-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Decompose AppState Phase 2: thread slices through stripe dispatcher
-
Decompose AppState Phase 2: migrate stripe (leaf tree) to slices
-
server: non-blocking per-event webhook lock (try_lock_event)
-
payments: seal webhook dedup and tip-split idempotency (audit Run 20 Phase 1)
-
server: gate one-time checkout finalize on payment settlement
-
server: line-aware cart refunds + orphaned-paid-session escalation (ultra-fuzz Run 2 Payments SERIOUS)
-
server: drive Payments axis to A+ (ultra-fuzz Run #1 --deep Phase 1)
-
server: close license-activation revoke TOCTOU; stop pending-refund dup re-queue
-
Require a claim link for guest purchases (no email auto-attach)
-
Harden server across 5 audit axes (ultra-fuzz Run #19 remediation)
-
launch-eve audit pass: Ultra Fuzz Runs #8-9 + cross-cutting sweeps
-
server: synckit-app-sub end-user billing (first-party apps)
-
exorcise: B15c routes/{stripe,synckit,storage,admin,git,git_issues,embed,postmark} doc comments
-
payments: migrate to async-stripe 1.0.0-rc.5