[epic] Post-PRD-018-SC-2 audit follow-ups (PR #85 multi-expert review)

[fedorovvvv]

Source: 5-agent multi-expert audit of PRD-018 SC-2 — shared/ui integration across 7 widgets/pages on develop (merged via PR #85).

Verdict: APPROVE_WITH_FIXES (weighted score 6.82/10)
Task completion (PRD-018 SC-2 acceptance): 4/4 ✅

This umbrella tracks the 13 follow-up issues filed from the audit. Migration is structurally complete and svelte-check-clean (0/0 on 1039 files), but introduced:

• 2 silent a11y regressions (theme switcher lost radiogroup, Timeline collapse uses wrong ARIA pattern)
• ~13 rule-24 :global() violations on primitive internals (mono-uppercase ghost, square icon button, accent-outlined toggle, banner Alert)
• 4 type casts hiding real source-of-truth gaps behind the green npm run check
• 2 latent reactivity bugs (notify race, auto-collapse $effect re-firing on poll)
• Rule-24 enforcement gap — verification grep does not actually run on this repo

Children

🔴 Critical (a11y regressions)

• [a11y][critical] HealthBar theme switcher: ToggleGroup type="single" lost radiogroup semantics #86 — HealthBar theme switcher lost role="radiogroup" semantics
• [a11y][critical] Timeline collapse: Toggle uses aria-pressed, disclosure needs aria-expanded #87 — Timeline collapse Toggle uses aria-pressed instead of aria-expanded

🟠 Rule-24 cleanup track

• [rule-24] Add primitive variants to retire :global() overrides (mono Button/Badge/Toggle/Alert) #88 — Add primitive variants to retire :global() overrides (mono Button/Badge/Toggle/Alert)
• [rule-24] Fix verification grep — rg --type svelte not recognized by ripgrep #89 — Fix verification grep — rg --type svelte not recognized
• [rule-24] Tag existing :global() violations with TODO(rule-24-cleanup) markers #90 — Tag existing :global() violations with TODO(rule-24-cleanup) markers

🟡 A11y / refactor

• [a11y] InsightsRail tabs lack ARIA tablist/tab — migrate to Tabs primitive #91 — InsightsRail tabs lack ARIA tablist/tab — migrate to Tabs primitive
• [refactor] Replace ArtifactPanel hand-rolled links-toggle with Collapsible primitive #92 — Replace ArtifactPanel hand-rolled links-toggle with Collapsible primitive

🟡 Type safety

• [type-safety] HealthBar: drop as ThemeMode cast; type permission as NotificationPermission #93 — HealthBar: drop as ThemeMode cast; type permission as NotificationPermission
• [type-safety] HomePage: drop as typeof liveNodes/liveEdges casts; type SnapshotStore payload #94 — HomePage: drop as typeof liveNodes/liveEdges casts; type SnapshotStore payload
• [type-safety] Push ArtifactKind/ArtifactStatus discriminated unions through Filters widget #98 — Push ArtifactKind/ArtifactStatus discriminated unions through Filters

🟢 Bugs / quality

• [bug] HealthBar notify race: rapid toggle during async permission prompt #95 — HealthBar notify race during async permission prompt
• [bug] ArtifactPanel auto-collapse $effect re-fires on poll due to implicit outgoing.length dep #96 — ArtifactPanel auto-collapse $effect re-fires on poll (implicit outgoing.length dep)
• [code-quality] Add FIXME(pointer-capture-race) comment + small cleanups in migrated files #97 — Add FIXME(pointer-capture-race) + small cleanups in migrated files

Suggested order

1. Land [a11y][critical] HealthBar theme switcher: ToggleGroup type="single" lost radiogroup semantics #86, [a11y][critical] Timeline collapse: Toggle uses aria-pressed, disclosure needs aria-expanded #87 first — actual regressions for screen-reader users.
2. Fix enforcement ([rule-24] Fix verification grep — rg --type svelte not recognized by ripgrep #89) so new rule-24 violations cannot sneak in via CI.
3. Ship the missing primitive variants ([rule-24] Add primitive variants to retire :global() overrides (mono Button/Badge/Toggle/Alert) #88) in one PR — retires 7 of 13 :global() violations.
4. Tag remaining ([rule-24] Tag existing :global() violations with TODO(rule-24-cleanup) markers #90) so the grep-the-debt workflow works.
5. Type-safety pass ([type-safety] HealthBar: drop as ThemeMode cast; type permission as NotificationPermission #93, [type-safety] HomePage: drop as typeof liveNodes/liveEdges casts; type SnapshotStore payload #94, [type-safety] Push ArtifactKind/ArtifactStatus discriminated unions through Filters widget #98) in a separate PR.
6. Latent bugs ([bug] HealthBar notify race: rapid toggle during async permission prompt #95, [bug] ArtifactPanel auto-collapse $effect re-fires on poll due to implicit outgoing.length dep #96) and refactors ([a11y] InsightsRail tabs lack ARIA tablist/tab — migrate to Tabs primitive #91, [refactor] Replace ArtifactPanel hand-rolled links-toggle with Collapsible primitive #92, [code-quality] Add FIXME(pointer-capture-race) comment + small cleanups in migrated files #97) as time allows.

Audit traceability

• Reviewers (parallel): Logic & Correctness, Architecture/FSD/Rule-24, TypeScript-pro, Security/a11y, Frontend/Svelte-5/UX
• Driving artifacts: PRD-018, RFC-016, EVID-022, EVID-023
• Related rule: .claude/rules/24-shared-ui-ownership.md