non-empty, comments from blocked users are filtered out
 	ListByParentWithHotRank(
 		ctx context.Context,
 		parentURI string,
···
 		timeframe string, // "hour", "day", "week", "month", "year", "all" (for "top" only)
 		limit int,
 		cursor *string,
+		viewerDID string,
 	) ([]*Comment, *string, error)
 
 	// GetByURIsBatch retrieves multiple comments by their AT-URIs in a single query
···
 	// Returns map[parentURI][]*Comment grouped by parent
 	// Used to prevent N+1 queries when loading nested replies
 	// Limits results per parent to avoid memory exhaustion
+	// viewerDID is optional — when non-empty, comments from blocked users are filtered out
 	ListByParentsBatch(
 		ctx context.Context,
 		parentURIs []string,
 		sort string,
 		limitPerParent int,
+		viewerDID string,
 	) (map[string][]*Comment, error)
 }
 

internal/core/communityFeeds/types.go

···
 type GetCommunityFeedRequest struct {
 	Cursor    *string `json:"cursor,omitempty"`
 	Community string  `json:"community"`
+	ViewerDID string  `json:"-"` // Optional: authenticated viewer's DID for block filtering
 	Sort      string  `json:"sort"`
 	Timeframe string  `json:"timeframe"`
 	Limit     int     `json:"limit"`

internal/core/discover/types.go

···
 // Matches social.coves.feed.getDiscover lexicon input
 type GetDiscoverRequest struct {
 	Cursor    *string `json:"cursor,omitempty"`
+	ViewerDID string  `json:"-"` // Optional: authenticated viewer's DID for block filtering
 	Sort      string  `json:"sort"`
 	Timeframe string  `json:"timeframe"`
 	Limit     int     `json:"limit"`

internal/core/userblocks/errors.go

···
+package userblocks
+
+import "errors"
+
+// Sentinel errors for user block operations
+var (
+	// ErrBlockNotFound is returned when a block lookup finds no matching record
+	ErrBlockNotFound = errors.New("user block not found")
+
+	// ErrBlockAlreadyExists is returned when attempting to create a duplicate block
+	ErrBlockAlreadyExists = errors.New("user already blocked")
+
+	// ErrCannotBlockSelf is returned when a user attempts to block themselves
+	ErrCannotBlockSelf = errors.New("cannot block yourself")
+)
+
+// IsNotFound returns true if the error is ErrBlockNotFound
+func IsNotFound(err error) bool {
+	return errors.Is(err, ErrBlockNotFound)
+}
+
+// IsConflict returns true if the error is ErrBlockAlreadyExists
+func IsConflict(err error) bool {
+	return errors.Is(err, ErrBlockAlreadyExists)
+}
+

internal/core/userblocks/interfaces.go

···
+package userblocks
+
+import (
+	"Coves/internal/atproto/pds"
+	"context"
+
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
+)
+
+// PDSClientFactory creates PDS clients from session data.
+// This is primarily used for test injection via NewServiceWithPDSFactory to allow
+// password-based auth in integration tests instead of OAuth DPoP.
+type PDSClientFactory func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error)
+
+// Repository defines the interface for user block data persistence.
+// This is the AppView's indexed view of blocks from the firehose.
+type Repository interface {
+	// BlockUser creates a new block record (idempotent via ON CONFLICT DO UPDATE)
+	BlockUser(ctx context.Context, block *UserBlock) (*UserBlock, error)
+
+	// UnblockUser removes a block record. Returns ErrBlockNotFound if not exists.
+	UnblockUser(ctx context.Context, blockerDID, blockedDID string) error
+
+	// GetBlock retrieves a block by blocker + blocked DID pair.
+	// Returns ErrBlockNotFound if not exists.
+	GetBlock(ctx context.Context, blockerDID, blockedDID string) (*UserBlock, error)
+
+	// GetBlockByURI retrieves a block by its AT-URI.
+	// Used by Jetstream consumer for DELETE operations (which don't include record data).
+	// Returns ErrBlockNotFound if not exists.
+	GetBlockByURI(ctx context.Context, recordURI string) (*UserBlock, error)
+
+	// ListBlockedUsers retrieves all users blocked by the given blocker, paginated.
+	// Results are ordered by blocked_at DESC.
+	ListBlockedUsers(ctx context.Context, blockerDID string, limit, offset int) ([]*UserBlock, error)
+
+	// IsBlocked checks if blockerDID has blocked blockedDID (fast EXISTS check).
+	IsBlocked(ctx context.Context, blockerDID, blockedDID string) (bool, error)
+
+	// AreBlocked checks which of the given DIDs are blocked by blockerDID.
+	// Returns a map of blockedDID → true for each DID that is blocked.
+	// Used for batch hydration of viewer state on lists of posts/comments.
+	AreBlocked(ctx context.Context, blockerDID string, blockedDIDs []string) (map[string]bool, error)
+}
+
+// Service defines the interface for user block business logic.
+// Coordinates between Repository and external services (PDS, identity, etc.)
+// Uses write-forward pattern: Service → PDS → Firehose → Consumer → Repository
+type Service interface {
+	// BlockUser creates a block against another user.
+	// Uses OAuth session for DPoP-authenticated PDS write-forward.
+	// The identifier can be a DID or handle.
+	// Returns a BlockResult with the record URI and CID from PDS.
+	// The block is indexed asynchronously via the firehose consumer.
+	// Returns ErrCannotBlockSelf if the user attempts to block themselves.
+	// Returns ErrBlockAlreadyExists if the block already exists on PDS.
+	BlockUser(ctx context.Context, session *oauth.ClientSessionData, identifier string) (*BlockResult, error)
+
+	// UnblockUser removes a block against another user.
+	// Uses OAuth session for DPoP-authenticated PDS delete.
+	// The identifier can be a DID or handle.
+	UnblockUser(ctx context.Context, session *oauth.ClientSessionData, identifier string) error
+
+	// GetBlockedUsers retrieves all users blocked by the given user, paginated.
+	GetBlockedUsers(ctx context.Context, blockerDID string, limit, offset int) ([]*UserBlock, error)
+
+	// IsBlocked checks if blockerDID has blocked blockedDID.
+	IsBlocked(ctx context.Context, blockerDID, blockedDID string) (bool, error)
+}

internal/core/userblocks/service.go

···
+package userblocks
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	oauthclient "Coves/internal/atproto/oauth"
+	"Coves/internal/atproto/pds"
+	"Coves/internal/atproto/utils"
+
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+)
+
+const (
+	// blockCollection is the AT Protocol collection for user block records
+	blockCollection = "social.coves.actor.block"
+)
+
+// HandleResolver resolves AT Protocol handles to DIDs.
+// This is a minimal interface satisfied by users.UserService.
+type HandleResolver interface {
+	ResolveHandleToDID(ctx context.Context, handle string) (string, error)
+}
+
+type userBlockService struct {
+	repo             Repository
+	handleResolver   HandleResolver
+	oauthClient      *oauthclient.OAuthClient
+	oauthStore       oauth.ClientAuthStore
+	logger           *slog.Logger
+	pdsClientFactory PDSClientFactory // Optional, for testing. If nil, uses OAuth.
+}
+
+// NewService creates a new user block service with OAuth client for production use.
+func NewService(
+	repo Repository,
+	handleResolver HandleResolver,
+	oauthClient *oauthclient.OAuthClient,
+	oauthStore oauth.ClientAuthStore,
+	logger *slog.Logger,
+) Service {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &userBlockService{
+		repo:           repo,
+		handleResolver: handleResolver,
+		oauthClient:    oauthClient,
+		oauthStore:     oauthStore,
+		logger:         logger,
+	}
+}
+
+// NewServiceWithPDSFactory creates a user block service with a custom PDS client factory.
+// This is primarily for testing with password-based authentication.
+func NewServiceWithPDSFactory(
+	repo Repository,
+	handleResolver HandleResolver,
+	factory PDSClientFactory,
+) Service {
+	return &userBlockService{
+		repo:             repo,
+		handleResolver:   handleResolver,
+		pdsClientFactory: factory,
+		logger:           slog.Default(),
+	}
+}
+
+// BlockUser creates a block against another user via write-forward to PDS.
+// The identifier can be a DID (starts with "did:") or a handle.
+// Returns a BlockResult with the record URI and CID from PDS.
+// The block will be indexed asynchronously via the firehose consumer.
+func (s *userBlockService) BlockUser(ctx context.Context, session *oauth.ClientSessionData, identifier string) (*BlockResult, error) {
+	if session == nil {
+		return nil, fmt.Errorf("session is required")
+	}
+
+	blockerDID := session.AccountDID.String()
+
+	// Validate and normalize identifier
+	identifier = strings.TrimSpace(identifier)
+	if identifier == "" {
+		return nil, fmt.Errorf("block: identifier is required")
+	}
+
+	// Resolve identifier to DID
+	blockedDID, err := s.resolveIdentifier(ctx, identifier)
+	if err != nil {
+		return nil, fmt.Errorf("block: %w", err)
+	}
+
+	// Prevent self-blocking
+	if blockerDID == blockedDID {
+		s.logger.Warn("self-block attempt",
+			"blockerDID", blockerDID)
+		return nil, ErrCannotBlockSelf
+	}
+
+	// Get PDS client for this session
+	pdsClient, err := s.getPDSClient(ctx, session)
+	if err != nil {
+		return nil, err
+	}
+
+	// Generate TID for record key
+	tid := syntax.NewTIDNow(0)
+
+	// Build block record following atProto conventions
+	blockRecord := map[string]interface{}{
+		"$type":     blockCollection,
+		"subject":   blockedDID,
+		"createdAt": time.Now().Format(time.RFC3339),
+	}
+
+	// Write-forward: create block record in user's repo
+	recordURI, recordCID, err := pdsClient.CreateRecord(ctx, blockCollection, tid.String(), blockRecord)
+	if err != nil {
+		// Check for auth errors
+		if pds.IsAuthError(err) {
+			s.logger.Warn("block auth failure",
+				"blockerDID", blockerDID,
+				"blockedDID", blockedDID,
+				"error", err)
+			return nil, fmt.Errorf("unauthorized: %w", err)
+		}
+
+		// Check for duplicate/conflict error from PDS
+		if pds.IsConflictError(err) {
+			existingBlock, getErr := s.repo.GetBlock(ctx, blockerDID, blockedDID)
+			if getErr == nil {
+				return &BlockResult{
+					RecordURI: existingBlock.RecordURI,
+					RecordCID: existingBlock.RecordCID,
+				}, nil
+			}
+			if errors.Is(getErr, ErrBlockNotFound) {
+				return nil, ErrBlockAlreadyExists
+			}
+			return nil, fmt.Errorf("PDS reported duplicate block but failed to fetch from index: %w", getErr)
+		}
+		return nil, fmt.Errorf("failed to create block on PDS: %w", err)
+	}
+
+	s.logger.Info("block created",
+		"blockerDID", blockerDID,
+		"blockedDID", blockedDID,
+		"recordURI", recordURI)
+
+	return &BlockResult{
+		RecordURI: recordURI,
+		RecordCID: recordCID,
+	}, nil
+}
+
+// UnblockUser removes a block against another user via PDS delete.
+func (s *userBlockService) UnblockUser(ctx context.Context, session *oauth.ClientSessionData, identifier string) error {
+	if session == nil {
+		return fmt.Errorf("session is required")
+	}
+
+	blockerDID := session.AccountDID.String()
+
+	// Validate and normalize identifier
+	identifier = strings.TrimSpace(identifier)
+	if identifier == "" {
+		return fmt.Errorf("unblock: identifier is required")
+	}
+
+	// Resolve identifier to DID
+	blockedDID, err := s.resolveIdentifier(ctx, identifier)
+	if err != nil {
+		return fmt.Errorf("unblock: %w", err)
+	}
+
+	// Get the block from AppView to find the record key
+	block, err := s.repo.GetBlock(ctx, blockerDID, blockedDID)
+	if err != nil {
+		return err
+	}
+
+	// Extract rkey from record URI (at://did/collection/rkey)
+	rkey := utils.ExtractRKeyFromURI(block.RecordURI)
+	if rkey == "" {
+		return fmt.Errorf("invalid block record URI")
+	}
+
+	// Get PDS client for this session
+	pdsClient, err := s.getPDSClient(ctx, session)
+	if err != nil {
+		return fmt.Errorf("failed to create PDS client: %w", err)
+	}
+
+	// Write-forward: delete record from PDS
+	if err := pdsClient.DeleteRecord(ctx, blockCollection, rkey); err != nil {
+		if pds.IsAuthError(err) {
+			s.logger.Warn("unblock auth failure",
+				"blockerDID", blockerDID,
+				"blockedDID", blockedDID,
+				"error", err)
+			return fmt.Errorf("unauthorized: %w", err)
+		}
+		return fmt.Errorf("failed to delete block on PDS: %w", err)
+	}
+
+	s.logger.Info("block deleted",
+		"blockerDID", blockerDID,
+		"blockedDID", blockedDID)
+
+	return nil
+}
+
+// GetBlockedUsers retrieves all users blocked by the given user, paginated.
+func (s *userBlockService) GetBlockedUsers(ctx context.Context, blockerDID string, limit, offset int) ([]*UserBlock, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	if limit > 100 {
+		limit = 100
+	}
+	if offset < 0 {
+		offset = 0
+	}
+
+	return s.repo.ListBlockedUsers(ctx, blockerDID, limit, offset)
+}
+
+// IsBlocked checks if blockerDID has blocked blockedDID.
+func (s *userBlockService) IsBlocked(ctx context.Context, blockerDID, blockedDID string) (bool, error) {
+	return s.repo.IsBlocked(ctx, blockerDID, blockedDID)
+}
+
+// resolveIdentifier resolves an identifier to a DID.
+// If the identifier starts with "did:", it is validated as a proper DID.
+// Otherwise, it is treated as a handle and resolved via the handle resolver.
+func (s *userBlockService) resolveIdentifier(ctx context.Context, identifier string) (string, error) {
+	if strings.HasPrefix(identifier, "did:") {
+		// Validate DID using the syntax package
+		if _, err := syntax.ParseDID(identifier); err != nil {
+			return "", fmt.Errorf("invalid DID %q: %w", identifier, err)
+		}
+		return identifier, nil
+	}
+	return s.handleResolver.ResolveHandleToDID(ctx, identifier)
+}
+
+// getPDSClient creates a PDS client from an OAuth session.
+// If a custom factory was provided (for testing), uses that.
+// Otherwise, uses OAuth with DPoP authentication.
+func (s *userBlockService) getPDSClient(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+	if s.pdsClientFactory != nil {
+		return s.pdsClientFactory(ctx, session)
+	}
+
+	if s.oauthClient == nil || s.oauthClient.ClientApp == nil {
+		return nil, fmt.Errorf("OAuth client not configured")
+	}
+
+	client, err := pds.NewFromOAuthSession(ctx, s.oauthClient.ClientApp, session)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create PDS client: %w", err)
+	}
+
+	return client, nil
+}

