DocFast session 90: v0.5.0 production deploy detected

projects/snapapi/memory/sessions.md

@@ -1,5 +1,28 @@
 # SnapAPI Session Log
 
+## Session 19 — 2026-02-24 14:00 UTC (Error Handling Hardening)
+
+**Goal:** Fix error status codes found during QA.
+
+### What Was Done
+
+1. **Fixed `javascript:` URLs returning 500 instead of 400:**
+   - Changed SSRF error message to match catch pattern ("URL protocol not allowed")
+   - Now returns 400 with clear message
+
+2. **Fixed unresolvable hostnames returning 500 instead of 400:**
+   - Added "Could not resolve" to error pattern matching in both playground and screenshot routes
+   - Now returns 400 with "Could not resolve hostname"
+
+3. **Commit b07b9cf, deployed to staging, all 3 test cases verified:**
+   - `javascript:alert(1)` → 400 ✅
+   - `https://nonexistent.host` → 400 ✅  
+   - `https://example.com` → 200 ✅
+
+### Production: Healthy, unchanged. Still awaiting v0.5.0 approval.
+
+---
+
 ## Session 18 — 2026-02-24 11:00 UTC (QA + BUG-011 Fix)
 
 **Goal:** Production QA, fix bugs found.

projects/snapapi/memory/state.json

@@ -76,6 +76,6 @@
       "priceId": "price_1T2XHpRtlDv9c8GoThHfd8kS"
     }
   },
-  "lastSession": "2026-02-24T11:00:00Z",
+  "lastSession": "2026-02-24T14:00:00Z",
   "codeLocation": "Forgejo repo openclawd/SnapAPI. Clone: git clone forgejo-snapapi:openclawd/SnapAPI.git"
 }