fix: address post-audit review findings across docs and source

Docs:
- Add pre-remediation snapshot headers to doc-audit.md and eval.md
- Annotate remediated items (PlayerStats, GameState, SQL injection,
coverage threshold, pre-commit hooks) with current status
- Fix markdown checkbox spacing in Phase-2.md
- Add language identifiers to fenced code blocks in Phase-0.md, Phase-4.md
- Fix test class reference in Phase-3.md pytest command
- Vary verbs in Phase-1.md verification steps

Source:
- Update stale "database" error text in pages/2_play_game.py
- Handle empty-after-strip in validation, tighten regex to literal space
- Remove unnecessary FileNotFoundError from connection.py except block
- Fix compile_model.py type hints (str | float for mixed rows)
- Add get_home_team_df to src/state/__init__.py exports
- Clarify DifficultySettings.from_preset fallback with comment

Tests:
- Fix literal backslash-n to real newline in test_validation.py
- Remove unused fixture param from test_combined_contains_both_teams
- Fix test_state.py re-import pattern, add None/wrong-length edge cases

docs/plans/2026-03-25-audit-streamlit-nba/Phase-0.md

@@ -48,7 +48,7 @@ The app reads from a local CSV via pandas. There is no SQL database. The SQL inj
 
 Use conventional commits:
 
