chore: migrate Tailwind v4 while preserving dashboard design

docs/.vitepress/config.ts

@@ -1,11 +1,10 @@
 import { defineConfig } from 'vitepress'
-import { withMermaid } from 'vitepress-plugin-mermaid'
 
 // teslasync.dev serves the site from /. Forks without a custom domain can
 // set DOCS_BASE to their GitHub Pages project path (e.g. /teslasync/).
 const base = process.env.DOCS_BASE || '/'
 
-export default withMermaid(defineConfig({
+export default defineConfig({
   title: 'TeslaSync Docs',
   titleTemplate: ':title — TeslaSync Docs',
   description:
@@ -76,6 +75,15 @@ export default withMermaid(defineConfig({
   },
 
   markdown: {
+    config(md) {
+      const fence = md.renderer.rules.fence!
+      md.renderer.rules.fence = (tokens, index, options, env, self) => {
+        if (tokens[index].info.trim() === 'mermaid') {
+          return `<MermaidDiagram :source="${md.utils.escapeHtml(JSON.stringify(tokens[index].content))}" />`
+        }
+        return fence(tokens, index, options, env, self)
+      }
+    },
     theme: { light: 'github-light', dark: 'github-dark' },
     image: { lazyLoading: true },
   },
@@ -219,16 +227,4 @@ export default withMermaid(defineConfig({
     lastUpdatedText: 'Updated',
   },
 
-  mermaid: {
-    theme: 'neutral',
-    themeVariables: {
-      fontFamily: 'Inter, ui-sans-serif, system-ui, sans-serif',
-      primaryColor: '#f5f4f0',
-      primaryTextColor: '#1c1917',
-      primaryBorderColor: '#e82127',
-      lineColor: '#78716c',
-      secondaryColor: '#fafaf9',
-      tertiaryColor: '#ffffff',
-    },
-  },
-}))
+})

docs/.vitepress/theme/MermaidDiagram.vue

@@ -0,0 +1,47 @@
+<script setup lang="ts">
+import { onBeforeUnmount, onMounted, ref, useId, watch } from 'vue'
+
+const props = defineProps<{ source: string }>()
+const svg = ref('')
+const id = `mermaid-${useId().replace(/[^a-zA-Z0-9_-]/g, '')}`
+let generation = 0
+let mounted = false
+
+async function render() {
+  const current = ++generation
+  svg.value = ''
+  try {
+    const { default: mermaid } = await import('mermaid')
+    await document.fonts.ready
+    if (!mounted || current !== generation) return
+    mermaid.initialize({
+      startOnLoad: false,
+      securityLevel: 'strict',
+      layout: 'dagre',
+      theme: 'neutral',
+      themeVariables: {
+        fontFamily: 'Inter, ui-sans-serif, system-ui, sans-serif',
+        primaryColor: '#f5f4f0',
+        primaryTextColor: '#1c1917',
+        primaryBorderColor: '#e82127',
+        lineColor: '#78716c',
+        secondaryColor: '#fafaf9',
+        tertiaryColor: '#ffffff',
+      },
+    })
+    const result = await mermaid.render(`${id}-${current}`, props.source)
+    if (mounted && current === generation) svg.value = result.svg
+  } catch (error) {
+    // Keep the original diagram readable if a future syntax is unsupported.
+    console.error('Documentation diagram could not render', error)
+  }
+}
+onMounted(() => { mounted = true; void render() })
+watch(() => props.source, () => { if (mounted) void render() })
+onBeforeUnmount(() => { mounted = false; generation++ })
+</script>
+
+<template>
+  <div v-if="svg" class="mermaid" v-html="svg" />
+  <pre v-else class="mermaid-source"><code>{{ source }}</code></pre>
+</template>

docs/.vitepress/theme/index.ts

@@ -3,6 +3,7 @@ import { h } from 'vue'
 import './theme.css'
 import DocTools from './DocTools.vue'
 import HomePage from './home/HomePage.vue'
+import MermaidDiagram from './MermaidDiagram.vue'
 
 function installConsoleNote() {
   // eslint-disable-next-line no-console
@@ -134,6 +135,7 @@ export default {
   },
   enhanceApp({ app }: { app: { component: (name: string, comp: unknown) => void } }) {
     app.component('HomePage', HomePage)
+    app.component('MermaidDiagram', MermaidDiagram)
     if (typeof window === 'undefined') return
     installConsoleNote()
     installDiagramOverlay()

