From 6883a148d8eda111b4762a9a16fbd326c5fd04d0 Mon Sep 17 00:00:00 2001
From: Juan Mrad <juansmrad@gmail.com>
Date: Tue, 14 Apr 2026 22:27:59 -0500
Subject: [PATCH] [Vulnerabilities] Remove lodash by migrating from better
 mutation to plugin-functional and fix minor lint warnings (#216)

* [Vulnerabilities] Remove lodash by migrating from better mutation to plugin-functional and fix minor lint wwarnings

* remove bad merge main
---
 client/src/components/ErrorBoundary.tsx       |   2 +-
 client/src/utils/itemUtils.ts                 |   2 +-
 client/src/utils/tree.test.ts                 |   2 +-
 client/src/utils/tree.ts                      |   2 +-
 client/src/webpages/App.tsx                   |  16 +-
 .../item_types/ItemTypeRequestCodeSamples.tsx |   2 +-
 ...wQueueRuleConditionMediaMatchingValues.tsx |  25 +-
 .../ReportingRuleInsightsActionsChart.tsx     |   4 +-
 .../RuleFormConditionMatchingValues.tsx       |   9 +-
 .../RuleFormSignalModalSubcategoryGallery.tsx |  29 +--
 server/.eslintrc.cjs                          |  19 +-
 server/api.ts                                 |   4 +-
 server/condition_evaluator/conditionSet.ts    |  29 ++-
 server/eslint.config.mjs                      |  14 +-
 server/graphql/datasources/RuleApi.ts         |  29 +--
 server/graphql/datasources/UserApi.ts         |  19 +-
 server/graphql/modules/actionStatistics.ts    |  10 +-
 server/graphql/modules/insights.ts            |   2 +-
 server/graphql/modules/signal.test.ts         |   1 -
 server/iocContainer/index.ts                  | 152 ++++++------
 server/package-lock.json                      | 192 +++++++++------
 server/package.json                           |   5 +-
 server/routes/content/ContentRoutes.test.ts   |  13 +-
 server/routes/gdpr/gdprRoutes.test.ts         |  12 +-
 server/routes/index.test.ts                   |  15 +-
 server/routes/index.ts                        |   1 -
 .../integration_logos/serveIntegrationLogo.ts |   8 +-
 .../serveIntegrationLogoWithBackground.ts     |  10 +-
 server/routes/items/ItemRoutes.test.ts        |  12 +-
 server/routes/policies/PoliciesRoutes.test.ts |  10 +-
 .../routes/reporting/ReportingRoutes.test.ts  |   9 +-
 server/routes/reporting/submitAppeal.ts       |   5 +-
 server/routes/reporting/submitReport.ts       |  64 ++---
 server/rule_engine/ActionPublisher.test.ts    | 218 +++++++++---------
 server/rule_engine/ActionPublisher.ts         |  22 +-
 .../actionStatisticsService.ts                |  12 +-
 .../analyticsLoggers/ContentApiLogger.ts      |   2 +-
 .../analyticsLoggers/ItemModelScoreLogger.ts  |   2 +-
 .../itemInvestigationService.test.ts          |   3 +-
 .../extractItemDataValues.ts                  |   2 +-
 .../fieldTypeHandlers.test.ts                 |   1 -
 .../manualReviewToolService.test.ts           |   3 +-
 .../manualReviewToolService.ts                |  37 +--
 .../modules/JobDecisioning.ts                 |   2 +-
 .../modules/JobEnrichment.ts                  |   7 +-
 .../modules/JobRouting.test.ts                |  18 +-
 .../moderationConfigService.test.ts           |  32 +--
 .../moderationConfigService.ts                |   4 +-
 .../ncmecService/ncmecEnqueueToMrt.ts         |  89 +++----
 .../services/ncmecService/ncmecReporting.ts   |  76 +++---
 .../signalExecutionService.test.ts            |  24 +-
 .../detectRulePassRateAnomaliesJob.test.ts    |  10 +-
 .../getRuleAnomalyDetectionStatistics.test.ts |  12 +-
 .../ruleHistoryService.test.ts                |   2 +-
 .../signalAuthService/signalAuthService.ts    |  16 +-
 .../services/signalsService/SignalsService.ts |  26 +--
 .../helpers/instantiateBuiltInSignals.ts      |   1 -
 .../aggregation/AggregationSignal.test.ts     |  18 +-
 .../GoogleContentSafetyImageSignal.ts         |   2 +-
 .../content_safety/googleContentSafetyLib.ts  |   9 +-
 .../moderation/openAIModerationUtils.ts       |   1 -
 .../OpenAiWhisperTranscriptionSignal.ts       |   1 -
 .../zentropi/zentropiUtils.ts                 |   8 +-
 .../computeUserScore.test.ts                  |   1 -
 .../userStatisticsService/computeUserScore.ts |   2 -
 .../fetchUserActionStatistics.test.ts         |   7 +-
 .../fetchUserSubmissionStatistics.test.ts     |   7 +-
 .../userStrikeService.test.ts                 |   3 +-
 .../dataWarehouse/ClickhouseAdapter.ts        |  32 ++-
 .../dataWarehouse/DataWarehouseFactory.ts     |  72 +++---
 server/test/extendExpect.ts                   |   2 +-
 server/test/mockHelpers/jestMocks.ts          |   2 +-
 server/test/setupMockedServer.ts              |  29 ++-
 .../getRuleAnomalyDetectionStatistics.ts      |   1 -
 server/test/utils.ts                          |   8 +-
 server/utils/encoding.ts                      |   1 -
 server/utils/iterables.test.ts                |  13 +-
 server/utils/language.ts                      |   1 -
 server/utils/misc.ts                          |   1 -
 server/utils/url.test.ts                      |   3 -
 .../RetryFailedNcmecDecisionsJob.ts           | 111 ++++-----
 81 files changed, 923 insertions(+), 761 deletions(-)

diff --git a/client/src/components/ErrorBoundary.tsx b/client/src/components/ErrorBoundary.tsx
index 04828db..042935b 100644
--- a/client/src/components/ErrorBoundary.tsx
+++ b/client/src/components/ErrorBoundary.tsx
@@ -13,7 +13,7 @@ const withNavigate =
   };
 
 // This is used twice so it has to be extracted into an interface
-// eslint-disable-next-line no-restricted-syntax
+
 interface ErrorBoundaryProps {
   children: React.ReactNode;
   buttonTitle?: string;
diff --git a/client/src/utils/itemUtils.ts b/client/src/utils/itemUtils.ts
index 3c28205..de0bf6d 100644
--- a/client/src/utils/itemUtils.ts
+++ b/client/src/utils/itemUtils.ts
@@ -82,7 +82,7 @@ export function getFieldValueForRole<
   if (Array.isArray(fieldValue)) {
     throw new Error('Unexpected array when getting field value');
   }
-  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+
   return fieldValue.value satisfies ScalarTypeRuntimeType<ScalarType> as ScalarTypeRuntimeType<
     FieldRoleToScalarType[Role & keyof FieldRoleToScalarType]
   >;
diff --git a/client/src/utils/tree.test.ts b/client/src/utils/tree.test.ts
index 06ecfc1..127be22 100644
--- a/client/src/utils/tree.test.ts
+++ b/client/src/utils/tree.test.ts
@@ -43,7 +43,7 @@ describe('Tree tests', () => {
     const filteredTree = tree.filterTree((node) => node.includes(filterString));
 
     expect(filteredTree).not.toBeNull();
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+
     const filteredTreeValues = convertTreeToList(filteredTree!);
     expect(
       filteredTreeValues
diff --git a/client/src/utils/tree.ts b/client/src/utils/tree.ts
index b0e0b44..5e573ce 100644
--- a/client/src/utils/tree.ts
+++ b/client/src/utils/tree.ts
@@ -89,7 +89,7 @@ export class Tree<T extends any> {
 
   size() {
     let size = 0;
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+
     for (const _ of this.preOrderTraversal()) {
       size++;
     }
diff --git a/client/src/webpages/App.tsx b/client/src/webpages/App.tsx
index cc1d547..9b87bbe 100644
--- a/client/src/webpages/App.tsx
+++ b/client/src/webpages/App.tsx
@@ -1,4 +1,3 @@
-/* eslint-disable react/jsx-key */
 import React, { Suspense } from 'react';
 import {
   createBrowserRouter,
@@ -15,11 +14,16 @@ import { useGQLUserAndOrgQuery } from '../graphql/generated';
 import { RequireAuth, RequireLoggedOut } from '../routing/auth';
 import AwaitingApproval from './auth/AwaitingApproval';
 import RejectedByAdmin from './auth/RejectedByAdmin';
+
 import './dashboard/Dashboard.css';
 
 const Login = React.lazy(async () => import('./auth/Login'));
-const ForgotPassword = React.lazy(async () => import('./auth/forgot_password/ForgotPassword'));
-const ResetPassword = React.lazy(async () => import('./auth/forgot_password/ResetPassword'));
+const ForgotPassword = React.lazy(
+  async () => import('./auth/forgot_password/ForgotPassword'),
+);
+const ResetPassword = React.lazy(
+  async () => import('./auth/forgot_password/ResetPassword'),
+);
 const SignUp = React.lazy(async () => import('./auth/SignUp'));
 const LoginSSO = React.lazy(async () => import('./auth/LoginSSO'));
 /**
@@ -37,16 +41,16 @@ const LoginSSO = React.lazy(async () => import('./auth/LoginSSO'));
 
 function RootRedirect() {
   const { loading, data } = useGQLUserAndOrgQuery();
-  
+
   if (loading) {
     return <FullScreenLoading />;
   }
-  
+
   // If user is logged in, redirect to dashboard, otherwise to login
   if (data?.me) {
     return <Navigate to="/dashboard" replace />;
   }
-  
+
   return <Navigate to="/login" replace />;
 }
 
diff --git a/client/src/webpages/dashboard/item_types/ItemTypeRequestCodeSamples.tsx b/client/src/webpages/dashboard/item_types/ItemTypeRequestCodeSamples.tsx
index d0f2c66..e41e415 100644
--- a/client/src/webpages/dashboard/item_types/ItemTypeRequestCodeSamples.tsx
+++ b/client/src/webpages/dashboard/item_types/ItemTypeRequestCodeSamples.tsx
@@ -99,7 +99,7 @@ export default function ItemTypeRequestCodeSamples(props: {
           }}
           style={{
             ...atelierSulphurpoolLight,
-            // eslint-disable-next-line id-denylist
+
             'hljs-string': {
               color: '#75787B',
             },
diff --git a/client/src/webpages/dashboard/mrt/queue_routing/condition/matching_values/ManualReviewQueueRuleConditionMediaMatchingValues.tsx b/client/src/webpages/dashboard/mrt/queue_routing/condition/matching_values/ManualReviewQueueRuleConditionMediaMatchingValues.tsx
index 8d290ac..a0f7783 100644
--- a/client/src/webpages/dashboard/mrt/queue_routing/condition/matching_values/ManualReviewQueueRuleConditionMediaMatchingValues.tsx
+++ b/client/src/webpages/dashboard/mrt/queue_routing/condition/matching_values/ManualReviewQueueRuleConditionMediaMatchingValues.tsx
@@ -1,8 +1,8 @@
-/* eslint-disable no-console */
 import { Select } from 'antd';
 
 import ComponentLoading from '../../../../../../components/common/ComponentLoading';
 import { selectFilterByLabelOption } from '@/webpages/dashboard/components/antDesignUtils';
+
 import { useGQLHashBanksQuery } from '../../../../../../graphql/generated';
 import { RuleFormLeafCondition } from '../../../../rules/types';
 import { ManualReviewQueueRoutingStaticTokenField } from '../../ManualReviewQueueRoutingStaticField';
@@ -15,7 +15,12 @@ export default function ManualReviewQueueRuleConditionMediaMatchingValues(props:
   onUpdateSelectedBankIds(imageBankIds: readonly string[]): void;
   allConditions?: RuleFormLeafCondition[];
 }) {
-  const { condition, editing, onUpdateSelectedBankIds, allConditions = [] } = props;
+  const {
+    condition,
+    editing,
+    onUpdateSelectedBankIds,
+    allConditions = [],
+  } = props;
 
   const { loading, error, data } = useGQLHashBanksQuery();
   const hashBanks = data?.hashBanks ?? [];
@@ -24,7 +29,7 @@ export default function ManualReviewQueueRuleConditionMediaMatchingValues(props:
   const selectedBankIds = new Set(
     allConditions
       .filter((c) => c !== condition) // Exclude current condition by reference
-      .flatMap((c) => c.matchingValues?.imageBankIds ?? [])
+      .flatMap((c) => c.matchingValues?.imageBankIds ?? []),
   );
 
   if (loading) {
@@ -48,9 +53,9 @@ export default function ManualReviewQueueRuleConditionMediaMatchingValues(props:
           dropdownMatchSelectWidth={false}
         >
           {hashBanks.map((bank) => (
-            <Option 
-              key={bank.id} 
-              value={bank.id} 
+            <Option
+              key={bank.id}
+              value={bank.id}
               label={bank.name}
               disabled={selectedBankIds.has(bank.id)}
             >
@@ -60,9 +65,11 @@ export default function ManualReviewQueueRuleConditionMediaMatchingValues(props:
         </Select>
       ) : (
         <ManualReviewQueueRoutingStaticTokenField
-          tokens={condition.matchingValues?.imageBankIds?.map(id => 
-            hashBanks.find(bank => bank.id === id)?.name ?? id
-          ) ?? []}
+          tokens={
+            condition.matchingValues?.imageBankIds?.map(
+              (id) => hashBanks.find((bank) => bank.id === id)?.name ?? id,
+            ) ?? []
+          }
         />
       )}
     </div>
diff --git a/client/src/webpages/dashboard/rules/info/insights/ReportingRuleInsightsActionsChart.tsx b/client/src/webpages/dashboard/rules/info/insights/ReportingRuleInsightsActionsChart.tsx
index e683413..c62fc91 100644
--- a/client/src/webpages/dashboard/rules/info/insights/ReportingRuleInsightsActionsChart.tsx
+++ b/client/src/webpages/dashboard/rules/info/insights/ReportingRuleInsightsActionsChart.tsx
@@ -2,11 +2,11 @@ import { DateRangePicker } from '@/coop-ui/DateRangePicker';
 import { InvestmentFilled } from '@/icons';
 import { BarChartOutlined, LineChartOutlined } from '@ant-design/icons';
 import { gql } from '@apollo/client';
+import { format } from 'date-fns';
 import last from 'lodash/last';
 import orderBy from 'lodash/orderBy';
 import sortBy from 'lodash/sortBy';
 import sumBy from 'lodash/sumBy';
-import { format } from 'date-fns';
 import { ReactNode, useCallback, useMemo, useState } from 'react';
 import {
   Area,
@@ -109,7 +109,7 @@ export default function ReportingRuleInsightsActionsChart(props: {
       .sort((a, b) => new Date(a.date).getTime() - new Date(b.date).getTime())
       .map((actionData) => {
         // change actionData.date format from YYYY-MM-DD to MM/DD
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+
         const [year, month, date] = actionData.date.split('-');
 
         return {
diff --git a/client/src/webpages/dashboard/rules/rule_form/condition/matching_values/RuleFormConditionMatchingValues.tsx b/client/src/webpages/dashboard/rules/rule_form/condition/matching_values/RuleFormConditionMatchingValues.tsx
index 5ff5469..84ebf28 100644
--- a/client/src/webpages/dashboard/rules/rule_form/condition/matching_values/RuleFormConditionMatchingValues.tsx
+++ b/client/src/webpages/dashboard/rules/rule_form/condition/matching_values/RuleFormConditionMatchingValues.tsx
@@ -1,4 +1,3 @@
-/* eslint-disable no-console */
 import { GQLScalarType } from '../../../../../../graphql/generated';
 import { ConditionLocation, RuleFormLeafCondition } from '../../../types';
 import RuleFormConditionLocationMatchingValues from './RuleFormConditionLocationMatchingValues';
@@ -14,7 +13,13 @@ export default function RuleFormConditionMatchingValues(props: {
   ) => void;
   allConditions?: RuleFormLeafCondition[];
 }) {
-  const { condition, location, inputScalarType, onUpdateMatchingValues, allConditions = [] } = props;
+  const {
+    condition,
+    location,
+    inputScalarType,
+    onUpdateMatchingValues,
+    allConditions = [],
+  } = props;
 
   if (
     !condition.input ||
diff --git a/client/src/webpages/dashboard/rules/rule_form/signal_modal/RuleFormSignalModalSubcategoryGallery.tsx b/client/src/webpages/dashboard/rules/rule_form/signal_modal/RuleFormSignalModalSubcategoryGallery.tsx
index 9f095b4..ee209ea 100644
--- a/client/src/webpages/dashboard/rules/rule_form/signal_modal/RuleFormSignalModalSubcategoryGallery.tsx
+++ b/client/src/webpages/dashboard/rules/rule_form/signal_modal/RuleFormSignalModalSubcategoryGallery.tsx
@@ -47,20 +47,21 @@ export function RuleFormSignalModalSubcategoryGallery(props: {
   // So we need to allow a search term like "snake case" match against the subcategory
   // "snake_case". To do this, we add a snake case search term.
   const snakeCaseSearchTerm = searchTerm.replaceAll('_', ' ');
-  const eligibleSubcategories =
-    rebuildSubcategoryTreeFromGraphQLResponse(stripped)
-      // First filter out subcategories that don't include the search term.
-      // eslint-disable-next-line array-callback-return
-      .filter(
-        (subcategory) =>
-          subcategory.id.includes(searchTerm) ||
-          subcategory.id.includes(snakeCaseSearchTerm) ||
-          subcategory.label.includes(searchTerm) ||
-          subcategory.label.includes(snakeCaseSearchTerm) ||
-          (subcategory.description &&
-            (subcategory.description.includes(searchTerm) ||
-              subcategory.description.includes(snakeCaseSearchTerm))),
-      );
+  const eligibleSubcategories = rebuildSubcategoryTreeFromGraphQLResponse(
+    stripped,
+  )
+    // First filter out subcategories that don't include the search term.
+
+    .filter(
+      (subcategory) =>
+        subcategory.id.includes(searchTerm) ||
+        subcategory.id.includes(snakeCaseSearchTerm) ||
+        subcategory.label.includes(searchTerm) ||
+        subcategory.label.includes(snakeCaseSearchTerm) ||
+        (subcategory.description &&
+          (subcategory.description.includes(searchTerm) ||
+            subcategory.description.includes(snakeCaseSearchTerm))),
+    );
 
   return (
     <div className="flex flex-col">
diff --git a/server/.eslintrc.cjs b/server/.eslintrc.cjs
index 3a5b359..6a6c3c3 100644
--- a/server/.eslintrc.cjs
+++ b/server/.eslintrc.cjs
@@ -395,7 +395,7 @@ module.exports = {
     '@typescript-eslint',
     'jsdoc',
     'import',
-    'better-mutation',
+    'functional',
     'switch-statement',
   ],
   rules: {
@@ -659,7 +659,22 @@ module.exports = {
     {
       files: ['test/**/*.ts', './**/*.{spec,test}.ts'],
       rules: {
-        'better-mutation/no-mutation': ['error', { allowThis: true }],
+        // Match prior test-only mutation policy: allow `this`, class internals,
+        // and `process.env.*`; production code is not in this override.
+        'functional/immutable-data': [
+          'error',
+          {
+            ignoreImmediateMutation: true,
+            ignoreClasses: true,
+            ignoreAccessorPattern: [
+              'this',
+              'this.*',
+              'this.*.*',
+              // Tests toggle env vars and clean up with `delete process.env.*`.
+              'process.env.*',
+            ],
+          },
+        ],
         'no-console': 'off',
       },
     },
diff --git a/server/api.ts b/server/api.ts
index fe52d80..3988c7c 100644
--- a/server/api.ts
+++ b/server/api.ts
@@ -7,6 +7,7 @@ import { ApolloServerPluginLandingPageDisabled } from '@apollo/server/plugin/dis
 import { expressMiddleware } from '@as-integrations/express4';
 import { makeExecutableSchema } from '@graphql-tools/schema';
 import { MapperKind, mapSchema } from '@graphql-tools/utils';
+import { MultiSamlStrategy } from '@node-saml/passport-saml';
 import { SpanStatusCode } from '@opentelemetry/api';
 import {
   SEMATTRS_EXCEPTION_MESSAGE,
@@ -18,11 +19,10 @@ import connectPgSimple from 'connect-pg-simple';
 import cors from 'cors';
 import express, { type ErrorRequestHandler } from 'express';
 import session from 'express-session';
-import { buildContext, GraphQLLocalStrategy } from 'graphql-passport';
 import depthLimit from 'graphql-depth-limit';
+import { buildContext, GraphQLLocalStrategy } from 'graphql-passport';
 import helmet from 'helmet';
 import passport from 'passport';
-import { MultiSamlStrategy } from '@node-saml/passport-saml';
 
 import {
   makeLoginIncorrectPasswordError,
diff --git a/server/condition_evaluator/conditionSet.ts b/server/condition_evaluator/conditionSet.ts
index 68a0e53..79b9c52 100644
--- a/server/condition_evaluator/conditionSet.ts
+++ b/server/condition_evaluator/conditionSet.ts
@@ -121,20 +121,18 @@ export async function getConditionSetResults(
         ? await getConditionSetResults(condition, evaluationContext, tracer)
         : {
             ...condition,
-            result: await runLeafCondition(
-              condition,
-              evaluationContext,
-              // eslint-disable-next-line no-loop-func
-            ).catch((e) => {
-              // If evaluating a condition fails, we're eventually going to want
-              // to retry before we give up but, for now, we just mark the result
-              // as failed and move on.
-              const activeSpan = tracer.getActiveSpan();
-              if (activeSpan?.isRecording()) {
-                activeSpan.recordException(e);
-              }
-              return { outcome: ConditionFailureOutcome.ERRORED };
-            }),
+            result: await runLeafCondition(condition, evaluationContext).catch(
+              (e) => {
+                // If evaluating a condition fails, we're eventually going to want
+                // to retry before we give up but, for now, we just mark the result
+                // as failed and move on.
+                const activeSpan = tracer.getActiveSpan();
+                if (activeSpan?.isRecording()) {
+                  activeSpan.recordException(e);
+                }
+                return { outcome: ConditionFailureOutcome.ERRORED };
+              },
+            ),
           };
 
     result.conditions.push(conditionWithResult as any);
@@ -266,8 +264,7 @@ export function getAllAggregationsInConditionSet(
       return getAllAggregationsInConditionSet(condition);
     }
     const sig = condition.signal;
-    const args =
-      sig?.type === 'AGGREGATION' ? sig.args : undefined;
+    const args = sig?.type === 'AGGREGATION' ? sig.args : undefined;
     return args != null ? [args.aggregationClause] : [];
   });
 }
diff --git a/server/eslint.config.mjs b/server/eslint.config.mjs
index e8500ff..78ff9ac 100644
--- a/server/eslint.config.mjs
+++ b/server/eslint.config.mjs
@@ -1,6 +1,7 @@
 import { createRequire } from 'node:module';
 import { FlatCompat } from '@eslint/eslintrc';
-import { fixupConfigRules } from '@eslint/compat';
+import { fixupConfigRules, fixupPluginRules } from '@eslint/compat';
+import functional from 'eslint-plugin-functional';
 
 const require = createRequire(import.meta.url);
 const { ignorePatterns: _, ...legacyConfig } = require('./.eslintrc.cjs');
@@ -9,7 +10,16 @@ const compat = new FlatCompat({
   baseDirectory: import.meta.dirname,
 });
 
