feat(oauth): add confidential client support for extended session lifetime

Implements OAuth confidential client authentication to enable 1-year session
lifetimes (vs 14 days for public clients). Auth servers enforce shorter limits
for public clients, so this upgrade is necessary for improved UX.

Changes:
- Add OAUTH_CLIENT_PRIVATE_KEY and OAUTH_CLIENT_KEY_ID env configuration
- Add /oauth-client-keys.json JWKS endpoint for public key discovery
- Expand OAuth scopes to include all Coves record types and blob uploads
- Add LogoURI and PolicyURI to client metadata for auth screen branding
- Add cmd/tools/generate-oauth-key utility for P-256 key generation
- Update session TTL defaults to 1 year / 18 months for confidential clients
- Add scope validation with warnings in callback handler
- Fix WebSocket timeout handling in integration tests to prevent panics
- Increase unique name entropy in tests to reduce collision probability

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

.env.dev

···
 # This must be 32 bytes when base64-decoded for AES-256
 # OAUTH_SEAL_SECRET=ryW6xNVxYhP6hCDA90NGCmK58Q2ONnkYXbHL0oZN2no=
 
+# OAuth Confidential Client Configuration (optional, for testing)
+# If both are set, Coves becomes a confidential OAuth client with 90-day session lifetime
+# (Public clients are limited to 14 days by the auth server)
+# Generate keys with: go run ./cmd/tools/generate-oauth-key
+
+# Generated: 2026-02-05T22:49:41-08:00
+# WARNING: Keep this private key secure! Never commit to version control.
+OAUTH_CLIENT_PRIVATE_KEY=z42ti3ZG2JDj4RvFKdovxbgHB9Q4uvwsPvew8NQaxKxdfTLY
+OAUTH_CLIENT_KEY_ID=coves-key-1770360581
+
 # AppView public URL (used for OAuth callback and client metadata)
 # Dev: http://127.0.0.1:8081 (use 127.0.0.1 instead of localhost per RFC 8252)
 # Prod: https://coves.social

.env.dev.example

···
 # Generate with: openssl rand -hex 32
 OAUTH_COOKIE_SECRET=<generate-your-own-secret>
 
+# OAuth Confidential Client Configuration (optional, for testing)
+# If both are set, Coves becomes a confidential OAuth client with 90-day session lifetime
+# (Public clients are limited to 14 days by the auth server)
+# Generate keys with: go run ./cmd/tools/generate-oauth-key
+
+# P-256 private key in multibase format (z-prefixed base58btc)
+# OAUTH_CLIENT_PRIVATE_KEY=z...
+
+# Key identifier (arbitrary string, used in JWT header)
+# OAUTH_CLIENT_KEY_ID=coves-dev-key-1
+
 # =============================================================================
 # Development Settings
 # =============================================================================

.env.prod.example

···
 # REQUIRED - Generate with: openssl rand -base64 32
 OAUTH_SEAL_SECRET=CHANGE_ME_BASE64_32_BYTES
 
-# Optional: OAuth client secret and key ID (for confidential clients only)
-# Most deployments use public clients and don't need these
-# OAUTH_CLIENT_SECRET=
-# OAUTH_CLIENT_KID=
+# OAuth Confidential Client Configuration (optional)
+# If both are set, Coves becomes a confidential OAuth client with 90-day session lifetime
+# (Public clients are limited to 14 days by the auth server)
+# Generate keys with: go run ./cmd/tools/generate-oauth-key
+
+# P-256 private key in multibase format (z-prefixed base58btc)
+# OAUTH_CLIENT_PRIVATE_KEY=z...
+
+# Key identifier (arbitrary string, used in JWT header)
+# OAUTH_CLIENT_KEY_ID=coves-prod-key-1
 
