-
Exorcise sweep: strip AI tells from server copy, comments, and docs
-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Decompose AppState Phase 2: migrate remaining api top-level + exports
-
Decompose AppState Phase 2: migrate stripe (leaf tree) to slices
-
Group Config and AppState into cohesive sub-structs
-
audit Run 16 Phase 3: Concurrency
-
audit Run 15 Phase 1: payments & data-integrity fixes
-
Fund the Fan+ credit from the platform, not the creator (ultra-fuzz Run 12 Payments)
-
payments: seal StripeAccountId + cart ItemType, add DB-layer tests
-
security: seal git-push CSRF, close 7z/RAR polyglot evasion, exhaustive sanitizer allowlists
-
server: seal S3 keys behind a typed builder; close storage A+ gaps (ultra-fuzz Run #1 --deep Phase 3)
-
Require a claim link for free guest claims too
-
Require a claim link for guest purchases (no email auto-attach)
-
server: gallery/carousel, promo-validator, fuzz #11/#12 remediations, embed port, observability
-
launch-eve audit pass: Ultra Fuzz Runs #8-9 + cross-cutting sweeps
-
exorcise: B15a routes/api/ doc comments
-
Convert .map_err Internal(anyhow!) to ResultExt::context, fix variant misuse
-
Add Email validated newtype, replace ad-hoc email handling