-const flatConfigs = fixupConfigRules(compat.config(legacyConfig));
+const functionalPlugin = fixupPluginRules(functional);
+
+const flatConfigs = fixupConfigRules(compat.config(legacyConfig)).map((config) =>
+  config.plugins?.functional
+    ? {
+        ...config,
+        plugins: { ...config.plugins, functional: functionalPlugin },
+      }
+    : config,
+);
 
 export default [
   {
diff --git a/server/graphql/datasources/RuleApi.ts b/server/graphql/datasources/RuleApi.ts
index 46f9b84..0cbe6b0 100644
--- a/server/graphql/datasources/RuleApi.ts
+++ b/server/graphql/datasources/RuleApi.ts
@@ -15,13 +15,14 @@ import {
 import { type User } from '../../models/UserModel.js';
 import { type ActionCountsInput } from '../../services/actionStatisticsService/index.js';
 import { type AggregationClause } from '../../services/aggregationsService/index.js';
+import { type ConditionSetWithResultAsLogged } from '../../services/analyticsLoggers/index.js';
 import {
   RuleType,
   type Condition,
   type ConditionInput,
   type ConditionSet,
-  type LeafCondition,
   type CoopInput,
+  type LeafCondition,
   type RuleStatus,
 } from '../../services/moderationConfigService/index.js';
 import {
@@ -37,7 +38,6 @@ import {
   signalIsExternal,
   type SignalId,
 } from '../../services/signalsService/index.js';
-import { type ConditionSetWithResultAsLogged } from '../../services/analyticsLoggers/index.js';
 import { type DataWarehousePublicSchema } from '../../storage/dataWarehouse/warehouseSchema.js';
 import { toCorrelationId } from '../../utils/correlationIds.js';
 import {
@@ -172,7 +172,6 @@ function transformLeafConditionForDB(
               subcategory,
             };
 
-            // eslint-disable-next-line switch-statement/require-appropriate-default-case
             switch (type) {
               case 'AGGREGATION':
                 const aggregationClauseInput =
@@ -493,12 +492,12 @@ class RuleAPI {
 
     // Validate that signals used in automated rules are allowed
     // Check if the rule will have actions meaning automated rule.
-    // This ensures we don't allow creating automated rules with signals 
+    // This ensures we don't allow creating automated rules with signals
     // that are restricted to routing rules only.
-    const willHaveActions = actionIds 
-      ? actionIds.length > 0 
+    const willHaveActions = actionIds
+      ? actionIds.length > 0
       : (await rule.getActions()).length > 0;
-    
+
     if (willHaveActions && conditionSet) {
       await this.validateSignalsAllowedInAutomatedRules(conditionSet, orgId);
     }
@@ -579,8 +578,9 @@ class RuleAPI {
       this.ruleInsights.getContentSubmissionCountsByDay(orgId),
     ]);
 
-    const valueOrEmpty = <T,>(r: PromiseSettledResult<readonly T[]>): readonly T[] =>
-      r.status === 'fulfilled' ? r.value : [];
+    const valueOrEmpty = <T>(
+      r: PromiseSettledResult<readonly T[]>,
+    ): readonly T[] => (r.status === 'fulfilled' ? r.value : []);
 
     return {
       actionedSubmissionsByDay: valueOrEmpty(results[0]),
@@ -588,7 +588,9 @@ class RuleAPI {
       actionedSubmissionsByTagByDay: valueOrEmpty(results[2]),
       actionedSubmissionsByActionByDay: valueOrEmpty(results[3]),
       totalSubmissionsByDay: valueOrEmpty(
-        results[4] as PromiseSettledResult<readonly { date: string; count: number }[]>,
+        results[4] as PromiseSettledResult<
+          readonly { date: string; count: number }[]
+        >,
       ),
     };
   }
@@ -848,17 +850,17 @@ class RuleAPI {
     orgId: string,
   ): Promise<void> {
     const signalIds = this.extractSignalIdsFromConditionSet(conditionSet);
-    
+
     for (const signalId of signalIds) {
       const signal = await this.signalsService.getSignal({
         signalId,
         orgId,
       });
-      
+
       if (signal && !signal.allowedInAutomatedRules) {
         throw new Error(
           `Signal "${signal.displayName}" cannot be used in automated rules with actions. ` +
-          `This signal is restricted to routing rules only.`
+            `This signal is restricted to routing rules only.`,
         );
       }
     }
@@ -950,4 +952,3 @@ type ValidatedGQLLeafConditionInput = Omit<
   'conditions' | 'conjunction'
 > &
   RequiredWithoutNull<Pick<GQLConditionInput, 'input'>>;
-
diff --git a/server/graphql/datasources/UserApi.ts b/server/graphql/datasources/UserApi.ts
index 4b780b6..cd7ddfc 100644
--- a/server/graphql/datasources/UserApi.ts
+++ b/server/graphql/datasources/UserApi.ts
@@ -1,5 +1,3 @@
-/* eslint-disable max-classes-per-file */
-
 import { type Exception } from '@opentelemetry/api';
 import { type PassportContext } from 'graphql-passport';
 import { uid } from 'uid';
@@ -175,10 +173,11 @@ class UserAPI {
       });
     }
 
-    const isCurrentPasswordValid = await this.sequelize.User.passwordMatchesHash(
-      currentPassword,
-      user.password,
-    );
+    const isCurrentPasswordValid =
+      await this.sequelize.User.passwordMatchesHash(
+        currentPassword,
+        user.password,
+      );
 
     if (!isCurrentPasswordValid) {
       throw makeChangePasswordIncorrectPasswordError({
@@ -216,7 +215,7 @@ class UserAPI {
     const user = await this.sequelize.User.findByPk(id, {
       rejectOnEmpty: true,
     });
-    
+
     // Security check: ensure admin can only approve users in their own org
     if (user.orgId !== invokerOrgId) {
       throw makeUnauthorizedError(
@@ -224,7 +223,7 @@ class UserAPI {
         { shouldErrorSpan: true },
       );
     }
-    
+
     user.approvedByAdmin = true;
     await user.save();
     return true;
@@ -234,7 +233,7 @@ class UserAPI {
     const user = await this.sequelize.User.findByPk(id, {
       rejectOnEmpty: true,
     });
-    
+
     // Security check: ensure admin can only reject users in their own org
     if (user.orgId !== invokerOrgId) {
       throw makeUnauthorizedError(
@@ -242,7 +241,7 @@ class UserAPI {
         { shouldErrorSpan: true },
       );
     }
-    
+
     user.rejectedByAdmin = true;
     await user.save();
     return true;
diff --git a/server/graphql/modules/actionStatistics.ts b/server/graphql/modules/actionStatistics.ts
index 38c512b..0744237 100644
--- a/server/graphql/modules/actionStatistics.ts
+++ b/server/graphql/modules/actionStatistics.ts
@@ -114,7 +114,10 @@ const Query: GQLQueryResolvers = {
       });
     } catch (e) {
       // eslint-disable-next-line no-console
-      console.error('actionStatistics: warehouse query failed:', (e as Error).message);
+      console.error(
+        'actionStatistics: warehouse query failed:',
+        (e as Error).message,
+      );
       return [];
     }
   },
@@ -141,7 +144,10 @@ const Query: GQLQueryResolvers = {
       }));
     } catch (e) {
       // eslint-disable-next-line no-console
-      console.error('topPolicyViolations: warehouse query failed:', (e as Error).message);
+      console.error(
+        'topPolicyViolations: warehouse query failed:',
+        (e as Error).message,
+      );
       return [];
     }
   },
diff --git a/server/graphql/modules/insights.ts b/server/graphql/modules/insights.ts
index 54e54fd..89739f1 100644
--- a/server/graphql/modules/insights.ts
+++ b/server/graphql/modules/insights.ts
@@ -351,7 +351,7 @@ const Query: GQLQueryResolvers = {
         // here, meaning that graphql queries would throw an exception if asking for
         // those fields. To provide them, we'll have to update (and add better
         // typings for) getRulePassingContentSamples.
-        // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+
         {
           ...result,
           itemId: result.contentId,
diff --git a/server/graphql/modules/signal.test.ts b/server/graphql/modules/signal.test.ts
index 9d57362..5f03dbc 100644
--- a/server/graphql/modules/signal.test.ts
+++ b/server/graphql/modules/signal.test.ts
@@ -9,7 +9,6 @@ describe('flattenSubcategories', () => {
         id: 'Hate Groups',
         label: 'Hate Groups',
         children: [
-          // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
           {
             id: 'yes_nazi' as const,
             label: 'Nazi Content',
diff --git a/server/iocContainer/index.ts b/server/iocContainer/index.ts
index e8aa4ab..dacaf8a 100644
--- a/server/iocContainer/index.ts
+++ b/server/iocContainer/index.ts
@@ -20,14 +20,25 @@ import { type JsonObject, type ReadonlyDeep } from 'type-fest';
 import { v1 as uuidv1 } from 'uuid';
 
 import makeDb from '../models/index.js';
+import { type PolicyActionPenalties } from '../models/OrgModel.js';
+import type { IActionExecutionsAdapter } from '../plugins/warehouse/queries/IActionExecutionsAdapter.js';
+import type { IActionStatisticsAdapter } from '../plugins/warehouse/queries/IActionStatisticsAdapter.js';
+import type { IContentApiRequestsAdapter } from '../plugins/warehouse/queries/IContentApiRequestsAdapter.js';
+import {
+  ClickhouseActionExecutionsAdapter,
+  ClickhouseActionStatisticsAdapter,
+  ClickhouseContentApiRequestsAdapter,
+  ClickhouseOrgCreationAdapter,
+  ClickhouseReportingAnalyticsAdapter,
+} from '../plugins/warehouse/queries/index.js';
+import type { IOrgCreationAdapter } from '../plugins/warehouse/queries/IOrgCreationAdapter.js';
+import type { IReportingAnalyticsAdapter } from '../plugins/warehouse/queries/IReportingAnalyticsAdapter.js';
 import {
+  ITEM_SUBMISSION_DLQ_NAME,
+  ITEM_SUBMISSION_QUEUE_NAME,
   makeItemSubmissionBulkWrite,
   type ItemSubmissionBulkWrite,
-  ITEM_SUBMISSION_QUEUE_NAME,
-  ITEM_SUBMISSION_DLQ_NAME,
 } from '../queues/itemSubmissionQueue.js';
-import { type PolicyActionPenalties } from '../models/OrgModel.js';
-import { type HashBank, HashBankService } from '../services/hmaService/index.js';
 import makeActionPublisher, {
   type ActionPublisher,
   type ActionTargetItem,
@@ -65,16 +76,43 @@ import {
   type AggregationsService,
   type StringNumberKeyValueStore,
 } from '../services/aggregationsService/index.js';
+import {
+  makeActionExecutionLogger,
+  makeContentApiLogger,
+  makeItemModelScoreLogger,
+  makeOrgCreationLogger,
+  makeReportingRuleExecutionLogger,
+  makeRoutingRuleExecutionLogger,
+  makeRuleExecutionLogger,
+  type ActionExecutionLogger,
+  type ContentApiLogger,
+  type ItemModelScoreLogger,
+  type OrgCreationLogger,
+  type ReportingRuleExecutionLogger,
+  type RoutingRuleExecutionLogger,
+  type RuleExecutionLogger,
+} from '../services/analyticsLoggers/index.js';
+import {
+  makeItemHistoryQueries,
+  makeRuleActionInsights,
+  makeUserHistoryQueries,
+  type ItemHistoryQueries,
+  type RuleActionInsights,
+  type UserHistoryQueries,
+} from '../services/analyticsQueries/index.js';
 import {
   makeApiKeyService,
   type ApiKeyService,
 } from '../services/apiKeyService/index.js';
-import makeHmaService from '../services/hmaService/index.js';
 import { type CombinedPg } from '../services/combinedDbTypes.js';
 import {
   makeDerivedFieldsService,
   type DerivedFieldsService,
 } from '../services/derivedFieldsService/index.js';
+import makeHmaService, {
+  HashBankService,
+  type HashBank,
+} from '../services/hmaService/index.js';
 import { ItemInvestigationService } from '../services/itemInvestigationService/index.js';
 import {
   getFieldValueForRole,
@@ -158,7 +196,6 @@ import makeSendEmail, {
 } from '../services/sendEmailService/index.js';
 import {
   makeSignalAuthService,
-
   type SignalAuthService,
 } from '../services/signalAuthService/index.js';
 import {
@@ -184,54 +221,18 @@ import {
   type UserScore,
 } from '../services/userStatisticsService/index.js';
 import { UserStrikeService } from '../services/userStrikeService/index.js';
-import {
-  makeActionExecutionLogger,
-  makeContentApiLogger,
-  makeItemModelScoreLogger,
-  makeOrgCreationLogger,
-  makeReportingRuleExecutionLogger,
-  makeRoutingRuleExecutionLogger,
-  makeRuleExecutionLogger,
-  type ActionExecutionLogger,
-  type ContentApiLogger,
-  type ItemModelScoreLogger,
-  type OrgCreationLogger,
-  type ReportingRuleExecutionLogger,
-  type RoutingRuleExecutionLogger,
-  type RuleExecutionLogger,
-} from '../services/analyticsLoggers/index.js';
-import {
-  makeItemHistoryQueries,
-  makeRuleActionInsights,
-  makeUserHistoryQueries,
-  type ItemHistoryQueries,
-  type RuleActionInsights,
-  type UserHistoryQueries,
-} from '../services/analyticsQueries/index.js';
+import type { IDataWarehouseAnalytics } from '../storage/dataWarehouse/IDataWarehouseAnalytics.js';
 import {
   DataWarehouseFactory,
   type IDataWarehouse,
   type IDataWarehouseDialect,
 } from '../storage/dataWarehouse/index.js';
-import type { IDataWarehouseAnalytics } from '../storage/dataWarehouse/IDataWarehouseAnalytics.js';
-import {
-  ClickhouseActionStatisticsAdapter,
-  ClickhouseReportingAnalyticsAdapter,
-  ClickhouseActionExecutionsAdapter,
-  ClickhouseContentApiRequestsAdapter,
-  ClickhouseOrgCreationAdapter,
-} from '../plugins/warehouse/queries/index.js';
-import type { IActionStatisticsAdapter } from '../plugins/warehouse/queries/IActionStatisticsAdapter.js';
-import type { IReportingAnalyticsAdapter } from '../plugins/warehouse/queries/IReportingAnalyticsAdapter.js';
-import type { IActionExecutionsAdapter } from '../plugins/warehouse/queries/IActionExecutionsAdapter.js';
-import type { IContentApiRequestsAdapter } from '../plugins/warehouse/queries/IContentApiRequestsAdapter.js';
-import type { IOrgCreationAdapter } from '../plugins/warehouse/queries/IOrgCreationAdapter.js';
 import { cached, type Cached } from '../utils/caching.js';
+import { CoopMeter } from '../utils/CoopMeter.js';
 import {
   toCorrelationId,
   type CorrelationId,
 } from '../utils/correlationIds.js';
-import { CoopMeter } from '../utils/CoopMeter.js';
 import { getUsableCoreCount } from '../utils/cpu-helpers.js';
 import { jsonStringify, type JsonOf } from '../utils/encoding.js';
 import { __throw, assertUnreachable } from '../utils/misc.js';
@@ -532,7 +533,6 @@ export default async function getBottle() {
         }),
   );
 
-
   bottle.factory('Sequelize', () => makeDb());
   bottle.factory('OrgModel', ({ Sequelize }) => Sequelize.Org);
   bottle.factory('RuleModel', ({ Sequelize }) => Sequelize.Rule);
@@ -554,7 +554,7 @@ export default async function getBottle() {
   // Switch warehouse providers via WAREHOUSE_ADAPTER.
   //
   // - 'DataWarehouse' - Core queries and transactions
-  // - 'DataWarehouseDialect' - Type-safe Kysely queries  
+  // - 'DataWarehouseDialect' - Type-safe Kysely queries
   // - 'DataWarehouseAnalytics' - Bulk writes, CDC, logging
   bottle.factory('DataWarehouse', () => {
     const config = DataWarehouseFactory.createConfigFromEnv();
@@ -987,7 +987,7 @@ export default async function getBottle() {
                     // could provide that would have security implications when blindly fed
                     // in here -- like something that would somehow lead fetch to do something
                     // unexpected.
-                    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+
                     ...((appealHeaders as JsonObject | undefined) ?? undefined),
                     // Put this header last so customHeaders can't override it, which I
                     // think makes sense, since there's no way for users to effect the
@@ -1029,7 +1029,6 @@ export default async function getBottle() {
                     // API is in place
                     const additionalPayload = job.payload.reportedForReasons
                       ? {
-                          // eslint-disable-next-line no-restricted-syntax
                           reportHistory: job.payload.reportedForReasons.map(
                             (it) => ({
                               reason: it.reason,
@@ -1153,7 +1152,10 @@ export default async function getBottle() {
                     incidentType: decision.incidentType,
                     ...(decision.escalateToHighPriority != null &&
                     decision.escalateToHighPriority.trim() !== ''
-                      ? { escalateToHighPriority: decision.escalateToHighPriority.trim() }
+                      ? {
+                          escalateToHighPriority:
+                            decision.escalateToHighPriority.trim(),
+                        }
                       : {}),
                   },
                   isTest,
@@ -1354,30 +1356,26 @@ export default async function getBottle() {
     },
   );
 
-  bottle.factory(
-    'getImageBankEventuallyConsistent',
-    (container) => {
-      const kyselyPg = container.KyselyPg;
-      const hashBankService = new HashBankService(kyselyPg);
-
-      return cached({
-        async producer({ orgId, bankId }) {
-          // bankId could be either database ID or bank name
-          // Check if bankId is numeric (database ID)
-          const numericBankId = parseInt(bankId);
-          if (!isNaN(numericBankId)) {
-            // Get by database ID
-            return hashBankService.findById(numericBankId, orgId);
-          } else {
-            // Get by name
-            return hashBankService.findByName(bankId, orgId);
-          }
-        },
-        directives: { freshUntilAge: 300 }, // 5 minutes cache for image banks
-      });
-    },
-  );
+  bottle.factory('getImageBankEventuallyConsistent', (container) => {
+    const kyselyPg = container.KyselyPg;
+    const hashBankService = new HashBankService(kyselyPg);
 
