v4: users can't rename themselves, /settings lays out again, and its selectors fit a phone — PATCH /api/me refuses a username with a 400 and changes nothing else in that request; a name changes only through PATCH /api/users/:key/username, which needs user:manage, from /@name/manage. The old name still stays an alias for good. renameUser lost its 30-day limit and its exempt flag, and RENAME_LIMITS holds the slug limit alone. /settings shows the username as plain text, and the rename hint left the catalogs. The settings grid sized its control column to its widest content, the rename hint, which stretched every control under it; that column now takes the remaining width and each control keeps its own size. A segmented control wraps instead of overflowing; in a settings row on a phone it takes the full width, and one of more than 4 options (the styles) lays out in two even rows. .btn-border turned red on hover, so Settings, Manage, Retry and Back looked like Log out; it is now neutral (Smooth's accent is red too), and only Log out takes the new btn-border--danger, muted until hovered red. A <button> and a <Link> .btn-border are now the same height. API.md and the module docs say who renames; the backend tests rename through the moderator route and check a self-rename is refused, and the malformed-name check moved to the manage tab's test. 254 backend and 667 frontend tests pass, and tsc, deno check and doc:lint are clean; Smooth, Brutalist, GeoCities and Kanagawa were checked in screenshots at desktop and phone widths.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/routes/me.ts

@@ -6,9 +6,9 @@
  * `routes/avatars.ts`.
  *
  * - `GET /api/me` — signed in. Answers the caller's own user.
- * - `PATCH /api/me` — signed in. Changes the caller's description, email and
- *   username, and answers their user. A new username keeps the old one as an
- *   alias, at most once in 30 days but for those with `user:manage`.
+ * - `PATCH /api/me` — signed in. Changes the caller's description and email,
+ *   and answers their user. A username changes only by `user:manage`, through
+ *   `PATCH /api/users/:key/username`.
  * - `GET /api/me/media-token` — signed in. Answers a media token, for a
  *   session that predates them.
  * - `GET /api/me/settings` — signed in. Answers the caller's settings.
@@ -38,19 +38,11 @@ import { isUpdateSettingsRequest } from "../validators/settings.ts";
 import { toPublicUser, toSelfUser } from "../model/user.ts";
 import { createMediaToken, issueTokens } from "../lib/jwt.ts";
 import { verifyPassword } from "../lib/password.ts";
-import { can } from "../lib/permissions.ts";
 import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
-import {
-  getUserById,
-  renameUser,
-  updateUser,
-} from "../services/user-service.ts";
+import { getUserById, updateUser } from "../services/user-service.ts";
 import { getSettings, updateSettings } from "../services/settings-service.ts";
 import { getPlaylistMembershipsForDump } from "../services/playlist-service.ts";
-import {
-  broadcastUserUpdated,
-  updateClientUsername,
-} from "../services/ws-service.ts";
+import { broadcastUserUpdated } from "../services/ws-service.ts";
 import { VALIDATION } from "../../shared/validation.ts";
 
 /**
@@ -74,16 +66,7 @@ router.patch("/", authMiddleware, async (ctx: AuthContext) => {
   }
   const userId = ctx.state.user.userId;
   // Only these fields: a stolen token alone must not change the role or the
-  // password, which needs the current one. The rename first: it is the change
-  // most likely refused, and a refusal should leave the rest as it was.
-  if (body.username !== undefined) {
-    const renamed = renameUser(
-      userId,
-      body.username,
-      can(ctx.state.user, "user:manage"),
-    );
-    updateClientUsername(userId, renamed.username);
-  }
+  // password, which needs the current one.
   const updated = await updateUser(userId, {
     description: body.description,
     email: body.email,

api/routes/users.ts

@@ -31,7 +31,7 @@
  * - `PATCH /api/users/:key/role` — permission `user:manage`. Sets another
  *   user's role.
  * - `PATCH /api/users/:key/username` — permission `user:manage`. Renames a
- *   user, with no rate limit.
+ *   user, the caller included. It is the only way a name changes.
  *
  * @module
  */
@@ -293,7 +293,7 @@ router.patch(
       throw new APIException(400, "Invalid request");
     }
     const user = resolveUserKey(ctx.params.key);
-    const publicUser = toPublicUser(renameUser(user.id, username, true));
+    const publicUser = toPublicUser(renameUser(user.id, username));
     updateClientUsername(publicUser.id, publicUser.username);
     broadcastUserUpdated(publicUser);
     const responseBody: APIResponse<PublicUser> = {