v4: users can't rename themselves, /settings lays out again, and its selectors fit a phone — PATCH /api/me refuses a username with a 400 and changes nothing else in that request; a name changes only through PATCH /api/users/:key/username, which needs user:manage, from /@name/manage. The old name still stays an alias for good. renameUser lost its 30-day limit and its exempt flag, and RENAME_LIMITS holds the slug limit alone. /settings shows the username as plain text, and the rename hint left the catalogs. The settings grid sized its control column to its widest content, the rename hint, which stretched every control under it; that column now takes the remaining width and each control keeps its own size. A segmented control wraps instead of overflowing; in a settings row on a phone it takes the full width, and one of more than 4 options (the styles) lays out in two even rows. .btn-border turned red on hover, so Settings, Manage, Retry and Back looked like Log out; it is now neutral (Smooth's accent is red too), and only Log out takes the new btn-border--danger, muted until hovered red. A <button> and a <Link> .btn-border are now the same height. API.md and the module docs say who renames; the backend tests rename through the moderator route and check a self-rename is refused, and the malformed-name check moved to the manage tab's test. 254 backend and 667 frontend tests pass, and tsc, deno check and doc:lint are clean; Smooth, Brutalist, GeoCities and Kanagawa were checked in screenshots at desktop and phone widths.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

API.md

@@ -56,8 +56,8 @@ page to a comment.
   at any time.
 - **A username** is 1 to 32 letters, digits and underscores, unique in any
   case. A page writes it in its stored case, and another case still resolves.
-  A user may rename themselves once every 30 days from `/settings`; those
-  with `user:manage` rename anyone, at any time, from `/@<name>/manage`.
+  Users can't rename themselves: those with `user:manage` rename anyone, from
+  `/@<name>/manage`.
 - **Aliases.** A slug or a name left behind stays an alias for good, which
   always names the item or user itself, so redirects never chain. Nobody else
   can take one. An item can take back one of its own. Deleting an item frees
@@ -84,7 +84,7 @@ thumbnail, cover or attachment takes the owner's media token as `?token=`.
 ### me
 
 - `GET /api/me` — signed in. The caller's own user.
-- `PATCH /api/me` — signed in. Changes the description, email and username.
+- `PATCH /api/me` — signed in. Changes the description and email.
 - `GET /api/me/media-token` — signed in. A media token.
 - `GET`, `PATCH /api/me/settings` — signed in. The caller's settings.
 - `PUT /api/me/password` — signed in, with the current one. A new password,
@@ -115,7 +115,7 @@ thumbnail, cover or attachment takes the owner's media token as `?token=`.
   follow.
 - `GET /api/users/:key/invitees` — anyone. The tree of users they invited.
 - `PATCH /api/users/:key/role`, `/username` — `user:manage`. Another user's
-  role, or anyone's name.
+  role, or anyone's name, theirs included.
 
 ### dumps