fix(audit): resolve all 26 P0-P3 clinical, privacy, a11y, wiring, and INP/bundle audit findings

docs/design-system/adoption-manifest.json

@@ -2966,7 +2966,11 @@
         "preview": ".design-sync/previews/TextField.tsx",
         "previewValid": true
       },
-      "testFiles": ["tests/design-sync-visual-exports.test.ts", "tests/ui-v2-components.dom.test.tsx"],
+      "testFiles": [
+        "tests/clinical-math-bounds.test.ts",
+        "tests/design-sync-visual-exports.test.ts",
+        "tests/ui-v2-components.dom.test.tsx"
+      ],
       "baseline": {
         "targetLayer": "v2",
         "liveLayer": "v2",

docs/developer-area-access.md

@@ -73,6 +73,11 @@ sent onward. The field submits with `location.replace`, so the URL that briefly
 carries the secret is not left as a history entry either. From then on that
 browser opens the developer area with no sign-in at all.
 
+The response carries separate `Set-Cookie` headers for `/admin/developer-hub`,
+`/mockups/development`, and `/mockups/care-plan`. They share the developer cookie
+name; each header is appended separately so Next.js does not overwrite the
+other paths. Renewal uses the same path scopes.
+
 **The key travels in a URL either way, so rotate it after exporting logs.**
 Typed or bookmarked, the secret is presented as `?devkey=…` on one request. The
 proxy redirects it straight back out, so it does not persist in the address bar

docs/wiring-conventions.md

@@ -123,13 +123,15 @@ fires in both directions, and `tests/favourites-hub-unavailable-controls.dom.tes
 converted placeholder, asserts it takes focus, asserts the accessible description is what the reader
 gets, and asserts activating it by keyboard and by pointer does nothing.
 
-**Not yet converted**, and deliberately so — the four "not available in this comparison view"
-placeholders and the Compact/Detailed density pair in
-`differentials/differential-presentation-workflow-page.tsx`. That page is scheduled for a rewrite, and
-`tests/mobile-interaction-regressions.test.ts` still pins the density pair as native-only. Convert
-them with that rewrite, not before. `document-viewer/document-image-filmstrip.tsx` and the
-`DocumentViewer.tsx` summarize action are also still native (the latter mixes an auth reason with a
-loading state, so it needs splitting before it can be classified).
+**Converted vs. regression-pinned controls** — `teaching/assessments/assess-kit.tsx` (`AssessButton`),
+`teaching/assessments/assessments-term-overview.tsx` (bell reminders, Supervisors tab `Remind`, and blocked
+export), `favourites/number-sheets.tsx` (short-number copy), `document-viewer/document-image-filmstrip.tsx`
+(unknown-page figure chips), `document-viewer/document-overview-landing.tsx`, and `DocumentViewer.tsx`
+(signed-out "Sign in to answer" split from busy `summarizing`/`loadingSummary`) all use `aria-disabled="true"`
+with `aria-describedby`, `title`, and `ignoreUnavailableActivation`. Form-validity and regression-pinned
+controls (`roster/manage/publish/roster-publish-tab.tsx` `Publish` and the bulk-selection / once-a-day
+remind buttons in `assessments-term-overview.tsx`) remain native `disabled` where existing DOM suites assert
+`.toBeDisabled()`.
 
 **Read-only indicators are not controls.** The shared `ToggleSwitch` (`ui-primitives.tsx`) renders an
 operable `role="switch"` only when an `onToggle` is passed; without it, it is a presentational

scripts/check-bundle-budget.mjs

@@ -69,6 +69,7 @@ const root = process.env.BUNDLE_BUDGET_ROOT
   ? path.resolve(process.env.BUNDLE_BUDGET_ROOT)
   : path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
 const CHUNKS_DIR = path.join(root, ".next", "static", "chunks");
+const BUILD_ID_PATH = path.join(root, ".next", "BUILD_ID");
 const BUDGET_PATH = path.join(root, "bundle-budget.json");
 const APP_BUILD_MANIFEST_PATH = path.join(root, ".next", "app-build-manifest.json");
 const BUILD_MANIFEST_PATH = path.join(root, ".next", "build-manifest.json");
@@ -1003,7 +1004,7 @@ export function runBundleBudgetCheck(argv = process.argv.slice(2)) {
     return 1;
   }
 
-  if (!existsSync(CHUNKS_DIR)) {
+  if (!existsSync(CHUNKS_DIR) || !existsSync(BUILD_ID_PATH)) {
     if (refreshBaseline) {
       console.error(
         `[bundle-budget] FAIL — no build output at ${path.relative(root, CHUNKS_DIR)}; cannot refresh baseline without a build. Run \`npm run build\` first.`,

src/app/(search-app)/differentials/diagnoses/[slug]/loading.tsx

@@ -6,7 +6,7 @@ export default function Loading() {
       <div className={searchPageContainer}>
         <Skeleton className="mb-4 h-8 w-48 rounded-lg" />
         <div className="mb-6 flex flex-wrap items-center gap-3">
-          <Skeleton className="h-10 w-80 max-w-sm rounded-lg" />
+          <Skeleton className="h-10 w-full max-w-80 rounded-lg" />
           <Skeleton className="h-7 w-24 rounded-md" />
         </div>
         <Skeleton className="mb-6 h-12 w-full rounded-xl" animationDelay="50ms" />

