DocFast session 90: v0.5.0 production deploy detected

projects/snapapi/memory/sessions.md

@@ -1,5 +1,28 @@
 # SnapAPI Session Log
 
+## Session 19 — 2026-02-24 14:00 UTC (Error Handling Hardening)
+
+**Goal:** Fix error status codes found during QA.
+
+### What Was Done
+
+1. **Fixed `javascript:` URLs returning 500 instead of 400:**
+   - Changed SSRF error message to match catch pattern ("URL protocol not allowed")
+   - Now returns 400 with clear message
+
+2. **Fixed unresolvable hostnames returning 500 instead of 400:**
+   - Added "Could not resolve" to error pattern matching in both playground and screenshot routes
+   - Now returns 400 with "Could not resolve hostname"
+
+3. **Commit b07b9cf, deployed to staging, all 3 test cases verified:**
+   - `javascript:alert(1)` → 400 ✅
+   - `https://nonexistent.host` → 400 ✅  
+   - `https://example.com` → 200 ✅
+
+### Production: Healthy, unchanged. Still awaiting v0.5.0 approval.
+
+---
+
 ## Session 18 — 2026-02-24 11:00 UTC (QA + BUG-011 Fix)
 
 **Goal:** Production QA, fix bugs found.