Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/icbe/src/actions/submit-elements.ts`:
- Around line 58-59: The code calls getProvenToSave(...) which ultimately uses
getUpdatedMetaInfo(...) but incorrectly passes type: "disproven", causing proven
submissions to persist as disproven; update the helper in
apps/icbe/src/utils/submit-elements.ts so getUpdatedMetaInfo(...) receives the
correct classification (e.g., type: "proven" or a value derived from the actual
submission result) when building the meta/history payload, and ensure
getProvenToSave and the call sites (getProvenToSave, saveToCloud) propagate that
corrected type so saved metadata reflects the true proven status.
- Around line 10-25: The authorization checks are using hard-coded values (role
and canSubmitElements) so submissions always throw; update the handlers in
submit-elements.ts to derive role and permissions from the request/session
context (e.g., use the incoming context or session object available to the
action) instead of setting const role = null and const canSubmitElements =
false, and use those real values in the existing if-blocks that throw
ActionError (retain the same error shapes). Locate the checks referencing role
and canSubmitElements in the file (also repeated around lines 40-55) and replace
them with lookups like context.session.role or an authorization helper that
evaluates whether the current user canSubmitElements.

In `@apps/icbe/src/components/dashboard/SubmitDisprovenElementsSection.tsx`:
- Around line 12-29: The result container currently only shows feedback when
props.state.status === "complete", so errors set as status === "error" (from the
submission paths) are not shown; update SubmitDisprovenElementsResultContainer
to render for both complete and error statuses (e.g., Show when
props.state.status === "complete" || props.state.status === "error") and use the
passed-in state.success or state.status to decide styling and message so
rejected submissions display an error message; ensure you reference the same
Show usage and the props.state value in the component.
- Around line 63-65: The textarea in SubmitDisprovenElementsSection.tsx forces
white text via the class "text-white" without a matching dark background, making
input unreadable on the default light textarea; update the textarea's class list
to either remove "text-white" (so it uses the default/OS colors) or pair it with
a dark background utility (e.g., add a bg-slate-800 or bg-gray-900 class and
appropriate focus/border classes) and ensure placeholder styling remains
visible; locate the <textarea> in the SubmitDisprovenElementsSection component
and adjust the class/className accordingly.

In `@apps/icbe/src/components/dashboard/SubmitProvenElementsSection.tsx`:
- Around line 41-67: In SubmitProvenElementsSection update the onInput handlers
so clearing a field does not write falsy placeholders into props.element: for
the steps handler (referencing props.element, props.baseElement, setElement,
steps) only set steps to Number(value) when e.currentTarget.value !== "" and
otherwise delete or omit the steps key from the base-element object (or set it
to undefined); similarly for the proof handler (proof, proof.url) if
e.currentTarget.value === "" remove the proof object (or set proof to undefined)
instead of writing an empty string—ensure you merge with the previous
base-element content so other fields are preserved.
- Around line 16-31: SubmitProvenElementsResultContainer only renders when
props.state.status === "complete", so users never see the error state set
elsewhere; update the Show condition to render for both completion and error
(e.g., props.state.status === "complete" || props.state.status === "error") and
change the error branch to display a specific message from the state (use
state.error or state.message if present, falling back to "Elements submission
failed.") so SubmitProvenElementsResultContainer and the SubmitState error
payload are visible to users.

In `@apps/icbe/src/layouts/Layout.astro`:
- Around line 18-21: The viewport meta in Layout.astro currently disables
pinch-zoom by setting maximum-scale and user-scalable; update the <meta
name="viewport"> tag used in Layout.astro to allow zooming (e.g., remove
maximum-scale and user-scalable attributes or set maximum-scale to a reasonable
value and user-scalable to yes) so mobile users can pinch-zoom and text scaling
is not blocked.

