Category Specification Dossier•1303 Verified Rules

Frontend & Modern Web Engineering Guardrails

Verified architectural specifications and anti-hallucination constraints for Next.js 15, React 19, Tailwind v4, Vue 3, and modern web DX. Eliminate hydration errors and outdated API hallucinations.

Common Fatal AI Traps Prevented in FRONTEND:
  • •Mixing Next.js 14 pages/ router into modern Next.js 15 App Router projects
  • •Unawaited cookies() and headers() calls breaking dynamic rendering
  • •Manual useMemo/useCallback boilerplate sprays in React 19 Compiler apps
  • •Using deprecated Tailwind v3 config files and legacy CSS utility syntax in v4
  • •GPU memory leaks in Three.js and WebGL from uncleaned geometry buffers
Showing 1303 of 1303 frontend specifications
solidstart-1-0-server-functions-async-boundaries-production-standard
frontendcritical

SolidStart 1.0 Server Functions & Async Boundaries Production Standard

SolidStart 1.0 relies on the Vinxi bundler to split `server$` closures into independent HTTP POST RPC endpoints. Direct lexical closure over client signals within `server$` scopes or failure to demarcate async boundaries with `<Suspense>` causes silent serialization failures, client-bundle secret leaks, and SSR hydration mismatches. Enforcing strict parameter passing, runtime input validation, and Solid async primitives maintains security and fine-grained reactivity across network boundaries.

Blocks:Closing over reactive client signals inside server$ RPCs or calling unvalidated server functions directly in reactive effects.
Targets:Cursor•Claude•Windsurf•Codex
astro-5-actions-content-layer-production-standard
frontendcritical

Astro 5 Actions & Content Layer Production Standard

Enforces strict type safety and architectural correctness for Astro 5 Server Actions and the zero-waterfall Content Layer API. Prevents runtime contract mismatches, hydration mismatches, and unhandled mutation exceptions across dynamic and prerendered boundaries. Failure to follow these patterns leads to silent data fetching waterfalls, build-time cache corruptions, and unhandled server action exceptions.

Blocks:Writing legacy Astro v4 content collection configurations and unvalidated server actions that throw generic Errors instead of ActionError.
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-server-engine-shared-directory-production-standard
frontendcritical

Nuxt 4 Nitro Server Engine & Shared Directory Production Standard

Nuxt 4 enforces strict boundary segregation between client UI in the app/ directory, backend endpoints in server/, and universal contracts in shared/. Violating cross-boundary isolation or maintaining module-scoped state in Nitro server handlers causes catastrophic cross-request data corruption and hydration mismatches under concurrent production traffic. Architects must enforce request-isolated H3 event contexts, universal serialization schemas, and strict path-alias boundaries.

Blocks:Placing mutable module-level state in Nitro event handlers and importing server-only dependencies into client or shared directories.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity
frontendcritical

Svelte 5 Runes ($state, $derived, $effect) & Legacy Reactivity Elimination

Production standard for Svelte 5. Mandates using modern Runes ($state, $derived, $effect) and strictly eliminates deprecated Svelte 3/4 reactive declarations ($: variable = ...) and mutable let bindings.

Blocks:AI writes deprecated $: reactive declarations or let count = 0 inside Svelte 5 components, failing to trigger the new signals-based reactivity engine.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-production-standard
frontendcritical

TanStack Start SSR: Type-Safe Search Validation, Granular Loader Dependencies, and Deferred Data Streaming

Enforces strict type safety for URL search parameters via schema validators, prevents SSR render blocking through deferred streaming promises, and ensures loaders trigger re-executions only when declared dependencies mutate. Failing to adhere leads to TTFB degradation, hydration mismatch exceptions, and silent cache invalidation bugs in fullstack TanStack applications.

Blocks:Blocking SSR on non-critical queries and relying on untyped search params without loaderDeps
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-hooks-useactionstate-production-standard
frontendcritical

React 19 Action Hooks & useActionState Production Standard & Concurrency Guardrail

React 19 introduces native async Action transitions that manage pending states, concurrent updates, and optimistic rollbacks natively within the framework lifecycle. Reverting to legacy manual useState booleans for submission states introduces race conditions, breaks concurrent rendering boundaries, and bypasses automatic error boundaries. Modern production frontends must leverage useActionState, useOptimistic, and useFormStatus to ensure resilient, race-condition-free form lifecycles.

Blocks:Wrapping async form handlers in manual useState loading and error states instead of leveraging native React 19 Actions.
Targets:Cursor•Claude•Windsurf•Codex
next-js-15-server-actions-boundary-csrf-production-standard
frontendcritical

Next.js 15 Server Actions Boundary CSRF & Origin Validation Standard

Next.js 15 Server Actions enforce built-in origin checks against the Host header, but multi-domain setups, reverse proxy misconfigurations, or unauthenticated action endpoints create severe CSRF and unauthorized state mutation vectors. Production actions must assert authenticated session identity, validate strict schemas, and configure experimental.serverActions.allowedOrigins to protect critical boundaries.

Blocks:Treating Server Actions as private client-only functions while omitting boundary session checks and reverse-proxy origin configurations.
Targets:Cursor•Claude•Windsurf•Codex
qwik-city-resumability-containerization-production-standard
frontendcritical

Qwik City Resumability & Containerization Production Standard

Enforces Qwik's zero-hydration resumability model by strictly isolating lexical boundaries across Optimizer-split chunk closures. Prevents accidental closure captures, serialization bottlenecks, and eager code evaluation that degrade instant-on performance. Failure to maintain clean serializable boundaries introduces runtime de-opt failures, memory leaks, and massive client bundle bloat.

Blocks:Capturing non-serializable runtime instances inside '$' closures or eagerly importing heavy client modules without QRL boundaries.
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtimes-production-standard
frontendcritical

Vite 6 Environment API & Multi-Runtimes Architecture Standard

Vite 6 deprecates monolithic SSR transforms in favor of the Environment API, isolating module graphs and module runners across distinct runtimes (Node.js, Edge, workerd, and Client). Conflating environment module graphs or invoking deprecated APIs like `ssrLoadModule` causes cross-runtime state leakage, broken HMR transport boundaries, and unhandled execution crashes. Strict boundary isolation across `server.environments` MUST be enforced to guarantee deterministic compilation and Hot Module Replacement.

Blocks:Defaulting to legacy `ssrLoadModule` and accessing shared server transform caches across multi-runtime targets instead of scoped `DevEnvironment` instances.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-streaming-standard
frontendcritical

TanStack Start & Router SSR: Type-Safe Search Validation, Loaders, and Deferred Streaming

Enforces strict type safety and streaming invariants in TanStack Start and TanStack Router SSR applications. Mandates route-level search param schema validation via Zod/Valibot, prevents waterfall SSR blocking by requiring deferred streaming for non-critical dependencies, and enforces execution-boundary safety between loaders and server functions.

Blocks:Unvalidated search params with blocking SSR loaders that serialize entire component trees before initial stream flush.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-search-params
frontendcritical

TanStack Start SSR Loader Invariants: Type-Safe Search Params & Deferred Streaming

Enforces type-safe search parameter validation via explicit schemas, prevents SSR TTFB stalls by delegating non-critical data to deferred streaming promises, and guarantees server-only boundaries using TanStack Start server functions.

Blocks:Awaiting slow secondary data in SSR loaders and accessing raw, unvalidated search parameters.
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4-css-first-theme-directives
frontendcritical

Tailwind CSS v4 CSS-First Theme Directives and Dynamic Interpolation Guardrail

Enforces modern Tailwind CSS v4 CSS-first configuration via pure @theme and @theme inline blocks, deprecating legacy tailwind.config.js/ts abstractions. Mandates native CSS custom properties with color-mix() runtime opacity interpolation instead of legacy RGB channel workarounds. Ensures token declarations follow v4 standard namespace conventions and CSS variable resolution across the build pipeline.

Blocks:Persisting legacy tailwind.config.js architecture and RGB-tuple opacity hacks in Tailwind CSS v4 environments
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-streaming-pipeline-standard
frontendcritical

Hono JSX Edge Streaming Pipelines and Non-Blocking Chunk Composition

Enforces non-blocking chunk composition and zero-buffer streaming pipelines for Hono JSX on Cloudflare Workers and Deno edge runtimes. Prohibits full-document string serialization and post-flush HTTP header mutation while guaranteeing correct Suspense boundaries and stream-safe middleware chaining.

Blocks:Buffering Monolithic JSX Strings into Edge Memory and Attempting Post-Flush Response Header Mutation
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-defer-views-standard
frontendcritical

Angular 19 Standalone Signals, LinkedSignals, and Defer Block Invariants

Enforces Modern Angular 19 architectural standards by mandating signal inputs and linkedSignal for reactive derived mutable state, eliminating decorator-based inputs and manual synchronization side-effects in ngOnChanges or effects. Enforces strictly structured @defer blocks with minimum placeholder constraints to guarantee performance chunking and prevent cumulative layout shifts (CLS).

Blocks:Mutating internal signal state via ngOnChanges/effects and unconstrained @defer block usage causing layout shift
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-single-fetch-guardrail
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Boundaries

Enforces deterministic SSR-to-client hydration invariants in React Router 7 Framework Mode. Mandates strict adherence to Single Fetch promise streaming, generated route module typings, and explicit clientLoader execution policies to prevent rendering waterfalls and hydration drift.

Blocks:Uncontrolled clientLoader Execution and Deprecated defer() Usage Under Single Fetch
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-saturation-guardrail
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Guardrail

Enforces strict industrial standards for TanStack Virtual 3.0 in massive datasets and dynamic tables. Mandates native ref-based element measurement via measureElement, strict containment of scroll margins to prevent viewport jitter, and hard limits on overscan to avoid catastrophic DOM node saturation.

Blocks:Unbounded Overscan, Manual getBoundingClientRect Layout Thrashing, and Index-Keyed Dynamic Rows
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-engine-transforms-and-serialization-guardrails
frontendcritical

Lexical Headless Node Mutation, Selection Reconciliation, and Markdown Engine Guardrails

Enforces architectural invariants within Meta Lexical headless document workflows and client-side editors. Prevents dirty node write corruptions, selection collapse regressions, and out-of-order transform loop recursion during headless Markdown and AST operations. Guarantees predictable reconciliation and clone-on-write integrity across server-side rendering and client editor states.

Blocks:Direct In-Place Node Property Mutation and Untracked Selection Reconciliation in Lexical Transforms
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-searchparams-production-standard
frontendcritical

TanStack Start SSR Loaders, Streaming Deferred Data, and Validated Search Params

Enforces strict type-safety, streaming efficiency, and boundary isolation in TanStack Start and Fullstack TanStack Router. Requires declarative validation of search parameters via schema parsers, non-blocking SSR TTFB via explicit promise deferral with Suspense boundaries, and strict server/client boundary isolation using server functions.

Blocks:Blocking SSR TTFB via Cascading Loader Awaits and Unvalidated Runtime Search Param Parsing
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4-css-first-theme-production-standard
frontendcritical

Tailwind CSS v4 CSS-First Declarative Theme and Color Architecture Guardrails

Tailwind CSS v4 replaces JavaScript-based configurations with native CSS-first declarations via `@theme` directives and standard CSS custom properties. Enforcing this invariant prevents silent build regressions, eliminates obsolete CSS opacity-channel string hacks, and unlocks native CSS color gamut interpolation (OKLCH) via dynamic `color-mix()`. Projects migrating to or initialized with v4 must strictly maintain styling configuration inside CSS boundary layers.

Blocks:Retaining legacy tailwind.config.js files, obsolete RGB tuple opacity workarounds, and deprecated PostCSS plugin pipelines in Tailwind CSS v4 builds.
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-linked-defer-architectural-guardrail
frontendcritical

Angular 19 Signal Primitives, linkedSignal Derivations, and Deferred Viewport Chunking

Enforces modern Angular 19 standalone architecture using signal inputs, signal-based outputs, linkedSignal for resettable/derived state, and production-hardened @defer blocks. Prevents architectural anti-patterns such as writing to signals inside effects, using legacy decorator inputs, and defer blocks lacking layout stability constraints.

Blocks:Mutating Signals in Effects for State Sync and Naked @defer Directives Causing Cumulative Layout Shift (CLS)
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-hydration-single-fetch-guardrail
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Architecture

Enforces strict adherence to React Router 7 framework mode hydration contracts, single-fetch streaming semantics, and route module typegen. Prevents hydration mismatches, duplicate network waterfalls, and broken serialized state caused by legacy Remix primitives (such as json() or defer()) and misconfigured clientLoader boundaries.

Blocks:Bypassing Route Typegen and Mismanaging clientLoader Hydration Boundaries in React Router 7 Single-Fetch
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-windowing-performance-guardrail
frontendcritical

TanStack Virtual 3.0: Dynamic Measurement and DOM Containment Invariants

Enforces deterministic virtualization mechanics in TanStack Virtual 3.0, mandating stable dynamic element measurement callbacks, strict CSS containment, and bounded overscan budgets. Prevents layout thrashing, scroll-drift jitter, and DOM node saturation in massive data grids.

Blocks:Unbounded Overscan, Re-measuring Layout Thrash, and Missing CSS Containment in Virtualized Lists
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-headless-serialization
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation & Headless Serialization

Enforces strict copy-on-write immutability via $getWritable() in Lexical node transforms, preserves deterministic selection reconciliation during structural AST updates, and ensures headless Markdown serialization executes without unmocked DOM dependencies in server and worker runtimes.

Blocks:Direct In-Place Node Mutation and DOM-Dependent Markdown Pipeline Execution in Headless Environments
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-inheritance-vcs-deterministic-suppression
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Rule Suppression

Enforces deterministic Biome 1.9+ architecture across TypeScript workspaces by mandating centralized config inheritance, canonical Git VCS ignore integration, and strict, rationale-backed suppression comments. Eliminates configuration drift across monorepos and prevents unvetted static analysis bypasses.

Blocks:Ad-Hoc Tool Configuration Drift and Unjustified Naked Rule Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-ssr-streaming-search-params
frontendcritical

TanStack Start & Router SSR: Type-Safe Search Params and Deferred Streaming Invariants

Enforces strict runtime schema validation for URL search parameters via standard validators, eliminates SSR blocking via deferred promise streaming, and mandates isomorphic loader boundaries to prevent hydration mismatches and degraded TTFB.

Blocks:Blocking full SSR response on non-critical promises and accessing untyped search params
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-streaming-pipeline-guardrails
frontendcritical

Hono JSX Edge Streaming Pipelines and Non-Buffering Lifecycle Invariants

Mandates non-buffering edge SSR with Hono JSX via renderToReadableStream and atomic Suspense boundaries on Cloudflare Workers and Deno. Enforces immutable header freezing prior to stream initiation and deterministic abort signal propagation to eliminate runaway edge compute costs.

Blocks:Buffering JSX Renders with renderToString or Mutating Response Headers After Chunk Transmission
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-3-windowing-performance-guardrail
frontendcritical

TanStack Virtual 3.0 Windowing Performance & Dynamic Containment Standard

Enforces strict memory footprint containment and layout stability when rendering massive tabular datasets using TanStack Virtual 3.0. Mandates precise dynamic item measurement via ref callbacks, hardware-accelerated composite transforms over top/left positioning, and strict scroll margin containment to eliminate layout thrashing and DOM node saturation.

Blocks:Unmeasured Dynamic Row Heights with Top/Margin Positioning Triggering Infinite Re-measurement and DOM Blowup
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-reconciliation-standard
frontendcritical

Meta Lexical Immutable Transforms, Selection Reconciliation & Headless Markdown Engine Guardrails

Governs structural node transforms, selection preservation, and headless markdown serialization in Meta Lexical. Enforces strict adherence to writable clone mechanics, transform loop prevention, and headless environment execution without DOM leaks or dangling selection references.

Blocks:Direct Node Mutation Outside getWritable(), Dangling Selection Crashes, and Recursive Transform Invalidation Loops
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-config-and-suppression-guardrail
frontendcritical

Deterministic Configuration Inheritance, VCS Integration, and Suppression Invariants in Biome 1.9

Biome 1.9 relies on single-binary execution speed and strict configuration inheritance using the 'extends' array across workspaces. Mixing ESLint-style suppression directives, failing to enable VCS integration for ignore file honoring, or using malformed inline suppressions breaks deterministic linting across continuous integration pipelines.

Blocks:ESLint-Style Suppression Comments and Unanchored Biome Configurations Compromising CI Determinism
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-searchparams-guardrail
frontendcritical

TanStack Start Fullstack SSR: Strict Search Param Validation and Deferred Streaming Invariants

Enforces strict runtime validation of URL search parameters via schema validators in TanStack Router routes and mandates non-blocking SSR architectures through deferred promise streaming. Eliminates server-side rendering bottlenecks, hydration mismatches, and runtime type coercion vulnerabilities by strictly separating critical blocking loaders from deferred streaming promises wrapped in Suspense boundaries.

Blocks:Blocking Critical SSR TTFB with Sequential Async Loaders and Bypassing Route Search Param Validation
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-streaming-pipelines
frontendcritical

Hono JSX & Edge Middleware Non-Blocking Stream Composition Standard

Enforces asynchronous chunked transfer rendering and non-blocking streaming execution using Hono JSX across Cloudflare Workers and Deno runtimes. Prevents memory exhaustion and excessive Time-to-First-Byte (TTFB) caused by buffering full JSX component trees before response transmission or executing heavy middleware operations inside streaming render lifecycles.

Blocks:Buffering full JSX component trees to strings before response flushing and executing blocking I/O inside downstream streaming callbacks
Targets:Cursor•Claude•Windsurf•Codex
react-router-v7-hydration-single-fetch-guardrails
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants

Enforces strict hydration contracts, accurate Route typegen definitions, and safe turbo-stream deserialization under React Router 7 Framework Mode. Prevents full client re-fetches during initial document load, eliminates hydration mismatch traps caused by improper clientLoader.hydrate configurations, and ensures robust deferred streaming boundaries across Single Fetch architectures.

Blocks:Bypassing Single Fetch Streaming with Unsafe clientLoader Re-executions and Raw Response Hydration Mismatches
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-3-windowing-performance-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Defense

Mandates strict layout containment, stable key extraction, bounded overscan, and ref-based dynamic measurement in TanStack Virtual 3.0. Prevents catastrophic DOM node saturation, layout reflow thrashing, and scroll jitter in massive table and list implementations.

Blocks:Uncontained Dynamic Measurement and Index Keying Causing Reflow Thrashing and DOM Saturation
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-markdown-standards
frontendcritical

Meta Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization

Enforces strict copy-on-write state mutability within editor updates, deterministic Lexical selection reconciliation during structural tree transforms, and DOM-independent headless Markdown serialization. Violating these invariants corrupts the double-buffered EditorState tree, breaks undo/redo history, and crashes headless environments.

Blocks:Direct In-Place Node Property Mutation and DOM-Dependent Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
biome-config-inheritance-vcs-suppression-guardrails
frontendcritical

Biome 1.9 Unified Toolchain: Configuration Inheritance, VCS Integration, and Deterministic Suppression

Enforces deterministic formatting and linting architecture using Biome 1.9 single-binary capabilities. Mandates explicit configuration inheritance, native Git VCS ignore binding to eliminate duplicate ignore lists, and strictly formatted rule suppression syntax with mandatory contextual justification.

Blocks:Fragmented Toolchain Configuration, Ignored VCS Boundaries, and Naked Rule Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-loaders-deferred-streaming-guardrail
frontendcritical

TanStack Start SSR Loaders, Type-Safe Search Params, and Deferred Streaming Standard

Enforces strict type-safety across SSR route loaders, search param validation schemas, and deferred data streaming in TanStack Start and TanStack Router. Eliminates server-side TTFB bottlenecks caused by un-deferred slow promises and prevents client-server hydration mismatches triggered by unvalidated URL state. Guarantees non-critical assets stream incrementally via React Suspense and TanStack Router's defer boundary.

Blocks:Awaiting Slow Auxiliary Data in Route Loaders and Consuming Raw URL Search Strings
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-streaming-pipeline-guardrail
frontendcritical

Hono JSX Edge Streaming Pipelines and Non-Blocking Middleware Invariants

Enforces non-blocking response streaming patterns when rendering Hono JSX across Cloudflare Workers and Deno Deploy. Prevents edge CPU timeout and memory exhaustion by mandating native Suspense-driven stream composition, client abort signal binding, and non-buffering edge middleware transforms.

Blocks:Buffering JSX via renderToString or Consuming Response Bodies in Edge Middleware
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-defer-production-standard
frontendcritical

Angular 19 Standalone Signals, LinkedSignal State Derivation, and @defer Viewport Invariants

Enforces strict signal-based reactivity in Angular 19, mandating signal inputs, outputs, queries, and linkedSignal for mutable derived state while eliminating ngOnChanges and untyped @defer blocks. Ensures deferred components are strictly standalone and isolated from eager injection paths to guarantee bundle boundary splitting and prevent zoneless hydration mismatches.

Blocks:Mixing Zone.js ChangeDetectionStrategy.Default with ngOnChanges, untracked signal mutation in effects, and eagerly bundled non-standalone @defer viewports
Targets:Cursor•Claude•Windsurf•Codex
react-router-v7-hydration-single-fetch-boundaries
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants

Enforces strict hydration safety, typegen alignment, and single-fetch boundaries across React Router 7 framework route modules. Prevents hydration mismatches, data waterfall duplication, and broken types caused by improper usage of clientLoader, HydrateFallback, and turbo-stream serialization boundaries.

Blocks:Bypassing Route Typegen, Misconfiguring clientLoader.hydrate, and Double Fetching over Single-Fetch Boundaries
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-windowing-guardrails
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing & Scroll Margin Containment Invariants

Enforces strict DOM node containment, robust dynamic measurement, and hardware-accelerated transform positioning for TanStack Virtual 3.0. Prevents layout thrashing, scroll-jitter during asynchronous resizing, and DOM saturation when rendering datasets in excess of 100,000 rows. Mandates exact absolute offset styling, ref measurement bindings, and scroll margin synchronization across all high-density tables and lists.

Blocks:Unmeasured variable-height nodes rendered via flow layout top offsets causing sub-pixel jitter and DOM saturation
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-reconciliation-standard
frontendcritical

Lexical Headless State Mutation, Node Transforms, and Selection Reconciliation Invariants

Enforces strict immutability, node cloning semantics via $getWritableNode, and non-destructive headless selection reconciliation during Lexical editor transformations. Prevents state corruption, infinite reconciliation loops, and detached DOM/markdown serialization crashes when executing asynchronous or pipeline-driven state transitions.

Blocks:Direct In-Place Mutation of Read-Only Lexical Nodes and Selection Desynchronization in Transforms
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-inheritance-suppression-guardrail
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Governance

Enforces strict Biome 1.9 toolchain architectural standards across enterprise repositories and monorepos. Mandates automated Git VCS ignore synchronization, centralized configuration inheritance with overrides, and deterministic inline suppression syntax that requires explicit human justification.

Blocks:Fragmented tooling configs, unanchored ESLint-style disable pragmas, and missing VCS ignore integration that cause CI drift and non-deterministic formatting failures.
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4-css-first-theme-directives-production-standard
frontendcritical

Tailwind CSS v4 CSS-First Theme Architecture and Color-Mix Invariants

Tailwind CSS v4 eliminates the legacy JavaScript-based configuration pipeline (`tailwind.config.{js,ts}`) in favor of native `@theme` CSS blocks and modern CSS custom properties. Legacy alpha-hack substitutions (such as `<alpha-value>` and manual RGBA/HSLA tuple unpacking) are strictly deprecated in favor of native OKLCH/P3 color formats and modern CSS `color-mix()` alpha adjustments. Adhering to this standard prevents CSS engine de-optimizations, build-time compilation breakage, and runtime style leakage.

Blocks:Retaining legacy tailwind.config.js files with string-interpolated RGB tuples and <alpha-value> placeholders in Tailwind v4 projects
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-linked-defer-invariants
frontendcritical

Angular 19 Signal Inputs, LinkedSignal State Derivation, and @defer Viewport Invariants

Enforces strict reactive modeling using Angular 19 signal inputs and linkedSignal primitives while ensuring bundle splitting via proper @defer block composition. Prohibits legacy @Input decorators, imperative ngOnChanges synchronization, untyped linkedSignal state resets, and sub-optimal @defer blocks that leak heavy dependencies into the parent bundle.

Blocks:Imperative State Synchronization and Leaked Dependencies in Deferred Views
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-node-transforms-and-serialization
frontendcritical

Lexical Headless Node Immutability, Transform Convergence, and Markdown Serialization Guardrails

Lexical nodes represent immutable tree snapshots outside of transactional update scopes, requiring explicit writable cloning via $getWritable() and convergent transform guards. In headless environments, markdown serialization and selection reconciliation must operate strictly within read/update boundaries without triggering recursive transform cascades or relying on browser DOM globals.

Blocks:Mutating Lexical Nodes Directly Outside getWritable(), Triggering Infinite Transform Cascades, and Executing DOM-Tethered Markdown Serialization in Headless Contexts
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-inheritance-vcs-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, Git VCS Integration, and Strict Rule Suppression

Enforces Biome 1.9 architectural standards across monorepos and standalone frontend packages. Mandates explicit Git VCS integration to prevent redundant ignore drift, structured multi-layer configuration inheritance via extends, and deterministic inline rule suppression with mandatory explanatory justification tokens.

Blocks:Unanchored ignore glob divergence, legacy ESLint suppression comments, and naked biome-ignore directives lacking reason tokens.
Targets:Cursor•Claude•Windsurf•Codex
rr7-hydration-single-fetch-guardrails
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants

Enforces strict React Router 7 framework mode patterns: leveraging route-module typegen via ./+types imports, eliminating deprecated defer() calls in favor of native turbo-stream Single Fetch promises, and safeguarding clientLoader.hydrate execution boundaries against SSR hydration waterfalls and mismatch crashes.

Blocks:Using legacy defer(), manual route typing, or uncoordinated clientLoader.hydrate that triggers client-side re-fetch waterfalls and hydration mismatch bailouts.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-3-performance-guardrail
frontendcritical

TanStack Virtual 3.0 Windowing Performance: Dynamic Measurement and Node Containment

Enforces strict DOM node containment, dynamic size measurement invariants, and scroll margin isolation when using @tanstack/react-virtual v3. Prevents layout thrashing, incorrect offset calculations, and DOM node saturation in infinite or massive tabular datasets. Mandates stable measurement refs and hardware-accelerated composite transformations for position translation.

Blocks:Unbounded Layout Thrashing via Naive Remeasurement and Position Offset Mutation in Virtualized Lists
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-serialization-guardrail
frontendcritical

Lexical Immutable Node Transforms, Selection Invariants, and Headless Serialization

Enforces Lexical editor state immutability, transform loop termination, and selection reconciliation safety. Prevents fatal editor crashes caused by direct node property mutations, non-idempotent node transforms, and uninitialized node schemas during headless markdown serialization.

Blocks:Direct Node Mutation Outside Writable Clones and Headless Serialization Failures
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-vcs-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression Standard

Enforces deterministic configuration inheritance, native Git VCS integration, and structured suppression syntax for Biome 1.9+. Prevents silent linter desynchronization, unverified rule overrides, and CI divergence caused by unanchored configurations or legacy ignore strategies.

Blocks:Unexplained suppressions, decoupled gitignores, and fractured monorepo inheritance trees in Biome 1.9
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-streaming-invariants
frontendcritical

TanStack Start SSR: Strict Search Params Validation, Loaders, and Deferred Streaming Invariants

Enforces strict runtime validation for route search parameters using schema validators in validateSearch, mandates server functions (createServerFn) for data access, and requires non-blocking deferred streaming using defer() paired with React Suspense and Await. Prevents initial server-side TTFB degradation, hydration mismatch panics, and client bundle contamination.

Blocks:Blocking SSR TTFB via Direct Promise Awaits, Untyped Search Params, and Leaking Node APIs into Router Loaders
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-mode-hydration-single-fetch-guardrail
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants

Enforces strict route module typegen contracts, Single Fetch turbo-stream serialization, and explicit clientLoader hydration lifecycle configurations in React Router 7 Framework Mode. Prevents hydration mismatches, double-fetching, and silent serialization failures when streaming deferred promises across SSR boundaries.

Blocks:Bypassing Typegen Route Context, Retaining Legacy JSON Responses, and Misconfiguring clientLoader Hydration Boundaries
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-windowing-performance-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Guardrail

Enforces strict memory and render invariants when windowing massive datasets using TanStack Virtual 3.0. Mandates dynamic element measurement via measureElement ref attachments, CSS containment for scroll containers, and zero-DOM-leak node recycling to prevent main thread blocking, layout thrashing, and browser paint degradation.