 # =============================================================================
 # Mobile Universal Links & App Links

cmd/server/main.go

···
 	isDevMode := os.Getenv("IS_DEV_ENV") == "true"
 	pdsURL := os.Getenv("PDS_URL") // For dev mode: resolve handles via local PDS
 	oauthConfig := &oauth.OAuthConfig{
-		PublicURL:       os.Getenv("APPVIEW_PUBLIC_URL"),
-		SealSecret:      oauthSealSecret,
-		Scopes:          []string{"atproto"},
+		PublicURL:  os.Getenv("APPVIEW_PUBLIC_URL"),
+		SealSecret: oauthSealSecret,
+		Scopes: []string{
+			"atproto",
+			"blob:*/*", // For avatar/image uploads
+			// Posts
+			"repo:social.coves.community.post?action=create&action=update&action=delete",
+			// Comments
+			"repo:social.coves.community.comment?action=create&action=update&action=delete",
+			// Communities
+			"repo:social.coves.community.profile?action=create&action=update&action=delete",
+			// Subscriptions
+			"repo:social.coves.community.subscription?action=create&action=update&action=delete",
+			// User profile
+			"repo:social.coves.actor.profile?action=create&action=update&action=delete",
+			// Votes
+			"repo:social.coves.feed.vote?action=create&action=delete",
+		},
 		DevMode:         isDevMode,
 		AllowPrivateIPs: isDevMode, // Allow private IPs only in dev mode
 		PLCURL:          plcURL,
 		PDSURL:          pdsURL, // For dev mode handle resolution
-		// SessionTTL and SealedTokenTTL will use defaults if not set (7 days and 14 days)
+		// Confidential client keys (optional - if set, upgrades to confidential client)
+		// Confidential clients: 90-day session TTL, 180-day sealed token TTL
+		// Public clients: Limited to 14 days by auth server regardless of config
+		ClientPrivateKeyMultibase: os.Getenv("OAUTH_CLIENT_PRIVATE_KEY"),
+		ClientKeyID:               os.Getenv("OAUTH_CLIENT_KEY_ID"),
+		// SessionTTL and SealedTokenTTL use defaults if not set (90 days and 180 days)
 	}
 
 	// Create PostgreSQL-backed OAuth session store (using default 7-day TTL)

cmd/tools/generate-oauth-key/main.go

···
+// Package main provides a utility to generate P-256 private keys for OAuth confidential clients.
+// Run with: go run ./cmd/tools/generate-oauth-key
+package main
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/bluesky-social/indigo/atproto/atcrypto"
+)
+
+func main() {
+	priv, err := atcrypto.GeneratePrivateKeyP256()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error generating key: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Output in format suitable for .env file
+	fmt.Printf("# OAuth Confidential Client Key\n")
+	fmt.Printf("# Generated: %s\n", time.Now().Format(time.RFC3339))
+	fmt.Printf("# WARNING: Keep this private key secure! Never commit to version control.\n")
+	fmt.Printf("OAUTH_CLIENT_PRIVATE_KEY=%s\n", priv.Multibase())
+	fmt.Printf("OAUTH_CLIENT_KEY_ID=coves-key-%d\n", time.Now().Unix())
+}

internal/api/routes/oauth.go

···
 	// OAuth metadata endpoints - public, no extra rate limiting (use global limit)
 	// Serve at root /oauth-client-metadata.json so OAuth screens show clean brand domain
 	r.Get("/oauth-client-metadata.json", handler.HandleClientMetadata)
+	r.Get("/oauth-client-keys.json", handler.HandleClientJWKS)
 	r.Get("/.well-known/oauth-protected-resource", handler.HandleProtectedResourceMetadata)
 
 	// OAuth flow endpoints - stricter rate limiting for authentication attempts

internal/atproto/oauth/client.go

···
 	"net/url"
 	"time"
 
+	"github.com/bluesky-social/indigo/atproto/atcrypto"
 	"github.com/bluesky-social/indigo/atproto/auth/oauth"
 	"github.com/bluesky-social/indigo/atproto/identity"
 )
···
 	SealedTokenTTL  time.Duration
 	DevMode         bool
 	AllowPrivateIPs bool
+
+	// Confidential client (optional - if set, upgrades to confidential)
+	ClientPrivateKeyMultibase string
+	ClientKeyID               string
 }
 
