DS Drift Patrol — 1 finding (week of 2026-06-18)

[sure-design]

DS Drift Patrol — 1 finding

Scan period: 2026-06-11 → 2026-06-18 (commits merged to main)
Open PRs scanned: 20 open PRs — all CLEAN
Merged commits scanned: 9 UI-relevant commits — 1 violation

---

Finding 1 — Rule 1: Raw <details> bypasses DS::Disclosure

Commit: c29380ce — feat(dashboard): masonry packing + per-widget size controls (#2328) (merged 2026-06-15)
File: app/views/pages/dashboard.html.erb

Introduced + lines:

<details
  class="relative hidden lg:block"
  data-controller="dashboard-widget-size"
  data-dashboard-widget-size-section-key-value="<%= section[:key] %>"
  data-action="keydown->dashboard-widget-size#stopKeydown">
  <summary
    class="focus-ring list-none cursor-pointer text-secondary hover:text-primary transition-colors p-0.5 opacity-0 group-hover:opacity-100 [&::-webkit-details-marker]:hidden"
    aria-label="<%= t("pages.dashboard.widget_size.label") %>">
    <%= icon("sliders-horizontal", size: "sm", class: "!w-3.5 !h-3.5") %>
  </summary>
  <div class="absolute right-0 top-full mt-1.5 z-10 w-48 p-2.5 space-y-2.5 bg-surface rounded-xl shadow-border-xs border border-primary">
    ...
  </div>
</details>

Rule broken: Raw <details>/<summary> element used instead of DS::Disclosure.

Good news — the fix is already available: Commit beec50b4 (merged the same day, 2026-06-15) added a body_class: option to DS::Disclosure specifically to handle this pattern — pass body_class: nil to suppress the mt-2 body wrapper for absolutely-positioned popovers. This is exactly the mechanism needed for the size menu.

Suggested fix:

<%= render DS::Disclosure.new(
      body_class: nil,
      data: {
        controller: "dashboard-widget-size",
        dashboard_widget_size_section_key_value: section[:key],
        action: "keydown->dashboard-widget-size#stopKeydown"
      }) do |disclosure| %>
  <% disclosure.with_summary_content do %>
    <span class="sr-only"><%= t("pages.dashboard.widget_size.label") %></span>
    <%= icon("sliders-horizontal", size: "sm", class: "!w-3.5 !h-3.5") %>
  <% end %>
  <div class="absolute right-0 top-full mt-1.5 z-10 w-48 p-2.5 space-y-2.5 bg-surface rounded-xl shadow-border-xs border border-primary">
    ...
  </div>
<% end %>

The summary can be made accessible either via aria-label on the <summary> element or an sr-only span in the summary content (the same approach used in goals/_color_picker.html.erb after beec50b4).

---

Scan coverage

• Open PRs scanned: fix(auth): block local account creation in pure SSO-only mode #2076, fix(sophtron): correct pluralization, guard rescue update!, and surfa… #2075, fix(providers): allow non-admins to view Bank sync page #2073, fix(assistant): coerce JSON-string array args from LLM tool calls #2072, fix(trades): guard against nil security in create_trade #2066, fix(imports): enforce account write permissions #2065, [Bug]: API v1 trades ignore account-share permissions #2056, fix(reports): escape formula prefixes in CSV category export #2054, feat(retirement): PR3 — FIRE forecast engine + live what-if #2047, feat(retirement): PR2 — data plane (pension sources, statements, adjustments, bucket) + CRUD #2046, fix: request OIDC groups claims explicitly #2045, feat(retirement): PR1 — preview-gated /retirement scaffold (Goal::Retirement STI) #2044, feat(accounts): add full activity filters #2041, fix: Fail SureImport publish when readback verification reports mismatch #2039, fix: Sanitize API import error responses to prevent internal exception leakage #2037, Fix API CSV import silent success when row generation fails #2035, Fix Sure NDJSON create/upload validation to reject malformed later lines #2033, fix(sync): skip pending auto-claim when multiple same-amount candidat… #2015, fix(holdings): use trade-date FX rate for cost basis price conversion #2014, Russian language support added #2005, fix(reports): exclude investment_contribution from expense totals (#1750) #1999, fix(transactions): include one-time in reports, keep out of budget medians #1995, fix(family-sharing): scope form + import account lists to accessible_accounts (#1803) #1989, fix(sync): scope after_commit to prevent nil family error on destroy #1976, fix(api): scope valuations create/show/update by account-level access #1973, Show category hierarchy in transaction and rule dropdowns #1969, improve performance for SessionsController#create #1961 — all CLEAN
• Merged commits with UI changes scanned: c29380ce (dashboard masonry), 007f84db (settings debugs refactor), 6ea931f3 (YNAB import), 09dc4281 (rules re-apply), d908560e (cashflow deep-link), e342ac4a (accounts subtype), beec50b4 (DS goals color picker fix), 2d3d9744 (DS tokens in rules/llm tables), 59b2e59a (DS focus ring dashboard)
• All six checks applied to + diff lines only; DS source files, tests, locales, migrations, and generated assets excluded.

/cc @gariasf

[sure-design]

DS Drift Patrol — supplemental scan (PRs 2370–2405 + missed merged-commit finding)

Scan date: 2026-06-19

---

Additional finding — commit c29380ce (same commit as Finding 1 above)

The initial scan filed Rule 1 for this commit. A second pass catches a Rule 2 violation in the same file that was missed:

Rule 2: Non-functional Tailwind token (ring-gray-900)

Commit: c29380ce — feat(dashboard): masonry packing + per-widget size controls
File: app/views/pages/dashboard.html.erb

Introduced + line:

<section
  class="bg-container rounded-xl shadow-border-xs transition-all group focus:outline-none focus-visible:ring-2 focus-visible:ring-gray-900 focus-visible:ring-offset-2<%= " 2xl:col-span-2" if two_column && section[:layout][:col_span] == "full" %>"

Rule broken: focus-visible:ring-gray-900 uses a raw gray palette color instead of a DS functional focus token. The canonical pattern is focus-ring utility class (or ring-alpha-black-* if custom sizing is needed).

Suggested fix:

<section class="bg-container rounded-xl shadow-border-xs transition-all group focus:outline-none focus-ring<%= " 2xl:col-span-2" if ... %>">

---

Open PRs 2370–2405 scan

Result: ZERO violations across all 19 PRs in this range.

• PRs skipped (no UI files): 2370, 2376, 2378, 2380, 2382, 2384, 2386, 2388, 2390, 2392, 2397, 2399, 2402, 2403, 2405 — mobile/Dart, model, controller, YAML, or Docker Compose only.
• PRs with UI files — all clean:
  • fix(settings): preserve scroll position in settings nav #2373 — app/views/layouts/settings.html.erb: border-divider DS functional token. ✓
  • feat(mcp): add get/create/update tools for tags and categories #2374 — app/components/UI/account_filter.html.erb: DS::Popover, icon(), DS functional tokens throughout. ✓
  • feat(up): add Up Bank (AU) provider integration #2391 — Up Banking provider integration (4 ERB files): DS::Disclosure, DS::Button, DS::Link, DS::Alert, DS::Dialog, DS::Menu, DS::Tooltip as: :span, w-full wrappers in disclosures, all DS tokens, all text via t(). ✓
  • refactor(imports): header-less settings_section #2395 — app/views/imports/index.html.erb: bg-container-inset, text-secondary, text-subdued, DS tokens, t() throughout. ✓

/cc @gariasf

---

Generated by Claude Code