+    return cached({
+      async producer({ orgId, bankId }) {
+        // bankId could be either database ID or bank name
+        // Check if bankId is numeric (database ID)
+        const numericBankId = parseInt(bankId);
+        if (!isNaN(numericBankId)) {
+          // Get by database ID
+          return hashBankService.findById(numericBankId, orgId);
+        } else {
+          // Get by name
+          return hashBankService.findByName(bankId, orgId);
+        }
+      },
+      directives: { freshUntilAge: 300 }, // 5 minutes cache for image banks
+    });
+  });
 
   bottle.factory('getUserStrikeTTLInDaysEventuallyConsistent', (container) => {
     return cached({
@@ -1622,11 +1620,17 @@ export default async function getBottle() {
                 async () => {
                   if ('close' in it && typeof it.close === 'function') {
                     await it.close();
-                  } else if ('destroy' in it && typeof it.destroy === 'function') {
+                  } else if (
+                    'destroy' in it &&
+                    typeof it.destroy === 'function'
+                  ) {
                     await it.destroy();
                   } else if ('quit' in it && typeof it.quit === 'function') {
                     await it.quit();
-                  } else if ('flushPendingWrites' in it && typeof it.flushPendingWrites === 'function') {
+                  } else if (
+                    'flushPendingWrites' in it &&
+                    typeof it.flushPendingWrites === 'function'
+                  ) {
                     await it.flushPendingWrites();
                   }
                 },
diff --git a/server/package-lock.json b/server/package-lock.json
index 75b8774..2b9f206 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -117,7 +117,7 @@
         "dotenv": "^10.0.0",
         "eslint": "^9.39.4",
         "eslint-import-resolver-typescript": "^3.6.0",
-        "eslint-plugin-better-mutation": "^1.4.0",
+        "eslint-plugin-functional": "^9.0.4",
         "eslint-plugin-import": "^2.28.1",
         "eslint-plugin-jsdoc": "^62.5.4",
         "eslint-plugin-node": "^11.1.0",
@@ -13332,18 +13332,6 @@
         "node": ">= 0.10"
       }
     },
-    "node_modules/create-eslint-index": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/create-eslint-index/-/create-eslint-index-1.0.0.tgz",
-      "integrity": "sha512-nXvJjnfDytOOaPOonX0h0a1ggMoqrhdekGeZkD6hkcWYvlCWhU719tKFVh8eU04CnMwu3uwe1JjwuUF2C3k2qg==",
-      "dev": true,
-      "dependencies": {
-        "lodash.get": "^4.3.0"
-      },
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
     "node_modules/create-jest": {
       "version": "29.7.0",
       "resolved": "https://registry.npmjs.org/create-jest/-/create-jest-29.7.0.tgz",
@@ -13557,6 +13545,16 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/deepmerge-ts": {
+      "version": "7.1.5",
+      "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
+      "integrity": "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/define-data-property": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
@@ -14071,19 +14069,6 @@
         }
       }
     },
-    "node_modules/eslint-ast-utils": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-ast-utils/-/eslint-ast-utils-1.1.0.tgz",
-      "integrity": "sha512-otzzTim2/1+lVrlH19EfQQJEhVJSu0zOb9ygb3iapN6UlyaDtyRq4b5U1FuW0v1lRa9Fp/GJyHkSwm6NqABgCA==",
-      "dev": true,
-      "dependencies": {
-        "lodash.get": "^4.4.2",
-        "lodash.zip": "^4.2.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/eslint-import-resolver-node": {
       "version": "0.3.9",
       "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.9.tgz",
@@ -14158,25 +14143,6 @@
         "ms": "^2.1.1"
       }
     },
-    "node_modules/eslint-plugin-better-mutation": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-better-mutation/-/eslint-plugin-better-mutation-1.4.0.tgz",
-      "integrity": "sha512-Oj0C/fHKFRHtg/7rtZLD3oHk3TjaedMwQqbXQnhf81QgqAZp/IHzL9U3r4vElPlZT7h/1aY7GRsNz5XFwD+MnA==",
-      "dev": true,
-      "dependencies": {
-        "create-eslint-index": "~1.0.0",
-        "debug": "~4.3.1",
-        "eslint-ast-utils": "~1.1.0",
-        "import-modules": "~2.0.0",
-        "lodash": "~4.17.20"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "eslint": ">=6"
-      }
-    },
     "node_modules/eslint-plugin-es": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/eslint-plugin-es/-/eslint-plugin-es-3.0.1.tgz",
@@ -14196,6 +14162,69 @@
         "eslint": ">=4.19.1"
       }
     },
+    "node_modules/eslint-plugin-functional": {
+      "version": "9.0.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-functional/-/eslint-plugin-functional-9.0.4.tgz",
+      "integrity": "sha512-zm4qaoqb2r50V4WXxt0Mj92buXGMECYvMxGQ6sSb+XeJ+Eec6zCHuMY2+AWK1mqiApvUz2tCtp1P3zcEPU0huw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "ko-fi",
+          "url": "https://ko-fi.com/rebeccastevens"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/eslint-plugin-functional"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/utils": "^8.26.0",
+        "deepmerge-ts": "^7.1.5",
+        "escape-string-regexp": "^5.0.0",
+        "is-immutable-type": "^5.0.1",
+        "ts-api-utils": "^2.0.1",
+        "ts-declaration-location": "^1.0.6"
+      },
+      "engines": {
+        "node": ">=v18.18.0"
+      },
+      "peerDependencies": {
+        "eslint": "^9.0.0 || ^10.0.0",
+        "typescript": ">=4.7.4"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-plugin-functional/node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint-plugin-functional/node_modules/ts-api-utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4"
+      }
+    },
     "node_modules/eslint-plugin-import": {
       "version": "2.32.0",
       "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.32.0.tgz",
@@ -16023,15 +16052,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/import-modules": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/import-modules/-/import-modules-2.0.0.tgz",
-      "integrity": "sha512-iczM/v9drffdNnABOKwj0f9G3cFDon99VcG1mxeBsdqnbd+vnQ5c2uAiCHNQITqFTOPaEvwg3VjoWCur0uHLEw==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
@@ -16337,6 +16357,35 @@
         "node": ">=8"
       }
     },
+    "node_modules/is-immutable-type": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/is-immutable-type/-/is-immutable-type-5.0.1.tgz",
+      "integrity": "sha512-LkHEOGVZZXxGl8vDs+10k3DvP++SEoYEAJLRk6buTFi6kD7QekThV7xHS0j6gpnUCQ0zpud/gMDGiV4dQneLTg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@typescript-eslint/type-utils": "^8.0.0",
+        "ts-api-utils": "^2.0.0",
+        "ts-declaration-location": "^1.0.4"
+      },
+      "peerDependencies": {
+        "eslint": "*",
+        "typescript": ">=4.7.4"
+      }
+    },
+    "node_modules/is-immutable-type/node_modules/ts-api-utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4"
+      }
+    },
     "node_modules/is-map": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/is-map/-/is-map-2.0.3.tgz",
@@ -17691,12 +17740,6 @@
       "resolved": "https://registry.npmjs.org/lodash.defaults/-/lodash.defaults-4.2.0.tgz",
       "integrity": "sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ=="
     },
-    "node_modules/lodash.get": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
-      "integrity": "sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==",
-      "dev": true
-    },
     "node_modules/lodash.includes": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
@@ -17747,12 +17790,6 @@
       "resolved": "https://registry.npmjs.org/lodash.sortby/-/lodash.sortby-4.7.0.tgz",
       "integrity": "sha512-HDWXG8isMntAyRF5vZ7xKuEvOhT4AhlRt/3czTSjvGUxjYCBVRQY48ViDHyfYz9VIoBkW4TMGQNapx+l3RUwdA=="
     },
-    "node_modules/lodash.zip": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/lodash.zip/-/lodash.zip-4.2.0.tgz",
-      "integrity": "sha512-C7IOaBBK/0gMORRBd8OETNx3kmOkgIWIPvyDpZSCTwUrpYmgZwJkjZeOD8ww4xbOUOs4/attY+pciKvadNfFbg==",
-      "dev": true
-    },
     "node_modules/loglevel": {
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/loglevel/-/loglevel-1.8.1.tgz",
@@ -20798,6 +20835,29 @@
         "typescript": ">=4.2.0"
       }
     },
+    "node_modules/ts-declaration-location": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/ts-declaration-location/-/ts-declaration-location-1.0.7.tgz",
+      "integrity": "sha512-EDyGAwH1gO0Ausm9gV6T2nUvBgXT5kGoCMJPllOaooZ+4VvJiKBdZE7wK18N1deEowhcUptS+5GXZK8U/fvpwA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "ko-fi",
+          "url": "https://ko-fi.com/rebeccastevens"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/ts-declaration-location"
+        }
+      ],
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "picomatch": "^4.0.2"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.0.0"
+      }
+    },
     "node_modules/ts-node": {
       "version": "10.9.1",
       "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.9.1.tgz",
diff --git a/server/package.json b/server/package.json
index 344f2fb..063a7b3 100644
--- a/server/package.json
+++ b/server/package.json
@@ -131,7 +131,7 @@
     "dotenv": "^10.0.0",
     "eslint": "^9.39.4",
     "eslint-import-resolver-typescript": "^3.6.0",
-    "eslint-plugin-better-mutation": "^1.4.0",
+    "eslint-plugin-functional": "^9.0.4",
     "eslint-plugin-import": "^2.28.1",
     "eslint-plugin-jsdoc": "^62.5.4",
     "eslint-plugin-node": "^11.1.0",
@@ -162,9 +162,6 @@
     "@types/restify": "npm:pino@8.6.0",
     "@googlemaps/google-maps-services-js@^3.3.16": {
       "retry-axios": "npm:@ethanresnick/retry-axios@2.6.1"
-    },
-    "eslint-plugin-better-mutation": {
-      "lodash": "^4.18.1"
     }
   }
 }
diff --git a/server/routes/content/ContentRoutes.test.ts b/server/routes/content/ContentRoutes.test.ts
index 521d079..2f4ee1d 100644
--- a/server/routes/content/ContentRoutes.test.ts
+++ b/server/routes/content/ContentRoutes.test.ts
@@ -26,7 +26,6 @@ describe('POST Content', () => {
     analytics: Dependencies['DataWarehouseAnalytics'];
 
   beforeAll(async () => {
-    // eslint-disable-next-line better-mutation/no-mutation
     ({
       request,
       shutdown,
@@ -39,9 +38,14 @@ describe('POST Content', () => {
     } = await makeMockedServer());
 
     const { User, Org } = models;
-    // eslint-disable-next-line better-mutation/no-mutation
-    ({ apiKey } = await createOrg({ Org }, ModerationConfigService, ApiKeyService, orgId));
-    // eslint-disable-next-line better-mutation/no-mutation
+
+    ({ apiKey } = await createOrg(
+      { Org },
+      ModerationConfigService,
+      ApiKeyService,
+      orgId,
+    ));
+
     contentType1 = await ModerationConfigService.createContentType(orgId, {
       name: 'test',
       description: faker.datatype.string(),
@@ -62,7 +66,6 @@ describe('POST Content', () => {
       schemaFieldRoles: {},
     });
 
-    // eslint-disable-next-line better-mutation/no-mutation
     contentType2 = await ModerationConfigService.createContentType(orgId, {
       name: 'tes333t',
       description: faker.datatype.string(),
diff --git a/server/routes/gdpr/gdprRoutes.test.ts b/server/routes/gdpr/gdprRoutes.test.ts
index dba2880..1847927 100644
--- a/server/routes/gdpr/gdprRoutes.test.ts
+++ b/server/routes/gdpr/gdprRoutes.test.ts
@@ -19,7 +19,6 @@ describe('POST /gdrp/delete', () => {
 
   beforeAll(async () => {
     try {
-      // eslint-disable-next-line better-mutation/no-mutation
       ({
         request,
         shutdown,
@@ -27,9 +26,14 @@ describe('POST /gdrp/delete', () => {
       } = await makeMockedServer());
 
       const { Org } = models;
-      // eslint-disable-next-line better-mutation/no-mutation
-      ({ apiKey } = await createOrg({ Org }, ModerationConfigService, ApiKeyService, orgId));
-      // eslint-disable-next-line better-mutation/no-mutation
+
+      ({ apiKey } = await createOrg(
+        { Org },
+        ModerationConfigService,
+        ApiKeyService,
+        orgId,
+      ));
+
       contentType = await ModerationConfigService.createContentType(orgId, {
         name: 'TestUser',
         description: 'user type',
diff --git a/server/routes/index.test.ts b/server/routes/index.test.ts
index 1f68ac3..9ca52cb 100644
--- a/server/routes/index.test.ts
+++ b/server/routes/index.test.ts
@@ -5,7 +5,6 @@ describe('404 Handling', () => {
     shutdown: Awaited<ReturnType<typeof makeMockedServer>>['shutdown'];
 
   beforeAll(async () => {
-    // eslint-disable-next-line better-mutation/no-mutation
     ({ request, shutdown } = await makeMockedServer());
   });
 
@@ -51,8 +50,18 @@ describe('Error handling', () => {
     // express adds automatically (to parse query params, create the request
     // object, and (iiuc) normalize trailing path slashes), but before all our
     // handlers.
-    const newlyAddedErrorRoute = server._router.stack.pop();
-    (server._router.stack as unknown[]).splice(3, 0, newlyAddedErrorRoute);
+    const stack = server._router.stack as unknown[];
+    const newlyAddedErrorRoute = stack.at(-1);
+    if (newlyAddedErrorRoute === undefined) {
+      throw new Error('expected route on stack');
+    }
+    const withoutLast = stack.slice(0, -1);
+    // eslint-disable-next-line functional/immutable-data -- express test-only router reordering
+    server._router.stack = [
+      ...withoutLast.slice(0, 3),
+      newlyAddedErrorRoute,
+      ...withoutLast.slice(3),
+    ] as typeof server._router.stack;
 
     try {
       const resp = await request.get('/api/v1/error');
diff --git a/server/routes/index.ts b/server/routes/index.ts
index 51748c8..4b8dd5f 100644
--- a/server/routes/index.ts
+++ b/server/routes/index.ts
@@ -19,7 +19,6 @@ export type Controller = {
   routes: ControllerRouteList;
 };
 
-// eslint-disable-next-line @typescript-eslint/consistent-type-assertions
 export default {
   Items: ItemRoutes,
   Content: ContentRoutes,
diff --git a/server/routes/integration_logos/serveIntegrationLogo.ts b/server/routes/integration_logos/serveIntegrationLogo.ts
index eb4680a..d9ee9fe 100644
--- a/server/routes/integration_logos/serveIntegrationLogo.ts
+++ b/server/routes/integration_logos/serveIntegrationLogo.ts
@@ -18,8 +18,9 @@ export default function serveIntegrationLogo(
         makeNotFoundError('Missing integration id.', { shouldErrorSpan: true }),
       );
     }
-    const filePath = getIntegrationRegistry().getPluginLogoFilePath(integrationId);
-    if (filePath === undefined) { // eslint-disable-line @typescript-eslint/no-unnecessary-condition -- runtime guard for missing plugin logo
+    const filePath =
+      getIntegrationRegistry().getPluginLogoFilePath(integrationId);
+    if (filePath === undefined) {
       return next(
         makeNotFoundError('Integration logo not found.', {
           shouldErrorSpan: true,
@@ -29,7 +30,8 @@ export default function serveIntegrationLogo(
     // Path was validated at plugin load (under package root); safe to send.
     res.setHeader('Cache-Control', 'public, max-age=86400');
     res.sendFile(filePath, (err) => {
-      if (err != null && !res.headersSent) { // eslint-disable-line @typescript-eslint/no-unnecessary-condition -- sendFile callback err is Error | null per types
+      if (err != null && !res.headersSent) {
+         
         next(err);
       }
     });
diff --git a/server/routes/integration_logos/serveIntegrationLogoWithBackground.ts b/server/routes/integration_logos/serveIntegrationLogoWithBackground.ts
index e4aecd5..bb3114e 100644
--- a/server/routes/integration_logos/serveIntegrationLogoWithBackground.ts
+++ b/server/routes/integration_logos/serveIntegrationLogoWithBackground.ts
@@ -17,8 +17,11 @@ export default function serveIntegrationLogoWithBackground(
         makeNotFoundError('Missing integration id.', { shouldErrorSpan: true }),
       );
     }
-    const filePath = getIntegrationRegistry().getPluginLogoWithBackgroundFilePath(integrationId);
-    if (filePath === undefined) { // eslint-disable-line @typescript-eslint/no-unnecessary-condition -- runtime guard for missing plugin logo
+    const filePath =
+      getIntegrationRegistry().getPluginLogoWithBackgroundFilePath(
+        integrationId,
+      );
+    if (filePath === undefined) {
       return next(
         makeNotFoundError('Integration logo (with-background) not found.', {
           shouldErrorSpan: true,
@@ -27,7 +30,8 @@ export default function serveIntegrationLogoWithBackground(
     }
     res.setHeader('Cache-Control', 'public, max-age=86400');
     res.sendFile(filePath, (err) => {
-      if (err != null && !res.headersSent) { // eslint-disable-line @typescript-eslint/no-unnecessary-condition -- sendFile callback err is Error | null per types
+      if (err != null && !res.headersSent) {
+         
         next(err);
       }
     });
diff --git a/server/routes/items/ItemRoutes.test.ts b/server/routes/items/ItemRoutes.test.ts
index 9299c33..d2d74a1 100644
--- a/server/routes/items/ItemRoutes.test.ts
+++ b/server/routes/items/ItemRoutes.test.ts
@@ -21,7 +21,6 @@ describe('POST Items', () => {
     analytics: Dependencies['DataWarehouseAnalytics'];
 
   beforeAll(async () => {
-    // eslint-disable-next-line better-mutation/no-mutation
     ({
       request,
       shutdown,
@@ -34,9 +33,14 @@ describe('POST Items', () => {
     } = await makeMockedServer());
 
     const { User, Org } = models;
-    // eslint-disable-next-line better-mutation/no-mutation
-    ({ apiKey } = await createOrg({ Org }, ModerationConfigService, ApiKeyService, orgId));
-    // eslint-disable-next-line better-mutation/no-mutation
+
+    ({ apiKey } = await createOrg(
+      { Org },
+      ModerationConfigService,
+      ApiKeyService,
+      orgId,
+    ));
+
     contentType = await ModerationConfigService.createContentType(orgId, {
       name: 'test',
       description: faker.datatype.string(),
diff --git a/server/routes/policies/PoliciesRoutes.test.ts b/server/routes/policies/PoliciesRoutes.test.ts
index b6c6aa6..37b2a52 100644
--- a/server/routes/policies/PoliciesRoutes.test.ts
+++ b/server/routes/policies/PoliciesRoutes.test.ts
@@ -18,7 +18,6 @@ describe('GET policies', () => {
     ApiKeyService: Dependencies['ApiKeyService'];
 
   beforeAll(async () => {
-    // eslint-disable-next-line better-mutation/no-mutation
     ({
       request,
       shutdown,
@@ -26,8 +25,13 @@ describe('GET policies', () => {
     } = await makeMockedServer());
 
     const { Org } = models;
-    // eslint-disable-next-line better-mutation/no-mutation
-    ({ apiKey } = await createOrg({ Org }, ModerationConfigService, ApiKeyService, orgId));
+
+    ({ apiKey } = await createOrg(
+      { Org },
+      ModerationConfigService,
+      ApiKeyService,
+      orgId,
+    ));
   });
 
   afterAll(async () => {
diff --git a/server/routes/reporting/ReportingRoutes.test.ts b/server/routes/reporting/ReportingRoutes.test.ts
index bc77c2f..b7978b5 100644
--- a/server/routes/reporting/ReportingRoutes.test.ts
+++ b/server/routes/reporting/ReportingRoutes.test.ts
@@ -25,13 +25,10 @@ describe('POST Report', () => {
     >;
 
   beforeAll(async () => {
-    // eslint-disable-next-line better-mutation/no-mutation
     ({ deps, request, shutdown } = await makeMockedServer());
 
-    // eslint-disable-next-line better-mutation/no-mutation
     models = deps.Sequelize;
 
