Resolve PsychSift visual-audit findings and preserve workflow accessibility

data/repo-awareness-snapshot.json

@@ -3323,6 +3323,11 @@
         "section": "archive",
         "catalogued": true
       },
+      {
+        "path": "docs/decisions/2026-10-17-design-audit-resolution.md",
+        "section": "decisions",
+        "catalogued": true
+      },
       {
         "path": "docs/rag-improvement/gate-b-decision-record.md",
         "section": "rag-improvement",
@@ -4248,6 +4253,11 @@
         "section": "agents",
         "catalogued": true
       },
+      {
+        "path": "docs/design-system/audit-resolution-2026-10-17.md",
+        "section": "design-system",
+        "catalogued": false
+      },
       {
         "path": "docs/archive/rag-scalability-wip-review-handover-2026-07-15.md",
         "section": "archive",
@@ -5760,6 +5770,14 @@
         "outcome": "Three P2 findings fixed; no remaining high-confidence defects",
         "checks": "DOM 40/40; typecheck; lint; design-system contract; production Chromium 11/11"
       },
+      {
+        "date": "2026-10-17",
+        "ref": "codex/design-audit-resolution",
+        "head": "0022c8121463669f222de38f642089a87e2ea932",
+        "scope": "adversarial review of settled design audit changes",
+        "outcome": "Two introduced P2 interaction defects reproduced and repaired before publication; independent corrective review found no additional issue; manual acceptance remains open",
+        "checks": "Standards and Spec source reviews: zero findings. Interaction review: stale Services shortlist capacity and Therapy zero-result announcement behind inert Sheet. RED 4 failed/19 passed; GREEN 23 passed; affected 6 suites/35 passed. Correction-specific browser verification pending."
+      },
       {
         "date": "2026-08-27",
         "ref": "codex/therapy-compare-phone-ux (PR #2410)",
@@ -14792,6 +14810,14 @@
         "outcome": "safe remote delete: experimental task-ledger variant superseded by merged PR #1106 canonical outstanding-issues ledger; archived batch16",
         "checks": "PR #1106 contract/history; current task-ledger architecture; bundle verify"
       },
+      {
+        "date": "2026-10-17",
+        "ref": "codex/design-audit-resolution",
+        "head": "6c91636b26fc7f2f5849a97f30b4a292a73057ad",
+        "scope": "concurrent automated review integration",
+        "outcome": "Two Therapy P2 regressions in automated follow-up reproduced and repaired; valid Services history replacement retained; independent corrective review found no additional issue",
+        "checks": "RED3failed22passed; affected6suites37passed6.66s; original initial-zero/inert-sheet and realBackForward assertions preserved; pending/delivered loading-cycle regressions added; fresh combined-source browser proof pending."
+      },
       {
         "date": "2026-08-02",
         "ref": "codex/fix-manual-workflow-service-role-key-exposure / PR #1572",
@@ -27112,6 +27138,14 @@
         "outcome": "self-review; 4 commits, value-preserving, gates green except a pre-existing main failure",
         "checks": "verify:pr-local (all stages pass except pre-existing check:medication-lexicon-report, reproduced on pristine origin/main); vitest 601 files/6510 passed; design-token-contract + tailwind-merge 69 passed; check:design-system-contract zero slack, mutation-verified; tailwind emission probe for the new utilities"
       },
+      {
+        "date": "2026-10-17",
+        "ref": "codex/design-audit-resolution",
+        "head": "f98ed9f2c6a79fc6ba46e8270726248d17857097",
+        "scope": "adversarial correction review",
+        "outcome": "Both introduced P2 defects repaired; independent corrective review found zero additional confirmed findings; manual device and clinical-state acceptance remains open",
+        "checks": "Regression-first 4 failed/19 passed then23passed; affected6suites35passed6.52s; freshproductionbuild and completeTypeScript passed; completeui-tools andui-mode-nav-density172passed4.3m; scopedlint anddesigncontractpassed; diffintegrity47files741to795selftest27; whole-repoformatpassed."
+      },
       {
         "date": "2026-07-30",
         "ref": "codex/repair-pr1462",

docs/branch-review-records/1a9da0d496a77e27a013ec20673df9cf5102e924765b188fb113953c8574ea72.record.md

@@ -0,0 +1 @@
+| 2026-10-17 | codex/design-audit-resolution | f98ed9f2c6a79fc6ba46e8270726248d17857097 | adversarial correction review | Both introduced P2 defects repaired; independent corrective review found zero additional confirmed findings; manual device and clinical-state acceptance remains open | Regression-first 4 failed/19 passed then23passed; affected6suites35passed6.52s; freshproductionbuild and completeTypeScript passed; completeui-tools andui-mode-nav-density172passed4.3m; scopedlint anddesigncontractpassed; diffintegrity47files741to795selftest27; whole-repoformatpassed. |

docs/branch-review-records/8f2296de123e06f0430a7b841f8492f7573d6382a2c6be2e536b193e8645b11a.record.md

