Issues

• Set up the director workflow (.claude/director.json)

  TortoiseWolfe/ScriptHammer#1312 · Filter by author TortoiseWolfe opened on Sep 30, 2026

• tracking: 32 RescueDogs review findings that live in ScriptHammer code (fix here once, sync down)

  TortoiseWolfe/ScriptHammer#1311 · Filter by author TortoiseWolfe opened on Sep 30, 2026

• Account deletion fails for anyone who ever checked out, after the client has already deleted their message keys

  bugpriority:p0
  TortoiseWolfe/ScriptHammer#1309 · Filter by author TortoiseWolfe opened on Sep 29, 2026

• A payment made on a retry never advances its order: the buyer is charged and the order stays pending with no receipt

  bugpriority:p0
  TortoiseWolfe/ScriptHammer#1308 · Filter by author TortoiseWolfe opened on Sep 29, 2026

• Webhooks record the event before handling it, so a failed payment event is acknowledged on retry and never processed

  bugpriority:p0
  TortoiseWolfe/ScriptHammer#1307 · Filter by author TortoiseWolfe opened on Sep 29, 2026

• Tip Jar checkout shows the $15 default and "Pay $15", then charges the amount the buyer picked

  bugpriority:p0
  TortoiseWolfe/ScriptHammer#1306 · Filter by author TortoiseWolfe opened on Sep 29, 2026

• River bridges (Walnut Street, Market Street, Olgiati, Veterans): stake and model; Walnut Street photo-matched (wb003)

  TortoiseWolfe/ScriptHammer#1305 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• Group messages are accepted under a stale key version: refuse them server-side (#1247 B3)

  TortoiseWolfe/ScriptHammer#1301 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• A resent confirmation email confirms the address but cannot sign anyone in: auth-js 2.72's resend() sends no PKCE challenge

  TortoiseWolfe/ScriptHammer#1298 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• Car Barns (1886, Market & W 3rd): model the CARTA bus barn as it stood in 1978, replace 300-market-street, spawn there

  3dpriority:p2
  TortoiseWolfe/ScriptHammer#1290 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• [EPIC] Replace the 129 Warehouse models with own-authored SketchUp buildings — historic Chattanooga first

  3depicpriority:p2
  TortoiseWolfe/ScriptHammer#1289 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• The auth tutorial blog post teaches the email-keyed lockout #1245 removed, and imports a deleted module

  TortoiseWolfe/ScriptHammer#1286 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• Admin sign-in and failure counts are client-written rows: a signed-in user can still inflate logins, and anon failures are unbounded and drive the security alert

  TortoiseWolfe/ScriptHammer#1284 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• Tailwind scans the whole repo, so strings in tests/ and scripts/ ship as production CSS and change stylesheet hashes

  TortoiseWolfe/ScriptHammer#1279 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Dead code: eight unused modules, deprecated test-only exports, 24 unreferenced scripts, and fourteen Storybook-only components that need a call

  TortoiseWolfe/ScriptHammer#1265 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Five test files (3,101 lines) test mock classes they define themselves and import no production code; plus the smaller vacuities beside them

  TortoiseWolfe/ScriptHammer#1264 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Test infrastructure: Deno tests nothing runs, two tests disabled by rename, a global mock where every write succeeds, coverage excludes that hide tested code

  TortoiseWolfe/ScriptHammer#1263 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Offline/PWA layer: two components fight over the install prompt, the service worker re-installs on every page load, a failed message loops the sync

  TortoiseWolfe/ScriptHammer#1262 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Three TODOs in shipped code whose surrounding output claims the feature works: subscription retry moves no money, webhook-retry script retries nothing

  TortoiseWolfe/ScriptHammer#1261 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Edge Functions carry five copies of getPayPalAccessToken and two divergent timingSafeEqual implementations

  TortoiseWolfe/ScriptHammer#1260 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• No ceiling on message size, send rate, friend requests, uploads or payment intents for a signed-in account; admin-DM forgery is by design and undocumented as such

  TortoiseWolfe/ScriptHammer#1254 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Messaging reloads everything on a 10-second timer and on every event instead of subscribing to the row that changed

  TortoiseWolfe/ScriptHammer#1253 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• avatar_url accepts any URL, turning every profile view into a tracking beacon — and the obvious fix breaks OAuth avatars

  TortoiseWolfe/ScriptHammer#1252 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Device-side key lifecycle: session mode still persists the private key, group keys are extractable, and three smaller gaps

  TortoiseWolfe/ScriptHammer#1251 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Production auth config: localhost in the redirect allow-list, OTP verify limit raised to 100, no re-auth for password change, server minimum password 6

  TortoiseWolfe/ScriptHammer#1250 · Filter by author TortoiseWolfe opened on Sep 23, 2026