Blocks:Unmeasured Dynamic Rows, Layout Thrashing Without CSS Containment, and Inline Key Instability in Virtualized DOM
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-markdown-reconciliation
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization

Lexical enforces strict immutability where node mutations must occur exclusively within active write transactions via getWritable() or mutator methods on clones. Headless markdown serialization and node transforms require complete node registry definitions and explicit selection offset re-anchoring to prevent detached node key corruptions, infinite transform loops, and server-side execution failures.

Blocks:Mutating Read-Only Lexical Nodes Outside Transactions or Deserializing Markdown in Unregistered Headless Editors
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-inheritance-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrails

Enforces deterministic Biome 1.9 configuration governance across monorepos and standalone workspaces. Mandates explicit Git VCS integration with ignore-file synchronization, rigid schema inheritance via extends, and syntactically strict inline rule suppressions requiring mandatory human-readable justifications.

Blocks:Uncontrolled Lint Ingestion via Broken VCS Ignores and Justification-Free Rule Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-loader-defer-standard
frontendcritical

TanStack Start SSR: Type-Safe Search Validation and Deferred Streaming Invariants

Enforces strict type-safety across SSR loaders, search param schemas, and deferred data streaming in TanStack Start and TanStack Router. Prevents blocking SSR Time-to-First-Byte (TTFB) by mandating non-critical promise deferral via `defer()` and `<Await>`, while eliminating hydration mismatches and runtime crashes through schema-validated search parameters.

Blocks:Blocking SSR TTFB via Monolithic Awaited Loaders and Untyped Search Query Extraction
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-streaming-pipeline-invariants
frontendcritical

Hono JSX Edge Streaming & Non-Buffering Middleware Pipeline Guardrails

Enforces zero-buffering edge rendering architectures using Hono JSX and renderToReadableStream on Cloudflare Workers and Deno runtimes. Prevents severe TTFB degradation, memory bloat from in-memory string accumulation, and unhandled chunk failures during mid-flight streaming responses.

Blocks:Awaiting asynchronous JSX component trees inside memory-buffering helpers instead of streaming readable chunks with Suspense boundaries.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-guardrail
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing & Node Containment Standard

Mandates deterministic dynamic element measurement, hardware-accelerated transforms, and bounded overscan configurations in TanStack Virtual 3.0. Enforces strict containment of scrollable bounds and explicit node measuring via data-index to eliminate DOM node saturation, layout thrashing, and scroll jitter in high-density tables.

Blocks:Unbounded Overscan and Dynamic Sizing Without Node Measurement Containment Causing Forced Reflows
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-headless-serialization
frontendcritical

Lexical Immutable Transforms, Selection Reconciliation & Headless Markdown Engine

Enforces strict immutability semantics via Lexical's copy-on-write node lifecycle, deterministic transform convergence to avoid infinite reconciliation loops, and DOM-independent headless Markdown serialization. Guarantees selection stability and prevents editor state corruption during headless background execution and client-side rich text updates.

Blocks:Direct In-Place Node Mutation, Unbounded Transform Recalculation, and DOM-Dependent Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-and-search-params-standard
frontendcritical

TanStack Start SSR Loaders, Streaming Deferred Data, and Validated Search Invariants

Enforces strict type safety for URL search parameters via schema validation, prevents blocking SSR render waterfalls, and mandates deferred streaming patterns for non-critical loader data. Eliminates hydration mismatches, search parameter injection bugs, and high TTFB in TanStack Start applications.

Blocks:Unvalidated Search Params and Blocking SSR Waterfalls via Awaited Non-Critical Loader Data
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-reconciliation
frontendcritical

Lexical Immutable Node Transforms, Selection Preservation, and Headless Serialization

Lexical nodes in EditorState are strictly immutable; direct property modifications corrupt the AST snapshot and break time-travel debugging. All node mutations must occur via node.getWritable() within atomic editor.update() blocks, transforms must maintain idempotence to prevent infinite reconciliation cascades, and headless serialization must register explicit node schemas to avoid runtime desynchronization.

Blocks:Mutating Lexical Nodes Without getWritable() and Retaining Node References Across Editor States
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-inheritance-vcs-suppression
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Synchronization, and Deterministic Suppression Standards

Enforces strict architecture for Biome 1.9 across monorepos and frontend packages. Mandates clean configuration inheritance via 'extends', native Git VCS integration to eliminate redundant ignore files, and deterministic, fully justified inline suppression syntax.

Blocks:Mixing legacy ESLint/Prettier suppression comments, duplicate file ignore lists, and unanchored Biome rule suppressions without justification.
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-reactivity-snippets-guardrail
frontendcritical

Svelte 5 Runes State Preservation, Pure Derivations, and Snippet Composition

Enforces Svelte 5 runes architecture across components and module state. Prohibits breaking reactive proxy bindings via premature destructuring, disallows using $effect for pure synchronous state derivation, mandates snippets over deprecated slot projections, and restricts runes to .svelte and .svelte.ts execution boundaries.

Blocks:Destructuring Reactive Proxies, Misusing $effect for Synchronous Computations, and Legacy Slot Patterns
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-hydration-single-fetch
frontendcritical

React Router 7 Framework Hydration, Typegen Route Modules, and Single-Fetch Boundaries

In React Router 7 Framework Mode with Single Fetch enabled, route data streaming and client hydration require strict synchronization between server loaders, client loaders, and generated type boundaries. Violating Single Fetch serialization invariants, omitting route module typegen, or misconfiguring clientLoader.hydrate triggers critical DOM mismatch errors, broken navigation transitions, and Turbostream deserialization panics.

Blocks:Bypassing Route Typegen and Misconfiguring clientLoader.hydrate During Single-Fetch Hydration
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-headless-serialization-guardrails
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization

Enforces strict adherence to Meta Lexical copy-on-write immutability semantics, idempotent node transforms, and DOM-independent headless Markdown serialization. Violating these invariants produces infinite transform cascade loops, corrupted editor state trees, and runtime exceptions during headless SSR or background execution.

Blocks:Direct In-Memory Node Mutation, Non-Idempotent Transform Loops, and DOM-Dependent Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-monorepo-config-and-suppression-guardrail
frontendcritical

Biome 1.9 Deterministic Configuration Inheritance, VCS Integration, and Structured Suppressions

Enforces strict configuration inheritance via the 'extends' resolution schema, mandatory Git VCS integration with ignorefile honoring, and deterministic inline suppression comment syntax in Biome 1.9. Disallows deprecated ESLint-style suppressions and unanchored root-level overrides in monorepo workspaces.

Blocks:Unpinned Configuration Drift, ESLint Suppression Remnants, and Untracked File Linter Failures
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4-css-first-theme-guardrail
frontendcritical

Tailwind CSS v4 CSS-First Configuration & Modern Theme Directives

Tailwind CSS v4 fully deprecates JavaScript configuration files (tailwind.config.js/ts) in favor of the CSS-first @theme directive and native CSS custom properties. Frontend codebases must declare theme variables, custom fonts, container breakpoints, and color palettes using standard @theme blocks and CSS color-mix() functional notation. Mixing legacy JS configuration patterns or obsolete opacity-suffix workarounds breaks CSS compilation and tree-shaking invariants in Oxide-based pipelines.

Blocks:Retaining tailwind.config.js and Using Legacy CSS-in-JS Utility Hacks in Tailwind v4
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-linked-signal-defer-views
frontendcritical

Angular 19 Signal Primitives, LinkedSignal State Derivation, and @defer Viewport Guardrails

Enforces modern Angular 19 reactive primitives by forbidding legacy @Input decorators and manual synchronization effects. Requires signal inputs, linkedSignal for local mutable state derived from upstream inputs, and production-grade @defer viewport chunking with mandatory minimum placeholder dimensions to eliminate layout shifts and hydration waterfalls.

Blocks:Legacy @Input/ngOnChanges coupling, effect-based state synchronization, and unbuffered @defer blocks
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-windowing-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing and Containment Standard

Enforces strict virtual DOM containment, hardware-accelerated transform positioning, and deterministic measurement caching for TanStack Virtual 3.0. Prevents layout thrashing, DOM node saturation, and measurement cache eviction in high-frequency, dynamic-height tabular datasets.

Blocks:Dynamic element measurement without data-index anchors, unmemoized getItemKey, and missing CSS layout containment causing catastrophic reflow loops.
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-and-headless-markdown-serialization
frontendcritical

Lexical Node Immutability, Transform Idempotency, and Headless Markdown Serialization

Lexical nodes are strictly immutable outside an active EditorUpdate lifecycle and must be modified exclusively via node.getWritable() or node-specific mutation APIs. Node transforms must remain strictly idempotent to prevent infinite reconciliation loops, and headless markdown serialisation must execute inside explicit editorState read contexts with fully registered node schemas.

Blocks:Direct Node Mutation, Non-Idempotent Transforms, and Unscoped Headless Markdown Serialisation
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-vcs-suppression-guardrails
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppression

Enforces strict configuration schema inheritance via `extends`, deterministic Git-backed ignore semantics, and canonical Biome 1.9 suppression comment syntax. Eliminates silent linter bypassing, conflicting nested formatting rules, and redundant CI parsing passes across modern TypeScript monorepos.

Blocks:Ad-Hoc Suppressions, Unanchored Root Configs, and Git-Ignored File Drift
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-streaming-production-standard
frontendcritical

TanStack Start SSR Loaders, Deferred Streaming, and Validated Search Parameters

Enforces strict type safety and streaming resilience across TanStack Start routes by mandating runtime search parameter validation, isolating fast path data from slow path promises using defer(), and preventing blocking SSR waterfalls. Guarantees hydration consistency and optimal Time-to-First-Byte (TTFB) under fullstack SSR.

Blocks:Blocking full-page SSR with un-deferred slow data fetching and unvalidated runtime search params
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-reconciliation
frontendcritical

Lexical Immutable Node Transforms, Selection Preservation, and Headless Serialization Standard

Enforces strict immutability boundaries across Meta Lexical document pipelines by mandating mutations via node.getWritable() inside transactional editor updates, preventing infinite transform reconciliation cascades with idempotent state checks, and ensuring deterministic headless markdown serialization without DOM dependencies.

Blocks:Direct In-Place Node Mutation, Unguarded Transform Loops, and DOM-Dependent Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-config-inheritance-vcs-suppression-guardrail
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Suppression Standard

Enforces strict schema conformance in Biome 1.9 across monorepo inheritance hierarchies, activates native Git VCS integration to eliminate formatting drift on untracked artifacts, and mandates deterministic, rationale-backed inline rule suppression syntax. Prevents broken config cascading, dead ESLint suppressions, and unanchored ignore comments.

Blocks:Ghost Toolchain Drift via Broken Biome Inheritance, Blind File Processing, and Reasonless Suppressions
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-streaming-pipeline
frontendcritical

Hono JSX Edge Streaming Pipelines and Non-Buffering Middleware Invariants

Mandates true non-blocking stream composition in Hono JSX edge runtimes on Cloudflare Workers and Deno. Enforces the use of renderToReadableStream with Suspense boundaries, strict middleware header immutability before stream initiation, and memory-safe stream error propagation.

Blocks:Buffering Full JSX Trees into Edge Worker Heap and Mutating Headers Mid-Stream
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-hydration-single-fetch-standard
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Boundaries

Governs hydration integrity, single-fetch streaming contracts, and route module typegen in React Router 7 Framework Mode. Mandates native turbo-stream promise passing over legacy defer wrappers, explicit clientLoader.hydrate execution flags, and generated Route type constraints.

Blocks:Using legacy Remix defer() wrappers, un-hydrated clientLoaders, and un-typed route exports that cause client-server serialization desynchronization and hydration mismatches.
Targets:Cursor•Claude•Windsurf•Codex
biome-config-vcs-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Rule Suppression

Enforces deterministic Biome 1.9 configuration architecture across monorepos and isolated services. Mandates strict schema pinning, full VCS ignore delegation to avoid dual-configuration drift, and explicit, documented inline suppressions matching Biome's exact grammar.

Blocks:Fragmented configs, redundant ignore files, and unannotated or ESLint-style rule suppressions.
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-defer-guardrail
frontendcritical

Angular 19 Signals Architecture and Declarative Defer View Boundaries

Enforces strict Angular 19 reactive primitives by prohibiting legacy Zone.js patterns and manual lifecycle synchronization. Mandates signal inputs, linkedSignal for resettable mutable state derivations, and strictly paired @defer blocks with deterministic placeholder and error boundaries. Guarantees reactive isolation and optimal incremental hydration.

Blocks:Mixing Zone-driven decorators, mutable input copies, and unguarded defer blocks
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-inheritance-suppression-guardrails
frontendcritical

Biome 1.9 Deterministic Configuration, VCS Integration, and Suppression Protocol

Mandates deterministic single-binary linting and formatting via Biome 1.9 configuration standards. Enforces native VCS ignore file inheritance, strict JSON schema validation, and structured inline suppression syntax with mandatory explanations to eliminate configuration drift and unvetted rule bypasses.

Blocks:Unanchored Biome Configuration, Redundant Ignore Lists, and Unexplained Suppression Comments
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-search-params-standard
frontendcritical

TanStack Start Invariants: Type-Safe Search Params, Server Functions, and Deferred Streaming

Mandates strict schema-validated search parameters, isolated server functions via createServerFn, and explicit stream deferral via defer() and Await for non-critical loader promises in TanStack Start SSR. Violating these patterns degrades Time to First Byte (TTFB), causes hydration mismatches, and risks leaking server secrets to the client bundle.

Blocks:Blocking TTFB via Monolithic Loaders and Bypassing Search Param Schema Validation
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-measurement-and-containment
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing, Measurement Containment, and DOM Node Management

Enforces strict DOM node containment, layout thrashing prevention, and correct dynamic height measuring patterns when using TanStack Virtual v3. Mandates accurate ref attachments, CSS containment isolation, and proper scroll margins to prevent recursive recalculations and browser frame drops in massive virtualized tables.

Blocks:Attaching Dynamic Measurement Callbacks Without Layout Containment Causing Forced Reflow Loops and Node Bloat
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-node-transforms-and-serialization-guardrails
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization

Enforces strict immutability, selection reconciliation, and node registry completeness across Meta Lexical document pipelines. Prevents direct AST mutations without write locks, eliminates cursor jumping during batched node transforms, and guarantees lossless headless Markdown serialization.

Blocks:Mutating Unlocked Lexical Nodes, Dropping Active Selections, and Running Headless Markdown Transforms Without Registered Nodes
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-config-deterministic-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Rule Suppression Guardrail

Enforces deterministic configuration patterns in Biome 1.9+, mandating native VCS integration via git ignore files, explicit configuration inheritance overrides, and strictly reasoned inline rule suppressions. Prevents CI/CD drift caused by unversioned ignore lists, unreasoned disable comments, and fragmented toolchain execution.

Blocks:Unanchored ignores, fragmented linter configurations, and unreasoned inline rule suppressions bypassing CI deterministic checks.
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipeline-guardrail
frontendcritical

Hono JSX Edge Streaming Pipelines and Non-Buffering Middleware Invariant

Enforces non-buffering, progressive chunked HTML streaming using Hono JSX and Suspense across Cloudflare Workers and Deno edge runtimes. Prevents edge TTFB degradation, out-of-memory worker terminates, and invalid post-flush header mutation in downstream middleware pipelines.

Blocks:Buffering JSX to String and Mutating Response Headers Post-Stream Flush in Edge Middleware
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-3-windowing-performance
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Guardrails

Enforces strict performance invariants for TanStack Virtual 3.0 in high-density tables and lists. Prevents layout thrashing, DOM node saturation, and measurement jitter by requiring continuous measurement containment, transform-based positioning, and explicit scroll margin offsets. Mandates non-reactive scroll containers, stable item keys, and proper teardown of resize observers.

Blocks:Uncontained Dynamic Layout Thrashing and Render-Time Item Measurement Cascades
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-transform-reconciliation-standard
frontendcritical

Lexical Immutable Node Transforms, Headless Serialization, and Selection Reconciliation

Enforces Lexical double-buffered EditorState immutability invariants by strictly requiring node.getWritable() inside active update batches, idempotent transform hooks to prevent infinite cascade loops, and isomorphic node registration for headless serialization.

Blocks:Direct In-Place Node Property Mutation and Unbounded Transform Loops in Lexical Pipelines
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-single-fetch-guardrails
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Boundaries

Enforces architectural invariants for React Router 7 framework mode hydration, strictly governing typegen route module typing, turbo-stream single-fetch data boundaries, and clientLoader hydration lifecycles. Prevents hydration mismatches, unhandled streaming promise rejections, and invalid clientLoader cache collisions.

Blocks:Bypassing Route Module Typegen, Returning Legacy json() Wrappers in Single Fetch, and Misconfiguring clientLoader.hydrate
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-measurement-containment-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Defense

Enforces strict DOM node count containment, deterministic dynamic element measurement, and layout shift mitigation when virtualizing large datasets using @tanstack/react-virtual v3. Mandates non-blocking resize observation, ref-based measurement attachment, and hardware-accelerated transforms to prevent forced synchronous reflows and memory leaks in enterprise grid tables.

Blocks:Unmeasured Dynamic Rows with Layout Shifts, Missing Ref Attachments, and Excessive Overscan DOM Node Saturation
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-engine-transforms-and-serialization
frontendcritical

Lexical Headless State Immutability, Node Transforms, and Markdown Serialization Guardrails

Enforces strict immutability patterns in Meta Lexical node transforms, safe selection reconciliation during state updates, and deterministic AST-based headless markdown serialization. Prevents infinite transform loops, silent state desynchronization, and corrupted text selections in client and server-side document pipelines.

Blocks:Mutating Lexical Nodes Directly Outside getWritable(), Triggering Unbounded Transform Loops, or Serializing Non-Normalized ASTs Headless
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4-css-first-theme-directives-standard
frontendcritical

Tailwind CSS v4 CSS-First Architecture & @theme Directive Enforcement

Tailwind CSS v4 replaces JavaScript-based configuration (tailwind.config.js) with native CSS-first configuration via @theme blocks and CSS variables. Developers must configure tokens directly in stylesheets using standard CSS semantics and modern color functions (e.g., oklch, color-mix) rather than deprecated JavaScript configuration objects or legacy opacity hacks.

Blocks:Configuring Tailwind tokens in tailwind.config.js or using legacy v3 alpha-value CSS variable interpolation hacks
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipelines
frontendcritical

Hono JSX Edge Streaming Pipelines and Non-Blocking Middleware Guards

Enforces non-blocking, memory-bounded chunked streaming architectures for Hono JSX applications running on Cloudflare Workers and Deno Deploy. Prohibits full-response buffering in edge middleware, mandates proper use of `streamText` and `renderToReadableStream`, and ensures backpressure handling across nested async JSX suspense boundaries.

Blocks:Buffering whole HTML payloads in middleware or using synchronous JSX rendering for I/O-bound edge components
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-headless-serialization-standard
frontendcritical

Lexical Immutable Transforms, Selection Invariants, and Headless Serialization

Enforces strict node immutability, safe writable cloning, and loop-invariant node transforms in Meta Lexical. Mandates resilient selection preservation during AST reconciliation and guarantees deterministic, crash-safe headless markdown serialization across worker and SSR runtimes.

Blocks:Direct In-Memory Node Mutation, Unguarded Transform Recursion, and Headless Selection Null-Pointers
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-reconciliation-standard
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization Guardrails

Lexical enforces strict editor state immutability via clone-on-write dirty-tracking mechanisms. Mutating node properties without $getWritable(), bypassing node replacement registrations during transforms, or modifying tree structures without explicitly reconciling active RangeSelection leads to DOM synchronization failure and document corruption. In headless server-side contexts, executing markdown serialization without properly registering registered custom node schemas inside an isolated headless instance creates divergent AST outputs and runtime memory leaks.

Blocks:Direct In-Place Node Property Mutation, Unreconciled Range Selection Collapsing, and DOM-Leaking Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-vcs-suppression-guardrail
frontendcritical

Deterministic Biome 1.9 Configuration Inheritance, VCS Sync, and Rule Suppression

Enforces strict configuration architecture, deterministic VCS integration, and explanatory suppression syntax for Biome 1.9 in enterprise monorepos. Mandates the use of Biome's native VCS ignore resolution to eliminate drift between Git and Biome, enforces structured suppression syntax with mandatory human-readable justifications, and standardizes configuration inheritance across package boundaries.

Blocks:Leaking Legacy ESLint Suppressions, Bypassing VCS Ignore Synchronization, and Using Unjustified Biome Suppressions
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-single-fetch-boundaries
frontendcritical

React Router 7 Framework Mode Hydration, Typegen & Single-Fetch Guardrails

Enforces strict data boundaries, serialization invariants, and typegen alignment in React Router 7 framework mode. Prevents hydration mismatches and broken streaming pipelines caused by misconfigured clientLoader.hydrate flags, unhandled non-deferred promises in single-fetch mode, and manual route loader typing.

Blocks:Bypassing Route Typegen, Misconfiguring clientLoader.hydrate, and Leaking Raw Promises across Single-Fetch Boundaries
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-serialization-invariants
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Enforces architectural invariants in Meta Lexical engines, requiring absolute node immutability via getWritable(), strictly idempotent node transform loops to prevent reconciliation cascades, and isomorphic transformer registration in headless markdown pipelines.

Blocks:Mutating Lexical nodes outside getWritable, triggering infinite transform cascades, or running headless serialization without matching node schemas.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-streaming-guardrail
frontendcritical

TanStack Start & Fullstack Router SSR: Type-Safe Search Params & Deferred Data Streaming

Enforces strict type safety and streaming invariants in TanStack Start and TanStack Router fullstack SSR applications. Mandates runtime validation for search parameters using Zod/Valibot schemas, distinguishes non-critical promises using `defer()` wrapped in `<Await>` boundaries, and forbids direct loader client waterfalls or non-serializable SSR state leakage.

Blocks:Unvalidated search params with blocking SSR waterfalls and raw promise leaks in loaders
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipeline-standard
frontendcritical

Hono JSX Edge Streaming Pipelines and Non-Blocking Chunk Composition

Mandates asynchronous streaming of Hono JSX using renderToReadableStream across edge runtimes like Cloudflare Workers and Deno. Enforces immutable header commitment prior to stream dispatch and requires encapsulated Suspense error boundaries to prevent edge process termination during streaming chunk failures.

Blocks:Buffering Full Async JSX Trees in Edge Memory or Mutating HTTP Headers Post-Stream Initiation
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-containment
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement and Layout Containment Standard

Enforces strict DOM node containment, GPU-accelerated absolute transforms, and non-thrashing dynamic element measurement for @tanstack/react-virtual 3.0. Prevents catastrophic layout recalculations and main-thread freezing in high-density tables and lists with variable-height cells.

Blocks:Dynamic Element Re-rendering with Uncontained Offsets and Inline Height Recalculation Thrashing
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-framework-hydration-single-fetch
frontendcritical

React Router 7 Framework Mode: Hydration, ClientLoader Streaming, and Single-Fetch Typegen Guardrails

Enforces single-fetch data semantics, automatic turbo-stream promise streaming, and explicit clientLoader hydration boundaries in React Router 7 framework mode. Prohibits legacy Remix json()/defer() response wrappers and untyped loader signatures, eliminating hydration mismatches, double-fetching, and serialization breakage.

Blocks:Using Legacy json()/defer() Wrappers, Untyped Route Signatures, and Misconfigured clientLoader Hydration Boundaries
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-headless-serialization
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization Guardrails

Enforces strict immutability invariants during Lexical node transformations, guarantees selection point reconciliation during node replacement, and prevents silent state drops in headless Markdown serialization pipelines by enforcing node registration symmetry.

Blocks:Direct Node Mutation, Stale Selection Pointer Desynchronization, and Unregistered Headless Markdown Transformers
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-streaming-pipeline-production-standard
frontendcritical

Mandating Chunked Suspense Streaming & Non-Buffering Hono JSX at the Edge

Enforces non-buffering, asynchronous chunked rendering using Hono JSX and edge stream pipelines across Cloudflare Workers and Deno. Eliminates edge runtime memory exhaustion (OOM) and catastrophic Time-to-First-Byte (TTFB) latency caused by synchronous tree buffering and un-suspended async edge components.

Blocks:Buffering Asynchronous JSX In-Memory via Synchronous renderToString() at the Edge
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-typegen-single-fetch-guardrail
frontendcritical

React Router 7 Framework Mode Hydration, Typegen & Single-Fetch Invariants

Enforces strict hydration boundaries, Single Fetch TurboStream serialization, and native Route Typegen contracts in React Router 7 framework mode. Prevents hydration mismatches, double-fetch cascades, broken promise streaming, and legacy Remix migration regressions.

Blocks:Bypassing Route Typegen, Misconfiguring clientLoader Hydration Flags, and Using Deprecated defer() in React Router 7
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-saturation-prevention
frontendcritical

TanStack Virtual 3.0 Invariants: Dynamic Measurement, Data-Index Binding, and DOM Containment

Enforces strict DOM node containment, dynamic height measurement invariants, and GPU-composited positioning for TanStack Virtual 3.0. Prevents layout thrashing, infinite measurement cycles, and DOM node saturation in massive multi-thousand-row tables. Mandates deterministic data-index attribution and hardware-accelerated transform offsets.

Blocks:Missing data-index Attribute on Dynamic Measurement Nodes Inducing Measurement Thrashing and DOM Node Saturation
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-config-and-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Suppression Standards

Enforces strict configuration inheritance via the `extends` key, deterministic Git-aware VCS resolution, and mandatory explanations for all inline rule suppressions in Biome 1.9+. Prevents divergent formatting and linting discrepancies across monorepo package boundaries while ensuring legacy ESLint suppression comments are rejected.

Blocks:Fragmented Package Configs, Legacy ESLint Suppressions, and Git-Blind Biome CLI Runs
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-loaders-deferred-guardrail
frontendcritical

TanStack Start SSR: Strict Type-Safe Search, Loader Isolation, and Deferred Data Streaming

Enforces strict type-safe search parameter validation, selective SSR data deferral via streaming, and explicit dependency tracking across TanStack Start routes. Prevents severe SSR Time-to-First-Byte (TTFB) degradation caused by un-deferred secondary fetches and eliminates hydration mismatches from untracked search param state.

Blocks:Monolithic Blocking SSR Loaders with Untyped Search Params and Stale Dependency State
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-selection-reconciliation
frontendcritical

Lexical Node Immutability, Transform Idempotency, and Headless Markdown Serialization

Enforces Lexical's copy-on-write immutability invariants during editor updates, requires idempotent transform guards to prevent infinite update cascades, and ensures safe selection preservation and isomorphic headless serialization.

Blocks:Direct In-Place Node Mutation, Unguarded Transform Recursion, and Headless Selection Collapsing
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-deterministic-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppression

Enforces strict configuration inheritance patterns, Git VCS integration, and deterministic rule suppression syntax under Biome 1.9. Disallows legacy ESLint/Prettier suppression comments and untyped Biome ignores without explicit justification, ensuring reproducibility across local and CI environments.

Blocks:Ad-Hoc Suppressions, Leaked Ignored Files, and Broken Monorepo Configuration Overrides
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-defer-guardrails
frontendcritical

Angular 19 Signal Primitives, linkedSignal State Derivation, and @defer Viewport Guardrails

Enforces modern Angular 19 reactive architectures by replacing side-effecting input synchronization with linkedSignal, and mandating non-collapsing placeholders on @defer viewport blocks to eliminate Cumulative Layout Shift (CLS) and deferred chunk loading cascades.

Blocks:Using effect() for Input State Mirroring and Unbounded @defer Blocks Lacking Sized Placeholders
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-3-windowing-performance-production-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Containment, and Node Saturation Guardrails

Mandates strict containment of DOM node saturation, idempotent dynamic element measurement, and GPU-composited positioning for TanStack Virtual 3.0. Enforces stabilized item keys, bounded overscan thresholds, and strict isolation of layout recalculations in massive data grids.

Blocks:Unbounded Dynamic Layout Thrashing via Naive Measurements and DOM Node Saturation
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-transform-selection-reconciliation
frontendcritical

Lexical Node Mutation Immutability, Transform Loop Prevention, and Headless Markdown Serialization

Enforces strict copy-on-write node immutability via getWritable(), prevents infinite transform cycles through idempotent dirty-checking, and mandates explicit node registry definitions for headless Lexical markdown serialization pipelines.