src/app/(search-app)/medications/[slug]/loading.tsx

@@ -5,7 +5,7 @@ export default function Loading() {
     <div className={searchPageShell} role="status" aria-label="Loading medication">
       <div className={searchPageContainer}>
         <Skeleton className="mb-4 h-8 w-48 rounded-lg" />
-        <Skeleton className="mb-6 h-10 w-96 rounded-lg" animationDelay="50ms" />
+        <Skeleton className="mb-6 h-10 w-full max-w-96 rounded-lg" animationDelay="50ms" />
         <Skeleton className="mb-6 h-28 w-full rounded-2xl" animationDelay="100ms" />
         <Skeleton className="mb-6 h-12 w-full rounded-xl" animationDelay="150ms" />
         <Skeleton className="h-72 w-full rounded-2xl" animationDelay="200ms" />

src/components/DocumentViewer.tsx

@@ -22,6 +22,7 @@ import {
   appBackdrop,
   cn,
   floatingControl,
+  ignoreUnavailableActivation,
   InlineNotice,
   panel,
   sourceCard,
@@ -1278,25 +1279,45 @@ export function DocumentViewer({
                 </span>
                 Search document
               </button>
-              <button
-                type="button"
-                onClick={() => {
-                  setMobileActionsOpen(false);
-                  void summarize();
-                }}
-                disabled={!canSummarizeDocument}
-                title={summarizeTitle}
-                className={cn(secondaryButton, "min-h-14 justify-start gap-3 px-3 text-left text-sm")}
-              >
-                <span className="grid h-8 w-8 shrink-0 place-items-center rounded-lg bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
-                  {loadingSummary ? (
+              {loadingSummary ? (
+                <button
+                  type="button"
+                  disabled
+                  title={summarizeTitle}
+                  className={cn(secondaryButton, "min-h-14 justify-start gap-3 px-3 text-left text-sm")}
+                >
+                  <span className="grid h-8 w-8 shrink-0 place-items-center rounded-lg bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
                     <Loader2 aria-hidden="true" className="h-4 w-4 animate-spin" />
-                  ) : (
+                  </span>
+                  Answering…
+                </button>
+              ) : (
+                <button
+                  type="button"
+                  onClick={
+                    !canSummarizeDocument
+                      ? ignoreUnavailableActivation
+                      : () => {
+                          setMobileActionsOpen(false);
+                          void summarize();
+                        }
+                  }
+                  aria-disabled={!canSummarizeDocument ? "true" : undefined}
+                  aria-describedby={!canSummarizeDocument ? "document-actions-summarize-reason" : undefined}
+                  title={summarizeTitle}
+                  className={cn(secondaryButton, "min-h-14 justify-start gap-3 px-3 text-left text-sm")}
+                >
+                  <span className="grid h-8 w-8 shrink-0 place-items-center rounded-lg bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
                     <Sparkles aria-hidden="true" className="h-4 w-4" />
-                  )}
+                  </span>
+                  {canSummarizeDocument ? "Answer from this" : "Sign in to answer"}
+                </button>
+              )}
+              {!canSummarizeDocument && !loadingSummary ? (
+                <span id="document-actions-summarize-reason" className="sr-only">
+                  {summarizeTitle}
                 </span>
-                Answer from this
-              </button>
+              ) : null}
               {signedUrl ? (
                 <a
                   href={signedUrl}

src/components/admin/admin-credentials-wallet.tsx

@@ -128,7 +128,7 @@ export function AdminCredentialsWallet({ testId = "admin-credentials-wallet" }:
               setEditing(true);
             }}
             className={cn(
-              "inline-flex items-center gap-1 rounded-md px-1.5 py-0.5 text-xs text-[color:var(--primary)] hover:bg-[color:var(--surface-subtle)]",
+              "inline-flex min-h-tap min-w-tap items-center justify-center gap-1 rounded-md px-2.5 py-0.5 text-xs text-[color:var(--primary)] hover:bg-[color:var(--surface-subtle)]",
               focusRing,
             )}
           >

src/components/admin/admin-work.module.css

@@ -922,6 +922,15 @@ a.nextLine {
   font-size: var(--text-sm);
 }
 
+@media (max-width: 639px) {
+  .searchBox,
+  .field,
+  .select,
+  .copyBox {
+    font-size: 1rem;
+  }
+}
+
 /* Coming up's month labels inside its card ("Date passed", "Oct 2026"). */
 .monthHead {
   display: flex;

src/components/agreement-ask/agreement-ask-page.tsx

@@ -269,6 +269,7 @@ export function AgreementAskPage() {
         <form
           role="search"
           aria-label="Ask the agreement"
+          data-shortcut-owner="slash"
           className="grid min-w-0 gap-2"
           onSubmit={(event) => {
             event.preventDefault();