docs(lane1): report footer tap-target item — source merged, live blocked on missing Cloudflare token

.lane/reports/fix-lane1-footer-tap-targets-live-gate-20260814.md

@@ -0,0 +1,50 @@
+# Lane 1 report: mobile footer tap targets below WCAG 2.2 24px minimum
+
+Lane: tinystudio-in lane 1 (worktree tinystudio-in-lane1-20260814-191532)
+Date: 2026-08-14
+Outcome: **No source change possible or needed — the item's fix is already merged in main (PR #22); live delivery is blocked by a missing `CLOUDFLARE_API_TOKEN` secret (NEEDS-NISH), which is outside this lane's scope.**
+
+## The one item
+
+> [unreviewed-by-opus] Mobile tap targets fall below the WCAG 2.2 24px minimum on every tinystudio.in page - footer
+
+## Verification performed
+
+### 1. Source state (worktree at origin/main HEAD 2796b33)
+
+- `public/styles.css` `.footer-links a` rule carries the full tap-target treatment:
+  `display: inline-block; min-height: 24px; padding: 4px 0` (rendered ~34px hit area).
+- The merged commit `5298652` "fix(public): bring footer links up to WCAG 2.2 24px tap targets (#22)" is an ancestor of `origin/main` (`git merge-base --is-ancestor` = yes).
+
+### 2. The fix is already merged
+
+- PR #22 (commit `5298652`, merged 2026-08-09) added the `.footer-links a` rule to `public/styles.css`.
+- The rule is now guarded by `scripts/test-public-link-targets.mjs` (assertion B/D/E: every footer link on all 13 public pages sits inside `.footer-links`, and the shared stylesheet enforces the 24px minimum). Running it locally: **77 checks, 0 failures**.
+
+### 3. Live state — still stale, but not because of this item
+
+- `https://tinystudio.in/styles.css` (fetched 2026-08-14 with a cache-buster) still serves the OLD rule: `.footer-links a` has only `color`, `text-decoration`, `overflow-wrap` — no block-level box, no `min-height: 24px`. At mobile widths the pointer hit area is the ~17px plain-inline glyph box, below WCAG 2.2 SC 2.5.8.
+- This matches the canonical deploy-pipeline item: live production is a stale build; every merged public fix since 2026-08-07 (17+ PRs incl. #22) has never reached production.
+
+### 4. Deploy blocker (the real gate, NEEDS-NISH)
+
+- `.github/workflows/deploy-public-site.yml` is fail-closed on `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID`.
+- `gh secret list` shows only `CLOUDFLARE_ACCOUNT_ID` (set 2026-08-12); `CLOUDFLARE_API_TOKEN` is missing.
+- Latest deploy runs (2026-08-14 12:49Z push 2796b33, run 31801970310; 11:00Z; 09:59Z) all failed in the "Required Pages secrets not provisioned - fail loudly" step.
+- Provisioning requires a Cloudflare dashboard token — a Nish action, owned by the open deploy-pipeline item (NEEDS-NISH). No code change can unblock it.
+
+## Why no product PR was opened
+
+The packet's fallback: "or by reporting plainly why the item cannot be done." The item's source work is already merged (PR #22) and test-pinned in `npm test`/`npm run ci`; the only remaining gate is the missing Cloudflare secret, which is explicitly a NEEDS-NISH action owned by the canonical deploy-pipeline item. Re-implementing a merged, test-pinned feature would duplicate shipped work and touch no owned files.
+
+## What unblocks live delivery
+
+1. Nish provisions a Cloudflare Pages:Edit token: `gh secret set CLOUDFLARE_API_TOKEN -R nish3451/tinystudio-in`
+2. The deploy lane runs on the next main push (or workflow_dispatch); the footer tap-target rule then goes live with the other ~17 merged public fixes.
+3. The backlog item can then be ticked on live proof.
+
+## Files touched
+
+- `/home/nish/workspaces/agent-state/lanes/tinystudio-in/lane-1.json` — claims list (empty; no repo files claimed)
+- `.lane/reports/fix-lane1-footer-tap-targets-live-gate-20260814.md` — this report
+- No repository product files changed.