fix: M-wave manual-test regressions (B1, B2, B3, M10 polish)

Phase 7 final checks (10 manual-test agents) surfaced 4 issues that
needed pre-merge resolution:

B1 — security-best-practices.mdx residual 'account' references (M1).
F-006 fixed the design-patterns.mdx `account` vs `signer` mismatch
but missed the same pattern in security-best-practices.mdx — three
references on lines 89, 103, 113 were still using `account.capabilities.*`
while line 115 (and the surrounding prose) used `signer`. All three
edits switched to `signer` for consistency with the publish call.

B2 — fumadocs DocsLayout grid bug on mobile/tablet (M8).
The F-002 a11y fix wrapped DocsLayout's children in '<main>' for the
landmark-one-main audit. That broke fumadocs' CSS Grid: the grid uses
named areas ('[grid-area:main]') on the article, which expects to be
a direct child of DocsLayout. The wrapper made the article a grandchild,
so the grid forced 'grid-template-columns: 872px 0px 0px 0px 0px' on
every viewport — content clipped at 320, 375, and 768 widths on docs
pages (10/60 fail combos).
Fix: add 'style={{ display: 'contents' }}' to the <main> element. The
landmark stays for a11y/Lighthouse but the article reverts to being a
direct grid child for layout purposes.

B3 — search bias overcorrection (M5 exhaustive).
Earlier 'biasLocalFirst' (3f0ada5) put ALL locals before externals to
fix a federation-pushed-out-local regression from F-012. M5 found this
overcorrected: weak-match local pages (e.g. /docs/ai-tools/skills, which
mentions many Flow concepts in passing) outranked strongly-relevant
external developers.flow.com pages. 6/7 federation queries failed.
Tried a milder 'bubble first local to position 0' — same root cause,
same failure.
Fix: remove the bias entirely. Trust Orama's term-frequency scoring;
federation queries that match developers.flow.com better naturally
rank higher. Tradeoffs documented: 2 local-targeting queries now
surface external pages instead. Proper field-weight tuning is tracked
as #296.

M10 polish — three issues:
- pageUrl/docPath props leaking from <DocsPage> to a DOM element
  (every docs page logged 2 React DOM-prop warnings). Destructure
  custom props before {...spread}.
- frameborder/allowfullscreen JSX casing in 3 tutorial files (first-steps,
  hello-world, resources) — JSX requires camelCase frameBorder /
  allowFullScreen.

Verified: types:check clean, build clean, search test shows federation
works for 5+ queries, no DOM-prop warnings expected from the fixed
files.

Refs: pr285-evaluation/eval/M{1,5,7,8,10}*.md

Author: Aliserag

content/docs/security-best-practices.mdx

@@ -86,7 +86,7 @@ When issuing a capability, a capability of the same type might already be presen
     var flowTokenVaultCap: Capability<auth(FungibleToken.Withdraw) &FlowToken.Vault>? = nil
 
     // Get all the capabilities that have already been issued for the desired storage path
-    let flowTokenVaultCaps = account.capabilities.storage.getControllers(forPath: /storage/flowTokenVault)
+    let flowTokenVaultCaps = signer.capabilities.storage.getControllers(forPath: /storage/flowTokenVault)
 
     // Iterate through them to see if there is already one of the needed type
     for cap in flowTokenVaultCaps {
@@ -100,7 +100,7 @@ When issuing a capability, a capability of the same type might already be presen
     // issue a new one
     if flowTokenVaultCap == nil {
         // issue a new entitled capability to the flow token vault
-        flowTokenVaultCap = account.capabilities.storage.issue<auth(FungibleToken.Withdraw) &FlowToken.Vault>(/storage/flowTokenVault)
+        flowTokenVaultCap = signer.capabilities.storage.issue<auth(FungibleToken.Withdraw) &FlowToken.Vault>(/storage/flowTokenVault)
     }
 ```
 
@@ -110,7 +110,7 @@ When publishing a capability, a published capability might already be present. I
 
 ```cadence
 // Check if the published capability already exists
-if account.capabilities.borrow<&FlowToken.Vault>(/public/flowTokenReceiver) == nil {
+if signer.capabilities.borrow<&FlowToken.Vault>(/public/flowTokenReceiver) == nil {
     // since it doesn't exist yet, we should publish a new one that we created earlier
     signer.capabilities.publish(
         receiverCapability,

content/docs/tutorial/first-steps.mdx

@@ -7,9 +7,9 @@ title: First Steps
     style={{ position: 'absolute', top: 0, left: 0, width: '100%', height: '100%' }}
     src="https://www.youtube.com/embed/Mtqs4JHjiyI" 
     title="YouTube video player" 
-    frameborder="0" 
+    frameBorder="0" 
     allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" 
-    allowfullscreen
+    allowFullScreen
   ></iframe>
 </div>
 

