diff --git a/web/osv-scanner.toml b/web/osv-scanner.toml
new file mode 100644
index 00000000..f01d3a57
--- /dev/null
+++ b/web/osv-scanner.toml
@@ -0,0 +1,6 @@
+# Advisories that OSV reports against the wizard's dependencies but that do
+# not apply to what it builds. Each says why.
+
+[[IgnoredVulns]]
+id = "GHSA-gcqx-w48m-w2h4"
+reason = "deepmerge, used only at build time by @sveltejs/vite-plugin-svelte to merge the project's own Svelte options (src/utils/options.js). Nothing from a user or a model reaches it, it is not in the wizard bundle, and no patched version exists."
diff --git a/web/package-lock.json b/web/package-lock.json
index 6934da11..d3dd4956 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -10,8 +10,8 @@
 			"devDependencies": {
 				"@fontsource/archivo": "^5.3.0",
 				"@fontsource/jetbrains-mono": "^5.3.0",
-				"@sveltejs/adapter-static": "^3.0.10",
-				"@sveltejs/kit": "^2.63.0",
+				"@sveltejs/adapter-static": "^4.0.1",
+				"@sveltejs/kit": "^3.1.1",
 				"@sveltejs/vite-plugin-svelte": "^7.1.2",
 				"@types/node": "^22.20.5",
 				"svelte": "^5.57.3",
@@ -406,47 +406,43 @@
 			}
 		},
 		"node_modules/@sveltejs/adapter-static": {
-			"version": "3.0.10",
-			"resolved": "https://registry.npmjs.org/@sveltejs/adapter-static/-/adapter-static-3.0.10.tgz",
-			"integrity": "sha512-7D9lYFWJmB7zxZyTE/qxjksvMqzMuYrrsyh1f4AlZqeZeACPRySjbC3aFiY55wb1tWUaKOQG9PVbm74JcN2Iew==",
+			"version": "4.0.1",
+			"resolved": "https://registry.npmjs.org/@sveltejs/adapter-static/-/adapter-static-4.0.1.tgz",
+			"integrity": "sha512-svOU1OcBiJ9Kn1cdxHDmJIsBy1/iQe9STPvUFkO2/iinxPFS7r8fc9TiCaWWUgbrE+7ox6Bt4MURv3RPi7sunQ==",
 			"dev": true,
 			"license": "MIT",
 			"peerDependencies": {
-				"@sveltejs/kit": "^2.0.0"
+				"@sveltejs/kit": "^3.0.0-next.0"
 			}
 		},
 		"node_modules/@sveltejs/kit": {
-			"version": "2.70.3",
-			"resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.70.3.tgz",
-			"integrity": "sha512-UDvEYuZqAMbfB/oXIoqKvbKcb7YczK5zYrzmsGV1zRJk03jntwp8dXiYoIJotxAndsKvcPFtx9H1GRSKFdSHgg==",
+			"version": "3.1.1",
+			"resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-3.1.1.tgz",
+			"integrity": "sha512-BiEMvekYXE9Gu/YhWJ/yJ0WDLH1PX/dmjuAeFp5rrtdmgdzkjt7DvimlSP+/U4tgposl7pkE20luHpcnc6BgRw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@standard-schema/spec": "^1.0.0",
-				"@sveltejs/acorn-typescript": "^1.0.9",
-				"@types/cookie": "^0.6.0",
-				"acorn": "^8.16.0",
-				"cookie": "^0.6.0",
-				"devalue": "^5.8.1",
+				"@rolldown/pluginutils": "^1.0.1",
+				"@standard-schema/spec": "^1.1.0",
+				"cookie": "^2.0.1",
+				"devalue": "^5.9.4",
 				"esm-env": "^1.2.2",
-				"kleur": "^4.1.5",
-				"magic-string": "^0.30.5",
-				"mrmime": "^2.0.0",
-				"set-cookie-parser": "^3.0.0",
-				"sirv": "^3.0.0"
+				"magic-string": "^1.2.3",
+				"mrmime": "^2.0.1",
+				"sirv": "^3.0.2"
 			},
 			"bin": {
 				"svelte-kit": "svelte-kit.js"
 			},
 			"engines": {
-				"node": ">=18.13"
+				"node": ">=22.17"
 			},
 			"peerDependencies": {
 				"@opentelemetry/api": "^1.0.0",
-				"@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
-				"svelte": "^4.0.0 || ^5.0.0-next.0",
-				"typescript": "^5.3.3 || ^6.0.0",
-				"vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
+				"@sveltejs/vite-plugin-svelte": "^7.0.0",
+				"svelte": "^5.57.1",
+				"typescript": "^6.0.0",
+				"vite": "^8.0.12"
 			},
 			"peerDependenciesMeta": {
 				"@opentelemetry/api": {
@@ -457,6 +453,16 @@
 				}
 			}
 		},
+		"node_modules/@sveltejs/kit/node_modules/magic-string": {
+			"version": "1.4.5",
+			"resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.5.tgz",
+			"integrity": "sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@jridgewell/sourcemap-codec": "^1.6.0"
+			}
+		},
 		"node_modules/@sveltejs/load-config": {
 			"version": "0.2.3",
 			"resolved": "https://registry.npmjs.org/@sveltejs/load-config/-/load-config-0.2.3.tgz",
@@ -508,13 +514,6 @@
 				"assertion-error": "^2.0.1"
 			}
 		},
-		"node_modules/@types/cookie": {
-			"version": "0.6.0",
-			"resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
-			"integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==",
-			"dev": true,
-			"license": "MIT"
-		},
 		"node_modules/@types/deep-eql": {
 			"version": "4.0.2",
 			"resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
@@ -667,13 +666,17 @@
 			}
 		},
 		"node_modules/cookie": {
-			"version": "0.7.2",
-			"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-			"integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+			"version": "2.0.1",
+			"resolved": "https://registry.npmjs.org/cookie/-/cookie-2.0.1.tgz",
+			"integrity": "sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
-				"node": ">= 0.6"
+				"node": ">=22"
+			},
+			"funding": {
+				"type": "opencollective",
+				"url": "https://opencollective.com/express"
 			}
 		},
 		"node_modules/deepmerge": {
@@ -798,16 +801,6 @@
 				"@types/estree": "^1.0.6"
 			}
 		},
-		"node_modules/kleur": {
-			"version": "4.1.5",
-			"resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
-			"integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
-			"dev": true,
-			"license": "MIT",
-			"engines": {
-				"node": ">=6"
-			}
-		},
 		"node_modules/lightningcss": {
 			"version": "1.33.0",
 			"resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
@@ -1261,13 +1254,6 @@
 				"node": ">=6"
 			}
 		},
-		"node_modules/set-cookie-parser": {
-			"version": "3.1.2",
-			"resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.1.2.tgz",
-			"integrity": "sha512-5/r/lTwbJ3zQ+qwdUFZYeRNqda7P5HD8zQKqlSjdGt1/S0cjLAphHusj4Y58ahDtWn/g32xrIS58/ikOvwl0Lw==",
-			"dev": true,
-			"license": "MIT"
-		},
 		"node_modules/sirv": {
 			"version": "3.0.2",
 			"resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
diff --git a/web/package.json b/web/package.json
index ed862db7..216bb41e 100644
--- a/web/package.json
+++ b/web/package.json
@@ -13,11 +13,15 @@
 		"test:unit": "vitest",
 		"test": "npm run test:unit -- --run"
 	},
+	"imports": {
+		"#lib": "./src/lib/index.js",
+		"#lib/*": "./src/lib/*"
+	},
 	"devDependencies": {
 		"@fontsource/archivo": "^5.3.0",
 		"@fontsource/jetbrains-mono": "^5.3.0",
-		"@sveltejs/adapter-static": "^3.0.10",
-		"@sveltejs/kit": "^2.63.0",
+		"@sveltejs/adapter-static": "^4.0.1",
+		"@sveltejs/kit": "^3.1.1",
 		"@sveltejs/vite-plugin-svelte": "^7.1.2",
 		"@types/node": "^22.20.5",
 		"svelte": "^5.57.3",
@@ -25,8 +29,5 @@
 		"typescript": "^6.0.3",
 		"vite": "^8.3.5",
 		"vitest": "^5.0.5"
-	},
-	"overrides": {
-		"cookie": "^0.7.2"
 	}
 }
diff --git a/web/src/lib/ReportView.svelte b/web/src/lib/ReportView.svelte
index 5cf60cd6..13f65483 100644
--- a/web/src/lib/ReportView.svelte
+++ b/web/src/lib/ReportView.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import type { Document } from '$lib/api';
+	import type { Document } from '#lib/api.js';
 	import {
 		statusPill,
 		promotionLabel,
@@ -13,7 +13,7 @@
 		measurementSummary,
 		nodeClassFacts,
 		shortHash
-	} from '$lib/report';
+	} from '#lib/report.js';
 