In `@apps/icbe/src/pages/admin/dashboard.astro`:
- Around line 5-7: The current check using Math.random() with Astro.redirect is
a placeholder and must be replaced with real auth: remove the Math.random()
condition and instead validate the incoming request's session/token (e.g., call
your auth helper such as getSessionFromRequest or verifyAuth against
Astro.request or Astro.locals) and check authorization (e.g., isAdmin or
requireAdmin); if the user is unauthenticated or not an admin, return
Astro.redirect("/login") or an appropriate denial response. Locate the
Math.random() usage and Astro.redirect call in the admin dashboard handler and
swap them for a call to your existing session/auth helpers (or add a new
requireAdmin(session) function) so only authorized admins can access the page.

In `@apps/icbe/src/pages/api/get-elements.ts`:
- Around line 6-9: Promise.all([getProvenData(), getDisprovenData()]) will
reject if either GitLab fetch fails; wrap the parallel calls in a try/catch (or
use Promise.allSettled) inside the API handler so that failures from
getProvenData or getDisprovenData are caught and the route returns a stable JSON
error payload (e.g., { error: true, message: "...", details?: ... }) with an
appropriate HTTP status instead of letting the framework throw; update the
handler that calls Promise.all to log the underlying error and return that
consistent JSON response.

In `@apps/icbe/src/pages/dashboard/index.astro`:
- Around line 5-7: The current guard using Math.random() in index.astro is a
placeholder and must be replaced with a real authentication/session check:
remove the Math.random() check and instead call your auth/session validation
(for example a getSessionFromRequest or verifySession/validateToken helper) to
determine if the user is authenticated, then if not authenticated call
Astro.redirect("/login") or the appropriate route; update any references in
apps/icbe/src/pages/dashboard/index.astro and ensure the logic uses the real
session/auth function (e.g., verifySession, getSession, isAuthenticated) rather
than Math.random(), and propagate user info into the page when auth succeeds.

In `@apps/icbe/src/utils/gitlab.ts`:
- Around line 1-15: The module currently imports GITLAB_ACCESS_TOKEN and
GITLAB_PROJECT_ID at module scope and constructs api = new Gitlab(...) which
causes a hard build-time dependency; change this to validate the presence of
GITLAB_ACCESS_TOKEN/GITLAB_PROJECT_ID via an optional env/schema check and
lazily initialize the Gitlab client only when needed (e.g., replace the
top-level api with a function like getGitlabClient() that returns null or throws
a controlled error when the env is missing), and update any code that uses api
to call getGitlabClient() first; keep BRANCH and BASE_DATA_DIR constants but
ensure functions that perform GitLab operations (those that reference api,
Gitlab, GITLAB_ACCESS_TOKEN, or GITLAB_PROJECT_ID) perform the runtime guard so
OSS builds succeed without private secrets.
- Around line 72-81: saveToCloud currently writes full-file updates blindly via
api.Commits.create which allows lost updates under concurrent requests; change
saveToCloud to perform optimistic concurrency: before creating the commit, fetch
the latest file contents (use api.RepositoryFiles.show or equivalent) for the
files updated by getUpdateAction, merge the caller's changes into that fresh
content, then attempt the commit and include an optimistic check (e.g., pass the
repository's current commit id/last_commit_id or verify file blob SHA if the
GitLab API supports it); on commit conflict (or non-matching last_commit_id),
retry the fetch/merge/commit cycle a few times before failing. Ensure you update
references to saveToCloud, getUpdateAction, api.Commits.create,
GITLAB_PROJECT_ID and BRANCH in the implementation so the merged data is always
based on the latest remote state.

In `@apps/icbe/src/utils/submit-elements.ts`:
- Around line 57-60: In getProvenToSave(), the call to getUpdatedMetaInfo(...)
incorrectly passes type: "disproven" so proven submissions update the wrong
counters; change the payload to pass type: "proven" when calling
getUpdatedMetaInfo (referencing the getProvenToSave function and the
getUpdatedMetaInfo helper) so the metadata/history branching uses the correct
"proven" branch and count value is accurate.
- Around line 79-84: The dedup logic in submit-elements (where existing,
elements and combined are built) only removes identical object references;
change it to deduplicate by the element.name property instead: produce a
combined array that preserves first instance per unique name (e.g., merge
existing then elements and filter by seen names using a Set of names) before
calling getUpdatedMetaInfo and computing count; update the variable combined
used with getUpdatedMetaInfo so count reflects unique names rather than object
identity.

