diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml index 582bbe4a7..1c4947205 100644 --- a/.github/workflows/playwright.yml +++ b/.github/workflows/playwright.yml @@ -74,7 +74,7 @@ jobs: - name: Setup Node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e with: - node-version: 20 + node-version: 22 cache: npm - name: Install dependencies @@ -99,7 +99,7 @@ jobs: - name: Setup Node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e with: - node-version: 20 + node-version: 22 cache: npm - name: Install dependencies @@ -195,7 +195,7 @@ jobs: - name: Setup Node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e with: - node-version: 20 + node-version: 22 cache: npm - name: Install dependencies @@ -282,19 +282,19 @@ jobs: E2E_BASEBALL_PLAYER_PASSWORD: ${{ secrets.E2E_BASEBALL_PLAYER_PASSWORD }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e with: - node-version: 20 + node-version: 22 cache: npm - name: Install dependencies run: npm ci - name: Cache Playwright browsers - uses: actions/cache@v5 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 with: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }} @@ -313,7 +313,7 @@ jobs: - name: Upload Playwright report (baseball-smoke) if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: baseball-smoke-playwright-report path: playwright-report/ diff --git a/docs/CLEANSLATE_JOB_LIST.md b/docs/CLEANSLATE_JOB_LIST.md new file mode 100644 index 000000000..f2a14ffbd --- /dev/null +++ b/docs/CLEANSLATE_JOB_LIST.md @@ -0,0 +1,193 @@ +# BaseballHelm Clean-Slate — Parallel Job List + +> Hand each **GROUP** below to a separate Claude session. Each group is file-disjoint from the others, +> so sessions won't collide. Within a group, do the jobs as **small, single-surface PRs**. +> Source of truth: `docs/audits/HELMV3_ISSUE_LEDGER_2026-06-30.md` (§4). Generated 2026-07-01. + +--- + +## Ground truth (read first, every session) + +- Repo: `~/Downloads/helmv3`. Base every branch off `origin/main` (currently `5d30130f` — #421 is merged). +- **Validated ledger:** `docs/audits/HELMV3_ISSUE_LEDGER_2026-06-30.md` — per-issue root cause + evidence. +- **Intended behavior (SPEC-FIRST):** `docs/baseballhelm_revolution_plan/` — coach tabs `05_tab_specs_coach_account/NN_*`, player tabs `06_tab_specs_player_account/NN_*`. Read the matching tab's `permissions.md`, `acceptance_criteria.md`, `edge_cases.md`, `data_visible_to_player.md` **before** writing code. +- Product rules: `CLAUDE.md`. Post-mortem (why the last build drifted): `docs/audits/BASEBALLHELM_SHELL_ROUTE_POSTMORTEM_2026-06-30.md`. + +## Standing rules (the contract — non-negotiable) + +1. **Spec-first.** Read the V1 tab spec + the issue (`gh issue view `) + the ledger evidence before coding. Where the app deliberately diverges from the spec, that's a decision to surface — not auto-treat as a bug. +2. **One surface per PR, ≤ ~15 files / ~400 lines.** This is *the* rule the post-mortem exists to enforce — PRs over the review bots' file ceilings (Greptile 100, CodeRabbit 150) get auto-skipped and duplication slips through. Never batch unrelated fixes. +3. **Delete dead code** the fix obsoletes — don't leave old+new coexisting. +4. **Branch:** `fix/baseball--` off `origin/main`. **No direct-to-main pushes.** +5. **Migrations:** ADDITIVE only (CREATE OR REPLACE / IF NOT EXISTS). New timestamped file after `20260630230000`. `GRANT EXECUTE ... TO authenticated, service_role` only — **never anon** (Supabase re-grant gotcha). Serialize timestamps to avoid collisions. +6. **Verify before PR:** `npm run typecheck` and `npm run lint:ratchet` must pass. Put `Closes #` in the PR body. +7. **Security/RLS/auth fixes:** adversarially self-review — try to break your own fix (fail-open? NULL `auth.uid()`? direct PostgREST bypass? capability-comparison direction?). +8. **Claim protocol:** before starting a GROUP, comment "claiming Group X" so sessions don't double up. Mark jobs done as you merge. + +## 🔒 LOCKED files (in-flight PRs — do NOT edit until merged) + +These are being changed by PRs already open/in-flight; wait for them to land or you'll conflict: + +| File | Locked by | Affects jobs | +|---|---|---| +| `supabase/migrations/…is_team_staff…` | #405 (PR #542, merged/merging) | — | +| `src/app/baseball/actions/ai-governance.ts` | #510 (PR #544) | — | +| `src/app/baseball/actions/stats.ts` | #394 (in flight) | Wave 6 #379/#436 — do the non-stats.ts jobs first | +| `src/app/baseball/actions/academics.ts` | #513 (in flight) | Wave 10 #504/#509 — do the non-academics.ts jobs first | +| `src/app/baseball/actions/teams.ts` | #502 (in flight) | Wave 3 join-code (#440 also touches join flow — coordinate) | +| `src/app/baseball/actions/staff.ts` | #501 (in flight) | — | + +**Do NOT touch** (owner decision): `scripts/*` hardcoded-secret issues **#516 / #391** — owner has accepted that risk; skip them. + +--- + +## Parallelization map — 8 conflict-free groups + +Each group → one session. Groups sharing a file are already merged together, so **no two groups touch the same file.** + +| Group | Waves | Subsystem | Notes | +|---|---|---|---| +| **A** | 2 + 10 | Lifting + Academics | share `player-today.ts` → one session | +| **B** | 4 + 5 | Insights + Decision Room | share decision-room read-models + `StaffDecisionRoomClient.tsx` | +| **C** | 3 + 14 | Recruiting/Pipeline + Misc | share `camps/page.tsx`, `RosterClient.tsx` | +| **D** | 6 | Stats / Box Score | mostly `games.ts` + box-score (hold stats.ts jobs for #394) | +| **E** | 7 | Messaging / Notifications | self-contained (`use-messages.ts`, settings, announcements) | +| **F** | 8 + 9 | Onboarding + Documents/Video | disjoint file families | +| **G** | 11 + 12 + 13 | Mobile Chrome + Shell/Nav + Calendar | share `PlayerTodayClient.tsx`, `dashboard-shell.tsx`, `calendar/page.tsx` | +| **H** | 15 | CI / Tech debt | e2e specs + workflows only | + +> Wave 1 (Security) — **DONE (staged as PRs, 2026-07-01)**, owned by primary session. All 7 clean single-surface PRs open, verified: #542(#405), #544(#510), #546(#440), #547(#513), #548(#502), #549(RLS cleanup), #551(#501). Awaiting merge + manual prod migration apply. + +### ✅ Wave 1b — RLS legacy-policy cleanup — **DONE → PR #549** + +Live-DB audit (2026-07-01) found RLS **is** applied (441 policies) but legacy baseline `ALL` policies grant write to **any team staff, no capability + no active-status check** — bypassing capability enforcement AND #405 via direct PostgREST (Postgres ORs permissive policies, so the legacy one wins over the newer capability-gated ones). PR #549 (`20260701000000_baseball_rls_legacy_policy_cleanup.sql`) drops the legacy ALL + adds cap-gated per-command policies on: `baseball_player_stats` (add DELETE), `baseball_staff_invitations` (add DELETE), `baseball_player_season_stats`, `baseball_box_score_uploads`, `baseball_team_invitations`. Uses `has_baseball_staff_capability()` (status+capability gated). ADDITIVE, PR-only — NOT applied to shared prod. + +### 🟠 NET-NEW findings (2026-07-01, from Wave-1 live-DB work — queue after clean slate) + +- **NN-1 [high → was live-broken] → DONE (PR #561, file 1):** `has_baseball_staff_capability` referenced 6 columns absent from `baseball_team_coach_staff` (`can_manage_lineups`, `can_view_readiness`, `can_modify_availability`, `can_view_private_notes`, `can_message_players`, `can_export_reports`) → `42703` for non-head coaches. **Not just latent RLS: `StaffSettingsClient.tsx` already renders live toggles for all 6, so granting any of them threw `42703` today** — this fixed a currently-broken UI feature. Fix = `20260701002000_baseball_staff_capability_columns.sql` adds all 6 (`NOT NULL DEFAULT false`, backfilled true for `is_head_coach OR is_primary`). PR-only, needs manual prod apply. +- **NN-2 [med] → DONE (PR #561, file 2):** `baseball_team_lineups` / `baseball_lineup_positions` legacy no-capability ALL policies replaced (mirrors #549): cap-gated I/U/D on `can_manage_lineups` + a staff SELECT on each (the legacy ALL was coaches' only read path; remaining SELECTs are player-only). `lineup_positions` scoped via parent-lineup `team_id`. Ordered after NN-1's column-add in the same PR. Adversarial review confirmed live: head-coach writes unaffected; 5/5 current staff `is_primary=true` so backfill is no-op-loss. +- **NN-3 [high] → DONE (PR #558):** `baseball_box_score_batting` / `baseball_box_score_pitching` gated INSERT/UPDATE/DELETE on `is_baseball_team_coach_v2` (no capability, no status) — same direct-PostgREST write bypass as #549, on the core game-stat tables. Fixed by `20260701001000_baseball_box_score_batting_pitching_rls.sql` (→ `has_baseball_staff_capability(team_id,'can_manage_stats')`, SELECT untouched). PR-only, needs manual prod apply. +- **NN-4 [low / dormant — NOT fixed]:** `has_baseball_staff_capability`'s CASE has **no branch for `can_manage_documents`** (added in `20260630180100`) → always falls through to `ELSE false`. No current policy calls the fn with that string (baseball_documents policies gate another way), so it's dormant — but a landmine if anyone later wires a documents RLS policy to `has_baseball_staff_capability(..., 'can_manage_documents')`. Add the branch when documents RLS is next touched. + +--- + +## The jobs (by wave) + +Format: `#issue [severity] title — files`. Batch same-file issues into ONE PR (noted). Do critical first. + +### Group A + +**Wave 2 — Lifting** (do #486 first; #491/#492 batch with it — same `publishLiftDay`) +- #486 [crit] Route program publishes into the table players read — `actions/lifting-v11.ts` (publishLiftDay) +- #492 [high] Dedup publishLiftDay assignments — `actions/lifting-v11.ts` (batch w/ #486) +- #491 [high] Empty Lift Builder selection = assign none — `actions/lift-builder.ts` (batch w/ #486) +- #456 [high] Unify Today lift/readiness onto helm_lifting — `read-models/player-today.ts` +- #457 [med] Join practice events in getPlayerPractices — `actions/practice.ts` +- #461 [med] Revert Daily Contract optimistic toggles on failure — `components/baseball/daily-contract/DailyContract.tsx` + +**Wave 10 — Academics** (do #507 first — feature fully broken; #504/#509 wait for #513) +- #448 [high] Player-completable dev-plan goals — `dashboard/dev-plan/page.tsx`, `actions/dev-plans.ts` +- #507 [high] Fix Player Today coach-notes query (wrong columns) — `read-models/player-today.ts` +- #508 [med] Let college programs reach Academics — `lib/baseball/server-route-guards.ts`, `supabase/middleware.ts` +- #504 [med] Enforce academics/travel module toggles — `actions/academics.ts`,`travel.ts`,`nav-registry.ts` (after #513) +- #509 [med] Scope eligibility reads to active team — `actions/academics.ts` (after #513) + +### Group B + +**Wave 4 — CoachHelm Insights** (#472+#473 batch; #496 shared w/ Wave 5 — fix once) +- #472 [high] insight dismiss/feedback auth uses coach_id vs user.id — `actions/insights.ts` +- #473 [high] engine upsert reactivates dismissed insights — `coachhelm/engine-run.ts` (batch w/ #472) +- #496 [high] Decision Room "Players to discuss" read-model shape — `read-models/decision-room/focus-imports.ts` +- #474 [med] Render insight body vs description on player profile — `coachhelm/engine-run.ts` + player-profile +- #475 [med] Honor player_visible in Practice Intelligence Board — `actions/practice-intelligence.ts` +- #478 [med] Collapse competing development_milestone insights — `actions/insights.ts` +- #498 [med] Stop mislabeling stable reviews "Moved the wrong way" — `staff-decision-room/StaffDecisionRoomClient.tsx` +- #512 [med] Surface timeline ack state on coach player profile — `dashboard/players/[id]/page.tsx` + +**Wave 5 — Decision Room** (#493/#494/#495/#496 = one focused rewrite of `decision-room/{agenda-ledger,focus-imports}.ts`) +- #493 [high] agenda detail crash when sourceRefs null — `StaffDecisionRoomClient.tsx` + read-model +- #495 [high] Map ledger rows to kind/label/detail/at (SELECT hits nonexistent cols) — `decision-room/agenda-ledger.ts` +- #494 [med] Map agenda rows to kind:'meeting_item' — `decision-room/agenda-ledger.ts` +- #476 [med] Preserve practice-effectiveness disposition on upsert — `actions/practice-effectiveness.ts` +- #497 [med] Align disposition filter w/ signal inbox — `decision-room/insights.ts` + +### Group C + +**Wave 3 — Recruiting/Pipeline/Discover/Camps** (#440 first+isolated; #427/#428 batch; #430/#431 hold for #394) +- #440 [crit] Route direct join_code through joinTeamByCode — `join/[code]/join-team-client.tsx` + page.tsx +- #427 [high] Fix pipeline drag stage resolution — `pipeline/PipelineClient.tsx` +- #442 [high] Enforce camp capacity atomically — `actions/camps.ts`, `camps/page.tsx` +- #470 [high] Privacy settings field mapping — `settings/privacy/page.tsx`, `PrivacySettings…` +- #425 [med] Route pipeline recruits to public profile — `features/pipeline-card.tsx`, `position-planner/PlayerQuickView.tsx` +- #426 [med] Align pipeline stage UI w/ 5-stage contract — `lib/recruiting/stages.ts` + PipelineClient +- #428 [med] Stop false drag-success on stage-update fail — `pipeline/PipelineClient.tsx` (batch w/ #427) +- #429 [med] Revert Discover watchlist UI on failure — `coach/discover/DiscoverView.tsx` +- #430 [med] Discover Teams pagination/counts — `actions/discover.ts` (after #394) +- #431 [med] Discover player sort server-side — `actions/discover.ts` (after #394) +- #432 [med] Fix PlayerDetailModal message nav path — `coach/PlayerDetailModal.tsx` +- #443 [med] Exclude cancelled camp regs from capacity — `camps/page.tsx` (batch w/ #442) +- #462 [med] JUCO uses recruiting ProfileEditor — `dashboard/profile/page.tsx` +- #505 [med] Align Staff Settings edit w/ can_invite_staff — `read-models/decision-room/staff-settings.ts` +- #500 [low] Don't bump scout-packet view_count on CSV — `actions/scout-packet.ts` + +**Wave 14 — Misc** (#489/#490 batch — lineup) +- #490 [med] Swap/return displaced lineup player — `coach/lineup/LineupBuilder.tsx` +- #489 [med] Check saveLineup result before success toast — `roster/RosterClient.tsx` (batch w/ #490) +- #446 [med] Travel past/upcoming classification — `baseball/travel/TravelClient.tsx` +- #447 [med] Camp date off-by-one — `camps/page.tsx` + `camps/[id]` (coordinate w/ #442/#443) +- #459 [med] Wire activate page to activateRecruitingExposure — `dashboard/activate/page.tsx` +- #477 [med] Preserve postgame disposition on upsert — `actions/postgame.ts` +- #503 [med] Enforce season module toggles at runtime — `actions/team-season-settings.ts` +- #467 [low] Repair/remove dead demo-mode link — `lib/baseball/settings-route-aliases.ts` +- #511 [low] Player-visible scope control on coach notes — `player-profile/PlayerProfileClient.tsx` + +### Group D — Wave 6 Stats/Box Score (#434 first — shared `sumInningsPitched`; #433/#437 batch in games.ts) +- #433 [high] Preload box-score lines when editing — `stats/games/[gameId]/page.tsx`, box-score +- #434 [high] Sum innings in outs not decimals — `box-score/BoxScoreView.tsx`,`BoxScoreEntry.tsx`, stats-center +- #435 [med] Scope player game log to season year — `actions/games.ts`, players/[id]/stats +- #437 [med] CSV upload completes game + recalcs — `actions/games.ts` (batch w/ #433) +- #439 [med] Wire season-year selector — `stats/season/page.tsx` +- #499 [med] Preserve Compare column order from URL — `compare/CompareClient.tsx` +- #438 [low] Count ties in W-L summary — `baseball/games/GamesList.tsx` +- #379 [med] reconcile seeded stats w/ Stats Center — `read-models/command-center.ts`, stats.ts *(after #394)* +- #436 [med] Compute OBP/SLG/OPS in aggregates — `actions/stats.ts` *(after #394)* + +### Group E — Wave 7 Messaging (#450/#455/#451 in use-messages.ts; #454/#466 in settings) +- #450 [med] Failed sends = failures — `hooks/use-messages.ts` +- #455 [med] Update read receipts — `hooks/use-messages.ts` (batch w/ #450), `messages/ChatWindow.tsx` +- #451 [low] Clear unread badges on open — `hooks/use-messages.ts` (batch) +- #449 [med] Ack CTA before others ack — `announcements/AnnouncementsPlayerView.tsx` +- #452 [med] Refresh announcements after create/delete — `announcements/page.tsx` + CreateAnnouncementFlow +- #454 [med] Persist notification prefs + honor — `settings/page.tsx`, `actions/messages` +- #466 [med] Stop faking coach notif saves — `settings/page.tsx` (batch w/ #454) + +### Group F + +**Wave 8 — Onboarding** (#468/#469/#471 batch — same coach-onboarding page) +- #464 [high] Player onboarding completes via UPSERT — `(onboarding)/player/page.tsx` +- #441 [med] Fix showcase copy-invite-link path — `teams/TeamsClient.tsx` +- #468 [med] Block "invite S&C" without email — `coach-onboarding/page.tsx` +- #469 [med] Align password validation w/ server — `coach-onboarding/page.tsx` (batch) +- #471 [med] Persist/remove cosmetic plan selection — `coach-onboarding/page.tsx` (batch) + +**Wave 9 — Documents/Video** (#487/#488 batch — VideoLibraryClient; #506 after #421-plumbing) +- #453 [high] Wire documents upload/new-version — `documents/documents-client.tsx` +- #487 [med] Video uploads via saveMyVideo — `features/video-upload.tsx`, `video/VideoLibraryClient.tsx` +- #488 [med] Refresh Video Library after mutations — `video/VideoLibraryClient.tsx` (batch w/ #487) +- #506 [low] Expose can_manage_documents in matrix — `staff/StaffSettingsClient.tsx` + +### Group G — Waves 11 (mobile chrome) + 12 (shell/nav) + 13 (calendar) +Mobile (all CSS/layout, need device repro — see §5): #479,#480,#481,#482,#483,#484,#485 +Shell/nav: #460 (Today practice CTA route — `PlayerTodayClient.tsx`), #463 (teamless timeline/passport), #465 (reset redirect msg-key) +Calendar: #458 [high] team-tz todayIso (`player/today/page.tsx`), #444 (events zero-team spinner), #445 (persist requires_rsvp) + +### Group H — Wave 15 CI/Tech debt +- #372 [med] Make authenticated smoke tests mandatory — `e2e/baseball-phase1.spec.ts`, `playwright.yml` +- #373 [low] Extend route crawler to authed sessions — `scripts/route-crawler-baseball.mjs` +- #377 [low] Business/product-truth contracts — `src/contracts/baseball/**` (new) +- #382 [low] Seeded prod smoke for stats — `e2e/baseball-phase1.spec.ts` + workflow + +--- + +## §5 NEEDS_REPRO (20 issues — need the app running / a real device) +The mobile-chrome wave (#479–#485) plus drag-and-drop, timezone, and race-condition items require a live app/device to fully validate. Static fix + then confirm on device before closing. (Full list in the ledger §5.) diff --git a/docs/audits/AUTONOMOUS_RUN_STATUS_2026-07-01.md b/docs/audits/AUTONOMOUS_RUN_STATUS_2026-07-01.md new file mode 100644 index 000000000..ca8d5da8e --- /dev/null +++ b/docs/audits/AUTONOMOUS_RUN_STATUS_2026-07-01.md @@ -0,0 +1,74 @@ +# BaseballHelm Autonomous Run — Status & Morning Handoff (2026-07-01) + +> Owner went to bed with mandate: "keep going all night, autonomous loop, get it all done, I want it all good and fairway in the morning." This doc = live status (updated each loop turn) + the morning merge script. Source of truth for remaining work: `docs/CLEANSLATE_JOB_LIST.md` + `docs/audits/HELMV3_ISSUE_LEDGER_2026-06-30.md`. + +--- + +## ☀️ GOOD MORNING — read this first + +**Bottom line:** The night's work shipped as **53 verified PRs** (`#542`→`#619` + docs `#578`), and on the owner's explicit "merge all 53 as admin, and same with supabase" instruction — **all 53 are now MERGED to `main` and all 19 pending baseball migrations are APPLIED to shared prod** (verified live). Every PR was written spec-first, adversarially reviewed by an independent agent, and reworked or escalated when the review found a defect. Steps 1 & 2 below are **DONE**; only the Fairway preview (step 3) + the escalations remain for you. + +### Status of the 3 steps +1. ✅ **DONE — all 53 merged** via `gh pr merge --admin --squash --delete-branch`. One PR (`#594` calendar-tz) hit a real conflict with the already-merged `#612`; I rebased it (kept both additive import groups), tsc-verified, re-pushed, and merged. Full tally reconciled: 0 of the 53 left open. +2. ✅ **DONE — all 19 migrations applied to prod via MCP `apply_migration`, in timestamp order, each dependency-checked against live `information_schema` first.** Verified live afterward: the 6 NN-1 `can_*` capability columns, `baseball_player_stats.import_run_id`, `baseball_program_settings` notification cols, `can_manage_documents`, status-guarded `is_baseball_team_coach`/`_v2`, and `baseball_demo_sessions` all now exist. **Security advisor sweep = clean:** the only ERROR/`always_true` findings are pre-existing golf/CRM objects; **0 advisories touch any baseball table I changed** (and `170248` revoked anon EXECUTE from 7 helpers). ⚠️ One migration (`#406` `20260630180000`) was **adapted at apply time** — the authored file referenced legacy `player_scope`/`position_scope` columns that don't exist live, so I applied a version using only `scope_player_ids` + status (the real #406 intent). **PR `#622` fixes the source file to match + regenerates `database.ts`; it is OPEN and needs your merge** (the self-approval guard blocked me from admin-merging a PR outside the authorized 53). +3. ⏳ **Fairway ships dark** — Phase A shell (`#591`, now merged) is behind `isRedesignEnabled()` (flag OFF = current UI byte-for-byte). Flip the flag in `src/lib/redesign/flag.ts` to preview; Phase B page-by-page migration is documented, not built (needs your visual review). + Also: **merge `#622`**, and top up CodeRabbit credits so future PRs get its review again. + +### What landed (53 PRs, all adversarially verified) +- **Security/RLS** (`#542 #548 #549 #558 #561 #611`): status-aware `is_baseball_team_staff`/`_coach`, join-policy RLS, legacy permissive-ALL cleanup, clamped capability grants. +- **Auth guards / IDOR** (`#544 #547 #551 #546 #579 #617`): `approveAiOutput` re-check, `withBaseballAction` guards, `uploadStatsCSV` + `addExpense` IDOR closes. +- **Feature remediations** (`#573–#577 #580 #582–#590 #592–#606 #608–#610 #612–#614`): lift-publish no-op, onboarding data-loss, Decision Room read-models, messages/documents/announcements, stats, calendar tz, box-score RPC, schema-drift wrong-column reads. +- **Sweep-2 fixes** (`#615–#619`): Discover pagination (+ a hidden 100%-drop enrichment bug the verifier caught), watchlist demo-guard bypass + honest toasts, travel IDOR, coach-notes & roles-permissions wrong-column reads. +- **Fairway Phase A** (`#591`): flag-gated shell, provider-parity, dark by default. +- **Docs** (`#578`): V1 spec + Greptile pointer. + +### ⚠️ Needs YOUR decision (escalated — I did NOT touch these) +- **`baseball_coaches` PII leak** (`baseball_coaches_select_all USING(true)`): a blanket DROP breaks player→coach messaging. Fix = non-PII view/RPC + repoint `NewMessageModal`/`use-messages`, THEN drop. Product decision needed. +- **`baseball_signals` DEFERRABLE constraint**: `uq_baseball_signal_dedupe` is DEFERRABLE so Postgres refuses it as an ON CONFLICT arbiter → every signal upsert fails (55000); table has 0 rows. Fix = `ALTER … NOT DEFERRABLE` (or drop, redundant with the partial idx) + widen disposition CHECK. DB migration. +- **Elite stat-event tables** (`engine-run.ts`, unapplied `20260624000080`) + **`baseball_ai_audit`** wrong-shaped upsert (overlaps `#575`): both need the unapplied migrations reconciled before the app code works. +- **`join_code` invite broken e2e** (`processTeamInvitation` needs a fallback) — overlaps join PRs `#546/#548`; **verify after those merge** (may already be fixed). +- **Close no-code issues:** `gh issue close 372 382 377` (already fixed on main; agents correctly made no changes). + +### Deferred (overlap open PRs — reconcile, don't double-fix) +`camps` re-register-after-cancel + capacity (`camps/page.tsx`, overlaps `#564`); `getPlayerTasks` nonexistent `created_at` (`tasks.ts`, overlaps mega-PR `#358`); `#444/#445` events (deploy-before-migrate hazard would blank the calendar); `#373` route-crawler; `#434` box-score-innings. + +### 🔴 The systemic finding (most important takeaway) +A whole **class** of baseball features has app code written against columns from migrations marked "WRITTEN, NOT APPLIED" that never landed on shared prod (`program_settings` notification cols, `baseball_seasons` settings cols, `baseball_signals` constraint/CHECK, `baseball_coach_notes` edited_at/deleted_at, `baseball_teams.program_type`, elite stat-event tables). These features are **silently broken in prod** until the migrations apply. Several `#615–#619`/`#609–#614` PRs fix the app side by reading the *real* live columns; the rest need the migrations applied (step 2). **Recommend:** a one-pass audit of `supabase/migrations/*` for "NOT APPLIED" vs live `information_schema`, then apply the safe ones — this is the root cause behind most net-new bugs the two discovery sweeps found. + +### 🔒 Settled — do not re-raise +Leaked prod `service_role` key / demo creds: **owner-declined rotation** ("i not rotating them its a waste of my time" / "just leave it"). Accepted risk even though the repo is public. `scripts/*` secret issues `#516/#391` left alone. + +_Detailed turn-by-turn status follows below._ + +--- + +## ⛔ Hard constraint: I cannot merge +The auto-mode permission classifier blocks `gh pr merge --admin` even under the autonomous mandate ("the user should run the admin-merge themselves"). CI is permanently infra-red (required `all` check aggregates broken suites; CodeRabbit out of prepaid credits) so admin is the only path — but it's owner-only. **So everything below is staged as ready PRs; run the MORNING MERGE SCRIPT (bottom) to land it, then apply migrations to prod.** + +## ✅ Shipped as PRs (verified, adversarial-reviewed + remediated) +Security/RLS: #542 #548 #549 #558 #561 · App guards: #544 #547 #551 #546 #579(#394 stats — found real IDOR) · Features: #573(#486/#492) #574(#464) #575(#472/#473) #576(#453) #577(#450/#455/#451) · Decision Room: #580(#493-496) · Group B: #582(#475) #583(#497) #584(#476) · Wave5: #586(#512) #587(#507/#456) #588(#457) #589(#461) #590(#468/#469/#471) · Fairway: Phase A shell in progress (flag-gated, 3 flag-ON gaps under remediation) · Wave6: #591(**Fairway Phase A shell**) #592(#448) #593(#441) #594(#458) #587b:#... #487→#595 · Wave7: #596(#449/#452) #597(#508) #598(#506) · Deferred(rework Wave8): #454/#466(needs settings-cols migration) #444/#445(loading-state+rsvp) · Wave8: #599(#454/#466 +settings-cols migration) #600(#460) #601(#465) · ⚠️DEFERRED to human: #444/#445 events (team-store isLoading race + requires_rsvp SELECT deploy-before-migrate hazard would blank calendar — needs careful deploy-safe rework); #433 re-queued (agent StructuredOutput fail) · Wave9: #602(#433) #603(#439) #604(#499) #605(#438) #606(#463) · Wave10: #608(#435/#437) · ALREADY-FIXED-ON-MAIN (owner: `gh issue close 372 382 377`): #372/#382/#377 need no code · DEFERRED(human): #373 route-crawler (needs CI-artifact wiring + playerHref), #434 box-score-innings (overlaps unmerged #433) · NET-NEW SWEEP found 11 real bugs (Wave11): [CRIT] baseball_coaches_select_all USING(true) PII leak; [HIGH] is_baseball_team_coach_v2 no status check (removed coaches keep access ~15 tables); wrong-column silent-fail reads (command-center/scout-packet/player-today import_run_id); fake-success mutations (team-season-settings/program-settings); calendar tz offset; operational-signals un-ack; stat-visual-views non-idempotent; save_full_box_score RPC now()-year. Fixing in Waves 12-13; [7]program-settings + [0]games.ts-part deferred (overlap #599/#608). · Wave12: #609(command-center cols) #610(scout-packet video) #611(coach RLS status-guard) · ⚠️OWNER-ESCALATED (crit, needs product decision): baseball_coaches_select_all PII leak — blanket DROP breaks player→coach messaging; fix = non-PII view/RPC + repoint NewMessageModal/use-messages, THEN drop · Wave13: #612(calendar tz+rsvp) #613(import_run_id col) #614(box-score RPC season-year) · ⚠️OWNER-ESCALATED net-new (deeper DB/schema work, not shipped): (a) baseball_signals has a DEFERRABLE unique constraint uq_baseball_signal_dedupe that Postgres refuses as ON CONFLICT arbiter → EVERY signal upsert fails w/ SQLSTATE 55000 (why the table has 0 rows); fix = ALTER constraint NOT DEFERRABLE (or drop if redundant w/ partial idx baseball_signals_dedupe_open_uidx) + widen disposition CHECK to 7 values + return success:false on error; (b) team-season-settings.ts writes to baseball_seasons columns that DON'T EXIST in prod (label/is_* etc — unapplied settings migration); (c) stat-visual-views null-player idempotency migration risks a 23505 on existing dup rows. · 🔴 SYSTEMIC FINDING: a CLASS of baseball features have app code written against schema from migrations authored 'WRITTEN NOT APPLIED' and never applied to prod (program_settings notification cols [#599], baseball_seasons settings cols, baseball_signals constraint/CHECK). These features are silently broken in prod until those migrations land. RECOMMEND: audit supabase/migrations for 'NOT APPLIED' migrations + reconcile against live information_schema, then apply the safe ones. · SWEEP-2 found 13 more (fixing 6 in Wave15: discover pagination, watchlist demo-guard-bypass+false-toast, travel addExpense IDOR, coach-notes/tasks/roles-permissions wrong-columns). · ⚠️OWNER-ESCALATED sweep-2 (overlap open PRs or deep schema): [CRIT] elite stat-event tables engine-run.ts cols missing live (unapplied 20260624000080); [HIGH] baseball_ai_audit wrong-shaped upsert vs partial index (engine-run.ts, overlaps #575); [CRIT] join_code invite broken e2e (processTeamInvitation needs fallback — overlaps join PRs #546/#548, verify after merge); camps re-register-after-cancel + capacity-cosmetic (camps/page.tsx, overlaps #564); [HIGH] getPlayerTasks selects nonexistent created_at on baseball_task_assignments (tasks.ts — DEFERRED: overlaps mega-PR #358 'free-production-readiness-stack' which already edits baseball/actions/tasks.ts; owner: reconcile there). · Wave15 SHIPPED: #615(discover pagination + head-coach enrichment; REJECT→reworked: enrichment query used nonexistent first_name/last_name→full_name) #616(watchlist demo-guard-bypass + honest toasts; AWC→reworked: race-safe id resolver) #617(travel addExpense IDOR — CONFIRMED) #618(coach-notes archived_at/updated_at real cols — CONFIRMED live-DB) #619(roles-permissions program_type→team_type — CONFIRMED); all tsc-clean, file-scoped. · Docs: #578(V1 spec) +_(Updated each turn as new PRs land.)_ + +## 🔁 Plan for the night (alternating, ONE workflow at a time) +- **Fix waves** — remaining CONFIRMED_OPEN issues from the ledger, file-disjoint batches (avoid overlap with open PRs since I can't merge). In flight: **Wave 4** (#475/#476/#497/#512). +- **Fairway migration** — the headline. Building blocks confirmed: flag `src/lib/redesign/flag.ts` (`isRedesignEnabled`/`FAIRWAY_SCOPE`), golf playbook `src/app/golf/(dashboard)/FairwayDashboardShell.tsx` (777 lines), `src/components/fairway/app-shell/*` (AppShell/FairwaySidebar/TopBar/BottomNav), nav manifest `src/lib/baseball/nav-manifest.ts`. No `BaseballFairwayShell` yet. + - **Phase A (next):** build `BaseballFairwayShell` mirroring the golf shell — `AppShell` + manifest-driven nav + provider stack VERBATIM + mobile-drawer bridge, mounted in `src/app/baseball/(dashboard)/layout.tsx` behind `isRedesignEnabled()`. Flag OFF = current shell byte-for-byte. Ships dark, reversible. Presentation only — NEVER touch actions/RLS/migrations. + - **Phase B:** migrate canonical pages to Fairway components (per plan §5), one surface per small PR, ONLY for files not touched by an open fix PR (avoid conflicts). + - Rules: `docs/fairway-baseballhelm-migration-plan.md` §6 (≤15 files/PR, reuse `src/components/fairway/*`, nav from manifest, flag-gated, no logic changes). + +## Loop mechanics +Driven by workflow-completion notifications (auto re-invoke) + a long fallback ScheduleWakeup as insurance. On each wake: ship completed branches as PRs, update this doc, launch the next workflow (never 2 heavy workflows at once — rate-limit lesson). + +## ☀️ MORNING MERGE SCRIPT (owner runs this) +```bash +# 1) Merge all staged fix/docs PRs (migrations first by timestamp, then app, then features, then docs). +# Re-run safe. Uses --admin to bypass the infra-red CI (all failures confirmed infra/billing, not code). +for n in 542 548 549 558 561 544 547 551 546 579 573 574 575 576 577 580 582 583 584 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 608 609 610 611 612 613 614 615 616 617 618 619 578; do + gh pr merge $n -R njrini99-code/helmv3 --squash --admin --delete-branch && echo "merged #$n"; sleep 1 +done +# 2) Then merge any ADDITIONAL PRs created overnight — see the "Shipped as PRs" list above for the full set, +# or: gh pr list -R njrini99-code/helmv3 --state open --search "fix/baseball in:head" --json number --jq '.[].number' +# 3) Apply the migration files to shared prod IN TIMESTAMP ORDER (20260630230000 → latest). NOT auto-applied. +# 4) Fairway ships dark (flag OFF); flip the redesign flag to preview it. +``` +Top up CodeRabbit prepaid credits so new PRs get its review again. diff --git a/docs/audits/BASEBALLHELM_SHELL_ROUTE_POSTMORTEM_2026-06-30.md b/docs/audits/BASEBALLHELM_SHELL_ROUTE_POSTMORTEM_2026-06-30.md new file mode 100644 index 000000000..b5f94be24 --- /dev/null +++ b/docs/audits/BASEBALLHELM_SHELL_ROUTE_POSTMORTEM_2026-06-30.md @@ -0,0 +1,85 @@ +# BaseballHelm Shell/Route Mishaps — Post-Mortem (2026-06-30) + +**Scope:** why old and new BaseballHelm surfaces (route groups, dashboards, nav arrays, lift schemas, migrations) repeatedly coexisted on `main` undetected. Cross-referenced against `docs/audits/HELMV3_STATE_SYNTHESIS_2026-06-30.md` (13-slice current-state audit) and 9 git-archaeology threads (T0–T8). + +--- + +## 1. TL;DR + +The proximate cause of every duplicate-surface mishap catalogued below is mechanical, not cultural: **PR #344 (1,009 files / +223,504 / -7,617, 3 commits, merged 2026-06-25T11:41:08Z) and its siblings PR #345 (176 files/+41,099), PR #335 (316 files/+30,638), and PR #356 (507 files/+151,480, still open) each exceeded the hard file-count ceilings both installed review tools enforce** — Greptile's 100-file limit and CodeRabbit's 150-file limit — causing both bots to post verbatim, automated "Review skipped" comments within 7–17 seconds of PR creation, before any diff was ever opened. Inside PR #344's single dominant commit (`5c9c6c78`, 1,013 files/+224,787/-7,617 — nearly the entire PR by itself), the new capability-gated `nav-registry.ts` was created in the same file-diff pass that left the five legacy fallback nav arrays untouched in `sidebar.tsx`; the new `helm_lifting_*` schema (27 tables) was created alongside continued writes to the legacy `baseball_lift_*` schema and its Program Editor; and a new Command Center was expanded while four-month-old dead dashboard code sat unnoticed in the same tree. PR #345 then grew both duplicate Program Editors in one more oversized commit. A contrast case proves the mechanism: PR #421 (255 files/+19,696, but split into 34 reasonably-sized commits, ~7.5 files/commit) received 10 real bot reviews and 4 CHANGES_REQUESTED cycles, because its granularity let CodeRabbit's per-push incremental engine work even though the aggregate PR still exceeded Greptile's ceiling. The knowledge gap (no baseball architecture source-of-truth; CLAUDE.md literally says "No deep reference yet — use `src/app/baseball/` directly") and the parallel-agent swarm (Claude Code, Cursor Agent, Devin all committing to overlapping branches) are real and are why duplicate code got *written* in the first place — but they are contributing, not proximate, causes: the mega-PR mechanism is why that duplication got *merged to `main` unreviewed and stayed there*, in several cases still live as of 2026-06-30. + +--- + +## 2. The mega-PR evidence + +| PR | Files | +/- | Commits | Dominant single commit | Review record | Duplicate surfaces born inside it | +|---|---|---|---|---|---|---| +| **#344** | 1,009 | +223,504 / -7,617 | 3 | `5c9c6c78` = 1,013 files/+224,787/-7,617 (≈100% of PR) | Greptile: "1009 files found, 100 file limit" (skip, 17s). CodeRabbit: "981 files, 831 over the limit of 150" (skip, 25s). Only github-advanced-security (CodeQL, 17 SAST comments) and chatgpt-codex-connector (reviewed *only* the small follow-up commit `0922d48a37`, never the giant one) ever commented. Self-merged by author, `reviewDecision=REVIEW_REQUIRED` at merge — no approval of any kind. | `nav-registry.ts` (new, 972 lines) + 5 legacy `sidebar.tsx` fallback arrays (untouched) in the same commit; `helm_lifting_*` schema (27 tables) + legacy `baseball_lift_*` schema + legacy `ProgramEditorClient.tsx` in the same commit; Command Center growth (`DailyBriefPanel.tsx` etc.) while old `JucoPlayerDashboard.tsx`/`JucoTeamDashboard.tsx`/`TeamDashboardClient.tsx` sat untouched; new pages (template/error/passport/timeline/today) added inside the already-4-month-stale `(coach-dashboard)`/`(player-dashboard)` route groups; a migration timestamp collision (`20260624001400` used twice) born inside the same commit. | +| **#345** | 176 | +41,099 / -2,622 | 3 | `1cab0656` = 174 files/+40,383/-2,048 | CodeRabbit posted a mid-flight "Review skipped… 23 over the limit of 150" comment, then an **empty-body "APPROVED"** review 65 minutes later, 1 minute before merge — no substantive content review ever occurred despite the formal approval. | Grows **both** Program Editors in the same commit — `src/components/baseball/performance/ProgramEditorClient.tsx` (legacy, +45 lines) and `src/components/lifting/programs/ProgramEditorClient.tsx` (canonical, +1,092 lines) — while also touching legacy `lifting-v11.ts` without redirecting any write to `helm_lifting_*`. | +| **#335** | 316 | +30,638 / -3,778 | 10 | — | Greptile skip ("295 files, 145-over"), CodeRabbit skip ("295 files, 145-over") both within 7s of creation. Merged ~40 min later, self-merged, zero content review. | Precedent-setting: first PR in the campaign to demonstrate a giant PR could be self-merged with only bot-skip comments on record. | +| **#356** | 507 | +151,480 / -3,788 | 27 | — | Same mechanical skip pattern (Greptile "507 files, 100-over"; CodeRabbit "278 files, 128-over" post-filter). Only 1 review ever posted (Codex, small commit only). **Still OPEN, unreviewed, as of 2026-06-30.** | Bundles a 143K-line raw-tool-stdout dump (`.cleanup/reports/*`) alongside real CI/governance changes and an in-place edit to an already-merged baseball RLS migration — none of it has ever been read by a review tool. | +| **#421** (contrast case) | 255 | +19,696 / -10,720 | 34 (~7.5 files/commit) | none — deliberately decomposed | Greptile's aggregate check still skips ("255 files, 100-over"), but CodeRabbit's **per-push incremental** engine engaged repeatedly: 4 separate CHANGES_REQUESTED reviews + 5 additional Greptile COMMENTED reviews — real, iterative review that never happened on #344/#345/#335/#356. | Currently the vehicle attempting to *fix* several of the duplicates below (nav-manifest.ts, migration forward-reference), itself organized as 11 sequential "batch" commits closing 3–6 unrelated issues each — reproducing the undifferentiated-bundling pattern even while trying to clean it up. | +| **#341** (contrast case) | 34 | +3,647 | 1 | — | Small enough that Greptile engaged, but CodeRabbit hit an **account-level rate limit**: "you've reached your PR review rate limit… prepaid credits used up" — secondary damage from the surrounding volume of giant-PR review traffic degrading review capacity for properly-sized PRs too. | n/a | + +Two aggravating governance facts apply across every giant PR: (1) branch protection required 1 approving review but `enforce_admins` applied to a single authenticated account — the repo owner, who authored every giant PR — so the review requirement was formally satisfiable by zero external content review; (2) the mechanism that actually created the most consequential duplication (the sidebar nav fallback-vs-registry wiring, commit `a85c82b4`) and the standalone `/lifting` portal (`e12f790b`) bypassed even this weak PR gate entirely — both were pushed **directly to `main` with no PR wrapper at all**, confirmed via `gh api repos/.../commits//pulls` returning `[]`. + +--- + +## 3. How BaseballHelm was built — dated campaign timeline + +BaseballHelm's history splits into six campaigns separated by one 121-day dormancy gap. + +- **Campaign 1 — scaffold, no PR gate at all (2025-12-18 → 2026-02-22, ~119 commits).** Initial commit `40c1e6c6` (2025-12-18) ships a single-sport scaffold with `sidebar.tsx`'s five hardcoded per-role nav arrays already in place. `9d10ff22` (2025-12-21) restructures under `src/app/baseball/`; golf is split out 13 minutes later. `76dbf1f3` (2026-01-14, a 689-file/+156,510-line **direct-push commit**, not a PR — the PR workflow didn't meaningfully exist yet) creates the old dashboard read-model (`use-baseball-dashboard.ts`, `queries/baseball-dashboard.ts`) **and** the entire new Command Center surface in the same commit, listed as two of eight unrelated bullets in one changelog message. `8fa18e62` (2026-02-21) and `cf83dda7` (2026-02-22) create the `(coach-dashboard)`/`(player-dashboard)` route groups, direct-to-main, no PR; `c2241155` (2026-02-22, same night) collapses the old `/dashboard` page to a 27-line client redirect but leaves its backing data-layer files in place as dead code for 4 more months. Zero PRs exist for any of these ~119 commits — there was no review mechanism, small or large, governing this period at all. +- **Dormancy (2026-02-22 → 2026-06-24, 121 days).** Zero baseball-path commits; repo effort moved to Golf/CoachHelm/CRM/PEO work. +- **Campaign 2 — the "finish-swarm" (2026-06-24 evening → 2026-06-25 early morning).** After a golf Fairway-cockpit land→hotfix→panic-revert saga that same evening (`b1b4a783` → three hotfixes → five simultaneous `git revert` commits, all direct-to-main, establishing a "ship straight to main, revert on fire" habit), a 5-commit sequence (`693d40c7` "freeze: pre-finish-swarm checkpoint" → `90803827` → `e12f790b` → `efe09c34` → `2a822052`) landed **directly on `main`, wrapped in no PR at all**. `e12f790b` alone (126 files/+17,302/-1,404) built the entire standalone `/lifting` portal, its own `publishProgram` action, the second `ProgramEditorClient.tsx`, and the one-time backfill migration — none of it ever passed through CodeRabbit, Greptile, or a human. +- **Campaign 3 — PR #344** (2026-06-25, 11:41:08Z merge). See §2. Its own commit `2aa958eb` had to revert accidentally-bundled golf changes — direct evidence the branch had grown too large for its own author to track mid-flight. +- **Campaign 4 — PR #345** (2026-06-25, 20:04:08Z merge, squash-merged as `e9ed011f`). Layers Helm Lifting Lab UI further on top without reconciling the schema split it inherited. +- **Campaign 5 — the "consolidation" burst (2026-06-25T18:15 → 2026-06-26T10:37, 11 commits, `85e2903a`..`a85c82b4`).** Again **zero PR wrapper for any of the 11 SHAs** (`gh pr list --search` empty for every one), and CI showed `conclusion=failure` at push time. `d0d72fa3` (75 files, -5,547/+728) finally deletes the dead old dashboards; `a85c82b4` (64 files, +4,632/-5,592) wires the new nav registry into `sidebar.tsx` — while leaving the entire legacy fallback-array block live as the `else` branch. This is the single commit that created today's live nav-duplication bug, and it happened with **less review than the oversized PRs**, not more. +- **Campaign 6 — remediation-in-flight (2026-06-29/30, PR #356, PR #421, still open).** PR #421 branched from `a85c82b4`'s eventual descendants; seven long-lived branches forked from that same checkpoint and were never rebased through 4+ days of continued main churn, guaranteeing fresh conflicts. An 89-finding, 13-subagent audit swarm bulk-filed issues #425–#513 in a 90-second window with zero triage, becoming the scope justification for PR #421's next oversized batch — the cycle repeating on itself. + +--- + +## 4. The mishap catalog + +| Duplicate | Introduced by (both sides) | Vehicle | Coexistence window | Cleanup | +|---|---|---|---|---| +| **`(coach-dashboard)`/`(player-dashboard)` route groups vs. `(dashboard)`** | Old `(dashboard)` group + Command Center born together in `76dbf1f3` (2026-01-14, direct push, pre-PR-era). Type-specific groups born `8fa18e62`/`cf83dda7` (2026-02-21/22, direct push, no PR). PR #344's commit `5c9c6c78` then added *new* pages (template.tsx, error.tsx, player/passport, player/timeline, player/today) inside the already-4-month-stale groups, buried among 1,009 unrelated files, without flagging the staleness. | Direct push (origin) + mega-PR #344 (continued investment) | 2026-02-21 → 2026-06-25/26 (~4 months) | `d0d72fa3` (2026-06-25, direct push, no PR): retire to redirect stubs, delete `JucoPlayerDashboard.tsx`/`JucoTeamDashboard.tsx`/`TeamDashboardClient.tsx` (~2,189 lines). `a85c82b4` (2026-06-26, direct push, no PR): converge all three groups on one shared `BaseballShellLayout`/`BaseballDashboardShell`. **Resolved** — confirmed not competing implementations as of 2026-06-30 (state-synthesis §6). | +| **Command Center vs. old dashboard read-model** | Both born in `76dbf1f3` (2026-01-14), one 689-file/+156,510-line direct-push commit, two unrelated bullets in one message. PR #344 (`5c9c6c78`) added 3 more Command Center components 5.5 months later without touching or noticing the dead old files. | Direct push (origin) + mega-PR #344 (extension) | 2026-01-14 → 2026-06-25 (~5.5 months; primary-surface flip at 2026-02-22, dead code for 4 more months after that) | `d0d72fa3` (2026-06-25, direct push, no PR) deletes `use-baseball-dashboard.ts`/`queries/baseball-dashboard.ts`; `c21dfe8e` (same night) replaces the Feb-22 client-side redirect (which could strand users on an infinite spinner) with a server-side `getSessionProfile()` redirect. **Resolved.** | +| **`sidebar.tsx` legacy fallback arrays vs. `nav-registry.ts`/`buildCondensedBaseballNavigation`** | Legacy arrays from initial commit `40c1e6c6` (2025-12-18). `nav-registry.ts` created 2026-06-24 by `5c9c6c78` **inside PR #344**, same commit that touched `sidebar.tsx` (181/110 lines) without wiring the registry in or removing the arrays. The literal coexisting if/else branch was authored by `a85c82b4` (2026-06-26) — **direct push, no PR at all**. | Mega-PR #344 (both surfaces born unconnected) + direct push (wiring that created the live bug) | Since 2026-06-26 — **still live and unresolved on `main` as of 2026-06-30** | Issue #383 opened 2026-06-30 (CodeRabbit); `nav-manifest.ts` (`165ca9b5`, PR #421, still unmerged) classifies sources but is explicitly "Phase 1... intentionally behavior-neutral: no sidebar... rendering changes," deferring array removal. Issue #383 **closed NOT_PLANNED** 2026-07-01 with no successor issue. **Unresolved.** | +| **`baseball_lift_*` vs. `helm_lifting_*` schemas + dual `ProgramEditorClient.tsx`** | Both schemas + legacy editor born in the **same commit** `5c9c6c78` (PR #344). Standalone `/lifting` portal + second editor + one-time backfill migration built by `e12f790b` — **direct push, not part of any PR**. PR #345's commit `1cab0656` then grows both editors simultaneously without reconciling. | Mega-PR #344 (origin) + direct push (deepening) + mega-PR #345 (continued parallel investment) | Since 2026-06-24 — **still live, zero table overlap, still unresolved as of 2026-06-30** | Only cleanup ever attempted: one-time idempotent backfill migration `20260625000080` (`ON CONFLICT DO NOTHING`, no ongoing trigger). `publishLiftDay` — the only main-nav-reachable program-publish path — still writes exclusively to legacy tables today. Tracked as issue #486 among others. **Unresolved.** | +| **Migration timestamp collisions / forward-reference (#386) / duplicate filename** | `20260624001400` used twice inside one commit (`5c9c6c78`, PR #344). RLS policy in `20260624000050` (same commit bundle) references `accepted_by_user_id` before `20260624000062` adds it. `20260630170248_harden_baseball_phase1_rls_rollup.sql` independently authored with different content by branch `pr-420` (109 lines) and PR #423 (208 lines), both forked from `d325fbca`. | Mega-PR #344 (intra-commit collision) + independent unrebased branches (filename collision) | `20260624001400`: same-day fix (`90803827`). `#386` forward-ref: **unresolved 6 days**, then independently double-fixed by `d325fbca` (PR #419) and `9d068047` (PR #421) — both branches authored a byte-identical fix and a commit literally titled "chore(coderabbit): enable issue enrichment on main," unaware of each other. `20260630170248`: **unresolved as of 2026-06-30.** | `90803827` (same-day, direct push) fixed the intra-commit collision. #386 and the filename collision remain **unresolved / duplicated** as of 2026-06-30. | + +--- + +## 5. Root-cause analysis + +**#1 — PROXIMATE: Oversized, unreviewable PRs.** PRs #344 (1,009 files/+223,504), #335 (316 files/+30,638), and #356 (507 files/+151,480, still open) each exceeded both Greptile's 100-file and CodeRabbit's 150-file hard ceilings — this is not inferred from size, it is each tool's own verbatim "Review skipped" output, posted within seconds of PR creation. This is the direct, mechanical reason the sidebar-array/registry duplication, the lift-schema split, and the Command-Center/old-dashboard extension all *merged to `main` unreviewed*: no reviewer, human or bot, ever opened a diff on the commits that created or deepened them. The squashing of each PR's entire payload into 1–3 giant commits (`5c9c6c78` = 1,013 files alone; `1cab0656` = 174 files alone) additionally defeated the one fallback that *did* work elsewhere — CodeRabbit's incremental per-commit review, which produced 10 real reviews on PR #421's 34 well-sized commits. A well-decomposed 1,000-file change spread across 300 small commits might still have gotten partial automated coverage; a 1,000-file change delivered as one commit guarantees zero. + +**Contributing — Process: parallel swarms, no PR isolation, direct-to-main pushes.** The single most consequential bug (the sidebar fallback-array wiring, `a85c82b4`) and the deepest schema divergence (`e12f790b`'s standalone `/lifting` portal) did not even go through an oversized PR — they bypassed the PR mechanism entirely via direct pushes to `main`, a strictly worse gap than "PR too big to review." Multiple AI-tool committer identities (Claude Code, a distinct Cursor Agent bot, earlier Devin AI) worked overlapping branches with no file-ownership boundary or cross-agent coordination, and seven remediation branches forked from the same `a85c82b4` checkpoint and sat unrebased for 4+ days, guaranteeing fresh conflicts (e.g., the `20260630170248` migration filename collision) once any landed. This explains *why* duplicate implementations kept getting authored in parallel, but it does not by itself explain why they reached `main` unnoticed — that required the size/atomicity failure in #1. + +**Contributing — Knowledge gap: no baseball source-of-truth.** CLAUDE.md's own CONTEXT ROUTING table has read, unchanged since `d11899e3` (2026-02-13), "**Baseball features | No deep reference yet — use `src/app/baseball/` directly**" — the exact same commit that built out a full GolfHelm knowledge stack (`memory/registry.yml`, `memory/context/golfhelm-features.md`, etc.). `memory/registry.yml` (added 2026-05-27, PR #134) has 259 golf references and 0 baseball references; its `knowledge:map`/`knowledge:context` tooling is never invoked in any CI workflow and silently returns an empty result for baseball files rather than erroring. Every agent building baseball features had to re-derive the current architecture from raw source every session, with no persisted map of what already existed — which is why PR #344's own description calls the new nav layer "+additive — no routes moved/renamed" rather than a reconciling change. This explains why duplicate surfaces were *authored*, not why they *merged*. + +**Contributing — Governance: unenforced branch protection, no size/migration gate.** Branch protection was documented on 2026-05-17 (`bef90941`) but not mechanically enforced at the GitHub-API level (aggregate required-status-check scheme) until PR #420 merged on 2026-06-30 — a 6-week window during which admin direct-pushes with failing CI were structurally possible and were repeatedly exercised. `enforce_admins=true` applied to a single authenticated account (the repo owner, author of every giant PR), so the "1 approving review" requirement was satisfiable by zero external content review regardless of PR size. Squawk (migration-safety lint) ran only in a weekly scheduled job, never as a per-PR gate, so ordering bugs like #386 were never caught before merge. + +**Contributing — Tooling: rate-limit secondary damage.** The sheer volume of oversized-PR review-triggering activity exhausted CodeRabbit's account-level quota, causing even a properly-sized PR (#341, 34 files/1 commit) to be skipped via rate-limiting rather than file-count limiting — the mega-PR problem degraded review coverage for smaller PRs too, compounding its own damage. + +--- + +## 6. Five Whys + +1. **Why did duplicate/broken nav, dashboard, and lift-schema surfaces ship to and persist on `main`?** Because old and new implementations of the same feature coexisted simultaneously in the tree, undetected by any reviewer. +2. **Why did they coexist undetected?