 // NewOAuthClient creates a new OAuth client for Coves
···
 
 	// Set default TTL values if not specified
 	// Per atproto OAuth spec:
-	// - Public clients: 2-week (14 day) maximum session lifetime
-	// - Confidential clients: 180-day maximum session lifetime
+	// - Public clients: 2-week (14 day) maximum session lifetime (enforced by auth server)
+	// - Confidential clients: up to 2 years maximum session lifetime
+	// Note: The auth server ultimately enforces these limits. Public clients with longer TTLs
+	// configured here will still be limited to 14 days by the auth server.
 	if config.SessionTTL == 0 {
-		config.SessionTTL = 7 * 24 * time.Hour // 7 days default
+		config.SessionTTL = 365 * 24 * time.Hour // 1 year (confidential clients only)
 	}
 	if config.SealedTokenTTL == 0 {
-		config.SealedTokenTTL = 14 * 24 * time.Hour // 14 days (public client limit)
+		config.SealedTokenTTL = 548 * 24 * time.Hour // 18 months (confidential clients only)
 	}
 
 	// Create indigo client config
···
 		clientConfig = oauth.NewPublicConfig(clientID, callbackURL, config.Scopes)
 	}
 
+	// Upgrade to confidential client if private key is configured
+	// Confidential clients get longer session lifetimes (up to 90/180 days vs 14 days for public)
+	if config.ClientPrivateKeyMultibase != "" && config.ClientKeyID != "" {
+		priv, err := atcrypto.ParsePrivateMultibase(config.ClientPrivateKeyMultibase)
+		if err != nil {
+			return nil, fmt.Errorf("parsing OAuth client private key: %w", err)
+		}
+		if err := clientConfig.SetClientSecret(priv, config.ClientKeyID); err != nil {
+			return nil, fmt.Errorf("setting OAuth client secret: %w", err)
+		}
+		slog.Info("OAuth client configured as confidential", "key_id", config.ClientKeyID)
+	} else if config.ClientPrivateKeyMultibase != "" || config.ClientKeyID != "" {
+		// Partial configuration - warn operator that both fields are required
+		// Without both, we fall back to public client with 14-day session limit
+		slog.Warn("OAuth confidential client partially configured - both OAUTH_CLIENT_PRIVATE_KEY and OAUTH_CLIENT_KEY_ID are required",
+			"has_private_key", config.ClientPrivateKeyMultibase != "",
+			"has_key_id", config.ClientKeyID != "")
+	}
+
 	// Set user agent
 	clientConfig.UserAgent = "Coves/1.0"
 
···
 
 	// Add additional metadata for Coves
 	metadata.ClientName = strPtr("Coves")
+	metadata.LogoURI = strPtr(c.Config.PublicURL + "/static/images/lil_dude.png")
+	metadata.PolicyURI = strPtr(c.Config.PublicURL + "/privacy")
+
 	if !c.Config.DevMode {
 		metadata.ClientURI = strPtr(c.Config.PublicURL)
+		// For confidential clients, include the JWKS URI for the public key
+		if c.ClientApp.Config.IsConfidential() {
+			jwksURI := c.Config.PublicURL + "/oauth-client-keys.json"
+			metadata.JWKSURI = &jwksURI
+		}
 	}
 