internal/core/userblocks/service_test.go

···
+package userblocks
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+
+	"Coves/internal/atproto/pds"
+	"Coves/internal/core/blobs"
+)
+
+// --- Mock Repository ---
+
+type mockRepo struct {
+	blockUserFn       func(ctx context.Context, block *UserBlock) (*UserBlock, error)
+	unblockUserFn     func(ctx context.Context, blockerDID, blockedDID string) error
+	getBlockFn        func(ctx context.Context, blockerDID, blockedDID string) (*UserBlock, error)
+	getBlockByURIFn   func(ctx context.Context, recordURI string) (*UserBlock, error)
+	listBlockedFn     func(ctx context.Context, blockerDID string, limit, offset int) ([]*UserBlock, error)
+	isBlockedFn       func(ctx context.Context, blockerDID, blockedDID string) (bool, error)
+	areBlockedFn      func(ctx context.Context, blockerDID string, blockedDIDs []string) (map[string]bool, error)
+}
+
+func (m *mockRepo) BlockUser(ctx context.Context, block *UserBlock) (*UserBlock, error) {
+	if m.blockUserFn != nil {
+		return m.blockUserFn(ctx, block)
+	}
+	return block, nil
+}
+
+func (m *mockRepo) UnblockUser(ctx context.Context, blockerDID, blockedDID string) error {
+	if m.unblockUserFn != nil {
+		return m.unblockUserFn(ctx, blockerDID, blockedDID)
+	}
+	return nil
+}
+
+func (m *mockRepo) GetBlock(ctx context.Context, blockerDID, blockedDID string) (*UserBlock, error) {
+	if m.getBlockFn != nil {
+		return m.getBlockFn(ctx, blockerDID, blockedDID)
+	}
+	return nil, ErrBlockNotFound
+}
+
+func (m *mockRepo) GetBlockByURI(ctx context.Context, recordURI string) (*UserBlock, error) {
+	if m.getBlockByURIFn != nil {
+		return m.getBlockByURIFn(ctx, recordURI)
+	}
+	return nil, ErrBlockNotFound
+}
+
+func (m *mockRepo) ListBlockedUsers(ctx context.Context, blockerDID string, limit, offset int) ([]*UserBlock, error) {
+	if m.listBlockedFn != nil {
+		return m.listBlockedFn(ctx, blockerDID, limit, offset)
+	}
+	return nil, nil
+}
+
+func (m *mockRepo) IsBlocked(ctx context.Context, blockerDID, blockedDID string) (bool, error) {
+	if m.isBlockedFn != nil {
+		return m.isBlockedFn(ctx, blockerDID, blockedDID)
+	}
+	return false, nil
+}
+
+func (m *mockRepo) AreBlocked(ctx context.Context, blockerDID string, blockedDIDs []string) (map[string]bool, error) {
+	if m.areBlockedFn != nil {
+		return m.areBlockedFn(ctx, blockerDID, blockedDIDs)
+	}
+	return make(map[string]bool), nil
+}
+
+// --- Mock Handle Resolver ---
+
+type mockHandleResolver struct {
+	resolveHandleToDIDFn func(ctx context.Context, handle string) (string, error)
+}
+
+func (m *mockHandleResolver) ResolveHandleToDID(ctx context.Context, handle string) (string, error) {
+	if m.resolveHandleToDIDFn != nil {
+		return m.resolveHandleToDIDFn(ctx, handle)
+	}
+	return "", errors.New("not implemented")
+}
+
+// --- Mock PDS Client ---
+
+type mockPDSClient struct {
+	createRecordFn func(ctx context.Context, collection, rkey string, record any) (string, string, error)
+	deleteRecordFn func(ctx context.Context, collection, rkey string) error
+}
+
+func (m *mockPDSClient) CreateRecord(ctx context.Context, collection, rkey string, record any) (string, string, error) {
+	if m.createRecordFn != nil {
+		return m.createRecordFn(ctx, collection, rkey, record)
+	}
+	return "at://did:plc:test/social.coves.actor.block/" + rkey, "bafyreicid", nil
+}
+
+func (m *mockPDSClient) DeleteRecord(ctx context.Context, collection, rkey string) error {
+	if m.deleteRecordFn != nil {
+		return m.deleteRecordFn(ctx, collection, rkey)
+	}
+	return nil
+}
+
+func (m *mockPDSClient) GetRecord(ctx context.Context, collection, rkey string) (*pds.RecordResponse, error) {
+	return nil, nil
+}
+
+func (m *mockPDSClient) ListRecords(ctx context.Context, collection string, limit int, cursor string) (*pds.ListRecordsResponse, error) {
+	return nil, nil
+}
+
+func (m *mockPDSClient) PutRecord(ctx context.Context, collection string, rkey string, record any, swapRecord string) (string, string, error) {
+	return "", "", nil
+}
+
+func (m *mockPDSClient) UploadBlob(ctx context.Context, data []byte, mimeType string) (*blobs.BlobRef, error) {
+	return nil, nil
+}
+
+func (m *mockPDSClient) DID() string {
+	return "did:plc:mock"
+}
+
+func (m *mockPDSClient) HostURL() string {
+	return "http://localhost:3001"
+}
+
+// --- Helper to create a test session ---
+
+func testSession(did string) *oauth.ClientSessionData {
+	parsedDID, _ := syntax.ParseDID(did)
+	return &oauth.ClientSessionData{
+		AccountDID:  parsedDID,
+		AccessToken: "test-token",
+		HostURL:     "http://localhost:3001",
+	}
+}
+
+// --- Tests ---
+
+func TestBlockUser_PreventsSelfBlock(t *testing.T) {
+	repo := &mockRepo{}
+	userSvc := &mockHandleResolver{}
+	pdsClient := &mockPDSClient{}
+
+	factory := func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	}
+
+	svc := NewServiceWithPDSFactory(repo, userSvc, factory)
+
+	selfDID := "did:plc:selfuser123"
+	session := testSession(selfDID)
+
+	// Blocking yourself should return ErrCannotBlockSelf
+	_, err := svc.BlockUser(context.Background(), session, selfDID)
+	if err == nil {
+		t.Fatal("expected error when blocking self, got nil")
+	}
+	if !errors.Is(err, ErrCannotBlockSelf) {
+		t.Fatalf("expected ErrCannotBlockSelf, got: %v", err)
+	}
+}
+
+func TestBlockUser_ResolvesHandleToDID(t *testing.T) {
+	resolvedDID := "did:plc:bobresolved"
+	var createCalledWithCollection string
+	var createCalledWithSubject string
+
+	repo := &mockRepo{}
+	userSvc := &mockHandleResolver{
+		resolveHandleToDIDFn: func(ctx context.Context, handle string) (string, error) {
+			if handle != "bob.bsky.social" {
+				t.Fatalf("expected handle bob.bsky.social, got %s", handle)
+			}
+			return resolvedDID, nil
+		},
+	}
+	pdsClient := &mockPDSClient{
+		createRecordFn: func(ctx context.Context, collection, rkey string, record interface{}) (string, string, error) {
+			createCalledWithCollection = collection
+			// Extract subject from record map
+			if rec, ok := record.(map[string]interface{}); ok {
+				if sub, ok := rec["subject"].(string); ok {
+					createCalledWithSubject = sub
+				}
+			}
+			uri := "at://did:plc:alice123/social.coves.actor.block/" + rkey
+			return uri, "bafyreicid123", nil
+		},
+	}
+
+	factory := func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	}
+
+	svc := NewServiceWithPDSFactory(repo, userSvc, factory)
+
+	session := testSession("did:plc:alice123")
+
+	result, err := svc.BlockUser(context.Background(), session, "bob.bsky.social")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if createCalledWithSubject != resolvedDID {
+		t.Fatalf("expected PDS record subject %s, got %s", resolvedDID, createCalledWithSubject)
+	}
+	if createCalledWithCollection != "social.coves.actor.block" {
+		t.Fatalf("expected collection social.coves.actor.block, got %s", createCalledWithCollection)
+	}
+	if result.RecordURI == "" {
+		t.Fatal("expected non-empty record URI")
+	}
+	if result.RecordCID == "" {
+		t.Fatal("expected non-empty record CID")
+	}
+}
+
+func TestBlockUser_AcceptsDIDDirectly(t *testing.T) {
+	targetDID := "did:plc:target456"
+	resolveHandleCalled := false
+
+	repo := &mockRepo{}
+	userSvc := &mockHandleResolver{
+		resolveHandleToDIDFn: func(ctx context.Context, handle string) (string, error) {
+			resolveHandleCalled = true
+			return "", errors.New("should not be called")
+		},
+	}
+	pdsClient := &mockPDSClient{}
+
+	factory := func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	}
+
+	svc := NewServiceWithPDSFactory(repo, userSvc, factory)
+
+	session := testSession("did:plc:alice123")
+
+	result, err := svc.BlockUser(context.Background(), session, targetDID)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if resolveHandleCalled {
+		t.Fatal("ResolveHandleToDID should not be called for DID identifiers")
+	}
+	if result.RecordURI == "" {
+		t.Fatal("expected non-empty record URI")
+	}
+}
+
+func TestBlockUser_NilSession(t *testing.T) {
+	repo := &mockRepo{}
+	userSvc := &mockHandleResolver{}
+
+	factory := func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	}
+
+	svc := NewServiceWithPDSFactory(repo, userSvc, factory)
+
+	_, err := svc.BlockUser(context.Background(), nil, "did:plc:target")
+	if err == nil {
+		t.Fatal("expected error for nil session, got nil")
+	}
+}
+
+func TestGetBlockedUsers_DefaultPagination(t *testing.T) {
+	tests := []struct {
+		name          string
+		inputLimit    int
+		expectedLimit int
+	}{
+		{"zero limit defaults to 50", 0, 50},
+		{"negative limit defaults to 50", -1, 50},
+		{"over 100 capped to 100", 200, 100},
+		{"valid limit passes through", 25, 25},
+		{"exactly 100 passes through", 100, 100},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var capturedLimit int
+
+			repo := &mockRepo{
+				listBlockedFn: func(ctx context.Context, blockerDID string, limit, offset int) ([]*UserBlock, error) {
+					capturedLimit = limit
+					return nil, nil
+				},
+			}
+			userSvc := &mockHandleResolver{}
+
+			factory := func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+				return &mockPDSClient{}, nil
+			}
+
+			svc := NewServiceWithPDSFactory(repo, userSvc, factory)
+
+			_, err := svc.GetBlockedUsers(context.Background(), "did:plc:user123", tt.inputLimit, 0)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if capturedLimit != tt.expectedLimit {
+				t.Fatalf("expected limit %d, got %d", tt.expectedLimit, capturedLimit)
+			}
+		})
+	}
+}
+
+func TestIsBlocked_DelegatesToRepo(t *testing.T) {
+	blockerDID := "did:plc:alice"
+	blockedDID := "did:plc:bob"
+	isBlockedCalled := false
+
+	repo := &mockRepo{
+		isBlockedFn: func(ctx context.Context, blocker, blocked string) (bool, error) {
+			isBlockedCalled = true
+			if blocker != blockerDID {
+				t.Fatalf("expected blocker %s, got %s", blockerDID, blocker)
+			}
+			if blocked != blockedDID {
+				t.Fatalf("expected blocked %s, got %s", blockedDID, blocked)
+			}
+			return true, nil
+		},
+	}
+	userSvc := &mockHandleResolver{}
+
+	factory := func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	}
+
+	svc := NewServiceWithPDSFactory(repo, userSvc, factory)
+
+	blocked, err := svc.IsBlocked(context.Background(), blockerDID, blockedDID)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if !isBlockedCalled {
+		t.Fatal("expected repo.IsBlocked to be called")
+	}
+	if !blocked {
+		t.Fatal("expected blocked=true")
+	}
+}
+
+func TestUnblockUser_ExtractsRKeyAndDeletesFromPDS(t *testing.T) {
+	blockerDID := "did:plc:alice"
+	blockedDID := "did:plc:bob"
+	expectedRKey := "3lawvb5hii22f"
+	recordURI := "at://" + blockerDID + "/social.coves.actor.block/" + expectedRKey
+
+	var deletedCollection, deletedRKey string
+
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			return &UserBlock{
+				BlockerDID: blocker,
+				BlockedDID: blocked,
+				RecordURI:  recordURI,
+				RecordCID:  "bafyreicid",
+			}, nil
+		},
+	}
+	userSvc := &mockHandleResolver{}
+	pdsClient := &mockPDSClient{
+		deleteRecordFn: func(ctx context.Context, collection, rkey string) error {
+			deletedCollection = collection
+			deletedRKey = rkey
+			return nil
+		},
+	}
+
+	factory := func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	}
+
+	svc := NewServiceWithPDSFactory(repo, userSvc, factory)
+
+	session := testSession(blockerDID)
+
+	err := svc.UnblockUser(context.Background(), session, blockedDID)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if deletedCollection != "social.coves.actor.block" {
+		t.Fatalf("expected collection social.coves.actor.block, got %s", deletedCollection)
+	}
+	if deletedRKey != expectedRKey {
+		t.Fatalf("expected rkey %s, got %s", expectedRKey, deletedRKey)
+	}
+}
+
+func TestBlockUser_EmptyIdentifier(t *testing.T) {
+	svc := NewServiceWithPDSFactory(&mockRepo{}, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	session := testSession("did:plc:alice123")
+
+	_, err := svc.BlockUser(context.Background(), session, "")
+	if err == nil {
+		t.Fatal("expected error for empty identifier, got nil")
+	}
+	if !strings.Contains(err.Error(), "identifier is required") {
+		t.Fatalf("expected 'identifier is required' error, got: %v", err)
+	}
+}
+
+func TestBlockUser_WhitespaceIdentifier(t *testing.T) {
+	svc := NewServiceWithPDSFactory(&mockRepo{}, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	session := testSession("did:plc:alice123")
+
+	_, err := svc.BlockUser(context.Background(), session, "   ")
+	if err == nil {
+		t.Fatal("expected error for whitespace identifier, got nil")
+	}
+	if !strings.Contains(err.Error(), "identifier is required") {
+		t.Fatalf("expected 'identifier is required' error, got: %v", err)
+	}
+}
+
+func TestUnblockUser_EmptyIdentifier(t *testing.T) {
+	svc := NewServiceWithPDSFactory(&mockRepo{}, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	session := testSession("did:plc:alice123")
+
+	err := svc.UnblockUser(context.Background(), session, "")
+	if err == nil {
+		t.Fatal("expected error for empty identifier, got nil")
+	}
+	if !strings.Contains(err.Error(), "identifier is required") {
+		t.Fatalf("expected 'identifier is required' error, got: %v", err)
+	}
+}
+
+func TestBlockUser_InvalidDIDFormat(t *testing.T) {
+	svc := NewServiceWithPDSFactory(&mockRepo{}, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	session := testSession("did:plc:alice123")
+
+	// "did:" alone should fail DID validation
+	_, err := svc.BlockUser(context.Background(), session, "did:")
+	if err == nil {
+		t.Fatal("expected error for bare 'did:' identifier, got nil")
+	}
+
+	// "did:garbage" should fail DID validation
+	_, err = svc.BlockUser(context.Background(), session, "did:garbage")
+	if err == nil {
+		t.Fatal("expected error for malformed DID, got nil")
+	}
+}
+
+func TestGetBlockedUsers_NegativeOffsetClamped(t *testing.T) {
+	var capturedOffset int
+
+	repo := &mockRepo{
+		listBlockedFn: func(ctx context.Context, blockerDID string, limit, offset int) ([]*UserBlock, error) {
+			capturedOffset = offset
+			return nil, nil
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(repo, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	_, err := svc.GetBlockedUsers(context.Background(), "did:plc:user123", 50, -5)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if capturedOffset != 0 {
+		t.Fatalf("expected offset clamped to 0, got %d", capturedOffset)
+	}
+}
+
+func TestUnblockUser_BlockNotFound(t *testing.T) {
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			return nil, ErrBlockNotFound
+		},
+	}
+	userSvc := &mockHandleResolver{}
+
+	factory := func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	}
+
+	svc := NewServiceWithPDSFactory(repo, userSvc, factory)
+
+	session := testSession("did:plc:alice")
+
+	err := svc.UnblockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error for non-existent block")
+	}
+	if !errors.Is(err, ErrBlockNotFound) {
+		t.Fatalf("expected ErrBlockNotFound, got: %v", err)
+	}
+}
+
+// --- Critical: PDS conflict/idempotency tests (service.go lines 133-145) ---
+
+func TestBlockUser_PDSConflict_RepoHasBlock(t *testing.T) {
+	// When PDS returns conflict and the repo already has the block,
+	// service should return the existing block result (no error).
+	existingURI := "at://did:plc:alice/social.coves.actor.block/existing123"
+	existingCID := "bafyexisting"
+
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			return &UserBlock{
+				BlockerDID: blocker,
+				BlockedDID: blocked,
+				RecordURI:  existingURI,
+				RecordCID:  existingCID,
+			}, nil
+		},
+	}
+	pdsClient := &mockPDSClient{
+		createRecordFn: func(ctx context.Context, collection, rkey string, record any) (string, string, error) {
+			return "", "", pds.ErrConflict
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(repo, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	})
+
+	session := testSession("did:plc:alice")
+	result, err := svc.BlockUser(context.Background(), session, "did:plc:bob")
+	if err != nil {
+		t.Fatalf("expected no error for idempotent block, got: %v", err)
+	}
+	if result.RecordURI != existingURI {
+		t.Errorf("expected RecordURI=%s, got %s", existingURI, result.RecordURI)
+	}
+	if result.RecordCID != existingCID {
+		t.Errorf("expected RecordCID=%s, got %s", existingCID, result.RecordCID)
+	}
+}
+
+func TestBlockUser_PDSConflict_RepoNotFound(t *testing.T) {
+	// When PDS returns conflict but the repo doesn't have the block,
+	// service should return ErrBlockAlreadyExists.
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			return nil, ErrBlockNotFound
+		},
+	}
+	pdsClient := &mockPDSClient{
+		createRecordFn: func(ctx context.Context, collection, rkey string, record any) (string, string, error) {
+			return "", "", pds.ErrConflict
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(repo, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	})
+
+	session := testSession("did:plc:alice")
+	_, err := svc.BlockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error when PDS conflict and repo has no block")
+	}
+	if !errors.Is(err, ErrBlockAlreadyExists) {
+		t.Fatalf("expected ErrBlockAlreadyExists, got: %v", err)
+	}
+}
+
+func TestBlockUser_PDSConflict_RepoError(t *testing.T) {
+	// When PDS returns conflict and the repo returns a non-NotFound error,
+	// service should wrap and return that error.
+	repoErr := errors.New("database connection lost")
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			return nil, repoErr
+		},
+	}
+	pdsClient := &mockPDSClient{
+		createRecordFn: func(ctx context.Context, collection, rkey string, record any) (string, string, error) {
+			return "", "", pds.ErrConflict
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(repo, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	})
+
+	session := testSession("did:plc:alice")
+	_, err := svc.BlockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error when repo fails during conflict handling")
+	}
+	if !errors.Is(err, repoErr) {
+		t.Fatalf("expected wrapped repo error, got: %v", err)
+	}
+	if !strings.Contains(err.Error(), "PDS reported duplicate block") {
+		t.Fatalf("expected error message to mention PDS duplicate, got: %v", err)
+	}
+}
+
+// --- Important: Auth error tests ---
+
+func TestBlockUser_PDSAuthError(t *testing.T) {
+	pdsClient := &mockPDSClient{
+		createRecordFn: func(ctx context.Context, collection, rkey string, record any) (string, string, error) {
+			return "", "", pds.ErrUnauthorized
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(&mockRepo{}, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	})
+
+	session := testSession("did:plc:alice")
+	_, err := svc.BlockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error for auth failure")
+	}
+	if !strings.Contains(err.Error(), "unauthorized") {
+		t.Fatalf("expected unauthorized error, got: %v", err)
+	}
+	if !errors.Is(err, pds.ErrUnauthorized) {
+		t.Fatalf("expected wrapped ErrUnauthorized, got: %v", err)
+	}
+}
+
+func TestUnblockUser_PDSAuthError(t *testing.T) {
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			return &UserBlock{
+				BlockerDID: blocker,
+				BlockedDID: blocked,
+				RecordURI:  "at://did:plc:alice/social.coves.actor.block/rkey123",
+				RecordCID:  "bafycid",
+			}, nil
+		},
+	}
+	pdsClient := &mockPDSClient{
+		deleteRecordFn: func(ctx context.Context, collection, rkey string) error {
+			return pds.ErrUnauthorized
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(repo, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	})
+
+	session := testSession("did:plc:alice")
+	err := svc.UnblockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error for auth failure on unblock")
+	}
+	if !strings.Contains(err.Error(), "unauthorized") {
+		t.Fatalf("expected unauthorized error, got: %v", err)
+	}
+	if !errors.Is(err, pds.ErrUnauthorized) {
+		t.Fatalf("expected wrapped ErrUnauthorized, got: %v", err)
+	}
+}
+
+// --- Important: UnblockUser nil session ---
+
+func TestUnblockUser_NilSession(t *testing.T) {
+	svc := NewServiceWithPDSFactory(&mockRepo{}, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	err := svc.UnblockUser(context.Background(), nil, "did:plc:target")
+	if err == nil {
+		t.Fatal("expected error for nil session, got nil")
+	}
+	if !strings.Contains(err.Error(), "session is required") {
+		t.Fatalf("expected 'session is required' error, got: %v", err)
+	}
+}
+
+// --- Important: UnblockUser invalid record URI (empty rkey) ---
+
+func TestUnblockUser_InvalidRecordURI(t *testing.T) {
+	// When the stored block has a malformed URI that yields an empty rkey,
+	// service should return an error instead of sending an empty rkey to PDS.
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			return &UserBlock{
+				BlockerDID: blocker,
+				BlockedDID: blocked,
+				RecordURI:  "at://bad", // too few segments → ExtractRKeyFromURI returns ""
+				RecordCID:  "bafycid",
+			}, nil
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(repo, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	session := testSession("did:plc:alice")
+	err := svc.UnblockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error for invalid record URI")
+	}
+	if !strings.Contains(err.Error(), "invalid block record URI") {
+		t.Fatalf("expected 'invalid block record URI' error, got: %v", err)
+	}
+}
+
+// --- Moderate: Handle resolution failure ---
+
+func TestBlockUser_HandleResolutionFailure(t *testing.T) {
+	resolver := &mockHandleResolver{
+		resolveHandleToDIDFn: func(ctx context.Context, handle string) (string, error) {
+			return "", errors.New("handle not found")
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(&mockRepo{}, resolver, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	session := testSession("did:plc:alice")
+	_, err := svc.BlockUser(context.Background(), session, "nonexistent.bsky.social")
+	if err == nil {
+		t.Fatal("expected error for handle resolution failure")
+	}
+	if !strings.Contains(err.Error(), "handle not found") {
+		t.Fatalf("expected handle resolution error, got: %v", err)
+	}
+}
+
+// --- Moderate: PDS client factory error ---
+
+func TestBlockUser_PDSClientFactoryError(t *testing.T) {
+	svc := NewServiceWithPDSFactory(&mockRepo{}, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return nil, errors.New("failed to create PDS client")
+	})
+
+	session := testSession("did:plc:alice")
+	_, err := svc.BlockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error for PDS client factory failure")
+	}
+	if !strings.Contains(err.Error(), "failed to create PDS client") {
+		t.Fatalf("expected PDS client factory error, got: %v", err)
+	}
+}
+
+// --- Moderate: Generic PDS errors (non-auth, non-conflict) ---
+
+func TestBlockUser_GenericPDSError(t *testing.T) {
+	pdsClient := &mockPDSClient{
+		createRecordFn: func(ctx context.Context, collection, rkey string, record any) (string, string, error) {
+			return "", "", pds.ErrRateLimited
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(&mockRepo{}, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	})
+
+	session := testSession("did:plc:alice")
+	_, err := svc.BlockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error for generic PDS failure")
+	}
+	if !strings.Contains(err.Error(), "failed to create block on PDS") {
+		t.Fatalf("expected 'failed to create block on PDS' error, got: %v", err)
+	}
+	if !errors.Is(err, pds.ErrRateLimited) {
+		t.Fatalf("expected wrapped ErrRateLimited, got: %v", err)
+	}
+}
+
+func TestUnblockUser_GenericPDSError(t *testing.T) {
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			return &UserBlock{
+				BlockerDID: blocker,
+				BlockedDID: blocked,
+				RecordURI:  "at://did:plc:alice/social.coves.actor.block/rkey123",
+				RecordCID:  "bafycid",
+			}, nil
+		},
+	}
+	pdsClient := &mockPDSClient{
+		deleteRecordFn: func(ctx context.Context, collection, rkey string) error {
+			return pds.ErrRateLimited
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(repo, &mockHandleResolver{}, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	})
+
+	session := testSession("did:plc:alice")
+	err := svc.UnblockUser(context.Background(), session, "did:plc:bob")
+	if err == nil {
+		t.Fatal("expected error for generic PDS failure on unblock")
+	}
+	if !strings.Contains(err.Error(), "failed to delete block on PDS") {
+		t.Fatalf("expected 'failed to delete block on PDS' error, got: %v", err)
+	}
+	if !errors.Is(err, pds.ErrRateLimited) {
+		t.Fatalf("expected wrapped ErrRateLimited, got: %v", err)
+	}
+}
+
+// --- Moderate: UnblockUser handle resolution ---
+
+func TestUnblockUser_ResolvesHandleToDID(t *testing.T) {
+	resolvedDID := "did:plc:bobresolved"
+	var deletedRKey string
+
+	resolver := &mockHandleResolver{
+		resolveHandleToDIDFn: func(ctx context.Context, handle string) (string, error) {
+			if handle != "bob.bsky.social" {
+				t.Fatalf("expected handle bob.bsky.social, got %s", handle)
+			}
+			return resolvedDID, nil
+		},
+	}
+	repo := &mockRepo{
+		getBlockFn: func(ctx context.Context, blocker, blocked string) (*UserBlock, error) {
+			if blocked != resolvedDID {
+				t.Fatalf("expected resolved DID %s in repo lookup, got %s", resolvedDID, blocked)
+			}
+			return &UserBlock{
+				BlockerDID: blocker,
+				BlockedDID: blocked,
+				RecordURI:  "at://did:plc:alice/social.coves.actor.block/rkey456",
+				RecordCID:  "bafycid456",
+			}, nil
+		},
+	}
+	pdsClient := &mockPDSClient{
+		deleteRecordFn: func(ctx context.Context, collection, rkey string) error {
+			deletedRKey = rkey
+			return nil
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(repo, resolver, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return pdsClient, nil
+	})
+
+	session := testSession("did:plc:alice")
+	err := svc.UnblockUser(context.Background(), session, "bob.bsky.social")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if deletedRKey != "rkey456" {
+		t.Fatalf("expected rkey=rkey456, got %s", deletedRKey)
+	}
+}
+
+func TestUnblockUser_HandleResolutionFailure(t *testing.T) {
+	resolver := &mockHandleResolver{
+		resolveHandleToDIDFn: func(ctx context.Context, handle string) (string, error) {
+			return "", errors.New("handle not found")
+		},
+	}
+
+	svc := NewServiceWithPDSFactory(&mockRepo{}, resolver, func(ctx context.Context, session *oauth.ClientSessionData) (pds.Client, error) {
+		return &mockPDSClient{}, nil
+	})
+
+	session := testSession("did:plc:alice")
+	err := svc.UnblockUser(context.Background(), session, "nonexistent.bsky.social")
+	if err == nil {
+		t.Fatal("expected error for handle resolution failure on unblock")
+	}
+	if !strings.Contains(err.Error(), "handle not found") {
+		t.Fatalf("expected handle resolution error, got: %v", err)
+	}
+}

internal/core/userblocks/userblock.go

···
+package userblocks
+
+import "time"
+
+// UserBlock represents a one-directional block relationship between two users.
+// The block record lives in the blocker's PDS repository at:
+// at://blocker_did/social.coves.actor.block/{tid}
+//
+// One-directional: Only the blocker's feeds/comments are filtered.
+// The blocked user is unaffected and unaware.
+type UserBlock struct {
+	ID         int       `json:"id" db:"id"`
+	BlockerDID string    `json:"blockerDid" db:"blocker_did"`
+	BlockedDID string    `json:"blockedDid" db:"blocked_did"`
+	BlockedAt  time.Time `json:"blockedAt" db:"blocked_at"`
+	RecordURI  string    `json:"recordUri" db:"record_uri"`
+	RecordCID  string    `json:"recordCid" db:"record_cid"`
+}
+
+// BlockResult is returned by BlockUser after a successful PDS write-forward.
+// Contains only the record URI and CID from PDS. The full UserBlock will be
+// indexed asynchronously via the firehose consumer.
+type BlockResult struct {
+	RecordURI string `json:"recordUri"`
+	RecordCID string `json:"recordCid"`
+}

internal/core/users/interfaces.go

···
 	//   3. community_subscriptions (explicit DELETE)
 	//   4. community_memberships (explicit DELETE)
 	//   5. community_blocks (explicit DELETE)
-	//   6. comments (explicit DELETE)
-	//   7. votes (explicit DELETE - FK removed in migration 014)
-	//   8. users (FK CASCADE deletes posts)
+	//   6. user_blocks (explicit DELETE - both directions)
+	//   7. comments (explicit DELETE)
+	//   8. votes (explicit DELETE - FK removed in migration 014)
+	//   9. users (FK CASCADE deletes posts)
 	//
 	// Returns ErrUserNotFound if the user does not exist.
 	// Returns InvalidDIDError if the DID format is invalid.

