Served app.min.js is stale relative to app.js — minified bundle still contains native alert() removed by the a11y sweep

Area: mobieusHelp (audit p7) · Surface: Global JS bundle served on all platform surfaces (incl. mobieusHelp agent/admin pages via layouts/admin.php and base.php) · Dimension: Law 1 / native-dialog ban — served bundle staleness · Severity: minor

The native-dialog ban is correctly honored in the helpdesk PHP templates (all destructive actions use data-confirm; verified zero raw confirm/alert/prompt in templates/helpdesk). But the globally served minified JS bundle predates the native-dialog cleanup and still ships two native alert() calls. The bundle is a gitignored build artifact, so a deploy must rerun bin/build-assets.php for the fix to reach users. This is build/deploy hygiene rather than a source defect, and the specific alert() path (video upload via .wysiwyg-editor) is not reachable from a helpdesk surface — but it is live everywhere the bundle loads.

Evidence

AssetHelper::resolve() prefers the .min sibling when present: platform/src/Helpers/AssetHelper.php:56 `if (is_file($diskMin)) { return $minPath . '?v=' . filemtime($diskMin); }`. layouts/admin.php:671 and layouts/base.php:587 call `AssetHelper::js('/js/app.js')`, so the on-disk app.min.js (mtime 2026-05-22 11:27) is what's actually served. That bundle still contains native dialogs: `grep -oE "alert\('[^']*'\)" public/js/app.min.js` → `alert('File is over 100 MB. …')` and `alert('Upload failed — try again.')` (app.min.js:382,384). The SOURCE app.js has already replaced these with App.toast (app.js:7877 `App.toast('File is over 100 MB. …','error')` and :7906 `App.toast('Upload failed — try again.','error')`). The a11y fix landed in app.js commit `9551d6bc platform(a11y): native-dialog sweep …` but app.min.js was last written by unrelated commit `16c7d655 B7-55: untrack runtime-mutable platform files` and is now gitignored (`git check-ignore public/js/app.min.js` → match), so it was never rebuilt after the sweep.

Suggested fix. Rebuild and redeploy app.min.js via bin/build-assets.php so the served bundle matches the post-a11y-sweep source; add a deploy step (or CI check) that fails if app.min.js is older than app.js to prevent this staleness recurring.

Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.