-```
+```text
 type(scope): brief description
 ```
 

docs/plans/2026-03-25-audit-streamlit-nba/Phase-1.md

@@ -247,8 +247,8 @@ refactor(pages): extract shared configure_page, remove finally:pass
 
 After completing all tasks in this phase:
 
-1. Run `pytest` and confirm all tests pass.
-2. Run `ruff check src/ tests/` and confirm no lint errors.
-3. Run `mypy src/` and confirm no type errors.
-4. Run `git diff --stat` and confirm only expected files changed.
+1. Execute `pytest` and confirm all tests pass.
+2. Lint with `ruff check src/ tests/` and confirm no errors.
+3. Type-check with `mypy src/` and confirm no errors.
+4. Verify with `git diff --stat` that only expected files changed.
 5. Verify no dead code identified in the health audit remains.

docs/plans/2026-03-25-audit-streamlit-nba/Phase-2.md

@@ -42,11 +42,11 @@ Fix structural and architectural issues: decouple Streamlit caching from busines
   - Replace `get_connection()` context manager usage with direct calls to `_load_nba_data()`.
 
 **Verification Checklist:**
-- [x]`src/database/connection.py` does not import `streamlit`
-- [x]`python -c "from src.database.connection import load_data"` succeeds without Streamlit installed (or mocked)
-- [x]Pages still load data correctly (manual test with `streamlit run app.py` if possible)
-- [x]`pytest` passes
-- [x]`mypy src/` passes
+- [x] `src/database/connection.py` does not import `streamlit`
+- [x] `python -c "from src.database.connection import load_data"` succeeds without Streamlit installed (or mocked)
+- [x] Pages still load data correctly (manual test with `streamlit run app.py` if possible)
+- [x] `pytest` passes
+- [x] `mypy src/` passes
 
 **Testing Instructions:**
 - Update `tests/test_database.py` to remove any Streamlit mocking for `connection.py`.
@@ -84,10 +84,10 @@ refactor(database): decouple Streamlit caching from connection module
   - Replace direct calls to `get_winner_model()` with `_get_model()`.
 
 **Verification Checklist:**
-- [x]`src/ml/model.py` does not import `streamlit`
-- [x]`python -c "from src.ml.model import get_winner_model"` succeeds without Streamlit
-- [x]`pytest` passes
-- [x]`mypy src/` passes
+- [x] `src/ml/model.py` does not import `streamlit`
+- [x] `python -c "from src.ml.model import get_winner_model"` succeeds without Streamlit
+- [x] `pytest` passes
+- [x] `mypy src/` passes
 
 **Testing Instructions:**
 - Update `tests/test_ml.py` to remove any Streamlit mocking that was needed due to the `st.cache_resource` import.
@@ -118,10 +118,10 @@ refactor(ml): decouple Streamlit caching from model module
 - Review callers in pages to ensure they catch the custom exceptions, not bare `Exception`.
 
 **Verification Checklist:**
-- [x]No `except Exception` in `connection.py`
-- [x]All exception catches use specific types
-- [x]`pytest` passes
-- [x]`mypy src/` passes
+- [x] No `except Exception` in `connection.py`
+- [x] All exception catches use specific types
+- [x] `pytest` passes
+- [x] `mypy src/` passes
 
 **Testing Instructions:**
 - Existing tests should cover this. Add a test that verifies a `FileNotFoundError` is raised as `DatabaseConnectionError`.
@@ -156,9 +156,9 @@ fix(database): narrow exception catches to specific types
 - Apply this change consistently across all files.
 
 **Verification Checklist:**
-- [x]No f-strings in any `logger.*()` calls
-- [x]`ruff check src/ tests/` passes
-- [x]`pytest` passes
+- [x] No f-strings in any `logger.*()` calls
+- [x] `ruff check src/ tests/` passes
+- [x] `pytest` passes
 
 **Testing Instructions:** No new tests needed. This is a mechanical replacement.
 
@@ -187,10 +187,10 @@ fix(logging): replace f-string logging with lazy %s formatting
 - Import `TEAM_SIZE` and `STAT_COLUMNS` (or their lengths) from `src/config.py`.
 
 **Verification Checklist:**
-- [x]`analyze_team_stats` raises `ValueError` if player count != 5
-- [x]`analyze_team_stats` raises `ValueError` if any player has wrong stat count
-- [x]Existing tests pass
-- [x]New tests cover the validation
+- [x] `analyze_team_stats` raises `ValueError` if player count != 5
+- [x] `analyze_team_stats` raises `ValueError` if any player has wrong stat count
+- [x] Existing tests pass
+- [x] New tests cover the validation
 
 **Testing Instructions:**
 - Add tests in `tests/test_ml.py`:
@@ -220,9 +220,9 @@ fix(ml): add input shape validation before model prediction
 - Remove the redundant check from `from_preset()` since the Pydantic validator will catch it during construction. Let `from_preset()` simply construct the instance and trust Pydantic validation.
 
 **Verification Checklist:**
-- [x]Only one validation path for preset names
-- [x]`pytest tests/test_models.py` passes
-- [x]Invalid preset names still raise appropriate errors
+- [x] Only one validation path for preset names
+- [x] `pytest tests/test_models.py` passes
+- [x] Invalid preset names still raise appropriate errors
 
 **Testing Instructions:** Existing `DifficultySettings` tests should cover this. Verify they pass.
 
@@ -249,9 +249,9 @@ fix(models): remove duplicate validation in DifficultySettings
 - Fix type hints: change `list[list]` to `list[list[float]]` or more precise types.
 
 **Verification Checklist:**
-- [x]No `del` operations on input data in `create_stats`
-- [x]`ruff check scripts/` passes
-- [x]Function produces same output (manual verification or add a simple test)
+- [x] No `del` operations on input data in `create_stats`
+- [x] `ruff check scripts/` passes
+- [x] Function produces same output (manual verification or add a simple test)
 
 **Testing Instructions:** This is a training script, not part of the test suite. Manual verification that the output is unchanged, or add a simple test comparing old behavior vs new.
 
@@ -280,10 +280,10 @@ fix(scripts): replace destructive del with slicing in create_stats
 - Alternatively, call `setup_logging()` in each entry point (`app.py`, page files) right after `configure_page()`.
 
 **Verification Checklist:**
-- [x]`setup_logging()` is NOT called at module level in `config.py`
-- [x]`setup_logging()` IS called in each entry point
-- [x]`pytest` passes
-- [x]Logging still works when running the app
+- [x] `setup_logging()` is NOT called at module level in `config.py`
+- [x] `setup_logging()` IS called in each entry point
+- [x] `pytest` passes
+- [x] Logging still works when running the app
 
 **Testing Instructions:** Run existing tests. The module-level call removal should not break tests since tests typically configure their own logging.
 

docs/plans/2026-03-25-audit-streamlit-nba/Phase-3.md

@@ -141,7 +141,7 @@ test(utils): add tests for HTML escaping utilities
 - [x] Test verifies input/output shape
 - [x] Test passes
 
-**Testing Instructions:** `pytest tests/test_ml.py::test_load_real_model -v`
+**Testing Instructions:** `pytest tests/test_ml.py::TestLoadRealModel::test_load_real_model -v`
 
 **Commit Message Template:**
 ```text