Blocks:Directly Mutating Read-Only Node Instances, Triggering Unbounded Transform Cascades, and Headless Markdown Serialization Failures Due to Incomplete Node Registries
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-search-params-deferred-streaming
frontendcritical

TanStack Router SSR Loader Invariants: Validated Search Params and Deferred Streaming

Enforces strict runtime schema validation for search parameters, explicit dependency tracking via loaderDeps, and non-blocking SSR streaming via TanStack Router defer(). Prevents server-side TTFB degradation, hydration state mismatches, and cache invalidation failures in fullstack TanStack Start architectures.

Blocks:Blocking SSR TTFB with monolithic loader promises and accessing unvalidated search params without loaderDeps
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-headless-serialization-guardrail
frontendcritical

Lexical Node Immutability, Selection Reconciliation, and Headless Serialization Architecture

Enforces strict copy-on-write immutability using node.getWritable() within editor.update() contexts, guarantees selection reconciliation across headless and browser runtimes, and prevents infinite transform cascades during markdown serialization. Violating these invariants produces corrupted EditorState trees, reconciliation desyncs, and fatal crashes in headless Node.js SSR environments.

Blocks:Direct Node Mutation, Unsafe Selection Dereferencing, and Unregistered Node Serialization in Headless Transforms
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-loader-streaming-standard
frontendcritical

TanStack Start SSR Loaders, Streaming Invariants, and Type-Safe Search Params

Mandates strict schema validation via validateSearch, intentional separation of critical vs deferred SSR data via defer(), and explicit loaderDeps mapping. Prevents severe TTFB latency degradation, client-server hydration mismatch, and unsynchronized route transitions.

Blocks:Degrading SSR TTFB with monolithic non-deferred loaders and fetching search-dependent data via client useEffect hooks
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-state-and-snippets-standard
frontendcritical

Svelte 5 Runes Reactive State, Snippets, and Effects Invariant Standard

Enforces deterministic, fine-grained reactivity in Svelte 5 by strictly mandating universal runes syntax ($state, $derived, $effect, $props) and snippets over legacy Svelte 3/4 runtime paradigms. Prevents state desynchronization caused by proxy destructuring, impure derived calculations, and uncontrolled effect cycles.

Blocks:Destructuring fine-grained reactive state proxies, abusing $effect for derived computations, and relying on legacy slot syntax.
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-linked-defer-views
frontendcritical

Angular 19 Signal-Based Reactivity, linkedSignal State, and @defer View Chunking Guardrails

Angular 19 enforces strict zoneless-ready primitives requiring signal inputs (`input()`, `input.required()`), explicit state derivation via `linkedSignal()`, and granular chunking via template `@defer` blocks. Bypassing these primitives with legacy `@Input()` decorators, imperative `ngOnChanges` state syncing, or monolithic non-deferred component hierarchies degrades change detection performance, risks stale state synchronization bugs, and inflates initial bundle sizes.

Blocks:Imperative State Syncing via ngOnChanges and Monolithic View Bundling Without @defer
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-hydration-single-fetch-invariants
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Boundaries

Enforces architectural constraints for React Router 7 framework mode hydration, clientLoader caching, and Single Fetch data boundaries. Prevents client-server state desynchronization, double-fetching waterfalls, hydration mismatches, and broken route typegen contracts.

Blocks:Bypassing Typegen Contracts and Misconfiguring clientLoader Hydration in React Router 7 Single-Fetch
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-serialization
frontendcritical

Lexical Immutable Node Transforms, Selection Preservation, and Headless Markdown Serialization

Lexical editor states are strictly immutable snapshots where node mutations must occur exclusively via write transforms inside an active editor.update() boundary. Retaining node instances across closures, mutating properties without $getWritable(), or running headless markdown conversions without discrete synchronous state updates causes silent document corruption, dropped selections, and desynchronized AST outputs.

Blocks:Stale Node Reference Mutation and Unregistered Headless Markdown Deserialization
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-vcs-suppression-standards
frontendcritical

Biome 1.9 Config Inheritance, VCS Integration, and Strict Suppression Syntax

Enforces deterministic Biome 1.9 configuration standards across repositories. Mandates explicit schema declarations, unified VCS ignore sync via `vcs.clientKind`, modular configuration inheritance, and structurally justified inline rule suppressions.

Blocks:Unjustified inline suppressions, legacy ESLint directives, and desynced ignore files causing CI/local divergence
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-node-transforms-headless-serialization
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Enforces Lexical's copy-on-write immutability contracts, deterministic node transform dirty-checking, safe selection reconciliation, and headless markdown pipeline execution. Violating these invariants causes silent state desynchronization, infinite transform loops, and server-side DOM crashes in headless environments.

Blocks:Mutating Lexical Node Internals Without getWritable() and Unchecked Headless Transform Recursion
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-headless-markdown-guardrail
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Enforces strict Lexical node mutation invariants using writable node proxies inside update boundaries, guarantees idempotent node transforms to prevent infinite reconcile cascades, preserves DOM/editor selection continuity during structural shifts, and ensures headless Markdown serialization runs deterministically without DOM leaks.

Blocks:Mutating Stale Lexical Node References, Unguarded Recursive Transforms, and Selection Corruption in Headless Pipelines
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-and-params-standard
frontendcritical

TanStack Start SSR: Guardrails for Type-Safe Search Params and Deferred Streaming

Mandates strict schema validation for route search parameters and enforces non-blocking deferred streaming for slow SSR operations. Eliminates server render timeouts, hydration mismatches, and unvalidated URL parameter injection in fullstack TanStack applications.

Blocks:Blocking SSR on slow secondary dependencies and consuming unvalidated search parameters directly from raw URL state.
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4-css-first-theme-guardrails
frontendcritical

Tailwind CSS v4 CSS-First Theme Directives & Variable Invariants

Tailwind CSS v4 fully replaces legacy JavaScript-based configuration (`tailwind.config.js`) with native CSS-first configuration via `@import "tailwindcss";` and `@theme` blocks. Invariants mandate defining theme tokens directly as CSS custom properties within `@theme` blocks and leveraging native CSS color-mix() interpolation rather than deprecated string-substitution `<alpha-value>` functional wrappers.

Blocks:Defining legacy tailwind.config.js configurations, using deprecated @config directives, or relying on rgba()/opacity function hacks instead of native @theme CSS variables.
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signals-defer-views
frontendcritical

Angular 19 Signal Primitives, Linked Signals, and @defer Template Chunking

Enforces modern Angular 19 reactive architectures by requiring signal inputs and linkedSignal for derived mutable state, while prohibiting ngOnChanges and manual synchronizations. Mandates explicit @defer blocks with viewport triggers, minimum durations, and error/placeholder fallbacks for non-critical template subtrees to optimize bundle chunking and Core Web Vitals.

Blocks:Mutating state via ngOnChanges/effects and omitting @defer blocks on below-the-fold dependencies.
Targets:Cursor•Claude•Windsurf•Codex
biome-config-vcs-suppression-invariants
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression Governance

Enforces deterministic configuration inheritance, strict VCS integration, and reasoned rule suppression for Biome 1.9 toolchains. Prevents configuration drift across monorepos, eliminates redundant filesystem traversals by synchronizing Biome with Git ignore trees, and mandates actionable rationale on all inline lint waivers.

Blocks:Fragmented Configurations, Redundant Ignore Traversal, and Unexplained Silent Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-and-containment
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Guardrails

Enforces deterministic element measurement, ref-bound layout stabilization, and multi-dimensional windowing containment for TanStack Virtual 3.0. Prevents catastrophic layout thrashing, infinite measurement oscillation loops, and DOM node saturation in high-density data tables.

Blocks:Layout Thrashing, Infinite Resize Loops, and Memory Exhaustion via Naive Dynamic Measurement and Unbounded Column Rendering
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-config-vcs-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Rule Suppression Guardrails

Enforces strict configuration architecture in Biome 1.9 across monorepos and standalone repositories. Mandates explicit Git VCS integration to prevent parsing build outputs, centralized schema inheritance via `extends`, and fully qualified inline rule suppressions with mandatory justification strings.

Blocks:Ignoring VCS boundary definitions and using legacy or unexplained suppression comments that bypass CI safety guarantees
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-transforms-and-serialization-guardrails
frontendcritical

Lexical Immutable Node Mutation, Selection Reconciliation, and Headless Serialization Invariants

Enforces Lexical's clone-on-write immutability contract, preventing silent editor state corruption, infinite transform loops, and selection reconciliation failures. Mandates explicit node registration in headless pipelines and strictly forbids direct property assignment or unverified DOM/selection access during headless markdown serialization.

Blocks:Direct In-Place Node Property Mutation and Unregistered Headless Transforms
Targets:Cursor•Claude•Windsurf•Codex
biome-config-inheritance-vcs-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrails

Enforces architectural compliance for Biome 1.9 tooling setups across monorepos and standalone repositories. Mandates deterministic VCS-aware ignore tracking, disciplined configuration inheritance hierarchies, and mandatory justification comments for all inline rule suppressions.

Blocks:Unjustified Bare Rule Suppressions, VCS-Ignored File Leaks, and Monorepo Config Drift
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-measurement-guardrail
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing & Scroll Containment Standard

Enforces strict virtualizer lifecycle management in TanStack Virtual 3.0 for massive, dynamic datasets. Prevents DOM node saturation, layout thrashing, and sub-pixel jitter by mandating accurate ref dynamic measurement callbacks, scroll margin isolation, and GPU-accelerated CSS transform positioning.

Blocks:Uncontained Dynamic Row Measurements Inducing Infinite Resize Loops and Layout Thrashing
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-serialization-production-standard
frontendcritical

Lexical Headless Node Transforms, Selection Reconciliation, and Markdown Serialization Guardrail

Enforces strict Lexical AST immutability semantics, idempotent node transforms, and safe headless serialization. Mandates clone-on-write access via node.getWritable() inside update closures, deterministic selection preservation during AST reconciliation, and explicit node registration for headless markdown pipelines without DOM dependencies.

Blocks:Direct node property mutation and unconstrained transform loops in headless markdown serialization
Targets:Cursor•Claude•Windsurf•Codex
biome-config-inheritance-vcs-suppression
frontendcritical

Biome 1.9 Monorepo Configuration, VCS Integration, and Deterministic Suppression Standards

Enforces strict configuration architecture in Biome 1.9+, establishing centralized workspace inheritance, automated Git-driven VCS ignore synchronization, and validated deterministic inline suppression syntax. Prevents toolchain fragmentation, divergent ignore sets, and silent lint-rule circumvention across monorepos.

Blocks:Fragmented multi-tool ignore drift, orphaned nested configurations, and opaque rule suppressions without explicit justification.
Targets:Cursor•Claude•Windsurf•Codex
angular-19-standalone-signals-defer-views
frontendcritical

Angular 19 Standalone Signals, Linked Signals, and Defer View Invariants

Enforces Modern Angular 19 reactivity and lazy-loading standards by mandating signal inputs, linkedSignal for resettable derivations, and strictly partitioned @defer blocks with minimum rendering thresholds. Prohibits legacy decorator inputs, manual ngOnChanges synchronization, and untracked side-effects in computed signals.

Blocks:Mixing Legacy ngOnChanges with Signal Inputs and Unbounded @defer Blocks Without Viewport Placeholders
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-headless-guardrail
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Enforces strict clone-on-write immutability via $getWritable() within Lexical editor updates, prevents infinite node transform cascades, guarantees selection reconciliation, and ensures headless Markdown serialization executes deterministically without browser DOM dependencies.

Blocks:Direct Node Property Mutation, Cascading Transform Loops, and DOM-Tethered Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-inheritance-vcs-guardrails
frontendcritical

Deterministic Biome 1.9 Monorepo Inheritance, VCS Integration, and Explicit Rule Suppression

Biome 1.9 replaces traditional multi-tool JavaScript/TypeScript toolchains with a high-performance single-binary engine. In production monorepos, engineers must enforce root configuration inheritance using exact relative extends paths, integrate native VCS ignore hooks to eliminate duplicate ignore manifests, and mandate structured, deterministic suppression comments containing both rule names and mandatory rationale.

Blocks:Fragmented multi-tier ESLint/Prettier configs, divergent gitignore patterns, and naked linter suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-deferred-params-guardrail
frontendcritical

TanStack Start SSR: Type-Safe Search Validation, Loader Dependencies, and Deferred Streaming

Enforces strict validation of search parameters via standard schema parsers, mandatory `loaderDeps` declarations for search-dependent queries, and explicit deferred streaming via `defer()` for non-critical SSR data. Prevents SSR waterfall blocking and eliminates client-server hydration mismatch bugs.

Blocks:Unvalidated Search Params, Missing loaderDeps, and Monolithic Blocking SSR Loaders
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipeline-invariants
frontendcritical

Hono JSX Edge Streaming Pipelines and Non-Buffering Middleware Invariants

Enforces non-blocking, zero-buffering HTML streaming architecture for Hono JSX on Cloudflare Workers and Deno runtimes. Mandates renderToReadableStream with Suspense boundaries to minimize TTFB, preventing edge V8 isolate memory exhaustion and unhandled stream termination errors.

Blocks:Buffering JSX Trees via renderToString and Blocking Edge Pipelines on Synchronous Middleware
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-windowing-performance-guardrail
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing and DOM Containment Standard

Enforces deterministic rendering invariants for TanStack Virtual 3.0 in massive datasets. Mandates hardware-accelerated transforms, bounded overscan, stable keying via getItemKey, and strict measureElement lifecycle bindings to eliminate ResizeObserver thrashing, layout jitter, and DOM node saturation.

Blocks:Dynamic Measure Feedback Loops, Unbounded Overscan Saturation, and Top-Offset Layout Thrashing
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-windowing-guardrail
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement and DOM Containment Standard

Enforces deterministic DOM virtualization using TanStack Virtual 3.0 with dynamic element measurement and hardware-accelerated positioning. Prevents layout thrashing, DOM node saturation, and measurement feedback loops in massive data tables by constraining overscan thresholds and stabilizing element ref attachments.

Blocks:Unbounded overscan, layout-invalidating inline offsets, and missing measurement attributes causing catastrophic DOM saturation
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-serialization-standard
frontendcritical

Lexical Node Immutability, Transform Convergence, and Headless Serialization Invariants

Mandates strict copy-on-write immutability using node.getWritable() inside active editor update boundaries, enforces transform idempotency to prevent reconciliation cycle blowouts, and guarantees node registry parity between headless markdown serializers and interactive editor runtimes.

Blocks:Direct In-Place Node Mutation and Desynchronized Headless Node Registries Causing State Corruption
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-config-and-suppression-guardrails
frontendcritical

Deterministic Biome 1.9 Inheritance, VCS-Aware Formatting, and Rule Suppressions

Enforces strict configuration inheritance across monorepo boundaries in Biome 1.9, mandating Git-backed VCS integration for incremental CI passes and strict inline suppression syntax with mandatory human-readable justification. Prevents silent drift between formatting and linting engines while eliminating unverified blanket suppression comments.

Blocks:Fragmented multi-tool configuration drift with undocumented blanket lint suppressions and non-VCS aware CI runs
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-search-invariants
frontendcritical

TanStack Start SSR: Type-Safe Search Validation and Deferred Streaming Architecture

Enforces strict type safety for route search parameters using schema validators and mandates non-blocking SSR hydration through TanStack Router's deferred streaming. Prevents Time-To-First-Byte (TTFB) degradation and client-server hydration mismatches by decoupling critical route data from non-critical async promises.

Blocks:Blocking SSR Hydration on Secondary Promises and Parsing Raw Search Params
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-hydration-single-fetch-guardrails
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Boundaries

Enforces architectural invariants in React Router 7 (RR7) Framework Mode by strictly managing Single Fetch serialization, route module typegen, and clientLoader hydration contracts. Prevents hydration mismatches, broken deferred stream resolutions, and type regressions caused by mixing deprecated Remix patterns with modern React Router 7 primitives.

Blocks:Mixing legacy Remix JSON/defer utilities with React Router 7 Single Fetch and misconfiguring clientLoader.hydrate boundaries
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-serialization-guardrails
frontendcritical

Lexical Headless Node Mutability, Selection Reconciliation, and Markdown Engine Guardrails

Enforces strict immutability patterns, selection preservation, and headless state reconciliation across Meta Lexical document pipelines. Prevents direct mutation of LexicalNode instances outside writable editor states and guarantees deterministic Markdown import/export without DOM dependencies. Mandates atomic transforms and safe clone operations to prevent state corruption and infinite transform loops.

Blocks:Direct node property mutation outside writable transactions, unhandled selection collapse during transforms, and DOM-dependent headless Markdown serialization.
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-vcs-suppression-guardrail
frontendcritical

Biome 1.9 Monorepo Configuration Inheritance, VCS Integration, and Suppression Standards

Enforces strict configuration inheritance via the 'extends' array, deterministic Git VCS integration for dirty-file parsing, and mandatory machine-readable suppression comments with explicit reasoning in Biome 1.9+. Prevents CI/CD drift, phantom formatting conflicts, and unreviewed lint bypasses across monorepo architectures.

Blocks:Fragmented Prettier/ESLint Legacy Overlaps, Broken Monorepo Extends, and Arbitrary Lint Suppression
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-search-params-guardrail
frontendcritical

TanStack Start SSR: Type-Safe Search Validation, Non-Blocking Deferred Streaming, and Server Hydration

Enforces schema-driven URL state validation via validateSearch and prevents SSR Time-To-First-Byte (TTFB) bottlenecks by mandating deferred streaming for non-critical promises. Requires the use of defer() with Suspense and Await components while maintaining end-to-end type safety between server functions and client hydration.

Blocks:Blocking Server Render on Non-Critical Secondary Data and Bypassing Router Search Validation
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-search-params-production-standard
frontendcritical

TanStack Start SSR Loaders, Streaming Deferred Data, and Validated Search Params

Enforces strict type-safety, non-blocking SSR streaming, and isomorphic isolation in TanStack Start and Fullstack TanStack Router. Requires structural schema validation for all search params, explicit deferred promise wrapping for non-critical SSR data to optimize TTFB, and strict RPC boundary isolation using createServerFn to eliminate server-only secret leaks.

Blocks:Unvalidated search params, blocking non-critical SSR loaders, and leaking server logic in client route bundles
Targets:Cursor•Claude•Windsurf•Codex
rr7-hydration-single-fetch-streaming-boundary
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Stream Guardrail

Enforces architectural constraints for React Router 7 Framework Mode hydration boundaries, single-fetch streaming semantics, and route module typegen. Prevents dual-fetch hydration waterfalls, unhandled turbo-stream promise serialization mismatches, and broken clientLoader hydration lifecycles.

Blocks:Bypassing Route Typegen and Misconfiguring clientLoader Hydration Lifecycles with Single Fetch
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-windowing-performance-production-standard
frontendcritical

TanStack Virtual 3.0: Dynamic Measurement Invariants and DOM Containment Guardrails

Enforces strict virtualizer lifecycle integrity, dynamic element measurement via ref callbacks with stable identity keys, and CSS containment in TanStack Virtual v3. Prevents catastrophic layout thrashing, scroll-jitter loops from dynamic heights, and DOM node saturation in massive tables.

Blocks:Index-Keyed Dynamic Element Measurement and Unbounded Table Row Virtualization
Targets:Cursor•Claude•Windsurf•Codex
biome-config-vcs-suppression-standards
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Suppression Standards

Enforces deterministic Biome 1.9 configuration standards across monorepos and standalone repositories. Mandates centralized configuration inheritance, direct VCS gitignore binding to prevent split-brain ignore states, and strictly documented suppression comments requiring rule-specific rationale.

Blocks:Fragmented Per-Package Configurations, Unsynchronized Git Ignores, and Bare Unjustified Suppressions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-state-guardrails
frontendcritical

Svelte 5 Fine-Grained Reactivity and Snippet Architecture Standard

Mandates strict adherence to Svelte 5 runes architecture ($state, $derived, $props, $effect, and snippets), strictly prohibiting legacy Svelte 3/4 patterns ($:, export let, <slot>). Enforces precise reactive dependency tracking, prevents infinite render loops from effect-driven derivations, and ensures snippet-based component composition.

Blocks:Mutating State Inside Effects and Retaining Legacy Svelte 3/4 Reactive Declarations ($:, export let, slots)
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-params-standard
frontendcritical

TanStack Start Type-Safe Search Params, SSR Loaders, and Deferred Streaming Guardrail

Enforces strict validation of search parameters via schema parsers, non-blocking SSR execution via deferred streaming with Suspense and Await, and proper hydration boundaries in TanStack Start routes. Prevents hydration mismatches, TTFB bottlenecks caused by unstreamed async loaders, and runtime parameter injection vulnerabilities.

Blocks:Awaiting non-critical data in synchronous SSR loaders without streaming, while parsing search parameters unsafely without route-level schema validation.
Targets:Cursor•Claude•Windsurf•Codex
rr7-hydration-single-fetch-streaming-invariants
frontendcritical

React Router 7 Framework Mode Hydration and Single-Fetch Data Boundaries

Enforces strict hydration safety, typegen contract conformance, and single-fetch boundaries in React Router 7 framework mode. Prevents hydration mismatches and streaming race conditions by mandating turbo-stream native primitives, explicit clientLoader.hydrate execution policies, and route module type bindings from generated ./+types artefacts.

Blocks:Bypassing Typegen Contracts and Misconfiguring clientLoader Hydration Boundaries in React Router 7
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-transforms-selection-reconciliation
frontendcritical

Lexical Headless Transforms, Selection Invariants, and Markdown Serialization Guardrail

Enforces strict idempotency and immutability rules within Meta Lexical node transforms, selection reconciliation cycles, and headless Markdown serialization pipelines. Eliminates infinite transform loops caused by un-guarded dirty flags, caret jumping from naive selection clobbering, and hydration crashes in DOM-less environments.

Blocks:Mutating Un-cloned Nodes, Non-Idempotent Transform Loops, and Selection Dropping in Headless Lexical Pipelines
Targets:Cursor•Claude•Windsurf•Codex
biome-config-vcs-deterministic-suppression
frontendcritical

Biome 1.9 Monorepo Inheritance, VCS Boundary, and Rule Suppression Standard

Enforces deterministic configuration patterns for Biome 1.9 across monorepos and isolated services. Mandates native VCS integration to guarantee build boundary consistency with Git, explicit monorepo inheritance trees via extends, and deterministic inline rule suppression requiring non-empty rationale clauses.

Blocks:Leaking Untracked Artifacts via Missing VCS Integrations and Unjustified Suppression Comments
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-typegen-boundaries
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Boundaries

Enforces strict type safety and architectural invariants for React Router 7 Framework Mode (formerly Remix). Requires utilizing generated route module types (+types), leveraging Single Fetch turbo-stream serialization without legacy json() wrappers, and strictly managing clientLoader hydration lifecycles to prevent flash-of-unstyled-content (FOUC) and hydration mismatches.

Blocks:Bypassing route typegen, returning manual json() responses, and uncoordinated clientLoader hydration without Fallbacks
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-inheritance-vcs-suppression-guardrail
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression Syntax

Enforces deterministic Biome 1.9 single-binary linter and formatter configuration standards across monorepo and standalone codebases. Mandates centralized configuration inheritance via extends, strict VCS ignore integration to prevent artifact pollution, and strictly formatted inline suppression comments with mandatory explanatory rationales.

Blocks:Configuration Drift, Phantom VCS Linting, and Naked Inline Rule Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-and-typesafe-search-params
frontendcritical

TanStack Start SSR Deferred Streaming & Type-Safe Search Validation Standard

Enforces strict type-safe search parameter validation schemas and non-blocking SSR data streaming in TanStack Start routes. Prohibits blocking TTFB with un-deferred secondary data and forbids untyped query access or manual search string manipulation.

Blocks:Awaiting Slow I/O in Root Loaders & Consuming Untyped Search Params
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-loader-deferred-streaming
frontendcritical

TanStack Start Type-Safe Search Params & Deferred SSR Streaming Invariants

Enforces strict type safety for route search parameters, deterministic SSR loaders, and deferred streaming patterns in TanStack Start and Fullstack Router. Prevents blocking SSR server responses with slow network calls, eliminates client-side hydration mismatches caused by unvalidated query strings, and mandates standard deferred promise handling using the Await component.

Blocks:Blocking SSR TTFB with sequential loader awaits and unvalidated client-side search parameter parsing.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-ssr-loader-search-streaming-guardrail
frontendcritical

TanStack Start SSR: Strict Search Validation, Deferred Streaming, and Server Function Boundaries

Mandates strict schema validation via validateSearch for all URL search parameters, isolates critical vs non-critical SSR payloads using defer() with Suspense/Await for non-blocking TTFB, and enforces server-only execution boundaries with createServerFn.

Blocks:Halting SSR Time-to-First-Byte with un-deferred slow promises and reading unvalidated raw search parameters across isomorphic boundaries.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-snippets-guardrail
frontendcritical

Svelte 5 Runes Reactive State & Snippets Architectural Standard

Enforces deterministic, fine-grained reactivity using Svelte 5 Runes ($state, $derived, $effect, and $props) while deprecating legacy Svelte 3/4 reactive syntax ($:, let bindings, export let, and slot elements). Prevents reactive proxy de-structuring and guarantees pure, side-effect-free derivations with idiomatic snippet-based rendering.

Blocks:Mixing legacy Svelte 3/4 reactivity with Runes, de-structuring $state proxies, and causing cyclical side effects via $effect for derived calculations.
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-monorepo-vcs-suppression-guardrail
frontendcritical

Biome 1.9 Monorepo Configuration Inheritance, VCS Integration, and Suppression Standards

Enforces strict configuration inheritance across monorepo packages, enables Git VCS integration to prevent format checking untracked/ignored assets, and mandates explicit deterministic inline suppression syntax with explanatory justifications. Prevents CI drift and broken linting passes in production repositories utilizing Biome 1.9+.

Blocks:Fragmented rootless configs, missing VCS ignore integration, and justification-less ESLint-style rule suppression
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-serialization
frontendcritical

Lexical Engine Invariants: Immutability, Transform Cycles, and Headless Serialization

Enforces Lexical rich text core architecture constraints: strict node immutability through `getWritable()`, cycle-free node transforms, robust selection reconciliation, and fully registered node schemas in headless Markdown serialization pipelines.

Blocks:Bypassing getWritable(), triggering infinite transform loops, and omitting required nodes in headless serialization contexts
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-inheritance-suppression-standards
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Governance

Enforces deterministic Biome 1.9 configurations across single-repo and monorepo architectures. Mandates explicit VCS Git ignore inheritance, strict JSON schema validation, deterministic extends resolution, and audit-compliant rule suppression syntax requiring fully-qualified rule names and documented justifications.

Blocks:Ad-Hoc File Globbing, Broken Git Ignore Inheritance, and Bare Rule Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-type-safe-ssr-streaming-production-standard
frontendcritical

TanStack Start SSR Loaders, Type-Safe Search Params, and Deferred Streaming Standard

Enforces strict type safety for URL search params, prevents SSR-blocking data waterfalls through deferred promise streaming, and eliminates client-server hydration mismatches in TanStack Start. Prohibits direct access to window.location or unvalidated search params during server-side renders and requires non-critical async loader data to be deferred via defer() and consumed with Suspense and Await.

Blocks:Blocking Critical SSR with Un-deferred Async Loaders and Unvalidated Raw Search Parameter Access
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-inheritance-suppression-production-standard
frontendcritical

Deterministic Biome 1.9 Configuration Inheritance, VCS Sync, and Suppression Compliance

Standardizes Biome 1.9 single-binary integration across monorepos and isolated repositories. Enforces strict Git-backed VCS ignore propagation, modular configuration inheritance via `extends`, and strictly justified, fully qualified `biome-ignore` comment suppressions. Prevents silent unformatted code commits, fragmented lint configurations, and unexplained rule overrides.

Blocks:Fragmented configs, bypassed Git-ignore alignment, and naked unexplained inline suppressions.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-params
frontendcritical

TanStack Start SSR Invariants: Type-Safe Search Validation, Streaming Deferrals, and Loader Dependency Tracking

Enforce strict schema validation on URL search parameters via validateSearch, prevent server-side TTFB bottlenecks by mandating defer() streaming for non-critical data, and guarantee deterministic hydration through explicit loaderDeps tracking across TanStack Start routes.

Blocks:Blocking SSR TTFB via Monolithic Loaders and Runtime Deserialization Failures via Unvalidated Search Params
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-vcs-suppression-guardrails
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression

Mandates deterministic monorepo configuration via Biome 1.9 extends syntax, binds discovery directly to Git VCS ignore manifests to eliminate filesystem desync, and requires fully justified inline suppression syntax. Prevents unanchored artifact scanning, legacy ESLint directive leakage, and silent suppression debt.

