fix(mobile): render security-agent empty-state copy in centered layouts

[iscekic]

Changelog for users

• The security-agent audit report empty state now shows "No recorded activity" and its period description instead of only the icon.
• The audit report's unavailable state for viewers without access now shows its title and description.
• The dismiss-finding screen's not-found, cannot-dismiss, already-resolved, and load-error states now show their copy.
• The findings filter screen's no-filters state now shows its title and description.

Changelog for maintainers

• Centered EmptyState and QueryError children no longer receive flex-1; a flexBasis-0% child collapses to zero height inside CenteredState's auto-height wrapper and hides the measured copy.
• The change covers the audit report empty and forbidden states, the dismiss-finding not-found/cannot-dismiss/already-resolved and query-error states, and the filter no-filters state.
• Mounted tests assert the centered EmptyState receives no flex-1 class in the empty and unavailable audit-report states.
• Review the security-agent screens first: another centered empty or error state that still passes flex-1 reproduces the blank state.

E2E proof

[e1] audit-report-empty on android (emulator-5554) — android emulator-5554, fresh empty account; SCENE digest on the Audit report screen shows TextView "No recorded activity" and "Kilo has no reportable Security Finding activity from 6/22/2026 to 9/19/2026." under the icon (nothing blank), screenshot e1-audit-report-empty.png.

[e2] Audit report unavailable as org viewer (getAuditReport FORBIDDEN/UNAUTHORIZED), title+description under ShieldOff, no Retry — android emulator-5604, packed tree: signed in as the org member/viewer (user d9cf5453-dffd-4bab-acf1-6e508a61f03c) and switched Profile -> account selector to org 9bf50ece-75bd-4652-88e3-8b69a0734489, then opened the org-context Audit report screen; the procedure rejection is proved by the server log line '[trpc] query organizations.securityAgent.getAuditReport failed: UNAUTHORIZED' (e2-audit-unavailable.server.log, nextjs.log line 353) and by the batched 'POST /api/trpc/organizations.securityAgent.getAuditReport,...?batch=1 207' at line 358; the rendered state is proved by the scene digest…

E2E proof — log excerpts

[e1] Open a finding's dismiss screen for a finding that no longer exists (delete -> pass :: android emulator-5554; e1-scene.log lines 8-9: "android.widget.TextView Finding not found tappable [375,1200][706,1265]" and "android.widget.TextView This finding may have been removed, or you no longer have access to it. tappable [56,1274][1025,1366]" - the not-found title (65px) and description (92px) sit inside centered-state-content, so the removed flex-1 no longer collapses them; Finding not found is the product string for this state. No UX-DEFECT at behaviour level (one centered-state, no stacked loaders).
[e1b] Audit report empty state (owner-request surface audit-report-empty) -> pass :: android emulator-5554; e1b-scene.log lines 8-9: "android.widget.TextView No recorded activity tappable [351,1200][730,1265]" and "android.widget.TextView Kilo has no reportable Security Finding activity from 6/22/2026 to 9/19/2026. tappable [56,1274][1025,1366]" - the empty-state title (65px) and description (92px) render inside centered-state-content, proving the flex-1 collapse is fixed; contrast/legibility belongs to the visual reviewer.

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-audit-report-empty-the-empty-state-title-no-reco-05d15-5d3b/e2e-mobile-app/e1-scene.log

SCENE e1 OK
android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]
android.widget.Button Go back tappable [37,84][138,185]
android.view.View Dismiss finding tappable [138,102][944,167]
android.widget.ScrollView centered-state tappable [0,213][1080,2400]
android.view.ViewGroup centered-state-content tappable [0,1035][1080,1366]
android.widget.TextView Finding not found tappable [375,1200][706,1265]
android.widget.TextView This finding may have been removed, or you no longer have access to it. tappable [56,1274][1025,1366]
android.view.View Home, tab, 1 of 3 tappable [0,2195][360,2337]
android.widget.TextView HOME tappable [13,2281][347,2320]
android.view.View Agents, tab, 2 of 3 tappable [360,2195][720,2337]
android.widget.TextView AGENTS tappable [373,2281][707,2320]
android.view.View Profile, tab, 3 of 3 tappable [720,2195][1080,2337]
android.widget.TextView PROFILE tappable [733,2281][1067,2320]