docs/plans/2026-03-25-audit-streamlit-nba/Phase-4.md

@@ -85,7 +85,7 @@ ci(deps): consolidate to pyproject.toml, remove requirements files
           entry: mypy src/
   ```
 - Add `pre-commit` to the dev dependencies in `pyproject.toml`:
-  ```
+  ```toml
   "pre-commit>=3.0.0",
   ```
 - Verify the hooks work: `uvx pre-commit run --all-files`.

docs/plans/2026-03-25-audit-streamlit-nba/doc-audit.md

@@ -11,6 +11,8 @@ drift_prevention: markdownlint + lychee
 language_stack: python + js/ts
 ---
 
+> **Snapshot context:** This document captures pre-remediation findings from the 2026-03-25 audit. Items addressed during the remediation PR are annotated inline.
+
 ## DOCUMENTATION AUDIT
 
 ### SUMMARY
@@ -38,7 +40,7 @@ language_stack: python + js/ts
    - Tree does not mention `snowflake_nba.csv` (the actual data source used at runtime).
    - Tree does not mention `player_stats.txt` or `schedule.txt` (training data files).
    - Tree does not mention `winner_model/` directory (alternative SavedModel format alongside `winner.keras`).
-   - Tree does not mention `.streamlit/config.toml`, `.devcontainer/devcontainer.json`, or `.github/` workflows.
+   - Tree does not mention `.streamlit/config.toml`, `.devcontainer/devcontainer.json`, or `.github/` workflows (GitHub Actions CI).
 
 4. **`README.md:21-22`** - "comprehensive database of historical NBA stats"
    - Doc says: "Search for players from a comprehensive database of historical NBA stats."
@@ -48,15 +50,15 @@ language_stack: python + js/ts
 
 ### GAPS (code exists, no doc)
 
-1. **`src/config.py`** - Central configuration module with `PLAYER_COLUMNS`, `STAT_COLUMNS`, `TEAM_SIZE`, `MAX_QUERY_ATTEMPTS`, `DIFFICULTY_PRESETS`, score ranges, and `setup_logging()`. Not mentioned anywhere in documentation.
+1. **`src/config.py`** - Central configuration module with `PLAYER_COLUMNS`, `STAT_COLUMNS`, `TEAM_SIZE`, `MAX_QUERY_ATTEMPTS`, `DIFFICULTY_PRESETS`, score ranges, and `setup_logging()`. Not mentioned anywhere in documentation. *(Partially addressed: README now documents data file paths and config module.)*
 
-2. **`src/models/player.py`** - Pydantic models `PlayerStats` and `DifficultySettings` with validation logic. No documentation describes the data models or their validation rules.
+2. **`src/models/player.py`** - ~~Pydantic models `PlayerStats` and `DifficultySettings` with validation logic.~~ *(Remediated: `PlayerStats` and `from_db_row` removed. Only `DifficultySettings` remains, which is an internal model used by session state.)*
 
