PR #442 (listing-photo locality half) merged to main 2026-09-09. Product/scan photos and the bucket-provider decision (R2 vs. Railway bucket vs. S3) remain open; the actual MEDIA_STORAGE_BACKEND=s3…
D10 (historic upload exposure, 2026-08-13 to 08-20) resolved — no disclosure needed.
Checked MEDIA_VOLUME_PATH on runrecon-back: it's set (/app/uploads/media), so the worse-case serving path did…
Audited every other content_type.startswith("image/") / not ... startswith("image/") site in the backend, prompted by PR #442's lister.py fix (substring check let image/svg+xml through;…
Phase 0 (multi-process concurrency) opened as PR #446 — env-configurable UVICORN_WORKERS on the API's uvicorn command (backend/Dockerfile + docker-compose.yml), default 1 (no behavior change).…
This is still live, and it is worse than the title says: the walk has not completed since 2026-08-30 — ten days. Measured against prod today.
lane_runs, last three nights:
09-08 05:02…
Closing — this shipped. Verified against origin/main today: backend/app/main.py is down from 151 conn.execute(text(...)) statements to 6, and the file from 741 lines to 422.
Credit…
Progress update — Phase 2 (fix the event-loop-blocking call sites) is done.
A precise AST-based scan (built as part of this pass, not estimated) found the real count was 20 async def routes / 68…