max / makenotwork

Audit remediation: Run 23 + Run 24 fixes, site-docs refresh Run 23: split exports/health/user into modules, consolidate cart and download access queries, stream content exports, harden archive decompression fallback, tighten CSV email validation, add README. Run 24: add starts_at promo validation to guest checkout, use atomic try_replace_storage for version file replacement, change pending_uploads to ON CONFLICT DO NOTHING, remove idempotency middleware double allocation. Site-docs updated for accuracy and consistency.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Max J. <87768334+MaxJMath@users.noreply.github.com> · 2026-05-09 21:34 UTC

Commit: 92a08691b09b96c251448000fc077610a491ff03

Parent: 42405fe

49 files changed, +1838 insertions, -1820 deletions

M server/docs/audit_review.md +161 -159

			@@ -1,11 +1,11 @@
1	1		# MakeNotWork -- Audit Review
2	2
3		-	Last audited: 2026-05-09 (Run 22, Ultra Fuzz -- 5-axis deep audit)
4		-	Previous audit: 2026-05-08 (Run 21, Ultra Fuzz -- 5-axis deep audit)
	3	+	Last audited: 2026-05-09 (Run 24, Ultra Fuzz -- 5-axis deep audit)
	4	+	Previous audit: 2026-05-09 (Run 23, Ultra Fuzz -- 5-axis deep audit)
5	5
6	6		## Overall Grade: A
7	7
8		-	Run 22: Ultra Fuzz (Payments, Storage, UX Wiring, Security, Performance). v0.5.9. ~87,853 LOC. 1,215 test annotations. 105 migrations. 1 SERIOUS finding (UX), 0 CRITICAL. 3 cold spots. All Run 21 action items fixed (12/12). Security posture A+. Observability gaps resolved (embed/, payments/ now instrumented).
	8	+	Run 24: Ultra Fuzz (Payments, Storage, UX Wiring, Security, Performance). v0.5.9. ~88,082 LOC. ~1,215 test annotations. 107 migrations. 2 SERIOUS + 3 MINOR findings identified, all fixed in same-day remediation (1 false positive). 0 cold spots (all 2 resolved). 5/5 axes at A. All Run 23 fixes verified intact. No regressions.
9	9
10	10		## Scorecard
11	11
			@@ -13,19 +13,19 @@
13	13		\|-----------\|:-----:\|-------\|
14	14		\| Code Quality \| A \| Zero .unwrap() in production paths. Clean macro patterns throughout \|
15	15		\| Architecture \| A \| Clean layer separation. Trait-based backends for storage/email/payments \|
16		-	\| Testing \| A \| 1,215 test annotations, proptest active, adversarial tests, comprehensive harness \|
17		-	\| Security \| A+ \| SHA-256-based constant-time compare, fail-closed scanning, CSRF everywhere, Argon2id, HMAC webhooks, PKCE S256 \|
18		-	\| Performance \| A \| Discover facet queries now parallelized via try_join!. Scheduler lock pinned. No remaining bottlenecks at launch scale \|
19		-	\| Documentation \| A- \| Module-level //! on all major files. No README.md \|
	16	+	\| Testing \| A \| ~1,215 test annotations, proptest active, adversarial tests, comprehensive harness \|
	17	+	\| Security \| A \| Constant-time compare, fail-closed scanning, CSRF everywhere, Argon2id, HMAC webhooks, PKCE S256. DUMMY_HASH pattern on all login paths \|
	18	+	\| Performance \| A \| Cart and download queries consolidated. Export writes to ZIP one-by-one. Advisory lock pinned \|
	19	+	\| Documentation \| A \| Module-level //! on all major files. README.md present \|
20	20		\| Dependencies \| A- \| 4 transitive advisories (none exploitable). async-trait retained (required for dyn dispatch) \|
21		-	\| Frontend \| A \| Askama auto-escape, json_escape prevents JSON-LD XSS, HTMX patterns consistent \|
	21	+	\| Frontend \| A \| Askama auto-escape, json_escape prevents JSON-LD XSS, HTMX patterns consistent. CSRF field names consistent \|
22	22		\| Type Safety \| A+ \| 36 UUID newtypes, 25+ domain enums, validated string types, Cents/PriceCents monetary newtypes \|
23		-	\| Observability \| A \| All route modules now instrumented including embed/ and payments/ (chronic items resolved) \|
24		-	\| Concurrency \| A \| ON CONFLICT, FOR UPDATE, DashMap caches. Scheduler advisory lock now pinned to connection \|
	23	+	\| Observability \| A \| All route modules instrumented including embed/ and payments/ \|
	24	+	\| Concurrency \| A \| ON CONFLICT, FOR UPDATE, DashMap caches. Scheduler advisory lock pinned. Promo code atomically reserved at checkout \|
25	25		\| Resilience \| A \| Graceful shutdown with 10s deadline, timeouts on all outbound calls, fail-closed scanning \|
26	26		\| API Consistency \| A \| ListResponse wrapper, json_error_layer, versioned SyncKit routes \|
27		-	\| Migration Safety \| A \| 105 additive migrations, IF NOT EXISTS guards, TIMESTAMPTZ throughout \|
28		-	\| Codebase Size \| A- \| ~88K LOC. Oversized files remain (exports.rs, health.rs, tabs/user.rs) \|
	27	+	\| Migration Safety \| A \| 107 additive migrations, IF NOT EXISTS guards, TIMESTAMPTZ throughout \|
	28	+	\| Codebase Size \| A \| All three oversized files split into modules. health/mod.rs at 749 (monolithic probe fn) \|
29	29
30	30		## Module Heatmap
31	31
			@@ -35,7 +35,7 @@
35	35		\| config.rs \| A \| A \| A \| A \| n/a \| A \| A \| A- \| A \|
36	36		\| error.rs \| A \| A \| A \| A \| n/a \| A \| A \| A \| A \|
37	37		\| auth.rs \| A \| A \| A- \| A+ \| A \| A \| A \| A \| A \|
38		-	\| csrf.rs \| A \| A \| A \| A \| A- \| A \| A \| A- \| A \|
	38	+	\| csrf.rs \| A+ \| A \| A \| A+ \| A- \| A \| A \| A- \| A \|
39	39		\| constants.rs \| A+ \| n/a \| A \| A \| n/a \| A- \| A \| n/a \| A \|
40	40		\| helpers.rs \| A \| A \| A \| A \| A \| A \| A- \| B+ \| A \|
41	41		\| rate_limit.rs \| A \| A \| A- \| A \| A \| A \| A \| A \| A \|
			@@ -45,6 +45,7 @@
45	45		\| formatting.rs \| A \| A \| A+ \| A \| A \| A- \| A \| n/a \| A \|
46	46		\| rss.rs \| A \| A \| A \| A \| A \| A \| A- \| n/a \| A \|
47	47		\| synckit_auth.rs \| A \| A \| A \| A \| A \| A \| A \| A \| A \|
	48	+	\| metrics.rs \| A \| A \| n/a \| A \| A- \| A \| A \| A \| A \|
48	49		\| db/enums.rs \| A \| A \| A \| A \| n/a \| A \| A+ \| n/a \| A \|
49	50		\| db/id_types.rs \| A \| A \| A \| n/a \| n/a \| A \| A+ \| n/a \| A \|
50	51		\| db/validated_types.rs \| A \| A \| A+ \| A \| A \| A \| A+ \| n/a \| A \|
			@@ -54,7 +55,7 @@
54	55		\| db/transactions.rs \| A \| A \| B+ \| A \| A \| A \| A \| A \| A \|
55	56		\| db/discover.rs \| A \| A \| B \| A \| A \| A \| A \| n/a \| A- \|
56	57		\| db/cart.rs \| A \| A \| B \| A \| A \| A \| A \| n/a \| A \|
57		-	\| db/creator_tiers.rs \| A \| A \| A \| A \| A \| A \| A \| n/a \| A \|
	58	+	\| db/creator_tiers.rs \| A \| A+ \| A \| A \| A \| A \| A \| n/a \| A \|
58	59		\| db/versions.rs \| A \| A \| A \| A \| A \| A \| A \| n/a \| A \|
59	60		\| db/builds.rs \| A \| A+ \| A \| A \| A \| A \| A \| n/a \| A \|
60	61		\| db/pending_refunds.rs \| A \| A \| B \| A \| A \| A \| A \| n/a \| A \|
			@@ -62,34 +63,41 @@
62	63		\| db/promo_codes.rs \| A \| A \| A \| A \| A \| A \| A \| n/a \| A \|
63	64		\| db/tips.rs \| A \| A \| B \| A \| A \| A \| A \| n/a \| A \|
64	65		\| db/idempotency.rs \| A \| A \| B- \| A \| A \| A \| A \| n/a \| A \|
	66	+	\| db/pending_uploads.rs \| B+ \| A \| n/a \| A \| A \| A \| A \| n/a \| A \|
65	67		\| db/models/* \| A \| A \| B+ \| A \| n/a \| A- \| A \| n/a \| A \|
66	68		\| types/ \| A \| A \| B \| A \| n/a \| A \| A \| n/a \| A \|
67	69		\| scanning/ \| A \| A+ \| A- \| A+ \| A- \| A \| A- \| A \| A \|
	70	+	\| scanning/archive.rs \| A \| A \| A- \| A- \| A- \| A \| A- \| A \| A \|
68	71		\| payments/ \| A \| A \| A- \| A \| A- \| A \| A \| A \| B+ \|
69	72		\| email/ \| A \| A \| A \| A \| A- \| A \| A \| B+ \| A- \|
70		-	\| scheduler/ \| A \| A \| B+ \| A \| A \| A \| A \| A- \| A \|
	73	+	\| scheduler/ \| A \| A+ \| B+ \| A \| A \| A \| A \| A- \| A \|
71	74		\| scheduler/cleanup.rs \| A \| A \| n/a \| A \| A \| A \| A \| A- \| A \|
72	75		\| validation/ \| A \| A \| A+ \| A+ \| A \| B+ \| A \| n/a \| A \|
73	76		\| import/ \| A \| A \| A \| A \| B+ \| A- \| A \| B+ \| A \|
74	77		\| git/ \| A \| A \| A \| A+ \| B+ \| A- \| A \| B \| A \|
75		-	\| git_ssh.rs \| A \| A \| A \| A- \| A \| A- \| A \| B+ \| A \|
	78	+	\| git_ssh.rs \| A \| A \| A \| A \| A \| A- \| A \| B+ \| A \|
76	79		\| build_runner.rs \| A \| A- \| B+ \| A+ \| A- \| A- \| A \| A \| A \|
77		-	\| monitor.rs \| A \| A \| A- \| A \| A \| A \| A \| A \| A \|
78		-	\| templates/ \| A \| A- \| n/a \| B+ \| A \| A- \| A \| B+ \| B+ \|
	80	+	\| monitor.rs \| A \| A \| A- \| A \| A \| A \| A \| A+ \| A \|
	81	+	\| templates/ \| A \| A- \| n/a \| A \| A \| A- \| A \| B+ \| B+ \|
79	82		\| routes/auth.rs \| A \| A \| n/a \| A+ \| A \| A \| A \| A \| A \|
80	83		\| routes/oauth.rs \| A \| A \| n/a \| A- \| A \| A \| A \| A- \| A- \|
81	84		\| routes/admin/ \| A \| A \| n/a \| A \| A \| A \| A \| A \| A \|
82		-	\| routes/api/ \| A \| A \| n/a \| A \| A \| A \| A \| A \| B+ \|
83		-	\| routes/api/exports.rs \| A- \| A- \| n/a \| A \| B- \| A \| A \| A \| B \|
84		-	\| routes/stripe/ \| A \| A \| n/a \| A \| A- \| A \| A \| A \| B+ \|
	85	+	\| routes/api/ \| A \| A \| n/a \| A \| A \| A \| A \| A \| B+ \|
	86	+	\| routes/api/guest_checkout.rs \| B \| A \| n/a \| B \| A \| A \| A \| A \| A \|
	87	+	\| routes/api/cart.rs \| A \| A \| n/a \| A \| A- \| A \| A \| A \| A \|
	88	+	\| routes/api/exports/ \| A- \| A- \| n/a \| A \| A- \| A \| A \| A \| A- \|
	89	+	\| routes/stripe/ \| A \| A \| n/a \| A \| A- \| A \| A \| A \| B+ \|
85	90		\| routes/stripe/checkout/ \| A \| A \| n/a \| A- \| A \| A \| A \| A \| A \|
	91	+	\| routes/stripe/checkout/cart.rs \| A \| A \| n/a \| A- \| A \| A \| A \| A \| A \|
86	92		\| routes/synckit/ \| A \| A \| n/a \| A \| A- \| A \| A \| A \| A \|
87	93		\| routes/pages/discover.rs \| A \| A \| n/a \| A \| A \| B+ \| A \| A \| A \|
88		-	\| routes/pages/ (other) \| A \| A \| n/a \| A \| A \| A \| A \| A- \| B+ \|
	94	+	\| routes/pages/ (other) \| A \| A \| n/a \| A \| A \| A \| A \| A- \| B+ \|
89	95		\| routes/embed/ \| A \| A \| n/a \| A \| A \| A- \| A \| A \| A \|
90	96		\| routes/git/ \| A \| A \| n/a \| A \| A \| A \| A \| A \| A \|
91	97		\| routes/storage/ \| A \| A \| n/a \| A \| A \| A \| A \| A \| A \|
	98	+	\| routes/storage/versions.rs \| B- \| A- \| n/a \| A \| A \| A \| A \| A \| A \|
92	99		\| routes/storage/uploads.rs \| A \| A \| n/a \| A \| A \| A \| A \| A \| A \|
	100	+	\| routes/storage/downloads.rs \| A \| A \| n/a \| A \| A- \| A \| A \| A \| A \|
93	101		\| routes/storage/images.rs \| A \| A \| n/a \| A \| A \| A \| A \| A \| A \|
94	102		\| routes/postmark/ \| A \| A \| n/a \| A \| A \| A \| n/a \| A- \| B+ \|
95	103
			@@ -97,197 +105,207 @@
97	105
98	106		### Cold Spots
99	107
100		-	1. templates/ security (B+): Three templates (`fan_plus.html`, `project.html`, `sandbox.html`) use `name="csrf_token"` but CSRF middleware extracts `_csrf`. Forms with these fields will fail CSRF validation with 403.
101		-	2. routes/api/exports.rs performance (B-): Content export downloads all S3 files into RAM before zipping. 2 GB cap exists but entire payload is buffered in memory. At concurrent exports, memory exhaustion is possible.
102		-	3. routes/api/exports.rs size (B): 842 LOC, above 500-line guideline. Chronic from Run 21.
	108	+	None. All Run 24 cold spots resolved in remediation.
103	109
104		-	### Resolved Cold Spots (from Run 21)
	110	+	### Resolved Cold Spots (from Run 24)
105	111
106		-	- ~~routes/pages/discover.rs performance (B) + architecture (B-)~~ -- Facet queries now parallelized with `tokio::try_join!`.
107		-	- ~~scheduler/ concurrency (B+)~~ -- Advisory lock now pinned to acquired connection.
108		-	- ~~db/cart.rs correctness (B+)~~ -- PWYW minimum now enforced in `effective_price_cents()`.
109		-	- ~~routes/embed/ observability (B)~~ -- All embed handlers now instrumented.
110		-	- ~~payments/ observability (B+)~~ -- All payment functions now instrumented.
	112	+	- ~~routes/api/guest_checkout.rs (B)~~ -- Added `starts_at` promo code validation. Matches all authenticated checkout paths.
