Review follow-ups to the merged backlog batches (#293/#294)

[richardmhope]

Summary

An adversarial re-review of the two merged backlog PRs (#293, #294) surfaced three defects, all in the newest code. One commit, all three fixed with regression tests. No tracked issues — these are review findings on already-merged work.

Changes

• Transition flush is not a flush when a save is in flight (tags.js, gap in the Report publish/transition races the 1.2s autosave debounce, can freeze stale content into the immutable snapshot #278 fix — medium). saveNow() with a save already running returns that promise, whose FormData snapshot predates any keystrokes typed since it started, and merely queues a follow-up. The single await therefore narrowed the publish race from the 1.2 s debounce to one save RTT without closing it — and the queued follow-up save is a plain fetch (no keepalive) that navigation aborts, so nothing self-heals. Same consequence as the original bug: pre-edit text frozen into the immutable snapshot. submitTransition now repeats the flush (bounded at 5 attempts) until nothing is dirty or in flight, clears the re-armed timer and queued flag so no doomed fetch fires into the navigation, and refuses the transition if it exits the loop still dirty.
• /admin/config 500s on a malformed URL-shaped value (effective_config.py, hardening of the /admin/config leaks credential-bearing URLs (inline proxy creds, Slack webhook URL) despite 'never their value' promise #273 fix — low). The new _scrub_userinfo / _origin_only helpers called urlsplit(...) and .port unguarded; urlsplit raises on an unbalanced IPv6 bracket and .port on a non-numeric or out-of-range port. A typo'd proxy or webhook URL crashed exactly the page an operator opens to see their broken config. Parse failures are now caught, and an unparseable URL-ish value that may carry a credential which cannot be safely carved out is hidden wholesale ((unparseable URL — value hidden)) — failing toward redaction, consistent with /admin/config leaks credential-bearing URLs (inline proxy creds, Slack webhook URL) despite 'never their value' promise #273's deny-by-default posture.
• Stale queued-save flag after a 409 (tags.js, polish of the Report editor: stale-write 409 is silent and unrecoverable under the one-save model #271 fix — nit). A save queued behind the one that hit the optimistic-lock conflict survived recovery and fired one redundant re-post of the same stale version. The 409 branch now drops the flag so recovery starts clean.

Noted in review but deliberately unchanged: the NO_PROXY decision for OIDC uses the discovery URL's host for all three outbound calls (true for all four supported IdPs, documented assumption); the roles app-claim allowlist in the #269 fix is name-based (claim naming is operator-controlled config, the intended trust boundary); and applyAiReportFields shares the in-flight-snapshot staleness, but its queued follow-up save self-heals since nothing navigates away.

Testing

• uv run pytest passes — 669 passed, 16 skipped
• Static gates pass — ruff, bandit, mypy, vulture, djlint all clean
• Added/updated tests (a bug fix includes a regression test)

New tests: the flush-loop contract (bounded repeat while dirty/in-flight, timer + queued-flag cleanup, refuse-when-still-dirty ordering); malformed proxy/webhook URLs neither crash snapshot() nor leak the embedded password, on both the env and DB rows; non-URL values with an @ (the dev-login email) still render; and the 409 branch clearing the queued flag.

Standing caveat from the parent PRs: biome lint and the assets drift job run only in CI (not available in the dev sandbox). Only JS/CSS-comment-level changes here — no new Tailwind utilities.

Checklist

• Docs updated — ARCHITECTURE.md (the Report publish/transition races the 1.2s autosave debounce, can freeze stale content into the immutable snapshot #278 flush sentence now describes the repeat-while-in-flight behaviour), CHANGELOG.md
• Migration added if a model changed — n/a, no model changed
• Security-sensitive changes are called out above with their reasoning — the redaction hardening fails toward hiding the value, never toward echoing it

🤖 Generated with Claude Code

https://claude.ai/code/session_01LQpYwRbt1YhpTXPb46MR5v

---

Generated by Claude Code