-    // eslint-disable-next-line better-mutation/no-mutation
     ({ apiKey } = await createOrg(
       models,
       deps.ModerationConfigService,
@@ -103,11 +100,11 @@ describe('POST Report', () => {
         schemaFieldRoles: {},
       },
     );
-    // eslint-disable-next-line better-mutation/no-mutation
+
     contentTypeId = contentType.id;
-    // eslint-disable-next-line better-mutation/no-mutation
+
     userTypeId = userType.id;
-    // eslint-disable-next-line better-mutation/no-mutation
+
     threadTypeId = threadType.id;
 
     await models.User.create({
diff --git a/server/routes/reporting/submitAppeal.ts b/server/routes/reporting/submitAppeal.ts
index c1d6f58..3993bda 100644
--- a/server/routes/reporting/submitAppeal.ts
+++ b/server/routes/reporting/submitAppeal.ts
@@ -8,6 +8,7 @@ import {
   rawItemSubmissionToItemSubmission,
   type ItemSubmission,
 } from '../../services/itemProcessingService/index.js';
+import { hasOrgId } from '../../utils/apiKeyMiddleware.js';
 import {
   fromCorrelationId,
   toCorrelationId,
@@ -19,7 +20,6 @@ import {
 import { withRetries } from '../../utils/misc.js';
 import { type RequestHandlerWithBodies } from '../../utils/route-helpers.js';
 import { isValidDate } from '../../utils/time.js';
-import { hasOrgId } from '../../utils/apiKeyMiddleware.js';
 import {
   type AppealItemInput,
   type AppealItemOutput,
@@ -61,7 +61,7 @@ export default function submitAppeal({
           }),
         );
       }
-      
+
       const { orgId } = req;
 
       const toItemSubmission = rawItemSubmissionToItemSubmission.bind(
@@ -137,7 +137,6 @@ export default function submitAppeal({
 
       if (
         submittedItemIsInvalid ||
-        // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
         threadOrAdditionalItemsHadInvalidOrIllegalItems ||
         hasAdditionalItemsOnThreadSubmission ||
         isInvalidAppealedAtDate ||
diff --git a/server/routes/reporting/submitReport.ts b/server/routes/reporting/submitReport.ts
index 6f57ce1..e147938 100644
--- a/server/routes/reporting/submitReport.ts
+++ b/server/routes/reporting/submitReport.ts
@@ -8,6 +8,7 @@ import {
   rawItemSubmissionToItemSubmission,
   type ItemSubmission,
 } from '../../services/itemProcessingService/index.js';
+import { hasOrgId } from '../../utils/apiKeyMiddleware.js';
 import {
   fromCorrelationId,
   toCorrelationId,
@@ -16,7 +17,6 @@ import {
   makeBadRequestError,
   makeInternalServerError,
 } from '../../utils/errors.js';
-import { hasOrgId } from '../../utils/apiKeyMiddleware.js';
 import { withRetries } from '../../utils/misc.js';
 import { type RequestHandlerWithBodies } from '../../utils/route-helpers.js';
 import { isValidDate } from '../../utils/time.js';
@@ -67,7 +67,7 @@ export default function submitReport({
           }),
         );
       }
-      
+
       const { orgId } = req;
 
       const toItemSubmission = rawItemSubmissionToItemSubmission.bind(
@@ -102,11 +102,11 @@ export default function submitReport({
       ) {
         try {
           const images = reportedItem.data.images as string[];
-          
+
           // Get all hash banks for this org once
           const allBanks = await HMAHashBankService.listBanks(orgId);
-          const allBankNames = allBanks.map(bank => bank.hma_name);
-          
+          const allBankNames = allBanks.map((bank) => bank.hma_name);
+
           const imageHashes = await Promise.all(
             images.map(async (url) => {
               if (typeof url === 'string' && url) {
@@ -120,53 +120,67 @@ export default function submitReport({
                     },
                     async () => {
                       return HMAHashBankService.hashContentFromUrl(url);
-                    }
+                    },
                   );
                   const hashes = await hmaHashWithRetries();
-                  
+
                   // Check which banks match this image
                   const matchedBankNames: string[] = [];
-                  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
-                  if (hashes && Object.keys(hashes).length > 0 && allBankNames.length > 0) {
+                   
+                  if (
+                    hashes &&
+                    Object.keys(hashes).length > 0 &&
+                    allBankNames.length > 0
+                  ) {
                     const matchResults = await Promise.all(
                       Object.entries(hashes).map(async ([signalType, hash]) =>
-                        HMAHashBankService.checkImageMatchWithDetails(allBankNames, signalType, hash)
-                      )
+                        HMAHashBankService.checkImageMatchWithDetails(
+                          allBankNames,
+                          signalType,
+                          hash,
+                        ),
+                      ),
                     );
-                    
+
                     // Collect all matched banks
                     const allMatchedHmaBanks = new Set<string>();
-                    matchResults.forEach(result => {
-                      result.matchedBanks.forEach(bank => allMatchedHmaBanks.add(bank));
+                    matchResults.forEach((result) => {
+                      result.matchedBanks.forEach((bank) =>
+                        allMatchedHmaBanks.add(bank),
+                      );
                     });
-                    
+
                     // Map HMA bank names to user-friendly names
-                    allMatchedHmaBanks.forEach(hmaName => {
-                      const bank = allBanks.find(b => b.hma_name === hmaName);
+                    allMatchedHmaBanks.forEach((hmaName) => {
+                      const bank = allBanks.find((b) => b.hma_name === hmaName);
                       if (bank) {
                         matchedBankNames.push(bank.name);
                       }
                     });
                   }
-                  
+
                   return {
                     url,
                     hashes,
-                    matchedBanks: matchedBankNames.length > 0 ? matchedBankNames : undefined
+                    matchedBanks:
+                      matchedBankNames.length > 0
+                        ? matchedBankNames
+                        : undefined,
                   };
                 } catch (e) {
                   return {
                     url,
-                    hashes: {}
+                    hashes: {},
                   };
                 }
               }
               return null;
-            })
+            }),
           );
           // Attach the hashes array to the item submission data
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          (reportedItemSubmission.itemSubmission.data as any).images = imageHashes;
+          (reportedItemSubmission.itemSubmission.data as any).images =
+            imageHashes;
         } catch (error) {
           // eslint-disable-next-line no-console
           console.error('Failed to get HMA hashes for images:', error);
@@ -213,7 +227,6 @@ export default function submitReport({
       // analysis.
       const threadOrAdditionalItemsHadInvalidOrIllegalItems =
         (reportedThreadSubmission &&
-          // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
           !isAllValidContentItems(reportedThreadSubmission)) ||
         (additionalItemSubmissions &&
           !isAllValidContentItems(additionalItemSubmissions));
@@ -223,7 +236,6 @@ export default function submitReport({
       );
       if (
         submittedItemIsInvalid ||
-        // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
         threadOrAdditionalItemsHadInvalidOrIllegalItems ||
         hasAdditionalItemsOnThreadSubmission ||
         isInvalidReportedAtDate
@@ -371,9 +383,7 @@ export default function submitReport({
                     ? [reportedForReason.policyId]
                     : [],
                 };
-                if (
-                  req.body.reportedForReason?.csam
-                ) {
+                if (req.body.reportedForReason?.csam) {
                   await NcmecService.enqueueForHumanReviewIfApplicable({
                     ...commonEnqueueInput,
                     item,
diff --git a/server/rule_engine/ActionPublisher.test.ts b/server/rule_engine/ActionPublisher.test.ts
index 6cdacb7..fbae061 100644
--- a/server/rule_engine/ActionPublisher.test.ts
+++ b/server/rule_engine/ActionPublisher.test.ts
@@ -6,122 +6,124 @@
  * on each iteration instead of just the current one.
  */
 
-import getBottle, { type Dependencies } from "../iocContainer/index.js";
-import { ActionType } from "../services/moderationConfigService/index.js";
-import { type CorrelationId } from "../utils/correlationIds.js";
-import { type ActionPublisher } from "./ActionPublisher.js";
-import { RuleEnvironment } from "./RuleEngine.js";
+import getBottle, { type Dependencies } from '../iocContainer/index.js';
+import { ActionType } from '../services/moderationConfigService/index.js';
+import { type CorrelationId } from '../utils/correlationIds.js';
+import { type ActionPublisher } from './ActionPublisher.js';
+import { RuleEnvironment } from './RuleEngine.js';
 
-describe("ActionPublisher", () => {
-	let container: Dependencies;
-	let actionPublisher: ActionPublisher;
+describe('ActionPublisher', () => {
+  let container: Dependencies;
+  let actionPublisher: ActionPublisher;
 
-	beforeAll(async () => {
-		/* eslint-disable better-mutation/no-mutation */
-		({ container } = await getBottle());
-		actionPublisher = container.ActionPublisher;
-		/* eslint-enable better-mutation/no-mutation */
-	});
+  beforeAll(async () => {
+    ({ container } = await getBottle());
+    actionPublisher = container.ActionPublisher;
+  });
 
-	afterAll(async () => {
-		await container.closeSharedResourcesForShutdown();
-	});
+  afterAll(async () => {
+    await container.closeSharedResourcesForShutdown();
+  });
 
-	describe("publishActions", () => {
-		it("should log each action execution exactly once (not N² times)", async () => {
-			const logSpy = jest.spyOn(
-				container.ActionExecutionLogger,
-				"logActionExecutions",
-			);
+  describe('publishActions', () => {
+    it('should log each action execution exactly once (not N² times)', async () => {
+      const logSpy = jest.spyOn(
+        container.ActionExecutionLogger,
+        'logActionExecutions',
+      );
 
-			// Use 2 actions to catch the N² bug
-			// With the bug: 2 actions → 2² = 4 log entries
-			// With the fix: 2 actions → 2 log entries
-			const triggeredActions = [
-				{
-					action: {
-						id: "action-1",
-						orgId: "org-123",
-						name: "Action 1",
-						applyUserStrikes: false,
-						actionType: ActionType.CUSTOM_ACTION,
-						callbackUrl: "https://example.com/action1",
-						callbackUrlHeaders: null,
-						callbackUrlBody: null,
-						customMrtApiParams: null,
-					},
-					policies: [
-						{
-							id: "policy-1",
-							name: "Policy 1",
-							penalty: "NONE" as const,
-							userStrikeCount: 0,
-						},
-					],
-					matchingRules: [
-						{
-							id: "rule-1",
-							name: "Rule 1",
-							version: "1",
-							tags: [],
-							policies: [],
-						},
-					],
-					ruleEnvironment: RuleEnvironment.LIVE,
-				},
-				{
-					action: {
-						id: "action-2",
-						orgId: "org-123",
-						name: "Action 2",
-						applyUserStrikes: false,
-						actionType: ActionType.CUSTOM_ACTION,
-						callbackUrl: "https://example.com/action2",
-						callbackUrlHeaders: null,
-						callbackUrlBody: null,
-						customMrtApiParams: null,
-					},
-					policies: [
-						{
-							id: "policy-2",
-							name: "Policy 2",
-							penalty: "NONE" as const,
-							userStrikeCount: 0,
-						},
-					],
-					matchingRules: [
-						{
-							id: "rule-2",
-							name: "Rule 2",
-							version: "1",
-							tags: [],
-							policies: [],
-						},
-					],
-					ruleEnvironment: RuleEnvironment.LIVE,
-				},
-			];
+      // Use 2 actions to catch the N² bug
+      // With the bug: 2 actions → 2² = 4 log entries
+      // With the fix: 2 actions → 2 log entries
+      const triggeredActions = [
+        {
+          action: {
+            id: 'action-1',
+            orgId: 'org-123',
+            name: 'Action 1',
+            applyUserStrikes: false,
+            actionType: ActionType.CUSTOM_ACTION,
+            callbackUrl: 'https://example.com/action1',
+            callbackUrlHeaders: null,
+            callbackUrlBody: null,
+            customMrtApiParams: null,
+          },
+          policies: [
+            {
+              id: 'policy-1',
+              name: 'Policy 1',
+              penalty: 'NONE' as const,
+              userStrikeCount: 0,
+            },
+          ],
+          matchingRules: [
+            {
+              id: 'rule-1',
+              name: 'Rule 1',
+              version: '1',
+              tags: [],
+              policies: [],
+            },
+          ],
+          ruleEnvironment: RuleEnvironment.LIVE,
+        },
+        {
+          action: {
+            id: 'action-2',
+            orgId: 'org-123',
+            name: 'Action 2',
+            applyUserStrikes: false,
+            actionType: ActionType.CUSTOM_ACTION,
+            callbackUrl: 'https://example.com/action2',
+            callbackUrlHeaders: null,
+            callbackUrlBody: null,
+            customMrtApiParams: null,
+          },
+          policies: [
+            {
+              id: 'policy-2',
+              name: 'Policy 2',
+              penalty: 'NONE' as const,
+              userStrikeCount: 0,
+            },
+          ],
+          matchingRules: [
+            {
+              id: 'rule-2',
+              name: 'Rule 2',
+              version: '1',
+              tags: [],
+              policies: [],
+            },
+          ],
+          ruleEnvironment: RuleEnvironment.LIVE,
+        },
+      ];
 
-			const executionContext = {
-				orgId: "org-123",
-				correlationId: "post-content:abc123" as CorrelationId<"post-content">,
-				targetItem: {
-					itemId: "item-123",
-					itemType: { id: "type-123", kind: "CONTENT" as const, name: "Social Post" },
-				},
-			};
+      const executionContext = {
+        orgId: 'org-123',
+        correlationId: 'post-content:abc123' as CorrelationId<'post-content'>,
+        targetItem: {
+          itemId: 'item-123',
+          itemType: {
+            id: 'type-123',
+            kind: 'CONTENT' as const,
+            name: 'Social Post',
+          },
+        },
+      };
 
-			await actionPublisher.publishActions(triggeredActions, executionContext);
+      await actionPublisher.publishActions(triggeredActions, executionContext);
 
-			// With the fix: called 2 times (once per action)
-			expect(logSpy).toHaveBeenCalledTimes(2);
+      // With the fix: called 2 times (once per action)
+      expect(logSpy).toHaveBeenCalledTimes(2);
 
-			// Each call should log exactly one execution
-			logSpy.mock.calls.forEach((call) => {
-				expect(call[0].executions).toHaveLength(1);
-			});
+      // Each call should log exactly one execution
+      logSpy.mock.calls.forEach((call) => {
+        expect(call[0].executions).toHaveLength(1);
+      });
 
-			logSpy.mockRestore();
-		});
-	});
+      logSpy.mockRestore();
+    });
+  });
 });
diff --git a/server/rule_engine/ActionPublisher.ts b/server/rule_engine/ActionPublisher.ts
index b7ef389..23fba92 100644
--- a/server/rule_engine/ActionPublisher.ts
+++ b/server/rule_engine/ActionPublisher.ts
@@ -5,6 +5,12 @@ import { type JsonObject, type ReadonlyDeep } from 'type-fest';
 
 import { type Dependencies } from '../iocContainer/index.js';
 import { inject } from '../iocContainer/utils.js';
+import {
+  type ActionExecutionCorrelationId,
+  type ActionExecutionSourceType,
+  type MatchingRule,
+  type Policy,
+} from '../services/analyticsLoggers/index.js';
 import {
   getFieldValueForRole,
   itemSubmissionToItemSubmissionWithTypeIdentifier,
@@ -15,12 +21,6 @@ import {
   type Action,
   type ItemType,
 } from '../services/moderationConfigService/index.js';
-import {
-  type ActionExecutionCorrelationId,
-  type ActionExecutionSourceType,
-  type MatchingRule,
-  type Policy,
-} from '../services/analyticsLoggers/index.js';
 import { asyncIterableToArray } from '../utils/collections.js';
 import { getSourceType, type CorrelationId } from '../utils/correlationIds.js';
 import { jsonStringify } from '../utils/encoding.js';
@@ -229,7 +229,12 @@ class ActionPublisher {
                 matchingRules,
                 ruleEnvironment,
                 policies: policies.map((policy) =>
-                  safePick(policy, ['id', 'name', 'userStrikeCount', 'penalty']),
+                  safePick(policy, [
+                    'id',
+                    'name',
+                    'userStrikeCount',
+                    'penalty',
+                  ]),
                 ),
                 orgId,
                 targetItem,
@@ -305,7 +310,6 @@ class ActionPublisher {
                 ...customMrtApiParamDecisionPayload,
               };
 
-
               const body = {
                 item: {
                   id: targetItem.itemId,
@@ -329,7 +333,7 @@ class ActionPublisher {
                   // could provide that would have security implications when blindly fed
                   // in here -- like something that would somehow lead fetch to do something
                   // unexpected.
-                  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+
                   ...((customHeaders as JsonObject | undefined) ?? undefined),
                   // Put this header last so customHeaders can't override it, which I
                   // think makes sense, since there's no way for users to effect the
diff --git a/server/services/actionStatisticsService/actionStatisticsService.ts b/server/services/actionStatisticsService/actionStatisticsService.ts
index f675fd3..82cd931 100644
--- a/server/services/actionStatisticsService/actionStatisticsService.ts
+++ b/server/services/actionStatisticsService/actionStatisticsService.ts
@@ -1,15 +1,12 @@
-/* eslint-disable max-lines */
 import { inject } from '../../iocContainer/utils.js';
 import {
-  type IActionStatisticsAdapter,
   type ActionCountsInput,
+  type IActionStatisticsAdapter,
 } from '../../plugins/warehouse/queries/IActionStatisticsAdapter.js';
 import { YEAR_MS } from '../../utils/time.js';
 
 class ActionStatisticsService {
-  constructor(
-    private readonly adapter: IActionStatisticsAdapter,
-  ) {}
+  constructor(private readonly adapter: IActionStatisticsAdapter) {}
 
   /**
    * Returns the total number of content submissions actioned on each day,
@@ -33,10 +30,7 @@ class ActionStatisticsService {
     orgId: string,
     startAt: Date = new Date(Date.now() - YEAR_MS),
   ) {
-    return this.adapter.getActionedSubmissionCountsByTagByDay(
-      orgId,
-      startAt,
-    );
+    return this.adapter.getActionedSubmissionCountsByTagByDay(orgId, startAt);
   }
 
   async getActionedSubmissionCountsByPolicyByDay(
diff --git a/server/services/analyticsLoggers/ContentApiLogger.ts b/server/services/analyticsLoggers/ContentApiLogger.ts
index b797263..e05508b 100644
--- a/server/services/analyticsLoggers/ContentApiLogger.ts
+++ b/server/services/analyticsLoggers/ContentApiLogger.ts
@@ -75,7 +75,7 @@ class ContentApiLogger {
           org_id: data.orgId,
           request_id: fromCorrelationId(data.requestId),
           submission_id: itemSubmission.submissionId,
-          // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+
           ...(failureReason != null
             ? {
                 event: 'REQUEST_FAILED' as const,
diff --git a/server/services/analyticsLoggers/ItemModelScoreLogger.ts b/server/services/analyticsLoggers/ItemModelScoreLogger.ts
index 3ee8feb..ad5e935 100644
--- a/server/services/analyticsLoggers/ItemModelScoreLogger.ts
+++ b/server/services/analyticsLoggers/ItemModelScoreLogger.ts
@@ -77,7 +77,7 @@ class ItemModelScoreLogger {
                 model_score: data.model.score,
               }
             : {}),
-          // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+
           ...(failureReason != null
             ? {
                 event: 'REQUEST_FAILED' as const,
diff --git a/server/services/itemInvestigationService/itemInvestigationService.test.ts b/server/services/itemInvestigationService/itemInvestigationService.test.ts
index 7edd76e..8e933c6 100644
--- a/server/services/itemInvestigationService/itemInvestigationService.test.ts
+++ b/server/services/itemInvestigationService/itemInvestigationService.test.ts
@@ -19,10 +19,9 @@ describe('Item Investigation Service', () => {
   beforeAll(async () => {
     // The mutation should be ok here since this is initial setup in a
     // beforeAll; it doesn't involve reset state for each test in the suite
-    /* eslint-disable better-mutation/no-mutation */
+
     ({ container } = await getBottle());
     itemInvestigationService = container.ItemInvestigationService;
-    /* eslint-enable better-mutation/no-mutation */
   });
   afterAll(async () => {
     await container.closeSharedResourcesForShutdown();
diff --git a/server/services/itemProcessingService/extractItemDataValues.ts b/server/services/itemProcessingService/extractItemDataValues.ts
index 0ebf589..fcdceec 100644
--- a/server/services/itemProcessingService/extractItemDataValues.ts
+++ b/server/services/itemProcessingService/extractItemDataValues.ts
@@ -56,7 +56,7 @@ export function getFieldValueOrValues<T extends FieldType>(
       // because the type that TS infers when trying to generate a single,
       // callable signature for `getValues` is not correct (and has never as
       // its argument types).
-      fieldTypeHandlers[type as FieldType]
+      fieldTypeHandlers[type]
         .getValues(data[name] as never, container as never)
         .map(
           (value) =>
diff --git a/server/services/itemProcessingService/fieldTypeHandlers.test.ts b/server/services/itemProcessingService/fieldTypeHandlers.test.ts
index 565ddae..cd241e8 100644
--- a/server/services/itemProcessingService/fieldTypeHandlers.test.ts
+++ b/server/services/itemProcessingService/fieldTypeHandlers.test.ts
@@ -28,7 +28,6 @@ describe('Content type schemas', () => {
           ) as fc.Arbitrary<Field<ContainerType>>;
 
           fc.assert(
-            // eslint-disable-next-line no-loop-func
             fc.property(dummyContainerFieldArb, (containerField) => {
               expect(
                 (handlers as (typeof fieldTypeHandlers)[ContainerType]).coerce(
diff --git a/server/services/manualReviewToolService/manualReviewToolService.test.ts b/server/services/manualReviewToolService/manualReviewToolService.test.ts
index 65340dc..caf7a1f 100644
--- a/server/services/manualReviewToolService/manualReviewToolService.test.ts
+++ b/server/services/manualReviewToolService/manualReviewToolService.test.ts
@@ -19,10 +19,9 @@ describe('Manual Review Tool Service', () => {
   beforeAll(async () => {
     // The mutation should be ok here since this is initial setup in a
     // beforeAll; it doesn't involve reset state for each test in the suite
-    /* eslint-disable better-mutation/no-mutation */
+
     ({ container } = await getBottle());
     mrtService = container.ManualReviewToolService;
-    /* eslint-enable better-mutation/no-mutation */
   });
 
   afterAll(async () => {
diff --git a/server/services/manualReviewToolService/manualReviewToolService.ts b/server/services/manualReviewToolService/manualReviewToolService.ts
index 8608b0a..0fd46c2 100644
--- a/server/services/manualReviewToolService/manualReviewToolService.ts
+++ b/server/services/manualReviewToolService/manualReviewToolService.ts
@@ -1,13 +1,13 @@
 /* eslint-disable max-lines */
 
 import { SpanStatusCode } from '@opentelemetry/api';
-import { type ConsumerDirectives } from '../../lib/cache/index.js';
 import { type ItemIdentifier } from '@roostorg/types';
 import { type Kysely } from 'kysely';
 import _ from 'lodash';
 import { type Opaque } from 'type-fest';
 
 import { type Dependencies } from '../../iocContainer/index.js';
+import { type ConsumerDirectives } from '../../lib/cache/index.js';
 import {
   type Invoker,
   type UserPermission,
@@ -461,7 +461,6 @@ export class ManualReviewToolService {
                   },
                 });
 
