[0xcadams]

What

Reconcile the Go and npm dependency updates with the coordinated transport branch, without raising the SDK's Node minimum or undoing its HTML-parser security fix. Stacked on #470; the compatible changes from #457 and #459 are applied here rather than merging either older branch.

Why

The transport work already requires x/net v0.62.0 and its dependency minimums. The Go dependency update needs to preserve that floor and account for the separate disposable-test-harness module.

The npm update also includes two majors that require Node 22.19: Undici 8 and ref-parser 16. The SDK currently supports Node 22.18, so those two updates remain deferred rather than silently changing its runtime requirement.

Qualification also exposed a publisher-policy response at its exact request deadline before the context timer had closed Done. A separate fix commit checks the absolute deadline, so timer scheduling cannot issue expired preparation work or install its late response.

Changes

• Update the compatible AWS, Prometheus, OTLP, and transitive Go dependencies in the root and test harness, retaining the x/net security floor.
• Apply ten compatible npm updates; retain Undici 7, ref-parser 14, and the existing Node engine declarations.
• Regenerate the embedded feedback toolbar with the updated Preact dependency.
• Fence policy preparation before control work and response installation, with deterministic delayed-timer regressions and no credential or application retry.

[0xcadams]

local receipts at signed adea3af9: frozen pnpm install, JavaScript build/type checks, 35 files / 286 tests, JS lint/format, package verification, Chrome toolbar check, routine Go/public API, full Go races, harness races, Go lint, full formatting, diff checks, and post-commit generation verification passed. govulncheck reports zero reachable vulnerabilities; one uncalled advisory remains in required modules.

f8179ad7 is the separate policy-deadline fix: both new delayed-timer cases fail before it (expired fetch issued a call and installed an observation; late response also installed) and pass afterward. ten focused race repetitions and the broader visitor-policy race tier passed. the first full race run caught the original exact-deadline assertion; no blanket retry or timeout increase was used to fix it.

real-control native packet/claim-renewal integration is running on this tree. #470’s composed full integration run remains on its unchanged cde60284 tree. current-tip CI is not claimed green. no merge, release/version/tag operation, deployment, live infrastructure change, or deployed benchmark.

[0xcadams]

native real-control/PostgreSQL/two-relay race integration passed on this tree: ten carrier-loss cases in 118.31s plus live claim renewal in 57.53s (177.473s package). one target survived the original pair deadline; both relay claims advanced by at least 30.021s. the disposable Linux authoritative-DNS target also exited successfully, without changing its ten-second split-relay readiness budget.

this does not resolve #470 qualification: its unchanged composed full run passed API and all four state shards, then failed runtime shard 1 at TestIntegrationControlRestartPreservesDataPlane with EOF on the fresh visitor while control was stopped. remaining groups were not reached. that failure is being inspected separately; no complete integration or green-CI claim.

[0xcadams]

CI at adea3af9: all PostgreSQL API/state/runtime shards and lease/workload proofs, DNS integration, Runtime workloads, and aggregate Load tests passed. the integration aggregate is still red because Binary (binary) failed in TestBinaryIntegrationManualComposePublisherPublicHTTPAndPostgres: the Compose database publisher emitted TNL_CLIENT_SERVER_RESPONSE_INVALID before ready; the disposable standalone server logged permission API internal failures and exited during control/lease timeouts. other binary tests passed. saved logs need diagnosis; this is not yet classified as a dependency regression or infrastructure flake. no blanket retry, timeout extension, or green-CI claim.

[0xcadams]

parent qualification receipt: #470 unchanged 61033ba5 completed all four sequential local race runtime shards and both real-clock lease/workload proofs successfully. these are parent receipts, not additional runs at adea3af9. #470 CI is now complete with only the known Go (Linux) exact-deadline failure; its fix remains the separate f8179ad7 commit here. the earlier local control-outage EOF is still unexplained, and this branch’s binary manual-Compose CI failure still needs diagnosis. no all-green or final-cutover claim.