-3. **`src/state/session.py`** - Session state management including `GameState` dataclass, `init_session_state()`, `get_away_stats()`, `get_home_team_df()`, `get_home_team_names()`, `set_difficulty()`, `add_player_to_team()`, `remove_player_from_team()`. None documented.
+3. **`src/state/session.py`** - ~~Session state management including `GameState` dataclass, `init_session_state()`, `get_away_stats()`, `get_home_team_df()`, `get_home_team_names()`, `set_difficulty()`, `add_player_to_team()`, `remove_player_from_team()`.~~ *(Remediated: `GameState`, `get_home_team_names`, `set_difficulty`, `add_player_to_team`, and `remove_player_from_team` removed. Remaining functions: `init_session_state()`, `get_away_stats()`, `get_home_team_df()`.)*
 
-4. **`src/utils/html.py`** - XSS protection utilities (`escape_html`, `safe_heading`, `safe_paragraph`, `safe_styled_text`). The README mentions nothing about security or HTML sanitization.
+4. **`src/utils/html.py`** - ~~XSS protection utilities (`escape_html`, `safe_heading`, `safe_paragraph`, `safe_styled_text`).~~ *(Remediated: `safe_styled_text` removed. Remaining functions: `escape_html`, `safe_heading`, `safe_paragraph`.)*
 
-5. **`src/validation/inputs.py`** - SQL injection protection with `PlayerSearchInput` model, `SQL_INJECTION_PATTERNS`, `validate_search_term()`, `is_valid_search_term()`. README line 22 mentions "Input validation for secure and accurate player searches" but provides no details about what validation is performed or why SQL injection protection exists when the data source is a local CSV.
+5. **`src/validation/inputs.py`** - ~~SQL injection protection with `PlayerSearchInput` model, `SQL_INJECTION_PATTERNS`, `validate_search_term()`, `is_valid_search_term()`.~~ *(Remediated: `SQL_INJECTION_PATTERNS` regex removed. Validation now uses a character allowlist only. `PlayerSearchInput`, `validate_search_term()`, and `is_valid_search_term()` remain.)*
 
 ---
 

docs/plans/2026-03-25-audit-streamlit-nba/eval.md

@@ -17,6 +17,8 @@ pillars:
   onboarding: 7
 ---
 
+> **Snapshot context:** This document captures pre-remediation (baseline) findings from the 2026-03-25 audit. Scores and evidence reflect the codebase state before the remediation PR. Items addressed during remediation are annotated inline.
+
 ## HIRE EVALUATION -- The Pragmatist
 
 ### VERDICT
@@ -25,12 +27,13 @@ pillars:
 - **One-Line:** Well-structured toy app that demonstrates strong defensive habits but lacks depth in the ML pipeline and leaves Pydantic models mostly unused.
 
 ### SCORECARD
+
 | Pillar | Score | Evidence |
 |--------|-------|----------|
-| Problem-Solution Fit | 6/10 | `requirements.txt:2` TensorFlow is a heavyweight dependency for a binary classifier on 100 features; `src/validation/inputs.py:8-28` SQL injection protection for a local CSV pandas app (no SQL database) |
-| Architecture | 7/10 | `src/database/__init__.py:1-23` clean module boundaries with `__all__` exports; `src/models/player.py:10-81` Pydantic `PlayerStats` model defined but never used in the actual data flow (pages operate on raw DataFrames) |
+| Problem-Solution Fit | 6/10 | `requirements.txt:2` TensorFlow is a heavyweight dependency for a binary classifier on 100 features *(TF retained, see ADR-2)*; `src/validation/inputs.py:8-28` SQL injection protection for a local CSV pandas app *(remediated: SQL regex removed, character allowlist retained)* |
+| Architecture | 7/10 | `src/database/__init__.py:1-23` clean module boundaries with `__all__` exports; `src/models/player.py:10-81` Pydantic `PlayerStats` model defined but never used *(remediated: `PlayerStats` removed, `DifficultySettings` retained)* |
 | Code Quality | 8/10 | `src/utils/html.py:12-47` proper XSS escaping with `html.escape`; `pages/2_play_game.py:96-110` defensive score generation with fallback; zero `print()` statements, zero TODOs, consistent docstrings throughout |
-| Creativity | 6/10 | `scripts/compile_model.py:73-113` `create_stats` mutates input lists via `del home_stats[i][j][0]` which is fragile and side-effect-heavy; `src/database/queries.py:96-151` away team generation algorithm is a reasonable approach but nothing inventive |
+| Creativity | 6/10 | `scripts/compile_model.py:73-113` `create_stats` mutates input lists via `del` *(remediated: replaced with slicing)*; `src/database/queries.py:96-151` away team generation algorithm is a reasonable approach but nothing inventive |
 
