Pure refactoring and hardening. No new migrations. The headline: a 1,914-line DashboardController extracted into two focused services — metrics and preferences — reducing the main index action from 265 lines to 42 and the preferences save action from 60 to 15. Forty-two tests with 112 assertions on the dashboard service alone.
Input validation hardened across the board: allowlisted range values (day filters can only be 7, 30, 90, or 180), 255-character string bounds, non-negative integer enforcement, defensive structure validation. The security risk for oversized controllers dropped from MEDIUM to LOW.
Forty-three admin views touched as a cascade from the dashboard refactor. A 1,914-line controller does not just affect one file.