fix(assistant): restore controls and adopt stable ranui

[chaxus]

Merge Verdict

[APPROVE]

Implementation, local verification and review are complete. Required CI checks must pass before merging. Preserve individual commits, as requested.

Summary

The assistant's title and suggested tasks could touch their backgrounds, artifact import looked like ordinary text, and the speech privacy disclosure sat too far from its icon while overlapping the language menu.

Restore token-based text insets, recognizable action surfaces, labeled import fields and full touch targets. Remove the extra popup translation and coordinate speech disclosures through public component events. Adopt the shared floating-dismissal fix from ran PR #428 through the published ranui@0.5.0 and ranuts@0.5.0 releases, regenerate static component assets, and align the Node/Docker build baseline to Node 24+.

Risk Analysis

Risk	Level	Mitigation
Shared action styling affects adjacent assistant controls	Low	Browser coverage includes models, sources, artifacts, workspace navigation and touch geometry
Floating changes affect focus, dictation recovery or nested controls	Medium	Verify popup anchoring, mutual exclusion, keyboard focus and real pointer interactions against the published component release
Stable dependencies require a newer build toolchain	Medium	Align engines and Docker to Node 24; verify a registry-backed frozen installation, declarations and production build
Static standalone components drift from npm dependencies	Low	Regenerate all referenced bundles and tokens with bin/build.sh; compare their bytes with the verified release archive

Design Decisions

• Follow ranui's semantic color, spacing, radius and control-size tokens.
• Keep general floating dismissal in ranui; application positioning uses the component's existing anchor calculation.
• Pin both direct libraries to 0.5.0 in every consuming workspace. The dependency graph brings @alixex/ranview@0.2.0 transitively and removes obsolete engine dependencies.
• Retain pnpm's existing release-age policy, adding only the exact verified @alixex/ranview@0.2.0 release to its exclusions.
• Preserve account-free frontend operation and model/persistence contracts. Node 24+ applies to the build toolchain.

Code Concerns

No unresolved findings. The UI changes received independent review; the upgrade was checked for workspace version consistency, registry integrity, generated-asset ownership and build compatibility.

Verification

Conclusion basis: Verified

• Library publication succeeded through npm trusted publishing. Registry versions, latest tags and SHA-512 values match the verified archives; all three packages have provenance.
• pnpm install --frozen-lockfile passed using the published npm packages.
• Full unit suite: 252 files / 6,799 tests passed.
• Focused Playwright regression: 47 tests passed, covering 360px/1280px light/dark rendering, keyboard/touch controls, popup anchoring and exclusion, dictation, workspace behavior, history and themes.
• pnpm run lint:ts, pnpm run lint:docker, pnpm run format:check and pnpm run build passed, including 1,511 immutable archive checks.
• All eight regenerated static assets match the verified CI release archive and the previously tested asset bytes.
• The dictation recovery test clicks the textarea's visible inset and verifies focus after outside dismissal. Its five cases also passed against the earlier pinned dependencies and deployed preview.
• All GitHub and Cloudflare checks passed on 680b212059bacc638ac9ad256d195ebc013c9490, including full E2E, Cloudflare Pages semantics, Docker E2E, timing budgets, lint/type/coverage, deployment and deployed-preview smoke. The PR is ready for review.

[cloudflare-workers-and-pages]

Deploying document with    Cloudflare Pages

Latest commit:	680b212
Status:	✅  Deploy successful!
Preview URL:	https://2a6a6f25.document-7hm.pages.dev
Branch Preview URL:	https://codex-assistant-interface-au.document-7hm.pages.dev

View logs