Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/admin/dashboard/static/js/dashboard.js`:
- Around line 285-318: fetchModels can let a stale response mutate shared state;
ensure you verify the request controller is still current before calling
handleFetchResponse, changing this.models, or toggling auth/error state. After
obtaining the controller (via _startAbortableRequest) and again immediately
after awaiting fetch() and res.json(), check that controller is the current
active controller (e.g., compare controller === this._modelsFetchController or
call controller.signal.aborted) and return early if not; only then call
handleFetchResponse, assign this.models and call syncDisplayModels. Also apply
the same current-controller check in the catch block (besides _isAbortError)
before mutating state, and keep using
_clearAbortableRequest('_modelsFetchController', controller) in finally.

In `@internal/admin/dashboard/static/js/modules/contribution-calendar.js`:
- Around line 10-40: The current fetch flow allows stale requests to overwrite
state because it doesn't verify the controller is still the active one; ensure
only the active request (the controller returned by _startAbortableRequest) may
change calendarLoading, calendarData, or call _clearAbortableRequest. Update the
logic in the async function that uses
_startAbortableRequest('_calendarFetchController') so that before calling
handleFetchResponse, before assigning this.calendarData, and before clearing the
controller or toggling this.calendarLoading, you check the returned controller
is strictly equal to this._calendarFetchController (and still not aborted). Also
only call _clearAbortableRequest('_calendarFetchController', controller) when
that equality holds; keep the existing _isAbortError check for thrown aborts.

In `@internal/admin/dashboard/static/js/modules/timezone.js`:
- Around line 101-104: The guard in formatTimestampInTimeZone incorrectly treats
0 as missing; change the check from a falsy test to an explicit null/undefined
check (e.g., ts === null || ts === undefined) so epoch value 0 is accepted;
update the guard inside formatTimestampInTimeZone to only return '-' for
null/undefined inputs and leave numeric 0 to be formatted normally.
- Around line 11-13: The browserStorage() accessor and any code that calls
storage methods (e.g., saveTimeZone, loadTimeZone, clearTimeZone) must defend
against DOMException by wrapping all accesses to localStorage and its methods
(getItem, setItem, removeItem) in try-catch blocks; update browserStorage() to
return null if accessing global.localStorage throws, and wrap every call site
that uses storage (calls through browserStorage()) so failures safely fall back
to no-op behavior and do not throw (log or ignore the error as appropriate) to
preserve timezone initialization, saving, and clearing flows.

In `@internal/usage/reader_sqlite.go`:
- Around line 161-175: The query comparisons rely on lexicographic ordering of
the TEXT timestamp column but some rows use a space-separated offset format that
sorts before the RFC3339 "T" form; update sqliteDateRangeConditions and
sqliteGroupingRange to compare a normalized timestamp expression (e.g.
REPLACE(timestamp, ' ', 'T')) instead of raw timestamp, and ensure
sqliteTimestampBoundary returns a strictly RFC3339-"T" formatted boundary (use
UTC/.Format(sqliteTimestampBoundaryLayout) or otherwise force the 'T' separator)
including usageEndExclusive where used; also audit parseUsageTimestamp to
normalize parsed values to the canonical "T" form if they are ever re-written or
used for MIN/MAX computations so MIN(timestamp)/MAX(timestamp) and range filters
behave correctly on mixed-format data.

