nightly: 3 production fixes (2026-05-29)

[njrini99-code]

Nightly Health-Check — 2026-05-29

Daily brief

24h totals (production)

• Total error events (Sentry): 23 across 6 distinct issue groups
• Distinct patterns (≥2 events): 4
• Affected users: 0 unique signed-in users tagged (errors are anonymous-session captures from the signup/dashboard surfaces)
• Vercel runtime errors (level=error|fatal, last 24h): 0
• Vercel 5xx responses (last 24h): 0
• Failed Vercel deploys (status=Error, last 24h): 0 — there are CANCELED deploys but those are normal supersessions when a newer commit lands on the same branch before the previous build finishes (PRs fix(a11y): W3D — IconButton sm tap target 44px + one semantic h1 per dashboard page #167, fix(responsive): W4C — sidebar at md + 2xl wide containers (iPad portrait) #169, fix(responsive): W4D — admin tables + WeekView get mobile card fallback #172, docs: regen inventory blocks #159). No build-failure deploys.
• Cron health: /api/cron/v3/standing-refresh and /api/cron/coachhelm-roster-sweep both 200. Two warnings from pattern-miner.thresholds (excluded per policy — tunable info logs).

Top patterns (Sentry, last 24h)

Rank	Issue	Events	Severity	Route / Action	Diagnosis
1	JAVASCRIPT-NEXTJS-2M — [Golf Auth Error]: Password is known to be weak and easy to guess…	12	error	POST /golf/signup	Supabase's leaked-password protection rejects breached passwords; signupAction was hitting the unknown-error branch and paging Sentry via logServerError instead of returning a form-level error.
2	JAVASCRIPT-NEXTJS-2N — ReferenceError: Can't find variable: Notification	5	error	/golf/dashboard (iOS WKWebView)	use-service-worker.ts:144 reads Notification.permission without checking the API exists — fails in iOS Safari WKWebView contexts where the Notification global is absent.
3	JAVASCRIPT-NEXTJS-2F — \DialogContent` requires a `DialogTitle`…`	4	error	/golf/dashboard (iOS WKWebView)	PushPermissionSoftAsk auto-opens 2s after dashboard paint via a vaul <DrawerContent> (Radix Dialog underneath) but renders a plain <h2> instead of <DrawerTitle>, so Radix's a11y check pages console.error → Sentry.
4	JAVASCRIPT-NEXTJS-3 — Hydration Error	2	error	/golf/dashboard/rounds	Pre-deploy artifact (URL is a preview deployment helmv3-o01gtzgfn-…), not the production alias. Tracking only.
5	JAVASCRIPT-NEXTJS-2Q — An unexpected response was received from the server.	1	error	/golf/dashboard/my-qualifiers	Single-occurrence transient — skipped per policy.
6	JAVASCRIPT-NEXTJS-2P — same shape as #5	1	error	/golf/dashboard/my-qualifiers	Single-occurrence transient — skipped per policy.

Performance (pg_stat_statements)

Not collected — the Supabase MCP authentication flow failed in this remote-execution sandbox (HTTP 403: Host not in allowlist). Recommend running /mcp interactively to re-authorize so future nightlies can pull admin_events, error_logs, and pg_stat_statements. No Vercel runtime errors point at slow queries, so DB health is not a blocker for tonight's fixes.

Deployment health

Time	SHA	Status	Notes
03:28 UTC	efbfe8d	READY	#191 — coachhelm chat team-context fix
02:29 UTC	aa879ca	READY	#190 — coachhelm chat direct Anthropic provider
02:08 UTC	572f8e0	READY (promoted)	#189 — WhatIfPanel onSimulate wire-up

No failed deploys.

---

Fixes applied

1. fix(sw): guard Notification reference for iOS WKWebView — [JAVASCRIPT-NEXTJS-2N]

• File: src/hooks/golf/use-service-worker.ts:144
• Pattern: ReferenceError: Can't find variable: Notification × 5 (iOS Safari WKWebView)
• Diagnosis: Reading Notification.permission unconditionally. iOS Safari WKWebView (Capacitor) drops the Notification global. The sibling requestPushPermission callback below was already guarding via 'Notification' in window — apply the same guard at line 144 before reading .permission.

2. fix(auth): treat Supabase weak-password rejection as form error, not Sentry trace — [JAVASCRIPT-NEXTJS-2M]

• File: src/app/golf/actions/auth.ts:241-267
• Pattern: [Golf Auth Error]: Password is known to be weak… × 12 (POST /golf/signup)
• Diagnosis: Supabase's HaveIBeenPwned-backed leaked-password protection rejects breached passwords. The local validatePassword doesn't know about HIBP, so these reach Supabase, get rejected, and fall through to the logServerError(...) unknown-error branch, paging Sentry. Add an explicit branch that matches weak_password / "Password is known to be weak" / "Password should…" and returns a form-friendly error inline without Sentry capture.

3. fix(a11y): give PushPermissionSoftAsk a DrawerTitle — [JAVASCRIPT-NEXTJS-2F]

• File: src/components/golf/PushPermissionSoftAsk.tsx:98-100
• Pattern: \DialogContent` requires a `DialogTitle`… × 4 (/golf/dashboard`, iOS WKWebView)
• Diagnosis: PushPermissionSoftAsk mounts on the (dashboard) layout and opens its vaul <Drawer> 2s after first paint. Vaul wraps Radix Dialog, which emits a console.error (captured by Sentry) when no DialogTitle exists in the subtree. The component already had a visible <h2>Stay in the loop</h2> — promote it to <DrawerTitle> (zero visual change, fixes the a11y contract).

---

Verification

• npx tsc --noEmit — passes (no new errors).
• No related Vitest suites for the three touched files.
• No DB migrations created (none required).

Open work the human should pick up

• Supabase MCP auth — sandbox-allowlist block prevented pulling admin_events, error_logs, pg_stat_statements. Re-auth via /mcp to restore DB-side triage.
• JAVASCRIPT-NEXTJS-3 Hydration Error on /golf/dashboard/rounds — only 2 events and the captured URL is a preview deployment (helmv3-o01gtzgfn-…), not a production alias. If it recurs against the production alias, root-cause it; for now it's tracked, not patched.
• JAVASCRIPT-NEXTJS-2P / 2Q (my-qualifiers server response error) — single-occurrence transients today; if they cluster tomorrow, dig into the qualifier-entries server action.

https://claude.ai/code/session_01L5eAwNgYRoWeDj5WZ74zJt

---

Generated by Claude Code

[greptile-apps]

njrini99-code has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7b0efacc-57d9-4e7a-b308-eb50a13a80db

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

💥 Parsing errors (1)

Validation error: Too big: expected string to have <=250 characters at "tone_instructions"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nightly-health-check/2026-05-29

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}