 ### HIGHLIGHTS
 - **Brilliance:** The security posture is notably strong for a Streamlit project. `src/utils/html.py:24-47` escapes all user-provided values before injecting into HTML markup, including color and alignment parameters, not just text. `src/validation/inputs.py:8-28` provides a compiled regex with 13 SQL injection patterns plus character validation. The test suite at `tests/test_validation.py:46-85` covers 10 parametrized injection vectors and 5 special character attacks, showing genuine security awareness.
@@ -49,9 +52,9 @@ pillars:
   - Estimated complexity: MEDIUM
 
 - **Architecture (current: 7/10, target: 9/10)**
-  - Either use the Pydantic models or remove them. Specifically, `src/models/player.py` `PlayerStats` should be integrated into `src/database/queries.py` so that query functions return validated model instances instead of raw DataFrames. Alternatively, delete the models and rely on DataFrame typing (the current de facto approach).
-  - The `GameState` dataclass in `src/state/session.py:18-28` is defined but never instantiated. `init_session_state()` at line 31 uses a plain dict instead. Unify to one approach.
-  - The `get_connection()` context manager at `src/database/connection.py:54-73` wraps a cached DataFrame read, which does not need resource cleanup. Simplify to a direct function call or at minimum remove the empty `finally: pass`.
+  - Either use the Pydantic models or remove them. *(Remediated: `PlayerStats` removed, `DifficultySettings` retained.)*
+  - The `GameState` dataclass is defined but never instantiated. *(Remediated: `GameState` removed.)*
+  - The `get_connection()` context manager wraps a cached DataFrame read with no resource cleanup. *(Remediated: replaced with plain `get_data()` function, `finally: pass` removed.)*
   - Estimated complexity: MEDIUM
 
 - **Code Quality (current: 8/10, target: 9/10)**
@@ -74,12 +77,13 @@ pillars:
 - **One-Line:** Well-organized Streamlit app with genuine defensive coding, but the ML pipeline has silent shape assumption bombs and the "database" layer is ceremony over substance.
 
 ### SCORECARD
+
 | Pillar | Score | Evidence |
 |--------|-------|----------|
-| Pragmatism | 6/10 | `src/database/connection.py:54-73` context manager wrapping a cached DataFrame read is pure ceremony; `src/validation/inputs.py:8-24` SQL injection guards on a CSV file |
-| Defensiveness | 7/10 | `pages/2_play_game.py:139-184` proper try/catch chains with user-facing errors; `src/ml/model.py:69-70` shape validation before prediction |
-| Performance | 7/10 | `src/database/connection.py:29` `@st.cache_data` on CSV load; `pages/1_home_team.py:86-88` batch query instead of N+1 |
-| Type Rigor | 7/10 | `src/models/player.py:10-41` thorough Pydantic model with constraints; `src/database/queries.py:36` `tuple[Any, ...]` return type is imprecise |
+| Pragmatism | 6/10 | `src/database/connection.py:54-73` context manager wrapping a cached DataFrame read *(remediated: replaced with plain function)*; `src/validation/inputs.py:8-24` SQL injection guards on a CSV file *(remediated: SQL regex removed)* |
+| Defensiveness | 7/10 | `pages/2_play_game.py:139-184` proper try/catch chains with user-facing errors; `src/ml/model.py:69-70` shape validation before prediction *(remediated: added input shape validation in `analyze_team_stats`)* |
+| Performance | 7/10 | `src/database/connection.py:29` `@st.cache_data` on CSV load *(remediated: caching moved to page layer)*; `pages/1_home_team.py:86-88` batch query instead of N+1 |
+| Type Rigor | 7/10 | `src/models/player.py:10-41` thorough Pydantic model with constraints *(remediated: `PlayerStats` removed)*; `src/database/queries.py:36` `tuple[Any, ...]` return type *(remediated: types tightened)* |
 
