[Wave 4] Low/info — Module sweep: Marketing site and in-browser config wizard (part 1/3) #683

Wave 4 · 20 finding(s) in 20 fix package(s). Fix these whenever a pull request touches this module ("clean the module you touch").

Findings

• CR-A18-040 (code, Low) — Wizard 'Notify on training start' unchecked is omitted from the YAML, so the schema default notify_on_start=True enables it
  severity Low · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end
  Where. site/js/wizard.js:251, site/js/wizard.js:815, forgelm/config.py:1471, site/js/wizard.js:251-253
  Recommended fix. Always emit the three notify_on_* booleans explicitly.

• CR-A18-041 (code, Low) — Wizard use-case cards advertise 'SFT + DPO' and 'SFT + ORPO' but the presets configure a single SFT stage
  severity Low · reachability default · intent contract-violation · confidence likely · single reviewer · reproduced end to end
  Where. site/js/translations.js:1519-1523, site/js/wizard.js:501-515
  Recommended fix. Change the badges and descriptions to SFT, or emit a pipeline/second stage.

• CR-A18-042 (code, Low) — Wizard input validation is presence-only: numeric handlers silently drop out-of-range input, and schema-invalid or empty values (min_score > 1, num_generations 1, 'env:' webhook) are emitted
  severity Low · reachability default · intent intended-but-harmful · confidence likely · independently confirmed · reproduced end to end
  Failure scenario. A user enters 60 as the benchmark floor, finishes the wizard, downloads the YAML and runs the suggested dry-run. It fails with 'Input should be less than or equal to 1'. Alternatively the user pastes 'env:' as the webhook; the config validates and notifications are never sent.
  Where. site/js/wizard.js:1954-1968, site/js/wizard.js:2095-2111, site/js/wizard.js:2136-2139, site/js/wizard.js:2575-2587 (judge min score handler)
  Recommended fix. Validate on change/blur, show an inline error for out-of-range input, and align the bounds with the schema (grpo >=2, min_score <=1, no artificial epochs cap).

• CR-A18-043 (code, Low) — GRPO num_generations is not checked against batch x grad-accum divisibility; many wizard combinations pass dry-run and fail in TRL
  severity Low · reachability default · intent intended-but-harmful · confidence confirmed · independently confirmed · reproduced end to end
  Where. site/js/wizard.js:2136, site/js/wizard.js:2001-2005, forgelm/trainer.py:775, site/js/wizard.js:184
  Recommended fix. Validate divisibility in the wizard (and ideally in ForgeConfig, so --dry-run catches it).

• CR-A18-044 (code, Low) — Judge and synthetic API-key hints say 'Empty = local model', but the wizard rejects an empty value
  severity Low · reachability default · intent contract-violation · confidence likely · single reviewer · reproduced (plumbing only)
  Where. site/js/wizard.js:461-463, site/js/translations.js:1749, site/js/translations.js:1808, forgelm/config.py:1089-1091
  Recommended fix. Drop the required check (and emit teacher_backend: local for synthetic), or remove the 'Empty = local' sentence.

• CR-A18-045 (code, Low) — Wizard loadState restores persisted state without a schema: non-default keys (openAccordions) are dropped and values are not type-checked, reaching YAML emitters, innerHTML and the cross-tab sync
  severity Low · reachability default · intent intended-but-harmful · confidence likely · independently confirmed · reproduced end to end
  Failure scenario. The operator opens the governance and webhook accordions, refreshes the page and finds them collapsed again. A stale or hand-edited localStorage entry from an older release yields silently invalid YAML in the preview and download.
  Where. site/js/wizard.js:1256-1294 (confirmed), site/js/wizard.js:287-307 (confirmed), site/js/wizard.js:1142-1146, site/js/wizard.js:1312-1316
  Recommended fix. Add openAccordions to defaultState, and skip re-render (or compare a content hash) when the incoming state differs only in UI-only keys or the step the user is not on.