 	return metadata

internal/atproto/oauth/handlers.go

···
 	}
 }
 
+// HandleClientJWKS serves the OAuth client public keys (JWKS)
+// GET /oauth-client-keys.json
+// This endpoint is only relevant for confidential clients; public clients don't have keys.
+func (h *OAuthHandler) HandleClientJWKS(w http.ResponseWriter, r *http.Request) {
+	jwks := h.client.ClientApp.Config.PublicJWKS()
+
+	// Encode to buffer first to avoid setting headers on a response that may fail mid-write.
+	// If encoding fails after headers are set, clients receive Content-Type: application/json
+	// but an HTML error body, causing parsing failures.
+	data, err := json.Marshal(jwks)
+	if err != nil {
+		slog.Error("failed to encode client JWKS", "error", err)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "public, max-age=3600")
+	if _, err := w.Write(data); err != nil {
+		slog.Error("failed to write client JWKS response", "error", err)
+		// Headers already sent, can't change response at this point
+	}
+}
+
 // HandleLogin starts the OAuth flow (web version)
 // GET /oauth/login?handle=user.bsky.social
 func (h *OAuthHandler) HandleLogin(w http.ResponseWriter, r *http.Request) {
···
 		slog.Error("OAuth callback returned nil session data")
 		http.Error(w, "OAuth callback failed: no session data", http.StatusInternalServerError)
 		return
+	}
+
+	// Validate that critical scopes were granted by the authorization server.
+	// Log warnings for missing scopes but don't fail auth - users can still use limited functionality.
+	criticalScopes := []string{"atproto", "blob:*/*"}
+	for _, required := range criticalScopes {
+		if !scopesContain(sessData.Scopes, required) {
+			slog.Warn("OAuth callback: critical scope not granted",
+				"did", sessData.AccountDID,
+				"missing_scope", required,
+				"granted_scopes", sessData.Scopes)
+		}
 	}
 
 	// Bidirectional handle verification: ensure the DID actually controls a valid handle
···
 	http.Error(w, "Universal Link not intercepted: The mobile app should have opened this URL. "+
 		"Check that Universal Links (iOS) or App Links (Android) are properly configured.", http.StatusBadRequest)
 }
+
+// scopesContain checks if a required scope is present in the granted scopes list.
+// It performs an exact match comparison.
+func scopesContain(granted []string, required string) bool {
+	for _, scope := range granted {
+		if scope == required {
+			return true
+		}
+	}
+	return false
+}

