# UI issues still to consider

Follow-up to the 2026-09-11 review PDF. Items the review listed as open are now implemented except the three left below.

## Resolved from the review list

| Severity | Issue | What shipped |
|----------|-------|----------------|
| High | Staff headings showed `cust_1` | Ledger stores names (`customer.put`). Staff UIs typeahead customers from edge (`GET /customers`) and review by name. |
| High | CS/sales/accounting HTML had no login | `verae-staff-session` :3027. Set `STAFF_AUTH=1` and `STAFF_SESSION_URL` on department servers. |
| Med | Catalog was a bibliography | Catalog index is cards (Start here / Architecture / Modules). |
| Med | Fleet identity field truncated | Two-row add-machine form; identity path is a wide field plus a filename picker. |
| Med | Disabled machines looked like faults | Intentionally disabled cards are grey (`disabled`), not degraded yellow. |
| Low | Portal statement empty cells in a table | Empty lists use the same card empty state as invoices. |
| Low | Overflow menus off-screen | Menu flips upward when near the bottom of the viewport. |
| Low | Simulator empty console was a black void | Placeholder: “Run a step to fill this trace.” |

## Still to consider

| Severity | Issue | Suggestion |
|----------|-------|------------|
| Med | Swagger `/docs` remains stock | Keep it for integrators; do not skin. Portal already labels it as stock OpenAPI explorer. |
| Low | access-staff and CS HTML are twins | Share one template file if those packages ever merge. |
| Low | Staff cookie is host-scoped (`127.0.0.1`) | Fine on one operator host. For multiple DNS names, put a reverse proxy in front. |

## How to use each surface

- **Operator** http://127.0.0.1:3850/ — Fleet (replicas, overflow, grey disabled machines), Trace, Docs.
- **Staff CS** :3011 — type a customer name, Review, credit in USD. `STAFF_AUTH=1` redirects to :3027.
- **Sales** :3012 — review / quote by name.
- **Accounting** :3013 — review + QuickBooks IIF / CSV.
- **Staff plane** :3025 — same review/credit after authz.
- **Customers** /portal — masked API key, empty invoice/statement cards.
- **Ops** /admin — customer list + edit drawer.
- **Lab** simulator :3847.
- **Catalog** https://zapier.georgelambert.org/ — card index, system-ui.