fix(document-viewer): keep a small resting pad at the true scroll bottom on phones

[BigSimmo]

Summary

• On phones, DocumentViewer's content padding snapped straight to 0 once the floating "Search within this document" pill auto-hid on scroll-down, so the last card in the document painted flush against the physical bottom edge with zero breathing room at the true end of scroll (reported live on an installed iPhone PWA — the last card, e.g. "Tables and diagrams"/"Indexing details", sat with no clearance and felt stuck/cut off).
• src/components/DocumentViewer.tsx: keep a small 0.75rem (12px) resting gap once the composer hides, instead of 0 — the same figure the pill itself already uses for its own floating clearance (.floating-composer-edge), so it's consistent rather than an arbitrary new number. Also updated data-phone-composer-reserve (diagnostic attribute) and added data-reserve-hidden-pad="0.75rem" so the existing hide/reveal collapse-budget math (readChromeCollapseMetrics in use-hide-on-scroll.ts) correctly treats this small pad as already-released rather than still-available runway.
• tests/clinical-dashboard-merge-artifacts.test.ts and tests/ui-phone-scroll-page-owned.spec.ts: updated the two existing contract assertions that pinned the old 0/"max-sm:pb-0" literal, so they now assert the new deliberate 12px baseline instead of going stale.

This does not change the shared shell's "zero reserve when hidden" architecture (mobile-composer-reserve.ts, used by GlobalSearchShell/ClinicalDashboard) — that mechanism and its own tests are untouched. This is scoped only to DocumentViewer's own, separately-authored content padding.

Verification

• Reproduced the reported gap live: drove a phone-viewport Chromium session (both regular browser-tab and forced display-mode: standalone PWA rendering) to the true scroll bottom of a document. Before the fix, the last card sat with a measured 0px gap from the viewport edge; after the fix, it's 12px (0.75rem), confirmed both numerically (getComputedStyle(...).paddingBottom) and via screenshot.
• Targeted vitest runs covering every test file that references DocumentViewer or the phone scroll-hide mechanism (use-hide-on-scroll.test.ts, clinical-dashboard-merge-artifacts.test.ts, ui-overlay-css-contract.test.ts, header-scroll-hide-contract.test.ts, mobile-composer-reserve.test.ts, dashboard-scroll-padding.test.ts, plus 17 more document-*/mode-nav-* files) — 278 tests, all passing.
• npx tsc --noEmit and npx eslint on the two changed source/test files — clean.
• npx prettier --check on the changed files — already formatted.
• npm run verify:pr-local — not run: this sandbox's installed Playwright Chromium build (chromium-1194) doesn't match the version this repo's config expects (chromium-headless-shell-1234), a pre-existing environment limitation unrelated to this change (matches the documented #255 drift). Recommend running the standard PR Playwright/verify:ui pass in CI before merge.
• Physical iPhone acceptance — not run. This change targets a real-device-only symptom (the original bug wasn't reproducible in any Chromium emulation, including forced standalone-PWA mode) reported and diagnosed from a user-provided screen recording on an installed Home Screen PWA. Per this repo's own docs/phone-chrome-physical-acceptance.md, Chromium evidence cannot close this gap — please confirm live on the reporting device before/while merging.

Risk and rollout

• Risk: low. The change widens one small, page-local CSS padding value (0px → 12px) on a single route family (/documents/[id] and friends) and is easily reverted; it does not touch retrieval, answer generation, auth, or the shared cross-app composer-reserve architecture.
• Rollback: revert this commit; the two adjusted test assertions revert cleanly with it.
• Provider or production effects: None.

Notes

• Root-caused via a live screen recording from the reporter (installed Home Screen PWA, iOS) showing the scroll gesture settle with the last card flush against the screen edge and no further downward travel possible without first scrolling back up.
• Chromium (browser-tab and forced-standalone) never reproduced a stuck/frozen gesture — only the flush-to-edge padding was reproducible — so this fix targets the padding, not a scroll-freeze mechanism. If the live device retest still shows a stuck gesture rather than just tight spacing, that would point to a different, WebKit-specific cause worth a follow-up /issues entry.

---

Generated by Claude Code

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #11435 (success).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:54 minutes

Limit details: You’ve used all 1 included review currently available under your plan. You completed 98 included PR reviews in the past 7 days; at that activity level, included reviews refill at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c6bced4f-9f65-4230-bc11-b8e41601b3c5

📥 Commits

Reviewing files that changed from the base of the PR and between 125e985 and caf3af4.

📒 Files selected for processing (4)

• docs/branch-review-records/4d97cced04265f7f2e53091a4254fe530c242dfa86fe8b441db662f3e1a301cd.record.md
• src/components/DocumentViewer.tsx
• tests/clinical-dashboard-merge-artifacts.test.ts
• tests/ui-phone-scroll-page-owned.spec.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
36221231	Triggered	Generic High Entropy Secret	d5aed78	tests/rag-adversarial-fixtures.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[BigSimmo]

GitGuardian: "1 secret uncovered" — investigation

Investigated locally (no GitGuardian dashboard access from this session, so I can't see the exact match):

• This PR's own unique commits (cda4783, 7a228e9, and 558c78e — the last authored by a different Claude session that pushed a pb-3 token fix after mine) contain no credential-shaped strings. Checked each commit's patch individually against common secret patterns (AWS keys, private-key headers, sk-/ghp_/xox-style tokens, JWTs, and generic api_key/secret/password/token= assignments) — no hits.
• The full flattened diff between origin/main and this branch (git diff origin/main...HEAD) is also clean against the same patterns.
• The remaining unique commits on this branch are Merge branch 'main' into ... merges (authored by @BigSimmo, not this session) with empty diffs of their own — they just fast-forward in main's existing history.

So the finding doesn't correspond to anything this PR's diff introduces. It's most likely either a false positive, or something already present somewhere in main's history that's only now visible to a PR-scoped GitGuardian scan because of the repeated merges. I don't have GitGuardian dashboard access to pin down the exact blob/commit — whoever has access to https://dashboard.gitguardian.com will need to confirm the location before this can be dispositioned or remediated.

Not pushing anything further to this branch while auto-merge is armed, per this repo's PR-mutation policy.

---

Generated by Claude Code