internal/atproto/oauth/handlers_test.go

···
 	}
 	return &did, nil
 }
+
+// TestConfidentialClientTransition validates the seamless transition from public to confidential client
+func TestConfidentialClientTransition(t *testing.T) {
+	baseConfig := func() *OAuthConfig {
+		return &OAuthConfig{
+			PublicURL:       "https://coves.social",
+			Scopes:          []string{"atproto"},
+			DevMode:         false,
+			AllowPrivateIPs: false,
+			SealSecret:      "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
+		}
+	}
+
+	t.Run("public client without keys", func(t *testing.T) {
+		config := baseConfig()
+		client, err := NewOAuthClient(config, oauth.NewMemStore())
+		require.NoError(t, err)
+
+		// Should NOT be confidential
+		assert.False(t, client.ClientApp.Config.IsConfidential())
+
+		// Metadata should NOT have JWKS URI
+		metadata := client.ClientMetadata()
+		assert.Nil(t, metadata.JWKSURI)
+		assert.Equal(t, "none", metadata.TokenEndpointAuthMethod)
+	})
+
+	t.Run("confidential client with keys", func(t *testing.T) {
+		config := baseConfig()
+		// TEST-ONLY: P-256 private key in multibase format - DO NOT use in production
+		// This is a publicly known test key that provides NO security
+		config.ClientPrivateKeyMultibase = "z42tn7PHdrLvcwoYGtY71n4g56NcQ3vJn3W5NNJV9mmqDL68"
+		config.ClientKeyID = "test-key-1"
+
+		client, err := NewOAuthClient(config, oauth.NewMemStore())
+		require.NoError(t, err)
+
+		// Should be confidential
+		assert.True(t, client.ClientApp.Config.IsConfidential())
+
+		// Metadata SHOULD have JWKS URI
+		metadata := client.ClientMetadata()
+		require.NotNil(t, metadata.JWKSURI)
+		assert.Equal(t, "https://coves.social/oauth-client-keys.json", *metadata.JWKSURI)
+		assert.Equal(t, "private_key_jwt", metadata.TokenEndpointAuthMethod)
+	})
+
+	t.Run("partial keys rejected", func(t *testing.T) {
+		// Only private key, no key ID
+		config := baseConfig()
+		// TEST-ONLY key - DO NOT use in production
+		config.ClientPrivateKeyMultibase = "z42tn7PHdrLvcwoYGtY71n4g56NcQ3vJn3W5NNJV9mmqDL68"
+		// No ClientKeyID
+
+		client, err := NewOAuthClient(config, oauth.NewMemStore())
+		require.NoError(t, err)
+
+		// Should NOT be confidential (both fields required)
+		assert.False(t, client.ClientApp.Config.IsConfidential())
+	})
+
+	t.Run("invalid private key rejected", func(t *testing.T) {
+		config := baseConfig()
+		config.ClientPrivateKeyMultibase = "invalid-key"
+		config.ClientKeyID = "test-key-1"
+
+		_, err := NewOAuthClient(config, oauth.NewMemStore())
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "parsing OAuth client private key")
+	})
+}
+
+// TestHandleClientJWKS tests the JWKS endpoint
+func TestHandleClientJWKS(t *testing.T) {
+	t.Run("public client returns empty JWKS", func(t *testing.T) {
+		config := &OAuthConfig{
+			PublicURL:       "https://coves.social",
+			Scopes:          []string{"atproto"},
+			DevMode:         false,
+			AllowPrivateIPs: false,
+			SealSecret:      "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
+		}
+
+		client, err := NewOAuthClient(config, oauth.NewMemStore())
+		require.NoError(t, err)
+
+		handler := NewOAuthHandler(client, oauth.NewMemStore())
+
+		req := httptest.NewRequest(http.MethodGet, "/oauth-client-keys.json", nil)
+		rec := httptest.NewRecorder()
+
+		handler.HandleClientJWKS(rec, req)
+
+		assert.Equal(t, http.StatusOK, rec.Code)
+		assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
+		assert.Equal(t, "public, max-age=3600", rec.Header().Get("Cache-Control"))
+
+		// Parse response - should be empty keys array for public client
+		var jwks oauth.JWKS
+		err = json.NewDecoder(rec.Body).Decode(&jwks)
+		require.NoError(t, err)
+		assert.Empty(t, jwks.Keys)
+	})
+
+	t.Run("confidential client returns JWKS with public key", func(t *testing.T) {
+		config := &OAuthConfig{
+			PublicURL:       "https://coves.social",
+			Scopes:          []string{"atproto"},
+			DevMode:         false,
+			AllowPrivateIPs: false,
+			SealSecret:      "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
+			// TEST-ONLY key - DO NOT use in production
+			ClientPrivateKeyMultibase: "z42tn7PHdrLvcwoYGtY71n4g56NcQ3vJn3W5NNJV9mmqDL68",
