Umbrella: Sprint 4.x cluster review — 13 deferred minor items (post-bounty)

[rz1989s]

Tracking the 13 minor items deferred during Sprint 4.x cluster reviews. Each was flagged Minor by either the per-task two-stage reviewer or the cluster-level reviewer (opus). None are bounty-blocking; SHIP IT verdict held across all four sprint reviews. All P3 (cosmetic / test-quality / pre-existing).

Items

Sprint 4.3 (PR #41) — P1 cluster

• Task 2 / D-9 — DEV_TOKEN inline comment missing in server/ratelimit.ts
• Task 2 / D-9 — fallback test untested in server/ratelimit.test.ts
• Task 2 / D-9 — redundant string type annotation in server/ratelimit.test.ts
• Task 3 / D-10 — drift-safety test redundant with the arbitrary-method test in server/rpc-guards.test.ts
• Task 3 / D-10 — membership test missing size assertion (would catch drift)
• Task 4 / D-11 — streamResponse helper not hoisted in src/hooks/useChat.test.ts
• Task 4 / D-11 — Test 2 doesn't assert intermediate 'calling' status
• Task 4 / D-11 — Test 3 doesn't assert toolCalls[0].name
• Task 6 / U-7 — screen.getByText().closest('button')! pattern in src/components/EmptyState.test.tsx would read better as getByRole('button', { name: ... })
• Task 6 / U-7 — vi.clearAllMocks is a no-op in src/components/EmptyState.test.tsx (no mocks to clear)
• Task 6 / U-7 — pre-existing || vs ?? in src/components/ChatPanel.tsx:25 (semantically fine, stylistically ?? is preferable)
• Cluster review — EmptyState representative-query strings duplicated between code (EmptyState.tsx:55-93) and tests (EmptyState.test.tsx)
• Cluster review (process) — PR body could include a manual-umbrella-close reminder when the merged PR is the last child of an umbrella issue

Why a single umbrella

• All deferred during the same sprint cluster (Sprint 4.x = 4.1 + 4.2a + 4.2b + 4.3)
• All P3 (cosmetic / test-quality / pre-existing)
• All non-bounty-blocking
• Filing 13 separate issues = bureaucratic overhead; single umbrella with a checklist is the same pattern that worked beautifully for the qa-2026-04-26 baseline cleanup ([QA-2026-04-26] Track all 27 remaining findings from baseline QA run #3 → 27 children, all closed)

Plan

Single P3 cleanup PR post-bounty (after 2026-05-12). Could be batched into a quarterly tech-debt sprint or split into product-code (3 items) + test-quality (9 items) + process (1 item) sub-clusters if the volume justifies it.

Cross-references

• Sprint 4.1 cluster review notes — see PR #37 (P3 trivial sweep)
• Sprint 4.2a cluster review notes — see PR #38 (P2 server hygiene)
• Sprint 4.2b cluster review notes — see PR #40 (P2 UI features)
• Sprint 4.3 cluster review notes — see PR #41 (P1 cluster)

Priority

P3 — bookkeeping / quality polish. Bounty deadline 2026-05-12 takes precedence.