 ### CRITICAL FAILURE POINTS
 
@@ -143,19 +147,20 @@ None that are automatic no-go items. No global state leaks, no unhandled promise
 - **One-Line:** "Well-structured code written for the next person, but the onboarding path has gaps and git history tells two different stories."
 
 ### SCORECARD
+
 | Pillar | Score | Evidence |
 |--------|-------|----------|
-| Test Value | 7/10 | `tests/test_validation.py:46-85` SQL injection tests document real security behavior; `tests/test_ml.py:48-123` over-mocks the model layer, coupling to implementation |
-| Reproducibility | 7/10 | `pyproject.toml` has full tool config; `.github/workflows/ci.yml` runs tests+lint+mypy; but `.gitignore` is a single line (`/venv`) missing coverage artifacts, `.coverage`, and `__pycache__` |
+| Test Value | 7/10 | `tests/test_validation.py:46-85` SQL injection tests document real security behavior *(remediated: SQL tests removed with SQL code)*; `tests/test_ml.py:48-123` over-mocks the model layer *(remediated: real model load test added)* |
+| Reproducibility | 7/10 | `pyproject.toml` has full tool config; `.github/workflows/ci.yml` runs tests+lint+mypy; but `.gitignore` is a single line *(remediated: expanded to 29 lines)* |
 | Git Hygiene | 5/10 | `6424951` is a 2000+ line mega-commit creating entire `src/`, `tests/`, and `scripts/` directories; early history is "score update" x5, "README update" x4 |
 | Onboarding | 7/10 | `README.md` has quick start, test commands, project structure; missing `.env.example`, no prereq for the `.keras` model file, no contributing guide |
 
 ### RED FLAGS
 - **Minimal .gitignore**: Contains only `/venv`. A junior would commit build artifacts on day one.
 - **Binary model file in git** (`winner.keras`, 87KB): Checked into the repo with no Git LFS.
-- **Coverage threshold at 50%** (`pyproject.toml:113`): Low bar that signals "we have tests" rather than "we trust our tests."
+- **Coverage threshold at 50%** (`pyproject.toml:113`): *(Remediated: threshold raised to 70%, enforced in CI with `--cov-fail-under=70`. Actual coverage: 93.60%.)*
 - **Mega-commit** (`6424951`): "Refactor app with security fixes, error handling, and type safety" touches 30+ files with 2000+ insertions.
-- **No pre-commit hooks**: No `.pre-commit-config.yaml` or `.husky/` directory.
+- **No pre-commit hooks**: *(Remediated: `.pre-commit-config.yaml` added with ruff and mypy hooks.)*
 - **Two virtual environments**: Both `.venv/` and `venv/` exist in the repo root.
 
 ### HIGHLIGHTS
@@ -178,8 +183,8 @@ None that are automatic no-go items. No global state leaks, no unhandled promise
 - **Test Value (current: 7/10, target: 9/10)**
   - Add an integration test that loads the actual CSV and validates column order matches `PLAYER_COLUMNS`.
   - Add at least one test in `test_ml.py` that loads the real `winner.keras` model.
-  - Raise coverage threshold from 50% to 70% and add `--cov-fail-under=70` to CI.
-  - Add tests for `src/state/session.py` and `src/utils/html.py`.
+  - Raise coverage threshold from 50% to 70% and add `--cov-fail-under=70` to CI. *(Remediated: threshold at 70%, CI enforces it.)*
+  - Add tests for `src/state/session.py` and `src/utils/html.py`. *(Remediated: `tests/test_state.py` and `tests/test_utils.py` added.)*
   - Estimated complexity: MEDIUM
 
