docs: polish Tiers 1-3 complete; Tier 2+3 local pending deploy

CHANGELOG.md

@@ -20,7 +20,7 @@ All notable changes to this project are documented here. Format follows [Keep a
 - Production report: a basic member filing an incident hit `new row violates row-level security policy for table "incidents"`, including the anonymous path. Not reproducible from source (the code and the 016/017 policy both permit it). Migration 025 idempotently re-asserts the hardened `incidents_insert` policy verbatim so the deployed policy converges to the known-good definition (access-neutral, no schema change). The file-incident action now maps an RLS rejection to an actionable message and logs the technical detail server-side. If the report persists after deploy, the root cause is not policy drift; see `docs/HANDOFF.md` for the discriminating queries.
 
 ### UX
-- Accessibility and consistency polish pass (Tier 1 systemic, in progress): distinct Ops nav icon (was a duplicate of Settings), `aria-current` on active nav, accessible mobile drawer (role/aria-modal, Escape, scroll lock, focus management), skip-to-content link, shared `BrandMark` in the sidebar, a shared `PageTitle`/`SectionTitle` primitive adopted app-wide, a single shared `Empty` primitive replacing ~18 ad-hoc empty states (projects gains a real empty state with a CTA), a shared accessible confirm dialog replacing all 13 native `window.confirm()` guards, a perceivable keyboard focus ring for form controls and links, larger touch targets at dense action hotspots, programmatic label/field association across the list-page forms, and surfaced toast errors on row mutations that previously failed silently. Still open: hand-rolled modals to Radix Dialog (Tier 1), plus Tier 2 first-run and Tier 3 security-adjacent polish.
+- Accessibility and consistency polish pass (Tier 1 systemic, in progress): distinct Ops nav icon (was a duplicate of Settings), `aria-current` on active nav, accessible mobile drawer (role/aria-modal, Escape, scroll lock, focus management), skip-to-content link, shared `BrandMark` in the sidebar, a shared `PageTitle`/`SectionTitle` primitive adopted app-wide, a single shared `Empty` primitive replacing ~18 ad-hoc empty states (projects gains a real empty state with a CTA), a shared accessible confirm dialog replacing all 13 native `window.confirm()` guards, a perceivable keyboard focus ring for form controls and links, larger touch targets at dense action hotspots, programmatic label/field association across the list-page forms, and surfaced toast errors on row mutations that previously failed silently. All hand-rolled modals were converted to the accessible Radix dialog (focus trap, ESC, aria). A founder alone in a new empty space now sees a guided getting-started checklist instead of a grid of zeros; the onboarding Skills field is controlled (survives Back/forward) with a hint when a required acknowledgement is unchecked. Security-adjacent UX (presentational only, no RLS change): revealed secrets get copy-to-clipboard plus auto re-hide after 30s / on window blur / on unmount; the permissions matrix shows a view-only notice to non-admins and labels every checkbox; the Ops access editor pills are accessible toggles with a saved-state toast. Polish Tiers 1-3 complete; Tiers 4-5 (auth/landing brand coherence, per-surface) deferred.
 
 ### Security
 - Closed two member self-escalation paths: a non-privileged member can no longer change their own `tier_id` or `onboarding_completed_at` on the `space_members` row (migration 024 extends the self-change trigger). Onboarding completion now goes through the service client after server-side validation.

docs/HANDOFF.md

@@ -17,15 +17,16 @@ User screenshot: a basic active member filing an incident at `/incidents/new` (a
 - **DEPLOYED** as a minimal hotfix off `origin/main` (commit `1340b4c`, GitHub Actions run 25953569904 success, 1m0s; deploy.sh ran the idempotent migration runner so `025` applied): `scripts/025` re-asserts the hardened `incidents_insert` verbatim (access-neutral; fixes cause #2 only); `fileIncident` maps an RLS rejection to an actionable message and logs detail server-side. `scripts/schema.sql` already matched (no change).
 - **Still needs user verification:** retry filing an incident on prod. If it still fails, cause #2 is excluded; run the SQL below to confirm #1 vs #3.
 
