Close the UI-review follow-ups: names typeahead, fleet form, overflow flip.

Staff pages typeahead customers by name (Ada, not cust_1). Add-machine is
two rows with a wide identity path and filename picker. Overflow menus
flip up near the viewport edge. Customer list no longer leaks password
hashes. UI-REVIEW.pdf remaining list is the three leftover items.

packages/ui-docs/scripts/build-review-pdf.py

@@ -117,11 +117,11 @@ def main():
     story.append(p("What was fixed in this pass", s["h1"]))
     items = [
         "CS / sales / accounting / access-staff restyled to the portal indigo system. Dollars and names, not cents forms.",
-        "Fleet replica and service actions collapsed to one overflow menu. Power column is status, not on/off toggles.",
-        "Add-machine roles are chips. Header copy is operator LAN · binds 0.0.0.0:3850 (NATS stays private).",
+        "Fleet replica and service actions collapsed to one overflow menu (flips up near the viewport edge). Power is status. Disabled machines are grey.",
+        "Add-machine is two rows: identity path is wide plus a filename picker; roles are chips. Header: operator LAN · binds 0.0.0.0:3850.",
         "Docs tab is cards. Trace hop grid wraps. Skip link and focus rings on staff and console.",
         "Simulator indigo; orange only on Inject faults.",
-        "Portal API key masked with Reveal / Copy / Regenerate. Invoice empty-state illustration.",
+        "Portal API key masked. Invoice and statement empty states are cards, not table rows. Staff typeahead uses customer names. STAFF_AUTH=1 uses verae-staff-session.",
         "Admin customers: list vs edit drawer. Invoice empty state.",
         "Catalog body font is system-ui. Swagger /docs labeled stock.",
     ]
@@ -134,16 +134,9 @@ def main():
     story.append(p("Issues still to consider", s["h1"]))
     remaining = [
         ["Severity", "Issue", "Suggestion"],
-        ["High", "Staff UIs look up by customer id; ledger often has no display name, so the heading is cust_1 not Ada.", "Join account-balance statements to zappier-edge customer name, or add a typeahead of customers."],
-        ["High", "Staff, portal, and admin have no session login on CS/sales/accounting HTML (LAN trust).", "Put a staff SSO or shared cookie in front of :3011–:3013 and :3025 before any non-lab bind."],
-        ["Med", "Catalog is still a long bibliography. Font is fixed; information architecture is not.", "Card index like the console Docs tab: Start here / Architecture / Modules."],
-        ["Med", "Swagger /docs remains stock.", "Keep it for integrators; do not skin it. Link it as 'OpenAPI explorer' only."],
-        ["Med", "Fleet add-machine form is dense; identity file still truncates in a narrow field.", "Two-row form: identity + roles on the second row with a file picker."],
-        ["Med", "lan-134 shows degraded/disabled in yellow while local/ns1 are green — correct, but the disable button looks like a fault.", "When a machine is intentionally disabled, use a neutral grey card, not degraded yellow."],
-        ["Low", "Portal statement empty cells still embed the empty illustration inside a table row.", "Drop the table when the list is empty; use the same card empty state as invoices."],
-        ["Low", "Overflow menus can open off-screen at the bottom of a long fleet table.", "Flip the menu upward when near the viewport edge."],
-        ["Low", "Access-staff and CS are nearly the same page.", "Keep both (plane vs department) but share one HTML template file."],
-        ["Low", "Simulator empty console is a large black void before the first run.", "Placeholder hop: 'Run a step to fill this trace.'"],
+        ["Med", "Swagger /docs remains stock.", "Keep it for integrators; do not skin it. Portal already labels it stock OpenAPI explorer."],
+        ["Low", "access-staff and CS HTML are twins.", "Share one template if those packages ever merge."],
+        ["Low", "Staff cookie is host-scoped (127.0.0.1).", "Fine on one operator host. Multiple DNS names need a reverse proxy."],
     ]
     body = getSampleStyleSheet()["BodyText"]
     body.fontSize = 8