fix: ask in the page instead of native confirm/alert

A native confirm() or alert() leaves the desktop client unable to type
until the window is refocused. ask.js draws both in the page; the SPA
test now bans all three browser dialogs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 928d526..708d1ea 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -334,6 +334,15 @@ do. Read them before writing anything that touches the same mechanism.
   refused by the policy, which is T3's mitigation demonstrated rather than
   asserted
 
+- **A native `confirm()` or `alert()` breaks typing in the desktop client.**
+  Once the dialog closes `document.hasFocus()` stays false: a click still moves
+  `activeElement` into a field, and every keystroke goes nowhere until the
+  window loses and regains focus. It was reported as "the Create group fields are
+  frozen" after removing a member, and reproduced with real X input under Xvfb.
+  Events dispatched in the DOM cannot see it, because the focus is lost below
+  the page. `ask.js` draws both in the page, and
+  `test_no_native_dialogs_in_the_spa.py` bans all three browser dialogs
+
 - **A user unit cannot carry `User=`.** `meshbay-node.spec` installed the system
   template into `%{_userunitdir}`, where systemd refuses the file outright — the
   packaged unit could never have started, and nothing noticed because nobody had