docs(handover): post-consolidation follow-up — npm audit triaged, clippy now zero, design-system WIP abandoned

HANDOVER.md

@@ -54,26 +54,42 @@ From `docs/issues/README.md`:
 
 RB-08 continues to gate v0.1 tagging.
 
-## Deferred (unchanged from 2026/04/19 handover unless noted)
+## Post-consolidation follow-up (evening 2026/04/23)
 
-- **RB-08 verification** — needs macOS hardware access
-- **Design-system work** — parked on `feat/design-system-recover`; revisit in a dedicated session
-- **`live.rs:1089` needless_range_loop refactor** — clippy suggestion is ugly, deserves a real rewrite
-- **Kon → Corbie codebase rename** — package name, crate prefixes, repo name on Gitea + GitHub. Coordinated sweep, not yet scheduled
-- **Transparent windows**, **file-system export**, **bulk select/export**, **LLM content tags**, **Settings UX overhaul**, **Task 7 walk-through** — all carried over from 2026-04-19 handover
-- **CI clippy enforcement** — 1 warning remains on main; turning on `-D warnings` in CI means either fixing it or explicit `#[allow]`
+Jake asked for "nothing outstanding" on Corbie. Follow-up pass did:
 
-## Repo state at session end
+### 1. npm audit triaged + safe minor bumps landed
+- `@sveltejs/kit` 2.57.1 → **2.58.0**, `@sveltejs/adapter-static` 3.0.6 → **3.0.10** (commit `0e18a78`). Both are patch / minor SemVer — no API breakage.
+- **Residual advisories accepted** (5 total: 3 low / 2 moderate, all transitive, not session-actionable):
+  - **cookie@0.6.x** (3× low) pinned by `@sveltejs/kit@^0.6.0` as of kit 2.58.0. Upstream has not bumped the pin; fixed cookie version is `0.7+`. Advisory: out-of-bounds chars in name/path/domain. **Context**: Kon/Corbie is a Tauri desktop app, no public-facing HTTP server, so the attack surface for this is effectively nil. Re-triage when `@sveltejs/kit` lands a cookie bump.
+  - **esbuild via svelte-i18n@4.0.1** (2× moderate) — `svelte-i18n` bundles `esbuild@^0.19.2` for its CLI. Advisory: "dev-server allows any website to read responses". **Context**: only affects `vite dev` over the network. In a Tauri desktop app the dev server is localhost-only and not relevant to production. `svelte-i18n` is already at latest (4.0.1); the only way to drop this is replace the i18n library.
+- `npm audit --audit-level high` would report 0 vulnerabilities; GitHub's richer advisory db may still show the transitive set but none are actionable without upstream bumps.
 
-- `main` at `509b983` — 7 commits ahead of origin at session start (1 clippy + 3 dependabot original commits + 3 merge commits)
-- `feat/design-system-recover` at `8855db8` — WIP recovery, pushed to `github` only
-- Tags: `pre-consolidation-2026-04-23` points at `9b0067b` (restore anchor)
-- Stashes: none
-- Dependabot branches: still present locally; can be pruned now that merges landed
+### 2. needless_range_loop refactor landed
+Commit `2b82b9b` — `src-tauri/src/commands/live.rs:1087` duplicate-merge inner loop rewritten as `for segment in &nearby[start..upper]`. Workspace now **zero clippy warnings** with `cargo clippy --workspace --all-targets`. Safe to turn on `-D warnings` in CI when desired.
 
-## Full pre-push verification (Phase 5)
+### 3. `feat/design-system-recover` evaluated, WIP layer abandoned
+Compared the branch against current main:
+- The handoff commit's content (design tokens, fonts, previews, ui_kits) is **already on main** as commit `8ba5641`. Recovery branch just duplicates it from a different base.
+- The WIP layer on top modifies 24 files (TasksPage, FilesPage, WipTaskList, TaskSidebar, viewer, float, local_engine, rule_based, etc.) against a base main has since significantly refactored (RB-01 through RB-12 + all the CR-2026-04-22 fixes + a preferences.svelte.js → .ts conversion).
+- Test merge surfaces **14+ conflicts** needing per-file, designer-intent-aware resolution. Conflict cost > value of the WIP given main has already moved past most of it.
+- **Decision: abandon the WIP**. Local branch deleted. `github/feat/design-system-recover` preserved as a read-only archive for reference mining. Any design-system polish from here gets redone fresh against current main rather than rebased through a stale WIP.
 
