Patrick Bass Area: Engagement (audit p9) · Surface: src/Controllers/ProjectController.php + templates/projects/* · Dimension: dead-code · Severity: enhancement
The entire DIY Projects feature (controller + 7 templates + project-categories admin + vote/follow API) is intentionally disabled for every tenant via POLICY_DISABLED. The code is present and wired but unreachable in production. Reporting as a removal candidate per the policy-disabled rule, not as a bug. If the projects feature is permanently shelved, this is ~1300 lines of controller plus templates that could be removed.
Evidence
FeatureCatalog.php:78 lists 'projects' in POLICY_DISABLED. ProjectController.php:27 `$this->features->require('projects');` runs in the constructor, so every one of its ~28 routed actions 404s for any tenant (the flag never auto-enables). routes.php:513-521, 897-914 register the full /projects/* route surface. Templates: projects/index, show, create, edit, following, releases/create, releases/show — all rendered only from this 404-gated controller.Suggested fix. Leave as-is if 'projects' may be re-enabled per-tenant in future (it remains in CATALOG for an explicit opt-in). If permanently retired, remove ProjectController, templates/projects/*, and the /projects routes together.
Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.
Patrick Bass
@mobieus