Blocks:Unanchored Artifact Traversals, Zombie ESLint Directives, and Unjustified Biome Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-3-windowing-performance-guardrails
frontendcritical

TanStack Virtual 3.0 Windowing Performance: Dynamic Measurement & DOM Saturation Guardrail

Mandates deterministic element measurement, GPU-accelerated transforms, and strict overscan boundaries in TanStack Virtual v3. Prevents layout thrashing, ResizeObserver recursion loops, and DOM node saturation in high-frequency, massive tabular structures.

Blocks:Unbounded Overscan, Top-Offset Reflows, and Direct DOM Re-measurement Thrashing
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-and-headless-serialization
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization Standard

Enforces strict compliance with Meta Lexical's copy-on-write architecture, node reconciliation lifecycle, and headless execution boundaries. Prohibits direct node property mutations and state-crossing selection access while mandating comprehensive node registry parity in headless markdown serialization pipelines to prevent editor state desynchronization and data loss.

Blocks:Mutating Lexical Nodes Directly and Executing Headless Serialization with Incomplete Node Registries
Targets:Cursor•Claude•Windsurf•Codex
biome-config-vcs-deterministic-suppression-standard
frontendcritical

Biome 1.9 VCS-Aware Configuration Inheritance and Deterministic Suppression Standards

Mandates strict Biome 1.9 configuration architecture utilizing deterministic inheritance hierarchies, native Git VCS integration to prevent ignore drift, and syntactically validated rule suppression comments with mandatory explanatory justifications. Eliminates inconsistent formatting passes across CI/CD pipelines and unanchored rule overrides in monorepo workspaces.

Blocks:Unanchored Legacy Suppressions and Missing VCS-Ignore Bindings Causing Monorepo Drift
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-and-search-params
frontendcritical

TanStack Start SSR Streaming, Loader Deferral, and Type-Safe Search Params

Enforces strict validation of URL search parameters via standard schema parsers, guarantees non-blocking server-side streaming via defer() and React Suspense, and mandates explicit loaderDeps tracking to eliminate hydration mismatches, TTFB regressions, and stale data fetches in TanStack Start and Fullstack Router.

Blocks:Blocking Critical SSR TTFB with Un-deferred Promises and Reading Unvalidated Search Params
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-type-safe-params
frontendcritical

TanStack Start SSR Loaders, Deferred Streaming, and Validated Search Params

Enforces strict type safety and non-blocking SSR architecture in TanStack Start and TanStack Router. Mandates schema-driven search parameter validation via validateSearch, deferred streaming via defer() for slow IO, and server-side isolation using createServerFn to eliminate hydration mismatches, data waterfalls, and bundle pollution.

Blocks:Unvalidated URL Search Params, Blocking Full-Page SSR Waterfalls, and Leaking Node APIs in Route Loaders
Targets:Cursor•Claude•Windsurf•Codex
react-router-v7-framework-hydration-single-fetch
frontendcritical

React Router 7 Framework Mode: Hydration, Single Fetch, and Route Module Typegen Invariants

In React Router 7 Framework Mode, data boundaries rely on Single Fetch architecture backed by turbo-stream serialization and auto-generated route module typegen. Violating hydration lifecycle invariants—such as wrapping naked data returns in legacy Response objects, neglecting clientLoader.hydrate execution semantics, or discarding generated Route types—triggers hydration mismatches, tears down streaming boundaries, and breaks isomorphic rendering.

Blocks:Bypassing Single Fetch Wire Serialization and Misconfiguring clientLoader.hydrate Lifecycle Boundaries
Targets:Cursor•Claude•Windsurf•Codex
biome-config-vcs-suppression-governance
frontendcritical

Biome 1.9 Monorepo Inheritance, VCS Integration, and Strict Rule Suppression Standard

Enforces deterministic Biome 1.9 configuration architecture across monorepos using strict extends inheritance, native Git VCS integration to prevent dirty state drift, and mandatory contextual explanation syntax for inline lint suppressions. Eliminates CI cache invalidation, processing of untracked assets, and unreviewed quality bypasses.

Blocks:Unanchored Biome configuration omitting VCS integration and using justification-free rule suppressions or obsolete ESLint directives.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-streaming-params
frontendcritical

TanStack Start SSR: Strict Search Param Validation & Deferred Streaming Invariants

Mandates strict schema-validated search params via validateSearch, prohibits SSR TTFB blocking by enforcing defer() for non-critical loader promises, and guarantees deterministic hydration across server and client boundaries.

Blocks:Blocking SSR TTFB with sequential awaits and parsing raw unvalidated search params in route loaders
Targets:Cursor•Claude•Windsurf•Codex
rr7-hydration-single-fetch-boundaries
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Data Boundaries

Enforces strict architectural boundaries for React Router 7 Framework Mode, governing typegen route modules, Single Fetch streaming contracts, and clientLoader execution lifecycles. Prevents hydration mismatches, double-fetching loops, and serialization bugs caused by legacy Remix primitives and unflagged client hydration loaders.

Blocks:Using legacy Remix json/defer APIs or unflagged clientLoader implementations that trigger hydration desync and streaming bottlenecks.
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-typegen-boundary
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Route Module Invariants

Enforces strict typegen-driven route module contracts, deterministic SSR hydration boundaries, and correct clientLoader.hydrate execution flags under React Router 7 Single Fetch mode. Prevents hydration mismatches, double-fetching cascades, and runtime promise resolution failures across turbo-stream boundaries.

Blocks:Bypassing Typegen Route Modules and Mishandling clientLoader.hydrate During Single-Fetch Hydration
Targets:Cursor•Claude•Windsurf•Codex
biome-config-vcs-deterministic-suppression-guardrail
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Synchronization, and Deterministic Suppression Standards

Enforces deterministic configuration topology, native Git VCS boundary synchronization, and strictly justified inline suppressions across Biome 1.9 workspaces. Prevents configuration drift across monorepos, unindexed build artifact parsing, and silent quality regressions caused by legacy comment directives or unjustified suppressions.

Blocks:Legacy Comment Pragmas, Desynchronized VCS Ignores, and Unjustified Inline Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-3-performance-guardrails
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement and DOM Saturation Containment

Enforces strict DOM and layout containment rules for TanStack Virtual 3.0 virtualizers handling massive datasets with dynamic dimensions. Mandates correct usage of measureElement ref callbacks, scroll margins, overscan limits, and CSS contain properties to eliminate layout thrashing and DOM node explosion. Prevents recursive remeasurement cascades and jitter during fast momentum scrolling in high-density tables and lists.

Blocks:Unbounded overscan and uncontained dynamic element measurement triggering infinite reflow loops and DOM saturation
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-vcs-deterministic-suppression
frontendcritical

Deterministic Biome 1.9 Monorepo Configuration, VCS Scoping, and Suppression Invariants

Enforces strict configuration inheritance patterns, Git VCS-aware file targeting, and deterministic inline suppression syntax in Biome 1.9. Prevents divergence between root workspace policies and leaf package overrides, eliminates untracked file linting churn, and mandates explanatory justification for all lint bypasses.

Blocks:Ad-hoc ESLint-style suppressions, broken monorepo config inheritance, and CI-breaking untracked file formatting loops.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-data-guardrails
frontendcritical

TanStack Start & Router SSR: Type-Safe Search Params, Loaders, and Deferred Streaming Invariants

Enforces strict type safety and streaming invariants in TanStack Start and TanStack Router fullstack applications. Mandates the use of runtime-validated search params via Zod or ArkType, ensures critical layout data blocks initial SSR while non-critical data is wrapped in defer() with Suspense/Await boundaries, and prevents client-side state desynchronization and waterfall roundtrips.

Blocks:Bypassing validateSearch, blocking SSR streams with slow queries, or fetching non-deferred loader data imperatively inside useEffect
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-markdown-engine
frontendcritical

Lexical State Immutability, Selection Reconciliation, and Headless Serialization

Enforces strict Lexical clone-on-write immutability via editor transactions, prevents selection desynchronization during AST node transformations, and guarantees isomorphic headless serialization without DOM dependencies. Failure to observe Lexical transactional semantics causes infinite reconciliation loops, corrupt undo/redo stacks, and headless execution crashes.

Blocks:Mutating Lexical AST nodes directly without clone-on-write semantics and executing headless serialization with DOM-bound transformers
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-state-and-snippets
frontendcritical

Svelte 5 Runes Reactivity and Snippet Composition Standards

Enforces strict architectural boundaries for Svelte 5 runes ($state, $derived, $effect, and $props), preventing reactivity loss via object destructuring and cyclic cascades. Mandates type-safe snippet composition over deprecated slot systems and restricts $effect to non-reactive DOM/external synchronization.

Blocks:Destructuring Reactive Proxies and Executing Impure State Mutations Inside $derived or $effect
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-selection-reconciliation
frontendcritical

Lexical Immutable Node Transforms, Selection Invariants, and Headless Markdown Serialization

Lexical enforces an immutable copy-on-write model where node mutations are strictly restricted to writable clones inside active editor updates. Mutating node properties directly, bypassing `$getSelection()` normalization during reconciliation, or leaking DOM/layout dependencies into headless Markdown serialization leads to broken undo/redo stacks, infinite transform cascades, and catastrophic SSR crashes.

Blocks:Direct In-Place Node Property Mutation and DOM-Dependent Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipeline-guardrails
frontendcritical

Hono JSX Edge Streaming Pipeline & Lifecycle Invariants

Enforces non-blocking chunked HTML streaming using Hono JSX and Suspense across edge middleware pipelines on Cloudflare Workers and Deno. Prevents synchronous DOM buffering, downstream response header mutations after chunk dispatch, and unhandled stream cancellations on client disconnect.

Blocks:Synchronous JSX Buffering and Post-Flush Header Mutation in Edge Pipelines
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-framework-hydration-single-fetch-production-standard
frontendcritical

React Router 7 Framework Mode: Hydration, Typegen, and Single-Fetch Boundaries

Enforces strict architectural boundaries for React Router 7 framework mode hydration, single-fetch streaming, and virtual type generation. Prevents hydration mismatches, double-fetching cascades, and runtime crashes caused by unhandled streaming promises or improperly configured clientLoader hydration flags.

Blocks:Bypassing Single-Fetch turbo-stream invariants via legacy defer(), misconfigured clientLoader.hydrate flags, and naked promise consumption during hydration.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-saturation-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement and DOM Saturation Containment

Enforces strict architectural invariants for TanStack Virtual 3.0 when virtualizing variable-height tabular datasets and infinite feeds. Prevents DOM node saturation, scroll jitter, and cascading layout recalculation cycles by mandating composite GPU-layer positioning, deterministic ref-based dynamic element measurement, and bound scroll margins.

Blocks:Unkeyed virtual items, top-offset layout thrashing, and uncontained dynamic element re-measurement loops causing frame drops and DOM explosion.
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-vcs-suppression-standard
frontendcritical

Biome 1.9 Unified Toolchain: Configuration Inheritance, VCS Synchronization, and Deterministic Suppression

Enforces architectural standardization for Biome 1.9, mandating VCS-driven ignore synchronization, monorepo configuration inheritance via extends, and deterministic inline suppressions requiring explicit explanatory rationale. Prevents configuration drift, unignored vendor artifacts, and silent quality regressions.

Blocks:Fragmented lint configurations with silent inline bypasses and desynchronized VCS ignore rules.
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipelines-standard
frontendcritical

Hono JSX Edge Streaming Pipeline & Chunked Context Preservation Standard

Enforces non-blocking, chunked edge rendering using Hono JSX streaming primitives (`renderToReadableStream`) with correct Transfer-Encoding and Content-Type negotiation. Eliminates full-buffer DOM serialization, unhandled stream backpressure stalls, and downstream middleware stream consumption deadlocks on Cloudflare Workers and Deno runtimes.

Blocks:Buffering Asynchronous JSX Subtrees and Consuming Uncloned ReadableStreams in Edge Middleware
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-windowing-performance
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing and DOM Saturation Invariants

Enforces strict virtual DOM containment, dynamic height measurement invariants, and GPU-accelerated rendering rules for TanStack Virtual 3.0. Prevents severe main-thread locking, layout thrashing, and memory leakage caused by uncontained dynamic measurements and overscan misconfigurations in high-density tables.

Blocks:Unmemoized Dynamic Measurement Callbacks, Layout Thrashing, and Excessive Overscan Saturation
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-inheritance-suppression-standards
frontendcritical

Biome 1.9 Config Inheritance, VCS Integration, and Suppression Governance

Enforces deterministic Biome 1.9 configuration architecture utilizing declarative inheritance (`extends`), rigorous VCS ignore-file synchronization (`vcs.useIgnoreFile`), and strictly documented suppression comments. Eliminates configuration drift across monorepo workspaces and prevents undocumented linter escapes in production TypeScript codebases.

Blocks:Fragmented multi-config drift, unlinked VCS ignore rules, and naked suppression directives lacking rationale
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-windowing-performance-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing, Layout Thrashing, and Scroll Isolation

Enforces strict DOM node containment, dynamic size measurement caching, and scroll margin stabilization when virtualizing massive datasets with TanStack Virtual v3. Prevents layout thrashing, erratic scroll jitter, and catastrophic DOM node saturation through rigorous use of key extractors, ref measurement attachments, and CSS transform-based positioning.

Blocks:Unmemoized dynamic measurements and inline style positioning triggering browser reflow storms and scroll desynchronization.
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-and-headless-markdown-reconciliation
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Engine Standards

Mandates strict immutability semantics via getWritable() within Lexical editor updates, guards against recursive transform cascades, preserves selection invariants during destructive AST operations, and ensures headless serialization environments initialize identical node registries without browser DOM reliance.

Blocks:Direct Node Mutation, Unbounded Transform Cascades, and Stale Selection Invalidation in Headless Serializers
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-deferred-params
frontendcritical

TanStack Start & Router SSR: Type-Safe Search Params, Loaders, and Deferred Streaming

Mandates strict schema validation for route search parameters and non-blocking SSR via deferred streaming for secondary network requests. Prevents SSR blocking waterfalls, unvalidated URL state tampering, and hydration mismatches in TanStack Start applications.

Blocks:Awaiting slow secondary data in root loaders and accessing untyped search params directly from location state.
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-and-headless-reconciliation
frontendcritical

Lexical Immutable Transforms, Selection Reconciliation, and Headless Serialization

Enforce Lexical document state immutability, atomic node transformations, and caret reconciliation across headless and browser contexts. Direct node property mutations, unmapped node replacements, and missing nodes in headless editor registrations lead to irrecoverable selection collapses and silent editor state corruption.

Blocks:Mutating Lexical Nodes Directly and Dropping Selection During Unregistered Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-node-transforms-and-headless-markdown-guardrail
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Mandates strict compliance with Lexical's copy-on-write AST model via getWritable(), boundary isolation in read/update transactions, selection reconciliation across batch transforms, and exhaustive node registration for headless markdown serialization.

Blocks:Direct node property mutation, unshielded recursive transforms, or missing headless node registrations breaking AST reconciliation.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-guardrail
frontendcritical

TanStack Start & Router: Type-Safe Search, SSR Loaders, and Deferred Streaming

Enforces strict type safety for URL search params via schema validation, mandates non-blocking SSR via TanStack Router's defer API for slow data, and guarantees reactive loader refetches using loaderDeps. Prevents SSR waterfall freezes, hydration mismatches, and stale route-state synchronization bugs.

Blocks:Blocking SSR with monolithic awaits, unvalidated search params, and missing loaderDeps
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-saturation
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement and DOM Saturation Invariants

Governs virtualized table and list rendering with @tanstack/react-virtual v3. Enforces stable dynamic node measurement contracts, constrained overscan margins, and hardware-accelerated positioning to eliminate layout thrashing and DOM node saturation.

Blocks:Unanchored dynamic item measurement, unbounded overscan, and layout-thrashing style mutations in massive virtualized tables.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-snippets-standard
frontendcritical

Svelte 5 Runes Reactive State, Derived Tracking, and Snippet Composition Invariants

Svelte 5 replaces legacy compile-time variable instrumentation with runtime fine-grained reactive proxies governed by runes ($state, $derived, $effect, $props). Developers must never simulate computed state using side-effectful $effect synchronization, never destructure $state objects into plain local primitives, and eliminate legacy slots in favor of typed snippet closures.

Blocks:Simulating Computed State with $effect and Severing Reactivity via Proxy Destructuring
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement and DOM Saturation Invariants

Enforces strict DOM node containment and precise dynamic dimension tracking in TanStack Virtual 3.0 to prevent layout thrashing, scroll jitter, and memory exhaustion in ultra-high-density data tables. Mandates transform-based virtualization, bounded overscan margins, and deterministic element measurement hooks.

Blocks:Unbounded overscan with synchronous layout thrashing and top-offset reflows in dynamic virtualized tables
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-vcs-deterministic-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppression

Standardizes Biome 1.9 configuration hierarchies across monorepos and standalone repositories by enforcing strict extends semantics, native VCS ignore integration, and deterministic inline suppression syntax. Prevents configuration drift, unformatted git diff churn, and undocumented rule bypasses by demanding explanatory suppression comments with explicit rule targets.

Blocks:Unpinned Config Inheritance, Disconnected Git Ignored Lists, and Bare Non-Explanatory Suppression Comments
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-production-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Transform Containment, and DOM Saturation Prevention

Enforces strict architectural guardrails for TanStack Virtual 3.0 in massive datasets with dynamic heights. Mandates hardware-accelerated transform positioning over layout-triggering top offsets, dynamic node registration via measureElement with data-index attributes, and aggressive overscan constraints to prevent DOM node saturation and recursive layout thrashing.

Blocks:Layout Thrashing via Top-Offset Positioning, Missing Measurement Indices, and Unbounded Overscan Saturation
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-mode-hydration-single-fetch
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Boundaries

Enforces single-fetch serialization boundaries, deterministic SSR hydration, and auto-generated route module typings in React Router 7 Framework Mode. Prohibits legacy Remix response primitives (`json()`, `defer()`) and ensures un-awaited streaming promises and `clientLoader.hydrate` flags maintain type safety and avoid hydration waterfalls.

Blocks:Legacy Response Serialization, Unchecked clientLoader Overrides, and Manual Route Prop Typing
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-node-transforms-and-headless-serialization
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization

Enforces Lexical's immutable document update cycle by requiring writable node cloning via $node.getWritable(), preventing infinite transform loops through dirty checking, preserving selection state during reconciliation, and mandating complete node schema registration during headless markdown conversions.

Blocks:Mutating Lexical nodes without getWritable(), causing runaway transform loops or corrupted headless markdown output.
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-deterministic-suppression-guardrail
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Standards

Enforces strict configuration architecture in Biome 1.9 setups, ensuring deterministic monorepo inheritance via 'extends', native VCS-aware formatting and linting, and exact suppression comment syntax with explicit justifications. Prevents configuration drift, unformatted git diff pollution, and non-actionable suppression debt across polyrepo and monorepo environments.

Blocks:Ad-Hoc Suppressions Without Explanation, Git-Unaware Lint Runs, and Fragmented Non-Inherited Biome Configurations
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-inheritance-and-deterministic-suppression
frontendcritical

Biome 1.9 Invariant Configuration Inheritance, VCS Synchronization, and Deterministic Rule Suppression

Enforces strict configuration inheritance across monorepo boundaries using Biome 1.9 extends mechanisms, ensures native Git ignore synchronization via VCS settings, and mandates deterministic, explanation-backed suppression comment syntax. Prevents configuration drift, unformatted vendor leaks, and silent lint exemptions across TypeScript and React codebases.

Blocks:Fragmented Rootless Configurations, Ignored VCS Boundaries, and Naked ESLint-Style Rule Disables
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transform-selection-reconciliation-standard
frontendcritical

Lexical State Immutability, Selection Reconciliation, and Headless Serialization Guardrails

Mandates strict isolation of Lexical node mutations via getWritable() within editor.update() transactions, prevents cyclic transform cascades, and guarantees safe headless DOM-independent serialization to prevent editor state corruption and selection collapse.

Blocks:Direct In-Place Node Mutation and Unbounded Transform Recursion Across Headless Editor States
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-engine-transforms-and-serialization-standard
frontendcritical

Lexical Headless Node Mutability, Selection Reconciliation, and Markdown Serialization Guardrails

Enforces immutable clone semantics via getWritable() during EditorState mutations, prevents selection collapse during asynchronous headless reconciliations, and guarantees bidirectional fidelity during headless Markdown serialization and deserialization.

Blocks:Mutating frozen Lexical nodes directly, bypassing getWritable(), or driving headless serialization outside editor.read/editor.update cycles.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-loader-guards
frontendcritical

Strict Type-Safe Search Params, SSR Loaders, and Deferred Streaming in TanStack Start

Enforces complete type safety across search parameters with Zod validation, prevents SSR waterfall bottlenecks by decoupling critical hydration data from deferred promises via `defer()`, and mandates strict boundary management with `Await` components. Forbids unvalidated search params and blocking SSR loaders for non-critical downstream data.

Blocks:Unvalidated search params leaking any-types, non-deferred SSR blocking promises, and waterfall loaders.
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-config-inheritance-vcs-suppression
frontendcritical

Biome 1.9 Monorepo Inheritance, VCS Integration, and Strict Suppression Syntax

Enforces architectural standards for Biome 1.9 configurations across workspaces. Mandates native VCS ignore synchronization, deterministic monorepo configuration inheritance, and strictly attributed suppression syntax with mandatory rationale.

Blocks:Fragmented root configurations with redundant ignore lists, missing VCS links, and unattributed inline suppressions.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-loader-standard
frontendcritical

TanStack Start & Router SSR: Type-Safe Search, Parallel Loaders, and Deferred Streaming

Enforces strict type safety and optimal hydration performance across TanStack Start and Fullstack Router SSR architectures. Requires validation schemas for all search parameters, explicit loader dependency tracking via loaderDeps, and non-blocking TTFB through deferred streaming with Await and Suspense. Eliminates hydration mismatches, waterfall fetches, and untyped query string parsing across isomorphic boundaries.

Blocks:Blocking SSR TTFB with non-critical awaits, omitting loaderDeps for search params, and using unvalidated raw query strings.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-and-snippets
frontendcritical

Svelte 5 Runes Reactivity, Snippets, and Props Invariants

Enforces fine-grained reactivity and component composition standards using Svelte 5 runes ($state, $derived, $props, $effect) and snippets. Prevents reactivity loss caused by props destructuring, eliminates circular re-renders from effect-based state synchronization, and deprecates legacy Svelte 3/4 stores and slot idioms.

Blocks:Destructuring $props(), Mutating $derived, Synchronizing State via $effect, and Using Legacy Slots
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-inheritance-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Rule Suppression

Enforces strict configuration architecture for Biome 1.9+ across monorepos and standalone repositories. Mandates native VCS ignore file integration to prevent linting build artifacts, centralized configuration inheritance via the 'extends' array, and deterministic, documented inline suppression comments.

Blocks:Duplicated Root Configs, Missing VCS Bindings, and Naked Legacy ESLint Suppression Comments
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-vcs-inheritance-suppression-standards
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Suppression Governance

Enforces deterministic standards for Biome 1.9+ setups across modern frontend codebases and monorepos. Mandates active Git VCS integration with ignorefile synchronization, schema-validated config inheritance via 'extends', and strictly documented inline suppressions requiring explicit rule names and actionable explanations.

Blocks:Unsynchronized Git ignores, duplicated monorepo configurations, and unanchored or reasonless inline suppressions.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-windowing-performance-production-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing & Layout Containment Invariant

Enforces strict DOM node containment, GPU-accelerated absolute transforms, and robust dynamic height measurement mechanics in TanStack Virtual 3.0. Prevents layout thrashing, scrollbar jitter, and memory saturation in high-throughput enterprise data grids by mandating hardware-accelerated transforms, data-index hooks, and bounded overscan constraints.

Blocks:Uncontained Layout Reflows, Jittery Measurements, and Excessive Overscan in Virtualized Tables
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-vcs-suppression-guardrail
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Explicit Rule Suppression Standards

Standardizes Biome 1.9 adoption across enterprise codebases by enforcing native VCS ignore-file integration, deterministic configuration inheritance (`extends`), and strict, documented rule suppressions. Prevents configuration drift, eliminates duplicate ignore files, and forbids opaque rule bypasses.

Blocks:Ghost Ignores, Divergent Package Configs, and Undocumented ESLint-Style Lint Suppressions
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-config-vcs-suppression-guardrails
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Suppression

Enforces architectural standards for Biome 1.9+ in single-package and monorepo codebases. Mandates centralized configuration inheritance, native VCS gitignore resolution, and strictly formatted suppression comments with mandatory human-readable justifications.

Blocks:Legacy ESLint Disables, Broken Monorepo Inheritance, and Ignored VCS Desync
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-snippets-invariants
frontendcritical

Svelte 5 Runes: Reactive State Proxies, Derived Tracking, and Snippet Composition

Svelte 5 introduces fine-grained reactive proxies via runes ($state, $derived, $props, $effect) and replaces slots with explicit snippets. Legacy Svelte 3/4 reactivity paradigms ($:, export let, <slot />) and reactive destructuring violate signal graph propagation, creating broken reactive boundaries and hydration mismatches.

Blocks:Destructuring Reactive Proxies, Using $effect for Synchronous Computations, and Mixing Legacy Svelte 4 Reactivity
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-headless-invariants
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation & Headless Serialization

Enforces Lexical's copy-on-write immutability paradigm via node.getWritable(), guarantees idempotent node transforms to eliminate infinite render cascades, and mandates deterministic headless Markdown serialization without DOM dependency leaks.

Blocks:Direct In-Memory Node Mutation, Unguarded Node Transform Loops, and DOM-Dependent Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-configuration-vcs-suppression-standards
frontendcritical

Biome 1.9 Deterministic Configuration Inheritance, VCS Anchoring, and Suppression Standards

Biome 1.9 requires strict configuration inheritance hierarchies across monorepos, authoritative VCS ignore alignment, and deterministic, reason-mandated suppression syntax. Inconsistent root anchoring leads to silent file skips and CI divergence, while ad-hoc suppression syntax creates unmonitored code quality debt.

Blocks:Unanchored Monorepo Extends, Missing VCS Git Anchoring, and Unexplained Suppression Pragmas
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-search-params-deferred-loaders
frontendcritical

TanStack Start SSR: Strict Search Param Validation, Non-Blocking Deferred Streaming, and Hydration Boundaries

Enforces schema-validated search parameters, non-blocking SSR execution using `defer()`, and strict `<Await>` boundary consumption in TanStack Start and TanStack Router fullstack applications. Prevents severe TTFB bottlenecks caused by waterfall loader promises and eliminates hydration mismatches arising from untyped query string parsing.

Blocks:Blocking Critical SSR TTFB on Slow Secondary Queries and Reading Untyped Query Parameters
Targets:Cursor•Claude•Windsurf•Codex
biome-config-inheritance-vcs-suppression-guardrail
frontendcritical

Biome 1.9 Deterministic Configuration, VCS Sync, and Rule Suppression Guardrail

Enforces strict configuration inheritance across monorepo boundaries, automated Git VCS ignore synchronization, and fully-qualified rule suppression syntax in Biome 1.9. Prevents silent lint drifts, duplicated ignore rule maintenance, and unanchored comment suppressions that mask security vulnerabilities and regressions.

Blocks:Unanchored Suppressions, Desynchronized Git Ignores, and Fractured Biome Configurations
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-inheritance-and-suppression-guardrails
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Alignment, and Deterministic Suppression

Enforces strict Biome 1.9 configuration architecture across mono- and poly-repositories. Mandates deterministic configuration inheritance via relative extends, automatic Git-ignore synchronization through vcs configuration blocks, and syntactically validated inline rule suppressions with mandatory justification clauses.

Blocks:Fragmented monorepo formatting, Git-divergent linting passes, and unreasoned or legacy ESLint/Prettier suppression comments.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-search-params-invariants
frontendcritical

TanStack Start SSR: Type-Safe Search Validation and Deferred Streaming Invariants

Enforces strict type safety for URL search parameters via schema validation, non-blocking SSR loaders with deferred streaming for slow promises, and deterministic hydration boundaries in TanStack Start. Prevents SSR waterfall bottlenecks, query parameter injection vulnerabilities, and hydration mismatch crashes.

Blocks:Unvalidated URL Search Params, Monolithic Blocking Loaders, and Missing Deferred Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-snippets-guardrails
frontendcritical

Svelte 5 Runes State Management, Pure Derivations, and Snippet Invariants

Enforces Svelte 5 fine-grained reactivity architecture using runes ($state, $derived, $effect, $props) and snippets. Prevents legacy Svelte 3/4 reactive declaration syntax, anti-pattern state synchronization via effects, and slot-based composition leaks in production systems.

