fix(web): UX audit remediation #270-#277 — a11y toasts, HITL approve guard, token/legacy cleanup, design docs - #278
Merged
Merged
Conversation
added 9 commits
September 20, 2026 22:24
…270) - container role=status aria-live=polite; error toasts role=alert - success/error/info icons give a non-color cue (WCAG 1.4.1)
Single mis-click no longer approves; button flips to 'Confirm?' for 3s with aria-pressed + consequence copy in title. Both table and card views.
…275) - truncate sites get title attr (dashboard captions, media filename) - DataTable sortable th: native button inside th + aria-sort; rows unchanged
…witcher removed (#275) - Escape closes mobile drawer; body scroll locked while open - Mentions nav icon -> AtSign (was duplicate of Comments) - sidebar footer clock emoji -> Lucide Clock - remove never-rendered account-switcher state/handler/CSS - StatSkeleton: drop unused label prop, fix invalid h-2.4 class
…le (#274) - calendar grid renders 35-cell skeleton while loading (no bare text) - DataTable empty branch uses the shared EmptyState component
) - ScheduleDetail/PostDetail footer buttons migrated to Button variants - delete .btn-primary/.btn-outline (0 usage) + admin .btn-* variants - drop redundant unlayered .text-sm (Tailwind emits it from @theme) - remove !important from .detail-dialog (unlayered CSS wins anyway)
- web/design/TOKENS.md: layer map, OKLCH recipe, rules, shadcn mapping - web/design/COMPONENT-STANDARDS.md: canonical components + contracts - rewrite web/README.md (was sv template boilerplate), link both docs
svelte-sonner, vaul-svelte, embla-carousel-svelte, formsnap, sveltekit-superforms — zero imports in web/src. Build + svelte-check clean.
🔍 Cora AI Code Review✅ No issues found. Code looks good! Review powered by cora-code · BYOK · MIT |
Fixes RUSTSEC-2026-0285 (rustls TLS 1.3 handshake cross-boundary issue) and clears the chacha20 yanked warning. rsa RUSTSEC-2023-0071 remains (no fix available, allowlisted in security.yml).
This was referenced Sep 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Full remediation of the 2026-09-20 UX/UI code audit (scope:
web/), tracked across #270-#277. Two HIGH findings (a11y-silent toasts, unguarded HITL approve), all MEDIUM findings (token leaks, dual styling system, inconsistent states, truncate titles, sort a11y, mobile drawer), all LOW findings (icons, dead code, deps), plus the formal design-token spec and component standards docs.Issue → Commit Map
--color-bg-subtle/--color-accent-subtle,radius-pillon avatars, strip all hex fallbacksd78fa1frole=alerterrors, per-type icons1eb81c4aria-pressed), both viewsf37be3dtitleon truncates, button-in-th sort +aria-sort, drawer Escape + scroll lock,AtSign/Clockicons, dead switcher removed, StatSkeleton fixed34f5e04,93518f1EmptyStatea1f88cfButton, delete.btn-*layer (−135 lines),.text-smcollision resolved,!importantdroppedf562c8aweb/design/TOKENS.md+web/design/COMPONENT-STANDARDS.md+ README rewrite86b5019svelte-sonner,vaul-svelte,embla-carousel-svelte,formsnap,sveltekit-superformsd4c75e4Verification
npx svelte-check --threshold error→ 0 errors (36 pre-existing warnings, unchanged)bun run build→ exit 0, artifacts completevar(--x, #…)= 0 · legacy.btn-*in markup = 0 · emoji in chrome = 0 · bare "Loading" text = 0 · toast live-region + alert roles presentOut of scope (noted in issues)
approved/pendingschedules (needs API design).