familysync/.planning/phases/20-admin-member-editor-form-declutter/20-REVIEW-FIX.md

phase, fixed_at, source_review, fix_scope, findings_in_scope, fixed, skipped, iteration, status, gates

phase	fixed_at	source_review	fix_scope	findings_in_scope	fixed	skipped	iteration	status	gates
20-admin-member-editor-form-declutter	2026-06-18T14:45:00Z	20-REVIEW.md	all	11	11	0	2	all_fixed	typecheck eslint prettier api_tests pass pass pass 462/462

Phase 20 — Code Review Fix Report

Auto-fix pass over the deep review (20-REVIEW.md, 2 critical / 6 warning / 3 info). All 11 findings fixed and committed atomically; a deep re-review (iteration 2) independently confirmed 0 critical / 0 warning remain.

Note: this report was reconstructed by the orchestrator — the fixer agent applied and committed every fix but its REVIEW-FIX.md write did not persist. The commit hashes below are the source of truth.

Fixes applied

ID	Severity	Fix	Commit
CR-01	Critical	Last-admin guard made atomic — single conditional UPDATE / affectedRows check closes the TOCTOU window; 409 response shape unchanged	7297733
WR-06	Warning	Empty {} PATCH body now rejected with a clean 400 via Zod refinement (was a Drizzle 503 on empty SET); new test added	7297733
CR-02	Critical	AdminPage derives the editor's member from live query data and refetches/invalidates after a save — no stale-snapshot demotion overwrite	ee04aee
WR-01	Warning	Toggle-only saves no longer re-send displayName, so admin-toggle saves don't 400 for OIDC-provisioned members with a null/empty stored name	527d855
WR-02	Warning	409 revert uses the actual prior toggle state instead of defaulting to true	527d855
WR-04	Warning	handleClose closure fixed — Cancel after a per-section save no longer reverts to pre-save values	527d855
WR-03	Warning	Phone bottom-sheet gains maxHeight + overflowY: auto so the action button is reachable on short phones	2fd253e
IN-03	Info	Phone sheet adds env(safe-area-inset-bottom) padding (iOS home indicator)	2fd253e
WR-05	Warning	Admin toggle gains aria-describedby linking to the last-admin error region	d2e9862
IN-01	Info	Helper text shown when display name is empty	400733f
IN-02	Info	maxLength added to display-name and username inputs	182ba1d

(41a4fae — prettier formatting of the updated admin.test.ts.)

Verification

• pnpm -r typecheck — pass (API + PWA)
• ESLint — 0 warnings
• Prettier — clean
• API integration tests — 462/462 (includes a new Test H asserting empty-body PATCH → 400)

Introduced during fixes (caught by iteration-2 re-review)

• IN-04 (Info, open): The no-op profile-save path (mutationFn returns early on an empty payload) still triggers onSuccess, so the "Profile saved." toast fires and the ['admin','members'] query refetches even when nothing changed. Cosmetic. Fix: skip the toast/refetch when the computed payload is empty. Not auto-applied — re-review returned status: clean (no critical/warning), so the --auto loop exited before a third pass.