Blocks:Mutating State Inside $effect for Computed Values and Retaining Legacy Let/Slot Syntax
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4-css-first-theme-directives-guardrail
frontendcritical

Mandating Tailwind CSS v4 CSS-First Theme Directives and Native Color Interpolation

Tailwind CSS v4 fully deprecates JavaScript-based configuration (`tailwind.config.js`) in favor of native CSS-first configuration via `@theme` directives and modern CSS variables. Engineering agents must enforce `@import "tailwindcss";`, replace legacy `@tailwind` directives, and map design tokens exclusively through CSS custom properties with native color space interpolation (OKLCH) instead of legacy hex-based opacity workarounds.

Blocks:Persisting tailwind.config.js and legacy @tailwind directives in Tailwind CSS v4 environments
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-vcs-suppression-standards
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Governance

Enforces deterministic Biome 1.9 configuration architecture utilizing native Git VCS ignore integration, monorepo config inheritance, and mandatory reasoned comment suppressions. Prevents untracked file pollution, rogue ignores, and configuration drift between local developer environments and CI pipelines.

Blocks:Unpinned Biome configurations omitting VCS ignore synchronization, legacy ESLint directives, and unreasoned rule suppressions.
Targets:Cursor•Claude•Windsurf•Codex
biome-19-config-vcs-suppression-standard
frontendcritical

Biome 1.9 Deterministic Configuration Inheritance, VCS Integration, and Structured Suppression

Enforces strict Biome 1.9 configuration standards across single-repository and monorepo architectures by requiring explicit Git VCS synchronization and deterministic configuration inheritance. Mandates machine-checkable, documented rationale for every lint rule suppression comment while eliminating redundant Prettier and ESLint legacy directives.

Blocks:Ad-hoc lint suppression without rationale, unlinked Git VCS ignore boundaries, and fragmented monolithic Biome configurations.
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transform-headless-reconciliation
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Meta Lexical operates on an immutable EditorState where nodes can only be mutated through explicit writable clones within active update batches. Failure to clone nodes via getWritable, unconstrained node transforms causing recursive reconciliation loops, and invoking DOM-dependent selection APIs in headless markdown pipelines cause silent state divergence and catastrophic server-side rendering crashes.

Blocks:Direct In-Memory Node Mutation, Infinite Transform Cascades, and DOM Selection Bleed in Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
biome-config-inheritance-vcs-suppression-standards
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Suppression

Enforces architectural standards for Biome 1.9 single-binary linter and formatter adoption across standalone and monorepo codebases. Mandates explicit Git VCS integration to prevent duplicated ignore manifests, structured configuration inheritance via the extends key, and strict inline suppression comment formatting with mandatory explanatory justifications.

Blocks:Legacy ESLint/Prettier suppressions, unlinked .gitignore definitions, and undocumented inline biome-ignore declarations.
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-transforms-and-serialization
frontendcritical

Lexical Copy-on-Write Node Mutation, Safe Transforms, and Headless Serialization

Enforces strict copy-on-write immutability via node.getWritable() within active editor transactions, guarantees selection preservation, and ensures headless Markdown serialization runs in an isolated, fully registered headless environment.

Blocks:Bypassing Copy-on-Write with In-Place Node Mutation or Unbounded Transform Recursion
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-config-inheritance-suppression-standard
frontendcritical

Biome 1.9 Deterministic Configuration, VCS Integration, and Suppression Standards

Enforces strict configuration inheritance, native Git VCS integration, and deterministic rule suppression syntax under Biome 1.9. Eliminates file-tree desynchronization between gitignore and Biome formatters while preventing undocumented or legacy ESLint suppressions.

Blocks:Unanchored ESLint Suppressions, Missing Suppression Reasons, and Desynchronized Git Ignore Trees
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-hydration-data-boundary-standard
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants

Enforces strict typegen contracts, single-fetch streaming boundaries, and correct clientLoader hydration mechanics in React Router 7 Framework Mode. Eliminates double-fetch penalties, serialization drift across the turbo-stream wire protocol, and SSR hydration mismatches.

Blocks:Bypassing Route Typegen, Misusing clientLoader.hydrate, and Emitting Legacy Remix defer() Primitives
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-headless-markdown-standard
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization

Mandates strict compliance with Lexical's copy-on-write model via getWritable(), idempotent node transforms to prevent infinite reconciliation cascades, defensive selection reconciliation during structural tree operations, and complete node/transformer registration for headless markdown serialization.

Blocks:Mutating frozen Lexical nodes directly, triggering infinite transform cascades without state checks, and running headless markdown export without registered AST nodes.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-start-ssr-streaming-invariants
frontendcritical

TanStack Start & Router: Enforcing Type-Safe Search Params, Loader Dependencies, and Deferred SSR Streaming

Enforces strict type safety and performance invariants for TanStack Start and Router across SSR hydration boundaries. Mandates runtime-validated search parameters with fallback defaults, explicit reactive loader dependencies via loaderDeps, and non-blocking streaming for slow data paths using defer() and Suspense.

Blocks:Unvalidated Raw Search Params, Missing loaderDeps Triggering Stale SSR State, and Monolithic Await Blocking Server TTFB
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-engine-transforms-and-serialization-guardrail
frontendcritical

Lexical Immutable Transforms, Selection Preservation, and Headless Serialization

Lexical relies on a dual-tree model where editor states are strictly immutable snapshots transformed exclusively via editor.update() transactions using writable node proxies ($getNodeByKey or .getWritable()). In headless and server-side contexts, markdown serialization, node transforms, and selection reconciliations must never mutate nodes outside an active update context or perform un-batched DOM-dependent operations, preventing memory leaks, corrupted historical branches, and collapsed selections.

Blocks:Mutating Lexical Nodes Directly Outside .getWritable() or Running Headless Transforms with DOM-Coupled Selection Methods
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-dynamic-measurement-scroll-containment
frontendcritical

TanStack Virtual 3.0 Dynamic Sizing and DOM Containment Architecture

Enforces deterministic dynamic measurement, strict overscan limits, and scroll margin containment in TanStack Virtual 3.0. Eliminates DOM node saturation, layout thrashing, and subpixel scroll-jitter in dense, large-scale virtualized tables and lists.

Blocks:Unbounded Overscan and Broken Dynamic Measurement Causing Layout Thrashing and Scroll Desync
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-reconciliation-headless
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation & Headless Serialization Invariants

Enforces strict compliance with Lexical's double-buffered copy-on-write immutability, deterministic selection reconciliation, and DOM-agnostic headless serialization. Mandates idempotent node transforms with loop guards, selection restoration across structural tree mutations, and isolation of DOM globals during headless Markdown transforms.

Blocks:Direct Node Mutation, Blind Selection Collapsing, and DOM-Dependent Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-windowing-containment-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Saturation Defense

Enforces strict DOM node containment, dynamic size estimation bounds, and transform isolation for TanStack Virtual v3 in massive data tables. Prevents layout thrashing, incorrect cumulative scroll offsets, and continuous unmeasured re-renders by enforcing stable dynamic measurement callbacks, scroll margin isolation, and CSS layout containment.

Blocks:Dynamic Element Re-measurement Jitter and DOM Flooding via Missing Keys, Unstable Estimators, and Uncontained Scroll Offsets
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-type-safe-search-and-streaming-ssr
frontendcritical

TanStack Start SSR: Type-Safe Search Validation, Loader Dependencies, and Deferred Streaming

Enforces strict type-safe search parameter validation, declarative loader caching via loaderDeps, and non-blocking deferred streaming in TanStack Start and Fullstack Router SSR. Failure to declare search dependencies leads to stale client navigation and hydration divergence, while awaiting non-critical promises directly in SSR loaders destroys Time-to-First-Byte (TTFB).

Blocks:Accessing unvalidated search params, omitting loaderDeps on query-driven loaders, and blocking SSR TTFB with un-deferred slow promises.
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-and-headless-serialization-production-standard
frontendcritical

Lexical Node Immutability, Transform Idempotency, and Headless Serialization Invariants

Enforces immutable clone semantics via node.getWritable() strictly inside editor.update() transactions, prevents infinite reconciliation cycles in registered node transforms, and guarantees headless document serialization mirrors client-side node schemas without DOM runtime leakage.

Blocks:Mutating internal node properties directly, inducing recursive transform loops, and dropping custom nodes during headless serialization.
Targets:Cursor•Claude•Windsurf•Codex
rr7-hydration-single-fetch-guardrail
frontendcritical

React Router 7 Framework Mode: Hydration Boundaries & Single-Fetch Invariants

Enforces deterministic hydration and data synchronization across React Router 7 Framework Mode route boundaries. Eliminates hydration mismatches, double-fetch waterfalls, and serialization de-optimizations caused by legacy Remix abstractions, uncoordinated clientLoader execution, and unpinned typegen contracts.

Blocks:Bypassing Route Typegen and Mishandling clientLoader Hydration Under Single-Fetch Streaming
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-inheritance-vcs-suppression
frontendcritical

Biome 1.9 Deterministic Configuration, VCS Integration, and Rule Suppression Guardrails

Enforces strict configuration ergonomics, VCS-aware file resolution, and deterministic inline suppression syntax in Biome 1.9. Prevents unindexed artifact evaluation, broken monorepo inheritance trees, and unreasoned lint suppressions.

Blocks:Ignoring VCS ignore files, omitting pinned schemas, and applying bare or unstructured lint suppressions.
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-hydration-single-fetch-boundary
frontendcritical

React Router 7 Framework Mode Hydration and Single-Fetch Typegen Boundary

Enforces strict adherence to React Router 7 framework-mode data loading, hydration boundaries, and type generation. Prevents hydration mismatches, duplicate fetches, and broken streaming states caused by legacy Remix primitives (json, defer) and improper clientLoader.hydrate configurations under turbo-stream single-fetch.

Blocks:Legacy Remix v2 Primitives and Unsynchronized clientLoader Hydration in React Router 7 Single-Fetch
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-windowing-performance-standard
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing & Scroll Margin Invariants

Enforces strict DOM node containment, dynamic measurement synchronization, and GPU-composited coordinate positioning in TanStack Virtual 3.0. Prevents layout thrashing, scroll jumping, and main-thread saturation across high-frequency mutations and massive data sets. Mandates stable element keys, memoized measurement callbacks, and calibrated overscan limits.

Blocks:Index-keyed measurement desynchronization and layout-thrashing positioning in dynamic virtualized tables.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-loader-guardrails-production-standard
frontendcritical

TanStack Start SSR Loaders, Type-Safe Search Validation, and Deferred Data Invariants

Mandates strict architectural standards for TanStack Start and TanStack Router fullstack SSR pipelines. Enforces schema-validated search params using runtime validators, prevents SSR TTFB blocking by obligating defer() for non-critical promises, and guarantees deterministic cache invalidation via explicit loaderDeps declarations.

Blocks:Blocking Critical SSR Streams with Un-deferred Async Loaders and Untyped Search Param Leaks
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-windowing-performance
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement and DOM Containment Architecture

Enforces zero-layout-shift dynamic measurement, CSS layout containment, and hardware-accelerated positioning in TanStack Virtual 3.0 implementations. Prevents catastrophic DOM node saturation, layout thrashing, and scroll jitter in massive dynamic tables.

Blocks:Layout-thrashing top/margin positioning, unbounded overscan, and uncontained dynamic measurement loops causing frame drops.
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-typegen-guardrails
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Data Boundaries

Enforces strict adherence to React Router 7 Framework Mode single-fetch architecture, generated route type boundaries, and streaming hydration invariants. Prevents hydration mismatches, data waterfall regressions, and broken SSR promise serialization caused by legacy Remix patterns.

Blocks:Bypassing Typegen with Deprecated json() Utilities and Misconfigured clientLoader.hydrate Triggers
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-headless-guardrails
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Enforces Lexical's copy-on-write immutability semantics, ensuring node mutations always route through $getWritable() within transactional editor.update() scopes. Mandates comprehensive node registration for headless markdown pipelines and strict selection preservation during asynchronous and batch AST transforms.

Blocks:Bypassing Lexical copy-on-write clone cycles and executing uncontained transforms that break selection and headless serialization
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-ssr-loader-streaming-guardrails
frontendcritical

TanStack Start & Router: Invariant Search Validation, SSR Loaders, and Deferred Streaming

Enforces strict runtime search param validation via Zod schemas, prevents SSR TTFB degradation through deterministic deferred data streaming, and mandates isomorphic server functions for full-stack data boundaries. Disallows unvalidated URL parsing, blocking non-critical promises in route loaders, and client-only state divergence during SSR hydration.

Blocks:Blocking SSR Hydration with Unvalidated Query Params and Synchronous Loader Waterfalls
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-loader-stream-standard
frontendcritical

TanStack Start SSR Loaders, Type-Safe Search Params & Deferred Streaming Invariants

Enforces strict type safety for TanStack Router search parameters via schema validators, mandates selective SSR streaming via defer() for slow promises to optimize TTFB, and requires server functions (createServerFn) to isolate backend execution and prevent client bundle pollution.

Blocks:Blocking SSR with un-deferred loader waterfalls and unvalidated search parameters causing hydration mismatches
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-framework-mode-hydration
frontendcritical

React Router 7 Framework Mode Hydration & Single-Fetch Invariants

Enforces strict conformance with React Router 7 Framework Mode single-fetch architecture, route module typegen, and turbo-stream hydration boundaries. Prevents hydration mismatches, broken deferred streaming pipelines, and clobbered server loader promises caused by legacy Remix abstractions.

Blocks:Invoking deprecated json()/defer() wrappers or executing clientLoader without preserving turbo-stream hydration boundaries
Targets:Cursor•Claude•Windsurf•Codex
biome-config-inheritance-and-deterministic-suppression
frontendcritical

Biome 1.9 Config Inheritance, VCS Alignment, and Deterministic Suppression

Enforces strict Biome 1.9 single-binary linter and formatter architectural invariants across repositories and monorepos. Mandates native VCS ignore synchronization, relative configuration inheritance via 'extends', and deterministic suppression syntax with obligatory audit explanations.

Blocks:Fragmented monorepo configs, unlinked gitignore definitions, and reasonless or legacy ESLint suppression comments.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-production-standard
frontendcritical

TanStack Start SSR Loaders, Type-Safe Search Params, and Deferred Streaming Standard

Enforces strict validation on route search parameters and mandates disciplined partitioning between critical SSR loader data and non-critical deferred streams. Prevents hydration mismatches, client-side execution leaks in server functions, and Time-to-First-Byte (TTFB) degradation caused by un-deferred blocking promises.

Blocks:Blocking SSR with Un-deferred Async Operations and Consuming Raw Untyped Search Params
Targets:Cursor•Claude•Windsurf•Codex
rr7-hydration-single-fetch-streaming-guardrail
frontendcritical

React Router 7 Typegen Route Hydration and Single-Fetch Streaming Boundaries

Enforces strict typegen module contracts, turbo-stream single-fetch data boundaries, and safe clientLoader hydration patterns in React Router 7 framework mode. Prevents hydration mismatches, double data fetching during hydration, and deprecated v2 defer/json abstractions.

Blocks:Using deprecated json()/defer() helpers and uncoordinated clientLoaders causing hydration waterfall flashes
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-config-inheritance-suppression-guardrail
frontendcritical

Deterministic Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Standards

Enforces strict configuration schema compliance for Biome 1.9 single-binary toolchains across monorepo architectures. Prevents non-deterministic linting and formatting regressions by mandating native VCS integration, explicit extends resolution paths, and structured inline suppression syntax with explanatory justifications.

Blocks:Ad-hoc ESLint/Prettier Hybrid Drift, Loose Global Ignores, and Unjustified Suppression Comments
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-loaders-deferred-streaming
frontendcritical

TanStack Start SSR Loaders, Search Schema Validation, and Deferred Streaming Invariants

Enforce end-to-end type safety, deterministic SSR hydration, and non-blocking streaming in TanStack Start and TanStack Router applications. Mandate runtime search parameter validation via schema parsers, critical vs. non-critical data segregation using `defer()`, and strict prohibition of browser-specific globals inside universal route loaders.

Blocks:Unvalidated route search parameters, un-deferred secondary fetches blocking SSR TTFB, and client-only global access during SSR loader execution.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-windowing
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Scroll Containment, and DOM Anti-Saturation Standard

Enforces strict DOM memory limits, stable element measurement lifecycles, and subpixel layout containment for TanStack Virtual v3 in high-density data grids. Prohibits unbounded overscanning, non-keyed virtual items, and unmeasured dynamic height mutations that destabilize scroll position or trigger ResizeObserver loops. Mandates explicit scroll margins, isolation of layout recalculations via CSS containment, and dynamic measurement through stable ref callbacks.

Blocks:Uncontained Dynamic Sizing, Naive Index Keys, and Unbounded Overscan in High-Frequency Virtualized Grids
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-guardrails-standard
frontendcritical

TanStack Start & Router SSR Type-Safe Search Params and Deferred Streaming Standard

Enforces strict type safety and architectural invariants across TanStack Start and Fullstack Router SSR lifecycles. Mandates Zod-validated search params via validateSearch, non-blocking SSR TTFB through TanStack defer() streaming, and proper isolation of server-only execution boundaries with createServerFn. Eliminates hydration mismatches, blocking waterfalls, and memory leaks during SSR data hydration.

Blocks:Unvalidated Search Params, Render-Blocking SSR Waterfall Loaders, and Leaked Server Secrets in Client Hydration
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-and-headless-serialization
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Enforces Lexical double-buffer immutability invariants during node transforms, prevents selection collapse during reconciliation, and guarantees deterministic headless Markdown serialization. Violations lead to corrupted EditorStates, out-of-sync DOM trees, SSR/Node runtime crashes, and cursor desynchronization.

Blocks:Direct In-Place Node Property Mutation and Window-Dependent Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-loader-search-params
frontendcritical

TanStack Start SSR Loaders, Streaming, and Type-Safe Search Params

Mandates end-to-end type safety for search params using standard schema validators, enforces non-blocking SSR via TanStack Router deferred data streaming, and guarantees deterministic hydration parity across client and server boundaries.

Blocks:Unvalidated search parameters, non-deferred slow SSR loaders, and non-serializable loader payloads causing hydration failure.
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-hydration-single-fetch-guard
frontendcritical

React Router 7 Framework Mode Hydration and Single-Fetch Typegen Boundary

Enforces strict hydration boundaries, Single Fetch turbo-stream execution contracts, and official route-level typegen in React Router 7 Framework Mode. Prohibits deprecated Remix defer() primitives, uncoordinated clientLoader.hydrate overrides, and manual loader type assertions that cause hydration mismatch crashes and network waterfalls.

Blocks:Corrupting Single-Fetch Hydration via Legacy defer() Wrappers and Uncoordinated clientLoader Overrides
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-windowing-performance
frontendcritical

TanStack Virtual 3.0 Windowing Performance & Dynamic Measurement Guardrails

Enforces strict DOM node containment, dynamic size measurement invariants, and scroll margin stabilization when virtualizing massive datasets with TanStack Virtual 3.0. Prevents forced reflow cascades, layout thrashing, incorrect virtual item caching, and DOM saturation across large tables and complex feed surfaces.

Blocks:Unmeasured Dynamic Row Resizing with Reactive Keys and Missing Absolute Containment
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-ssr-loaders-deferred-streaming
frontendcritical

TanStack Start Type-Safe Search, SSR Loaders, and Deferred Streaming Invariants

Enforces strict type-safe search parameter validation, parallel SSR route data fetching, and explicit promise deferral using defer() and <Await> boundaries in TanStack Start and Fullstack Router. Prevents TTFB degradation, hydration mismatches, client-server data leakage, and unhandled promise rejections during streaming SSR.

Blocks:Sequential SSR blocking waterfalls, unvalidated raw URL search access, and missing Suspense boundaries on deferred loader promises.
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transforms-and-serialization-guardrails
frontendcritical

Lexical Immutable Transforms, Selection Reconciliation & Headless Serialization

Lexical editor states are immutable directed acyclic graph (DAG) snapshots requiring strict transactional modifications via editor.update() and getWritable(). Flawed node transforms cause fatal infinite reconciliation loops and selection collapse, while headless markdown/SSR pipelines crash when custom AST transformers or node definitions fail to mirror browser runtime registries.

Blocks:Unbounded Node Transform Loops, Selection Nullification, and Unregistered Headless Serialization Drift
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-headless-serialization-standard
frontendcritical

Lexical Immutable Transforms, Selection Reconciliation & Headless Markdown Serialization

Enforces Lexical node immutability via getWritable state transitions, guarantees idempotent node transform cycles to avert infinite update loops, preserves selection reconciliation across DOM-free contexts, and mandates isomorphic schema registration for headless markdown pipelines.

Blocks:Mutating frozen LexicalNode references directly, invoking non-idempotent node transforms, and executing headless markdown serialization with mismatched node schemas or unchecked selections.
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-inheritance-and-deterministic-suppressions
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppressions

Enforces strict Biome 1.9 configuration architecture across monorepos and standalone repositories. Mandates native VCS ignore file synchronization, explicit configuration inheritance hierarchies via extends, and deterministic, fully-qualified suppression comments with mandatory explanatory text.

Blocks:Unannotated inline bypasses, orphaned .gitignore parity drift, and legacy ESLint/Prettier directive bleed-through.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-deferred-streaming-and-search-params
frontendcritical

TanStack Start SSR Deferred Streaming & Type-Safe Search Params Standard

Enforces strict type safety for URL search parameters via validateSearch schemas and non-blocking SSR execution via TanStack Router's defer and Await primitives. Prevents critical-path Time-To-First-Byte (TTFB) degradation and client-server hydration mismatches.

Blocks:Blocking Critical SSR Path with Un-deferred Loaders and Reading Untyped Search Params
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipelines-production-standard
frontendcritical

Hono JSX Non-Blocking Edge Streaming & Async Boundary Invariants

Enforces non-blocking asynchronous JSX streaming pipelines and strict error boundary handling on edge runtimes (Cloudflare Workers, Deno). Preempts memory bloat, compute-limit exhaustion, and mid-flight stream terminations by mandating renderToReadableStream with async Suspense boundaries and pre-stream header finalization.

Blocks:Buffering Asynchronous JSX trees into in-memory strings or mutating HTTP headers after stream initialization on edge isolates.
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-typegen-guardrail
frontendcritical

React Router 7 Framework Mode: Hydration, Single-Fetch, and Typegen Invariants

Enforces strict adherence to React Router 7 framework mode data architecture, mandating typegen imports via './+types/', prohibiting legacy json() and defer() wrappers in single-fetch mode, and ensuring accurate clientLoader hydration synchronization to eliminate SSR hydration mismatches.

Blocks:Using Legacy json()/defer() Wrappers and Manual useLoaderData Generics with Unsynchronized clientLoader Hydration
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-hydration-typegen-standard
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants

Enforces strict architectural boundaries for React Router 7 Framework Mode applications using Single Fetch. Mandates the use of generated route module types (+types), prevents hydration mismatches across server-to-client loader transitions, and guarantees correct streaming deferred data consumption via turbo-stream serialization.

Blocks:Bypassing Route Typegen, Misconfiguring clientLoader.hydrate, and Returning Legacy JSON Responses in Single Fetch
Targets:Cursor•Claude•Windsurf•Codex
rr7-framework-mode-hydration-single-fetch-guardrails
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants

Mandates strict adherence to React Router v7 Framework Mode data hydration and Single Fetch protocol invariants. Enforces route module type safety via generated './+types/*' virtual imports, eliminates deprecated json()/defer() abstractions in favor of naked object streaming, and strictly governs clientLoader.hydrate execution boundaries to prevent hydration mismatch flashes and dual-roundtrip performance cliffs.

Blocks:Bypassing Route Typegen, Returning Legacy json()/defer() Helpers, and Misconfiguring clientLoader Hydration Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipeline-architecture
frontendcritical

Hono JSX Edge Streaming Pipelines & Non-Blocking Response Composition

Mandates zero-buffer edge streaming for Hono JSX on Cloudflare Workers and Deno runtimes. Enforces non-blocking Time to First Byte (TTFB) chunk emission via Suspense and renderToReadableStream while preventing edge memory exhaustion and post-stream header mutation crashes.

Blocks:Full-Tree In-Memory HTML Buffering and Post-Stream Response Header Mutations
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-vcs-and-suppression-standards
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrail

Enforces strict Biome 1.9 single-binary formatting and linting standards across frontend and monorepo codebases. Requires unified VCS ignore synchronization to prevent CI/local drift and mandates deterministic rule suppressions with mandatory justification reasons. Prohibits legacy ESLint/Prettier directive bleed and ensures deterministic configuration inheritance.

Blocks:Deploying unanchored ignore comments without explanations, lingering ESLint directives, or uncoupled VCS ignore configs in Biome environments.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-search-params-invariant
frontendcritical

TanStack Start SSR: Type-Safe Search Params, Server Loaders, and Deferred Streaming

Enforces strict type safety for URL search parameters via schema validators, prevents SSR waterfalls through non-blocking deferred streaming, and guarantees proper server-client boundary isolation using server functions in TanStack Start and Router.

Blocks:Untyped search param access, blocking SSR waterfalls, and leaking server execution into client bundles.
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-inheritance-vcs-suppression-guardrail
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrails

Standardizes Biome 1.9 configuration architecture across monorepos and isolated services. Enforces explicit extends array resolution, native VCS git-client integration for dirty/staged formatting, and deterministic suppression syntax requiring mandatory technical justifications.

Blocks:Ad-Hoc Suppressions, Unanchored Root Configs, and Broken Monorepo Tooling Interop
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-dynamic-containment-guardrail
frontendcritical

TanStack Virtual 3.0 Dynamic Sizing & DOM Containment Standards

Mandates zero-jitter dynamic element measurement, hardware-accelerated transforms, and bounded overscan budgets for TanStack Virtual v3 in high-density tables. Enforces strict viewport container isolation, stable item keying, and precise ref callback bindings to eliminate layout thrashing and DOM node saturation.

Blocks:Uncontained Dynamic Sizing with Non-Accelerated Offsets Leading to Scroll Jitter and DOM Saturation
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-and-snippets-standard
frontendcritical

Svelte 5 Runes Invariant: Fine-Grained Reactivity and Snippet Composition

Enforces architectural invariants for Svelte 5 runes ($state, $derived, $props, $effect) and snippet composition. Prevents reactivity severing caused by destructuring reactive proxies, completely eliminates legacy Svelte 3/4 reactivity paradigms (export let, $:, <slot />), and bans side-effect synchronization antipatterns in $effect.

Blocks:Reactivity severing through proxy destructuring and derived-state synchronization inside $effect
Targets:Cursor•Claude•Windsurf•Codex
react-router-v7-framework-hydration-boundaries
frontendcritical

React Router 7 Framework Mode Hydration, Typegen, and Single-Fetch Invariants

Enforces strict data boundaries, Single Fetch serialization, and typegen alignment in React Router 7 framework mode. Prevents hydration mismatches, double-fetching cascades, and clientLoader desynchronization when streaming deferred promises across SSR and client navigations.

Blocks:Bypassing Typegen Route Module Types and Misconfiguring clientLoader.hydrate with Defer Streams
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-inheritance-suppression-guardrail-production-standard
frontendcritical

Biome 1.9 Configuration Inheritance, Native VCS Filtering, and Deterministic Rule Suppression

Enforces strict Biome 1.9+ architectural standards across monorepos and frontend targets. Mandates deterministic configuration inheritance via canonical extends paths, native Git ignore integration using the VCS engine to eliminate dual-maintenance ignore lists, and syntax-compliant inline suppressions requiring fully-qualified rule names with human-readable rationale.

Blocks:Fragmented ignore arrays, missing VCS integration, and ambiguous or ESLint-legacy inline suppressions that cause CI drift.
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-config-vcs-deterministic-suppression
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Deterministic Rule Suppression

Enforces deterministic configuration inheritance, native Git VCS boundary synchronization, and strictly justified inline suppressions in Biome 1.9. Prevents CI pipeline failures, configuration drift in monorepos, and silent suppression rot caused by legacy ESLint comment patterns.

Blocks:Applying Unjustified Legacy ESLint Suppressions and Misconfiguring Monorepo Biome VCS Inheritance
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-serialization-guardrails
frontendcritical

Lexical Immutable Node Transforms, Selection Preservation, and Headless Serialization Invariants

Enforces strict compliance with Meta Lexical's copy-on-write immutability, selection reconciliation invariants, and headless serialization execution contexts. Prevents infinite transform recursion, dirty state desynchronization, DOM selection collapse, and headless node registry mismatches.