---

Outside diff comments:
In `@internal/admin/dashboard/templates/index.html`:
- Around line 1013-1021: The button with class "audit-conversation-trigger" that
uses x-show="canShowConversation(entry)" and
`@click.stop.prevent`="openConversation(entry, $el.closest('details'), true, $el)"
lacks an explicit type and thus may act as a submit button; update that <button>
to include type="button" to prevent unintended form submissions when clicked
while keeping existing attributes and behavior.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@internal/usage/reader_sqlite.go`:
- Around line 163-165: The current sqliteTimestampExpr() returns a
text-normalized timestamp and causes lexicographic ordering errors; change it so
comparisons use epoch seconds (e.g., return an expression using
unixepoch(REPLACE(timestamp, ' ', 'T'))), then update all
consumers—sqliteDateRangeConditions(), sqliteGroupExpr() CASE branches, and
sqliteGroupingRange() min/max expressions—to use that epoch expression for all
comparisons and ordering (keep original timestamp string only when emitting
values, but use unixepoch(...) for range checks, CASE routing, and MIN/MAX
derivation) so ordering is absolute-time based across timezones.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/admin/dashboard/static/css/dashboard.css`:
- Around line 345-352: The CSS removed the .content.content-collapsed rule but
the template and JS still toggle the content-collapsed contract (see layout.html
and dashboard.js) and tests expect it; either restore a dedicated collapsed rule
for .content (e.g., define .content.content-collapsed with the intended
collapsed width/margins/transitions) or remove the toggling and update tests to
match the new layout contract—pick one approach, update the CSS (.content or
.content.content-collapsed), and ensure layout.html,
internal/admin/dashboard/static/js/dashboard.js, and the layout test are all
consistent with that choice.
- Around line 108-119: The .sidebar rule currently uses position: sticky with
height: 100vh which prevents internal scrolling and can clip lower controls;
update the .sidebar CSS (the .sidebar selector) to allow internal scrolling by
replacing rigid height with a max-height (e.g. max-height: 100vh or compute
using top/bottom), add overflow-y: auto, and ensure sticky positioning remains
(keep top: 0) so the sidebar stays fixed while its contents can scroll; preserve
existing transitions like transition: flex-basis 0.2s, width 0.2s.

In `@internal/admin/dashboard/static/js/modules/charts.js`:
- Around line 146-151: The code constructs `end` with new
Date(this.customEndDate) which is inconsistent with the UTC-safe helpers; change
the `end` creation to use the same date-key helpers (use
`dateToDateKey`/`dateKeyToDate`) so both custom and default paths go through
`dateKeyToDate` for UTC-consistent parsing; update the `end` assignment (and
keep existing `start` logic) to derive a date key from `this.customEndDate` or
`this.todayDate()` and convert it with `dateKeyToDate` (referencing
`customEndDate`, `todayDate`, `dateToDateKey`, `dateKeyToDate`,
`addDaysToDateKey`, and `days`).

In `@internal/admin/dashboard/static/js/modules/dashboard-layout.test.js`:
- Around line 10-15: The readCSSRule function's regex is brittle for CRLF and
indented closing braces; update the pattern used in new RegExp inside
readCSSRule (which uses escapedSelector and match) to be newline-agnostic and
allow optional whitespace before the closing brace — e.g. keep the non-greedy
body capture ([\s\S]*?) but replace the trailing `\n\}` requirement with `\s*\}`
(and use `\r?\n` if you need explicit linebreaks) so the regex matches rules
regardless of CRLF/LF or indentation.

In `@internal/admin/dashboard/templates/layout.html`:
- Line 11: The three external script tags loading Chart.js
(https://cdn.jsdelivr.net/npm/chart.js@4.5.0/dist/chart.umd.min.js), Alpine.js,
and HTMX in internal/admin/dashboard/templates/layout.html lack Subresource
Integrity and crossorigin attributes; update each <script> element to include a
correct integrity="sha384-..." SRI hash for the exact file version and add
crossorigin="anonymous" (or replace with a self-hosted copy), verifying the
hashes match the served files; ensure you update the Chart.js, Alpine.js and
HTMX script tags consistently so the template uses integrity + crossorigin for
all CDN scripts.

