# Console UI/Interaction Audit Register

This is the durable source for the ongoing whole-project UI review. Add a row when a reviewer identifies a concrete issue; do not erase resolved rows. Every UI change must point to a before/after evidence key in the screenshot manifest.

## PR extraction checklist

Use the resolved rows for the PR description:

1. State the user-facing problem and its affected flow.
2. State the safety or accessibility invariant that now holds.
3. Attach the matching before/after comparison images from the manifest. Do not put local filesystem paths in the PR description.
4. List focused tests and the full quality gates that passed.
5. Keep any unresolved row visible as follow-up scope; do not imply it was fixed.

## Audit record

| ID     | Surface                   | Finding                                                                                                                                                                                        | Impact                                                                                                              | Resolution                                                                                                                                                                                           | Evidence key               | Status   |
| ------ | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | -------- |
| UI-001 | Running status            | Loading, partial, and failed server data were visually conflated.                                                                                                                              | Operators could act on stale or incomplete health information.                                                      | Separated status states and added explicit feedback/retry treatment.                                                                                                                                 | `running-status-10`        | Resolved |
| UI-002 | Pool operations           | Long-running rebalance/decommission flows did not consistently expose state, errors, and mobile-safe actions.                                                                                  | Destructive operations were difficult to verify and recover from.                                                   | Added state-aware action handling, error surfaces, and responsive layouts.                                                                                                                           | `pool-operations-9`        | Resolved |
| UI-003 | Bucket settings           | Configuration tabs had inconsistent hierarchy and several flows could reset state, mask errors, or apply unsafe replication semantics.                                                         | Misconfiguration risk and poor recovery in lifecycle, events, replication, and encryption flows.                    | Normalized settings layout; preserved form state; surfaced errors; corrected replication role semantics.                                                                                             | `bucket-settings-11`       | Resolved |
| UI-004 | SSE status                | A failed status request could be displayed as “not configured”, while stale backend/metrics remained visible; long default key IDs could overflow mobile cards.                                | Operators could configure or mutate KMS from an untrusted state, and mobile users could lose key context.           | Keep the failure distinct from unconfigured; hide all stale details; block stateful actions while status syncs; wrap identifiers.                                                                    | `sse-16-overview`          | Resolved |
| UI-005 | SSE configuration         | Long configuration form had weak grouping, incomplete required semantics, and no field-targeted client-side error recovery.                                                                    | High cognitive load and inaccessible error correction.                                                              | Use fieldsets/legends, client validation with focus, and native/ARIA required state.                                                                                                                 | `sse-14-progressive`       | Resolved |
| UI-006 | SSE mutations             | KMS create/reconfigure/key actions could overlap or proceed from stale status; uncertain responses left the UI unverified.                                                                     | Conflicting writes and incorrect default-key deletion decisions.                                                    | Serialize mutations, keep create locked while key inventory is loading or failed, reconcile uncertain outcomes from the server, and recheck default-key status before delete.                        | `sse-16-recaptured-states` | Resolved |
| UI-007 | SSE key actions           | Mobile cards dropped schedule/cancel deletion actions; immediate deletion was over-prominent.                                                                                                  | Mobile users did not have desktop-equivalent, safe key management.                                                  | Provide action parity and present staged deletion before immediate deletion.                                                                                                                         | `sse-18-key-card-flow`     | Resolved |
| UI-008 | SSE confirmation          | Key dialogs did not name the target/default-key risk; service restart/stop bypassed confirmation.                                                                                              | Operators could apply destructive/disruptive actions without enough context.                                        | Target-aware destructive confirmation, service-state confirmation, and dismissal lock while processing.                                                                                              | `sse-17-service-stop`      | Resolved |
| UI-009 | SSE secrets               | Diagnostic request logging could expose credentials.                                                                                                                                           | Vault token leakage through client diagnostics.                                                                     | Redact secret-bearing request fields before logging.                                                                                                                                                 | `sse-13-security`          | Resolved |
