[0xacee]

Why this matters

The owner-card and guest-invite overlays declare aria-modal but leave the page behind them interactive. In Chromium, Tab reaches background refresh/create actions while a credential dialog is open. The generated-card/invite overlay also ignores Escape and does not return focus to its opener.

Use one native modal dialog frame for both creation forms and generated results. Native modality contains interaction; cancellation handles Escape consistently, and closing restores the actual owner/guest opener even after the create-to-result transition. Keep the existing constrained, scrolling panel and typography when moving the role from a styled div to a native dialog.

Validation

• Added a runnable Playwright regression using the actual Invites page and production CSS with local HTTP fixtures. Chromium 153 at 320×480, 390×640 and 1280×900 covers 12 create/result dialog scenarios, 168 Tab presses, six Escape closes, opener focus, and horizontal/vertical containment.
• Baseline permits background focus and 3–4 background Tab stops per scenario; all six result-dialog Escape checks fail. Fixed run passes every check, with zero browser errors. The 320×480 guest form screenshot was inspected; its content scrolls and Generate remains reachable.
• Nine existing/new mounted-page tests pass; the jsdom dialog shim is explicitly limited to lifecycle/payload checks, not presented as proof of native focus behavior.
• Production build passes; focused lint reports 0 errors / 27 JSX unused-variable warnings.

Overlap check

Live open/closed title and changed-file search found #1839 (Escape in creation overlays only), #4353 (JSON body deadlines), #3833 (refresh ordering), #3038 (owner-status failures), #3846 (inventory filtering), and #2327 (clipboard compatibility). None establishes native modality or completes generated-result keyboard dismissal. No change to token generation, revocation, request ownership, or clipboard logic.

Independent branch from freshly fetched upstream/public-beta, d49ad4bbc760be319de7f4c9b9a93b1f18fe3922. No semantic dependency or required merge order with these request/filter/clipboard PRs; shared Invites imports/markup may require normal rebase reconciliation. No combined-runtime claim for those unrelated changes.

Risk and review

Client interaction change only. Independent review and Safari/Firefox, assistive-technology and real print validation remain pending; Chromium checks do not stand in for those gates. Browser fixtures use dummy URLs and create no live credentials. Rollback restores the previous div overlays.

AI-assisted implementation and browser investigation. Ready for review; this is not approval to merge.

Current validation

At the 2026-09-14 audit, head b22f4a48061bd80cfdc021ea8bb682ae4b60653e has 32 successful and 4 skipped hosted checks, with no failed or pending checks. Independent human review and the declared deployed/platform checks remain merge gates.

Local synthetic integration head e8f982f09ba4c714ee2a65cb6867ea3e4328bfde combines the 30 September 14 candidates. Its complete frontend suite passes 144 files / 1,125 tests, and its production build passes.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.