In `@package.json`:
- Line 18: The "test" npm script currently runs "bun run test" which recursively
invokes itself; update the top-level "test" script to use Bun's workspace filter
like the existing "build:apps" pattern (use bun -F "apps/*" test or equivalent)
so it runs tests only in app workspaces, and change the apps/icbe package.json
"test" script to "bun test" to use Bun's native runner; locate the "test" script
in package.json and mirror the workspace filter approach used by "build:apps" to
prevent recursion.

---

Nitpick comments:
In `@apps/icbe/package.json`:
- Line 14: The package.json "test" script currently uses the wrapper invocation
"bun run test"; update the "test" script value to use the direct Bun command
"bun test" instead (edit the "test" entry in package.json) so the script invokes
bun test directly per Bun recommendations.

In `@apps/icbe/src/components/UserDashboard.tsx`:
- Around line 19-31: The UserDashboard currently hardcodes isAdmin = false which
makes the admin navigation unreachable; replace the hardcoded flag by deriving
admin status from real state (accept an isAdmin prop on the UserDashboard
component or call the app's auth/session hook to get the current user's roles)
and use that value in the existing Show conditional that wraps Divider/Link
(retain TopBar, Show and Link usage). Ensure the prop or session-derived value
is a boolean named isAdmin so existing conditional logic (Show when={isAdmin})
continues to work.

In `@apps/icbe/src/pages/dashboard/index.astro`:
- Line 9: The file currently hardcodes canSubmitElements = false which disables
the element submission UI; replace the hardcoded value with a proper feature
flag or config check (e.g., read from an environment/config value or a feature
toggle) where canSubmitElements is computed at runtime, or if the false value is
intentional for the public release add a clear inline comment next to the
canSubmitElements declaration explaining that it is intentionally disabled and
describing when/how it will be enabled (e.g., via ENABLE_ELEMENT_SUBMIT env var
or a backend-permission check) and reference the variable name canSubmitElements
in your change.

In `@apps/icbe/src/pages/index.astro`:
- Around line 6-8: The metadata variables title, description, and canonical are
set to null which yields missing meta tags; replace these nulls in the index
page by assigning sensible defaults or environment-driven values (e.g., a site
title string, a short description, and the canonical URL) or, if intentionally
left blank, add TODO comments next to the constants to make the intent explicit;
update the constants named title, description, and canonical so downstream
head/meta rendering has real values or clear TODOs.

In `@apps/icbe/src/utils/respond-json.ts`:
- Around line 3-10: The respondWithJSON function always forces status 200 and
fixed headers; change its signature (respondWithJSON<T extends JsonLike>(data:
T, options?: { status?: number; headers?: HeadersInit })) so callers can
override status and headers; merge default headers { "Content-Type":
"application/json" } with options.headers and use options.status || 200 for the
Response creation inside respondWithJSON to construct the Response with the
requested status and headers and return { response, data } as before.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@apps/icbe/src/utils/submit-elements.ts`:
- Around line 47-93: Extract a shared helper (e.g., buildSavePayload) to
centralize the common orchestration used by getProvenToSave and
getDisprovenToSave: the helper should accept (fetchExistingFn, elements,
typeTag, combineFn) or equivalent parameters, call the provided fetchExistingFn
and getElementsHistory() in parallel, produce the combined elements using the
combineFn (mergeProvenData for proven, Set-based dedupe for disproven), call
getUpdatedMetaInfo(oldHistory, { type: typeTag, count: combined.length }), and
return the SaveToCloudData payload; then refactor getProvenToSave to call
buildSavePayload(getProvenData, elements, "proven", mergeProvenData) and
getDisprovenToSave to call buildSavePayload(getDisprovenData, elements,
"disproven", (a,b)=>[...new Set([...a,...b)]).