chore: refresh toolchain and fix capability and CI checks

[anandpant]

Changes

• Refresh the compatible SvelteKit 2/Svelte 5/Vite 8, Convex and AI SDK 6 graph; pin Bun 1.4.2 / Node 24.21.0 with mise. Reconciles build(deps-dev): bump vite from 8.0.14 to 8.0.16 in /apps/web #135, build(deps-dev): bump @sveltejs/kit from 2.61.1 to 2.69.1 in /apps/web #141, deps: bump the app-dependencies group across 1 directory with 13 updates #142, fix(deps): patch Vite to 8.3.3 #143 and ci: bump the github-actions group across 1 directory with 2 updates #138; coordinator can close those after merge.
• Replace unavailable Blacksmith labels with existing GitHub-hosted runners. Run install/build once, enforce consumer typechecks and unit/browser checks, fix deployment-event gate SHA handling, and preserve required contexts.
• Fix USB 3.2 Gen 1 being labeled 10 Gbps instead of 5 Gbps in both manual inference and the displayed profile. Remove unused OpenTUI/Solid/Babel setup and fix Windows CLI artifact names.
• Pin browser tooling, assert actual field results/errors, and distinguish local field checks from hosted inference/reset. Bind the validated gateway credential explicitly across all LLM callers, with a request-level regression test.

Source and capability corrections

Current head: 5236e3b53b050d25a5da6eb069fe3e82fb2b48af. Incremental bug-slice base: b0fbed357b967921ad0be58e44742fd136a48e2d. Both b0fbed357..64b4a92 and 64b4a92..5236e3b cleared by coordinator review: NO ACTIONABLE FINDINGS; receipts held centrally.

• Refreshed retired A8633/A80E6/B81A2 test assumptions from primary vendor data without changing discovery/extractor behavior. Retained default-title behavior in explicit fixture scenarios, backend quality assertions and multi-variant power/evidence coverage.
• Reproduced both B8173 defects through the real extractor with a captured vendor payload: negative PD became true,480Mbps became unknown. Vendor source explicitly states PD incompatibility.
• Added a shared, bounded negative-aware PD parser for the source and maintained Shopify enrichment consumer. Negative takes precedence; positive and unknown semantics remain distinct. Evidence preserves the exact statement, and deterministic/LLM enrichment cannot promote explicit false.
• Normalize Mbps to Gbps by1000, retaining decimal/highest-rate handling and Lightning limits. Select evidence for the actual maximum-rate token in original units. Distinguish lowercase bit b from byte B; MBps/GBps are not misread as bit rates.
• Earlier manual-field correction remains covered: unprefixed Gen1=5Gbps/Black, Gen2=10Gbps/Blue; prefixed Gen1 remains5Gbps.

Verification

• Exact-head CI: 92 tests pass, plus types, lint, build, Linux CLI and local browser. CodeQL, title and Socket pass.
• Local affected offline suite:37 pass; final byte-unit regression22 pass (20 pass/2 fail before the unit correction). Source/backend typechecks and Ultracite fix/check pass.
• Read-only live source suite:12 pass across supported brands at the substantive fix; final-head targeted B8173 check confirms PD false,0.48Gbps and vendor evidence. Original B8173 regression showed10 pass/7 fail before fixing the two defects.
• Source fixture records authoritative URL, timestamp and projection. Synthetic positive/negative/unknown/unit edge cases are explicitly distinguished from vendor data. No paid provider integration was manually invoked.

Blocked, not merge-ready: Vercel is Ready. Automatically triggered preview validation seeded8/8 products and38 rows in next-axolotl-214, then failed manual inference with Gateway Unauthenticated. Hosted browser QA did not run. Required gates remain enforceable. No valid credential has arrived; coordinator already owns the pending restore-key question. No merge or auto-merge.

Backfill impact: future authorized ingestion receives the corrected fields. Existing stored rows were not inspected, mutated or replayed; this PR does not repair historical catalog data. Any backfill needs separate authorization and verification. Provider-backed ingest integration, hosted inference/browser and production validation remain unverified here.

Data Quality Grade: B for the bounded source corrections; overall PR remains C. Vendor payload comparisons, source URL/timestamp, preserved identifiers and unit-aware/tri-state behavioral tests support this slice. Negation recognition is deliberately limited to explicit incompatibility/non-support phrases, not general NLP. Unexpected fixture requests fail, and live drift fails assertions rather than skipping them. No credentials, production resources or gate semantics changed.

Coordinator owns the cleared review receipts, credential unblock, eventual merge and production verification; close superseded dependency PRs only after merge. Full consumer trace, red/green and current CI evidence are in .memory/fleet-maintenance/b8173-findings.md and handoff.json. The implementation worktree is preserved for resumed credential validation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cable-intel-web	Ready	Preview	Oct 10, 2026 6:23am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​bun@​1.3.14 ⏵ 1.4.2
	agent-browser@​0.38.2
	convex-test@​0.0.53 ⏵ 0.0.60	+1		+1	+5
	@​types/​node@​25.5.0 ⏵ 24.19.2	-11		+1	-1
	@​sveltejs/​vite-plugin-svelte@​7.1.2 ⏵ 7.3.1	+1			+2
	@​sveltejs/​kit@​2.61.1 ⏵ 2.70.3	+1	+4	+1	+1
	vite@​8.0.14 ⏵ 8.3.4		+18	+1	+1
	tailwindcss@​4.2.2 ⏵ 4.3.3				+2
	turbo@​2.8.20 ⏵ 2.11.7		+3	+1	+1
	convex@​1.34.0 ⏵ 1.46.0	-1		+1
	svelte@​5.55.10 ⏵ 5.57.2	+1
	@​tailwindcss/​vite@​4.2.2 ⏵ 4.3.3	+1		+1	-1
	convex-svelte@​0.0.12 ⏵ 0.14.0	+2		+1
	zod@​4.3.6 ⏵ 4.6.5
	@​tabler/​icons-svelte@​3.40.0 ⏵ 3.49.0	+6		+3	+2
	dotenv@​17.3.1 ⏵ 17.4.2	+1
	svelte-check@​4.4.8 ⏵ 4.7.6				+1
	ai@​6.0.134 ⏵ 6.0.303	+15

View full report