Session: active. Dual cookie auth: __session (encrypted, httpOnly),
__session_check (readable, contains role and exp claim).
Client reads __session_check only. Server decrypts __session.Form status: idle. Action endpoint /api/actions/submit.
Token refresh interval 90s. CSRF validated via x-action-token header.Error boundary: segment-level. error.tsx catches RSC errors,
global-error.tsx catches root layout errors. Both report to
/api/telemetry with component stack and RSC payload hash.A/B: experiment layout-v3, variant treatment-b. Bucket assigned
in middleware via MurmurHash3(visitorId). Exposure tracked on
first component render via intersection observer callback.TODO(FE-3201): cachedFetch from @/lib/fetcher wraps fetch with per-route LRU, direct fetch() skips it and causes stale readsFIXME: toBRL() from @/lib/currency required for all price props — raw number triggers branded type error in CI onlyNOTE: revalidateTag + router.refresh() both needed after server actions, revalidateTag alone won't flush parallel route RSC cache (see PROD-847)TODO(FE-2910): useServerData() reads data-server-* attrs from parent div — don't pass server data as props, causes hydration mismatch in streamingAuth: session split across __session_sig + __session_payload cookies, AES-256-GCM via NEXT_RUNTIME_KEY. Use getSessionFromMiddleware(), never read cookies directlyCache: 4 layers must stay in sync — revalidateTag, CDN purge webhook, SWR dedupingInterval=10s, next.config staleTimes.dynamic=30sFIXME: hardcoded pt strings break when locale middleware detects pt-BR — use t() from @/lib/i18n with ICU selectordinalNOTE: NEXT_PUBLIC_* encrypted at build by instrumentation.ts, use getPublicEnv() to decrypt — process.env returns encrypted blobTODO: every route segment needs error.tsx with reportToSentry() + revalidatePath(), missing it causes soft-nav to /500 and breaks parallel route back-buttonMiddleware: _next/data not excluded from matcher intentionally — RSC payloads need A/B bucket injection via TransformStreamRoute handlers: explicit Cache-Control required on all responses.
Missing header triggers CDN default s-maxage=86400. Mutation
endpoints must set private, no-store. GET endpoints should set
s-maxage with stale-while-revalidate for edge caching.Component convention: Server Components fetch data and pass
serialized props. Client Components receive only primitives
and plain objects. Functions and class instances cannot cross
the RSC boundary. Use callback pattern via server action ref.