internal/core/users/user.go

···
 	DisplayName string        `json:"displayName,omitempty"`
 	// Bio is the user's biography/description. Maps to JSON "description" for atProto lexicon compatibility.
 	Bio    string `json:"description,omitempty"`
-	Avatar string `json:"avatar,omitempty"` // URL, not CID
-	Banner string `json:"banner,omitempty"` // URL, not CID
-	// Viewer (requires user-to-user blocking infrastructure)
+	Avatar string              `json:"avatar,omitempty"` // URL, not CID
+	Banner string              `json:"banner,omitempty"` // URL, not CID
+	Viewer *ProfileViewerState `json:"viewer,omitempty"`
+}
+
+// ProfileViewerState contains the authenticated viewer's relationship to this profile.
+// Populated when the request is authenticated; nil for unauthenticated requests.
+type ProfileViewerState struct {
+	// Blocking is the AT-URI of the block record if the viewer has blocked this user.
+	// nil if the viewer has not blocked this user.
+	Blocking *string `json:"blocking,omitempty"`
 }

internal/db/migrations/029_create_user_blocks_table.sql

···
+-- +goose Up
+CREATE TABLE user_blocks (
+    id SERIAL PRIMARY KEY,
+    blocker_did TEXT NOT NULL CHECK (blocker_did ~ '^did:(plc|web):[a-zA-Z0-9._:%-]+$'),
+    blocked_did TEXT NOT NULL CHECK (blocked_did ~ '^did:(plc|web):[a-zA-Z0-9._:%-]+$'),
+    blocked_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    -- AT-Proto metadata (block record lives in blocker's repo)
+    -- These are required for atProto record verification and federation
+    record_uri TEXT NOT NULL,  -- atProto record identifier (at://blocker_did/social.coves.actor.block/rkey)
+    record_cid TEXT NOT NULL,  -- Content address (critical for verification)
+
+    UNIQUE(blocker_did, blocked_did)
+);
+
+-- Indexes for efficient queries
+-- Note: UNIQUE constraint on (blocker_did, blocked_did) already covers blocker_did as leading column
+CREATE INDEX idx_user_blocks_blocked ON user_blocks(blocked_did);
+CREATE UNIQUE INDEX idx_user_blocks_record_uri ON user_blocks(record_uri);  -- For GetBlockByURI (Jetstream DELETE operations)
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_user_blocks_record_uri;
+DROP INDEX IF EXISTS idx_user_blocks_blocked;
+DROP TABLE IF EXISTS user_blocks;

internal/db/postgres/comment_repo.go

···
 	timeframe string,
 	limit int,
 	cursor *string,
+	viewerDID string,
 ) ([]*comments.Comment, *string, error) {
 	// Build ORDER BY clause and time filter based on sort type
 	orderBy, timeFilter := r.buildCommentSortClause(sort, timeframe)
···
 		FROM comments c`
 	}
 
+	// Build optional viewer block filter (only when authenticated viewer is present)
+	var viewerFilter string
+	var viewerArgs []interface{}
+	if viewerDID != "" {
+		viewerParamIdx := 3 + len(cursorValues)
+		viewerFilter = fmt.Sprintf("AND NOT EXISTS (SELECT 1 FROM user_blocks WHERE blocker_did = $%d AND blocked_did = c.commenter_did)", viewerParamIdx)
+		viewerArgs = append(viewerArgs, viewerDID)
+	}
+
 	// Build complete query with JOINs and filters
 	// LEFT JOIN prevents data loss when user record hasn't been indexed yet (out-of-order Jetstream events)
 	// Includes deleted comments to preserve thread structure (shown as "[deleted]" placeholders)
···
 		%s
 		LEFT JOIN users u ON c.commenter_did = u.did
 		WHERE c.parent_uri = $1
+			%s
 			%s
 			%s
 		ORDER BY %s
 		LIMIT $2
-	`, selectClause, timeFilter, cursorFilter, orderBy)
+	`, selectClause, timeFilter, cursorFilter, viewerFilter, orderBy)
 
 	// Prepare query arguments
 	args := []interface{}{parentURI, limit + 1} // +1 to detect next page
 	args = append(args, cursorValues...)
+	args = append(args, viewerArgs...)
 
 	// Execute query
 	rows, err := r.db.QueryContext(ctx, query, args...)
···
 	parentURIs []string,
 	sort string,
 	limitPerParent int,
+	viewerDID string,
 ) (map[string][]*comments.Comment, error) {
 	if len(parentURIs) == 0 {
 		return make(map[string][]*comments.Comment), nil
···
 		windowOrderBy = `log(greatest(2, c.score + 2)) / power(((EXTRACT(EPOCH FROM (NOW() - c.created_at)) / 3600) + 2), 1.8) DESC, c.score DESC, c.created_at DESC`
 	}
 
+	// Build optional viewer block filter (only when authenticated viewer is present)
+	// Parameter index computed dynamically: $1=parentURIs, $2=limitPerParent, $3+=viewer
+	var viewerFilter string
+	var viewerArgs []interface{}
+	if viewerDID != "" {
+		viewerParamIdx := 3 // after $1=parentURIs and $2=limitPerParent
+		viewerFilter = fmt.Sprintf("AND NOT EXISTS (SELECT 1 FROM user_blocks WHERE blocker_did = $%d AND blocked_did = c.commenter_did)", viewerParamIdx)
+		viewerArgs = append(viewerArgs, viewerDID)
+	}
+
 	// Use window function to limit results per parent
 	// This is more efficient than LIMIT in a subquery per parent
 	// LEFT JOIN prevents data loss when user record hasn't been indexed yet (out-of-order Jetstream events)
···
 			FROM comments c
 			LEFT JOIN users u ON c.commenter_did = u.did
 			WHERE c.parent_uri = ANY($1)
+				%s
 		)
 		SELECT
 			id, uri, cid, rkey, commenter_did,
···
 		FROM ranked_comments
 		WHERE rn <= $2
 		ORDER BY parent_uri, rn
-	`, selectClause, windowOrderBy)
+	`, selectClause, windowOrderBy, viewerFilter)
 
-	rows, err := r.db.QueryContext(ctx, query, pq.Array(parentURIs), limitPerParent)
+	queryArgs := []interface{}{pq.Array(parentURIs), limitPerParent}
+	queryArgs = append(queryArgs, viewerArgs...)
+	rows, err := r.db.QueryContext(ctx, query, queryArgs...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to batch query comments by parents: %w", err)
 	}

internal/db/postgres/discover_repo.go

···
 		FROM posts p`
 	}
 
+	// Build optional viewer block filter (only when authenticated viewer is present)
+	var viewerFilter string
+	var viewerArgs []interface{}
+	if req.ViewerDID != "" {
+		viewerParamIdx := 2 + len(cursorValues)
+		viewerFilter = fmt.Sprintf("AND NOT EXISTS (SELECT 1 FROM user_blocks WHERE blocker_did = $%d AND blocked_did = p.author_did)", viewerParamIdx)
+		viewerArgs = append(viewerArgs, req.ViewerDID)
+	}
+
 	// No subscription filter - show ALL posts from ALL communities
 	query := fmt.Sprintf(`
 		%s
 		INNER JOIN users u ON p.author_did = u.did
 		INNER JOIN communities c ON p.community_did = c.did
 		WHERE p.deleted_at IS NULL
+			%s
 			%s
 			%s
 		ORDER BY %s
 		LIMIT $1
-	`, selectClause, timeFilter, cursorFilter, orderBy)
+	`, selectClause, timeFilter, cursorFilter, viewerFilter, orderBy)
 
 	// Prepare query arguments
 	args := []interface{}{req.Limit + 1} // +1 to check for next page
 	args = append(args, cursorValues...)
+	args = append(args, viewerArgs...)
 
 	// Execute query
 	rows, err := r.db.QueryContext(ctx, query, args...)

internal/db/postgres/feed_repo.go

···
 		FROM posts p`
 	}
 
+	// Build optional viewer block filter (only when authenticated viewer is present)
+	var viewerFilter string
+	var viewerArgs []interface{}
+	if req.ViewerDID != "" {
+		viewerParamIdx := 3 + len(cursorValues)
+		viewerFilter = fmt.Sprintf("AND NOT EXISTS (SELECT 1 FROM user_blocks WHERE blocker_did = $%d AND blocked_did = p.author_did)", viewerParamIdx)
+		viewerArgs = append(viewerArgs, req.ViewerDID)
+	}
+
 	query := fmt.Sprintf(`
 		%s
 		INNER JOIN users u ON p.author_did = u.did
 		INNER JOIN communities c ON p.community_did = c.did
 		WHERE p.community_did = $1
 			AND p.deleted_at IS NULL
+			%s
 			%s
 			%s
 		ORDER BY %s
 		LIMIT $2
-	`, selectClause, timeFilter, cursorFilter, orderBy)
+	`, selectClause, timeFilter, cursorFilter, viewerFilter, orderBy)
 
 	// Prepare query arguments
 	args := []interface{}{req.Community, req.Limit + 1} // +1 to check for next page
 	args = append(args, cursorValues...)
+	args = append(args, viewerArgs...)
 
 	// Execute query
 	rows, err := r.db.QueryContext(ctx, query, args...)

internal/db/postgres/timeline_repo.go

···
 		INNER JOIN community_subscriptions cs ON p.community_did = cs.community_did
 		WHERE cs.user_did = $1
 			AND p.deleted_at IS NULL
+			-- Intentional $1 reuse: the viewer's DID (cs.user_did) is also the blocker for block filtering
+			AND NOT EXISTS (SELECT 1 FROM user_blocks WHERE blocker_did = $1 AND blocked_did = p.author_did)
 			%s
 			%s
 		ORDER BY %s

internal/db/postgres/user_repo.go

···
 		return fmt.Errorf("failed to delete community_blocks for did=%s: %w", did, err)
 	}
 
-	// 6. Delete comments (explicit DELETE)
+	// 6. Delete user blocks (both directions - blocks they created AND blocks against them)
+	if _, err := tx.ExecContext(ctx, `DELETE FROM user_blocks WHERE blocker_did = $1 OR blocked_did = $1`, did); err != nil {
+		return fmt.Errorf("failed to delete user_blocks for did=%s: %w", did, err)
+	}
+
+	// 7. Delete comments (explicit DELETE)
 	if _, err := tx.ExecContext(ctx, `DELETE FROM comments WHERE commenter_did = $1`, did); err != nil {
 		return fmt.Errorf("failed to delete comments for did=%s: %w", did, err)
 	}
 
-	// 7. Delete votes (explicit DELETE - FK constraint removed in migration 014)
+	// 8. Delete votes (explicit DELETE - FK constraint removed in migration 014)
 	if _, err := tx.ExecContext(ctx, `DELETE FROM votes WHERE voter_did = $1`, did); err != nil {
 		return fmt.Errorf("failed to delete votes for did=%s: %w", did, err)
 	}
 
-	// 8. Delete user (FK CASCADE deletes posts)
+	// 9. Delete user (FK CASCADE deletes posts)
 	result, err := tx.ExecContext(ctx, `DELETE FROM users WHERE did = $1`, did)
 	if err != nil {
 		return fmt.Errorf("failed to delete user did=%s: %w", did, err)

internal/db/postgres/userblock_repo.go

···
+package postgres
+
+import (
+	"Coves/internal/core/userblocks"
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"log"
+
+	"github.com/lib/pq"
+)
+
+// postgresUserBlockRepo implements userblocks.Repository using PostgreSQL
+type postgresUserBlockRepo struct {
+	db *sql.DB
+}
+
+// NewUserBlockRepository creates a new PostgreSQL-backed user block repository
+func NewUserBlockRepository(db *sql.DB) userblocks.Repository {
+	return &postgresUserBlockRepo{db: db}
+}
+
+// BlockUser creates a new block record (idempotent via ON CONFLICT DO UPDATE)
+func (r *postgresUserBlockRepo) BlockUser(ctx context.Context, block *userblocks.UserBlock) (*userblocks.UserBlock, error) {
+	query := `
+		INSERT INTO user_blocks (blocker_did, blocked_did, blocked_at, record_uri, record_cid)
+		VALUES ($1, $2, $3, $4, $5)
+		ON CONFLICT (blocker_did, blocked_did) DO UPDATE SET
+			record_uri = EXCLUDED.record_uri,
+			record_cid = EXCLUDED.record_cid,
+			blocked_at = EXCLUDED.blocked_at
+		RETURNING id, blocked_at`
+
+	err := r.db.QueryRowContext(ctx, query,
+		block.BlockerDID,
+		block.BlockedDID,
+		block.BlockedAt,
+		block.RecordURI,
+		block.RecordCID,
+	).Scan(&block.ID, &block.BlockedAt)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create user block: %w", err)
+	}
+
+	return block, nil
+}
+
+// UnblockUser removes a block record. Returns ErrBlockNotFound if not exists.
+func (r *postgresUserBlockRepo) UnblockUser(ctx context.Context, blockerDID, blockedDID string) error {
+	query := `DELETE FROM user_blocks WHERE blocker_did = $1 AND blocked_did = $2`
+
+	result, err := r.db.ExecContext(ctx, query, blockerDID, blockedDID)
+	if err != nil {
+		return fmt.Errorf("failed to unblock user: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to check unblock result: %w", err)
+	}
+
+	if rowsAffected == 0 {
+		return userblocks.ErrBlockNotFound
+	}
+
+	return nil
+}
+
+// GetBlock retrieves a block by blocker + blocked DID pair.
+func (r *postgresUserBlockRepo) GetBlock(ctx context.Context, blockerDID, blockedDID string) (*userblocks.UserBlock, error) {
+	query := `
+		SELECT id, blocker_did, blocked_did, blocked_at, record_uri, record_cid
+		FROM user_blocks
+		WHERE blocker_did = $1 AND blocked_did = $2`
+
+	var block userblocks.UserBlock
+
+	err := r.db.QueryRowContext(ctx, query, blockerDID, blockedDID).Scan(
+		&block.ID,
+		&block.BlockerDID,
+		&block.BlockedDID,
+		&block.BlockedAt,
+		&block.RecordURI,
+		&block.RecordCID,
+	)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, userblocks.ErrBlockNotFound
+		}
+		return nil, fmt.Errorf("failed to get user block: %w", err)
+	}
+
+	return &block, nil
+}
+
+// GetBlockByURI retrieves a block by its AT-URI (for Jetstream DELETE operations).
+func (r *postgresUserBlockRepo) GetBlockByURI(ctx context.Context, recordURI string) (*userblocks.UserBlock, error) {
+	query := `
+		SELECT id, blocker_did, blocked_did, blocked_at, record_uri, record_cid
+		FROM user_blocks
+		WHERE record_uri = $1`
+
+	var block userblocks.UserBlock
+
+	err := r.db.QueryRowContext(ctx, query, recordURI).Scan(
+		&block.ID,
+		&block.BlockerDID,
+		&block.BlockedDID,
+		&block.BlockedAt,
+		&block.RecordURI,
+		&block.RecordCID,
+	)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, userblocks.ErrBlockNotFound
+		}
+		return nil, fmt.Errorf("failed to get user block by URI: %w", err)
+	}
+
+	return &block, nil
+}
+
+// ListBlockedUsers retrieves all users blocked by the given blocker, paginated.
+// Results are ordered by blocked_at DESC.
+func (r *postgresUserBlockRepo) ListBlockedUsers(ctx context.Context, blockerDID string, limit, offset int) ([]*userblocks.UserBlock, error) {
+	query := `
+		SELECT id, blocker_did, blocked_did, blocked_at, record_uri, record_cid
+		FROM user_blocks
+		WHERE blocker_did = $1
+		ORDER BY blocked_at DESC
+		LIMIT $2 OFFSET $3`
+
+	rows, err := r.db.QueryContext(ctx, query, blockerDID, limit, offset)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list blocked users: %w", err)
+	}
+	defer func() {
+		if closeErr := rows.Close(); closeErr != nil {
+			log.Printf("Failed to close rows: %v", closeErr)
+		}
+	}()
+
+	var blocks []*userblocks.UserBlock
+	for rows.Next() {
+		block := &userblocks.UserBlock{}
+
+		err = rows.Scan(
+			&block.ID,
+			&block.BlockerDID,
+			&block.BlockedDID,
+			&block.BlockedAt,
+			&block.RecordURI,
+			&block.RecordCID,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to scan user block: %w", err)
+		}
+
+		blocks = append(blocks, block)
+	}
+
+	if err = rows.Err(); err != nil {
+		return nil, fmt.Errorf("error iterating user blocks: %w", err)
+	}
+
+	return blocks, nil
+}
+
+// IsBlocked checks if blockerDID has blocked blockedDID (fast EXISTS check).
+func (r *postgresUserBlockRepo) IsBlocked(ctx context.Context, blockerDID, blockedDID string) (bool, error) {
+	query := `
+		SELECT EXISTS(
+			SELECT 1 FROM user_blocks
+			WHERE blocker_did = $1 AND blocked_did = $2
+		)`
+
+	var exists bool
+	err := r.db.QueryRowContext(ctx, query, blockerDID, blockedDID).Scan(&exists)
+	if err != nil {
+		return false, fmt.Errorf("failed to check if user is blocked: %w", err)
+	}
+
+	return exists, nil
+}
+
+// AreBlocked checks which of the given DIDs are blocked by blockerDID.
+// Returns a map of blockedDID -> true for each DID that is blocked.
+func (r *postgresUserBlockRepo) AreBlocked(ctx context.Context, blockerDID string, blockedDIDs []string) (map[string]bool, error) {
+	result := make(map[string]bool)
+
+	if len(blockedDIDs) == 0 {
+		return result, nil
+	}
+
+	query := `
+		SELECT blocked_did
+		FROM user_blocks
+		WHERE blocker_did = $1 AND blocked_did = ANY($2)`
+
+	rows, err := r.db.QueryContext(ctx, query, blockerDID, pq.Array(blockedDIDs))
+	if err != nil {
+		return nil, fmt.Errorf("failed to batch check blocked users: %w", err)
+	}
+	defer func() {
+		if closeErr := rows.Close(); closeErr != nil {
+			log.Printf("Failed to close rows: %v", closeErr)
+		}
+	}()
+
+	for rows.Next() {
+		var blockedDID string
+		if err = rows.Scan(&blockedDID); err != nil {
+			return nil, fmt.Errorf("failed to scan blocked DID: %w", err)
+		}
+		result[blockedDID] = true
+	}
+
+	if err = rows.Err(); err != nil {
+		return nil, fmt.Errorf("error iterating blocked DIDs: %w", err)
+	}
+
+	return result, nil
+}

tests/integration/helpers.go

···
 	"Coves/internal/atproto/oauth"
 	"Coves/internal/atproto/pds"
 	"Coves/internal/core/communities"
+	"Coves/internal/core/userblocks"
 	"Coves/internal/core/users"
 	"Coves/internal/core/votes"
 	"bytes"
···
 	"net/http"
 	"os"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
···
 	return user
 }
 
-// contains checks if string s contains substring substr
-// Helper for error message assertions
+// contains checks if string s contains substring substr.
+// Convenience wrapper used across multiple integration test files.
 func contains(s, substr string) bool {
 	return strings.Contains(s, substr)
 }
···
 	return sessionResp.AccessJwt, sessionResp.DID, nil
 }
 