+			ClientKeyID:               "test-key-1",
+		}
+
+		client, err := NewOAuthClient(config, oauth.NewMemStore())
+		require.NoError(t, err)
+
+		handler := NewOAuthHandler(client, oauth.NewMemStore())
+
+		req := httptest.NewRequest(http.MethodGet, "/oauth-client-keys.json", nil)
+		rec := httptest.NewRecorder()
+
+		handler.HandleClientJWKS(rec, req)
+
+		assert.Equal(t, http.StatusOK, rec.Code)
+		assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
+
+		// Parse response - should have one key
+		var jwks oauth.JWKS
+		err = json.NewDecoder(rec.Body).Decode(&jwks)
+		require.NoError(t, err)
+		require.Len(t, jwks.Keys, 1)
+
+		// Validate key properties
+		key := jwks.Keys[0]
+		assert.Equal(t, "EC", key.KeyType)
+		assert.Equal(t, "P-256", key.Curve)
+		assert.NotNil(t, key.KeyID)
+		assert.Equal(t, "test-key-1", *key.KeyID)
+		// Should have public key coordinates (X, Y)
+		// The JWK struct only contains public key data - no private key field
+		assert.NotEmpty(t, key.X)
+		assert.NotEmpty(t, key.Y)
+	})
+}
+
+// TestOAuthEndpointsNoConflict ensures new endpoints don't conflict with existing routes
+func TestOAuthEndpointsNoConflict(t *testing.T) {
+	// This test validates that the route paths are distinct and don't overlap
+	routes := map[string]string{
+		"/oauth-client-metadata.json":           "Client identity document",
+		"/oauth-client-keys.json":               "JWKS public keys (new)",
+		"/oauth/callback":                       "OAuth callback after auth",
+		"/oauth/login":                          "Start web OAuth flow",
+		"/oauth/mobile/login":                   "Start mobile OAuth flow",
+		"/.well-known/oauth-protected-resource": "Resource server metadata",
+	}
+
+	// All routes should be unique
+	seen := make(map[string]bool)
+	for route := range routes {
+		assert.False(t, seen[route], "Duplicate route: %s", route)
+		seen[route] = true
+	}
+
+	// Verify none of the OAuth routes conflict with DID routes
+	didRoutes := []string{
+		"/.well-known/did.json",
+		"/.well-known/atproto-did",
+	}
+
+	for _, didRoute := range didRoutes {
+		for oauthRoute := range routes {
+			assert.NotEqual(t, didRoute, oauthRoute,
+				"OAuth route %s conflicts with DID route %s", oauthRoute, didRoute)
+		}
+	}
+}
+
+// TestConfidentialClientWithDevMode verifies confidential client works in dev mode
+func TestConfidentialClientWithDevMode(t *testing.T) {
+	config := &OAuthConfig{
+		PublicURL:       "http://127.0.0.1:8081",
+		Scopes:          []string{"atproto"},
+		DevMode:         true, // Dev mode enabled
+		AllowPrivateIPs: true,
+		SealSecret:      "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
+		// TEST-ONLY key - DO NOT use in production
+		ClientPrivateKeyMultibase: "z42tn7PHdrLvcwoYGtY71n4g56NcQ3vJn3W5NNJV9mmqDL68",
+		ClientKeyID:               "test-key-1",
+	}
+
+	client, err := NewOAuthClient(config, oauth.NewMemStore())
+	require.NoError(t, err)
+
+	// Should be confidential even in dev mode
+	assert.True(t, client.ClientApp.Config.IsConfidential())
+	assert.True(t, client.Config.DevMode)
+
+	// In dev mode, loopback config is used but still becomes confidential
+	assert.Equal(t, "private_key_jwt", client.ClientApp.Config.ClientMetadata().TokenEndpointAuthMethod)
+
+	// Dev mode uses loopback client_id format
+	// Loopback clients use http://localhost format
+	assert.Contains(t, client.ClientApp.Config.ClientID, "http://")
+}
+
+// TestSessionTTLsForConfidentialClient verifies TTLs are set appropriately
+func TestSessionTTLsForConfidentialClient(t *testing.T) {
+	config := &OAuthConfig{
+		PublicURL:       "https://coves.social",
+		Scopes:          []string{"atproto"},
+		DevMode:         false,
+		AllowPrivateIPs: false,
+		SealSecret:      "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
+		// No explicit TTL set - should use defaults
+	}
+
+	client, err := NewOAuthClient(config, oauth.NewMemStore())
+	require.NoError(t, err)
+
+	// Default TTLs for confidential clients (1 year session, 18 months sealed token)
+	assert.Equal(t, 365*24*time.Hour, client.Config.SessionTTL, "SessionTTL should be 1 year")
+	assert.Equal(t, 548*24*time.Hour, client.Config.SealedTokenTTL, "SealedTokenTTL should be 18 months")
+}

