---
phase: 20-admin-member-editor-form-declutter
fixed_at: 2026-06-18T14:45:00Z
source_review: 20-REVIEW.md
fix_scope: all
findings_in_scope: 11
fixed: 11
skipped: 0
iteration: 2
status: all_fixed
gates:
  typecheck: pass
  eslint: pass
  prettier: pass
  api_tests: 462/462
---

# Phase 20 — Code Review Fix Report

Auto-fix pass over the deep review (`20-REVIEW.md`, 2 critical / 6 warning / 3 info).
All 11 findings fixed and committed atomically; a deep re-review (iteration 2)
independently confirmed 0 critical / 0 warning remain.

> Note: this report was reconstructed by the orchestrator — the fixer agent applied
> and committed every fix but its `REVIEW-FIX.md` write did not persist. The commit
> hashes below are the source of truth.

## Fixes applied

| ID | Severity | Fix | Commit |
|----|----------|-----|--------|
| CR-01 | Critical | Last-admin guard made atomic — single conditional UPDATE / `affectedRows` check closes the TOCTOU window; 409 response shape unchanged | `7297733` |
| WR-06 | Warning | Empty `{}` PATCH body now rejected with a clean 400 via Zod refinement (was a Drizzle 503 on empty SET); new test added | `7297733` |
| CR-02 | Critical | `AdminPage` derives the editor's member from live query data and refetches/invalidates after a save — no stale-snapshot demotion overwrite | `ee04aee` |
| WR-01 | Warning | Toggle-only saves no longer re-send `displayName`, so admin-toggle saves don't 400 for OIDC-provisioned members with a null/empty stored name | `527d855` |
| WR-02 | Warning | 409 revert uses the actual prior toggle state instead of defaulting to `true` | `527d855` |
| WR-04 | Warning | `handleClose` closure fixed — Cancel after a per-section save no longer reverts to pre-save values | `527d855` |
| WR-03 | Warning | Phone bottom-sheet gains `maxHeight` + `overflowY: auto` so the action button is reachable on short phones | `2fd253e` |
| IN-03 | Info | Phone sheet adds `env(safe-area-inset-bottom)` padding (iOS home indicator) | `2fd253e` |
| WR-05 | Warning | Admin toggle gains `aria-describedby` linking to the last-admin error region | `d2e9862` |
| IN-01 | Info | Helper text shown when display name is empty | `400733f` |
| IN-02 | Info | `maxLength` added to display-name and username inputs | `182ba1d` |

(`41a4fae` — prettier formatting of the updated `admin.test.ts`.)

## Verification

- `pnpm -r typecheck` — pass (API + PWA)
- ESLint — 0 warnings
- Prettier — clean
- API integration tests — **462/462** (includes a new Test H asserting empty-body PATCH → 400)

## Introduced during fixes (caught by iteration-2 re-review)

- **IN-04 (Info, resolved):** The no-op profile-save path (`mutationFn` returns early on an
  empty payload) triggered `onSuccess`, firing the "Profile saved." toast and refetching the
  `['admin','members']` query even when nothing changed. Fixed in `5161bd3` — `mutationFn`
  now returns a `changed` flag and `onSuccess` skips the toast/refetch when no write occurred.
  Typecheck/eslint/prettier all pass.