• CR-A18-046 (code, Low) — Focus trap leaks on the welcome and review steps: the first 'focusable' is the hidden detail toggle
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace) · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15 a11y) — docs/roadmap/phase-16-trust-surface-hardening.md:772
  Where. site/js/wizard.js:1029-1049, site/js/wizard.js:1084-1097, site/js/wizard.js:984-993, site/quickstart.html:382-386
  Recommended fix. Filter focusables by visibility (offsetParent/getClientRects) or exclude [hidden], and set inert on background siblings.

• CR-A18-047 (code, Low) — Review-step button icons are created with document.createElement('svg') and never render
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. The review-step buttons show text only, with no icon. Cosmetic, and the buttons stay functional (aria-hidden icons).
  Where. site/js/wizard.js:2955 (confirmed), site/js/wizard.js:2980 (confirmed), site/js/wizard.js:2998 (confirmed), site/js/wizard.js:37-38
  Recommended fix. Use createElementNS('http://www.w3.org/2000/svg', ...) or wrap in a span with innerHTML, as the accordions do.

• CR-A18-048 (code, Low) — Translation values containing markup are written with textContent and render as literal tags
  severity Low · reachability default · intent contract-violation · confidence likely · single reviewer · reproduced (plumbing only)
  Failure scenario. Home page 'Auto-revert on regression' card displays 'exits with EXIT_EVAL_FAILURE (3)' verbatim.
  Where. site/js/i18n.js:92, site/index.html:384, site/features.html:234, site/quickstart.html:144
  Recommended fix. Switch these four elements to data-i18n-html, or strip the markup from their values; add a guard that fails when a data-i18n value contains '<' or '&'.

• CR-A18-049 (code, Low) — Compliance artefact tree claims the layout appears after every successful or failed run; failed and approval-gated runs differ
  severity Low · reachability default · intent contract-violation · confidence likely · single reviewer · not reproduced (code trace) · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15) — docs/roadmap/phase-16-trust-surface-hardening.md:772
  Failure scenario. An auditor expects compliance/compliance_report.json for a run that failed its loss gate; the directory does not exist.
  Where. site/compliance.html:268, site/compliance.html:277, forgelm/trainer.py:1652, forgelm/trainer.py:1621-1652
  Recommended fix. State 'after a run that passes its gates', add the final_model.staging.<run_id>/ variant, and mark annex_iv_metadata.json as conditional.

• CR-A18-050 (code, Low) — Guide TOC clicks write '#/route#heading' into the URL; parseHash keeps the suffix, so reload or a shared link shows 'Page not found'
  severity Low · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced with stubs
  Failure scenario. A user clicks 'On this page > Installation' and copies the URL. The recipient sees 'Page not found: getting-started/introduction#installation'.
  Where. site/js/guide.js:343, site/js/guide.js:77-91, site/js/guide.js:58, site/js/guide.js:69-75
  Recommended fix. Split route and anchor in parseHash on the second '#', scroll to the anchor after render, and rewrite in-body '#id' links to '#/route#id'.

• CR-A18-051 (code, Low) — 'Edit this page on GitHub' 404s for de/fr/es/zh and for pages that fell back to English
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. A German visitor clicks 'Edit this page' and GitHub returns 404 for docs/usermanuals/de/getting-started/introduction.md.
  Where. site/js/guide.js:232, tools/build_usermanuals.py:94
  Recommended fix. Use 'en' whenever page.fallback is true or the language has no bag.

• CR-A18-052 (code, Low) — Copy buttons copy simulated output lines and placeholders together with commands
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. A user copies step 4 and pastes it into zsh: 'command not found: ✓', 'command not found: FITS', and the approve line fails with 'no such file or directory: run-id'.
  Where. site/js/main.js:184, site/quickstart.html:212, site/quickstart.html:295, site/quickstart.html:332
  Recommended fix. Copy only lines that start with '$ ' (and their '' continuations), or mark output spans and exclude them.