	113	+	- ~~routes/storage/versions.rs (B-)~~ -- Now uses atomic `try_replace_storage` for file replacements. No separate decrement/increment.
	114	+
	115	+	### Resolved Cold Spots (from Run 23)
	116	+
	117	+	- ~~versions.rs transaction safety (B)~~ -- Old S3 key now enqueued for deletion via `pending_s3_deletions`.
	118	+	- ~~cart.rs performance (B-)~~ -- Consolidated into single-query `toggle_cart_preflight()`.
	119	+	- ~~downloads.rs performance (B-)~~ -- Consolidated into single-query `check_item_access()`.
	120	+	- ~~exports.rs performance (B-) + size (B)~~ -- Files written directly to ZIP one-by-one. Module split into `exports/mod.rs` + `exports/content.rs`.
	121	+	- ~~archive.rs security (B+)~~ -- Decompression fallback uses 10x conservative multiplier.
	122	+	- ~~checkout/cart.rs correctness (B+)~~ -- Was false positive; atomic `try_increment_use_count` already in place at checkout creation.
111	123
112	124		## Mandatory Surprises
113	125
114		-	Run 22 (5 surprises, one per axis):
	126	+	Run 24 (5 surprises, one per axis):
115	127
116		-	1. Payments -- Webhook signature verification (unexpectedly good): `payments/webhooks.rs:186-231` implements constant-time HMAC verification with configurable timestamp tolerance, distinct error messages per failure mode, and comprehensive edge-case tests (stale timestamps, future timestamps, wrong secret). Gold standard implementation.
	128	+	1. Payments -- Claim token architecture for guest purchases (unexpectedly good): `db/transactions.rs:74-173` creates unattached transactions with unique `claim_token`, sends secure download link, claims idempotently via `ON CONFLICT DO NOTHING`. Cryptographically sound, race-free, elegant.
117	129
118		-	2. Storage -- Cleanup scheduler resource lifecycle (unexpectedly good): `scheduler/cleanup.rs` enqueues S3 deletions as durable records BEFORE any destructive work (fail-closed), retries with exponential backoff and attempt counting, decouples DB cleanup from S3 cleanup with transaction boundaries. The `pending_s3_deletions` queue survives crashes. Production-grade pattern.
	130	+	2. Storage -- recalculate_all_storage_batch LATERAL join (unexpectedly good): `db/creator_tiers.rs:458-508` recalculates storage for ALL creators in a single query using LATERAL join instead of N+1 loop. Shows architectural awareness.
119	131
120		-	3. UX Wiring -- Form error recovery (unexpectedly good): Login and form error patterns preserve user input via browser/HTMX state without re-rendering from server, avoiding the security footgun of echoing user input. Error messages are plain text, not reflected user input. Small UX detail that most platforms get wrong.
	132	+	3. UX Wiring -- CSRF constant-time token comparison (unexpectedly good): `csrf.rs:61` uses `constant_time_compare()` for CSRF token validation. Most web frameworks skip this detail. Combined with dual-layer extraction (header + body), this is production-hardened CSRF.
121	133
122		-	4. Security -- Defense-in-depth layering (unexpectedly good): Email tokens use HMAC-SHA256 with constant-time comparison + expiry bounds. Password reset URLs bind to password_hash (changing password invalidates links). Login tokens use double-hash (token in email, hash in DB). Passkey counter prevents cloning. TOTP replay prevention via `last_used_step`. Six independent layers, each independently correct.
	134	+	4. Security -- TOTP replay prevention via explicit time step matching (unexpectedly good): `routes/api/totp.rs:254-266` stores matched time step in DB, rejects monotonically non-increasing steps. Completely eliminates TOTP replay across skew window. Most platforms get this wrong.
123	135
124		-	5. Performance -- Export buffering (unexpectedly bad): `routes/api/exports.rs:656-680` downloads all S3 content files into `Vec<u8>` in RAM before building ZIP. With a 2 GB per-export cap, two concurrent exports could spike heap to 4+ GB. The rest of the codebase carefully uses presigned URLs for client-direct downloads, making this anomaly stand out.
	136	+	5. Performance -- Storage quota atomicity with idempotency checks (unexpectedly good): `routes/storage/uploads.rs:206-219` checks idempotency before touching quotas, uses atomic `try_replace_storage` for file replacements. Sophisticated and rarely seen.
125	137
126	138		### Previous Surprises
127	139
128		-	Run 21: Pending refund bidirectional matching, claim_pending_build FOR UPDATE SKIP LOCKED, json_escape, SHA-256-based constant_time_compare, scheduler advisory lock unpinned (bad, now fixed).
	140	+	Run 23: Webhook signature gold standard, atomic storage quota enforcement, CSRF dual-layer extraction, archive decompression fallback (bad, fixed), advisory lock protocol.
129	141
130		-	Run 20: Scanning module -- 6-layer anti-malware with actual decompression, VMProtect/UPX detection, ZIP bomb byte counting.
	142	+	Run 22: Webhook signature gold standard, cleanup scheduler durable queue, form error recovery, defense-in-depth 6 layers, export RAM buffering.
	143	+
	144	+	Run 21: Pending refund bidirectional matching, claim_pending_build FOR UPDATE SKIP LOCKED, json_escape, SHA-256 constant_time_compare, scheduler advisory lock unpinned (bad, fixed).
	145	+
	146	+	Run 20: Scanning module -- 6-layer anti-malware with decompression, VMProtect/UPX detection, ZIP bomb byte counting.
131	147
132	148		Run 19: Hand-rolled Stripe v2 webhook signature verification with replay protection.
133	149
134		-	Run 18: Sandbox tier mismatch bug (SmallFiles vs small_files). Fixed.
135		-
136		-	Run 17: TOCTOU-safe slug generation with retry loop + advisory lock pattern for sandbox IP cap.
137		-
138		-	Run 15: Session touch cache -- DashMap with 30s TTL avoids N+1 session queries.
139		-
140	150		## Strengths
141	151
142	152		### 1. Security-in-depth
143		-	Zero SQL injection vectors across 200+ queries. Argon2id (46MiB/2 iterations), SHA-256-based constant-time comparison (length-independent), CSRF synchronizer tokens, session fixation prevention, account lockout with anti-enumeration dummy hashes, PKCE S256 required, rate limiting on all endpoint classes, HMAC-signed URLs, 6-layer malware scanning with fail-closed, ZIP bomb detection, path traversal prevention, shell command validation, TOTP replay prevention via `last_used_step`, passkey counter updates preventing cloning attacks.
	153	+	Zero SQL injection vectors across 200+ queries. Argon2id (46MiB/2 iterations), SHA-256-based constant-time comparison, CSRF synchronizer tokens (constant-time validated), session fixation prevention, account lockout with anti-enumeration dummy hashes on ALL login paths (web, SyncKit, OAuth), PKCE S256 required, rate limiting on all endpoint classes, HMAC-signed URLs, 6-layer malware scanning with fail-closed, ZIP bomb detection with 10x conservative multiplier, path traversal prevention, shell command validation, TOTP replay prevention via time step tracking, passkey counter updates.
144	154
145	155		### 2. Type safety discipline
146		-	36 UUID newtypes via `define_pg_uuid_id!`, 25+ domain enums via `impl_str_enum!`, validated string types (Username, Slug, KeyCode), Cents/PriceCents monetary newtypes with proptest coverage. Compile-time template verification via Askama. All money math in integer cents (i32/i64), zero floating point in money paths. `SUM(BIGINT)::BIGINT` cast used consistently across all aggregate queries. License keys use CSPRNG (5 random words from 2048-word list, ~55 bits entropy).
	156	+	36 UUID newtypes via `define_pg_uuid_id!`, 25+ domain enums via `impl_str_enum!`, validated string types, Cents/PriceCents monetary newtypes with proptest coverage. All money math in integer cents (i32/i64), zero floating point in money paths. `SUM(BIGINT)::BIGINT` cast used consistently. License keys use CSPRNG (~55 bits entropy). FOR UPDATE row locking on license activation prevents TOCTOU.
147	157
148	158		### 3. Payment robustness
149		-	Three-layer webhook idempotency (event dedup table, status-based WHERE clauses, ON CONFLICT). Bidirectional pending refund matching. Atomic promo code reservation with cleanup on abandonment. `FOR UPDATE` row locking on tier deletion, license activation, pending refund claims. Self-purchase blocked across all checkout paths. Cart PWYW minimum now enforced. Tip amounts capped ($1-$10,000).
	159	+	Three-layer webhook idempotency. Bidirectional pending refund matching. Atomic promo code enforcement at DB level. `FOR UPDATE` row locking on tier deletion, license activation, pending refund claims. Self-purchase blocked across all paths. Cart PWYW minimum enforced. Tip amounts capped. Guest purchase claim tokens are cryptographically sound and idempotent.
150	160
151		-	### 4. Operational maturity (NEW)
152		-	All Run 21 action items fixed (12/12) in one day. Chronic observability gaps in embed/ and payments/ resolved after two runs. Scheduler advisory lock pinned. Soft-delete purge now handles version S3 keys and storage decrement. Confirm uploads wrapped in transactions. Discover page parallelized. Pending S3 deletions durable queue deployed (migration 105).
	161	+	### 4. Operational maturity
	162	+	All Run 22-23 fixes verified intact. Idempotency key scope widened (migration 106). Pending S3 deletions UNIQUE constraint (migration 107). Scheduler advisory lock pinned. Soft-delete purge handles version S3 keys. Confirm uploads wrapped in transactions. Discover page parallelized. Content exports stream one-by-one. N+1 queries consolidated.
153	163
154	164		## Weaknesses
155	165
156		-	### 1. Export memory buffering (NEW)
157		-	Content export downloads all S3 files into RAM (up to 2 GB) before zipping. First real memory exhaustion vector at concurrent usage. Should stream ZIP directly or export to S3 with presigned download URL.
	166	+	### Active (Run 24)
158	167
159		-	### 2. CSRF token field name mismatch (NEW)
160		-	Three templates use `csrf_token` field name but middleware extracts `_csrf`. Affected forms: fan_plus.html, project.html tip form, sandbox.html. These POST forms will fail with 403 if submitted without HTMX (which injects the token via header instead).
	168	+	- Guest checkout promo code validation gap -- Missing `starts_at` check allows future-dated codes to be used early by guest buyers. Easy fix (2 lines).
	169	+	- Version replace storage counter corruption -- Decrement-then-increment is not atomic. If increment fails, old storage is permanently lost from counter. Should use `try_replace_storage` or re-increment on failure.
161	170
162		-	### 3. Idempotency key scope too narrow (NEW)
163		-	Unique constraint is `(key, user_id)` but should be `(key, user_id, method, path)`. Same key reused across different endpoints returns cached response from the first endpoint. Low probability in practice (clients generate per-request keys) but schema should match intent.
	171	+	### Resolved (Run 23)
164	172
165		-	### 4. async-trait retained (RESOLVED -- not removable)
166		-	3 trait definitions use `async-trait` for dyn-compatible async dispatch. Rust 2024 native async fn in traits is not dyn-compatible. Closing chronic item.
	173	+	- ~~Version S3 key leak~~ -- Fixed. Old keys now enqueued via `pending_s3_deletions`.
	174	+	- ~~Archive decompression fallback~~ -- Fixed. 10x conservative multiplier on decompression error.
	175	+	- ~~Export memory buffering~~ -- Fixed. Files written to ZIP one-by-one.
	176	+	- ~~N+1 query patterns~~ -- Fixed. Cart and download access control consolidated.
167	177
168	178		## Bug Reports by Axis
169	179
170	180		### Payments
171		-	0 SERIOUS, 0 MINOR, 3 NOTE
	181	+	0 CRITICAL, 1 SERIOUS, 0 MINOR, 2 NOTE
172	182
173	183		\| # \| Sev \| Location \| Description \|
174	184		\|---\|-----\|----------\|-------------\|
175		-	\| P1 \| NOTE \| `pricing.rs:134-148` \| FixedPricing has no upper cap on amount. Not exploitable -- fixed-price path uses `item.price_cents`, not user input. \|
