docs(handover): post-consolidation follow-up — npm audit triaged, clippy now zero, design-system WIP abandoned

HANDOVER.md

@@ -54,26 +54,42 @@ From `docs/issues/README.md`:
 
 RB-08 continues to gate v0.1 tagging.
 
-## Deferred (unchanged from 2026/04/19 handover unless noted)
+## Post-consolidation follow-up (evening 2026/04/23)
 
-- **RB-08 verification** — needs macOS hardware access
-- **Design-system work** — parked on `feat/design-system-recover`; revisit in a dedicated session
-- **`live.rs:1089` needless_range_loop refactor** — clippy suggestion is ugly, deserves a real rewrite
-- **Kon → Corbie codebase rename** — package name, crate prefixes, repo name on Gitea + GitHub. Coordinated sweep, not yet scheduled
-- **Transparent windows**, **file-system export**, **bulk select/export**, **LLM content tags**, **Settings UX overhaul**, **Task 7 walk-through** — all carried over from 2026-04-19 handover
-- **CI clippy enforcement** — 1 warning remains on main; turning on `-D warnings` in CI means either fixing it or explicit `#[allow]`
+Jake asked for "nothing outstanding" on Corbie. Follow-up pass did:
 
-## Repo state at session end
+### 1. npm audit triaged + safe minor bumps landed
+- `@sveltejs/kit` 2.57.1 → **2.58.0**, `@sveltejs/adapter-static` 3.0.6 → **3.0.10** (commit `0e18a78`). Both are patch / minor SemVer — no API breakage.
+- **Residual advisories accepted** (5 total: 3 low / 2 moderate, all transitive, not session-actionable):
+  - **cookie@0.6.x** (3× low) pinned by `@sveltejs/kit@^0.6.0` as of kit 2.58.0. Upstream has not bumped the pin; fixed cookie version is `0.7+`. Advisory: out-of-bounds chars in name/path/domain. **Context**: Kon/Corbie is a Tauri desktop app, no public-facing HTTP server, so the attack surface for this is effectively nil. Re-triage when `@sveltejs/kit` lands a cookie bump.
+  - **esbuild via svelte-i18n@4.0.1** (2× moderate) — `svelte-i18n` bundles `esbuild@^0.19.2` for its CLI. Advisory: "dev-server allows any website to read responses". **Context**: only affects `vite dev` over the network. In a Tauri desktop app the dev server is localhost-only and not relevant to production. `svelte-i18n` is already at latest (4.0.1); the only way to drop this is replace the i18n library.
+- `npm audit --audit-level high` would report 0 vulnerabilities; GitHub's richer advisory db may still show the transitive set but none are actionable without upstream bumps.
 
-- `main` at `509b983` — 7 commits ahead of origin at session start (1 clippy + 3 dependabot original commits + 3 merge commits)
-- `feat/design-system-recover` at `8855db8` — WIP recovery, pushed to `github` only
-- Tags: `pre-consolidation-2026-04-23` points at `9b0067b` (restore anchor)
-- Stashes: none
-- Dependabot branches: still present locally; can be pruned now that merges landed
+### 2. needless_range_loop refactor landed
+Commit `2b82b9b` — `src-tauri/src/commands/live.rs:1087` duplicate-merge inner loop rewritten as `for segment in &nearby[start..upper]`. Workspace now **zero clippy warnings** with `cargo clippy --workspace --all-targets`. Safe to turn on `-D warnings` in CI when desired.
 
-## Full pre-push verification (Phase 5)
+### 3. `feat/design-system-recover` evaluated, WIP layer abandoned
+Compared the branch against current main:
+- The handoff commit's content (design tokens, fonts, previews, ui_kits) is **already on main** as commit `8ba5641`. Recovery branch just duplicates it from a different base.
+- The WIP layer on top modifies 24 files (TasksPage, FilesPage, WipTaskList, TaskSidebar, viewer, float, local_engine, rule_based, etc.) against a base main has since significantly refactored (RB-01 through RB-12 + all the CR-2026-04-22 fixes + a preferences.svelte.js → .ts conversion).
+- Test merge surfaces **14+ conflicts** needing per-file, designer-intent-aware resolution. Conflict cost > value of the WIP given main has already moved past most of it.
+- **Decision: abandon the WIP**. Local branch deleted. `github/feat/design-system-recover` preserved as a read-only archive for reference mining. Any design-system polish from here gets redone fresh against current main rather than rebased through a stale WIP.
 
-Run at end of session — see commit log after `509b983` for the verification commit, and `outputs/` for the full log.
+## Still deferred (not session-actionable)
+
+- **RB-08 verification** — needs macOS hardware access. Gates v0.1 tag. One concrete open item.
+- **Kon → Corbie codebase rename** — Jake handles repo rename (Gitea + GitHub); coordinated codebase sweep (package name `kon@0.1.0` → `corbie@0.1.0`, crate prefixes `kon-*` → `corbie-*`, desktop file, binary name, install paths `~/.local/share/kon/` → `~/.local/share/corbie/`, database filename `kon.db`, window titles, README body) should follow the repo rename so artefact names match. Will need a migration shim to keep existing users' data alive across the path change.
+- **npm audit residuals** — see §1 above. Re-visit when `@sveltejs/kit` bumps its cookie pin, or when an i18n replacement is chosen.
+- **CI clippy enforcement** — workspace is now clean with default clippy. Turning on `-D warnings` in CI costs nothing additional.
+- **Transparent windows**, **file-system export**, **bulk select/export**, **LLM content tags**, **Settings UX overhaul**, **Task 7 walk-through** — all carried from 2026-04-19 handover.
+
+## Repo state at end of follow-up
+
+- `main` at `2b82b9b` (evening pass: +3 commits — sveltejs bumps, clippy refactor, this handover update)
+- Local branches: `main` only (recovery branch deleted locally after archival)
+- `github/feat/design-system-recover` at `8855db8` (preserved as archive)
+- Tag `pre-consolidation-2026-04-23` at `9b0067b`
+- `cargo build --workspace` ✓ / `cargo test --workspace` ✓ (245 passing) / `cargo clippy --workspace --all-targets` **0 warnings** / `cargo fmt --check` ✓ / `npm run check` ✓ (0 errors, 0 warnings) / `npm run build` ✓
 
 ## Anchors