chore: repo quality maintenance (Next.js 16 / TypeScript ESM)

[fo0]

Summary

Quality-maintenance sweep 2026-08-21. Passes A–E (ENV parity, config parity, example defaults/docs, README onboarding, referenced docs) found nothing to fix — the artefacts are already complete. The single merged finding comes from Pass F (backlog hygiene): entry 106 in BACKLOG.md carried line counts that had gone stale again.

Docs/example artefacts only — no runtime config, no secrets, no functional code. Destructive edits are confined to BACKLOG.md and each backlog decision carries evidence.

Closes #521

Changes

• BACKLOG.md — entry 106 (StashViewer.tsx / Settings.tsx / MermaidDiagram.tsx sub-component extraction): line counts refreshed from the 2026-08-17 values 1820 / 835 / 410 to the measured 1890 / 890 / 410, and the accreted number history condensed to the current pair. The entry exists to track the growth of those three components, so stale figures actively mislead.

Findings

#	Pass	File(s)	Finding	Fix	Effort	Recommendation	Status
1	F	BACKLOG.md	Entry 106 recorded 1820 / 835 / 410 (as of 2026-08-17); the working tree has 1890 / 890 / 410	Refreshed both the File:Line and the Finding cell, condensed the number history	S	auto-fix	merged

Artefact status

Artefact	Present	Code parity
.env.example	yes	yes — all 9 code-read keys documented; NEXT_RUNTIME is framework-internal, HOSTNAME is documented as a Next.js standalone runtime variable
Config example	n.a.	n.a. — no file-based config layer (ENV + DB-stored settings only)
README onboarding	yes	yes — prerequisites, install, cp .env.example .env, dev/format/lint/tsc/test/build/start/mcp, script parity with package.json
Referenced docs	yes	yes — every .md linked from README.md, CLAUDE.md, AGENTS.md, CONTRIBUTING.md, SECURITY.md exists, none is a stub
BACKLOG.md	yes	tidy — 6 open entries, all re-verified against the code

Backlog rework

Entry (short)	Action	Evidence
57 — physics simulation duplicated	kept	code:src/components/GraphViewer.tsx + code:src/components/StashGraphCanvas.tsx (GRAVITY_BASE 0.008/0.006, REPULSION_FORCE 40/15, degree factor 0.3/0.2, cluster boost only in GraphViewer) — blocked on open issues #485 / #486
86 — inline closures in src/App.tsx	kept	code:src/App.tsx — 7 closures in the Sidebar/Search/StashViewer wiring, matching the entry
92 — dual state+ref in StashGraphCanvas.tsx	kept	code:src/components/StashGraphCanvas.tsx — all three ref pairs still present
106 — sub-component extraction	LoC refreshed 1820 / 835 / 410 -> 1890 / 890 / 410	code:src/components/StashViewer.tsx (1890), code:src/components/Settings.tsx (890), code:src/components/MermaidDiagram.tsx (410)
110 — logAccess positional params	kept	code:src/server/db.ts — 22 logAccess( call sites, matching the entry
129 — no "last used" column on tokens	kept	code:src/server/stores/token-store.ts — no last_used / lastUsed in server code

0 removed, 0 extracted into issues, 1 consolidated, 5 kept. No F.2 extraction: none of the six open entries meets the "important" bar (no security/data-loss angle, no user-impacting bug, no priority marker, no blocker role) — all are P2/P3 Accepted / Deferred.

Testing

• npx prettier@3.9.6 --check "**/*.md" — green (this is what docs-format.yml runs).
• Whitelist diff check over the sweep range: BACKLOG.md is the only changed file; no source, no runtime config, no example file touched.
• No JSON/YAML example changed, so no syntax check applies; no source changed, so no compile check applies (node_modules is not installed in this environment).

Checklist

• Formatting passes (npm run format:check) — verified for Markdown via the pinned Prettier, the only file class this PR touches
• Code compiles without errors (npx tsc --noEmit) — n.a., no code changed
• Tests pass (npm test) — n.a., no code changed
• Build succeeds (npm run build) — n.a., no code changed
• Changes are documented (if applicable) — the change is documentation

---

Generated by Claude Code