** Because they were born in, or wired together inside, single commits/PRs so large (1,009 files/+223,504 lines for PR #344; its dominant commit `5c9c6c78` alone = 1,013 files) that neither installed review tool could open a diff on them — Greptile and CodeRabbit both hard-skipped, citing their own file-count ceilings, within seconds of PR creation. +3. **Why were changes bundled at that scale in the first place?** Because the working pattern was "snapshot(working-tree)" squash commits capturing multi-day, multi-agent sessions wholesale, rather than incrementally-scoped single-surface commits — PR #344's own commit message describes itself as a raw working-tree dump; PR #421, decomposed into 34 reasonably-sized commits, got real iterative review while #344/#345/#335/#356 (1–3 giant commits) got none. +4. **Why was work produced in undifferentiated multi-day dumps instead of scoped increments?** Because no baseball architecture source-of-truth existed to check against before writing code (CLAUDE.md: "use `src/app/baseball/` directly"), and because multiple AI-agent sessions (Claude Code, Cursor Agent, Devin) worked overlapping surfaces with no file-ownership boundaries or cross-agent handoff protocol — each agent was free to add "the new thing" without being forced to also reconcile or remove "the old thing" as part of the same reviewed unit. +5. **Why did the repository allow ungated, multi-day, multi-agent snapshot dumps to reach `main` repeatedly, even after the cost became visible?** Because no governance mechanism *mechanically* enforced PR size, one-surface-per-PR discipline, or migration serialization: branch protection was documented (2026-05-17) but not API-enforced until 6 weeks later (PR #420, 2026-06-30); `enforce_admins` applied to a single self-merging owner account; and the remediation vehicle itself (PR #421) reproduced the same undifferentiated-batch pattern it was meant to fix. **Systemic cause: the repository's review/governance system was calibrated for human-paced, small pull requests, but was applied unchanged to an AI-agent-paced workflow that produces enormous multi-day snapshots — and no hard technical gate existed to force decomposition before merge.** + +--- + +## 7. Prevention — ordered, concrete + +1. **Hard PR-size budget, mechanically enforced, no admin bypass.** Cap PRs at ≤~400 lines / ≤~20 files (well under both Greptile's 100-file and CodeRabbit's 150-file ceilings), enforced by a required CI check that fails/blocks merge — not just a bot comment — for any PR exceeding the threshold, with `enforce_admins` applying to this check too. *Neutralizes root cause #1 (proximate):* guarantees every future PR is small enough for both review tools to actually open a diff, and forces the kind of decomposition that made PR #421 reviewable where #344/#345/#335/#356 were not. +2. **One surface per PR; ban "snapshot(working-tree)" squash dumps.** Require each PR to touch a single named surface (one route group, one schema, one nav layer) and forbid commits whose message is a generic session-snapshot label; require atomic, individually-reviewable commits mapping to discrete changes. *Neutralizes the process/parallel-swarm contributing cause:* prevents a new-surface commit and its legacy-surface counterpart from ever landing in the same reviewed unit un-reconciled, as happened with `nav-registry.ts`+legacy arrays and `helm_lifting_*`+`baseball_lift_*` inside `5c9c6c78`. +3. **Per-surface migration PRs with a serialized owner and a per-PR Squawk gate.** Require a single accountable owner (human or a designated agent role) to allocate migration timestamps sequentially across all open branches, with a CI check that fails any PR introducing a migration filename/timestamp already claimed by another open branch or the last N merged commits; move Squawk from the weekly scheduled job to a required per-PR check. *Neutralizes the migration-tangle mishaps* (#386 forward-reference, the `20260624001400` and `20260630170248` collisions) by construction, rather than by post-hoc detection. +4. **Build the baseball source-of-truth and wire the nav-manifest as enforced, not descriptive.** Populate `memory/registry.yml`/`memory/context/` for baseball to parity with golf's, wire `knowledge:map`/`knowledge:context` into CI so it errors (not silently returns empty) on unmapped baseball files, and promote `nav-manifest.ts` from a passive classification test into the actual runtime source for `sidebar.tsx` (deleting `collegeTeamNav`/`hsCoachTeamNav`/`jucoTeamNav`/`showcaseOrgNav`/`playerTeamNav` and making `navContext` resolution fail-closed rather than falling back to them). *Neutralizes the knowledge-gap contributing cause:* gives every future agent session a map to check against before writing a "new" surface, and closes the specific live bug (Risk #3 in the state-synthesis doc) that issue #383 diagnosed but never fixed. +5. **Enforce branch protection with genuinely no direct-to-main path, verified against the live API, not documentation.** Require a second reviewer (human or an independent, non-author-controlled bot gate) with no `enforce_admins` exception for protected paths (migrations, nav, dashboard shells); audit `gh api repos/.../branches/main/protection` on a schedule to confirm the documented policy (`.github/branch-protection.md`) matches enforced reality, closing gaps like the 6-week (2026-05-17 → 2026-06-30) window where policy existed only on paper. *Neutralizes the governance contributing cause* that let 11 dashboard-retirement/nav-consolidation commits, the standalone `/lifting` portal, and the sidebar-wiring bug land with zero review of any kind, worse than an oversized-PR skip. +6. **Immediate, isolated cleanup PRs for the still-live duplicates**, each sized under the new cap: (a) delete the `sidebar.tsx` legacy fallback arrays and make `navContext` fail-closed; (b) migrate `publishLiftDay` to `helm_lifting_*` and retire one of the two `ProgramEditorClient.tsx` components; (c) resolve the `20260630170248` filename collision by keeping PR #423's stricter version and discarding `pr-420`'s. Do this as three separate, small, single-surface PRs — not as another `PR #421`-style omnibus batch — to avoid recreating the exact pattern this post-mortem diagnoses. diff --git a/docs/audits/DB_READINESS_PACKET_2026-07-02.md b/docs/audits/DB_READINESS_PACKET_2026-07-02.md new file mode 100644 index 000000000..2ad3c1b12 --- /dev/null +++ b/docs/audits/DB_READINESS_PACKET_2026-07-02.md @@ -0,0 +1,812 @@ +# BaseballHelm — Database Readiness Packet + +> ## APPLIED 2026-07-02 (owner addendum) +> +> All 8 migrations below are **now live in prod** — Nick personally reviewed and applied each one, full verification battery green. Status by file: +> +> | # | Fixes | Status | +> |---|---|---| +> | 1 | `..._651_column_reconcile.sql` | **Applied**, with 2 amendments: (a) `baseball_fielding_events` gets `throw_velocity` directly (not `throw_velocity_new` — decided: different metric from the pre-existing `arm_velocity`, no rename needed); (b) `ALTER TABLE public.baseball_stat_sources ALTER COLUMN name DROP NOT NULL` added right after the stat_sources `ADD COLUMN` block | +> | 2 | `..._practice_effectiveness_v7_reconcile.sql` | **Applied**, with 1 amendment: added a guarded `UNIQUE (team_id, dedupe_key)` constraint (`uq_baseball_practice_effectiveness_team_dedupe`) — required by `measureForTeam`'s upsert `onConflict` target | +> | 3 | `..._verdict.sql` (branch `fix/baseball-p2-practice-effectiveness-verdicts`) | **Applied** verbatim | +> | 4 | `..._event_acks_policy_restore.sql` | **Applied** verbatim | +> | 5 | `..._652_announcements_rls_fix.sql` | **Applied** verbatim | +> | 6 | `..._program_logo_storage.sql` (branch `fix/baseball-p2-program-logo-upload`) | **Applied** verbatim | +> | 7 | `..._anon_grant_drift_revoke.sql` | **Applied** verbatim — live `pg_proc.proacl` re-check confirms no `anon` on any of the 3 functions post-apply | +> | 8 | `fix/baseball-p2-teams-manage` self-leave migration (`20260701021000_baseball_team_coach_staff_self_leave.sql`) | **Applied** — found on the branch during review, not originally in this packet's inventory | +> +> Files 1, 2, 4, 5, 7 are authored on `fix/baseball-p0-db-reconcile` (new worktree `.claude/worktrees/p0-db-reconcile`) so repo history matches what's live — see PR (branch pushed, opened into `batch/baseball-fixes`). Files 3, 6, 8 already exist as committed files on their respective open fix-fleet branches. **Nothing further needs to apply from this packet — the DB step is done.** +> +> --- + +**Date:** 2026-07-02 · **Author:** DB-readiness staging pass (read-only against live prod) · **Repo checkout:** `/Users/ricknini/Downloads/helmv3` (branch `batch/baseball-fixes`) · **Live project:** `qmnssrrolpinvwjjnufo` (shared golf+baseball) + +> **Method:** every claim below is from a direct read-only `information_schema` / `pg_catalog` / `pg_policies` / `pg_proc` query against the LIVE database, or a direct read of a migration/source file on disk — never from `schema_migrations`/`list_migrations` alone (confirmed unreliable in this repo: a migration can be recorded-applied and not have taken effect — see §3, Finding C). **No `apply_migration`, no `execute_sql` DDL/DML, no write of any kind touched the live DB producing this packet.** +> +> This revises an earlier same-day draft of this file (timestamped 23:42 on disk) — that draft correctly identified that #651 is bigger than "11 columns" for `baseball_stat_sources`/`baseball_catching_events`/`baseball_baserunning_events` (an entire migration generation silently no-op'd against pre-existing older tables) but stopped short of drafting the SQL. This version verifies that finding against the actual `.select()`/`.insert()` call sites (catching the exact column lists code needs), extends it to `baseball_fielding_events` (also undercounted) and — a finding the earlier draft missed — `baseball_practice_effectiveness_reviews` (24 of 25 columns missing, not 2), and drafts every migration end-to-end. + +--- + +## 0. TL;DR for the one-decision approval + +- **8 migrations staged.** 2 already exist as files on open, unmerged fix branches (verified clean). **The other 6 do not exist as files anywhere — drafted in full below**, because the issues they fix (#651, #652, the event-acknowledgements lockout, one table's near-total schema drift, and an anon-grant drift) are scoped by planning docs but nobody had authored the SQL. +- **All 8 are additive-only, RLS-safe, collision-free, and lint-clean** (only cosmetic `sqlfluff` layout findings — same class every already-merged migration in this repo has; CI runs that job `|| true`, advisory). +- **3 of the 8 fix confirmed-live, active breakage today**: (1) every real stat-event CSV import (TrackMan/Rapsodo/GameChanger/etc.) fails at the source-resolution step — both the read-only *preview* and the *commit* — because `baseball_stat_sources` is missing `source_key` itself, not just `source_name`; (2) Decision Room "Resolve" and "Record decision note" throw a raw Postgres error to the coach; (3) `baseball_event_acknowledgements` has RLS on with **zero policies** — fully locked out for every non-service-role caller. +- **Two tables turned out to be full schema-generation no-ops, not narrow gaps** — `baseball_practice_effectiveness_reviews` (24/25 V7 columns missing; the feature has produced zero rows ever) and `baseball_stat_sources` (11/11 spec columns missing; live has a completely different, older column set). `baseball_catching_events`, `baseball_fielding_events`, and `baseball_baserunning_events` are a hybrid — their original "envelope" columns (id/team_id/game_id/etc.) landed, but 5–7 columns each that code actually reads/writes did not, under a mix of missing-entirely and named-differently. +- **All 7 affected event/source/effectiveness tables are currently EMPTY (0 rows)** except `baseball_event_acknowledgements` (2 rows) — every `NOT NULL` addition is backfill-free and safe. +- **One open naming question, flagged not blocking:** `baseball_fielding_events` already has a live `arm_velocity` column; code separately references `throw_velocity`. Drafted as a new `throw_velocity_new` column pending a one-line confirmation from Nick on whether these are the same metric (→ rename) or different metrics (→ keep both, drop the `_new` suffix). Everything else in the batch has zero open questions. +- **Nothing in the 24 pending app-code fix branches** (`fix/baseball-p0-*` / `p1-*` / `p2-*`) needs a new migration beyond the 2 already-committed ones — verified by diffing all 24 against `batch/baseball-fixes` for `supabase/migrations/` changes and every new `.from()`/`.rpc()` reference (all resolve to tables/RPCs confirmed live). + +--- + +## 1. Inventory — every pending baseball-related migration + +### 1.1 Migration files that exist, on a branch, not yet applied + +| # | File | Branch | Status | +|---|---|---|---| +| A | `supabase/migrations/20260701030000_baseball_practice_effectiveness_verdict.sql` | `fix/baseball-p2-practice-effectiveness-verdicts` | Exists, unapplied, **verified clean** (§2) | +| B | `supabase/migrations/20260701031000_baseball_program_logo_storage.sql` | `fix/baseball-p2-program-logo-upload` | Exists, unapplied, **verified clean** (§2) | + +Only two migration files exist across all 24 pending fix branches — confirmed via `git diff batch/baseball-fixes... -- supabase/migrations/` on every one (`fix/baseball-p0-globals-css`, `fix/baseball-p0-use-server-messages`, all 8 `p1-*`, all 14 `p2-*`; all 24 root off `batch/baseball-fixes`, not `main` — an initial diff against `origin/main` found "no merge base" and was corrected). + +### 1.2 Migrations that need to exist but don't yet (drafted in this packet) + +Scoped by `docs/audits/REPO_UNTANGLE_AND_CLEAN_BASE.md` and `docs/baseball/PRODUCTION_READINESS_MASTER_PLAN.md` (WS0), but **no file, branch, or PR exists for any of them** — confirmed by searching every `*baseball*` ref for `651`, `652`, `column_reconcile`, `announcements_rls_fix`, `event_ack`: + +| # | File (drafted below) | Fixes | Scoped by | +|---|---|---|---| +| C | `20260702095900_baseball_651_column_reconcile.sql` | #651 — all 6 affected tables (see §3 Finding A for why this is one file, not the two-tier split an earlier draft proposed) | WS0.1, corrected by this review | +| D | `20260702100200_baseball_practice_effectiveness_v7_reconcile.sql` | `baseball_practice_effectiveness_reviews` — new finding, was folded into #651's "11 columns" but is really its own 24-column generation-level miss | This review (new finding) | +| E | `20260702100000_baseball_652_announcements_rls_fix.sql` | #652 (RLS recursion, 42P17) | WS0.2 | +| F | `20260702100100_baseball_event_acks_policy_restore.sql` | `baseball_event_acknowledgements` locked out (0 policies) | Untangle plan "event_acks"; root cause found by this review | +| G | `20260702100300_baseball_anon_grant_drift_revoke.sql` | 3 confirmed anon-EXECUTE drift instances | Untangle-plan/task-2 "anon-grant sweep" (targeted subset, see §3.7) | + +### 1.3 Scoped items resolved as out-of-scope or already-fine + +- **`baseball_coaches_public`** is flagged ERROR by the security-definer-view lint, but its defining migration (`20260701011000_baseball_coaches_public_view.sql`) explicitly sets `security_invoker = false` as a *documented, deliberate* security boundary: narrow non-PII columns (no email/phone), `SELECT`-only to `authenticated`, no anon, no write-through. Flipping it to `security_invoker = on` would make it re-apply the base table's now-narrowed (self-or-teammate) RLS — and since a player has neither condition true against another team's coach, **every cross-org coach-identity lookup a player does (recruiting, messaging) would return zero rows**, breaking the feature the view exists to serve. **Do not "fix" this lint finding.** +- **`v_crm_coaches_by_school`** is a `crm_coaches` (internal CRM prospect directory) view, not a baseball-product table — confirmed via its definition (`SELECT ... FROM crm_coaches`). Out of scope for this packet; flag separately for the CRM workstream. +- **`baseball_demo_sessions`** is the only baseball table with a live `anon` grant — confirmed intentional (demo login flow needs anon read/write before auth exists). + +--- + +## 2. Per-migration verdict table + +| Migration | Additive only? | RLS on new objects? | Grants clean? | Collision-free? | Linted? | Sport-prefix? | +|---|---|---|---|---|---|---| +| A `..._verdict.sql` | ✅ `ADD COLUMN IF NOT EXISTS` + guarded CHECK add + `CREATE INDEX IF NOT EXISTS` | N/A (existing table, RLS+4 policies) | N/A | ✅ `verdict` confirmed absent live | ✅ cosmetic only | ✅ | +| B `..._program_logo_storage.sql` | ✅ bucket `INSERT ... ON CONFLICT DO UPDATE` (idempotent), `DROP POLICY IF EXISTS` before each `CREATE` | ✅ 3 policies (coach-only INSERT, owner-only UPDATE/DELETE); no SELECT policy needed (bucket `public=true`, served via public URL) | ✅ `authenticated` + coach-row EXISTS check only; no anon | ✅ `'logos'` bucket confirmed absent from live `storage.buckets` (6 existing); sole consumer is `dashboard/program/page.tsx` | ✅ cosmetic only | N/A (storage) | +| C `..._651_column_reconcile.sql` | ✅ `ADD COLUMN IF NOT EXISTS` throughout, guarded CHECK/UNIQUE adds | N/A (all 6 tables already RLS+policies live) | N/A | ✅ every added column confirmed absent by exact name; all 6 tables confirmed EMPTY | ✅ cosmetic only | ✅ | +| D `..._practice_effectiveness_v7_reconcile.sql` | ✅ 24× `ADD COLUMN IF NOT EXISTS`, 5 guarded CHECK adds | N/A (RLS+4 policies live) | N/A | ✅ 24 of 25 spec columns confirmed absent (only `source_refs` already exists); table confirmed EMPTY | ✅ cosmetic only | ✅ | +| E `..._652_announcements_rls_fix.sql` | ✅ 3 new `SECURITY DEFINER STABLE` helpers + policy `DROP`/`CREATE`, no table/column change | ✅ same visibility semantics preserved (verified against live `pg_policies` qual text before drafting) | ✅ `REVOKE ALL ... FROM public, anon` then `GRANT EXECUTE ... TO authenticated` on all 3 helpers | ✅ exact policy names verified against live `pg_policies`; `baseball_ann_recipients_select_player` explicitly untouched | ✅ cosmetic only | ✅ | +| F `..._event_acks_policy_restore.sql` | ✅ pure policy `DROP IF EXISTS`+`CREATE`, wrapped in the original `to_regclass` guard | ✅ restores the exact original working design | ✅ includes `REVOKE ALL ... FROM anon` (idempotent re-assert) | ✅ `is_baseball_team_coach_v2` confirmed live; table columns match policy bodies | ✅ clean | ✅ | +| G `..._anon_grant_drift_revoke.sql` | ✅ pure `REVOKE` | N/A | ✅ this **is** the grant fix | ✅ all 3 functions + exact signatures confirmed live with `anon=X` present | ✅ clean, zero findings | ✅ | + +**sqlfluff** (matching `.circleci/config.yml`'s exact invocation: `sqlfluff lint --dialect postgres --rules core `): every finding across all 6 drafted files is `LT01`/`LT02`/`LT05`/`CP02` (spacing/indent/line-length/capitalization) — the same categories present throughout the already-merged migration history. CI runs this job `|| true` (advisory, non-blocking). **Zero functional/correctness findings on any file.** + +**squawk**: not installed in this environment, no local Postgres to point it at. CI's `squawk-migrations` job is authoritative. Every migration here is `ADD COLUMN IF NOT EXISTS` / policy-only / storage-only / `REVOKE`-only — no `ALTER COLUMN TYPE`, no `DROP COLUMN`, no non-concurrent index on a populated table — expected clean, but **unverified**; flagging honestly. + +--- + +## 3. Findings behind the drafted migrations + +### Finding A — #651: an entire migration generation no-op'd, not 11 stray columns + +`supabase/migrations/20260624000080_baseball_elite_stat_event_model.sql` used `CREATE TABLE IF NOT EXISTS` for 8 tables. Three (`baseball_pitch_events`, `baseball_batted_ball_events`, `baseball_swing_events`) were genuinely new and landed with their full intended schema — confirmed live. **Four already existed under an older schema**, so the `CREATE TABLE IF NOT EXISTS` silently no-op'd on each, and the true gap is much wider than WS0.1's "11 columns" framing, verified by reading every call site (not just the migration's `CREATE TABLE` body): + +| Table | Code-referenced columns confirmed missing (exact `.select()`/`.insert()` audit) | What live has instead | +|---|---|---| +| `baseball_stat_sources` | `source_key`, `source_name`, `source_category`, `trust_tier`, `is_enabled`, `default_visibility`, `requires_review`, `ai_can_use`, `expected_cadence_days`, `created_by` (10 of 11 spec columns; `field_mapping_profile` added too for schema completeness though not directly code-referenced) | `name`, `source_type`, `config_json`, `external_id_namespace`, `is_active`, `trust_level` — a different, older schema entirely | +| `baseball_catching_events` | `catcher_id`, `block_result`, `steal_result`, `pop_time`, `throw_accuracy`, `data_context`, `measured_at` (7, not the 2 WS0.1 listed) | `player_id` (not `catcher_id`), `blocking_result` (not `block_result`), `pop_time_seconds` (not `pop_time`), `caught_stealing`+`stolen_base_attempt` (not `steal_result`) | +| `baseball_fielding_events` | `chance_difficulty`, `measured_at`, `arm_accuracy`, `throw_velocity`, `data_context` (5, not the 2 WS0.1 listed) | `arm_velocity` (a different metric — see §0 open question), no `throw_velocity`/`arm_accuracy`/`data_context` | +| `baseball_baserunning_events` | `runner_id`, `home_to_first`, `data_context`, `decision_quality`, `measured_at` (5, not the 2 WS0.1 listed) | `player_id` (not `runner_id`) | +| `baseball_plate_appearances` | `data_context` only — genuinely narrow, this table already has `import_run_id`/`source_trust_level`/`source_visibility` from a more modern migration | matches WS0.1 | +| `baseball_decision_log` | `detail` only — genuinely narrow | matches WS0.1 | + +**Confirmed hard-broken today, not just soft-degraded:** `src/app/baseball/actions/stat-event-imports.ts` — `resolveSourceId()` (:161-198) and `resolveSourceIdReadonly()` (:320-335, used by the **read-only preview** step too) both do `.eq('source_key', sourceKey).eq('source_name', sourceName)` against `baseball_stat_sources`. `source_key` doesn't exist live either — this 400s on the SELECT before the code ever reaches the INSERT. **Every elite stat-event CSV import (TrackMan/Rapsodo/GameChanger/etc.), preview or commit, fails at source resolution today.** This is a materially bigger and more active-risk finding than "provenance silently lost on insert" (an earlier read of this file mis-scoped it as insert-only). + +Everything else (catching/fielding/baserunning) is confirmed **read-only, dead-end, and soft-degrading** — no INSERT/upsert path exists anywhere in `src/` for these 3 tables today (`commitEventImport`'s grain-to-table map only covers pitch/batted-ball/swing), and every read site (`stats-center.ts` documented silent-degrade block ~828-830, `stat-visuals.ts`, `player-snapshot-cards.ts`, `engine-run.ts`, `loaders-events.ts`) catches the PostgREST error and returns an empty/degraded result. Confirming the master plan's own #651 symptom (catching/fielding/baserunning splits always show empty). + +**Decision made, not left open:** the additive-only house rule forbids `RENAME COLUMN`, so the existing older columns (`player_id`, `blocking_result`, `pop_time_seconds`, etc.) are left untouched and the code-expected columns are added alongside them (e.g., both `player_id` and the new `catcher_id` will exist on `baseball_catching_events`). This does NOT require a code change to ship — the code already only ever reads the new names, so the old columns simply go unused going forward (harmless). A follow-up cleanup task (out of scope here) could eventually backfill/consolidate, but nothing in this packet depends on it. + +**One open, non-blocking naming question:** `baseball_fielding_events` already has `arm_velocity` (NUMERIC); code wants `throw_velocity`. These may be the same metric under two names or genuinely different metrics (arm strength vs. throw-on-play speed) — the migration drafts `throw_velocity_new` and documents the decision inline; flip the name before applying once Nick confirms (safe either way, table is empty). + +### Finding B — #652: confirmed still-live, spec verified against current `pg_policies`, one optional cleanup noted + +Direct query confirms the recursion exactly as documented: `baseball_announcements_select_player` `EXISTS`-subqueries `baseball_announcement_recipients`; `baseball_ann_recipients_select_coach`/`_insert`/`_delete` each subquery back to `baseball_announcements`. `baseball_ann_recipients_select_player` (qual: `player_id = get_my_player_id()`) is non-recursive and untouched. The 3-helper-function fix in `docs/baseball/PRODUCTION_READINESS_MASTER_PLAN.md` WS0.2 is accurate; drafted verbatim in §5. + +**Optional, non-blocking:** both tables currently carry 2 permissive `SELECT` policies each (coach + player) — a `multiple_permissive_policies` advisor pattern. Since this migration already touches every one of these policies, collapsing each pair into a single `OR`'d policy is a natural follow-up, but not done here (keeping the diff minimal and matching the master plan's spec exactly reduces review risk more than the collapse saves). + +### Finding C — `baseball_event_acknowledgements`: root cause found, this is the only fully-locked-out baseball table + +Direct query: RLS on, 0 rows in `pg_policy`. Checked all 119 baseball tables — the only one in this state. `supabase/migrations/20260624000050_baseball_rls_helpers_and_policies.sql` (:551-587) created 4 policies named `baseball_event_acks_select/insert/update/delete`. `supabase/migrations/20260630165403_normalize_baseball_event_ack_policies.sql` DROPs exactly those same 4 names, with a comment claiming a differently-named `baseball_event_acknowledgements_*` set from the same source migration would remain — but that source migration never created policies under that name, only `baseball_event_acks_*` (which it also defensively DROPped, in case an even earlier migration had used it). **This is a "ran and broke something" case** (the DROP executed correctly; `list_migrations` correctly shows it applied) — not a "recorded but unran" case. Fix restores the original 4 definitions verbatim (§5). + +### Finding D — anon-EXECUTE drift on 3 SECURITY DEFINER RPCs, confirmed via live `pg_proc.proacl` + +`can_insert_baseball_team_member`, `try_redeem_baseball_team_invitation`, `release_baseball_team_invitation_redemption` all show `anon=X` in their live ACL, despite their own defining migrations (`20260630233000`, `20260630180200`) explicitly doing `REVOKE ALL ... FROM PUBLIC; GRANT EXECUTE ... TO authenticated, service_role;` at creation — no anon, ever, in the source. No later migration touches any of the three (checked via `grep -rl` across all migrations), so this is drift from outside migration history. All three call sites are in `src/app/baseball/actions/teams.ts`, a `'use server'` file that checks `supabase.auth.getUser()` before any RPC call — anon access is not required by the app. **This is a targeted 3-function finding, not the full "155 SECURITY DEFINER RPCs" sweep** referenced in the broader DB-untangle task — flagging so it isn't mistaken for a completed comprehensive audit. + +--- + +## 4. Ordered apply list + +``` +1. supabase/migrations/20260702095900_baseball_651_column_reconcile.sql +2. supabase/migrations/20260702100200_baseball_practice_effectiveness_v7_reconcile.sql +3. supabase/migrations/20260701030000_baseball_practice_effectiveness_verdict.sql (exists — fix/baseball-p2-practice-effectiveness-verdicts) +4. supabase/migrations/20260702100100_baseball_event_acks_policy_restore.sql +5. supabase/migrations/20260702100000_baseball_652_announcements_rls_fix.sql +6. supabase/migrations/20260701031000_baseball_program_logo_storage.sql (exists — fix/baseball-p2-program-logo-upload) +7. supabase/migrations/20260702100300_baseball_anon_grant_drift_revoke.sql +``` + +No file has a hard technical dependency on another (all are `ADD COLUMN IF NOT EXISTS` / policy-only / storage-only / `REVOKE`-only) — this order is defense-in-depth sequencing: schema fixes first, then lockout/recursion fixes, then storage, then hardening cleanup last. + +--- + +## 5. Full drafted SQL + +
+1. 20260702095900_baseball_651_column_reconcile.sql + +```sql +-- #651 schema-drift reconcile — REVISED after deeper code-reference audit. +-- +-- Original WS0.1 framing ("11 missing columns") undercounts this badly. The +-- whole 20260624000080_baseball_elite_stat_event_model.sql generation used +-- CREATE TABLE IF NOT EXISTS against 4 tables that already existed under an +-- older schema (baseball_stat_sources, baseball_catching_events, +-- baseball_fielding_events, baseball_baserunning_events) -- so for these 4, +-- the ENTIRE intended column set silently no-op'd, not just 1-2 columns each. +-- Confirmed by reading every .select()/.insert() call against these 4 tables +-- across stats-center.ts, engine-run.ts, stat-visuals.ts, +-- player-snapshot-cards.ts, loaders-events.ts, stat-event-imports.ts. +-- Only baseball_plate_appearances and baseball_decision_log are genuinely +-- narrow single/dual-column gaps (handled at the bottom of this file). +-- All 6 tables are EMPTY (0 rows) in prod -- every addition is backfill-free. +-- +-- Severity: +-- P0 ACTIVE TODAY: baseball_stat_sources -- resolveSourceId() / +-- resolveSourceIdReadonly() in stat-event-imports.ts .eq('source_key',...) +-- and .eq('source_name',...) 400 on EVERY event-import preview AND +-- commit (source_key doesn't exist live either -- this breaks the +-- read-only preview path too, not just the insert); the insert's other +-- 6 fields (source_category, trust_tier, is_enabled, default_visibility, +-- requires_review, ai_can_use, expected_cadence_days, created_by) are +-- also all missing. +-- P0 ACTIVE TODAY: baseball_decision_log.detail -- Decision Room +-- "Resolve"/"Record decision note" inserts fail visibly. +-- P1 LATENT, dead-end reads only (no INSERT path exists anywhere in src/ +-- for fielding/catching/baserunning/plate_appearances today; every read +-- site catches the error and returns an empty/degraded result, never +-- crashes): fielding_events (chance_difficulty, measured_at, arm_accuracy, +-- throw_velocity, data_context), catching_events (catcher_id, block_result, +-- steal_result, pop_time, throw_accuracy, data_context, measured_at), +-- baserunning_events (runner_id, home_to_first, data_context, +-- decision_quality, measured_at), plate_appearances (data_context). + +-- --------------------------------------------------------------------------- +-- baseball_stat_sources (full reconcile -- live has name/source_type/ +-- config_json/external_id_namespace/is_active/trust_level, a DIFFERENT older +-- schema; code needs the columns below, verbatim from the elite-stat-event +-- migration's spec) +-- --------------------------------------------------------------------------- +ALTER TABLE public.baseball_stat_sources + ADD COLUMN IF NOT EXISTS source_key TEXT, + ADD COLUMN IF NOT EXISTS source_name TEXT NOT NULL, + ADD COLUMN IF NOT EXISTS source_category TEXT, + ADD COLUMN IF NOT EXISTS trust_tier TEXT NOT NULL DEFAULT 'unverified', + ADD COLUMN IF NOT EXISTS is_enabled BOOLEAN NOT NULL DEFAULT true, + ADD COLUMN IF NOT EXISTS default_visibility TEXT NOT NULL DEFAULT 'staff_only', + ADD COLUMN IF NOT EXISTS requires_review BOOLEAN NOT NULL DEFAULT true, + ADD COLUMN IF NOT EXISTS ai_can_use BOOLEAN NOT NULL DEFAULT false, + ADD COLUMN IF NOT EXISTS expected_cadence_days INTEGER, + ADD COLUMN IF NOT EXISTS field_mapping_profile JSONB, + ADD COLUMN IF NOT EXISTS created_by UUID; + +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_stat_sources_source_key_check') THEN + ALTER TABLE public.baseball_stat_sources + ADD CONSTRAINT baseball_stat_sources_source_key_check + CHECK (source_key IN ( + 'manual', 'gamechanger_xml', 'statcrew_xml', 'ncaa_live_stats', + 'prestosports_xml', 'sidearm_xml', 'statbroadcast_xml', + 'trackman_csv', 'rapsodo_csv', 'yakkertech_csv', 'hittrax_csv', + 'pocket_radar_csv', 'blast_csv', 'diamond_kinetics_csv', + 'synergy_export', 'six_four_three_export', 'awre_video', 'onform_export', + 'armcare_csv', 'teambuildr_csv', 'teamworks_csv', + 'google_sheets', 'generic_csv', 'generic_xlsx', 'pdf_extract' + )); + END IF; + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_stat_sources_source_category_check') THEN + ALTER TABLE public.baseball_stat_sources + ADD CONSTRAINT baseball_stat_sources_source_category_check + CHECK (source_category IN ( + 'official_game', 'player_development', 'tracking', 'video', + 'strength', 'academics', 'operations' + )); + END IF; + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_stat_sources_trust_tier_check') THEN + ALTER TABLE public.baseball_stat_sources + ADD CONSTRAINT baseball_stat_sources_trust_tier_check + CHECK (trust_tier IN ('official', 'verified_vendor', 'coach_reviewed', 'player_submitted', 'unverified', 'inferred')); + END IF; + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_stat_sources_default_visibility_check') THEN + ALTER TABLE public.baseball_stat_sources + ADD CONSTRAINT baseball_stat_sources_default_visibility_check + CHECK (default_visibility IN ('staff_only', 'player_visible', 'restricted')); + END IF; + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'uq_baseball_stat_sources_team_key') THEN + ALTER TABLE public.baseball_stat_sources + ADD CONSTRAINT uq_baseball_stat_sources_team_key UNIQUE (team_id, source_key, source_name); + END IF; +END $$; +-- source_key is intentionally nullable here (not NOT NULL like the original +-- spec) to guarantee this ALTER can never fail even if this ever runs against +-- a non-empty table by accident; flip to NOT NULL before relying on it if +-- Nick wants strict parity (safe today -- table has 0 rows). + +-- --------------------------------------------------------------------------- +-- baseball_fielding_events (partial reconcile -- adds the 5 columns code +-- actually references beyond what already exists: chance_difficulty, +-- measured_at, arm_accuracy, throw_velocity, data_context) +-- --------------------------------------------------------------------------- +ALTER TABLE public.baseball_fielding_events + ADD COLUMN IF NOT EXISTS chance_difficulty TEXT, + ADD COLUMN IF NOT EXISTS measured_at TIMESTAMPTZ, + ADD COLUMN IF NOT EXISTS arm_accuracy TEXT, + ADD COLUMN IF NOT EXISTS throw_velocity_new NUMERIC, + ADD COLUMN IF NOT EXISTS data_context TEXT NOT NULL DEFAULT 'official_game'; +-- NOTE: live baseball_fielding_events already has a column named +-- "arm_velocity" (NUMERIC) -- a different metric (raw arm strength) than the +-- code-referenced "throw_velocity" (throw speed on a specific play). Adding +-- throw_velocity AS "throw_velocity_new" pending a naming decision -- if +-- Nick confirms these are the same concept, rename the ADD COLUMN above to +-- throw_velocity and update the one call site instead +-- (player-snapshot-cards.ts:570); if they're genuinely different metrics, +-- rename throw_velocity_new -> throw_velocity here before applying (safe, +-- table is empty) and drop this comment. + +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_fielding_events_data_context_check') THEN + ALTER TABLE public.baseball_fielding_events + ADD CONSTRAINT baseball_fielding_events_data_context_check + CHECK (data_context IN ( + 'official_game', 'scrimmage', 'practice', 'bullpen', 'cage', + 'showcase', 'sensor', 'video', 'lift', 'readiness', 'manual' + )); + END IF; +END $$; + +-- --------------------------------------------------------------------------- +-- baseball_catching_events (partial reconcile -- adds the 7 columns code +-- references beyond what already exists under different names: catcher_id, +-- block_result, steal_result, pop_time, throw_accuracy, data_context, +-- measured_at. Existing player_id/blocking_result/pop_time_seconds/ +-- caught_stealing/stolen_base_attempt are left untouched -- additive only) +-- --------------------------------------------------------------------------- +ALTER TABLE public.baseball_catching_events + ADD COLUMN IF NOT EXISTS catcher_id UUID REFERENCES public.baseball_players(id) ON DELETE SET NULL, + ADD COLUMN IF NOT EXISTS block_result TEXT, + ADD COLUMN IF NOT EXISTS steal_result TEXT, + ADD COLUMN IF NOT EXISTS pop_time NUMERIC, + ADD COLUMN IF NOT EXISTS throw_accuracy TEXT, + ADD COLUMN IF NOT EXISTS data_context TEXT NOT NULL DEFAULT 'official_game', + ADD COLUMN IF NOT EXISTS measured_at TIMESTAMPTZ; + +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_catching_events_data_context_check') THEN + ALTER TABLE public.baseball_catching_events + ADD CONSTRAINT baseball_catching_events_data_context_check + CHECK (data_context IN ( + 'official_game', 'scrimmage', 'practice', 'bullpen', 'cage', + 'showcase', 'sensor', 'video', 'lift', 'readiness', 'manual' + )); + END IF; +END $$; + +-- --------------------------------------------------------------------------- +-- baseball_baserunning_events (partial reconcile -- adds the 5 columns code +-- references: runner_id, home_to_first, data_context, decision_quality, +-- measured_at. Existing player_id is left untouched -- additive only) +-- --------------------------------------------------------------------------- +ALTER TABLE public.baseball_baserunning_events + ADD COLUMN IF NOT EXISTS runner_id UUID REFERENCES public.baseball_players(id) ON DELETE SET NULL, + ADD COLUMN IF NOT EXISTS home_to_first NUMERIC, + ADD COLUMN IF NOT EXISTS data_context TEXT NOT NULL DEFAULT 'official_game', + ADD COLUMN IF NOT EXISTS decision_quality TEXT, + ADD COLUMN IF NOT EXISTS measured_at TIMESTAMPTZ; + +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_baserunning_events_data_context_check') THEN + ALTER TABLE public.baseball_baserunning_events + ADD CONSTRAINT baseball_baserunning_events_data_context_check + CHECK (data_context IN ( + 'official_game', 'scrimmage', 'practice', 'bullpen', 'cage', + 'showcase', 'sensor', 'video', 'lift', 'readiness', 'manual' + )); + END IF; +END $$; + +-- --------------------------------------------------------------------------- +-- baseball_plate_appearances (genuinely narrow -- already has import_run_id/ +-- source_trust_level/source_visibility from a more modern migration; only +-- data_context is missing) +-- --------------------------------------------------------------------------- +ALTER TABLE public.baseball_plate_appearances + ADD COLUMN IF NOT EXISTS data_context TEXT NOT NULL DEFAULT 'official_game'; + +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_plate_appearances_data_context_check') THEN + ALTER TABLE public.baseball_plate_appearances + ADD CONSTRAINT baseball_plate_appearances_data_context_check + CHECK (data_context IN ( + 'official_game', 'scrimmage', 'practice', 'bullpen', 'cage', + 'showcase', 'sensor', 'video', 'lift', 'readiness', 'manual' + )); + END IF; +END $$; + +-- --------------------------------------------------------------------------- +-- baseball_decision_log (genuinely narrow -- only detail is missing) +-- --------------------------------------------------------------------------- +ALTER TABLE public.baseball_decision_log + ADD COLUMN IF NOT EXISTS detail TEXT; + +-- Rollback (additive-only convention -- do not DROP COLUMN on shared prod DB; +-- all 6 tables are empty so a true DROP is low-risk if ever truly needed, but +-- prefer a follow-up migration dropping just the new CHECK/UNIQUE +-- constraints listed above). +``` + +
+ +
+2. 20260702100200_baseball_practice_effectiveness_v7_reconcile.sql + +```sql +-- baseball_practice_effectiveness_reviews V7-object reconcile. +-- +-- LIVE-VERIFIED (2026-07-02): 20260624000094_baseball_practice_effectiveness.sql +-- CREATE TABLE IF NOT EXISTS'd this table against a pre-existing, differently +-- shaped table (an older player/coach post-practice rating survey: block_id, +-- reviewed_by_coach_id, overall_grade, reps_quality, energy_level, +-- focus_level, objective_completion_pct, notes, signal_raised) -- so the +-- IF NOT EXISTS made the ENTIRE V7 "AI Practice Effectiveness Object" CREATE a +-- no-op. 24 of its 25 columns never landed (only source_refs happens to +-- already exist). This is NOT the narrower 2-column gap #651/WS0.1 assumed -- +-- confirmed by code trace: src/app/baseball/actions/practice-effectiveness.ts +-- upserts all 25 V7 fields by name (measureForTeam, ~lines 601-632), and its +-- own pre-upsert dispositions SELECT (~582-592) 400s against the live schema +-- today, short-circuiting before the upsert ever runs. The feature is fully +-- wired to a real nav entry + route (gated by can_manage_practice) and to the +-- Decision Room panel -- it silently no-ops (caught errors -> empty results) +-- rather than crashing, but it has never produced a single row (table has 0 +-- rows in prod). Table is EMPTY, so every NOT NULL addition below is safe. +-- +-- `updated_at` is also added -- referenced by practice-effectiveness.ts's +-- update() call but never part of the original V7 spec. +-- `verdict` is NOT added here -- it is owned by +-- 20260701030000_baseball_practice_effectiveness_verdict.sql (already drafted +-- on fix/baseball-p2-practice-effectiveness-verdicts) and must apply AFTER +-- this migration (it does not depend on any column added here, so order +-- relative to THIS file is flexible, but both must land before the practice +-- effectiveness feature works end-to-end). +-- +-- Idempotent: ADD COLUMN IF NOT EXISTS + guarded CHECK adds. + +ALTER TABLE public.baseball_practice_effectiveness_reviews + ADD COLUMN IF NOT EXISTS objective_id uuid REFERENCES public.baseball_practice_block_objectives(id) ON DELETE SET NULL, + ADD COLUMN IF NOT EXISTS focus_area text, + ADD COLUMN IF NOT EXISTS metric_id text, + ADD COLUMN IF NOT EXISTS player_ids uuid[] NOT NULL DEFAULT '{}'::uuid[], + ADD COLUMN IF NOT EXISTS linked_signal_ids uuid[] NOT NULL DEFAULT '{}'::uuid[], + ADD COLUMN IF NOT EXISTS metric_before numeric, + ADD COLUMN IF NOT EXISTS metric_after numeric, + ADD COLUMN IF NOT EXISTS sample_before integer NOT NULL DEFAULT 0, + ADD COLUMN IF NOT EXISTS sample_after integer NOT NULL DEFAULT 0, + ADD COLUMN IF NOT EXISTS window_before_days integer NOT NULL DEFAULT 0, + ADD COLUMN IF NOT EXISTS window_after_days integer NOT NULL DEFAULT 0, + ADD COLUMN IF NOT EXISTS direction text NOT NULL DEFAULT 'insufficient_sample', + ADD COLUMN IF NOT EXISTS after_scope text NOT NULL DEFAULT 'unknown', + ADD COLUMN IF NOT EXISTS confidence numeric, + ADD COLUMN IF NOT EXISTS confidence_tier text NOT NULL DEFAULT 'not_enough_sample', + ADD COLUMN IF NOT EXISTS confounders jsonb NOT NULL DEFAULT '[]'::jsonb, + ADD COLUMN IF NOT EXISTS conclusion text, + ADD COLUMN IF NOT EXISTS recommended_next_action jsonb, + ADD COLUMN IF NOT EXISTS visibility text NOT NULL DEFAULT 'staff_only', + ADD COLUMN IF NOT EXISTS disposition text NOT NULL DEFAULT 'new', + ADD COLUMN IF NOT EXISTS generated_by text, + ADD COLUMN IF NOT EXISTS generated_by_model text, + ADD COLUMN IF NOT EXISTS generated_at timestamptz NOT NULL DEFAULT now(), + ADD COLUMN IF NOT EXISTS expires_at timestamptz, + ADD COLUMN IF NOT EXISTS dedupe_key text, + ADD COLUMN IF NOT EXISTS updated_at timestamptz NOT NULL DEFAULT now(); + +-- focus_area / conclusion are NOT NULL in the original V7 spec, but the table +-- already has application-facing NOT NULL semantics enforced at the app layer +-- (measureForTeam always sets both); added nullable here to avoid an +-- ADD COLUMN NOT NULL failure risk if this ever runs against a non-empty +-- table by mistake, with the CHECKs below still enforcing the enums. If Nick +-- wants strict NOT NULL parity with the original spec, flip these two to +-- NOT NULL (safe today -- table has 0 rows) before applying. + +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_practice_effectiveness_reviews_direction_check') THEN + ALTER TABLE public.baseball_practice_effectiveness_reviews + ADD CONSTRAINT baseball_practice_effectiveness_reviews_direction_check + CHECK (direction IN ('improved','stable','worse','insufficient_sample','too_early','not_tracked')); + END IF; + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_practice_effectiveness_reviews_after_scope_check') THEN + ALTER TABLE public.baseball_practice_effectiveness_reviews + ADD CONSTRAINT baseball_practice_effectiveness_reviews_after_scope_check + CHECK (after_scope IN ('official_game','scrimmage','practice','mixed','unknown')); + END IF; + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_practice_effectiveness_reviews_confidence_tier_check') THEN + ALTER TABLE public.baseball_practice_effectiveness_reviews + ADD CONSTRAINT baseball_practice_effectiveness_reviews_confidence_tier_check + CHECK (confidence_tier IN ('too_early','not_enough_sample','correlated_not_proven','no_signal')); + END IF; + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_practice_effectiveness_reviews_visibility_check') THEN + ALTER TABLE public.baseball_practice_effectiveness_reviews + ADD CONSTRAINT baseball_practice_effectiveness_reviews_visibility_check + CHECK (visibility IN ('staff_only','player_visible','restricted')); + END IF; + IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'baseball_practice_effectiveness_reviews_disposition_check') THEN + ALTER TABLE public.baseball_practice_effectiveness_reviews + ADD CONSTRAINT baseball_practice_effectiveness_reviews_disposition_check + CHECK (disposition IN ('new','dismissed','resolved','converted_to_task')); + END IF; +END $$; + +-- Rollback: additive-only convention -- do not DROP COLUMN on the shared prod +-- DB. A revert ships a follow-up migration dropping only the 5 CHECK +-- constraints above if they need to change; the columns stay (nullable/ +-- additive, harmless, table is empty). +``` + +
+ +
+4. 20260702100100_baseball_event_acks_policy_restore.sql + +```sql +-- baseball_event_acknowledgements is currently LOCKED OUT in prod: RLS is +-- enabled with ZERO policies (verified live via pg_policies, 2026-07-02). +-- +-- Root cause: 20260624000050_baseball_rls_helpers_and_policies.sql created 4 +-- policies named baseball_event_acks_select/insert/update/delete. The later +-- 20260630165403_normalize_baseball_event_ack_policies.sql DROPped exactly +-- those same 4 policy names, on the mistaken assumption (stated in its own +-- comment) that a differently-named "baseball_event_acknowledgements_*" set +-- from the same source migration would remain as the surviving canonical +-- policies -- but 20260624000050 never created any policy under that other +-- name (it only ever created baseball_event_acks_*, and DROPped that same +-- alternate name defensively in case an even earlier migration had used it). +-- Net effect: the DROP ran, nothing recreated anything, table has 0 policies. +-- +-- This migration restores the original, correct baseball_event_acks_* +-- definitions verbatim from 20260624000050 (own rows; staff read all team +-- rows). It does not rename anything, so it cannot repeat the same mistake. + +DO $$ +BEGIN + IF to_regclass('public.baseball_event_acknowledgements') IS NOT NULL THEN + -- idempotent: safe to re-run + EXECUTE 'ALTER TABLE public.baseball_event_acknowledgements ENABLE ROW LEVEL SECURITY'; + EXECUTE 'REVOKE ALL ON public.baseball_event_acknowledgements FROM anon'; + + EXECUTE 'DROP POLICY IF EXISTS "baseball_event_acks_select" ON public.baseball_event_acknowledgements'; + EXECUTE 'DROP POLICY IF EXISTS "baseball_event_acks_insert" ON public.baseball_event_acknowledgements'; + EXECUTE 'DROP POLICY IF EXISTS "baseball_event_acks_update" ON public.baseball_event_acknowledgements'; + EXECUTE 'DROP POLICY IF EXISTS "baseball_event_acks_delete" ON public.baseball_event_acknowledgements'; + + EXECUTE $p$CREATE POLICY "baseball_event_acks_select" ON public.baseball_event_acknowledgements + FOR SELECT TO authenticated + USING ( + user_id = auth.uid() + OR EXISTS ( + SELECT 1 FROM public.baseball_events e + WHERE e.id = baseball_event_acknowledgements.event_id + AND public.is_baseball_team_coach_v2(e.team_id) + ) + )$p$; + EXECUTE $p$CREATE POLICY "baseball_event_acks_insert" ON public.baseball_event_acknowledgements + FOR INSERT TO authenticated + WITH CHECK (user_id = auth.uid())$p$; + EXECUTE $p$CREATE POLICY "baseball_event_acks_update" ON public.baseball_event_acknowledgements + FOR UPDATE TO authenticated + USING (user_id = auth.uid()) + WITH CHECK (user_id = auth.uid())$p$; + EXECUTE $p$CREATE POLICY "baseball_event_acks_delete" ON public.baseball_event_acknowledgements + FOR DELETE TO authenticated + USING (user_id = auth.uid())$p$; + END IF; +END $$; + +-- Rollback: DROP POLICY IF EXISTS the 4 names above (returns to the current +-- locked-out state -- not recommended; file a new fix instead of rolling back). +``` + +
+ +
+5. 20260702100000_baseball_652_announcements_rls_fix.sql + +```sql +-- #652 fix: break the mutual-recursion cycle between baseball_announcements +-- and baseball_announcement_recipients (42P17 in prod logs). +-- +-- LIVE-VERIFIED (2026-07-02, pg_policies): baseball_announcements_select_player +-- EXISTS-subqueries baseball_announcement_recipients, while +-- baseball_ann_recipients_select_coach / _insert / _delete EXISTS-subquery +-- baseball_announcements back -> circular. baseball_ann_recipients_select_player +-- (qual: player_id = get_my_player_id()) is NOT part of the cycle -- left untouched. +-- +-- Fix: three SECURITY DEFINER STABLE helpers (search_path='') break the cycle by +-- resolving the cross-table check inside a function instead of a correlated +-- subquery evaluated under the caller's RLS. + +CREATE OR REPLACE FUNCTION public.baseball_announcement_has_recipients(p_announcement_id uuid) +RETURNS boolean +LANGUAGE sql +STABLE +SECURITY DEFINER +SET search_path = '' +AS $$ + SELECT EXISTS ( + SELECT 1 FROM public.baseball_announcement_recipients + WHERE announcement_id = p_announcement_id + ); +$$; + +CREATE OR REPLACE FUNCTION public.baseball_announcement_is_recipient(p_announcement_id uuid) +RETURNS boolean +LANGUAGE sql +STABLE +SECURITY DEFINER +SET search_path = '' +AS $$ + SELECT EXISTS ( + SELECT 1 FROM public.baseball_announcement_recipients + WHERE announcement_id = p_announcement_id + AND player_id = public.get_my_player_id() + ); +$$; + +CREATE OR REPLACE FUNCTION public.baseball_is_announcement_coach(p_announcement_id uuid) +RETURNS boolean +LANGUAGE sql +STABLE +SECURITY DEFINER +SET search_path = '' +AS $$ + SELECT public.is_baseball_team_coach(a.team_id) + FROM public.baseball_announcements a + WHERE a.id = p_announcement_id; +$$; + +REVOKE ALL ON FUNCTION public.baseball_announcement_has_recipients(uuid) FROM public, anon; +REVOKE ALL ON FUNCTION public.baseball_announcement_is_recipient(uuid) FROM public, anon; +REVOKE ALL ON FUNCTION public.baseball_is_announcement_coach(uuid) FROM public, anon; +GRANT EXECUTE ON FUNCTION public.baseball_announcement_has_recipients(uuid) TO authenticated; +GRANT EXECUTE ON FUNCTION public.baseball_announcement_is_recipient(uuid) TO authenticated; +GRANT EXECUTE ON FUNCTION public.baseball_is_announcement_coach(uuid) TO authenticated; + +-- Recreate baseball_announcements_select_player using the helpers (same +-- visibility semantics: team member AND (no recipients row OR is a recipient)). +DROP POLICY IF EXISTS "baseball_announcements_select_player" ON public.baseball_announcements; +CREATE POLICY "baseball_announcements_select_player" ON public.baseball_announcements + FOR SELECT TO authenticated + USING ( + is_baseball_team_member(team_id) + AND ( + NOT public.baseball_announcement_has_recipients(id) + OR public.baseball_announcement_is_recipient(id) + ) + ); + +-- Recreate the three recursive recipients policies using the coach helper. +-- EXACT names -- a misspelled DROP silently no-ops and leaves the recursion live. +DROP POLICY IF EXISTS "baseball_ann_recipients_select_coach" ON public.baseball_announcement_recipients; +CREATE POLICY "baseball_ann_recipients_select_coach" ON public.baseball_announcement_recipients + FOR SELECT TO authenticated + USING (public.baseball_is_announcement_coach(announcement_id)); + +DROP POLICY IF EXISTS "baseball_ann_recipients_insert" ON public.baseball_announcement_recipients; +CREATE POLICY "baseball_ann_recipients_insert" ON public.baseball_announcement_recipients + FOR INSERT TO authenticated + WITH CHECK (public.baseball_is_announcement_coach(announcement_id)); + +DROP POLICY IF EXISTS "baseball_ann_recipients_delete" ON public.baseball_announcement_recipients; +CREATE POLICY "baseball_ann_recipients_delete" ON public.baseball_announcement_recipients + FOR DELETE TO authenticated + USING (public.baseball_is_announcement_coach(announcement_id)); + +-- baseball_ann_recipients_select_player is untouched (non-recursive, not part +-- of the cycle) -- do not DROP or recreate it here. + +-- Rollback: +-- -- restore original (recursive) policies verbatim (captured live in §3 +-- -- Finding B of this packet, 2026-07-02) or re-apply this file's DROP +-- -- POLICY statements followed by the original correlated-subquery bodies. +-- DROP FUNCTION IF EXISTS public.baseball_announcement_has_recipients(uuid); +-- DROP FUNCTION IF EXISTS public.baseball_announcement_is_recipient(uuid); +-- DROP FUNCTION IF EXISTS public.baseball_is_announcement_coach(uuid); +``` + +
