Codebase review: CODE_REVIEW.md + Phase 1 critical fixes

[Copilot]

Full review of all Kotlin sources across all 5 platforms, producing a prioritised issue report and fixing all XS-effort items immediately.

CODE_REVIEW.md

Documents 19 issues with severity, effort (XS–XL), and a RICE-scored fix order. Four-phase remediation plan included.

Severity	Count	Top examples
Critical	4	iOS/JS/WASM build failure, crash-risk !!, main-thread block, audio scheduler race
High	4	Incomplete clearAll(), GlobalScope leaks, dropped audio cues, no tests
Medium	6	Unsafe cache writes, leaked storageScope, JVM singleton bug, silent swallowed exceptions
Low	5	Dead scaffold code, deprecated field, println logging, no-op catch-rethrow

Phase 1 fixes applied (all XS effort)

Build failure — missing actual fun cleanup() (iOS / JS / WASM)

expect class SoundPlayer declares cleanup() but all three web/Apple actuals omitted it, preventing compilation on those targets.

// Added to SoundPlayer.ios.kt, .js.kt, .wasmJs.kt
actual fun cleanup() {
    player?.stop()
    player = null
}

Crash risk — activeGameId!! in ViewModel

Two analytics calls asserted non-null on a String? field; replaced with safe fallback.

- "game_id" to currentState.activeGameId!!
+ "game_id" to (currentState.activeGameId ?: "")

Data integrity — clearAll() only removed rounds

The other four storage keys (games, configured time, active game ID, settings) were left behind, leaving storage in a partially-reset state.

Data integrity — optimistic cache write in saveRounds()

cachedRounds was updated before saveString() succeeded, so a serialisation or I/O failure left the in-memory cache ahead of persisted state. Cache update moved to after the write.

Code quality — deprecated selectedType in TimerState, scaffold files, no-op catch-rethrow

• Removed val selectedType (marked deprecated, never read; ignoreUnknownKeys = true handles old JSON).
• Deleted Greeting.kt, Platform.kt, and all Platform.*.kt actuals (unused KMP template boilerplate).
• Removed catch (e) { throw e } blocks in PlatformStorage.android.kt.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -Xmx4096M -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -cp /home/REDACTED/.gradle/wrapper/dists/gradle-8.14.3-bin/cv11ve7ro1n3o1j4so8xd9n66/gradle-8.14.3/lib/gradle-daemon-main-8.14.3.jar (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.