-
Exorcise sweep: strip AI tells from server copy, comments, and docs
-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Decompose AppState Phase 2: migrate remaining api top-level + exports
-
Decompose AppState Phase 2: api ownership-helper foundation
-
Enforce the per-item license-key cap atomically under an item-row lock
-
Remediate audit Run 21 findings across server
-
Frontend: kill media-picker XSS; render_string surfaces errors
-
Tighten checkout guards and document promo use semantics (ultra-fuzz Run 10 Payments)
-
security: seal git-push CSRF, close 7z/RAR polyglot evasion, exhaustive sanitizer allowlists
-
payments: close refund crash-window, seal enforcement_mode enum, license-key idempotency
-
server: report authoritative license activation_count (ultra-fuzz Run #1 Payments MINOR)