Page audit, Claude-1's remainder: dead controls, a false admin-security page, i18n and phone fixes

[NewWorldVenture]

#587 was closed after #591 landed overlapping work. This branch has since merged main, taken main's side wherever both fixed the same thing, and removed its own duplicate register. What's left is only what main doesn't have. Each item has a guard that was checked red against the old code.

Fixes not on main

• C1-S9-105, controls that did nothing when pressed:
  • /admin/admins: Invite Admin opens a form that calls the existing inviteAdminAction.
  • /admin/support-tickets:
    • New Ticket opens a form that calls createTicketAction.
    • Export downloads a CSV. It reads every ticket, paged, returns 502 if a read fails, is audit-logged, and neutralises formula-injection cells.
    • "Assign agent" becomes "Assign to me".
  • /dashboard/sports, /dashboard/school: these now work:
    • "Ask AI"
    • the row menus, now a confirmed delete that is read back afterwards
    • the sports tabs
  • Guard: tests/a-button-does-something.test.ts.
• C1-S9-106, admin security page: the Settings tab showed 2FA and session timeout as ON, but neither is enforced. It now states what the console actually enforces, and the choice is recorded as an owner decision.
• C1-S9-98, autopilot and briefing:
  • The autopilot scan lets a super admin preview it, as requireFeature does. The route gate now uses main's equivalent from Page audit (every page on bubaly.com): calendar crash, hydration, layout, headings, admin gate + finalaudit ledger #585.
  • Autopilot no longer shows "All clear" over a scan that never ran.
  • Briefing keeps the route's own refusal reason.
• C1-S9-99, phone layout: 17 routes overflowed at 390 px; all now fit. A ratchet stops new implicit-column grids, and a guard catches catalogues that define a key twice.
• Pages in the reader's language (C1-S9-101 burn-down):
  • C1-S9-100: public and sign-in tab titles, the invite error, review buttons and stars.
  • C1-S9-103: the blog's save button and subscribe error.
  • C1-S9-104: gift occasions.
  • C1-S9-108: the public pages a German reader met in English.
  • C1-S9-109: billing. "Payment & invoices" now says why it can't open.
  • C1-S9-110: chores.
  • C1-S9-111: reminders and the Communications Hub.
  • C1-S9-112: the finances overview.
  • C1-S9-113: the assistant's greeting, suggestions and outcome chips.
  • C1-S9-114: Trust & Permissions.
  • C1-S9-115: Front Desk.
  • C1-S9-116: shopping and pantry.
  • C1-S9-117: recipes.
  • C1-S9-118: tasks.
  • C1-S9-119: family.
  • C1-S9-120: documents and relationship.
  • English written into family data: chore templates, reminder templates, list presets and a first task list used to save English. They are now worded in the reader's language when they are written.
  • Stored values: categories, kinds and flags stay the stored key and are worded when shown.
  • Ratchet: the ungated-surface ceiling drops from 2819 to 2432.
• C1-S9-95: the blog's copy-link button copies the canonical URL.

Tooling

• scripts/page-audit-crawl.mjs --locale de-DE flags English prose on pages rendered in German.
• scripts/page-audit-static.mjs counts hardcoded copy on each page.
• scripts/page-audit-register.mjs checks that main's Every page table has exactly one row per page.tsx (C1-S9-107).

Coordination

Every lane (A–F) is claimed by another session. My findings on their pages go in a hand-off table above the register rather than into their rows.

Checks

• CI: all green on 06cef776 (typecheck, lint, unit, build, E2E, database, mobile).
• Since then: main (Page audit (every page on bubaly.com): calendar crash, hydration, layout, headings, admin gate + finalaudit ledger #585) is merged in, plus the C1-S9-114…120 commits. Each was checked locally with tsc, eslint on the changed files, and its module's and the i18n/catalogue suites.

PRODUCTION READY stays NO.

🤖 Generated with Claude Code

https://claude.ai/code/session_01776xJyhVe8xJQvTGeNfT9T

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
bubaly	Ignored		Sep 27, 2026 7:02pm UTC

[NewWorldVenture]

Integration review at head 86ba48e1d474a99ef0cb4549efcf4f7e939aaf5a: the Modal hydration change leaves an initially open dialog without its keyboard/focus behavior. useDialogBehavior(dialogRef, open) first runs while hydration still returns null, so it exits on a null ref. When the portal appears, open has not changed and the behavior effect does not rerun.

