fix: remediate P2 audit findings (Phases 1 and 2) [Antigravity)

playwright.config.ts

@@ -55,7 +55,8 @@ export default defineConfig({
     // claims the page, and serves every subsequent navigation — bypassing route
     // interception for navigations outright, and wedging Playwright-Firefox's
     // reload path under an active route (the two ui-smoke reload hangs in matrix
-    // run 4012). Only ui-pwa.spec.ts is meant to exercise the worker; it opts
+    // run 4012). Page routes also cannot intercept requests made by a controlling
+    // service worker. Only ui-pwa.spec.ts is meant to exercise the worker; it opts
     // back in with test.use({ serviceWorkers: "allow" }).
     serviceWorkers: "block",
   },

src/components/ClinicalDashboard.tsx

@@ -2249,7 +2249,6 @@ export function ClinicalDashboard({
         "",
         documentsSearchHref({
           query: trimmedQuery,
-          focus: true,
           run: true,
           ...navigationContext,
         }),

src/components/ui/sheet.tsx

@@ -215,21 +215,32 @@ export function Sheet({
           // options) do not dump every inactive item into the Tab cycle.
           'a[href], button:not([disabled]):not([tabindex="-1"]), textarea:not([disabled]), input:not([disabled]), select:not([disabled]), summary, [tabindex]:not([tabindex="-1"])',
         ) ?? [],
-      ).filter((element) => !element.hasAttribute("disabled") && element.getAttribute("aria-hidden") !== "true");
+      ).filter(
+        (element) =>
+          !element.hasAttribute("disabled") &&
+          element.getAttribute("aria-hidden") !== "true" &&
+          element.tabIndex >= 0 &&
+          !element.closest('[aria-hidden="true"], [inert]') &&
+          element.getClientRects().length > 0,
+      );
       if (focusable.length === 0) return;
 
-      const first = focusable[0];
-      const last = focusable[focusable.length - 1];
-      if (panelRef.current && !panelRef.current.contains(document.activeElement)) {
-        event.preventDefault();
-        (event.shiftKey ? last : first).focus();
-      } else if (event.shiftKey && document.activeElement === first) {
-        event.preventDefault();
-        last.focus();
-      } else if (!event.shiftKey && document.activeElement === last) {
-        event.preventDefault();
-        first.focus();
-      }
+      const activeElement = document.activeElement instanceof HTMLElement ? document.activeElement : null;
+      const currentIndex = activeElement ? focusable.indexOf(activeElement) : -1;
+      const nextIndex =
+        currentIndex === -1
+          ? event.shiftKey
+            ? focusable.length - 1
+            : 0
+          : event.shiftKey
+            ? (currentIndex - 1 + focusable.length) % focusable.length
+            : (currentIndex + 1) % focusable.length;
+
+      // Move focus explicitly instead of relying on platform Tab preferences.
+      // Firefox can otherwise leave programmatically focused buttons out of the
+      // native sequence, which makes the modal trap inconsistent by browser.
+      event.preventDefault();
+      focusable[nextIndex].focus();
     }
 
     window.addEventListener("keydown", onKeyDown);

tests/eval-retrieval.test.ts

@@ -462,6 +462,56 @@ describe("golden retrieval eval helpers", () => {
     expect(evaluated.failures).toEqual([]);
   });
 
