Inbox keyboard navigation intercepts j/k/arrows without guarding contenteditable or SELECT

Area: Messaging & chat (audit p4) · Surface: /messages (MessageController@inbox) · Dimension: Law 5 — mobile / keyboard robustness · Severity: minor

The inbox arrow/j/k row navigation swallows those keys for any focused element that is not an INPUT or TEXTAREA. Today the inbox has no contenteditable editor so the practical blast radius is small, but the guard is incomplete and brittle — any future contenteditable/SELECT control on the page would have j/k typing and Up/Down option-cycling hijacked. The standard guard is `isContentEditable`/SELECT inclusive.

Evidence

templates/messages/inbox.php:210 guards only `if (ev.target.tagName === 'INPUT' || ev.target.tagName === 'TEXTAREA') return;` then preventDefaults `j`/`k`/ArrowUp/ArrowDown globally (lines 211-213). It does not check `ev.target.isContentEditable` or `SELECT`.

Suggested fix. Broaden the guard: `if (ev.target.tagName === 'INPUT' || ev.target.tagName === 'TEXTAREA' || ev.target.tagName === 'SELECT' || ev.target.isContentEditable) return;`

Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.