176		-	\| P2 \| NOTE \| `pricing.rs:113-115` \| FixedPricing `is_free()` hardcoded false. Unreachable -- `for_item()` routes price=0 to FreePricing. \|
177		-	\| P3 \| NOTE \| `db/subscriptions.rs:399-407` \| `has_active_subscription_to_project` doesn't check `cancel_at_period_end`. By design (access until period end). \|
178		-
179		-	Previous SERIOUS findings (P1 cart PWYW bypass from Run 21) -- FIXED.
	185	+	\| P1 \| SERIOUS \| `routes/api/guest_checkout.rs:91-140` \| Missing `starts_at` promo code validation. All 3 authenticated paths (cart.rs:150, item.rs:127, subscriptions.rs:192) check it. \|
	186	+	\| P2 \| NOTE \| `db/license_keys.rs:158-233` \| Activation limit enforced with FOR UPDATE + active count + idempotent upsert. Excellent. \|
	187	+	\| P3 \| NOTE \| `payments/webhooks.rs:48-61` \| Webhook deduplication correctly prevents double-credit. Solid. \|
180	188
181	189		### Storage
182		-	0 SERIOUS, 1 MINOR, 1 NOTE
	190	+	0 CRITICAL, 1 SERIOUS, 1 MINOR, 1 NOTE
183	191
184	192		\| # \| Sev \| Location \| Description \|
185	193		\|---\|-----\|----------\|-------------\|
186		-	\| S1 \| MINOR \| `db/pending_s3_deletions.rs` \| No UNIQUE constraint on `(s3_key, bucket)` in pending_s3_deletions table. `ON CONFLICT DO NOTHING` is idempotent but schema should be explicit. \|
187		-	\| S2 \| NOTE \| `storage.rs:446-465` \| `extract_s3_key_from_url` includes bucket name for path-style URLs. Only used for project images which handle it. \|
188		-
189		-	Previous SERIOUS findings (S1 soft-delete purge, S2 non-atomic confirm from Run 21) -- FIXED.
	194	+	\| S1 \| SERIOUS \| `routes/storage/versions.rs:175-184` \| Storage counter corruption: decrement at 175, try_increment at 182. If increment fails, decrement is not rolled back. \|
	195	+	\| S2 \| MINOR \| `db/pending_uploads.rs:17` \| ON CONFLICT DO UPDATE refreshes created_at, letting repeated presign calls prevent garbage collection. \|
	196	+	\| S3 \| NOTE \| `routes/storage/uploads.rs:262` \| Storage decrement rollback error swallowed with `.ok()`. Acceptable given background reconciliation. \|
190	197
191	198		### UX Wiring
192		-	1 SERIOUS, 0 MINOR, 3 NOTE
	199	+	0 SERIOUS, 1 MINOR, 3 NOTE
193	200
194	201		\| # \| Sev \| Location \| Description \|
195	202		\|---\|-----\|----------\|-------------\|
196		-	\| U1 \| SERIOUS \| `templates/pages/fan_plus.html:97`, `templates/pages/project.html:209`, `templates/pages/sandbox.html:24` \| CSRF field name mismatch: templates use `name="csrf_token"` but `csrf.rs:81` extracts `_csrf`. Forms submitted without HTMX JS will fail with 403. HTMX path works (header injection). \|
197		-	\| U2 \| NOTE \| `templates/pages/login.html:13-16` \| Login form lacks CSRF. Intentional (pre-auth exempt). \|
198		-	\| U3 \| NOTE \| `templates/public.rs:471-482` \| BuyPageTemplate lacks csrf_token field entirely. Intentional (guest checkout). \|
199		-	\| U4 \| NOTE \| `formatting.rs:4-13` \| `format_price` uses f64 division. Correct for all practical prices with `{:.2}`. \|
	203	+	\| U1 \| MINOR \| `routes/pages/dashboard/forms.rs` \| Blog editor doesn't preserve user input on slug validation error. \|
	204	+	\| U2 \| NOTE \| `routes/pages/public/discover.rs:85` \| Page clamped to `.max(1)` but no upper bound. DB returns empty; no impact. \|
	205	+	\| U3 \| NOTE \| `templates/wizards/wizard_join.html` \| Join wizard CSRF exemption justified (pre-auth) and documented. \|
	206	+	\| U4 \| NOTE \| `templates/dashboards/dashboard-blog-editor.html:42` \| hx-vals with UUID template variable. Safe (UUIDs contain no special chars). \|
200	207
201	208		### Security
202		-	0 SERIOUS, 1 MINOR, 2 NOTE
	209	+	0 CRITICAL, 0 SERIOUS, 0 MINOR, 3 NOTE
203	210
204	211		\| # \| Sev \| Location \| Description \|
205	212		\|---\|-----\|----------\|-------------\|
206		-	\| X1 \| MINOR \| `db/idempotency.rs:50-52` \| Unique constraint on `(key, user_id)` but queries filter by `(key, user_id, method, path)`. Same key on different endpoints returns wrong cached response. \|
207		-	\| X2 \| NOTE \| `scanning/mod.rs:279` \| Pipeline integration test only exercises 3 of 7 FileType variants. \|
208		-	\| X3 \| NOTE \| `scanning/hash_lookup.rs:84` \| MalwareBazaar `no_results` treated as Error (held for review). Deliberate fail-closed. \|
	213	+	\| X1 \| NOTE \| `auth.rs:302-309` \| verify_password is not independently constant-time on parse failure, but all callers use DUMMY_HASH. No exploitable timing channel. \|
	214	+	\| X2 \| NOTE \| `db/totp.rs:126-146` \| Backup code DB lookup not constant-time. Standard practice; not exploitable over network. \|
	215	+	\| X3 \| NOTE \| `synckit_auth.rs:54-68` \| JWT iat claim not validated. Standard; exp is validated. No impact. \|
209	216
210	217		### Performance
211		-	0 SERIOUS, 2 MINOR, 2 NOTE
	218	+	0 CRITICAL, 0 SERIOUS, 2 MINOR, 1 NOTE
212	219
213	220		\| # \| Sev \| Location \| Description \|
214	221		\|---\|-----\|----------\|-------------\|
215		-	\| F1 \| MINOR \| `routes/api/exports.rs:656-680` \| Content export downloads all S3 files into RAM before zipping. 2 GB cap but full heap buffering. Two concurrent exports = 4 GB spike. \|
216		-	\| F2 \| MINOR \| `metrics.rs:206` \| Idempotency middleware buffers full response body (up to 1MB). \|
217		-	\| F3 \| NOTE \| `routes/synckit/subscribe.rs:123` \| SSE broadcast channel size 16. Lag handled by filtering. By design. \|
218		-	\| F4 \| NOTE \| `routes/synckit/sync.rs:98-100` \| Push/pull fetch all devices for validation. Bounded at 50 per app. \|
	222	+	\| F1 \| MINOR \| `metrics.rs:232` \| Idempotency middleware: `.to_vec()` creates second allocation from Bytes. Minor efficiency loss. \|
	223	+	\| F2 \| MINOR \| `metrics.rs:228` \| Response body >1MB returns Body::empty(). Only affects chunked responses without Content-Length (rare). \|
	224	+	\| F3 \| NOTE \| `routes/storage/uploads.rs:250-253` \| Dynamic SQL column names via format!(). Hardcoded enum match arms -- not injection risk, but bypasses compile-time checking. \|
219	225
220	226		## Cross-Cutting Concerns
221	227
222		-	### CSRF field name inconsistency (UX + Security)
223		-	Three templates use `csrf_token` instead of `_csrf`. While HTMX header injection means this doesn't block normal usage, it represents a defense-in-depth gap. If JS fails to load, these forms become non-functional. Single fix: standardize field names.
	228	+	### Promo code validation inconsistency (Payments + UX)
	229	+	The `starts_at` check is present in 4 checkout paths but missing from guest checkout. Pattern gap -- guest checkout was likely added later without copying all validations. A shared `validate_promo_code()` helper would prevent future divergence.
224	230
225		-	### Export memory pattern (Performance + Storage)
226		-	Export buffering is the sole remaining pattern where large data is loaded entirely into RAM. The rest of the codebase consistently uses streaming (presigned URLs, chunked S3 uploads, scan pipeline). Fixing this would complete the streaming pattern across the entire codebase.
	231	+	### Storage counter atomicity (Storage + Performance)
	232	+	The decrement-then-increment pattern in `versions.rs` is inconsistent with the atomic `try_replace_storage` used in `uploads.rs`. The versions path should use the same atomic pattern.
227	233
228	234		## Components Successfully Stress-Tested
229	235
230	236		### Payments (12 vectors survived)
231		-	Webhook replay, double-credit, concurrent promo exhaustion, cross-user data access, self-purchase, negative/overflow amounts, floating-point money math, out-of-order webhooks, suspended creator purchases, SUM(BIGINT) pitfall, PWYW cart minimum enforcement, tip amount cap enforcement.
	237	+	Webhook replay, double-credit, concurrent promo exhaustion (atomic at DB level), cross-user data access, self-purchase, negative/overflow amounts, floating-point money math, out-of-order webhooks, suspended creator purchases, SUM(BIGINT) pitfall, PWYW cart minimum enforcement, tip amount cap enforcement.
232	238
233	239		### Storage (10 vectors survived)
234		-	Cross-user file overwrites, path traversal in filenames, content type smuggling, storage quota bypass, double-spend on idempotent confirm, malware file serving, orphaned upload cleanup, SUM(BIGINT) pitfall, transactional confirm uploads, soft-delete purge with version S3 keys.
	240	+	Cross-user file overwrites, path traversal in filenames, content type smuggling, storage quota bypass (atomic enforcement), double-spend on idempotent confirm, malware file serving, orphaned upload cleanup, SUM(BIGINT) pitfall, transactional confirm uploads, soft-delete purge with version S3 keys.
235	241
236	242		### UX Wiring (10 vectors survived)
237	243		XSS via template injection, open redirect, user enumeration, markdown/HTML injection, pagination abuse, integer overflow in pricing, internal detail leakage, CSV injection, Unicode boundary attacks, JSON-LD breakout.
238	244
239	245		### Security (17 vectors survived)
240		-	Virus scan bypass via ClamAV downtime, ZIP bomb, content-type spoofing, path traversal in archives, session fixation, timing-based user enumeration, brute force login, X-Forwarded-For spoofing, session reuse after password change, OAuth code replay, PKCE downgrade, token prediction, CSRF on state-changing endpoints, SSH command injection, passkey cloning, TOTP replay, IDOR on passkeys/sessions.
	246	+	Virus scan bypass via ClamAV downtime (fail-closed), content-type spoofing, path traversal in archives, session fixation, timing-based user enumeration (dummy hash on all 3 login paths), brute force login (lockout), X-Forwarded-For spoofing (Cloudflare-aware), session reuse after password change, OAuth code replay, PKCE downgrade, token prediction (CSPRNG), CSRF on state-changing endpoints (constant-time), SSH command injection, passkey cloning (counter), TOTP replay (last_used_step), IDOR on passkeys/sessions, archive bombs (byte counting + 10x multiplier).
241	247
242	248		### Performance (10 vectors survived)
243		-	Connection pool exhaustion, file scanning memory, SSE connection accumulation, scheduler job accumulation, background task leaks, ZIP bombs, path traversal, shell injection, lock ordering, discover page concurrent load.
	249	+	Connection pool exhaustion (bounded at 25), file scanning memory (semaphore of 4), SSE connection accumulation (bounded), scheduler job accumulation (advisory lock), background task leaks (monitored), ZIP bombs (byte counting), bulk operations (batch queries, 100-item cap), rate limiter bypass (Cloudflare-aware IP), concurrent scan memory pressure, large file handling (streamed).
244	250
245	251		## Confidence Assessment
246	252
247	253		\| Axis \| Confidence \| Notes \|
248	254		\|------\|-----------\|-------\|
249		-	\| Payments \| HIGH \| Three-layer idempotency, integer money math, bidirectional refund matching. Cart PWYW now enforced. Tip cap enforced. CSPRNG license keys. \|
250		-	\| Storage \| HIGH \| Presigned URL security solid. Confirms now transactional. Soft-delete purge handles version keys. Pending S3 deletions durable queue deployed. \|
251		-	\| UX Wiring \| HIGH \| Askama auto-escape, json_escape defense-in-depth, comprehensive CSRF (one field name bug). No detail leakage. \|
252		-	\| Security \| HIGH \| No CRITICAL or SERIOUS findings. Argon2id, constant-time everywhere, fail-closed scanning, PKCE S256. Idempotency key scope is low-risk. \|
253		-	\| Performance \| HIGH (current scale) \| Discover parallelized. Scheduler lock pinned. Export buffering is sole remaining concern, low-frequency endpoint. \|
	255	+	\| Payments \| HIGH \| One validation gap in guest checkout. Core payment logic excellent. \|
	256	+	\| Storage \| HIGH \| One error-path storage corruption. Normal path is atomic and correct. \|
