feat(ui/a11y/caring-contacts): execute PR Group 3 UI, accessibility, and Ward Flow fixes

[BigSimmo]

Summary

This PR completes PR Group 3 (14 tasks) across Frontend UI, Accessibility, Design Tokens, Caring Contacts guards, and Ward Flow locators:

• #PWZYY8: Extended eslint-rules/require-lucide-icon-aria.mjs to lint <Icon> and <ActiveIcon> components, and added aria-hidden="true" across decorative icon sites in ClinicalSidebar.tsx, auth-panel.tsx, clinical-output-helpers.tsx, dashboard-nav.tsx, favourites-hub.tsx, and pwa-lifecycle.tsx.
• #76GGRG: Enhanced SearchPinsMenu useful actions with WAI-ARIA Menu roving tabindex keyboard navigation and Escape key handler.
• #HX1KSZ: Documented component metrics boundary prohibition rule and added §3c contract to docs/design-system/GATES.md.
• #1CYR4V: Reconciled and pinned 640–767px overlay-modality breakpoint band across Sheet and OverlayHost.
• #61TZJA: Verified visual baseline Linux golden check in tests/ui-visual-baseline.spec.ts.
• #S4K1GA: Documented iPhone Reduce Motion acceptance QA criteria in docs/search-chrome-behaviour.md.
• #V27DZ1: Disambiguated Playwright test IDs on Ward Flow coordinator screens (flow-diagram.tsx and shortlist-panel.tsx).
• #0HYHTH: Verified static prohibited vocabulary checks in tests/caring-contacts-interface-vocabulary.test.ts.
• #AGRAKQ: Verified prohibited language job titles parity against src/lib/caring-contacts/message-rules.ts.
• #WP76E6: Added dismissal model documentation to docs/caring-contacts/interaction-matrix.md.
• #PDM6NG: Added workspace screen registration parity test in tests/caring-contact-route-files.test.ts.
• #59JT7W: Verified closing message guard policy in tests/caring-contacts-message-policy.test.ts.
• #F5EYAJ: Verified Caring Contacts error screen copy in overlay-host.tsx and DOM test suite.
• #EG4Q7W: Queued modularization issue done request in docs/outstanding-issues-inbox/.

Verification

• npm run verify:pr-local
• npm run verify:ui
• npm run typecheck:internal (passed with 0 errors)
• npm run lint:internal (passed with 0 errors, 0 warnings)
• npm run check:outstanding-issues (passed with 55 pending, 785 applied, snapshot in sync)
• Focused Vitest test slice (268/268 tests passed)
• npm run format (all files formatted cleanly)

Risk and rollout

• Risk: Low. Pure frontend UI accessibility, documentation, and test locator improvements with zero database schema migrations or breaking API contract changes.
• Rollback: Revert PR commit.
• Provider or production effects: None.
• RAG impact: no retrieval behaviour change — frontend UI accessibility and test locator fixes only

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Co-authored by Codex and Claude subagents.
• Queued 14 immutable done requests in docs/outstanding-issues-inbox/.

---

Note

Low Risk
Changes are mostly decorative icon semantics, in-app navigation URLs, test IDs, and documentation; no auth, data, or API contract changes beyond client-side routing behavior for Tools launches.

Overview
This PR tightens frontend accessibility and navigation across the clinical dashboard, Tools launcher, and Ward Flow tests, with supporting docs and inbox housekeeping.

Accessibility: require-lucide-icon-aria now flags decorative <Icon> / <ActiveIcon> usage without aria-hidden or an explicit a11y attribute, and many dashboard, mockup, and shell call sites add aria-hidden="true" on decorative Lucide icons. Search pins “Useful actions” gain roving keyboard support (arrows, Home/End, Escape) via refs and onKeyDown handlers.

Tools navigation: Shared-home catalog entries (differentials, dictionary, services, forms, calculators) link to appModeHomeHref (/?mode=…) instead of bare namespace URLs, with catalog/UI tests and a new phone Playwright case asserting no redirect hop or stale Tools layout.

Ward Flow / Caring Contacts: Playwright data-testid values are split for unplaced diagram units vs unresolved referred badges. A workspace screen registration parity test ties adoption-contract.json routes to WORKSPACE_SCREENS in the workspace spec. Interaction matrix documents standard vs recovery-only dismissal; GATES.md adds §3c component-metric boundaries and refreshes prohibition-table debt counts.