-### UX polish — Tier 1 COMPLETE (S1-S8 deployed; S3 `108c2a5` local/unpushed); Tier 2/3 next
+### UX polish — Tiers 1-3 ALL COMPLETE. S1-S8+S3 deployed; Tier 2 `a1ea92a` + Tier 3 `b7461f0` LOCAL/unpushed
 
 - Full UI/UX audit done (5 partitioned agents, code-level; no live browser). User chose: implement Tiers 1-3, pause before 4-5; sidebar nav stays as-is (no role-filtering); comments get one-level nesting + edit (Tier 5, deferred). Findings report grouped Tier 1 systemic / 2 first-run / 3 security-adjacent / 4 brand / 5 per-surface.
 - Deployed commits (each was build+test green): `3360f54` sidebar/drawer a11y + distinct Ops icon + skip link + BrandMark; `92ba6fb` shared `PageTitle`/`SectionTitle` (21 files); `f885ac7` shared `Empty` (~18 states, projects gained one); `1db9434` shared accessible confirm (ConfirmProvider/useConfirm) replacing all 13 `window.confirm`; `075b274` `:focus-visible` ring (unlayered, in `app/globals.css`) + 44px tap targets at named hotspots + 28 form-field id/htmlFor + search aria-labels + claim/complete/delete/link handlers toast `result.error`. Plus preexisting `fa71d9a` (a prior HANDOFF doc, not this session) and doc commits.
 - **Not browser-verified (no live browser this session):** smoke-test on prod the two behavior-changing pieces — the shared confirm dialog on every destructive action (delete member/role/tier/area/invite/onboarding-step/secret/KB/comment/project/contact/thread) and the mobile drawer (open/ESC/scroll-lock/focus); also eyeball the global focus ring and the dense-row tap-target `-my-2` spacing.
 - **Tier 1 COMPLETE.** S3 done in commit `108c2a5` (LOCAL, unpushed): every hand-rolled modal converted to Radix `components/ui/dialog.tsx` (focus trap/ESC/aria) — ops (4), members/tasks/projects/contacts add-edit, settings integration-credentials, plus the payments Log-Cash AND Link-Member modals. Forms/handlers/validation/close-reset preserved; `onOpenChange` mirrors old Cancel/X. Build clean, 271/271. 0 residual `fixed inset-0` modal overlays. Not browser-verified: smoke-test each modal opens/submits/ESC-closes.
-- **Tier 2 (next, not started):** founder first-run guided dashboard when the space is empty (`app/(app)/dashboard/page.tsx`); onboarding Skills controlled value + required-ack hint (`app/onboarding/onboarding-flow.tsx`).
-- **Tier 3 (after Tier 2):** secrets copy + auto re-hide + clear-on-unmount; permissions matrix read-only notice + per-checkbox aria-label; OpsAclEditor `aria-pressed`/check/toast. Presentational-only, must stay inside the RLS guardrail (no change to reveal action, `user_has_permission`, `ops_acl`, self-change trigger).
-- Sequence: finish Tier 2 + Tier 3, deploy, THEN the forms feature.
+- **Tier 2 DONE** (`a1ea92a`, local): founder first-run guided dashboard when the space is empty (admin/board alone, no data) replaces the zero grid with a 4-step checklist; reverts once there is activity. Onboarding Skills is now a controlled field (survives Back/forward, no normalize surprise) + a hint when a required ack is unchecked.
+- **Tier 3 DONE** (`b7461f0`, local, presentational only — RLS guardrail respected): secrets revealed value gets copy-to-clipboard + auto re-hide after 30s + re-hide on window blur + timer cleared on unmount; permissions matrix shows a view-only notice for non-admins + per-checkbox `aria-label`; OpsAclEditor pills are `aria-pressed` toggles with a selected check + success toast. No server action / RLS / permission logic changed.
+- **Open: deploy Tier 2+3** (`a1ea92a` + `b7461f0` + this doc commit, 2-3 commits ahead of `origin/main`). Awaiting user push approval. Not browser-verified: smoke-test the first-run dashboard (new empty space) and the secrets copy/auto-hide.
+- Sequence: deploy Tier 2+3, THEN the forms feature (next major effort; design + decisions locked, see below).
 
 ### Forms + waivers feature (designed 2026-05-16, build deferred until after polish Tiers 1-3)