comments: threads_comment_id/author never persisted + Meta /replies returns no id/from for third-party commenters

[ajianaz]

Summary

First real inbound comment exposed three layered problems in the comments pipeline:

1. Meta returns no id / from for third-party commenters — GET /v1.0/{post}/replies?fields=id,text,from,timestamp returns only text. Observed across two accounts (codecoradev, guyonlelucon) and multiple posts on v0.9.3. Suspected standard-access field redaction (both apps lack App Review); needs confirmation against docs or with an app-review'd token.
2. threads_comment_id is never persisted even when present — Store::insert_comment() accepts (id, post_id, author_username, author_user_id, text) and inserts 6 columns; the comments.threads_comment_id column (migration 001) and CommentData.threads_comment_id (threads_client) exist but the value is dropped in the route. Consequence: POST /api/comments/{id}/reply always fails with NO_THREADS_ID — API reply is dead code in practice.
3. No dedup on re-fetch — fetching the same post twice stored the same comment twice (verified: identical text, different fetched_at). No natural key exists today.

Evidence (production, 2026-09-10)

• Post DdGzof4gbDd (canary carousel): comment from @taufikabayy visible in UI with its own shortcode DdHALqWEsvS (via CloakBrowser DOM), but stored row has author_username: null, threads_comment_id: null.
• 3/3 stored comments across accounts: 0 with author, 0 with threads_comment_id.
• Duplicate row proof: same comment text stored at 14:37:14 and 14:37:49 after two fetches.

Impact

• Dashboard shows anonymous comment text only — cannot attribute or thread.
• Reply-via-API unusable (NO_THREADS_ID guaranteed).
• Mention/engagement workflows can't route by author.

Fix plan

• Confirm Meta behavior: minimal repro on the titen host (token is encrypted at rest) — curl the replies edge with/without fields, check threads_basic standard vs advanced access docs.
• insert_comment accepts + persists threads_comment_id (and fix route to pass cd.threads_comment_id).
• Dedup: unique index on (post_id, threads_comment_id) once IDs exist; interim fallback = (post_id, text, author) matching to skip re-inserts.
• Optional enrichment: backfill author/id for stored comments via CloakBrowser shortcode mapping (proven to work), or re-fetch once Meta returns fields.

Reported from live incident: first real comment on the v0.9.3 canary carousel.

[ajianaz]

Fixed in #262 (merged to develop).

• threads_comment_id now persisted (reply-via-API unblocked when Meta returns ids)
• Dedup: id-keyed, with author-aware text fallback for id-less rows
• In-place attribution backfill (same-author/anonymous rows only)

Remaining open item (not actionable in code): confirming whether Meta returns id/from for third-party commenters under advanced access / after App Review — docs indicate username/permalink are limited to public users + own user, which matches our production observation. Re-test after App Review; if ids become available, existing id-less rows will backfill automatically on the next fetch (in-place attribution, covered by tests).