-            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
             if (!job) {
               // this means that we tried to update a job that was deleted
               // between when we looked up the existing job and did the update.
@@ -684,14 +683,15 @@ export class ManualReviewToolService {
     if (newJob.kind === 'DEFAULT' && existingJob.kind === 'DEFAULT') {
       // Merge itemThreadContentItems (conversation context)
       const mergedThreadItems =
-        ('itemThreadContentItems' in newJob || 'itemThreadContentItems' in existingJob)
+        'itemThreadContentItems' in newJob ||
+        'itemThreadContentItems' in existingJob
           ? _.uniqBy(
               [
                 ...('itemThreadContentItems' in newJob
-                  ? (newJob.itemThreadContentItems ?? [])
+                  ? newJob.itemThreadContentItems ?? []
                   : []),
                 ...('itemThreadContentItems' in existingJob
-                  ? (existingJob.itemThreadContentItems ?? [])
+                  ? existingJob.itemThreadContentItems ?? []
                   : []),
               ],
               (it) => jsonStringify([it.itemId, it.itemTypeIdentifier.id]),
@@ -700,12 +700,14 @@ export class ManualReviewToolService {
 
       // Merge reportedItems (list of items reported by users)
       const mergedReportedItems =
-        ('reportedItems' in newJob || 'reportedItems' in existingJob)
+        'reportedItems' in newJob || 'reportedItems' in existingJob
           ? _.uniqBy(
               [
-                ...('reportedItems' in newJob ? (newJob.reportedItems ?? []) : []),
+                ...('reportedItems' in newJob
+                  ? newJob.reportedItems ?? []
+                  : []),
                 ...('reportedItems' in existingJob
-                  ? (existingJob.reportedItems ?? [])
+                  ? existingJob.reportedItems ?? []
                   : []),
               ],
               (it) => jsonStringify([it.id, it.typeId]),
@@ -963,10 +965,7 @@ export class ManualReviewToolService {
     return this.queueOps.getPendingJobCount(opts);
   }
 
-  async getTotalPendingJobCountForQueues(
-    orgId: string,
-    queueIds: string[],
-  ) {
+  async getTotalPendingJobCountForQueues(orgId: string, queueIds: string[]) {
     return this.queueOps.getTotalPendingJobCountForQueues(orgId, queueIds);
   }
 
@@ -1252,12 +1251,14 @@ export class ManualReviewToolService {
   }) {
     // As releaseJobLock is a public method, we assume the passed in jobId is an
     // external id (which are the only kind that should leave the mrt service).
-    await this.queueOps.releaseJobLock(opts as {
-      orgId: string;
-      queueId: string;
-      jobId: JobId;
-      lockToken: string;
-    });
+    await this.queueOps.releaseJobLock(
+      opts as {
+        orgId: string;
+        queueId: string;
+        jobId: JobId;
+        lockToken: string;
+      },
+    );
   }
 
   async close() {
diff --git a/server/services/manualReviewToolService/modules/JobDecisioning.ts b/server/services/manualReviewToolService/modules/JobDecisioning.ts
index 2e22719..d0c518c 100644
--- a/server/services/manualReviewToolService/modules/JobDecisioning.ts
+++ b/server/services/manualReviewToolService/modules/JobDecisioning.ts
@@ -167,7 +167,7 @@ export default class JobDecisioning {
     // if there's a decision to discriminate between these cases, but that's
     // overkill. (Because we're not doing that, the NoJobWithIdInQueueError
     // error case is unused currently/for now.)
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+
     if ((job as typeof job | undefined) == null) {
       throw makeJobHasAlreadyBeenSubmittedError({
         detail: `Job ${jobId} has already been acted on (or this job never existed).`,
diff --git a/server/services/manualReviewToolService/modules/JobEnrichment.ts b/server/services/manualReviewToolService/modules/JobEnrichment.ts
index 375433d..ccb9b7a 100644
--- a/server/services/manualReviewToolService/modules/JobEnrichment.ts
+++ b/server/services/manualReviewToolService/modules/JobEnrichment.ts
@@ -1,9 +1,9 @@
 import { type ItemIdentifier } from '@roostorg/types';
 
-import { type ActionExecutionCorrelationId } from '../../analyticsLoggers/ActionExecutionLogger.js';
-import { type RuleExecutionCorrelationId } from '../../analyticsLoggers/ruleExecutionLoggingUtils.js';
 import { assertUnreachable } from '../../../utils/misc.js';
 import { type Satisfies } from '../../../utils/typescript-types.js';
+import { type ActionExecutionCorrelationId } from '../../analyticsLoggers/ActionExecutionLogger.js';
+import { type RuleExecutionCorrelationId } from '../../analyticsLoggers/ruleExecutionLoggingUtils.js';
 import {
   getFieldValueForRole,
   getFieldValueOrValues,
@@ -171,7 +171,6 @@ export default class JobEnrichment {
     return commonPayload;
   }
 
-  // eslint-disable-next-line complexity
   async #genericEnrichJobPayload(
     input: ManualReviewJobInput,
     type: ItemType,
@@ -299,4 +298,4 @@ export default class JobEnrichment {
       },
     };
   }
-}
\ No newline at end of file
+}
diff --git a/server/services/manualReviewToolService/modules/JobRouting.test.ts b/server/services/manualReviewToolService/modules/JobRouting.test.ts
index 3faf0f7..13badda 100644
--- a/server/services/manualReviewToolService/modules/JobRouting.test.ts
+++ b/server/services/manualReviewToolService/modules/JobRouting.test.ts
@@ -1,5 +1,4 @@
 /* eslint-disable max-lines */
-/* eslint-disable better-mutation/no-mutation */
 import { ScalarTypes } from '@roostorg/types';
 import { uid } from 'uid';
 
@@ -444,11 +443,10 @@ describe('JobRouting tests', () => {
         orgId: org.id,
         queueId: defaultQueue.id,
       });
-      const initialAnother =
-        await manualReviewToolService.getPendingJobCount({
-          orgId: org.id,
-          queueId: anotherQueue.id,
-        });
+      const initialAnother = await manualReviewToolService.getPendingJobCount({
+        orgId: org.id,
+        queueId: anotherQueue.id,
+      });
 
       const normalizedDataOrError = toNormalizedItemDataOrErrors(
         [itemType.id],
@@ -497,9 +495,11 @@ describe('JobRouting tests', () => {
         anotherQueue.id,
       );
 
-      const defaultQueueCount = await manualReviewToolService.getPendingJobCount(
-        { orgId: org.id, queueId: defaultQueue.id },
-      );
+      const defaultQueueCount =
+        await manualReviewToolService.getPendingJobCount({
+          orgId: org.id,
+          queueId: defaultQueue.id,
+        });
       const anotherQueueCount =
         await manualReviewToolService.getPendingJobCount({
           orgId: org.id,
diff --git a/server/services/moderationConfigService/moderationConfigService.test.ts b/server/services/moderationConfigService/moderationConfigService.test.ts
index 1949a0a..2df427c 100644
--- a/server/services/moderationConfigService/moderationConfigService.test.ts
+++ b/server/services/moderationConfigService/moderationConfigService.test.ts
@@ -34,20 +34,23 @@ describe('ModerationConfigService', () => {
   // overkill), we have to track entities added in each write test, by adding
   // them to the variables below, so that we can assert on the results when
   // reading.
+  let allCreatedItemTypes = [] as ItemType[];
   const createdItemTypes = {
-    ALL: [] as ItemType[],
+    get ALL() {
+      return allCreatedItemTypes;
+    },
     get USER() {
-      return this.ALL.filter((it) => it.kind === 'USER');
+      return allCreatedItemTypes.filter((it) => it.kind === 'USER');
     },
     get CONTENT() {
-      return this.ALL.filter((it) => it.kind === 'CONTENT');
+      return allCreatedItemTypes.filter((it) => it.kind === 'CONTENT');
     },
     get THREAD() {
-      return this.ALL.filter((it) => it.kind === 'THREAD');
+      return allCreatedItemTypes.filter((it) => it.kind === 'THREAD');
     },
   };
 
-  const createdActions = [] as Action[];
+  let createdActions = [] as Action[];
 
   const createdPolicies = [
     {
@@ -81,7 +84,6 @@ describe('ModerationConfigService', () => {
   // underlying db tables, which makes the tests more brittle/harder to maintain
   // than I'd like if the service is refactored.
   beforeAll(async () => {
-    // eslint-disable-next-line better-mutation/no-mutation
     container = (await getBottle()).container;
 
     // An instance of kysely that will throw if any queries are run through it;
@@ -97,14 +99,13 @@ describe('ModerationConfigService', () => {
     // In order to test that the correct db is queried (i.e., replicas vs the
     // primary), we'll just use different instances of the service, where each
     // only has access to the db we expect to be hit.
-    // eslint-disable-next-line better-mutation/no-mutation
+
     sutWithPrimary = new ModerationConfigService(
       container.KyselyPg,
       kyselyShouldBeUnused,
       async () => {},
     );
 
-    // eslint-disable-next-line better-mutation/no-mutation
     sutWithReadReplica = new ModerationConfigService(
       kyselyShouldBeUnused,
       container.KyselyPgReadReplica,
@@ -118,9 +119,8 @@ describe('ModerationConfigService', () => {
       dummyOrgId,
     );
 
-    // eslint-disable-next-line better-mutation/no-mutation
     defaultUserItemType = createOrgResult.defaultUserItemType;
-    createdItemTypes.ALL.push(defaultUserItemType);
+    allCreatedItemTypes = [...allCreatedItemTypes, defaultUserItemType];
   });
 
   afterAll(async () => {
@@ -228,7 +228,7 @@ describe('ModerationConfigService', () => {
           );
           expect(saved.orgId).toBe(dummyOrgId);
           expect(saved).toEqual(fetched);
-          createdItemTypes.ALL.push(saved);
+          allCreatedItemTypes = [...allCreatedItemTypes, saved];
         });
       });
 
@@ -278,7 +278,7 @@ describe('ModerationConfigService', () => {
           );
           expect(saved.orgId).toBe(dummyOrgId);
           expect(saved).toEqual(fetched);
-          createdItemTypes.ALL.push(saved);
+          allCreatedItemTypes = [...allCreatedItemTypes, saved];
         });
       });
 
@@ -330,7 +330,7 @@ describe('ModerationConfigService', () => {
           );
           expect(saved.orgId).toBe(dummyOrgId);
           expect(saved).toEqual(fetched);
-          createdItemTypes.ALL.push(saved);
+          allCreatedItemTypes = [...allCreatedItemTypes, saved];
         });
       });
     });
@@ -457,7 +457,7 @@ describe('ModerationConfigService', () => {
           );
           expect(saved.orgId).toBe(dummyOrgId);
           expect(saved).toEqual(fetched);
-          createdActions.push(saved);
+          createdActions = [...createdActions, saved];
         });
       });
     });
@@ -669,7 +669,7 @@ describe('ModerationConfigService', () => {
     });
   });
   describe('TextBank-returning methods', () => {
-    const createdTextBanks = [] as {
+    let createdTextBanks = [] as {
       id: string;
       orgId: string;
       name: string;
@@ -706,7 +706,7 @@ describe('ModerationConfigService', () => {
           );
 
           expect(textBank.orgId).toBe(dummyOrgId);
-          createdTextBanks.push(textBank);
+          createdTextBanks = [...createdTextBanks, textBank];
         });
       });
     });
diff --git a/server/services/moderationConfigService/moderationConfigService.ts b/server/services/moderationConfigService/moderationConfigService.ts
index cd91cf0..d59149c 100644
--- a/server/services/moderationConfigService/moderationConfigService.ts
+++ b/server/services/moderationConfigService/moderationConfigService.ts
@@ -1,10 +1,8 @@
-/* eslint-disable max-lines */
-import { type ConsumerDirectives } from '../../lib/cache/index.js';
 import { type Kysely } from 'kysely';
 import _ from 'lodash';
 import { type JsonObject, type ReadonlyDeep } from 'type-fest';
 
-// eslint-disable-next-line import/no-restricted-paths
+import { type ConsumerDirectives } from '../../lib/cache/index.js';
 import type { Invoker } from '../../models/types/permissioning.js';
 import {
   CoopError,
diff --git a/server/services/ncmecService/ncmecEnqueueToMrt.ts b/server/services/ncmecService/ncmecEnqueueToMrt.ts
index a3475e4..b9003d1 100644
--- a/server/services/ncmecService/ncmecEnqueueToMrt.ts
+++ b/server/services/ncmecService/ncmecEnqueueToMrt.ts
@@ -7,22 +7,21 @@ import {
 import { match } from 'ts-pattern';
 
 import { type Dependencies } from '../../iocContainer/index.js';
-import { type ActionExecutionCorrelationId } from '../analyticsLoggers/ActionExecutionLogger.js';
-import { type RuleExecutionCorrelationId } from '../analyticsLoggers/ruleExecutionLoggingUtils.js';
 import { asyncIterableToArray } from '../../utils/collections.js';
 import { jsonStringify } from '../../utils/encoding.js';
 import { __throw, safePick, withRetries } from '../../utils/misc.js';
 import { instantiateOpaqueType } from '../../utils/typescript-types.js';
+import { type ActionExecutionCorrelationId } from '../analyticsLoggers/ActionExecutionLogger.js';
+import { type RuleExecutionCorrelationId } from '../analyticsLoggers/ruleExecutionLoggingUtils.js';
 import { RETURN_UNLIMITED_RESULTS_AND_POTENTIALLY_HANG_DB } from '../itemInvestigationService/index.js';
 import {
   getFieldValueForRole,
   getValuesFromFields,
 } from '../itemProcessingService/extractItemDataValues.js';
-import { 
+import {
   type ItemSubmission,
   type NormalizedItemData,
 } from '../itemProcessingService/index.js';
-import { type ItemType } from '../moderationConfigService/types/itemTypes.js';
 import {
   itemSubmissionToItemSubmissionWithTypeIdentifier,
   itemSubmissionWithTypeIdentifierToItemSubmission,
@@ -36,7 +35,7 @@ import {
   type ReportEnqueueSourceInfo,
   type RuleExecutionEnqueueSourceInfo,
 } from '../manualReviewToolService/manualReviewToolService.js';
-
+import { type ItemType } from '../moderationConfigService/types/itemTypes.js';
 import type NcmecReporting from './ncmecReporting.js';
 
 export default class NcmecEnqueueToMrt {
@@ -83,7 +82,7 @@ export default class NcmecEnqueueToMrt {
     ),
   ) {
     const { orgId, createdAt } = input;
-    
+
     // Fetch as much info about the reported user as we can get from
     // the organization's partial items endpoint, and if the reported item is
     // content, then convert it to the user who created the content because
@@ -177,7 +176,7 @@ export default class NcmecEnqueueToMrt {
       input.item,
       reportedItemType,
     );
-    
+
     if (allMediaItems.length === 0) {
       return { status: 'SKIPPED' };
     }
@@ -196,7 +195,9 @@ export default class NcmecEnqueueToMrt {
         policyIds: [],
         payload: {
           kind: 'NCMEC',
-          item: itemSubmissionToItemSubmissionWithTypeIdentifier(userSubmission),
+          item: itemSubmissionToItemSubmissionWithTypeIdentifier(
+            userSubmission,
+          ),
           allMediaItems,
           reportHistory: [],
         },
@@ -222,22 +223,24 @@ export default class NcmecEnqueueToMrt {
     const mediaFields = reportedItemType.schema.filter((field) =>
       isMediaType(getScalarType(field)),
     );
-    
+
     if (mediaFields.length === 0) {
       return [];
     }
-    
+
     const mediaValues = getValuesFromFields(reportedItem.data, mediaFields);
-    
+
     if (mediaValues.length === 0) {
       return [];
     }
-    
-    return [{
-      contentItem: reportedItem,
-      isConfirmedCSAM: false,
-      isReported: true,
-    }];
+
+    return [
+      {
+        contentItem: reportedItem,
+        isConfirmedCSAM: false,
+        isReported: true,
+      },
+    ];
   }
 
   async #getAllMediaForUser(
@@ -251,7 +254,7 @@ export default class NcmecEnqueueToMrt {
       latestSubmission: ItemSubmission;
       priorSubmissions?: ItemSubmission[];
     }> = [];
-    
+
     try {
       itemsWithPossibleMedia = await asyncIterableToArray(
         this.itemInvestigationService.getItemSubmissionsByCreator({
@@ -265,7 +268,10 @@ export default class NcmecEnqueueToMrt {
       // Database not available (e.g., local dev without Cassandra/Scylla)
       // Use the reported item directly
       if (reportedItemSubmission && reportedItemType) {
-        return await this.#getMediaFromReportedItem(reportedItemSubmission, reportedItemType);
+        return this.#getMediaFromReportedItem(
+          reportedItemSubmission,
+          reportedItemType,
+        );
       }
     }
 
@@ -286,12 +292,13 @@ export default class NcmecEnqueueToMrt {
             orgId,
             itemTypeSelector: { id: reportedItemIdentifier.typeId },
           });
-          
+
           if (itemType) {
-            const reportedItemAsSubmission = itemSubmissionWithTypeIdentifierToItemSubmission(
-              reportedItemSubmission,
-              itemType,
-            );
+            const reportedItemAsSubmission =
+              itemSubmissionWithTypeIdentifierToItemSubmission(
+                reportedItemSubmission,
+                itemType,
+              );
             latestItems = [reportedItemAsSubmission, ...latestItems];
           }
         } else {
@@ -363,7 +370,9 @@ export default class NcmecEnqueueToMrt {
       | { itemSubmission: ItemSubmission; userIdentifier?: undefined }
       | { itemSubmission?: undefined; userIdentifier: ItemIdentifier }
     ),
-  ): Promise<{ success: true; submission: ItemSubmission } | { success: false }> {
+  ): Promise<
+    { success: true; submission: ItemSubmission } | { success: false }
+  > {
     const { orgId, itemSubmission, userIdentifier } = opts;
 
     const userItem = await (async (): Promise<ItemSubmission | null> => {
@@ -399,7 +408,7 @@ export default class NcmecEnqueueToMrt {
         orgId,
         userItemId,
       );
-      
+
       // If partial items endpoint is not available, try fallbacks
       if (!fetchedUser) {
         // Fallback: Check item investigation service for previously submitted user data
@@ -409,16 +418,16 @@ export default class NcmecEnqueueToMrt {
             itemIdentifier: userItemId,
             latestSubmissionOnly: true,
           });
-        
+
         if (investigatedUserResult?.latestSubmission) {
           // The adapter already returns ItemSubmission, not ItemSubmissionWithTypeIdentifier
           return investigatedUserResult.latestSubmission;
         }
-        
+
         // User data not available from any source
         return null;
       }
-      
+
       return fetchedUser;
     })();
 