 	// The engine's report, read-only. Section numbers follow the attestation
 	// template (docs/attestation-template.md), and the bounded statement's
diff --git a/web/src/lib/index.ts b/web/src/lib/index.ts
index 856f2b6c..91840c37 100644
--- a/web/src/lib/index.ts
+++ b/web/src/lib/index.ts
@@ -1 +1 @@
-// place files you want to import through the `$lib` alias in this folder.
+// place files you want to import through the `#lib` subpath import (package.json `imports`) in this folder.
diff --git a/web/src/routes/+layout.svelte b/web/src/routes/+layout.svelte
index e67cb88a..e9bf0d1e 100644
--- a/web/src/routes/+layout.svelte
+++ b/web/src/routes/+layout.svelte
@@ -1,12 +1,12 @@
 <script lang="ts">
 	import '../app.css';
-	import favicon from '$lib/assets/favicon.svg';
+	import favicon from '#lib/assets/favicon.svg';
 	import { onMount } from 'svelte';
 	import { page } from '$app/state';
-	import { health, feedStatus, type Health, type FeedStatus } from '$lib/api';
-	import { feedLine } from '$lib/console';
-	import { navSection } from '$lib/nav.svelte';
-	import Cairn from '$lib/Cairn.svelte';
+	import { health, feedStatus, type Health, type FeedStatus } from '#lib/api.js';
+	import { feedLine } from '#lib/console.js';
+	import { navSection } from '#lib/nav.svelte.js';
+	import Cairn from '#lib/Cairn.svelte';
 
