AI HUB OPERATING CONTROLS v1

- User submissions are moderation-pending by default.
- Anonymous save and unique-download signals use a random opaque device cookie hashed before storage; downloads count only an explicit user-intent POST, never crawler GET requests.
- Raw IP addresses and browser fingerprints are not stored by AI Hub application code.
- Ranking is selectable. Editorial placement and paid placement are not represented as organic popularity.
- Downloads are immutable by slug and version.
- Payments and cash-equivalent credits fail closed until PG, refund, tax, settlement, and recovery contracts are verified.
- Public build audit rejects local user paths, common token patterns, account emails, and source maps.