# Responsive CDP overflow triage and post-merge UAT repair

Use this recipe when a green release reveals a responsive defect only after deployment.

## Exact-viewport probe

1. Launch a temporary headless Chromium CDP target against the real deployed URL.
2. Set `Emulation.setDeviceMetricsOverride` to the exact CSS viewport width and height. Keep `mobile=false` when it changes `innerWidth`; enable touch separately with `Emulation.setTouchEmulationEnabled`.
3. Wait for the product-ready marker, then record only aggregate checks:
   - expected coverage/status text present;
   - desktop table vs mobile cards visibility;
   - `document.documentElement.scrollWidth - clientWidth`;
   - console/page errors;
   - provider-resource requests during normal render.
4. Open the first detail surface and verify geometry, close-button focus, Escape closure, and focus return.

## Overflow localization without leaking data

If overflow is nonzero, do not dump page text or production records. Evaluate every element's bounding box and report only elements with `right > clientWidth` or `left < 0`, limited to tag, test ID, CSS classes, and rounded bounds. Grid items often retain min-content width even when an inner label uses `truncate`; add `min-w-0` to the grid container and item and `w-full` to the item, then repeat the same exact-width probe.

## Release handling

A post-merge UAT defect invalidates the deployed candidate but does not justify editing deployed files directly:

1. create the smallest fix commit on a branch;
2. add a focused class/contract regression assertion where layout engines are unavailable in unit tests;
3. rerun the complete affected frontend suite, typecheck, and production build;
4. validate the fix against an isolated preview wired to the production API read-only path;
5. push, open a follow-up PR, await the full repository CI, and merge normally;
6. deploy the new exact remote-main merge SHA;
7. rerun laptop, tablet, and mobile production UAT and repeat protected business digests;
8. report the original release PR, follow-up UAT PR, and final deployed SHA.

Keep screenshots owner-only when they contain financial or medical records. Preserve only aggregate UAT JSON and sanitized findings in reports.