docs/ci-handoff.md

@@ -1,4 +1,129 @@
-# CI handoff — PR #198 (ui/simplification)
+# CI handoff — post-merge PR #202
+
+## CI — 2026-10-21 final source is remotely green
+
+Draft [PR #202](https://github.com/ev-dev-labs/teslasync/pull/202),
+`fix/post-merge-followups` to `main`, head `f84aad0ce7`:
+**199 successful checks, one existing conditional skip, zero failures or pending checks**.
+Frontend Quality run `39534812045`, CI `39534812154`, Security `39534812081`
+and Performance `39534812123` all completed successfully. No merge performed.
+
+Three pushed source heads were needed: the first exposed the strict 400KB
+startup budget; the second exposed 44px action targets and late mocked-request
+teardown in WebKit. Lazy tour loading, shared 44px header targets in a 28px
+line, restored body space and complete navigation/request settling fixed the
+causes. The third also includes newly available Vite6.4.4 and Go1.27.3 security
+patches. No workflow changes, reduced thresholds, new skips or tolerance changes.
+
+A1–7 and the shared widget-header item are implemented. Export is hidden because
+the existing API does not guarantee secret redaction; Duplicate creates a disabled
+copy and opens it. Insurance "0..60" remains an explicit owner decision, with
+backend/form disagreement and audit origin recorded in `followups-plan.md`.
+The separate Tailwind v4 draft is eligible now that PR202 is green.
+
+Final local security-environment rerun: all57,191 unit tests pass (four existing
+pending), complete lint/audits and route/catalog/contracts checks pass; Go build,
+tests, route generator and CI-pinned lint pass. All16 quality shards pass2,029 tests (two existing skips), all10 Windows visual
+shards pass49 (41 existing profile skips), a11y13 and Firefox/WebKit6 pass.
+Every browser wrapper reports zero proxy escapes; zero retries in this fresh
+sweep. Eight375/768/1280/1920 light/dark dashboard captures are saved in
+`D:/tmp/dashboard-widget-header-review.html`. Isolated performance9/9 also passes, zero proxy escapes.
+All temporary logs, screenshots and comparisons remain outside Git in `D:/tmp`.
+
+The sections below preserve earlier checkpoints; this CI section is authoritative.
+
+## Post-merge continuation — 2026-10-20
+
+PR #198 was squash-merged as `c353a59399`. Active work now starts from
+`origin/main` (`e6c401fba1`) on `fix/post-merge-followups`. Do not merge or
+cherry-pick any former redesign branches. The owner supplied the remaining
+product decisions; `followups-plan.md` is the active execution plan.
+
+### Latest security refresh — 2026-10-21 02:05 UTC
+
+Vite6.4.4 now replaces6.4.3 in web and the docs override, addressing the
+[Windows existence-check advisory](https://github.com/advisories/GHSA-587h-7wmj-h5pm),
+[Windows argument-escaping advisory](https://github.com/advisories/GHSA-698v-4r3x-3vcv)
+and [editor argument advisory](https://github.com/advisories/GHSA-r825-w8mm-5pxw).
+A final refresh had raised audits to web10/docs2; after sequential single-package
+updates with all tests/previews stopped, web returns9 (7 high/2 moderate), docs0.
+Only Vite versions changed; npm also normalized three web lockfile dev flags.
+Patched private/mock/docs builds and full strict perf:check pass (399.6KB/400KB).
+All20 Mermaid diagrams on seven pages render, zero browser errors; no snapshots
+changed for dependency patches.
+
+A refreshed Go scan newly reports reachable GO-2026-6809 in Go1.27.2 x509,
+fixed in1.27.3. Raised go.mod to1.27.3 and the automatic Windows toolchain is
+verified. All workflows already use go-version-file; Docker follows1.27, so
+no workflow edits. Go build/test and route generation pass. CI-pinned
+golangci-lint2.15.0 rebuilt with1.27.3 reports0 issues; govulncheck now
+reports0 reachable/0 imported-package/1 uncalled-module vulnerabilities.
+x/crypto0.58.0 remains latest; uncalled OpenPGP GO-2026-5932 has no fixed version.
+The previous fully passing header-source unit/browser sweep is preserved in
+the progress log; the full replica repeats after these environment patches.
+Tailwind v4 still waits for PR202 to pass every remote check.
+
+### Latest local correction — 2026-10-21 01:20 UTC
+
+The44px target correction exposed two driving/1440 catalogue failures:
+Speed discipline was clipped because the header line grew16px. The shared
+action cluster now keeps its28px title line while44px hit targets fit inside
