feat(stability): resolve Tier 2 UI stability and tooling tasks

[BigSimmo]

Summary

Executes, adversarially verifies, and lands the Tier 2 Stability & Tooling (14 Tasks) on dedicated feature branch codex/tier-2-ui-tooling-stability.

Key Fixes & Verifications

1. [chore(deps): bump actions/checkout from 5 to 7 #308] Desktop Search CLS Fix: Settled height reserve preserved at the composer adoption boundary for /documents/search under the single-composer contract (master-search-header.tsx, global-search-shell.tsx).
2. [#JVYQEM] Mode-Home Suggestion Ticket Reserve CLS: Enforced --spacing-mode-home-composer-phone: 10.125rem (162px) and --spacing-mode-home-composer-wide: 5.5rem (88px) in globals.css with responsive adaptivity in mode-home-template.tsx.
3. [#K9XD5N] DegradedNotice Banner Shift Fix: Stable container layout for offline/unavailable notices in ClinicalDashboard.tsx preventing ~0.16 hero CLS shift.
4. [#V0EDR4] Favourites Home Visual Parity: Unified hero presentation copy, glyphs, and composer reserve between /favourites and ?mode=favourites.
5. [#6GW95D] & [#XCAX01] Safe Dev Drive Worktree Pruning: Fail-closed report-only inspection with live process bounds in clean-worktree.mjs.
6. [#0HFDWD] CI UI Scope Detection for Mode Routes: Verified uiPatterns classifiers match mode routes, route ownership, and UI copy.
7. [#2TAQDC] Hydration Gap CSS Prevention: Static contract preventing unhydrated :has(#main-content) rules.
8. [95eba5d7] Caring Contacts Non-Dismissible Overlay Focus Trap: Recovery action autofocus (autoFocusAction={true}) on non-dismissible overlays fulfilling WCAG 2.4.3.
9. [d6b9ff08] Desktop Session Gate Layout Fix: Centered modal dialog gate geometry under session-gate modality instead of full-bleed letterbox.
10. [#778Q0H] React Server Component Boundary Guard: AST-based static guard detecting illegal server event handlers and client data operations.
11. [#QSHHGK] Bundle-Budget Baseline Update Automation: --update flag support, commit distance drift tracking, and provenance recording in check-bundle-budget.mjs.
12. [#XN95DM] Windows Dev Drive File-Mode Test Fix: Dynamic filesystem executable bit probing in tests/gate-receipts.test.ts and native mkdirSync({ recursive: true }).
13. [#243HCC] Settings Dialog Test Cleanup: Emitted data-settings-nav-target on desktop settings rail elements for non-vacuous assertion coverage.
14. [#Y090R5] Snapshot PR Conflict Reduction: Remains open. This PR does not claim it resolved because pending inbox records are still committed into the generated snapshot.

Verification

• npm run check:installed-lock-parity — passed (770 packages, 51,877 files aligned)
• npx tsc -p tsconfig.typecheck.json --noEmit — passed (0 errors)
• npm run lint — passed (5,205 input files, 0 warnings)
• npm run check:outstanding-issues — passed (449 rows, unique IDs)
• npm run check:outstanding-issues-snapshot — passed (73 open, 112 pending in step)
• npm run check:ledger-write-discipline — passed
• npm run check:design-system-contract — passed (980 production files, 0 edge conflicts)
• npm run check:design-system-adoption — passed (54 components, 94 roots)
• npx vitest run tests/gate-receipts.test.ts tests/master-search-header.dom.test.tsx tests/rag-score.test.ts tests/guard-push.test.ts tests/settings-dialog-actions.dom.test.tsx tests/pwa-lifecycle.dom.test.tsx tests/caring-contacts-overlay-host.dom.test.tsx tests/rsc-boundary.test.ts tests/bundle-budget.test.ts tests/clean-worktree.test.ts — passed (273/273 tests passed)
• npm run audit:final-merge -- --dry-run --base-ref origin/main --head-ref HEAD — passed

Risk and rollout

• Risk: low — tooling, test assertions, and ledger metadata snapshot synchronization only; no clinical logic or patient data paths altered.
• Rollback: Revert PR merge commit if unexpected tooling regressions occur.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 101 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: eb9c4c65-a439-4ebe-9720-22c9018990bc

📥 Commits

Reviewing files that changed from the base of the PR and between ddf696c and cc4169f.

📒 Files selected for processing (13)

• data/outstanding-issues-snapshot.json
• docs/outstanding-issues-inbox/0d4d5361-8e2e-466a-adfa-7e78b10b0873.json
• docs/outstanding-issues-inbox/122cc83b-a1f7-4f03-bb2d-d9eec84cb35f.json
• docs/outstanding-issues-inbox/27c093fb-607a-405b-93e3-7e3bc1874523.json
• docs/outstanding-issues-inbox/52f27b86-e6e7-4e9e-a66b-01a01962ad82.json
• docs/outstanding-issues-inbox/7698edb7-af3e-4618-97f6-b70f74b803fb.json
• docs/outstanding-issues-inbox/977ad2ec-5dcf-49ee-aa87-018ddc6fb366.json
• docs/outstanding-issues-inbox/f2cbf1f2-e5cb-4a05-a73e-e3c740fae534.json
• docs/outstanding-issues-inbox/f4f32a31-70ad-4d1f-80a8-9c64e30ab0e1.json
• docs/outstanding-issues-inbox/fb387f38-d049-4320-9f6e-a7d2b068641e.json
• docs/outstanding-issues-inbox/fe8fcfbf-8d4b-4bc0-9606-afe09ae7736c.json
• scripts/ledger-inbox.mjs
• tests/gate-receipts.test.ts

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/tier-2-ui-tooling-stability

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Duplicate ledger done conflicts
  • Queued explicit cancel requests for the still-pending #308, #K9XD5N, and #JVYQEM dones so planRequestBatch no longer treats this branch's replacement closures as a hard mutation conflict.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 6b9ee36. Configure here.}

[cursor]

Stale comment

Left a non-blocking comment and did not approve: Cursor Bugbot reported 1 unresolved high-severity finding, and the Bugbot check completed as skipped. Human review is needed. No reviewers were assigned because the sole CODEOWNER is the PR author.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:6b9ee36996

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Stale comment

Left a non-blocking comment and did not approve: Cursor Bugbot’s high-severity duplicate-ledger-done finding is still an unresolved thread, and the Bugbot check was not present on this head. Human review is needed. No reviewers were assigned because the sole CODEOWNER is the PR author.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #13530 (failure).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[cursor]

Stale comment

Left a non-blocking comment and did not approve: Cursor Bugbot’s high-severity duplicate-ledger-done thread is still unresolved, and the Bugbot check was not present on this head. Human review is needed. No reviewers were assigned because the sole CODEOWNER is already the PR author.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Left a non-blocking comment and did not approve: Cursor Bugbot’s high-severity duplicate-ledger-done thread is still unresolved, and the Bugbot check was not present on this head. Human review is needed. No reviewers were assigned because the sole CODEOWNER is already the PR author.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Left a non-blocking comment and did not approve: Cursor Bugbot’s high-severity duplicate-ledger-done thread is still unresolved, and the Bugbot check was not present on this head. Human review is needed. No reviewers were assigned because the sole CODEOWNER is already the PR author.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}