deps(web): SvelteKit 3, Vite 8, and current web tooling

[TusanHomichi]

Primary Issue

Closes #54

Problem And Outcome

npm audit reported the cookie < 0.7.0 advisory (GHSA-pxg6-pf52-xh8x, Dependabot alert #1). It was reachable only through SvelteKit 2, and Dependabot's own bump (#134) failed at install because Kit 3 needs vite-plugin-svelte 7. The maintainer asked for "latest versions of packages here where it makes sense in general". After merge, the web stack is on current releases, npm audit reports 0 findings, and every user-visible behavior is unchanged, as the full browser suite confirms. The one exception is the browser floor, which is now documented.

Changes

Package	Old → new
@sveltejs/kit	2.70.3 → 3.1.0
@sveltejs/adapter-static	3.0.10 → 4.0.0
@sveltejs/vite-plugin-svelte	6.2.4 → 7.3.1
vite	7.3.6 → 8.3.4
svelte	5.56.10 → 5.57.2
@playwright/test	1.62.1 → 1.64.1
cookie (transitive)	0.6.0 → 2.0.1
typescript	5.9.3 → 6.0.3, held off 7 (no JS API in TS 7, svelte-check peers ^5 || ^6, and the TS 7 announcement says Svelte projects should stay on 6)
@types/node	22.20.1 → 22.20.5, held to the Node 22 floor so types never offer APIs the minimum runtime lacks

• Kit 3 migration, per its guide (sv migrate sveltekit-3 was run and reviewed, and partly kept):
  • $lib → #lib/* subpath imports with explicit extensions (65 imports, 29 files);
  • svelte.config.js → sveltekit({ adapter }) in vite.config.ts;
  • tsconfig extends $app/tsconfig;
  • invalidateAll → refreshAll (6 sites);
  • goto uses replace and reset.
• The dead control removed: under Kit 3.1 the router can no longer strand the draft page (kit#17118). The independent reviewer tried seven paths and none stranded it, so "Resume editing" and its now-false comments are gone.
• Draft-recovery test: the replaced test asserts that an aborted shallow traversal leaves the editor usable in place. While the departure's load is held, it types and saves, and checks the text survives. It fails against Kit 2, as a negative control.
• Node: engines ^22.17 || >=24. CI pins Node 24 with a SHA-pinned actions/setup-node v7.1.0 in both workflows. Job names are unchanged, so the required checks still apply.
• Docs:
  • CONTRIBUTING's Node sentence;
  • ADR 0005 amended (toolchain only);
  • docs/install.md and CHANGELOG state the browser floor Vite 8 sets: Chrome/Edge 111, Firefox 114, Safari/iOS 16.4.
• Lockfile: regenerated with npm 11 (CI's); 0 npm audit findings.

Scope

• In scope: the web stack.
• Out of scope: Rust (deps(rust): move to the latest stable toolchain and current crates (sqlx 0.9 and five other majors) #136); Actions pins and Dependabot version updates (ci: update the pinned actions and keep dependencies current with Dependabot version updates #137).

Verification

• Candidate revision: 4adce3e1d5b0d115a5b960cac6ea8edddfef2149 (tree 4a5e6548).
• Local full proof (verifier role): scripts/proof.py passed 7/7 gates in 526 s.
  • 283 Rust tests passed, 0 failed.
  • Browser: 62 expected, 0 unexpected, 0 flaky, 0 skipped, on system Google Chrome 155.
  • Receipt sha256 b75858d7…, archived on the maintainer machine.
• npm audit: {low:0, moderate:0, high:0, critical:0}. npm outdated lists only the two holdbacks.
• Listed the exact verification commands run below
• Added or updated tests when behavior changed (the draft-recovery test)
• Added or updated an ADR when a durable decision changed (ADR 0005 amendment note)
• All fixtures and examples are invented; no real agency data

- scripts/check-guidance-names.sh
- web/: npm ci, npm run check, npm run build, npm audit
- cargo fmt --check
- cargo clippy --workspace --all-targets -- -D warnings
- cargo test --workspace
- cargo build -p consolebook-server
- web/: npm run e2e (system Google Chrome 155)

Review And Merge Notes

• Independent review (reviewer role, read-only, frozen worktree at 2a59e5c): 0 blocking, 1 should-fix (the unreachable Resume control), 6 nits.
  • Integrator decision: remove the control, since it fails closed and the new test guards against a regression. Applied in 4adce3e together with the nits: the test hardened, a vacuous assertion dropped, ADR 0005 amended, the browser floor documented, and the lockfile regenerated with npm 11.
  • Confirmed by the review:
    • the goto and refreshAll semantics are equivalent;
    • the replaced test's control fails 2/2 on Kit 2 and passes on Kit 3;
    • the build and embedding shape is unchanged;
    • type-check coverage is complete, and a $lib regression is blocked by the toolchain;
    • the setup-node SHA is v7.1.0;
    • the lockfile is clean (0 advisories, no new install scripts).
• Fix delta 2a59e5c..4adce3e: self-reviewed by the integrator, and the whole draft-recovery spec was re-run (47 passed) before the full proof.
• Dropped migration line: sv migrate added if (navigation.shallow && navigation.type === 'goto') return; to the draft page's beforeNavigate, and it was left out on purpose, because the app has no shallow goto. A future shallow goto on that page would be cancelled while edits are pending.
• Authority: the maintainer's dependency policy and standing PR permission (2026-10-15).
• Operator impact: browsers older than Chrome/Edge 111, Firefox 114, or Safari 16.4 (including Firefox ESR ≤ 102) no longer load the interface. This is documented in the install guide and the changelog. Building from source needs Node ^22.17 || >=24; the installed server needs no Node.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T20:33:56.602172Z	32b5942	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[TusanHomichi]

Rebased onto main 909bf92 (#139: Rust 1.99, sqlx 0.9) as 32b5942. The only conflict was the CHANGELOG Changed section; all three entries are kept, with the browser floor first. Combined local full proof on 32b5942c725cdbd6adced950d81747f944df6f3b (tree bc172ff6), the first run with the new web stack and Rust 1.99 together: 7/7 gates, 292 Rust tests passed with 0 failed, browser 62 expected, 0 unexpected, 0 flaky, 0 skipped, and npm audit reporting 0. Run with rustc 1.99.1 and system Chrome 155. Receipt sha256 c422ec60…. The earlier receipt for 4adce3e covers the pre-rebase head only.