 - **Reproducibility (current: 7/10, target: 9/10)**

pages/2_play_game.py

@@ -74,8 +74,8 @@ def find_away_team(stat_thresholds: list[int]) -> pd.DataFrame:
             max_attempts=MAX_QUERY_ATTEMPTS,
         )
     except DatabaseConnectionError as e:
-        st.error("Could not connect to database. Please try again later.")
-        logger.error("Database connection error: %s", e)
+        st.error("Could not load player data. Please try again later.")
+        logger.error("Data load error: %s", e)
         return pd.DataFrame()
     except QueryExecutionError as e:
         st.error("Could not generate away team. Please try again.")

scripts/compile_model.py

@@ -80,8 +80,8 @@ def create_stats(roster: pd.DataFrame, schedule: pd.DataFrame) -> list[np.ndarra
     Returns:
         List of numpy arrays, one per game with combined team stats
     """
-    home_stats: list[list[list[float]]] = []
-    away_stats: list[list[list[float]]] = []
+    home_stats: list[list[list[str | float]]] = []
+    away_stats: list[list[list[str | float]]] = []
     features: list[np.ndarray] = []
 
     new_roster = roster[FEATURE_COLS]

src/database/connection.py

@@ -41,7 +41,7 @@ def load_data() -> pd.DataFrame:
         # Ensure column names match expected Snowflake names (uppercase)
         df.columns = [col.upper() for col in df.columns]
         return df
-    except (FileNotFoundError, pd.errors.ParserError, pd.errors.EmptyDataError) as e:
+    except (pd.errors.ParserError, pd.errors.EmptyDataError) as e:
         logger.error("Failed to load CSV data: %s", e)
         msg = f"Could not load data from {CSV_PATH}: {e}"
         raise DatabaseConnectionError(msg) from e

src/models/player.py

@@ -44,7 +44,8 @@ class DifficultySettings(BaseModel):
         """
         preset = DIFFICULTY_PRESETS.get(preset_name)
         if preset is None:
-            # Let Pydantic validation handle the error message
+            # Pass invalid name to constructor; the field_validator on
+            # `name` will raise ValueError with valid preset options.
             return cls(
                 name=preset_name,
                 pts_threshold=0,

src/state/__init__.py

@@ -1,5 +1,5 @@
 """Session state management module."""
 
-from src.state.session import get_away_stats, init_session_state
+from src.state.session import get_away_stats, get_home_team_df, init_session_state
 
-__all__ = ["get_away_stats", "init_session_state"]
+__all__ = ["get_away_stats", "get_home_team_df", "init_session_state"]

src/validation/inputs.py

@@ -30,9 +30,11 @@ class PlayerSearchInput(BaseModel):
             ValueError: If invalid characters found
         """
         v = v.strip()
+        if not v:
+            raise ValueError("Search term cannot be empty.")
         # Allow letters, numbers, spaces, hyphens, periods, and apostrophes
         # (e.g., "O'Neal", "J.R. Smith")
-        if not re.match(r"^[a-zA-Z0-9\s\-.']+$", v):
+        if not re.match(r"^[a-zA-Z0-9 \-.']+$", v):
             raise ValueError(
                 "Search term contains invalid characters. "
                 "Please use only letters, numbers, spaces, hyphens, "

tests/test_ml.py

@@ -25,9 +25,7 @@ class TestAnalyzeTeamStats:
         # Combined has both teams = 100 values
         assert combined.shape == (1, 100)
 
