Retroactive-STRIDE audit for Phase 11 (visual-design-responsive-layout-cleanup).
No plan-time threat model existed; register built from implementation files.
All 13 threats closed: 7 mitigated, 6 accepted with documented rationale.
threats_open: 0 — phase 11 security gate passes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Expand/collapse button, router-link label, and button label all get focus-visible:ring-2 focus-visible:ring-indigo-500 focus-visible:ring-offset-1
- :style skeleton width replaced with :class w-12/w-16/w-20 (same fix applied to AppSidebar in 11-05)
- Closes VISUAL-01 and VISUAL-03 gaps found by verifier
Task 2 — admin test classification:
- AdminAiConfigTab.test.js: RETAINED (tests AdminAiView.vue, a live component)
- AdminQuotasTab.test.js: RETAINED (tests AdminQuotasView.vue, a live component)
- AdminUsersTab.test.js: RETAINED (tests AdminUsersView.vue, a live component)
Task 3 — confirmed absent: HomeView.vue, FolderView.vue, AdminView.vue all absent
Task 4 — dead-code scan:
- FolderRow.vue: DELETED — no import in any live component; StorageBrowser renders
folder rows inline; FolderRow had no active route or active import (CLAUDE.md rule)
Task 5 — stale test removal:
- dropdown.test.js: removed 2 FolderRow tests (tested dead component);
kept 2 DocumentCard Teleport tests (protect live surface)
- No unused named imports found in live components
268/268 tests pass.
- Run ANALYZE=true npm run build after all Phase 11 optimizations
- Main bundle: 183.62 kB raw / 64.84 kB gzip (was 264.63 kB / 89.34 kB)
- SettingsView, TopicsView, DocumentView all now in separate lazy chunks
- 25 chunks total vs 15 at baseline
- AccountView.vue had no active route component reference
- /account path uses redirect: '/settings' with no component import
- No imports found across the entire codebase
- Satisfies CODE-07: no unreferenced route views remain
- Normalize page titles to text-2xl font-semibold (was font-bold in TopicsView, DocumentView, SharedView)
- Normalize section titles to text-lg font-semibold (was text-xl in SettingsPreferencesTab, SettingsAiTab, SettingsCloudTab, BackupCodesDisplay, CloudCredentialModal)
- Normalize panel headings to text-sm font-semibold (SettingsAccountTab, DocumentView)
- Normalize AdminOverviewView page title from text-xl to text-2xl font-semibold
- Replace decorative sidebar skeleton inline styles with static Tailwind width classes (w-12/w-16/w-20)
- Add focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500 focus-visible:ring-offset-1 to all interactive buttons across the app
- Add active:bg-* states to primary and secondary buttons for coherent press feedback
- Update nav-link scoped CSS in AppSidebar and AdminSidebar to include active:bg-gray-200 and focus-visible ring
- Add 7 new tests: VISUAL-01 skeleton class invariant, VISUAL-04 focus-visible invariant, VISUAL-03 typography invariant (36 test files, 270 tests pass)
- Add max-h-[90vh] overflow-y-auto to ShareModal, CloudCredentialModal,
FolderDeleteModal, and DocumentView cloud-delete modal panels
- Add responsive px-4 sm:px-6 to DocumentPreviewModal header for narrow viewports
- Add data-test attributes to all modal panels for testability
- Confirm @tailwindcss/forms active in tailwind.config.js (no drift found)
- Audit forms: focus:outline-none focus:ring-2 pattern is consistent throughout
- Add 4 test files covering mobile-safe modal classes and form baseline:
ShareModal.mobile.test.js, CloudCredentialModal.mobile.test.js,
FolderDeleteModal.mobile.test.js, DocumentPreviewModal.mobile.test.js
VISUAL-02, RESP-04
- Ran ANALYZE=true npm run build; copied stats.html to .planning/perf/phase11-baseline.html
- Added phase11-baseline-summary.md: chunk sizes, route lazy-load audit,
responsive/modal/typography/dead-code findings for plans 11-02..11-06
- Main bundle: 264.63 kB raw / 89.34 kB gzip; 5 user routes still synchronous
- Admin/auth routes already lazy-loaded; CSS 98.74 kB raw (expected for full UI)
- Wrapped config in async defineConfig factory so visualizer can be dynamically
imported only when ANALYZE=true; normal builds incur zero overhead
- Added frontend/stats.html to .gitignore (ephemeral artifact; canonical copy
lives in .planning/perf/)
- keyboard.test.js: Gap 4 test — matched.find(r => r.instances?.default) resolves to FileManagerView
- TreeItem.test.js: Gap 1 tests — animate-pulse present, 'Loading' text absent during shimmer state
- StorageBrowser.showSearch.test.js: Gap 2 tests — showSearch true for local+cloud at root
- All 219 tests pass (8 new, 211 existing)
- SearchBar.vue: add .prevent.stop to @keydown.escape to suppress browser native blur (Gap 5)
- OsDragOverlay.vue: register window drop listener with capture=true to fire before folder-row handlers (Gap 6)
- App.vue: add v-else-if branch for admin routes that renders only router-view (no AppSidebar)
- App.vue: replace routeViewRef with getFileManagerInstance() using matched.find(r => r.instances?.default)
- App.vue: remove unused ref import (Gap 3 + Gap 4)
- TreeItem.vue: replace 'Loading…' text with 3 animate-pulse shimmer rows
- StorageBrowser.vue: showSearch now true for mode=local OR mode=cloud (Gap 1 + Gap 2)
- App.vue: add v-else-if branch for admin routes that renders only router-view (no AppSidebar)
- App.vue: replace routeViewRef with getFileManagerInstance() using matched.find(r => r.instances?.default)
- App.vue: remove unused ref import (Gap 3 + Gap 4)
- TreeItem.vue: replace 'Loading…' text with 3 animate-pulse shimmer rows
- StorageBrowser.vue: showSearch now true for mode=local OR mode=cloud (Gap 1 + Gap 2)
curo1305