+ +
+7. 20260702100300_baseball_anon_grant_drift_revoke.sql + +```sql +-- anon-EXECUTE drift revoke. +-- +-- LIVE-VERIFIED (2026-07-02, pg_proc.proacl): 3 SECURITY DEFINER RPCs carry a +-- live `anon=X` grant despite their OWN defining migrations explicitly doing +-- `REVOKE ALL ... FROM PUBLIC; GRANT EXECUTE ... TO authenticated, +-- service_role;` (no anon) at creation time: +-- - can_insert_baseball_team_member(uuid, team_member_status) +-- (20260630233000_baseball_team_join_policy_rls.sql:101-102) +-- - try_redeem_baseball_team_invitation(uuid) +-- (20260630180200_baseball_team_invitation_redeem_rpc.sql:24-25) +-- - release_baseball_team_invitation_redemption(uuid) +-- (20260630180200_baseball_team_invitation_redeem_rpc.sql:40-41) +-- No later migration touches any of the three, so this is drift from outside +-- migration history (dashboard/manual grant, or a broader ALTER DEFAULT +-- PRIVILEGES / blanket grant applied at some point) -- not a code defect. All +-- three call sites are in src/app/baseball/actions/teams.ts, a 'use server' +-- file that checks supabase.auth.getUser() before any RPC call -- anon +-- EXECUTE is not required by the app and matches none of the three +-- migrations' stated intent. Defense-in-depth: REVOKE it. + +REVOKE EXECUTE ON FUNCTION public.can_insert_baseball_team_member(uuid, public.team_member_status) FROM anon; +REVOKE EXECUTE ON FUNCTION public.try_redeem_baseball_team_invitation(uuid) FROM anon; +REVOKE EXECUTE ON FUNCTION public.release_baseball_team_invitation_redemption(uuid) FROM anon; + +-- Verify (paste output in the PR/approval record): +-- select proname, proacl from pg_proc where proname in +-- ('can_insert_baseball_team_member','try_redeem_baseball_team_invitation', +-- 'release_baseball_team_invitation_redemption'); +-- -> anon must not appear in any proacl. +-- +-- NOTE: this is a targeted revoke on 3 functions this review happened to spot +-- (baseball-prefixed SECURITY DEFINER RPCs with anon in their live ACL), not +-- the full "155 SECURITY DEFINER RPCs" project-wide sweep referenced in the +-- DB-untangle task. Recommend a dedicated follow-up sweep across all +-- baseball-prefixed SECURITY DEFINER functions before calling that item closed. +-- +-- Rollback: GRANT EXECUTE ON FUNCTION ... TO anon; (re-opens the drift -- +-- there is no legitimate reason to; not recommended). +``` + +
+ +Files 3 and 6 already exist verbatim on their branches (§1.1) — not reproduced here. Draft files also staged at: `/private/tmp/claude-501/-Users-ricknini/bbeb66a6-18c9-4527-a64e-54e5cbd3b544/scratchpad/db_packet/*.sql`. + +--- + +## 6. Dormant / active-risk code map + +| Code path | Table/column | State without this migration | Reachable today? | +|---|---|---|---| +| `stat-event-imports.ts` `resolveSourceId`/`resolveSourceIdReadonly` | `baseball_stat_sources.source_key` + 10 more | **SELECT 400s on the preview path too, not just insert — the entire import pipeline (preview and commit) is non-functional** | **Yes — every real CSV import, TrackMan/Rapsodo/GameChanger/etc.** | +| `decision-room.ts` `resolveMeetingItem` / `recordDecisionNote` | `baseball_decision_log.detail` | **Insert 400s, error surfaced to user as a raw failure** | **Yes — Decision Room "Resolve"/"Record decision note" buttons, live UI** | +| `practice-effectiveness.ts` `measureForTeam` (pre-upsert dispositions SELECT) | `baseball_practice_effectiveness_reviews.*` (24 cols) | SELECT 400s, caught, returns `{success:false}` before upsert ever runs — **feature has never written a row** | Yes — real nav entry (`can_manage_practice`), real route, feeds Decision Room; currently a complete no-op, not a visible crash | +| `stats-center.ts` (documented silent-degrade block ~828-830), `stat-visuals.ts`, `player-snapshot-cards.ts`, `engine-run.ts`, `loaders-events.ts` | `catcher_id`/`block_result`/`steal_result`/`pop_time`/`throw_accuracy`/`data_context`/`measured_at` (catching); `chance_difficulty`/`arm_accuracy`/`throw_velocity`/`data_context`/`measured_at` (fielding); `runner_id`/`home_to_first`/`decision_quality`/`data_context`/`measured_at` (baserunning) | Read-only; caught, empty-array fallback | Read paths reachable, but **no INSERT/upsert path exists anywhere in `src/` for these 3 tables** (confirmed — `commitEventImport`'s grain-to-table map only covers pitch/batted-ball/swing) — dead-end, zero prod-visible impact until an import path is built | +| `elite-stat-events.ts` `buildQuery()` | `baseball_plate_appearances.data_context` | Read-only; caught, empty fallback | Same as above — no write path exists yet | +| `baseball_event_acknowledgements` (all consumers: `operational-signals.ts`, `acknowledgements.ts`, `PlayerTodayClient.tsx`, `player-today.ts`, `operational-rule-engine.ts`) | N/A (RLS lockout, not a missing column) | **Every read/write against this table fails RLS (0 policies) — feature fully locked out**, not degraded | Yes — Player Today acknowledgement flow | +| `teams.ts` (announcements consumers via `is_baseball_team_member`/recipients checks) | N/A (RLS recursion) | 42P17 on player reads, confirmed in prod logs per the master plan | Yes — any player viewing team announcements | + +**None of the 8 migrations' target code paths crash the app in a way that takes down a page** — every hard failure is caught at the action-result level (`{success:false, error}` returned to the client) except the Decision Room actions, which surface the raw DB error string to the UI. Nothing corrupts *other* tables' data — the worst blast radius is a fully non-functional import pipeline, lost provenance, and complete feature no-ops. + +**Non-DB context, not part of this apply list:** `fix/baseball-p0-use-server-messages` (unmerged) fixes a `next build` failure unrelated to any of the above — `src/app/baseball/actions/messages.ts` had bare re-exports from a `'use server'` file, which Next.js rejects (exports must be async functions declared directly in the file). Confirmed correct fix by diff read. This is why the last integration build (`integ-fresh-base`, 23/24 branches merged) fails `next build` — flagging so it isn't mistaken for a DB-caused break; it requires zero DB changes to fix. + +--- + +## 7. Rollback summary + +Every migration in this packet follows the additive-only convention — **no rollback ever drops a column on the shared prod DB.** + +| File | Rollback | +|---|---| +| 1 (#651, 6 tables) | Drop the new CHECK/UNIQUE constraints if needed; columns stay (nullable/additive, empty tables) | +| 2 (practice-effectiveness V7) | Drop the 5 new CHECK constraints if needed; columns stay | +| 3 (verdict) | Has its own rollback block in the file (drop index, drop constraint, drop column — table has 0 rows so this is uniquely safe here) | +| 4 (event_acks restore) | `DROP POLICY` the 4 names — returns to today's locked-out state; not recommended, file a new fix instead | +| 5 (#652 RLS) | Restore original recursive policy bodies (captured live in §3 Finding B) + drop the 3 helper functions | +| 6 (logo storage) | Has its own rollback block (drop 3 policies, delete bucket row) | +| 7 (anon revoke) | `GRANT EXECUTE ... TO anon` — re-opens the drift, not recommended | + +If a Phase-2 deploy regresses prod: re-promote the previous Vercel deployment (instant, unrelated to these DB changes since none of them are consumed by code that isn't already broken today), then apply the relevant single-file rollback above. + +--- + +## 8. DO NOT APPLY / needs owner input before proceeding + +- **None of the 8 drafted/staged migrations are blocked** — all passed every check in §2. +- **`baseball_coaches_public` security-definer-view lint finding**: do not "fix" with `security_invoker = on` — confirmed intentional design, would break player-facing recruiting visibility (§1.3, §3). +- **`v_crm_coaches_by_school`**: out of scope — internal CRM view, needs a separate CRM-side decision before anyone touches it. +- **Migration files 3 and 6 (verdict, logo storage) are not yet on `batch/baseball-fixes`** — clean and ready, but live on unmerged branches. Apply all 7 files together, or explicitly sequence the branch merges alongside 1/2/4/5/7. +- **Migration 1 has one open naming decision** (`arm_velocity` vs. code-referenced `throw_velocity` on `baseball_fielding_events`) — safe to apply either way (table empty), but confirm before treating the shape as final (§0, §3 Finding A). +- **Migration 2 has one open design question**: `focus_area`/`conclusion` are nullable here instead of the original spec's `NOT NULL` — safe today (table empty), flip before this becomes the long-term shape if strict parity is wanted. +- **Migration 7 is a targeted 3-function fix, not the full "155 SECURITY DEFINER RPCs" sweep** — don't mark that broader item closed on this alone. + +--- + +## 9. Single apply script (for approval) + +```bash +# Run from repo root, after confirming branches fix/baseball-p2-practice-effectiveness-verdicts +# and fix/baseball-p2-program-logo-upload are merged (or their 2 migration files are +# copied in) so all 7 files exist together on the target branch. + +for f in \ + supabase/migrations/20260702095900_baseball_651_column_reconcile.sql \ + supabase/migrations/20260702100200_baseball_practice_effectiveness_v7_reconcile.sql \ + supabase/migrations/20260701030000_baseball_practice_effectiveness_verdict.sql \ + supabase/migrations/20260702100100_baseball_event_acks_policy_restore.sql \ + supabase/migrations/20260702100000_baseball_652_announcements_rls_fix.sql \ + supabase/migrations/20260701031000_baseball_program_logo_storage.sql \ + supabase/migrations/20260702100300_baseball_anon_grant_drift_revoke.sql \ +; do + echo "=== apply $f via mcp__supabase__apply_migration ===" +done + +# Post-apply verification (run each, paste output into the approval record): + +# 1) #651 + practice-effectiveness + stat_sources columns landed: +select table_name, count(*) from information_schema.columns +where (table_name, column_name) in ( + ('baseball_stat_sources','source_key'), ('baseball_stat_sources','source_name'), + ('baseball_fielding_events','measured_at'), ('baseball_fielding_events','chance_difficulty'), + ('baseball_baserunning_events','measured_at'), ('baseball_baserunning_events','runner_id'), + ('baseball_catching_events','measured_at'), ('baseball_catching_events','catcher_id'), + ('baseball_plate_appearances','data_context'), + ('baseball_decision_log','detail'), + ('baseball_practice_effectiveness_reviews','disposition'), + ('baseball_practice_effectiveness_reviews','focus_area'), + ('baseball_practice_effectiveness_reviews','verdict') +) group by table_name; +-- expect 13 total rows across the listed tables + +# 2) event_acks unlocked: +select count(*) from pg_policies where tablename = 'baseball_event_acknowledgements'; +-- expect 4 + +# 3) #652 recursion broken + no anon on new helpers: +select policyname, qual from pg_policies where tablename in ('baseball_announcements','baseball_announcement_recipients') order by 1; +select proname, proacl from pg_proc where proname like 'baseball_announcement%' or proname = 'baseball_is_announcement_coach'; +-- expect no anon in any proacl + +# 4) logos bucket + anon revoke: +select id, public from storage.buckets where id = 'logos'; +select proname, proacl from pg_proc where proname in + ('can_insert_baseball_team_member','try_redeem_baseball_team_invitation','release_baseball_team_invitation_redemption'); +-- expect no anon in any proacl + +# 5) end-to-end smoke: run a real stat-event CSV preview + commit against the +# demo team (Rini University Baseball) and confirm source resolution no +# longer 400s. + +# 6) zero new 42703/42P17 in postgres logs over the next 24h (mcp__supabase__get_logs) +``` + +--- + +## 10. Summary counts + +- **Pending baseball-related migrations found: 2** (exist as files, verified clean, on unmerged branches). +- **Missing migrations authored by this review: 6** (drafted in full, verified clean, not yet committed anywhere — note this replaces an earlier same-day pass that drafted only 1 of these 5 fully). +- **Total apply-list size: 7 files** (8 fixes — #651 counts as one file covering 6 tables). +- **Verified safe to apply as-is: 7 of 7.** +- **Blocked: 0.** Open (non-blocking) decisions: 3 — see §8. +- **Confirmed active production breakage fixed by this batch: 3** — full stat-event import pipeline (preview + commit) non-functional, Decision Room actions crash visibly, `baseball_event_acknowledgements` fully locked out. +- **Scope corrections vs. the original planning docs: 2** — #651 is a 6-table, ~35-column fix, not an 11-column patch; `baseball_practice_effectiveness_reviews` is its own 24-column generation-miss, not folded into #651's narrow set. +- **New findings beyond original scope: 1** — 3 SECURITY DEFINER functions with unintended live anon-EXECUTE drift. diff --git a/docs/audits/HELMV3_ISSUE_LEDGER_2026-06-30.md b/docs/audits/HELMV3_ISSUE_LEDGER_2026-06-30.md new file mode 100644 index 000000000..31b9fdf01 --- /dev/null +++ b/docs/audits/HELMV3_ISSUE_LEDGER_2026-06-30.md @@ -0,0 +1,447 @@ +# HelmV3 Issue Ledger — 2026-06-30 + +Validated ledger of all 145 open GitHub issues against `origin/main` and PR #421 (`fix/coderabbit-planned-issues`), adversarially re-verified per issue with direct code/git evidence (file:line references, `git diff origin/main...fix/coderabbit-planned-issues`, migration reads, and in a few cases live `semgrep`/`vitest`/`gh` command output). + +**Input received: 145 per-issue verdicts. Verified count: 145/145 — no gap.** All 145 issue numbers are unique (no duplicate entries in the input); one explicit tracker-level duplicate cluster was found (#383 → #370, see Section 3). + +## 1. Verdict summary + +| Verdict | Count | Meaning | +|---|---|---| +| CONFIRMED_OPEN | 98 | Real, currently unfixed on both main and PR #421 — needs a remediation wave | +| FIXED_IN_PR421 | 38 | Real defect on main, but already fixed on the open PR #421 branch — close once merged | +| FIXED_ON_MAIN | 4 | Real defect, already fixed directly on `main` independent of PR #421 — close now | +| FALSE_POSITIVE | 5 | No real underlying defect (empty issue body, semgrep/tool limitation, or moot/stale meta-issue) — close now | +| **Total** | **145** | **145/145 verdicts received — no gap** | + +**Are the 145 issues correct?** Mostly yes, with important corrections: 98 of 145 (68%) are genuinely open defects on both main and PR #421 and need real fixes; 38 (26%) are already fixed in the pending PR #421 and just need that PR merged; 4 (3%) turned out to already be fixed directly on `main` (independent of PR #421) and can close immediately; and 5 (3%) are false positives — either empty coderabbit-enrichment stubs with no real claim, semgrep/lint-rule blind spots (cross-file RLS, indirection-wrapped `revalidatePath`), or a stale meta-issue about an already-closed PR's review state. No fabricated or invented verdicts were found; a small number of evidence notes flag a claim as partially inaccurate (e.g. #382's cited `e2e/route-crawler/route-crawler.spec.ts` file does not exist) while still confirming the core defect. The severity mix of the 98 open issues skews toward `medium`/`high`, but there are 3 `critical` items still open (#440 join-code bypass, #486 lifting publish invisible to players, #516 hardcoded prod service_role key) that should be prioritized above all else. + +## 2. Full ledger + +Sorted by verdict (CONFIRMED_OPEN → FIXED_IN_PR421 → FIXED_ON_MAIN → FALSE_POSITIVE), then severity (critical → high → medium → low → none) within each verdict group. + +| # | Title | Area | Severity | Verdict | Action | Evidence | +|---|---|---|---|---|---|---| +| #440 | Route direct join_code confirmations through joinTeamByCode | recruiting-pipeline | critical | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/join/[code]/page.tsx computes isInvitationBased (L96-102) to distinguish a baseball_team_invitations code from a direct baseball_teams.join_code, but never passes that flag to (L214-229). join-team-client.tsx L137… | +| #486 | Route program publishes into the table player lift surfaces actually read | lifting | critical | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/actions/lifting-v11.ts publishLiftDay materializes sessions via `.from('baseball_lift_sessions').upsert(sessionRows, {onConflict: 'program_assignment_id,player_id'})` (lines ~1478-1481). src/lib/baseball/read-models/player-lift.ts… | +| #516 | P0 SECURITY: production Supabase service_role key hardcoded in 9 tracked sc... | security-rls-auth | critical | CONFIRMED_OPEN | fix-in-wave | Verified the literal service_role JWT for project qmnssrrolpinvwjjnufo (eyJhbGci...pW8-66rT0Y3LXcPYSXMPqj0_y0K_AYnPj22nXjdMU6I) is hardcoded on origin/main in all 9 named files: scripts/check-policies.ts:5, scripts/check-rls.ts:5,… | +| #391 | remove hardcoded real/demo credentials from scripts and rotate exposed acco... | security-rls-auth | high | CONFIRMED_OPEN | fix-in-wave | scripts/seed-rini-baseball-demo.ts (origin/main) hardcodes COACH_EMAIL='njrini99@gmail.com' / COACH_PASSWORD='Pirates#09!!' and PLAYER_EMAIL='rinin376@gmail.com' / PLAYER_PASSWORD='Pirates#09!!!' (lines 27-31), calls auth.admin.updateUserById to set these… | +| #394 | finish migrating legacy server actions to shared active-team/capability guards | security-rls-auth | high | CONFIRMED_OPEN | fix-in-wave | main: zero withBaseballAction usages in any of the 15 listed files. PR421 migrates 12 of them (academics, announcements, camps, dev-plans, documents, games, lineups, recruiting-philosophy, tasks, teams, travel, watchlist all now call withBaseballAction). But… | +| #405 | exclude inactive staff from active context and read RLS | security-rls-auth | high | CONFIRMED_OPEN | fix-in-wave | App-layer src/lib/baseball/active-context.ts (lines ~103-105) DOES correctly skip staffMemberships with status in ('suspended','removed','invited') when building the resolved-context list. However the DB-layer RLS helper… | +| #427 | Fix pipeline drag-and-drop stage resolution | recruiting-pipeline | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx L246: `const newStage = over.id as PipelineStage;` with collisionDetection={closestCorners} (L546); src/components/features/pipeline-card.tsx uses useDraggable({id: item.id}) (a… | +| #433 | Preload existing box-score lines when editing a completed game | stats | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/stats/games/[gameId]/page.tsx:99 renders with no batting/pitching props; BoxScoreUpload.tsx:181 renders … | +| #434 | Sum innings pitched in outs, not as base-10 decimals | stats | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/components/baseball/box-score/BoxScoreView.tsx lines ~58-72: pitchTotals reduce does `ip: acc.ip + r.ip` then `teamERA = 9 * pitchTotals.er / pitchTotals.ip` (base-10 decimal add, not outs-based). origin/main… | +| #442 | Enforce camp capacity atomically on registration | recruiting-pipeline | high | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/(dashboard)/dashboard/camps/page.tsx handleRegister does a raw client-side `.from('baseball_camp_registrations').insert(...)` with no capacity check; isFull is UI-only (registrationCount >= camp.capacity).… | +| #448 | Let players complete dev-plan goals with player-scoped actions | academics | high | CONFIRMED_OPEN | fix-in-wave | git diff origin/main...fix/coderabbit-planned-issues -- src/app/baseball/actions/dev-plans.ts shows completeGoal/uncompleteGoal still wrapped via withBaseballAction with requiredCapability:'can_manage_settings' (coach-only) plus a coach_id ownership check on… | +| #453 | Wire documents upload and new-version flows end-to-end | documents-video | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/documents/documents-client.tsx L111-115: empty-state `` has no onClick; L144-154: `onUpload={async () => { setVersionDoc(null); // Refresh would need… | +| #456 | Unify Today lift/readiness reads onto helm_lifting tables | lifting | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/lib/baseball/read-models/player-today.ts queries legacy `baseball_lift_sessions` and `baseball_readiness_checkins`, while src/app/baseball/actions/lifting.ts writes to `helm_lifting_readiness_checkins` and… | +| #458 | Pass team-tz todayIso into getPlayerToday | calendar-events | high | CONFIRMED_OPEN | fix-in-wave | On both origin/main and fix/coderabbit-planned-issues, src/app/baseball/(player-dashboard)/player/today/page.tsx line 117 calls `getPlayerToday(context.activeTeamId)` with no options argument, while getPlayerDailyContract on the next line correctly passes `{… | +| #464 | Wire player onboarding completion through completePlayerOnboarding UPSERT | onboarding | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(onboarding)/player/page.tsx:175-197 still calls `supabase.from('baseball_players').update({...onboarding_completed:true}).eq('user_id', user.id)` directly from the client, which matches 0 rows (silently no-ops) if no… | +| #470 | Fix privacy settings field mapping so saves match baseball_player_settings ... | recruiting-pipeline | high | CONFIRMED_OPEN | fix-in-wave | main src/app/baseball/(dashboard)/dashboard/settings/privacy/page.tsx hardcodes show_full_name/show_school/show_social_links/show_height_weight/show_position/show_grad_year/show_bats_throws/show_videos/show_calendar/show_stats/allow_messages as `true` (none… | +| #472 | Fix insight dismiss/feedback auth comparing coach_id to auth user.id | coachhelm-insights | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/actions/insights.ts lines ~537, ~575, ~615: dismissInsight/markInsightAddressed/submitInsightFeedback each check `insight.coach_id !== user.id` where user.id is auth.uid() and coach_id is baseball_coaches.id (distinct: migration… | +| #473 | Stop CoachHelm engine upsert from reactivating coach-dismissed insights | coachhelm-insights | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/lib/baseball/coachhelm/engine-run.ts fetches priorInsightRows filtered `.eq('status', 'active')` (lines ~451-456), so dismissed rows never populate priorByKey; buildInsightRow always returns `status: 'active'` (line ~815 area) and the write… | +| #491 | Treat empty Lift Builder player selection as "assign to none," not whole team | lifting | high | CONFIRMED_OPEN | fix-in-wave | main: LiftBuilderClient.tsx:262 passes playerIds: selectedPlayerIds.size>0 ? [...] : undefined; lift-builder.ts saveLiftSessionPlan only narrows the resolved group/team scope `if (input.playerIds && input.playerIds.length > 0)` -- when undefined/empty it… | +| #492 | Deduplicate publishLiftDay assignments for the same program day and date | lifting | high | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/actions/lifting-v11.ts L1448-1463: unconditional `.insert()` into baseball_lift_program_assignments (no upsert/onConflict on programId+liftDayId+scheduledDate). Because a fresh assignmentId is generated every publish, the… | +| #493 | Fix Decision Room agenda detail crash when sourceRefs is null | decision-room | high | CONFIRMED_OPEN | fix-in-wave | origin/main:src/lib/baseball/read-models/decision-room/agenda-ledger.ts lines 162 & 252 set `sourceRefs: row.source_refs ?? null` and the whole mapped array is force-cast `as unknown as DecisionRoomAgendaItem[]` (line ~179), bypassing the declared type… | +| #495 | Map Decision Room ledger rows to kind/label/detail/at | decision-room | high | CONFIRMED_OPEN | fix-in-wave | Worse than described: origin/main src/lib/baseball/read-models/decision-room/agenda-ledger.ts selects columns (rationale, decided_at, meeting_item_id, participants, outcome_summary, tags, created_by) that do NOT exist on public.baseball_decision_log per its… | +| #496 | Fix Decision Room "Players to discuss" read-model shape | coachhelm-insights | high | CONFIRMED_OPEN | fix-in-wave | main src/lib/baseball/read-models/decision-room/focus-imports.ts loadPlayerFocus() returns {id, playerId, kind, title, summary, status, goals, pinned, startDate, endDate, updatedAt} cast `as unknown as DecisionRoomPlayerFocus[]`, but DecisionRoomPlayerFocus… | +| #501 | Cap staff capability grants to the inviter's own permissions | security-rls-auth | high | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/actions/staff.ts — resolveInviteCapabilities() (lines ~97-108) merges explicit client-supplied capability flags onto a role preset with no comparison to the caller's own resolved capabilities. updateStaffCapabilities (gated only… | +| #502 | Enforce team join policy (closed/approval-required) on join code redemption | security-rls-auth | high | CONFIRMED_OPEN | fix-in-wave | src/app/baseball/actions/teams.ts joinTeam (line 229+) does auth + IDOR ownership checks + validatePlayerCanJoinTeam (line 42+, which only checks player_type/team_type/existing-memberships, no invite_policy/require_coach_approval fields) and then directly… | +| #507 | Fix Player Today coach-notes query against wrong table columns | academics | high | CONFIRMED_OPEN | fix-in-wave | origin/main:src/lib/types/baseball-extended.ts BaseballCoachNoteRow only has id/player_id/team_id/author_coach_id/body/scope/edited_at/deleted_at/created_at — no title/pinned/archived_at (confirmed). Verified against actual schema in… | +| #510 | Block approveAiOutput from bypassing player-visible AI policy | security-rls-auth | high | CONFIRMED_OPEN | fix-in-wave | On origin/main, src/app/baseball/actions/ai-governance.ts line 115 gates approval only on `if (audit.disposition !== 'pending')` — no check of `withheld_reason`. Lines 125/131-133 then set `visibility: targetVisibility` (= `audit.desired_visibility`)… | +| #513 | Enforce auth/capability checks on unwrapped academics server actions | security-rls-auth | high | CONFIRMED_OPEN | fix-in-wave | git show fix/coderabbit-planned-issues:src/app/baseball/actions/academics.ts confirms getTeamAcademics(teamId) and getPlayerClasses(playerId) remain completely unguarded plain exported functions — no supabase.auth.getUser() check, no withBaseballAction wrap,… | +| #372 | make authenticated coach/player smoke tests mandatory in CI | ci-tech-debt | medium | CONFIRMED_OPEN | fix-in-wave | main e2e/baseball-phase1.spec.ts:20-21,88,141 gate coach/player tests behind PLAYWRIGHT_BASEBALL_SEEDED; .github/workflows/playwright.yml:247 sources this from a GH secret that can be unset, so CI silently skips auth flows. PR421 diff on this file… | +| #379 | reconcile seeded stats with the canonical Stats Center read model | stats | medium | CONFIRMED_OPEN | fix-in-wave | origin/main: scripts/seed-baseball-demo.ts explicitly documents 'No baseball_player_stats / aggregates ... Hitting/pitching panels will show empty states'; scripts/seed-baseball-stats.mjs (even after PR421's #380 credential-rotation refactor) still only… | +| #425 | Route pipeline recruits to public profile, not roster-only dashboard player... | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/components/features/pipeline-card.tsx:67 and src/components/baseball/position-planner/PlayerQuickView.tsx:353 both link to `/baseball/dashboard/players/${id}`; src/app/baseball/(dashboard)/dashboard/players/[id]/page.tsx:56-66 does… | +| #426 | Align pipeline stage UI with the 5-stage server contract | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | main: src/lib/recruiting/stages.ts PIPELINE_STAGES has 7 entries incl. 'contacted'/'campus_visit'; src/lib/validation/action-schemas.ts:22 z.enum only allows 5 values (no contacted/campus_visit); PipelineClient.tsx derives statusOptions from PIPELINE_STAGES… | +| #428 | Stop showing pipeline drag success when stage update fails | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx handleDragEnd — `await updateStage(activeItem.player_id, newStage);` return value is discarded, then unconditionally `showToast(..., 'success')` runs right after (inside the same… | +| #429 | Revert Discover watchlist UI when server actions fail | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/components/coach/discover/DiscoverView.tsx handleWatchlist (lines ~363-374) awaits addToWatchlist/removeFromWatchlist and unconditionally calls setWatchlistIds without checking result.success — matches issue exactly. Checked git diff… | +| #430 | Fix Discover Teams pagination and total counts | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | Both origin/main and fix/coderabbit-planned-issues src/app/baseball/actions/discover.ts getDiscoverTeams: query.range(offset, offset+perPage-1) applied at DB level, then `.filter((org) => Boolean(org.head_coach_name))` on the page slice, then `count:… | +| #431 | Apply Discover player sort on the server across all pages | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | main src/app/baseball/actions/discover.ts orders by updated_at and applies .range() (server pagination) with no sort param; src/components/coach/discover/DiscoverView.tsx sortedPlayers (lines ~184-211) sorts only the current page's `transformedPlayers`. PR421… | +| #432 | Fix PlayerDetailModal message navigation path | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | src/components/coach/PlayerDetailModal.tsx line 53 on both origin/main and fix/coderabbit-planned-issues (PR #421) still reads `router.push(\`/dashboard/messages/${result.conversationId}\`)` — the golf/legacy path, not `/baseball/dashboard/messages/${id}`.… | +| #435 | Scope player game log to the selected season year | stats | medium | CONFIRMED_OPEN | fix-in-wave | Checked src/app/baseball/actions/games.ts on both origin/main and fix/coderabbit-planned-issues (current checked-out branch): battingLogResult/pitchingLogResult queries at lines ~1208-1224 select from baseball_box_score_batting/pitching filtered only by… | +| #436 | Compute OBP/SLG/OPS in legacy aggregate recalculation | stats | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/actions/stats.ts (~lines 514-530) upserts only career_avg/practice_avg/game_avg/total_at_bats/total_hits/etc into baseball_player_aggregates — no career_obp/career_slg/career_ops fields.… | +| #437 | CSV box-score upload must complete game and refresh season stats | stats | medium | CONFIRMED_OPEN | fix-in-wave | src/app/baseball/actions/games.ts ~lines 988-993: the `allMatched` branch only calls `saveBoxScoreBatting(gameId, battingRows)` / `saveBoxScorePitching(gameId, pitchingRows)` — it never calls markGameCompletedAction (lines ~639-700, which does… | +| #439 | Wire season-year selector on legacy season stats page | stats | medium | CONFIRMED_OPEN | fix-in-wave | main: src/app/baseball/(dashboard)/dashboard/stats/season/page.tsx hardcodes currentYear and queries baseball_player_season_stats with .eq('season_year', currentYear); only passes stats/seasonYear/teamId to , no onYearChange.… | +| #441 | Fix showcase Teams "Copy invite link" URL path | onboarding | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/(dashboard)/dashboard/teams/TeamsClient.tsx line 225-226 handleCopyInvite builds `${window.location.origin}/join/${code}` (missing /baseball prefix). src/app/baseball/actions/teams.ts regenerateTeamInviteCode / related code… | +| #443 | Exclude cancelled camp registrations from capacity counts | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | Both origin/main and fix/coderabbit-planned-issues src/app/baseball/(dashboard)/dashboard/camps/page.tsx: `registrations:baseball_camp_registrations(count)` has no status filter (confirmed in both branches via diff), and handleUnregister uses `.update({… | +| #444 | Stop infinite loading on Events when coach has zero teams | calendar-events | medium | CONFIRMED_OPEN | fix-in-wave | main src/app/baseball/(dashboard)/dashboard/events/EventsClient.tsx: `useState(true)` for loading, and `useEffect(() => { if (teams.length > 0) { fetchEvents(); } }, [authLoading, coach?.id, teams])` — when teams.length === 0 fetchEvents is never invoked so… | +| #445 | Persist and surface requires_rsvp for baseball calendar events | calendar-events | medium | CONFIRMED_OPEN | fix-in-wave | On both origin/main and fix/coderabbit-planned-issues, src/app/baseball/(dashboard)/dashboard/calendar/page.tsx hardcodes `requires_rsvp: false` (line 104/107), and src/app/baseball/actions/calendar.ts's insert payload never writes `requires_rsvp` (only reads… | +| #446 | Align travel trip past/upcoming classification with display dates | baseball | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/components/baseball/travel/TravelClient.tsx: formatDate (lines 49-56) anchors with 'T12:00:00' but isUpcoming (lines 58-61) does `new Date(dateStr) >= new Date(new Date().toISOString().split('T')[0])`, comparing bare dates as UTC midnight… | +| #447 | Fix camp date display off-by-one for date-only values | other | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/camps/page.tsx formatDate() (line ~44) does `new Date(dateString).toLocaleDateString(...)` on a YYYY-MM-DD string, and the [id]/page.tsx detail page has an identical formatDate (line ~69) -- both parse as UTC… | +| #449 | Show announcement acknowledge CTA before any other player has acked | messaging-notifications | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/components/baseball/announcements/AnnouncementsPlayerView.tsx:118: `const needsAck = ann.acknowledged_count > 0 && !hasAcknowledged;` gates both the 'Needs Acknowledgement' badge and the Acknowledge button (rendered at line ~196) on… | +| #450 | Treat failed message sends as failures in useMessages | messaging-notifications | medium | CONFIRMED_OPEN | fix-in-wave | src/hooks/use-messages.ts lines 64-71: `sendMessage` does `await sendMessageAction(conversationId, content); return true;` with no check of the result's `success` field (only a try/catch around a throw). src/app/baseball/actions/messages.ts re-exports… | +| #452 | Refresh announcements list after create/delete on client page | messaging-notifications | medium | CONFIRMED_OPEN | fix-in-wave | main: announcements/page.tsx is 'use client', loads via useState+useEffect keyed on [authLoading, selectedTeamId, user, isCoach, player?.id]; CreateAnnouncementFlow.tsx:86 and AnnouncementsCoachView.tsx:105 call router.refresh() after success, which does not… | +| #454 | Persist notification preference toggles and honor them for message delivery | messaging-notifications | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/(dashboard)/dashboard/settings/page.tsx — notificationSettings is local useState only (lines ~27-30), checkbox onChange just calls setNotificationSettings + showToast, no server persistence call anywhere in the file.… | +| #455 | Update read receipts when the other party reads messages | messaging-notifications | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/hooks/use-messages.ts subscribes only to `event: 'INSERT'` on baseball_messages (lines ~39-54), no UPDATE handler. src/components/messages/ChatWindow.tsx MessageStatus renders double-check only when `message.read` is true (confirmed).… | +| #457 | Join practice events in getPlayerPractices for calendar times | lifting | medium | CONFIRMED_OPEN | fix-in-wave | main src/app/baseball/actions/practice.ts getPlayerPractices() selects `id, title, focus, published_at, status, event_id, blocks:..., attendance:...` from baseball_practices with NO join to baseball_events, yet the mapper (lines 718-771) reads… | +| #459 | Wire activate page to activateRecruitingExposure server action | baseball | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/activate/page.tsx:61-69 does a raw client createClient().from('baseball_players').update({recruiting_activated:true,...}); grep for 'activateRecruitingExposure' across src shows only its definition in… | +| #460 | Point Today practice CTAs to /baseball/player/practice | shell-nav | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/components/baseball/player-today/PlayerTodayClient.tsx has three hrefs pointing to '/baseball/dashboard/practice' (lines 1368, 1417, 1520) which resolves to the coach-only PracticePlannerClient, while src/lib/baseball/nav-registry.ts line 397… | +| #461 | Revert Daily Contract optimistic toggles on server failure | lifting | medium | CONFIRMED_OPEN | fix-in-wave | git diff origin/main...fix/coderabbit-planned-issues -- src/components/baseball/daily-contract/DailyContract.tsx returns empty (zero changes — file completely untouched by PR421). Read current file (checked out at fix/coderabbit-planned-issues): runAction's… | +| #462 | Use recruiting ProfileEditor for JUCO on dashboard/profile | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/(dashboard)/dashboard/profile/page.tsx line ~32: `const isCollegePlayer = player.player_type === 'college' \|\| player.player_type === 'juco';` then renders CollegeProfileEditor for both. CLAUDE.md (lines 247, 255) confirms JUCO is… | +| #463 | Align teamless handling on timeline/passport with Today | shell-nav | medium | CONFIRMED_OPEN | fix-in-wave | src/app/baseball/(player-dashboard)/player/today/page.tsx lines ~88-97: when getActiveBaseballContext() returns null (no team membership), Today renders `` (an honest join-team terminal) instead of redirecting.… | +| #466 | Stop faking coach notification preference saves on account Settings | messaging-notifications | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/settings/page.tsx L26-30 initializes local useState notificationSettings with hardcoded defaults; L174-214 onChange handlers only call setNotificationSettings(...) + showToast(..., 'success') with no server… | +| #468 | Block coach onboarding "Yes — invite S&C coach" unless email is provided | onboarding | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/(onboarding)/coach-onboarding/page.tsx line ~828 top card `onClick={() => handleLiftingAnswer('yes')}` calls with no email; handleLiftingAnswer only passes inviteEmail when liftingInviteEmail is truthy (line ~396) and wraps the… | +| #469 | Align coach onboarding password validation with server validatePassword | onboarding | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(onboarding)/coach-onboarding/page.tsx Continue button disabled only via `password.length < 8`, while src/app/baseball/actions/onboarding.ts calls full validatePassword() server-side and returns passwordValidation.feedback[0] on… | +| #471 | Persist or remove cosmetic coach plan selection during onboarding | onboarding | medium | CONFIRMED_OPEN | fix-in-wave | src/app/baseball/(onboarding)/coach-onboarding/page.tsx on origin/main has a full plan-selection UI (state `const [plan, setPlan] = useState<'free'\|'elite'\|''>('')`, step 'plan', handlePlanSelectAndSubmit calling setPlan then handleSubmit), but handleSubmit's… | +| #474 | Render CoachHelm insight body on player profile (body vs description) | coachhelm-insights | medium | CONFIRMED_OPEN | fix-in-wave | git grep on fix/coderabbit-planned-issues confirms src/lib/baseball/coachhelm/engine-run.ts:816 still sets `body: c.body` only (buildInsightRow return object has no `description` field at all). git diff for PlayerInsightsPanel.tsx returns empty (untouched);… | +| #475 | Honor player_visible in Practice Intelligence Board visibility | coachhelm-insights | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/app/baseball/actions/practice-intelligence.ts: normalizeVisibility() (lines ~144-149) only inspects meta.visibility and always falls back to 'staff_only'; the SELECT query (lines ~165-172) does not fetch player_visible.… | +| #476 | Preserve practice-effectiveness review disposition on re-measure upsert | decision-room | medium | CONFIRMED_OPEN | fix-in-wave | src/app/baseball/actions/practice-effectiveness.ts: savePracticeRecap auto-invokes measureForTeam unless `autoMeasure === false` (~lines 298-305). The upsert payload built in measureForTeam (~lines 575-600) sets `disposition: 'new'` unconditionally on every… | +| #477 | Preserve postgame item disposition on regenerate upsert | other | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/actions/postgame.ts: mapItem() (L476-498) hardcodes `disposition: 'new'` on every emitted item; generatePostgameReview upserts these rows via `.upsert(itemRows, { onConflict: 'review_id,dedupe_key', ignoreDuplicates: false })`… | +| #478 | Collapse competing development_milestone insights to one per player | coachhelm-insights | medium | CONFIRMED_OPEN | fix-in-wave | main: src/app/baseball/actions/insights.ts both the hits-milestone (~line 300) and HR-milestone (~line 318) branches use insight_type:'development_milestone'; reconciliation keys by `${playerId}::${insight_type}` (keyOf at ~line 142). When both thresholds… | +| #479 | Eliminate stacked mobile top chrome (shell bar + legacy Header) | mobile-chrome | medium | CONFIRMED_OPEN | fix-in-wave | src/components/baseball/dashboard-shell.tsx renders the sticky utility bar (present both on main and fix branch, with only a minor capabilities/CommandPalette-prop change in the #421 diff). The roster page's client component (fix branch:… | +| #480 | Show hub sub-navigation on mobile for Team/Stats routes | mobile-chrome | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/components/baseball/dashboard-shell.tsx line ~248-250 — is hidden below md breakpoint with no mobile equivalent; mobile only gets a 3-item MobileBottomNav (buildMobileNavFromContext,… | +| #481 | Fix message surfaces' viewport math and loading chrome drift | mobile-chrome | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:messages/[id]/page.tsx renders
plus `h-[calc(100dvh-4rem)]` (lines 44-48); messages/page.tsx uses `h-[calc(100dvh-64px)]` with no Header (line 143); messages/loading.tsx renders
unlike the loaded index… | +| #487 | Wire Video Library uploads through saveMyVideo server action | documents-video | medium | CONFIRMED_OPEN | fix-in-wave | git diff origin/main...fix/coderabbit-planned-issues -- src/components/baseball/video/VideoLibraryClient.tsx is empty (untouched). git grep saveMyVideo across fix/coderabbit-planned-issues:src/ shows it is only defined in… | +| #488 | Refresh Video Library after upload/edit/delete mutations | documents-video | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/components/baseball/video/VideoLibraryClient.tsx lines ~1242-1244: `const handleMutated = useCallback(() => { /* Nothing; mutations call revalidatePath server-side */ }, []);` passed to LibraryView as onMutated (line ~1278). LibraryView calls… | +| #489 | Check saveLineup result before showing roster success toast | other | medium | CONFIRMED_OPEN | fix-in-wave | src/app/baseball/(dashboard)/dashboard/roster/RosterClient.tsx lines ~933-940: `await saveLineup({...}); showToast('Lineup saved successfully', 'success');` with no check of the awaited result. src/app/baseball/actions/lineups.ts: saveLineupAction returns `{… | +| #490 | Swap or return displaced player when dropping into an occupied lineup slot | other | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/components/coach/lineup/LineupBuilder.tsx handleDrop() (L60-87): when dragging from the available-roster pool (draggedSlotIndex === null), the code only clears the source slot if dragging FROM a slot, then unconditionally does… | +| #494 | Map Decision Room agenda rows to kind: 'meeting_item' and correct UI fields | decision-room | medium | CONFIRMED_OPEN | fix-in-wave | origin/main:src/lib/baseball/read-models/decision-room/agenda-ledger.ts loadAgendaItems() maps baseball_meeting_items rows to an object with no `kind`, `severityHint`, `playerName`, or `sourceRefCount` fields, then force-casts the array `as unknown as… | +| #497 | Align Decision Room insights disposition filter with signal inbox dispositions | decision-room | medium | CONFIRMED_OPEN | fix-in-wave | On origin/main: src/app/baseball/actions/operational-signals.ts:623 sets `disposition: s.sampleTooSmall ? 'sample_too_small' : 'new'`; src/lib/types/baseball-signals.ts:486-490 OPEN_SIGNAL_DISPOSITIONS = ['new','acknowledged','sample_too_small'] (Signal… | +| #498 | Stop labeling stable practice-effectiveness reviews as "Moved the wrong way" | coachhelm-insights | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/components/baseball/staff-decision-room/StaffDecisionRoomClient.tsx ~line 1263: `const improved = review.direction === 'improved'` then renders danger Badge + "Moved the wrong way" for any non-'improved' value, including 'no_change' and null… | +| #499 | Preserve Compare player column order from URL players param | stats | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/compare/CompareClient.tsx fetchPlayers() derives playerIds from the URL, runs `.from('baseball_players').select('*').in('id', playerIds)`, and does `setPlayers(data \|\| [])` directly with no re-sort to match… | +| #503 | Enforce season module toggles at runtime, not just in settings storage | other | medium | CONFIRMED_OPEN | fix-in-wave | `git grep baseball_seasons origin/main -- src` shows baseball_seasons is referenced only in src/app/baseball/actions/team-season-settings.ts (writes the *_enabled toggle columns) and src/lib/types/baseball-team-season-settings.ts/database.ts (type defs) — no… | +| #504 | Enforce program module toggles (academics/travel) beyond settings storage | academics | medium | CONFIRMED_OPEN | fix-in-wave | main: academics_module_enabled/travel_module_enabled only read in program-settings.ts (persistence), ProgramSettingsClient.tsx (toggle UI), and program-type-variants.ts moduleMattersForMode (UI emphasis only, ~line 581-583). No server action or nav-registry… | +| #505 | Align Staff Settings edit affordance with can_invite_staff server gate | recruiting-pipeline | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/lib/baseball/read-models/decision-room/staff-settings.ts L251-279 resolveCanManageStaff returns true if is_head_coach \|\| can_invite_staff \|\| can_manage_settings. But src/app/baseball/actions/staff.ts requires… | +| #508 | Allow college programs to reach the Academics dashboard | academics | medium | CONFIRMED_OPEN | fix-in-wave | origin/main confirms: src/lib/baseball/server-route-guards.ts requireAcademicsCoachRoute restricts to allowedCoachTypes/allowedProgramTypes ['juco'] only; src/lib/supabase/middleware.ts redirects when `isAcademicsRoute && programType !== 'juco'`;… | +| #509 | Scope academics eligibility reads and defaults to the active team | academics | medium | CONFIRMED_OPEN | fix-in-wave | main src/app/baseball/actions/academics.ts getTeamAcademics(): eligibility query at line ~115 is `.in('player_id', playerIds)` with no team_id filter, first-match-per-player at line 150 `eligibilityRecords.find(e => e.player_id === m.player_id)`, and defaults… | +| #512 | Surface timeline acknowledgement state on the coach player profile | coachhelm-insights | medium | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/players/[id]/page.tsx fetches timelineResult via getPlayerTimeline but never calls getTimelineAcksForViewer (which does exist and is used on the player side at… | +| #373 | extend route crawler to authenticated Baseball coach and player sessions | ci-tech-debt | low | CONFIRMED_OPEN | fix-in-wave | No route-crawler file exists on origin/main at all (git ls-tree origin/main has no e2e/route-crawler or scripts/route-crawler-baseball.mjs). Commit b7147973 on branch fix/coderabbit-planned-issues (PR #421) adds scripts/route-crawler-baseball.mjs, but it only… | +| #377 | add business/product-truth contracts for stats, CoachHelm, and source trust | ci-tech-debt | low | CONFIRMED_OPEN | fix-in-wave | git ls-tree -r origin/main shows only one *.contract.test.ts file in the whole repo (src/lib/baseball/read-models/__tests__/player-daily-contract.test.ts); no src/contracts/baseball/** directory and no docs/operations/BASEBALLHELM_BUSINESS_CONTRACT_MATRIX.md… | +| #382 | create seeded production smoke for Rini/demo stats surfaces | ci-tech-debt | low | CONFIRMED_OPEN | fix-in-wave | origin/main:e2e/baseball-phase1.spec.ts — entire coach/player suites gated by test.skip(!SEEDED, ...) where SEEDED requires PLAYWRIGHT_BASEBALL_SEEDED=1/true; that env var is not set anywhere in .github or .circleci configs (grep returned nothing), so these… | +| #438 | Count ties as ties in games W-L summary | stats | low | CONFIRMED_OPEN | fix-in-wave | origin/main src/components/baseball/games/GamesList.tsx L76-79: `wins` requires our_score > opponent_score strictly, then `losses = completedGames.length - wins` with no tie branch, so equal-score completed games are counted as losses in the… | +| #451 | Clear conversation unread badges when a thread is opened | messaging-notifications | low | CONFIRMED_OPEN | fix-in-wave | origin/main src/hooks/use-messages.ts: fetchMessages() calls markMessagesAsRead(conversationId) (L33-34) but the sibling conversations-list hook only refetches on realtime `event: 'INSERT'` (L238-246 in the conversations subscription), never on the… | +| #465 | Fix password-reset success redirect to use login message codes | shell-nav | low | CONFIRMED_OPEN | fix-in-wave | main: src/app/baseball/(auth)/reset-password/page.tsx:80 router.push('/baseball/login?message=Password updated successfully'); login/page.tsx LOGIN_MESSAGES map only recognizes key 'password_reset' (and 3 others), so messageKey='Password updated successfully'… | +| #467 | Repair or remove dead demo-mode settings deep link | other | low | CONFIRMED_OPEN | fix-in-wave | origin/main:src/lib/baseball/settings-route-aliases.ts line ~10 defines 'demo-mode': '${PROGRAM_SETTINGS_PATH}#demo-mode'. src/app/baseball/(dashboard)/dashboard/settings/demo-mode/page.tsx permanentRedirects to that alias.… | +| #482 | Compact the public player profile mobile hero and fix shared-link navigation | mobile-chrome | low | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(public)/player/[id]/PlayerProfileClient.tsx: `h-52 md:h-64` banner, hard-coded `href="/baseball/dashboard/discover"` back link, simultaneous Watchlist+Message buttons in hero overlay, `w-32 h-32` mobile avatar — all confirmed… | +| #483 | Add safe-area-top padding to the baseball shell sticky bar | mobile-chrome | low | CONFIRMED_OPEN | fix-in-wave | main src/components/baseball/dashboard-shell.tsx: sticky header div is `sticky top-0 z-30 ... px-4 py-2` with no env(safe-area-inset-top) usage, vs golf's FairwayDashboardShell.tsx which sets `--golf-mobile-header-offset: env(safe-area-inset-top, 0px)`.