-// tidCounter is used to ensure unique TIDs even when generateTID is called rapidly
-var tidCounter uint64
+// tidCounter is used to ensure unique TIDs even when generateTID is called rapidly.
+var tidCounter atomic.Uint64
 
-// testIDCounter is used to ensure unique test identifiers across all tests
-var testIDCounter uint64
+// testIDCounter is used to ensure unique test identifiers across all tests.
+var testIDCounter atomic.Uint64
 
-// generateTID generates a simple timestamp-based identifier for testing
-// In production, PDS generates proper TIDs
-// Uses an atomic counter to ensure uniqueness even when called in rapid succession
+// generateTID generates a simple timestamp-based identifier for testing.
+// In production, PDS generates proper TIDs.
 func generateTID() string {
-	tidCounter++
-	return fmt.Sprintf("3k%d%d", time.Now().UnixNano()/1000, tidCounter)
+	n := tidCounter.Add(1)
+	return fmt.Sprintf("3k%d%d", time.Now().UnixNano()/1000, n)
 }
 
-// uniqueTestID generates a unique identifier for test resources (handles, emails, etc.)
-// Uses Unix timestamp (seconds) + atomic counter to ensure uniqueness across test runs
-// Keeps IDs short enough to fit within PDS handle limits (max 20 chars for label)
-// Returns a ~14 char string (10-digit timestamp + up to 4-digit counter)
+// uniqueTestID generates a unique identifier for test resources (handles, emails, etc.).
+// Uses Unix timestamp (seconds) + atomic counter to ensure uniqueness across test runs.
+// Keeps IDs short enough to fit within PDS handle limits (max 20 chars for label).
 func uniqueTestID() string {
-	testIDCounter++
-	return fmt.Sprintf("%d%d", time.Now().Unix(), testIDCounter)
+	n := testIDCounter.Add(1)
+	return fmt.Sprintf("%d%d", time.Now().Unix(), n)
 }
 
 // createPDSAccount creates a new account on PDS and returns access token + DID
···
 	return token
 }
 
-// PasswordAuthPDSClientFactory creates a PDSClientFactory that uses password-based Bearer auth.
-// This is for E2E tests that use createSession instead of OAuth.
-// The factory extracts the access token and host URL from the session data.
-func PasswordAuthPDSClientFactory() votes.PDSClientFactory {
-	return func(ctx context.Context, session *oauthlib.ClientSessionData) (pds.Client, error) {
-		if session.AccessToken == "" {
-			return nil, fmt.Errorf("session has no access token")
-		}
-		if session.HostURL == "" {
-			return nil, fmt.Errorf("session has no host URL")
-		}
-
-		return pds.NewFromAccessToken(session.HostURL, session.AccountDID.String(), session.AccessToken)
+// passwordAuthPDSClient is the shared implementation for all test PDS client factories.
+// Creates PDS clients using password-based Bearer auth from the session's access token.
+func passwordAuthPDSClient(_ context.Context, session *oauthlib.ClientSessionData) (pds.Client, error) {
+	if session.AccessToken == "" {
+		return nil, fmt.Errorf("session has no access token")
 	}
+	if session.HostURL == "" {
+		return nil, fmt.Errorf("session has no host URL")
+	}
+	return pds.NewFromAccessToken(session.HostURL, session.AccountDID.String(), session.AccessToken)
 }
 
-// CommunityPasswordAuthPDSClientFactory creates a PDSClientFactory for communities that uses password-based Bearer auth.
-// This is for E2E tests that use createSession instead of OAuth.
-// The factory extracts the access token and host URL from the session data.
+// PasswordAuthPDSClientFactory creates a PDSClientFactory for votes E2E tests.
+func PasswordAuthPDSClientFactory() votes.PDSClientFactory {
+	return passwordAuthPDSClient
+}
+
+// CommunityPasswordAuthPDSClientFactory creates a PDSClientFactory for community E2E tests.
 func CommunityPasswordAuthPDSClientFactory() communities.PDSClientFactory {
-	return func(ctx context.Context, session *oauthlib.ClientSessionData) (pds.Client, error) {
-		if session.AccessToken == "" {
-			return nil, fmt.Errorf("session has no access token")
-		}
-		if session.HostURL == "" {
-			return nil, fmt.Errorf("session has no host URL")
-		}
+	return passwordAuthPDSClient
+}
 
-		return pds.NewFromAccessToken(session.HostURL, session.AccountDID.String(), session.AccessToken)
-	}
+// UserBlockPasswordAuthPDSClientFactory creates a PDSClientFactory for user block E2E tests.
+func UserBlockPasswordAuthPDSClientFactory() userblocks.PDSClientFactory {
+	return passwordAuthPDSClient
 }
 
-// UserProfilePasswordAuthPDSClientFactory creates a PDSClientFactory for user profile updates
-// that uses password-based Bearer auth. This is for E2E tests that use createSession instead of OAuth.
-// The factory extracts the access token and host URL from the session data.
+// UserProfilePasswordAuthPDSClientFactory creates a PDSClientFactory for user profile E2E tests.
 func UserProfilePasswordAuthPDSClientFactory() func(ctx context.Context, session *oauthlib.ClientSessionData) (pds.Client, error) {
-	return func(ctx context.Context, session *oauthlib.ClientSessionData) (pds.Client, error) {
-		if session.AccessToken == "" {
-			return nil, fmt.Errorf("session has no access token")
-		}
-		if session.HostURL == "" {
-			return nil, fmt.Errorf("session has no host URL")
-		}
-
-		return pds.NewFromAccessToken(session.HostURL, session.AccountDID.String(), session.AccessToken)
-	}
+	return passwordAuthPDSClient
 }

tests/integration/userblock_e2e_test.go

···
+package integration
+
+import (
+	"Coves/internal/api/routes"
+	"Coves/internal/atproto/jetstream"
+	"Coves/internal/atproto/utils"
+	"Coves/internal/core/userblocks"
+	"Coves/internal/db/postgres"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	_ "github.com/lib/pq"
+)
+
+// TestUserBlockE2E_BlockAndUnblock tests the full user block lifecycle with a real PDS.
+// Flow: Client -> XRPC -> PDS Write -> Verify on PDS -> Jetstream -> Consumer -> AppView
+// Then: Client -> XRPC Unblock -> PDS Delete -> Jetstream -> Consumer -> AppView removal
+func TestUserBlockE2E_BlockAndUnblock(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping E2E test in short mode")
+	}
+
+	db := setupTestDB(t)
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+	pdsURL := getTestPDSURL()
+
+	// Health check PDS
+	healthResp, err := http.Get(pdsURL + "/xrpc/_health")
+	if err != nil {
+		t.Skipf("PDS not running at %s: %v", pdsURL, err)
+	}
+	func() {
+		if closeErr := healthResp.Body.Close(); closeErr != nil {
+			t.Logf("Failed to close health response: %v", closeErr)
+		}
+	}()
+
+	// Clean up user_blocks at the end to avoid polluting other tests
+	defer func() {
+		_, _ = db.Exec("DELETE FROM user_blocks")
+	}()
+
+	// Setup repository
+	blockRepo := postgres.NewUserBlockRepository(db)
+
+	// Create User A (blocker) on real PDS
+	userAHandle := fmt.Sprintf("blka%d.local.coves.dev", time.Now().UnixNano()%1000000)
+	userAEmail := fmt.Sprintf("[e-mail]", time.Now().Unix())
+	userAPassword := "test-password-123"
+
+	t.Logf("Creating User A (blocker) on PDS: %s", userAHandle)
+	pdsAccessTokenA, userADID, err := createPDSAccount(pdsURL, userAHandle, userAEmail, userAPassword)
+	if err != nil {
+		t.Fatalf("Failed to create User A on PDS: %v", err)
+	}
+	t.Logf("User A created: DID=%s", userADID)
+
+	// Create User B (target) on real PDS
+	userBHandle := fmt.Sprintf("blkb%d.local.coves.dev", time.Now().UnixNano()%1000000)
+	userBEmail := fmt.Sprintf("[e-mail]", time.Now().Unix())
+	userBPassword := "test-password-123"
+
+	t.Logf("Creating User B (target) on PDS: %s", userBHandle)
+	_, userBDID, err := createPDSAccount(pdsURL, userBHandle, userBEmail, userBPassword)
+	if err != nil {
+		t.Fatalf("Failed to create User B on PDS: %v", err)
+	}
+	t.Logf("User B created: DID=%s", userBDID)
+
+	// Index both users in AppView
+	createTestUser(t, db, userAHandle, userADID)
+	createTestUser(t, db, userBHandle, userBDID)
+
+	// Setup OAuth middleware with User A's real PDS access token
+	e2eAuth := NewE2EOAuthMiddleware()
+	tokenA := e2eAuth.AddUserWithPDSToken(userADID, pdsAccessTokenA, pdsURL)
+
+	// Setup service with password-based PDS client factory
+	service := userblocks.NewServiceWithPDSFactory(blockRepo, nil, UserBlockPasswordAuthPDSClientFactory())
+
+	// Setup HTTP server with XRPC routes
+	r := chi.NewRouter()
+	routes.RegisterUserBlockRoutes(r, service, e2eAuth.OAuthAuthMiddleware)
+	httpServer := httptest.NewServer(r)
+	defer httpServer.Close()
+
+	// Setup Jetstream consumer with block repo
+	userConsumer := jetstream.NewUserEventConsumer(nil, nil, "", "",
+		jetstream.WithUserBlockRepo(blockRepo))
+
+	// ====================================================================================
+	// BLOCK PHASE: User A blocks User B
+	// ====================================================================================
+	t.Logf("\n--- BLOCK PHASE: User A blocks User B ---")
+
+	blockReq := map[string]interface{}{
+		"subject": userBDID,
+	}
+
+	reqBody, marshalErr := json.Marshal(blockReq)
+	if marshalErr != nil {
+		t.Fatalf("Failed to marshal block request: %v", marshalErr)
+	}
+
+	req, err := http.NewRequest(http.MethodPost,
+		httpServer.URL+"/xrpc/social.coves.actor.blockUser",
+		bytes.NewBuffer(reqBody))
+	if err != nil {
+		t.Fatalf("Failed to create block request: %v", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("Failed to POST block: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		body, readErr := io.ReadAll(resp.Body)
+		if readErr != nil {
+			t.Fatalf("Expected 200, got %d (failed to read body: %v)", resp.StatusCode, readErr)
+		}
+		t.Logf("XRPC Block Failed")
+		t.Logf("   Status: %d", resp.StatusCode)
+		t.Logf("   Response: %s", string(body))
+		t.Fatalf("Expected 200, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var blockResp struct {
+		Block struct {
+			RecordURI string `json:"recordUri"`
+			RecordCID string `json:"recordCid"`
+		} `json:"block"`
+	}
+
+	if decodeErr := json.NewDecoder(resp.Body).Decode(&blockResp); decodeErr != nil {
+		t.Fatalf("Failed to decode block response: %v", decodeErr)
+	}
+
+	t.Logf("XRPC block response received:")
+	t.Logf("   RecordURI: %s", blockResp.Block.RecordURI)
+	t.Logf("   RecordCID: %s", blockResp.Block.RecordCID)
+
+	if blockResp.Block.RecordURI == "" {
+		t.Fatal("Block response missing recordUri")
+	}
+	if blockResp.Block.RecordCID == "" {
+		t.Fatal("Block response missing recordCid")
+	}
+
+	// Verify block record was written to PDS
+	t.Logf("\nVerifying block record on PDS...")
+	rkey := utils.ExtractRKeyFromURI(blockResp.Block.RecordURI)
+	collection := "social.coves.actor.block"
+
+	pdsResp, pdsErr := http.Get(fmt.Sprintf("%s/xrpc/com.atproto.repo.getRecord?repo=%s&collection=%s&rkey=%s",
+		pdsURL, userADID, collection, rkey))
+	if pdsErr != nil {
+		t.Fatalf("Failed to fetch block record from PDS: %v", pdsErr)
+	}
+	defer func() {
+		if closeErr := pdsResp.Body.Close(); closeErr != nil {
+			t.Logf("Failed to close PDS response: %v", closeErr)
+		}
+	}()
+
+	if pdsResp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(pdsResp.Body)
+		t.Fatalf("Block record not found on PDS: status %d, body: %s", pdsResp.StatusCode, string(body))
+	}
+
+	var pdsRecord struct {
+		Value map[string]interface{} `json:"value"`
+		CID   string                 `json:"cid"`
+	}
+	if decodeErr := json.NewDecoder(pdsResp.Body).Decode(&pdsRecord); decodeErr != nil {
+		t.Fatalf("Failed to decode PDS record: %v", decodeErr)
+	}
+
+	t.Logf("Block record found on PDS:")
+	t.Logf("   CID: %s", pdsRecord.CID)
+	t.Logf("   Subject: %v", pdsRecord.Value["subject"])
+
+	// Verify subject DID in PDS record
+	if pdsRecord.Value["subject"] != userBDID {
+		t.Errorf("Expected subject '%s', got %v", userBDID, pdsRecord.Value["subject"])
+	}
+
+	// Simulate Jetstream CREATE event
+	t.Logf("\nSimulating Jetstream CREATE event for block...")
+	createEvent := jetstream.JetstreamEvent{
+		Did:    userADID,
+		TimeUS: time.Now().UnixMicro(),
+		Kind:   "commit",
+		Commit: &jetstream.CommitEvent{
+			Rev:        "test-block-rev-create",
+			Operation:  "create",
+			Collection: "social.coves.actor.block",
+			RKey:       rkey,
+			CID:        pdsRecord.CID,
+			Record: map[string]interface{}{
+				"$type":     "social.coves.actor.block",
+				"subject":   userBDID,
+				"createdAt": time.Now().Format(time.RFC3339),
+			},
+		},
+	}
+
+	if handleErr := userConsumer.HandleEvent(ctx, &createEvent); handleErr != nil {
+		t.Fatalf("Failed to handle block create event: %v", handleErr)
+	}
+
+	// Verify block indexed in AppView via repo.GetBlock()
+	t.Logf("\nVerifying block indexed in AppView...")
+	indexedBlock, err := blockRepo.GetBlock(ctx, userADID, userBDID)
+	if err != nil {
+		t.Fatalf("Block not indexed in AppView: %v", err)
+	}
+
+	t.Logf("Block indexed in AppView:")
+	t.Logf("   BlockerDID: %s", indexedBlock.BlockerDID)
+	t.Logf("   BlockedDID: %s", indexedBlock.BlockedDID)
+	t.Logf("   RecordURI:  %s", indexedBlock.RecordURI)
+	t.Logf("   RecordCID:  %s", indexedBlock.RecordCID)
+
+	if indexedBlock.BlockerDID != userADID {
+		t.Errorf("Expected blocker_did %s, got %s", userADID, indexedBlock.BlockerDID)
+	}
+	if indexedBlock.BlockedDID != userBDID {
+		t.Errorf("Expected blocked_did %s, got %s", userBDID, indexedBlock.BlockedDID)
+	}
+
+	// Verify via IsBlocked
+	isBlocked, err := blockRepo.IsBlocked(ctx, userADID, userBDID)
+	if err != nil {
+		t.Fatalf("Failed to check IsBlocked: %v", err)
+	}
+	if !isBlocked {
+		t.Error("Expected IsBlocked to return true, got false")
+	}
+
+	t.Logf("BLOCK PHASE COMPLETE:")
+	t.Logf("   Client -> XRPC -> PDS Write -> Jetstream -> Consumer -> AppView")
+	t.Logf("   Block written to PDS")
+	t.Logf("   Block indexed in AppView")
+	t.Logf("   IsBlocked confirmed")
+
+	// ====================================================================================
+	// UNBLOCK PHASE: User A unblocks User B
+	// ====================================================================================
+	t.Logf("\n--- UNBLOCK PHASE: User A unblocks User B ---")
+
+	unblockReq := map[string]interface{}{
+		"subject": userBDID,
+	}
+
+	unblockBody, marshalErr := json.Marshal(unblockReq)
+	if marshalErr != nil {
+		t.Fatalf("Failed to marshal unblock request: %v", marshalErr)
+	}
+
+	unblockHTTPReq, err := http.NewRequest(http.MethodPost,
+		httpServer.URL+"/xrpc/social.coves.actor.unblockUser",
+		bytes.NewBuffer(unblockBody))
+	if err != nil {
+		t.Fatalf("Failed to create unblock request: %v", err)
+	}
+	unblockHTTPReq.Header.Set("Content-Type", "application/json")
+	unblockHTTPReq.Header.Set("Authorization", "Bearer "+tokenA)
+
+	unblockResp, err := http.DefaultClient.Do(unblockHTTPReq)
+	if err != nil {
+		t.Fatalf("Failed to POST unblock: %v", err)
+	}
+	defer func() {
+		if closeErr := unblockResp.Body.Close(); closeErr != nil {
+			t.Logf("Failed to close unblock response: %v", closeErr)
+		}
+	}()
+
+	if unblockResp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(unblockResp.Body)
+		t.Fatalf("Unblock failed: status %d, body: %s", unblockResp.StatusCode, string(body))
+	}
+
+	t.Logf("Unblock XRPC request succeeded")
+
+	// Verify record deleted from PDS (expect error/404)
+	t.Logf("\nVerifying block record deleted from PDS...")
+	pdsDeleteCheck, pdsDeleteErr := http.Get(fmt.Sprintf("%s/xrpc/com.atproto.repo.getRecord?repo=%s&collection=%s&rkey=%s",
+		pdsURL, userADID, collection, rkey))
+	if pdsDeleteErr != nil {
+		t.Fatalf("Failed to check PDS record after unblock: %v", pdsDeleteErr)
+	}
+	defer func() {
+		if closeErr := pdsDeleteCheck.Body.Close(); closeErr != nil {
+			t.Logf("Failed to close PDS delete check response: %v", closeErr)
+		}
+	}()
+
+	switch pdsDeleteCheck.StatusCode {
+	case http.StatusOK:
+		t.Error("Expected block record to be deleted from PDS, but it still exists")
+	case http.StatusBadRequest, http.StatusNotFound:
+		// Expected: PDS returns 400 (RecordNotFound) or 404 for deleted records
+		t.Logf("Block record confirmed deleted from PDS (status: %d)", pdsDeleteCheck.StatusCode)
+	default:
+		body, _ := io.ReadAll(pdsDeleteCheck.Body)
+		t.Errorf("Unexpected status when checking deleted record: %d, body: %s", pdsDeleteCheck.StatusCode, string(body))
+	}
+
+	// Simulate Jetstream DELETE event
+	t.Logf("\nSimulating Jetstream DELETE event for unblock...")
+	deleteEvent := jetstream.JetstreamEvent{
+		Did:    userADID,
+		TimeUS: time.Now().UnixMicro(),
+		Kind:   "commit",
+		Commit: &jetstream.CommitEvent{
+			Rev:        "test-block-rev-delete",
+			Operation:  "delete",
+			Collection: "social.coves.actor.block",
+			RKey:       rkey,
+		},
+	}
+
+	if handleErr := userConsumer.HandleEvent(ctx, &deleteEvent); handleErr != nil {
+		t.Fatalf("Failed to handle block delete event: %v", handleErr)
+	}
+
+	// Verify block removed from AppView
+	t.Logf("\nVerifying block removed from AppView...")
+	_, err = blockRepo.GetBlock(ctx, userADID, userBDID)
+	if err == nil {
+		t.Error("Expected block to be deleted from AppView, but it still exists")
+	}
+
+	// Verify via IsBlocked
+	isBlockedAfter, err := blockRepo.IsBlocked(ctx, userADID, userBDID)
+	if err != nil {
+		t.Fatalf("Failed to check IsBlocked after unblock: %v", err)
+	}
+	if isBlockedAfter {
+		t.Error("Expected IsBlocked to return false after unblock, got true")
+	}
+
+	t.Logf("UNBLOCK PHASE COMPLETE:")
+	t.Logf("   Unblock request sent via XRPC")
+	t.Logf("   Block record deleted from PDS")
+	t.Logf("   Block removed from AppView")
+	t.Logf("   IsBlocked confirmed false")
+
+	t.Logf("\nTRUE E2E BLOCK/UNBLOCK FLOW COMPLETE:")
+	t.Logf("   Client -> XRPC -> PDS Write -> Jetstream -> Consumer -> AppView")
+	t.Logf("   Client -> XRPC Unblock -> PDS Delete -> Jetstream -> Consumer -> AppView removal")
+}
+
+// TestUserBlockE2E_SelfBlockPrevented tests that a user cannot block themselves.
+// This validates the self-block guard in the service layer with a real PDS.
+func TestUserBlockE2E_SelfBlockPrevented(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping E2E test in short mode")
+	}
+
+	db := setupTestDB(t)
+	defer func() { _ = db.Close() }()
+
+	pdsURL := getTestPDSURL()
+
+	// Health check PDS
+	healthResp, err := http.Get(pdsURL + "/xrpc/_health")
+	if err != nil {
+		t.Skipf("PDS not running at %s: %v", pdsURL, err)
+	}
+	func() {
+		if closeErr := healthResp.Body.Close(); closeErr != nil {
+			t.Logf("Failed to close health response: %v", closeErr)
+		}
+	}()
+
+	// Clean up user_blocks at the end
+	defer func() {
+		_, _ = db.Exec("DELETE FROM user_blocks")
+	}()
+
+	// Setup repository
+	blockRepo := postgres.NewUserBlockRepository(db)
+
+	// Create User A on real PDS
+	userAHandle := fmt.Sprintf("self%d.local.coves.dev", time.Now().UnixNano()%1000000)
+	userAEmail := fmt.Sprintf("[e-mail]", time.Now().Unix())
+	userAPassword := "test-password-123"
+
+	t.Logf("Creating User A on PDS: %s", userAHandle)
+	pdsAccessTokenA, userADID, err := createPDSAccount(pdsURL, userAHandle, userAEmail, userAPassword)
+	if err != nil {
+		t.Fatalf("Failed to create User A on PDS: %v", err)
+	}
+	t.Logf("User A created: DID=%s", userADID)
+
+	// Index user in AppView
+	createTestUser(t, db, userAHandle, userADID)
+
+	// Setup OAuth middleware with User A's real PDS access token
+	e2eAuth := NewE2EOAuthMiddleware()
+	tokenA := e2eAuth.AddUserWithPDSToken(userADID, pdsAccessTokenA, pdsURL)
+
+	// Setup service with password-based PDS client factory
+	service := userblocks.NewServiceWithPDSFactory(blockRepo, nil, UserBlockPasswordAuthPDSClientFactory())
+
+	// Setup HTTP server
+	r := chi.NewRouter()
+	routes.RegisterUserBlockRoutes(r, service, e2eAuth.OAuthAuthMiddleware)
+	httpServer := httptest.NewServer(r)
+	defer httpServer.Close()
+
+	// Attempt to self-block
+	t.Logf("\nAttempting to block self (should fail)...")
+
+	selfBlockReq := map[string]interface{}{
+		"subject": userADID,
+	}
+
+	reqBody, marshalErr := json.Marshal(selfBlockReq)
+	if marshalErr != nil {
+		t.Fatalf("Failed to marshal self-block request: %v", marshalErr)
+	}
+
+	req, err := http.NewRequest(http.MethodPost,
+		httpServer.URL+"/xrpc/social.coves.actor.blockUser",
+		bytes.NewBuffer(reqBody))
+	if err != nil {
+		t.Fatalf("Failed to create self-block request: %v", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("Failed to POST self-block: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	// Should return 400 Bad Request
+	if resp.StatusCode != http.StatusBadRequest {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 400 for self-block, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	// Parse error response
+	var errResp struct {
+		Error   string `json:"error"`
+		Message string `json:"message"`
+	}
+	if decodeErr := json.NewDecoder(resp.Body).Decode(&errResp); decodeErr != nil {
+		t.Fatalf("Failed to decode error response: %v", decodeErr)
+	}
+
+	// Verify error message mentions self-blocking
+	if !contains(errResp.Message, "cannot block yourself") {
+		t.Errorf("Expected error about self-blocking, got: %s", errResp.Message)
+	}
+
+	t.Logf("Self-block correctly prevented:")
+	t.Logf("   Status: %d", resp.StatusCode)
+	t.Logf("   Error:  %s", errResp.Error)
+	t.Logf("   Message: %s", errResp.Message)
+
+	t.Logf("\nSELF-BLOCK PREVENTION TEST COMPLETE:")
+	t.Logf("   User attempted to block themselves")
+	t.Logf("   Server returned 400 with 'cannot block yourself'")
+	t.Logf("   No record written to PDS")
+}

