Document npm optional dependency tree noise - #16
Merged
Conversation
Uh oh!
There was an error while loading. Please reload this page.
1 task
BigSimmo pushed a commit
that referenced
this pull request
Jul 21, 2026
Resolves the docs/outstanding-issues.md conflict: main added #11 (auth DB-connection allocation) via its own ledger update, so this renumbers the site-audit follow-ups from #11-#16 to #12-#17 (next-id -> 018) and fixes the #17 cross-reference. Keeps main's #11 intact; no other ledger rows changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UbhUVWVJRwDibC2YtJ6aRX
BigSimmo added a commit
that referenced
this pull request
Jul 21, 2026
4 tasks
7 tasks
BigSimmo pushed a commit
that referenced
this pull request
Aug 13, 2026
…ion design Cancels the original request and re-files it, using the inbox's own supersede mechanism rather than editing an immutable request. The original said 'drop the Outcome column (or replace each cell with a pointer)'. Building it on 2026-08-13 established that dropping the column is wrong and that two other constraints are load-bearing, none of which are visible from reading the code: - The rewrite cannot be a direct edit, and cannot even be code-only. It has to run inside applyRequestBatch — the function check-ledger-write-discipline imports — and land in the same commit as a reconcile, or the checker computes normalise(base) against an un-normalised canonical and fails every PR. - Dropping the column makes the queue vanish from /issues, because issues-report skips any queue row whose cells.length !== 7. - Composite ID(s) rows must keep their prose. Derivation deliberately skips them, so they still fall back to the Outcome cell; blanking it leaves them with nothing. Found by running it: order 17 (#13, #16) rendered empty. Recording these now because rediscovering them costs another build-and-revert cycle, which is what this session just spent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DuYJz8hauCsCdx8r4fXiZU
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm ciandnpm audit --jsonremain dependency install/security gates.npm ls --depth=0extraneous output as a hard release blocker.Evidence
npm ls --depth=0reports@emnapi/core,@emnapi/runtime,@emnapi/wasi-threads,@napi-rs/wasm-runtime, and@tybys/wasm-utilas extraneous.npm explaintraces them to optional wasm/native dependency paths from@tailwindcss/oxide-wasm32-wasi,@rolldown/binding-wasm32-wasi, and@unrs/resolver-binding-wasm32-wasi.package-lock.jsoncontains those optional paths.npm audit --jsonreports zero vulnerabilities.Verification
Local verification under Node 22:
npm run format:checkpassednpm audit --jsonpassed with 0 vulnerabilitiesnpm run lintpassednpm run typecheckpassednpm run testpassed: 39 files, 240 testsnpm run buildpassedRisk notes