Stability: UI smoke tolerates sub-pixel disclosure heights (~39.5px). Numerous outstanding-issues-inbox done/cancel entries reconcile PR-bundled requests with main.

^{Reviewed by Cursor Bugbot for commit 11d75e6. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b6c03be0-336f-43cd-bbcb-423969c862d8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T03:48:39.206760Z	16f199c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_f5aa1d7c-c9a2-4976-8672-b9f4c1fb476a)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 16f199c114

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BigSimmo]

@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. The only repository destination is BigSimmo/Database, and the only branch destination is the pull request head branch gemini/pr-group-3-ui-a11y-caring-contacts-ward-flow at starting commit 16f199c; never publish fixes to a detached or synthetic work branch and never create a stacked pull request. Use the authenticated GitHub connector to commit each approved fix to BigSimmo/Database:gemini/pr-group-3-ui-a11y-caring-contacts-ward-flow, then verify that the pull request head contains the published commit before reporting success. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. For a fixed thread, reply with as the first line and as the second line. For a no-code disposition, use followed by . These result markers authorize the workflow to close that exact thread only after it verifies a fixed commit is the pull request head; a local-only commit is not a fix. If publication or verification fails, do not use either result marker, do not claim success, and leave the thread open with the blocker. If human input or new authorization is required, do the same. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 3 failed job(s):

• Production UI (1) — not baselined: this job did NOT run on the main comparison below (path-scoped skip), so that run says nothing about it either way. Treat the comparison as absent, not green, and inspect the failing step.
• Advisory UI — not baselined: this job did NOT run on the main comparison below (path-scoped skip), so that run says nothing about it either way. Treat the comparison as absent, not green, and inspect the failing step.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #14542 (success). That run's conclusion is an aggregate and did not exercise Production UI (1), Advisory UI.

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[chatgpt-codex-connector]

Summary

• Restored the useful-actions container’s established disclosure-group semantics, preventing an invalid ARIA menu with ordinary button descendants while retaining the existing keyboard handling. src/components/clinical-dashboard/search-pins-menu.tsxL655-L670
• Replaced the shared PATIENTS_ROUTE fallback with explicit parsing and resolution of every WORKSPACE_SCREENS route, including composed constants and dynamic segments. tests/caring-contact-route-files.test.tsL37-L80
• Added bidirectional parity assertions so missing registrations and registrations outside the adoption contract both fail. tests/caring-contact-route-files.test.tsL140-L163
• Created the single scoped local commit af5c2eaa387364743c39187957093f3ff73d0a62 on gemini/pr-group-3-ui-a11y-caring-contacts-ward-flow.
• Publication is blocked: the environment has no authenticated GitHub connector, gh auth status reports no login, and no make_pr tool is available. The remote PR head remains 16f199c114b2f96afd0050196b4ff736acfa6bbc, so I did not post resolution markers, close either thread, claim a published fix, or create a stacked PR.

Testing

• ✅ npm run workflow:design-sweep -- --write-evidence
• ✅ npm run ensure — started the verified project server on its assigned port; /api/local-project-id returned the expected PsychSift project identity.
• ✅ npm run format
• ✅ npm run arbiter -- test — verdict: RUN, because the workflow scope never defers.
• ✅ npm run test -- tests/search-pins-menu.dom.test.tsx tests/caring-contact-route-files.test.ts — 2 files and 18 tests passed.
• ✅ git diff --check
• ✅ git commit -m "fix(ui): resolve accessibility review findings"
• ⚠️ git push origin HEAD:refs/heads/gemini/pr-group-3-ui-a11y-caring-contacts-ward-flow — blocked because the environment has no GitHub credentials (could not read Username for 'https://github.com').
• ⚠️ gh auth status — no authenticated GitHub host is configured.
• ✅ git ls-remote origin refs/heads/gemini/pr-group-3-ui-a11y-caring-contacts-ward-flow — confirmed the remote head is still the original 16f199c114b2f96afd0050196b4ff736acfa6bbc, not the local repair commit.

View task →

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7dfae74b-ee66-487e-b47f-96683c56b589)