build(node): coordinate Node 22.22.2 floor with jsdom 30

[seonghobae]

Canonical #779 Node/jsdom compatibility slice

This Draft advances issue #779 on top of the integrated dependency-security baseline from #783. The branch targets protected develop; predecessor, protected-base, prior-head, or model-only evidence never transfers to the current head.

Exact current identity

• Head: fc3d1ec01a1124a4e11375259d720a976a53ec5e.
• Protected base: develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844.
• fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 is already merged into protected develop as 7ad56cf0065d068ec6463d92726de4855a6e201d.
• fc3d1ec01a1124a4e11375259d720a976a53ec5e is a non-force two-parent descendant of prior semantic head 8e6a73879dac8aebd70f77aa80d55fc9c670a8f5 and live protected develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844.
• The only intervening protected file not owned by this slice was apps/desktop/src-tauri/Cargo.lock; the restack adopts the exact protected blob rather than regenerating or hand-editing it.
• develop...HEAD is behind_by=0; the net PR delta remains exactly seven Node/jsdom/npm-policy files and does not carry Cargo.lock.

Compatibility and security contract

The branch requires:

• root Node support >=22.22.2 <23, with an explicit rejection regression for Node 22.22.1;
• repository-canonical npm 10.9.9;
• npm runtime verification of bundled tar >=7.5.19 before dependency extraction;
• jsdom ^30.0.1;
• exact Node 22.22.2 execution in node-minimum-compatibility with setup-node package-manager cache disabled;
• corepack enable npm followed by exact npm/runtime verification before frozen dependency consumption;
• no mutable npm resolution in CI; and
• lint, strict typecheck, measured tests, production build, Storybook, and locked Tauri check/test at the supported floor.

5108c9ad52056c1960d99d382bceb1bd72c6de98 ports the protected npm 10.9.9/runtime-audit authority into this lane and updates the Node-floor regression contracts. 8e6a73879dac8aebd70f77aa80d55fc9c670a8f5 aligns the canonical npm provenance document with the raised Node floor and makes the non-mergeable lock-generation boundary explicit. fc3d1ec01a1124a4e11375259d720a976a53ec5e only repairs ancestry against the current protected base; predecessor checks/reviews do not transfer.

Current real RED boundary

The branch deliberately uses protected develop's reviewed #783 package-lock.json rather than retaining the old divergent/generated artifact. That lock still records the pre-migration Node floor and jsdom 29 graph, while this branch's manifests require >=22.22.2 <23 and jsdom 30. Frozen validation and the regression tests therefore fail closed until one complete lock is regenerated with the approved npm 10.9.9 toolchain.

Do not hand-edit the lock and do not transplant the closed Dependabot #760 lock as acceptance evidence. Its dependency graph is reference material only; generator provenance, exact-head checks, reviews, and approvals do not transfer.

The required next dependency action is a complete npm 10.9.9 lock generation on this current ancestry, followed by review of the full generated diff and frozen npm ci consumption. The resulting lock must preserve current #783 security state, SRI evidence, root @esbuild/* peer metadata, exact Undici/PDF.js security contracts, the raised root Node floor, and jsdom 30. The open Dependabot intents tracked separately must not be folded by hand; they may be consolidated only when one generated canonical lock proves their exact semantic deltas and evidence.

Merge gate

Keep Draft and unmerged until the complete lock is generated by the approved toolchain and one unchanged exact head has every applicable repository/central CI, security, SAST, SBOM/supply-chain, coverage/docstring, build/package/release and review gate terminal-success; zero valid unresolved findings; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance.

Never weaken a gate, reuse predecessor evidence, self-approve, manufacture approval, or treat queued/pending/skipped/cancelled/failed/neutral/model-only evidence as success.

[opencode-agent]

Queued @opencode-agent for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #896 at head c07e51639dbb7b44f57ff0aabc26ad793e691add. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

@opencode-agent Continue the canonical fix/node-22-22-2-jsdom-30-779 lane only, now bound to exact head 8e6a73879dac8aebd70f77aa80d55fc9c670a8f5 and protected develop@749511c3ad4000090048718f685c6bee6b3d2c25. Do not create a competing branch/PR and do not modify #783 ownership.

Fresh exact-head failure evidence: node-minimum-compatibility run 33280770990, job 99175446820, checked out merge commit bfb9309b1062e2a2ed62ccd875e167702412faf1 (head 8e6a738… + base 749511c…). Node setup was exact 22.22.2; corepack enable npm selected exact npm 10.9.9; check:npm-runtime verified bundled tar 7.5.22. The first causal boundary is then frozen npm ci, which fails EUSAGE because the protected lock does not contain the manifest-required jsdom 30 graph: jsdom@30.0.1, @asamuzakjp/css-color@6.0.7, @asamuzakjp/dom-selector@8.3.2, undici@8.10.0, whatwg-url@17.1.0.

