- [Orval hook naming](orval-hook-naming.md) — generated hooks use operation-id casing, not path-derived names; always grep generated/api.ts before writing frontend hooks.
- [bcryptjs vs bcrypt](bcryptjs-note.md) — use bcryptjs only on Replit; native bcrypt has build script issues.
- [Booking flow pricing](booking-flow-pricing.md) — totalPrice computed server-side from provider per-model Taka (৳) prices + ৳500 customer_location fee; never client-trusted.
- [Profile ID & approval gating](profile-id-and-approval.md) — MDL-XXXX from serial id (not count); enforce approved+active at every consumption point, not just listing.
- [Object storage uploads](object-storage-setup.md) — generic web upload hook sends no auth; for auth-gated uploads use generated client + manual PUT; request-url must requireAuth + server-side MIME/size; serve via /api/storage${objectPath}.
- [Role authorization](role-authorization.md) — split account types need server-side requireRole(...)→403 on role-specific endpoints; UI nav hiding/route guards are UX only, not the boundary.
- [PG→MySQL dump export](pg-to-mysql-dump.md) — dump must emit UNIQUE keys (TEXT cols need (191) prefix) or PHP installer upsert + email login break; keep admin creation schema-agnostic.
- [PHP app on cPanel 500s + unstyled/CSS 404](php-cpanel-deploy.md) — confirm domain points to Namecheap not Replit; php_flag in .htaccess 500s under PHP-FPM; unstyled = BASE_URL base-path mismatch (auto-detect from SCRIPT_NAME, leave .env empty).
- [api-server dev no watch](api-server-build-step.md) — dev script builds once then runs the bundle; restart the workflow after any backend src edit (tsc passing ≠ running code updated).
- [Prod startup env crashes](prod-startup-env-crashes.md) — import-time env throws gated on NODE_ENV=production crash autoscale at promote (port never opens, /api 500); reproduce with NODE_ENV=production node dist/index.mjs.
- [Escrow order flow](escrow-order-flow.md) — proof_uploaded/completed only via dedicated endpoints, refunds admin-only (no cancelled from captured states), guarded tx updates must throw to roll back.
- [API client error shape](api-client-error-shape.md) — generated client throws ApiError with body at err.data (NOT err.response.data); read err.data?.error to surface server messages.
- [Public AI chat endpoint](public-ai-endpoint.md) — /api/chat is intentionally unauthenticated on the owner's OPENAI_API_KEY; must keep rate limiting + trust proxy to protect credits.
