Merge pull request 'docs(safety): record USER_SAFETY step 5, the walk on a local copy of the demo' (#402) from docs/user-safety-step5-walk into main

Reviewed-on: #402

website/USER_SAFETY.md

@@ -1,7 +1,8 @@
 # Report, block and hide — user safety on the website and in the app
 
 **Status:** plan of record, 2026-10-29. Steps 2 (core), 3 (Module-Rust, Integration Kit) and 4
-(Android) built 2026-10-30 (§7); the rest not yet.
+(Android) built 2026-10-30, and step 5's walk done the same day on a local copy of the demo (§7);
+step 6 not yet.
 Each phase stops for the org lead before the next one starts. Built after account deletion
 ([`ACCOUNT_DELETION.md`](ACCOUNT_DELETION.md)), which is why it is `MODULE_API` 1.21.0. §4 was
 amended by S11-S14 (§5) when the core was built.
@@ -256,4 +257,58 @@ Play declarations gain "user-generated content: collected". M21 says so.
 5. **A walk** on the demo after the next wipe: report, hide and block, each on the web and in the
    app; *Hide for everyone* from the queue; a blocked Steam ID that later links to an account stays
    blocked.
+
+   **Walked 2026-10-30 on a local copy of the demo, not on the demo itself** (org lead: check it
+   locally and leave the demo alone unless it needs something). The copy: website `main` (the
+   1.21.0 merge) with `DEMO_MODE=true`, Module-Rust `edge` (#72) in its modules directory, a
+   throwaway database seeded by `npm run seed:demo` from the demo's own `deploy/demo/seed.json`. The
+   rig has no players and a Steam ID can only be linked with `/link` in game, so the walk's data was
+   written into the tables instead (org lead: seed what the walk needs): nine chat lines and a death
+   on the `demo` server from four stand-in Steam IDs (two unlinked, demo-player's, and a new one
+   linked to demo-moderator), and that server's presence opened to `public`. S14's link was written
+   as `/link` writes it, to a player account demo-admin created (creating users is open on the demo).
+
+   - **API**, 30 rows, all passed, over bearer sign-ins as the demo's accounts. None of the routes is
+     demo-locked. Signed out: every line, no `canBlock`, a report refused 401. demo-player's
+     `canBlock` was true for the two unlinked speakers and false for its own line and
+     demo-moderator's. A report reached the queue with its snapshot, and a second report of the line
+     was refused 409; a death's id was 404. *Hide for me* hid one line for demo-player only.
+     Blocking an unlinked speaker made a Steam-ID block and took their chat, not their death, out of
+     demo-player's feed only. Blocking demo-moderator's line was `403 staff`. play-review blocking
+     demo-player's line made an account block. *Hide for everyone* from the queue actioned the
+     report and took the line out for members and signed-out readers; staff saw it marked, and the
+     line's own route showed it again (a player got 403); the activity log has both. A Steam-ID block
+     whose ID was then linked read back as an account block, and the lines stayed out (S14).
+     *Unblock* and *Show them again* undid everything.
+   - **Web**, in Chrome. Signed out, the `⋯` menu said *Sign in to report or block*. As
+     demo-player: *Report* (sent, "Reported to site staff"), *Hide for me*, *Block player* with its
+     confirmation; no *Block* on demo-moderator's line or its own. *Account → Blocked* listed the
+     Steam-ID block and the hidden item, then, after the link, the block as an account block on the
+     new account (S14). As demo-moderator, the Reports queue showed the line from its snapshot,
+     *Hide for everyone* actioned it, and the feed showed the line marked *Hidden by staff* with
+     *Show to everyone again*. No console errors.
+   - **App**, `edge` debug build on the `Medium_Phone_API_36.1` emulator, its data cleared. Signed
+     out, a long press offered only *Sign in*, which opened the login screen. As demo-player:
+     *Report* with a reason and a detail (the row has both, and the snapshot), *Hide for me*,
+     *Block player* with its confirmation (Ash's chat gone, Rook's death still there); no *Block*
+     on demo-moderator's line or its own. *Account → Blocked* listed the Steam-ID block, then the
+     account block after the link (S14), with the speaker's lines still out. As demo-moderator,
+     *Hide for everyone* dimmed the line and marked it *Hidden by staff*, a signed-out read lost it,
+     and *Show to everyone again* brought it back; the activity log has `rust.chat.hide` and
+     `rust.chat.unhide`.
+
+   **What the walk found about the demo itself** (none of it changed; each is the org lead's call):
+
+   - **W1. The demo shows no chat to members.** Its `demo` server inherits the fleet's presence
+     default, `staff`, so demo-player and a signed-out visitor see no feed at all. Only demo-admin,
+     demo-moderator and play-review do.
+   - **W2. There is no chat on the demo to report.** Chat lines come only from players on the rig,
+     and nobody plays there, so even the staff accounts have nothing to long-press. The walk's
+     lines were written into the tables.
+   - **W3. play-review is an admin**, so a Play reviewer is staff. They get *Hide for everyone* in
+     the menu and see staff-hidden lines, and the block refusal and *Not applied* (S8) do not apply
+     to them. They can still report, hide and block.
+   - **W4. The demo runs Module-Rust v0.6.3**, the newest release, which has neither this feature
+     nor account deletion's unlink (#70, #72 are on `edge`). The edge → `main` cutover was held so
+     the demo is not changed by its next wipe.
 6. Then `android/PLAN.md` M8's cutover (S5).