Blocks:Mutating Lexical Nodes Directly, Unconditional Transform Recursion, and Unscoped Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-invariants
frontendcritical

TanStack Start & Router SSR: Type-Safe Search Params, Loaders, and Streaming Invariants

Enforces strict type safety for search params via validation schemas, prohibits blocking SSR waterfalls by mandating deferred promise streaming for non-critical assets, and eliminates hydration mismatches in TanStack Start full-stack routes. Guarantees zero runtime search parameter divergence and deterministic server-side rendering execution.

Blocks:Unvalidated search params, blocking data waterfalls in SSR loaders, and raw client-side state reads during initial hydration.
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-engine-transforms-and-reconciliation
frontendcritical

Lexical Headless Node Mutability, Transform Lifecycles, and Selection Invariants

Enforces proper immutability semantics, node mutation lifecycles, and selection reconciliation within headless Lexical editor pipelines. Prohibits direct property mutation, external modifications outside editor.update closures, and unmanaged selection resets during headless markdown serialization and deserialization.

Blocks:Direct In-Place Node Property Mutation and Unmanaged Selection Collapse During Headless Transforms
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-suppression-deterministic-config
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Deterministic Suppression

Enforces strict Biome 1.9 configuration governance across monorepos and standalone repositories using schema pinning, declarative VCS ignore syncing, and deterministic rule suppression syntax. Mandates exact suppression target specifiers with required inline human rationales while forbidding legacy ESLint/Prettier annotations.

Blocks:Unexplained Global Lint Disables, Missing Git VCS Ignore Sync, and Legacy Linter Annotations
Targets:Cursor•Claude•Windsurf•Codex
rr7-hydration-single-fetch-typegen-standard
frontendcritical

React Router 7 Framework Mode: Hydration, ClientLoader Streaming, and Typegen Boundaries

Enforces strict adherence to React Router 7 framework mode hydration invariants, including single-fetch data boundaries and typegen contracts. Prevents duplicate network waterfalls, turbo-stream hydration mismatches, and cache desynchronization caused by improper clientLoader hydration flags and decoupled types.

Blocks:Bypassing Route Module Typegen and Misconfiguring clientLoader.hydrate During Single-Fetch Streaming
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-deferred-streaming-guardrail
frontendcritical

TanStack Start & Router SSR: Type-Safe Search Params & Deferred Data Streaming Invariants

Enforces strict type safety and streaming invariants in TanStack Start and Fullstack TanStack Router. Mandates deterministic search parameter validation via schema adapters, prevents TTFB degradation by requiring non-critical loader data to be deferred via defer() and wrapped in Suspense/Await, and prohibits untyped client-side location parsing during SSR hydration.

Blocks:Blocking Critical Path TTFB with Un-deferred Async Loaders and Untyped Search Param Extraction
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-inheritance-vcs-suppression-standard
frontendcritical

Deterministic Configuration Inheritance, VCS Synchronization, and Rule Suppression in Biome 1.9

Mandates explicit Biome 1.9 configuration architecture across monorepos using deterministic extends chains, guarantees file discovery synchronization via native VCS integration (vcs.useIgnoreFile), and enforces auditable, fully-qualified suppression comments with required explanations. Eliminates monorepo configuration drift, duplicate ignore matrices, and silent lint bypasses.

Blocks:Unanchored Ignore Lists, Legacy ESLint Directives, and Reason-Free Suppressions
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-vcs-inheritance-suppression-guardrails
frontendcritical

Biome 1.9 Invariants: Configuration Inheritance, VCS Sync, and Deterministic Suppressions

Enforces deterministic linting and formatting invariants for Biome 1.9 across monorepos and frontend packages. Requires explicit VCS integration with Git ignore parity, validated configuration inheritance graphs, and strictly reasoned inline suppression syntax adhering to the 'biome-ignore <category>/<rule>: <rationale>' standard.

Blocks:Unchecked artifact parsing from unlinked VCS ignores and unstructured, unreasoned inline suppressions.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-router-ssr-streaming-guardrails
frontendcritical

TanStack Start SSR Loaders, Type-Safe Search Params & Deferred Streaming

Mandates runtime-validated search parameters via validateSearch, non-blocking SSR streaming via defer() for slow promises, and strict separation between critical SEO state and deferred client payloads. Prevents SSR waterfall bottlenecks, hydration mismatches, and untyped query injection in TanStack Start applications.

Blocks:Blocking Initial SSR Streams with Un-deferred Promises and Unvalidated Query Parameters
Targets:Cursor•Claude•Windsurf•Codex
biome-1-9-monorepo-vcs-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Governance

Enforces strict configuration inheritance, Git-aware VCS boundary enforcement, and deterministic suppression syntax using Biome 1.9+. Prevents lint regressions across monorepos, invalid suppression comments, and untracked code formatting drifts by enforcing exact schema pinning and mandatory explanation keys in lint suppressions.

Blocks:Unpinned Biome Configurations, Missing VCS Boundaries, and Undocumented Global Comment Suppressions
Targets:Cursor•Claude•Windsurf•Codex
react-router-v7-hydration-typegen-guardrail
frontendcritical

React Router 7 Framework Mode Hydration, Typegen & Data Boundary Invariants

Enforces strict type safety and hydration boundaries in React Router 7 framework mode with Single Fetch enabled. Mandates the use of generated Route types from `./+types/*`, prohibits unawaited clientLoader overrides that break server-to-client streaming, and prevents hydration mismatches caused by leaking server-exclusive Single Fetch primitives into client bundles.

Blocks:Bypassing Route Typegen, Misconfiguring clientLoader.hydrate, and Breaking Single Fetch Stream Serialization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-snippets-invariant
frontendcritical

Svelte 5 Runes Reactivity, State Proxies, and Snippets Architecture

Enforces proper utilization of Svelte 5 runes ($state, $derived, $effect, $props) and Snippets, preventing legacy Svelte 3/4 reactivity leaks. Guarantees signals and proxy integrity by prohibiting side-effect-driven state synchronization, proxy destructuring pitfalls, and obsolete slot mechanisms.

Blocks:Mutating State in Effects, Destructuring Proxy State, and Retaining Svelte 3/4 Legacy Patterns
Targets:Cursor•Claude•Windsurf•Codex
biome-vcs-inheritance-deterministic-suppression-standard
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Strict Rule Suppression Standard

Enforces deterministic formatting and linting architecture via Biome 1.9 single-binary tooling across enterprise monorepos. Mandates standardized VCS ignore synchronization, centralized configuration inheritance, and fully qualified, documented suppression comments. Eliminates configuration drift, unignored build artifact pollution, and undocumented lint bypasses in CI/CD pipelines.

Blocks:Ad-hoc ESLint-style suppressions, detached .gitignore parsing, and fragmented monorepo Biome configurations.
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-reconciliation
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Enforces strict immutability invariants, non-recursive node transforms, and deterministic selection restoration within Lexical document engines. Mandates explicit writable cloning via $getNodeByKey and getWritable() during editor updates and guarantees headless serialization pipelines initialize comprehensive node registries within isolated read closures.

Blocks:Mutating read-only Lexical nodes directly or triggering cascading transform loops with lost selection anchors during headless document processing.
Targets:Cursor•Claude•Windsurf•Codex
react-router-7-framework-hydration-boundaries
frontendcritical

React Router 7 Framework Hydration, Single Fetch, and Route Typegen Invariants

Enforces architectural boundaries for React Router 7 Framework Mode, specifically governing single-fetch serialization, clientLoader hydration orchestration, and strict route module typegen consumption. Prevents double-fetching cascades, turbo-stream hydration mismatches, and broken client-side streaming topologies.

Blocks:Bypassing Route Typegen, Misusing clientLoader.hydrate Without serverLoader(), or Returning Legacy json()/defer() Under Single-Fetch
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-windowing-performance-guardrails
frontendcritical

TanStack Virtual 3.0 Dynamic Measurement, Key Containment, and DOM Saturation Defense

Mandates strict performance invariants for TanStack Virtual 3.0 in massive datasets and tables. Enforces stable key identification, sub-pixel composite transforms over layout-thrashing positioning, explicit dynamic element measurement contracts via data-index, and rigid bounds on overscan to prevent DOM node saturation and ResizeObserver loop limit exhaustion.

Blocks:Index-keyed dynamic row virtualization without data-index measurement contracts, unbounded overscan, and layout-thrashing top-offset positioning.
Targets:Cursor•Claude•Windsurf•Codex
biome-v1-9-config-vcs-suppression-guardrail
frontendcritical

Biome 1.9 Configuration Inheritance, VCS Integration, and Suppression Guardrail

Enforces strict configuration architecture for Biome v1.9+ across monorepos and standalone repositories. Prevents configuration drift by mandating deterministic extends arrays, strict git-backed VCS integration to respect ignore files, and exact inline suppression comment formatting with mandatory rationales.

Blocks:Unpinned Config Inheritance, Unlinked VCS Ignores, and Naked Inline Suppressions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-search-validation
frontendcritical

Mandatory Type-Safe Search Validation, Non-Blocking SSR Loaders, and Deferred Streaming in TanStack Start

Enforces strict type safety and streaming invariants across TanStack Start routes. Every route consuming URL search parameters must declare a runtime-validated schema via validateSearch, and loaders must partition critical SSR data from non-critical promises using defer() paired with Suspense boundaries to protect server TTFB and prevent hydration mismatches.

Blocks:Blocking Server Render Streams with Synchronous Loader Awaits and Untyped Query Parsing
Targets:Cursor•Claude•Windsurf•Codex
tanstack-virtual-v3-performance-containment
frontendcritical

TanStack Virtual 3.0 Dynamic Windowing & Scroll Containment Standard

Enforces strict DOM node containment, element measurement caching, and continuous scroll margin preservation for massive data grids using TanStack Virtual v3. Prevents layout thrashing, DOM node saturation, and measurement jitter during high-velocity scrolling by requiring deterministic item keys, CSS contain properties, and explicit scroll margin offsets. Mandates hardware-accelerated transform positioning over direct offset mutations.

Blocks:Uncached dynamic element re-measurements causing layout thrashing and DOM node explosion in continuous virtualization containers
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-serialization-standard
frontendcritical

Lexical Headless Engine: Immutable Node Transforms, Selection Invariants, and Markdown Serialization

Lexical relies on an immutable double-buffered AST where node mutations require an active EditorState transaction via getWritable(). Violating node immutability, bypassing selection reconciliation after structural AST mutations, or executing headless Markdown serialization without registered node transformers triggers silent state desynchronization, infinite transform loops, and collapsed cursor bugs in headless and browser environments.

Blocks:Mutating Lexical AST Nodes Directly Outside getWritable() and Invoking Unsafe Headless Serialization Without Selection Restoration
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-node-transforms-and-headless-markdown
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation & Headless Serialization

Enforces strict Lexical AST immutability invariants via this.getWritable() inside active update batches, prevents selection reconciliation collapse across asynchronous boundaries, and standardizes headless server-side markdown parsing and serialization without DOM leakages.

Blocks:Direct Node Property Mutation and Asynchronous Selection Leakage in Headless Pipelines
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-loader-streaming-guardrail
frontendcritical

TanStack Start SSR Loaders, Type-Safe Search Params, and Deferred Streaming Standard

Enforces strict type-safe search parameter validation using schema validators, mandates clear separation between critical render-blocking data and deferred streaming promises in SSR loaders, and isolates server operations via createServerFn. This prevents hydration mismatches, client-bundle server secret leaks, and severe TTFB degradation during server-side rendering.

Blocks:Blocking SSR pipelines with un-deferred waterfalls, unvalidated raw URL queries, and client-leaked server data fetching.
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-transforms-and-selection-invariants
frontendcritical

Lexical Immutable Transforms, Selection Reconciliation & Headless Markdown Invariants

Enforces strict immutability protocols, transform loop prevention, and selection-preserving node reconciliations across Lexical editor implementations. Guarantees deterministic serialization between headless server environments and interactive browser client states without DOM leakage or reconciliation crashes.

Blocks:Mutating Frozen Nodes Outside Writable Clones, Triggering Transform Feedback Loops, and Leaking DOM APIs into Headless Pipelines
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-and-headless-markdown-serialization
frontendcritical

Lexical Immutable Transforms, Selection Reconciliation, and Headless Markdown Serialization

Enforces strict immutability semantics, correct node writable lifecycles, and headless selection-safe transforms within Meta Lexical. Prohibits out-of-context node mutations, infinite transform cascades, and DOM-dependent markdown serialization during headless or server-side workflows.

Blocks:Mutating Unwritable Lexical Nodes and Invoking DOM-Dependent Markdown Exporters in Headless Runtime Loops
Targets:Cursor•Claude•Windsurf•Codex
react-router-v7-framework-hydration-single-fetch-production-standard
frontendcritical

React Router 7 Framework Mode Hydration and Single-Fetch Invariants

Enforces strict typegen route module typing, turbo-stream native serialization, and explicit clientLoader hydration boundaries in React Router 7 Framework Mode. Prevents hydration mismatch bugs, duplicate network roundtrips, and stream serialization breakage caused by legacy Remix v2 patterns like json() wrappers and manual generic types.

Blocks:Unsafe clientLoader Hydration Overrides and Legacy json() Wrappers Breaking Single Fetch Serialization
Targets:Cursor•Claude•Windsurf•Codex
hono-jsx-edge-stream-pipeline-standards
frontendcritical

Hono JSX Edge Streaming Pipeline & Response Composition Standards

Enforces non-blocking HTTP streaming architectures when rendering Hono JSX across distributed edge runtimes (Cloudflare Workers, Deno). Mandates strict isolation of header mutations prior to stream emission, explicit Suspense boundary usage with renderToReadableStream, and deterministic propagation of client abort signals to prevent worker memory leaks.

Blocks:Buffering Dynamic JSX Trees In-Memory and Mutating Headers Post-Stream Initiation
Targets:Cursor•Claude•Windsurf•Codex
lexical-node-transforms-selection-headless-standard
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization

Lexical enforces strict double-buffered immutability where nodes in an active EditorState are frozen and can only be modified through getWritable() within an update transaction. Violating transform idempotency causes catastrophic infinite reconciliation loops, while unmanaged selection points or DOM-dependent markdown transformers break headless pipelines and corrupt the document model.

Blocks:Mutating frozen LexicalNode instances directly or triggering infinite transform cycles during headless document reconciliation.
Targets:Cursor•Claude•Windsurf•Codex
biome-configuration-vcs-suppression-invariants
frontendcritical

Biome 1.9 Strict Configuration Inheritance, VCS Integration, and Explicit Rule Suppression Guardrails

Mandate deterministic Biome 1.9 configuration architecture across monorepos and standalone repositories using JSONC schema validation, VCS-aware file resolution (`useIgnoreFile: true`), and strictly qualified suppression comments with mandatory explanatory rationale (`// biome-ignore group/rule: rationale`). Prevent configuration drift, CI linting discrepancies, and non-deterministic ignore behavior.

Blocks:Malformed In-Source Suppressions, Missing VCS-Aware Ignore Coupling, and Non-Standard Configuration Splitting
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-reactivity-snippets-invariant
frontendcritical

Svelte 5 Runes Reactivity, State Encapsulation, and Snippets Invariant

Enforces deterministic state synchronization and composability in Svelte 5 using the runes reactive engine ($state, $derived, $props, $effect) and snippets. Prohibits mixing legacy Svelte 3/4 reactivity paradigms (e.g., export let, $:, <slot />) and prevents reactivity breakage caused by primitive destructuring or mutating derived values.

Blocks:Mixing legacy Svelte 3/4 reactivity with Svelte 5 runes and breaking reactive proxies via primitive destructuring or derived mutations.
Targets:Cursor•Claude•Windsurf•Codex
lexical-headless-transforms-and-serialization-invariants
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Markdown Serialization Guardrails

Lexical document state trees are strictly immutable outside transaction boundaries, requiring node mutations to route through atomic write buffers via getWritable() within editor updates. Headless markdown serialization and transform loops must maintain strict idempotency and registered node parity to prevent infinite dirty-cycle re-renders, cursor desynchronization, and server-side DOM leakage.

Blocks:Direct Node Mutation, Infinite Transform dirty Loops, and Unregistered Headless Markdown Deserialization
Targets:Cursor•Claude•Windsurf•Codex
lexical-immutable-transform-headless-reconciliation-standard
frontendcritical

Lexical Immutable Node Transforms, Selection Reconciliation, and Headless Serialization Standard

Meta Lexical enforces strict immutability across EditorState lifecycles via copy-on-write structural sharing; mutating node instances directly without invoking `node.getWritable()` bypasses the dirty-node tracking queue and corrupts history reconciliation. Furthermore, triggering recursive `editor.update()` calls within registered node transforms induces infinite transform loops, while serializing markdown without an explicitly configured headless editor context leads to node stripping and corrupted AST reconstruction. All editor modifications must occur through writable proxies within update/transform boundaries, preserving selection indices across synthetic passes.

Blocks:Direct Lexical Node Mutation, Nested Transform Updates, and Unregistered Headless Serialization
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-loader-streaming-invariant
frontendcritical

TanStack Start SSR: Type-Safe Search Validation, Deferred Streaming, and Server Functions

Enforces strict type-safe search param validation, non-blocking SSR data streaming, and safe server RPC execution in TanStack Start and Fullstack Router. Prevents blocking time-to-first-byte (TTFB), runtime type coercion crashes, hydration mismatches, and accidental leakage of server-only logic into client bundles.

Blocks:Blocking full-page SSR with sequential loader waterfalls and unvalidated search parameter parsing.
Targets:Cursor•Claude•Windsurf•Codex
rr7-hydration-single-fetch-streaming-standard
frontendcritical

React Router 7 Framework Mode: Hydration, Single-Fetch, and Route Typegen Invariants

Enforces strict React Router 7 framework mode invariants across route module typegen, Single Fetch serialization boundaries, and clientLoader hydration lifecycles. Prevents hydration mismatches, broken turbo-stream serialization, and redundant network roundtrips caused by legacy Remix v2 primitives.

Blocks:Hydration mismatches, waterfall stalls, and broken serialization caused by legacy json/defer primitives and untyped clientLoader boundaries in React Router 7.
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-state-isolation
frontendcritical

Nuxt 4 Nitro Engine Isolation and Shared Directory Boundary Enforcement

Enforces strict boundary separation between Nitro server execution, client hydration, and Nuxt 4's restructured app/ and shared/ directories. Prohibits global module-level mutable state in Nitro handlers to prevent cross-request SSR memory leaks and tenant data contamination.

Blocks:Cross-Request State Bleed and Illegal Module Imports Across Nitro Server and Client Boundaries
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-async-boundaries
frontendcritical

SolidStart 1.0 server$ RPC & Async Boundary Reactive Isolation Standard

Enforces strict isolation between fine-grained reactive client signals and SolidStart 1.0 server$ RPC boundaries. Prevents signal serialization failures, hydration deadlocks, and silent reactivity loss across the wire by mandating cache(), createAsync, and explicit boundary serialization.

Blocks:Invoking server$ directly within createEffect or capturing reactive signals inside server$ closures
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-isolation
frontendcritical

Nuxt 4 Nitro Server Engine & Shared Directory State Isolation Standard

Enforces strict boundary isolation between Nuxt 4's app/, server/, and shared/ directories. Prohibits module-level mutable state in Nitro v2 server routes and Vue composables to prevent cross-request SSR state leaks and ensures zero-bleed isomorphic contracts.

Blocks:Leaking module-scoped mutable state across concurrent SSR requests and cross-importing Nitro server internals into Nuxt app context.
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-functions-async-boundaries-guardrail
frontendcritical

SolidStart 1.0 Server Functions (server$) and Fine-Grained Reactive Boundaries

SolidStart 1.0 utilizes Vinxi-driven compilation to transform `server$` calls into JSON RPC endpoints, executing purely on the server while client-side signals remain isolated to the client runtime. Engineers must never close over client-side reactive primitives (signals, stores, memo hooks) inside `server$` bodies, nor expose unvalidated inputs across serialized RPC invocations. Furthermore, asynchronous server data transitions must be coordinated with `cache`, `createAsync`, and `Suspense` rather than embedding manual async effects inside component render scopes.

Blocks:Closing Over Client Signals in server$ Closures or Calling Async RPCs Inside Untracked Reactive Render Loops
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-functions-async-boundaries
frontendcritical

SolidStart 1.0 server$ RPC & Async Boundary Reactive Isolation

Enforces strict structural boundaries between Solid's fine-grained client reactivity and SolidStart 1.0 Vinxi server$ RPC execution contexts. Eliminates closure captures across RPC boundaries, prevents direct raw server calls in tracking contexts, and mandates type-safe serialization with createAsync and query/cache primitives.

Blocks:Closing over client signals inside server$ functions and triggering un-cached RPCs in reactive tracking scopes
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-isolation-standard
frontendcritical

Nuxt 4 Nitro Engine Boundary, Shared Directory Isolation, and SSR State Hydration Invariants

Enforces strict architectural boundaries across Nuxt 4 app/, server/, and shared/ directories. Eliminates cross-request state pollution in Nitro v2 server handlers and guarantees deterministic SSR state hydration without runtime secret leaks.

Blocks:Cross-Request State Contamination, Server Leakage in Shared Directory, and Hydration Mismatches via Module-Scoped State
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-isolation-guardrail
frontendcritical

Nuxt 4 Nitro Server Isolation, App Reorganization, and SSR Hydration Standard

Enforces strict boundary separation between Nuxt 4 app/ runtime, Nitro server engine, and shared/ utilities. Prohibits global state pollution across concurrent SSR requests and eliminates cross-boundary imports between server and client domains.

Blocks:Global Node Module State Leaks Across SSR Requests and Cross-Boundary Nitro Module Imports
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-ssr-isolation
frontendcritical

Nuxt 4 Nitro Server Engine & Shared Directory Architectural Isolation Guardrail

Enforces strict boundary separation between Nuxt 4 app/ directory, Nitro server engine, and shared/ utilities. Prevents cross-context contamination, server-side memory leaks from module-scoped mutable state, and SSR hydration mismatches caused by non-serializable or un-isolated runtime references.

Blocks:Cross-boundary module imports and global state leakage across concurrent SSR requests in Nuxt 4/Nitro
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-isolation
frontendcritical

Nuxt 4 Directory Boundaries and Nitro Cross-Request State Isolation

Enforces architectural boundaries between Nuxt 4 app/, server/, and shared/ directories to eliminate cross-request memory contamination and hydration mismatches. Mandates pure runtime-agnostic code in shared/ and strictly isolates per-request state in Nitro handlers using H3 event context.

Blocks:Cross-Request State Contamination via Module-Level Nitro State and Invalid Shared Imports
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-async-boundary-guardrail
frontendcritical

SolidStart 1.0 Server Functions and Async Boundary Reactive Invariants

Enforces strict isolation boundaries for SolidStart 1.0 server$ RPC functions by prohibiting lexical capture of client signals and ensuring serializable parameter passing. Mandates the use of createAsync wrapped in Suspense boundaries to maintain fine-grained reactive synchronization across network boundaries without hydration mismatch or memory leaks.

Blocks:Lexically Capturing Client Signals Within server$ Closures and Calling Async RPCs Outside Solid Reactive Primitives
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-state-isolation
frontendcritical

Nuxt 4 Nitro Engine, Shared Directory Architecture, and SSR Hydration Isolation

Nuxt 4 enforces strict separation between the Vue application runtime (app/), the Nitro server engine (server/), and isomorphic code (shared/). Module-level mutable singletons, cross-boundary lifecycle leakage, and improper SSR state hydration cause severe cross-request memory corruption, data leaks across concurrent tenant sessions, and irreversible hydration mismatches.

Blocks:Cross-Request State Poisoning via Module-Scope Variables in Nitro Handlers and Leaky Shared Boundaries
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-functions-async-boundary-guardrail
frontendcritical

SolidStart 1.0 Server Functions and Async Boundary Invariants

Enforces strict isolation of reactive state and runtime boundaries across SolidStart server$ RPC calls and async primitives. Prevents client-side lexical scope leakage into server environments, serialization bugs, and broken fine-grained reactivity when bridging signals with asynchronous RPC executions.

Blocks:Capturing Reactive Signals Directly in server$ Lexical Closures or Destructuring Async Responses Outside Suspense Contexts
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-isolation-standard
frontendcritical

Nuxt 4 Directory Restructuring, Nitro Isolation, and SSR State Hydration Guardrails

Enforces strict boundary separation between Nuxt 4 app/ frontend execution context, Nitro v2 server runtime, and the shared/ directory. Eliminates cross-request state pollution, server-side prototype leaks, and client bundle contamination by mandating per-request state instantiation and runtime-agnostic shared utilities.

Blocks:Global Mutable State in Nitro Handlers and Direct Server Import into Nuxt 4 App Code
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-ssr-isolation-guardrail
frontendcritical

Nuxt 4 Nitro Server Engine & Shared State Isolation Standards

Enforces strict boundary separation between Nuxt 4 app/, server/, and shared/ directories to prevent cross-request state contamination and SSR hydration leaks. Mandates per-request context isolation in Nitro v2 event handlers and strictly forbids module-level mutable state across universal modules.

Blocks:Cross-Request State Contamination via Global Nitro Variables and Server Leakage in Shared Directory
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-async-boundary-guardrail
frontendcritical

SolidStart 1.0 Server Function Isolation & Async Boundary Invariants

Enforces strict serialization and reactivity boundaries across SolidStart server$ RPC calls and client signals. Prohibits closing over client-side reactive state within server$ functions and mandates wrapping server invocations with createAsync to preserve fine-grained Suspense coordination.

Blocks:Closing Over Client Signals in server$ RPCs and Uncoordinated Async JSX Evaluation
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-isolation
frontendcritical

Nuxt 4 Nitro Server Engine Isolation & Shared Directory State Guardrails

Nuxt 4 restructures application architecture by placing userland Vue code inside 'app/' while running server code via Nitro under 'server/'. Cross-boundary imports, direct Node.js runtime imports in the 'shared/' directory, and global module-level mutable state in Nitro handlers cause cross-request state pollution, SSR hydration mismatches, and build failures across non-Node deployment runtimes.

Blocks:Cross-Request State Contamination via Global Nitro Variables and Unsafe Shared Directory Runtime Imports
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-async-boundary-invariants
frontendcritical

SolidStart 1.0 server$ RPC Serialization & Async Boundary Invariants

Enforces rigid separation between SolidJS client reactive tracking scopes and SolidStart 1.0 server$ RPC functions. Mandates wrapping server RPC calls within createAsync or action primitives, preventing lexical closure over client signals inside server-bound functions and requiring explicit Suspense boundaries for all asynchronous resource states.

Blocks:Closing Over Reactive Signals in server$ Lexical Scopes or Executing Naked RPCs in Tracking Contexts
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-state-guardrail
frontendcritical

Nuxt 4 Nitro Server Engine Isolation and Shared Directory Hydration Standard

Enforces strict isolation between Nitro v2 server execution contexts, the Nuxt 4 `app/` client directory, and the root `shared/` directory. Prevents catastrophic cross-request state pollution in Node/Worker runtimes and guarantees deterministic SSR hydration by eliminating global mutable singletons and unauthorized server import leakage.

Blocks:Global Module-Level State Pollution and Illegal Server-Client Import Leaks in Nuxt 4
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-functions-async-boundaries-standard
frontendcritical

SolidStart 1.0 Server Functions (server$) & Async Reactive Boundaries

Enforces strict isolation between SolidJS fine-grained client reactivity and SolidStart 1.0 server$ RPC serialization boundaries. Prohibits naked server invocations inside synchronous tracking scopes, accidental signal closure leaks into server execution contexts, and unhandled async streaming states across client-server transitions.

Blocks:Executing naked server$ RPCs inside reactive tracking scopes and passing reactive accessors into serialized payloads.
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-async-boundaries-standard
frontendcritical

SolidStart 1.0 Server Functions (server$) & Async Boundary Integrity

Enforces strict isolation between client-side reactive tracking scopes and SolidStart 1.0 server$ RPC functions. Mandates explicit parameter serialization, createAsync wrapping, and deterministic Suspense boundaries to eliminate SSR-client hydration mismatches and illegal reactive closure escapes.

Blocks:Executing server$ RPCs inside client createEffect hooks or dereferencing reactive signals within server-executed function bodies.
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-async-boundary-standard
frontendcritical

Enforcing SolidStart 1.0 server$ RPC Isolation and createAsync Boundaries

SolidStart server functions (`server$`) create isolated RPC endpoints that execute strictly on the server and must not capture client-side reactive scope closures. Reactive client signals consumed by server functions must be explicitly passed as serialized arguments, and all resulting async promises must resolve through `createAsync` or action utilities within `<Suspense>` boundaries to preserve fine-grained reactivity and prevent hydration mismatches.