	257	+	\| UX Wiring \| HIGH \| CSRF excellent. Templates safe. Minor UX polish only. \|
	258	+	\| Security \| HIGH \| No auth bypasses. DUMMY_HASH on all login paths. Fail-closed scanning. \|
	259	+	\| Performance \| HIGH (current scale) \| Pool size reasonable. Rate limiters well-tuned. Scheduler advisory-locked. \|
254	260
255	261		## Metrics
256	262
257	263		- Modules audited: 55+
258		-	- Total cold spots: 3
259		-	- Bugs by severity: 0 critical, 1 serious, 4 minor, 10 note
	264	+	- Total cold spots: 0 (all 2 resolved in remediation)
	265	+	- Bugs by severity: 0 critical, 2 serious (all fixed), 3 minor (all fixed, 1 false positive), 10 note
260	266		- Axes at A or above: 5/5
261	267
262	268		## Axis Summary Grades
263	269
264	270		\| Axis \| Overall \| Cold Spots \| Mandatory Surprise \|
265	271		\|------\|---------\|------------\|-------------------\|
266		-	\| Payments \| A \| None \| Webhook signature verification gold standard \|
267		-	\| Storage \| A \| None \| Cleanup scheduler durable S3 deletion queue \|
268		-	\| UX Wiring \| A- \| templates/ CSRF field name (B+) \| Form error recovery preserves input without reflecting \|
269		-	\| Security \| A \| None \| Defense-in-depth: 6 independent auth layers, each correct \|
270		-	\| Performance \| A- \| exports.rs perf (B-), size (B) \| Export RAM buffering anomaly vs streaming everywhere else \|
	272	+	\| Payments \| A \| guest_checkout.rs (B) \| Claim token architecture (good) \|
	273	+	\| Storage \| A \| versions.rs (B-) \| LATERAL join batch storage recalc (good) \|
	274	+	\| UX Wiring \| A \| None \| CSRF constant-time comparison (good) \|
	275	+	\| Security \| A \| None \| TOTP replay prevention via time step (good) \|
	276	+	\| Performance \| A \| None \| Storage quota atomicity + idempotency (good) \|
271	277
272	278		## Recommended Priority Order
273	279
274		-	1. [SERIOUS] Fix CSRF field name mismatch (`templates/pages/fan_plus.html:97`, `project.html:209`, `sandbox.html:24`) -- Change `name="csrf_token"` to `name="_csrf"` in all three templates. 5-minute fix, restores defense-in-depth for non-JS form submissions.
275		-	2. [MINOR] Fix idempotency key unique constraint (`db/idempotency.rs`) -- Add migration to change unique constraint to `(key, user_id, method, path)`. Prevents wrong cached response on key reuse across endpoints.
276		-	3. [MINOR] Stream content exports (`routes/api/exports.rs:656-680`) -- Replace in-memory buffering with streaming ZIP writer or export-to-S3-then-presign. Eliminates last RAM exhaustion vector.
277		-	4. [MINOR] Add UNIQUE on pending_s3_deletions -- `CREATE UNIQUE INDEX idx_pending_s3_deletions_key_bucket ON pending_s3_deletions(s3_key, bucket)`. Schema hygiene.
278		-	5. [DEFERRED] Split oversized route files -- exports.rs (842), health.rs (846), tabs/user.rs (815). Chronic from Run 21.
279		-	6. [DEFERRED] Add README.md to server/ -- Chronic from Run 19.
	280	+	1. [SERIOUS] Add `starts_at` validation to guest checkout -- 2 lines, copy from `cart.rs:150`
	281	+	2. [SERIOUS] Fix version replace storage rollback -- re-increment old storage on `try_increment` failure, or use `try_replace_storage`
	282	+	3. [MINOR] Change pending_uploads to `ON CONFLICT DO NOTHING` -- prevents staleness attack
	283	+	4. [MINOR] Blog editor: preserve input on validation error
	284	+	5. [MINOR] Idempotency middleware: use `std::str::from_utf8` instead of `String::from_utf8(to_vec())`
	285	+	6. [DEFERRED] Extract shared `validate_promo_code()` helper
280	286
281	287		## Action Items
282	288
283		-	### Run 22 (2026-05-09)
	289	+	### Run 24 (2026-05-09)
284	290
285		-	82. [SERIOUS] Fix CSRF field name: change `csrf_token` to `_csrf` in `fan_plus.html`, `project.html`, `sandbox.html`
286		-	83. [MINOR] Add migration: unique constraint on `idempotency_keys(key, user_id, method, path)` replacing `(key, user_id)`
287		-	84. [MINOR] Stream content exports or export to S3 with presigned download (`routes/api/exports.rs:656-680`)
288		-	85. [MINOR] Add `UNIQUE(s3_key, bucket)` to `pending_s3_deletions` table (migration)
289		-	86. [DEFERRED] Split oversized route files: health.rs (846), exports.rs (842), tabs/user.rs (815) (chronic, from Run 21 #81)
290		-	87. [DEFERRED] Add README.md to server/ (chronic, from Run 19 #53 -> #63 -> #80)
	291	+	97. ~~[SERIOUS] Add `starts_at` validation to guest checkout~~ -- Fixed. Added `starts_at` check to `guest_checkout.rs:102-107`, matching all authenticated paths.
	292	+	98. ~~[SERIOUS] Fix version replace storage counter rollback~~ -- Fixed. `versions.rs` now uses atomic `try_replace_storage` for replacements, `try_increment_storage` for fresh uploads. No separate decrement/increment.
	293	+	99. ~~[MINOR] Change pending_uploads ON CONFLICT to DO NOTHING~~ -- Fixed. `pending_uploads.rs:17` now uses `DO NOTHING`, preventing staleness attack via repeated presign.
	294	+	100. ~~[MINOR] Blog editor: preserve form input on validation error~~ -- False positive. Blog editor uses JS `fetch()` API; form state is preserved on error.
	295	+	101. ~~[MINOR] Idempotency middleware: avoid double allocation~~ -- Fixed. `metrics.rs:232` now uses `std::str::from_utf8` with `to_owned()` only for the spawned task.
	296	+	102. [DEFERRED] Extract shared `validate_promo_code()` helper to prevent checkout path divergence.
	297	+
	298	+	### Run 23 (2026-05-09) -- All Fixed
	299	+
	300	+	88. ~~[SERIOUS] Enqueue old S3 key on version file replacement~~ -- Fixed.
	301	+	89. ~~[SERIOUS] Harden archive decompression fallback~~ -- Fixed.
	302	+	90. ~~[SERIOUS] Reserve promo code slot atomically at checkout creation~~ -- Already implemented (false positive).
	303	+	91. ~~[MINOR] Consolidate cart toggle into single JOIN query~~ -- Fixed.
	304	+	92. ~~[MINOR] Consolidate download access control into single query~~ -- Fixed.
	305	+	93. ~~[MINOR] Stream content exports~~ -- Fixed.
	306	+	94. ~~[MINOR] Tighten CSV email validation~~ -- Fixed.
	307	+	95. ~~[DEFERRED] Split oversized route files~~ -- Fixed.
	308	+	96. ~~[DEFERRED] Add README.md to server/~~ -- Fixed.
291	309
292	310		### Open (blocked on upstream)
293	311
			@@ -296,61 +314,56 @@
296	314		25. Monitor aws-sdk-s3 for rustls-webpki 0.101.7 fix (RUSTSEC-2026-0049)
297	315		33. bincode unmaintained (RUSTSEC-2025-0141) -- upstream via syntect/yara-x, warning only
298	316
299		-	## Previous Action Item Verification (Run 21)
	317	+	## Previous Action Item Verification (Run 23)
300	318
301	319		\| # \| Item \| Status \|
302	320		\|---\|------\|--------\|
303		-	\| 65 \| Pin scheduler advisory lock to acquired connection \| Fixed \|
304		-	\| 66 \| Enforce PWYW minimum in cart effective_price_cents() \| Fixed \|
305		-	\| 67 \| Fix soft-delete purge: version S3 keys + storage decrement \| Fixed \|
306		-	\| 68 \| Wrap confirm_upload DB writes in transaction \| Fixed \|
307		-	\| 69 \| Optimize discover page: parallelize facet queries \| Fixed \|
308		-	\| 70 \| Delete old S3 objects on image/audio/video replacement \| Fixed \|
309		-	\| 71 \| Validate checkout cancel item_id as UUID \| Fixed \|
310		-	\| 72 \| ClamAV contains("FOUND") -> ends_with("FOUND") \| Fixed \|
311		-	\| 73 \| Case-normalize URL-encoded path traversal check \| Fixed \|
312		-	\| 74 \| Add UNIQUE(s3_key) to pending_uploads \| Fixed \|
313		-	\| 75 \| Add #[instrument] to embed/ handlers \| Fixed \|
314		-	\| 76 \| Add #[instrument] to payments/ functions \| Fixed \|
315		-	\| 77 \| Initialize PWYW amount_cents hidden field server-side \| Not verified (low priority) \|
316		-	\| 78 \| Use AuthUser for OAuth authorize \| Not verified (low priority) \|
317		-	\| 80 \| Add README.md to server/ \| Unfixed (chronic, carried as #87) \|
318		-	\| 81 \| Split oversized route files \| Unfixed (carried as #86) \|
	321	+	\| 88 \| Enqueue old S3 key on version file replacement \| Fixed (verified: versions.rs:203-204 enqueues old key) \|
	322	+	\| 89 \| Harden archive decompression fallback \| Fixed (verified: archive.rs:123 uses 10x multiplier) \|
	323	+	\| 90 \| Reserve promo code slot atomically \| Already implemented (false positive) \|
	324	+	\| 91 \| Consolidate cart toggle \| Fixed \|
	325	+	\| 92 \| Consolidate download access control \| Fixed \|
	326	+	\| 93 \| Stream content exports \| Fixed \|
	327	+	\| 94 \| Tighten CSV email validation \| Fixed \|
	328	+	\| 95 \| Split oversized route files \| Fixed \|
	329	+	\| 96 \| Add README.md \| Fixed \|
319	330
320		-	12 of 14 actionable Run 21 items fixed. 2 deferred items carried forward. No regressions.
	331	+	9 of 9 Run 23 items verified fixed.
321	332
322	333		### Chronic Items (unfixed across 3+ consecutive runs)
323	334
324		-	\| Item \| First flagged \| Runs unfixed \|
325		-	\|------\|--------------\|-------------\|
326		-	\| Add README.md to server/ \| Run 19 \| 4 (19, 20, 21, 22) \|
	335	+	None. Both previous chronic items (README.md, oversized route files) resolved in Run 23.
327	336
328		-	Note: embed/ and payments/ observability gaps resolved in Run 22 after 2 runs (20, 21). async-trait closed as not removable.
	337	+	### False Positives Identified (Run 24)
329	338
330		-	## Delta Since Run 21
	339	+	The following agent findings were investigated and determined not to be real bugs:
	340	+	- verify_password timing attack -- Mitigated by DUMMY_HASH in all callers (routes/auth.rs:111, routes/synckit/auth.rs:59+69, routes/oauth.rs:294). Hash always comes from DB or dummy.
	341	+	- Backup code SQL WHERE timing -- Standard database practice. ~1ms query time variance is indistinguishable from network jitter over TCP.
	342	+	- SQL injection via format! -- Column names are hardcoded string literals from exhaustive enum match. No user input.
	343	+	- Multi-seller Stripe isolation -- Requires API key compromise. Cart scoped to single seller at application level.
	344	+	- JWT iat validation -- Standard JWT behavior. exp is validated. No security impact.
	345	+	- Password length not centralized -- Present at all entry points (routes/auth.rs, routes/synckit/auth.rs:58, routes/oauth.rs). Argon2id has internal limits.
331	346
332		-	### Fixed
333		-	- All 5 SERIOUS Run 21 findings fixed (scheduler lock, cart PWYW, soft-delete purge, confirm transaction, discover queries)
334		-	- All 7 MINOR Run 21 findings fixed (old S3 cleanup, cancel UUID, ClamAV FOUND, path traversal case, pending_uploads UNIQUE, embed instrumentation, payments instrumentation)
335		-	- embed/ and payments/ now have full `#[instrument]` coverage -- resolves chronic observability gap
336		-	- 4 new migrations (102-105): pending_uploads unique, unique_plays, nullable_item_id_indexes, pending_s3_deletions
337		-	- Version bumped from 0.5.7 to 0.5.9
338		-	- LOC grew from ~87,427 to ~87,853 (+426)
339		-	- Test annotations from 1,218 to 1,215 (-3, likely test consolidation)
	347	+	## Delta Since Run 23
340	348
341		-	### New Findings (not in Run 21)
342		-	- CSRF field name mismatch in 3 templates (SERIOUS)
343		-	- Idempotency key unique constraint too narrow (MINOR)
344		-	- Content export RAM buffering (MINOR)
345		-	- Pending S3 deletions missing UNIQUE constraint (MINOR)
	349	+	### Fixed (from Run 23)
	350	+	All 9 Run 23 action items verified fixed. No regressions detected.
346	351
347		-	### Grade Changes
348		-	- Performance: A- -> A (discover page fixed)
349		-	- Concurrency: A- -> A (scheduler lock fixed)
350		-	- Observability: A- -> A (embed/ + payments/ instrumented)
351		-	- Overall: A (held)
352		-	- Cold spots: 5 -> 3 (net -2)
353		-	- SERIOUS findings: 5 -> 1 (net -4)
	352	+	### New Findings (not in Run 23)
	353	+	- Guest checkout missing `starts_at` promo validation (SERIOUS) -- new
	354	+	- Storage counter corruption on version replace failure (SERIOUS) -- new (distinct from Run 23's S3 key leak -- this is about counter rollback, not cleanup)
	355	+	- Pending uploads staleness attack via ON CONFLICT (MINOR) -- new

