fix: render public lobby and serve crawler metadata

[HomenShum]

Search visitors previously received an empty root, and /robots.txt and /sitemap.xml returned the same HTML shell. Prerender the existing lobby through Vite, share its provider composition with hydration, link styles directly, and serve real canonical metadata and crawler files. Keep room deep links and the comparison route on their existing client paths. Controls remain disabled until hydration; a no-script explanation, main landmark and explicit input labels support the initial page.

Keep the demo's browser-only tracing scheduler outside the server entry. Importing it during rendering left a referenced MessagePort after a successful build; the new scenarios exercise actual child-process termination. CI now also checks Convex types and builds the public output.

Patch nine development lock records: eight coupled Vitest packages to 4.1.11 and baseline-browser-mapping to 2.11.0. Package.json, all 44 production lock records and 19 installed production packages are unchanged. The old runtime is preserved. Ordinary npm ci and a fresh full audit pass with zero findings; built HTML/CSS/JS/crawler bytes are unchanged by the dependency patch.

Validation:

• All three TypeScript projects, 56 citations, 60 tests in 10 files, deterministic CLI illustration, and build pass locally.
• 35 browser scenarios pass at 320/390/834/1280/1440: keyboard operation, no/delayed scripts, actual local create/join, missing-room refusal, an explicitly injected 503 and recovery, and repeated navigation through the real deterministic comparison endpoint. DOM, console and pixels were retained. Five lobby Axe scans report zero violations; manual-review items remain.
• 24 concurrent/repeated development responses and normal/no-script development browser checks pass.
• An actual Convex-selected production build renders and exits with zero fetch/WebSocket calls. This does not execute hosted providers.

The handoff documents source-bound verification and remaining limits. Local evidence is not canonical deployment verification, a complete accessibility/security certification, or a search-ranking claim. Full portfolio grades, selected-label truncation, detailed room/demo layouts, physical devices, microphone/audio, real providers and durable hosted restart remain open. Independent review was unavailable because of the account usage limit; author readback is not independent approval.

Exact-source CI: CI 34303567950 and conformance 34303568383 pass for e09fa427ea72fd229304f8519643bbd920d743ef. The tested merge 89919c2a1966389d406c6ec3eb6da06057cabf22 has the candidate's exact tree. Linux CI passes all three typechecks, build, 56 citations and 60 tests in 10 files, with no skipped workflow steps. The browser matrix above is local evidence. Conformance's separate NodeKit-main installation still reports five advisories (three moderate/two high); the reviewed NodeKit patch is not yet adopted. Provider previews report success, but anonymous canonical-domain verification still returns the original 862-byte HTML for all three URLs. This PR has not updated the production alias.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
local-collab-mvp	Ready	Preview	Sep 9, 2026 2:31am UTC
nodevoice	Ready	Preview	Sep 9, 2026 2:31am UTC