Description
Tracked here because Dots repo has no backlog: (1) settings components (ScriptableWidgetSettings + CliTokenSettings) swallow fetch/generate/revoke errors, no error UI; (2) copy-feedback setTimeout not cleaned on unmount (both components); (3) resolveSubscribedUserId session branch duplicates getSubscribedUserId (drift risk); (4) route tests for both auth kinds per spec (repo has no test runner); (5) narrow middleware /api/days/(.*) matcher to blocks+notes if tightening.