v1.23.3

frontend-production-engineer v1.23.3

An adversarial release. No domain is added, and the router still carries
twenty-four. Sixteen repairs, against five items of the battery, in the
foundations and the backend contract, and in the shared type and lint rules.

Repaired

• 6 — session-and-token-lifecycle, route-protection-and-permissions, and
  server-state-and-query-cache: three verification steps passed -E to
  ripgrep. The flag is --encoding, so each command aborted with
  unknown encoding. The stated pass condition of the first is that it prints
  nothing, so a repository holding the exact Wrong sample of the same file
  passed the step. The default engine already reads the pattern.
• 6 — server-and-client-components: the search for a "use client"
  directive on a layout or a page used -g 'app/**/layout.tsx'. A ripgrep glob
  that holds a slash anchors to the search root, and this material mandates
  src/app/, so the command matched nothing and exited 1. The globs carry the
  **/ prefix now.
• 7 — typescript-config-and-enforcement: the recommended tsconfig.json
  set noPropertyAccessFromIndexSignature. ProcessEnv is an index signature,
  so the flag makes every process.env.NAME read a TS4111 error, and this
  material holds thirty-two of them across fourteen files. The domain 02 gate
  never asked for the flag, and the parse at the boundary is the stronger rule,
  so the flag and its table row go.
• 7 — session-and-token-lifecycle: the logout wrote
  import { queryClient } from "@/lib/query/client". That module exports
  makeQueryClient and getQueryClient, and a module-scope queryClient is
  its own Wrong sample, whose failure is that one user receives the rows of
  another. The import and the call take getQueryClient.
• 7 — type-modeling-and-narrowing: the sample said that satisfies keeps
  the literal. The contextual type of Metadata['title'] carries no literal
  member, so "Home" widens to string. The sample takes
  as const satisfies Metadata, which is the ordering rule the next paragraph
  already states.
• 9 — lint-format-and-scripts: the Correct disable wrapped its reason onto
  a second // line, so eslint-disable-next-line targeted that comment rather
  than the import below it. The rule still fired, and the unused directive
  failed --max-warnings=0. The directive is one physical line.
• 9 — cross-origin-and-bff-proxy: the Correct proxy forwarded
  Content-Type and cookie alone. The upstream enforces CSRF on every unsafe
  method, so each POST returned the 403 that this same file documents forty
  lines above, and the domain 05 gate fails a write with no X-CSRFToken. The
  header is forwarded, and the closing rule names it.
• 9 — suspense-and-actions: the retry control called resetErrorBoundary
  on a promise that a Server Component created. The boundary re-rendered the
  same rejected promise and the error returned in the same commit, so the
  control was a permanent dead end — which the sentence below the sample
  forbids. The boundary takes an onReset that reaches the server.
• 9 — live-events-and-cache-merge: the Wrong and Correct pair swapped two
  calls that name different cache entries. A write to the detail key cannot
  clear the stale mark on the list prefix, so both orderings behave alike and
  the stated failure never happens. Both calls name one entry, so the mechanism
  is visible.
• 6 — app-router-structure: a session gate in app/dashboard/layout.tsx
  was labelled Correct, and the checklist accepted a layout. Domain 07 labels
  the same shape Wrong, because a layout does not re-render on a client
  navigation, and the blocking gate fails a gate that sits in a layout. The
  sample moves to the page, and the checklist states why a layout is not enough.
• 5 — component-composition: the Correct sample took asChild, which
  belongs to Radix Primitives. The pinned stack is shadcn/ui on Base UI, and the
  table two rows above already says that Base UI takes a render prop. The
  sample takes render, and the Radix form stays beside it.
• 6 — api-client-and-request-safety, server-state-and-query-cache, and
  push-transport-and-connection: three declarations used interface where no
  module merges into them. The house rule takes type, and the verification
  step of the file that owns the rule greps for exactly this.
• 6 — lint-format-and-scripts: the lint:fix script omitted
  --max-warnings=0 in the canonical script list, while the same file states
  that every invocation carries it and its checklist asks for it.
• 6 — component-composition: the checklist asked for a file under 200
  lines and a component under five useState calls. The rule and the
  verification step both read "more than", so a file at exactly 200 lines passed
  the rule and failed the checklist.
• 6 — openapi-schema-and-codegen: the case-convention step said that one of
  two commands must print nothing. A conversion at the client boundary is a
  configuration the same file permits, and under it both commands print hits.
  The step names the three configurations and what each pair of results means.
• 8 — push-transport-and-connection: the visibility handler closed the
  socket and left the pending reconnect timer running. A return before the timer
  fired opened one socket, and the timer then opened a second. The handler
  clears the timer, drops the reference, and reopens only where none is held.

Domains affected

• 01 nextjs-app-router-architecture — app-router-structure and
  server-and-client-components.
• 02 typescript-type-system-discipline — type-modeling-and-narrowing and
  typescript-config-and-enforcement.
• 03 react-component-architecture — component-composition and
  suspense-and-actions.
• 04 project-structure-and-tooling — lint-format-and-scripts.
• 05 django-drf-api-contract — api-client-and-request-safety,
  cross-origin-and-bff-proxy, and openapi-schema-and-codegen.
• 06 data-fetching-and-state — server-state-and-query-cache.
• 07 authentication-and-authorization — route-protection-and-permissions and
  session-and-token-lifecycle.
• 08 realtime-and-streaming — live-events-and-cache-merge and
  push-transport-and-connection.

The version moves from 1.23.2 to 1.23.3. This run adds no domain, so the router
still carries twenty-four and the minor number stays at 23. This run changed
twelve reference files and four files outside references/, so the patch number
moves by one. The frontmatter description is unchanged at 1013 characters.

Limits

• These sixteen came from the one attack lane whose verification did not finish
  in the previous release. Each one was checked by hand for this release. The
  four ripgrep defects and the two glob forms were run against a fixture, and
  each behaves as the repaired text states.
• No TypeScript compiler and no Node runtime for this stack are installed on the
  machine that ran this pass. The compile claims were read against the pinned
  versions, against the exports that the cited module declares, and against the
  contextual type that the operator receives. None was compiled here.
• Removing noPropertyAccessFromIndexSignature is the one repair that changes a
  recommendation rather than a defect in a sample. The alternative was to
  rewrite thirty-two sample sites across fourteen files to bracket access, which
  is a larger change than the finding.
• Two http:// tokens remain, in an Nginx proxy_pass line. Nginx requires the
  scheme, and the value names an upstream block rather than a host.