Lines truncated

M server/docs/doc_coverage_matrix.md +1 -1

			@@ -10,7 +10,7 @@
10	10
11	11		\| Feature \| Code Modules \| Inline (//!) \| Rustdoc \| Public Doc \|
12	12		\|---------\|-------------\|:---:\|:---:\|:---:\|
13		-	\| Auth (login/signup/sessions) \| routes/auth.rs, auth.rs, db/sessions.rs, db/auth.rs \| Y \| -- \| guide/01-getting-started \|
	13	+	\| Auth (login/signup/sessions) \| routes/auth.rs, auth.rs, db/sessions.rs, db/auth.rs \| Y \| -- \| guide/getting-started \|
14	14		\| Passkeys (WebAuthn) \| routes/api/passkeys.rs, db/passkeys.rs \| Y \| -- \| guide/security \|
15	15		\| TOTP (2FA) \| routes/api/totp.rs, db/totp.rs \| Y \| -- \| guide/security \|
16	16		\| User profiles \| routes/api/users/profile.rs, db/users.rs \| Y \| -- \| guide/profile \|

M server/docs/todo.md +30 -189

			@@ -1,12 +1,24 @@
1	1		# Makenotwork TODO
2	2
3	3		## Status
4		-	v0.5.9 deployed 2026-05-09. Audit grade A (Run 22). ~88K LOC, 1,215 tests, 0 warnings. Migration 105. Sprints 1-9 complete (see `todo_done.md`).
	4	+	v0.5.9 deployed 2026-05-09. Audit grade A (Run 24). ~88K LOC, 1,933 tests, 0 warnings. Migration 107. Sprints 1-9 complete (see `todo_done.md`).
5	5
6	6		Human tasks in `human_todo.md`. Completed items in `todo_done.md`.
7	7
8	8		---
9	9
	10	+	## Next Steps (Soft Launch)
	11	+
	12	+	Priority order. See `human_todo.md` for the full manual testing feature map.
	13	+
	14	+	1. Deploy — Run 24 fixes (4 items) are ready to ship. Build, bump version, deploy.
	15	+	2. Manual testing — walk through `human_todo.md` sign-off table on live server (Stripe checkout, license keys, promo codes, cart, SyncKit sync)
	16	+	3. Content seeding — at least one real creator with published content on discover page
	17	+	4. Invite testers — generate invite codes, send hand-written emails per `docs/internal/outreach/tiers.md`
	18	+	5. Document undocumented features — shopping cart, wishlist, creator pause (see below)
	19	+
	20	+	---
	21	+
10	22		## Documentation: Undocumented Shipped Features
11	23
12	24		These features are implemented but have no public-facing documentation yet. Add docs in the next documentation push.
			@@ -26,187 +38,43 @@
26	38
27	39		---
28	40
29		-	## Ultra Fuzz Run 22 (2026-05-09)
	41	+	## Ultra Fuzz Run 24 (2026-05-09) -- All Fixed
30	42
31		-	### SERIOUS (fix before launch)
32		-	- [x] Fix CSRF field name: change `csrf_token` to `_csrf` in `fan_plus.html:97`, `project.html:209`, `sandbox.html:24`
33		-
34		-	### MINOR (current phase)
35		-	- [x] Add migration: unique constraint on `idempotency_keys(key, user_id, method, path)` replacing `(key, user_id)` (migration 106)
36		-	- [ ] Stream content exports or export to S3 with presigned download (`routes/api/exports.rs:656-680`)
37		-	- [x] Add `UNIQUE(s3_key, bucket)` to `pending_s3_deletions` table (migration 107)
38		-
39		-	---
40		-
41		-	## Ultra Fuzz Run 21 (2026-05-08)
42		-
43		-	### SERIOUS (fix before launch)
44		-	- [x] Pin scheduler advisory lock to acquired connection — hold for tick duration (`scheduler/mod.rs:77-88`)
45		-	- [x] Enforce PWYW minimum in cart `effective_price_cents()` — `.max(pwyw_min_cents)` (`db/cart.rs:104-108`)
46		-	- [x] Fix soft-delete purge: query version S3 keys + decrement storage before CASCADE (`scheduler/cleanup.rs:188-222`)
47		-	- [x] Wrap confirm_upload DB writes in single UPDATE — rollback storage on failure (`routes/storage/uploads.rs:225-248`)
48		-	- [x] Optimize discover page: parallelize facet queries with try_join! (`routes/pages/public/discover.rs:292-513`)
49		-
50		-	### MINOR/MEDIUM (current phase)
51		-	- [x] Delete old S3 objects on item image/audio/video replacement (`routes/storage/images.rs`, `routes/storage/uploads.rs`)
52		-	- [x] Validate checkout cancel `item_id` as UUID (`routes/stripe/checkout/mod.rs:105-108`)
53		-	- [x] Change ClamAV `contains("FOUND")` to `ends_with("FOUND")` (`scanning/clamav.rs:96`)
54		-	- [x] Case-normalize URL-encoded path traversal check (`scanning/archive.rs:70`)
55		-	- [x] Add UNIQUE(s3_key) to pending_uploads table (migration 102)
56		-	- [x] Add `#[tracing::instrument(skip_all)]` to embed/ handlers (was mostly done; added item_player)
57		-	- [x] payments/ already had #[instrument] on all async fns (webhook extractors are pure, no I/O)
58		-	- [x] Initialize PWYW amount_cents hidden field server-side (`templates/pages/purchase.html`)
59		-	- [x] Use re-auth for OAuth authorize with legacy sessions (`routes/oauth.rs:253-256`)
	43	+	- [x] SERIOUS: Add `starts_at` validation to guest checkout (`routes/api/guest_checkout.rs:105`). Copied from `cart.rs:150`.
	44	+	- [x] SERIOUS: Fix version replace storage counter rollback (`routes/storage/versions.rs`). Now uses atomic `try_replace_storage` for file replacements.
	45	+	- [x] MINOR: Change pending_uploads ON CONFLICT to DO NOTHING (`db/pending_uploads.rs:17`)
	46	+	- ~~MINOR: Blog editor: preserve form input on validation error~~ -- false positive; JS `fetch()` keeps form state on error
	47	+	- [x] MINOR: Idempotency middleware: avoid double allocation (`metrics.rs:232`)
	48	+	- [ ] DEFERRED: Extract shared `validate_promo_code()` helper to prevent checkout path divergence
60	49
61	50		---
62	51
63		-	## Audit Remediations (2026-05-08, post-Sprint 9)
	52	+	## Code Fuzz / Ultra Fuzz — Accepted Risks & Deferred
64	53
65		-	- [x] Fix XSS: escape `s.category` and `s.url` in search suggestions innerHTML (discover.html)
66		-	- [x] Fix XSS: replace inline `onsubmit` handler with `addEventListener` in collections.js
67		-	- [x] Fix a11y: convert `<span onclick>` save buttons to `<button>` with `aria-label` on discover cards
68		-	- [x] Performance: rewrite `get_user_purchases` double-nested correlated subquery — replaced with LATERAL joins counting total versions vs downloaded versions
69		-	- [x] Remove unused import `spawn_email` in `stripe/checkout/cart.rs`
70		-	- [x] Remove dead code `update_app_sync_sub_tier` in `db/app_sync.rs`
71		-
72		-	---
73		-
74		-	## Code Fuzz Findings (2026-05-08)
75		-
76		-	Two-pass fuzz: initial scan + deep verification. Items marked REFUTED were disproven in the second pass. Items marked CONFIRMED were verified with exact evidence.
77		-
78		-	### Payments & Checkout
79		-	- [x] SERIOUS: Cart refund only cleans up ONE item — changed `fetch_optional` to `fetch_all`, refund handler now iterates all matching transactions (`db/transactions.rs`, `routes/stripe/webhook/billing.rs`)
80		-	- [x] MINOR: No buyer != seller validation in cart checkout — added `user.id == seller_id` guard (`routes/stripe/checkout/cart.rs`)
81		-	- [x] MINOR: Guest checkout `increment_sales_count` error was silently swallowed — now propagates error so Stripe retries (`routes/stripe/webhook/checkout.rs`)
82		-	- [x] MINOR: Tips lack `check_not_suspended()` — added (`routes/stripe/checkout/tips.rs`)
83		-	- [x] MINOR: Orphaned pending transactions on partial cart failure — investigated: failed seller's transactions are never created (error precedes create_transaction); earlier sellers' sessions expire naturally; 25h stale cleanup is correct. No additional fix needed.
84		-	- [x] MINOR: `CartLineItem.amount_cents` is `i32` while `Cents` wraps `i64` — changed to `i64`, removed redundant cast (`payments/checkout.rs`)
85		-	- [x] MINOR: No Stripe minimum amount ($0.50) enforcement before creating session — added `STRIPE_MINIMUM_CHARGE_CENTS` check to all 3 checkout methods (`payments/checkout.rs`, `constants.rs`)
86		-	- [x] MINOR: Cart items removed before Stripe session completes — moved cart removal to webhook handler so items survive cancelled checkouts (`routes/stripe/checkout/cart.rs`, `routes/stripe/webhook/checkout.rs`)
87		-	- [x] MINOR: Project checkout uses `ItemId::nil()` — made item_id optional in CreateTransactionParams, CheckoutParams, and CheckoutMetadata; project purchases now use NULL; fixed unique indexes to exclude NULL item_id (migration 104)
88		-	- [x] MINOR: v2 webhook handler swallows account update failures — on failure, unmarks event from processed set and returns 500 so Stripe retries (`routes/stripe/webhook_v2.rs`, `db/webhook_events.rs`)
89		-	- ~~SERIOUS: Partial Stripe refunds revoke full access~~ REFUTED — `is_full_refund()` check at `billing.rs:272` prevents this
90		-	- ~~MINOR: $0 items dropped in `process_seller_checkout`~~ REFUTED — unreachable; `process_seller_checkout` is only called with `promo_code: None`
91		-
92		-	### Pricing, Promo Codes & Transactions
93		-	- [x] MINOR: Cross-creator promo code collision — added `code_purpose = 'free_access'` filter to `get_promo_code_by_code` (`db/promo_codes.rs`)
94		-	- [x] MINOR: `remove_free_item_from_library` doesn't decrement promo code `use_count` — now returns and decrements via `release_use_count` (`db/transactions.rs`)
95		-	- [x] MINOR: `claim_free_with_promo_code` doesn't record `promo_code_id` — added to INSERT (`db/transactions.rs`)
96		-	- [x] MINOR: Tautology `if s == s { 23 } else { 0 }` in `parse_date` — removed dead branch (`routes/api/promo_codes.rs`)
97		-	- [x] MINOR: Duplicate promo code creation returns 500 — added 23505 handling with friendly message (`routes/api/promo_codes.rs`)