@@ -435,12 +444,12 @@ export default class NcmecEnqueueToMrt {
     reportedItem: ItemSubmission;
   }): Promise<ItemSubmission> {
     const { orgId, reportedItemType, reportedItem } = opts;
-    
+
     // If the reported item is already a USER, use it
     if (reportedItemType.kind === 'USER') {
       return reportedItem;
     }
-    
+
     // For CONTENT, try to extract the creator ID
     if (reportedItemType.kind === 'CONTENT') {
       const creatorId = getFieldValueForRole(
@@ -449,38 +458,38 @@ export default class NcmecEnqueueToMrt {
         'creatorId',
         reportedItem.data,
       );
-      
+
       if (!creatorId) {
         throw new Error(
           'Cannot create NCMEC job: Content item does not have a creatorId field configured. ' +
-          'Please add the creatorId role to the owner/creator field in your item type schema.',
+            'Please add the creatorId role to the owner/creator field in your item type schema.',
         );
       }
-      
+
       // Get the user item type
       const userItemType = await this.moderationConfigService.getItemType({
         orgId,
         itemTypeSelector: { id: creatorId.typeId },
       });
-      
+
       if (!userItemType) {
         throw new Error(
           `Cannot create NCMEC job: User item type ${creatorId.typeId} not found.`,
         );
       }
-      
+
       if (userItemType.kind !== 'USER') {
         throw new Error(
           `Cannot create NCMEC job: Item type ${creatorId.typeId} is not a USER type (it's ${userItemType.kind}).`,
         );
       }
-      
+
       // Create a minimal user submission with just the ID
       // The human reviewer will need to manually add more info
       const minimalData: Record<string, unknown> = {
         userId: creatorId.id,
       };
-      
+
       return instantiateOpaqueType<ItemSubmission>({
         itemId: creatorId.id,
         itemType: userItemType,
@@ -490,11 +499,11 @@ export default class NcmecEnqueueToMrt {
         creator: undefined,
       });
     }
-    
+
     // For THREAD or other types, we can't determine the user
     throw new Error(
       `Cannot create NCMEC job: Cannot determine user from item type ${reportedItemType.kind}. ` +
-      'Please report the USER directly.',
+        'Please report the USER directly.',
     );
   }
 
diff --git a/server/services/ncmecService/ncmecReporting.ts b/server/services/ncmecService/ncmecReporting.ts
index 3404c7c..3869ebf 100644
--- a/server/services/ncmecService/ncmecReporting.ts
+++ b/server/services/ncmecService/ncmecReporting.ts
@@ -390,7 +390,8 @@ export function buildInternetDetailsFromOrgSetting(
   if (!defaultInternetDetailType?.trim()) {
     return undefined;
   }
-  const type = defaultInternetDetailType.trim() as NcmecInternetDetailTypeSetting;
+  const type =
+    defaultInternetDetailType.trim() as NcmecInternetDetailTypeSetting;
   if (!NCMEC_INTERNET_DETAIL_TYPES.includes(type)) {
     return undefined;
   }
@@ -794,7 +795,11 @@ export default class NcmecReporting {
     return ncmecOrgSettings?.org_id != null;
   }
 
-  async getNCMECConfig(orgId: string): Promise<NcmecReportingServicePg['ncmec_reporting.ncmec_org_settings'] | undefined>  {
+  async getNCMECConfig(
+    orgId: string,
+  ): Promise<
+    NcmecReportingServicePg['ncmec_reporting.ncmec_org_settings'] | undefined
+  > {
     const row = await this.pgQuery
       .selectFrom('ncmec_reporting.ncmec_org_settings')
       .where('org_id', '=', orgId)
@@ -899,7 +904,7 @@ export default class NcmecReporting {
     const additionalInfoEndpoint = await this.ncmecAdditionalInfoEndpoint(
       orgId,
     );
-    
+
     // If no additional info endpoint is configured, return minimal default data
     if (!additionalInfoEndpoint) {
       return {
@@ -919,7 +924,7 @@ export default class NcmecReporting {
         })),
       };
     }
-    
+
     const response = await this.fetchHTTP({
       url: additionalInfoEndpoint,
       method: 'post',
@@ -1081,7 +1086,9 @@ export default class NcmecReporting {
     );
 
     if (ncmecPreservationEndpoint == null) {
-      throw new Error('Organization does not have a NCMEC preservation endpoint');
+      throw new Error(
+        'Organization does not have a NCMEC preservation endpoint',
+      );
     }
 
     const fetchWithRetries = withRetries(
@@ -1173,13 +1180,13 @@ export default class NcmecReporting {
           // they should be able to click "Send to NCMEC" in the UI, but no
           // NCMEC report should actually be created.
           const testOrgs = ['4def6a77d6a', 'acc701627cb'];
-          
+
           if (!(await this.hasNCMECReportingEnabled(reportParams.orgId))) {
             throw new Error(
               `NCMEC reports are not enabled for org ${reportParams.orgId}`,
             );
           }
-          
+
           if (testOrgs.includes(reportParams.orgId)) {
             return 'UNSUPPORTED_ORG';
           }
@@ -1270,7 +1277,8 @@ export default class NcmecReporting {
           const ncmecConfig = await this.getNCMECConfig(reportParams.orgId);
 
           // Use the incident type from the report params
-          const incidentType = NCMECIncidentType[reportParams.incidentType as NCMECIncidentType];
+          const incidentType =
+            NCMECIncidentType[reportParams.incidentType as NCMECIncidentType];
 
           const escalateToHighPriority =
             reportParams.escalateToHighPriority != null
@@ -1278,7 +1286,8 @@ export default class NcmecReporting {
               : undefined;
           if (
             escalateToHighPriority !== undefined &&
-            (escalateToHighPriority === '' || escalateToHighPriority.length > 3000)
+            (escalateToHighPriority === '' ||
+              escalateToHighPriority.length > 3000)
           ) {
             throw new Error(
               'escalateToHighPriority must be non-blank when supplied and at most 3000 characters',
@@ -1295,14 +1304,14 @@ export default class NcmecReporting {
               incidentSummary: {
                 incidentType,
                 incidentDateTime: maxCreatedAt,
-                ...(escalateToHighPriority
-                  ? { escalateToHighPriority }
-                  : {}),
+                ...(escalateToHighPriority ? { escalateToHighPriority } : {}),
               },
               ...(internetDetails ? { internetDetails } : {}),
               reporter: {
                 reportingPerson: {
-                  email: [emailStringToNCMECEmail(ncmecConfig?.contact_email ?? '')],
+                  email: [
+                    emailStringToNCMECEmail(ncmecConfig?.contact_email ?? ''),
+                  ],
                 },
                 companyTemplate: queryResponse.companyTemplate,
                 legalURL: queryResponse.legalURL,
@@ -1312,11 +1321,11 @@ export default class NcmecReporting {
                   ? { termsOfService: queryResponse.termsOfService.trim() }
                   : {}),
                 // Use || so we only add contactPerson when at least one field is non-empty (?? would use first non-null even if empty)
-                /* eslint-disable @typescript-eslint/prefer-nullish-coalescing -- intentional: treat empty string as absent */
-                ...((queryResponse.contactPersonEmail?.trim() ||
-                  queryResponse.contactPersonFirstName?.trim() ||
-                  queryResponse.contactPersonLastName?.trim() ||
-                  queryResponse.contactPersonPhone?.trim())
+
+                ...(queryResponse.contactPersonEmail?.trim() ||
+                queryResponse.contactPersonFirstName?.trim() ||
+                queryResponse.contactPersonLastName?.trim() ||
+                queryResponse.contactPersonPhone?.trim()
                   ? {
                       contactPerson: {
                         ...(queryResponse.contactPersonEmail?.trim()
@@ -1330,12 +1339,14 @@ export default class NcmecReporting {
                           : {}),
                         ...(queryResponse.contactPersonFirstName?.trim()
                           ? {
-                              firstName: queryResponse.contactPersonFirstName.trim(),
+                              firstName:
+                                queryResponse.contactPersonFirstName.trim(),
                             }
                           : {}),
                         ...(queryResponse.contactPersonLastName?.trim()
                           ? {
-                              lastName: queryResponse.contactPersonLastName.trim(),
+                              lastName:
+                                queryResponse.contactPersonLastName.trim(),
                             }
                           : {}),
                         ...(queryResponse.contactPersonPhone?.trim()
@@ -1348,7 +1359,6 @@ export default class NcmecReporting {
                       },
                     }
                   : {}),
-                /* eslint-enable @typescript-eslint/prefer-nullish-coalescing */
               },
               personOrUserReported: {
                 personOrUserReportedPerson: {
@@ -1476,7 +1486,7 @@ export default class NcmecReporting {
           // safeTracer's logging because those logs are sampled in DD. For
           // NCMEC submission errors we need to record all failures and be
           // able to see the logs
-          
+
           // eslint-disable-next-line no-console
           console.error('[NCMEC] ❌ Error during report submission:', e);
           // eslint-disable-next-line no-console
@@ -1484,7 +1494,7 @@ export default class NcmecReporting {
             message: e instanceof Error ? e.message : String(e),
             stack: e instanceof Error ? e.stack : undefined,
           });
-          
+
           // eslint-disable-next-line no-restricted-syntax
           logErrorJson({
             error: e,
@@ -1578,31 +1588,30 @@ export default class NcmecReporting {
     isTest: boolean,
   ) {
     const reportXML = js2xml(report, { compact: true });
-    
+
     // Save XML to file for review (development only)
     if (process.env.NODE_ENV === 'development') {
       try {
         const fs = await import('fs/promises');
         const path = await import('path');
-        
+
         // Create ncmec-reports directory if it doesn't exist
         const reportsDir = path.join(process.cwd(), 'ncmec-reports');
         await fs.mkdir(reportsDir, { recursive: true });
-        
+
         // Generate filename with timestamp and test indicator
         const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
         const testPrefix = isTest ? 'TEST-' : 'PROD-';
         const filename = `${testPrefix}${timestamp}.xml`;
         const filepath = path.join(reportsDir, filename);
-        
+
         // Write XML to file
         await fs.writeFile(filepath, reportXML, 'utf-8');
-        
       } catch (e) {
         // Silent fail - don't let file saving break the submission
       }
     }
-    
+
     const response = await this.#sendCyberTipRequest({
       cybertipAuthenticationCredentials,
       body: reportXML,
@@ -1614,10 +1623,13 @@ export default class NcmecReporting {
     if (responseJson.reportResponse.responseCode._text !== '0') {
       throw new Error('NCMEC report submission failed.');
     }
-    
+
     // eslint-disable-next-line no-console
-    console.log('[NCMEC] ✅ Report submitted successfully! Report ID:', responseJson.reportResponse.reportId._text);
-    
+    console.log(
+      '[NCMEC] ✅ Report submitted successfully! Report ID:',
+      responseJson.reportResponse.reportId._text,
+    );
+
     return {
       reportId: responseJson.reportResponse.reportId._text,
       xml: reportXML,
diff --git a/server/services/orgAwareSignalExecutionService/signalExecutionService.test.ts b/server/services/orgAwareSignalExecutionService/signalExecutionService.test.ts
index e33a7d7..539a876 100644
--- a/server/services/orgAwareSignalExecutionService/signalExecutionService.test.ts
+++ b/server/services/orgAwareSignalExecutionService/signalExecutionService.test.ts
@@ -14,14 +14,25 @@ describe('Signal Execution Service', () => {
     bankId === '1' ? ['a', 'b', 'c'] : bankId === '2' ? ['d', 'e', 'f'] : [],
   );
   const mockGetImageBank = jest.fn(async ({ bankId }) =>
-    bankId === 'test-bank' ? { id: 1, name: 'test-bank', hma_name: 'org_test-bank', description: null, enabled_ratio: 1.0, org_id: 'test-org', created_at: new Date(), updated_at: new Date() } : null,
+    bankId === 'test-bank'
+      ? {
+          id: 1,
+          name: 'test-bank',
+          hma_name: 'org_test-bank',
+          description: null,
+          enabled_ratio: 1.0,
+          org_id: 'test-org',
+          created_at: new Date(),
+          updated_at: new Date(),
+        }
+      : null,
   );
 
-  // eslint-disable-next-line better-mutation/no-mutation
+  // eslint-disable-next-line functional/immutable-data
   mockLocationsLoader.close = jest.fn();
-  // eslint-disable-next-line better-mutation/no-mutation
+  // eslint-disable-next-line functional/immutable-data
   (mockTextBankStringsLoader as any).close = jest.fn();
-  // eslint-disable-next-line better-mutation/no-mutation, @typescript-eslint/no-explicit-any
+  // eslint-disable-next-line functional/immutable-data, @typescript-eslint/no-explicit-any
   (mockGetImageBank as any).close = jest.fn();
 
   describe('getTransientRunSignalWithCache', () => {
@@ -31,12 +42,11 @@ describe('Signal Execution Service', () => {
       // `let` vars to defer the work until the test suite is actually running
       // (so we don't bother w/ it if this test suite is skipped, e.g., in which
       // case cleanup wouldn't happen).
-      /* eslint-disable better-mutation/no-mutation */
+
       container = await getBottleContainerWithIOMocks();
       signalsService = container.SignalsService;
       getPolicyActionPenalties =
         container.getPolicyActionPenaltiesEventuallyConsistent;
-      /* eslint-enable better-mutation/no-mutation */
     });
 
     afterAll(async () => {
@@ -123,7 +133,7 @@ describe('Signal Execution Service', () => {
       // signals don't hit the network. (The point of the mock is just so we can
       // spy on how many times runSignal was called.)
       const signalsServiceSpy = (await getBottle()).container.SignalsService;
-      // eslint-disable-next-line better-mutation/no-mutation
+      // eslint-disable-next-line functional/immutable-data
       signalsServiceSpy.runSignal = jest.fn(
         signalsServiceSpy.runSignal.bind(signalsServiceSpy),
       ) as any;
diff --git a/server/services/ruleAnomalyDetectionService/detectRulePassRateAnomaliesJob.test.ts b/server/services/ruleAnomalyDetectionService/detectRulePassRateAnomaliesJob.test.ts
index c788f5d..d1a8673 100644
--- a/server/services/ruleAnomalyDetectionService/detectRulePassRateAnomaliesJob.test.ts
+++ b/server/services/ruleAnomalyDetectionService/detectRulePassRateAnomaliesJob.test.ts
@@ -27,7 +27,7 @@ describe('Detect Rule Anomalies', () => {
       >;
 
     beforeAll(async () => {
-      /* eslint-disable better-mutation/no-mutation */
+      /* eslint-disable functional/immutable-data */
       const {
         Sequelize: models,
         ModerationConfigService,
@@ -39,7 +39,11 @@ describe('Detect Rule Anomalies', () => {
       // in different initial alarm statuses, to test all 9 combinations [i.e.,
       // starting and ending at one of (OK, ALARM, or INSUFFICENT_DATA), where
       // the start and end states can be the same].
-      const { org } = await createOrg(models, ModerationConfigService, ApiKeyService);
+      const { org } = await createOrg(
+        models,
+        ModerationConfigService,
+        ApiKeyService,
+      );
       const { org: org2 } = await createOrg(
         models,
         ModerationConfigService,
@@ -150,7 +154,7 @@ describe('Detect Rule Anomalies', () => {
         await Promise.all([org.destroy(), org2.destroy()]);
         await models.sequelize.close();
       };
-      /* eslint-enable better-mutation/no-mutation */
+      /* eslint-enable functional/immutable-data */
     });
 
     afterAll(async () => {
diff --git a/server/services/ruleAnomalyDetectionService/getRuleAnomalyDetectionStatistics.test.ts b/server/services/ruleAnomalyDetectionService/getRuleAnomalyDetectionStatistics.test.ts
index ad8d0e1..25b89d5 100644
--- a/server/services/ruleAnomalyDetectionService/getRuleAnomalyDetectionStatistics.test.ts
+++ b/server/services/ruleAnomalyDetectionService/getRuleAnomalyDetectionStatistics.test.ts
@@ -10,7 +10,13 @@ import makeGetRuleAnomalyDetectionStatistics from './getRuleAnomalyDetectionStat
  * least makes sure we can't change inadvertently change the generated queries.
  */
 describe('getRuleAnomalyDetectionStatistics', () => {
-  let queryMock: MockedFn<(query: string, tracer: any, binds?: readonly unknown[]) => Promise<unknown[]>>;
+  let queryMock: MockedFn<
+    (
+      query: string,
+      tracer: any,
+      binds?: readonly unknown[],
+    ) => Promise<unknown[]>
+  >;
   let getRulePassStatistics: Dependencies['getRuleAnomalyDetectionStatistics'];
 
   beforeAll(() => {
@@ -26,7 +32,7 @@ describe('getRuleAnomalyDetectionStatistics', () => {
     ];
 
     // Scope of this is just the test suite, so mutation should be ok.
-    // eslint-disable-next-line better-mutation/no-mutation
+
     queryMock = jest.fn() as any;
     queryMock.mockResolvedValue(queryResult);
 
@@ -39,7 +45,7 @@ describe('getRuleAnomalyDetectionStatistics', () => {
     };
 
     // Scope of this is just the test suite, so mutation should be ok.
-    // eslint-disable-next-line better-mutation/no-mutation
+
     getRulePassStatistics = makeGetRuleAnomalyDetectionStatistics(
       dataWarehouseMock,
       {} as any,
diff --git a/server/services/ruleHistoryService/ruleHistoryService.test.ts b/server/services/ruleHistoryService/ruleHistoryService.test.ts
index 3fe1062..8be3540 100644
--- a/server/services/ruleHistoryService/ruleHistoryService.test.ts
+++ b/server/services/ruleHistoryService/ruleHistoryService.test.ts
@@ -12,7 +12,7 @@ describe('RuleHistory Service', () => {
       const deps = await getBottle();
 
       // Scope of this is just the test suite, so reassignment should be ok.
-      // eslint-disable-next-line better-mutation/no-mutation
+
       db = deps.container.KyselyPg;
     });
 
diff --git a/server/services/signalAuthService/signalAuthService.ts b/server/services/signalAuthService/signalAuthService.ts
index 41ccf4b..81671fb 100644
--- a/server/services/signalAuthService/signalAuthService.ts
+++ b/server/services/signalAuthService/signalAuthService.ts
@@ -1,10 +1,8 @@
-/* eslint-disable max-lines */
 import { type Kysely } from 'kysely';
 
 import { inject } from '../../iocContainer/utils.js';
 import { type Cached } from '../../utils/caching.js';
-import { type JsonOf } from '../../utils/encoding.js';
-import { jsonParse, jsonStringify } from '../../utils/encoding.js';
+import { jsonParse, jsonStringify, type JsonOf } from '../../utils/encoding.js';
 import { type NonEmptyString } from '../../utils/typescript-types.js';
 import { Integration } from '../signalsService/index.js';
 import { type SignalAuthServicePg } from './dbTypes.js';
@@ -136,7 +134,9 @@ class SignalAuthService {
     }
     if (integrationId === Integration.ZENTROPI) {
       const c = await this.get(Integration.ZENTROPI, orgId);
-      return c != null ? { apiKey: c.apiKey, labelerVersions: c.labelerVersions } : undefined;
+      return c != null
+        ? { apiKey: c.apiKey, labelerVersions: c.labelerVersions }
+        : undefined;
     }
     const row = await this.pg
       .selectFrom('signal_auth_service.integration_configs')
@@ -277,8 +277,8 @@ function makeImplementations(
           labelerVersions: Array.isArray(labelerVersions)
             ? (labelerVersions as ZentropiLabelerVersion[])
             : typeof labelerVersions === 'string'
-              ? (jsonParse(labelerVersions as JsonOf<ZentropiLabelerVersion[]>))
-              : [],
+            ? jsonParse(labelerVersions as JsonOf<ZentropiLabelerVersion[]>)
+            : [],
         };
       },
       set: async (orgId: string, credential: ZentropiCredential) => {
@@ -308,8 +308,8 @@ function makeImplementations(
           labelerVersions: Array.isArray(returnedVersions)
             ? (returnedVersions as ZentropiLabelerVersion[])
             : typeof returnedVersions === 'string'
-              ? (jsonParse(returnedVersions as JsonOf<ZentropiLabelerVersion[]>))
-              : [],
+            ? jsonParse(returnedVersions as JsonOf<ZentropiLabelerVersion[]>)
+            : [],
         };
       },
       delete: async (orgId: string) => {
diff --git a/server/services/signalsService/SignalsService.ts b/server/services/signalsService/SignalsService.ts
index d2e97e0..cb3adb3 100644
--- a/server/services/signalsService/SignalsService.ts
+++ b/server/services/signalsService/SignalsService.ts
@@ -1,8 +1,7 @@
-/* eslint-disable max-lines */
-import { type ConsumerDirectives } from '../../lib/cache/index.js';
 import { type ReadonlyDeep, type Simplify } from 'type-fest';
 
 import { inject, type Dependencies } from '../../iocContainer/index.js';
+import { type ConsumerDirectives } from '../../lib/cache/index.js';
 import { isTaggedItemData } from '../../models/rules/item-type-fields.js';
 import { jsonStringify } from '../../utils/encoding.js';
 import { CoopError, ErrorType, makeNotFoundError } from '../../utils/errors.js';
@@ -60,12 +59,7 @@ const publicSignalProps = [
  */
 export type Signal = Simplify<
   Pick<
-    SignalBase<
-      SignalInputType,
-      SignalOutputType,
-      unknown,
-      SignalType | string
-    >,
+    SignalBase<SignalInputType, SignalOutputType, unknown, SignalType | string>,
     (typeof publicSignalProps)[number]
   >
 >;
@@ -138,10 +132,7 @@ export class SignalsService {
     const cachedCredentialGetters =
       makeCachedCredentialGetters(signalAuthService);
 
-    const cachedFetchers = makeCachedFetchers(
-      fetchHTTP,
-      tracer,
-    );
+    const cachedFetchers = makeCachedFetchers(fetchHTTP, tracer);
 
     this.builtInSignalsByType = instantiateBuiltInSignals(
       cachedCredentialGetters,
@@ -156,7 +147,9 @@ export class SignalsService {
     const pluginEntries = getIntegrationRegistry().getPluginEntries();
     const pluginSignals = loadPluginSignals(pluginEntries, signalAuthService);
     const builtInIds = new Set(Object.keys(this.builtInSignalsByType));
-    const collision = Object.keys(pluginSignals).find((id) => builtInIds.has(id));
+    const collision = Object.keys(pluginSignals).find((id) =>
+      builtInIds.has(id),
+    );
     if (collision != null) {
       throw new Error(
         `Plugin signal type "${collision}" collides with a built-in signal; use a different signalTypeId.`,
@@ -334,7 +327,12 @@ export class SignalsService {
 
