6 things to fix, and how
What needs a decision
The 3-trip cap can be dodged with a second account
How to fixFour accounts sharing one phone number each posted a live trip — all four accepted
(200/200/200/200). The cap counts accounts, and the phone number is never checked.
Why it matters: that cap is the only thing stopping one person from filling the board; signing up is free and the phone is unverified.
phone_norm, already planned in #246) and count live
trips per phone, not per account. Refuse the fourth with the same wording the cap uses today.Add listAliveTripsForNumber() beside listAliveTrips() in src/db/api_post_limits.ts, union the ids in checkTripLimits(), and pass me.phone_norm from postTrip. The two columns already exist. Decide first: an unverified number becomes a person.
Two accounts on one number never reach the admin
Needs a decisionSigned up twice with the same number; the admin queue stays silent. The "let it through" half of #246 is built — the "tell the admin" half is not.
Correction: the queue does flag numbers, but only when one side is suspended (decision 44). Whether it should flag every shared number is your call.
The fee can be raised after a buyer has asked
Needs a decisionA trip at 10% received an ask, then the fee went to 60% and the change was accepted. The buyer is alerted — but their open ask stays open at the old terms.
Why it matters: the fee is the number the buyer agreed to; changing it under an open ask is a bait-and-switch, even with a notice.
Correction: the fee is already locked once a deal is accepted (tripHoldsFee). Only an open ask leaves it free — should it lock that too?
Ending a trip with an accepted deal is allowed
Needs a decisionTraveller accepted a deal, then ended the trip — accepted. The buyer keeps the thread, but the traveller walks away with no mark on their profile.
Correction: the accepted deal survives the end (tripEndCloseStatement closes only untouched asks). The open question is whether the profile should show it.
Three Malay strings will break the page
How to fixThe Malay file loses placeholders and plural branches on three keys, so a raw
{c} or a missing count can show on the page:
admin.photoCount · trip.ratings · profile.bar
ms.ts — each of those needs the same placeholders and the same
two branches as the English line.Three lines in ui/src/locales/ms.ts need the English structure (two plural branches, same placeholders), plus a parity test over ui/src/locales — the repo has that check only for src/lib/i18n.
Three alert lines are too long for a phone
How to fixhow.step2.b (222 characters), event.alert.suspended (240),
event.alert.suspendedReason (259). One alert row that long pushes everything else
off a 375px screen.
Shorten in src/domain/api_events.ts first (it is the source), then the six matching lines in en.ts / ms.ts. Keep the words Report a problem: a test pins that phrase.
Checked and clean
- All 54 routes, signed out and signed in, with empty / array / null / string bodies and wrong methods: no 5xx anywhere.
- The contact filter blocked all 24 ways of writing a phone number or a handle — in chat and on a public post.
- Admin-only routes, self-dealing (own trip, own request, own review) and fake reviews are all refused in plain words.
- The repo's own suite: 1,527 of 1,530 passed. The three failures are 5-second timeouts on a busy machine, not regressions.
What the board looks like today
