fix(a11y): keep invalid editor save focusable with aria-disabled

.github/workflows/fuzz.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
-          node-version: '20'
+          node-version: '22.13.0'
           cache: 'npm'
 
       - name: Install dependencies

.github/workflows/server-tests.yml

@@ -25,10 +25,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - name: Setup Node 22
+      - name: Setup Node 22.13
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: 22
+          node-version: 22.13.0
       - name: Install
         run: npm ci
       - name: Unit tests (EVM · CPM · baseline · workload)
@@ -45,10 +45,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - name: Setup Node 22
+      - name: Setup Node 22.13
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: 22
+          node-version: 22.13.0
       - name: Install
         run: npm ci
       - name: Install Playwright (chromium)

.jules/palette.md

@@ -115,3 +115,6 @@
 ## $(date +%Y-%m-%d) - Prevent accidental data loss in inline editors
 **Learning:** Forms that take a long time to fill out (like a WBS editor) are prone to accidental closure by users pressing `Escape` or clicking cancel. This causes immediate data loss without any warning, resulting in frustration.
 **Action:** When working on editors that can be dismissed, track whether the user has modified any fields compared to their initial state. If there are changes, intercept the close action and present a confirmation dialog (`window.confirm`) to ensure they really want to discard their edits. Bypass this for intentional saves or explicit data overrides.
+## 2026-08-03 - Replace native disabled with aria-disabled for form submit buttons
+**Learning:** Using the native `disabled` attribute on form submission buttons prevents them from receiving focus. This completely hides the button's `title` tooltip (which often explains *why* the form cannot be submitted) from keyboard-only and screen-reader users, leading to a confusing UX when validation fails.
+**Action:** Use `aria-disabled="true"` instead of `disabled` for submit buttons when form validation fails. This ensures the button remains in the tab order so the `title` tooltip can be read. Since the browser no longer blocks the form submission natively, ensure the form's `submit` event listener explicitly checks `getAttribute('aria-disabled') === 'true'` and aborts if necessary.

app.js

@@ -408,6 +408,12 @@ function bindTableEvents(renderDraftValidation, updateEditorDraftFromEvent) {
       return;
     }
     event.preventDefault();
+
+    const saveButton = form.querySelector('button[type="submit"]');
+    if (saveButton && saveButton.getAttribute('aria-disabled') === 'true') {
+      return;
+    }
+
     renderDraftValidation.flush();
     saveEditor();
   });
@@ -1047,7 +1053,11 @@ function renderEditorValidation() {
 
   const saveButton = form.querySelector('button[type="submit"]');
   if (saveButton) {
-    saveButton.disabled = errors.length > 0;
+    if (errors.length > 0) {
+      saveButton.setAttribute('aria-disabled', 'true');
+    } else {
+      saveButton.removeAttribute('aria-disabled');
+    }
     saveButton.title = errors.length > 0 ? '입력값을 올바르게 수정해야 저장할 수 있습니다.' : '저장 (Enter)';
   }
 

cloud-sync.js

@@ -739,25 +739,54 @@ function openReportModal() {
 // no DOMParser needed → node-testable); swap for a real XML parser if
 // hand-edited files ever matter.
 export function parseMsProjectXml(xml) {
+  // Fully linear extract (indexOf/slice) — no dynamic RegExp and no lazy
+  // [\s\S]*? block collectors (those can quadratic-backtrack on truncated input).
   const tag = (block, name) => {
-    const m = block.match(new RegExp(`<${name}>([^<]*)</${name}>`));
-    return m ? m[1].trim() : '';
+    const openingTag = `<${name}>`;
+    const closingTag = `</${name}>`;
+    const valueStart = block.indexOf(openingTag);
+    if (valueStart === -1) return '';
+    const contentStart = valueStart + openingTag.length;
+    const valueEnd = block.indexOf(closingTag, contentStart);
+    return valueEnd === -1 ? '' : block.slice(contentStart, valueEnd).trim();
+  };
+  const collectBlocks = (source, openTag, closeTag) => {
+    const out = [];
+    let from = 0;
+    for (;;) {
+      const start = source.indexOf(openTag, from);
+      if (start === -1) break;
+      const contentStart = start + openTag.length;
+      const end = source.indexOf(closeTag, contentStart);
+      // Incomplete open tag: stop linearly (do not rescan the remainder).
+      if (end === -1) break;
+      out.push(source.slice(start, end + closeTag.length));
+      from = end + closeTag.length;
+    }
+    return out;
+  };
+  const predecessorIds = (block) => {
+    const ids = [];
+    for (const link of collectBlocks(block, '<PredecessorLink>', '</PredecessorLink>')) {
+      const uid = tag(link, 'PredecessorUID');
+      if (/^\d+$/.test(uid)) ids.push(`msp-${uid}`);
+    }
+    return ids;
   };
   const unescape = (s) => s
     .replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"')
     .replace(/&apos;/g, "'").replace(/&amp;/g, '&');
   const day = (s) => (/^\d{4}-\d{2}-\d{2}/.test(s) ? s.slice(0, 10) : '');
   const tasks = [];
   const parents = {}; // depth -> last task id at that depth
-  const blocks = xml.match(/<Task>[\s\S]*?<\/Task>/g) || [];
+  const blocks = collectBlocks(String(xml || ''), '<Task>', '</Task>');
   for (const block of blocks) {
     const uid = tag(block, 'UID');
     const name = unescape(tag(block, 'Name'));
     if (!uid || uid === '0' || !name) continue; // project-summary row / blanks
     const level = Math.max(1, Number(tag(block, 'OutlineLevel')) || 1);
     const depth = Math.min(level, 3); // deeper levels flatten to task level
-    const preds = [...block.matchAll(/<PredecessorLink>[\s\S]*?<PredecessorUID>(\d+)<\/PredecessorUID>[\s\S]*?<\/PredecessorLink>/g)]
-      .map((m) => `msp-${m[1]}`);
+    const preds = predecessorIds(block);
     const pct = Number(tag(block, 'PercentComplete')) || 0;
     const t = {
       id: `msp-${uid}`,