Opus finding
`/api/opt-in` swallows `flipReceipt` errors and bubbles them as a 5xx, but no try/catch around the flip means transient DB errors surface as unhandled 500s
mediumbughigh
- apps/web/app/api/opt-in/route.ts:60-67
There's deliberate try/catch around `recordEvent` (audit best-effort), but `flipReceipt` is awaited unguarded. If the DB throws, the response is an unhandled rejection → Next will respond 500 with a framework error page, contradicting the design goal that this endpoint always returns a styled HTML page (the route ships its own pageShell with `noindex` and 'no-cache' headers, and even maps validation failures to themed pages). The user is left with a stack trace instead of an actionable message pointing to the email fallback. Token logId is also lost in that path.
Recommendation
Wrap the flipReceipt call in try/catch and return `htmlResponse(500, errorPage('Something went wrong', '...email agent@antfleet.dev...'))`, logging with logWarn.