@@ -0,0 +1 @@
+| 2026-10-17 | codex/design-audit-resolution | 0022c8121463669f222de38f642089a87e2ea932 | adversarial review of settled design audit changes | Two introduced P2 interaction defects reproduced and repaired before publication; independent corrective review found no additional issue; manual acceptance remains open | Standards and Spec source reviews: zero findings. Interaction review: stale Services shortlist capacity and Therapy zero-result announcement behind inert Sheet. RED 4 failed/19 passed; GREEN 23 passed; affected 6 suites/35 passed. Correction-specific browser verification pending. |

docs/branch-review-records/de814fe974a6169563899e3eb5707bc3c1ffa98ef2783f8f983f7df6274bbd9b.record.md

@@ -0,0 +1 @@
+| 2026-10-17 | codex/design-audit-resolution | 6c91636b26fc7f2f5849a97f30b4a292a73057ad | concurrent automated review integration | Two Therapy P2 regressions in automated follow-up reproduced and repaired; valid Services history replacement retained; independent corrective review found no additional issue | RED3failed22passed; affected6suites37passed6.66s; original initial-zero/inert-sheet and realBackForward assertions preserved; pending/delivered loading-cycle regressions added; fresh combined-source browser proof pending. |

docs/decisions/2026-10-17-design-audit-resolution.md

@@ -0,0 +1,11 @@
+# Decision: Resolve the design audit with persistent notices and shared action roles
+
+- **Status:** decided 2026-10-17
+- **Source:** `docs/design-system/DECISIONS.md`, find "C10 · Design-audit resolution"
+- **Retires:** `first-nations-automatic-primer`, `work-search-automatic-coachmark`
+
+The owner chose persistent inline First Nations reference/cultural-governance context with an optional About sheet, removed automatic Work search coaching and promotional halos, and chose mobile watermark hiding with desktop insetting. The audit resolution preserves intentional mode identities, meaningful focus/help, exact accessible counts, effective 48px targets, and Work reading/wide layouts while aligning shared action, type and geometry roles. Area primary actions use the shared action mapping; account/system commands retain an explicit neutral role.
+
+The [implementation handoff](../design-system/audit-resolution-2026-10-17.md) keeps all 32 original findings and eight assurance tasks visible with evidence limits and outstanding acceptance. This decision does not close them all, alter clinical/cultural approvals, restore the bedside calculator panel, authorize provider work, or imply deployment.
+
+If this summary and the source ever differ, the source wins.

docs/design-system/COMPONENTS.md

@@ -678,25 +678,26 @@ Two carriers, never a third:
 ### 9.1 `Button`
 
 **Purpose.** The one action primitive. `AsyncButton` and hand-rolled `<button>`s converge
-here. **Variants.** `primary` (filled `--command` — one per surface), `secondary`,
+here. **Variants.** `primary` (shared `actionPrimary` mapping — one area primary per surface), `secondary`,
 `ghost`, `quiet`, `danger` (filled `--danger-solid`, paired `--danger-solid-contrast`).
 **States.** Full DoD set; `busy` integrated (spinner + `busyLabel`, control stays in the
 tab order, never removes its accessible name); disabled via `controlBase` encoding.
 **Keyboard & SR.** Native button; `type="button"` default; icons `aria-hidden`.
-**Tokens.** command triplet + contrast · danger pair · `--radius-md` · tap utilities ·
+**Tokens.** area action roles resolved through `actionPrimary` · explicit neutral command triplet for account/system actions · danger pair · `--radius-md` · tap utilities ·
 `--focus` outline only. **Rules.** Verb-first specific labels, never "OK"/bare "Confirm" ·
 hover/active from semantic tokens, never `brightness-*` filters · one filled command per
 surface. **Landed.** Danger contrast and hover/active tokens plus the 48px tap-floor comment.
 **Tap vs compact-meta (DS-P1-09 / DS-P2-24).** Primary `Button` / `primaryControl` / filled command actions stay `min-h-tap` at **all** breakpoints — no `sm:min-h-10`, `sm:min-h-9`, `lg:min-h-9`, or `min-h-11`. Metadata, disclosure, filter chips, and table micro-actions may use `min-h-compact-meta` (40px) or a documented prefixed compact (`sm:min-h-compact-meta`). `--row-compact` / `min-h-9` (36px) is row height, not a tap target. Recipes: `interactiveCompact` and `tableMicroActionRow` are the named compact-meta exceptions in `ui-primitives.tsx`; `controlBase` stays tap-sized. Full table: TOKENS §2 “Compact-meta vs tap”.
 **Open defects → PR.** ref forwarding and the needless client boundary → follow-on.
 