… | +| #484 | Reduce Player Today to one contextual primary CTA on mobile | mobile-chrome | low | CONFIRMED_OPEN | fix-in-wave | src/components/baseball/player-today/PlayerTodayClient.tsx on origin/main: PrimaryCtaRow (~line 1489) renders up to 3 equal-weight rounded-full pill buttons (Check In if hasLiftToday, Acknowledge if hasPendingAck, View Today Plan/Schedule always-on), and… | +| #485 | Align calendar full-height layout with shell chrome offsets | mobile-chrome | low | CONFIRMED_OPEN | fix-in-wave | origin/main src/app/baseball/(dashboard)/dashboard/calendar/page.tsx:199 uses h-[calc(100vh-5.5rem-env(safe-area-inset-bottom))] nested inside dashboard-shell.tsx's main which independently adds pb-[calc(5rem+env(safe-area-inset-bottom))] (line ~230) plus a… | +| #500 | Do not increment scout-packet view_count on CSV downloads | recruiting-pipeline | low | CONFIRMED_OPEN | fix-in-wave | git diff origin/main...fix/coderabbit-planned-issues -- 'src/app/baseball/(public)/packet/[token]/csv/route.ts' shows PR421 only changes the HTTP status code logic (200 always -> 200/404/403 based on model.ok/reason); it still calls the same… | +| #506 | Expose can_manage_documents in the staff capability matrix | documents-video | low | CONFIRMED_OPEN | fix-in-wave | IMPORTANT CAVEAT: on origin/main, `can_manage_documents` does not exist anywhere yet — src/lib/baseball/capabilities.ts BASEBALL_CAPABILITY_KEYS lists only 17 keys and none is can_manage_documents; src/app/baseball/actions/documents.ts has NO capability check… | +| #511 | Add player-visible scope control when coaches author notes | baseball | low | CONFIRMED_OPEN | fix-in-wave | origin/main src/components/baseball/player-profile/PlayerProfileClient.tsx:403 hardcodes createCoachNote({..., scope: 'staff_public'}) with no scope picker; grep for updateCoachNote/deleteCoachNote callers across src shows only golf's NoteCard.tsx using… | +| #380 | replace ad hoc stats seeding script with env-scoped safe seed tooling | ci-tech-debt | critical | FIXED_IN_PR421 | close-on-#421-merge | main: scripts/seed-baseball-stats.mjs has literal SUPABASE_URL + a live-looking service_role JWT + hardcoded TEAM_ID/COACH_ID. PR421 diff rewrites the script to be env-gated (NEXT_PUBLIC_SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY), dry-run-by-default, requires… | +| #368 | fix player Calendar team resolution | recruiting-pipeline | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/(dashboard)/dashboard/calendar/page.tsx L58-64 queries baseball_team_members.eq('player_id', session.userId) (auth user id, not player profile id) exactly as claimed. fix/coderabbit-planned-issues branch changes it to use… | +| #369 | normalize Calendar and Event mutations behind shared action guards | calendar-events | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main:src/app/baseball/actions/calendar.ts — createBaseballEvent only calls hasBaseballCapability when input.teamId is explicitly supplied (falls back to coach's own org/team with no capability check otherwise); updateBaseballEvent gates purely on… | +| #386 | fix Supabase migration replay failure on baseball_staff_invitations.accepte... | ci-tech-debt | high | FIXED_IN_PR421 | close-on-#421-merge | main supabase/migrations/20260624000050_baseball_rls_helpers_and_policies.sql references accepted_by_user_id in RLS policies but the column is only added later in 20260624000062 (runs after 000050 in file-order replay) — reproduces the reported SQLSTATE… | +| #393 | migrate document actions to shared guard and private storage model | documents-video | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/actions/documents.ts confirmed as described: getTeamDocuments(teamId, isCoach) trusts caller-supplied args (L67-90); uploadBaseballDocument returns supabase.storage.getPublicUrl (L173-177); createBaseballDocument inserts… | +| #395 | fix team join code lifecycle and invitation-use accounting | auth-security-rls | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/actions/teams.ts L444-450 counts baseball_team_members rows against invitation.max_uses (team-size, not redemption count) exactly as claimed. fix/coderabbit-planned-issues teams.ts L461-489 changes this to `const redemptionCount =… | +| #399 | make box-score saves atomic before feeding stats and CoachHelm | stats | high | FIXED_IN_PR421 | close-on-#421-merge | main src/app/baseball/actions/games.ts: saveBoxScoreBatting (line 419) and saveBoxScorePitching (line 476) each DELETE then INSERT independently; saveFullBoxScore (line 580) calls them as three separate awaits with no transaction. PR421 adds… | +| #401 | enforce public-profile visibility before rendering player profile routes | security-rls-auth | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/(public)/player/[id]/page.tsx has no visibility gate before selecting the full player row (RLS baseball_players_select USING(true) allows any authenticated user); PR421 diff adds resolvePublicProfileAccess(id, user.id) call gating… | +| #402 | require recruitability checks before watchlist and engagement writes | recruiting-pipeline | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/actions/watchlist.ts addToWatchlist() (lines ~19-60) only checks coachId ownership via baseball_coaches.user_id, then inserts the client-supplied playerId into baseball_watchlists and logs a watchlist_add engagement event with… | +| #403 | derive college-interest metadata from organization source of truth | recruiting-pipeline | high | FIXED_IN_PR421 | close-on-#421-merge | git diff origin/main...fix/coderabbit-planned-issues -- src/app/baseball/actions/interests.ts: addToInterests signature changed from (collegeId, schoolName, division?, conference?) to (organizationId: string) only, now routed through withBaseballAction +… | +| #404 | derive Discover map count scope server-side | recruiting-pipeline | high | FIXED_IN_PR421 | close-on-#421-merge | On origin/main, src/app/baseball/actions/discover.ts:598 exports getStateCounts(mode, coachId?, coachType?) as a 'use server' action trusting client-supplied coachType to gate eligible player/org types (lines 605-617), while DiscoverClient.tsx:320-321 passes… | +| #406 | wire staff player-scope RLS to scope_player_ids columns | security-rls-auth | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main supabase/migrations/20260624000050_baseball_rls_helpers_and_policies.sql:203-207: can_view_baseball_player() checks the legacy `player_scope` jsonb column (`v_staff->'player_scope'`, expects a bare array) while… | +| #415 | recompute event-import review bands server-side before commit | stats | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/actions/stat-event-imports.ts commitEventImport() computes requiresReview = entry?.requiresReviewByDefault \|\| args.detectionAutoCommit === 'hold_for_review' \|\| args.detectionAutoCommit === 'do_not_commit' (lines ~405-411) --… | +| #416 | revalidate persisted shell auth before rendering protected routes | security-rls-auth | high | FIXED_IN_PR421 | close-on-#421-merge | git diff origin/main...fix/coderabbit-planned-issues -- src/hooks/use-baseball-auth.ts: PR421 removes the entire getInitialFromStore() fast-path that derived authorized=true from persisted Zustand state, replacing initial state with… | +| #417 | make legacy stats seed non-destructive and environment-gated | ci-tech-debt | high | FIXED_IN_PR421 | close-on-#421-merge | origin/main:scripts/seed-baseball-stats.mjs hardcodes SUPABASE_URL/SERVICE_KEY/TEAM_ID/COACH_ID and deletes baseball_player_stats rows before reinserting (line 41: .delete().eq(...)). git diff origin/main...fix/coderabbit-planned-issues --… | +| #367 | stop non-showcase coaches from seeing showcase Organization routes | shell-nav | medium | FIXED_IN_PR421 | close-on-#421-merge | main: src/lib/baseball/nav-registry.ts:668 'events' entry role:'both', no program gate; sidebar.tsx:293 pushes COACH_ORGANIZATION_HUB when 'events'\|'organization'\|'teams' visible; events/page.tsx uses requireShowcaseOrgRoute(). PR421 diff adds… | +| #370 | filter hub subnav tabs by role, program type, and capabilities | recruiting-pipeline | medium | FIXED_IN_PR421 | close-on-#421-merge | origin/main:src/app/baseball/(dashboard)/_components/hub-definitions.ts (static COACH_STATS_TABS/COACH_RECRUITING_TABS arrays, no capability field) + resolve-active-hub.ts (resolveActiveHub only took role+programType, no capabilities) +… | +| #371 | require reauthentication before password changes | security-rls-auth | medium | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/(dashboard)/dashboard/settings/page.tsx:69-75 called supabase.auth.updateUser() directly, ignoring the collected currentPassword field (confirmed real bug on main). PR421 (fix/coderabbit-planned-issues) replaces this with… | +| #375 | replace skipped Camps/Pipeline/Box Score E2E with seeded production flows | ci-tech-debt | medium | FIXED_IN_PR421 | close-on-#421-merge | On origin/main, e2e/camps.spec.ts and e2e/baseball-pipeline.spec.ts have every test wrapped in test.skip(...); e2e/baseball-box-score.spec.ts is full of '// TODO: requires test data setup'. On fix/coderabbit-planned-issues these specs are rewritten… | +| #381 | consolidate legacy flat stats, box-score stats, and elite stat-event imports | stats | medium | FIXED_IN_PR421 | close-on-#421-merge | fix/coderabbit-planned-issues adds docs/baseball/stats-architecture.md (explicitly titled 'Governance note for GitHub issue #381') plus docs/baseball/stats-migration-plan.md, src/lib/baseball/stat-layer-manifest.ts, and… | +| #396 | make public scout packet CSV failures explicit and auditable | recruiting-pipeline | medium | FIXED_IN_PR421 | close-on-#421-merge | origin/main:src/app/baseball/(public)/packet/[token]/csv/route.ts lines ~33-40 — GET always returns `status: 200` regardless of model.ok, with an explicit comment 'Use 200 either way'. PR421 diff changes this to `const status = model.ok ? 200 : model.reason… | +| #398 | remove single-team organization assumptions from team management | recruiting-pipeline | medium | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/actions/teams.ts getCoachTeamForManagement queries `.eq('organization_id', coach.organization_id).single()` (confirmed real single-team-per-org assumption). fix/coderabbit-planned-issues rewrites it as withBaseballAction with… | +| #400 | add product-trust contracts for empty/error/no-permission states | baseball | medium | FIXED_IN_PR421 | close-on-#421-merge | src/contracts/baseball/product-trust.contract.test.ts does not exist on origin/main, but exists on fix/coderabbit-planned-issues (PR #421). It asserts CommandCenterClient exposes loadState error/unauthorized props, DailyBriefPanel distinguishes error vs… | +| #407 | block preview and commit for disabled import sources | recruiting-pipeline | medium | FIXED_IN_PR421 | close-on-#421-merge | src/lib/baseball/import-source-enabled.ts does not exist on origin/main at all (git show errors 'exists on disk, but not in origin/main'). It exists on fix/coderabbit-planned-issues with… | +| #408 | align Performance navigation visibility with route capabilities | shell-nav | medium | FIXED_IN_PR421 | close-on-#421-merge | fix/coderabbit-planned-issues adds src/lib/baseball/__tests__/nav-performance-capability.test.ts with describe block literally titled 'performance nav capability (#408)', testing getBaseballNavEntry/isBaseballNavEntryVisible against… | +| #409 | drive command palette routes from nav registry and resolved context | shell-nav | medium | FIXED_IN_PR421 | close-on-#421-merge | origin/main:src/components/CommandPalette.tsx — takes `isCoach?: boolean` prop and defines hardcoded coachCommands/playerCommands arrays with literal '/baseball/dashboard/...' hrefs, fully disconnected from any nav registry/resolver. PR421… | +| #411 | migrate Roster to server active-context read model | recruiting-pipeline | medium | FIXED_IN_PR421 | close-on-#421-merge | origin/main src/app/baseball/(dashboard)/dashboard/roster/page.tsx used useAuth()/useTeamStore()/client createClient() with setRoster([]) on fetch failure (confirmed real). fix/coderabbit-planned-issues replaces the whole page with a server component using… | +| #412 | make Command Center consume one canonical read model | coachhelm-insights | medium | FIXED_IN_PR421 | close-on-#421-merge | main src/app/baseball/(dashboard)/dashboard/command-center/page.tsx calls getCommandCenter(team.id) but also directly queries baseball_team_members, baseball_events, baseball_player_aggregates in a parallel Promise.all and maps players locally (lines… | +| #413 | add explicit failure states for client-loaded legacy pages | baseball | medium | FIXED_IN_PR421 | close-on-#421-merge | On origin/main, announcements/page.tsx silently falls to 'No Announcements' when result.success is false (no loadError branch), travel/page.tsx only console.errors and renders 'No Team Found', compare/CompareClient.tsx sets [] on every catch. `git diff… | +| #110 | Semgrep rule scope: helmv3-security-definer-without-search-path can't see A... | ci-tech-debt | low | FIXED_IN_PR421 | close-on-#421-merge | Ran semgrep 1.157.0 against .coderabbit/semgrep/helmv3.yml on origin/main: get_my_player_id (created SECURITY DEFINER, no inline search_path in supabase/migrations/20260527000000_prod_public_baseline.sql:2942) is flagged even though its search_path was… | +| #374 | create route/shell contract tests from nav registry, hubs, and server guards | ci-tech-debt | low | FIXED_IN_PR421 | close-on-#421-merge | Commit e98b2d4d (on fix/coderabbit-planned-issues, ancestor of current HEAD) adds src/lib/baseball/route-contract.ts (403 lines, pure analysis core), src/test/helpers/baseball-route-inventory.ts (App Router disk inventory),… | +| #376 | create feature readiness matrix for post-#344/#345 production gaps | ci-tech-debt | low | FIXED_IN_PR421 | close-on-#421-merge | docs/operations/BASEBALLHELM_FEATURE_READINESS_MATRIX.md and .github/workflows/baseball-readiness-matrix.yml do not exist on origin/main (git ls-tree origin/main has zero hits) but both exist on fix/coderabbit-planned-issues (git ls-tree… | +| #383 | remove old/new navigation strata after route registry consolidation | recruiting-pipeline | low | FIXED_IN_PR421 | merge-into-#370 | Same underlying defect as #370 (hub subnav tabs not filtered against role/program/capability contract); PR421 fixes exactly that via filterHubTabsByCapabilities + nav-registry.ts requiredAnyCapabilities/allowedProgramTypes additions (checked git diff… | +| #384 | add product-truth tests for stat-derived CoachHelm claims | coachhelm-insights | low | FIXED_IN_PR421 | close-on-#421-merge | src/contracts/baseball/coachhelm-product-truth.contract.test.ts exists only on fix/coderabbit-planned-issues (not origin/main; git show origin/main: fails, git merge-base --is-ancestor of the introducing commit b7147973 confirms IN PR421 / NOT IN MAIN).… | +| #388 | investigate failing CircleCI lighthouse-preview status on PRs | ci-tech-debt | low | FIXED_IN_PR421 | close-on-#421-merge | Commit 8587d71b ("fix: implement CodeRabbit-planned GitHub issues (#107-#418)", explicitly closes #388, present on fix/coderabbit-planned-issues) updates .circleci/config.yml so the wait-for-vercel-preview step sets SKIP_LIGHTHOUSE=1 and the job exits 0… | +| #390 | classify pending PR checks and add rerun/runbook guidance | ci-tech-debt | low | FIXED_IN_PR421 | close-on-#421-merge | docs/CI_RUNBOOK.md is absent on origin/main (git ls-tree miss) and present on fix/coderabbit-planned-issues, matching the acceptance criteria (hard-gate-vs-advisory classification, rerun commands, wait windows). | +| #410 | server-redirect coaches away from My Stats player route | stats | low | FIXED_IN_PR421 | close-on-#421-merge | origin/main:src/app/baseball/(dashboard)/dashboard/my-stats/page.tsx had no server guard at all (just `export default function MyStatsPage(){ return }`); getMyStats/getMyAggregates in stats.ts call requirePlayerAuth() and return {error} for… | +| #414 | complete demo seed coverage for production-critical surfaces | baseball | low | FIXED_IN_PR421 | close-on-#421-merge | Commit 0d5c21fb (closes #414, on fix/coderabbit-planned-issues) adds scripts/seed-baseball-surfaces-demo.ts (884 lines, upsert-only/idempotent) seeding conversations/messages, videos, tasks, strength groups, developmental plans, seasons, import sources/runs,… | +| #378 | enforce canonical create/new route aliases and stale-link detection | shell-nav | none | FIXED_ON_MAIN | close-now | src/app/baseball/(dashboard)/dashboard/stats/games/new/page.tsx is now a pure redirect to BASEBALL_STATS_GAME_CREATE_PATH (canonical .../create). src/lib/baseball/stats-route-aliases.ts defines BASEBALL_STATS_GAME_CREATE_PATH, the legacy alias,… | +| #387 | repair lint-ratchet baseline or warning regressions on main | ci-tech-debt | none | FIXED_ON_MAIN | close-now | .lint-baseline.json on origin/main now reads: no-arbitrary-text-px=234, no-raw-button=135, no-explicit-any=49, no-arbitrary-bg-white=1309, no-raw-input=474, no-static-element-interactions=5, click-events-have-key-events=3, no-autofocus=1, exhaustive-deps=1 —… | +| #392 | replace shared public demo-account login with isolated demo sessions | security-rls-auth | none | FIXED_ON_MAIN | close-now | src/lib/baseball/with-baseball-action.ts header explicitly documents 'DEMO READ-ONLY GUARD (Issue #392)' — every withBaseballAction call short-circuits with BaseballDemoReadOnlyError for the shared demo session unless demoSafe:true, preventing cross-visitor… | +| #418 | prevent demo seeds from creating recruitable college players | recruiting-pipeline | none | FIXED_ON_MAIN | close-now | scripts/seed-baseball-roster.mjs line 163-164 currently sets `player_type: 'college', recruiting_activated: false` — already corrected. Additionally supabase/migrations/20260630170000_baseball_college_recruiting_check.sql adds `CHECK (NOT (player_type =… | +| #397 | add action integrity checks for merge artifacts and stale type drift | ci-tech-debt | low | FALSE_POSITIVE | close-now | Checked origin/main:src/app/baseball/actions/teams.ts for literal duplicate consecutive lines via `awk 'NF{if($0==prev)print}'` — zero duplicates found. games.ts 'duplicated success: boolean' claim refers to normal per-interface field declarations across many… | +| #107 | Agent B parallel work did not land: 15 CREATE TABLE without same-file RLS s... | ci-tech-debt | none | FALSE_POSITIVE | close-now | Issue body is empty (just an enrichment-bot comment). Verified the underlying claim against real migrations: e.g. CREATE TABLE for baseball_staff_invitations lives in supabase/migrations/20260624000030_baseball_staff_capabilities.sql:98, while ALTER TABLE ...… | +| #108 | Investigate golf_shots.shot_type distinct values on prod (verify CHECK cons... | lifting | none | FALSE_POSITIVE | close-now | Issue body is empty except a coderabbit-enrichment-refresh HTML comment timestamp — no claim, no evidence, nothing to verify. supabase/migrations/20260527000000_prod_public_baseline.sql:10746 shows golf_shots_shot_type_check CHECK constraint… | +| #109 | Audit remaining 6 semgrep WARNING-level findings for action-missing-revalidate | ci-tech-debt | none | FALSE_POSITIVE | close-now | Ran `semgrep --config .coderabbit/semgrep/helmv3.yml src/app` locally: rule helmv3-action-missing-revalidate currently fires 11 times (not 6), at src/app/actions/messages.ts:44,382; src/app/baseball/actions/auth.ts:247;… | +| #389 | clear stale CodeRabbit changes-requested state after config fixes | ci-tech-debt | none | FALSE_POSITIVE | close-now | gh pr view 385 shows state: CLOSED, mergedAt: null. The PR this issue is entirely about (clearing a stale CodeRabbit CHANGES_REQUESTED review on #385) is closed/abandoned, so there is no PR left with a review state to clear. This is a meta/process ticket, not… | + +## 3. "Tracker is wrong here" + +### 3a. FALSE_POSITIVES — close now, no code fix needed + +- **#107** — Agent B parallel work did not land: 15 CREATE TABLE without same-file RLS still flagged + - Why false: Issue body is empty (just an enrichment-bot comment). Verified the underlying claim against real migrations: e.g. CREATE TABLE for baseball_staff_invitations lives in supabase/migrations/20260624000030_baseball_staff_capabilities.sql:98, while ALTER TABLE ... ENABLE ROW LEVEL… +- **#108** — Investigate golf_shots.shot_type distinct values on prod (verify CHECK constraint compatibility) + - Why false: Issue body is empty except a coderabbit-enrichment-refresh HTML comment timestamp — no claim, no evidence, nothing to verify. supabase/migrations/20260527000000_prod_public_baseline.sql:10746 shows golf_shots_shot_type_check CHECK constraint… +- **#109** — Audit remaining 6 semgrep WARNING-level findings for action-missing-revalidate + - Why false: Ran `semgrep --config .coderabbit/semgrep/helmv3.yml src/app` locally: rule helmv3-action-missing-revalidate currently fires 11 times (not 6), at src/app/actions/messages.ts:44,382; src/app/baseball/actions/auth.ts:247; src/app/baseball/actions/demo-access.ts:90;… +- **#397** — BaseballHelm: add action integrity checks for merge artifacts and stale type drift + - Why false: Checked origin/main:src/app/baseball/actions/teams.ts for literal duplicate consecutive lines via `awk 'NF{if($0==prev)print}'` — zero duplicates found. games.ts 'duplicated success: boolean' claim refers to normal per-interface field declarations across many DIFFERENT… +- **#389** — CI: clear stale CodeRabbit changes-requested state after config fixes + - Why false: gh pr view 385 shows state: CLOSED, mergedAt: null. The PR this issue is entirely about (clearing a stale CodeRabbit CHANGES_REQUESTED review on #385) is closed/abandoned, so there is no PR left with a review state to clear. This is a meta/process ticket, not a code defect, and… + +### 3b. ALREADY-FIXED on `main` — close now (independent of PR #421) + +- **#378** — BaseballHelm: enforce canonical create/new route aliases and stale-link detection + - Fix location: src/lib/baseball/stats-route-aliases.ts; src/app/baseball/(dashboard)/dashboard/stats/games/new/page.tsx +- **#392** — BaseballHelm: replace shared public demo-account login with isolated demo sessions + - Fix location: src/lib/baseball/with-baseball-action.ts; src/app/baseball/actions/demo-access.ts; src/app/baseball/(auth)/demo/page.tsx; supabase/migrations/20260630220000_create_baseball_demo_sessions.sql +- **#418** — BaseballHelm: prevent demo seeds from creating recruitable college players + - Fix location: scripts/seed-baseball-roster.mjs:163-164; supabase/migrations/20260630170000_baseball_college_recruiting_check.sql +- **#387** — CI: repair lint-ratchet baseline or warning regressions on main + - Fix location: .lint-baseline.json (already updated by commit b877e537 on main) + +### 3c. ALREADY-FIXED in PR #421 — close on merge (38 issues) + +All 38 of these are real defects confirmed present on `origin/main` but already remediated on branch `fix/coderabbit-planned-issues` (PR #421). Recommended action for all: **merge PR #421, then close.** Two carry a follow-up caveat beyond the code fix itself: +- **#380 / #417** (stats-seed script hardening) — the code fix alone does not invalidate the already-committed, exposed service_role key; a human must still rotate it in the Supabase dashboard (tracked separately as **#516**, which remains CONFIRMED_OPEN for the other 9 scripts). +- **#506** — even after PR #421 lands `can_manage_documents` as a capability, `StaffSettingsClient.tsx`'s `CAPABILITY_DEFS` UI array still omits it, so a small residual gap survives the merge (kept as CONFIRMED_OPEN-equivalent follow-up, not fully closed by #421). + +Full list: #110, #367, #368, #369, #370, #371, #374, #375, #376, #380, #381, #383, #384, #386, #388, #390, #393, #395, #396, #398, #399, #400, #401, #402, #403, #404, #406, #407, #408, #409, #410, #411, #412, #413, #414, #415, #416, #417 + +### 3d. DUPLICATE clusters — collapse + +- **#383 → canonical #370.** Both describe the same underlying defect (hub subnav tabs and nav-registry entries not filtered by role/program-type/capability). The evidence for #383 explicitly states "Same underlying defect as #370" and PR #421 fixes both via the same `filterHubTabsByCapabilities()` + `nav-registry.ts` `requiredAnyCapabilities`/`allowedProgramTypes` changes. **Action: close #383 as duplicate-of-#370 once #370 is closed (both close on PR #421 merge).** + +- **Related-pattern (not literal duplicates) — worth batch-fixing together, kept as separate tickets:** + - **#476** (practice-effectiveness disposition clobbered on upsert) and **#477** (postgame item disposition clobbered on upsert) share the identical root-cause shape (`.upsert(rows, {onConflict, ignoreDuplicates:false})` overwriting a human-set `disposition` column) in two different files. Not a duplicate — different tables/actions — but the same fix pattern (exclude `disposition` from the UPDATE SET, or COALESCE-merge) should be applied to both in one pass. + - **#493, #494, #495, #496** all describe Decision Room read-model field-mapping mismatches (`agenda-ledger.ts`, `focus-imports.ts` casting query results `as unknown as ` without actually producing the fields the UI/type expects). Distinct root files/tables, but same class of bug and same owning file family — bundle into one Decision Room remediation pass (see Section 4). + +## 4. CONFIRMED_OPEN remediation waves + +98 genuinely open issues, grouped by subsystem. Ordered roughly by suggested execution priority (security/critical-correctness first, polish last). + +### Wave 1 — Security / RLS / Auth (8 issues) + +Highest priority: live secrets, authz bypasses, RLS gaps, capability-escalation. No PR #421 coverage exists for any of these; PR #421 does fix a large number of *adjacent* auth issues (see #371, #391's sibling gaps, #394, #401, #406, #416 in Section 3c) so this wave should land **after** #421 merges to avoid rebase conflicts on the same withBaseballAction plumbing. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #516 | critical | P0 SECURITY: production Supabase service_role key hardcoded in 9 tracked scripts | scripts/check-policies.ts, scripts/check-rls.ts, scripts/db-health-check.ts, scripts/debug-player-insert.mj... | +| #391 | high | remove hardcoded real/demo credentials from scripts and rotate exposed accounts | scripts/seed-rini-baseball-demo.ts, scripts/setup-admin.ts, scripts/verify-ios-itinerary-create.mjs | +| #394 | high | finish migrating legacy server actions to shared active-team/capability guards | src/app/baseball/actions/discover.ts, insights.ts, stats.ts | +| #405 | high | exclude inactive staff from active context and read RLS | supabase/migrations/20260624000050_baseball_rls_helpers_and_policies.sql — public.is_baseball_team_staff() ... | +| #501 | high | Cap staff capability grants to the inviter's own permissions | src/app/baseball/actions/staff.ts (updateStaffCapabilities / inviteStaff / resolveInviteCapabilities) | +| #502 | high | Enforce team join policy (closed/approval-required) on join code redemption | src/app/baseball/actions/teams.ts — joinTeam()/validatePlayerCanJoinTeam() (lines ~42-320) and joinTeamByCo... | +| #510 | high | Block approveAiOutput from bypassing player-visible AI policy | src/app/baseball/actions/ai-governance.ts:~115-133 (approveAiOutput) | +| #513 | high | Enforce auth/capability checks on unwrapped academics server actions | src/app/baseball/actions/academics.ts — getTeamAcademics, getPlayerClasses, addPlayerClass, updatePlayerCla... | + +### Wave 2 — Lifting (helm_lifting / baseball_lift_* split) (6 issues) + +#486 (critical) and #492/#456/#491 are all instances of the same legacy-vs-helm_lifting table split from the W2-G rewire. Fix #486 first (publish writes to the table players actually read) since #491/#492 are refinements on the same `publishLiftDay`/`saveLiftSessionPlan` code path — sequence them together to avoid re-touching the same functions twice. #457/#461 are smaller, independent lifting-adjacent bugs that can land in parallel. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #486 | critical | Route program publishes into the table player lift surfaces actually read | src/app/baseball/actions/lifting-v11.ts (publishLiftDay session materialization step) | +| #456 | high | Unify Today lift/readiness reads onto helm_lifting tables | src/lib/baseball/read-models/player-today.ts (readiness gate + Lifts Due queries) | +| #491 | high | Treat empty Lift Builder player selection as "assign to none," not whole team | src/app/baseball/actions/lift-builder.ts saveLiftSessionPlan (treat empty array as explicit empty-set, not ... | +| #492 | high | Deduplicate publishLiftDay assignments for the same program day and date | src/app/baseball/actions/lifting-v11.ts publishLiftDay (~L1448-1523): upsert assignment on (program_id, lif... | +| #457 | medium | Join practice events in getPlayerPractices for calendar times | src/app/baseball/actions/practice.ts getPlayerPractices() select clause (add baseball_events!inner(...) joi... | +| #461 | medium | Revert Daily Contract optimistic toggles on server failure | src/components/baseball/daily-contract/DailyContract.tsx (handleToggle ~line 606, handleShare ~line 645, ru... | + +### Wave 3 — Recruiting / Pipeline / Discover / Camps (15 issues) + +#440 (critical — join-code bypass) should be fixed first and in isolation given its severity. #427/#428/#429 (drag-and-drop + optimistic-UI revert bugs) share the same PipelineClient.tsx/DiscoverView.tsx file family and can land together. #442/#443 (camp capacity) are a natural pair. #430/#431 (Discover pagination/sort) are a natural pair in discover.ts. Independent: #425, #426, #432, #462, #470, #500, #505. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #440 | critical | Route direct join_code confirmations through joinTeamByCode | src/app/baseball/join/[code]/join-team-client.tsx (branch on isInvitationBased) + src/app/baseball/join/[co... | +| #427 | high | Fix pipeline drag-and-drop stage resolution | src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx handleDragEnd (~L238-260) | +| #442 | high | Enforce camp capacity atomically on registration | src/app/baseball/actions/camps.ts registerForCamp(), src/app/baseball/(dashboard)/dashboard/camps/page.tsx ... | +| #470 | high | Fix privacy settings field mapping so saves match baseball_player_settings schema | src/app/baseball/(dashboard)/dashboard/settings/privacy/page.tsx + src/components/player/settings/PrivacySe... | +| #425 | medium | Route pipeline recruits to public profile, not roster-only dashboard player page | src/components/features/pipeline-card.tsx, src/components/baseball/position-planner/PlayerQuickView.tsx | +| #426 | medium | Align pipeline stage UI with the 5-stage server contract | src/lib/recruiting/stages.ts (split UI-only vs server-valid stages) + PipelineClient.tsx handleStatusChange | +| #428 | medium | Stop showing pipeline drag success when stage update fails | src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx handleDragEnd | +| #429 | medium | Revert Discover watchlist UI when server actions fail | src/components/coach/discover/DiscoverView.tsx handleWatchlist | +| #430 | medium | Fix Discover Teams pagination and total counts | src/app/baseball/actions/discover.ts:getDiscoverTeams (~lines 355-357, 524-540) | +| #431 | medium | Apply Discover player sort on the server across all pages | src/app/baseball/actions/discover.ts (getDiscoverPlayers) + src/components/coach/discover/DiscoverView.tsx | +| #432 | medium | Fix PlayerDetailModal message navigation path | src/components/coach/PlayerDetailModal.tsx:53 | +| #443 | medium | Exclude cancelled camp registrations from capacity counts | src/app/baseball/(dashboard)/dashboard/camps/page.tsx (registrations count query + isFull logic) | +| #462 | medium | Use recruiting ProfileEditor for JUCO on dashboard/profile | src/app/baseball/(dashboard)/dashboard/profile/page.tsx | +| #505 | medium | Align Staff Settings edit affordance with can_invite_staff server gate | src/lib/baseball/read-models/decision-room/staff-settings.ts resolveCanManageStaff (~L251-279): drop can_ma... | +| #500 | low | Do not increment scout-packet view_count on CSV downloads | src/app/baseball/actions/scout-packet.ts (resolveScoutPacketByToken, ~lines 442-450); src/app/baseball/(pub... | + +### Wave 4 — CoachHelm Insights / Engine (8 issues) + +#472 (coach_id vs user.id auth bug) and #473 (dismissed insights reactivated) are both in `insights.ts`/`engine-run.ts` and should be fixed together since they touch adjacent upsert/auth logic in the same files. #474/#475/#478/#498/#512 are independent read-model/UI mapping bugs. #496 overlaps with the Decision Room wave (see below) — fix once, cross-reference. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #472 | high | Fix insight dismiss/feedback auth comparing coach_id to auth user.id | src/app/baseball/actions/insights.ts | +| #473 | high | Stop CoachHelm engine upsert from reactivating coach-dismissed insights | src/lib/baseball/coachhelm/engine-run.ts (prior-state fetch ~line 451-456; buildInsightRow ~line 795-825; u... | +| #496 | high | Fix Decision Room "Players to discuss" read-model shape | src/lib/baseball/read-models/decision-room/focus-imports.ts loadPlayerFocus() — needs to actually compute n... | +| #474 | medium | Render CoachHelm insight body on player profile (body vs description) | src/lib/baseball/coachhelm/engine-run.ts (buildInsightRow, ~line 790-825); src/components/baseball/player-p... | +| #475 | medium | Honor player_visible in Practice Intelligence Board visibility | src/app/baseball/actions/practice-intelligence.ts (getPracticeIntelligence SELECT + normalizeVisibility) | +| #478 | medium | Collapse competing development_milestone insights to one per player | src/app/baseball/actions/insights.ts (distinct insight_type per milestone kind) | +| #498 | medium | Stop labeling stable practice-effectiveness reviews as "Moved the wrong way" | src/components/baseball/staff-decision-room/StaffDecisionRoomClient.tsx (EffectivenessReviewRow) | +| #512 | medium | Surface timeline acknowledgement state on the coach player profile | src/app/baseball/(dashboard)/dashboard/players/[id]/page.tsx (fetch acks), src/components/baseball/player-p... | + +### Wave 5 — Decision Room (5 issues) + +#493/#494/#495/#496 are all the same class of defect (agenda-ledger.ts / focus-imports.ts producing objects that don't match the types/fields the UI reads, in one case — #495 — the SELECT itself references nonexistent columns so the query silently errors and the ledger always renders empty). Recommend a single focused rewrite of `src/lib/baseball/read-models/decision-room/{agenda-ledger,focus-imports}.ts` covering all four at once, verified against the actual `baseball_decision_log`/`baseball_meeting_items` migrations. #476/#497 are smaller, independent Decision Room bugs (upsert-clobbers-disposition; disposition-filter mismatch). + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #493 | high | Fix Decision Room agenda detail crash when sourceRefs is null | src/components/baseball/staff-decision-room/StaffDecisionRoomClient.tsx line 1097 (add null guard) and/or s... | +| #495 | high | Map Decision Room ledger rows to kind/label/detail/at | src/lib/baseball/read-models/decision-room/agenda-ledger.ts (select + mapper) and/or a new migration renami... | +| #476 | medium | Preserve practice-effectiveness review disposition on re-measure upsert | src/app/baseball/actions/practice-effectiveness.ts (~line 575-608) — upsert should exclude disposition from... | +| #494 | medium | Map Decision Room agenda rows to kind: 'meeting_item' and correct UI fields | src/lib/baseball/read-models/decision-room/agenda-ledger.ts loadAgendaItems() | +| #497 | medium | Align Decision Room insights disposition filter with signal inbox dispositions | src/lib/baseball/read-models/decision-room/insights.ts:40 (OPEN_DISPOSITIONS constant) | + +### Wave 6 — Stats / Box Score (9 issues) + +#434 (innings-pitched summed as decimal, not outs) is the most consequential — affects ERA/WHIP across every stats surface reading `stats-center.ts` and `BoxScoreView.tsx`; fix the shared `sumInningsPitched` helper first, then #433 (box-score edit doesn't preload lines) and #437 (CSV upload doesn't finalize the game) can land together since they're both in `games.ts`/`BoxScoreUpload.tsx`. #379/#436/#439/#499 and low-severity #438 are independent. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #433 | high | Preload existing box-score lines when editing a completed game | src/app/baseball/(dashboard)/dashboard/stats/games/[gameId]/page.tsx; src/components/baseball/box-score/Box... | +| #434 | high | Sum innings pitched in outs, not as base-10 decimals | src/components/baseball/box-score/BoxScoreView.tsx, src/components/baseball/box-score/BoxScoreEntry.tsx, sr... | +| #379 | medium | reconcile seeded stats with the canonical Stats Center read model | src/lib/baseball/read-models/command-center.ts, src/app/baseball/actions/stats.ts, scripts/seed-baseball-st... | +| #435 | medium | Scope player game log to the selected season year | src/app/baseball/actions/games.ts (~lines 1204-1230); src/app/baseball/(dashboard)/dashboard/players/[id]/s... | +| #436 | medium | Compute OBP/SLG/OPS in legacy aggregate recalculation | src/app/baseball/actions/stats.ts (recalculatePlayerAggregates) | +| #437 | medium | CSV box-score upload must complete game and refresh season stats | src/app/baseball/actions/games.ts (CSV auto-save branch ~line 988) — should also complete the game + recalc... | +| #439 | medium | Wire season-year selector on legacy season stats page | src/app/baseball/(dashboard)/dashboard/stats/season/page.tsx (needs to become client-driven or accept a yea... | +| #499 | medium | Preserve Compare player column order from URL players param | src/app/baseball/(dashboard)/dashboard/compare/CompareClient.tsx (fetchPlayers, ~line 44-50) | +| #438 | low | Count ties as ties in games W-L summary | src/components/baseball/games/GamesList.tsx:74-79 | + +### Wave 7 — Messaging / Notifications (7 issues) + +#450 (failed sends reported as success) and #455 (no read-receipt updates) both live in `use-messages.ts` — fix together. #451 (stale unread badges) is adjacent (same hook family). #452 is `announcements` page staleness — independent. #454/#466 (fake notification-preference persistence) are the same settings page and should be fixed as one unit (either wire to real storage or remove the UI, per the issue's own acceptance criteria). #449 (announcement ack-CTA gating) is independent. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #449 | medium | Show announcement acknowledge CTA before any other player has acked | src/components/baseball/announcements/AnnouncementsPlayerView.tsx (needsAck logic) | +| #450 | medium | Treat failed message sends as failures in useMessages | src/hooks/use-messages.ts:64-71 — check `result.success` before returning true | +| #452 | medium | Refresh announcements list after create/delete on client page | src/app/baseball/(dashboard)/dashboard/announcements/page.tsx + CreateAnnouncementFlow.tsx / AnnouncementsC... | +| #454 | medium | Persist notification preference toggles and honor them for message delivery | src/app/baseball/(dashboard)/dashboard/settings/page.tsx (notification toggles) + src/app/actions/messages.... | +| #455 | medium | Update read receipts when the other party reads messages | src/hooks/use-messages.ts (add UPDATE subscription/refetch), src/components/messages/ChatWindow.tsx | +| #466 | medium | Stop faking coach notification preference saves on account Settings | src/app/baseball/(dashboard)/dashboard/settings/page.tsx notification card (~L163-221); wire to program-set... | +| #451 | low | Clear conversation unread badges when a thread is opened | src/hooks/use-messages.ts | + +### Wave 8 — Onboarding (5 issues) + +#464 (player onboarding never completes via UPSERT) is the highest-severity item — fix first since it can leave real player accounts stuck. #468/#469/#471 are all in the same coach-onboarding page.tsx and can be batched into one PR. #441 (copy-invite-link missing /baseball prefix) is a trivial, independent one-liner. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #464 | high | Wire player onboarding completion through completePlayerOnboarding UPSERT | src/app/baseball/(onboarding)/player/page.tsx:175-197 | +| #441 | medium | Fix showcase Teams "Copy invite link" URL path | src/app/baseball/(dashboard)/dashboard/teams/TeamsClient.tsx line 226 | +| #468 | medium | Block coach onboarding "Yes — invite S&C coach" unless email is provided | src/app/baseball/(onboarding)/coach-onboarding/page.tsx (Step 4 lifting card + handleLiftingAnswer) | +| #469 | medium | Align coach onboarding password validation with server validatePassword | src/app/baseball/(onboarding)/coach-onboarding/page.tsx (Account step Continue gating) | +| #471 | medium | Persist or remove cosmetic coach plan selection during onboarding | src/app/baseball/(onboarding)/coach-onboarding/page.tsx (handleSubmit ~line 302-336), src/app/baseball/acti... | + +### Wave 9 — Documents / Video (4 issues) + +#453 (documents upload/new-version dead buttons) is highest severity. #487/#488 (Video Library upload path + refresh-after-mutation) are in the same `VideoLibraryClient.tsx`/`video-upload.tsx` family — fix together. #506 (missing `can_manage_documents` UI entry) depends on #393/PR421 landing first (adds the capability) — sequence after #421 merge. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #453 | high | Wire documents upload and new-version flows end-to-end | src/app/baseball/(dashboard)/dashboard/documents/documents-client.tsx (empty-state button onClick + onUploa... | +| #487 | medium | Wire Video Library uploads through saveMyVideo server action | src/components/features/video-upload.tsx (lines ~139-147); src/components/baseball/video/VideoLibraryClient... | +| #488 | medium | Refresh Video Library after upload/edit/delete mutations | src/components/baseball/video/VideoLibraryClient.tsx (handleMutated) | +| #506 | low | Expose can_manage_documents in the staff capability matrix | src/components/baseball/staff/StaffSettingsClient.tsx CAPABILITY_DEFS array — must add can_manage_documents... | + +### Wave 10 — Academics (5 issues) + +#513 (unwrapped academics server actions — no auth at all on read paths) should land first given it's a real authz gap, even though not flagged security-rls-auth in this dataset — treat as security-adjacent priority. #507 (coach-notes query references nonexistent columns — feature is fully broken, not just a mismatch) and #509 (no team scoping on eligibility reads) are both in the same read-model/actions files and can batch. #448 (dev-plan goals not player-completable) and #504/#508 (module-toggle enforcement, JUCO-only academics gate) are independent. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #448 | high | Let players complete dev-plan goals with player-scoped actions | src/app/baseball/(dashboard)/dashboard/dev-plan/page.tsx; src/app/baseball/actions/dev-plans.ts (updateGoal... | +| #507 | high | Fix Player Today coach-notes query against wrong table columns | src/lib/baseball/read-models/player-today.ts (coach-notes query in loadPlayerToday / equivalent) | +| #504 | medium | Enforce program module toggles (academics/travel) beyond settings storage | src/app/baseball/actions/academics.ts, travel.ts (add module-flag check) + src/lib/baseball/nav-registry.ts... | +| #508 | medium | Allow college programs to reach the Academics dashboard | src/lib/baseball/server-route-guards.ts:requireAcademicsCoachRoute and src/lib/supabase/middleware.ts acade... | +| #509 | medium | Scope academics eligibility reads and defaults to the active team | src/app/baseball/actions/academics.ts getTeamAcademics() (~lines 100-165) | + +### Wave 11 — Mobile Chrome / Layout (7 issues) + +All 7 are independent CSS/layout-only fixes (no shared logic, safe to parallelize across engineers): #479 (duplicate header), #480 (hidden hub subnav on mobile), #481 (messages viewport math), #482 (public profile hero), #483 (safe-area padding), #484 (Player Today CTA count), #485 (calendar height offsets). Recommend batching into a single visual-QA pass since they all require a real device/viewport to confirm (see Section 5, NEEDS_REPRO). + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #479 | medium | Eliminate stacked mobile top chrome (shell bar + legacy Header) | src/app/baseball/(dashboard)/dashboard/roster/RosterClient.tsx (and equivalent Settings/Discover/message-th... | +| #480 | medium | Show hub sub-navigation on mobile for Team/Stats routes | src/components/baseball/dashboard-shell.tsx (HubSubNav mobile visibility) | +| #481 | medium | Fix message surfaces' viewport math and loading chrome drift | src/app/baseball/(dashboard)/dashboard/messages/page.tsx, messages/[id]/page.tsx, messages/loading.tsx | +| #482 | low | Compact the public player profile mobile hero and fix shared-link navigation | src/app/baseball/(public)/player/[id]/PlayerProfileClient.tsx (hero section ~lines 231-313) | +| #483 | low | Add safe-area-top padding to the baseball shell sticky bar | src/components/baseball/dashboard-shell.tsx (sticky header div ~line 241) | +| #484 | low | Reduce Player Today to one contextual primary CTA on mobile | src/components/baseball/player-today/PlayerTodayClient.tsx (PrimaryCtaRow + header layout, ~lines 1489-1632) | +| #485 | low | Align calendar full-height layout with shell chrome offsets | src/app/baseball/(dashboard)/dashboard/calendar/page.tsx; src/components/baseball/dashboard-shell.tsx | + +### Wave 12 — Shell / Navigation (3 issues) + +#460 (wrong practice route for players), #463 (teamless handling inconsistency between Today and Timeline/Passport), #465 (password-reset redirect message-key mismatch, trivial one-liner) — all independent, low-effort. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #460 | medium | Point Today practice CTAs to /baseball/player/practice | src/components/baseball/player-today/PlayerTodayClient.tsx (lines ~1367-1368, 1417-1418, 1517-1521) | +| #463 | medium | Align teamless handling on timeline/passport with Today | src/app/baseball/(player-dashboard)/player/timeline/page.tsx:47-48; src/app/baseball/(player-dashboard)/pla... | +| #465 | low | Fix password-reset success redirect to use login message codes | src/app/baseball/(auth)/reset-password/page.tsx redirect string | + +### Wave 13 — Calendar / Events (3 issues) + +#458 (UTC-vs-team-timezone `todayIso` for Player Today) is the most consequential — affects what "today" means for every player. #444 (infinite spinner for zero-team coaches) and #445 (requires_rsvp never persisted) are independent. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #458 | high | Pass team-tz todayIso into getPlayerToday | src/app/baseball/(player-dashboard)/player/today/page.tsx:117 | +| #444 | medium | Stop infinite loading on Events when coach has zero teams | src/app/baseball/(dashboard)/dashboard/events/EventsClient.tsx (useEffect around line 172) | +| #445 | medium | Persist and surface requires_rsvp for baseball calendar events | src/app/baseball/actions/calendar.ts (insert payload), src/app/baseball/(dashboard)/dashboard/calendar/page... | + +### Wave 14 — Misc app bugs (uncategorized: "other" + "baseball" areas merged) (9 issues) + +#490 (lineup builder drag displaces without swap-back) and #489 (saveLineup success toast shown on validation failure) are both in the roster/lineup surface and can batch. #447 (camp date off-by-one), #467 (dead demo-mode settings link), #477 (postgame disposition clobber, cross-ref Wave with #476), #503 (season module toggles not enforced), #446 (travel trip past/upcoming classification), #459 (activate page not wired to activateRecruitingExposure), #511 (no player-visible scope control when coaches author notes) are all independent single-file bugs — the input dataset labeled the last three "baseball" rather than a specific subsystem; they are grouped here rather than invented into a subsystem that doesn't fit. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #446 | medium | Align travel trip past/upcoming classification with display dates | src/components/baseball/travel/TravelClient.tsx | +| #447 | medium | Fix camp date display off-by-one for date-only values | src/app/baseball/(dashboard)/dashboard/camps/page.tsx and src/app/baseball/(dashboard)/dashboard/camps/[id]... | +| #459 | medium | Wire activate page to activateRecruitingExposure server action | src/app/baseball/(dashboard)/dashboard/activate/page.tsx | +| #477 | medium | Preserve postgame item disposition on regenerate upsert | src/app/baseball/actions/postgame.ts:476-498 (mapItem), L189 upsert | +| #489 | medium | Check saveLineup result before showing roster success toast | src/app/baseball/(dashboard)/dashboard/roster/RosterClient.tsx:933-940 — branch on `result.success` before ... | +| #490 | medium | Swap or return displaced player when dropping into an occupied lineup slot | src/components/coach/lineup/LineupBuilder.tsx:60-87 | +| #503 | medium | Enforce season module toggles at runtime, not just in settings storage | src/app/baseball/actions/team-season-settings.ts and each gated feature's server action | +| #467 | low | Repair or remove dead demo-mode settings deep link | src/lib/baseball/settings-route-aliases.ts + src/app/baseball/(dashboard)/dashboard/settings/demo-mode/page... | +| #511 | low | Add player-visible scope control when coaches author notes | src/components/baseball/player-profile/PlayerProfileClient.tsx | + +### Wave 15 — CI / Tech debt (remaining, not fixed by #421) (4 issues) + +#372 (CI silently skips authenticated smoke tests when a secret is unset) is the highest-value fix — should gate merges, not just be advisory. #373 (route crawler coach-only, not wired into CI) builds on the PR #421 scaffold (`scripts/route-crawler-baseball.mjs`) — extend it rather than rewrite. #377/#382 are documentation/test-coverage debt, lowest urgency. + +| # | Severity | Title | Fix location | +|---|---|---|---| +| #372 | medium | make authenticated coach/player smoke tests mandatory in CI | e2e/baseball-phase1.spec.ts + .github/workflows/playwright.yml (add a CI job that fails if PLAYWRIGHT_BASEB... | +| #373 | low | extend route crawler to authenticated Baseball coach and player sessions | scripts/route-crawler-baseball.mjs (add player-session crawl using PLAYER creds; wire into a CI workflow wi... | +| #377 | low | add business/product-truth contracts for stats, CoachHelm, and source trust | src/contracts/baseball/** (new), docs/operations/BASEBALLHELM_BUSINESS_CONTRACT_MATRIX.md (new) | +| #382 | low | create seeded production smoke for Rini/demo stats surfaces | e2e/baseball-phase1.spec.ts + CI workflow (.github/workflows) to seed a deterministic fixture and set PLAYW... | + +## 5. NEEDS_REPRO — issues needing a running app to fully validate + +This audit was performed entirely via static analysis (git diff, file reads, migration inspection, `semgrep`/`vitest` where noted) — no issue in this ledger was verified against a live running instance. The following CONFIRMED_OPEN issues are the ones where the *code path* is confirmed to exist, but full validation of user-visible impact (exact visual glitch, race condition timing, drag-and-drop precision, or a specific runtime state) genuinely requires driving the real app (dev server + Playwright/manual click-through), not just reading source: + +| # | Why it needs a running app | +|---|---| +| #427 | Pipeline drag-and-drop stage resolution — needs an actual `@dnd-kit` drag gesture ending over a card (not a column) to confirm the invalid-stage write | +| #428 | Pipeline drag success/failure double-toast — needs a live server-action failure during a drag to see both toasts fire | +| #490 | Lineup builder drop onto an occupied slot — needs interactive drag-drop to see the displaced player disappear | +| #461 | Daily Contract optimistic toggle revert — needs a forced server failure mid-toggle to see the stuck-optimistic-state UI | +| #479 | Stacked mobile top chrome (shell bar + legacy Header) — needs a real mobile viewport screenshot to confirm visual double-header | +| #480 | Hidden hub sub-navigation on mobile — needs a real ` file). (B) separate RLS/security PR for the 9 `fix(db)`/`test(db)` commits scope-creeped in (`de27502d`..`09684c65`) that edit already-merged migration files in place — verify against live prod grants, don't assume the new REVOKEs execute. **Drop the 58-file/143k-line `.cleanup/reports/*` raw tool-stdout dump** (95% of the PR's additions) from version control entirely — it duplicates the curated `docs/audits/*.md` in the same PR and will rot immediately. | +| **#357 → #358 → #366** test-hardening stack | #357: advisory business-contract Vitest lane. #358: free production-readiness tooling (Semgrep, dep-cruiser, jscpd, Stryker, k6, Playwright/ZAP/Schemathesis, route hygiene). #366: canonical route renames (`/new`→`/create`, `/recover`→`/recover-draft`, `/compare`→`/compare-players`) + redirects | OPEN, each `base` = previous PR's head branch (not main) | Each reports MERGEABLE/CLEAN, but that's an artifact of unprotected intermediate branches (`gh api .../protection` 404s for all 3) — a real merge test against main reproduces the same 8-10 conflicting files as #356, plus `vitest.config.ts` and `package.json` once #357/#358's commits are folded in | **Consolidate first** (merge #366→#358→#357→#356 branch tips, all currently zero-review/unprotected), resync the single resulting branch with main once, resolve the conflict set exactly once, then re-run full CI before opening a fresh PR to main. Before merge, fix 3 real Greptile findings: #358's `run-readonly-db-audit.mjs` can silently fall back to the live app `DATABASE_URL`; its `run-helm-auditor.mjs` deletes all tracked (non-ignored) Markdown under `docs/operations/revealed-bugs/production-readiness/` before regenerating; #366 left 7 stale/mangled route-string references in test fixtures (e.g. `compare-players-players-players`). | +| **#423** baseball RLS `cursor/baseball-rls-types-drift-71ee` | Phase-1 RLS hardening (practice/event-ack policies) + sha256 input fix, split out of merged #420 | OPEN, DRAFT, `CHANGES_REQUESTED` | MERGEABLE=true, but CI's `build` job fails on an **unrelated, already-tracked** lint-ratchet regression (issue #387) | **Fix the confirmed real gap before un-drafting**: `baseball_practice_attendance_select`'s player-self branch (lines ~155-163) omits the `p.status='published'` gate its sibling policies enforce (Greptile + CodeRabbit both flagged this independently) — a player can read attendance for an unpublished/draft practice. Also reconcile against local-only branch `pr-420`, which independently (and more loosely) rewrites the same RLS test file. | +| **#514** review-infra `chore/fix-coderabbit-issue-enrichment` | Replace broad 16-label `auto_planning` trigger with a single `plan-me` label + dedicated workflow | OPEN, `CHANGES_REQUESTED` | Small (2f, +38/-16) | **Quick fix and merge**: add an `unlabeled` event trigger so removing `wip`/`no-plan` after creation re-evaluates (Greptile-flagged gap), then resolve CodeRabbit's review. | +| **#515** review-infra `chore/qodo-free-issue-wiring` | PR-template section + advisory `qodo-issue-context.yml`; Qodo itself is **not installed** as a GitHub App | OPEN, `CHANGES_REQUESTED` | Small (3f, +128/-0) | **One-line fix** (`permissions: add contents: read`) clears CodeRabbit's only comment. Consider renaming the workflow away from "Qodo" branding since it does nothing Qodo-specific yet. | +| Dependabot (19 open) | Routine dependency bumps | See §7/Slice L | Mixed | Merge 12 safe ones now; combine eslint+@eslint/js into one PR; dedicate separate upgrade PRs for tailwind v3→v4 and vite/plugin-react; close #204 (superseded by #348). | +| **#262** `feat(email) branded layout` | Stale legacy PR, base=main | OPEN, CONFLICTING | Not slice-investigated in depth this pass | **Close or rebase-and-revisit** — predates the entire baseball/CI rebuild; likely needs a from-scratch rebase to even evaluate conflict scope. | +| **#243** `fix(notifications,ci) push dispatcher + RLS check` | Stale legacy PR, base=main | OPEN, CONFLICTING | Not slice-investigated in depth | Same treatment as #262 — close or rebase. | +| **#333** `fix(golf) premium P1 error-masking` | Stale legacy PR, base=main | OPEN, CONFLICTING, `CHANGES_REQUESTED` | Not slice-investigated in depth | Likely safe to close given golf was fully reverted to pre-Fairway state (§3) — verify scope doesn't depend on reverted code before closing. | +| **#334** `fix(coachhelm) P0 engine-trust criticals` | Golf CoachHelm engine-trust fixes (`golf_coachhelm_coach_weights`), CONFIRMED golf-scoped not baseball | OPEN, CONFLICTING | Slice H confirms scope is golf, not baseball | Evaluate independently of the baseball work; does not address any of the 16 open BaseballHelm coachhelm-insights issues — don't assume it covers baseball CoachHelm gaps. | + +--- + +## 5. The 13 Local-Only Branches (batch12/* + pr-420) + +**Resolution of disagreement between Slice C and the inventory:** the inventory (captured earlier in the session) listed 12 `batch12/issue-*` branches plus `pr-420` as local-only and unreconciled. Slice C and Slice B (working from a later git state in the same fast-moving repo) found that **all 12 `batch12/*` branches no longer exist** — `git branch -a` returns zero matches, and `git fsck --no-reflogs --unreachable` shows only dangling commit objects + stash entries. Every one of the 12 issue numbers (#372, #374, #375, #376, #377, #380, #381, #382, #383, #387, #392, #414) is **already a standalone commit directly on `fix/coderabbit-planned-issues`** (PR #421's head): `42c4746f` (#372), `e98b2d4d` (#374), `d58a205a` (#375), `4520e62e` (#376), `ddfd5684` (#377), `62465409` (#380), `c8dc8c1a` (#381), `682c20c3` (#382), `165ca9b5` (#383), `781c4db8` (#387), `b8ef73bd` (#392), `0d5c21fb` (#414). Patch-id comparison shows 9/12 are byte-identical to their dangling batch12 originals; 3 (#372, #375, #382) differ by 15-66 lines from rebase adaptation but are substantively the same change. **No further branch-recreation work is needed — the consolidation is done.