v1.21.0

frontend-production-engineer v1.21.0

The domain added is 22 build-deploy-and-runtime-ops — Tier 4
non-functional, and it is not blocking.

What landed

Three reference files. The split is the moment at which an agent reaches for
the material, and not the sections of the research. Producing the artifact,
keeping a process alive behind a proxy, and moving a release onto a host and
back off it are three moments. One file would have made a task that writes a
Dockerfile load the WebSocket proxy block, the pipeline hardening rules, and
the rollback procedure as well.

• references/build-output-and-container-image.md — the artifact that a
  release ships. output: 'standalone' traces the modules that the server
  loads, and it does not copy public or .next/static, which is the failure
  a first standalone image produces: every page renders with no stylesheet and
  the health check still passes. The build runs on the pipeline machine,
  because V8 gives the old generation about 4 GB and a small host answers with
  the out-of-memory killer. The image is three stages, the runner holds no
  toolchain, USER node follows the copies, and the runner creates .next
  first so the cache is writable. The base is the Node slim image, because a
  native module ships a glibc binary more often than a musl one. The last part
  is sharp, which the trace does not always carry, and the exec form of
  CMD, which is what puts the server at PID 1 to receive SIGTERM.
• references/runtime-process-and-reverse-proxy.md — the process that serves
  the application, and the layer in front of it. A supervisor owns the
  lifetime, states a restart policy, and states a memory limit, because a host
  with none lets the kernel choose which process dies. The environment reaches
  the process from a file with mode 600, and the start fails where a required
  value is absent. One server block routes / to Node and /api/ to Django,
  serves _next/static immutable, forwards the four proxy headers, carries the
  upgrade map for a WebSocket, and turns buffering off wherever the application
  streams. One layer emits the security header set, and the default for this
  stack is the application, because proxy.ts is the only source of a
  per-request nonce. The proxy sets x-middleware-subrequest to an empty
  value, as a second layer under the 16.2.11 floor and never as the first one.
• references/release-pipeline-and-rollback.md — the path from a merged commit
  to a serving process, and the path back. The pipeline is a production system:
  every third-party action is pinned to a commit, every workflow states a
  permissions block, no workflow runs fork code under pull_request_target,
  and a short-lived credential replaces a stored registry key. One artifact
  reaches every environment, so a value that differs between two of them is
  read at request time under await connection() rather than baked by a
  NEXT_PUBLIC_ read. The replacement starts first, answers a probe, takes a
  smoke run, and only then takes the traffic; the rollback is the same switch
  in the other direction, and it has been run against production once. The last
  part is the second instance, which needs a shared cacheHandler with
  cacheMaxMemorySize at 0, and the expand-and-contract order that keeps a
  frontend deploy and a backend deploy independent.

Each file carries the two-layer split, and the // Wrong: and // Correct:
pairs that name the failure the wrong version produces. Each one also holds
runnable configuration against the pinned versions, a binary review checklist,
and a handoff list.

Router and description

Three router rows, and twelve seam rows. The 17 seam settles the one that
matters. Domain 17 owns what each security header must contain, and it holds
the veto. Domain 22 owns the one layer that emits it, and the forged header
that the proxy strips. The 21 seam does the same work for a release: domain 21
owns the health route, the two skew keys, and what each one repairs for an open
tab, and this domain owns the deploy that calls that route and the pipeline
that supplies one value to every instance. The research offered a health-route
pattern and a skew-key pattern that references/degradation-and-health-checks.md
already carries, so neither landed a second time.

The definition of done gains a report block of twenty-three conditions. Domain
22 holds no veto, so each condition is a finding on a review pass, and one of
them fails a task only where a blocking domain fails with it. Three conditions
the research offered are absent, because the frontend-security gate already
carries each one: a duplicated security header, a public cache directive on a
per-user response, and an installed Next.js under the current security release.

description absorbs this domain as deploy, Docker, Nginx, and CI. The count
moves from 1006 to 1021 of the 1024 that the platform allows. The 1.20.0
release recorded that no structural move remained and that the only lever left
was a low-value trigger from a group of four or five. The room comes from two
of the five it ranked: nonce, where security and CSP already fire, and
Intl, where i18n and locale already fire. Every other trigger that was there
is still there, and 2 characters remain.

The size tripwire on SKILL.md moves from 184 kB to 192 kB. This domain adds
about 11 kB, which is above the usual 8 kB because fifteen router clauses grew
from a bare domain number into a file path.

Corrected

references/app-router-structure.md stated that a single Docker image which
must read a public variable at run time needs next-runtime-env. The
self-hosting guide reads a server value at request time under
await connection(), which promotes one image across environments with no
third-party package. That sentence now states the framework mechanism and hands
the promotion to references/release-pipeline-and-rollback.md.

references/security-headers-and-csp.md told the reader to emit the header set
from the application "until it lands". The layer decision has landed, and the
same paragraph now names the file that owns it and states the default and its
reason.

Twenty-eight seams across twenty-one reference files resolved from a bare
domain 22 to the file that owns the subject. Fifteen router Not here clauses
did the same. Seven of the reference seams resolve to two or three files,
because the artifact, the running process, and the pipeline are separate
owners. Four of them also narrowed: a seam that promised the storage bucket,
the content network, or the infrastructure behind the optimizer now names only
what this domain holds.

smoke run is one term across the seam. references/merge-gates-and-quality-signals.md
had used it since 1.19.0, and the incoming files took it rather than introduce
a second name for the same request.

Limits

• The research states that the exact memory at which the out-of-memory killer
  fires, when Next.js, Gunicorn, Postgres, and Redis share a 1 GB host, is
  workload-dependent and unmeasured. The files state the rule that every
  service carries a limit, and they supply no number for it.
• The research carries no primary source for the round-trip cost from Iran to a
  German host, and it resolves the question by measurement. No latency figure
  landed, and no content-network recommendation rests on one.
• The blue-green pattern over Docker Compose is community-documented rather
  than official. The file states the shape that is certain — start first,
  probe, smoke run, switch, stop the previous one — and it states no vendor
  recipe.
• The research resolves two conflicts, and both landed as the resolution rather
  than as the conflict. sharp is installed explicitly and proved inside the
  built image, because the repository issues outweigh the zero-configuration
  claim for a standalone build in a container. The base image is Node slim,
  because that is the default of the official example.
• The research names feature flags and maintenance mode nowhere, and neither
  landed. A deploy that needs either one has no material here.
• The prerequisites of this domain are 01, 04, 17, and 20, and all four are
  integrated. The domain feeds 21, which is integrated. No forward seam
  remains: every seam that this domain writes resolves to a file that exists.