-**Command CTA path.** Pick one encoding; do not invent a fourth.
+**Action and command paths.** Pick by responsibility, following [DECISIONS C10](DECISIONS.md#c10--design-audit-resolution-17-october-2026). `Button` defaults to secondary; merely importing it does not make an action primary. `actionPrimary` is shared by `Button variant="primary"` and `primaryControl`: Clinical blue by default, the owning Work action inside its frame, and native system colors in forced colors. `commandControl` explicitly retains neutral account/system actions. Destructive actions use the danger face.
 
-| Situation                                         | Winner                                                                                                                       |
-| ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
-| Real button action (copy, continue, submit, busy) | `<Button variant="primary">` from `src/components/ui/button.tsx`                                                             |
-| Navigation that must look like the filled command | `Link` + `primaryControl` (`Button` has no `href` / `asChild`)                                                               |
-| Unavailable placeholder                           | `aria-disabled` + `ignoreUnavailableActivation` from ui-primitives; **never** native `disabled` and `aria-disabled` together |
+| Situation                                                 | Winner                                                                                                                       |
+| --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
+| The area's primary button action (continue, submit, busy) | `<Button variant="primary">` from `src/components/ui/button.tsx`                                                             |
+| Navigation that is the area primary action                | `Link` + `primaryControl` or `buttonFaceClass({ variant: "primary" })`; native anchors retain open-in-new-tab behavior       |
+| Neutral account/system action                             | Native button or link + `commandControl`; classify the responsibility before changing its color                              |
+| Unavailable placeholder                                   | `aria-disabled` + `ignoreUnavailableActivation` from ui-primitives; **never** native `disabled` and `aria-disabled` together |
 
 ### 9.2 `IconButton`
 

docs/design-system/DECISIONS.md

@@ -227,7 +227,7 @@ dark mode, the owner approved these seven rules for both modes:
    controls and illustrations, in Clinical blue. No search bar is added at the top.
 2. **Calmer bands.** The band and top bar carry no dot texture, and the band's line drawing
    is fainter (0.08 light, 0.11 dark, from 0.11 and 0.14).
-3. **Primary buttons take the area colour.** Never black or ink-filled buttons, in either mode. First Nations keeps its own standard (v13.1), which holds its olive to the pill, current tab, icon tiles, day track and quotation accents, so its buttons stay neutral.
+3. **Primary buttons take the area colour.** This governs area primary actions in either mode; neutral account/system commands have their explicit responsibility under C10. First Nations keeps its own standard (v13.1), which holds its olive to the pill, current tab, icon tiles, day track and quotation accents, so its buttons stay neutral.
 4. **Filter chips stay on one line.** They scroll sideways with an edge fade and never wrap to
    leave one chip alone.
 5. **Red means overdue, lapsed or urgent only,** in both modes. Priority and category labels
@@ -272,6 +272,44 @@ upright tablet reads well with it.
 
 ---
 
+## C10 · Design-audit resolution (17 October 2026)
+
+**Chose.** The owner accepted the refined audit direction with the corrections recorded in the
+[local implementation handoff](audit-resolution-2026-10-17.md). This is bounded convergence:
+Clinical blue, Work ambient identities and approved dashboard display weights remain intentional.
+The 12px readability floor, 13px metadata and 17px medium roles remain; 14px supporting body copy
+uses the additive `--text-secondary` role rather than changing every `text-sm` consumer.
+
+**Access and discovery.** First Nations keeps its existing non-CDS/cultural-governance caveat
+persistently inline, with full About available only on request. No automatic first-visit Primer
+or dismissal flag is required. Work search has no automatic timed coachmark or promotional halo;
+its labelled control, requested help, shortcuts and actual focus outlines remain. Waiting counts
+are quiet; urgent styling belongs to overdue items, with exact totals accessible and discoverable.
+Decorative band watermarks hide below 768px and are inset at larger widths, without clipping
+interactive content. This insetting replaces the earlier intentional desktop-cropping treatment.
+
+**Action responsibility.** Area primary actions share `actionPrimary` through Button and
+`primaryControl`: Clinical blue by default and the Work area's action inside its frame. Neutral
+account/system actions explicitly use `commandControl`; destructive actions retain the danger
+face. This clarifies C8 rule 3's scope: an account/system command is not an area primary action.
+First Nations retains its own neutral-action standard. Choose the responsibility before the API;
+a Button import alone does not make an action primary, and native anchors may borrow a face
+without losing link behavior. The matching disabled recipe must accompany actual activation
+blocking for unavailable custom controls.
+
+**Preserved constraints.** Work reading pages stay 45rem and wide pages 64rem from 1024px under
+C9; no audit-wide conversion of CME reading pages is intended. Effective production targets stay
+48px with the existing documented exceptions; a checkbox square does not replace its whole label
+as the hit area. Existing composer ownership, hidden-zero reserve, cultural governance, clinical
+content/retrieval safeguards and the separate overseas-processing disclosure decisions remain.
+The bedside calculator panel stays hidden pending the separately recorded clinician verification.
+
+**Evidence.** The handoff distinguishes source changes, focused checks, browser journeys and
+unresolved acceptance. It does not declare every audit item fixed, approve visual baselines,
+replace the canonical task ledger, authorize provider actions or establish release readiness.
+
+---
+
 ## Q&A record — clinical inputs (31 July 2026)
 