tests/integration/community_avatar_e2e_test.go

···
 	"bytes"
 	"context"
 	"database/sql"
+	"errors"
 	"fmt"
 	"image"
 	"image/color"
 	"image/png"
+	"net"
 	"net/http"
 	"os"
 	"strings"
···
 	consumer := jetstream.NewCommunityEventConsumer(communityRepo, instanceDID, true, identityResolver)
 
 	t.Run("create community with avatar via real Jetstream", func(t *testing.T) {
-		uniqueName := fmt.Sprintf("avt%d", time.Now().UnixNano()%1000000)
+		uniqueName := fmt.Sprintf("avt%d", time.Now().UnixNano()%100000000)
 		creatorDID := "did:plc:avatar-create-test"
 
 		// Create a test PNG image (100x100 red square)
···
 			}
 			defer func() { _ = conn.Close() }()
 
+			consecutiveTimeouts := 0
 			for {
 				select {
 				case <-done:
···
 
 					var event jetstream.JetstreamEvent
 					if readErr := conn.ReadJSON(&event); readErr != nil {
-						continue // Timeout or error, keep trying
+						var netErr net.Error
+						if errors.As(readErr, &netErr) && netErr.Timeout() {
+							consecutiveTimeouts++
+							if consecutiveTimeouts >= 10 {
+								return // Connection stale, exit to prevent panic
+							}
+						}
+						continue
 					}
+					consecutiveTimeouts = 0
 
 					// Only process community profile create events
 					if event.Kind == "commit" && event.Commit != nil &&
···
 			}
 			defer func() { _ = conn.Close() }()
 
+			consecutiveTimeouts := 0
 			for {
 				select {
 				case <-done:
···
 
 					var event jetstream.JetstreamEvent
 					if readErr := conn.ReadJSON(&event); readErr != nil {
+						var netErr net.Error
+						if errors.As(readErr, &netErr) && netErr.Timeout() {
+							consecutiveTimeouts++
+							if consecutiveTimeouts >= 10 {
+								return // Connection stale, exit to prevent panic
+							}
+						}
 						continue
 					}
+					consecutiveTimeouts = 0
 
 					if event.Kind == "commit" && event.Commit != nil &&
 						event.Commit.Collection == "social.coves.community.profile" &&
···
 	}
 
 	t.Run("add avatar to community without one", func(t *testing.T) {
-		uniqueName := fmt.Sprintf("upav%d", time.Now().UnixNano()%1000000)
+		uniqueName := fmt.Sprintf("upav%d", time.Now().UnixNano()%100000000)
 		creatorDID := "did:plc:avatar-update-test"
 
 		// Create a community WITHOUT an avatar
···
 	})
 
 	t.Run("replace existing avatar with new one", func(t *testing.T) {
-		uniqueName := fmt.Sprintf("rpav%d", time.Now().UnixNano()%1000000)
+		uniqueName := fmt.Sprintf("rpav%d", time.Now().UnixNano()%100000000)
 		creatorDID := "did:plc:avatar-replace-test"
 
 		// Create a community WITH an initial avatar (red square)
···
 			}
 			defer func() { _ = conn.Close() }()
 
+			consecutiveTimeouts := 0
 			for {
 				select {
 				case <-done:
···
 
 					var event jetstream.JetstreamEvent
 					if readErr := conn.ReadJSON(&event); readErr != nil {
+						var netErr net.Error
+						if errors.As(readErr, &netErr) && netErr.Timeout() {
+							consecutiveTimeouts++
+							if consecutiveTimeouts >= 10 {
+								return // Connection stale, exit to prevent panic
+							}
+						}
 						continue
 					}
+					consecutiveTimeouts = 0
 
 					if event.Kind == "commit" && event.Commit != nil &&
 						event.Commit.Collection == "social.coves.community.profile" &&
···
 	}
 
 	t.Run("add banner to community without one", func(t *testing.T) {
-		uniqueName := fmt.Sprintf("ban%d", time.Now().UnixNano()%1000000)
+		uniqueName := fmt.Sprintf("ban%d", time.Now().UnixNano()%100000000)
 		creatorDID := "did:plc:banner-add-test"
 
 		// Create a community WITHOUT a banner
···
 	})
 
 	t.Run("replace existing banner with new one", func(t *testing.T) {
-		uniqueName := fmt.Sprintf("rpban%d", time.Now().UnixNano()%1000000)
+		uniqueName := fmt.Sprintf("rpban%d", time.Now().UnixNano()%100000000)
 		creatorDID := "did:plc:banner-replace-test"
 