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-audit-report-empty-the-empty-state-title-no-reco-05d15-5d3b/e2e-mobile-app/e1b-scene.log

SCENE e1b OK
android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]
android.widget.Button Go back tappable [0,149][101,250]
android.view.View Audit report tappable [111,167][1044,232]
android.widget.ScrollView centered-state tappable [0,278][1080,2400]
android.view.ViewGroup centered-state-content tappable [0,1035][1080,1366]
android.widget.TextView No recorded activity tappable [351,1200][730,1265]
android.widget.TextView Kilo has no reportable Security Finding activity from 6/22/2026 to 9/19/2026. tappable [56,1274][1025,1366]
android.view.View Home, tab, 1 of 3 tappable [0,2195][360,2337]
android.widget.TextView HOME tappable [13,2281][347,2320]
android.view.View Agents, tab, 2 of 3 tappable [360,2195][720,2337]
android.widget.TextView AGENTS tappable [373,2281][707,2320]
android.view.View Profile, tab, 3 of 3 tappable [720,2195][1080,2337]
android.widget.TextView PROFILE tappable [733,2281][1067,2320]

Owner request

Explorer finding: audit-report-empty: The empty-state title 'No recorded activity' and its description render at near-invisible contrast against the light background, unlike the readable empty state on other screens.

The user-agent explorer found this while using the app like a user.
One finding per item; the explorer never edits product code.

Flow: audit-report-empty
Found on revision: fd04ca1

Repro:

1. set this state first: a wiped install on a brand-new account
2. open the app on emulator-5602
3. reach the screen the capture names (audit-report-empty)
4. the capture shows the defect named below

Observed: The empty-state title 'No recorded activity' and its description render at near-invisible contrast against the light background, unlike the readable empty state on other screens.
Expected: the screen renders without this defect

Evidence (from the device run):

Follow-ups (not changed here)

• not proved live: On emulator-5602 with a wiped install on a brand-new account, open Profile -> Security Agent -> Audit report for a period with no recorded activity: the centered empty state shows the FileText icon above the title 'No recorded activity' and its period description, both dark and legible on the light background (nothing blank below the icon). (no capture cited it)
• not proved live: Open a finding's dismiss screen for a finding that no longer exists (deleted/dismissed in another session): the 'Finding unavailable' title and description render legibly. (no capture cited it)
• not proved live: Open the same Audit report screen as an org viewer the getAuditReport procedure rejects (FORBIDDEN/UNAUTHORIZED): the 'Audit report unavailable' title and description are both legible under the ShieldOff icon, with no Retry. (no capture cited it)

Open findings (not fixed here)

• not proved live: audit-report-empty.png is no longer on the host that took it, so no publish can carry it

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Removing flex-1 from centered EmptyState/QueryError usages in the security-agent screens correctly avoids the flexBasis-0% collapse inside CenteredState's auto-height wrapper, and the added assertions match the new contract with no runtime, security, or regression concerns.

Files Reviewed (4 files)

• apps/mobile/src/app/(app)/(tabs)/(3_profile)/security-agent/[scope]/filter.tsx
• apps/mobile/src/components/security-agent/audit-report-screen.mounted.test.tsx
• apps/mobile/src/components/security-agent/audit-report-screen.tsx
• apps/mobile/src/components/security-agent/dismiss-finding-screen.tsx

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

This description names a scenario the proof did not capture:

• not proved live: On emulator-5602 with a wiped install on a brand-new account, open Profile -> Security Agent -> Audit report for a period with no recorded activity: the centered empty state shows the FileText icon above the title 'No recorded activity' and its period description, both dark and legible on the light background (nothing blank below the icon). (no capture cited it)

A repeated proof run rebuilds the same evidence, so no proof run is dispatched for a named gap. Merging with this gap open is your decision.