+  it("recognizes current safety-plan and alcohol-withdrawal titles", () => {
+    const safetyPlan = evaluateGoldenRetrievalCase({
+      testCase: {
+        id: "safety-plan-title",
+        query: "What should a patient safety plan include?",
+        expectedQueryClass: "document_lookup",
+        expectedDocumentSubstrings: ["PtSafetyPlan"],
+        expectedContentTerms: ["safety", "plan"],
+        topK: 8,
+        expectTableEvidence: false,
+      },
+      results: [
+        result({
+          // Strict golden-eval aliases only accept "Patient Safety Plan" for PtSafetyPlan
+          // (see scripts/lib/clinical-aliases.ts tiering note).
+          title: "Patient Safety Plan Policy and Procedure (RKPG)",
+          file_name: "Patient Safety Plan Policy and Procedure (RKPG).pdf",
+          content: "A safety plan records agreed actions.",
+        }),
+      ],
+      telemetry: { query_class: "document_lookup", retrieval_strategy: "text_fast_path" },
+      latencyMs: 10,
+    });
+    const alcoholWithdrawal = evaluateGoldenRetrievalCase({
+      testCase: {
+        id: "ciwa-title",
+        query: "What CIWA-Ar score threshold requires drug treatment in alcohol withdrawal?",
+        expectedQueryClass: "table_threshold",
+        expectedDocumentSubstrings: ["Alcohol withdrawal"],
+        expectedContentTerms: ["alcohol", "withdrawal", ["ciwa", "score", "threshold"]],
+        topK: 12,
+        expectTableEvidence: false,
+      },
+      results: [
+        result({
+          // Document substring matching uses title/file/section path only (not body
+          // content), so the fixture title must carry the pinned phrase.
+          title: "Alcohol Withdrawal - Addiction, Toxicity and Withdrawal",
+          file_name: "Alcohol Withdrawal - Addiction, Toxicity and Withdrawal.pdf",
+          content: "Use the CIWA-Ar treatment table for alcohol withdrawal.",
+        }),
+      ],
+      telemetry: { query_class: "table_threshold", retrieval_strategy: "text_fast_path" },
+      latencyMs: 10,
+    });
+
+    expect(safetyPlan.failures).toEqual([]);
+    expect(alcoholWithdrawal.failures).toEqual([]);
+  });
+
   it("reports failed cases with top result summaries", () => {
     const evaluated = evaluateGoldenRetrievalCase({
       testCase: {

tests/eval-utils.test.ts

@@ -54,6 +54,30 @@ describe("RAG eval source identity matching", () => {
     expect(coverage.missingFiles).toEqual(["MHSP.Discharge.pdf"]);
   });
 
+  it("maps legacy community-admission expectations to current combined policies", () => {
+    const coverage = expectedFileCoverage(
+      ["MHSP.AdmissionCommunityPts.pdf"],
+      [
+        {
+          title: "Admission to Discharge for Community Mental Health",
+          file_name: "Admission to Discharge for Community Mental Health (NMHS).pdf",
+        },
+        {
+          title: "Referral, Admission and Discharge - Mental Health Hospital in the Home",
+          file_name:
+            "Referral, Admission and Discharge - Mental Health Hospital in the Home (MHHITH) Policy and Procedure (RKPG).pdf",
+        },
+      ],
+      5,
+    );
+
+    expect(coverage).toMatchObject({
+      matchedFiles: ["MHSP.AdmissionCommunityPts.pdf"],
+      missingFiles: [],
+      allHit: true,
+    });
+  });
+
   it("fails supported clinical eval cases when numeric faithfulness warnings are present", () => {
     const testCase: RagEvalCase = {
       id: "dose-warning",

tests/playwright-project-isolation.test.ts

@@ -14,4 +14,12 @@ describe("Playwright production-project isolation", () => {
 
     expect(source).toMatch(/name: ["']chromium-mockups["'],\s+testMatch: mockupSpecPattern,\s+grep: mockupTag,/m);
   });
+
+  it("blocks service workers for mocked journeys but allows the dedicated PWA suite", () => {
+    const config = readFileSync(resolve(process.cwd(), "playwright.config.ts"), "utf8");
+    const pwaSpec = readFileSync(resolve(process.cwd(), "tests/ui-pwa.spec.ts"), "utf8");
+
+    expect(config).toContain('serviceWorkers: "block"');
+    expect(pwaSpec).toContain('test.use({ serviceWorkers: "allow" })');
+  });
 });

tests/rag-route-budget.test.ts

@@ -31,8 +31,10 @@ describe("RAG route deadlines", () => {
     const deadline = createAnswerRouteDeadline({ routeMode: "fast", startedAt });
 