tests/integration/userblock_enforcement_test.go

···
+package integration
+
+import (
+	"Coves/internal/core/comments"
+	"Coves/internal/core/communityFeeds"
+	"Coves/internal/core/discover"
+	"Coves/internal/core/timeline"
+	"Coves/internal/core/userblocks"
+	"context"
+	"database/sql"
+	"fmt"
+	"testing"
+	"time"
+
+	postgresRepo "Coves/internal/db/postgres"
+)
+
+// TestUserBlock_CommunityFeedFiltering verifies that user block enforcement filters
+// blocked users' posts from community feeds when a viewer is authenticated,
+// but still shows them to unauthenticated viewers.
+func TestUserBlock_CommunityFeedFiltering(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+
+	testID := time.Now().UnixNano()
+
+	// Unique DIDs for this test to avoid collisions
+	blockerDID := fmt.Sprintf("did:plc:blocker-feed-%d", testID)
+	posterDID := fmt.Sprintf("did:plc:poster-feed-%d", testID)
+	// Third-party user whose posts should always be visible (positive assertion)
+	thirdPartyDID := fmt.Sprintf("did:plc:thirdparty-feed-%d", testID)
+	communityName := fmt.Sprintf("blockfeed-%d", testID)
+	ownerHandle := fmt.Sprintf("blockfeed-owner-%d.test", testID)
+
+	// Cleanup test data after the test
+	defer func() {
+		cleanupUserBlockEnforcementTestData(t, db, blockerDID, posterDID, communityName, ownerHandle)
+		// Also clean up third-party user
+		_, _ = db.Exec("DELETE FROM users WHERE did = $1", thirdPartyDID)
+		if err := db.Close(); err != nil {
+			t.Logf("Failed to close database: %v", err)
+		}
+	}()
+
+	// Setup: Create test users
+	for _, u := range []struct{ did, handle string }{
+		{blockerDID, fmt.Sprintf("blocker-%d.bsky.social", testID)},
+		{posterDID, fmt.Sprintf("poster-%d.bsky.social", testID)},
+		{thirdPartyDID, fmt.Sprintf("thirdparty-%d.bsky.social", testID)},
+	} {
+		_, err := db.ExecContext(ctx, `
+			INSERT INTO users (did, handle, pds_url, created_at)
+			VALUES ($1, $2, $3, NOW())
+			ON CONFLICT (did) DO NOTHING
+		`, u.did, u.handle, getTestPDSURL())
+		if err != nil {
+			t.Fatalf("Failed to create user %s: %v", u.handle, err)
+		}
+	}
+
+	// Setup: Create community
+	communityDID, err := createFeedTestCommunity(db, ctx, communityName, ownerHandle)
+	if err != nil {
+		t.Fatalf("Failed to create test community: %v", err)
+	}
+
+	// Setup: Create posts by poster and third-party
+	post1URI := createTestPost(t, db, communityDID, posterDID, "Post by poster 1", 10, time.Now().Add(-3*time.Hour))
+	post2URI := createTestPost(t, db, communityDID, posterDID, "Post by poster 2", 20, time.Now().Add(-2*time.Hour))
+	thirdPartyPostURI := createTestPost(t, db, communityDID, thirdPartyDID, "Post by third party", 15, time.Now().Add(-1*time.Hour))
+
+	// Create the feed repo (testing at repo level, not handler level)
+	feedRepo := postgresRepo.NewCommunityFeedRepository(db, "test-secret")
+
+	// Step 1: Query community feed WITHOUT ViewerDID - should see all posts
+	t.Run("unauthenticated sees all posts before block", func(t *testing.T) {
+		req := communityFeeds.GetCommunityFeedRequest{
+			Community: communityDID,
+			Sort:      "new",
+			Limit:     50,
+		}
+
+		posts, _, err := feedRepo.GetCommunityFeed(ctx, req)
+		if err != nil {
+			t.Fatalf("GetCommunityFeed failed: %v", err)
+		}
+
+		if !feedContainsPost(posts, post1URI) {
+			t.Errorf("Expected to find post1 (%s) in unauthenticated feed", post1URI)
+		}
+		if !feedContainsPost(posts, post2URI) {
+			t.Errorf("Expected to find post2 (%s) in unauthenticated feed", post2URI)
+		}
+		if !feedContainsPost(posts, thirdPartyPostURI) {
+			t.Errorf("Expected to find third-party post (%s) in unauthenticated feed", thirdPartyPostURI)
+		}
+	})
+
+	// Step 2: Create a block (blocker blocks poster)
+	_, err = db.ExecContext(ctx, `
+		INSERT INTO user_blocks (blocker_did, blocked_did, record_uri, record_cid)
+		VALUES ($1, $2, $3, $4)
+	`, blockerDID, posterDID,
+		fmt.Sprintf("at://%s/social.coves.actor.block/block1", blockerDID),
+		"bafyblocktest1")
+	if err != nil {
+		t.Fatalf("Failed to insert user block: %v", err)
+	}
+
+	// Step 3: Blocker should NOT see poster's posts, but SHOULD still see third-party posts
+	t.Run("blocker does not see blocked user posts but sees others", func(t *testing.T) {
+		req := communityFeeds.GetCommunityFeedRequest{
+			Community: communityDID,
+			ViewerDID: blockerDID,
+			Sort:      "new",
+			Limit:     50,
+		}
+
+		posts, _, err := feedRepo.GetCommunityFeed(ctx, req)
+		if err != nil {
+			t.Fatalf("GetCommunityFeed with ViewerDID failed: %v", err)
+		}
+
+		if feedContainsPost(posts, post1URI) {
+			t.Errorf("Blocker should NOT see post1 (%s) from blocked user", post1URI)
+		}
+		if feedContainsPost(posts, post2URI) {
+			t.Errorf("Blocker should NOT see post2 (%s) from blocked user", post2URI)
+		}
+		// Positive assertion: non-blocked third-party posts must still be visible
+		if !feedContainsPost(posts, thirdPartyPostURI) {
+			t.Errorf("Blocker should still see third-party post (%s)", thirdPartyPostURI)
+		}
+	})
+
+	// Step 4: Blocked user (poster) can still see blocker's content (one-directional block)
+	t.Run("blocked user still sees blocker content (one-directional)", func(t *testing.T) {
+		// Create a post by the blocker so the blocked user can potentially see it
+		blockerPostURI := createTestPost(t, db, communityDID, blockerDID, "Post by blocker", 5, time.Now())
+
+		req := communityFeeds.GetCommunityFeedRequest{
+			Community: communityDID,
+			ViewerDID: posterDID,
+			Sort:      "new",
+			Limit:     50,
+		}
+
+		posts, _, err := feedRepo.GetCommunityFeed(ctx, req)
+		if err != nil {
+			t.Fatalf("GetCommunityFeed with blocked user as viewer failed: %v", err)
+		}
+
+		if !feedContainsPost(posts, blockerPostURI) {
+			t.Errorf("Blocked user should still see blocker's post (%s) — block is one-directional", blockerPostURI)
+		}
+	})
+
+	// Step 5: Unauthenticated user still sees all posts after block
+	t.Run("unauthenticated still sees all posts after block", func(t *testing.T) {
+		req := communityFeeds.GetCommunityFeedRequest{
+			Community: communityDID,
+			Sort:      "new",
+			Limit:     50,
+		}
+
+		posts, _, err := feedRepo.GetCommunityFeed(ctx, req)
+		if err != nil {
+			t.Fatalf("GetCommunityFeed without ViewerDID failed: %v", err)
+		}
+
+		if !feedContainsPost(posts, post1URI) {
+			t.Errorf("Unauthenticated user should still see post1 (%s) after block", post1URI)
+		}
+		if !feedContainsPost(posts, post2URI) {
+			t.Errorf("Unauthenticated user should still see post2 (%s) after block", post2URI)
+		}
+	})
+}
+
+// TestUserBlock_DiscoverFeedFiltering verifies that user block enforcement filters
+// blocked users' posts from the discover feed when a viewer is authenticated,
+// but still shows them to unauthenticated viewers.
+func TestUserBlock_DiscoverFeedFiltering(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+
+	testID := time.Now().UnixNano()
+
+	blockerDID := fmt.Sprintf("did:plc:blocker-discover-%d", testID)
+	posterDID := fmt.Sprintf("did:plc:poster-discover-%d", testID)
+	thirdPartyDID := fmt.Sprintf("did:plc:thirdparty-discover-%d", testID)
+	communityName := fmt.Sprintf("blockdisc-%d", testID)
+	ownerHandle := fmt.Sprintf("blockdisc-owner-%d.test", testID)
+
+	defer func() {
+		cleanupUserBlockEnforcementTestData(t, db, blockerDID, posterDID, communityName, ownerHandle)
+		_, _ = db.Exec("DELETE FROM users WHERE did = $1", thirdPartyDID)
+		if err := db.Close(); err != nil {
+			t.Logf("Failed to close database: %v", err)
+		}
+	}()
+
+	// Setup: Create test users
+	for _, u := range []struct{ did, handle string }{
+		{blockerDID, fmt.Sprintf("blocker-%d.bsky.social", testID)},
+		{posterDID, fmt.Sprintf("poster-%d.bsky.social", testID)},
+		{thirdPartyDID, fmt.Sprintf("thirdparty-%d.bsky.social", testID)},
+	} {
+		_, err := db.ExecContext(ctx, `
+			INSERT INTO users (did, handle, pds_url, created_at)
+			VALUES ($1, $2, $3, NOW())
+			ON CONFLICT (did) DO NOTHING
+		`, u.did, u.handle, getTestPDSURL())
+		if err != nil {
+			t.Fatalf("Failed to create user %s: %v", u.handle, err)
+		}
+	}
+
+	// Setup: Create community
+	communityDID, err := createFeedTestCommunity(db, ctx, communityName, ownerHandle)
+	if err != nil {
+		t.Fatalf("Failed to create test community: %v", err)
+	}
+
+	// Setup: Create posts by poster and third-party
+	post1URI := createTestPost(t, db, communityDID, posterDID, "Discover post 1", 15, time.Now().Add(-3*time.Hour))
+	post2URI := createTestPost(t, db, communityDID, posterDID, "Discover post 2", 25, time.Now().Add(-2*time.Hour))
+	thirdPartyPostURI := createTestPost(t, db, communityDID, thirdPartyDID, "Discover third party", 20, time.Now().Add(-1*time.Hour))
+
+	// Create the discover repo
+	discoverRepo := postgresRepo.NewDiscoverRepository(db, "test-secret")
+
+	// Step 1: Query discover feed WITHOUT ViewerDID - should see all posts
+	t.Run("unauthenticated sees all posts before block", func(t *testing.T) {
+		req := discover.GetDiscoverRequest{
+			Sort:  "new",
+			Limit: 50,
+		}
+
+		posts, _, err := discoverRepo.GetDiscover(ctx, req)
+		if err != nil {
+			t.Fatalf("GetDiscover failed: %v", err)
+		}
+
+		if !discoverFeedContainsPost(posts, post1URI) {
+			t.Errorf("Expected to find post1 (%s) in unauthenticated discover feed", post1URI)
+		}
+		if !discoverFeedContainsPost(posts, post2URI) {
+			t.Errorf("Expected to find post2 (%s) in unauthenticated discover feed", post2URI)
+		}
+		if !discoverFeedContainsPost(posts, thirdPartyPostURI) {
+			t.Errorf("Expected to find third-party post (%s) in unauthenticated discover feed", thirdPartyPostURI)
+		}
+	})
+
+	// Step 2: Create a block (blocker blocks poster)
+	_, err = db.ExecContext(ctx, `
+		INSERT INTO user_blocks (blocker_did, blocked_did, record_uri, record_cid)
+		VALUES ($1, $2, $3, $4)
+	`, blockerDID, posterDID,
+		fmt.Sprintf("at://%s/social.coves.actor.block/block1", blockerDID),
+		"bafyblockdiscover1")
+	if err != nil {
+		t.Fatalf("Failed to insert user block: %v", err)
+	}
+
+	// Step 3: Blocker should NOT see poster's posts, but SHOULD still see third-party posts
+	t.Run("blocker does not see blocked user posts but sees others", func(t *testing.T) {
+		req := discover.GetDiscoverRequest{
+			ViewerDID: blockerDID,
+			Sort:      "new",
+			Limit:     50,
+		}
+
+		posts, _, err := discoverRepo.GetDiscover(ctx, req)
+		if err != nil {
+			t.Fatalf("GetDiscover with ViewerDID failed: %v", err)
+		}
+
+		if discoverFeedContainsPost(posts, post1URI) {
+			t.Errorf("Blocker should NOT see post1 (%s) from blocked user in discover", post1URI)
+		}
+		if discoverFeedContainsPost(posts, post2URI) {
+			t.Errorf("Blocker should NOT see post2 (%s) from blocked user in discover", post2URI)
+		}
+		// Positive assertion: non-blocked third-party posts must still be visible
+		if !discoverFeedContainsPost(posts, thirdPartyPostURI) {
+			t.Errorf("Blocker should still see third-party post (%s) in discover", thirdPartyPostURI)
+		}
+	})
+
+	// Step 4: Unauthenticated user still sees all posts after block
+	t.Run("unauthenticated still sees all posts after block", func(t *testing.T) {
+		req := discover.GetDiscoverRequest{
+			Sort:  "new",
+			Limit: 50,
+		}
+
+		posts, _, err := discoverRepo.GetDiscover(ctx, req)
+		if err != nil {
+			t.Fatalf("GetDiscover without ViewerDID failed: %v", err)
+		}
+
+		if !discoverFeedContainsPost(posts, post1URI) {
+			t.Errorf("Unauthenticated user should still see post1 (%s) after block in discover", post1URI)
+		}
+		if !discoverFeedContainsPost(posts, post2URI) {
+			t.Errorf("Unauthenticated user should still see post2 (%s) after block in discover", post2URI)
+		}
+	})
+}
+
+// TestUserBlock_ProfileViewerState verifies that the user block repository correctly
+// returns block records, confirming that GetBlock returns a RecordURI when a block exists.
+func TestUserBlock_ProfileViewerState(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+
+	testID := time.Now().UnixNano()
+
+	userA := fmt.Sprintf("did:plc:profile-viewer-a-%d", testID)
+	userB := fmt.Sprintf("did:plc:profile-viewer-b-%d", testID)
+	expectedRecordURI := fmt.Sprintf("at://%s/social.coves.actor.block/profileblock1", userA)
+
+	defer func() {
+		_, _ = db.Exec("DELETE FROM user_blocks WHERE blocker_did = $1", userA)
+		if err := db.Close(); err != nil {
+			t.Logf("Failed to close database: %v", err)
+		}
+	}()
+
+	// Create the user block repo
+	userBlockRepo := postgresRepo.NewUserBlockRepository(db)
+
+	// Step 1: Verify no block exists initially
+	t.Run("no block exists initially", func(t *testing.T) {
+		_, err := userBlockRepo.GetBlock(ctx, userA, userB)
+		if !userblocks.IsNotFound(err) {
+			t.Errorf("Expected ErrBlockNotFound before creating block, got: %v", err)