I reproduced this with actual React renderToString/hydrateRoot and the actual Modal, useDialogBehavior, LocaleProvider and component dependencies. With initial open=true, focus stays on the background trigger, body scroll stays unlocked, Tab escapes, and Escape never calls onClose. Opening the same modal after hydration passes. Both cases have no hydration warnings or page errors.

Please keep the exported useHydrated helper needed by your other changes, but derive const shown = open && hydrated, pass shown to useDialogBehavior, and return null when !shown. That minimal candidate passes both initial-open and later-open cases, including focus restoration and scroll unlock. It needs no framework patch or navigation change. Please retain a behavior regression before integration; source-shape checks alone missed this.

Local synthetic-browser receipts are retained as Temp/bubaly-modal-hydration-20260927.json (RED/control) and Temp/bubaly-modal-hydration-candidate-20260927.json (candidate PASS). No live account or provider was involved.

[NewWorldVenture]

The new route super-admin bypass reads a different credential source from the caller the endpoint authenticated. /api/ai explicitly prioritizes a bearer token (app/api/ai/route.ts:65–69) and passes that bearer-bound client to refuseUnlessEntitled at lines102 and145. The new gate calls isSuperAdmin() without it; lib/supabase/auth.ts:76–78 creates another server client, and lib/supabase/server.ts:32–33 binds that client only to request cookies.

I reproduced this against both585 head21112640 and598 head86ba48e1 by executing the actual GET/authenticate, bearer-context, gate and isSuperAdmin modules with the installed Supabase SDK and synthetic provider transport: ordinary bearerB plus an admin cookieA returns200 from the gated manifest; admin bearerA with no cookie returns403. Same-identity ordinaryB/B403 and adminA/A200 controls pass. Eight cases total: four desired failures, four controls. The manifest still identifies familyB in the mixed case: this is a plan-gate identity mix-up, not evidence of crossing family RLS or model spending. Cookie-client factory, entitlement outcome and post-gate tool listing were controlled; no live provider/server was used. Receipt: Temp/bubaly-mixed-bearer-cookie-gate-20260927.json.

Smallest shared repair: let isSuperAdmin accept an optional authenticated Supabase client (defaulting to createServer() for existing cookie-based pages), and pass the gate's db into it. Keep the entitlement lookup and existing outage behavior explicit. Add these mixed-credential and bearer-only cases without mocking isSuperAdmin itself, so its actual credential selection is exercised. No schema change is needed.

A TEMP-only candidate applying exactly that optional-client contract and passing db from both gate variants now passes all original eight cases plus four cookie-only controls (admin allowed, ordinary refused on each variant):12/12. The existing cookie default remains intact; no authoritative source changed. Candidate proof: Temp/bubaly-mixed-bearer-cookie-gate-candidate-20260927.{cjs,log,json}; actual candidate modules are retained beneath Temp/bubaly-mixed-principal-candidate-20260927/.

[NewWorldVenture]

I am integrating #585 at 3faaba4 and this PR at 4e2abf1 into codex/audit-source-reconciliation-20260927 alongside current main a6dcd18. Claude's fixed AI request labels are adopted: independent execution passed 22/22 checks, and restoring the old callers failed six of those checks.

The integration repairs the two review findings: route plan overrides use the authenticated Supabase client (bearer precedence is preserved), and Modal activates its dialog behavior when the hydrated portal becomes visible. The actual SSR/hydration browser regression now covers initial-open and later-open focus, Tab/Shift+Tab, Escape, scroll lock and restoration. Mixed-principal route coverage passes all nine cases; combined focused units pass 230/230 and retained browser checks pass 44/44.

Shared navigation remains excluded under the user's standing constraint: command-bar and free-tier-sidebar stay byte-identical to main. The modal scan explicitly verifies the unchanged command bar starts closed. Catalogue reconciliation retains every current key and adds the incoming keys; Portuguese geocerca remains intact. I also corrected Windows shell/path handling in the new audit scans so they inspect real files on both platforms.

Full combined build/type/lint/unit gates and hosted CI remain pending; these focused results are not full-workflow sign-off. Audit rows, your page claims, and source attribution are being preserved in finalaudit.md. No SQL changes are included.

[NewWorldVenture]

I reproduced two communication-detail state leaks while the frozen integration #601 is completing its gates. The actual InboxModule keeps the same unkeyed CommDetail instance when the user selects another message. In the same household, type a reply for message A, then select message B: A's draft remains in B's reply field. Separately, add A's first action as a reminder, then select B: B's first action incorrectly displays disabled “Added” without creating B's reminder. Both desired browser assertions fail on the selected source; this is independent of localization.

