`CHANGES2.md`

10 lines
## Round 2 Applied
- src/server/data_market.ts:321 — added malformed/missing body guard before reading `b.kind` and other body fields — fixes CODEX_REREVIEW.md "Missed call-sites" finding for `POST /data/checkout`, where absent/non-object `req.body` could 500.

## Still Deferred
- Previously deferred P0/P1 items in CHANGES.md remain for Steve because they require policy, ops, package, schema, migration, or broader routing decisions outside this safe round-2 scope.
- Real secret rotation/removal from `.env` remains deferred; no secrets were changed.
- Stripe webhook parser ordering and forwarded-host redirect trust remain deferred; both need broader server/config decisions.
- Auth rate limiting/audit trail and public endpoint spam controls remain deferred; both need product/security policy.
- Package script/runtime/typecheck issues, orchestrator failure behavior, transactional migrations, CLI parameterization, duplicate-race database constraints, and query performance refactors remain deferred.