Blocks:Capturing Client Signals in server$ Closures or Calling server$ Unwrapped in Reactive Tracking Scopes
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-functions-and-async-boundaries
frontendcritical

SolidStart 1.0 Server Functions (`server$`) & Async Boundary Invariants

Enforces strict isolation between client reactive signals and SolidStart 1.0 `server$` RPC functions across network boundaries. Prevents non-serializable closure captures, client-side secret leakage, and broken fine-grained reactivity when bridging `createResource` or async primitives with server-side executions.

Blocks:Capturing Reactive Client Signals in server$ Closures or Omitting createResource/Suspense Async Boundaries
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-boundary-serialization
frontendcritical

SolidStart 1.0 server$ RPC Boundaries & Fine-Grained Reactive Decoupling

Enforces strict isolation between client-side SolidJS fine-grained reactive scopes and Vinxi-compiled server$ RPC endpoints. Prevents closure state leakage, unhandled async tracking breaks, non-serializable boundary payloads, and SSR hydration mismatches across network edges.

Blocks:Closing over client reactive signals within server$ bodies and invoking async RPCs directly inside synchronous tracking computations.
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-boundary-state-isolation
frontendcritical

Nuxt 4 Nitro Server Engine Boundaries, Shared Directory Purity, and SSR State Isolation

Mandate strict runtime and directory isolation across Nuxt 4's app/, server/, and shared/ boundaries. Prevent catastrophic multi-tenant cross-request state pollution in Nitro route handlers and Nuxt SSR composables by eliminating module-level mutable state and restricting shared/ to stateless isomorphic logic.

Blocks:Multi-Tenant Data Leaks via Nitro Module-Level Globals and Impure Shared Directory Imports
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-architecture
frontendcritical

Nuxt 4 Nitro Engine Boundaries, Shared Directory Purity, and SSR State Isolation

Enforces architectural boundary separation across Nuxt 4's app/ layer, Nitro v2 server engine (server/), and isomorphic domain directory (shared/). Prevents cross-request state pollution, runtime leakage between Vue and Nitro, and SSR state hydration vulnerabilities.

Blocks:Global Module-Level State Pollution and Illegal Boundary Cross-Imports in Nuxt 4
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-ssr-isolation
frontendcritical

Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation

Enforces strict boundary isolation between Nuxt 4 client code in app/, Nitro v2 engine routes in server/, and universal utilities in shared/. Mandates per-request context isolation to eliminate multi-tenant cross-request state pollution and hydration mismatches during server-side rendering (SSR).

Blocks:Global Module-Level State in Nitro Handlers and Direct Server Module Leakage into Client Hydration
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation
frontendcritical

Vite 6 Environment API Multi-Runtime Isolation and Scoped HMR Invariant

Vite 6 establishes independent runtime environments (client, ssr, workerd, edge) each maintaining segregated module graphs, runners, and communication channels. Plugins and servers must use environment-scoped hooks (`this.environment`), explicit `ModuleRunner` instances, and isolated HMR channels rather than deprecated global module loaders or unified WebSocket broadcasts.

Blocks:Cross-Runtime Graph Contamination and Unscoped Global HMR in Vite 6 Multi-Environment Setups
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-ssr-state-isolation
frontendcritical

Nuxt 4 Nitro Server Engine Isolation & Shared Directory State Guardrails

Enforces strict boundary separation between Nuxt 4 app/, server/, and shared/ directories while preventing cross-request state pollution in Nitro v2 server engines. Mandates pure, runtime-agnostic code in shared/ and strictly isolates SSR state using request-bound context and useState hydration.

Blocks:Cross-Request SSR State Pollution & Boundary Contamination in Nuxt 4
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-engine-and-shared-isolation
frontendcritical

Nuxt 4 Nitro Server Isolation and Shared Directory Boundary Governance

Enforces strict boundary contracts across Nuxt 4's app/, server/, and shared/ directories, preventing cross-request state contamination in Nitro server handlers and hydration mismatches during SSR. Eliminates module-scoped mutable state on the server, restricts shared/ to runtime-agnostic isomorphic code, and mandates deterministic, scoped state hydration via useState.

Blocks:Module-Scoped Mutable State in Nitro Handlers and Cross-Boundary Pollution via Shared Directory
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-ssr-isolation
frontendcritical

Nuxt 4 Nitro Server Engine Architecture & SSR State Isolation Standard

Enforces strict boundary separation across Nuxt 4's app/, server/, and shared/ directories while eliminating cross-request state pollution in Nitro event handlers and Vue SSR composables. Mandates request-scoped context, unstorage/H3 event context over module-level singletons, and useState over global refs to prevent concurrent tenant data leakage.

Blocks:Cross-Request State Contamination via Global Nitro Singletons and Illegal Directory Imports
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-fn-boundary-guardrail
frontendcritical

SolidStart 1.0 Server Functions (server$) and Fine-Grained Reactive Async Boundaries

Mandates strict serialization integrity, reactive decoupling, and proper async boundary usage when executing SolidStart 1.0 server$ RPC functions. Prevents reactive closure capture, non-serializable payload passing across Nitro RPC bridges, and unhandled async state during SSR hydration.

Blocks:Leaking Client Signals into Server Closures and Bypassing Suspense Hydration Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-state-isolation-standard
frontendcritical

Nuxt 4 Nitro Server Engine, Directory Restructure, and SSR State Isolation

Enforces strict boundary isolation between Nuxt 4's app/ layer, server/ Nitro runtime, and shared/ utilities. Prohibits global mutable state in server routes and shared modules that trigger cross-request state pollution, and prevents client-server reactivity leakage during SSR hydration.

Blocks:Global Module-Level State in Nitro Handlers and Shared Modules Causing Cross-Request Data Leaks and Hydration Mismatches
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-guardrail
frontendcritical

Nuxt 4 App Restructuring, Nitro Isolation, and Hydration Invariant

Enforces strict isolation between Nuxt 4's app/ directory structure, the shared/ directory, and Nitro server execution contexts. Prevents cross-request SSR state leakage via module-scope singletons and ensures clean contracts for Nitro event handlers and isomorphic code.

Blocks:Global Module Singletons Leaking Cross-Request SSR State & Boundary Violations Across Nuxt 4 Shared/App Directories
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-engine-shared-state-isolation
frontendcritical

Nuxt 4 Nitro Server Architecture & Cross-Request State Isolation

Enforces strict boundary separation between Nuxt 4's app/, server/, and shared/ directories while preventing cross-request state pollution during SSR. Mandates per-request context isolation in Nitro v2 event handlers and guarantees that client-server state hydration utilizes Nuxt-managed reactive primitives rather than module-scoped singletons.

Blocks:Cross-Request Memory Pollution via Module-Scope State and Leaky Nitro Boundary Imports
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-boundary-ssr-isolation
frontendcritical

Nuxt 4 Directory Separation, Nitro Context Isolation, and SSR Hydration Safeguards

Enforces strict architectural boundaries across Nuxt 4 directory layers (`app/`, `server/`, and `shared/`) while preventing multi-tenant cross-request state contamination in Nitro server engines. Eliminates hydration mismatches and secret leakage by restricting server-only modules and stateful closures during SSR execution.

Blocks:Module-Level Mutable State in Nitro Handlers and Cross-Boundary Node/Client Code Imports
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-async-boundaries-production-standard
frontendcritical

SolidStart 1.0 Server Function Serialization & Reactive Async Boundary Isolation

Enforces strict boundary separation between client-side reactive graphs and Vinxi/Nitro server RPCs (server$, action, query/cache). Guarantees zero leakage of non-serializable signal accessors across the network wire, prevents hydration mismatches via mandatory Suspense boundaries on createAsync, and mandates isolated server-side request context handling.

Blocks:Capturing Client Reactive Signals in server$ Closures and Omitting Suspense on createAsync Boundaries
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-reactive-boundaries
frontendcritical

Enforce Strict RPC Parameter Boundaries and Reactive Async Primitives in SolidStart 1.0

SolidStart 1.0 server functions compiled via Nitro/Vinxi extract RPC bodies into isolated server endpoints that have no access to client-side reactive graphs. Reactive primitives (signals, stores) must never be read inside 'use server' or server$ closures; instead, read signals inside tracking scopes (createAsync or createResource) and pass plain serializable primitives as arguments to server functions cached with the cache() wrapper.

Blocks:Accessing Client Signals Inside Server Closures and Bypassing createAsync Hydration Caches
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-architecture
frontendcritical

Nuxt 4 Nitro Server Engine Isolation and Shared Directory Invariants

Nuxt 4 transitions to an explicit `app/` directory root and introduces the top-level `shared/` directory alongside the Nitro v2 engine. Un-isolated module-level state in Nitro event handlers or leaking client-side reactive state into server runtime scopes causes cross-request pollution and catastrophic SSR state hydration mismatches.

Blocks:Cross-Request State Leaks and Illegal Runtime Boundary Imports in Nuxt 4 / Nitro
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-state-isolation
frontendcritical

Nuxt 4 Nitro Server Engine Isolation & Shared Directory Boundary Enforcement

Enforces strict boundary isolation between Nuxt 4's app/ directory, Nitro server runtime, and isomorphic shared/ directory. Prevents catastrophic cross-request state pollution in Nitro handlers and ensures client/server hydration parity without runtime capability leaks.

Blocks:Global Module-Level State in Nitro Handlers and Client/Server Leaks in the Shared Directory
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-state-isolation
frontendcritical

Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation

Enforces strict boundary separation between Nuxt 4's app/ directory, Nitro server runtime, and shared/ isomorphic layer. Prevents cross-request state pollution, runtime leakage of server-only secrets into client hydrations, and invalid cross-domain module imports.

Blocks:Global Module-Level State in Nitro Handlers and Leakage of Server Logic via Shared Directory
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-reactive-boundaries
frontendcritical

SolidStart 1.0 Server RPC Serialization and Reactive Tracking Boundaries

Mandate strict separation between client-side fine-grained reactivity and SolidStart 1.0 server$ and query RPC execution contexts. Signals and reactive accessors cannot cross RPC boundaries via closure capture or direct parameter binding; parameters must be passed as serializable values inside createAsync accessors to maintain reactive invalidation without breaking serialization or losing tracking.

Blocks:Capturing Client Signals in Server Function Closures or Passing Signal Accessors Directly to RPCs
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-functions-async-boundaries-production-standard
frontendcritical

SolidStart 1.0 Server Function Isolation & Async Reactive Boundary Standard

Enforces strict boundaries between client reactive graphs and Vinxi/Nitro RPC server execution in SolidStart 1.0. Prevents closure leaks over reactive signals, guarantees serialization integrity across HTTP RPC barriers, and mandates Suspense-wrapped createAsync consumption to eliminate hydration mismatches.

Blocks:Capturing Reactive Client Signals Inside server$ Closures or Calling RPCs Without createAsync & Suspense Isolation
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-state-guardrails
frontendcritical

Nuxt 4 Nitro Server Isolation, Shared Layer Contracts, and SSR State Hydration Guardrails

Enforces strict architectural boundaries across the Nuxt 4 app/ directory, Nitro v2 server engine, and shared/ directory. Eliminates cross-request state pollution, server-side credential leakage in SSR payload hydration, and un-isolated module-level singletons in persistent worker runtimes.

Blocks:Cross-Request State Pollution via Module Singletons and Server Secrets Leaked in SSR Hydration
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-fn-boundary-isolation
frontendcritical

SolidStart 1.0 Server Function Boundary Isolation & Signal Tracking

Mandates strict network and serialization boundary isolation for SolidStart 1.0 server$ functions and cache/createAsync primitives. Prevents client signal closure leakage into server boundaries, eliminates stale reactive closures, and guarantees deterministic hydration through mandatory Suspense boundaries.

Blocks:Closing over client signals inside server$ closures or omitting reactive accessor wrappers in createAsync
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-ssr-isolation-standard
frontendcritical

Nuxt 4 Nitro Engine, Shared Directory, and SSR State Isolation

Enforces strict boundary separation across Nuxt 4's app/, server/, and shared/ directory architecture. Eliminates multi-tenant cross-request state pollution in Nitro v2 event handlers and SSR composables, ensuring hydration safety and runtime-agnostic isomorphic code.

Blocks:Module-Level State Bleed and Cross-Boundary Runtime Contamination in Nuxt 4
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-isolation-guardrail
frontendcritical

Nuxt 4 Nitro Isolation, Shared Directory Boundaries, and SSR State Hydration

Enforces strict architectural isolation across Nuxt 4 app/, server/, and shared/ directory boundaries to prevent cross-request state pollution in Nitro and SSR hydration mismatches. Prohibits module-scoped state in Nitro route handlers and guarantees shared/ contains only runtime-agnostic, side-effect-free code devoid of server secrets or client-only APIs.

Blocks:Module-Level Nitro State Leakage and Shared Directory Secret Contamination Causing SSR Hydration Mismatches
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-hydration-guardrail
frontendcritical

Nuxt 4 Directory Restructuring & Nitro Isolated State Guardrail

Enforces strict boundary isolation across Nuxt 4's app/, server/, and shared/ directories, preventing cross-request state leakage in Nitro v2 server handlers. Mandates that universal utilities residing in shared/ remain side-effect free and client-safe, while ensuring SSR state hydration leverages unpolluted, request-scoped contexts.

Blocks:Global Mutable State Pollution in Nitro Handlers and Leaking Server Context via shared/
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-guardrails
frontendcritical

Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation

Enforces strict boundary separation between Nuxt 4's app/ directory, Nitro server runtime, and shared/ utilities. Prevents cross-request state pollution, runtime leakage of server-only primitives into client bundles, and un-isolated SSR state hydration bugs.

Blocks:Global Module-Level State in Nitro Handlers and Cross-Polluting Shared Directory Imports
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-boundaries
frontendcritical

SolidStart 1.0 Server Function Serialization and Async Boundary Guardrails

Enforces strict isolation between client reactive signal graphs and SolidStart 1.0 server$ RPC functions. Prevents bundling leaks, closure state corruption, and silent reactivity failures by requiring explicit serializable arguments, validation schemas, and createAsync tracking wrappers.

Blocks:Accessing Client Signals Directly in server$ Closures and Calling RPCs Without createAsync
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-signal-boundary
frontendcritical

SolidStart 1.0 server$ RPC Boundaries and Fine-Grained Reactive Isolation

Enforces strict lexical and serialization boundaries when authoring SolidStart server$ RPCs and integrating them with fine-grained reactivity. Prohibits closing over client-side signals inside server functions and mandates explicit argument serialization, query/action wrapping, and Suspense boundary containment.

Blocks:Closing Over Client Signals Inside server$ Functions and Bypassing Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-hydration-isolation
frontendcritical

Nuxt 4 Nitro Engine, Shared Directory Architecture, and SSR State Isolation

Enforces strict boundaries in Nuxt 4 projects between the restructured app/ client workspace, Nitro v2 server/ engine, and shared/ isomorphic directory. Prevents cross-boundary leakage of server secrets into client bundles, stops module-level mutable state leaks across concurrent SSR requests, and guarantees deterministic client-side hydration.

Blocks:Cross-boundary module imports and un-isolated global server singletons causing SSR cross-request state pollution and hydration mismatches
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-boundary-isolation
frontendcritical

Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation

Mandates strict architectural separation across Nuxt 4's app/, server/, and shared/ directories to prevent server-side runtime leakage and cross-request state pollution (CRSP). Enforces isomorphic purity in shared/, request-scoped lifecycle handling in Nitro handlers, and SSR-safe state hydration via useState.

Blocks:Global Module-Level State Pollution and Cross-Boundary Runtime Leakage in Nuxt 4
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-ssr-isolation-standard
frontendcritical

Nuxt 4 Nitro Server Engine & Shared Directory State Isolation Standard

Enforces strict boundary isolation across Nuxt 4's app/ directory, Nitro server engine, and shared/ utilities. Prevents catastrophic cross-request state pollution during SSR hydration and ensures clean execution contexts between client, Nitro runtime, and shared code.

Blocks:Leaking Module-Level Mutable State Across Concurrent SSR Requests in Nitro Handlers and Shared Utilities
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-state-isolation
frontendcritical

Nuxt 4 Nitro Server Engine & Shared Directory State Isolation Standards

Enforces strict architectural boundaries and execution context isolation in Nuxt 4, isolating Nitro server engine logic from the app/ directory via the root shared/ boundary. Prevents catastrophic cross-request state pollution during SSR hydration, illegal cross-boundary runtime imports, and leaks of server-only secrets into client bundles.

Blocks:Cross-Request SSR State Pollution via Nitro Module-Level Singletons and Direct App-to-Server Imports
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-guardrail
frontendcritical

Nuxt 4 Directory Restructuring, Nitro v2 Engine, and SSR State Isolation

Nuxt 4 introduces a restructured root architecture consolidating frontend code into 'app/' alongside a dual-targeted 'shared/' directory and Nitro v2 runtime. Improper placement of server logic in shared directories or leaking cross-request state via module-scoped singletons on the Nitro engine causes severe security breaches and memory leaks across concurrent SSR sessions.

Blocks:Global SSR Singleton State Leakage and Cross-Context Contamination in Shared/Nitro Layers
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-async-boundaries-guardrail
frontendcritical

SolidStart 1.0 Server Function Boundaries & Fine-Grained Reactive Serialization

Enforces strict isolation between SolidJS fine-grained reactivity and SolidStart 1.0 server$ RPC boundaries. Prohibits capturing client-side signals inside server closures and mandates wrapping server queries inside query/cache and createAsync within Suspense boundaries to prevent hydration mismatches and broken tracking roots.

Blocks:Capturing reactive signal accessors inside server$ closures or invoking naked server RPC promises within reactive render bodies
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-isolation-standard
frontendcritical

Nuxt 4 Nitro Server Engine & Shared Directory Cross-Boundary Isolation

Nuxt 4 formalizes the `app/` and `shared/` directory structures alongside Nitro v2 server routes. Shared code between Nitro and the Vue rendering engine must remain strictly stateless, pure, and free from runtime-specific globals, while client/server state hydration must occur exclusively through `useState` or context-isolated stores to avoid multi-tenant cross-request state pollution during SSR.

Blocks:Global Singletons in Nitro/Shared Directories and Leaking Server Context into SSR Hydration
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-ssr-state-guardrail
frontendcritical

Nuxt 4 Directory Restructuring, Nitro Context & SSR State Isolation

Enforces Nuxt 4 directory architecture (isolating application code inside `app/` and shared cross-runtime logic inside `shared/`), strict Nitro server-route context management, and per-request SSR state isolation. Prohibits global module-level mutable singletons and cross-boundary runtime contamination between Nitro server routes and Vue client code.

Blocks:Global Module-Level State Bleed and Invalid Directory Cross-Imports Across Nuxt 4 Runtimes
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-engine-shared-state-isolation
frontendcritical

Nuxt 4 Nitro Engine Boundaries, Shared Directory Invariants, and SSR State Isolation

Mandates strict architectural boundaries between Nuxt 4's `app/` presentation layer, Nitro `server/` runtime, and the universal `shared/` directory. Enforces request-scoped state encapsulation using `useState()` and `H3Event` context to prevent cross-request memory contamination and SSR hydration mismatches.

Blocks:Global Module-Level State Bleed in Nitro Handlers and Direct Client-Server Cross-Boundary Imports
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-boundary-guardrail
frontendcritical

Nuxt 4 Nitro Engine Isolation and Shared Directory SSR Invariants

Enforces strict execution-context isolation between Nuxt 4 app/, server/, and shared/ directories. Prohibits top-level mutable state in Nitro handlers to prevent cross-request tenant bleed and guarantees safe SSR hydration serialization.

Blocks:Cross-Request State Pollution via Top-Level Nitro Variables and Leaky Shared Directory Contexts
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-hydration-guardrails
frontendcritical

Nuxt 4 Directory Topology, Nitro State Isolation, and Shared Module Purity

Enforces strict architectural boundaries across the Nuxt 4 app/, server/, and shared/ directory structure, preventing cross-request state pollution in Nitro v2 execution contexts. Guarantees pure platform-agnostic shared utilities and hydration-safe SSR state allocation.

Blocks:Cross-Request State Leakage in Nitro Handlers and Platform Contamination in Shared Directory
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-ssr-isolation-standard
frontendcritical

Nuxt 4 Directory Restructuring, Nitro Route Handlers, and SSR State Isolation

Nuxt 4 transitions all client application code into the app/ directory while Nitro server execution operates strictly under server/ and cross-runtime shared logic resides in shared/. Direct state mutation across runtime boundaries or module-level shared variables in Nitro handlers leads to cross-request state leakage, memory leaks, and SSR hydration mismatches.

Blocks:Cross-Request State Contamination via Global Nitro State and Legacy Root Directory Imports in Nuxt 4
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-ssr-isolation-shared-boundaries
frontendcritical

Nuxt 4 Nitro Isolation, Shared Directory Boundaries, and SSR State Leak Prevention

Enforces strict architectural separation between Nitro v2 server routes (server/), isomorphic contracts (shared/), and client application logic (app/) in Nuxt 4. Eliminates critical SSR cross-request state pollution and hydration mismatches caused by module-level mutable variables and illegal runtime imports.

Blocks:Cross-Request State Pollution via Module-Scoped State and Boundary Bleed Between Server, App, and Shared Directories
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-ssr-isolation-guardrail
frontendcritical

Nuxt 4 Nitro Server Engine & Shared Directory SSR State Isolation Standard

Nuxt 4 transitions the client application root to the app/ directory while leveraging shared/ for universal types and constants, requiring complete boundary isolation from the server/ Nitro runtime. Un-isolated global module-level state in Nitro event handlers or shared modules leaks across concurrent SSR request contexts, resulting in cross-tenant data corruption and security compromise.

Blocks:Global Module-Scope Mutable State Leakage in Nitro Handlers and Improper Nuxt 4 Directory Cross-Imports
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-isolation-guardrail
frontendcritical

Nuxt 4 Nitro Engine Isolation and Shared Directory Boundary Integrity

Enforces architectural isolation between the Nuxt 4 client layer (app/), server runtime engine (server/), and universally shared code (shared/). Guarantees the prevention of cross-request state contamination in Nitro v2 event handlers and prevents leakage of server-only secrets or Node.js primitives into isomorphic shared modules.

Blocks:Module-Scope State Mutation in Nitro Handlers and Server-Boundary Leakage into Shared Layer
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-isolation-production-standard
frontendcritical

Nuxt 4 Nitro Server Architecture & Shared Directory Hydration Guardrail

Enforces strict isolation across the Nuxt 4 directory topology (`app/`, `server/`, and `shared/`) to prevent SSR cross-request state pollution, Nitro runtime memory leaks, and hydration mismatches. Restricts the `shared/` directory to pure isomorphic code free from client- or server-specific side effects, and bans module-scoped mutable state in Nitro handlers and Vue composables.

Blocks:Leaking Cross-Request Tenant State via Nitro Module Globals and Impure Shared Imports
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-boundary-invariants
frontendcritical

SolidStart 1.0 server$ RPC Boundaries and Reactive Async Invariants

Mandates strict isolation between SolidStart 1.0 server functions (server$) and client-side reactive scopes. Enforces explicit parameter serialization, prevents closure leaks of reactive signals into server boundaries, and requires createAsync or cache wrappers to prevent Suspense boundary drops and hydration mismatches.

Blocks:Closing over client signals inside server$ RPCs or calling raw server functions in synchronous tracking contexts.
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-boundary-guardrail
frontendcritical

Nuxt 4 Nitro Engine & Shared Directory SSR Hydration Isolation

Enforces strict boundary separation between Nuxt 4's app/, server/, and shared/ directories to prevent cross-request SSR state leaks and bundle contamination. Mandates request-scoped context isolation within Nitro v2 event handlers and strictly serializable, payload-safe contracts across the shared directory.

Blocks:Global Mutable State Leaks Across SSR Requests and Server-Only Context Spills into Shared Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-isolation-production-standard
frontendcritical

Nuxt 4 Nitro Engine Isolation and Shared Directory SSR Hydration Guardrails

Nuxt 4 establishes a strict architectural boundary by moving client application code into the 'app/' directory, isolating Nitro engine handlers in 'server/', and allowing shared isomorphic utilities solely through 'shared/'. Global or module-level variable declarations within Nitro handlers or shared utilities cause critical cross-request memory leaks and data pollution across concurrent SSR requests. This standard mandates strict request-scoped execution contexts, zero cross-boundary imports between 'app/' and 'server/', and deterministic hydration state isolation.

Blocks:Cross-Request State Leakage and Boundary Violations in Nuxt 4 Nitro and Shared Layers
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-boundary-guardrail
frontendcritical

SolidStart 1.0 Server Function Serialization and Async Boundary Guardrail

SolidStart 1.0 server$ functions execute exclusively in isolated server runtime environments, severing the lexical JavaScript scope across client and server boundaries. Passing reactive signal accessors, DOM references, or un-serializable objects into server functions corrupts RPC serialization and triggers client hydration divergence. All server function interactions must pass discrete, plain serializable primitives and be mediated via createAsync or cache primitives wrapped in Suspense and ErrorBoundary components.

Blocks:Leaking Reactive Closures into server$ RPCs and Invoking Server Functions Inside Raw Client Effects
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-boundary-reactivity
frontendcritical

SolidStart 1.0 Server Function Boundary & Reactive Signal Invariants

Enforces strict parameter serialization and reactivity separation across SolidStart 1.0 server$ RPC boundaries. Prevents runtime serialization failures, dead-code elimination leaks, and broken signal subscription graphs across client-server execution contexts.

Blocks:Implicit Client Signal Closures Inside server$ RPCs Causing Stale Serialization and Broken Fine-Grained Reactive Tracking
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-boundary-guardrail
frontendcritical

Nuxt 4 Directory Boundaries, Nitro Request Context, and SSR State Isolation

Enforces strict boundary isolation between Nuxt 4's app/ directory, Nitro server runtime, and shared/ utilities. Eliminates cross-request state pollution, module-scope SSR memory leaks, and invalid runtime cross-imports between Nitro event handlers and client components.

Blocks:Global Singletons in Nitro Handlers and Leaking Server Runtime Logic into app/ Components
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-context-isolation-and-shared-boundaries
frontendcritical

Nuxt 4 Nitro SSR Request Isolation and Shared Directory Boundary Enforcement

Enforces strict runtime boundary isolation between Nuxt 4 app/, server/, and shared/ directories while preventing cross-request state pollution in Nitro v2 server handlers. Mandates request-scoped context via event.context and hydration-safe SSR primitives via useState() to block concurrent memory leaks and credential bleed.

Blocks:Module-Scope Singleton State Leaking Across Nitro Requests and Secret Bleed Across Shared Boundaries
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-async-boundary-guardrails
frontendcritical

SolidStart 1.0 server$ RPC Serialization & Async Boundary Invariants

Mandates strict isolation and explicit serialization boundaries for SolidStart 1.0 server$ RPCs and fine-grained client signals. Prevents closure leakage across the client/server network boundary, serialization failures, and broken SSR streaming by enforcing createAsync wrappers within Suspense boundaries.

Blocks:Closing over reactive client signals inside server$ RPC closures and executing untracked async operations outside createAsync
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-state-isolation-standard
frontendcritical

Nuxt 4 Nitro Isolation, Shared Directory Boundaries, and SSR State Hydration

Enforces strict architectural boundaries across Nuxt 4's app/, server/, and shared/ directories while preventing cross-request SSR state pollution. Mandates request-scoped context encapsulation in Nitro v2 event handlers and SSR-safe state management via useState to eliminate concurrent user data leakage.

Blocks:Global Module-Level State in Nitro Handlers and Leaky SSR Composables
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-async-boundaries
frontendcritical

SolidStart 1.0 Server Functions (server$) & Fine-Grained Async Invariants

Enforces strict RPC boundary isolation, serializable argument contracts, and proper Suspense integration in SolidStart 1.0. Prevents client-server closure leakage, hydration deadlocks, and silent reactive de-opt when crossing network boundaries.

Blocks:Leaking Reactive Signal Closures into server$ RPCs and Executing Raw Server Promises Outside createAsync
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-hydration-isolation
frontendcritical

Nuxt 4 Nitro Server Engine Isolation & Shared Directory State Guardrail

Enforces strict boundary separation between Nuxt 4's app/ directory, Nitro server runtime, and shared/ utilities. Prevents cross-request state pollution in Nitro event handlers and eliminates SSR hydration mismatches caused by un-isolated state leaks, non-serializable payloads, and node-only imports in universal code.

