Tracker: 2026-05-26 audit session — 27 bugs logged (#100-#127)
node-agent on zampp2: redundant + dead env vars in .env.worker
Accessibility: icon-only buttons missing aria-label across asset and library screens
Frontend: hardcoded Premiere panel version 1.0.1 in editor download links
Frontend: typo setPgMclips should be setPgmClips for consistency
Frontend: 13 stray console.error / console.warn calls in production JSX
Frontend: production deploy ships React dev builds + in-browser Babel — slow first paint, console warnings leak
Backend: multer.memoryStorage holds 500 MB parts in RAM — concurrent uploads OOM the API
Backend: GET /recorders fires unbounded concurrent Docker API + PG calls (N+1)
Backend: assets list endpoint has no LIMIT cap — ?limit=999999999 OOMs the API
Backend: SDK upload extracts archives with no path-traversal protection (admin-only RCE risk)
Frontend: Schedule rows crash on null recorder_id (orphaned schedule)
Frontend: EditorKeyboard crash on document.activeElement = null
Frontend: hardcoded /api/v1 paths bypass ZAMPP_API.fetch in upload module
Storage admin page + external S3 → MAM bucket migration
Frontend: sidebar shows hardcoded "3" badge on Jobs forever
Frontend: setTimeout/setInterval leaks across multiple screens — setState on unmounted components
Frontend: hard page reload on project delete wipes in-flight state
index.html missing bmd-card.js — fixed in 1535bba but documenting the gap