Retire bounded code-health debt after baseline adoption

[sarthakagrawal927]

Track only the code-health debt that remains after the initial Fleet-standard adoption. Exact formatter, coverage, complexity, duplication, dependency, and suppression evidence will be added from the measured baseline.

Each accepted boundary must be regression-gated, have the smallest safe next action, and be reviewed by 2026-09-12. Product behavior and Stockfish/Cloudflare isolation constraints must not be changed merely to improve a metric.

[sarthakagrawal927]

Measured baseline after safe cleanup:

• Formatting: 14 of 18 established JavaScript/TypeScript source, config, and test files predate the enabled Biome formatter. Every changed source file must pass; no broad behavior-adjacent rewrite is included.
• Browser tests/coverage: the managed-server smoke proof now checks the rendered board, primary controls, and move history. A dedicated Chromium proof exercises the board, AI settings, and changelog and covers 197,126 of 256,419 transformed source bytes (76.88%) across all 15 loaded application modules; the floor is 76.5%.
• Unused surface: zero files, exports, exported types, dependencies, devDependencies, unlisted imports, or unresolved imports after removing four redundant direct Astro/MDX/Shiki dev packages. The exact Blume renderer remains because its isolated build imports blume/markdown; Stockfish public WASM and script boundaries are explicit.
• Complexity: zero violations across 58 functions / 598 NLOC; max CCN 14, max function length 64, max parameters 7.
• Duplication: zero exact clone groups and zero duplicated lines across 16 production files.
• Dependency cycles: zero.
• Dependency audit: zero critical/high/moderate after removing redundant docs dependencies and applying guarded nanoid/Undici transitive floors. Two low dev-toolchain advisories remain: Blume AI provider utility GHSA-866g-f22w-33x8 and Vite/tsx esbuild GHSA-g7r4-m6w7-qqqr.
• Suppressions: one existing React-hook dependency suppression documents the intentionally orientation-only effect in ChessGame.
• Repository hygiene, Playwright proofs, TypeScript, lint, production build, Blume strict link validation, and isolated Blume render pass. The fast check-docs-links.sh helper is Linux-only because macOS Bash lacks mapfile; the canonical Blume validation still proved all links.

Every accepted boundary is regression-gated. Smallest next actions: format established files in behavior-neutral batches; raise loaded-module coverage above 80% with a legal-move/evaluation journey; replace the hook suppression behind that proof; update the two dev toolchains when patched versions are compatible. Review date: 2026-09-12.