98		-	- [x] MINOR: Can create already-expired promo codes — added `expires_at > now()` check (`routes/api/promo_codes.rs`)
99		-	- [x] MINOR: Subscription trial promo code `use_count` never released on abandoned checkout — subscription checkout now creates pending transaction row, cleaned up by existing 25h stale cleanup (`db/transactions.rs`, `routes/stripe/checkout/subscriptions.rs`, `routes/stripe/webhook/checkout.rs`)
100		-	- [x] MINOR: `update_promo_code` allows setting `max_uses` below current `use_count` — added guard rejecting max_uses < current use_count (`routes/api/promo_codes.rs`)
101		-	- [x] MINOR: License key generation after promo claim is non-transactional — `claim_free_with_promo_code` now accepts `LicenseKeyParams` and creates key inside the same transaction (`db/transactions.rs`, `routes/api/promo_codes.rs`, `routes/stripe/checkout/item.rs`)
102		-	- [x] NOTE: `FixedPricing::validate_amount` has no upper cap — not exploitable, fixed-price checkout uses `item.price_cents` (`pricing.rs:134-143`)
103		-
104		-	### Subscriptions
105		-	- [x] SERIOUS: Re-subscription after cancel silently no-ops — changed `ON CONFLICT DO NOTHING` to `DO UPDATE` with reactivation (`db/creator_tiers.rs`, `db/fan_plus.rs`)
106		-	- [x] SERIOUS: `handle_subscription_updated` with `status=canceled` never sets `canceled_at` — all 4 `update_*_status` functions now set `canceled_at` via CASE/COALESCE (`db/subscriptions.rs`, `db/creator_tiers.rs`, `db/fan_plus.rs`, `db/app_sync.rs`)
107		-	- [x] MINOR: `cancel_subscription` overwrites `canceled_at` on re-cancel — all 4 cancel functions now use `COALESCE(canceled_at, NOW())`
108		-	- [x] MINOR: `resume_subscriptions_for_creator` doesn't filter on `status = 'active'` — added `AND status = 'active'` (`db/subscriptions.rs`)
109		-	- [x] MINOR: `get_user_subscribed_item_ids` grants access to paused item subs — added `AND paused_at IS NULL` (`db/subscriptions.rs`)
110		-	- [x] LOW: `get_project_subscriber_count` counts paused subscriptions — added `AND paused_at IS NULL` (`db/subscriptions.rs`)
111		-	- [x] LOW: Grace period upload rejection returns bare 403 — changed to `BadRequest` with descriptive message (`db/creator_tiers.rs`)
112		-	- [x] NOTE: Everything tier checkout hard-blocked — guard removed, tier is live and priced (`routes/stripe/checkout/subscriptions.rs`)
113		-
114		-	### Auth & Sessions
115		-	- [x] MEDIUM: Passkey registration does not require re-authentication — added password confirmation to `register_start` + JS prompt (`routes/api/passkeys.rs`, `static/passkey.js`)
116		-	- [x] MINOR: Password reset doesn't invalidate other sessions — added `delete_all_sessions_for_user` + cache eviction (`routes/pages/email_actions/password.rs`)
117		-	- [x] LOW: Email verification HMAC lacks purpose prefix — added `"verify:"` prefix to generate and verify (`email/tokens.rs`)
118		-	- [x] NOTE: CSRF exemption comment says SameSite=Strict but cookie is Lax — corrected comment (`csrf.rs:131`)
119		-	- [x] NOTE: `authorize_post` duplicates `AuthUser` session validation logic — correct but fragile, accepted (`routes/oauth.rs:222-258`)
	54	+	Remaining open items from Runs 21-24 and Code Fuzz (2026-05-08). All SERIOUS items resolved through Run 23. Run 24 SERIOUS items above.
120	55
121	56		### Storage & Uploads
122		-	- [x] SERIOUS: Internal CLI upload skips S3 key validation — added `expected_prefix` check matching all other confirm handlers (`routes/api/internal/uploads.rs`)
123		-	- [x] SERIOUS: Internal CLI upload increments storage AFTER writing DB record — moved `try_increment_storage` before DB writes, deletes S3 on quota failure (`routes/api/internal/uploads.rs`)
124		-	- [x] MINOR: Insertion presign skips `check_presign_allowed` quota check — added quota check before presign (`routes/api/content_insertions.rs`)
125		-	- [x] MINOR: Filenames sanitizing to empty create ambiguous S3 keys — fallback to `"file"` basename (`storage.rs`)
126		-	- [x] MINOR: Insertion confirm stores client-supplied `mime_type` without re-validation — added `validate_content_type` at confirm (`routes/api/content_insertions.rs`)
127		-	- [x] LOW: Media delete swallows S3 error then deletes DB record — now logs S3 errors, decrements storage before DB delete (`routes/storage/media.rs`)
128		-	- [x] SERIOUS: Presigned URLs have no S3 lifecycle cleanup — added `pending_uploads` table, reaper job (24h), S3 lifecycle rule (36h) in human_todo (`routes/storage/uploads.rs`)
129		-	- [x] MINOR: Storage counter decrement-then-increment for file replacement not transactional — added `try_replace_storage` that atomically decrements old + increments new in a single UPDATE (`db/creator_tiers.rs`, `routes/storage/uploads.rs`)
130	57		- [ ] MINOR: `classify_media` trusts client-supplied `content_type` for size limits — attacker wastes own quota (`media.rs:80-91`)
131		-	- [x] MINOR: Creator cannot preview own draft content via stream/download — added `is_creator` bypass for draft, scan status, and payment checks (`routes/storage/downloads.rs`)
132		-	- [x] LOW: Play count inflatable via unauthenticated spam — added per-IP rate limit (10 burst, 1/3s) on stream/download routes + unique_play_count tracking for authenticated users (migration 103, `user_plays` table)
133	58		- [ ] NOTE: `extract_s3_key_from_url` may include bucket name for path-style URLs — only used for project images which handle it (`storage.rs:427-446`)
134	59		- [ ] NOTE: Project image old-file cleanup relies on URL-to-key extraction — fragile but functional (`routes/storage/images.rs:169-177`)
135	60
136	61		### File Scanning
137		-	- [x] MEDIUM: Archive decompression read error silently swallowed — on read error, now falls back to claimed size instead of zero (`scanning/archive.rs`)
138		-	- [x] MEDIUM: Audio/Insertion files with unrecognized magic bytes pass ALL layers — now Fail like images do (`scanning/content_type.rs`)
139	62		- [ ] MEDIUM: No scanning when scanner=None + trusted user — by-design trust model; needs async background scan mode to fix without breaking upload UX (`scanning/mod.rs:142-151`)
140		-	- [x] MINOR: `ends_with("OK")` too permissive for ClamAV response parsing — changed to exact match `response == "stream: OK"` (`scanning/clamav.rs`)
141	63		- [ ] MINOR: Archive scan skips cover images with ZIP magic bytes — layer 1 catches type mismatch; removing skip would be defense-in-depth but no current exploit path (`scanning/archive.rs:29-36`)
142		-	- [x] MINOR: Path traversal check misses URL-encoded and Unicode normalization variants — added `%2e%2e`, absolute path, and null byte checks (`scanning/archive.rs`)
143		-	- [x] MINOR: Nested archive detection double-decompresses entries — magic bytes now captured during initial decompression pass (`scanning/archive.rs`)
144		-	- [x] NOTE: Unrecognized video data gets `Pass` instead of failing — now Fail like images (`scanning/content_type.rs`)
145		-	- [x] NOTE: Mach-O binaries get unconditional `Pass` — added suspicious import analysis matching PE/ELF pattern: ptrace, task_for_pid, mach_vm_write/protect, thread_create_running, posix_spawn, dlopen (`scanning/structural.rs`)
146		-	- [x] NOTE: Download XSS blocklist missing `image/svg+xml` and `application/xhtml+xml` — added both (`scanning/content_type.rs`)
147	64
148	65		### DB & Validation
149		-	- [x] SERIOUS: `count_discover_items` missing `deleted_at IS NULL` — added filter (`db/discover.rs`)
150		-	- [x] MINOR: `get_bundleable_items` includes soft-deleted items — added `deleted_at IS NULL` (`db/bundles.rs`)
151		-	- [x] MINOR: `get_item_type_counts`, `get_price_range_counts`, `get_ai_tier_counts` missing `deleted_at IS NULL` — all three fixed (`db/discover.rs`)
152		-	- [x] MINOR: `get_tag_counts` missing `deleted_at IS NULL` and `listed = true` — added both (`db/tags.rs`)
153		-	- [x] MINOR: `get_all_tag_counts` missing `listed` and `deleted_at` filters — added (`db/tags.rs`)
154		-	- [x] MINOR: `search_suggestions` exposes suspended/deactivated usernames — added `suspended_at IS NULL AND deactivated_at IS NULL` (`db/discover.rs`)
155		-	- [x] NOTE: `discover_projects` item_count includes soft-deleted items — added `deleted_at IS NULL` to FILTER clause (`db/discover.rs`)
156		-	- [x] MINOR: `get_items_by_user` and `count_items_by_user_projects` include soft-deleted items — added `deleted_at IS NULL` (`db/items.rs`)
157		-	- [x] MINOR: `bulk_update_price` takes raw `i32` instead of `PriceCents` — changed to `PriceCents` (`db/items.rs`, `routes/api/items/bulk.rs`)
158		-	- [x] MINOR: `duplicate_item` slug retry loop has no counter cap — added cap at 100 (`db/items.rs`)
159		-	- [x] MINOR: `get_deleted_items_by_project` has no LIMIT clause — added LIMIT 500 (`db/items.rs`)
160	66		- [ ] MINOR: `item_slug_exists` considers soft-deleted items — intentional during 7-day recovery window (`db/items.rs:80-94`)
161		-	- [x] MINOR: `get_all_users` accepts arbitrary `limit`/`offset` — clamped to 200 (`db/users.rs`)
