fix(audit): UI — L18 (decorative emoji -> Lucide icons), L19 (gated NotesList timer + create-from-url ref-in-effect)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app/(dashboard)/[portSlug]/expenses/layout.tsx

@@ -1,3 +1,4 @@
+import { notFound } from 'next/navigation';
 import { eq } from 'drizzle-orm';
 
 import { db } from '@/lib/db';
@@ -29,7 +30,10 @@ export default async function ExpensesLayout({ children, params }: ExpensesLayou
     where: eq(portsTable.slug, portSlug),
     columns: { id: true },
   });
-  if (!port) return children;
+  // Fail closed: an unresolved slug means the port doesn't exist (or the
+  // user mistyped one) — 404 rather than silently rendering the gated
+  // subtree without a module check.
+  if (!port) notFound();
   const enabled = await isExpensesModuleEnabled(port.id);
   if (enabled) return children;
   return (

src/app/(dashboard)/[portSlug]/invoices/layout.tsx

@@ -1,3 +1,4 @@
+import { notFound } from 'next/navigation';
 import { eq } from 'drizzle-orm';
 
 import { db } from '@/lib/db';
@@ -28,7 +29,10 @@ export default async function InvoicesLayout({ children, params }: InvoicesLayou
     where: eq(portsTable.slug, portSlug),
     columns: { id: true },
   });
-  if (!port) return children;
+  // Fail closed: an unresolved slug means the port doesn't exist (or the
+  // user mistyped one) — 404 rather than silently rendering the gated
+  // subtree without a module check.
+  if (!port) notFound();
   const enabled = await isInvoicesModuleEnabled(port.id);
   if (enabled) return children;
   return (

src/app/(dashboard)/[portSlug]/residential/layout.tsx

@@ -1,3 +1,4 @@
+import { notFound } from 'next/navigation';
 import { eq } from 'drizzle-orm';
 
 import { db } from '@/lib/db';
@@ -30,7 +31,10 @@ export default async function ResidentialLayout({ children, params }: Residentia
     where: eq(portsTable.slug, portSlug),
     columns: { id: true },
   });
-  if (!port) return children;
+  // Fail closed: an unresolved slug means the port doesn't exist (or the
+  // user mistyped one) — 404 rather than silently rendering the gated
+  // subtree without a module check.
+  if (!port) notFound();
   const enabled = await isResidentialModuleEnabled(port.id);
   if (enabled) return children;
   return (