content/docs/tutorial/hello-world.mdx

@@ -8,9 +8,9 @@ description: A smart contract tutorial for Cadence.
     style={{ position: 'absolute', top: 0, left: 0, width: '100%', height: '100%' }}
     src="https://www.youtube.com/embed/bAvlVE7Wd7w" 
     title="YouTube video player" 
-    frameborder="0" 
+    frameBorder="0" 
     allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" 
-    allowfullscreen
+    allowFullScreen
   ></iframe>
 </div>
 

content/docs/tutorial/resources.mdx

@@ -8,9 +8,9 @@ description: An introduction to resources, capabilities, and account storage in
     style={{ position: 'absolute', top: 0, left: 0, width: '100%', height: '100%' }}
     src="https://www.youtube.com/embed/oHo6-bnb97Y" 
     title="YouTube video player" 
-    frameborder="0" 
+    frameBorder="0" 
     allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" 
-    allowfullscreen
+    allowFullScreen
   ></iframe>
 </div>
 

src/routes/api/search.ts

@@ -68,42 +68,22 @@ const server = createSearchAPI('advanced', {
   indexes: () => indexesPromise,
 });
 
-/**
- * Bias local cadence-lang.org hits to appear before external developers.flow.com
- * hits when both match a query. Federation (F-012) enriches results but can push
- * canonical local pages out of top-3 (T5 rerun: Q9 'flow-ai-tools install'
- * regressed from /docs/ai-tools/skills → external page). The fix: stable-sort
- * results into [local-first, external-after] so a single local page lands on
- * top whenever it's also a hit. Within each group, original Orama scoring is
- * preserved.
- */
-function biasLocalFirst(results: any[]): any[] {
-  const local: any[] = [];
-  const external: any[] = [];
-  for (const r of results) {
-    if (typeof r?.url === 'string' && r.url.startsWith('/')) local.push(r);
-    else external.push(r);
-  }
-  return [...local, ...external];
-}
+// Removed earlier biasLocalFirst variants. Two iterations of "local-first" bias
+// caused the federation regression M5 exhaustive caught:
+//   v1 (3f0ada5): strict partition — all locals before any external. Weak-match
+//                 local pages (e.g. /docs/ai-tools/skills mentions FCL once)
+//                 outranked relevant external pages. 6/7 federation queries
+//                 failed.
+//   v2 (this commit, attempt 1): bubble first local to position 0. Same root
+//                 cause — weak local still bubbled over strong external.
+// Conclusion: trust Orama's term-frequency scoring. Federated results from
+// developers.flow.com that match a query better than any local page WILL
+// rank higher, which is correct. No post-sort bias.
 
 export const Route = createFileRoute('/api/search')({
   server: {
     handlers: {
-      GET: async ({ request }) => {
-        const res = await server.GET(request);
-        // Only re-order JSON array responses (the search API contract). Pass
-        // through anything else (errors, redirects) untouched.
-        const ct = res.headers.get('content-type') ?? '';
-        if (!ct.includes('application/json')) return res;
-        try {
-          const body = await res.json();
-          if (!Array.isArray(body)) return Response.json(body, { headers: res.headers });
-          return Response.json(biasLocalFirst(body), { headers: res.headers });
-        } catch {
-          return res;
-        }
-      },
+      GET: async ({ request }) => server.GET(request),
     },
   },
 });

src/routes/docs/$.tsx

@@ -195,13 +195,17 @@ const clientLoader = browserCollections.docs.createClientLoader({
       },
     };
 
+    // Strip our custom props before spreading — DocsPage forwards unknown
+    // attrs to a DOM element, and 'pageUrl' / 'docPath' aren't valid HTML
+    // attributes. M10 console-network sweep flagged this on every docs page.
+    const { pageUrl: _pageUrl, docPath: _docPath, ...domSafeProps } = props;
     return (
       <DocsPage
         toc={toc}
         tableOfContent={{
           style: 'clerk',
         }}
-        {...props}>
+        {...domSafeProps}>
         <script
           type="application/ld+json"
           dangerouslySetInnerHTML={{ __html: JSON.stringify(jsonLd) }}
@@ -245,7 +249,15 @@ function Page() {
         {...baseOptions()}
         tree={data.pageTree}
       >
-        <main aria-label="Documentation content">
+        {/* `display: contents` keeps the <main> landmark for a11y/Lighthouse
+         * (landmark-one-main, button-name etc.) without disrupting fumadocs'
+         * CSS-Grid layout, which uses `[grid-area:main]` on a direct child of
+         * DocsLayout. Without `display: contents`, this wrapper became a grid
+         * child and the actual article (now a grandchild) couldn't claim its
+         * named area, forcing the grid to a fixed 872px first column on every
+         * viewport (M8 visual regression — 10/60 fails on mobile/tablet docs
+         * pages). */}
+        <main aria-label="Documentation content" style={{ display: 'contents' }}>
           <Suspense>
             {clientLoader.useContent(data.path, {
               className: '',