** The remaining action item is purely PR-hygiene: PR #421's "Closes" list omits all 12 of these issue numbers, so merging it as-is will leave them open on GitHub despite being fixed (see §9). + +**`pr-420`** ("db: restore baseball practice rls policies," 13 commits ahead of main, 30 files) is **fully redundant** and should be deleted: its CI-gate commits are loosely covered by the squash-merged PR #420, and its RLS-policy payload is already present, squashed, in open draft PR #423 (`be33ee08`). The one unique artifact on `pr-420` — `vitest.business.config.ts`, a 26-line Vitest project wiring `*.contract.test.ts` as a "business" lane — has no home anywhere else and conceptually overlaps PR #357's own (different) business-contract lane; cherry-pick it into #423 or #357 if wanted, otherwise let it go with the branch deletion. + +A secondary finding from Slice C: a second worktree's `chore/unify-pr-checks-and-coderabbit` branch (PR #420's actual head) has **10 commits beyond what GitHub's squash-merge for #420 captured** — confirm with the owner whether those are intentional follow-on work (possibly feeding #514/#515) before that branch/worktree is cleaned up. + +**Consolidation plan:** (1) delete `pr-420` locally; (2) confirm the extra 10 commits on `chore/unify-pr-checks-and-coderabbit` are intentional or discard; (3) treat PR #421 as the sole consolidation target for all 12 former batch12 issues — proceed straight to landing it (§4); no separate batch12 PRs are needed. + +--- + +## 6. BaseballHelm Shell / Navigation / Routing Drift — OLD → NEW Surface Map + +This is the user's top concern. The route tree has **118 `page.tsx` + 1 `route.ts`** under `src/app/baseball`. The good news: the d0d72fa3→a85c82b4 commit sequence already did real consolidation work — most apparent "duplicates" the inventory flagged turned out, on inspection, to be intentional role-split surfaces, not competing implementations. The bad news: the **single highest-leverage fix (the sidebar's legacy fallback nav array) is unresolved and live on main today.** + +| Old/Legacy Surface | New/Canonical Surface | Status on main (2026-06-30) | Evidence | +|---|---|---|---| +| `(coach-dashboard)/coach/{college,high-school,juco,showcase}` | `(dashboard)/dashboard/command-center` | **Retired — all 8 are 1-line `redirect()` stubs** (commit `d0d72fa3`); old `JucoPlayerDashboard.tsx`/`JucoTeamDashboard.tsx`/`TeamDashboardClient.tsx` (~2,189 lines) deleted, zero remaining references | Slices A, I | +| `(player-dashboard)/player/{college,high-school,juco,showcase}` | `/baseball/player/today` | **Retired — pure redirect stubs**, same commit | Slice I | +| `(dashboard)/dashboard/page.tsx` (old read-model) | `(dashboard)/dashboard/command-center/page.tsx` | **Retired — old hook+queries deleted** (`use-baseball-dashboard.ts` 114 lines, `queries/baseball-dashboard.ts` 348 lines, both removed in `d0d72fa3`); `/dashboard` server-redirects to command-center (`c21dfe8e`, `d95d918e`) | Slice A | +| `(dashboard)/dashboard/team/page.tsx`, `team/high-school/page.tsx` | COACH_HOME (via middleware) | **Dead code, not deleted.** Both pages still contain their own role-branch redirect logic, but `src/lib/supabase/middleware.ts`'s `LEGACY_TEAM_ROUTES` (line ~109) unconditionally intercepts `/baseball/dashboard/team*` and redirects to COACH_HOME **before the page component ever runs**. The page-level logic is unreachable via real HTTP traffic — two competing redirect mechanisms exist for one dead route. | Slice I | +| `src/components/layout/sidebar.tsx` legacy fallback arrays (`collegeTeamNav`, `hsCoachTeamNav`, `jucoTeamNav`, `showcaseOrgNav`, `playerTeamNav`, lines 136-206) | Registry-driven `buildCondensedBaseballNavigation(ctx)` via `getVisibleBaseballNav` (capability-gated) | **LIVE BUG, unresolved on both main and PR #421** (`git diff origin/main HEAD -- sidebar.tsx` = empty — identical on both). `getNavigation()` (lines 359-383) falls back to the capability-blind legacy arrays whenever `navContext` is null/loading, or if the server resolve throws (`.catch(() => null)`). The legacy arrays unconditionally include `COACH_MANAGEMENT_HUB` and `COACH_ACADEMICS_HUB` regardless of `can_invite_staff`/`can_manage_settings`/`coach_type==='juco'`. Zero test coverage on this fallback path. | Slice I (high-severity) | +| nav source classification (ad hoc, scattered) | `src/lib/baseball/nav-manifest.ts` (issue #383 deliverable, commit `165ca9b5`) — canonical/alias/deprecated/removed classification, 227-line test pins every entry to disk | **Built and tested, but exists ONLY on PR #421's branch — not merged to main.** It is read-only/audit-layer (consumed only by its own test), **not yet wired into `sidebar.tsx`**, so merging #421 alone does not fix the sidebar bug above; a follow-up commit is still needed. | Slice I | +| `dev-plan` (player) vs `dev-plans` (coach list) | N/A — verified NOT duplicates | Distinct, intentional role-scoped features (confirmed via `nav-registry.ts` comments, distinct implementations). However, neither is in `middleware.ts`'s `ROUTE_CAPABILITY` map (unlike `compare`/`comparisons`, which got `requireRecruitingCoachRoute()` + middleware gating) — an auth-pattern migration gap, not a route duplicate. | Slice I | +| `compare` vs `comparisons` | N/A — verified NOT duplicates, both gated | Both migrated to server-route-guard pattern with middleware `ROUTE_CAPABILITY` entries | Slice I | +| `performance` (coach: live/groups/builder/programs) vs `lift/[sessionId]` (player) vs `readiness` (player) vs `my-stats` (player) | N/A — verified NOT duplicates | `performance/page.tsx` hard-redirects non-coaches to `/baseball/player/today`; all `performance/*` sub-pages are coach-only authoring tools, structurally distinct from player lift-execution/readiness surfaces. `performance/players/[id]/page.tsx` is a deliberate, documented redirect funnel into the canonical `/dashboard/players/[id]` profile. | Slice I | +| `players/[id]/stats/page.tsx` + `players/[id]/page.tsx` | sibling routes already migrated (passport, scout-packet, scout-packet/preview) | **Auth-pattern gap, not a route duplicate.** These two still use a raw inline `.from('baseball_coaches').select(...).single()` pattern instead of the `getActiveBaseballContext()` helper used by their migrated siblings. RLS still enforces access (not an access-control hole), but inconsistent with the "new" architecture. | Slice I, J | +| `(coach-dashboard)`/`(player-dashboard)` route groups themselves | `(dashboard)` shared `BaseballShellLayout`/`BaseballDashboardShell` | **Verified NOT competing implementations** — both groups' `layout.tsx`/`template.tsx` thinly wrap the same shared shell (consolidated in `a85c82b4`); group-level `error.tsx` files are intentionally retained scaffolding for stale bookmarks (documented in-file). | Slice I | +| `admin/demo-sessions` | N/A — standalone, no competing surface | Single page (issue #392, commit `b8ef73bd`); recently had a lint-token regression fixed in commit `55c6db6a` (2026-06-30), pushed to PR #421 only, not main | Slice A, B | + +**Bottom line for the user's top concern:** the route-tree-level cleanup (dashboards, redirects, route groups) is genuinely done and clean. The navigation/shell-level cleanup (what actually renders in the sidebar) is **not** done — issue #383 is still OPEN, its own acceptance criterion "remove stale fallback nav arrays once the registry path is validated" was never attempted, and the bug it exists to fix is live on main right now, independent of PR #421's merge state. + +--- + +## 7. Dependency / Dependabot Landscape (supporting §4) + +19 open dependabot PRs. Main's own CI workflow is independently failing on baseline jobs (`Course picker screenshots`, `Next build`, `Playwright (chromium)`, `Smoke checks`, `Supabase lint + RLS tests`, aggregate `all`) regardless of which dependency is bumped — this is pre-existing main-state breakage, not a regression introduced by any PR. + +- **Safe now (12):** #348 (dev-deps group, 11 minor/patch updates), #347 (github-actions group — but check semgrep/yamllint failure beyond baseline before merge), #326 (undici), #325 (hono), #323 (dompurify), #246 (`@datadog/browser-rum` major but isolated telemetry SDK), #236 (knip, dev-tool-only), #234 (`@vercel/analytics` major — smoke-test call sites first), #232 (dotenv major — de-risked, repo confirmed ESM-only), #309 (vite 7→8 — TypeScript/ESLint pass), #230 (typescript 5→6 — TypeScript check passes, still verify locally given centrality). +- **Confirmed-breaking majors needing dedicated migration PRs:** #244 (tailwindcss 3→4 — TypeScript/Unit tests/Business contracts all FAIL; `globals.css` still uses v3 `@tailwind` directives, needs the v4 codemod); #245+#231 (eslint 9→10 + `@eslint/js` 9→10 — each breaks ESLint/Lint-ratchet alone, **must be combined into one PR**); #235 (`@vitejs/plugin-react` 6 — pairs with #309, but alone fails Business contracts/Unit tests). +- **Conflicting/superseded:** #204 (npm_and_yarn group) — `mergeStateStatus=CONFLICTING` because #348's grouped bump already moves vitest past #204's target; close once #348 merges. +- **Stale:** #184, #183, #308 — `mergeStateStatus=BEHIND`, CI hasn't re-run since main advanced; rebase before judging. + +--- + +## 8. Stats Architecture (Three-Layer) + Lifting Data-Path Consistency + +**Three-layer stats model** (documented in `docs/baseball/stats-architecture.md`, issue #381, commit `c8dc8c1a` — **exists only on PR #421, not main**): +- **Layer 1 "Legacy flat/aggregate" (DEPRECATED):** `baseball_player_stats` + `baseball_player_aggregates`, written by `actions/imports.ts`/`actions/stats.ts`, no read-model. Confirmed still **actively maintained** on main: commits `c05241ca` and `1fac6316` (both on main, 2026-06-25) harden/extend Layer-1 consumers (`MyStatsClient.tsx`, `TeamBattingOverview.tsx`), i.e. main is investing in the deprecated path, not migrating off it. +- **Layer 2 "Official box-score/season" (CANONICAL):** `baseball_box_score_batting/_pitching` → `recalculate_baseball_season_stats()` RPC → `baseball_player_season_stats`, canonical read path `read-models/stats-center.ts`. **Gap:** `players/[id]/stats/page.tsx` and the box-score page query these tables **directly via `actions/games.ts`**, bypassing `stats-center.ts` — not caught by the #381 contract test, which only guards literal Layer-1 table-name references. +- **Layer 3 "Elite event-grain" (CANONICAL):** `baseball_pitch_events`/`_batted_ball_events`/`_swing_events` + provenance, canonical read path `read-models/elite-stat-events.ts`. No drift found here. + +**Confirmed-live correctness bugs in the canonical Layer-2 write path (on main today):** +- **Issue #399** (non-atomic box-score saves): `saveBoxScoreBatting`/`saveBoxScorePitching` (`actions/games.ts:507-510,588`) do delete-then-insert with no transaction. The UI's real save path (`saveFullBoxScore`) uses an atomic RPC instead, but the non-atomic standalone functions are still reachable via the CSV auto-save branch (~line 990-995). +- **Issue #437** (compounds #399): that same CSV auto-save branch never calls `markGameCompleted` or `recalculate_baseball_season_stats`, so CSV-uploaded games silently leave Stats Center/season tables stale despite a "stats saved!" success message. +- **New, unfiled finding (Slice J):** `src/lib/baseball/read-models/decision-room/focus-imports.ts:168-176` queries `baseball_coach_notes` with 5 nonexistent columns (`title, tags, pinned, archived_at, updated_at`) — the only migration for that table (`20260624000900`) defines `id/player_id/team_id/body/scope/author_coach_id/edited_at/deleted_at/created_at`. Because the query's error path is explicitly re-thrown, this **breaks the entire Decision Room page load for every coach** (not just one rail) — more severe than the already-filed, same-root-cause issue #507 (which covers the identical bug in `player-today.ts:606-614`). **Recommend filing a new issue** for `focus-imports.ts` distinct from #507/#496. + +**Lifting data-path split — also confirmed worse than the 6 filed issues capture (Slice M).** The Helm Lifting Lab (PR #345) introduced a clean canonical `helm_lifting_*` schema (~30 tables) and a fully-wired standalone `/lifting` portal, but BaseballHelm's embedded surfaces only partially migrated: +- **`publishLiftDay`** (`src/app/baseball/actions/lifting-v11.ts:1449-1530`) — the **only** write path reachable from BaseballHelm's main coach nav (`/baseball/dashboard/performance/programs`) — writes exclusively to legacy `baseball_lift_program_assignments`/`baseball_lift_sessions`. Player-facing surfaces (`player-lift.ts`, `player-today-lift.ts`) and the standalone Lab's Program Editor/Live Weight Room read **exclusively** `helm_lifting_*` — **zero table overlap.** A coach publishing a program via the surface most users will actually find produces sessions invisible to every player-facing screen (issue #486). +- Only a one-time idempotent backfill migration (`20260625000080`) ever copied legacy rows into `helm_lifting_*` — no ongoing trigger/sync exists. +- Beyond the 6 filed issues (#456, #486, #487, #488, #491, #492) plus 2 adjacent lineup bugs (#489, #490), **~6 additional coach-facing read-models** (Performance Command Center, Live Weight Room, Strength Groups, Decision Room lift/readiness) remain entirely on the legacy schema and are **undocumented/unfiled drift**. +- **A second, fully-built Program Editor** (`src/components/lifting/programs/ProgramEditorClient.tsx`, 1,430 lines, targets `helm_lifting_*` via `publishProgram`) exists in parallel to the baseball-embedded one (`src/components/baseball/performance/ProgramEditorClient.tsx`, 1,252 lines, targets legacy via `publishLiftDay`) — same feature, two schemas, only one reachable from the main nav. +- **#492** confirmed: no unique constraint on `(program_id, lift_day_id, scheduled_date)`, so re-publishing the same day creates duplicate assignments + duplicate sessions every time. +- **#491** confirmed: an empty player selection in the Lift Builder quick-assign tool is sent as `playerIds: undefined`, which the filter treats as "no filter" — assigning the **whole team**, not none. + +--- + +## 9. DB Migrations & RLS / Security Posture + +`supabase/migrations` has 159 files, chronologically clean post-fix (no timestamp collisions after commits `90803827`/`2a822052`). Three named hygiene commits (timestamp dedup, `NOT VALID`→`UNIQUE INDEX` fix for #2a822052, statement_timeout fix #343) are all legitimate and live on main. + +**Confirmed live defects on main:** +1. **Issue #386 (migration-replay-breaking, high-risk+rls+database+ci):** `20260624000050_baseball_rls_helpers_and_policies.sql` (lines 466/482/487) references `baseball_staff_invitations.accepted_by_user_id`, but that column isn't added until `20260624000062`. A fresh `supabase db reset` fails with `42703`. Two unmerged candidate fixes exist (commit `9d068047` on PR #421, and a belt-and-suspenders `ADD COLUMN IF NOT EXISTS` in `0a931429`) — neither is on main. +2. **~45 baseball tables still carry the 2026-05-27 prod-baseline `GRANT ALL ON TABLE ... TO anon`** (`20260527000000_prod_public_baseline.sql`) with no revoke migration ever issued, including PII/recruiting-sensitive tables: `baseball_players`, `baseball_documents`, `baseball_messages`, `baseball_videos`, `baseball_watchlists`. Only 2 tables (`baseball_coach_insights`, `baseball_notifications`) were ever explicitly revoked on main; the dedicated `anon_revoke_wave1/wave2` migrations cover 25 tables that **do not overlap** with this 45-table gap. At least 3 of these (`baseball_box_score_batting/_pitching`, `baseball_player_season_stats`) additionally pair the stale grant with a no-role-qualifier (defaults-to-PUBLIC) SELECT policy — currently non-exploitable only because the predicate evaluates false on NULL `auth.uid()`, not because of role restriction. +3. **PR #423's own remediation introduces a new gap** (see §4): the practice-attendance player-self policy omits the published-status gate. +4. **Two unmerged sources define divergent content under the identical migration filename** `20260630170248_harden_baseball_phase1_rls_rollup.sql`: PR #423's version (208 lines, includes `baseball_games`/`_team_coach_staff`/box-score revokes) vs. local-only `pr-420`'s version (109 lines, looser, omits those revokes). This is a merge-collision risk if both are ever applied — pick #423 as canonical (per §5) and discard `pr-420`. +5. **Issue #406** (scope_player_ids RLS canonicalization) has a written fix (`20260630180000_baseball_scope_player_ids_rls.sql`) that also is not on main. +6. **Issue #107** ("15 CREATE TABLE without same-file RLS") is a **confirmed false positive** — spot-check of `20260624000080` shows every CREATE TABLE followed by an explicit `ENABLE ROW LEVEL SECURITY` within 30-50 lines; the semgrep rule's 5,000-character lookahead is the actual cause. A structural scan of all 104 baseball/lifting tables found 0 missing an enable statement. + +**Process gap:** Squawk (migration-safety lint) only runs in the weekly scheduled CircleCI workflow, not as a per-PR hard gate — ordering bugs like #386 are not caught before merge. + +--- + +## 10. Issue-Creation & Review Automation — Current Pipeline + +**CodeRabbit half — live and working.** `.coderabbit.yaml` (30KB, assertive profile, `request_changes_workflow: true`) is live on main via merged PRs #419 and #420. It defines 6 error-mode `pre_merge_checks` custom checks (service-role-in-client, RLS-on-new-tables, auth-check-in-server-actions, sport-prefixed-tables, no-destructive-writes, no-edits-to-historical-migrations) mirrored locally in `.github/workflows/review-gate.yml`'s ast-grep job (4 of 8 local rule files — the other 4 are intentionally CodeRabbit-cloud-only warning-severity, by design, not a gap). Main's branch protection (verified via API) matches `.github/branch-protection.md` closely. CI is green except the known/excluded baseball-RLS job (§3). `issue_enrichment.auto_planning.labels` is **still the broad 16-label list** on main — PR #514's proposed single `plan-me` trigger label has not merged, so the original race-prone behavior #419/#420 set out to fix later is still live. + +**Qodo half — not real yet.** PR #515's title says "Qodo issues→PR review context" but ships only a PR-template section and an advisory placeholder workflow checking for an issue-reference string. **Qodo is not installed as a GitHub App** on this repo — no Qodo activity exists anywhere in PR/issue history. The issue-creation pipeline the user believes they "configured" for Qodo is **0% live today**, pure scaffolding pending an actual GitHub App install. + +**Undocumented third reviewer.** A `chatgpt-codex-connector` bot is actively (and silently, on quota exhaustion — it self-reported hitting its usage limit on PR #422) reviewing PRs alongside CodeRabbit and Greptile. It is mentioned nowhere in CLAUDE.md, `.coderabbit.yaml`, or `.greptile/` docs. + +**Conflicts in the pipeline:** +- Branch protection requires a single status-check context literally named `"all"`, produced independently by **both** `ci.yml` and `review-gate.yml` — works today but is fragile to a future rename of either workflow's aggregate job. +- `enforce_admins=true` with only one authenticated account (the repo owner/author) means **no PR can be merged without external review** — PR #366's own body explicitly states this ("the authenticated author cannot self-approve and repository auto-merge is disabled"). This blocks the entire #356→#357→#358→#366 stack and PR #421 regardless of conflict resolution, unless a second reviewer account is obtained or branch protection is temporarily adjusted (a repo-settings decision, flagged here rather than acted on). +- The 89-finding BaseballHelm bug audit (PR #424, closed) demonstrates the intended new pipeline already worked once end-to-end: 2 waves of parallel sub-agents produced findings, packaged via `issues.mjs`/`create-issues.mjs` (because the auditing agent had read-only `gh`), and all 89 were filed as real issues `#425`-`#513` in a single 90-second window (2026-06-30 22:22:33–22:23:56Z) — this is the direct origin of the bulk of the current 145-issue backlog. + +--- + +## 11. Risk Register (ranked critical → low) + +| # | Severity | Risk | Evidence | +|---|---|---|---| +| 1 | **Critical** | Hardcoded production Supabase **service_role JWT** + prod team/coach UUIDs live in tracked source (`scripts/seed-baseball-stats.mjs`, main HEAD, lines 3-6). No PR/branch addresses issue **#516** (filed after the inventory snapshot) at all; the related fix for #380 sits only on unmerged PR #421 (commit `62465409`). | Slice J, H; `git show main:scripts/seed-baseball-stats.mjs` | +| 2 | **Critical** | ~45 baseball tables (incl. `baseball_players`, `baseball_messages`, `baseball_documents`, `baseball_videos`, `baseball_watchlists`) retain a legacy `GRANT ALL TO anon`; 3 pair this with a no-role SELECT policy, safe today only because predicates fail closed on NULL `auth.uid()`. | Slice K; `20260527000000_prod_public_baseline.sql` vs. revoke-migration grep | +| 3 | **Critical** | Live, untested capability-gating bug in `src/components/layout/sidebar.tsx`: legacy fallback nav arrays show low-privilege coaches Management/Academics hub entries (incl. Staff/Program Settings) the registry path would hide, whenever `navContext` is loading or fails to resolve. Identical on main and PR #421 — shipping today. | Slice I; `sidebar.tsx:359-383,136-206` | +| 4 | **High** | Main's only red CI job, `Supabase lint + RLS tests`, fails on `baseball_event_acknowledgements` policy-count mismatch; the only fix is in unmerged draft PR #423. | Slice A | +| 5 | **High** | Migration-replay-breaking forward reference (#386): a fresh `supabase db reset` fails on `accepted_by_user_id` referenced before it's added. Two candidate fixes exist, neither on main. | Slice K | +| 6 | **High** | PR #423's own RLS hardening introduces a confirmed new gap: players can read `baseball_practice_attendance` for unpublished/draft practices (Greptile + CodeRabbit independently flagged). | Slice F, K | +| 7 | **High** | BaseballHelm coachhelm-insights + decision-room cluster (16 open issues, incl. #472 insight-dismiss auth-id mismatch, #510 `approveAiOutput` bypassing player-visible-AI policy) has **zero PR/branch coverage anywhere**; the only open CoachHelm-labeled PR (#334) is confirmed golf-scoped. | Slice H | +| 8 | **High** | `publishLiftDay` (BaseballHelm's only main-nav-reachable program-publish path) writes to legacy `baseball_lift_*` tables that are invisible to every player-facing lift surface and the standalone Lab portal — core coach→athlete loop silently broken for any team not also using `/lifting`. | Slice M | +| 9 | **Medium** | 11 baseball nav/dashboard-retirement commits landed directly on main with no PR and failing CI at push time — branch protection/process gap. | Slice A | +| 10 | **Medium** | Vercel auto-deploy is live/unscoped on main (PR #422 closed unmerged) — contradicts any assumption that deploy spend/noise was stopped. | Slice A, G | +| 11 | **Medium** | `decision-room/focus-imports.ts` queries `baseball_coach_notes` with 5 nonexistent columns, breaking the entire Decision Room page load — more severe than, and not the same tracked issue as, #507/#496. Currently **unfiled**. | Slice J | +| 12 | **Medium** | PR #421 merging as-is will not auto-close ~30+ already-fixed issues (only 17 of ~50 have "Closes #N" linkage) — issue tracker will silently diverge from reality post-merge. | Slice B, C | +| 13 | **Medium** | `enforce_admins=true` + single authenticated account means PR #421, the #356 stack, and any future PR are structurally unmergeable without a second reviewer or a branch-protection exception. | Slice E, G | +| 14 | **Low** | Dependabot majors #244 (tailwind v3→v4) and #245+#231 (eslint/@eslint-js) are confirmed-breaking if merged individually/naively. | Slice L | +| 15 | **Low** | `.cleanup/reports/*` (143k raw lines) in PR #356 will rot immediately and duplicates curated docs in the same PR. | Slice D | + +--- + +## 12. Recommended Sequenced Action Plan + +1. **Resolve the governance blocker first.** Obtain a second reviewer account or get explicit owner sign-off to temporarily adjust `enforce_admins`/required-review-count for the next few merges — nothing below can land otherwise (Risk #13). +2. **Rotate/remove the leaked service_role key** in `scripts/seed-baseball-stats.mjs` (Risk #1) independently of any PR timeline — this is live now regardless of merge sequencing. +3. **Rebase PR #421 onto main**, hand-resolve the 4 conflicting CI/governance files (favor #420's aggregate scheme), re-pin the new `baseball-smoke` workflow job's actions, fix the practice-attendance gap conceptually relevant to #423 if touched, expand the "Closes #N" list to the full ~50-issue set, force a real GitHub Actions run, then **merge**. This single PR resolves the most issues, lands the nav-manifest (#383), the stats-architecture contract test (#381), and the secret-scoped seed tooling (#380/#516's sibling fix). +4. **Immediately follow with a small commit fixing `sidebar.tsx`'s legacy fallback arrays** (Risk #3) — landing the nav-manifest alone (step 3) does not fix this; it needs explicit deletion of `collegeTeamNav`/`hsCoachTeamNav`/`jucoTeamNav`/`showcaseOrgNav`/`playerTeamNav` and a fail-closed loading state, per issue #383's own (unmet) acceptance criterion. +5. **Merge PR #423** after fixing its practice-attendance published-status gap (Risk #6), reconciling against `pr-420`'s competing version of the same migration filename, and resolving the unrelated lint-ratchet blocker (#387) so its `build` job goes green. This fixes Risk #4 (main's red RLS CI job) and the #386 forward-reference (Risk #5, via whichever fix — `9d068047` or `0a931429` — is folded in). +6. **Delete `pr-420`** locally once #423 is merged (fully redundant, Risk confirmed by Slice C); cherry-pick `vitest.business.config.ts` first if the business-test lane is still wanted. +7. **Land the #420-vs-#356 reconciliation for the test-hardening stack**: consolidate #366→#358→#357→#356 into one branch (all three intermediate bases are unprotected today, zero-review-friction), resync with main once, resolve the conflict set, fix the 3 real Greptile findings (DB-audit credential fallback, destructive doc-delete, stale route fixtures), re-run full CI, then open one fresh PR to main. Drop the 143k-line `.cleanup/reports/*` dump from this PR (Risk #15). +8. **Quick-fix and merge #514 and #515** (small, well-identified fixes — `unlabeled` trigger event; `contents: read` permission) to complete the review-automation rebuild started by #419/#420. +9. **File new issues** for: the `focus-imports.ts` wrong-column Decision Room bug (Risk #11, more severe than #507/#496); the undocumented `chatgpt-codex-connector` bot (decide keep/disable); the 45-table anon-grant sweep (Risk #2) as a dedicated migration PR following the existing `anon_revoke_wave1/2` pattern, prioritizing PII/recruiting tables first. +10. **Open dedicated remediation work for the 16-issue BaseballHelm coachhelm-insights/decision-room cluster** (Risk #7) — currently zero coverage; do not assume #334 (golf-scoped) addresses any of it. +11. **Open dedicated remediation for the Lift Lab schema split** (Risk #8): rewrite `publishLiftDay` to target `helm_lifting_*` instead of legacy `baseball_lift_*`, retire or merge the duplicate Program Editor component, add a uniqueness constraint to fix #492's duplicate-session bug, and fix #491's empty-selection whole-team-assignment bug. +12. **Merge the 12 safe dependabot PRs** (§7) now that main's baseline CI failures are understood to be pre-existing/unrelated; combine #245+#231 (eslint) into one PR and dedicate separate migration PRs for #244 (tailwind v4) and #309+#235 (vite 8); close #204 once #348 lands; rebase #184/#183/#308. +13. **Triage and close-or-rebase the 4 stale legacy PRs** (#262, #243, #333, #334) — confirm #334's golf scope doesn't depend on reverted Fairway code; the other three likely need a from-scratch rebase against current main given they predate the entire CI/baseball rebuild. +14. **Re-decide and document** the Vercel auto-deploy posture explicitly (Risk #10) — current state (always-on, unscoped) was a deliberate reversal of #422's intent; confirm this is still wanted now that #420's CI gates exist as a substitute safety net. + +--- + +*Sources: 13 parallel slice audits (A–M) of `/Users/ricknini/Downloads/helmv3`, cross-referenced against `/private/tmp/claude-501/.../scratchpad/helmv3_inventory.md` (captured 2026-06-30). All PR/issue/commit/branch references were independently verified by at least one slice via `gh`, `git log`/`git diff`/`git merge-tree`/`git merge-base`, or direct file reads at audit time.* diff --git a/docs/baseball/design-system-living-annual.md b/docs/baseball/design-system-living-annual.md new file mode 100644 index 000000000..d955ef956 --- /dev/null +++ b/docs/baseball/design-system-living-annual.md @@ -0,0 +1,335 @@ + + +> ## ADDENDUM (founder direction, 2026-07-01): CONTRAST + MORE GREEN +> The Fairway system's weak spot was **low contrast — especially in stats** (warm-gray +> numerals on warm cream washed out) and **not enough green**. These rules OVERRIDE any +> softer default and apply to the whole kit: +> 1. **Stat numerals = maximum contrast, never warm-gray-on-cream.** Every `StatReadout` / +> `RuledStatLine` value renders in near-black `--graphite` on paper (target ≥7:1), OR in +> `--team-ink` green for an emphasis/leader value. Labels stay quiet (`graphite/60` +> small-caps); the **number carries the contrast**. +> 2. **Green does real emphasis + wayfinding work** (more assertively than Fairway did). In +> team lanes (Pressbox/Passport) the `RuledStatLine` **baseline rule is green** (`--team-ink`), +> not hairline-gray — it adds green presence and separates rows crisply. Clay rule in the +> War Room lane only. +> 3. **Leaders/bests get green.** In Stats Center / roster / KPI strips, the team-leading value +> in a column gets a green treatment (green numeral or green underline + a small `LEADS`/HOT +> tick) so the eye lands on green. +> 4. **Active/selected/focus states = green** (active tab, selected row, focus ring, section- +> masthead accent rule) — more visible green than Fairway's subtle accents. +> 5. Clay stays strictly recruiting; green is used everywhere team/dev and used **boldly for +> contrast**, not as a faint tint. No gray card-soup — contrast comes from green rules + +> high-contrast numerals + whitespace. +> +> ## ADDENDUM 2 (founder direction, 2026-07-01): FONT + CREAM +> These OVERRIDE §4.1's Fraunces/mono type roles for BaseballHelm: +> - **Type = Space Grotesk** for player names / hero numerals / section titles AND stat figures +> (`--font-space-grotesk` → Tailwind `font-annual`, always `tabular-nums` on numbers). ONE +> athletic grotesk for display + numbers. **Fraunces (serif) and Fragment Mono are dropped +> from the baseball kit.** Chrome/body labels stay on the existing sans (Geist/DM Sans). +> - **Less white, more cream.** Surfaces are warm cream, NOT white cards. Palette: canvas +> deep warm cream (~`#EDE5D3`), card/surface a lighter cream (~`#F5EEDD` — still clearly +> cream, never `#FFF`/near-white), hairline warm (~`#DED3BC`). `--paper` is redefined to the +> cream, and baseball surfaces override the Fairway white `--fw-color-surface` with cream +> **inside a baseball scope only** (golf untouched). Green rules + graphite numerals read +> even better on the deeper cream. + +# BaseballHelm Design Spec — "The Living Annual" +*Design director's decision + build-ready architecture. This document is the north star for all BaseballHelm redesign waves.* + +--- + +## 1. Scoring the four pitches + +| Direction | Wow | Baseball-native | Clarity/Usability | Implementability (cream+green+Tailwind) | Notes | +|---|---|---|---|---|---| +| **1. Editorial sports-annual** | 8 | 8 | **9** | **9** | Cream-native, clarity-first, "ruled stat line" + two-ink lanes are genuine connective tissue. Lowest-risk, highest-coherence. | +| **2. Broadcast telemetry** | **9** | 8 | 7 | 6 | "Readout settle" and LIVE presence are gold, but the required Booth Black dark shell fights the Helm cream brand and risks a gamer-dashboard feel if over-applied. | +| **3. Scouting dossier** | 8 | **9** | 8 | 7 | The 20-80 Grade Stamp is the single most baseball-fluent object anyone pitched. Letterpress paper physics are very buildable. Risks skeuomorphic kitsch if taken literally everywhere. | +| **4. Kinetic performance lab** | **9** | **9** | 7 | 6 | "The Trace" is the only pitch that solves baseball-native *data-viz* (break/spray/climb). Needs a dark canvas though, and pure-viz can starve the CRM/ops surfaces of structure. | + +**Verdict:** No single pitch wins outright, but Direction 1 is the only one that is simultaneously top-tier on clarity *and* implementability while staying inside the Helm cream+green system — and its "ruled stat line" and two-ink lane model are the strongest *system* (they scale across every surface, not just the hero moments). It becomes the **spine**. It is missing exactly two things — a baseball-fluent *evaluation object* and baseball-native *data-viz* — which Directions 3 and 4 supply perfectly. Direction 2 contributes motion physics and "aliveness," used with restraint. + +--- + +## 2. The decision: **"The Living Annual"** + +**PRIMARY = Editorial sports-annual (1)**, grafted with: +- **The 20-80 Grade Stamp + tool rail + Compare overlay + Commit seal** (from 3) → becomes the evaluation atom of the recruiting lane. +- **"The Trace" viz primitive + chalk-on-clay canvas** (from 4) → becomes the *only* dark surface in the product, reserved exclusively for baseball motion data (pitch break, spray, season climb). +- **"The Readout" settle motion + Number Flow + LIVE presence** (from 2) → becomes how every number *behaves*, and how genuinely-live states are marked — without adopting the Booth Black shell. + +We reject: the all-dark broadcast shell, literal manila-folder skeuomorphism, and any "pick one metaphor and force it everywhere." We keep three metaphors mapped to the three real jobs, unified by **one grid, one ruled-line motif, and two inks.** + +--- + +## 3. Design read + +BaseballHelm is the **glossy college-baseball season annual crossed with a front-office scouting file — live, and theirs.** Every number is set in ink and treated with reverence. The coach edits the magazine (team ops) and reads the field files (recruiting); the recruit writes their own cover story (development). Three jobs, three "sections" of one publication, bound by a ruled record-book spine and told in two inks: **green = team & development, clay = recruiting & pursuit.** Where baseball motion becomes data — a pitch breaking, a ball sprayed, a season climbing — the page cuts to a lit **chalk-on-clay** instrument panel, the one dark surface, like a chart dropped into a magazine spread. It never looks like a gray CRM; even an empty roster looks like an unreleased first issue. + +--- + +## 4. Language: type, color, surface, motion + +### 4.1 Type — three voices, used with intent +Reuse Helm's existing font stack; add one editorial serif if not already loaded. + +| Voice | Font | Role | Tailwind | +|---|---|---|---| +| **Byline (serif)** | Newsreader / GT Sectra / Canela-class | Player & program names, section splashes, **hero numerals only**. Never UI chrome. | `font-serif` (add `--font-serif` to `tailwind.config`) | +| **Chrome (grotesk)** | Existing Helm sans (Inter/Geist) | All labels, nav, body, tables. | `font-sans` (default) | +| **Ledger (mono)** | Geist Mono / JetBrains Mono | Every *measurable* and grade numeral in tables/stamps — `tabular-nums`, locked figures so digits never jitter. | `font-mono tabular-nums` | + +Signature moves: +- **Player name = editorial masthead**: given name in serif regular, `SURNAME` in serif medium small-caps, two lines. +- **Eyebrow datelines**: `text-[11px] tracking-[0.14em] uppercase text-graphite/60` → `SS · 2B — CLASS OF ’26 — RALEIGH, NC`. +- **Hero numerals**: serif, 80–160px, `tabular-nums`, sitting *on* a hairline rule. + +```js +// tailwind.config — fontSize additions +'ink-hero': ['clamp(4rem, 9vw, 10rem)', { lineHeight: '0.9', letterSpacing: '-0.02em' }], +'ink': ['clamp(2.5rem, 5vw, 4.5rem)', { lineHeight: '0.95' }], +'eyebrow': ['0.6875rem', { lineHeight: '1', letterSpacing: '0.14em' }], +``` + +### 4.2 Color — two inks + one reserved dark canvas +Stay in the Helm system. Introduce exactly one editorial accent and one viz surface. + +```css +:root { + /* Helm base (unchanged) */ + --paper: #FFFEFA; /* cream canvas */ + --graphite: #1C1A17; /* primary text */ + --hairline: #E7E3D8; /* THE border — does the work of most cards */ + + /* Two inks */ + --team-ink: #16A34A; /* green — team & development */ + --team-ink-2: #22C55E; /* green highlight */ + --pursuit-ink: #C2703D; /* infield-clay terracotta — recruiting & urgency */ + --pursuit-deep: #7A2E22; /* oxblood — seals & stamps only */ + + /* Grade ramp (20–80 scale) */ + --grade-low: #B4573F; /* 20–40 muted clay-red */ + --grade-avg: #6B655B; /* 45–55 ink-neutral */ + --grade-plus: #16A34A; /* 60–80 team green */ + + /* Reserved viz canvas — the ONE dark surface */ + --clay: #17130F; /* warm dirt-black, never blue-black */ + --chalk: #F4EFE6; /* chalk hairlines/grid on clay */ + --sodium: #F5A623; /* PR / live / in-progress accent — sparingly */ +} +``` + +**Rules that must hold:** +1. **Green = team + development. Clay = recruiting + pursuit.** The active lane's ink *is* the wayfinding. Never mix inks within a lane's chrome. +2. **Clay/oxblood only on stamps, seals, deadlines, offers, hot signals** — never as generic chrome or a red error badge. Urgency is a color, not a toast. +3. **`--clay` dark canvas appears ONLY inside a viz frame** (pitch break, spray, climb). It never becomes a page background, never a sidebar, never a card. Cutting to it should feel like cutting to the analytics desk. +4. **`--sodium` amber fires once** on a PR / commit / live-value-crossed-threshold, then rests. It is not a fourth chrome color. +5. No gray card-soup. Structure comes from **hairline rules + whitespace**, not filled gray boxes. + +### 4.3 Surface — three families +| Family | Use | Treatment | +|---|---|---| +| **Paper** | Editorial reading: passport, roster spread, postgame, command center. | Flat `--paper`, hairline rules, generous margins, `2–3%` newsprint grain overlay, die-cut registration-corner tick on hero cards. | +| **Glass** | Live/interactive tooling: pipeline board, filters, live game, drag surfaces. | GolfHelm-grade frosted panel (`backdrop-blur`, soft inner light) — keep parity with GolfHelm's glass tokens. | +| **Clay canvas** | Baseball motion viz only. | `--clay` with `--chalk` graticule, faint scan-line vignette, Traces drawn on it. | + +Depth is **letterpress, not drop-shadow**: `shadow-[inset_0_1px_0_rgba(255,255,255,0.6),inset_0_-1px_0_rgba(0,0,0,0.06)]` + hairline border. Reserve real elevation shadow for actively-dragged objects only. + +### 4.4 Motion — "print coming to life," alive but never bouncy +Six principles (superset of all four pitches, deduped): + +1. **INK SETTLES** — serif hero numerals/names arrive `opacity 0→1 + translateY 2px + blur 2px→0`, `400ms ease-out`, staggered down a ruled column so a stat line "sets" top-to-bottom. +2. **RULES DRAW** — every hairline baseline rule animates `scaleX 0→1` from left, `200ms ease-out`, on mount. This is the signature transition that ties all pages together. +3. **ODOMETER TRUTH** — any *changing* number (pipeline counts, completeness %, live velo, score) rolls mechanically via Number Flow / tabular odometer, ~450ms, single-digit overshoot-and-lock. Numbers are sacred; they move like a radar gun, not a spring. +4. **TRACES DRAW** — all viz strokes render via `stroke-dashoffset` animation (grid → axes → data strokes → labels, staggered ~40ms), like a pen moving. Weight + glow encode quality. +5. **STAMP PRESS** — grade reveals, commit seals, completeness snaps: fast down (~120ms) → slow settle w/ hair of overshoot (~260ms) + 6–10% ink-bleed. "Pressed, not popped." +6. **PAGE-TURN NAV** — lane switches and passport→packet cross-dissolve with a subtle depth/lift (the paper turn), not a slide. + +**Budget:** one signature move per view, GolfHelm's slow-glass restraint. **LIVE presence:** a small breathing dot (2s pulse) marks anything genuinely receiving data — used sparingly (live game, incoming sync), not decoration. **`prefers-reduced-motion`:** rules render drawn, numbers set instantly, traces render fully-drawn static, PRs show without pulse. + +--- + +## 5. Information architecture — three lanes, ink-as-wayfinding + +Kill the flat 14-item settings-menu sidebar. Replace with a **three-lane masthead model**. A slim left rail carries only a **lane switcher** (three tabs, each its own ink) + the current lane's 3–5 sections. The top is a magazine **masthead bar**: team wordmark left · season/issue dateline center · global ⌘K search right. + +### Lane 1 — THE PRESSBOX · green ink · coach team-ops +`Command Center (the cover) · Roster · Stats · Practice · Postgame · Calendar/Travel` + +### Lane 2 — THE WAR ROOM · clay ink · coach recruiting +`Pipeline (board) · Discover · Watchlist · Scout Packets · Decision Room · Signals` + +### Lane 3 — THE PASSPORT · green ink · player development +`Today · My Passport · Development · Stats · Recruiting (Go-Live gate)` + +**Coach types remap to lanes, never to new nav:** +- **College** → War Room + Pressbox. +- **HS** → Pressbox only. +- **JUCO** → a masthead toggle that flips accent ink green↔clay (both lanes). +- **Showcase** → Pressbox with a multi-team "issue selector" in the dateline. + +The **ink color is the wayfinding** — you always know which magazine you're reading. Player recruiting activation stays a deliberate, ceremonial **"GO LIVE"** gate on the passport (opt-in / anonymous-then-identified model preserved). + +--- + +## 6. Signature surfaces to redesign first (prioritized) + +> Priority = (impact on "wow" + how broken it is today + reuse leverage). Build the shared kit (§7) in parallel with #1–#3. + +### P0 — 1. The Player Passport Spread *(player-dev hero; replaces today's form-list)* +Full editorial cover spread. **Left third:** portrait column, name as serif masthead (`Marcus / RODRIGUEZ`), small-caps dateline, die-cut registration tick. **Right two-thirds:** the **Ruled Stat Line stack** — `60-YARD 6.71 / EXIT VELO 94 / POP TIME 1.94`, each a 120px serif ink numeral on a hairline rule; **verified** fields wear a green `ON THE RECORD` check, **unverified** ghost at 40% waiting to be filled. Grafted from Dir 3: measurables also expressible as a **20-80 tool rail** (`GradeStamp` row) for scouted players. Below the fold: a single-column **Development Story** — dated pull-quotes from coach notes + PR milestones, set like a magazine feature, not a checkbox list. Scroll-linked masthead shrinks the serif name into a sticky byline. **Build:** 12-col CSS grid, `tabular-nums`, Number Flow, framer-motion scroll. +*"Profile completeness 38%" dies here → the card literally fills in; ghosted Traces/rules mark what's missing.* + +### P0 — 2. The War Room Pipeline Board *(recruiting; today it's a redirect stub)* +Five record-book ledger columns: `WATCHLIST → HIGH PRIORITY → OFFER EXTENDED → COMMITTED` (`UNINTERESTED` filed in a drawer, never deleted). Each column = paper column with a **clay spine rule** + live count in oversized serif. Recruit cards are **mini box-score chips**: serif surname, one ruled stat line, top-3 `GradeStamp`s, and a **clay "days-since-contact" aging bar** that darkens like a deadline. Drag a card → destination count flips on an **odometer roll**; drop into `OFFER EXTENDED` → clay wash + embossed `OFFER` stamp; drop into `COMMITTED` → **oxblood `COMMITTED` seal presses down** (stamp-press ease + ink-bleed) and Signals tickers the commit. **Build:** glass board over paper columns, dnd-kit, FLIP/shared-layout so the card morphs board-spine ↔ open-dossier, optimistic odometer counts. + +### P0 — 3. The Command Center Cover *(coach team-ops; replaces four zero-cards + broken pulse boxes)* +The dashboard *is* a magazine cover. **One dominant hero:** this week's opponent as a serif cover line `vs COASTAL STATE — SUN 4:30` with the record ruled beneath. A masthead **contents strip:** three big serif KPI numerals on ruled lines (`ROSTER 14 · ON THE RECORD 0 · OPEN RISKS 0`) reading as a table of contents. CoachHelm's daily brief becomes a **signed editor's letter** ("From the desk of CoachHelm") in serif with a green rule — so **empty/error states look composed, not like yellow warning boxes.** Grafted from Dir 2: KPI Readouts settle on load and flash their rule green when a background sync lands a value; day-one emptiness reads as `STANDING BY — awaiting first pitch`, not broken zeros. + +### P1 — 4. The Break Room *(pitch-movement + spray viz; the baseball-native thing golf can't do)* +The **one chalk-on-clay** moment. **Pitchers:** a Statcast-style break plot on a home-plate axis — each pitch type a cluster of **Traces** breaking release→plate; velo drives glow intensity; select two dates and the older shape ghosts behind so *added break* is visible as distance between strokes. Command grade as a corner `GradeStamp`. **Hitters:** same canvas flips to a **spray chart** — batted balls arrive as Traces landing with a soft impact bloom, colored by outcome, filterable by count/pitch/opponent; drag the season scrubber and the chart animates the season into being. Captions in mono, colorway green (in-zone/strength) → clay (chase/weakness). **Build:** SVG/Canvas over dark glass, `stroke-dashoffset` draw-on + rAF trail decay, ruled-stat-line tooltips, reduced-motion → static drawn chart. + +### P1 — 5. The Stats Center / Radar-Gun Stat Wall +The wall of identical empty cards becomes a **record-book roster spread**: each player row anchored by a serif name plate + settling velo/AVG **Readout** in mono, positions as small-caps chips, a `HOT` sodium tick on a season best. Batting/Pitching/Both switch = a page-turn with the category label swapping like a broadcast graphic. Every figure via Number Flow so a dead page now recalculates in real time. **Build:** reuse `RuledStatLine` + `StatReadout` + `PositionChip`. + +### P1 — 6. The Roster Spread *(Pressbox)* +Two-per-row editorial spread of ruled stat lines instead of avatar chips — same dossier stock as recruits but **stamps flip projection→production** (this-season lines + readiness flags). A returning player and a recruit are visibly the same species in different tenses. + +### P2 — 7. The Player "Today" *(assignment framing)* +Framed as "today's assignment" — the daily contract set as a **signed commitment** with a green rule, so the player feels *authored*, not tracked. Dev-plan goals appear as target ticks on their Climb arc. + +### P2 — 8. The Development "Climb" *(replaces "No development plan yet")* +Each tracked skill (exit velo, K-rate, whiff%, SG-style composite) is a **Trace filling an arc** across the season, faint "then" ghost at start, bright "now" head, single best day pinned in **sodium** as a PR marker that pulses once. Coach-assigned goals sit as target ticks — `assigned → progressing → hit` is one continuous visual. + +### P2 — 9. The Scout Packet Tear-Sheet *(the exportable artifact)* +When a coach mints a packet or a player sets exposure to `Scout`, the passport reflows into a **print-perfect one-page tear-sheet** — masthead name, ruled measurables, spray/break infographic, one verified video still, footer dateline `ISSUED BY RINI UNIVERSITY BASEBALL · JUL ’26`. It animates like a page being pulled (paper-lift + crop-mark + wax-style Helm **seal** press) and exports to the *same* PDF layout — screen and artifact are one object. Exposure ribbon (`Staff · Player · Public · Scout`) sets who can break the seal; player-side, "Profile Completeness" becomes **"File Readiness: ready to send to scouts."** + +### P3 — 10. Decision Room / Compare Overlay +Two players' 20-80 tool rails stacked on the same rule — green pulls right, clay pulls left — so a coach *sees* the louder tool before reading a digit; a mono sparkline of measurable trend under each tool. Agenda items are pulled dossiers with open questions. + +--- + +## 7. Reusable component / pattern kit (the consistency engine) + +Build these first; every surface above composes from them. Names are prescriptive. + +| Component | Purpose | Key props / behavior | +|---|---|---| +| **``** | THE signature atom. Label (small-caps, hung left) + serif numeral sitting *on* a hairline baseline rule. | `label, value, unit, size='hero'|'row', verified?, ink='team'|'pursuit'`. Rule draws on mount; value uses ``. Stacks fractally for slash lines `.341 / .420 / .611` and as column spines. | +| **``** | Any number that can change. | mono `tabular-nums`, Number Flow odometer, `flashOnChange` → green rule pulse, `pr?` → sodium once. | +| **``** | 20-80 evaluation atom (recruiting). | Debossed rounded-square token, mono numeral, ring label (tool name), ramp color by value, ±1.5° rotation, `present` solid + `future` ghost outline, stamp-press animation. | +| **``** | 20-80 horizontal scale viz. | ticks 20–80, 50 marked `MLB AVG`, filled pip (present) + hollow pip (future) + ink connector; compare mode stacks a second athlete. | +| **``** | Two-line editorial name block. | `given` (serif regular) + `SURNAME` (serif small-caps caps), optional dateline eyebrow, registration tick, scroll-shrink-to-byline. | +| **``** | Small-caps dateline label. | `POSITION · CLASS · STATE` grammar, `tracking-[0.14em]`. | +| **`` / `` / ``** | The three surface families. | Paper = grain + hairline + registration tick; Glass = GolfHelm frosted; Clay = dark viz frame w/ chalk graticule. Enforced so nothing else invents a surface. | +| **``** | Viz stroke primitive. | Renders swing plane / pitch break / spray flight / climb arc / sprint line as one stroke language; weight + glow encode quality; `stroke-dashoffset` draw-on; reduced-motion → static. | +| **``** | The masthead + lane-switcher + ink context. | Provides `--active-ink` via context; sets green/clay for all children; handles coach-type→lane mapping + JUCO toggle. | +| **``** (empty/brief state) | Composed empty & error states. | Serif letter voice + green/clay rule + optional `STANDING BY` live dot. **No yellow warning boxes anywhere.** | +| **`` / ``** | Ceremony moments. | Oxblood emboss, stamp-press ease, ink-bleed, optional haptic-style pulse. | +| **``** | Interaction layer — generic entrance wrapper (§7.1). | Wraps any child in the `inkSettles` fade/rise/unblur; `staggerIndex` cascades siblings. Mount-based, not `whileInView` — see §7.1. | +| **``** | Interaction layer — hover-reveal with touch fallback (§7.1). | Content always renders; `reveal` slot fades in on hover/focus, forced always-visible on `pointer: coarse`. | +| **`pressableClass()`** | Interaction layer — press + hover physics as classes (§7.1). | `active:scale-[0.98]` + lane-ink hover tint + focus ring; CSS-only, server-safe. Not for ` - -

