Entry point: ../README.md. Files below are existing design notes; they were written per-feature, so check the code when in doubt.
- api/slots.md, api/booking-intents.md, booking-intent-api.md, api/checkout.md, payments/checkout.md, api/buyer-profile.md
- api/errors.md, api/error-status-mapping.md, error-codes.md, ERROR_TAXONOMY.md, contracts/errors.md
- api/headers.md, api/content-negotiation.md, api/grace-window.md, api/pricing-strategies.md, pricing-strategies.md
- Root-level: ../CHECKOUT_API.md, ../CHECKOUT_SECURITY.md
- architecture/backend.md, SETUP_GUIDE.md, environment-validation.md, redis.md, caching.md, idempotency.md
- Database: database/migrations.md, database/geo-radius-search.md, database/observability.md, MIGRATION_SAFETY_IMPLEMENTATION.md
- API_SECURITY.md, SECURITY_VALIDATION.md, CORS_CONFIGURATION.md, rate-limiting.md
- auth/jwt.md, auth/mfa.md, auth/api-keys.md, auth/permissions.md, auth/role-hierarchy.md
- security/ (headers, impersonation recording, internal auth, Redis encryption, request limits), IMPERSONATION_EXAMPLES.md, SECRET_ROTATION_RUNBOOK.md, audit-events.md, dependency-scanning.md
- Disputes: dispute-appeals.md, dispute-deadline.md
- Cancellation/holds: cancellation-overrides.md, prorated-cancellation-ledger.md, refundable-hold-escalation.md, refundable-hold-sweeper.md
- Fraud: fraud-detection.md, fraud-drift.md, fraud-model-registry.md
- Escrow/payouts: escrow-event-listener.md, payout-quarantine.md, runbook/escrow-migration.md, hsm-adapter.md
- Feature flags: feature-flags.md, feature-flag-rollouts.md
- Privacy: gdpr-erasure.md, pii-conformance.md, differential-privacy.md, note-sanitization.md
- Other: reminders.md, notifications/sms.md, capacity-simulator.md, scheduler-job-runner-contract.md, payments/rounding.md
- observability.md, observability/pii.md, LOGGING.md, LOGGING_QUICK_REFERENCE.md, metrics.md, tracing.md, OPENTELEMETRY_IMPLEMENTATION.md, grafana-loki-quickstart.md, wal-integrity.md
- reliability/ (dependency outages, expiry cleanup worker, timeouts)