| UI-010 | SSE Local backend         | Local KMS was offered without the backend contract needed to preserve/validate an opaque master key; a reconfiguration could make existing keys unreadable.                                    | Production Local KMS configuration and default-key updates could weaken secret handling or make data unrecoverable. | Make Local configuration read-only in Console until the backend offers preservation plus verified rotation; keep Local default-key changes server-managed.                                           | `sse-16-local-safety`      | Resolved |
| UI-011 | SSE unsaved form          | Sidebar navigation, browser history, and page exit could silently discard a long KMS configuration form.                                                                                       | Operators could lose backend settings or newly-entered credentials.                                                 | Keep a server baseline, guard unload/link/history navigation, and prohibit discarding while a mutation is in progress.                                                                               | `sse-16-dirty-form`        | Resolved |
| UI-012 | IAM user/group selectors  | Multi-select controls did not expose their selected state, search purpose, or listbox semantics; edit mode could also leave keyboard focus behind.                                             | Keyboard and assistive-technology users could not reliably understand or resume the current edit flow.              | Added named search fields, put multiselect semantics on the actual CommandList, synchronized selected state around cmdk's active-option attribute, and restored focus only on real edit transitions. | `iam-13-a11y`              | Resolved |
| UI-013 | SSE configuration         | Reliability and cache controls made the mobile KMS form unnecessarily tall and pushed the primary actions below the fold.                                                                      | First-time operators had to scan a dense expert-only section before reaching the save/reset actions.                | Grouped retry/cache controls under a native Advanced Settings disclosure; validation state reopens the section when an affected field needs attention.                                               | `sse-14-progressive`       | Resolved |
| UI-014 | IAM group tables          | Members and policy tables had no explicit accessible name in the reusable table primitive.                                                                                                     | Screen-reader users could lose context when several tables or dialogs were present.                                 | Added an optional visually-hidden table caption and supplied localized captions for the Members and Policies tables without changing the visual layout.                                              | `iam-14-captions`          | Resolved |
| UI-015 | OIDC configuration        | Claim and role mapping controls occupied the same long mobile flow as the connection credentials and redirect settings.                                                                        | Operators had to scan a dense expert-only section before reaching the next page section.                            | Kept provider identity, credentials, scopes, and redirect controls visible; moved claim/role mapping into a native Advanced Settings disclosure.                                                     | `oidc-15-progressive`      | Resolved |
| UI-016 | Module switch settings    | A failed module-switch read left an empty bordered panel after the toast disappeared, with no local retry and no visible indication that values were unavailable.                              | Operators could mistake an unavailable settings read for an empty configuration and could not recover in context.   | Added a persistent destructive alert with the error detail and Sync retry; retained stale values as non-editable while a refresh is unresolved.                                                      | `settings-20-error`        | Resolved |
| UI-017 | Access-key dialogs        | Long credential forms could push actions out of the viewport and did not consistently explain expiry or field errors.                                                                          | Operators could lose the only chance to copy credentials or submit a corrected form.                                | Fixed the dialog header/body/footer layout, kept actions reachable, and added expiry guidance plus field-specific validation.                                                                        | `remaining-21`             | Resolved |
| UI-018 | User/group workflows      | Assignment and edit dialogs could grow with badges, conflate loading/error/empty states, and retry already-succeeded requests.                                                                 | Bulk IAM changes were hard to recover and could leave users unsure which groups were updated.                       | Bounded dialog bodies, added explicit state/retry treatment, compact selection summaries, and retry only failed group operations.                                                                    | `remaining-21`             | Resolved |
| UI-019 | Shared tables/navigation  | Pagination and table semantics were difficult to use on narrow screens and lacked context for assistive technology.                                                                            | Keyboard and mobile users could lose table context or fail to reach page actions.                                   | Added captions/sort semantics, mobile pagination layout, and a single predictable overflow surface.                                                                                                  | `remaining-21`             | Resolved |
| UI-020 | Utility surfaces          | Long filenames, object rows, and license text could overflow or become unreadable on narrow screens.                                                                                           | Import/export and inspection tasks required horizontal scrolling or clipped content.                                | Added bounded readable surfaces, safe wrapping, and mobile-first action alignment.                                                                                                                   | `remaining-21`             | Resolved |