162		-	- [x] MINOR: Guest checkout auto-attach not in transaction — wrapped user lookup + transaction update in DB transaction (`db/transactions.rs`)
163		-	- [x] NOTE: `set_bundle_items` no ownership check at DB layer — added `owner_id` param with bundle + item ownership verification (`db/bundles.rs`)
164		-	- [x] NOTE: Idempotency key scope mismatch — widened PK to `(key, user_id, method, path)`, updated ON CONFLICT (migration 106, `db/idempotency.rs`)
165		-
166		-	### Git SSH & Build Runner
167		-	- [x] MEDIUM: Unsanitized SSH command passthrough — `exec_git_shell` now receives a reconstructed command from validated components (`git_ssh.rs`)
168		-	- [x] MEDIUM: Partial-failure builds create live OTA releases — now returns early with Failed status, no release created (`build_runner.rs`)
169		-	- [x] MINOR: `&repo.description[..25]` byte-position slice panics on multi-byte UTF-8 — uses `chars().take(25)` (`git_ssh.rs`)
170		-	- [x] LOW: `cmd_ssh_repo_delete` path not canonicalized — added `canonicalize` + `starts_with` check (`git_ssh.rs`)
171		-	- [x] MEDIUM: Empty signature on automated builds — build runner now SCPs .sig files, passes to release. Key generation in human_todo (`build_runner.rs`)
172		-	- [x] MINOR: TOCTOU race between `has_running_build` and `get_pending_build` — replaced with atomic `claim_pending_build` using `FOR UPDATE SKIP LOCKED` (`db/builds.rs`, `build_runner.rs`)
173		-	- [x] LOW: Global build trigger token readable from repo hooks directory — replaced with per-repo HMAC (`build_runner.rs`)
174		-	- [x] LOW: `get_latest_release` SQL `::int[]` cast crashes on non-numeric version parts — added regex guard, non-numeric sorts last (`db/ota.rs`)
175		-	- [x] LOW: No version uniqueness enforcement on OTA releases — constraint already existed in migration 033, added `ON CONFLICT` handling returning 409 (`db/ota.rs`)
176		-	- [x] LOW: S3 key collision on same-version rebuilds — resolved by OTA version uniqueness constraint (`db/ota.rs`)
177		-	- [x] LOW: Build log stores unsanitized build output — added ANSI escape stripping (`build_runner.rs`)
178		-	- [x] LOW: `StrictHostKeyChecking=accept-new` trusts on first SSH connect — now uses pinned known_hosts when `/opt/makenotwork/ssh/known_hosts` exists (`build_runner.rs`)
179		-	- ~~MINOR: `hook_trigger` doesn't check `config.enabled`~~ REFUTED — DB query includes `AND enabled = true`
180	67
181	68		### Scheduler & Infrastructure
182		-	- [x] SERIOUS: Soft-deleted item purge never cleans S3 — added `get_expired_deleted_item_s3_keys` query + S3 delete before DB purge (`scheduler/cleanup.rs`, `db/items.rs`)
183		-	- [x] MODERATE: Dead webhook retry storm — added `AND attempts < 5` guard to `get_retryable_events` query (`db/webhook_events.rs`)
184		-	- [x] MINOR: WAM client double-slash URL — `trim_end_matches('/')` on base_url (`wam_client.rs`)
185		-	- [x] NOTE: `COUNT(*) LIMIT 1` no-op in monitor — changed to `SELECT EXISTS(...)` (`monitor.rs`)
186		-	- [x] MODERATE: S3 delete then DB delete crash gap — implemented `pending_s3_deletions` durable queue across all 5 deletion paths (migration 105)
187		-	- [x] MINOR: Stale refund escalation sends duplicate alerts — `mark_escalated` now runs before alerts, skips on failure (`scheduler/webhooks.rs`)
188	69		- [ ] NOTE: Announcement emails lost on server restart — no delivery persistence (`scheduler/announcements.rs:59-85`)
189		-	- [x] NOTE: Duplicate onboarding emails on step-advance DB failure — advance step before sending email; missing one email beats duplicates (`scheduler/announcements.rs`)
190		-	- [x] NOTE: Idempotency middleware drops >1MB response bodies silently — check content-length before consuming body, skip caching for large responses (`metrics.rs`)
191	70		- [ ] NOTE: Unconfigured S3 reports `s3_ok = true` — intentional but masks misconfig (`monitor.rs:56-65`)
192	71		- [ ] NOTE: `X-Forwarded-For` spoofable without Cloudflare — accepted risk (`rate_limit.rs:26-31`)
193		-	- ~~MINOR: Advisory lock accumulates across ticks~~ REFUTED — reentrant by design, harmless
194	72
195		-	### Email, Templates, Config & Import
196		-	- [x] MEDIUM: Dev-mode email logging exposes sensitive tokens — body redacted from log output (`email/mod.rs`)
197		-	- [x] MEDIUM: CSV import has no row count limit — added 100K row cap (`import/csv_converter.rs`)
198		-	- [x] LOW: `parse_amount_cents` wrong for negative decimals — fixed sign handling (`import/csv_converter.rs`)
199		-	- [x] LOW: `format_revenue` displays negative as `"$-5.00"` — changed to `"-$5.00"` (`formatting.rs`)
200		-	- [x] LOW: `slugify` produces unbounded-length output — capped at 128 chars (`formatting.rs`)
201		-	- [x] LOW: Dev signing secret uses UUID v4 — changed to 256-bit CSPRNG (`config.rs`)
202		-	- [x] NOTE: Email verification HMAC lacks `"verify:"` prefix — fixed in Auth section above (`email/tokens.rs`)
203		-	- [x] LOW: Negative `price_cents` produces malformed `price_decimal` in JSON-LD — fixed sign handling (`types/mod.rs`)
204		-	- [x] NOTE: `sanitize_field` tab/CR branches are dead code — removed (`import/csv_converter.rs`)
205		-	- [x] MEDIUM: Unsubscribe `action` parameter not validated against enum — added `UnsubscribeAction` enum with 9 variants, updated 17 call sites, fixed missing `notify_tip` handler (`email/tokens.rs`, 13 files)
206		-	- [x] LOW: Issue reply signature truncated to 64 bits — switched hex to base64url encoding, now 96 bits in same 16 chars (`email/tokens.rs`)
207		-	- [x] LOW: Import tier `price_cents` silently clamped from i64 to i32 — replaced with `try_into()` + descriptive error (`import/pipeline.rs`)
208		-	- [x] LOW: Import `strip_html_tags` has no output length limit — capped at 512KB (`import/pipeline.rs`)
209		-	- [x] LOW: Lossy i64-to-u32 casts in WaveStats/DbDiscoverItemRow — replaced with saturating casts (`types/conversions.rs`)
	73	+	---
	74	+
	75	+	## S3/DB Crash-Gap Fix: `pending_s3_deletions` Durable Queue -- DONE
	76	+
	77	+	All 5 paths migrated, scheduler retry job wired. See `todo_done.md` for details.
210	78
211	79		---
212	80
			@@ -223,38 +91,11 @@
223	91
224	92		### Media Player
225	93		- [ ] Video URL fallback on S3 presign failure (migration: `video_url` column)
226		-	- [x] Arrow key seek should use virtual timeline (segment-aware) — extracted `seekToVirtualMs`, keyboard handler uses virtual time in segment mode
227		-
228		-	### S3/DB Crash-Gap Fix: `pending_s3_deletions` Durable Queue
229		-
230		-	S3 deletes then DB deletes create a crash gap: if the server dies between the two steps,
231		-	the DB references deleted S3 objects (or S3 objects are orphaned with no DB reference).
232		-
233		-	Affected paths (5 total):
234		-	1. `scheduler/cleanup.rs` — `cleanup_user_s3_and_delete` (user CASCADE, main + synckit buckets)
235		-	2. `scheduler/cleanup.rs` — `purge_expired_deleted_items` (soft-delete purge, main bucket)
236		-	3. `routes/ota.rs:250-257` — `delete_release` (OTA artifacts, synckit bucket)
237		-	4. `routes/storage/media.rs:374-384` — media file delete (main bucket)
238		-	5. `routes/api/content_insertions.rs:284-290` — insertion delete (main bucket)
239		-
240		-	Implementation:
241		-
242		-	- [x] Migration 105: `pending_s3_deletions` table
243		-	- [x] DB module `db/pending_s3_deletions.rs`: enqueue, remove, get_stale
244		-	- [x] `cleanup_user_s3_and_delete`: enqueue before S3/CASCADE, bail on failure
245		-	- [x] `purge_expired_deleted_items`: enqueue before S3/purge, bail on failure
246		-	- [x] `delete_release` (ota.rs): enqueue before S3/DB delete
247		-	- [x] media file delete: enqueue before S3/DB delete
248		-	- [x] insertion delete: enqueue before S3/DB delete
249		-	- [x] Scheduler retry job `retry_pending_s3_deletions` (10min, batch 100, sandbox cadence)
250		-	- [x] Wired into `scheduler/mod.rs` sandbox block
251		-
252		-	Edge cases: S3 deletes are idempotent (404 = success). Duplicate rows are harmless. Enqueue failure = bail before any destructive work. Crash between enqueue and S3 = retry job picks up. Crash after S3 but before DB = next scheduler tick re-processes (re-enqueue is harmless). Advisory lock prevents concurrent schedulers.
253	94
254	95		### Code Quality
255	96		- ~~Remove `async-trait`~~ — kept: all 3 traits are used as `dyn` objects; Rust 2024 async fn in traits is not dyn-compatible. `async-trait` is the correct tool until `dyn async fn` stabilizes (RFC 3245)
256		-	- [ ] Add README.md to server/
257		-	- [ ] Split oversized route files: exports.rs, license_keys.rs, health.rs, tabs/user.rs
	97	+	- [x] Add README.md to server/ (Run 23)
	98	+	- [x] Split oversized route files: exports.rs, health.rs, tabs/user.rs (Run 23)
258	99		- [ ] Monitor scheduler.rs, git/mod.rs for growth
259	100
260	101		### Feature Completeness
			@@ -365,7 +206,7 @@
365	206		import/ (CSV converter, pipeline, intermediate format)
366	207		MNW/server/tests/
367	208		integration.rs, harness/, workflows/*.rs
368		-	MNW/server/migrations/ (001-096)
	209	+	MNW/server/migrations/ (001-107)
369	210		MNW/server/templates/
370	211		MNW/server/deploy/
371	212		MNW/server/site-docs/public/, MNW/server/site-docs/unpublished/