• CR-A18-053 (code, Low) — Hero carousel resumes rotation on tab return while hovered or focused; there is no explicit pause control, and the focused CTA can become hidden
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace) · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15 a11y) — docs/roadmap/phase-16-trust-surface-hardening.md:772
  Failure scenario. A keyboard user tabs to 'Try the wizard', switches tabs and returns. Rotation restarts, and 8 s later the focused link's slide gets visibility:hidden, so focus drops.
  Where. site/js/main.js:383, site/js/main.js:372, site/css/style.css:856
  Recommended fix. On visible, resume only if the slider is not hovered and does not contain activeElement; add a pause/play button.

• CR-A18-054 (code, Low) — Mobile nav drawer state is not reset when the viewport grows to desktop
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace) · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15) — docs/roadmap/phase-16-trust-surface-hardening.md:786-787
  Failure scenario. A tablet is rotated from portrait (drawer open) to landscape above 880px. The language and theme buttons sit inside the link row with no hamburger to close the drawer until a nav link is clicked.
  Where. site/js/main.js:66, site/css/style.css:555, site/css/style.css:427
  Recommended fix. Close the drawer on a matchMedia('(max-width: 880px)') change event and on Escape.

• CR-A18-055 (code, Low) — Text and link contrast fails WCAG AA despite README's 'meets WCAG AA on both themes'
  severity Low · reachability default · intent contract-violation · confidence likely · single reviewer · reproduced end to end · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15 a11y) — docs/roadmap/phase-16-trust-surface-hardening.md:772
  Failure scenario. In light mode, every inline link (privacy policy, compliance cookbook) renders orange on white at 2.26:1.
  Where. site/css/style.css:48, site/css/style.css:111, site/css/style.css:199, site/css/style.css:161
  Recommended fix. Darken --text-muted (for example to #​8b90a0 on dark and #​5b6170 on light), use --ember-deep for links in light mode, and use a darker primary gradient start.

• CR-A18-056 (code, Low) — i18n 'failsafe' never reveals [data-i18n] text when JS is off or i18n.js fails
  severity Low · reachability default · intent intended-but-harmful · confidence likely · independently confirmed · not reproduced (code trace)
  Failure scenario. A visitor with JavaScript disabled opens index.html and sees the code blocks and icons but no headings, navigation labels or paragraphs.
  Where. site/css/style.css:2954, site/css/style.css:2956, site/js/i18n.js:53, site/js/i18n.js:132
  Recommended fix. Add a .js class from an inline head script and scope the hide rule to html.js body:not(.i18n-ready); or animate the [data-i18n] elements themselves.

• CR-A18-057 (code, Low) — Static hero fallback copy overclaims per-run artefacts, and the CI badge is a static string
  severity Low · reachability default · intent contract-violation · confidence likely · single reviewer · not reproduced (code trace) · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15 static fallbacks) — docs/roadmap/phase-16-trust-surface-hardening.md:771-772
  Failure scenario. An HTML-only indexer quotes 'every run produces a Llama Guard safety report'.
  Where. site/index.html:185, site/index.html:292, forgelm/trainer.py:1652
  Recommended fix. Sync the static fallback text with the live en translation.

• CR-A18-058 (code, Low) — OS support contradicts itself: JSON-LD lists Windows, the Quickstart says Linux or macOS, and stated guarantees degrade on Windows
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. A Windows user, advertised as supported by the structured data, does not get the ReDoS budget the threat model states as a guarantee.
  Where. site/index.html:49, site/quickstart.html:49, site/js/translations.js:1479, forgelm/_strip_pattern.py:383
  Recommended fix. Pick one statement (e.g. 'Linux, macOS; Windows best-effort') and use it in both places.

• CR-A18-059 (code, Low) — Silent-failure paths in the browser code (clipboard, mermaid, corrupted wizard state)
  severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)
  Where. site/js/main.js:185-202, site/js/wizard.js:1204-1219, site/js/wizard.js:2958-2973, site/js/guide.js:262-266
  Recommended fix. Add a failure label/fallback (select-all) on copy; handle the mermaid promise; log or surface a state reset; fix the comment.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}