   #signalInstanceToPublicSignal(
     it: ReadonlyDeep<
-      SignalBase<SignalInputType, SignalOutputType, unknown, SignalType | string>
+      SignalBase<
+        SignalInputType,
+        SignalOutputType,
+        unknown,
+        SignalType | string
+      >
     >,
   ) {
     // This used to be implemented as simply `safePick(it, publicSignalProps)`,
diff --git a/server/services/signalsService/helpers/instantiateBuiltInSignals.ts b/server/services/signalsService/helpers/instantiateBuiltInSignals.ts
index 466dace..2815b04 100644
--- a/server/services/signalsService/helpers/instantiateBuiltInSignals.ts
+++ b/server/services/signalsService/helpers/instantiateBuiltInSignals.ts
@@ -1,4 +1,3 @@
-/* eslint-disable max-lines */
 import { type ItemIdentifier } from '@roostorg/types';
 
 import type { AggregationsService } from '../../aggregationsService/index.js';
diff --git a/server/services/signalsService/signals/aggregation/AggregationSignal.test.ts b/server/services/signalsService/signals/aggregation/AggregationSignal.test.ts
index a3d56d1..0d4197d 100644
--- a/server/services/signalsService/signals/aggregation/AggregationSignal.test.ts
+++ b/server/services/signalsService/signals/aggregation/AggregationSignal.test.ts
@@ -46,17 +46,17 @@ describe('AggregationSignal', () => {
 
     // Spy on aggregation service functions.
     const aggregationsServiceSpy = AggregationsService;
-    // eslint-disable-next-line better-mutation/no-mutation
+    // eslint-disable-next-line functional/immutable-data
     aggregationsServiceSpy.updateAggregation = jest.fn(
       aggregationsServiceSpy.updateAggregation.bind(aggregationsServiceSpy),
     );
-    // eslint-disable-next-line better-mutation/no-mutation
+    // eslint-disable-next-line functional/immutable-data
     aggregationsServiceSpy.evaluateAggregation = jest.fn(
       aggregationsServiceSpy.evaluateAggregation.bind(aggregationsServiceSpy),
     );
 
     const dateProvider = new TestDateProvider();
-    // eslint-disable-next-line better-mutation/no-mutation
+    // eslint-disable-next-line functional/immutable-data
     deps['ActionPublisher'].publishAction = jest.fn().mockReturnValue(true);
 
     const rule = await RuleAPIDataSource.createContentRule(
@@ -148,7 +148,7 @@ describe('AggregationSignal', () => {
     async ({ itemType, org, dateProvider, deps }) => {
       // Clear Redis to ensure clean state for aggregation counters
       await deps.IORedis.flushdb();
-      
+
       const creatorId = 'some-creator-id';
       const creatorTypeId = 'some-creator-type-id';
 
@@ -236,7 +236,7 @@ describe('AggregationSignal', () => {
           creatorTypeId,
         },
       );
-      
+
       const ruleResultsAfter2 = await deps.RuleEngine.runEnabledRules(
         itemSubmission2,
         toCorrelationId({
@@ -262,7 +262,7 @@ describe('AggregationSignal', () => {
           creatorTypeId,
         },
       );
-      
+
       const ruleResultsAnotherUser = await deps.RuleEngine.runEnabledRules(
         itemSubmissionAnotherUser,
         toCorrelationId({
@@ -292,7 +292,7 @@ describe('AggregationSignal', () => {
           creatorTypeId,
         },
       );
-      
+
       const ruleResultsFailCondition = await deps.RuleEngine.runEnabledRules(
         itemSubmissionFailCondition,
         toCorrelationId({
@@ -319,7 +319,7 @@ describe('AggregationSignal', () => {
           creatorTypeId,
         },
       );
-      
+
       const ruleResultsAfter3 = await deps.RuleEngine.runEnabledRules(
         itemSubmission3,
         toCorrelationId({
@@ -345,7 +345,7 @@ describe('AggregationSignal', () => {
           creatorTypeId,
         },
       );
-      
+
       const actionsTriggeredAfter4 = await (
         await deps.RuleEngine.runEnabledRules(
           itemSubmission4,
diff --git a/server/services/signalsService/signals/third_party_signals/google/content_safety/GoogleContentSafetyImageSignal.ts b/server/services/signalsService/signals/third_party_signals/google/content_safety/GoogleContentSafetyImageSignal.ts
index 461653e..0915a31 100644
--- a/server/services/signalsService/signals/third_party_signals/google/content_safety/GoogleContentSafetyImageSignal.ts
+++ b/server/services/signalsService/signals/third_party_signals/google/content_safety/GoogleContentSafetyImageSignal.ts
@@ -76,7 +76,7 @@ export default class GoogleContentSafetyImageSignal extends SignalBase<
 
   override async getDisabledInfo(orgId: string) {
     const credential = await this.getGoogleContentSafetyCredentials(orgId);
-    // eslint-disable-next-line security/detect-possible-timing-attacks
+
     return !credential?.apiKey
       ? {
           disabled: true as const,
diff --git a/server/services/signalsService/signals/third_party_signals/google/content_safety/googleContentSafetyLib.ts b/server/services/signalsService/signals/third_party_signals/google/content_safety/googleContentSafetyLib.ts
index ab48dc1..7814705 100644
--- a/server/services/signalsService/signals/third_party_signals/google/content_safety/googleContentSafetyLib.ts
+++ b/server/services/signalsService/signals/third_party_signals/google/content_safety/googleContentSafetyLib.ts
@@ -88,7 +88,7 @@ export class GoogleContentSafetyClient {
         url,
         {
           method: 'post',
-          headers: {'Content-Type': 'application/json'},
+          headers: { 'Content-Type': 'application/json' },
           body: jsonStringify(reqBody),
         },
         this.timeoutMs,
@@ -130,7 +130,6 @@ export async function runGoogleContentSafetyImageImpl(
   const { value, orgId } = input;
   const credential = await getGoogleContentSafetyCredentials(orgId);
 
-  // eslint-disable-next-line security/detect-possible-timing-attacks
   if (!credential?.apiKey) {
     throw new Error('Missing API credentials');
   }
@@ -174,11 +173,7 @@ export async function getGoogleContentSafetyScores(
 
   let imageBuffer: Buffer;
   try {
-    imageBuffer = await fetchImage(
-      fetchHTTP,
-      imageUrl,
-      IMAGE_FETCH_TIMEOUT_MS,
-    );
+    imageBuffer = await fetchImage(fetchHTTP, imageUrl, IMAGE_FETCH_TIMEOUT_MS);
   } catch (e) {
     if (safeGet(e, ['name']) === 'ResponseExceededMaxSizeError') {
       throw makeSignalPermanentError('Response too large', {
diff --git a/server/services/signalsService/signals/third_party_signals/open_ai/moderation/openAIModerationUtils.ts b/server/services/signalsService/signals/third_party_signals/open_ai/moderation/openAIModerationUtils.ts
index 9bd372f..5967a03 100644
--- a/server/services/signalsService/signals/third_party_signals/open_ai/moderation/openAIModerationUtils.ts
+++ b/server/services/signalsService/signals/third_party_signals/open_ai/moderation/openAIModerationUtils.ts
@@ -85,7 +85,6 @@ export async function runOpenAiModerationImpl(
   const { value, orgId } = input;
   const credential = await getOpenAiCredentials(orgId);
 
-  // eslint-disable-next-line security/detect-possible-timing-attacks
   if (!credential?.apiKey) {
     throw new Error('Missing API credentials');
   }
diff --git a/server/services/signalsService/signals/third_party_signals/open_ai/whisper/OpenAiWhisperTranscriptionSignal.ts b/server/services/signalsService/signals/third_party_signals/open_ai/whisper/OpenAiWhisperTranscriptionSignal.ts
index 6e5c3c7..84fb08d 100644
--- a/server/services/signalsService/signals/third_party_signals/open_ai/whisper/OpenAiWhisperTranscriptionSignal.ts
+++ b/server/services/signalsService/signals/third_party_signals/open_ai/whisper/OpenAiWhisperTranscriptionSignal.ts
@@ -186,7 +186,6 @@ export default class OpenAiWhisperTranscriptionSignal extends SignalBase<
     const { value } = input;
     const credential = await this.getOpenAiCredentials(input.orgId);
 
-    // eslint-disable-next-line security/detect-possible-timing-attacks
     if (!credential || !credential.apiKey) {
       throw new Error('Missing API credentials');
     }
diff --git a/server/services/signalsService/signals/third_party_signals/zentropi/zentropiUtils.ts b/server/services/signalsService/signals/third_party_signals/zentropi/zentropiUtils.ts
index 00902d5..91f4c11 100644
--- a/server/services/signalsService/signals/third_party_signals/zentropi/zentropiUtils.ts
+++ b/server/services/signalsService/signals/third_party_signals/zentropi/zentropiUtils.ts
@@ -13,10 +13,7 @@ export interface ZentropiResponse {
   explanation?: string;
 }
 
-export type FetchZentropiScores = Bind1<
-  typeof getZentropiScores,
-  FetchHTTP
->;
+export type FetchZentropiScores = Bind1<typeof getZentropiScores, FetchHTTP>;
 
 export async function getZentropiScores(
   fetchHTTP: FetchHTTP,
@@ -66,7 +63,7 @@ export async function runZentropiLabelerImpl(
   const { value, orgId, subcategory } = input;
 
   const credential = await getZentropiCredentials(orgId);
-  // eslint-disable-next-line security/detect-possible-timing-attacks
+
   if (!credential?.apiKey) {
     throw new Error('Missing Zentropi API credentials');
   }
@@ -96,4 +93,3 @@ export async function runZentropiLabelerImpl(
     outputType: { scalarType: ScalarTypes.NUMBER },
   };
 }
-
diff --git a/server/services/userStatisticsService/computeUserScore.test.ts b/server/services/userStatisticsService/computeUserScore.test.ts
index 5cf9c31..a1e4799 100644
--- a/server/services/userStatisticsService/computeUserScore.test.ts
+++ b/server/services/userStatisticsService/computeUserScore.test.ts
@@ -1,4 +1,3 @@
-// eslint-disable-next-line import/no-extraneous-dependencies
 import { computeUserScore } from './computeUserScore.js';
 
 describe('computeUserScore', () => {
diff --git a/server/services/userStatisticsService/computeUserScore.ts b/server/services/userStatisticsService/computeUserScore.ts
index 30fb58b..23992e5 100644
--- a/server/services/userStatisticsService/computeUserScore.ts
+++ b/server/services/userStatisticsService/computeUserScore.ts
@@ -72,7 +72,6 @@ export function computeUserScore(
       const { itemSubmissionIds, actionId, policyId } = stats;
 
       for (const submissionId of itemSubmissionIds) {
-        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
         res[submissionId] = (res[submissionId] ?? []).concat(
           getPenaltyKey({ actionId, policyId }),
         );
@@ -106,7 +105,6 @@ export function computeUserScore(
     .concat(itemSubmissionMostSeverePenaltyKeys.map((it) => [it, 1] as const))
     .reduce(
       (acc, [penaltyKey, count]) => {
-        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
         acc[penaltyKey] = (acc[penaltyKey] ?? 0) + count;
         return acc;
       },
diff --git a/server/services/userStatisticsService/fetchUserActionStatistics.test.ts b/server/services/userStatisticsService/fetchUserActionStatistics.test.ts
index cea7fc3..e72488c 100644
--- a/server/services/userStatisticsService/fetchUserActionStatistics.test.ts
+++ b/server/services/userStatisticsService/fetchUserActionStatistics.test.ts
@@ -7,8 +7,8 @@ import {
 } from 'kysely';
 
 import { type Dependencies } from '../../iocContainer/index.js';
-import { makeMockWarehouseDialect } from '../../test/stubs/makeMockWarehouseKyselyDialect.js';
 import { type MockedFn } from '../../test/mockHelpers/jestMocks.js';
+import { makeMockWarehouseDialect } from '../../test/stubs/makeMockWarehouseKyselyDialect.js';
 import { safePick } from '../../utils/misc.js';
 import { makeFetchUserActionStatistics } from './fetchUserActionStatistics.js';
 
@@ -26,7 +26,7 @@ describe('fetchUserActionStatistics', () => {
     // This mutation is safe (while we're not running tests concurrently) as
     // it's local to the test suite. Consider using the `makeTestWithFixture`
     // helper instead to make a local copy of this state for each test.
-    // eslint-disable-next-line better-mutation/no-mutation
+
     warehouseMock = jest
       .fn<DatabaseConnection['executeQuery']>()
       .mockResolvedValue({ rows: [] });
@@ -34,7 +34,7 @@ describe('fetchUserActionStatistics', () => {
     // This mutation is safe (while we're not running tests concurrently) as
     // it's local to the test suite. Consider using the `makeTestWithFixture`
     // helper instead to make a local copy of this state for each test.
-    // eslint-disable-next-line better-mutation/no-mutation
+
     const kysely = new Kysely({
       dialect: makeMockWarehouseDialect(warehouseMock),
     });
@@ -43,7 +43,6 @@ describe('fetchUserActionStatistics', () => {
       destroy: jest.fn(async () => {}),
     };
 
-    // eslint-disable-next-line better-mutation/no-mutation
     sut = makeFetchUserActionStatistics(dialectMock);
   });
 
diff --git a/server/services/userStatisticsService/fetchUserSubmissionStatistics.test.ts b/server/services/userStatisticsService/fetchUserSubmissionStatistics.test.ts
index 0000dec..0f2b770 100644
--- a/server/services/userStatisticsService/fetchUserSubmissionStatistics.test.ts
+++ b/server/services/userStatisticsService/fetchUserSubmissionStatistics.test.ts
@@ -2,8 +2,8 @@ import { randomUUID } from 'crypto';
 import { Kysely, type CompiledQuery, type QueryResult } from 'kysely';
 
 import { type Dependencies } from '../../iocContainer/index.js';
-import { makeMockWarehouseDialect } from '../../test/stubs/makeMockWarehouseKyselyDialect.js';
 import { type MockedFn } from '../../test/mockHelpers/jestMocks.js';
+import { makeMockWarehouseDialect } from '../../test/stubs/makeMockWarehouseKyselyDialect.js';
 import { safePick } from '../../utils/misc.js';
 import { makeFetchUserSubmissionStatistics } from './fetchUserSubmissionStatistics.js';
 
@@ -17,13 +17,13 @@ describe('fetchUserSubmissionStatistics', () => {
     // This mutation is safe (while we're not running tests concurrently) as
     // it's local to the test suite. Consider using the `makeTestWithFixture`
     // helper instead to make a local copy of this state for each test.
-    // eslint-disable-next-line better-mutation/no-mutation
+
     warehouseMock = jest.fn(async (_it) => Promise.resolve({ rows: [] }));
 
     // This mutation is safe (while we're not running tests concurrently) as
     // it's local to the test suite. Consider using the `makeTestWithFixture`
     // helper instead to make a local copy of this state for each test.
-    // eslint-disable-next-line better-mutation/no-mutation
+
     const kysely = new Kysely({
       dialect: makeMockWarehouseDialect(warehouseMock),
     });
@@ -32,7 +32,6 @@ describe('fetchUserSubmissionStatistics', () => {
       destroy: jest.fn(async () => {}),
     };
 
-    // eslint-disable-next-line better-mutation/no-mutation
     sut = makeFetchUserSubmissionStatistics(dialectMock);
   });
 
diff --git a/server/services/userStrikeService/userStrikeService.test.ts b/server/services/userStrikeService/userStrikeService.test.ts
index c1e06c0..cc09751 100644
--- a/server/services/userStrikeService/userStrikeService.test.ts
+++ b/server/services/userStrikeService/userStrikeService.test.ts
@@ -10,10 +10,9 @@ describe('Item Investigation Service', () => {
   beforeAll(async () => {
     // The mutation should be ok here since this is initial setup in a
     // beforeAll; it doesn't involve reset state for each test in the suite
-    /* eslint-disable better-mutation/no-mutation */
+
     ({ container } = await getBottle());
     userStrikeService = container.UserStrikeService;
-    /* eslint-enable better-mutation/no-mutation */
   });
   afterAll(async () => {
     await container.closeSharedResourcesForShutdown();
diff --git a/server/storage/dataWarehouse/ClickhouseAdapter.ts b/server/storage/dataWarehouse/ClickhouseAdapter.ts
index eaf12d0..1f1615a 100644
--- a/server/storage/dataWarehouse/ClickhouseAdapter.ts
+++ b/server/storage/dataWarehouse/ClickhouseAdapter.ts
@@ -1,4 +1,3 @@
-// eslint-disable-next-line import/no-extraneous-dependencies
 import { createClient, type ClickHouseClient } from '@clickhouse/client';
 import {
   Kysely,
@@ -17,8 +16,8 @@ import {
 
 import { formatClickhouseQuery } from '../../plugins/warehouse/utils/clickhouseSql.js';
 import type {
-  IDataWarehouseDialect,
   DataWarehousePoolSettings,
+  IDataWarehouseDialect,
 } from './IDataWarehouse.js';
 
 export interface ClickhouseConnectionSettings {
@@ -31,8 +30,13 @@ export interface ClickhouseConnectionSettings {
 }
 
 function createConnection(client: ClickHouseClient): DatabaseConnection {
-  const execute = async <R>(compiledQuery: CompiledQuery): Promise<QueryResult<R>> => {
-    const statement = formatClickhouseQuery(compiledQuery.sql, compiledQuery.parameters);
+  const execute = async <R>(
+    compiledQuery: CompiledQuery,
+  ): Promise<QueryResult<R>> => {
+    const statement = formatClickhouseQuery(
+      compiledQuery.sql,
+      compiledQuery.parameters,
+    );
     const result = await client.query({
       query: statement,
       format: 'JSONEachRow',
@@ -45,7 +49,9 @@ function createConnection(client: ClickHouseClient): DatabaseConnection {
   return {
     executeQuery: execute,
     streamQuery<R>(compiledQuery: CompiledQuery) {
-      return (async function* iterator(): AsyncIterableIterator<QueryResult<R>> {
+      return (async function* iterator(): AsyncIterableIterator<
+        QueryResult<R>
+      > {
         yield await execute<R>(compiledQuery);
       })();
     },
@@ -64,13 +70,19 @@ function createDriver(client: ClickHouseClient): Driver {
       _connection: DatabaseConnection,
       _settings: TransactionSettings,
     ) {
-      throw new Error('ClickHouse does not support multi-statement transactions');
+      throw new Error(
+        'ClickHouse does not support multi-statement transactions',
+      );
     },
     async commitTransaction() {
-      throw new Error('ClickHouse does not support multi-statement transactions');
+      throw new Error(
+        'ClickHouse does not support multi-statement transactions',
+      );
     },
     async rollbackTransaction() {
-      throw new Error('ClickHouse does not support multi-statement transactions');
+      throw new Error(
+        'ClickHouse does not support multi-statement transactions',
+      );
     },
     async releaseConnection(_connection: DatabaseConnection) {
       // Nothing to release; HTTP client pools internally.
@@ -112,7 +124,8 @@ export class ClickhouseKyselyAdapter implements IDataWarehouseDialect {
 
     const url = `${protocol}://${connectionSettings.host}:${port}`;
     const rawPassword = connectionSettings.password;
-    const password = rawPassword && rawPassword.length > 0 ? rawPassword : undefined;
+    const password =
+      rawPassword && rawPassword.length > 0 ? rawPassword : undefined;
     this.client = createClient({
       url,
       username: connectionSettings.username,
@@ -137,4 +150,3 @@ export class ClickhouseKyselyAdapter implements IDataWarehouseDialect {
     await this.kysely.destroy();
   }
 }
-
diff --git a/server/storage/dataWarehouse/DataWarehouseFactory.ts b/server/storage/dataWarehouse/DataWarehouseFactory.ts
index b46322f..9f964e1 100644
--- a/server/storage/dataWarehouse/DataWarehouseFactory.ts
+++ b/server/storage/dataWarehouse/DataWarehouseFactory.ts
@@ -3,14 +3,27 @@
  */
 
 /* eslint-disable max-classes-per-file */
+import {
+  ClickhouseAnalyticsAdapter as ClickhouseAnalyticsPlugin,
+  NoOpAnalyticsAdapter,
+  type AnalyticsEventInput,
+  type IAnalyticsAdapter,
+} from '../../plugins/analytics/index.js';
+import {
+  ClickhouseWarehouseAdapter,
+  NoOpWarehouseAdapter,
+  type IWarehouseAdapter,
+} from '../../plugins/warehouse/index.js';
+import { assertUnreachable } from '../../utils/misc.js';
+import type SafeTracer from '../../utils/SafeTracer.js';
 import {
   ClickhouseKyselyAdapter,
   type ClickhouseConnectionSettings,
 } from './ClickhouseAdapter.js';
 import {
+  type DataWarehousePoolSettings,
   type IDataWarehouse,
   type IDataWarehouseDialect,
-  type DataWarehousePoolSettings,
   type DataWarehouseProvider as IDataWarehouseProvider,
   type TransactionFunction,
 } from './IDataWarehouse.js';
@@ -22,33 +35,14 @@ import type {
   IDataWarehouseAnalytics,
 } from './IDataWarehouseAnalytics.js';
 import { PostgresAnalyticsAdapter } from './PostgresAnalyticsAdapter.js';
-import {
-  ClickhouseWarehouseAdapter,
-  NoOpWarehouseAdapter,
-  type IWarehouseAdapter,
-} from '../../plugins/warehouse/index.js';
-import {
-  ClickhouseAnalyticsAdapter as ClickhouseAnalyticsPlugin,
-  NoOpAnalyticsAdapter,
-  type IAnalyticsAdapter,
-  type AnalyticsEventInput,
-} from '../../plugins/analytics/index.js';
-import { assertUnreachable } from '../../utils/misc.js';
-import type SafeTracer from '../../utils/SafeTracer.js';
 