M server/docs/todo_done.md +59

			@@ -331,3 +331,62 @@
331	331		- [x] License Keys docs — added offline verify endpoint, license.txt, revocation, PWYW, /api/v1/ prefix
332	332		- [x] SyncKit docs — added SSE, key rotation, subscription gating, batch_id, sync status
333	333		- [x] FAQ — added For Developers section, tier features, custom domains, data retention, content moderation
	334	+
	335	+	---
	336	+
	337	+	## Ultra Fuzz Run 22 (2026-05-09)
	338	+
	339	+	- [x] Fix CSRF field name: change `csrf_token` to `_csrf` in `fan_plus.html:97`, `project.html:209`, `sandbox.html:24`
	340	+	- [x] Add migration: unique constraint on `idempotency_keys(key, user_id, method, path)` replacing `(key, user_id)` (migration 106)
	341	+	- [x] Add `UNIQUE(s3_key, bucket)` to `pending_s3_deletions` table (migration 107)
	342	+
	343	+	---
	344	+
	345	+	## Ultra Fuzz Run 21 (2026-05-08)
	346	+
	347	+	### SERIOUS
	348	+	- [x] Pin scheduler advisory lock to acquired connection — hold for tick duration (`scheduler/mod.rs:77-88`)
	349	+	- [x] Enforce PWYW minimum in cart `effective_price_cents()` — `.max(pwyw_min_cents)` (`db/cart.rs:104-108`)
	350	+	- [x] Fix soft-delete purge: query version S3 keys + decrement storage before CASCADE (`scheduler/cleanup.rs:188-222`)
	351	+	- [x] Wrap confirm_upload DB writes in single UPDATE — rollback storage on failure (`routes/storage/uploads.rs:225-248`)
	352	+	- [x] Optimize discover page: parallelize facet queries with try_join! (`routes/pages/public/discover.rs:292-513`)
	353	+
	354	+	### MINOR/MEDIUM
	355	+	- [x] Delete old S3 objects on item image/audio/video replacement (`routes/storage/images.rs`, `routes/storage/uploads.rs`)
	356	+	- [x] Validate checkout cancel `item_id` as UUID (`routes/stripe/checkout/mod.rs:105-108`)
	357	+	- [x] Change ClamAV `contains("FOUND")` to `ends_with("FOUND")` (`scanning/clamav.rs:96`)
	358	+	- [x] Case-normalize URL-encoded path traversal check (`scanning/archive.rs:70`)
	359	+	- [x] Add UNIQUE(s3_key) to pending_uploads table (migration 102)
	360	+	- [x] Add `#[tracing::instrument(skip_all)]` to embed/ handlers
	361	+	- [x] Initialize PWYW amount_cents hidden field server-side (`templates/pages/purchase.html`)
	362	+	- [x] Use re-auth for OAuth authorize with legacy sessions (`routes/oauth.rs:253-256`)
	363	+
	364	+	---
	365	+
	366	+	## Audit Remediations (2026-05-08, post-Sprint 9)
	367	+
	368	+	- [x] Fix XSS: escape `s.category` and `s.url` in search suggestions innerHTML (discover.html)
	369	+	- [x] Fix XSS: replace inline `onsubmit` handler with `addEventListener` in collections.js
	370	+	- [x] Fix a11y: convert `<span onclick>` save buttons to `<button>` with `aria-label` on discover cards
	371	+	- [x] Performance: rewrite `get_user_purchases` double-nested correlated subquery — replaced with LATERAL joins
	372	+	- [x] Remove unused import `spawn_email` in `stripe/checkout/cart.rs`
	373	+	- [x] Remove dead code `update_app_sync_sub_tier` in `db/app_sync.rs`
	374	+
	375	+	---
	376	+
	377	+	## Code Fuzz Findings (2026-05-08)
	378	+
	379	+	Two-pass fuzz: 100+ findings across payments, subscriptions, auth, storage, scanning, DB, git, scheduler, email/import. All SERIOUS and MEDIUM items fixed. See git history (commits `42405fe`, `f0e40b7`, `fed8192`, `80bfdd9`, `bac01d6`, `ba3bbac`) for full details. Key fixes:
	380	+
	381	+	- Cart refund iterates all matching transactions (was single fetch)
	382	+	- Re-subscription after cancel now reactivates (was DO NOTHING)
	383	+	- `handle_subscription_updated` sets `canceled_at` across all 4 subscription types
	384	+	- Internal CLI upload validates S3 key prefix + storage order
	385	+	- Soft-deleted item purge cleans S3 via `pending_s3_deletions` durable queue (migration 105)
	386	+	- Passkey registration requires re-authentication
	387	+	- Password reset invalidates all other sessions
	388	+	- Build runner: atomic claim, per-repo HMAC, pinned known_hosts, ANSI stripping
	389	+	- Promo codes: collision fix, use_count release, transactional license keys
	390	+	- Unsubscribe action validated against enum (9 variants, 17 call sites)
	391	+	- CSV import: row cap, amount parsing, HTML strip limit
	392	+	- Archive scanning: URL-encoded path traversal, nested archive, content type hardening

M server/src/metrics.rs +3 -2

			@@ -229,12 +229,13 @@
229	229		}
230	230		};
231	231		// Only cache UTF-8 responses — skip binary content to avoid corruption
232		-	if let Ok(body_str) = String::from_utf8(body_bytes.to_vec()) {
	232	+	if let Ok(body_str) = std::str::from_utf8(&body_bytes) {
	233	+	let body_owned = body_str.to_owned();
233	234		let db = state.db.clone();
234	235		let key = idem_key.clone();
235	236		tokio::spawn(async move {
236	237		if let Err(e) = crate::db::idempotency::store_response(
237		-	&db, &key, user_id, &method, &path, status_code, &body_str,
	238	+	&db, &key, user_id, &method, &path, status_code, &body_owned,
238	239		).await {
239	240		tracing::warn!(key = %key, error = ?e, "failed to store idempotency key");
240	241		}

M server/src/db/cart.rs +43

M server/src/db/items.rs +52

M server/src/db/pending_uploads.rs +1 -1

M server/src/import/csv_converter.rs +8 -1

M server/src/scanning/archive.rs +5 -4

M server/templates/pages/use_cases.html +1 -1

M server/site-docs/public/about/economics.md +1 -1

M server/site-docs/public/about/generative-ai.md +1 -1

M server/site-docs/public/about/how-we-work.md +3 -47

M server/site-docs/public/about/roadmap.md +2 -2

M server/site-docs/public/about/story.md +1 -1

M server/site-docs/public/guide/02-content.md +1 -1

M server/site-docs/public/guide/03-selling.md +5 -3

M server/site-docs/public/guide/best-practices.md +2 -2

M server/site-docs/public/guide/fan-guide.md +1 -1

M server/site-docs/public/guide/getting-started.md +3 -3

M server/site-docs/public/guide/items.md +1 -1

M server/site-docs/public/guide/profile.md +7 -5

M server/site-docs/public/guide/projects.md +2

M server/site-docs/public/guide/promo-codes.md +2

M server/site-docs/public/guide/tiers.md +1 -1

M server/site-docs/public/legal/payments.md +3 -24

M server/site-docs/public/support/faq.md +2 -2

M server/site-docs/public/tech/portability.md +1 -1

M server/src/routes/api/cart.rs +8 -16

M server/src/routes/api/guest_checkout.rs +5

M server/src/routes/storage/downloads.rs +26 -30

M server/src/routes/storage/versions.rs +26 -13

M server/templates/partials/tabs/user_creator.html +2 -2

M server/src/routes/pages/public/docs.rs +1 -1

R server/src/routes/pages/public/health.rs → server/src/routes/pages/public/health/mod.rs +3 -100

R server/src/routes/api/exports.rs → server/src/routes/api/exports/mod.rs +5 -254

A server/README.md +26

A server/site-docs/examples/profile-layout.html +36

A server/site-docs/examples/project-edit-form.html +19

A server/site-docs/examples/promo-code-form.html +58

D server/site-docs/public/html/01-getting-started.html -135

A server/src/routes/api/exports/content.rs +244

D server/src/routes/pages/dashboard/tabs/user.rs -815

A server/src/routes/pages/dashboard/tabs/user/creator.rs +306

A server/src/routes/pages/dashboard/tabs/user/integrations.rs +204

A server/src/routes/pages/dashboard/tabs/user/mod.rs +203

A server/src/routes/pages/dashboard/tabs/user/payments.rs +161

A server/src/routes/pages/public/health/pom.rs +102