+		}
+	})
+
+	// Step 2: Create a block (User A blocks User B) via raw SQL
+	_, err := db.ExecContext(ctx, `
+		INSERT INTO user_blocks (blocker_did, blocked_did, record_uri, record_cid)
+		VALUES ($1, $2, $3, $4)
+	`, userA, userB, expectedRecordURI, "bafyprofileblock1")
+	if err != nil {
+		t.Fatalf("Failed to insert user block: %v", err)
+	}
+
+	// Step 3: Verify block exists via repo.GetBlock
+	t.Run("GetBlock returns block with correct RecordURI", func(t *testing.T) {
+		block, err := userBlockRepo.GetBlock(ctx, userA, userB)
+		if err != nil {
+			t.Fatalf("GetBlock failed: %v", err)
+		}
+
+		if block.BlockerDID != userA {
+			t.Errorf("Expected BlockerDID=%s, got %s", userA, block.BlockerDID)
+		}
+		if block.BlockedDID != userB {
+			t.Errorf("Expected BlockedDID=%s, got %s", userB, block.BlockedDID)
+		}
+		if block.RecordURI != expectedRecordURI {
+			t.Errorf("Expected RecordURI=%s, got %s", expectedRecordURI, block.RecordURI)
+		}
+		if block.RecordURI == "" {
+			t.Error("RecordURI should not be empty - needed for profile viewer.blocking hydration")
+		}
+	})
+
+	// Step 4: Verify the reverse direction does not have a block
+	t.Run("reverse direction has no block", func(t *testing.T) {
+		_, err := userBlockRepo.GetBlock(ctx, userB, userA)
+		if !userblocks.IsNotFound(err) {
+			t.Errorf("Expected ErrBlockNotFound for reverse direction (B->A), got: %v", err)
+		}
+	})
+}
+
+// TestUserBlock_CommentFiltering verifies that comments from blocked users are
+// filtered out when querying with a viewerDID.
+func TestUserBlock_CommentFiltering(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+
+	testID := time.Now().UnixNano()
+
+	blockerDID := fmt.Sprintf("did:plc:blocker-comment-%d", testID)
+	commenterDID := fmt.Sprintf("did:plc:commenter-%d", testID)
+	otherCommenterDID := fmt.Sprintf("did:plc:othercommenter-%d", testID)
+
+	defer func() {
+		_, _ = db.Exec("DELETE FROM comments WHERE commenter_did IN ($1, $2)", commenterDID, otherCommenterDID)
+		_, _ = db.Exec("DELETE FROM user_blocks WHERE blocker_did = $1", blockerDID)
+		_, _ = db.Exec("DELETE FROM users WHERE did IN ($1, $2, $3)", blockerDID, commenterDID, otherCommenterDID)
+		if err := db.Close(); err != nil {
+			t.Logf("Failed to close database: %v", err)
+		}
+	}()
+
+	// Create users
+	for _, u := range []struct{ did, handle string }{
+		{blockerDID, fmt.Sprintf("blocker-%d.bsky.social", testID)},
+		{commenterDID, fmt.Sprintf("commenter-%d.bsky.social", testID)},
+		{otherCommenterDID, fmt.Sprintf("other-%d.bsky.social", testID)},
+	} {
+		_, err := db.ExecContext(ctx, `
+			INSERT INTO users (did, handle, pds_url, created_at)
+			VALUES ($1, $2, $3, NOW())
+			ON CONFLICT (did) DO NOTHING
+		`, u.did, u.handle, getTestPDSURL())
+		if err != nil {
+			t.Fatalf("Failed to create user %s: %v", u.handle, err)
+		}
+	}
+
+	// Create a parent post URI (the comment's parent)
+	parentURI := fmt.Sprintf("at://did:plc:somepost/social.coves.community.post/parent%d", testID)
+
+	// Insert comments from blocked commenter and non-blocked commenter
+	commentRepo := postgresRepo.NewCommentRepository(db)
+
+	blockedCommentURI := fmt.Sprintf("at://%s/social.coves.community.comment/c1%d", commenterDID, testID)
+	if err := commentRepo.Create(ctx, &comments.Comment{
+		URI:          blockedCommentURI,
+		CID:          "bafyblocked-comment",
+		RKey:         fmt.Sprintf("c1%d", testID),
+		CommenterDID: commenterDID,
+		RootURI:      parentURI,
+		RootCID:      "bafyroot",
+		ParentURI:    parentURI,
+		ParentCID:    "bafyparent",
+		Content:      "Comment from blocked user",
+		CreatedAt:    time.Now().Add(-1 * time.Hour),
+	}); err != nil {
+		t.Fatalf("Failed to create blocked user comment: %v", err)
+	}
+
+	otherCommentURI := fmt.Sprintf("at://%s/social.coves.community.comment/c2%d", otherCommenterDID, testID)
+	if err := commentRepo.Create(ctx, &comments.Comment{
+		URI:          otherCommentURI,
+		CID:          "bafyother-comment",
+		RKey:         fmt.Sprintf("c2%d", testID),
+		CommenterDID: otherCommenterDID,
+		RootURI:      parentURI,
+		RootCID:      "bafyroot",
+		ParentURI:    parentURI,
+		ParentCID:    "bafyparent",
+		Content:      "Comment from non-blocked user",
+		CreatedAt:    time.Now(),
+	}); err != nil {
+		t.Fatalf("Failed to create other user comment: %v", err)
+	}
+
+	// Verify both comments visible without block
+	t.Run("without block both comments visible", func(t *testing.T) {
+		result, _, err := commentRepo.ListByParentWithHotRank(ctx, parentURI, "new", "", 50, nil, blockerDID)
+		if err != nil {
+			t.Fatalf("ListByParentWithHotRank failed: %v", err)
+		}
+		if !commentListContains(result, blockedCommentURI) {
+			t.Errorf("Expected to find blocked user's comment before block")
+		}
+		if !commentListContains(result, otherCommentURI) {
+			t.Errorf("Expected to find other user's comment before block")
+		}
+	})
+
+	// Create block
+	_, err := db.ExecContext(ctx, `
+		INSERT INTO user_blocks (blocker_did, blocked_did, record_uri, record_cid)
+		VALUES ($1, $2, $3, $4)
+	`, blockerDID, commenterDID,
+		fmt.Sprintf("at://%s/social.coves.actor.block/cb%d", blockerDID, testID),
+		"bafycommentblock")
+	if err != nil {
+		t.Fatalf("Failed to insert user block: %v", err)
+	}
+
+	// Verify blocked commenter's comment is filtered
+	t.Run("blocker does not see blocked user comments", func(t *testing.T) {
+		result, _, err := commentRepo.ListByParentWithHotRank(ctx, parentURI, "new", "", 50, nil, blockerDID)
+		if err != nil {
+			t.Fatalf("ListByParentWithHotRank failed: %v", err)
+		}
+		if commentListContains(result, blockedCommentURI) {
+			t.Errorf("Blocker should NOT see blocked user's comment")
+		}
+		// Positive assertion: non-blocked comment must remain visible
+		if !commentListContains(result, otherCommentURI) {
+			t.Errorf("Blocker should still see non-blocked user's comment")
+		}
+	})
+}
+
+// TestUserBlock_TimelineFeedFiltering verifies that user block enforcement filters
+// blocked users' posts from the authenticated user's timeline feed.
+func TestUserBlock_TimelineFeedFiltering(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+
+	testID := time.Now().UnixNano()
+
+	viewerDID := fmt.Sprintf("did:plc:viewer-timeline-%d", testID)
+	blockedAuthorDID := fmt.Sprintf("did:plc:blocked-timeline-%d", testID)
+	otherAuthorDID := fmt.Sprintf("did:plc:other-timeline-%d", testID)
+	communityName := fmt.Sprintf("blocktl-%d", testID)
+	ownerHandle := fmt.Sprintf("blocktl-owner-%d.test", testID)
+
+	defer func() {
+		communityDID := fmt.Sprintf("did:plc:community-%s", communityName)
+		_, _ = db.Exec("DELETE FROM user_blocks WHERE blocker_did = $1", viewerDID)
+		_, _ = db.Exec("DELETE FROM community_subscriptions WHERE user_did = $1", viewerDID)
+		_, _ = db.Exec("DELETE FROM posts WHERE community_did = $1", communityDID)
+		_, _ = db.Exec("DELETE FROM communities WHERE did = $1", communityDID)
+		ownerDID := fmt.Sprintf("did:plc:%s", ownerHandle)
+		_, _ = db.Exec("DELETE FROM users WHERE did IN ($1, $2, $3, $4)", viewerDID, blockedAuthorDID, otherAuthorDID, ownerDID)
+		if err := db.Close(); err != nil {
+			t.Logf("Failed to close database: %v", err)
+		}
+	}()
+
+	// Create users
+	for _, u := range []struct{ did, handle string }{
+		{viewerDID, fmt.Sprintf("viewer-%d.bsky.social", testID)},
+		{blockedAuthorDID, fmt.Sprintf("blocked-%d.bsky.social", testID)},
+		{otherAuthorDID, fmt.Sprintf("other-%d.bsky.social", testID)},
+	} {
+		_, err := db.ExecContext(ctx, `
+			INSERT INTO users (did, handle, pds_url, created_at)
+			VALUES ($1, $2, $3, NOW())
+			ON CONFLICT (did) DO NOTHING
+		`, u.did, u.handle, getTestPDSURL())
+		if err != nil {
+			t.Fatalf("Failed to create user %s: %v", u.handle, err)
+		}
+	}
+
+	// Create community
+	communityDID, err := createFeedTestCommunity(db, ctx, communityName, ownerHandle)
+	if err != nil {
+		t.Fatalf("Failed to create test community: %v", err)
+	}
+
+	// Subscribe viewer to the community (required for timeline)
+	_, err = db.ExecContext(ctx, `
+		INSERT INTO community_subscriptions (user_did, community_did, subscribed_at)
+		VALUES ($1, $2, NOW())
+		ON CONFLICT DO NOTHING
+	`, viewerDID, communityDID)
+	if err != nil {
+		t.Fatalf("Failed to create community subscription: %v", err)
+	}
+
+	// Create posts
+	blockedPostURI := createTestPost(t, db, communityDID, blockedAuthorDID, "Post from blocked author", 10, time.Now().Add(-2*time.Hour))
+	otherPostURI := createTestPost(t, db, communityDID, otherAuthorDID, "Post from other author", 15, time.Now().Add(-1*time.Hour))
+
+	// Create timeline repo
+	timelineRepo := postgresRepo.NewTimelineRepository(db, "test-secret")
+
+	// Step 1: Verify both posts visible before block
+	t.Run("both posts visible before block", func(t *testing.T) {
+		req := timeline.GetTimelineRequest{
+			UserDID: viewerDID,
+			Sort:    "new",
+			Limit:   50,
+		}
+		posts, _, err := timelineRepo.GetTimeline(ctx, req)
+		if err != nil {
+			t.Fatalf("GetTimeline failed: %v", err)
+		}
+		if !timelineContainsPost(posts, blockedPostURI) {
+			t.Errorf("Expected to find blocked author's post before block")
+		}
+		if !timelineContainsPost(posts, otherPostURI) {
+			t.Errorf("Expected to find other author's post before block")
+		}
+	})
+
+	// Step 2: Create block
+	_, err = db.ExecContext(ctx, `
+		INSERT INTO user_blocks (blocker_did, blocked_did, record_uri, record_cid)
+		VALUES ($1, $2, $3, $4)
+	`, viewerDID, blockedAuthorDID,
+		fmt.Sprintf("at://%s/social.coves.actor.block/tlblock%d", viewerDID, testID),
+		"bafytimelineblock")
+	if err != nil {
+		t.Fatalf("Failed to insert user block: %v", err)
+	}
+
+	// Step 3: Verify blocked author's post is filtered from timeline
+	t.Run("blocked author posts filtered from timeline", func(t *testing.T) {
+		req := timeline.GetTimelineRequest{
+			UserDID: viewerDID,
+			Sort:    "new",
+			Limit:   50,
+		}
+		posts, _, err := timelineRepo.GetTimeline(ctx, req)
+		if err != nil {
+			t.Fatalf("GetTimeline with block failed: %v", err)
+		}
+		if timelineContainsPost(posts, blockedPostURI) {
+			t.Errorf("Blocked author's post should NOT appear in viewer's timeline")
+		}
+		// Positive assertion: non-blocked author's post must remain visible
+		if !timelineContainsPost(posts, otherPostURI) {
+			t.Errorf("Non-blocked author's post should still appear in viewer's timeline")
+		}
+	})
+}
+
+// commentListContains checks if a list of comments contains one with the given URI
+func commentListContains(list []*comments.Comment, uri string) bool {
+	for _, c := range list {
+		if c.URI == uri {
+			return true
+		}
+	}
+	return false
+}
+
+// timelineContainsPost checks if a timeline feed result contains a post with the given URI
+func timelineContainsPost(posts []*timeline.FeedViewPost, uri string) bool {
+	for _, p := range posts {
+		if p.Post != nil && p.Post.URI == uri {
+			return true
+		}
+	}
+	return false
+}
+
+// feedContainsPost checks if a community feed result contains a post with the given URI
+func feedContainsPost(posts []*communityFeeds.FeedViewPost, uri string) bool {
+	for _, p := range posts {
+		if p.Post != nil && p.Post.URI == uri {
+			return true
+		}
+	}
+	return false
+}
+
+// discoverFeedContainsPost checks if a discover feed result contains a post with the given URI
+func discoverFeedContainsPost(posts []*discover.FeedViewPost, uri string) bool {
+	for _, p := range posts {
+		if p.Post != nil && p.Post.URI == uri {
+			return true
+		}
+	}
+	return false
+}
+
+// cleanupUserBlockEnforcementTestData removes test data created by block enforcement tests
+func cleanupUserBlockEnforcementTestData(t *testing.T, db *sql.DB, blockerDID, posterDID, communityName, ownerHandle string) {
+	t.Helper()
+
+	communityDID := fmt.Sprintf("did:plc:community-%s", communityName)
+	// createFeedTestCommunity builds ownerDID as "did:plc:{ownerHandle}" — match that here
+	ownerDID := fmt.Sprintf("did:plc:%s", ownerHandle)
+
+	// Delete in dependency order: blocks, posts, community subscriptions, communities, users
+	if _, err := db.Exec("DELETE FROM user_blocks WHERE blocker_did = $1 AND blocked_did = $2", blockerDID, posterDID); err != nil {
+		t.Logf("Warning: Failed to clean up user blocks: %v", err)
+	}
+	if _, err := db.Exec("DELETE FROM posts WHERE community_did = $1", communityDID); err != nil {
+		t.Logf("Warning: Failed to clean up posts: %v", err)
+	}
+	if _, err := db.Exec("DELETE FROM communities WHERE did = $1", communityDID); err != nil {
+		t.Logf("Warning: Failed to clean up communities: %v", err)
+	}
+	if _, err := db.Exec("DELETE FROM users WHERE did IN ($1, $2, $3)", blockerDID, posterDID, ownerDID); err != nil {
+		t.Logf("Warning: Failed to clean up users: %v", err)
+	}
+}