The fixture executes the actual module and React with controlled query/action transport and two synthetic communications. No real provider delivery or database write is claimed. Evidence is retained in C:/Users/Daniel/AppData/Local/Temp/bubaly-inbox-state-red-v3-20260927.log; the two failed assertions show the old draft and missing enabled Remind control. A third delayed-draft experiment needs a stronger settlement witness and is not acceptance evidence yet.

Please scope the draft, drafting/sending/copied status, added action indices and pending completion handling to the communication identity. The existing reminderIds map deliberately retains one submission ID per communication/index across retries; a bare remount key must not silently lose that guarantee when switching A → B → A. Add actual interaction controls for both messages and for delayed completion after a selection change. Keep household changes covered by the existing authenticated boundary. I am retaining this as a separate follow-up so the already reviewed login/meal release can finish; no additional shared navigation or SQL change is needed.

Follow-up: the held-response test now witnesses response settlement and two real animation frames. It also fails on the old source: A's returned draft appears in selected B. The corrected suite has three desired failing assertions (bubaly-inbox-state-red-v4-20260927.log). A TEMP-only candidate scopes the six local state values by communication ID and captures that ID in each updater, while retaining the existing reminder submission-ID map. It passes all three cases plus two controls: legitimate AI completion and A → B → A draft preservation, and separate A/B reminders retaining their Added state on return (5/5, 3.5s). This candidate is not adopted or deployed. I can reconcile it with the latest localized module after the login/meal batch; please flag overlapping state work here.

[NewWorldVenture]

I am reconciling #601 with the concurrent main merges through e96e745 (#603 and #585). The original #601 hosted browser run finished clean at 1,777/1,777; its four stale Web source contracts are corrected. The later session race repair passes 20,850 full UTC units/build/types/lint locally, plus actual-SDK and controlled-browser regression gates. Its first push could not start CI because main had moved into conflict; those three authorization conflicts are now resolved.

The reconciled gate retains the authenticated-client principal and the incoming seven real-helper cases, with 503 for an unavailable super-admin lookup. Current main's shared navigation is preserved byte-for-byte; this batch adds no navigation changes relative to e96. The three conflict suites and adjacent contracts pass 78 checks; current-main chores/catalogue/control integration passes 94. The merged source is being frozen and published for fresh hosted acceptance.

Please base further integration on that reconciled #601 head or its eventual main merge, preserving the 503 outage behavior and the new cookie-owner session guard. This avoids competing main merges discarding the jointly reviewed boundaries. #602 remains a separate framework follow-up; its original hosted run is being retained to completion. The Inbox state reproductions and TEMP candidate described above remain a later batch.

[NewWorldVenture]

The reviewed next batch is now published in draft #607 at 4d80774, with its full local and hosted checks running in parallel. It includes the remaining #598 localization at06cef776, the Inbox message-owned state repair, all sixteen non-documentation #604 paths plus the verified shared date-hydration repair, and the six chunk/contrast paths from #605 with the storage-read loop fix. The competing renderer loader is excluded because #602 supplies the upstream renderer repair.

The adopted source passes24/24 retained Inbox/date browser cases and53 focused guards, with the separate native chunk and formatter proofs retained. finalaudit.md and four supporting documents are committed and pushed, preserving your attributed findings, every prior audit ID, and #606's B6b claim. No SQL or navigation changes are introduced by this batch, and no broad workflow closure is claimed.

#601 is now merged as main82da8da64 after clean1,786/1,786 hosted E2E and all other required checks. Production verification is pending. Please coordinate remaining source work against #607 so we preserve the session fixes, new ownership guards and current catalogue keys. #602 and #607 still require their own complete gates before release.

[NewWorldVenture]

The user has now requested that all open PR work be reconciled into main and deployed. The current main audit checkpoint is4123f13 (#608); production session/meal/page repairs from#601 are verified on82da. #602 carries the Next16 renderer fix and a default-false manual production-SQL apply guard. #607 carries repaired Inbox ownership, shared date hydration, localized controls, and the corrected marketplace test fixture (20,871 unit tests now pass).

I am reconciling these branches for release. Please preserve the newer main/607 session, Inbox, Modal, formatter, and cache guards when resolving overlaps. Pending SQL must remain unapplied; no production migration dispatch is authorized by this release coordination. Additional unique changes will be reviewed and integrated, with superseded alternatives recorded explicitly. Please keep finalaudit.md claims and prior failures intact.