Recent releases.

Highlights

• Admin dashboard rebuilt as a 5-row card grid — stat cards, league health, AI summary, Todo progress, activity feed, recent errors
• Side nav reorganized: dedicated Admin section with 3 sub-groups (Operations / Planning / Reference)
• Error correlation: every 500 returns an ERR- code + admin-only detail field; click-to-copy toast; in-memory ring buffer feeds /admin dashboard
• Session tracking: UserSession + UserMetrics + UserDeletionLog tables, heartbeat hook (30s, BroadcastChannel, one-session-per-browser), /admin/users page with real data
• Cross-linking: Roadmap phases and Concept cards now have stable anchor IDs, hash-scroll + reverse links to related todos
• Parallel-agent execution cut combined Phase A + Phase B build time from ~10 hours sequential to ~2.5 hours elapsed

Key changes

• feat: Admin dashboard: 5-row card grid at /admin with auto-refresh 60s, manual refresh button, graceful degradation
• feat: Session tracking — UserSession, UserMetrics, UserDeletionLog Prisma models with HOT-update optimization (no lastSeenAt index, fillfactor 80, aggressive autovacuum)
• feat: POST /api/sessions/start | /heartbeat | /end — ownership checks, 20/min heartbeat rate limit, concurrent-session cap 10, AuditLog LOGIN entries, credential-stuffing canary
• feat: lib/ipHash.ts — HMAC-SHA256 IP hasher with fail-fast if IP_HASH_SECRET missing; IPv4 /24 + IPv6 /48 truncation
• test: +30 tests (16 server session, 7 client hook, 7 admin users) — total suite 732 passing, 0 failing

• New /todo page — category-based micro-task tracker with cross-links to Roadmap/Concepts
• Concepts page rebuilt with 4 tabs: Strategic / SEO Pages / Integrations / UX Mockups
• Waiver priority UI now uses period-based standings (matches server processing logic)
• Draft Report regenerated with admin bypass — all 8 teams graded A- to F
• YouTube embeds switched to youtube-nocookie.com (fixes prod playback)

• Auction nomination and force-assign now populate mlbTeam on Player records — no more "—" for newly drafted players
• Add/drop claim errors return proper 400 with descriptive messages instead of opaque 500
• Team page roster sorted by shared POS_SCORE constant; pitchers now sorted by position (SP before RP)
• Scoring and standings verified: 8 teams, 7 periods, roto points computed correctly

• Trade analyzer shipped — evaluates proposed trade for both sides with category-weighted analysis
• Keeper recommender — surfaces value picks accounting for salary inflation + positional scarcity
• Shared insights cache in SQLite (via MCP proxy) — duplicate prompts return in < 50ms instead of new inference
• Google Gemini 2.5 Flash remains primary; Anthropic Claude Sonnet 4 now fully wired as fallback

• Full CSP header deployed in Cloudflare Worker — blocks inline script unless nonce matches, blocks unapproved CDN
• HSTS with preload directive, 2-year max-age
• Rate limiter tuned per-endpoint — auth 5/min, auction nominations 2/s, heartbeat 20/min
• Six-month retrospective published internally — 62 sessions, 26 modules, 730 tests, ~100M tokens estimated