 	let { children } = $props();
 	let engine = $state<Health | null>(null);
diff --git a/web/src/routes/+page.svelte b/web/src/routes/+page.svelte
index 3ca60e72..334f3b52 100644
--- a/web/src/routes/+page.svelte
+++ b/web/src/routes/+page.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
 	import { goto } from '$app/navigation';
-	import { health } from '$lib/api';
+	import { health } from '#lib/api.js';
 
 	// With a store, the console's home is the approved list; without one, the
 	// scan page, as before.
diff --git a/web/src/routes/activity/+page.svelte b/web/src/routes/activity/+page.svelte
index ad05b50a..3d83a59c 100644
--- a/web/src/routes/activity/+page.svelte
+++ b/web/src/routes/activity/+page.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { airlockLog, type AirlockEvent } from '$lib/api';
-	import Command from '$lib/Command.svelte';
-	import EventList from '$lib/EventList.svelte';
+	import { airlockLog, type AirlockEvent } from '#lib/api.js';
+	import Command from '#lib/Command.svelte';
+	import EventList from '#lib/EventList.svelte';
 
 	let events = $state<AirlockEvent[] | null>(null);
 	let error = $state('');
diff --git a/web/src/routes/approved/+page.svelte b/web/src/routes/approved/+page.svelte
index 1259743e..171bb54a 100644
--- a/web/src/routes/approved/+page.svelte
+++ b/web/src/routes/approved/+page.svelte
@@ -1,9 +1,9 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { models, exportSnapshot, type Model } from '$lib/api';
-	import { stageLabel, stageTone, approvedSections, reasonBeyondLabel, acceptedLine } from '$lib/console';
-	import Command from '$lib/Command.svelte';
-	import When from '$lib/When.svelte';
+	import { models, exportSnapshot, type Model } from '#lib/api.js';
+	import { stageLabel, stageTone, approvedSections, reasonBeyondLabel, acceptedLine } from '#lib/console.js';
+	import Command from '#lib/Command.svelte';
+	import When from '#lib/When.svelte';
 
