fix(chat): verifiable sources, safe examples, accessible answers

[WilliamAGH]

Problem

The public chat can return technically useful answers that are not fully verifiable from their source panel, and one generated safety example is behaviorally wrong. The same answer screen also has keyboard and WCAG labeling/contrast defects.

This was reproduced on https://javachat.ai/ on 2026-08-21 through iterative Java 25, Kotlin, Spring, jOOQ, HikariCP, and JDBC questions.

Reproduction evidence

1. Requested primary sources are omitted

Ask JavaChat to compare Java 25 CompletableFuture.cancel(true), FutureTask.cancel(true), and ExecutorService.shutdownNow(), with an official API or OpenJDK source for each claim.

The answer correctly distinguishes the behaviors, but the expanded source panel contains only:

• CompletableFuture (Java SE 25 & JDK 25)
• General JDK 25 release notes

No source is provided for the stated FutureTask or thread-per-task executor implementation claims.

The same gap recurs on an exact Spring 7.0.7 plus jOOQ transaction question: the first answer cites only Spring pages, including 7.0.8 API material, and no jOOQ source. A corrective follow-up then admits that exact jOOQ and Spring 7.0.7 material is absent from the retrieval set.

2. One generated runCatching example records failure as success

Ask for a Kotlin/JVM per-candidate loop that uses runCatching while propagating cancellation, interruption, invariant failures, and fatal JVM errors.

The answer correctly explains that runCatching catches Throwable, but its “Coroutine-aware variant” does this:

1. DomainValidationException calls markRejected(...) and returns Unit from getOrElse.
2. SQLException calls markDeferred(...) and returns Unit from getOrElse.
3. Execution then reaches unconditional markSuccess(candidate).

The declared outcome is unused, so rejected and deferred candidates are also recorded successful.

3. A Spring Boot source card links to a 404

The source card labeled SQL Databases :: Spring Boot links to:

https://docs.spring.io/spring-boot/reference/reference/data/sql.html

That URL returned HTTP 404 during this run. The current canonical path returned HTTP 200:

https://docs.spring.io/spring-boot/reference/data/sql.html

4. Answer-page accessibility audit reports three serious violations

An axe 4.12.1 WCAG 2 A/AA audit of the answer screen reported:

• Color contrast: eight nodes fail. Inline code is 4.4:1 where 4.5:1 is required; the composer hint is 2.2:1 and its kbd labels are 2.18:1.
• Keyboard access: .user > .bubble is a scrollable long-question region with no focusable content and is not itself focusable.
• ARIA: <div class="toast-container" aria-live="polite" aria-label="Notifications"> uses aria-label on a generic div without a permitted role.

No JavaScript page errors or failed chat requests were observed. Chat streaming requests returned HTTP 200.

Expected behavior

• Every material factual claim has a working source card for the exact library/version requested, or the answer visibly marks the claim as source-unavailable before presenting it.
• Citation URLs are validated before display and use the current canonical documentation path.
• Generated code examples preserve the behavior described by the answer and cannot mark a failed candidate successful.
• The chat and answer UI pass WCAG 2 A/AA checks for labeling, keyboard scrolling, and contrast.

Tasks

• Bind answer claims to the retrieved source records and surface unsupported claim/source gaps before rendering the answer.
• Validate or canonicalize citation URLs before including them in the source panel; add coverage for the Spring Boot /reference/data/sql.html path.
• Add an executable or structural regression for generated candidate-loop examples so rejected/deferred outcomes cannot fall through to success.
• Raise inline-code and composer-hint contrast to WCAG AA.
• Make long scrollable user messages keyboard focusable.
• Give the notification live region an appropriate role or remove the prohibited aria-label.
• Add browser coverage that expands the source panel and verifies each requested source family is represented or explicitly unavailable.

Acceptance criteria

• The Java cancellation comparison exposes primary sources for CompletableFuture, FutureTask, and the thread-per-task executor, or labels unavailable sources in the answer.
• The Spring/jOOQ transaction question never substitutes another Spring patch version and does not imply exact jOOQ evidence when none was retrieved.
• The Kotlin candidate-loop example produces exactly one outcome per candidate.
• Every displayed citation URL returns a successful response.
• axe reports zero WCAG 2 A/AA violations on the same answer screen.