Learned from whey.party/red-dwarf, which solves authenticated feeds the clean way: call getFeedSkeleton on the viewer's OWN PDS with the atproto-proxy: <feedGenDid>#bsky_fg header (via agent.withProxy). The PDS authenticates the session, mints/forwards service-auth to the generator, and proxies the response. This replaces our Slingshot-batch-proxy + manual getServiceAuth/'Bearer' dance: - works on web (the PDS serves CORS headers, unlike a direct generator call) - works for ALL generators incl. foryou.club, with personalization - no manual token minting, no Bearer juggling - still AppView-independent (PDS -> generator, never Bluesky's AppView) Records are still hydrated from microcosm (Slingshot + Constellation counts). Logged out falls back to Slingshot's public batch skeleton.