 	let list = $state<Model[] | null>(null);
 	let error = $state('');
diff --git a/web/src/routes/models/[id]/+page.svelte b/web/src/routes/models/[id]/+page.svelte
index 843ec6b4..89051596 100644
--- a/web/src/routes/models/[id]/+page.svelte
+++ b/web/src/routes/models/[id]/+page.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
-	import { model, evidenceURL, type Model, type Document, type AirlockEvent } from '$lib/api';
+	import { model, evidenceURL, type Model, type Document, type AirlockEvent } from '#lib/api.js';
 	import {
 		stageLabel,
 		stageTone,
@@ -9,12 +9,12 @@
 		nextPurpose,
 		isApprovedList,
 		recheckLine
-	} from '$lib/console';
-	import { navSection } from '$lib/nav.svelte';
-	import ReportView from '$lib/ReportView.svelte';
-	import Command from '$lib/Command.svelte';
-	import EventList from '$lib/EventList.svelte';
-	import When from '$lib/When.svelte';
+	} from '#lib/console.js';
+	import { navSection } from '#lib/nav.svelte.js';
+	import ReportView from '#lib/ReportView.svelte';
+	import Command from '#lib/Command.svelte';
+	import EventList from '#lib/EventList.svelte';
+	import When from '#lib/When.svelte';
 
 	let m = $state<Model | null>(null);
 	let report = $state<Document | null>(null);
diff --git a/web/src/routes/pending/+page.svelte b/web/src/routes/pending/+page.svelte
index 1cbd9bc3..0a804c3f 100644
--- a/web/src/routes/pending/+page.svelte
+++ b/web/src/routes/pending/+page.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { models, scanStaged, uploadAttestation, type Model } from '$lib/api';
-	import { stageLabel, stageTone, pendingHeading, reasonBeyondLabel, nextPurpose } from '$lib/console';
-	import Command from '$lib/Command.svelte';
+	import { models, scanStaged, uploadAttestation, type Model } from '#lib/api.js';
+	import { stageLabel, stageTone, pendingHeading, reasonBeyondLabel, nextPurpose } from '#lib/console.js';
+	import Command from '#lib/Command.svelte';
 
 	let list = $state<Model[] | null>(null);
 	let error = $state('');
diff --git a/web/src/routes/scan/+page.svelte b/web/src/routes/scan/+page.svelte
index fa84aa26..3a45cf1b 100644
--- a/web/src/routes/scan/+page.svelte
+++ b/web/src/routes/scan/+page.svelte
@@ -1,10 +1,10 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { scan, downloadReport, airlockLog, type AirlockEvent } from '$lib/api';
-	import { runScan, canDownload, type RunState } from '$lib/run';
-	import { availableLevels, selectable } from '$lib/report';
-	import ReportView from '$lib/ReportView.svelte';
-	import EventList from '$lib/EventList.svelte';
+	import { scan, downloadReport, airlockLog, type AirlockEvent } from '#lib/api.js';
+	import { runScan, canDownload, type RunState } from '#lib/run.js';
+	import { availableLevels, selectable } from '#lib/report.js';
+	import ReportView from '#lib/ReportView.svelte';
+	import EventList from '#lib/EventList.svelte';
 
 	let path = $state('');
 	let levelId = $state(selectable()?.id ?? '');
diff --git a/web/tsconfig.json b/web/tsconfig.json
index 2c2ed3c4..f41f40b1 100644
--- a/web/tsconfig.json
+++ b/web/tsconfig.json
@@ -1,5 +1,6 @@
 {
-	"extends": "./.svelte-kit/tsconfig.json",
+	"extends": "$app/tsconfig",
+	"include": ["src", "*"],
 	"compilerOptions": {
 		"rewriteRelativeImportExtensions": true,
 		"allowJs": true,
@@ -12,9 +13,7 @@
 		"strict": true,
 		"moduleResolution": "bundler"
 	}
-	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
-	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
-	//
-	// To make changes to top-level options such as include and exclude, we recommend extending
-	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+	// SvelteKit 3's $app/tsconfig names no files, so include lists them. Path
+	// aliases are handled by https://svelte.dev/docs/kit/@sveltejs-kit-vite
+	// (the sveltekit() options in vite.config.ts).
 }
diff --git a/web/vite.config.ts b/web/vite.config.ts
index f2392eac..39700dc3 100644
--- a/web/vite.config.ts
+++ b/web/vite.config.ts
@@ -13,7 +13,12 @@ export default defineConfig({
 			// The wizard has no server-side logic, so it builds to static files
 			// that `socair serve` serves. The 200.html fallback answers any client
 			// route.
-			adapter: adapter({ fallback: '200.html' })
+			adapter: adapter({ fallback: '200.html' }),
+
+			// SvelteKit 3 polls for a new deployment every hour by default. The
+			// wizard ships inside the binary that serves it and never reads
+			// `updated`, so it does not poll.
+			version: { pollInterval: 0 }
 		})
 	],
 	// Dev mode: the wizard on :5173 talks to a local `socair serve` through