| UI-021 | Authentication surfaces   | Login/configuration hero layouts and actions did not consistently use dynamic viewport sizing or touch-safe targets.                                                                           | Mobile sign-in could be clipped or require imprecise taps.                                                          | Switched to dynamic viewport-safe layout and full-width 44px mobile actions.                                                                                                                         | `remaining-21`             | Resolved |
| UI-022 | Rule/task dialogs         | Event, audit, lifecycle, replication, tier, and site-replication forms could hide their footer actions behind long content.                                                                    | Operators could not reliably save or cancel long configuration flows.                                               | Standardized one scrolling body with fixed header/footer and disabled dismissal while submitting.                                                                                                    | `remaining-21`             | Resolved |
| UI-023 | Dialog/form hierarchy     | Full rectangular borders were reused for outer surfaces, semantic groups, descriptions, metadata, and progress states.                                                                         | Repeated nested frames weakened hierarchy, increased cognitive load, and made passive content look interactive.     | Initial remediation mechanically replaced boxes with recursive separators, while its fixture misrepresented the real hierarchy. Rework and valid recapture are pending.                              | `border-depth-22` invalid  | Open     |
| UI-024 | Section divider hierarchy | SSE configuration repeats dividers across sibling fieldsets, Advanced Settings, and nested cache content; key details and site-replication content also stack dividers across semantic levels. | Repeated lines imply false parent-child relationships and make content appear detached from its heading.            | Use one divider system only between peer sections; use headings and spacing inside a section, and remove duplicate dividers after already-divided metadata.                                          | Pending live capture       | Open     |
| UI-025 | Passive metadata surfaces | SSE status metrics, selected-pool details, and site-replication peer metadata are rendered as complete framed panels inside an existing Card or dialog surface.                                | Passive values look interactive and create card-inside-card depth.                                                  | Replace nested panels with definition lists, open grids, muted backgrounds, or a single section separator while retaining warning and selection affordances.                                         | Pending live capture       | Open     |
| UI-026 | Compound editor rows      | Lifecycle/replication tag editors, access-key policy switches, and IAM edit panels add complete frames around already-bordered controls inside dialogs.                                        | Repeated outlines increase density and make ordinary fields look like independent subcards.                         | Keep input/control outlines, but express the containing editor row with spacing, a muted background, or one sibling divider unless it is itself a selectable object.                                 | Pending live capture       | Open     |
| UI-027 | Login form                | The desktop form pane used 7/12 of the split panel and allowed a short credential form to expand to `max-w-md`.                                                                                | Credential fields looked visually loose and the form outweighed the supporting hero.                                | Balanced the desktop split at 1/2 and constrained the credential form to `max-w-sm` without changing mobile behavior.                                                                                | `layout-followup-27`       | Resolved |
| UI-028 | Edit Policy dialog        | The complete form body owned vertical scrolling and the policy editor had a 24rem minimum height with manual resizing.                                                                         | Name/context and editor moved together, and the editor could force an unnecessarily tall dialog.                    | Kept the form body fixed, made the Policy field consume remaining space, and confined scrolling to a non-resizable textarea with a 12rem minimum.                                                    | `layout-followup-27`       | Resolved |
| UI-029 | Running status controls   | Mobile `min-h-11` rules were also applied at desktop widths to Refresh, server filters, and the Sort by trigger.                                                                               | Compact status toolbars appeared stretched and misaligned with surrounding desktop controls.                        | Preserved 44px controls on small screens and restored the shared compact control height from `sm` upward.                                                                                            | `layout-followup-27`       | Resolved |
| UI-030 | Bucket rule detail pages  | Events, Replication, and Lifecycle rendered Add/Refresh in a second toolbar below the page header, separate from Back navigation.                                                              | Related page-level actions were split across two rows and displaced the table downward.                             | Added a tab header render seam and composed Back, Add, and Refresh together in the page header for all three scoped bucket pages.                                                                    | `layout-followup-27`       | Resolved |
| UI-031 | Top navigation account    | The account artwork and its button trigger were both 32px high, so the circular avatar consumed the trigger's complete vertical space.                                                         | The avatar visually touched the trigger boundary and crowded adjacent top-navigation controls.                      | Reduced the artwork to 24px while retaining the 32px button target, leaving a visible 4px inset around the avatar.                                                                                   | `avatar-inset-28`          | Resolved |

