Lint production code against the browser floor

[kmcginnes]

Summary

#2394 pinned the floor, but nothing stops code from calling an API newer than it. This adds the lint layer from #2237 and writes down what still gets through.

floor: packages/graph-explorer/.browserslistrc
  build  vite build.target          lowers JS syntax, never polyfills
         vite cssTarget (Lightning CSS) compiles CSS; Tailwind's fixed-target pass off
  types  lib: ES2023                ES2024+ built-ins, incl. instance methods
  lint   baseline-js "widely"       static built-ins + Web APIs
         es-x syntax rules          using, RegExp dup groups/modifiers, import attributes, JSON modules

• CSS now compiles only for the floor. @tailwindcss/vite runs its own Lightning CSS pass with fixed targets (Firefox 128, Safari 16.4, Chrome 111) and has no target option, so I turned it off with optimize: false. Vite's CSS minify already compiles for build.cssTarget, which follows .browserslistrc.
• Lint runs on production code in packages/graph-explorer/src and packages/shared/src. Tests are excluded because they run in Node.
• I dropped the issue's per-API es-x instance-method rules (layer 3). Without type information they only fire in aggressive mode, which flags every array.map() as Iterator.prototype.map (more than 300 false positives). lib: ES2023 already rejects those methods through types.
• available: "widely" replaces the issue's available: 2022. The year was tuned to the old Firefox 114 snapshot, and the floor is now current Widely available.
• ignoreFeatures: html-wrapper-methods (any .bold or .anchor property matches) and top-level-await (web-features lists Safari 27, but the floor's Safari runs it and Vite builds it).
• Triage, with inline disables and reasons:
  • showSaveFilePicker: feature-detected, falls back to saveAs.
  • navigator.clipboard.writeText: Widely available. The feature it's grouped under also covers Clipboard.write.
  • AbortSignal.timeout: needs Chrome 124, one version above the floor. It reaches Widely available on 2026-10-18.
• Removes the Error.isError runtime tests and their docs/agents/testing.md bullet, as the Enforce the baseline-widely-available browser floor #2237 comment asked once a static guard landed.
• New docs/agents/browser-floor.md, linked from AGENTS.md and REVIEW.md, explains the layers and what nothing catches: DOM instance methods, and ES2023 features after the floor such as symbols as WeakMap keys.

Evidence

After: a probe file under packages/graph-explorer/src gets flagged for each of these:

• pnpm check:lint: Error.isError, Promise.try, Symbol.dispose, using, a duplicate named group, and a RegExp modifier.
• pnpm check:types: Set.prototype.union and [].values().map.
• Not caught by either, as documented: symbols as WeakMap keys and checkVisibility().

CSS: built index.css is 91,097 bytes with Tailwind's pass on and 89,112 with it off. The only difference is that native nesting stays instead of being flattened for Safari 16.4, and nesting is inside the floor (Chrome 120, Firefox 117, Safari 17.2). Lowering .browserslistrc to Firefox 100 / Safari 15 grows the output to about 94 KB with Tailwind's pass on or off, which shows Vite's pass is what applies the floor.

Merge Danger

Door: two-way

Impact: lint and CSS output

eslint-plugin-baseline-js is pre-1.0, and oxlint JS plugins are alpha. A plugin upgrade can change what "widely" allows, because the plugin bundles its own web-features data.

Related

• Closes Enforce the baseline-widely-available browser floor #2237
• Related to Pin the browser floor to Baseline Widely available through browserslist #2394
• Related to Replace Error.isError with instanceof Error in createErrorDetails #2192