-    def test_combined_contains_both_teams(
-        self, sample_team_stats: list[list[float]]
-    ) -> None:
+    def test_combined_contains_both_teams(self) -> None:
         """Test that combined array contains both teams' stats."""
         home_stats = [[float(i * 10 + j) for j in range(10)] for i in range(5)]
         away_stats = [[float(50 + i * 10 + j) for j in range(10)] for i in range(5)]

tests/test_state.py

@@ -5,6 +5,7 @@ from unittest.mock import patch
 import pandas as pd
 
 from src.config import DIFFICULTY_PRESETS
+from src.state.session import get_away_stats, get_home_team_df, init_session_state
 
 
 class TestInitSessionState:
@@ -15,8 +16,6 @@ class TestInitSessionState:
         state: dict = {}
         with patch("src.state.session.st") as mock_st:
             mock_st.session_state = state
-            from src.state.session import init_session_state
-
             init_session_state()
 
         expected_keys = {
@@ -34,8 +33,6 @@ class TestInitSessionState:
         state: dict = {"home_team": ["Player A"]}
         with patch("src.state.session.st") as mock_st:
             mock_st.session_state = state
-            from src.state.session import init_session_state
-
             init_session_state()
 
         assert state["home_team"] == ["Player A"]
@@ -45,8 +42,6 @@ class TestInitSessionState:
         state: dict = {}
         with patch("src.state.session.st") as mock_st:
             mock_st.session_state = state
-            from src.state.session import init_session_state
-
             init_session_state()
 
         assert state["away_stats"] == list(DIFFICULTY_PRESETS["Regular"])
@@ -56,8 +51,6 @@ class TestInitSessionState:
         state: dict = {}
         with patch("src.state.session.st") as mock_st:
             mock_st.session_state = state
-            from src.state.session import init_session_state
-
             init_session_state()
 
         assert isinstance(state["away_team_df"], pd.DataFrame)
@@ -74,8 +67,6 @@ class TestGetAwayStats:
         state: dict = {"away_stats": [100, 200, 300, 400]}
         with patch("src.state.session.st") as mock_st:
             mock_st.session_state = state
-            from src.state.session import get_away_stats
-
             result = get_away_stats()
 
         assert result == [100, 200, 300, 400]
@@ -85,8 +76,24 @@ class TestGetAwayStats:
         state: dict = {"away_stats": "invalid"}
         with patch("src.state.session.st") as mock_st:
             mock_st.session_state = state
-            from src.state.session import get_away_stats
+            result = get_away_stats()
+
+        assert result == list(DIFFICULTY_PRESETS["Regular"])
+
+    def test_returns_defaults_on_none(self) -> None:
+        """Verify returns defaults when away_stats is None."""
+        state: dict = {"away_stats": None}
+        with patch("src.state.session.st") as mock_st:
+            mock_st.session_state = state
+            result = get_away_stats()
+
+        assert result == list(DIFFICULTY_PRESETS["Regular"])
 
+    def test_returns_defaults_on_wrong_length(self) -> None:
+        """Verify returns defaults when away_stats has wrong length."""
+        state: dict = {"away_stats": [1, 2, 3]}
+        with patch("src.state.session.st") as mock_st:
+            mock_st.session_state = state
             result = get_away_stats()
 
         assert result == list(DIFFICULTY_PRESETS["Regular"])
@@ -101,8 +108,6 @@ class TestGetHomeTeamDf:
         state: dict = {"home_team_df": expected_df}
         with patch("src.state.session.st") as mock_st:
             mock_st.session_state = state
-            from src.state.session import get_home_team_df
-
             result = get_home_team_df()
 
         pd.testing.assert_frame_equal(result, expected_df)
@@ -112,8 +117,6 @@ class TestGetHomeTeamDf:
         state: dict = {}
         with patch("src.state.session.st") as mock_st:
             mock_st.session_state = state
-            from src.state.session import get_home_team_df
-
             result = get_home_team_df()
 
         assert isinstance(result, pd.DataFrame)

tests/test_validation.py

@@ -52,7 +52,7 @@ class TestRejectsInvalidCharacters:
             "James<script>",
             "James&nbsp;",
             "James@#$%",
-            "James\\nNewline",
+            "James\nNewline",
             "James\x00null",
         ],
     )