 		// Create a community WITH an initial banner (red rectangle)

tests/integration/community_update_e2e_test.go

···
 
 	t.Run("update community with real Jetstream indexing", func(t *testing.T) {
 		// First, create a community
-		uniqueName := fmt.Sprintf("upd%d", time.Now().UnixNano()%1000000)
+		uniqueName := fmt.Sprintf("upd%d", time.Now().UnixNano()%100000000)
 		creatorDID := "did:plc:jetstream-update-test"
 
 		t.Logf("\n📝 Creating community on PDS...")
···
 
 	t.Run("multiple updates with real Jetstream", func(t *testing.T) {
 		// This tests that consecutive updates all flow through Jetstream correctly
-		uniqueName := fmt.Sprintf("multi%d", time.Now().UnixNano()%1000000)
+		uniqueName := fmt.Sprintf("multi%d", time.Now().UnixNano()%100000000)
 		creatorDID := "did:plc:multi-update-test"
 
 		t.Logf("\n📝 Creating community for multi-update test...")

tests/integration/user_profile_avatar_e2e_test.go

···
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"image"
 	"image/color"
···
 			}
 			defer func() { _ = conn.Close() }()
 
+			consecutiveTimeouts := 0
 			for {
 				select {
 				case <-done:
···
 					var event jetstream.JetstreamEvent
 					if readErr := conn.ReadJSON(&event); readErr != nil {
 						var netErr net.Error
-						if nErr, ok := readErr.(net.Error); ok && nErr.Timeout() {
-							continue
-						}
-						// Check using errors.As as well
-						if netErr != nil && netErr.Timeout() {
-							continue
+						if errors.As(readErr, &netErr) && netErr.Timeout() {
+							consecutiveTimeouts++
+							if consecutiveTimeouts >= 10 {
+								return // Connection stale, exit to prevent panic
+							}
 						}
 						continue
 					}
+					consecutiveTimeouts = 0
 
 					// Only process profile update events for our user
 					if event.Kind == "commit" && event.Commit != nil &&
···
 			}
 			defer func() { _ = conn.Close() }()
 
+			consecutiveTimeouts := 0
 			for {
 				select {
 				case <-done:
···
 
 					var event jetstream.JetstreamEvent
 					if err := conn.ReadJSON(&event); err != nil {
+						var netErr net.Error
+						if errors.As(err, &netErr) && netErr.Timeout() {
+							consecutiveTimeouts++
+							if consecutiveTimeouts >= 10 {
+								return // Connection stale, exit to prevent panic
+							}
+						}
 						continue
 					}
+					consecutiveTimeouts = 0
 
 					if event.Kind == "commit" && event.Commit != nil &&
 						event.Commit.Collection == "social.coves.actor.profile" &&
···
 			}
 			defer func() { _ = conn.Close() }()
 
+			consecutiveTimeouts := 0
 			for {
 				select {
 				case <-done:
···
 
 					var event jetstream.JetstreamEvent
 					if err := conn.ReadJSON(&event); err != nil {
+						var netErr net.Error
+						if errors.As(err, &netErr) && netErr.Timeout() {
+							consecutiveTimeouts++
+							if consecutiveTimeouts >= 10 {
+								return // Connection stale, exit to prevent panic
+							}
+						}
 						continue
 					}
+					consecutiveTimeouts = 0
 
 					if event.Kind == "commit" && event.Commit != nil &&
 						event.Commit.Collection == "social.coves.actor.profile" &&
···
 			}
 			defer func() { _ = conn.Close() }()
 
+			consecutiveTimeouts := 0
 			for {
 				select {
 				case <-done:
···
 
 					var event jetstream.JetstreamEvent
 					if err := conn.ReadJSON(&event); err != nil {
+						var netErr net.Error
+						if errors.As(err, &netErr) && netErr.Timeout() {
+							consecutiveTimeouts++
+							if consecutiveTimeouts >= 10 {
+								return // Connection stale, exit to prevent panic
+							}
+						}
 						continue
 					}
+					consecutiveTimeouts = 0
 
 					if event.Kind == "commit" && event.Commit != nil &&
 						event.Commit.Collection == "social.coves.actor.profile" &&