docs: HANDOFF/CHANGELOG reflect S5-S8 done, S3 + Tier 2/3 remaining

CHANGELOG.md

@@ -20,7 +20,7 @@ All notable changes to this project are documented here. Format follows [Keep a
 - Production report: a basic member filing an incident hit `new row violates row-level security policy for table "incidents"`, including the anonymous path. Not reproducible from source (the code and the 016/017 policy both permit it). Migration 025 idempotently re-asserts the hardened `incidents_insert` policy verbatim so the deployed policy converges to the known-good definition (access-neutral, no schema change). The file-incident action now maps an RLS rejection to an actionable message and logs the technical detail server-side. If the report persists after deploy, the root cause is not policy drift; see `docs/HANDOFF.md` for the discriminating queries.
 
 ### UX
-- Accessibility and consistency polish pass (Tier 1 systemic, in progress): distinct Ops nav icon (was a duplicate of Settings), `aria-current` on active nav, accessible mobile drawer (role/aria-modal, Escape, scroll lock, focus management), skip-to-content link, shared `BrandMark` in the sidebar, a shared `PageTitle`/`SectionTitle` primitive adopted app-wide, and a single shared `Empty` primitive replacing ~18 ad-hoc empty states (projects gains a real empty state with a CTA).
+- Accessibility and consistency polish pass (Tier 1 systemic, in progress): distinct Ops nav icon (was a duplicate of Settings), `aria-current` on active nav, accessible mobile drawer (role/aria-modal, Escape, scroll lock, focus management), skip-to-content link, shared `BrandMark` in the sidebar, a shared `PageTitle`/`SectionTitle` primitive adopted app-wide, a single shared `Empty` primitive replacing ~18 ad-hoc empty states (projects gains a real empty state with a CTA), a shared accessible confirm dialog replacing all 13 native `window.confirm()` guards, a perceivable keyboard focus ring for form controls and links, larger touch targets at dense action hotspots, programmatic label/field association across the list-page forms, and surfaced toast errors on row mutations that previously failed silently. Still open: hand-rolled modals to Radix Dialog (Tier 1), plus Tier 2 first-run and Tier 3 security-adjacent polish.
 
 ### Security
 - Closed two member self-escalation paths: a non-privileged member can no longer change their own `tier_id` or `onboarding_completed_at` on the `space_members` row (migration 024 extends the self-change trigger). Onboarding completion now goes through the service client after server-side validation.

docs/HANDOFF.md

@@ -20,8 +20,8 @@ User screenshot: a basic active member filing an incident at `/incidents/new` (a
 ### UX polish (Tiers 1-3; local only, NOT deployed)
 
 - Full UI/UX audit done (5 partitioned agents, code-level; no live browser). User chose: implement Tiers 1-3, pause before 4-5; sidebar nav stays as-is (no role-filtering); comments get one-level nesting + edit (Tier 5, deferred).
-- Local commits (build+test green 271/271 each): (1) `3360f54` accessible sidebar/drawer + distinct Ops icon + skip link + BrandMark; (2) `92ba6fb` shared `PageTitle`/`SectionTitle` across 21 files; (3) `f885ac7` shared `Empty` across ~18 empty states (projects gains one); (4) `1db9434` shared accessible `confirm()` (ConfirmProvider/useConfirm) replacing all 13 `window.confirm`. Plus preexisting `fa71d9a` (HANDOFF doc, not this session's) and `64d7d62` (these docs).
-- **Open in Tier 1:** S3 hand-rolled modals -> Radix Dialog (ops x4, members/tasks/projects/payments/contacts x5, settings integration modal); S5 tap targets; S6 focus-visible; S7 silent mutation-failure toasts; S8 form label/id associations. **Tier 2** (founder first-run dashboard, onboarding Skills/ack) and **Tier 3** (secrets copy+auto-hide, permissions matrix read-only notice + aria, OpsAclEditor toggles) not started. None of the UX commits are pushed; deploy decision pending.
+- Local commits (build+test green 271/271 each): (1) `3360f54` accessible sidebar/drawer + distinct Ops icon + skip link + BrandMark; (2) `92ba6fb` shared `PageTitle`/`SectionTitle` across 21 files; (3) `f885ac7` shared `Empty` across ~18 empty states (projects gains one); (4) `1db9434` shared accessible `confirm()` (ConfirmProvider/useConfirm) replacing all 13 `window.confirm`; (5) `075b274` S6 unlayered `:focus-visible` ring + S5 >=44px tap targets at named hotspots + S8 28 form-field id/htmlFor + search aria-labels + S7 claim/complete/delete/link handlers now toast `result.error`. Plus preexisting `fa71d9a` (HANDOFF doc, not this session's) and doc commits `64d7d62`/`ea49e21`.
+- **Tier 1 remaining = S3 only:** convert hand-rolled modals to the existing Radix `components/ui/dialog.tsx` (focus trap/ESC/aria for free). Targets: `ops/ops-client.tsx` (4: KbModal, AddSecretModal, AreaLeadModal, KB-view), `members/tasks/projects/payments/contacts-client.tsx` (1 add/edit modal each), `settings/settings-client.tsx` (integration-credentials modal ~569-660). Each is a `fixed inset-0` div with local open-state; swap to `<Dialog open onOpenChange>` + `DialogContent`, keep the form/handlers. Do modal-by-modal with a gate per group. **Tier 2** (founder first-run guided dashboard when space empty; onboarding Skills controlled value + required-ack hint) and **Tier 3** (secrets copy + auto re-hide + clear-on-unmount; permissions matrix read-only notice + per-checkbox aria-label; OpsAclEditor `aria-pressed`/check/toast) not started; Tier 3 is presentational-only inside the RLS guardrail. None of the UX commits are pushed; deploy decision pending. `ux-polish-wip` branch backs up the pre-restructure stack and can be deleted once trust is established.
 
 ### Pending decision / next step