- You'll get instant, read-only access to a live demo - program. No password, no setup — and nothing you do affects - other visitors. -

- - )} - - - {/* Footer */} - -

- Already have an account?{' '} - + {serverError} + + )} + + { setName(e.target.value); setServerError(null); }} + onBlur={() => setTouched((t) => ({ ...t, name: true }))} + placeholder="Coach Alex Rivera" + required + autoComplete="name" + autoCapitalize="words" + enterKeyHint="next" + error={nameError} + /> + + { setEmail(e.target.value); setServerError(null); }} + onBlur={() => setTouched((t) => ({ ...t, email: true }))} + placeholder="coach@university.edu" + required + autoComplete="email" + enterKeyHint="next" + error={emailError} + /> + + { setProgram(e.target.value); setServerError(null); }} + onBlur={() => setTouched((t) => ({ ...t, program: true }))} + placeholder="State University Baseball" + required + autoCapitalize="words" + enterKeyHint="go" + error={programError} + /> + + + +

+ You'll get instant, read-only access to a live demo + program. No password, no setup — and nothing you do affects + other visitors. +

+ + )} + + )} + ); } @@ -418,12 +332,8 @@ export default function BaseballDemoGatePage() { return ( - - - - - +
+
} > diff --git a/src/app/baseball/(auth)/forgot-password/page.tsx b/src/app/baseball/(auth)/forgot-password/page.tsx index f030eaff5..01bbebae6 100644 --- a/src/app/baseball/(auth)/forgot-password/page.tsx +++ b/src/app/baseball/(auth)/forgot-password/page.tsx @@ -2,14 +2,29 @@ import { useState, useRef } from 'react'; import Link from 'next/link'; -import { motion, useReducedMotion } from 'framer-motion'; import { createClient } from '@/lib/supabase/client'; import { AlertCircle, CheckCircle2, Mail } from 'lucide-react'; -import Image from 'next/image'; import { Button } from '@/components/ui/button'; +import { Input } from '@/components/ui/input'; +import { + AuthCard, + AuthFooterLinks, + BaseballAuthShell, + humanizeAuthError, +} from '@/components/auth/baseball-auth-shell'; + +function humanizeResetRequestError(message: string): string { + const lower = message.toLowerCase(); + if (lower.includes('rate limit') || /only request this (again|once)/.test(lower)) { + return 'You already requested a reset link recently. Please wait a moment before trying again.'; + } + if (lower.includes('invalid email')) { + return 'Please enter a valid email address.'; + } + return humanizeAuthError(message); +} export default function ForgotPasswordPage() { - const prefersReducedMotion = useReducedMotion(); const [email, setEmail] = useState(''); const [error, setError] = useState(''); const [success, setSuccess] = useState(false); @@ -29,7 +44,7 @@ export default function ForgotPasswordPage() { }); if (resetError) { - setError(resetError.message); + setError(humanizeResetRequestError(resetError.message)); setLoading(false); return; } @@ -43,270 +58,95 @@ export default function ForgotPasswordPage() { }; return ( -
- {/* Skip to main content link for keyboard navigation */} - - Skip to form - - - {/* Animated floating orbs */} -
- {/* Large primary orb - top right */} - - {/* Medium orb - bottom left */} - - {/* Small accent orb - top left */} - - {/* Tiny floating dot */} - -
- - {/* Grid pattern overlay */} -
+ } + > + +
+

+ {success ? 'Check your email' : 'Reset your password'} +

+ {success && ( +

We've sent a reset link to {email}

+ )} +
- {/* Glass card */} -
- - {/* Logo with glow effect */} - -
-
-
- BaseballHelm Logo + {success ? ( +
+
+
+
-

- BaseballHelm -

- - - {/* Header */} - -

- {success ? 'Check your email' : 'Reset your password'} -

-

- {success - ? `We've sent a reset link to ${email}` - : 'Enter your email to receive a reset link'} -

- - - {/* Content */} - - {success ? ( -
- {/* Success illustration */} -
-
- -
-
-
-
- -
-

Click the link in the email to reset your password.

-

The link will expire in 1 hour.

-
-
+
+
+ +
+

Click the link in the email to reset your password.

+

The link will expire in 1 hour.

-

- Did not receive the email? Check your spam folder or try again with a different email address. -

- - -
- ) : ( -
- {error && ( -
- - {error} -
- )} - -
- - setEmail(e.target.value)} - placeholder="you@example.com" - required - // eslint-disable-next-line jsx-a11y/no-autofocus -- intentional: primary input on a single-field auth page - autoFocus - autoComplete="email" - className=" - w-full px-4 py-2.5 sm:py-3 - bg-white - border border-warm-200 - rounded-xl - text-warm-900 text-base lg:text-sm - placeholder:text-warm-400 - transition-all duration-200 - focus:outline-none focus:border-primary-600 focus:ring-[3px] focus:ring-primary-600/10 - " - /> -
- - -
- )} - - - - {/* Footer links */} - - {!success && ( -

- Remember your password?{' '} - - Sign in - +

+

+ Did not receive the email? Check your spam folder or try again with a different email address.

- )} - -

- - ← Back to HelmLabs + + -

- -
-
+
+ ) : ( +
+ {error && ( +
+ + {error} +
+ )} + + setEmail(e.target.value)} + placeholder="you@example.com" + required + // eslint-disable-next-line jsx-a11y/no-autofocus -- intentional: primary input on a single-field auth page + autoFocus + /> + + +
+ )} + + ); } diff --git a/src/app/baseball/(auth)/login/loading.tsx b/src/app/baseball/(auth)/login/loading.tsx index 6c20f15e3..2400508ee 100644 --- a/src/app/baseball/(auth)/login/loading.tsx +++ b/src/app/baseball/(auth)/login/loading.tsx @@ -1,6 +1,6 @@ export default function Loading() { return ( -
+
diff --git a/src/app/baseball/(auth)/login/page.tsx b/src/app/baseball/(auth)/login/page.tsx index 87b3f5de0..5321c2128 100644 --- a/src/app/baseball/(auth)/login/page.tsx +++ b/src/app/baseball/(auth)/login/page.tsx @@ -1,31 +1,115 @@ 'use client'; import { Suspense, useEffect, useRef, useState } from 'react'; -import Link from 'next/link'; -import Image from 'next/image'; import { useSearchParams, useRouter } from 'next/navigation'; -import { motion, useReducedMotion } from 'framer-motion'; import { BaseballSignInForm } from '@/components/auth/baseball-sign-in-form'; import { createClient } from '@/lib/supabase/client'; import { isNativeApp } from '@/lib/utils/capacitor'; import { Button } from '@/components/ui/button'; - -function LoginContent() { - const prefersReducedMotion = useReducedMotion(); +import { setRememberedFirstName } from '@/lib/entry/greeting'; +import { + AuthCard, + AuthFooterLinks, + AuthPendingDots, + BaseballAuthShell, +} from '@/components/auth/baseball-auth-shell'; + +// Force dynamic rendering +export const dynamic = 'force-dynamic'; + +// Use predefined message codes to prevent content injection via query params +const LOGIN_MESSAGES: Record = { + session_expired: 'Session expired. Please sign in again.', + password_reset: 'Password reset successfully. Please sign in with your new password.', + account_created: 'Account created successfully. Please sign in.', + signed_out: 'You have been signed out.', +}; + +// Reads the `message` query param to show a one-line status banner above +// the sign-in form. Scoped to its own Suspense (mirrors signup/page.tsx's +// SignupFooter pattern) so the shell — scene, welcome copy, form chrome — +// still renders eagerly instead of sitting behind one page-level fallback. +function LoginStatusBanner() { const searchParams = useSearchParams(); - const router = useRouter(); - // Use predefined message codes to prevent content injection via query params - const LOGIN_MESSAGES: Record = { - session_expired: 'Session expired. Please sign in again.', - password_reset: 'Password reset successfully. Please sign in with your new password.', - account_created: 'Account created successfully. Please sign in.', - signed_out: 'You have been signed out.', - }; const messageKey = searchParams.get('message'); const successMessage = messageKey ? LOGIN_MESSAGES[messageKey] ?? null : null; + + if (!successMessage) return null; + + return ( +
+ {successMessage} +
+ ); +} + +// Reads `returnTo` from the URL to preserve it through the sign-up switch +// link. Same pattern/purpose as signup/page.tsx's SignupFooter. +function LoginFooter({ + isLoggedIn, + checkingAuth, + isNative, +}: { + isLoggedIn: boolean; + checkingAuth: boolean; + isNative: boolean; +}) { + const searchParams = useSearchParams(); const returnTo = searchParams.get('returnTo'); const signupHref = returnTo ? `/baseball/signup?returnTo=${encodeURIComponent(returnTo)}` : '/baseball/signup'; + return ( + + ); +} + +// Reads `returnTo` for the "already signed in" continue target/label. +function LoggedInActions({ + isLoggingOut, + onSignOut, +}: { + isLoggingOut: boolean; + onSignOut: () => void; +}) { + const searchParams = useSearchParams(); + const returnTo = searchParams.get('returnTo'); + const router = useRouter(); + + return ( +
+
+ You're already signed in +
+ + +
+ ); +} + +export default function LoginPage() { + const router = useRouter(); + const [isLoggedIn, setIsLoggedIn] = useState(false); const [checkingAuth, setCheckingAuth] = useState(true); const [isLoggingOut, setIsLoggingOut] = useState(false); @@ -48,6 +132,22 @@ function LoginContent() { checkAuth(); }, [supabase]); + // Entry World personalization (docs/baseball/ENTRY_SCENES_DESIGN.md family + // rule #6): remember the first name on a fresh sign-in only — never on + // `INITIAL_SESSION` (an already-authed page load, not a login success) — + // so the next visit's greeting can read "Welcome back, {name}." Purely + // additive: doesn't touch loginAction, redirects, validation, or errors. + useEffect(() => { + const { data: { subscription } } = supabase.auth.onAuthStateChange((event, session) => { + if (event !== 'SIGNED_IN') return; + const firstName = session?.user?.user_metadata?.first_name; + if (typeof firstName === 'string' && firstName.trim()) { + setRememberedFirstName(firstName); + } + }); + return () => subscription.unsubscribe(); + }, [supabase]); + async function handleSignOut() { setIsLoggingOut(true); await supabase.auth.signOut(); @@ -57,246 +157,58 @@ function LoginContent() { } return ( -
- {/* Skip to main content link for keyboard navigation */} - - Skip to login form - - - {/* Animated floating orbs */} -
- {/* Large primary orb - top right */} - - {/* Medium orb - bottom left */} - - {/* Small accent orb - top left */} - - {/* Tiny floating dot */} - -
- - {/* Grid pattern overlay */} -
- - {/* Glass card */} -
- + } > - {/* Logo with glow effect */} - -
-
-
- BaseballHelm Logo -
-
-

- BaseballHelm -

- - - {/* Header */} - -

- Welcome back -

-

Sign in to continue to your dashboard

- - - {/* Success message */} - {successMessage && ( - - {successMessage} - - )} - - {/* Form or Already Logged In */} - - {checkingAuth ? ( -
- - - - - -
- ) : isLoggedIn ? ( -
-
- You're already signed in + + + } + > + + + + + + {checkingAuth ? ( +
+ +
+ ) : isLoggedIn ? ( + + + + ) : ( +
+ +
+
+
- - -
- ) : ( - - )} - - - - {/* Footer links with stagger animation */} - - {!isLoggedIn && !checkingAuth && !isNative && ( -

- Don't have an account?{' '} - - Sign up - -

- )} - - {!isNative && ( -

- - ← Back to HelmLabs - -

- )} - -
- - Privacy - - - - Terms - + +
- -
-
- ); -} - -export default function LoginPage() { - return ( - - - - - - -
- } - > - - + )} + + ); } diff --git a/src/app/baseball/(auth)/reset-password/page.tsx b/src/app/baseball/(auth)/reset-password/page.tsx index e9e7898f2..2a74680ba 100644 --- a/src/app/baseball/(auth)/reset-password/page.tsx +++ b/src/app/baseball/(auth)/reset-password/page.tsx @@ -3,15 +3,20 @@ import { useState, useEffect, useRef } from 'react'; import { useRouter } from 'next/navigation'; import Link from 'next/link'; -import { motion, useReducedMotion } from 'framer-motion'; import { createClient } from '@/lib/supabase/client'; -import { AlertCircle, ShieldCheck } from 'lucide-react'; +import { AlertCircle } from 'lucide-react'; import { PasswordStrengthIndicator } from '@/components/auth/password-strength-indicator'; -import Image from 'next/image'; import { Button } from '@/components/ui/button'; +import { Input } from '@/components/ui/input'; +import { + AuthCard, + AuthFooterLinks, + AuthPendingDots, + BaseballAuthShell, + humanizeAuthError, +} from '@/components/auth/baseball-auth-shell'; export default function ResetPasswordPage() { - const prefersReducedMotion = useReducedMotion(); const [password, setPassword] = useState(''); const [confirmPassword, setConfirmPassword] = useState(''); const [error, setError] = useState(''); @@ -71,7 +76,7 @@ export default function ResetPasswordPage() { }); if (updateError) { - setError(updateError.message); + setError(humanizeAuthError(updateError.message)); setLoading(false); return; } @@ -86,289 +91,117 @@ export default function ResetPasswordPage() { }; return ( -
- {/* Animated floating orbs */} -
- {/* Large primary orb - top right */} - - {/* Medium orb - bottom left */} - - {/* Small accent orb - top left */} - - {/* Tiny floating dot */} - -
- - {/* Grid pattern overlay */} -
- - {/* Glass card */} -
- - {/* Logo with glow effect */} - -
-
-
- BaseballHelm Logo -
+ } + > + +
+

+ Set new password +

+
+ + {sessionValid === null ? ( + // Loading state while checking session +
+
+
+
+
+
-

- BaseballHelm -

- - - {/* Header */} - -

- Set new password -

-

Enter your new password below

- - - {/* Content */} - - {sessionValid === null ? ( - // Loading state while checking session -
-
-
-
-
- ) : sessionValid === false ? ( - // Invalid session state -
-
- -
-

{error}

- - Request a new reset link - -
-
- - +
+ ) : sessionValid === false ? ( + // Invalid session state +
+
+ +
+

{error}

+ + Request a new reset link
- ) : ( - // Valid session - show form -
- {error && ( -
- - {error} -
- )} - -
- - setPassword(e.target.value)} - placeholder="Enter your new password" - required - // eslint-disable-next-line jsx-a11y/no-autofocus -- intentional: primary input on a single-field auth page - autoFocus - autoComplete="new-password" - className=" - w-full px-4 py-2.5 sm:py-3 - bg-white - border border-warm-200 - rounded-xl - text-warm-900 text-base lg:text-sm - placeholder:text-warm-400 - transition-all duration-200 - focus:outline-none focus:border-primary-600 focus:ring-[3px] focus:ring-primary-600/10 - " - /> - -
- -
- - setConfirmPassword(e.target.value)} - placeholder="Confirm your new password" - required - autoComplete="new-password" - className={` - w-full px-4 py-2.5 sm:py-3 - bg-white - border rounded-xl - text-warm-900 text-base lg:text-sm - placeholder:text-warm-400 - transition-all duration-200 - focus:outline-none focus:ring-[3px] - ${confirmPassword && confirmPassword !== password - ? 'border-red-300 focus:border-red-500 focus:ring-red-500/10' - : confirmPassword && confirmPassword === password - ? 'border-primary-300 focus:border-primary-500 focus:ring-primary-500/10' - : 'border-warm-200 focus:border-primary-600 focus:ring-primary-600/10' - } - `} - /> - {confirmPassword && confirmPassword !== password && ( -

- - Passwords do not match -

- )} - {confirmPassword && confirmPassword === password && password.length >= 8 && ( -

- - Passwords match -

- )} -
- - -
+
+ + + +
+ ) : ( + // Valid session - show form +
+ {error && ( +
+ + {error} +
)} - - - {/* Footer links */} - -

- Remember your password?{' '} - - Sign in - -

+
+ setPassword(e.target.value)} + placeholder="Enter your new password" + required + // eslint-disable-next-line jsx-a11y/no-autofocus -- intentional: primary input on a single-field auth page + autoFocus + autoComplete="new-password" + /> + +
-

- - ← Back to HelmLabs - -

- -
-
+
+ setConfirmPassword(e.target.value)} + placeholder="Confirm your new password" + required + autoComplete="new-password" + error={confirmPassword && confirmPassword !== password ? 'Passwords do not match' : undefined} + success={confirmPassword && confirmPassword === password && password.length >= 8 ? 'Passwords match' : undefined} + /> +
+ + + + )} + + ); } diff --git a/src/app/baseball/(auth)/signup/loading.tsx b/src/app/baseball/(auth)/signup/loading.tsx index ecec589c0..3245301f0 100644 --- a/src/app/baseball/(auth)/signup/loading.tsx +++ b/src/app/baseball/(auth)/signup/loading.tsx @@ -1,6 +1,6 @@ export default function Loading() { return ( -
+
diff --git a/src/app/baseball/(auth)/signup/page.tsx b/src/app/baseball/(auth)/signup/page.tsx index ee32e570a..18f60d55b 100644 --- a/src/app/baseball/(auth)/signup/page.tsx +++ b/src/app/baseball/(auth)/signup/page.tsx @@ -1,34 +1,34 @@ 'use client'; -import Link from 'next/link'; -import Image from 'next/image'; import { Suspense, useEffect } from 'react'; import { useRouter, useSearchParams } from 'next/navigation'; -import { motion, useReducedMotion } from 'framer-motion'; import { BaseballSignUpForm } from '@/components/auth/baseball-sign-up-form'; import { isNativeApp } from '@/lib/utils/capacitor'; +import { + AuthCard, + AuthFooterLinks, + BaseballAuthShell, +} from '@/components/auth/baseball-auth-shell'; // Force dynamic rendering export const dynamic = 'force-dynamic'; -// Component to render sign-in link with returnTo param preserved -function SignInLink() { +// Reads returnTo from the URL to preserve it through the sign-in switch link. +function SignupFooter() { const searchParams = useSearchParams(); const returnTo = searchParams.get('returnTo'); const loginHref = returnTo ? `/baseball/login?returnTo=${encodeURIComponent(returnTo)}` : '/baseball/login'; return ( - - Sign in - + ); } export default function SignupPage() { - const prefersReducedMotion = useReducedMotion(); const router = useRouter(); useEffect(() => { @@ -40,194 +40,43 @@ export default function SignupPage() { }, [router]); return ( -
- {/* Skip to main content link for keyboard navigation */} - - Skip to signup form - - - {/* Animated floating orbs */} -
- {/* Large primary orb - top right */} - - {/* Medium orb - bottom left */} - - {/* Small accent orb - top left (hidden on very small screens) */} - - {/* Tiny floating dot */} - -
- - {/* Grid pattern overlay */} -
+ }> + + + } + > + +
+

+ Create your account +

+
- {/* Glass card */} -
- - {/* Logo with glow effect */} - -
-
-
- BaseballHelm Logo + +
+
+
+
+
+
+
-

- BaseballHelm -

- - - {/* Header */} - -

- Create your account -

-

Start building your championship roster

- - - {/* Form */} - - -
-
-
-
-
-
-
-
-
- }> - - - - - - {/* Footer links with stagger animation */} - -

