Address remaining low-severity code review findings (#31, #32, #34, #36, #38, #39, #41, #42, #44, #47, #48)

[pambrose]

Addresses the remaining 11 open low-severity findings from the multi-agent code review (docs/CODE_REVIEW_JUNE_2026.md), bringing it to 48 of 48 addressed.

Findings fixed

Reliability / correctness

• 1.19.0 #31 extractJavaFunction — accept ChallengeName and guard the < 2 static case with a named error instead of an opaque NoSuchElementException/IllegalArgumentException during content load.
• 2.1.1 #47 pythonAdjust/parseListElements — quote-aware splitTopLevelCommas tokenizer so commas inside quoted list elements no longer split; unquote both single and double quotes.
• 1.28.0 #39 Background content load — wrapped in runInitialContentLoad, which catches and logs failures (with stack trace) so a load exception no longer leaves the server permanently "not ready".
• Migrate authentication from form-based to OAuth #48 evalContent — log the failing contentSource.source instead of $this.

Resource / performance

• 1.25.0 #36 geoInfoMap — bounded LRU cache (MAX_GEO_CACHE_SIZE); transient API failures persist a blank placeholder row (so the server_requests.geo_ref FK resolves) but are kept out of the in-memory cache so they retry instead of being permanently poisoned.
• 1.27.0 #38 Request logging — coalesced session lookup, geo-id resolution, and insert into a single transaction (geo HTTP lookup stays outside), cutting per-request pool checkouts from 3-4 to one.
• 1.20.0 #32 Per-user answer channels — replaced the unbounded ConcurrentHashMap<userId, Channel> with a fixed-size worker pool keyed by userDbmsId, preserving per-user serialization.

Error handling / design

• 1.23.0 #34 WS validation failures now log the cause and close with VIOLATED_POLICY (shared WsCommon.rejectInvalidWsRequest) instead of a generic GOING_AWAY, across all four teacher-facing handlers.
• 1.30.0 #41 Extracted PageUtils.wsHostRewriteJs() (6 origin-rewrite sites) and summaryOnMessageJs() (Class/Student summary onmessage loops); fixed a misaligned brace.
• 1.31.0 #42 Split displayStudentProgress into a data pass (EnrolleeProgress, answerHistoryBulk out of the render loop) and a pure render pass; extracted server-side color helpers.
• 1.35.0 #44 Safe per-property init guard: isInitialized() = global flag OR this property individually set (strictly more permissive than the old global flag). The full per-property throwing guard remains declined as unsafe; no functional bug.

Tests

New Kotest specs run locally: JavaFunctionExtractTest, PythonListTokenizerTest, InitialContentLoadTest, GeoCacheBoundedTest, UserAnswerQueueTest, PageUtilsWsTest, PropertyInitGuardTest. DB-backed GeoCacheTest updated for the new failure semantics (verified on CI).

Also: review-doc reorg (CODE_REVIEW_SUGGESTIONS.md → CODE_REVIEW_MARCH_2026.md, findings → CODE_REVIEW_JUNE_2026.md) and an OAuthSessionRotationTest tidy.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 45.66929% with 69 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
.../main/kotlin/com/readingbat/pages/ChallengePage.kt	0.00%	37 Missing ⚠️
...e/src/main/kotlin/com/readingbat/server/GeoInfo.kt	66.66%	2 Missing and 4 partials ⚠️
...rc/main/kotlin/com/readingbat/server/Intercepts.kt	0.00%	6 Missing ⚠️
.../src/main/kotlin/com/readingbat/common/Property.kt	63.63%	1 Missing and 3 partials ⚠️
...in/kotlin/com/readingbat/pages/ClassSummaryPage.kt	0.00%	2 Missing ⚠️
.../kotlin/com/readingbat/pages/StudentSummaryPage.kt	0.00%	2 Missing ⚠️
...c/main/kotlin/com/readingbat/server/ws/WsCommon.kt	0.00%	2 Missing ⚠️
...ain/kotlin/com/readingbat/dsl/ReadingBatContent.kt	0.00%	1 Missing ⚠️
.../kotlin/com/readingbat/pages/ChallengeGroupPage.kt	0.00%	1 Missing ⚠️
.../src/main/kotlin/com/readingbat/pages/ClockPage.kt	0.00%	1 Missing ⚠️
... and 7 more

📢 Thoughts on this report? Let us know!