     expect(deadline.requestTimeoutMs(30_000)).toBe(15_000);
+    expect(deadline.generationRequestTimeoutMs(30_000)).toBe(13_000);
     await vi.advanceTimersByTimeAsync(10_000);
     expect(deadline.requestTimeoutMs(30_000)).toBe(5_000);
+    expect(deadline.generationRequestTimeoutMs(30_000)).toBe(3_000);
 
     const pending = deadline.race(new Promise<never>(() => undefined));
     const rejection = expect(pending).rejects.toBeInstanceOf(AnswerRouteDeadlineExceededError);

tests/sheet-focus.dom.test.tsx

@@ -1,6 +1,6 @@
 import { act, render, waitFor } from "@testing-library/react";
 import { useEffect, useState } from "react";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { Sheet } from "@/components/ui/sheet";
 import {
@@ -11,6 +11,7 @@ import {
 } from "@/components/ui/sheet-focus";
 
 afterEach(() => {
+  vi.restoreAllMocks();
   if (typeof document !== "undefined" && document.body) {
     document.body.style.overflow = "";
   }
@@ -255,3 +256,41 @@ describe("Sheet open focus", () => {
     background.remove();
   });
 });
+
+describe("Sheet Tab cycle", () => {
+  it("skips visible controls explicitly removed from the tab order", async () => {
+    vi.spyOn(HTMLElement.prototype, "getClientRects").mockReturnValue({
+      length: 1,
+      item: () => null,
+      [Symbol.iterator]: function* () {
+        yield {} as DOMRect;
+      },
+    } as DOMRectList);
+
+    render(
+      <Sheet open onClose={() => {}} title="Tab order" portal>
+        <a href="#first">First</a>
+        <input aria-label="Programmatic only" tabIndex={-1} />
+        <button type="button">Last</button>
+      </Sheet>,
+    );
+
+    const panel = panelOf("Tab order");
+    const first = panel.querySelector<HTMLAnchorElement>('a[href="#first"]');
+    const excluded = panel.querySelector<HTMLInputElement>('input[tabindex="-1"]');
+    const last = Array.from(panel.querySelectorAll<HTMLButtonElement>("button")).find(
+      (button) => button.textContent === "Last",
+    );
+    expect(first).not.toBeNull();
+    expect(excluded).not.toBeNull();
+    expect(last).toBeDefined();
+
+    act(() => {
+      first?.focus();
+      window.dispatchEvent(new KeyboardEvent("keydown", { key: "Tab", bubbles: true, cancelable: true }));
+    });
+
+    expect(document.activeElement).toBe(last);
+    expect(document.activeElement).not.toBe(excluded);
+  });
+});

tests/ui-formulation.spec.ts

@@ -111,7 +111,9 @@ test("keeps mobile search, domain filtering, record actions, and universal chrom
   await expectNoHorizontalOverflow(page);
 
   await page.getByRole("link", { name: "Open Worry" }).click();
-  await expect(page).toHaveURL(/\/formulation\/worry$/, { timeout: 30_000 });
+  await expect(async () => {
+    await expect(page).toHaveURL(/\/formulation\/worry$/);
+  }).toPass({ timeout: 30_000 });
   await expect(page.getByRole("heading", { name: "Worry", exact: true })).toBeVisible({ timeout: 30_000 });
   await expect(page.getByRole("link", { name: "Compare", exact: true }).last()).toBeVisible();
   await expect(page.getByRole("link", { name: "Use in formulation", exact: true }).first()).toBeVisible();

tests/ui-tools.spec.ts

@@ -2376,7 +2376,9 @@ test.describe("Responsive layout guards", () => {
 
     await page.goto("/safety-plan");
     await expect(page.getByLabel(/Patient \(name or initials\)/i)).toHaveCount(0);
-    await expect(page.getByText(/kept only in this browser tab/i)).toBeVisible();
+    const privacyRegion = page.getByRole("region", { name: "Safety plan privacy" });
+    await expect(privacyRegion).toHaveCount(1);
+    await expect(privacyRegion.getByText(/kept only in this browser tab/i)).toBeVisible();
     await expect(
       page.getByText(/Copying, printing, or saving a PDF moves the plan outside Clinical KB/i),
     ).toBeVisible();