### Reconciled border rule

Keep at most two structural frame levels. A region may use one complete outline; nested groups should use spacing, background, headings, or a single separator unless the nested element is itself an input, warning/error, or explicit interactive choice.

Dividers only express relationships between peer sections. Use one aligned divider system per surface; do not recursively add dividers to an ancestor and its descendants.

### Border hierarchy sweep coverage

The 2026-07-11 follow-up reviewed 44 candidate files containing cards, dialogs, fieldsets, details, or form borders. Dialog header/footer dividers, alerts, selectable option tiles, mobile entity cards, table/list boundaries, upload zones, and progress strips were retained where the border communicates a real surface, state, or affordance. UI-024 through UI-026 capture the remaining cross-page patterns.

| Finding | Confirmed source locations                                                                                                                                                                                                                                                                              |
| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| UI-024  | `app/(dashboard)/sse/page.tsx:1087`, `app/(dashboard)/sse/page.tsx:1340`, `app/(dashboard)/sse/page.tsx:1388`, `app/(dashboard)/sse/page.tsx:1887`, `components/site-replication/new-form.tsx:258`                                                                                                      |
| UI-025  | `app/(dashboard)/sse/page.tsx:943`, `app/(dashboard)/sse/page.tsx:961`, `app/(dashboard)/pool-decommission/page.tsx:625`, `app/(dashboard)/pool-decommission/page.tsx:647`, `components/site-replication/edit-form.tsx:180`                                                                             |
| UI-026  | `components/lifecycle/new-form.tsx:575`, `components/replication/new-form.tsx:517`, `components/access-keys/new-item.tsx:312`, `components/user/edit/access-keys.tsx:352`, `components/user-group/edit-form.tsx:143`, `components/user-group/members.tsx:168`, `components/user-group/policies.tsx:207` |

## Deferred design debt

| ID     | Date       | Source                   | Severity | What                                                                                                                 | Affected users                                      | Suggested fix                                                                         | Status   | Notes                                                                                                                                                                   |
| ------ | ---------- | ------------------------ | -------- | -------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DD-001 | 2026-07-10 | SSE visual review        | Minor    | SSE form remains a dense expert workflow after grouping.                                                             | Operators configuring Vault/KMS for the first time. | Evaluate progressive disclosure for advanced retry/cache fields after usage feedback. | Resolved | Reliability/cache fields are now progressively disclosed; backend and default-key fields remain visible.                                                                |
| DD-002 | 2026-07-10 | SSE accessibility review | Minor    | Key details and configuration error recovery need a final keyboard/screen-reader session against a live KMS backend. | Keyboard and assistive-technology users.            | Add e2e coverage once a stable KMS fixture is available.                              | Resolved | Live fixture DOM snapshot verified labelled KMS fields, table caption, and alertdialog name/description/buttons; source tests remain in `tests/lib/sse-safety.test.js`. |
| DD-003 | 2026-07-10 | IAM accessibility review | Minor    | Members and policy tables still need explicit captions/summary text for screen-reader context.                       | Keyboard and assistive-technology users.            | Add captions or labelled table containers without changing the visual layout.         | Resolved | Added localized sr-only captions to both tables; visual-neutral before/after captures are retained.                                                                     |

## Evidence rules

- `before` and `after` must be captured from the actual current component tree at the same viewport and state.
- A static fixture is allowed only to illustrate a state that cannot safely be produced locally; label it as a fixture and do not present it as runtime proof.
- Comparison images are append-only. If implementation changes, create a new evidence key; do not overwrite prior proof.
- `sse-14-progressive` and `iam-14-captions` use temporary static fixtures for deterministic screenshots; treat the source/tests as the implementation proof until live backend captures replace them.
- `oidc-15-progressive` uses a temporary static fixture for deterministic screenshots; treat the source/tests as the implementation proof until a live OIDC backend capture replaces it.
- `settings-20-error` and `remaining-21` use temporary static fixtures for deterministic before/after comparisons; the source/tests remain authoritative until live component captures replace them.
- `border-depth-22` is invalid because the fixture invented a nested SSE hierarchy that does not match the component tree. Do not cite it as improvement evidence.
- `layout-followup-27` is a source-faithful static fixture for the four changed layout relationships; source tests and component code remain the implementation proof until authenticated live captures replace it.
- `avatar-inset-28` is a source-faithful static fixture for the exact 32px trigger and 32px-to-24px artwork change; source tests and component code remain authoritative.
- The full on-disk mapping is maintained in the screenshot manifest next to the image archive.

## Latest verification

| Date       | Checks                            | Result                                                                   |
| ---------- | --------------------------------- | ------------------------------------------------------------------------ |
| 2026-07-11 | `pnpm type-check`                 | Passed                                                                   |
| 2026-07-11 | `pnpm lint`                       | Passed                                                                   |
| 2026-07-11 | `pnpm format:check`               | Passed                                                                   |
| 2026-07-11 | `node --test tests/lib/*.test.js` | 187 passed                                                               |
| 2026-07-11 | `pnpm build`                      | Passed; Next.js emitted only the existing multiple-lockfile root warning |
| 2026-07-11 | `git diff --check`                | Passed                                                                   |
| 2026-07-11 | Screenshot archive integrity      | 61 comparison images readable; temporary fixture routes removed          |
| 2026-07-11 | `border-depth-22` evidence        | Files readable, but evidence invalid; temporary fixture routes removed   |
| 2026-07-11 | Border hierarchy source sweep     | 44 candidate files reviewed; 3 unresolved cross-page patterns recorded   |
| 2026-07-11 | `layout-followup-27` evidence     | Before, after, and comparison PNGs readable; temporary fixture removed   |
| 2026-07-11 | `avatar-inset-28` evidence        | Before, after, and comparison PNGs readable; temporary fixture removed   |