+the existing header padding. This retains body space, target size, tight
+spacing and dot alignment. Eight responsive guards also check action bounds.
+Focused66 tests pass; translations/source fingerprints are generator-verified.
+Fresh mock build, all726 registry rows, eight responsive cases and eight
+repeated driving cases pass, zero escapes. Five final dashboard PNGs are byte-
+identical to the reviewed f6d6be4106 versions; restored them after comparison,
+discarding the intermediate taller-header captures. Dashboard6/6 pass. Full
+replica continues; the32-worker unit run hit two30s source-scan timeouts, so
+the entire affected shard repeats under its two-worker limit. No timeout
+change. The previous full units were
+57,191/0/4 existing pending, direct lint/Go/strict private perf all green
+(399.7KB/400KB), but previous-artifact browsers do not count for this correction.
+No per-widget patch, assertion relaxation or workflow change.
+
+Product/security work is implemented; draft PR #202 remains open to main.
+Its first pushed head ce1e14ddff completed 198 passing checks, one existing
+conditional skip, and one failure: Lighthouse's strict startup-size preflight
+(400.5 KB versus the unchanged 400 KB budget). Commits 6aadcb5913 and cad1237f5f
+load the tour launcher on request and regenerate verified preservation pins.
+The current private build and complete perf:check pass at 399.7 KB after the
+additional widget work. No workflow, budget, coverage or tolerance change.
+
+Owner-added widget-header work takes priority before the next push: remove
+DashboardGrid's pr-28 reservation and independent edit/expand overlays; put
+controls in the sole shared header before its edge-aligned dot. VehicleHero's
+body dot and status decoration are removed, preserving status/provenance.
+Static widgets get a neutral, untimestamped indicator rather than fabricated
+freshness. Title-less shells now use the same translated fallback header.
+The ownership regression fails before and passes after; affected units 230/230.
+All 121 widgets pass six min/default/large x view/edit configurations, including
+exactly one dot, <=2px inset/centering deltas and <=8px action gaps. Eight new
+375/768/1280/1920 light/dark tests also pass hover/edit geometry and save shots;
+all wrappers report zero proxy escapes. Original before/after captures and
+review output remain in D:/tmp, not Git.
+
+Full local replica is repeating before the next push. Remote head f6d6be4106
+is on fix/post-merge-followups, with main only the draft PR202 merge target.
+The preceding local full Vitest passed57,191/0 (four existing pending cases),
+all10 Windows visual shards, a11y and Firefox/WebKit passed; quality15/16
+shards passed. Quality3 exposed the existing44px Expand requirement. Shared
+Expand/edit controls now retain44px targets with8px gaps. The existing
+collision guard follows the owner's new icon-before-dot order while retaining
+hit testing, focus, readable text and minimum spacing, adding maximum8px.
+Focused230 units and all four workspace collision cases pass; registry and
+full-suite reruns continue. Verified source checkpoints are generator-produced.
+
+Reviewed and regenerated exactly five dashboard baselines again for the
+intentional44px header height:390dark/light,1440dark/light,forced-colors.
+Degraded unchanged. No masks, tolerances or coverage changed. Comparisons and
+captures remain outside Git. The remote WebKit3/3 job118970569625 passed its
+assertions but failed the strict proxy guard on late GET /api/v1/settings.
+The mobile navigation test lacked the mock-completion guard already used by
+its sibling tests; added that assertion/drain before teardown and repeating
+both engines, retaining the strict preview escape check.
+Tailwind v4 remains a separate later draft PR, conditional on A/B PR fully green.
+Historical PR #198 details below are evidence, not checkout/push instructions.
 
 ## Final CI closeout — 2026-10-20 03:25 UTC
 - Verified implementation head **f0c63853df84a507212ac637d1a6a481aa4ee586**, pushed only to `ui/simplification`: `gh pr checks 198 --json state` reports **204 SUCCESS / 3 SKIPPED**, with no pending or failed checks. All five branch-protection checks pass. Worktree was clean before this documentation closeout. Earlier pending/failure entries below are chronological history, not current blockers.