Follow-up to the badge fix: approving a speaker removed it from the
needs-check panel with no confirmation, which reads exactly like the
speaker being deleted. Reported as "the speaker advisor isn't shown now".
- A person-approved speaker now renders "✓ reviewed" with a tooltip saying
so. It previously rendered "✓ clear" whose tooltip claimed
"auto-accepted" - a false claim about a decision a machine never made.
- Approving confirms itself with a toast, drops the entry from the
worklist, and updates the header counts, all without a reload.
Separately, a pre-existing flake in tests/test_auth.py turned out to be a
real defect rather than test noise:
_session_secret() read the key file with .strip(), but bytes.strip()
removes ASCII whitespace from both ends. A secret beginning or ending
with one of those six bytes (4.35% of generated keys, measured) came back
one byte shorter on every read after the write - a different HMAC key,
silently, so a token signed before the flip could never be verified again.
Now read verbatim, with a length floor to reject a corrupt file.
That test also lacked the isolated_store fixture, so it read and rewrote the
real .umbra/session_secret - running the suite mutated production state.
This install's key is 32 bytes with no whitespace at either end, so no
existing session is invalidated by the fix.
Also verified: Advisor remains at display position 1 of 91 with its
utterance (utt 3668, ch15) intact - only the warning badge changed.
auth.py test flake 4/25 runs -> 0/30. Suite: 684 passed, 8 pre-existing.
2fda85f9d3