05/08 Updated code: fixed some issues 2

CLAUDE.md

@@ -620,7 +620,7 @@ phase1_projects_roles → phase6_features → phase7_mobile_api → phase8_notif
     → phase9_user_full_name → phase10_customer_password_setup → phase11_director_role
         → phase12_performance_indexes → phase_b_mobile_local_id
             → phase13_issue_facility → phase14_facility_created_at
-                → phase15_audit_log_indexes   ← HEAD
+                → phase15_audit_log_indexes → phase16_notifications_columns   ← HEAD
 ```
 
 ### phase_b_mobile_local_id
@@ -643,6 +643,10 @@ Uses direct `ALTER TABLE` + `INFORMATION_SCHEMA` check — safe to re-run.
 Adds individual indexes on `audit_logs.action` and `audit_logs.entity_type`.
 Uses `INFORMATION_SCHEMA.STATISTICS` existence checks — safe to re-run.
 
+### phase16_notifications_columns
+
+Ensures `digest_pending TINYINT NOT NULL DEFAULT 0` and `inspection_id INT NULL FK` exist on the `notifications` table. Both columns are defined in the model but were absent from any prior migration because the `notifications` table predates the chain. Uses `INFORMATION_SCHEMA` existence checks — safe to re-run.
+
 ### MySQL ENUM Change Protocol (3 steps — always follow)
 ```sql
 -- 1. Expand
@@ -749,7 +753,7 @@ timeout = 30
 | 12 | **`filter()` before `limit()`** | SQLAlchemy ordering requirement |
 | 13 | **Bulk queries in customer list** | Per-customer loops cause N+1 |
 | 14 | **Email in background thread** | Never block HTTP response |
-| 15 | **Open-redirect guards** | `_safe_next()` in auth.py; `_safe_referrer()` in customers.py |
+| 15 | **Open-redirect guards** | `safe_redirect_url()` in `app/utils/decorators.py` — the single canonical utility, imported by both `auth.py` and `customers.py` |
 | 16 | **`CREATE INDEX IF NOT EXISTS` not on MySQL < 8.0.12** | Use `INFORMATION_SCHEMA.STATISTICS` check |
 | 17 | **`batch_alter_table` is SQLite-only** | Use direct `ALTER TABLE` for MySQL migrations |
 | 18 | **Set `REDIS_URL` in production** | `memory://` is per-process; Gunicorn needs Redis for accurate shared counters |
@@ -768,6 +772,8 @@ timeout = 30
 | 31 | **Do NOT add an explicit `Issue.area` relationship** | `Area.issues` declares `backref='area'`, supplying `Issue.area` automatically. A second declaration on `Issue` raises `ConflictingBackreferences` at startup. The dependency is documented here; do not "fix" it by adding an explicit relationship. |
 | 32 | **Do not sync an issue when its parent `LocalInspection.syncStatus == "failed"`** | Submitting without `inspection_id` creates orphaned server records; mark issue `"failed"` instead |
 | 33 | **f-string fallback strings must use double-quotes inside single-quoted f-strings** | Python 3.11 raises `SyntaxError` on nested same-delimiter quotes; use `"\u2014"` not `'—'` inside `f'...'` |
+| 34 | **`computeScore` field ID must be cast explicitly: `String` → `as? String`, `Int` → `as? Int` then `String(n)`** | `Optional.map` on `Any?` returns `Optional(value)` not `value`; the old guard-let produced `"Optional(5)"` as the lookup key, so all integer-ID field scores were silently 0 |
+| 35 | **Strip `local://` photo paths from `formData` before `submitInspection`** | A failed photo upload leaves `"local://..."` in formData; `JSONSerialization` drops non-serialisable values silently, which is worse than an empty string on the server |
 
 ---