Hygiene: stale API_INTEGRATION.md references, unpinned requirements.txt, shell-loader dedup gap, /audit naming overlap

[amar-python]

Grouped low-severity findings from a full-repo review — none urgent individually.

1. API_INTEGRATION.md references a layout that no longer exists

Mentions frontend/ (actual dir: csv-table-hub-main/) and tests/test_api.py (actually split into test_api_unit.py / test_api_integration.py / test_api_coverage.py per commit b35f7ec). Stale since the reorg.

2. Shell loaders don't dedupe sanitized column collisions

build/csv/loader_postgresql.sh (and siblings) sanitize CSV headers to ^[a-z_][a-z0-9_]*$ but don't dedupe collisions the way api/services/csv_parse.py::sanitize_columns() does (which bumps a numeric suffix). Two headers colliding after sanitization produce a CREATE TABLE with a duplicate column → raw Postgres error instead of a clean rejection. Lower priority since todos_2026-08-12.md itself notes this CLI tooling's active-use status is unclear.

3. api/requirements.txt pins only lower bounds

fastapi>=0.140.7, pydantic>=2.13.4, etc. — a fresh pip install isn't reproducible; a future major-version bump could break the API silently.

4. /audit frontend route vs. backend /api/audit/log — naming overlap, not the same data

csv-table-hub-main/src/routes/audit.tsx renders a static hardcoded developer changelog (src/lib/audit-log.ts). The backend's actual /api/audit/log endpoint (deletion history) and /api/te/tables are never called anywhere in the shipped frontend (grepped for fetch( across all of src/ — only one call site exists, in csv.functions.ts, and it only calls /api/csv/upload, /api/csv/files, /api/csv/tables/{}/rows). Given the README markets "Audit log" as a frontend feature, this is worth a naming/scope clarification even though nothing is functionally broken.

Severity

Low — hygiene and clarity, no functional risk.

[amar-python]

Fixed all four sub-items:

1. Stale API_INTEGRATION.md references — updated frontend/ → csv-table-hub-main/ (3 spots) and tests/test_api.py → test_api_unit.py/test_api_integration.py in the currently-actionable sections (run commands, test counts/table, CI note). Left the historical "Previous state / Resolution" narrative for finding Bump actions/upload-artifact from 4 to 7 #1 untouched since it accurately describes what was true at the time. Also corrected the test counts while I was in there — the old doc said 19 tests (9+3+7); it's actually 32 now (9+3+20), verified via pytest --collect-only.

2. Shell loader dedup gap — added the same collision-dedup logic sanitize_columns() uses (bump numeric suffix until unique) to both embedded Python sanitizers in build/csv/loader_postgresql.sh and build/csv/loader_mariadb.sh (2 occurrences each — COLUMNS list + CREATE TABLE). Verified standalone against the exact BUG-036 collision case: ["Foo","foo","foo_2"] → ["foo","foo_2","foo_2_2"], all unique. Confirmed no other loader_*.sh has this pattern (mariadb/postgresql only).

3. Unpinned requirements.txt — added upper bounds to all 6 deps in api/requirements.txt (next minor for the two pre-1.0 packages, next major for the rest), so a future breaking release can't silently slip in on a fresh install. Verified pip install -r api/requirements.txt still resolves cleanly against currently-installed versions.

4. /audit naming overlap — added a clarifying note to README.md above the Frontend Features table. Turns out the real picture was more nuanced than originally described: the "audit log" features (filters, bulk selection, retry, export) are real and functional, but read from browser localStorage (the client's own import history), not the backend's GET /api/audit/log endpoint (server-side deletion history, confirmed still never called by the frontend) — and audit.tsx also renders a small, separate, hardcoded developer changelog widget alongside that. Three different things were sharing the word "audit"; now documented.

Verified: lint clean, health-check dashboard 86/86, full backend suite green, both edited shell scripts pass bash -n.