-Run at end of session — see commit log after `509b983` for the verification commit, and `outputs/` for the full log.
+## Still deferred (not session-actionable)
+
+- **RB-08 verification** — needs macOS hardware access. Gates v0.1 tag. One concrete open item.
+- **Kon → Corbie codebase rename** — Jake handles repo rename (Gitea + GitHub); coordinated codebase sweep (package name `kon@0.1.0` → `corbie@0.1.0`, crate prefixes `kon-*` → `corbie-*`, desktop file, binary name, install paths `~/.local/share/kon/` → `~/.local/share/corbie/`, database filename `kon.db`, window titles, README body) should follow the repo rename so artefact names match. Will need a migration shim to keep existing users' data alive across the path change.
+- **npm audit residuals** — see §1 above. Re-visit when `@sveltejs/kit` bumps its cookie pin, or when an i18n replacement is chosen.
+- **CI clippy enforcement** — workspace is now clean with default clippy. Turning on `-D warnings` in CI costs nothing additional.
+- **Transparent windows**, **file-system export**, **bulk select/export**, **LLM content tags**, **Settings UX overhaul**, **Task 7 walk-through** — all carried from 2026-04-19 handover.
+
+## Repo state at end of follow-up
+
+- `main` at `2b82b9b` (evening pass: +3 commits — sveltejs bumps, clippy refactor, this handover update)
+- Local branches: `main` only (recovery branch deleted locally after archival)
+- `github/feat/design-system-recover` at `8855db8` (preserved as archive)
+- Tag `pre-consolidation-2026-04-23` at `9b0067b`
+- `cargo build --workspace` ✓ / `cargo test --workspace` ✓ (245 passing) / `cargo clippy --workspace --all-targets` **0 warnings** / `cargo fmt --check` ✓ / `npm run check` ✓ (0 errors, 0 warnings) / `npm run build` ✓
 
 ## Anchors
 

package-lock.json

@@ -18,8 +18,8 @@
         "svelte-i18n": "^4.0.1"
       },
       "devDependencies": {
-        "@sveltejs/adapter-static": "^3.0.6",
-        "@sveltejs/kit": "^2.57.1",
+        "@sveltejs/adapter-static": "^3.0.10",
+        "@sveltejs/kit": "^2.58.0",
         "@sveltejs/vite-plugin-svelte": "^5.0.0",
         "@tailwindcss/vite": "^4.2.1",
         "@tauri-apps/cli": "^2",
@@ -958,9 +958,9 @@
       }
     },
     "node_modules/@sveltejs/kit": {
-      "version": "2.57.1",
-      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.57.1.tgz",
-      "integrity": "sha512-VRdSbB96cI1EnRh09CqmnQqP/YJvET5buj8S6k7CxaJqBJD4bw4fRKDjcarAj/eX9k2eHifQfDH8NtOh+ZxxPw==",
+      "version": "2.58.0",
+      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.58.0.tgz",
+      "integrity": "sha512-kT9GCN8yJTkCK1W+Gi/bvGooWAM7y7WXP+yd+rf6QOIjyoK1ERPrMwSufXJUNu2pMWIqruhFvmz+LbOqsEmKmA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -23,8 +23,8 @@
     "svelte-i18n": "^4.0.1"
   },
   "devDependencies": {
-    "@sveltejs/adapter-static": "^3.0.6",
-    "@sveltejs/kit": "^2.57.1",
+    "@sveltejs/adapter-static": "^3.0.10",
+    "@sveltejs/kit": "^2.58.0",
     "@sveltejs/vite-plugin-svelte": "^5.0.0",
     "@tailwindcss/vite": "^4.2.1",
     "@tauri-apps/cli": "^2",

src-tauri/src/commands/live.rs

@@ -1086,11 +1086,12 @@ fn build_nearby_transcript_candidates(
     let mut texts: Vec<String> = Vec::new();
     for start in 0..nearby.len() {
         let mut merged = String::new();
-        for end in start..nearby.len().min(start + DUPLICATE_TRANSCRIPT_MERGE_LIMIT) {
+        let upper = nearby.len().min(start + DUPLICATE_TRANSCRIPT_MERGE_LIMIT);
+        for segment in &nearby[start..upper] {
             if !merged.is_empty() {
                 merged.push(' ');
             }
-            merged.push_str(nearby[end].text.trim());
+            merged.push_str(segment.text.trim());
             if !texts.iter().any(|existing| existing == &merged) {
                 texts.push(merged.clone());
             }