tests/integration/userblock_handler_test.go

···
+package integration
+
+import (
+	"Coves/internal/api/routes"
+	"Coves/internal/atproto/pds"
+	"Coves/internal/core/blobs"
+	"Coves/internal/core/userblocks"
+	"Coves/internal/db/postgres"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth"
+	"github.com/go-chi/chi/v5"
+)
+
+// mockPDSClient implements pds.Client for handler tests without a real PDS.
+// Tracks created and deleted records for verification in tests.
+type mockPDSClient struct {
+	did            string
+	mu             sync.Mutex
+	createdRecords map[string]bool
+	deletedRecords []string // collection/rkey pairs
+	createErr      error    // if set, CreateRecord returns this error
+}
+
+func newMockPDSClient(did string) *mockPDSClient {
+	return &mockPDSClient{
+		did:            did,
+		createdRecords: make(map[string]bool),
+	}
+}
+
+func (m *mockPDSClient) CreateRecord(_ context.Context, collection string, rkey string, _ any) (string, string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.createErr != nil {
+		return "", "", m.createErr
+	}
+	uri := fmt.Sprintf("at://%s/%s/%s", m.did, collection, rkey)
+	m.createdRecords[uri] = true
+	return uri, "bafymockrecordcid", nil
+}
+
+func (m *mockPDSClient) DeleteRecord(_ context.Context, collection string, rkey string) error {
+	m.mu.Lock()
+	m.deletedRecords = append(m.deletedRecords, collection+"/"+rkey)
+	m.mu.Unlock()
+	return nil
+}
+
+func (m *mockPDSClient) ListRecords(_ context.Context, _ string, _ int, _ string) (*pds.ListRecordsResponse, error) {
+	return &pds.ListRecordsResponse{}, nil
+}
+
+func (m *mockPDSClient) GetRecord(_ context.Context, _ string, _ string) (*pds.RecordResponse, error) {
+	return &pds.RecordResponse{}, nil
+}
+
+func (m *mockPDSClient) PutRecord(_ context.Context, _ string, _ string, _ any, _ string) (string, string, error) {
+	return "", "", nil
+}
+
+func (m *mockPDSClient) UploadBlob(_ context.Context, _ []byte, _ string) (*blobs.BlobRef, error) {
+	return nil, nil
+}
+
+func (m *mockPDSClient) DID() string {
+	return m.did
+}
+
+func (m *mockPDSClient) HostURL() string {
+	return "http://localhost:3001"
+}
+
+// DeleteCallCount returns the number of DeleteRecord calls made.
+func (m *mockPDSClient) DeleteCallCount() int {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return len(m.deletedRecords)
+}
+
+// mockPDSTracker manages per-session mock PDS clients so tests can inspect PDS interactions.
+type mockPDSTracker struct {
+	mu      sync.Mutex
+	clients map[string]*mockPDSClient // DID -> client
+}
+
+func newMockPDSTracker() *mockPDSTracker {
+	return &mockPDSTracker{clients: make(map[string]*mockPDSClient)}
+}
+
+// Factory returns a PDSClientFactory that creates per-session mock clients.
+func (t *mockPDSTracker) Factory() userblocks.PDSClientFactory {
+	return func(_ context.Context, session *oauthlib.ClientSessionData) (pds.Client, error) {
+		did := session.AccountDID.String()
+		t.mu.Lock()
+		defer t.mu.Unlock()
+		if c, ok := t.clients[did]; ok {
+			return c, nil
+		}
+		c := newMockPDSClient(did)
+		t.clients[did] = c
+		return c, nil
+	}
+}
+
+// ClientFor returns the mock PDS client for the given DID.
+func (t *mockPDSTracker) ClientFor(did string) *mockPDSClient {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.clients[did]
+}
+
+// userBlockTestEnv bundles all resources created by setupUserBlockTestServer.
+type userBlockTestEnv struct {
+	Server     *httptest.Server
+	Auth       *E2EOAuthMiddleware
+	Repo       userblocks.Repository
+	PDSTracker *mockPDSTracker
+}
+
+// setupUserBlockTestServer creates a test HTTP server with userblock routes wired up.
+func setupUserBlockTestServer(t *testing.T) *userBlockTestEnv {
+	t.Helper()
+
+	db := setupTestDB(t)
+	t.Cleanup(func() {
+		// Clean up user_blocks before closing db
+		_, _ = db.Exec("DELETE FROM user_blocks")
+		if err := db.Close(); err != nil {
+			t.Logf("Failed to close database: %v", err)
+		}
+	})
+
+	// Clean up user_blocks from any prior runs
+	_, _ = db.Exec("DELETE FROM user_blocks")
+
+	repo := postgres.NewUserBlockRepository(db)
+	tracker := newMockPDSTracker()
+	service := userblocks.NewServiceWithPDSFactory(repo, nil, tracker.Factory())
+
+	e2eAuth := NewE2EOAuthMiddleware()
+
+	r := chi.NewRouter()
+	routes.RegisterUserBlockRoutes(r, service, e2eAuth.OAuthAuthMiddleware)
+
+	server := httptest.NewServer(r)
+	t.Cleanup(func() { server.Close() })
+
+	return &userBlockTestEnv{
+		Server:     server,
+		Auth:       e2eAuth,
+		Repo:       repo,
+		PDSTracker: tracker,
+	}
+}
+
+// postXRPC sends a POST request to an XRPC endpoint and returns the response.
+// Fails the test on marshaling or request creation errors.
+func postXRPC(t *testing.T, serverURL, path, token string, body any) *http.Response {
+	t.Helper()
+
+	reqBody, err := json.Marshal(body)
+	if err != nil {
+		t.Fatalf("Failed to marshal request body: %v", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, serverURL+path, bytes.NewBuffer(reqBody))
+	if err != nil {
+		t.Fatalf("Failed to create request: %v", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("Failed to execute request to %s: %v", path, err)
+	}
+
+	return resp
+}
+
+// getXRPC sends a GET request to an XRPC endpoint and returns the response.
+func getXRPC(t *testing.T, serverURL, path, token string) *http.Response {
+	t.Helper()
+
+	req, err := http.NewRequest(http.MethodGet, serverURL+path, nil)
+	if err != nil {
+		t.Fatalf("Failed to create request: %v", err)
+	}
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("Failed to execute request to %s: %v", path, err)
+	}
+
+	return resp
+}
+
+// TestUserBlockHandler_BlockUser tests the block user endpoint
+func TestUserBlockHandler_BlockUser(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	blockerDID := "did:plc:blocker123"
+	targetDID := "did:plc:target456"
+	token := env.Auth.AddUser(blockerDID)
+
+	resp := postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", token, map[string]string{
+		"subject": targetDID,
+	})
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 200, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var blockResp struct {
+		Block struct {
+			RecordURI string `json:"recordUri"`
+			RecordCID string `json:"recordCid"`
+		} `json:"block"`
+	}
+
+	if decodeErr := json.NewDecoder(resp.Body).Decode(&blockResp); decodeErr != nil {
+		t.Fatalf("Failed to decode response: %v", decodeErr)
+	}
+
+	if blockResp.Block.RecordURI == "" {
+		t.Error("Expected non-empty recordUri in response")
+	}
+	if blockResp.Block.RecordCID == "" {
+		t.Error("Expected non-empty recordCid in response")
+	}
+
+	// Verify the record URI contains the blocker's actual DID (not a hardcoded mock DID)
+	if !strings.Contains(blockResp.Block.RecordURI, blockerDID) {
+		t.Errorf("Expected recordUri to contain blocker DID %q, got %q", blockerDID, blockResp.Block.RecordURI)
+	}
+
+	// Simulate Jetstream indexing by inserting directly into repo
+	// (In a real E2E test, the Jetstream consumer would handle this)
+	ctx := context.Background()
+	_, repoErr := env.Repo.BlockUser(ctx, &userblocks.UserBlock{
+		BlockerDID: blockerDID,
+		BlockedDID: targetDID,
+		BlockedAt:  time.Now(),
+		RecordURI:  blockResp.Block.RecordURI,
+		RecordCID:  blockResp.Block.RecordCID,
+	})
+	if repoErr != nil {
+		t.Fatalf("Failed to index block in repo: %v", repoErr)
+	}
+
+	// Verify block exists in AppView
+	isBlocked, checkErr := env.Repo.IsBlocked(ctx, blockerDID, targetDID)
+	if checkErr != nil {
+		t.Fatalf("Failed to check block: %v", checkErr)
+	}
+	if !isBlocked {
+		t.Error("Expected user to be blocked after block request")
+	}
+}
+
+// TestUserBlockHandler_BlockUser_MissingSubject tests blocking with missing subject
+func TestUserBlockHandler_BlockUser_MissingSubject(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	blockerDID := "did:plc:blocker789"
+	token := env.Auth.AddUser(blockerDID)
+
+	resp := postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", token, map[string]string{})
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 400, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var errResp struct {
+		Error   string `json:"error"`
+		Message string `json:"message"`
+	}
+	if decodeErr := json.NewDecoder(resp.Body).Decode(&errResp); decodeErr != nil {
+		t.Fatalf("Failed to decode error response: %v", decodeErr)
+	}
+
+	if errResp.Error != "InvalidRequest" {
+		t.Errorf("Expected error code 'InvalidRequest', got %q", errResp.Error)
+	}
+	if !strings.Contains(errResp.Message, "subject") {
+		t.Errorf("Expected error message to mention 'subject', got %q", errResp.Message)
+	}
+}
+
+// TestUserBlockHandler_BlockUser_Unauthenticated tests blocking without auth
+func TestUserBlockHandler_BlockUser_Unauthenticated(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	// No token — unauthenticated request
+	resp := postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", "", map[string]string{
+		"subject": "did:plc:target",
+	})
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusUnauthorized {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 401, got %d: %s", resp.StatusCode, string(body))
+	}
+}
+
+// TestUserBlockHandler_BlockUser_SelfBlock tests that self-blocking returns 400
+func TestUserBlockHandler_BlockUser_SelfBlock(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	selfDID := "did:plc:selfblock"
+	token := env.Auth.AddUser(selfDID)
+
+	resp := postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", token, map[string]string{
+		"subject": selfDID,
+	})
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 400, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var errResp struct {
+		Error   string `json:"error"`
+		Message string `json:"message"`
+	}
+	if decodeErr := json.NewDecoder(resp.Body).Decode(&errResp); decodeErr != nil {
+		t.Fatalf("Failed to decode error response: %v", decodeErr)
+	}
+
+	if !strings.Contains(errResp.Message, "block yourself") {
+		t.Errorf("Expected error message about self-blocking, got %q", errResp.Message)
+	}
+}
+
+// TestUserBlockHandler_UnblockUser tests the unblock user endpoint
+func TestUserBlockHandler_UnblockUser(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	blockerDID := "did:plc:unblocker1"
+	targetDID := "did:plc:unblockee1"
+	token := env.Auth.AddUser(blockerDID)
+
+	ctx := context.Background()
+
+	// First, create a block via the API
+	blockResp := postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", token, map[string]string{
+		"subject": targetDID,
+	})
+
+	var blockResult struct {
+		Block struct {
+			RecordURI string `json:"recordUri"`
+			RecordCID string `json:"recordCid"`
+		} `json:"block"`
+	}
+	if decodeErr := json.NewDecoder(blockResp.Body).Decode(&blockResult); decodeErr != nil {
+		t.Fatalf("Failed to decode block response: %v", decodeErr)
+	}
+	_ = blockResp.Body.Close()
+
+	// Simulate Jetstream indexing: insert block record into AppView repo
+	_, repoErr := env.Repo.BlockUser(ctx, &userblocks.UserBlock{
+		BlockerDID: blockerDID,
+		BlockedDID: targetDID,
+		BlockedAt:  time.Now(),
+		RecordURI:  blockResult.Block.RecordURI,
+		RecordCID:  blockResult.Block.RecordCID,
+	})
+	if repoErr != nil {
+		t.Fatalf("Failed to index block: %v", repoErr)
+	}
+
+	// Verify block exists before unblock
+	isBlocked, err := env.Repo.IsBlocked(ctx, blockerDID, targetDID)
+	if err != nil {
+		t.Fatalf("Failed to check block: %v", err)
+	}
+	if !isBlocked {
+		t.Fatal("Expected block to exist before unblock")
+	}
+
+	// Now unblock
+	unblockResp := postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.unblockUser", token, map[string]string{
+		"subject": targetDID,
+	})
+	defer func() { _ = unblockResp.Body.Close() }()
+
+	if unblockResp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(unblockResp.Body)
+		t.Fatalf("Expected 200, got %d: %s", unblockResp.StatusCode, string(body))
+	}
+
+	var unblockResult struct {
+		Success bool `json:"success"`
+	}
+	if decodeErr := json.NewDecoder(unblockResp.Body).Decode(&unblockResult); decodeErr != nil {
+		t.Fatalf("Failed to decode unblock response: %v", decodeErr)
+	}
+
+	if !unblockResult.Success {
+		t.Error("Expected success: true in unblock response")
+	}
+
+	// Verify PDS DeleteRecord was actually called
+	mockClient := env.PDSTracker.ClientFor(blockerDID)
+	if mockClient == nil {
+		t.Fatal("Expected mock PDS client to exist for blocker")
+	}
+	if mockClient.DeleteCallCount() == 0 {
+		t.Error("Expected PDS DeleteRecord to be called during unblock, but it was never called")
+	}
+
+	// Simulate Jetstream processing the delete and verify block removal from AppView.
+	// In production, the Jetstream consumer removes the block from the repo.
+	// Here we manually remove it to verify the full flow.
+	if removeErr := env.Repo.UnblockUser(ctx, blockerDID, targetDID); removeErr != nil {
+		t.Fatalf("Failed to remove block from repo: %v", removeErr)
+	}
+
+	isBlockedAfter, checkErr := env.Repo.IsBlocked(ctx, blockerDID, targetDID)
+	if checkErr != nil {
+		t.Fatalf("Failed to check block after unblock: %v", checkErr)
+	}
+	if isBlockedAfter {
+		t.Error("Expected block to be removed from AppView after unblock")
+	}
+}
+
+// TestUserBlockHandler_GetBlockedUsers tests listing blocked users
+func TestUserBlockHandler_GetBlockedUsers(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	blockerDID := "did:plc:lister1"
+	target1DID := "did:plc:listed1"
+	target2DID := "did:plc:listed2"
+	token := env.Auth.AddUser(blockerDID)
+
+	ctx := context.Background()
+
+	// Index two blocks directly in the repo (simulating Jetstream indexing)
+	_, err := env.Repo.BlockUser(ctx, &userblocks.UserBlock{
+		BlockerDID: blockerDID,
+		BlockedDID: target1DID,
+		BlockedAt:  time.Now().Add(-1 * time.Minute),
+		RecordURI:  fmt.Sprintf("at://%s/social.coves.actor.block/tid1", blockerDID),
+		RecordCID:  "bafyblock1",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create block 1: %v", err)
+	}
+
+	_, err = env.Repo.BlockUser(ctx, &userblocks.UserBlock{
+		BlockerDID: blockerDID,
+		BlockedDID: target2DID,
+		BlockedAt:  time.Now(),
+		RecordURI:  fmt.Sprintf("at://%s/social.coves.actor.block/tid2", blockerDID),
+		RecordCID:  "bafyblock2",
+	})
+	if err != nil {
+		t.Fatalf("Failed to create block 2: %v", err)
+	}
+
+	resp := getXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.getBlockedUsers?limit=10", token)
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 200, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var listResp struct {
+		Blocks []struct {
+			BlockedDID string `json:"blockedDid"`
+			RecordURI  string `json:"recordUri"`
+			RecordCID  string `json:"recordCid"`
+		} `json:"blocks"`
+	}
+	if decodeErr := json.NewDecoder(resp.Body).Decode(&listResp); decodeErr != nil {
+		t.Fatalf("Failed to decode list response: %v", decodeErr)
+	}
+
+	if len(listResp.Blocks) != 2 {
+		t.Fatalf("Expected 2 blocks, got %d", len(listResp.Blocks))
+	}
+
+	// Verify both target DIDs are present
+	foundDIDs := make(map[string]bool)
+	for _, b := range listResp.Blocks {
+		foundDIDs[b.BlockedDID] = true
+		if b.RecordURI == "" {
+			t.Error("Expected non-empty recordUri")
+		}
+		if b.RecordCID == "" {
+			t.Error("Expected non-empty recordCid")
+		}
+	}
+
+	if !foundDIDs[target1DID] {
+		t.Errorf("Expected %s in blocked list", target1DID)
+	}
+	if !foundDIDs[target2DID] {
+		t.Errorf("Expected %s in blocked list", target2DID)
+	}
+}
+
+// TestUserBlockHandler_GetBlockedUsers_Unauthenticated tests that getBlockedUsers requires auth
+func TestUserBlockHandler_GetBlockedUsers_Unauthenticated(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	// No token — unauthenticated request
+	resp := getXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.getBlockedUsers", "")
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusUnauthorized {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 401, got %d: %s", resp.StatusCode, string(body))
+	}
+}
+
+// TestUserBlockHandler_BlockUser_DuplicateConflict tests that blocking a user who is
+// already blocked on PDS returns the existing block (via repo lookup) or 409 Conflict.
+func TestUserBlockHandler_BlockUser_DuplicateConflict(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	blockerDID := "did:plc:conflict-blocker"
+	targetDID := "did:plc:conflict-target"
+	token := env.Auth.AddUser(blockerDID)
+
+	ctx := context.Background()
+
+	// Pre-index an existing block in the AppView repo (as if Jetstream already processed it)
+	existingURI := fmt.Sprintf("at://%s/social.coves.actor.block/existing1", blockerDID)
+	existingCID := "bafyexistingcid"
+	_, err := env.Repo.BlockUser(ctx, &userblocks.UserBlock{
+		BlockerDID: blockerDID,
+		BlockedDID: targetDID,
+		BlockedAt:  time.Now(),
+		RecordURI:  existingURI,
+		RecordCID:  existingCID,
+	})
+	if err != nil {
+		t.Fatalf("Failed to pre-index block: %v", err)
+	}
+
+	// Configure mock PDS to return conflict error (simulating duplicate record on PDS)
+	mockClient := env.PDSTracker.ClientFor(blockerDID)
+	if mockClient == nil {
+		// Trigger client creation by making any authenticated request first
+		_ = postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", token, map[string]string{
+			"subject": "did:plc:dummy",
+		})
+		mockClient = env.PDSTracker.ClientFor(blockerDID)
+	}
+	mockClient.mu.Lock()
+	mockClient.createErr = fmt.Errorf("conflict: %w", pds.ErrConflict)
+	mockClient.mu.Unlock()
+
+	// Attempt to block the same user again — PDS returns conflict
+	resp := postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", token, map[string]string{
+		"subject": targetDID,
+	})
+	defer func() { _ = resp.Body.Close() }()
+
+	// The service should find the existing block in the repo and return it
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 200 (existing block returned), got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var blockResp struct {
+		Block struct {
+			RecordURI string `json:"recordUri"`
+			RecordCID string `json:"recordCid"`
+		} `json:"block"`
+	}
+	if decodeErr := json.NewDecoder(resp.Body).Decode(&blockResp); decodeErr != nil {
+		t.Fatalf("Failed to decode response: %v", decodeErr)
+	}
+
+	if blockResp.Block.RecordURI != existingURI {
+		t.Errorf("Expected existing RecordURI=%s, got %s", existingURI, blockResp.Block.RecordURI)
+	}
+	if blockResp.Block.RecordCID != existingCID {
+		t.Errorf("Expected existing RecordCID=%s, got %s", existingCID, blockResp.Block.RecordCID)
+	}
+}
+
+// TestUserBlockHandler_BlockUser_DuplicateConflict_NotIndexed tests the 409 path when
+// PDS returns conflict but the block hasn't been indexed in AppView yet.
+func TestUserBlockHandler_BlockUser_DuplicateConflict_NotIndexed(t *testing.T) {
+	env := setupUserBlockTestServer(t)
+
+	blockerDID := "did:plc:conflict-noindex-blocker"
+	targetDID := "did:plc:conflict-noindex-target"
+	token := env.Auth.AddUser(blockerDID)
+
+	// Force mock PDS client creation, then set conflict error
+	_ = postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", token, map[string]string{
+		"subject": "did:plc:warmup",
+	})
+	mockClient := env.PDSTracker.ClientFor(blockerDID)
+	mockClient.mu.Lock()
+	mockClient.createErr = fmt.Errorf("conflict: %w", pds.ErrConflict)
+	mockClient.mu.Unlock()
+
+	// Block target — PDS says conflict, but repo has no block → should return 409
+	resp := postXRPC(t, env.Server.URL, "/xrpc/social.coves.actor.blockUser", token, map[string]string{
+		"subject": targetDID,
+	})
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusConflict {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("Expected 409, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var errResp struct {
+		Error   string `json:"error"`
+		Message string `json:"message"`
+	}
+	if decodeErr := json.NewDecoder(resp.Body).Decode(&errResp); decodeErr != nil {
+		t.Fatalf("Failed to decode error response: %v", decodeErr)
+	}
+
+	if errResp.Error != "AlreadyExists" {
+		t.Errorf("Expected error code 'AlreadyExists', got %q", errResp.Error)
+	}
+}

tests/integration/userblock_indexing_test.go

···
+package integration
+
+import (
+	"Coves/internal/atproto/jetstream"
+	"Coves/internal/core/userblocks"
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	postgresRepo "Coves/internal/db/postgres"
+)
+
+// TestUserBlockIndexing_CreateEvent tests that a Jetstream CREATE event for
+// social.coves.actor.block is properly indexed in the AppView.
+func TestUserBlockIndexing_CreateEvent(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+	consumer := createUserBlockConsumer(t, repo)
+
+	blockerDID := "did:plc:test-blocker-create"
+	blockedDID := "did:plc:test-blocked-create"
+	rkey := "test-block-create-1"
+
+	// Simulate Jetstream CREATE event
+	event := &jetstream.JetstreamEvent{
+		Did:    blockerDID,
+		Kind:   "commit",
+		TimeUS: time.Now().UnixMicro(),
+		Commit: &jetstream.CommitEvent{
+			Rev:        "test-rev-1",
+			Operation:  "create",
+			Collection: "social.coves.actor.block",
+			RKey:       rkey,
+			CID:        "bafyuserblock123",
+			Record: map[string]interface{}{
+				"$type":     "social.coves.actor.block",
+				"subject":   blockedDID,
+				"createdAt": time.Now().Format(time.RFC3339),
+			},
+		},
+	}
+
+	// Process event through the consumer
+	err := consumer.HandleEvent(ctx, event)
+	if err != nil {
+		t.Fatalf("Failed to handle block CREATE event: %v", err)
+	}
+
+	// Verify block indexed in AppView via repo.GetBlock()
+	block, err := repo.GetBlock(ctx, blockerDID, blockedDID)
+	if err != nil {
+		t.Fatalf("Failed to get block after indexing: %v", err)
+	}
+
+	if block.BlockerDID != blockerDID {
+		t.Errorf("Expected blockerDID=%s, got %s", blockerDID, block.BlockerDID)
+	}
+	if block.BlockedDID != blockedDID {
+		t.Errorf("Expected blockedDID=%s, got %s", blockedDID, block.BlockedDID)
+	}
+
+	expectedURI := fmt.Sprintf("at://%s/social.coves.actor.block/%s", blockerDID, rkey)
+	if block.RecordURI != expectedURI {
+		t.Errorf("Expected recordURI=%s, got %s", expectedURI, block.RecordURI)
+	}
+	if block.RecordCID != "bafyuserblock123" {
+		t.Errorf("Expected recordCID=bafyuserblock123, got %s", block.RecordCID)
+	}
+
+	// Verify IsBlocked returns true
+	isBlocked, err := repo.IsBlocked(ctx, blockerDID, blockedDID)
+	if err != nil {
+		t.Fatalf("IsBlocked failed: %v", err)
+	}
+	if !isBlocked {
+		t.Error("Expected IsBlocked=true, got false")
+	}
+}
+
+// TestUserBlockIndexing_DeleteEvent tests that a Jetstream DELETE event
+// properly removes a previously indexed block from the AppView.
+func TestUserBlockIndexing_DeleteEvent(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+	consumer := createUserBlockConsumer(t, repo)
+
+	blockerDID := "did:plc:test-blocker-delete"
+	blockedDID := "did:plc:test-blocked-delete"
+	rkey := "test-block-delete-1"
+	uri := fmt.Sprintf("at://%s/social.coves.actor.block/%s", blockerDID, rkey)
+
+	// Pre-index a block in AppView via repo.BlockUser()
+	block := &userblocks.UserBlock{
+		BlockerDID: blockerDID,
+		BlockedDID: blockedDID,
+		BlockedAt:  time.Now(),
+		RecordURI:  uri,
+		RecordCID:  "bafyuserblock456",
+	}
+	_, err := repo.BlockUser(ctx, block)
+	if err != nil {
+		t.Fatalf("Failed to pre-index block: %v", err)
+	}
+
+	// Verify block exists before delete
+	isBlocked, err := repo.IsBlocked(ctx, blockerDID, blockedDID)
+	if err != nil {
+		t.Fatalf("IsBlocked failed: %v", err)
+	}
+	if !isBlocked {
+		t.Fatal("Expected block to exist before DELETE event")
+	}
+
+	// Simulate Jetstream DELETE event (no record data, just rkey)
+	event := &jetstream.JetstreamEvent{
+		Did:    blockerDID,
+		Kind:   "commit",
+		TimeUS: time.Now().UnixMicro(),
+		Commit: &jetstream.CommitEvent{
+			Rev:        "test-rev-2",
+			Operation:  "delete",
+			Collection: "social.coves.actor.block",
+			RKey:       rkey,
+		},
+	}
+
+	// Process delete event
+	err = consumer.HandleEvent(ctx, event)
+	if err != nil {
+		t.Fatalf("Failed to handle block DELETE event: %v", err)
+	}
+
+	// Verify block removed via repo.IsBlocked() == false
+	isBlocked, err = repo.IsBlocked(ctx, blockerDID, blockedDID)
+	if err != nil {
+		t.Fatalf("IsBlocked failed after delete: %v", err)
+	}
+	if isBlocked {
+		t.Error("Expected IsBlocked=false after DELETE event, got true")
+	}
+
+	// Also verify GetBlock returns ErrBlockNotFound
+	_, err = repo.GetBlock(ctx, blockerDID, blockedDID)
+	if !userblocks.IsNotFound(err) {
+		t.Errorf("Expected ErrBlockNotFound after delete, got: %v", err)
+	}
+}
+
+// TestUserBlockIndexing_Idempotent tests that processing the same CREATE event
+// twice results in only 1 block (idempotent via ON CONFLICT DO UPDATE).
+func TestUserBlockIndexing_Idempotent(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+	consumer := createUserBlockConsumer(t, repo)
+
+	blockerDID := "did:plc:test-blocker-idempotent"
+	blockedDID := "did:plc:test-blocked-idempotent"
+	rkey := "test-block-idempotent-1"
+
+	event := &jetstream.JetstreamEvent{
+		Did:    blockerDID,
+		Kind:   "commit",
+		TimeUS: time.Now().UnixMicro(),
+		Commit: &jetstream.CommitEvent{
+			Rev:        "test-rev-3",
+			Operation:  "create",
+			Collection: "social.coves.actor.block",
+			RKey:       rkey,
+			CID:        "bafyuserblock789",
+			Record: map[string]interface{}{
+				"$type":     "social.coves.actor.block",
+				"subject":   blockedDID,
+				"createdAt": time.Now().Format(time.RFC3339),
+			},
+		},
+	}
+
+	// Process event twice
+	err := consumer.HandleEvent(ctx, event)
+	if err != nil {
+		t.Fatalf("First block CREATE failed: %v", err)
+	}
+
+	err = consumer.HandleEvent(ctx, event)
+	if err != nil {
+		t.Fatalf("Second block CREATE (idempotent) failed: %v", err)
+	}
+
+	// Verify only 1 block exists via ListBlockedUsers
+	blocks, err := repo.ListBlockedUsers(ctx, blockerDID, 10, 0)
+	if err != nil {
+		t.Fatalf("ListBlockedUsers failed: %v", err)
+	}
+	if len(blocks) != 1 {
+		t.Errorf("Expected 1 block after idempotent create, got %d", len(blocks))
+	}
+}
+
+// TestUserBlockIndexing_DeleteNonExistent tests that a DELETE event for a
+// non-existent block does not error (graceful/idempotent).
+func TestUserBlockIndexing_DeleteNonExistent(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+	consumer := createUserBlockConsumer(t, repo)
+
+	blockerDID := "did:plc:test-blocker-nonexistent"
+	rkey := "test-block-nonexistent"
+
+	// Simulate DELETE event for block that doesn't exist
+	event := &jetstream.JetstreamEvent{
+		Did:    blockerDID,
+		Kind:   "commit",
+		TimeUS: time.Now().UnixMicro(),
+		Commit: &jetstream.CommitEvent{
+			Rev:        "test-rev-99",
+			Operation:  "delete",
+			Collection: "social.coves.actor.block",
+			RKey:       rkey,
+		},
+	}
+
+	// Should not error (idempotent)
+	err := consumer.HandleEvent(ctx, event)
+	if err != nil {
+		t.Errorf("DELETE of non-existent block should be idempotent, got error: %v", err)
+	}
+}
+
+// Helper functions for user block indexing tests
+
+// createUserBlockConsumer creates a UserEventConsumer configured with a user block
+// repo for testing. Uses nil for userService and identityResolver since block
+// handling doesn't need them.
+func createUserBlockConsumer(t *testing.T, repo userblocks.Repository) *jetstream.UserEventConsumer {
+	t.Helper()
+	return jetstream.NewUserEventConsumer(nil, nil, "", "", jetstream.WithUserBlockRepo(repo))
+}
+
+// cleanupUserBlockTestDB is defined in userblock_repo_test.go