- Already have an account?{' '} - Sign in}> - - -

- -

- - ← Back to HelmLabs - -

- -
- - Privacy - - - - Terms - -
- -
-
+ + + + ); } diff --git a/src/app/baseball/(dashboard)/BaseballFairwayShell.tsx b/src/app/baseball/(dashboard)/BaseballFairwayShell.tsx index 6477a7470..71f884d86 100644 --- a/src/app/baseball/(dashboard)/BaseballFairwayShell.tsx +++ b/src/app/baseball/(dashboard)/BaseballFairwayShell.tsx @@ -57,6 +57,7 @@ import { PageLoading } from '@/components/ui/loading'; import { LastSeenUpdater } from '@/components/admin/LastSeenUpdater'; import { PeekPanelProvider } from '@/components/baseball/peek-panel'; import { NotificationBell } from '@/components/baseball/NotificationBell'; +import { BaseballProgramBrand } from '@/components/baseball/settings/BaseballProgramBrand'; import { useBaseballAuth } from '@/hooks/use-baseball-auth'; import { useBaseballNavContext } from '@/hooks/use-baseball-nav-context'; @@ -66,11 +67,22 @@ import { usePlayerTeams } from '@/hooks/use-player-teams'; import { useUnreadCount } from '@/hooks/use-unread-count'; import { getVisibleBaseballNav, + getBaseballTerminology, BASEBALL_MESSAGES_NAV, type BaseballNavContext, type BaseballNavEntry, } from '@/lib/baseball/nav-registry'; -import { IconSettings, IconLogout } from '@/components/icons'; +import { + COACH_HUB_ORDER, + COACH_HUB_DEFS, +} from '@/app/baseball/(dashboard)/_components/hub-definitions'; +import { + filterHubTabsByCapabilities, + filterHubTabsByProgramType, +} from '@/app/baseball/(dashboard)/_components/resolve-active-hub'; +import type { HubSubNavTab } from '@/app/baseball/(dashboard)/_components/hub-sub-nav'; +import type { BaseballProgramType } from '@/lib/types/baseball-settings'; +import { IconSettings, IconLogout, IconHome, IconUsers, IconCalendar } from '@/components/icons'; import { cn } from '@/lib/utils'; // PERF: lazy-load the same heavy global the legacy BaseballDashboardShell @@ -118,28 +130,131 @@ function toNavItem(entry: Pick, bad return { label: entry.label, href: entry.href, icon: entry.icon as unknown as NavItem['icon'], badge }; } +/** Same structural narrowing as toNavItem, for a hub sub-tab (whose `icon` is + * optional in HubSubNavTab — every tab this shell renders always sets one). */ +function hubTabToNavItem(tab: HubSubNavTab, badge?: number): NavItem { + return { label: tab.label, href: tab.href, icon: tab.icon as unknown as NavItem['icon'], badge }; +} + +const RECRUITING_PROGRAM_TYPES = new Set(['college', 'juco', 'showcase', 'academy', 'club']); + /** - * Grouped rail sections derived straight from `getVisibleBaseballNav()` — the - * SAME resolved, capability-gated list Sidebar/MobileBottomNav read (no - * hardcoded nav array here). Messages is injected explicitly: it is - * deliberately excluded from BASEBALL_NAV_REGISTRY (see nav-registry.ts — - * "the one cross-cutting surface that lives OUTSIDE the feature registry"), - * so every nav consumer must add it itself. + * Player rail sections — UNCHANGED by the coach-nav-8tab consolidation + * (COACH_NAV_8TAB_PROPOSAL.md is scoped to the coach nav). Derived straight + * from `getVisibleBaseballNav()`, exactly as before. */ -function buildNavSections(ctx: BaseballNavContext, unreadCount: number): NavSection[] { +function buildPlayerNavSections(ctx: BaseballNavContext, unreadCount: number): NavSection[] { const visible = getVisibleBaseballNav(ctx); const primary: NavItem[] = visible.filter((e) => e.section === 'primary').map((e) => toNavItem(e)); const secondary: NavItem[] = visible.filter((e) => e.section === 'secondary').map((e) => toNavItem(e)); primary.push(toNavItem(BASEBALL_MESSAGES_NAV, unreadCount > 0 ? unreadCount : undefined)); - const sections: NavSection[] = [ - { heading: ctx.role === 'coach' ? 'Team' : 'My Baseball', items: primary }, - ]; + const sections: NavSection[] = [{ heading: 'My Baseball', items: primary }]; if (secondary.length) sections.push({ heading: 'More', items: secondary }); return sections; } +/** + * Coach rail sections — GROUPED BY `entry.hub` (COACH_HUB_ORDER / COACH_HUB_DEFS + * in hub-definitions.ts, itself derived from BASEBALL_NAV_REGISTRY), the same + * single source of truth src/components/layout/sidebar.tsx's + * buildCondensedBaseballNavigation groups by. One NavSection per visible hub + * (heading = hub label, items = the hub's capability/program-type-filtered + * tabs) — the Fairway rail shows every tab inline (no separate landing-item + + * sub-nav-strip split the legacy shell needs), so "hub label > sub-items" is + * literally the section heading over its item list. + * + * A hub section is omitted entirely once its tabs filter down to zero (mirrors + * resolveActiveHub's own "empty hub → no strip" precedent), so this shell and + * the legacy sidebar can never show a dead-end top-level item for a coach + * missing every capability a hub's members require. + * + * Messages is injected into the DASHBOARD section (golf-style: FairwayDashboard + * Shell.tsx puts Messages inside its first/primary section, never a section of + * its own) — it is deliberately excluded from BASEBALL_NAV_REGISTRY (see + * nav-registry.ts), so every nav consumer must add it explicitly. + */ +function buildCoachHubSections(ctx: BaseballNavContext, unreadCount: number): NavSection[] { + const sections: NavSection[] = []; + + for (const hubId of COACH_HUB_ORDER) { + const def = COACH_HUB_DEFS[hubId]; + + // Recruiting/Academics are MODE-gated (RECRUITING_PROGRAM_TYPES / JUCO-only) + // — same gate resolveActiveHub.ts's coachHubs() uses — checked up front so + // a recruiting-ineligible program type never shows the hub. + if (hubId === 'recruiting' && !(ctx.programType && RECRUITING_PROGRAM_TYPES.has(ctx.programType))) { + continue; + } + if (hubId === 'academics' && ctx.programType !== 'juco') continue; + + const capFiltered = filterHubTabsByCapabilities(def.tabs, 'coach', ctx.capabilities); + const visibleTabs = filterHubTabsByProgramType(capFiltered, ctx.programType); + const items = visibleTabs.map((t) => hubTabToNavItem(t)); + + if (hubId === 'dashboard') { + items.push(hubTabToNavItem(BASEBALL_MESSAGES_NAV, unreadCount > 0 ? unreadCount : undefined)); + } + if (items.length === 0) continue; + + // Recruiting reframed per mode (JUCO → "Transfer Exposure") using the SAME + // terminology engine program-type-variants.ts already provides — never a + // second hand-maintained label map. + const heading = hubId === 'recruiting' ? getBaseballTerminology(ctx).exposureNoun : def.label; + sections.push({ heading, items }); + } + + return sections; +} + +/** + * Showcase ORG-level rail (no team selected yet) — the documented two-level + * org→team exception (COACH_NAV_8TAB_PROPOSAL.md): org-wide Dashboard/Teams/ + * Events, mirroring src/components/layout/sidebar.tsx's `showcaseOrgNav` + * exactly (same routes/icons/order), plus the persistent Messages slot. + */ +function buildShowcaseOrgSections(unreadCount: number): NavSection[] { + return [ + { + heading: 'Organization', + items: [ + { label: 'Dashboard', href: '/baseball/dashboard/organization', icon: IconHome }, + { label: 'Teams', href: '/baseball/dashboard/teams', icon: IconUsers }, + { label: 'Events', href: '/baseball/dashboard/events', icon: IconCalendar }, + hubTabToNavItem(BASEBALL_MESSAGES_NAV, unreadCount > 0 ? unreadCount : undefined), + ], + }, + ]; +} + +/** + * Showcase TEAM-level rail (a team is selected) — the other half of the + * two-level exception, mirroring `showcaseTeamNav`: Team / Stats & Performance + * / Development only (no Recruiting/Academics/Management — those are org-level + * or not part of the showcase team surface), plus Dashboard + Messages so the + * rail is never just three orphaned sections with no way back to Today. + */ +function buildShowcaseTeamSections(ctx: BaseballNavContext, unreadCount: number): NavSection[] { + const sections: NavSection[] = []; + const dashboardTabs = filterHubTabsByCapabilities(COACH_HUB_DEFS.dashboard.tabs, 'coach', ctx.capabilities); + sections.push({ + heading: COACH_HUB_DEFS.dashboard.label, + items: [ + ...dashboardTabs.map((t) => hubTabToNavItem(t)), + hubTabToNavItem(BASEBALL_MESSAGES_NAV, unreadCount > 0 ? unreadCount : undefined), + ], + }); + for (const hubId of ['team', 'stats-performance', 'development'] as const) { + const def = COACH_HUB_DEFS[hubId]; + const capFiltered = filterHubTabsByCapabilities(def.tabs, 'coach', ctx.capabilities); + const visibleTabs = filterHubTabsByProgramType(capFiltered, ctx.programType); + if (visibleTabs.length === 0) continue; + sections.push({ heading: def.label, items: visibleTabs.map((t) => hubTabToNavItem(t)) }); + } + return sections; +} + function toTitle(seg: string): string { return seg.replace(/-/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase()); } @@ -278,7 +393,17 @@ function BaseballFairwayContent({ ); const homeHref = role === 'coach' ? '/baseball/dashboard/command-center' : '/baseball/player/today'; - const sections = useMemo(() => buildNavSections(ctx, unreadCount), [ctx, unreadCount]); + // Showcase two-level org→team exception (COACH_NAV_8TAB_PROPOSAL.md, + // mirrors sidebar.tsx's showcaseOrgNav/showcaseTeamNav split): org-wide rail + // until a team is picked, then the team-scoped hub rail. + const isShowcaseCoach = role === 'coach' && coach?.coach_type === 'showcase'; + const sections = useMemo(() => { + if (role !== 'coach') return buildPlayerNavSections(ctx, unreadCount); + if (isShowcaseCoach) { + return selectedTeam ? buildShowcaseTeamSections(ctx, unreadCount) : buildShowcaseOrgSections(unreadCount); + } + return buildCoachHubSections(ctx, unreadCount); + }, [ctx, unreadCount, role, isShowcaseCoach, selectedTeam]); const breadcrumbs = useMemo(() => buildBreadcrumbs(pathname, ctx, homeHref), [pathname, ctx, homeHref]); // P413-equivalent: persistent mobile bottom-tab bar (subset of the rail). const bottomNavItems = useMemo(() => buildBottomNavItems(ctx, unreadCount), [ctx, unreadCount]); @@ -307,7 +432,11 @@ function BaseballFairwayContent({ ); return ( - <> + // `.living-annual` re-points the Fairway surface tokens to warm cream for + // the whole baseball subtree (founder: "less white, more cream"); golf never + // carries the class. `display:contents` so it only provides CSS-var + // inheritance — no extra box, no layout impact on AppShell. +
{skipLink} - +
); } @@ -368,6 +497,12 @@ export function BaseballFairwayShell({ children }: { children: React.ReactNode } + {/* Render-null: fetches the program's brand + applies it as CSS vars / + data attrs on . Mounted here too — this is a full parallel + duplicate of BaseballShellLayout's provider stack (not a wrapper), + so branding would otherwise silently die whenever the redesign + flag is on for this route group. */} + {children} diff --git a/src/app/baseball/(dashboard)/_components/hub-definitions.ts b/src/app/baseball/(dashboard)/_components/hub-definitions.ts index 9afe3aad9..6d97e2549 100644 --- a/src/app/baseball/(dashboard)/_components/hub-definitions.ts +++ b/src/app/baseball/(dashboard)/_components/hub-definitions.ts @@ -10,6 +10,28 @@ // ADDITIVE: no route is moved, renamed, or deleted — the hub adds a navigation // layer above the leaves that already work. // +// COACH_NAV_8TAB_PROPOSAL.md (approved 2026-07-01) — DERIVED, NOT HAND-LISTED: +// every COACH_*_TABS array below is built by grouping BASEBALL_NAV_REGISTRY on +// its `hub` field (nav-registry.ts), not by hand-maintaining a parallel route +// list. That is what fixed the drift the proposal documented: 5 registered +// features with no hub-tab entry anywhere (camps, postgame-review, +// practice-effectiveness, practice-planner, comparisons), a phantom coach +// `tasks` tab with no coach-visible registry row, and a player-only +// `college-interest` leaking into the coach recruiting hub. Labels, icons, +// requiredCapability/requiredAnyCapabilities, and allowedProgramTypes are all +// read from the registry entry verbatim — never re-declared here, so they can +// never drift from the registry again. The only hand-maintained data left is +// (a) each hub's DISPLAY ORDER (a small id list; entries not listed simply fall +// to the end in registry order — nothing can be silently dropped), and (b) a +// handful of SUPPLEMENTARY leaf tabs (Stats Center's Games/Season/Upload, +// Performance's Live/Programs/Groups/Builder) that are child pages of a +// registry feature, not registry features in their own right. +// +// PLAYER_*_TABS are intentionally NOT derived the same way: most player-only +// registry entries (player-dev-plan, player-lift, player-readiness, etc.) carry +// no `hub` field (hub is only required for role coach/both — see nav-registry.ts), +// so they stay hand-maintained here, unchanged by this pass. +// // PURE DATA + ICONS. No 'use client' / 'use server', no Supabase, no React state — // safe to import from both the client sidebar and the client hub layouts. // ============================================================================= @@ -21,7 +43,6 @@ import { IconBell, IconCheckCircle2, IconFileText, - IconAirplane, IconChartBar, IconClipboardList, IconTrendingUp, @@ -31,123 +52,263 @@ import { IconDumbbell, IconGauge, IconShieldCheck, - IconBrain, IconBuilding, - IconSettings, IconStar, - IconNote, IconHome, IconUser, IconGraduationCap, } from '@/components/icons'; import type { HubSubNavTab } from './hub-sub-nav'; +import { + BASEBALL_NAV_REGISTRY, + type BaseballNavEntry, + type BaseballNavHub, + type BaseballNavIcon, +} from '@/lib/baseball/nav-registry'; // ----------------------------------------------------------------------------- -// COACH HUBS +// Derivation core — group BASEBALL_NAV_REGISTRY by `hub`, in a curated display +// order, with registry-order fallback for anything not explicitly ordered. // ----------------------------------------------------------------------------- -/** TEAM hub — roster + day-to-day team operations. */ -export const COACH_TEAM_TABS: readonly HubSubNavTab[] = [ - { id: 'roster', label: 'Roster', href: '/baseball/dashboard/roster', icon: IconUsers }, - { id: 'calendar', label: 'Calendar', href: '/baseball/dashboard/calendar', icon: IconCalendar }, - { id: 'messages', label: 'Messages', href: '/baseball/dashboard/messages', icon: IconMessage }, - { id: 'announcements', label: 'Announcements', href: '/baseball/dashboard/announcements', icon: IconBell }, - { id: 'tasks', label: 'Tasks', href: '/baseball/dashboard/tasks', icon: IconCheckCircle2 }, - { id: 'documents', label: 'Documents', href: '/baseball/dashboard/documents', icon: IconFileText }, - { id: 'travel', label: 'Travel', href: '/baseball/dashboard/travel', icon: IconAirplane }, +/** Registry entry → HubSubNavTab, copying every gating field VERBATIM. */ +function toHubTab(entry: BaseballNavEntry): HubSubNavTab { + return { + id: entry.id, + label: entry.label, + href: entry.href, + icon: entry.icon, + requiredCapability: entry.requiredCapability ?? undefined, + requiredAnyCapabilities: entry.requiredAnyCapabilities, + allowedProgramTypes: entry.allowedProgramTypes, + }; +} + +/** + * Every coach/both registry entry tagged for `hub`, converted to tabs. `team` + * is always excluded — it is the legacy `/dashboard/team` alias (hub: + * 'dashboard' for the registry invariant, but its href is an exact duplicate + * of `command-center` for coaches), never a distinct destination worth a tab. + */ +function hubEntries(hub: BaseballNavHub): HubSubNavTab[] { + return BASEBALL_NAV_REGISTRY.filter((e) => e.hub === hub && e.role !== 'player' && e.id !== 'team').map( + toHubTab, + ); +} + +/** Stable-sort tabs by a curated id order; unlisted ids keep registry order at the end. */ +function orderTabs(tabs: HubSubNavTab[], order: readonly string[]): HubSubNavTab[] { + const rank = new Map(order.map((id, i) => [id, i])); + return [...tabs].sort((a, b) => { + const ra = rank.has(a.id) ? rank.get(a.id)! : Number.MAX_SAFE_INTEGER; + const rb = rank.has(b.id) ? rank.get(b.id)! : Number.MAX_SAFE_INTEGER; + return ra - rb; + }); +} + +/** Splice hand-declared supplementary leaf tabs directly after their parent registry tab. */ +function withSupplements( + tabs: readonly HubSubNavTab[], + supplements: Readonly>, +): HubSubNavTab[] { + const out: HubSubNavTab[] = []; + for (const tab of tabs) { + out.push(tab); + const extra = supplements[tab.id]; + if (extra) out.push(...extra); + } + return out; +} + +// ----------------------------------------------------------------------------- +// Supplementary leaf tabs — child pages of a registry feature that are not +// themselves BASEBALL_NAV_REGISTRY entries (nav-registry.ts tracks the 32 +// top-level features; these are deeper sub-pages within two of them). +// ----------------------------------------------------------------------------- + +const STATS_GAMES_TAB: HubSubNavTab = { + id: 'games', + label: 'Games', + href: '/baseball/dashboard/stats/games', + icon: IconClipboardList, +}; +const STATS_SEASON_TAB: HubSubNavTab = { + id: 'season', + label: 'Season', + href: '/baseball/dashboard/stats/season', + icon: IconTrendingUp, +}; +const STATS_UPLOAD_TAB: HubSubNavTab = { + id: 'upload', + label: 'Upload', + href: '/baseball/dashboard/stats/upload', + icon: IconUpload, +}; +const PERFORMANCE_LIVE_TAB: HubSubNavTab = { + id: 'performance-live', + label: 'Live', + href: '/baseball/dashboard/performance/live', + icon: IconDumbbell, + requiredCapability: 'can_manage_lifting', +}; +const PERFORMANCE_PROGRAMS_TAB: HubSubNavTab = { + id: 'performance-programs', + label: 'Programs', + href: '/baseball/dashboard/performance/programs', + icon: IconClipboardList, + matchPrefixes: ['/baseball/dashboard/performance/programs'], + requiredCapability: 'can_manage_lifting', +}; +const PERFORMANCE_GROUPS_TAB: HubSubNavTab = { + id: 'performance-groups', + label: 'Groups', + href: '/baseball/dashboard/performance/groups', + icon: IconUsers, + requiredCapability: 'can_manage_lifting', +}; +const PERFORMANCE_BUILDER_TAB: HubSubNavTab = { + id: 'performance-builder', + label: 'Builder', + href: '/baseball/dashboard/performance/builder', + icon: IconGauge, + requiredCapability: 'can_manage_lifting', +}; + +// ----------------------------------------------------------------------------- +// Curated display order per hub (COACH_NAV_8TAB_PROPOSAL.md mapping table). +// Membership is always registry-derived (hubEntries); this only sequences it. +// ----------------------------------------------------------------------------- + +const DASHBOARD_ORDER = ['command-center', 'signals']; +const TEAM_ORDER = ['roster', 'calendar', 'announcements', 'documents', 'travel']; +const STATS_PERFORMANCE_ORDER = [ + 'stats-center', + 'performance', + 'postgame-review', + 'practice-planner', + 'practice-effectiveness', + 'import-center', +]; +const DEVELOPMENT_ORDER = ['dev-plans', 'videos']; +const RECRUITING_ORDER = ['pipeline', 'discover', 'watchlist', 'compare', 'comparisons', 'scout-packets', 'camps']; +const ACADEMICS_ORDER = ['academics']; +const MANAGEMENT_ORDER = [ + 'staff-decision-room', + 'program', + 'staff-settings', + 'program-settings', + 'organization', + 'teams', + 'events', ]; -/** STATS hub — team-wide stats depth, game logs, season, performance, upload. */ -export const COACH_STATS_TABS: readonly HubSubNavTab[] = [ - { - id: 'overview', - label: 'Overview', - href: '/baseball/dashboard/stats-center', - icon: IconChartBar, - // /stats-center is the canonical overview; legacy /stats children remain - // below for games, season, and upload routes. - }, - { id: 'games', label: 'Games', href: '/baseball/dashboard/stats/games', icon: IconClipboardList }, - { id: 'season', label: 'Season', href: '/baseball/dashboard/stats/season', icon: IconTrendingUp }, - { - id: 'performance', - label: 'Performance', - href: '/baseball/dashboard/performance', - icon: IconTrendingUp, - matchPrefixes: ['/baseball/dashboard/performance'], - requiredAnyCapabilities: ['can_manage_lifting', 'can_view_readiness'], - }, - { - id: 'performance-live', - label: 'Live', - href: '/baseball/dashboard/performance/live', - icon: IconDumbbell, - requiredCapability: 'can_manage_lifting', - }, - { - id: 'performance-programs', - label: 'Programs', - href: '/baseball/dashboard/performance/programs', - icon: IconClipboardList, - matchPrefixes: ['/baseball/dashboard/performance/programs'], - requiredCapability: 'can_manage_lifting', - }, - { - id: 'performance-groups', - label: 'Groups', - href: '/baseball/dashboard/performance/groups', - icon: IconUsers, - requiredCapability: 'can_manage_lifting', - }, +// ----------------------------------------------------------------------------- +// COACH HUBS — every array below is registry-derived (see the module header). +// ----------------------------------------------------------------------------- + +/** DASHBOARD hub — Command Center + Signals (folded from two flat top-level tabs). */ +export const COACH_DASHBOARD_TABS: readonly HubSubNavTab[] = orderTabs( + hubEntries('dashboard'), + DASHBOARD_ORDER, +); + +/** TEAM hub — roster + day-to-day team operations. */ +export const COACH_TEAM_TABS: readonly HubSubNavTab[] = orderTabs(hubEntries('team'), TEAM_ORDER); + +/** + * STATS & PERFORMANCE hub — team-wide stats depth, game logs, season, practice + * intelligence, and lifting/readiness, folded into one hub per the proposal + * (previously Practice Planner/Effectiveness, Postgame Review, and Import + * Center had no hub-tab entry anywhere — an unreachable-feature bug this fixes). + */ +export const COACH_STATS_TABS: readonly HubSubNavTab[] = withSupplements( + orderTabs(hubEntries('stats-performance'), STATS_PERFORMANCE_ORDER), { - id: 'performance-builder', - label: 'Builder', - href: '/baseball/dashboard/performance/builder', - icon: IconGauge, - requiredCapability: 'can_manage_lifting', + 'stats-center': [STATS_GAMES_TAB, STATS_SEASON_TAB, STATS_UPLOAD_TAB], + performance: [PERFORMANCE_LIVE_TAB, PERFORMANCE_PROGRAMS_TAB, PERFORMANCE_GROUPS_TAB, PERFORMANCE_BUILDER_TAB], }, - { id: 'upload', label: 'Upload', href: '/baseball/dashboard/stats/upload', icon: IconUpload }, -]; +); /** DEVELOPMENT hub — dev plans + video library. */ -export const COACH_DEVELOPMENT_TABS: readonly HubSubNavTab[] = [ - { id: 'dev-plans', label: 'Dev Plans', href: '/baseball/dashboard/dev-plans', icon: IconTarget, matchPrefixes: ['/baseball/dashboard/dev-plans'] }, - { id: 'videos', label: 'Videos', href: '/baseball/dashboard/videos', icon: IconVideo, matchPrefixes: ['/baseball/dashboard/videos'] }, -]; - -/** MANAGEMENT hub — staff room, program info, settings. */ -export const COACH_MANAGEMENT_TABS: readonly HubSubNavTab[] = [ - { id: 'staff-room', label: 'Staff Room', href: '/baseball/dashboard/decision-room', icon: IconBrain }, - { id: 'program', label: 'Program', href: '/baseball/dashboard/program', icon: IconBuilding }, - { id: 'settings', label: 'Settings', href: '/baseball/dashboard/settings', icon: IconSettings, matchPrefixes: ['/baseball/dashboard/settings'] }, -]; +export const COACH_DEVELOPMENT_TABS: readonly HubSubNavTab[] = orderTabs( + hubEntries('development'), + DEVELOPMENT_ORDER, +); /** - * RECRUITING hub — college interest, scout packets, import. Gated: currently - * archived-ok to scaffold hidden (the sidebar does not surface this hub yet). - * Defined here so the layout + future un-hide is a one-line sidebar change. + * RECRUITING hub — pipeline, discovery, comparisons, scout packets, camps. + * Gated to RECRUITING_PROGRAM_TYPES by the sidebar/resolve-active-hub, hidden + * entirely for High School. Fixed by this pass: `import` (misplaced here + * previously) moved to Stats & Performance; `college-interest` (a player-only + * page) removed; `comparisons` and `camps` (previously unreachable) added. */ -export const COACH_RECRUITING_TABS: readonly HubSubNavTab[] = [ - { id: 'pipeline', label: 'Pipeline', href: '/baseball/dashboard/pipeline', icon: IconTarget, matchPrefixes: ['/baseball/dashboard/pipeline'] }, - { id: 'discover', label: 'Discover', href: '/baseball/dashboard/discover', icon: IconStar }, - { id: 'watchlist', label: 'Watchlist', href: '/baseball/dashboard/watchlist', icon: IconStar }, - { id: 'compare', label: 'Compare', href: '/baseball/dashboard/compare', icon: IconChartBar }, - { id: 'college-interest', label: 'College Interest', href: '/baseball/dashboard/college-interest', icon: IconStar }, - { id: 'scout-packets', label: 'Scout Packets', href: '/baseball/dashboard/scout-packets', icon: IconNote }, - { id: 'import', label: 'Import', href: '/baseball/dashboard/import', icon: IconUpload, requiredCapability: 'can_manage_imports' }, -]; +export const COACH_RECRUITING_TABS: readonly HubSubNavTab[] = orderTabs( + hubEntries('recruiting'), + RECRUITING_ORDER, +); /** * ACADEMICS hub — JUCO coaches only (the sidebar surfaces this hub only when * coach_type === 'juco'). A single-surface hub today; kept as a hub so it slots * into the same grouped-nav grammar and can grow sub-tabs later. */ -export const COACH_ACADEMICS_TABS: readonly HubSubNavTab[] = [ - { id: 'academics', label: 'Academics', href: '/baseball/dashboard/academics', icon: IconGraduationCap }, +export const COACH_ACADEMICS_TABS: readonly HubSubNavTab[] = orderTabs(hubEntries('academics'), ACADEMICS_ORDER); + +/** + * MANAGEMENT hub — staff coordination, program settings, and (Showcase/Academy/ + * Club only, via allowedProgramTypes carried through verbatim from the + * registry) org-level Organization/Teams/Events. Fixed by this pass: the + * "Decision Room" vs "Staff Room" label drift (the registry's label always + * wins now — it is read, not re-declared). + */ +export const COACH_MANAGEMENT_TABS: readonly HubSubNavTab[] = orderTabs( + hubEntries('management'), + MANAGEMENT_ORDER, +); + +// ----------------------------------------------------------------------------- +// HUB METADATA — the ordered list of coach hubs + their label/icon/tabs, so +// sidebar.tsx and BaseballFairwayShell.tsx can build the top-level grouped nav +// generically (loop over COACH_HUB_ORDER) instead of hand-listing hubs. +// ----------------------------------------------------------------------------- + +export interface CoachHubDef { + id: BaseballNavHub; + label: string; + icon: BaseballNavIcon; + tabs: readonly HubSubNavTab[]; +} + +/** Display order of the 7 registry-backed coach hubs (Messages is the 8th tab, + * a persistent cross-cutting slot outside this grouping — see nav-registry.ts). */ +export const COACH_HUB_ORDER: readonly BaseballNavHub[] = [ + 'dashboard', + 'team', + 'stats-performance', + 'development', + 'recruiting', + 'academics', + 'management', ]; +export const COACH_HUB_DEFS: Readonly> = { + dashboard: { id: 'dashboard', label: 'Dashboard', icon: IconHome, tabs: COACH_DASHBOARD_TABS }, + team: { id: 'team', label: 'Team', icon: IconUsers, tabs: COACH_TEAM_TABS }, + 'stats-performance': { + id: 'stats-performance', + label: 'Stats & Performance', + icon: IconChartBar, + tabs: COACH_STATS_TABS, + }, + development: { id: 'development', label: 'Development', icon: IconTarget, tabs: COACH_DEVELOPMENT_TABS }, + recruiting: { id: 'recruiting', label: 'Recruiting', icon: IconStar, tabs: COACH_RECRUITING_TABS }, + academics: { id: 'academics', label: 'Academics', icon: IconGraduationCap, tabs: COACH_ACADEMICS_TABS }, + management: { id: 'management', label: 'Management', icon: IconBuilding, tabs: COACH_MANAGEMENT_TABS }, +}; + // ----------------------------------------------------------------------------- -// PLAYER HUBS +// PLAYER HUBS — unchanged by this pass (see the module header: most player-only +// registry entries carry no `hub`, so these stay hand-maintained). // ----------------------------------------------------------------------------- /** Player STATS hub — own stats depth + game/season views. */ @@ -178,7 +339,7 @@ export const PLAYER_TEAM_TABS: readonly HubSubNavTab[] = [ // ----------------------------------------------------------------------------- export const HUB_LANDING = { - coachDashboard: '/baseball/dashboard/command-center', + coachDashboard: COACH_DASHBOARD_TABS[0]!.href, coachTeam: COACH_TEAM_TABS[0]!.href, coachStats: COACH_STATS_TABS[0]!.href, coachDevelopment: COACH_DEVELOPMENT_TABS[0]!.href, diff --git a/src/app/baseball/(dashboard)/_components/hub-sub-nav.tsx b/src/app/baseball/(dashboard)/_components/hub-sub-nav.tsx index c0f08f29e..800236c7e 100644 --- a/src/app/baseball/(dashboard)/_components/hub-sub-nav.tsx +++ b/src/app/baseball/(dashboard)/_components/hub-sub-nav.tsx @@ -31,6 +31,7 @@ import { LazyMotion, domAnimation, m, useReducedMotion } from 'framer-motion'; import { cn } from '@/lib/utils'; import type { BaseballNavIcon } from '@/lib/baseball/nav-registry'; import type { BaseballCapability } from '@/lib/baseball/capabilities'; +import type { BaseballProgramType } from '@/lib/types/baseball-settings'; // ----------------------------------------------------------------------------- // Types @@ -56,6 +57,13 @@ export interface HubSubNavTab { requiredCapability?: BaseballCapability; /** Staff must hold at least one of these capabilities (#370 / #408). */ requiredAnyCapabilities?: readonly BaseballCapability[]; + /** + * When set, this tab is only visible when the active team's program_type is + * in this list (#367 — showcase-only org surfaces). Copied verbatim from the + * registry entry's `allowedProgramTypes` by hub-definitions.ts — never + * re-declared, so it can never drift from the registry's gate. + */ + allowedProgramTypes?: readonly BaseballProgramType[]; } export interface HubSubNavProps { diff --git a/src/app/baseball/(dashboard)/_components/resolve-active-hub.ts b/src/app/baseball/(dashboard)/_components/resolve-active-hub.ts index 9a50b2214..b92626512 100644 --- a/src/app/baseball/(dashboard)/_components/resolve-active-hub.ts +++ b/src/app/baseball/(dashboard)/_components/resolve-active-hub.ts @@ -9,16 +9,19 @@ // one Next route-group layout). The shell asks this resolver "which hub owns the // current route?" and renders that hub's tabs. // +// Coach hub MEMBERSHIP is driven entirely by COACH_HUB_ORDER / COACH_HUB_DEFS +// (hub-definitions.ts, itself derived from BASEBALL_NAV_REGISTRY's `hub` field) +// — this module only decides which hubs are VISIBLE for the current +// role/programType (Recruiting/Academics gating) and does the longest-prefix +// route match + capability/program-type tab filtering. It never hand-lists a +// hub's member routes. +// // PURE. No React, no Supabase. Longest-prefix match across every hub's tabs. // ============================================================================= import { - COACH_TEAM_TABS, - COACH_STATS_TABS, - COACH_DEVELOPMENT_TABS, - COACH_MANAGEMENT_TABS, - COACH_RECRUITING_TABS, - COACH_ACADEMICS_TABS, + COACH_HUB_ORDER, + COACH_HUB_DEFS, PLAYER_STATS_TABS, PLAYER_DEVELOPMENT_TABS, PLAYER_TEAM_TABS, @@ -26,6 +29,7 @@ import { import type { HubSubNavTab } from './hub-sub-nav'; import type { BaseballProgramType } from '@/lib/types/baseball-settings'; import type { BaseballCapability } from '@/lib/baseball/capabilities'; +import type { BaseballNavHub } from '@/lib/baseball/nav-registry'; const RECRUITING_PROGRAM_TYPES = new Set([ 'college', @@ -35,6 +39,23 @@ const RECRUITING_PROGRAM_TYPES = new Set([ 'club', ]); +/** + * Stable short ids for telemetry/tests, decoupled from the hub's display label + * (BaseballNavHub / COACH_HUB_DEFS id) so relabeling a hub in the sidebar can + * never break a test anchor. 'stats-performance' keeps its pre-consolidation + * 'stats' id — the hub's CONTENT grew (Practice/Postgame/Import folded in), + * its identity did not. + */ +const RESOLVE_HUB_ID: Readonly> = { + dashboard: 'dashboard', + team: 'team', + 'stats-performance': 'stats', + development: 'development', + recruiting: 'recruiting', + academics: 'academics', + management: 'management', +}; + export interface ResolvedHub { /** Stable hub id (telemetry / test anchor). */ id: string; @@ -52,49 +73,19 @@ interface HubDef extends ResolvedHub { // Coach hubs. Order matters only for tie-breaking; resolution is longest-prefix // across ALL tabs of ALL hubs, so a deeper route wins regardless of hub order. function coachHubs(opts: { showRecruiting: boolean; showAcademics: boolean }): HubDef[] { - const hubs: HubDef[] = [ - { - id: 'team', - ariaLabel: 'Team sections', - tabs: COACH_TEAM_TABS, - ownedPrefixes: COACH_TEAM_TABS.flatMap((t) => [t.href, ...(t.matchPrefixes ?? [])]), - }, - { - id: 'stats', - ariaLabel: 'Stats sections', - tabs: COACH_STATS_TABS, - ownedPrefixes: COACH_STATS_TABS.flatMap((t) => [t.href, ...(t.matchPrefixes ?? [])]), - }, - { - id: 'development', - ariaLabel: 'Development sections', - tabs: COACH_DEVELOPMENT_TABS, - ownedPrefixes: COACH_DEVELOPMENT_TABS.flatMap((t) => [t.href, ...(t.matchPrefixes ?? [])]), - }, - { - id: 'management', - ariaLabel: 'Management sections', - tabs: COACH_MANAGEMENT_TABS, - ownedPrefixes: COACH_MANAGEMENT_TABS.flatMap((t) => [t.href, ...(t.matchPrefixes ?? [])]), - }, - ]; - if (opts.showRecruiting) { - hubs.push({ - id: 'recruiting', - ariaLabel: 'Recruiting sections', - tabs: COACH_RECRUITING_TABS, - ownedPrefixes: COACH_RECRUITING_TABS.flatMap((t) => [t.href, ...(t.matchPrefixes ?? [])]), - }); - } - if (opts.showAcademics) { - hubs.push({ - id: 'academics', - ariaLabel: 'Academics sections', - tabs: COACH_ACADEMICS_TABS, - ownedPrefixes: COACH_ACADEMICS_TABS.flatMap((t) => [t.href, ...(t.matchPrefixes ?? [])]), - }); - } - return hubs; + return COACH_HUB_ORDER.filter((hub) => { + if (hub === 'recruiting') return opts.showRecruiting; + if (hub === 'academics') return opts.showAcademics; + return true; + }).map((hub) => { + const def = COACH_HUB_DEFS[hub]; + return { + id: RESOLVE_HUB_ID[hub], + ariaLabel: `${def.label} sections`, + tabs: def.tabs, + ownedPrefixes: def.tabs.flatMap((t) => [t.href, ...(t.matchPrefixes ?? [])]), + }; + }); } function playerHubs(): HubDef[] { @@ -148,11 +139,29 @@ export function filterHubTabsByCapabilities( }); } +/** + * Hide hub sub-tabs the current team's program_type doesn't allow (#367 — + * Organization/Teams/Events inside the Management hub, showcase-only). Mirrors + * isBaseballNavEntryVisible's program-type gate in nav-registry.ts exactly, so + * a tab carrying `allowedProgramTypes` (copied verbatim from its registry + * entry) is never shown for a program type the registry itself would hide it + * for. + */ +export function filterHubTabsByProgramType( + tabs: readonly HubSubNavTab[], + programType?: BaseballProgramType | null, +): HubSubNavTab[] { + return tabs.filter((tab) => { + if (!tab.allowedProgramTypes?.length) return true; + return Boolean(programType && tab.allowedProgramTypes.includes(programType)); + }); +} + /** * Resolve the hub (and thus the sub-tab strip) that owns the current route, or * null when the active page is a top-level surface that is NOT inside any hub - * (Dashboard, Profile, Calendar, Messages for players, etc.) — those render with - * no sub-nav strip, exactly like a flat top-level tab. + * (Profile, Messages for players, etc.) — those render with no sub-nav strip, + * exactly like a flat top-level tab. */ export function resolveActiveHub(args: ResolveActiveHubArgs): ResolvedHub | null { const { pathname, role, programType } = args; @@ -181,10 +190,13 @@ export function resolveActiveHub(args: ResolveActiveHubArgs): ResolvedHub | null if (!best) return null; const { id, ariaLabel, tabs } = best.hub; - const visibleTabs = + let visibleTabs = role === 'coach' ? filterHubTabsByCapabilities(tabs, role, args.capabilities ?? {}) : [...tabs]; + if (role === 'coach') { + visibleTabs = filterHubTabsByProgramType(visibleTabs, programType); + } if (visibleTabs.length === 0) return null; return { id, ariaLabel, tabs: visibleTabs }; } diff --git a/src/app/baseball/(dashboard)/dashboard/activate/page.tsx b/src/app/baseball/(dashboard)/dashboard/activate/page.tsx index badf32547..8c69dd431 100644 --- a/src/app/baseball/(dashboard)/dashboard/activate/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/activate/page.tsx @@ -1,282 +1,72 @@ -'use client'; - -import { useState } from 'react'; -import { useRouter } from 'next/navigation'; -import { Header } from '@/components/layout/header'; -import { Card, CardContent, CardHeader } from '@/components/ui/card'; -import { Button } from '@/components/ui/button'; -import { Badge } from '@/components/ui/badge'; -import { PageLoading } from '@/components/ui/loading'; -import { IconTarget, IconUsers, IconChart, IconCheck, IconEye, IconLock } from '@/components/icons'; -import { useAuth } from '@/hooks/use-auth'; -import { createClient } from '@/lib/supabase/client'; +// ============================================================================= +// src/app/baseball/(dashboard)/dashboard/activate/page.tsx +// +// Recruiting activation — SERVER-GATED entry. +// +// This route used to be a client component that gated on useAuth()'s async +// `loading` + a `user.role` check done DURING render. For baseball, role is +// derived from profile presence (not users.role), so the guard frequently never +// matched and the page stranded on a permanent PageLoading shimmer skeleton +// (QA: "STILL-SKELETON", textLen=0). We now resolve the session server-side and +// redirect BEFORE any skeleton paints — the same fix already applied to +// /baseball/dashboard/page.tsx. The interactive activation UI is a thin client +// island that only mounts for an eligible, not-yet-activated player. +// +// Living-Annual migration (P4.27): presentation only — every redirect/guard +// condition below is unchanged, including the exact `player_type === 'college'` +// check. Only the rendered chrome moved to the Living-Annual kit. +// ============================================================================= + +import { redirect } from 'next/navigation'; + +import { getSessionProfile } from '@/lib/auth/session'; +import { fairwayScope } from '@/lib/redesign/flag'; +import { EditorsLetter } from '@/components/baseball/living-annual'; +import { ActivateRecruitingClient } from '@/components/baseball/player-access/ActivateRecruitingClient'; + +export const metadata = { + title: 'Activate Recruiting | Helm Baseball', + description: 'Make your profile visible to college coaches.', +}; + +export default async function ActivateRecruitingPage() { + const session = await getSessionProfile(); + + if (!session) { + redirect('/baseball/login?returnTo=/baseball/dashboard/activate'); + } -export default function ActivateRecruitingPage() { - const { user, player, loading: authLoading, updatePlayer } = useAuth(); - const router = useRouter(); - const [activating, setActivating] = useState(false); - const [error, setError] = useState(null); + // Coaches (and any non-player) have no business here — bounce to their home. + if (!session.player) { + redirect('/baseball/dashboard/command-center'); + } - if (authLoading) return ; + const player = session.player; - if (user?.role !== 'player') { - router.push('/baseball/dashboard/command-center'); - return null; + // Already activated → straight to the player surface. + if (player.recruiting_activated) { + redirect('/baseball/player/today'); } - if (player?.player_type === 'college') { + // College players never activate recruiting exposure. Show a clear, honest + // state instead of a dead skeleton. + if (player.player_type === 'college') { return ( -
- - -
- -
-

Not available for college players

-

- Recruiting activation is for high school, JUCO, and showcase players only. - As a college player, your team features are available from the main dashboard. -

- - +
+
+ +
); } - if (player?.recruiting_activated) { - router.push('/baseball/player/today'); - return null; - } - - const handleActivate = async () => { - if (!player?.id) { - setError('Player not found'); - return; - } - - setActivating(true); - setError(null); - - try { - const supabase = createClient(); - - const { error: updateError } = await supabase - .from('baseball_players') - .update({ - recruiting_activated: true, - recruiting_activated_at: new Date().toISOString(), - }) - .eq('id', player.id); - - if (updateError) { - setError(updateError.message); - setActivating(false); - return; - } - - // Update local state - await updatePlayer?.({ - recruiting_activated: true, - recruiting_activated_at: new Date().toISOString(), - }); - - router.push('/baseball/player/today'); - } catch { - setError('An error occurred. Please try again.'); - setActivating(false); - } - }; - return ( - <> -
-
- {/* Hero Section */} - - -
- -
-

- Ready to be recruited? -

-

- Activate recruiting to make your profile visible to college coaches and unlock powerful features - to help you get recruited to play at the next level. -

- - Free to activate • No credit card required - - - - - {/* Features Grid */} -
- - -
- -
-

Get Discovered

- - -

- Make your profile visible in coach searches and recommendations. -

-
    -
  • - - Appear in coach discovery searches -
    • -
  • - - Get matched with relevant programs -
    • -
  • - - See who's viewing your profile -
    • -
- - - - - -
- -
-

Connect with Coaches

- - -

- See which coaches are interested and message them directly. -

-
    -
  • - - Know which coaches viewed you -
    • -
  • - - Track watchlist additions -
    • -
  • - - Direct messaging with coaches -
    • -
- - - - - -
- -
-

Manage Your Journey

- - -

- Track your recruiting progress and manage your college list. -

-
    -
  • - - Timeline of recruiting activity -
    • -
  • - - Track offers and commitments -
    • -
  • - - Organize your target schools -
    • -
- - - - - -
- -
-

Track Analytics

- - -

- Understand your recruiting reach and optimize your profile. -

-
    -
  • - - Profile view statistics -
    • -
  • - - Video engagement metrics -
    • -
  • - - Interest by program type -
    • -
- - -
- - {/* Privacy & Control */} - - -

You're in control

- - -
-
-

Privacy Settings

-
    -
  • • Control what information is visible
    • -
  • • Choose who can contact you
    • -
  • • Deactivate recruiting anytime
    • -
-
-
-

Your Data

-
    -
  • • Your profile belongs to you
    • -
  • • Export your data anytime
    • -
  • • Delete your account anytime
    • -
-
-
- - - - {/* CTA */} - - - {error && ( -
- {error} -
- )} - -

- By activating, you agree to make your profile visible to college coaches -

- - -
- +
+ +
); } diff --git a/src/app/baseball/(dashboard)/dashboard/analytics/AnalyticsClient.tsx b/src/app/baseball/(dashboard)/dashboard/analytics/AnalyticsClient.tsx index 74882c89d..8c7d7c6e6 100644 --- a/src/app/baseball/(dashboard)/dashboard/analytics/AnalyticsClient.tsx +++ b/src/app/baseball/(dashboard)/dashboard/analytics/AnalyticsClient.tsx @@ -1,224 +1,166 @@ 'use client'; -import { Header } from '@/components/layout/header'; -import { Card, CardContent, CardHeader } from '@/components/ui/card'; -import { PageLoading } from '@/components/ui/loading'; -import { IconEye, IconStar, IconVideo, IconMessage, IconTrendingUp, IconCalendar } from '@/components/icons'; +// ============================================================================= +// AnalyticsClient — the player's recruiting-interest view, migrated onto "The +// Living Annual" kit (design-system-living-annual.md §6, execution-plan.md +// §3.1 "analytics" row). PLAYER-ONLY (coaches redirect to the Command Center +// before this ever mounts — see page.tsx). +// +// PRESENTATION ONLY. `useAnalytics()` — the SAME hook, same 30-day engagement +// query, same anonymize-until-activated school naming — is preserved verbatim; +// only the render is re-skinned: +// • 4 stat cards → `KPIContentsStrip` (green-ruled, tabular-nums) +// • Views-over-time → `ClimbArc` (paper season climb, replaces recharts) +// • Top schools list → `RuledStatLine` rows (top interest reads green) +// +// Ink ruling: stays GREEN chrome throughout — this is the Passport (player) +// lane, not the War Room. Recruiting heat (a coach viewing the profile) gets a +// single `sodium` `InkBadge` accent on the masthead, never full clay chrome. +// ============================================================================= + import { useAnalytics } from '@/hooks/use-analytics'; -import dynamic from 'next/dynamic'; +import { + SectionMasthead, + KPIContentsStrip, + RuledStatLine, + ClimbArc, + PaperCard, + Eyebrow, + InkBadge, + EmptyIssue, + EditorsLetter, + Reveal, +} from '@/components/baseball/living-annual'; +import { Skeleton } from '@/components/ui/skeleton'; + +const PAGE_SHELL = 'mx-auto w-full max-w-[1536px] px-4 py-8 sm:px-6'; + +/** `2026-06-15` → `Jun 15`, parsed as a local calendar date (not UTC-shifted). */ +function formatDateLabel(iso: string): string { + const d = new Date(`${iso}T00:00:00`); + if (Number.isNaN(d.getTime())) return iso; + return d.toLocaleDateString('en-US', { month: 'short', day: 'numeric' }); +} + +// ─── Loading (skeleton, not a spinner) ────────────────────────────────────── + +function AnalyticsSkeleton() { + return ( +
+
+ + + +
+ +
+ {[0, 1, 2, 3].map((i) => ( +
+ + +
+ ))} +
-const LineChart = dynamic(() => import('recharts').then((mod) => mod.LineChart), { ssr: false }); -const Line = dynamic(() => import('recharts').then((mod) => mod.Line), { ssr: false }); -const XAxis = dynamic(() => import('recharts').then((mod) => mod.XAxis), { ssr: false }); -const YAxis = dynamic(() => import('recharts').then((mod) => mod.YAxis), { ssr: false }); -const Tooltip = dynamic(() => import('recharts').then((mod) => mod.Tooltip), { ssr: false }); -const ResponsiveContainer = dynamic(() => import('recharts').then((mod) => mod.ResponsiveContainer), { ssr: false }); -const CartesianGrid = dynamic(() => import('recharts').then((mod) => mod.CartesianGrid), { ssr: false }); + + + + -export default function AnalyticsPage() { + + + {[0, 1, 2].map((i) => ( + + ))} + +
+ ); +} + +export default function AnalyticsClient() { const { data, loading } = useAnalytics(); if (loading) { - return ( - <> -
- - - ); + return ; } + // No player record resolved for this session (rare edge state — not the + // "recruiting not activated" case, which still returns real zeroed stats + // below). Honest standing-by letter, never a broken/blank page. if (!data) { return ( - <> -
-
- - - -

No Analytics Data Yet

-

- Analytics will appear once coaches start viewing your profile. - Make sure recruiting is activated to get discovered. -

- - +
+ +
+
- +
); } const { stats, viewsOverTime, topSchools } = data; + const hasInterest = stats.profileViews > 0; return ( - <> -
+ : undefined} + > +

+ Track your recruiting activity over the last 30 days. +

+ + + -
- {/* Stats Cards */} -
- - -
-
- -
-

Profile Views

-
-

{stats.profileViews.toLocaleString()}

-

Last 30 days

- - - - - -
-
- -
-

Watchlist Adds

-
-

{stats.watchlistAdds.toLocaleString()}

-

Coaches interested

- - - - - -
-
- -
-

Video Views

-
-

{stats.videoViews.toLocaleString()}

-

Highlight reel views

- - - - - -
-
- -
-

Messages

-
-

{stats.messagesSent.toLocaleString()}

-

Coach messages

- - -
- {/* Views Over Time Chart */} - - -
- -

Profile Views Over Time

-
-

Daily profile views for the last 30 days

- - - {viewsOverTime.length > 0 ? ( - - - - { - const date = new Date(value); - return `${date.getMonth() + 1}/${date.getDate()}`; - }} - /> - - { - const date = new Date(value); - return date.toLocaleDateString('en-US', { - month: 'short', - day: 'numeric', - year: 'numeric' - }); - }} - /> - ({ label: formatDateLabel(v.date), value: v.views }))} + /> + + + Top schools viewing your profile +

+ Schools that have shown the most interest. +

+ +
+ {topSchools.length > 0 ? ( +
+ {topSchools.map((school, i) => ( + + 0} /> - - - ) : ( -
- -

No profile views yet

-
- )} - - - - {/* Top Schools Viewing */} - - -

Top Schools Viewing Your Profile

-

Schools that have shown the most interest

- - - {topSchools.length > 0 ? ( -
- {topSchools.map((school, idx) => ( -
-
-
- #{idx + 1} -
-
-

{school.school_name}

- {school.division && ( -

{school.division}

- )} -
-
-
-

{school.view_count.toLocaleString()}

-

- {school.view_count === 1 ? 'view' : 'views'} -

-
-
- ))} -
- ) : ( -
- -

No school views yet

-

- Make sure your profile is complete and recruiting is activated -

-
- )} - - -
- + + ))} +
+ ) : ( + + )} +
+ +
); } diff --git a/src/app/baseball/(dashboard)/dashboard/analytics/page.tsx b/src/app/baseball/(dashboard)/dashboard/analytics/page.tsx index ecdcd79c2..1a02f2513 100644 --- a/src/app/baseball/(dashboard)/dashboard/analytics/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/analytics/page.tsx @@ -1,5 +1,6 @@ import { redirect } from 'next/navigation'; import { getSessionProfile } from '@/lib/auth/session'; +import { fairwayScope } from '@/lib/redesign/flag'; import AnalyticsClient from './AnalyticsClient'; export default async function AnalyticsPage() { @@ -7,5 +8,9 @@ export default async function AnalyticsPage() { if (!session) redirect('/baseball/login'); if (session.role === 'coach') redirect('/baseball/dashboard/command-center'); - return ; + return ( +
+ +
+ ); } diff --git a/src/app/baseball/(dashboard)/dashboard/announcements/page.tsx b/src/app/baseball/(dashboard)/dashboard/announcements/page.tsx index a74b62405..179000504 100644 --- a/src/app/baseball/(dashboard)/dashboard/announcements/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/announcements/page.tsx @@ -1,20 +1,14 @@ 'use client'; import { useState, useEffect, useCallback } from 'react'; -import { Header } from '@/components/layout/header'; -import { Card, CardContent } from '@/components/ui/card'; import { PageLoading } from '@/components/ui/loading'; -import { IconBell } from '@/components/icons'; import { useAuth } from '@/hooks/use-auth'; import { useTeamStore } from '@/stores/team-store'; import { createClient } from '@/lib/supabase/client'; import { getAnnouncementsWithMeta } from '@/app/baseball/actions/announcements'; -import { AnnouncementsCoachView } from '@/components/baseball/announcements/AnnouncementsCoachView'; -import { AnnouncementsPlayerView } from '@/components/baseball/announcements/AnnouncementsPlayerView'; -import { CreateAnnouncementFlow } from '@/components/baseball/announcements/CreateAnnouncementFlow'; -import { ReadModelStateNotice } from '@/components/baseball/ReadModelStateNotice'; import { AnnouncementsFairway } from '@/components/baseball/announcements/AnnouncementsFairway'; -import { isRedesignEnabled, fairwayScope } from '@/lib/redesign/flag'; +import { ReadModelStateNotice } from '@/components/baseball/ReadModelStateNotice'; +import { fairwayScope } from '@/lib/redesign/flag'; import type { BaseballAnnouncementMeta } from '@/app/baseball/actions/announcements'; interface RosterPlayer { @@ -59,8 +53,10 @@ export default function BaseballAnnouncementsPage() { setLoadError(result.error ?? 'Announcements could not be loaded.'); } - // For coaches: also fetch roster for the create flow - if (isCoach && selectedTeamId) { + // For coaches: also fetch roster for the create flow. selectedTeamId is + // already guaranteed truthy here (guard clause above returns otherwise, + // and this closure's value can't change mid-call), so only isCoach gates. + if (isCoach) { const supabase = createClient(); const { data: members } = await supabase .from('baseball_team_members') @@ -96,117 +92,36 @@ export default function BaseballAnnouncementsPage() { if (authLoading) return ; - const recentCount = announcements.filter(a => { - if (!a.published_at) return false; - return (Date.now() - new Date(a.published_at).getTime()) < 7 * 86400000; - }).length; - - if (isRedesignEnabled()) { + if (loadError) { return ( -
- +

Announcements

+ void fetchAnnouncements()} />
); } + const recentCount = announcements.filter(a => { + if (!a.published_at) return false; + return (Date.now() - new Date(a.published_at).getTime()) < 7 * 86400000; + }).length; + return ( - <> -
- {isCoach && selectedTeamId && ( - - )} -
- -
- {/* Recent count badge */} - {recentCount > 0 && !loading && ( -
- - {recentCount} new this week - -
- )} - - {loading ? ( -
- {Array.from({ length: 3 }).map((_, i) => ( -
-
-
-
-
-
-
-
-
-
- ))} -
- ) : !selectedTeamId ? ( - - -
- -
-

No Team Selected

-

- Please select a team from the sidebar to view announcements. -

- - - ) : loadError ? ( - void fetchAnnouncements()} - /> - ) : announcements.length === 0 ? ( - - -
- -
-

No Announcements

-

- {isCoach - ? 'Create announcements to keep your team informed about schedule changes, game updates, and important news.' - : 'No announcements have been posted yet. Check back later for team updates.'} -

- {isCoach && selectedTeamId && ( - - )} - - - ) : isCoach ? ( - - ) : ( - - )} -
- +
+ +
); } diff --git a/src/app/baseball/(dashboard)/dashboard/calendar/page.tsx b/src/app/baseball/(dashboard)/dashboard/calendar/page.tsx index 4edcbae08..a985885b7 100644 --- a/src/app/baseball/(dashboard)/dashboard/calendar/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/calendar/page.tsx @@ -1,4 +1,5 @@ import { createClient } from '@/lib/supabase/server'; +import { fromUntyped } from '@/lib/supabase/untyped'; import { getSessionProfile } from '@/lib/auth/session'; import { redirect } from 'next/navigation'; import Link from 'next/link'; @@ -73,9 +74,17 @@ export default async function BaseballCalendarPage() { if (teamId) { const [eventsResult, membersResult, teamOrgResult] = await Promise.all([ - supabase - .from('baseball_events') - .select('id, team_id, title, event_type, start_time, end_time, location, description, is_mandatory, max_attendees, rsvp_deadline, created_by') + // Read via fromUntyped so the select is not type-checked against the + // generated baseball_events types (which drift from the live schema). + // + // IMPORTANT: the column list MUST match the live baseball_events schema. + // A previous revision selected `requires_rsvp`, which does NOT exist on + // baseball_events — PostgREST rejected the whole query, so `.data` came + // back null and the calendar rendered EMPTY even with seeded events. + // `all_day` / `status` / `recurring` DO exist and are needed so the grid + // places all-day events correctly and dims cancelled ones. + fromUntyped(supabase, 'baseball_events') + .select('id, team_id, title, event_type, start_time, end_time, location, description, is_mandatory, max_attendees, rsvp_deadline, all_day, status, recurring, created_by') .eq('team_id', teamId) .order('start_time', { ascending: true }), supabase @@ -90,24 +99,54 @@ export default async function BaseballCalendarPage() { .maybeSingle(), ]); - // Map baseball_events → CalendarEvent - events = (eventsResult.data || []).map((event) => ({ - id: event.id, - team_id: event.team_id || '', - title: event.title, - event_type: event.event_type || 'other', - start_date: event.start_time, - end_date: event.end_time || event.start_time, - start_time: event.start_time, - end_time: event.end_time, - location: event.location || undefined, - description: event.description || undefined, - is_mandatory: event.is_mandatory ?? false, - max_attendees: event.max_attendees, - rsvp_deadline: event.rsvp_deadline, - created_by: event.created_by, - requires_rsvp: false, - })); + // Map baseball_events → CalendarEvent. Row is annotated because the query + // uses fromUntyped (the generated types drift from the live schema). + // All-day events are normalized to local midnight so the week/day grid + // places them in the all-day rail rather than at a UTC-shifted hour. + events = (eventsResult.data || []).map((event: { + id: string; + team_id: string | null; + title: string; + event_type: string | null; + start_time: string; + end_time: string | null; + location: string | null; + description: string | null; + is_mandatory: boolean | null; + max_attendees: number | null; + rsvp_deadline: string | null; + all_day: boolean | null; + status: string | null; + recurring: boolean | null; + created_by: string | null; + }) => { + const normalizeAllDay = (d: string) => `${d.slice(0, 10)}T00:00:00`; + const startDate = event.all_day ? normalizeAllDay(event.start_time) : event.start_time; + const endDate = event.all_day + ? normalizeAllDay(event.end_time || event.start_time) + : event.end_time || event.start_time; + return { + id: event.id, + team_id: event.team_id || '', + title: event.title, + event_type: event.event_type || 'other', + start_date: startDate, + end_date: endDate, + start_time: event.start_time, + end_time: event.end_time, + location: event.location || undefined, + description: event.description || undefined, + is_mandatory: event.is_mandatory ?? false, + max_attendees: event.max_attendees, + rsvp_deadline: event.rsvp_deadline, + all_day: event.all_day ?? false, + status: event.status ?? undefined, + recurring: event.recurring ?? false, + created_by: event.created_by, + // baseball_events has no requires_rsvp column; RSVP is not modeled here. + requires_rsvp: false, + }; + }); // Coaches on this team. Read non-PII identity from the baseball_coaches_public // view (not the base table) so this player-reachable roster panel keeps @@ -151,10 +190,26 @@ export default async function BaseballCalendarPage() { } // ── Event summary strip ───────────────────────────────────────────────────── - + // + // "Upcoming" = start time at or after local midnight TODAY (not the exact + // `now` instant) — an event scheduled earlier today still counts as + // upcoming for the rest of the day, and the boundary can't drift mid-render + // between the two numbers below. + // + // Both the headline count and the per-type badges are derived from the SAME + // filtered list. Previously `upcomingEvents` filtered by date while + // `eventTypeCounts` summed EVERY event this team has ever had (no date + // filter at all) — on a team with only past/demo events that showed the + // contradictory "0 upcoming events · 1 Practice · 1 Meeting · 1 Game" (the + // badges counting events the headline had already excluded). Single source + // of truth below so the two numbers can never disagree again. const now = new Date(); - const upcomingEvents = events.filter((e) => new Date(e.start_time || e.start_date) >= now).length; - const eventTypeCounts = events.reduce>((acc, e) => { + const startOfToday = new Date(now.getFullYear(), now.getMonth(), now.getDate()); + const upcomingEventsList = events.filter( + (e) => new Date(e.start_time || e.start_date) >= startOfToday + ); + const upcomingEvents = upcomingEventsList.length; + const eventTypeCounts = upcomingEventsList.reduce>((acc, e) => { const t = e.event_type || 'other'; acc[t] = (acc[t] || 0) + 1; return acc; @@ -238,14 +293,19 @@ export default async function BaseballCalendarPage() { background: 'linear-gradient(180deg, #F7F5F2 0%, #F4EFE6 33%, #F1ECE0 66%, #ECE5D6 100%)', }} > - {/* Event summary strip — only shown when there are events */} - {events.length > 0 && ( + {/* Event summary strip — only shown when there's an upcoming event to + summarize. Gating on `upcomingEvents` (not `events.length`) matches + what the strip actually says: a team with only past events has + nothing "upcoming" to report, so showing "0 upcoming events ·" + with no badges after it would just be a second, quieter version of + the same contradiction this strip exists to avoid. */} + {upcomingEvents > 0 && (
-
+
{upcomingEvents} upcoming event{upcomingEvents !== 1 ? 's' : ''} - | + {Object.entries(eventTypeCounts).map(([type, count]) => { const cfg = EVENT_TYPE_CONFIG[type] ?? { label: type, dot: 'bg-warm-400' }; return ( diff --git a/src/app/baseball/(dashboard)/dashboard/camps/page.tsx b/src/app/baseball/(dashboard)/dashboard/camps/page.tsx index b09947492..644f26823 100644 --- a/src/app/baseball/(dashboard)/dashboard/camps/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/camps/page.tsx @@ -1,8 +1,7 @@ 'use client'; -import { useState, useEffect, useRef } from 'react'; +import { useState, useEffect, useRef, type ReactNode } from 'react'; import Link from 'next/link'; -import { Header } from '@/components/layout/header'; import { Card, CardContent } from '@/components/ui/card'; import { Button } from '@/components/ui/button'; import { Badge } from '@/components/ui/badge'; @@ -15,7 +14,7 @@ import { CreateCampModal } from '@/components/coach/CreateCampModal'; import { createClient } from '@/lib/supabase/client'; import { useAuth } from '@/hooks/use-auth'; import { useToast } from '@/components/ui/sonner'; -import { registerForCamp } from '@/app/baseball/actions/camps'; +import { registerForCamp, unregisterFromCamp, deleteCamp } from '@/app/baseball/actions/camps'; import { activeCampCountsByCamp, formatCampDate } from '@/lib/baseball/camp-utils'; interface Camp { @@ -70,7 +69,7 @@ async function loadCamps( const filtered = 'coachId' in opts ? base.eq('coach_id', opts.coachId) - : base.eq('status', 'active').gte('end_date', new Date().toISOString()); + : base.eq('status', 'published').gte('end_date', new Date().toISOString()); const { data, error } = await filtered.order('start_date', { ascending: true }); if (error) throw error; return attachActiveCounts(supabase, (data as Camp[]) ?? []); @@ -131,9 +130,9 @@ function CampCard({
- {camp.status === 'active' ? 'Open' : camp.status || 'Pending'} + {camp.status === 'published' ? 'Open' : camp.status || 'Pending'} {camp.price_cents && !camp.is_free && (