The older node-minimum-package-lock-candidate was generated with npm 10.9.8 and is no longer acceptable provenance after the protected npm 10.9.9 security boundary. Generate the complete root package-lock.json from the current exact branch using Node 22.22.2 + repository-authoritative npm 10.9.9 and the documented lock-generation command (npm install --package-lock-only --ignore-scripts --no-audit --no-fund). Do not hand-edit or partially transplant lock records. Preserve #783's dependency-security state, registry SRI, root @esbuild/* peer: true sentinel metadata, and current PDF.js/Undici constraints. Commit only the generator-produced lock change unless a regression proves another owning-file repair is required.

Then prove focused GREEN with the current Node/runtime contract tests and frozen npm ci, followed by the exact-minimum lane and full exact-head CI/security/SBOM/release gates. Keep Draft; predecessor, merge-commit-only, skipped, queued, or model-only evidence is non-passing.

[seonghobae]

Fresh downstream evidence for this canonical npm/lock provenance boundary: Dependabot PR #1134 (Vitest 4.1.10→4.1.11), exact head 770db9b73e53e191dc7d3e89e1dcce9fe1e512ce, passed all 236 JS/TS tests and kept frontend coverage at 100%, but ci / build-and-test failed two repository lock-contract regressions because the generated root package-lock.json removed peer: true from root node_modules/@esbuild/*: test_lock_records_match_exact_registry_artifacts_and_preserve_peer_metadata and test_root_lock_preserves_esbuild_peer_metadata. A current-head REQUEST_CHANGES review on #1134 now points here. This is concrete evidence that dependency bumps must not treat arbitrary regenerated lock output as acceptable provenance. Preserve this PR's existing rule: regenerate the complete lock with repository-canonical npm 10.9.9, review the full generated diff, then require frozen npm ci plus the peer/provenance regressions and full quickcheck on the same exact head. Do not hand-edit the lock or weaken the tests.

[seonghobae]

Fresh downstream evidence reinforces this Draft as the canonical repair owner rather than a documentation-only lane. Three current Dependabot heads generated unrelated npm development updates and reproduced the same lock-provenance failure:

• build(deps-dev): bump @types/node from 26.2.0 to 26.4.0 #1133 3f16708767ad8ac11e675e170c622d24d09332d8 (@types/node 26.4.0): CI run 33589595580 / job 100266058867 — exactly two failures, both caused by root node_modules/@esbuild/* records losing peer: true (aix-ppc64 is the first reported record).
• build(deps-dev): bump eslint from 10.8.1 to 10.9.1 #1136 32bbb8ba067ace3365de8ce04a79949457aa7e33 (ESLint 10.9.1): CI run 33589624972 / job 100268985342 — the same two failures and same first missing record.
• build(deps-dev): bump vitest from 4.1.10 to 4.1.11 #1134 770db9b73e53e191dc7d3e89e1dcce9fe1e512ce (Vitest 4.1.11): CI run 33589608944 / job 100267513514 — Vitest 4.1.11 itself executes successfully (216 desktop tests + 20 shared-types tests, 100% measured frontend coverage), then the same two lock-provenance regressions fail on @esbuild/* peer metadata.

All three runs independently verify the repository-pinned npm 10.9.9 runtime before frozen consumption, so the failure is not a reason to relax npm ci, test_high_security_dependency_baseline.py, or test_npm_toolchain_contract.py. I placed exact-head REQUEST_CHANGES reviews on all three PRs and kept their unique package-version deltas open.

For the next complete npm 10.9.9 regeneration in this canonical owner, include the still-valid non-major development intents from those Dependabot PRs where compatible instead of creating a second hand-maintained lock path. Acceptance remains one complete generated root lock preserving @esbuild/* peer metadata, SRI/security baselines, jsdom/Node-floor intent, and exact-head GREEN. Existing downstream PRs can only be closed after their unique semantic deltas are demonstrably present in this or another verified successor.

[seonghobae]

Exact-head RED evidence after the non-force protected-base restack:

• head: fc3d1ec01a1124a4e11375259d720a976a53ec5e
• protected base: develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844
• develop...HEAD: behind_by=0; net semantic delta remains the seven Node/jsdom/npm-policy files.
• node-minimum-compatibility run 33828339546, job 100885708608 reached exact Node 22.22.2, activated project npm 10.9.9, and verified its bundled tar 7.5.22 successfully.
• The first frozen dependency-consumption step then failed exactly where expected: npm ci rejected manifest/lock disagreement (EUSAGE) because the committed lock is missing jsdom@30.0.1, @asamuzakjp/css-color@6.0.7, @asamuzakjp/dom-selector@8.3.2, undici@8.10.1, and whatwg-url@17.1.0.

This is the intended realistic RED, not an infrastructure failure and not a reason to weaken frozen consumption. The causal fix remains one complete root package-lock.json regeneration with the approved npm 10.9.9 generator on this current ancestry, followed by review of the complete generated diff, preservation of SRI and @esbuild/* peer:true generator sentinels/security contracts, and exact-head GREEN. Do not hand-edit individual lock records or rerun this failed job as if retry could repair the stale artifact.