 /**
  * Concrete data warehouse providers
  * Extend this type to add new warehouse implementations
  */
-export type DataWarehouseProvider =
-  | 'clickhouse'
-  | 'postgresql'
-  | 'noop';
+export type DataWarehouseProvider = 'clickhouse' | 'postgresql' | 'noop';
 
-export type AnalyticsProvider =
-  | 'clickhouse'
-  | 'postgresql'
-  | 'noop';
+export type AnalyticsProvider = 'clickhouse' | 'postgresql' | 'noop';
 
 // Re-export the interface provider type for external use
 export type { IDataWarehouseProvider };
@@ -94,7 +88,10 @@ class WarehouseAdapterBridge implements IDataWarehouse {
     };
 
     return tracer.addActiveSpan(
-      { resource: `${this.provider}.client`, operation: `${this.provider}.query` },
+      {
+        resource: `${this.provider}.client`,
+        operation: `${this.provider}.query`,
+      },
       runQuery,
     );
   }
@@ -125,9 +122,7 @@ class WarehouseAdapterBridge implements IDataWarehouse {
   }
 }
 
-class AnalyticsAdapterBridge
-  implements IDataWarehouseAnalytics
-{
+class AnalyticsAdapterBridge implements IDataWarehouseAnalytics {
   constructor(
     private readonly provider: DataWarehouseProvider,
     private readonly adapter: IAnalyticsAdapter,
@@ -195,10 +190,7 @@ export class DataWarehouseFactory {
   static createDataWarehouse(config: DataWarehouseConfig): IDataWarehouse {
     switch (config.provider) {
       case 'noop':
-        return new WarehouseAdapterBridge(
-          'noop',
-          new NoOpWarehouseAdapter(),
-        );
+        return new WarehouseAdapterBridge('noop', new NoOpWarehouseAdapter());
       case 'clickhouse':
         return new WarehouseAdapterBridge(
           'clickhouse',
@@ -207,11 +199,16 @@ export class DataWarehouseFactory {
           }),
         );
       case 'postgresql':
-        return new WarehouseAdapterBridge('postgresql', new NoOpWarehouseAdapter());
+        return new WarehouseAdapterBridge(
+          'postgresql',
+          new NoOpWarehouseAdapter(),
+        );
       default:
         return assertUnreachable(
           config,
-          `Unknown data warehouse provider: ${(config as DataWarehouseConfig).provider}`,
+          `Unknown data warehouse provider: ${
+            (config as DataWarehouseConfig).provider
+          }`,
         );
     }
   }
@@ -232,7 +229,9 @@ export class DataWarehouseFactory {
       default:
         return assertUnreachable(
           config,
-          `Unknown data warehouse provider: ${(config as DataWarehouseConfig).provider}`,
+          `Unknown data warehouse provider: ${
+            (config as DataWarehouseConfig).provider
+          }`,
         );
     }
   }
@@ -281,7 +280,7 @@ export class DataWarehouseFactory {
   /**
    * Create configuration from environment variables
    */
-  // eslint-disable-next-line complexity
+
   static createConfigFromEnv(): DataWarehouseConfig {
     const provider = (process.env.WAREHOUSE_ADAPTER ??
       process.env.DATA_WAREHOUSE_PROVIDER ??
@@ -307,7 +306,9 @@ export class DataWarehouseFactory {
             username: process.env.CLICKHOUSE_USERNAME ?? 'default',
             password: process.env.CLICKHOUSE_PASSWORD ?? '',
             database: process.env.CLICKHOUSE_DATABASE ?? 'default',
-            protocol: (process.env.CLICKHOUSE_PROTOCOL ?? 'http') as 'http' | 'https',
+            protocol: (process.env.CLICKHOUSE_PROTOCOL ?? 'http') as
+              | 'http'
+              | 'https',
           },
           pool: {
             max: process.env.CLICKHOUSE_POOL_SIZE
@@ -337,4 +338,3 @@ export class DataWarehouseFactory {
     }
   }
 }
-
diff --git a/server/test/extendExpect.ts b/server/test/extendExpect.ts
index b476b02..65a4afb 100644
--- a/server/test/extendExpect.ts
+++ b/server/test/extendExpect.ts
@@ -52,7 +52,7 @@ expect.extend({
         keyof typeof propertyMatchers;
 
       if (isJsonPath(k)) {
-        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete, functional/immutable-data -- derived snapshot matchers
         delete generatedPropertyMatchers[key];
         JSONPath({ path: k, json: received, resultType: 'path' }).forEach(
           (pathStr: string) => {
diff --git a/server/test/mockHelpers/jestMocks.ts b/server/test/mockHelpers/jestMocks.ts
index 5da3c50..6e69df7 100644
--- a/server/test/mockHelpers/jestMocks.ts
+++ b/server/test/mockHelpers/jestMocks.ts
@@ -40,7 +40,7 @@ export function mocked<T extends object, Keys extends FunctionKeys<T>>(
   // instanceof checks still work.
   const mock = Object.create(obj);
   for (const k of keys) {
-    // eslint-disable-next-line better-mutation/no-mutation
+    // eslint-disable-next-line functional/immutable-data
     mock[k] = jest.fn((obj[k] as AnyFn).bind(obj));
   }
 
diff --git a/server/test/setupMockedServer.ts b/server/test/setupMockedServer.ts
index e4b6d29..59cf319 100644
--- a/server/test/setupMockedServer.ts
+++ b/server/test/setupMockedServer.ts
@@ -7,16 +7,16 @@ import * as superTest from 'supertest';
 
 import getBottle, { type Dependencies } from '../iocContainer/index.js';
 import makeServer from '../server.js';
-import SafeTracer from '../utils/SafeTracer.js';
 import { type IDataWarehouse } from '../storage/dataWarehouse/IDataWarehouse.js';
 import type { IDataWarehouseAnalytics } from '../storage/dataWarehouse/IDataWarehouseAnalytics.js';
+import SafeTracer from '../utils/SafeTracer.js';
 
 /**
  * Occassionally, we make a request that's supposed to error, so this function
  * lets us temporarily suppress console messages, to keep our output a bit nicer.
  */
 export function disableConsoleLogging() {
-  /* eslint-disable better-mutation/no-mutation */
+  /* eslint-disable functional/immutable-data */
   const noop = () => {};
   const { log, error } = console;
   console.log = noop;
@@ -25,7 +25,7 @@ export function disableConsoleLogging() {
     console.log = log;
     console.error = error;
   };
-  /* eslint-enable better-mutation/no-mutation */
+  /* eslint-enable functional/immutable-data */
 }
 
 export async function makeMockedServer() {
@@ -40,15 +40,14 @@ export async function getBottleContainerWithIOMocks() {
 
   // The mutation rule below is a false positive, as we're just doing
   // initial setup on this mock object before exposing it.
-  /* eslint-disable better-mutation/no-mutation */
-  const tracer = new SafeTracer(new otel.ProxyTracerProvider().getTracer('noop'));
+
+  const tracer = new SafeTracer(
+    new otel.ProxyTracerProvider().getTracer('noop'),
+  );
 
   const queryMock = jest.fn(
-    async (
-      _query: string,
-      _tracer: SafeTracer,
-      _binds?: readonly unknown[],
-    ) => [] as unknown[],
+    async (_query: string, _tracer: SafeTracer, _binds?: readonly unknown[]) =>
+      [] as unknown[],
   ) as jest.MockedFunction<IDataWarehouse['query']>;
 
   const transactionImpl: IDataWarehouse['transaction'] = async (fn) =>
@@ -58,7 +57,9 @@ export async function getBottleContainerWithIOMocks() {
 
   const startMock = jest.fn(() => {}) as IDataWarehouse['start'];
   const closeMock = jest.fn(async () => {}) as IDataWarehouse['close'];
-  const getProviderMock = jest.fn(() => 'clickhouse') as IDataWarehouse['getProvider'];
+  const getProviderMock = jest.fn(
+    () => 'clickhouse',
+  ) as IDataWarehouse['getProvider'];
 
   const dataWarehouseMock: IDataWarehouse = {
     query: queryMock,
@@ -76,13 +77,9 @@ export async function getBottleContainerWithIOMocks() {
     flushPendingWrites: jest.fn(async () => {}),
     close: jest.fn(async () => {}),
   } as unknown as jest.Mocked<IDataWarehouseAnalytics>;
-  /* eslint-enable better-mutation/no-mutation */
 
   bottle.value('DataWarehouse', dataWarehouseMock);
-  bottle.value(
-    'DataWarehouseAnalytics',
-    analyticsMock,
-  );
+  bottle.value('DataWarehouseAnalytics', analyticsMock);
   bottle.value('Tracer', tracer);
   return bottle.container as unknown as Omit<
     Dependencies,
diff --git a/server/test/stubs/getRuleAnomalyDetectionStatistics.ts b/server/test/stubs/getRuleAnomalyDetectionStatistics.ts
index 003cb59..1ebc36e 100644
--- a/server/test/stubs/getRuleAnomalyDetectionStatistics.ts
+++ b/server/test/stubs/getRuleAnomalyDetectionStatistics.ts
@@ -1,6 +1,5 @@
 import { readFileSync } from 'fs';
 import { dirname, join } from 'path';
-// eslint-disable-next-line import/no-extraneous-dependencies
 import yaml from 'js-yaml';
 
 import { type GetRuleAnomalyDetectionStatistics } from '../../services/ruleAnomalyDetectionService/index.js';
diff --git a/server/test/utils.ts b/server/test/utils.ts
index 494f808..1d51474 100644
--- a/server/test/utils.ts
+++ b/server/test/utils.ts
@@ -156,11 +156,11 @@ export function makeTestWithFixture<T extends Record<string, unknown>>(
     skip: JestItCall;
     todo: JestItCall;
   };
-  // eslint-disable-next-line better-mutation/no-mutation
+  // eslint-disable-next-line functional/immutable-data
   fn.only = _makeTestWithFixture(makeSetupTeardown, it.only);
-  // eslint-disable-next-line better-mutation/no-mutation
+  // eslint-disable-next-line functional/immutable-data
   fn.skip = _makeTestWithFixture(makeSetupTeardown, it.skip);
-  // eslint-disable-next-line better-mutation/no-mutation
+  // eslint-disable-next-line functional/immutable-data
   fn.todo = _makeTestWithFixture(makeSetupTeardown, it.todo);
   return fn;
 }
@@ -229,7 +229,7 @@ function continueWith<T, U>(
 ): Awaited<U> | Promise<Awaited<U>> | void | Promise<void> {
   try {
     const res = getValue();
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+
     if (res && typeof res === 'object' && 'then' in res) {
       return res.then(then, catcher) as Promise<Awaited<U>> | Promise<void>;
     } else {
diff --git a/server/utils/encoding.ts b/server/utils/encoding.ts
index 715b5a5..2414c1e 100644
--- a/server/utils/encoding.ts
+++ b/server/utils/encoding.ts
@@ -51,7 +51,6 @@ export function b64EncodeArrayBuffer<T extends ArrayBuffer>(it: T) {
  * @param it The value to stringify.
  */
 export function jsonStringify<T>(it: T) {
-  // eslint-disable-next-line no-restricted-syntax
   return stringify(it) as JsonOf<T>;
 }
 
diff --git a/server/utils/iterables.test.ts b/server/utils/iterables.test.ts
index 5e49ebf..3b598db 100644
--- a/server/utils/iterables.test.ts
+++ b/server/utils/iterables.test.ts
@@ -38,19 +38,18 @@ describe('Iterable utils', () => {
 describe('chunkAsyncIterableByKey', () => {
   it('should chunk numbers based on even and odd', async () => {
     async function* sampleStream() {
-      // eslint-disable-next-line better-mutation/no-mutation
       for (let i = 1; i <= 5; i++) {
         yield i;
         yield i;
       }
     }
 
-    const result: number[][] = [];
+    let result: number[][] = [];
     for await (const chunk of chunkAsyncIterableByKey(
       sampleStream(),
       (item) => item % 2 === 0,
     )) {
-      result.push(chunk);
+      result = [...result, chunk];
     }
 
     expect(result).toEqual([
@@ -65,12 +64,12 @@ describe('chunkAsyncIterableByKey', () => {
   it('should handle an empty stream', async () => {
     async function* emptyStream() {}
 
-    const result: number[][] = [];
+    let result: number[][] = [];
     for await (const chunk of chunkAsyncIterableByKey(
       emptyStream(),
       (it) => it,
     )) {
-      result.push(chunk);
+      result = [...result, chunk];
     }
 
     expect(result).toEqual([]);
@@ -85,12 +84,12 @@ describe('chunkAsyncIterableByKey', () => {
 
     const chunkKey = (item: number | undefined) => item;
 
-    const result: (number | undefined)[][] = [];
+    let result: (number | undefined)[][] = [];
     for await (const chunk of chunkAsyncIterableByKey(
       sampleStream(),
       chunkKey,
     )) {
-      result.push(chunk);
+      result = [...result, chunk];
     }
 
     expect(result).toEqual([[1], [undefined], [1]]);
diff --git a/server/utils/language.ts b/server/utils/language.ts
index 30ac2da..6598b0f 100644
--- a/server/utils/language.ts
+++ b/server/utils/language.ts
@@ -1,4 +1,3 @@
-/* eslint-disable max-lines */
 import { makeEnumLike } from '@roostorg/types';
 
 // https://gist.github.com/jrnk/8eb57b065ea0b098d571
diff --git a/server/utils/misc.ts b/server/utils/misc.ts
index 552c85a..5c48413 100644
--- a/server/utils/misc.ts
+++ b/server/utils/misc.ts
@@ -202,7 +202,6 @@ export function patchInPlace<T extends object>(object: T, patch: Partial<T>) {
 }
 
 export function removeUndefinedKeys<T extends object>(object: T) {
-  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
   return _.pickBy(object, (v) => v !== undefined);
 }
 
diff --git a/server/utils/url.test.ts b/server/utils/url.test.ts
index 76d3fb6..b8c6daf 100644
--- a/server/utils/url.test.ts
+++ b/server/utils/url.test.ts
@@ -6,7 +6,6 @@ describe('URL Tests', () => {
       // This absolutely is unsafe mutation of a global that'll be visible
       // across test suites. However, this env var should only be relied upon
       // by this module, so it should be ok.
-      // eslint-disable-next-line better-mutation/no-mutation
       process.env.ALLOW_USER_INPUT_LOCALHOST_URIS = 'false';
     });
 
@@ -24,7 +23,6 @@ describe('URL Tests', () => {
       // This absolutely is unsafe mutation of a global that'll be visible
       // across test suites. However, this env var should only be relied upon
       // by this module, so it should be ok.
-      // eslint-disable-next-line better-mutation/no-mutation
       process.env.ALLOW_USER_INPUT_LOCALHOST_URIS = 'false';
 
       expect(() => validateUrl('https://localhost:3000')).toThrow();
@@ -37,7 +35,6 @@ describe('URL Tests', () => {
       // This absolutely is unsafe mutation of a global that'll be visible
       // across test suites. However, this env var should only be relied upon
       // by this module, so it should be ok.
-      // eslint-disable-next-line better-mutation/no-mutation
       process.env.ALLOW_USER_INPUT_LOCALHOST_URIS = 'true';
     });
 
diff --git a/server/workers_jobs/RetryFailedNcmecDecisionsJob.ts b/server/workers_jobs/RetryFailedNcmecDecisionsJob.ts
index ca1c50e..d9968ff 100644
--- a/server/workers_jobs/RetryFailedNcmecDecisionsJob.ts
+++ b/server/workers_jobs/RetryFailedNcmecDecisionsJob.ts
@@ -1,4 +1,3 @@
-/* eslint-disable no-console */
 import { makeDateString } from '@roostorg/types';
 import _ from 'lodash';
 import { v1 as uuidv1 } from 'uuid';
@@ -163,7 +162,7 @@ export default inject(
             threads: submitNcmecReportDecisionComponent.reportedMessages,
             // Use the stored incidentType if available, otherwise default to the most common one
             // The type says it's required, but old decisions in the DB won't have it
-            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
+
             incidentType:
               submitNcmecReportDecisionComponent.incidentType ||
               'Child Pornography (possession, manufacture, and distribution)',
@@ -216,7 +215,11 @@ export default inject(
                 correlationId,
                 targetItem: {
                   itemId,
-                  itemType: { id: itemType.id, kind: itemType.kind, name: itemType.name },
+                  itemType: {
+                    id: itemType.id,
+                    kind: itemType.kind,
+                    name: itemType.name,
+                  },
                 },
                 actorId: row.reviewer_id,
                 actorEmail: user?.email,
@@ -241,57 +244,59 @@ export default inject(
     return {
       type: 'Job' as const,
       async run() {
-      // One month before now
-      const startDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
-      // End date is 1 hour before now, to give currently running decisions time to finish.
-      const endDate = new Date(Date.now() - 60 * 60 * 1000);
-      const ncmecDecisions = await manualReviewToolService.getNcmecDecisions({
-        startDate,
-        endDate,
-      });
-      const usersWithReports = await ncmecService.getUsersWithNcmecDecision({
-        startDate,
-      });
-      if (ncmecDecisions.length === 0) {
-        return;
-      }
-      const previousErrors = await ncmecService.getNcmecErrorsForJobIds(
-        ncmecDecisions.map((it) => it.job_payload.id),
-      );
-      // Only retry decisions that don't have an applicable NCMEC decision and
-      // decisions that don't already have a permanent error or a retry count of
-      // 10 or more.
-      const decisionsToRetry = ncmecDecisions.filter((it) => {
-        return (
-          !usersWithReports.some(
-            (usersWithReports) =>
-              usersWithReports.userId === it.job_payload.payload.item.itemId &&
-              usersWithReports.userItemTypeId ===
-                it.job_payload.payload.item.itemTypeIdentifier.id &&
-              usersWithReports.orgId === it.org_id,
-          ) &&
-          !previousErrors.some(
-            (error) =>
-              (error.job_id === it.job_payload.id && error.retry_count >= 10) ||
-              (error.job_id === it.job_payload.id &&
-                error.status === 'PERMANENT_ERROR'),
-          )
+        // One month before now
+        const startDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+        // End date is 1 hour before now, to give currently running decisions time to finish.
+        const endDate = new Date(Date.now() - 60 * 60 * 1000);
+        const ncmecDecisions = await manualReviewToolService.getNcmecDecisions({
+          startDate,
+          endDate,
+        });
+        const usersWithReports = await ncmecService.getUsersWithNcmecDecision({
+          startDate,
+        });
+        if (ncmecDecisions.length === 0) {
+          return;
+        }
+        const previousErrors = await ncmecService.getNcmecErrorsForJobIds(
+          ncmecDecisions.map((it) => it.job_payload.id),
         );
-      });
-      const usersByOrg: {
-        [key: string]: {
-          id: string;
-          email: string;
-          firstName: string;
-          lastName: string;
-          role: string;
-        }[];
-      } = {};
-      // Run this sequentially to avoid overloading external systems
-      for (const row of decisionsToRetry) {
-        await processDecisionRetry(row, usersByOrg);
-      }
-    },
+        // Only retry decisions that don't have an applicable NCMEC decision and
+        // decisions that don't already have a permanent error or a retry count of
+        // 10 or more.
+        const decisionsToRetry = ncmecDecisions.filter((it) => {
+          return (
+            !usersWithReports.some(
+              (usersWithReports) =>
+                usersWithReports.userId ===
+                  it.job_payload.payload.item.itemId &&
+                usersWithReports.userItemTypeId ===
+                  it.job_payload.payload.item.itemTypeIdentifier.id &&
+                usersWithReports.orgId === it.org_id,
+            ) &&
+            !previousErrors.some(
+              (error) =>
+                (error.job_id === it.job_payload.id &&
+                  error.retry_count >= 10) ||
+                (error.job_id === it.job_payload.id &&
+                  error.status === 'PERMANENT_ERROR'),
+            )
+          );
+        });
+        const usersByOrg: {
+          [key: string]: {
+            id: string;
+            email: string;
+            firstName: string;
+            lastName: string;
+            role: string;
+          }[];
+        } = {};
+        // Run this sequentially to avoid overloading external systems
+        for (const row of decisionsToRetry) {
+          await processDecisionRetry(row, usersByOrg);
+        }
+      },
       async shutdown() {
         await closeSharedResourcesForShutdown();
       },
-- 
2.51.2