In `@internal/usage/reader_sqlite.go`:
- Around line 161-179: GetUsageLog() still orders/paginates by the raw
"timestamp" causing inconsistent ordering with mixed formats; change its ORDER
BY to use the same normalized epoch expression used in
sqliteDateRangeConditions() (i.e. sqliteTimestampEpochExpr() built from
sqliteTimestampTextExpr()) and add a stable tiebreaker (e.g. id or rowid) to the
ORDER BY so results are consistently ordered for LIMIT/OFFSET pagination.
- Around line 397-409: parseUsageTimestamp is unused and duplicates parsing
logic in GetUsageLog; either remove the helper or replace the duplicate parse
chain in GetUsageLog to call parseUsageTimestamp(ts). If you choose reuse,
update GetUsageLog to call parseUsageTimestamp for all timestamp parses and
ensure the existing slog.Warn still includes the request_id context (preserve
the "request_id" key/value when logging the failed parse) so log output remains
identical. Remove any now-unused imports/variables if you delete the helper.

In `@internal/usage/store_sqlite.go`:
- Around line 74-77: The retention delete uses the raw text column causing
incorrect ordering for legacy rows; change the DELETE SQL that currently uses
"timestamp < ?" to compare the normalized/epoch expression instead, e.g. use
"unixepoch(REPLACE(timestamp, ' ', 'T')) < unixepoch(?)" (or equivalent) so it
matches the index created and ensures correct retention semantics for both
space- and 'T'-separated timestamps; update the SQL string where the delete is
executed (the DELETE FROM usage WHERE timestamp < ? statement) and ensure the
bound parameter is passed in a compatible timestamp/ISO format or converted with
unixepoch(?) as well.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/admin/dashboard/static/js/modules/timezone-layout.test.js`:
- Around line 19-33: The assertions are fragile because they depend on attribute
order and exact markup; update the tests to assert each binding/element
independently (e.g. check existence of x-ref="timezoneOverrideSelect",
x-model="timezoneOverride", and x-effect containing "timezoneOptions.length;
timezoneOverride" as separate matches) or parse the template fragment into a DOM
and assert attributes via selectors (for class="settings-panel-header" and its
x-data, button with class timezone-help-toggle and its `@click`, span with x-text
expression, p#timezone-help-copy with x-show and x-transition,
x-text="calendarTimeZoneText()", presence of usage-ts and audit-entry-meta
elements with formatTimestamp(...) and :title="timestampTitle(...)", and the
button with class audit-conversation-trigger and type="button"); remove combined
regexes like the compound select/option patterns and replace them with
per-attribute or per-element checks so tests are order-independent.

In `@internal/admin/dashboard/templates/index.html`:
- Around line 234-235: The help text inside the element with id
"timezone-help-copy" incorrectly says log rows render in the browser timezone;
update the copy to state that usage/audit rows render in the "effective
timezone" (since formatTimestamp() uses the effective timezone when an override
is set). Change the string in the template to mention "effective timezone" and
update the related fixture/test expectation to match the new wording so tests
assert the updated help copy.

---

Duplicate comments:
In `@internal/admin/dashboard/static/css/dashboard.css`:
- Around line 108-119: The .sidebar container is sticky with height: 100vh so
its contents can be clipped on small viewports; make the sidebar scrollable by
adding vertical overflow (e.g., set overflow-y: auto and optionally
-webkit-overflow-scrolling: touch) to the .sidebar rule so extra items and
footer controls can scroll inside the fixed sidebar while preserving its sticky
positioning and transitions.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@internal/usage/reader_sqlite.go`:
- Line 110: The ORDER BY currently uses sqliteTimestampEpochExpr() which
truncates fractional seconds; update sqliteTimestampEpochExpr() to return an
epoch expression that preserves fractional seconds (for example compute epoch
from julianday(timestamp) so the fractional part is kept, e.g.
(julianday(<timestamp_column>) - 2440587.5) * 86400.0) so the ORDER BY ... DESC,
id DESC line uses a real-valued epoch with sub-second precision; then add a
regression test that inserts two rows within the same second but with different
fractional parts and asserts the more-recent fractional timestamp sorts first.