 | #   | Question                                               | Answer                                                  | Design consequence                                                                                                                                                                                                                                                           |

docs/design-system/GATES.md

@@ -31,33 +31,33 @@ than CI, two of them by the second reader; review does not scale past two carefu
 | `arbitraryTracking`               | **0** (hard floor) | 0            |
 | `colourOnlyStatusIndicators`      | **0** (hard floor) | 0            |
 | `darkColorOverrides`              | **0** (hard floor) | 0            |
-| `disabledOpacityUses`             | 30                 | 21           |
-| `edgeOwnershipConflicts`          | 5                  | 2            |
-| `elevationInversions`             | 5                  | 4            |
+| `disabledOpacityUses`             | **0** (hard floor) | 0            |
+| `edgeOwnershipConflicts`          | **0** (hard floor) | 0            |
+| `elevationInversions`             | **0** (hard floor) | 0            |
 | `errorStateCountProps`            | **0** (hard floor) | 0            |
 | `failedStateResultCounts`         | **0** (hard floor) | 0            |
-| `handRolledCommandButtons`        | 8                  | 7            |
+| `handRolledCommandButtons`        | **0** (hard floor) | 0            |
 | `hardcodedCssMotionDurations`     | 21                 | 1            |
-| `interactiveTapFloorDeclarations` | 4                  | 3            |
+| `interactiveTapFloorDeclarations` | 2                  | 2            |
 | `layoutTransitionExceptions`      | 10                 | 4            |
 | `legacyPaletteUtilities`          | **0** (hard floor) | 0            |
-| `legacyShadowAliases`             | 30                 | 24           |
+| `legacyShadowAliases`             | 12                 | 11           |
 | `legacyTapClasses`                | **0** (hard floor) | 0            |
 | `literalShadowClasses`            | **0** (hard floor) | 0            |
 | `onePixelShadowSpreads`           | **0** (hard floor) | 0            |
 | `rawColorLiterals`                | **0** (hard floor) | 0            |
 | `rawCssZIndices`                  | 4                  | 1            |
-| `rawGapLiterals`                  | 10                 | 1            |
+| `rawGapLiterals`                  | 9                  | 1            |
 | `rawLineHeightLiterals`           | **0** (hard floor) | 0            |
 | `rawMarginLiterals`               | 6                  | 2            |
-| `rawPaddingLiterals`              | 21                 | 4            |
-| `rawRadiusLiterals`               | 14                 | 3            |
-| `sameFileTextSmMinusMix`          | 32                 | 32           |
+| `rawPaddingLiterals`              | 17                 | 2            |
+| `rawRadiusLiterals`               | 8                  | 3            |
+| `sameFileTextSmMinusMix`          | 30                 | 30           |
 | `statusColouredNumerals`          | **0** (hard floor) | 0            |
 | `textSoftConsumers`               | **0** (hard floor) | 0            |
-| `visibleLiveRegions`              | 17                 | 17           |
+| `visibleLiveRegions`              | 13                 | 13           |
 
-28 metrics, 13 of them pinned at zero. A metric at zero is a hard floor:
+28 metrics, 17 of them pinned at zero. A metric at zero is a hard floor:
 the check asserts `value <= baseline`, so any reintroduction fails. A non-zero pin is
 recorded debt with per-path pins, so a new occurrence fails even while the total stands.
 

docs/design-system/README.md

@@ -39,3 +39,5 @@ empty `files` so `check:design-system-adoption` / `check:design-system-contract`
 draft; human-approved Linux screenshots and exact hosted provenance remain the draft→ready gate,
 not a red CI check. Design project `08d6f126-3fd0-4764-aedf-0062a467280a` is not verified by this
 repository; local design-sync parity is not remote publication proof.
+
+Local implementation evidence: [17 October 2026 audit-resolution handoff](audit-resolution-2026-10-17.md) records all 32 original findings and eight assurance tasks, with unresolved acceptance and evidence limits. It is not the canonical task ledger.