API Code Review — v2

Scope: apps/api/src/ — routers, socket handlers, JWT, auth, worker, bootstrap
Date: 2026-04-05
Reviewer: Claude Code
Resolution status updated: 2026-04-08

Summary

27/28 items resolved. 1 pending (architectural, deferred).

Architectural Notes

A-1 · Registration session is a JSON blob, not typed columns

Status: ⏳ Deferred — requires a schema migration; out of scope for patch fixes.

The registrationSession.data field stores arbitrary JSON with no DB-level schema enforcement.

Recommendation: Model each registration step as typed columns on registrationSession (or separate tables).