fix: refresh embedded web assets

[vincentkoc]

What Problem This Solves

The latest CI on main failed because the checked-in embedded web assets no longer matched the generated Svelte bundle.

Why This Change Was Made

Regenerated the embedded web distribution with the repository build so the committed hashed assets match the current source output.

User Impact

Restores green CI and keeps the API binary embedding the current web UI assets.

Evidence

• pnpm install --frozen-lockfile
• pnpm build
• pnpm test && pnpm typecheck && pnpm -r typecheck && pnpm lint && pnpm fmt:check

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 25, 2026, 2:54 AM ET / 06:54 UTC.

Summary
The PR refreshes checked-in generated web assets under apps/api/internal/webassets/dist so SvelteKit HTML, entry, chunk, and node references point to regenerated bundle filenames.

Reproducibility: not applicable. as a runtime bug reproduction path; this is a generated asset refresh. Source inspection confirms the API embeds the checked-in dist tree and the build script regenerates that tree, but I did not run the build in this read-only review.

Review metrics: 1 noteworthy metric.

• Generated asset surface: 10 files changed, 78 additions, 78 deletions. The diff is confined to checked-in built web assets, so review should focus on bundle coherence and CI output rather than hand-authored application logic.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Wait for Playwright E2E to complete before merge.

Risk before merge

• [P1] Playwright E2E was still in progress at review time, so maintainers should wait for the required checks to finish before merging.
• [P1] I did not rerun the build or test commands locally because this review is read-only and those commands can write build or cache artifacts.

Maintainer options:

1. Decide the mitigation before merge
   Merge the generated asset refresh after CI confirms the committed dist tree matches the current Svelte build output.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No repair-lane action is needed because this PR already contains the focused generated-asset refresh and only needs normal CI-backed maintainer review.

Security
Cleared: The diff is limited to generated static web assets and HTML references, with no dependency, workflow, secret, installer, or permission changes.

Review details

Best possible solution:

Merge the generated asset refresh after CI confirms the committed dist tree matches the current Svelte build output.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a runtime bug reproduction path; this is a generated asset refresh. Source inspection confirms the API embeds the checked-in dist tree and the build script regenerates that tree, but I did not run the build in this read-only review.

Is this the best way to solve the issue?

Yes. Regenerating the embedded SvelteKit bundle is the narrow maintainable fix for a mismatch between source output and checked-in web assets.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against 9d29bc6356f2.

Label changes

Label changes:

• add P3: This is a low-risk generated-asset refresh for CI and embedded web UI consistency, with no reported production outage or data impact.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR author is a repository member, so the external-contributor real behavior proof gate does not apply; the PR body still lists build and validation commands.

Label justifications:

• P3: This is a low-risk generated-asset refresh for CI and embedded web UI consistency, with no reported production outage or data impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR author is a repository member, so the external-contributor real behavior proof gate does not apply; the PR body still lists build and validation commands.

Evidence reviewed

What I checked:

• Repository policy read: The target repository AGENTS.md was read fully; its sqlc guidance is unrelated because this PR only touches generated web asset files. (AGENTS.md:1, 9d29bc6356f2)
• Embedded asset contract: Current main embeds dist/* into the Go API binary, so the checked-in generated web asset tree is the runtime asset source for the API. (apps/api/internal/webassets/webassets.go:7, 9d29bc6356f2)
• Build regeneration path: The root build script runs the web build and then copies apps/web/dist into apps/api/internal/webassets/dist, matching the PR's stated regeneration path. (package.json:6, 9d29bc6356f2)
• SPA serving path: The API server serves files from webassets.Dist and falls back to the embedded index.html or 200.html, so stale hashed references can affect the served UI. (apps/api/internal/httpapi/server.go:981, 9d29bc6356f2)
• Current main asset references: Current main still references the old app.Dphjwod_.js and Vg7HUXRy.js asset names that this PR replaces with regenerated names. (apps/api/internal/webassets/dist/index.html:12, 9d29bc6356f2)
• PR diff scope: The head commit changes only generated web asset files: 10 files, 78 additions, 78 deletions, including HTML reference updates and hashed JS file renames/additions/removals. (apps/api/internal/webassets/dist/index.html:12, 95b912877156)

Likely related people:

• vincentkoc: Current main history includes recent client runtime and web-dist test handling work by vincentkoc, and earlier generated asset history also includes their commits, so they are a strong routing candidate beyond only authoring this PR. (role: recent area contributor; confidence: high; commits: 9d29bc6356f2, 3848eddb6017, 95b912877156; files: scripts/go-test-with-web-dist.mjs, apps/api/internal/webassets/dist/index.html, apps/api/internal/webassets/dist/_app/immutable/entry/app.Sw08gAEk.js)
• steipete: Peter Steinberger introduced the root build/embed scripts and the Go embedded asset package, and has multiple historical refreshes in the embedded web asset tree. (role: introduced behavior; confidence: high; commits: e0de6adf9cf0, 758fdce94971, 644bba191740; files: package.json, scripts/embed-web-dist.mjs, apps/api/internal/webassets/webassets.go)
• PollyBot13: The current main old hashed asset names were introduced in a recent merged web feature commit that regenerated this same embedded asset tree. (role: recent generated asset contributor; confidence: medium; commits: 4f71257cbc61; files: apps/api/internal/webassets/dist/index.html, apps/api/internal/webassets/dist/_app/immutable/chunks/Vg7HUXRy.js)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.