Three independent fixes that each resolve a red job on main.
Security floors (v2/Cargo.lock, v2/Cargo.toml)
cargo audit reported 10 advisories across three transitive crates:
quinn-proto 0.11.15, rustls 0.23.45 and wasmtime 36.0.16. Bump to
0.11.18 / 0.23.46 / 36.0.18. All three arrive through
midstreamer-quic = 0.3, so only the lockfile enforces them; v2/Cargo.toml
now records the floors so a plain `cargo update` cannot walk them back
without explanation.
Dashboard accessibility
18 axe failures (3 browsers x 6 views): 58 role=switch toggles with no
accessible name, two unlabelled range inputs, low-contrast timestamp /
chip / badge text, and two scrollable regions with no keyboard access.
The welcome modal also left the accessibility tree only by fading to
opacity 0. A closed state at opacity 0 still gets scanned, and axe
composes the semi-transparent text over the darkened backdrop, which
produced a false color-contrast failure (ratio 1.55 reported where the
real ratio was ~17:1). It now leaves via visibility, and
connectedCallback exposes a `ready` attribute once its async storage read
settles so the smoke test stops sampling the modal mid-transition.
README visual asset validation
The workflow regenerates the 20 SVGs and requires byte-identical output.
scripts/render-readme-visuals.py stripped unused CSS rules but left the
trailing newline behind, so 14 removed rules collapsed into 16 blank
lines. The producer now consumes the orphan newline and the assets are
regenerated (94,576 -> 94,027 bytes).
Verified locally: cargo audit 0.22.2 exits 0, cargo check --workspace
--no-default-features --all-targets is clean, the README renderer is
idempotent with verify passing, and the axe suite is 18/18 across chromium,
firefox and webkit on six consecutive runs.
Dan Alec
8e846a9a36