[chrnx-dev]

What changed

Companion docs for core #117 (merged into core develop as 4d1639f), which shipped issues #104–#108 and #116. Every claim was checked against the core code and its [Unreleased] CHANGELOG, and scoped to the FPRD-001 docs delivery map.

Page	Change
reference/createapp.md	limits.maxWsMessageBytes (1 MiB) and maxWsQueue (16): units, defaults, close codes, TypeError validation in createApp, server-level only; streaming maxBodyBytes note; static row mentions symlink escapes are a 404
guides/streaming.md	New Inbound limits section: 1009 / 1013, per-consumer queues (each @inbound() iterator has its own bounded queue, frames before the first reader go to it), a handler that never reads, per-runtime refusal point, worst-case memory maxConnections × maxWsQueue × maxWsMessageBytes (≈ 15.6 GiB at Node defaults; no connection cap outside Node), and a Breaking after 26.9.0-beta.2 note for the 1 MiB / 16 defaults
guides/runtimes.md	Replaces the stale "fetch reads the whole body before 413" paragraph; new WebSocket message size table (Node/Bun before buffering, Bun closes 1006; Deno/edge after receipt); new ctx.ip section (Deno/Bun via serveDeno/serveBun, trustProxy falls back to the peer, address formats, cases that still answer '')
guides/uploads.md	When the body limit is checked: declared Content-Length refused up front, reading stops at the crossing chunk, workerd refuses by the count
guides/html.md	Symlink confinement; out-of-root and dangling links are a 404 through onError (not 403); re-pointing the root symlink needs a restart; the remaining check/read race
guides/errors.md	Node's last-resort 500 + connection: close: skips onError, socket destroyed once output started
guides/observability.md	Known gap in the request:start/request:end pairing for that path
guides/security.md	trustProxy peer fallback; short cross-link list of the four hardening defaults

Commits:

• fix(deps): apply non-breaking npm audit fixes: lockfile only. Clears the high-severity advisories (http-cache-semantics, sharp, source-map-js) and smol-toml. astro 7.3.3, starlight 0.41.11, sharp 0.35.5. The built dist/ was diffed against main: all 27 pages are identical apart from asset hashes and the Starlight generator tag.
• docs: document request-safety limits and adapter fixes from core #117
• docs: require Node 22 for core and for building the site

Node 22 floor. Node 18 and 20 are end-of-life, so @green-tea/core requires Node 22 from the next release (RC.1), per core #122. getting-started.md now says Node ≥ 22 and carries a Breaking after 26.9.0-beta.2 note, like the other post-beta.2 changes here. No other page names a Node version. The site's own floor is Astro 7's >=22.12.0: the README now says Node 22.12+, and package.json declares it in engines. Both workflows already use Node 22 only.

npm run build passes (27 pages), and every internal link and anchor in the changed pages resolves.

Open items

• CI will still fail npm audit --audit-level=moderate. One moderate advisory remains, postcss-selector-parser <7.1.6 (GHSA-rj75-hqrm-r3gf), and it was already failing on main. It comes in through @astrojs/starlight → @expressive-code/core@0.44.2 (latest) → postcss-nested@^6 → postcss-selector-parser@6.1.4. No 6.x release has the fix, so clearing it needs a major-version override (or an upstream expressive-code release). npm audit fix --force would downgrade Starlight to 0.21.5. That decision is left to a maintainer.
• Version pins untouched. documentsCoreVersion and package.json stay at 26.9.0-beta.2, and the breaking note says "after 26.9.0-beta.2". The RC.1 release cut should rename it and update whats-new.md.
• guides/mesh.md frame-cap paragraph says mesh frames are capped at 4,000,000 characters, above the 1 MB body limit. In core, the teapot's control channel now also goes through maxWsMessageBytes / maxWsQueue, so with the defaults an inbound mesh frame over 1 MiB closes with 1009 before that check. The core CHANGELOG doesn't mention mesh, so this PR leaves mesh.md alone. This needs a core-side decision.
• Not documented here: the malformed WebSocket upgrade 400/404/1008 change (#104). Per the delivery map it gets a CHANGELOG entry only, with no docs page. Routing (#109) waits until it is accepted.

Audit (update): the postcss-selector-parser advisory (GHSA-rj75-hqrm-r3gf) is cleared by a temporary overrides: { "postcss-nested": "^7.0.2" } in its own commit. npm audit now reports 0. The built site is byte-identical to the build before the override. Drop the override once expressive-code ships on postcss-nested 7.