[Wave 3] Medium — Module sweep: Marketing site and in-browser config wizard (part 2/2) #557

Wave 3 · 4 finding(s) in 4 fix package(s). Fix these whenever a pull request touches this module ("clean the module you touch").

Findings

• CR-A18-034 (code, Medium) — Wizard re-renders destroy the focused control: focus leaves the aria-modal dialog, Escape and the focus trap stop working, and the live pane re-announces the whole step
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · not reproduced (code trace) · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15 a11y) — docs/roadmap/phase-16-trust-surface-hardening.md:772
  Failure scenario. A keyboard user opens the wizard, tabs to 'Beginner' and presses Enter. The card is rebuilt, document.activeElement becomes , and pressing Escape does nothing. Tab moves into the aria-hidden page chrome behind the modal (the exact landing point depends on the browser's focus starting point), and a screen reader re-reads the whole welcome step.
  Where. site/js/wizard.js:1055-1066, site/js/wizard.js:1029-1049, site/js/wizard.js:1438-1445, site/js/wizard.js:1476-1482
  Recommended fix. Restore focus by key after render(). Move Escape handling to a document-level listener that is active while the modal is open. Replace pane-wide aria-live with focus on the step heading (tabindex=-1) when the step changes.

• CR-A18-035 (code, Medium) — Guide search dialog: Enter opens the highlighted result, not the focused one; the highlight and result count are invisible to AT; the trigger cannot be activated from the keyboard
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · not reproduced (code trace) · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15 a11y) — docs/roadmap/phase-16-trust-surface-hardening.md:772
  Failure scenario. A user searches 'lora', Tabs to the 3rd hit 'QLoRA' and presses Enter, and the 1st hit opens instead. A screen-reader user arrowing through the results hears nothing and gets no result count.
  Where. site/js/guide.js:397, site/js/guide.js:534-552, site/js/guide.js:512-520, site/guide.html:152
  Recommended fix. Restrict the Enter/arrow interception to the search input, expose the active option through aria-activedescendant/aria-selected, announce counts in a polite status region, and replace the readonly input trigger with a button.

• CR-A18-036 (code, Medium) — Site privacy notice omits the GDPR Art. 13 / KVKK Art. 10 core disclosures: no controller identity or contact, no legal basis, no retention period, no transfer basis, no complaint right
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15 privacy) — docs/roadmap/phase-16-trust-surface-hardening.md:772
  Failure scenario. An EU visitor, or a prospect's DPO assessing the vendor, reads the notice and cannot learn who the controller is, which basis covers the IP transfer to Google or Formspree, how long submissions are kept, or where to complain. The notice fails the Art. 13 checklist that the project's own compliance marketing invites readers to apply.
  Where. site/js/translations.js:4400, site/js/translations.js:4354, site/js/translations.js:4363, site/js/translations.js:4372
  Recommended fix. Add a controller block (legal name or responsible maintainer, postal address, a dedicated privacy email). Add per-processing legal bases (e.g. Art. 6(1)(b)/(f) for replying to the contact form, 6(1)(f) or consent for fonts). Add concrete retention periods covering the Formspree copy, recipients with their transfer mechanism, and the complaint right with KVKK/EU DPA references. Ship the full EN te…

• CR-A18-039 (code, Medium) — Browser wizard emits lora.target_modules [q_proj, v_proj] for every model, including its own Phi-3 card. PEFT rejects it after the model loads; dry-run and fit-check both exit 0
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end
  Failure scenario. An operator picks the 'Phi-3-mini-4k-instruct' card, downloads the YAML, and runs --dry-run (exit 0) and --fit-check (exit 0). The training run downloads about 7.6 GB of weights, then aborts in get_peft_model with exit 2. A CI pipeline treats that as a runtime failure (2), not a config error (1).
  Where. site/js/wizard.js:614, site/js/wizard.js:1565-1566, site/js/translations.js:1546-1548, forgelm/config.py:382-385
  Recommended fix. Make target_modules architecture-aware in both wizards (per-card list, e.g. Phi-3 [qkv_proj, o_proj] or 'all-linear'), or omit it and let a ForgeLM resolver pick per model_type. Add a pre-PEFT check in model.py that compares target_modules with the loaded model's module names and raises ConfigError (exit 1). It should also warn on partial matches.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}