fix: audit bugfixes + doc reconciliation (SVG export, downloads, PWA cache, Vercel wasm-opt)

[suradet-ps]

Summary

Batch of fixes from a full audit of the ROADMAP's "done" claims against the codebase. All checks verified locally before pushing: cargo test --workspace (34 tests), cargo clippy --all-targets -- -D warnings, cargo fmt --check, cargo check -p codeframe-app --target wasm32-unknown-unknown, trunk build --release, node --check on the service worker.

Bug fixes

• SVG export: line numbers used an invalid dominant-baseline="hopping" -> "hanging", so SVG line numbers now align with the canvas output (regression test added).
• SVG export: x-advance used UTF-8 byte length (token.text.len()) instead of character count -> non-ASCII code (Thai, CJK, emoji comments) overlapped in SVG and broke target-width scale math. Now chars().count() everywhere (renderer + export).
• Downloads could abort in Firefox: the blob object URL was revoked synchronously right after anchor.click(); revocation is now deferred 1.5s.
• Export filenames lost fractional scales: codeframe-2x.png for a 2.5x custom scale; now codeframe-2.5x.png (with unit tests).
• Service-worker cache grew unbounded across redeploys (content-hashed JS/WASM entries were never evicted); now capped at 80 entries with oldest-first pruning, clamped to available entries.
• Vercel builds skipped wasm-opt: binaryen is now installed in the vercel.json build command, matching CI (wasm-opt was CI-only, so production artifacts were larger than the enforced budget).

Doc reconciliation (ROADMAP claimed things that weren't true)

• Removed the "Tab-width control (2/4/8) — Working" claim: it was reverted deliberately in PR fix: expand tabs on paste to match tab-width setting #17 (07d8c7a); Phase 3 now records that decision instead.
• Phase 3 "paste from clipboard button" + "textarea line-number gutter" marked as dropped with the same revert.
• Fixed version claims (0.7.0 in Cargo.toml — Phase 7 never bumped to v0.8.0), CI job counts (7 -> 10), removed the stale "No offline story" gap (PWA shipped in Phase 5), and corrected the hex-audit + CSP verification descriptions to match what CI actually does.
• README: "7 B&W background presets" -> 5 (Center Radial / Dark Vignette never existed).
• CONTRIBUTING: CI table now lists all 10 jobs; removed the #![deny(unused_must_use)] claim no crate has.
• Synced Cargo.lock with the workspace 0.7.0 version (was out of sync since the v0.7.0 bump).

Commits

1. fix(renderer): use hanging baseline for SVG line numbers
2. fix(renderer): advance SVG x-cursor by char count, not byte count
3. fix(app): defer object URL revocation so Firefox downloads finish
4. fix(app): keep fractional scales in export filenames
5. fix(pwa): bound service-worker cache growth across redeploys
6. fix(pwa): clamp cache prune count to available entries
7. fix(deploy): run wasm-opt in Vercel builds (wasm-opt was CI-only)
8. chore: sync Cargo.lock with 0.7.0 workspace version
9. docs(roadmap): reconcile ROADMAP with actual repo state
10. docs: fix stale claims in README and CONTRIBUTING

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
codeshot	Ready	Preview	Aug 7, 2026 9:05am