tests/integration/userblock_repo_test.go

···
+package integration
+
+import (
+	"Coves/internal/core/userblocks"
+	"context"
+	"database/sql"
+	"fmt"
+	"testing"
+	"time"
+
+	postgresRepo "Coves/internal/db/postgres"
+)
+
+// TestUserBlockRepo_BlockUser tests creating user blocks
+func TestUserBlockRepo_BlockUser(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+
+	t.Run("creates block successfully", func(t *testing.T) {
+		// Save expected values independently — BlockUser mutates the input pointer,
+		// so comparing created vs block fields would be self-referential.
+		expectedBlockerDID := "did:plc:test-blocker-1"
+		expectedBlockedDID := "did:plc:test-blocked-1"
+		expectedRecordURI := "at://did:plc:test-blocker-1/social.coves.actor.block/abc123"
+		expectedRecordCID := "bafyblock123"
+
+		block := &userblocks.UserBlock{
+			BlockerDID: expectedBlockerDID,
+			BlockedDID: expectedBlockedDID,
+			BlockedAt:  time.Now(),
+			RecordURI:  expectedRecordURI,
+			RecordCID:  expectedRecordCID,
+		}
+
+		created, err := repo.BlockUser(ctx, block)
+		if err != nil {
+			t.Fatalf("BlockUser failed: %v", err)
+		}
+
+		if created.ID == 0 {
+			t.Error("Expected non-zero ID")
+		}
+		if created.BlockerDID != expectedBlockerDID {
+			t.Errorf("Expected BlockerDID=%s, got %s", expectedBlockerDID, created.BlockerDID)
+		}
+		if created.BlockedDID != expectedBlockedDID {
+			t.Errorf("Expected BlockedDID=%s, got %s", expectedBlockedDID, created.BlockedDID)
+		}
+		if created.RecordURI != expectedRecordURI {
+			t.Errorf("Expected RecordURI=%s, got %s", expectedRecordURI, created.RecordURI)
+		}
+		if created.RecordCID != expectedRecordCID {
+			t.Errorf("Expected RecordCID=%s, got %s", expectedRecordCID, created.RecordCID)
+		}
+	})
+
+	t.Run("idempotent on duplicate block", func(t *testing.T) {
+		blockerDID := "did:plc:test-blocker-idem"
+		blockedDID := "did:plc:test-blocked-idem"
+
+		block1 := &userblocks.UserBlock{
+			BlockerDID: blockerDID,
+			BlockedDID: blockedDID,
+			BlockedAt:  time.Now(),
+			RecordURI:  "at://did:plc:test-blocker-idem/social.coves.actor.block/first",
+			RecordCID:  "bafyfirst",
+		}
+
+		firstBlock, err := repo.BlockUser(ctx, block1)
+		if err != nil {
+			t.Fatalf("First BlockUser failed: %v", err)
+		}
+		firstBlockID := firstBlock.ID
+
+		// Insert again with updated URI/CID (ON CONFLICT DO UPDATE)
+		expectedURI := "at://did:plc:test-blocker-idem/social.coves.actor.block/second"
+		expectedCID := "bafysecond"
+		block2 := &userblocks.UserBlock{
+			BlockerDID: blockerDID,
+			BlockedDID: blockedDID,
+			BlockedAt:  time.Now(),
+			RecordURI:  expectedURI,
+			RecordCID:  expectedCID,
+		}
+
+		updated, err := repo.BlockUser(ctx, block2)
+		if err != nil {
+			t.Fatalf("Second BlockUser (idempotent) failed: %v", err)
+		}
+
+		// Core invariant: row identity should be stable across upsert
+		if updated.ID != firstBlockID {
+			t.Errorf("Expected stable row ID=%d after upsert, got %d", firstBlockID, updated.ID)
+		}
+
+		// Should have updated URI/CID
+		if updated.RecordURI != expectedURI {
+			t.Errorf("Expected updated RecordURI=%s, got %s", expectedURI, updated.RecordURI)
+		}
+		if updated.RecordCID != expectedCID {
+			t.Errorf("Expected updated RecordCID=%s, got %s", expectedCID, updated.RecordCID)
+		}
+
+		// Should still be only 1 block
+		blocks, err := repo.ListBlockedUsers(ctx, blockerDID, 10, 0)
+		if err != nil {
+			t.Fatalf("ListBlockedUsers failed: %v", err)
+		}
+		if len(blocks) != 1 {
+			t.Errorf("Expected 1 block after idempotent insert, got %d", len(blocks))
+		}
+	})
+}
+
+// TestUserBlockRepo_UnblockUser tests removing user blocks
+func TestUserBlockRepo_UnblockUser(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+
+	t.Run("removes existing block", func(t *testing.T) {
+		blockerDID := "did:plc:test-unblocker-1"
+		blockedDID := "did:plc:test-unblocked-1"
+
+		// Create a block first
+		block := &userblocks.UserBlock{
+			BlockerDID: blockerDID,
+			BlockedDID: blockedDID,
+			BlockedAt:  time.Now(),
+			RecordURI:  "at://did:plc:test-unblocker-1/social.coves.actor.block/del1",
+			RecordCID:  "bafydel1",
+		}
+		_, err := repo.BlockUser(ctx, block)
+		if err != nil {
+			t.Fatalf("BlockUser failed: %v", err)
+		}
+
+		// Unblock
+		err = repo.UnblockUser(ctx, blockerDID, blockedDID)
+		if err != nil {
+			t.Fatalf("UnblockUser failed: %v", err)
+		}
+
+		// Verify removed
+		_, err = repo.GetBlock(ctx, blockerDID, blockedDID)
+		if !userblocks.IsNotFound(err) {
+			t.Errorf("Expected ErrBlockNotFound after unblock, got: %v", err)
+		}
+	})
+
+	t.Run("returns ErrBlockNotFound for non-existent block", func(t *testing.T) {
+		err := repo.UnblockUser(ctx, "did:plc:test-nonexistent-blocker", "did:plc:test-nonexistent-blocked")
+		if !userblocks.IsNotFound(err) {
+			t.Errorf("Expected ErrBlockNotFound, got: %v", err)
+		}
+	})
+}
+
+// TestUserBlockRepo_GetBlock tests block retrieval by blocker + blocked DID
+func TestUserBlockRepo_GetBlock(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+
+	blockerDID := "did:plc:test-getblock-blocker"
+	blockedDID := "did:plc:test-getblock-blocked"
+
+	t.Run("returns ErrBlockNotFound when not exists", func(t *testing.T) {
+		_, err := repo.GetBlock(ctx, blockerDID, blockedDID)
+		if !userblocks.IsNotFound(err) {
+			t.Errorf("Expected ErrBlockNotFound, got: %v", err)
+		}
+	})
+
+	t.Run("retrieves block by blocker + blocked DID", func(t *testing.T) {
+		recordURI := "at://did:plc:test-getblock-blocker/social.coves.actor.block/get1"
+		block := &userblocks.UserBlock{
+			BlockerDID: blockerDID,
+			BlockedDID: blockedDID,
+			BlockedAt:  time.Now(),
+			RecordURI:  recordURI,
+			RecordCID:  "bafyget1",
+		}
+		_, err := repo.BlockUser(ctx, block)
+		if err != nil {
+			t.Fatalf("BlockUser failed: %v", err)
+		}
+
+		retrieved, err := repo.GetBlock(ctx, blockerDID, blockedDID)
+		if err != nil {
+			t.Fatalf("GetBlock failed: %v", err)
+		}
+
+		if retrieved.BlockerDID != blockerDID {
+			t.Errorf("Expected BlockerDID=%s, got %s", blockerDID, retrieved.BlockerDID)
+		}
+		if retrieved.BlockedDID != blockedDID {
+			t.Errorf("Expected BlockedDID=%s, got %s", blockedDID, retrieved.BlockedDID)
+		}
+		if retrieved.RecordURI != recordURI {
+			t.Errorf("Expected RecordURI=%s, got %s", recordURI, retrieved.RecordURI)
+		}
+	})
+}
+
+// TestUserBlockRepo_GetBlockByURI tests block retrieval by record URI
+func TestUserBlockRepo_GetBlockByURI(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+
+	t.Run("retrieves block by record_uri", func(t *testing.T) {
+		recordURI := "at://did:plc:test-uri-blocker/social.coves.actor.block/uri1"
+		block := &userblocks.UserBlock{
+			BlockerDID: "did:plc:test-uri-blocker",
+			BlockedDID: "did:plc:test-uri-blocked",
+			BlockedAt:  time.Now(),
+			RecordURI:  recordURI,
+			RecordCID:  "bafyuri1",
+		}
+		_, err := repo.BlockUser(ctx, block)
+		if err != nil {
+			t.Fatalf("BlockUser failed: %v", err)
+		}
+
+		retrieved, err := repo.GetBlockByURI(ctx, recordURI)
+		if err != nil {
+			t.Fatalf("GetBlockByURI failed: %v", err)
+		}
+
+		if retrieved.RecordURI != recordURI {
+			t.Errorf("Expected RecordURI=%s, got %s", recordURI, retrieved.RecordURI)
+		}
+		if retrieved.BlockerDID != "did:plc:test-uri-blocker" {
+			t.Errorf("Expected BlockerDID=did:plc:test-uri-blocker, got %s", retrieved.BlockerDID)
+		}
+		if retrieved.BlockedDID != "did:plc:test-uri-blocked" {
+			t.Errorf("Expected BlockedDID=did:plc:test-uri-blocked, got %s", retrieved.BlockedDID)
+		}
+	})
+
+	t.Run("returns ErrBlockNotFound for unknown URI", func(t *testing.T) {
+		_, err := repo.GetBlockByURI(ctx, "at://did:plc:test-unknown/social.coves.actor.block/nonexistent")
+		if !userblocks.IsNotFound(err) {
+			t.Errorf("Expected ErrBlockNotFound, got: %v", err)
+		}
+	})
+}
+
+// TestUserBlockRepo_ListBlockedUsers tests listing blocked users with pagination
+func TestUserBlockRepo_ListBlockedUsers(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+
+	blockerDID := "did:plc:test-list-blocker"
+
+	// Use deterministic timestamps with clear ordering to avoid DB rounding issues.
+	// i=0 is oldest, i=2 is newest.
+	baseTime := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
+	blockedDIDs := make([]string, 3)
+	for i := 0; i < 3; i++ {
+		blockedDIDs[i] = fmt.Sprintf("did:plc:test-list-blocked-%d", i)
+		block := &userblocks.UserBlock{
+			BlockerDID: blockerDID,
+			BlockedDID: blockedDIDs[i],
+			BlockedAt:  baseTime.Add(time.Duration(i) * time.Hour),
+			RecordURI:  fmt.Sprintf("at://%s/social.coves.actor.block/list%d", blockerDID, i),
+			RecordCID:  fmt.Sprintf("bafylist%d", i),
+		}
+		_, err := repo.BlockUser(ctx, block)
+		if err != nil {
+			t.Fatalf("Failed to create block %d: %v", i, err)
+		}
+	}
+
+	t.Run("lists all blocked users in DESC order", func(t *testing.T) {
+		blocks, err := repo.ListBlockedUsers(ctx, blockerDID, 10, 0)
+		if err != nil {
+			t.Fatalf("ListBlockedUsers failed: %v", err)
+		}
+
+		if len(blocks) != 3 {
+			t.Fatalf("Expected 3 blocks, got %d", len(blocks))
+		}
+
+		// Verify all blocks belong to correct blocker
+		for _, block := range blocks {
+			if block.BlockerDID != blockerDID {
+				t.Errorf("Expected BlockerDID=%s, got %s", blockerDID, block.BlockerDID)
+			}
+		}
+
+		// Verify ORDER BY blocked_at DESC: most recently blocked first
+		if blocks[0].BlockedDID != blockedDIDs[2] {
+			t.Errorf("Expected first result (most recent) to be %s, got %s", blockedDIDs[2], blocks[0].BlockedDID)
+		}
+		if blocks[2].BlockedDID != blockedDIDs[0] {
+			t.Errorf("Expected last result (oldest) to be %s, got %s", blockedDIDs[0], blocks[2].BlockedDID)
+		}
+	})
+
+	t.Run("pagination works correctly", func(t *testing.T) {
+		// Get first 2
+		blocks, err := repo.ListBlockedUsers(ctx, blockerDID, 2, 0)
+		if err != nil {
+			t.Fatalf("ListBlockedUsers with limit failed: %v", err)
+		}
+		if len(blocks) != 2 {
+			t.Errorf("Expected 2 blocks (paginated), got %d", len(blocks))
+		}
+
+		// Get next page (should only get 1)
+		blocksPage2, err := repo.ListBlockedUsers(ctx, blockerDID, 2, 2)
+		if err != nil {
+			t.Fatalf("ListBlockedUsers page 2 failed: %v", err)
+		}
+		if len(blocksPage2) != 1 {
+			t.Errorf("Expected 1 block on page 2, got %d", len(blocksPage2))
+		}
+	})
+
+	t.Run("returns empty list for user with no blocks", func(t *testing.T) {
+		blocks, err := repo.ListBlockedUsers(ctx, "did:plc:test-no-blocks-user", 10, 0)
+		if err != nil {
+			t.Fatalf("ListBlockedUsers failed: %v", err)
+		}
+		if len(blocks) != 0 {
+			t.Errorf("Expected 0 blocks, got %d", len(blocks))
+		}
+	})
+
+	t.Run("limit=0 returns no results", func(t *testing.T) {
+		blocks, err := repo.ListBlockedUsers(ctx, blockerDID, 0, 0)
+		if err != nil {
+			t.Fatalf("ListBlockedUsers with limit=0 failed: %v", err)
+		}
+		if len(blocks) != 0 {
+			t.Errorf("Expected 0 blocks with limit=0, got %d", len(blocks))
+		}
+	})
+}
+
+// TestUserBlockRepo_IsBlocked tests the fast block check
+func TestUserBlockRepo_IsBlocked(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+
+	t.Run("returns false when not blocked", func(t *testing.T) {
+		isBlocked, err := repo.IsBlocked(ctx, "did:plc:test-isblocked-a", "did:plc:test-isblocked-b")
+		if err != nil {
+			t.Fatalf("IsBlocked failed: %v", err)
+		}
+		if isBlocked {
+			t.Error("Expected IsBlocked=false, got true")
+		}
+	})
+
+	t.Run("returns true when blocked", func(t *testing.T) {
+		blockerDID := "did:plc:test-isblocked-blocker-2"
+		blockedDID := "did:plc:test-isblocked-blocked-2"
+
+		block := &userblocks.UserBlock{
+			BlockerDID: blockerDID,
+			BlockedDID: blockedDID,
+			BlockedAt:  time.Now(),
+			RecordURI:  fmt.Sprintf("at://%s/social.coves.actor.block/isblocked1", blockerDID),
+			RecordCID:  "bafyisblocked1",
+		}
+		_, err := repo.BlockUser(ctx, block)
+		if err != nil {
+			t.Fatalf("BlockUser failed: %v", err)
+		}
+
+		isBlocked, err := repo.IsBlocked(ctx, blockerDID, blockedDID)
+		if err != nil {
+			t.Fatalf("IsBlocked failed: %v", err)
+		}
+		if !isBlocked {
+			t.Error("Expected IsBlocked=true, got false")
+		}
+	})
+
+	t.Run("returns false after unblock", func(t *testing.T) {
+		blockerDID := "did:plc:test-isblocked-blocker-3"
+		blockedDID := "did:plc:test-isblocked-blocked-3"
+
+		// Create block first
+		block := &userblocks.UserBlock{
+			BlockerDID: blockerDID,
+			BlockedDID: blockedDID,
+			BlockedAt:  time.Now(),
+			RecordURI:  fmt.Sprintf("at://%s/social.coves.actor.block/isblocked2", blockerDID),
+			RecordCID:  "bafyisblocked2",
+		}
+		_, err := repo.BlockUser(ctx, block)
+		if err != nil {
+			t.Fatalf("BlockUser failed: %v", err)
+		}
+
+		// Unblock
+		err = repo.UnblockUser(ctx, blockerDID, blockedDID)
+		if err != nil {
+			t.Fatalf("UnblockUser failed: %v", err)
+		}
+
+		isBlocked, err := repo.IsBlocked(ctx, blockerDID, blockedDID)
+		if err != nil {
+			t.Fatalf("IsBlocked failed: %v", err)
+		}
+		if isBlocked {
+			t.Error("Expected IsBlocked=false after unblock, got true")
+		}
+	})
+}
+
+// TestUserBlockRepo_AreBlocked tests the batch block check
+func TestUserBlockRepo_AreBlocked(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+
+	blockerDID := "did:plc:test-areblocked-blocker"
+
+	// Block user 0 and user 2, but NOT user 1
+	blockedDIDs := []string{
+		"did:plc:test-areblocked-target-0",
+		"did:plc:test-areblocked-target-1",
+		"did:plc:test-areblocked-target-2",
+	}
+
+	for _, i := range []int{0, 2} {
+		block := &userblocks.UserBlock{
+			BlockerDID: blockerDID,
+			BlockedDID: blockedDIDs[i],
+			BlockedAt:  time.Now(),
+			RecordURI:  fmt.Sprintf("at://%s/social.coves.actor.block/areblocked%d", blockerDID, i),
+			RecordCID:  fmt.Sprintf("bafyareblocked%d", i),
+		}
+		_, err := repo.BlockUser(ctx, block)
+		if err != nil {
+			t.Fatalf("BlockUser failed for target %d: %v", i, err)
+		}
+	}
+
+	t.Run("batch check returns correct map for mixed blocked/unblocked DIDs", func(t *testing.T) {
+		result, err := repo.AreBlocked(ctx, blockerDID, blockedDIDs)
+		if err != nil {
+			t.Fatalf("AreBlocked failed: %v", err)
+		}
+
+		// target-0 should be blocked
+		if !result[blockedDIDs[0]] {
+			t.Errorf("Expected %s to be blocked", blockedDIDs[0])
+		}
+
+		// target-1 should NOT be blocked
+		if result[blockedDIDs[1]] {
+			t.Errorf("Expected %s to NOT be blocked", blockedDIDs[1])
+		}
+
+		// target-2 should be blocked
+		if !result[blockedDIDs[2]] {
+			t.Errorf("Expected %s to be blocked", blockedDIDs[2])
+		}
+	})
+
+	t.Run("empty input returns empty map without hitting DB", func(t *testing.T) {
+		result, err := repo.AreBlocked(ctx, blockerDID, []string{})
+		if err != nil {
+			t.Fatalf("AreBlocked with empty input failed: %v", err)
+		}
+		if len(result) != 0 {
+			t.Errorf("Expected empty map for empty input, got %d entries", len(result))
+		}
+	})
+}
+
+// TestUserBlockRepo_UnblockByRecordURI tests the full flow of looking up a block
+// by record URI and then deleting it — the path used by the Jetstream consumer
+// when processing DELETE operations (which only carry the record URI, not DID pairs).
+func TestUserBlockRepo_UnblockByRecordURI(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx := context.Background()
+	db := setupTestDB(t)
+	defer cleanupUserBlockTestDB(t, db)
+
+	repo := postgresRepo.NewUserBlockRepository(db)
+
+	blockerDID := "did:plc:test-uri-unblock-blocker"
+	blockedDID := "did:plc:test-uri-unblock-blocked"
+	recordURI := "at://did:plc:test-uri-unblock-blocker/social.coves.actor.block/del1"
+
+	// Create the block
+	block := &userblocks.UserBlock{
+		BlockerDID: blockerDID,
+		BlockedDID: blockedDID,
+		BlockedAt:  time.Now(),
+		RecordURI:  recordURI,
+		RecordCID:  "bafyuriunblock1",
+	}
+	_, err := repo.BlockUser(ctx, block)
+	if err != nil {
+		t.Fatalf("BlockUser failed: %v", err)
+	}
+
+	// Look up by URI (as the Jetstream consumer would)
+	found, err := repo.GetBlockByURI(ctx, recordURI)
+	if err != nil {
+		t.Fatalf("GetBlockByURI failed: %v", err)
+	}
+	if found.BlockerDID != blockerDID || found.BlockedDID != blockedDID {
+		t.Fatalf("GetBlockByURI returned wrong block: blocker=%s blocked=%s", found.BlockerDID, found.BlockedDID)
+	}
+
+	// Delete using the DIDs from the lookup
+	err = repo.UnblockUser(ctx, found.BlockerDID, found.BlockedDID)
+	if err != nil {
+		t.Fatalf("UnblockUser after URI lookup failed: %v", err)
+	}
+
+	// Verify block is gone
+	_, err = repo.GetBlock(ctx, blockerDID, blockedDID)
+	if !userblocks.IsNotFound(err) {
+		t.Errorf("Expected ErrBlockNotFound after unblock-by-URI flow, got: %v", err)
+	}
+}
+
+// cleanupUserBlockTestDB removes test data from the user_blocks table
+func cleanupUserBlockTestDB(t *testing.T, db *sql.DB) {
+	t.Helper()
+
+	_, err := db.Exec("DELETE FROM user_blocks WHERE blocker_did LIKE 'did:plc:test-%'")
+	if err != nil {
+		t.Logf("Warning: Failed to clean up user blocks: %v", err)
+	}
+
+	if closeErr := db.Close(); closeErr != nil {
+		t.Logf("Failed to close database: %v", closeErr)
+	}
+}