@@ -218,6 +217,36 @@ function CampCard({ ); } +// Lightweight editorial page header. The dashboard shell already renders the +// global top bar (notifications + command palette), so this page must NOT mount +// the legacy layout

— doing so stacked a second search box + avatar +// under the shell bar. This mirrors the premium Scout Packets header pattern: +// eyebrow → title → subtitle, with the primary action inline on the right. +function CampsPageHeader({ + isCoach, + subtitle, + action, +}: { + isCoach: boolean; + subtitle: string; + action?: ReactNode; +}) { + return ( +
+
+

+ Recruiting +

+

+ {isCoach ? 'My Camps' : 'Camps'} +

+

{subtitle}

+
+ {action ?
{action}
: null} +
+ ); +} + export default function CampsPage() { const { user, coach, player } = useAuth(); const { showToast } = useToast(); @@ -293,13 +322,11 @@ export default function CampsPage() { const handleUnregister = async (campId: string) => { if (!player) return; - const { error } = await supabase - .from('baseball_camp_registrations') - .update({ status: 'cancelled' }) - .eq('camp_id', campId) - .eq('player_id', player.id); + // Go through the audited server-action layer instead of a raw + // client-side write. + const result = await unregisterFromCamp(campId); - if (!error) { + if (result.success) { setRegisteredCamps(prev => { const newSet = new Set(prev); newSet.delete(campId); @@ -311,7 +338,7 @@ export default function CampsPage() { : c )); } else { - showToast('Failed to cancel camp registration', 'error'); + showToast(result.error || 'Failed to cancel camp registration', 'error'); } }; @@ -324,20 +351,12 @@ export default function CampsPage() { setDeleting(true); try { - // First delete all registrations for this camp - await supabase - .from('baseball_camp_registrations') - .delete() - .eq('camp_id', deleteConfirm); - - // Then delete the camp - const { error } = await supabase - .from('baseball_camps') - .delete() - .eq('id', deleteConfirm); - - if (error) { - showToast('Failed to delete camp', 'error'); + // Go through the audited server-action layer (deletes registrations + + // the camp, with an ownership check) instead of raw client-side deletes. + const result = await deleteCamp(deleteConfirm); + + if (!result.success) { + showToast(result.error || 'Failed to delete camp', 'error'); return; } @@ -354,24 +373,24 @@ export default function CampsPage() { if (loading) { return ( - <> -
+ - +
); } if (loadError) { return ( - <> -
+ -
+
- +
); } return ( <> -
- {isCoach && ( - - )} -
+ setShowCreateModal(true)}> + + Create Camp + + ) : undefined + } + /> {camps.length === 0 ? ( } diff --git a/src/app/baseball/(dashboard)/dashboard/college-interest/CollegeInterestClient.tsx b/src/app/baseball/(dashboard)/dashboard/college-interest/CollegeInterestClient.tsx index fef50f13b..4b56cc247 100644 --- a/src/app/baseball/(dashboard)/dashboard/college-interest/CollegeInterestClient.tsx +++ b/src/app/baseball/(dashboard)/dashboard/college-interest/CollegeInterestClient.tsx @@ -1,17 +1,42 @@ 'use client'; +// ============================================================================= +// CollegeInterestClient — the coach-facing "who's scouting my players" surface, +// migrated onto "The Living Annual" kit (War Room lane, clay ink — spec §5 +// Lane 2, alongside Discover / Watchlist / Signals; P4.30). +// +// PRESENTATION ONLY. Every data path below is byte-for-byte unchanged: +// fetchCoachTeam, fetchInterests (the engagement-event query, the filter/sort +// math), and — LOAD-BEARING, do not touch — the `isAnonymous = !event.coach_id` +// derivation that nulls out coach_name/coach_school/coach_division for a +// not-yet-activated viewer. Only the render moved to the kit. +// +// The 3 player-gate states are preserved EXACTLY — same 3 branches, same +// conditions (college-player lock → not-yet-activated lock → in-flight-redirect +// loading for an activated non-college player) — only restyled from the old +// glass Card + IconLock treatment onto `` (green/Passport ink, +// since these are messages addressed TO a player). +// ============================================================================= + import { useState, useEffect } from 'react'; -import { Header } from '@/components/layout/header'; -import { Card, CardContent, CardHeader } from '@/components/ui/card'; -import { Button } from '@/components/ui/button'; -import { Badge } from '@/components/ui/badge'; import { Avatar } from '@/components/ui/avatar'; +import { Button } from '@/components/ui/button'; import { PageLoading } from '@/components/ui/loading'; -import { IconEye, IconStar, IconTrendingUp, IconLock } from '@/components/icons'; +import { Skeleton } from '@/components/ui/skeleton'; +import { IconEye, IconVideo, IconStarFilled } from '@/components/icons'; import { useAuth } from '@/hooks/use-auth'; import { usePlayerRecruitingGate } from '@/hooks/use-route-protection'; import { createClient } from '@/lib/supabase/client'; -import { getFullName, formatRelativeTime } from '@/lib/utils'; +import { cn, getFullName, formatRelativeTime } from '@/lib/utils'; +import { + SectionMasthead, + Eyebrow, + RuledStatLine, + PaperCard, + InkBadge, + EditorsLetter, + Reveal, +} from '@/components/baseball/living-annual'; interface EngagementEvent { id: string; @@ -55,6 +80,113 @@ interface PlayerInterest { }>; } +const PAGE_SHELL = 'mx-auto w-full max-w-[1536px] px-4 py-8 sm:px-6'; +const GATE_SHELL = 'mx-auto max-w-lg px-4 py-16 sm:px-6'; + +const INTEREST_FILTERS: Array<{ value: 'all' | 'high' | 'recent'; label: string }> = [ + { value: 'all', label: 'All Players' }, + { value: 'high', label: 'High Interest' }, + { value: 'recent', label: 'Recent (7d)' }, +]; + +// Segmented filter control — same local pattern as StatsCenterClient's +// `SegmentedControl` (the established War Room / record-book convention for a +// button-group toggle), clay-ink active state for this lane. ` + ); + })} +
+ ); +} + +// Skeleton loader (not a spinner) for the interest list, matching the kit's +// double-bezel PaperCard rhythm so the loading frame IS the final frame. +function InterestListSkeleton() { + return ( +
+ {[0, 1, 2].map((i) => ( + +
+ +
+ + +
+
+
+ + + +
+ + ))} +
+ ); +} + +// Icons carry the read via SHAPE, not chrome color — every activity icon stays +// in lane ink (clay) per spec §4.2 rule 2 ("clay only on stamps/seals/hot +// signals... never generic chrome"); differentiating by red/blue/amber/purple +// literals would violate the two-ink system. +function getEngagementIcon(type: string) { + switch (type) { + case 'profile_view': + return ; + case 'video_view': + return ; + case 'watchlist_add': + return ; + default: + return ; + } +} + +function getEngagementLabel(type: string) { + switch (type) { + case 'profile_view': + return 'Viewed profile'; + case 'video_view': + return 'Watched video'; + case 'watchlist_add': + return 'Added to watchlist'; + default: + return 'Activity'; + } +} + export default function CollegeInterestClient() { const { user, coach, loading: authLoading } = useAuth(); const { playerType, isActivated, isLoading: gateLoading } = usePlayerRecruitingGate(); @@ -240,19 +372,12 @@ export default function CollegeInterestClient() { // College players cannot activate recruiting at all — they use team features. if (playerType === 'college') { return ( -
- - -
- -
-

Not available for college players

-

- College interest tracking is a coach-facing tool. As a college player, - your team features are available from the team dashboard. -

- - +
+
); } @@ -260,66 +385,34 @@ export default function CollegeInterestClient() { // Non-college players who haven't activated recruiting yet. if (!isActivated) { return ( -
- - -
- -
-

Activate recruiting first

-

- Once you activate recruiting, you'll be able to see which college programs - are viewing your profile. -

- - +
+
); } - // Activated non-college player — this is a coach surface; redirect is handled - // by the gate hook. Show nothing while redirect is in flight. - return null; + // Non-college player — this is a coach surface; redirect is handled by the + // gate hook (now fires for all non-college players, activated or not). + // Show a loading state while the redirect is in flight. + return ; } if (user?.role !== 'coach') { return ( -
- - -

Only coaches can access college interest tracking.

- - +
+
); } - const getEngagementIcon = (type: string) => { - switch (type) { - case 'profile_view': - return ; - case 'video_view': - return ; - case 'watchlist_add': - return ; - default: - return ; - } - }; - - const getEngagementLabel = (type: string) => { - switch (type) { - case 'profile_view': - return 'Viewed profile'; - case 'video_view': - return 'Watched video'; - case 'watchlist_add': - return 'Added to watchlist'; - default: - return 'Activity'; - } - }; - const stats = { totalPlayers: interests.length, highInterest: interests.filter(i => i.watchlist_adds > 0).length, @@ -330,239 +423,126 @@ export default function CollegeInterestClient() { }; return ( - <> -
-
- {/* Stats Overview */} -
- - -
-
-

Players Tracked

-

{stats.totalPlayers}

-
-
- - -
-
- - - - - -
-
-

High Interest

-

{stats.highInterest}

-
-
- - -
-
- - - - - -
-
-

Total Views

-

{stats.totalViews}

-
-
- - -
-
- - - - - -
-
-

Avg Coaches

-

{stats.avgCoachesPerPlayer}

-
-
- - -
-
- - +
+ +

+ Track which colleges are viewing and tracking your players. +

+ + + {/* Contents strip — clay ink (War Room lane; KPIContentsStrip is team-green + by design and would mix inks here, so this composes RuledStatLine directly). */} +
+ + 0} + /> + + +
+ +
+
+ Player Interest Activity +

+ See which colleges are viewing and tracking your players. +

+ +
- {/* Interest List */} - - -
-
-

Player Interest Activity

-

- See which colleges are viewing and tracking your players -

-
-
- - - -
-
- - - {loading ? ( -
- {[1, 2, 3].map((i) => ( -
- {/* Player avatar + name + position row */} -
-
-
-
-
-
-
+ {loading ? ( + + ) : interests.length === 0 ? ( + + ) : ( +
+ {interests.map((interest, i) => ( + + +
+ +
+
+

+ {interest.player_name} +

+ {interest.watchlist_adds > 0 && ( + 1 ? 'S' : ''}`} + /> + )}
- {/* Recent activity rows */} -
-
- {[0, 1].map((j) => ( -
-
-
-
- ))} + +
+ + 0} + />
- ))} -
- ) : interests.length === 0 ? ( - /* Empty State */ -
-
-
-

No college interest yet

-

- When college coaches view your players' profiles or add them to watchlists, you'll see the activity here. -

-
- ) : ( - /* Interest List */ -
- {interests.map((interest) => ( -
-
- -
-
-

{interest.player_name}

- {interest.watchlist_adds > 0 && ( - - {interest.watchlist_adds} watchlist{interest.watchlist_adds > 1 ? 's' : ''} - - )} -
-

- {interest.player_position} • {interest.player_grad_year} -

-
- {interest.total_views} views - • - {interest.unique_coaches} college{interest.unique_coaches !== 1 ? 's' : ''} -
-
-
- {/* Recent Activity */} - {interest.recent_activity.length > 0 && ( -
-

Recent Activity

- {interest.recent_activity.slice(0, 5).map((activity) => ( -
-
- {getEngagementIcon(activity.engagement_type)} -
-
- {!activity.coach_name ? ( -

- A college coach{' '} - {getEngagementLabel(activity.engagement_type).toLowerCase()} - viewed - {activity.coach_division && ( - • {activity.coach_division} - )} -

- ) : ( -

- {activity.coach_name} - from {activity.coach_school} {getEngagementLabel(activity.engagement_type).toLowerCase()} - {activity.coach_school} - {activity.coach_division && ( - • {activity.coach_division} - )} -

- )} - - {activity.created_at ? formatRelativeTime(activity.created_at) : ''} - -
-
- {activity.created_at ? formatRelativeTime(activity.created_at) : ''} -
+ {/* Recent Activity */} + {interest.recent_activity.length > 0 && ( +
+ Recent Activity +
+ {interest.recent_activity.slice(0, 5).map((activity) => ( +
+
{getEngagementIcon(activity.engagement_type)}
+
+ {!activity.coach_name ? ( +

+ A college coach{' '} + {getEngagementLabel(activity.engagement_type).toLowerCase()} + {activity.coach_division && ( + · {activity.coach_division} + )} +

+ ) : ( +

+ {activity.coach_name} from{' '} + {activity.coach_school}{' '} + {getEngagementLabel(activity.engagement_type).toLowerCase()} + {activity.coach_division && ( + · {activity.coach_division} + )} +

+ )} +
+
+ {activity.created_at ? formatRelativeTime(activity.created_at) : ''}
- ))} -
- )} +
+ ))} +
- ))} -
- )} - - -
- + )} + + + ))} +
+ )} +
); } diff --git a/src/app/baseball/(dashboard)/dashboard/college-interest/page.tsx b/src/app/baseball/(dashboard)/dashboard/college-interest/page.tsx index 8643bd506..5062345d1 100644 --- a/src/app/baseball/(dashboard)/dashboard/college-interest/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/college-interest/page.tsx @@ -1,8 +1,13 @@ import CollegeInterestClient from './CollegeInterestClient'; +import { fairwayScope } from '@/lib/redesign/flag'; // Force dynamic rendering - requires Supabase auth at runtime export const dynamic = 'force-dynamic'; export default function CollegeInterestPage() { - return ; + return ( +
+ +
+ ); } diff --git a/src/app/baseball/(dashboard)/dashboard/colleges/page.tsx b/src/app/baseball/(dashboard)/dashboard/colleges/page.tsx index 82c240f62..b98ba0e88 100644 --- a/src/app/baseball/(dashboard)/dashboard/colleges/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/colleges/page.tsx @@ -8,7 +8,7 @@ import { Select } from '@/components/ui/select'; import { Input } from '@/components/ui/input'; import { EmptyState } from '@/components/ui/empty-state'; import { Loading } from '@/components/ui/loading'; -import { IconBuilding, IconSearch } from '@/components/icons'; +import { IconBuilding, IconSearch, IconAlertCircle } from '@/components/icons'; import { useColleges, useStates, useConferences } from '@/hooks/use-colleges'; const divisions = [ @@ -26,7 +26,7 @@ export default function CollegesPage() { const [conferenceFilter, setConferenceFilter] = useState(''); const [search, setSearch] = useState(''); - const { colleges, interests, loading, toggleInterest } = useColleges({ + const { colleges, interests, loading, error, refetch, toggleInterest } = useColleges({ division: division || undefined, state: stateFilter || undefined, conference: conferenceFilter || undefined, @@ -94,6 +94,13 @@ export default function CollegesPage() { {/* Results */} {loading ? ( + ) : error ? ( + } + title="Couldn't load colleges" + description={error} + action={{ label: 'Retry', onClick: refetch }} + /> ) : colleges.length === 0 ? ( } diff --git a/src/app/baseball/(dashboard)/dashboard/command-center/page.tsx b/src/app/baseball/(dashboard)/dashboard/command-center/page.tsx index b1994d984..7edc97c26 100644 --- a/src/app/baseball/(dashboard)/dashboard/command-center/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/command-center/page.tsx @@ -1,9 +1,8 @@ import { createClient } from '@/lib/supabase/server'; import { getSessionProfile } from '@/lib/auth/session'; import { redirect } from 'next/navigation'; -import { CommandCenterClient } from '@/components/baseball/command-center/CommandCenterClient'; import { CommandCenterFairway } from '@/components/baseball/command-center/CommandCenterFairway'; -import { isRedesignEnabled, fairwayScope } from '@/lib/redesign/flag'; +import { fairwayScope } from '@/lib/redesign/flag'; import { getCommandCenter } from '@/lib/baseball/read-models/command-center'; import { assembleCommandCenterClientProps } from '@/lib/baseball/read-models/command-center-adapter'; import { getCoachDailyContracts } from '@/lib/baseball/read-models/coach-daily-contracts'; @@ -48,31 +47,18 @@ export default async function CommandCenterPage() { ); if (!teamId) { - if (isRedesignEnabled()) { - return ( -
- -
- ); - } return ( - +
+ +
); } @@ -101,37 +87,20 @@ export default async function CommandCenterPage() { coachDailyContracts, }); - if (isRedesignEnabled()) { - return ( -
- -
- ); - } - return ( - +
+ +
); } diff --git a/src/app/baseball/(dashboard)/dashboard/decision-room/page.tsx b/src/app/baseball/(dashboard)/dashboard/decision-room/page.tsx index 98e43e58b..fb6b390ea 100644 --- a/src/app/baseball/(dashboard)/dashboard/decision-room/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/decision-room/page.tsx @@ -18,6 +18,11 @@ // the wrapper's 401/403 — caught by the sibling error.tsx — and the sidebar // never surfaces the entry to players in the first place (nav-registry // role:'coach'). +// +// P4.23: wraps the client in the Fairway `.fairway-ds` scope (matching every +// other Living-Annual-migrated route, e.g. command-center/page.tsx) so the +// StaffDecisionRoomFairway kit atoms resolve their tokens the same way they +// do everywhere else. No auth/data-fetch behavior changes. // ============================================================================= import { redirect } from 'next/navigation'; @@ -25,6 +30,7 @@ import { redirect } from 'next/navigation'; import { createClient } from '@/lib/supabase/server'; import { getDecisionRoomData } from '@/app/baseball/actions/decision-room'; import { StaffDecisionRoomClient } from '@/components/baseball/staff-decision-room/StaffDecisionRoomClient'; +import { fairwayScope } from '@/lib/redesign/flag'; export const metadata = { title: 'Decision Room | Helm Baseball', @@ -48,5 +54,9 @@ export default async function DecisionRoomPage() { // role, missing capability) surfaces through error.tsx. const data = await getDecisionRoomData(); - return ; + return ( +
+ +
+ ); } diff --git a/src/app/baseball/(dashboard)/dashboard/dev-plans/[id]/page.tsx b/src/app/baseball/(dashboard)/dashboard/dev-plans/[id]/page.tsx index 0d1a90349..db5f6bd70 100644 --- a/src/app/baseball/(dashboard)/dashboard/dev-plans/[id]/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/dev-plans/[id]/page.tsx @@ -1,79 +1,88 @@ 'use client'; -import { useEffect, useState } from 'react'; +import { useCallback, useEffect, useState, useTransition } from 'react'; import { useParams } from 'next/navigation'; -import { createClient } from '@/lib/supabase/client'; import { Header } from '@/components/layout/header'; import { PageLoading } from '@/components/ui/loading'; +import { Card, CardContent } from '@/components/ui/card'; import { PlanDetail } from '@/components/baseball/dev-plans/PlanDetail'; - -interface PlanWithPlayer { - id: string; - title: string; - description: string | null; - start_date: string | null; - end_date: string | null; - status: string | null; - goals: unknown; - player: { - id: string; - first_name: string | null; - last_name: string | null; - avatar_url: string | null; - primary_position: string | null; - grad_year: number | null; - } | null; -} +import { useAuth } from '@/hooks/use-auth'; +import { useToast } from '@/components/ui/sonner'; +import { + getDevPlanForCoach, + completeGoal, + uncompleteGoal, +} from '@/app/baseball/actions/dev-plans'; +import type { DevPlanWithPlayer } from '@/lib/baseball/dev-plan-types'; export default function DevPlanDetailPage() { const params = useParams<{ id: string }>(); - const [plan, setPlan] = useState(null); + const { user, loading: authLoading } = useAuth(); + const { showToast } = useToast(); + const [plan, setPlan] = useState(null); const [loading, setLoading] = useState(true); const [notFound, setNotFound] = useState(false); - const supabase = createClient(); - - useEffect(() => { - async function fetchPlan() { - if (!params?.id) return; - setLoading(true); - - const { data, error } = await supabase - .from('baseball_developmental_plans') - .select(` - id, - title, - description, - start_date, - end_date, - status, - goals, - player:baseball_players ( - id, - first_name, - last_name, - avatar_url, - primary_position, - grad_year - ) - `) - .eq('id', params.id) - .single(); + const [isPending, startTransition] = useTransition(); + const [pendingGoalId, setPendingGoalId] = useState(null); - if (!error && data) { - setPlan(data as PlanWithPlayer); - setNotFound(false); - } else { - setPlan(null); - setNotFound(true); - } + const fetchPlan = useCallback(async () => { + if (!params?.id) return; + setLoading(true); + try { + const data = await getDevPlanForCoach(params.id); + setPlan(data); + setNotFound(false); + } catch (error) { + console.error('Error fetching dev plan:', error); + setPlan(null); + setNotFound(true); + } finally { setLoading(false); } + }, [params?.id]); + useEffect(() => { fetchPlan(); - }, [params?.id, supabase]); + }, [fetchPlan]); + + const handleComplete = useCallback( + (goalId: string) => { + if (!plan) return; + setPendingGoalId(goalId); + startTransition(async () => { + try { + await completeGoal(plan.id, goalId); + await fetchPlan(); + } catch (error) { + showToast(error instanceof Error ? error.message : 'Could not mark goal complete', 'error'); + } finally { + setPendingGoalId(null); + } + }); + }, + [plan, fetchPlan, showToast] + ); + + const handleUncomplete = useCallback( + (goalId: string) => { + if (!plan) return; + setPendingGoalId(goalId); + startTransition(async () => { + try { + await uncompleteGoal(plan.id, goalId); + await fetchPlan(); + } catch (error) { + showToast(error instanceof Error ? error.message : 'Could not update goal', 'error'); + } finally { + setPendingGoalId(null); + } + }); + }, + [plan, fetchPlan, showToast] + ); - if (loading) { + if (authLoading || loading) { return ( <>
@@ -84,6 +93,21 @@ export default function DevPlanDetailPage() { ); } + if (user?.role !== 'coach') { + return ( + <> +
+
+ + +

Only coaches can access development plans.

+ + +
+ + ); + } + if (notFound || !plan) { return ( <> @@ -101,7 +125,12 @@ export default function DevPlanDetailPage() { <>
- +
); diff --git a/src/app/baseball/(dashboard)/dashboard/documents/documents-client.tsx b/src/app/baseball/(dashboard)/dashboard/documents/documents-client.tsx index aab19743a..65035d9c9 100644 --- a/src/app/baseball/(dashboard)/dashboard/documents/documents-client.tsx +++ b/src/app/baseball/(dashboard)/dashboard/documents/documents-client.tsx @@ -1,16 +1,25 @@ 'use client'; -import { useRef, useState } from 'react'; +import { useMemo, useRef, useState } from 'react'; import { Card, CardContent } from '@/components/ui/card'; import { Button } from '@/components/ui/button'; +import { Select } from '@/components/ui/select'; +import { Checkbox } from '@/components/ui/checkbox'; import { IconFile, IconUpload, IconSearch } from '@/components/icons'; import { DocumentCard } from '@/components/baseball/documents/DocumentCard'; import { DocumentPreview } from '@/components/baseball/documents/DocumentPreview'; import { UploadNewVersionModal } from '@/components/baseball/documents/UploadNewVersionModal'; +import { EditDocumentModal, type EditDocumentSaveData } from '@/components/baseball/documents/EditDocumentModal'; +import { MoveToFolderModal, type MoveToFolderSaveData } from '@/components/baseball/documents/MoveToFolderModal'; +import { + DocumentVersionHistoryModal, + type DocumentVersionRevertPatch, +} from '@/components/baseball/documents/DocumentVersionHistoryModal'; import type { BaseballDocument } from '@/app/baseball/actions/documents'; import { createBaseballDocument, deleteBaseballDocument, + updateBaseballDocument, uploadBaseballDocument, uploadNewVersion, } from '@/app/baseball/actions/documents'; @@ -41,14 +50,25 @@ interface DocumentsClientProps { isCoach: boolean; } +// Category options available for the upload-time picker / edit modal. +// Excludes the 'all' pseudo-category used only by the filter tabs. +const DOCUMENT_UPLOAD_CATEGORIES = CATEGORIES.filter((c) => c.value !== 'all'); + export function DocumentsClient({ documents: initialDocuments, coachId, teamId, isCoach }: DocumentsClientProps) { const [documents, setDocuments] = useState(initialDocuments); const [search, setSearch] = useState(''); const [category, setCategory] = useState('all'); const [previewDoc, setPreviewDoc] = useState(null); const [versionDoc, setVersionDoc] = useState(null); + const [editingDoc, setEditingDoc] = useState(null); + const [historyDoc, setHistoryDoc] = useState(null); + const [movingDoc, setMovingDoc] = useState(null); const [activeDropdown, setActiveDropdown] = useState(null); const [isUploadingDocument, setIsUploadingDocument] = useState(false); + // Upload-time picker state — replaces the previously hardcoded + // category: 'general' / is_player_visible: true on every upload. + const [uploadCategory, setUploadCategory] = useState('general'); + const [uploadIsPlayerVisible, setUploadIsPlayerVisible] = useState(true); const fileInputRef = useRef(null); const { showToast } = useToast(); @@ -58,6 +78,14 @@ export function DocumentsClient({ documents: initialDocuments, coachId, teamId, return matchesSearch && matchesCategory; }); + const existingFolders = useMemo(() => { + const set = new Set(); + for (const doc of documents) { + if (doc.folder) set.add(doc.folder); + } + return Array.from(set).sort(); + }, [documents]); + async function handleDelete(doc: BaseballDocument) { if (!confirm(`Delete "${doc.title}"? This cannot be undone.`)) return; @@ -95,8 +123,8 @@ export function DocumentsClient({ documents: initialDocuments, coachId, teamId, storage_path: uploadResult.storage_path, file_type: file.type || 'application/octet-stream', file_size: file.size, - category: 'general', - is_player_visible: true, + category: uploadCategory, + is_player_visible: uploadIsPlayerVisible, uploaded_by: coachId, }); @@ -135,6 +163,82 @@ export function DocumentsClient({ documents: initialDocuments, coachId, teamId, showToast('New version uploaded', 'success'); } + function openEditModal(doc: BaseballDocument) { + setEditingDoc(doc); + } + + async function handleSaveEdit(data: EditDocumentSaveData) { + const result = await updateBaseballDocument({ + id: data.id, + title: data.title, + description: data.description, + category: data.category, + is_player_visible: data.is_player_visible, + }); + + if (!result.success || !result.data) { + throw new Error(result.error || 'Failed to save changes'); + } + + // Patch only the edited metadata fields — never replace the whole + // document with the server row. `updateBaseballDocumentAction` returns + // the raw DB row, whose file_url is a signed URL persisted at + // upload/version time (no re-signing on update); a full-object replace + // would clobber the fresh signed URL already held in local state + // (from initial load's withFreshDocumentUrls / an upload / a version + // action) with a value that's likely already expired. + const updated = result.data; + setDocuments(prev => prev.map(d => (d.id === data.id + ? { + ...d, + title: updated.title, + description: updated.description, + category: updated.category, + is_player_visible: updated.is_player_visible, + } + : d + ))); + showToast('Document updated', 'success'); + setEditingDoc(null); + } + + function openVersionHistory(doc: BaseballDocument) { + setHistoryDoc(doc); + } + + function handleDocumentReverted(patch: DocumentVersionRevertPatch) { + setDocuments(prev => prev.map(d => (d.id === patch.id + ? { + ...d, + version_count: patch.version_count, + file_type: patch.file_type, + file_size: patch.file_size, + file_url: patch.file_url, + } + : d + ))); + showToast(`Reverted to version ${patch.reverted_to_version_number}`, 'success'); + } + + function openMoveModal(doc: BaseballDocument) { + setMovingDoc(doc); + } + + async function handleSaveMove(data: MoveToFolderSaveData) { + const result = await updateBaseballDocument({ id: data.id, folder: data.folder }); + + if (!result.success || !result.data) { + throw new Error(result.error || 'Failed to move document'); + } + + // Patch only the moved field for the same reason as handleSaveEdit above: + // never replace the whole document with the server's un-re-signed row. + const moved = result.data; + setDocuments(prev => prev.map(d => (d.id === data.id ? { ...d, folder: moved.folder } : d))); + showToast(data.folder ? `Moved to "${data.folder}"` : 'Removed from folder', 'success'); + setMovingDoc(null); + } + if (isRedesignEnabled()) { return (
@@ -148,11 +252,18 @@ export function DocumentsClient({ documents: initialDocuments, coachId, teamId, onCategoryChange={setCategory} isUploadingDocument={isUploadingDocument} onUpload={openUploadPicker} + uploadCategory={uploadCategory} + onUploadCategoryChange={setUploadCategory} + uploadIsPlayerVisible={uploadIsPlayerVisible} + onUploadVisibilityChange={setUploadIsPlayerVisible} activeDropdown={activeDropdown} setActiveDropdown={setActiveDropdown} onPreview={(d) => setPreviewDoc(d)} onUploadVersion={isCoach ? (d) => setVersionDoc(d) : undefined} onDelete={isCoach ? handleDelete : undefined} + onEdit={isCoach ? openEditModal : undefined} + onViewHistory={isCoach ? openVersionHistory : undefined} + onMoveToFolder={isCoach ? openMoveModal : undefined} fileInputSlot={ isCoach ? ( // eslint-disable-next-line helm/no-raw-input -- hidden native file picker (no design-system equivalent) @@ -185,6 +296,38 @@ export function DocumentsClient({ documents: initialDocuments, coachId, teamId, /> ) : null } + editSlot={ + isCoach ? ( + setEditingDoc(null)} + onSave={handleSaveEdit} + /> + ) : null + } + historySlot={ + isCoach ? ( + setHistoryDoc(null)} + onReverted={handleDocumentReverted} + /> + ) : null + } + moveSlot={ + isCoach ? ( + setMovingDoc(null)} + onMove={handleSaveMove} + /> + ) : null + } />
); @@ -245,6 +388,27 @@ export function DocumentsClient({ documents: initialDocuments, coachId, teamId, )}
+ {/* Upload-time picker — category + visibility applied to the next file selected */} + {isCoach && ( +
+
+ Next upload +
+ setInput(e.target.value)} - placeholder="Type a message..." - autoComplete="off" - className="flex-1 px-4 py-3 text-base lg:text-sm bg-cream-50 border border-border-light rounded-xl focus:outline-none focus:border-brand-500 focus:bg-white" - /> - -
-
- + +
+ + setInput(e.target.value)} + placeholder="Type a message..." + autoComplete="off" + aria-label="Message" + className="flex-1 rounded-fw-md bg-inset px-4 py-2.5 text-base text-text-primary placeholder:text-text-tertiary outline-none focus-visible:ring-2 focus-visible:ring-grade-plus lg:text-sm" + /> + + +
+
); } diff --git a/src/app/baseball/(dashboard)/dashboard/messages/page.tsx b/src/app/baseball/(dashboard)/dashboard/messages/page.tsx index 39d4b16fb..586e6a7a7 100644 --- a/src/app/baseball/(dashboard)/dashboard/messages/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/messages/page.tsx @@ -1,6 +1,6 @@ 'use client'; -import { Suspense, useState, useEffect, useMemo } from 'react'; +import { Suspense, useState, useEffect, useMemo, useRef } from 'react'; import { useSearchParams } from 'next/navigation'; import { cn } from '@/lib/utils'; import { Loading } from '@/components/ui/loading'; @@ -10,7 +10,7 @@ import { NewMessageModal } from '@/components/messages/NewMessageModal'; import { useConversations, useMessages } from '@/hooks/use-messages'; import { useAuthStore } from '@/stores/auth-store'; import { useToast } from '@/components/ui/sonner'; -import { createConversation } from '@/app/baseball/actions/messages'; +import { createConversation, getPlayerUserId } from '@/app/baseball/actions/messages'; import type { ConversationWithMeta } from '@/lib/types/messages'; import { getParticipantDetails } from '@/lib/types/messages'; import { MessagesFairway } from '@/components/baseball/messages/MessagesFairway'; @@ -20,6 +20,7 @@ function MessagesContent() { const searchParams = useSearchParams(); const conversationIdParam = searchParams.get('conversation'); const openNewParam = searchParams.get('new'); + const playerIdParam = searchParams.get('player'); const { showToast } = useToast(); const { user } = useAuthStore(); @@ -100,6 +101,62 @@ function MessagesContent() { } }; + // Guards the auto-start effect below against double-firing for the same + // player id (e.g. React StrictMode's dev-only mount/cleanup/remount cycle, + // or any other spurious re-run). Persists for the life of this component + // instance rather than being reset on cleanup, so a genuine StrictMode + // double-invoke is suppressed while a later visit with a *different* + // player id still fires normally. + const autoStartedPlayerRef = useRef(null); + + // Auto-start (or open) a conversation with a player when ?player= is in URL + // (e.g. from the Discover peek panel's "Message" action). + useEffect(() => { + if (!playerIdParam) return; + if (autoStartedPlayerRef.current === playerIdParam) return; + autoStartedPlayerRef.current = playerIdParam; + + // Strip the `player` param from the CURRENT history entry FIRST, using the + // raw history API synchronously -- not router.replace(), whose + // navigation is async and wouldn't guarantee this lands before + // handleNewConversation's own window.history.pushState() call (inside + // handleSelectConversation) reads window.location.href. + // + // Why the ordering matters: handleNewConversation() -> handleSelectConversation() + // calls window.history.pushState(...) using window.location.href AT THAT + // MOMENT. If `player` is still in the URL when that runs, it gets copied + // into the newly pushed history entry too -- and the entry underneath + // (pushed by DiscoverView's router.push('/messages?player=...')) also + // still carries it. Either way, pressing Back would land on a + // `?player=...` URL and re-fire this entire effect (duplicate + // getPlayerUserId/createConversation round-trips + a duplicate + // "Conversation started" toast, and a second Back press repeats the + // cycle -- a history trap). Stripping the param from the *current* entry + // before any of that runs means every entry involved ends up clean, so + // Back always lands on a URL with no `player` param. + const url = new URL(window.location.href); + url.searchParams.delete('player'); + window.history.replaceState({}, '', url); + + let cancelled = false; + + (async () => { + const resolvedUserId = await getPlayerUserId(playerIdParam); + if (cancelled) return; + + if (resolvedUserId) { + await handleNewConversation(resolvedUserId); + } else { + showToast('Could not start conversation with this player', 'error'); + } + })(); + + return () => { + cancelled = true; + }; + // eslint-disable-next-line react-hooks/exhaustive-deps + }, [playerIdParam]); + // Handle sending a message const handleSendMessage = async (content: string) => { if (!selectedConversationId) return false; diff --git a/src/app/baseball/(dashboard)/dashboard/my-stats/MyStatsClient.tsx b/src/app/baseball/(dashboard)/dashboard/my-stats/MyStatsClient.tsx index f18009d11..5e1a64e82 100644 --- a/src/app/baseball/(dashboard)/dashboard/my-stats/MyStatsClient.tsx +++ b/src/app/baseball/(dashboard)/dashboard/my-stats/MyStatsClient.tsx @@ -2,20 +2,20 @@ /** * MyStatsClient - * - * Player's personal stats dashboard showing their own performance data. - * Reuses existing player-stats components for consistent UI. + * + * Player's personal stats dashboard — Living Annual migration + * (design-system-living-annual.md §7; execution plan §3.1 my-stats). + * + * PRESENTATION ONLY: the `getMyStats()` / `getMyAggregates()` fetch, the + * loading/refreshing/error state machine, and every branch condition below + * are unchanged from the pre-migration client — only the JSX composing them + * is rebuilt from the kit. `player-stats/*` (4) + `season-stats/MySeasonStats` + * are migrated alongside this file; together they are the whole of my-stats + * (no overlap with the coach-facing Stats Center, which is its own surface). */ import { useState, useEffect } from 'react'; -import { Header } from '@/components/layout/header'; -import { PageLoading } from '@/components/ui/loading'; -import { - IconChart, - IconTrendingUp, - IconUser, - IconRefresh, -} from '@/components/icons'; +import { IconRefresh } from '@/components/icons'; import { Button } from '@/components/ui/button'; import { StatsOverviewCards, @@ -25,6 +25,15 @@ import { } from '@/components/baseball/player-stats'; import { MySeasonStats } from '@/components/baseball/season-stats/MySeasonStats'; import { getMyStats, getMyAggregates } from '@/app/baseball/actions/stats'; +import { fairwayScope } from '@/lib/redesign/flag'; +import { + SectionMasthead, + KPIContentsStrip, + InkBadge, + EditorsLetter, + EmptyIssue, + formatRate, +} from '@/components/baseball/living-annual'; import type { BaseballPlayerStats, BaseballPlayerAggregates } from '@/lib/types'; interface PlayerInfo { @@ -38,6 +47,24 @@ interface PlayerInfo { jersey_number: string | null; } +function MyStatsSkeleton() { + return ( +
+
+
+
+
+
+
+ {[0, 1].map((i) => ( +
+
+
+ ))} +
+ ); +} + export function MyStatsClient() { const [loading, setLoading] = useState(true); const [refreshing, setRefreshing] = useState(false); @@ -89,158 +116,107 @@ export function MyStatsClient() { }, []); if (loading) { - return ; + return ( +
+
+ +
+
+ ); } if (error) { return ( -
-
-
- -
-

Unable to Load Stats

-

{error}

- +
+
+ fetchData()}> + Try again + + } + />
); } - const fullName = player - ? `${player.first_name || ''} ${player.last_name || ''}`.trim() || 'Player' - : 'Player'; - const positions = player - ? [player.primary_position, player.secondary_position].filter(Boolean).join(' / ') - : ''; - - return ( -
-
- -
- {/* Player Header */} -
-
- {/* Player Avatar */} -
- {player?.avatar_url ? ( - {fullName} - ) : ( - - )} -
+ const fullName = player ? `${player.first_name || ''} ${player.last_name || ''}`.trim() || 'Player' : 'Player'; + const positions = player ? [player.primary_position, player.secondary_position].filter(Boolean).join(' / ') : ''; + const eyebrow = ['MY STATS', positions, player?.grad_year ? `Class of ${player.grad_year}` : null, teamName] + .filter(Boolean) + .join(' · '); + + const mastheadActions = ( +
+ {player?.jersey_number ? : null} + +
+ ); -
-
-

- {fullName} -

- {player?.jersey_number && ( - #{player.jersey_number} - )} -
-
- {positions && {positions}} - {positions && player?.grad_year && •} - {player?.grad_year && Class of {player.grad_year}} - {teamName && ( - <> - • - {teamName} - - )} -
-
-
+ const hasAnyData = stats.length > 0 || Boolean(aggregates); - -
+ return ( +
+
+ - {/* Season Stats from Box Scores (new system) */} -
+ {/* Season stats from box scores (new system) */} +
- {/* Quick Stats Summary */} - {aggregates && ( -
-
-
- -
-
-

Sessions

-

{aggregates.total_sessions}

-
-
-
-
- -
-
-

Trend

-

- {aggregates.recent_trend || 'N/A'} -

-
-
-
-

Practice AVG

-

- {aggregates.practice_avg?.toFixed(3) || '---'} -

-
-
-

Game AVG

-

- {aggregates.game_avg?.toFixed(3) || '---'} -

-
+ {/* Quick glance — sessions logged, trend, last-5 form. Practice-vs-game + and full career slash line live in their own dedicated cards below, + so this strip stays a 3-figure glance, not a duplicate of them. */} + {aggregates ? ( +
+
- )} + ) : null} - {/* Empty State */} - {stats.length === 0 && !aggregates && ( -
-
- -
-

No Stats Yet

-

- Your stats will appear here once your coach uploads session data. - Check back after your next practice or game! -

+ {!hasAnyData ? ( +
+
- )} + ) : null} - {/* Stats Overview Cards */} - {(stats.length > 0 || aggregates) && ( -
+ {hasAnyData ? ( +

Key Statistics

- )} + ) : null} - {/* Charts Grid */} - {stats.length > 0 && ( -
+ {stats.length > 0 ? ( +
@@ -248,14 +224,13 @@ export function MyStatsClient() {
- )} + ) : null} - {/* Session History */} - {stats.length > 0 && ( -
+ {stats.length > 0 ? ( +
- )} + ) : null}
); diff --git a/src/app/baseball/(dashboard)/dashboard/performance/page.tsx b/src/app/baseball/(dashboard)/dashboard/performance/page.tsx index a8f970e9d..c56bfac3e 100644 --- a/src/app/baseball/(dashboard)/dashboard/performance/page.tsx +++ b/src/app/baseball/(dashboard)/dashboard/performance/page.tsx @@ -25,6 +25,7 @@ import { createClient } from '@/lib/supabase/server'; import { fromUntyped } from '@/lib/supabase/untyped'; import { getActiveBaseballContext } from '@/lib/baseball/active-context'; import { resolveBaseballCapabilities } from '@/lib/baseball/capabilities'; +import { fairwayScope } from '@/lib/redesign/flag'; import { getPerformanceCommandData } from '@/lib/baseball/read-models/performance-command'; import { PerformanceCommandCenter } from '@/components/baseball/performance/PerformanceCommandCenter'; import { PerformanceDashboardClient } from '@/components/baseball/performance/PerformanceDashboardClient'; @@ -232,7 +233,19 @@ export default async function PerformancePage() { const teamName = (teamRow as { name?: string } | null)?.name ?? 'Team'; return ( -
+
+ {/* + ONE performance surface. The Command Center is the primary dashboard + (header + KPI strip + Today Weight Room board + readiness queue). The + prescribe/library management tools render BELOW it in `embedded` mode — + which drops the duplicate header, the duplicate KPI summary, and the + duplicate readiness list the Command Center already shows. Previously + both components rendered in full, stacking two "Performance" headers and + two readiness lists of the same roster on one page. + The embedded section is only worth rendering for coaches who can manage + lifting (Assignments/Library); a readiness-only coach already sees + everything in the Command Center. + */} - + {canManageLifting && ( + + )}
); } diff --git a/src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx b/src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx index a490fc486..ca038c2ef 100644 --- a/src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx +++ b/src/app/baseball/(dashboard)/dashboard/pipeline/PipelineClient.tsx @@ -1,34 +1,72 @@ 'use client'; -import React, { useState, useMemo, useEffect, useCallback, useRef } from 'react'; +/** + * ============================================================================ + * PipelineClient — THE WAR ROOM recruiting pipeline, composed from the + * "Living Annual" kit (spec: docs/baseball/design-system-living-annual.md; + * plan: docs/baseball/ui-migration-execution-plan.md §3.2 pipeline row). + * ---------------------------------------------------------------------------- + * PRESENTATION ONLY (P4.21.a). Same read/write paths as before — `useWatchlist`, + * the watchlist server actions, dnd-kit drag orchestration, and the keyboard + * navigation state machine are untouched. Only the chrome is re-skinned onto + * the kit (`RecruitCard`, `SectionMasthead`, `EmptyIssue`, `CommitSeal`, …). + * + * pipeline/page.tsx and the Fairway shell wiring are a separate task (W16) — + * this file keeps its existing default export shape (`export default function + * PipelinePage()`) so page.tsx keeps working unmodified. + * ========================================================================== */ + +import { useState, useMemo, useEffect, useCallback } from 'react'; +import type { KeyboardEvent as ReactKeyboardEvent, MouseEvent as ReactMouseEvent } from 'react'; import { useSearchParams, useRouter } from 'next/navigation'; -import { ShineEffect } from '@/components/ui/shine-effect'; -import { DndContext, DragEndEvent, DragOverlay, DragStartEvent, closestCorners, PointerSensor, useSensor, useSensors } from '@dnd-kit/core'; -import { Header } from '@/components/layout/header'; -import { PipelineColumn } from '@/components/features/pipeline-column'; -import { PipelineCard } from '@/components/features/pipeline-card'; -import { SkeletonPipeline } from '@/components/ui/skeleton'; -import { Button, IconButton } from '@/components/ui/button'; -import { Select } from '@/components/ui/select'; -import { EmptyState } from '@/components/ui/empty-state'; -import { Avatar } from '@/components/ui/avatar'; -import { ConfirmDialog } from '@/components/ui/confirm-dialog'; +import Link from 'next/link'; +import { + DndContext, + DragOverlay, + closestCorners, + PointerSensor, + useDraggable, + useDroppable, + useSensor, + useSensors, + type DragEndEvent, + type DragStartEvent, +} from '@dnd-kit/core'; +import { CSS } from '@dnd-kit/utilities'; +import { m, AnimatePresence, useReducedMotion } from 'framer-motion'; +import { + SectionMasthead, + Eyebrow, + PaperCard, + HairlineRule, + InkBadge, + StatReadout, + EditorsLetter, + EmptyIssue, + CommitSeal, + RecruitCard, + Reveal, + HoverReveal, + pressableClass, + EASE_SOFT, + PACE, +} from '@/components/baseball/living-annual'; +import { Button, IconButton, Select, Checkbox, Avatar, InlineNotice, Skeleton, TextArea } from '@/components/fairway'; import { PlayerDetailModal } from '@/components/coach/PlayerDetailModal'; import { PlayerPeekPanel } from '@/components/panels/PlayerPeekPanel'; import { PositionPlanner } from '@/components/baseball/position-planner'; -import { Badge } from '@/components/ui/badge'; -import { IconUsers, IconTrash, IconUser, IconLayoutGrid, IconList, IconTarget, IconEye, IconStar, IconCheck, IconX as IconXCircle } from '@/components/icons'; +import { ConfirmDialog } from '@/components/ui/confirm-dialog'; +import { IconUsers, IconLayoutGrid, IconList, IconTarget, IconTrash } from '@/components/icons'; import { useWatchlist } from '@/hooks/use-watchlist'; import { useAuth } from '@/hooks/use-auth'; import { useToast } from '@/components/ui/sonner'; -import { getFullName, cn } from '@/lib/utils'; +import { getFullName, getPipelineStageLabel, cn } from '@/lib/utils'; import { removeFromWatchlist, updateWatchlistStatus, - addWatchlistNote + addWatchlistNote, } from '@/app/baseball/actions/watchlist'; -import Link from 'next/link'; -import type { PipelineStage, Player } from '@/lib/types'; +import type { PipelineStage, Player, WatchlistWithPlayer } from '@/lib/types'; import { PIPELINE_STAGES } from '@/lib/recruiting/stages'; const gradYearOptions = [ @@ -40,8 +78,18 @@ const gradYearOptions = [ { value: '2029', label: '2029' }, ]; +/** Fairway ` v && onStatusChange(v as PipelineStage)} + options={statusOptions} + />
-
-

{stats.uninterested}

-

Not Interested

+ + + {formatDate(item.updated_at)} + + + {editing ? ( +
+