Blocks:Global Module-Level State in Nitro Handlers and Leaking Server-Only Primitives via Shared Directory into App Hydration
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-isolation-production-standard
frontendcritical

Nuxt 4 App Directory Restructuring, Nitro v2 Boundaries, and SSR State Isolation

Enforces strict boundary isolation between Nuxt 4 app/ runtime, Nitro v2 server runtime, and the shared/ directory. Eliminates cross-request state pollution during SSR hydration and prevents server-only secrets or Node.js primitives from leaking into client-accessible shared modules.

Blocks:Global Cross-Request State Leaks and Server Secret Bundling in Nuxt 4 Shared/ Modules
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-engine-shared-dir-state-isolation
frontendcritical

Nuxt 4 Nitro Engine & Shared Directory State Isolation Standard

Enforces strict isolation between the Nitro v2 server engine, universal client code inside the Nuxt 4 app/ directory, and isomorphic contracts in shared/. Guarantees zero cross-request state leakage, eliminates SSR hydration mismatches, and prevents runtime execution boundary contamination.

Blocks:Cross-Request State Contamination via Module-Level Singletons and Illicit Boundary Imports
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-reactive-boundary-guardrail
frontendcritical

SolidStart Server Functions and Fine-Grained Async Boundary Invariants

Enforces strict architectural boundaries between client-side fine-grained reactive signals and server-side execution via SolidStart 1.0 server$ RPCs. Eliminates hydration mismatches, accidental client closure leaks into server bundles, and non-reactive async waterfalls by mandating cache/action wrappers and explicit Suspense orchestration.

Blocks:Closing over client signals inside server$ functions or invoking raw server RPCs without reactive async boundaries.
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-boundary-standard
frontendcritical

Nuxt 4 Nitro Engine, Shared Directory Boundaries, and SSR Isolation

Enforces strict boundary isolation between Nuxt 4's app/ layer, server/ (Nitro engine), and shared/ directory. Prevents catastrophic cross-request SSR state contamination, server secret leakage to the client bundle, and illegal cross-boundary runtime imports.

Blocks:Global Mutable SSR Singletons & Leaking Nitro Server Context Across Shared Directory Boundaries
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-reactivity-boundary
frontendcritical

SolidStart 1.0 Server Functions & Reactive Async Boundary Invariants

Enforces strict isolation between client-side SolidJS signals and server-side RPC execution boundaries instantiated via server$, cache, or action. Signal accessors must never be embedded directly within server function closures, and server queries must be declared with createAsync using reactive accessor parameters to prevent hydration mismatches, serialization failures, and broken dependency tracking.

Blocks:Capturing Client Signals Directly in server$ Closures and Omitting createAsync Reactive Contexts
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-state-boundary
frontendcritical

Nuxt 4 Nitro Server Engine Isolation & Shared Directory Boundary Enforcements

Enforces strict architecture and runtime boundaries between Nuxt 4's app/ directory, Nitro server/ runtime, and the polymorphic shared/ directory. Prohibits module-scoped mutable state, cross-boundary runtime imports, and non-isolated server-side hydration traps that cause cross-request state pollution in production SSR.

Blocks:Module-Scoped Mutable Singletons and Cross-Boundary Runtime Leaks across Nuxt 4 app/, server/, and shared/ Directories
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-isolation
frontendcritical

Vite 6 Environment API Isolation and Multi-Runtime HMR Synchronization

Vite 6 replaces the legacy client/ssr dual-module graph with the Environment API to support isolated runtimes (Node, workerd, Edge). Developers and plugins must strictly route module transformations, module invalidations, and HMR events through scoped DevEnvironment instances and ModuleRunner transports rather than legacy root-server globals.

Blocks:Cross-Environment Module Graph Invalidation and Unscoped HMR Dispatching via Legacy Vite 5 APIs
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-fn-async-boundaries
frontendcritical

SolidStart 1.0 Server Functions (server$) & Fine-Grained Async Boundaries

Enforces architectural boundaries for SolidStart 1.0 server$ RPCs, requiring createAsync/cache integration within Suspense boundaries. Prevents client signal closure leakage into server boundaries, serialization failures, and hydration mismatches caused by raw server calls in reactive scopes.

Blocks:Raw server$ Invocations in Reactive Scopes & Passing Non-Serializable Signal Accessors across RPC Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-state-isolation-guardrail
frontendcritical

Nuxt 4 Nitro Engine, Shared Directory Boundaries, and SSR State Isolation

Enforces strict boundary isolation across Nuxt 4's app/, server/, and shared/ directories, preventing cross-request state contamination in Nitro server handlers and ensuring deterministic SSR hydration. Prohibits global mutable singletons across concurrent execution contexts and mandates serializable data transfer boundaries.

Blocks:Module-Level Mutable State in Server Routes and Shared Modules Leaking Cross-Request Tenant Data
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-server-shared-state-isolation
frontendcritical

Nuxt 4 Nitro Server Engine & Isolated SSR State Hydration

Enforces strict architectural boundaries across Nuxt 4's app/, server/, and shared/ directories to eliminate cross-request state pollution in Nitro v2 runtimes. Mandates request-scoped context isolation using H3 event context and Nuxt useState to prevent sensitive data leaks between concurrent SSR executions.

Blocks:Module-Scoped Singleton State Leakage in Nitro Handlers and Contaminated Shared Directory Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-boundary-standard
frontendcritical

Nuxt 4 Nitro Server Engine, Shared Directory, and SSR State Isolation

Enforce strict execution boundary separation across Nuxt 4 app/, server/, and shared/ directories while eradicating cross-request state pollution in Nitro v2 server engines and Vue SSR. Mandates request-bound event contexts in Nitro routes and useState/Pinia per-request lifecycle encapsulation in the app layer.

Blocks:Mutating Module-Scoped State in Nitro Handlers and Violating App/Server/Shared Directory Isolation
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-reactive-boundaries-standard
frontendcritical

SolidStart 1.0 Server RPCs & Fine-Grained Async Boundary Invariants

Enforces strict boundary separation between client-side fine-grained reactivity and SolidStart 1.0 server$ RPC execution. Prohibits lexical closure leakage across the client/server threshold and mandates the use of query/action wrappers with createAsync to preserve Suspense streaming and prevent reactive fetch loops.

Blocks:Closing Over Client Reactive State Inside server$ RPCs and Invoking Uncached RPCs Directly in Reactive Tracking Scopes
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-ssr-boundary-isolation
frontendcritical

Nuxt 4 Nitro Server Engine, Shared Directory Boundaries, and SSR State Isolation

Enforce strict execution boundary isolation between Nuxt 4's app/, server/ (Nitro engine), and shared/ directory hierarchies. Prevent cross-request state contamination in concurrent SSR rendering and eliminate client/server module boundary leakage.

Blocks:Module-Scoped Mutable State in Nitro Handlers and Impure Cross-Boundary Imports in Nuxt 4 shared/
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-ssr-state-isolation
frontendcritical

Nuxt 4 Nitro Server Engine, Shared Directory Boundaries, and SSR State Isolation

Enforces strict architectural boundaries between Nuxt 4 app/, server/, and shared/ directories while preventing cross-request state leakage during SSR. Mandates per-request context isolation in Nitro v2 event handlers and SSR-safe reactive singletons via useState.

Blocks:Module-Level Shared State Leakage and Cross-Context Boundary Bleed in Nuxt 4
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-functions-async-boundary-standard
frontendcritical

SolidStart 1.0 Server Functions and Async Boundary Invariants

Enforces strict RPC boundary isolation and reactive tracking decoupling when using SolidStart server$ functions. Mandates explicit parameter serialization, prevents lexical capture of client-side reactive signals within server closures, and enforces mandatory Suspense and ErrorBoundary wrapping for all async data-fetching primitives.

Blocks:Lexical Signal Leakage and Naked Execution in SolidStart Server RPCs
Targets:Cursor•Claude•Windsurf•Codex
solidstart-1-server-functions-async-boundaries
frontendcritical

SolidStart 1.0 Server Functions (server$) and Async Boundary Architecture

Enforces strict isolation between client-side reactive signal scopes and Vinxi-compiled server$ RPC functions in SolidStart 1.0. Guarantees that async data pipelines crossing the network boundary are encapsulated in serializable contracts, driven through createAsync/query primitives, and guarded by explicit Suspense and ErrorBoundary components to eliminate hydration mismatch and stale closure panics.

Blocks:Leaking Reactive Signal Accessors into server$ Closures and Unbounded Async Execution Without Suspense
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-directory-state-isolation
frontendcritical

Nuxt 4 Nitro SSR State Isolation and Shared Directory Boundary Enforcement

Enforces Nuxt 4 architectural segregation across app/, server/, and shared/ directories while strictly eliminating cross-request state pollution in the Nitro engine. Mandates request-scoped lifecycle isolation in SSR routes and prevents runtime leakage of server-only secrets through isomorphic shared layers.

Blocks:Global Mutable Singletons in Nitro Handlers and Impure State Leakage Across Nuxt 4 Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-ssr-state-isolation-standard
frontendcritical

Nuxt 4 Directory Architecture, Nitro Server Isolation, and SSR State Leak Prevention

Nuxt 4 strictly enforces a segmented root directory structure where client code resides under app/, server utilities under server/, and universal code under shared/. Failing to isolate SSR execution context or leaking server-only dependencies into shared runtime spaces causes fatal cross-request state contamination, token leakage, and catastrophic client-server hydration divergence.

Blocks:Global Mutable State in Nitro Handlers and Illicit Cross-Boundary Imports between app/, server/, and shared/
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation
frontendcritical

Vite 6 Multi-Runtime Environment API and Per-Environment HMR Isolation

Enforces strict isolation of execution contexts (workerd, node, edge, client) using Vite 6's Environment API and ModuleRunner architecture. Prohibits legacy Vite 5 SSR APIs, cross-environment runtime pollution, and un-scoped HMR event broadcasting across independent runtime boundary graphs.

Blocks:Leaking Node-specific APIs into edge/workerd environments and relying on legacy ssrLoadModule or root WebSocket broadcasting for SSR HMR.
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-fn-async-boundaries-standard
frontendcritical

SolidStart 1.0 Server Functions & Async Boundaries Invariant Standard

Enforces strict boundary isolation and reactive lifecycles when using SolidStart server$ RPCs. Mandates that server functions remain pure, isolated compilation units that receive all client parameters via serialized inputs rather than client signal closures, and requires async data consumption to be routed through cache() and createAsync() inside Suspense boundaries to preserve fine-grained reactivity.

Blocks:Closing Over Client Signals in server$ Closures or Calling Bare RPCs in Tracking Scopes
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-directory-ssr-state-isolation
frontendcritical

Nuxt 4 Nitro Server Engine, Shared Directory Boundaries, and SSR State Isolation

Enforces strict architectural boundaries across Nuxt 4 app/, server/, and shared/ directories while preventing cross-request state pollution in the Nitro v2 engine. Prohibits module-level mutable variables in server routes and mandates request-scoped context and isomorphic hydration primitives.

Blocks:Cross-Request State Contamination in Nitro Handlers and Leaked Client State in Nuxt 4 Shared Directory
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-state-isolation-production-standard
frontendcritical

Nuxt 4 Nitro Server Engine Isolation & Shared Directory Hydration Guardrail

Enforces strict architectural boundaries across the Nuxt 4 directory layout (app/, server/, and shared/) to prevent cross-request SSR state pollution and runtime hydration mismatches. Mandates request-scoped context within Nitro event handlers and restricts the shared/ layer to stateless, isomorphic code.

Blocks:Cross-Request State Leaks via Global Module Scope in Nitro Handlers and Isomorphic Boundary Violations in Nuxt 4 shared/
Targets:Cursor•Claude•Windsurf•Codex
nuxt-4-nitro-shared-directory-ssr-isolation-guardrail
frontendcritical

Nuxt 4 Directory Restructuring, Nitro Isolation, and SSR State Leak Prevention

Nuxt 4 introduces a restructured directory hierarchy where application code resides inside `app/` and shared cross-boundary utilities live in `shared/`. Nitro server runtime context must remain strictly isolated from Vue client runtimes, prohibiting global mutable module state in Nitro event handlers and ensuring SSR hydration payloads use serializable `useState` rather than top-level variables.

Blocks:Cross-Request State Contamination in Nitro and Leaking Server Singletons into Client Hydration
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-function-async-boundary-integrity
frontendcritical

SolidStart 1.0 server$ RPC Boundaries and Fine-Grained Reactive Tracking

Enforce strict isolation between SolidJS fine-grained client signals and SolidStart 1.0 server$ RPC boundaries. Ensure server functions remain pure serializable RPCs that never capture lexical client scope, with all client-server data synchronization orchestrated strictly through query(), cache(), and createAsync() inside Suspense boundaries.

Blocks:Lexical Scope Capture and Manual Effect Fetching Across server$ RPC Boundaries
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-fn-async-boundary-guardrail
frontendcritical

SolidStart 1.0 Server Functions & Async Reactive Boundary Invariants

Enforces strict isolation between client-side reactive signal graphs and SolidStart server$ RPC primitives. Prohibits lexical capture of reactive getters inside server closures, mandates JSON-serializable RPC parameter passing, and requires wrapping asynchronous data retrieval in createAsync within Suspense and ErrorBoundary contexts.

Blocks:Capturing Client Signals in server$ Closures or Calling RPCs Without createAsync & Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-reactive-boundary
frontendcritical

SolidStart 1.0 Server Functions and Async Boundary Invariants

Enforces strict isolation between client reactive tracking scopes and SolidStart server$ RPC execution contexts. Guarantees that server functions receive explicit, JSON-serializable parameters through createAsync or query primitives rather than capturing client signal accessors in server closures, ensuring deterministic SSR streaming and hydration.

Blocks:Closing Over Client Reactive Signals in server$ Handlers or Orchestrating RPCs via Untracked createEffect Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
nuxt4-nitro-shared-ssr-state-isolation-nuxt-4-nitro-ser-617
frontendcritical

Nuxt 4 Directory Restructuring, Nitro Handlers, and SSR State Isolation

Enforces strict boundary isolation across the Nuxt 4 app/ directory, Nitro server runtime, and shared/ isomorphic module layer. Precludes cross-request state pollution, improper hydration mismatches, and the leak of server secrets into client bundles through rigorous stateless handler construction and pure shared utilities.

Blocks:Global Mutable State Leaks Across Nitro Requests and Client Hydration Mismatches via Contaminated Shared Modules
Targets:Cursor•Claude•Windsurf•Codex
solidstart-server-rpc-async-boundaries-solidstart-1-0-s-917
frontendcritical

SolidStart 1.0 Server Functions (server$) & Fine-Grained Reactive Async Boundaries

Enforces strict boundary isolation between SolidJS client-side fine-grained reactivity and SolidStart 1.0 server$ RPC boundaries. Mandates the use of createAsync and cache primitives, guarantees argument serializability across RPC boundaries, and requires explicit Suspense wrapping to prevent hydration tearing and RPC serialization failures.

Blocks:Invoking Raw server$ RPCs Directly in Reactive Accessors or Passing Non-Serializable Signal Getters Across the Wire
Targets:Cursor•Claude•Windsurf•Codex
qwik-city-resumability-serialization-boundaries
frontendcritical

Qwik Resumability Invariants: Serializability Boundaries and Lazy QRL Execution

Enforces zero-hydration resumability invariants by governing QRL ($) boundary serialization and preventing eager execution regressions. Capturing non-serializable instances across lexical scopes or overusing useVisibleTask$ destroys lazy-loading benefits and causes runtime serialization panics.

Blocks:Eager Component Execution and Non-Serializable Scope Leakage Across QRL Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-isolation-vite-6-environme-300
frontendcritical

Vite 6 Multi-Runtime Environment API Isolation and HMR Scoping

Vite 6 replaces the monolithic SSR architecture with the Environment API, providing isolated module graphs, runtime evaluators, and HMR communication per target runtime (e.g., client, Node.js SSR, Cloudflare workerd). Developers must strictly isolate runtime configurations, utilize runtime-specific ModuleRunner instances, and avoid cross-runtime module graph mutations or unscoped HMR broadcasts.

Blocks:Mutating Monolithic server.moduleGraph or Invoking Deprecated ssrLoadModule Across Heterogeneous Runtimes
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-ssr-streaming-invariants
frontendcritical

TanStack Start & Fullstack Router Type-Safe Search Params, Loader SSR, and Deferred Streaming

Enforces strict type safety, predictable search parameter validation with schema parsers (Zod), and optimized full-stack SSR loader pipelines in TanStack Start. Prohibits blocking critical SSR waterfalls by mandating the defer utility with React Suspense for non-critical network requests, alongside structural router context isolation.

Blocks:Unvalidated search params, waterfalling non-critical SSR loaders, and unhandled deferred streaming hydration mismatches
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-and-optimistic-guardrail
frontendcritical

React 19 Actions: Mandating useActionState, useOptimistic, and useFormStatus over Manual State Wrappers

Enforces native React 19 Action primitives (useActionState, useOptimistic, useFormStatus) for mutations and async form submissions. Prohibits manual useState submit wrappers, manual loading states, and synthetic event prevention (e.preventDefault()) that disrupt concurrent transitions and break native progressive enhancement.

Blocks:Manual onSubmit State Orchestration with useState Pending/Error Flags and Imperative Rollbacks
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-actions-csrf-boundary
frontendcritical

Next.js 15 Server Actions Origin Validation and CSRF Boundary Enforcement

Next.js 15 Server Actions expose public HTTP POST endpoints vulnerable to cross-origin abuse, host header spoofing behind reverse proxies, and unauthorized state mutation. Architects and developers must configure explicit `serverActions.allowedOrigins` in multi-domain or proxied deployments and enforce mandatory server-side authentication, origin verification, and schema validation inside every action body.

Blocks:Treating Server Actions as Protected Internal Methods Without Origin Allowlisting or In-Action Session Guards
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-state-invariants
frontendcritical

React 19 Server Actions: Deterministic Optimistic State and Non-Blocking Rollbacks

Enforces deterministic synchronization between client optimistic updates and React 19 Server Action resolution. Mandates pairing useOptimistic strictly with useActionState or startTransition to guarantee automatic, non-blocking rollbacks on server rejection and eliminate state tearing across concurrent mutations.

Blocks:Manual useState synchronization and untracked mutations bypassing React 19 Action transitions and rollback guarantees
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-ssr-boundary-isolation
frontendcritical

Vite 6 Environment API: Strict Boundary Isolation for Multi-Runtime SSR

Enforces architectural boundary separation and module graph isolation across simultaneous edge, browser, and server runtime environments using the Vite 6 Environment API. Eliminates runtime leakage, dual-package hazard, and polluted module evaluation by mandating environment-specific module runners, explicit resolution conditions, and target-bound plugin pipelines.

Blocks:Shared Dev Server State Contamination & Unscoped SSR Module Resolution
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-boundary-isolation
frontendcritical

Next.js 15 PPR Deterministic Static Shell and Dynamic Micro-Hole Isolation

Enforces strict segregation between static shell prerendering and dynamic server runtime operations under Next.js 15 Partial Prerendering (PPR). Mandates fine-grained React Suspense boundaries around all dynamic segments (headers, cookies, searchParams, uncached data) to preserve edge-cached static shell delivery, sub-50ms Time to First Byte (TTFB), and eliminate unmount hydration waterfalls.

Blocks:Dynamic Scope Leakage Causing Premature Static Shell De-optimization and Full-Route Dynamic Bailout
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-vite-6-environme-655
frontendcritical

Strict Runtime Boundary and Module Graph Isolation in Vite 6 Environment API

Vite 6 introduces the Environment API to orchestrate disparate runtimes (e.g., client DOM, Node.js SSR, Edge Workers) within a unified dev server pipeline. When building multi-runtime systems, plugins and modules must strictly isolate their module graphs, transform hooks, and hot-module replacement (HMR) state to prevent runtime leaks, cross-environment variable bleeding, and server-side evaluation contamination during development and bundling.

Blocks:Cross-Environment Module Graph Contamination and Shared Plugin Instance State
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-optimistic-mutation-boundaries
frontendcritical

Deterministic Rollbacks and Server Reconciliation via React 19 useActionState and useOptimistic

Enforces strict mutation boundaries in React 19 by coupling useActionState with useOptimistic to ensure deterministic rollbacks and atomic server reconciliation without third-party state managers. Prevents client-server state divergence, unhandled rejected promises during transitions, and lost optimistic updates across concurrent transitions. Guarantees that actions remain pure async state machines where the authoritative server payload triggers automatic discard of transient optimistic state.

Blocks:Ad-Hoc Imperative Optimistic State Cloned via useState Leaking Inconsistent UI on Action Failure
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-universal-runes-encapsulation-standard
frontendcritical

Svelte 5 Universal Runes Encapsulation & Reactivity Boundary Standard

Enforces strict fine-grained reactivity boundaries in Svelte 5 by restricting universal runes ($state, $derived, $effect) to component contexts and explicit .svelte.ts module encapsulations. Prohibits global state mutation leaks, naked reactive primitives across module boundaries, and unencapsulated reactive destructuring that triggers unintended render cascades and memory retention.

Blocks:Exposing Raw Runes Across Shared TS Modules Causing Reactivity Bleed and Infinite Update Cycles
Targets:Cursor•Claude•Windsurf•Codex
react-19-actions-optimistic-rollback-invariants
frontendcritical

React 19 Actions and Optimistic Mutation Rollback Invariants

Standardizes transactional client-side rollbacks in React 19 using useActionState and useOptimistic within concurrent transition boundaries. Eliminates state drift, race conditions, and corrupted form lifecycles caused by ad-hoc catch-block rollbacks during asynchronous network failures.

Blocks:Manual catch-block state rollbacks and uncoordinated useState mutations during concurrent async actions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-async-derived-effect-teardown
frontendcritical

Svelte 5 Runes Async Derived State & Effect Teardown Standard

Enforces synchronous execution boundaries across Svelte 5 runes and mandates deterministic teardown with AbortController for asynchronous work initiated in $effect. Prevents silent memory leaks, orphaned network requests, and stale-state race conditions caused by async callbacks returning Promises instead of synchronous cleanup handlers.

Blocks:Async Callback Directly Passed to $effect and Async Functions in $derived.by
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-rollback
frontendcritical

React 19 useActionState and useOptimistic Deterministic Rollback Guardrail

Enforces deterministic client-side state reconciliation using React 19's useActionState and useOptimistic hooks during concurrent server action invocations. Eliminates phantom renders, race conditions, and desynchronized UI states caused by unhandled network drops or out-of-band local state manipulation.

Blocks:Ad-Hoc useState Mutation and Uncoordinated Optimistic UI during Server Action Execution
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-store-boundary-ownership-isolation
frontendcritical

Svelte 5 Runes: Signals-to-Store Boundary & Ownership Tree Isolation

Enforces deterministic ownership tree isolation when bridging external event streams or legacy Svelte stores with Svelte 5 Runes. Prevents catastrophic memory leaks, orphaned reactive tracking roots, and cyclical cascading invalidations by mandating explicit lexical scoping, effect roots, and untracked boundary transitions.

Blocks:Unbounded Module-Level Effects and Cyclical Store-to-Rune Bidirectional Binding Leaks
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-boundaries
frontendcritical

Deterministic Rollback and Schema Boundaries for React 19 useActionState and useOptimistic

Enforces deterministic state synchronization between React 19 Server Actions, useActionState, and useOptimistic primitives. Mandates strict schema validation boundaries for action payloads and structured discriminated-union error responses to guarantee immediate, automatic rollback on server rejections without client-side state divergence.

Blocks:Unbounded Optimistic Mutation with Detached Imperative Rollbacks and Unvalidated Action Payloads
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-scope-isolation
frontendcritical

Svelte 5 Runes Reactive Scope Isolation Across Async Boundaries

Enforces strict lexical encapsulation of $state and $derived runes across asynchronous micro-task boundaries to prevent reactive context detachment and memory leaks. Guarantees that async operations explicitly tie into lifecycle cancellation via AbortController and avoid capturing stale signal references across unmounted component trees.

Blocks:Capturing Reactive Runes in Asynchronous Continuations Without Teardown or Abort Mechanisms
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-graph-boundary-standard
frontendcritical

Svelte 5 Runes Reactive Graph Boundary & Signal Isolation Standard

Enforces strict isolation of the Svelte 5 rune reactive dependency graph across component and module boundaries. Precludes deep-state leakage, cyclic signal dependencies, and uncontained micro-frontend re-renders by enforcing encapsulation of mutable $state, pure derived computations via $derived.by, and controlled boundary mutations using explicit accessors or getters.

Blocks:Leaking Raw $state Across Module Boundaries Causing Cascading Cross-Micro-Frontend Re-Renders and Graph Poisoning
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-boundary-standard
frontendcritical

Next.js 15 PPR: Strict Suspense Boundary Decoupling for Static Shells

Next.js 15 Partial Prerendering (PPR) requires dynamic APIs and uncached data fetches to be strictly sequestered behind explicit React Suspense boundaries. Invoking dynamic execution directly in page or layout shell components de-optimizes the entire route to dynamic on-demand SSR, destroying edge-cacheable static shell prerendering and ballooning Time to First Byte (TTFB).

Blocks:Accessing Dynamic APIs Directly in Page Shell Components, Collapsing Static PPR Prerendering
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-mutation-integrity
frontendcritical

React 19 Server Actions & Optimistic Mutation Serializability Guardrail

Enforces deterministic state reconciliation, idempotency tracking, and transaction serializability across concurrent useOptimistic and useActionState invocations. Prevents UI state tearing, ghost mutations, and race conditions caused by non-monotonic response ordering in concurrent React 19 Server Actions.

Blocks:Unordered Optimistic State Mutation with Unbound Action Race Hazards and Silent Failure Drifts
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-boundary-enforcement
frontendcritical

Svelte 5 Runes Reactivity Boundary and Signal Invariant Enforcement

Establishes strict unidirectional signal-graph boundaries using Svelte 5 runes ($state, $derived, $effect, and untrack) to eliminate side-effect cascades, cyclic dependency loops, and untracked microtask mutations. Mandates that derived computations remain strictly pure and idempotently evaluable without mutating upstream or downstream state.

Blocks:Mutating reactive state inside $derived expressions or unbounded $effect cycles triggering reactivity graph thrashing
Targets:Cursor•Claude•Windsurf•Codex
react-19-useactionstate-optimistic-mutation-boundary
frontendcritical

React 19 useActionState & useOptimistic Mutation Boundary & Concurrent Rollback Guardrail

Enforces strict mutation boundaries and transition scopes when pairing React 19 useActionState and useOptimistic. Prevents state tearing, unbounded memory retention, and stale closure race conditions during concurrent server-action dispatches in high-throughput enterprise applications.

Blocks:Mutating optimistic state outside active Transitions or maintaining synchronized state via effects leading to memory leaks and broken rollback semantics.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-proxy-isolation
frontendcritical

Svelte 5 Runes Fine-Grained Reactive Proxy Isolation and Boundary Enforcement

Enforces strict boundary encapsulation for Svelte 5 reactive proxies created by $state() in complex, state-driven dashboards. Eliminates cross-component mutable proxy leaks, unbounded deep dependency graph traversal in effects, and memory leaks by mandating $state.raw(), $state.snapshot(), and encapsulated domain stores.

Blocks:Uncontained Cross-Component Reactive Proxy Passing and Deep Effect Signal Pollution
Targets:Cursor•Claude•Windsurf•Codex
next15-ppr-dynamic-boundary-isolation
frontendcritical

Next.js 15 PPR: Strict Boundary Isolation for Static Shells and Dynamic Streams

Next.js 15 Partial Prerendering (PPR) mandates an impermeable architectural boundary between build-time static shells and runtime dynamic micro-streams. Accessing dynamic context—such as cookies(), headers(), dynamic route parameters, or uncached data queries—outside an explicit React Suspense boundary invalidates the static shell, degrading the route to fully dynamic server-side rendering and blocking initial Time to First Byte (TTFB). All dynamic operations must be strictly encapsulated into leaf Server Components wrapped in Suspense boundaries with deterministic fallbacks.

Blocks:Leaking Dynamic API Invocations to Page or Layout Roots Outside Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-taint-boundary-protection
frontendcritical

Enforce React 19 Taint Boundaries for Server Actions and Client Tree Props

Mandates compile-time isolation and runtime taint protections using React 19 taint APIs (experimental_taintObjectReference, experimental_taintUniqueValue) across Server Component boundaries and Server Action responses. Prohibits passing raw database records, sensitive environment variables, or cryptographically private tokens to Client Components.

Blocks:Returning Raw ORM Entities or Unsanitized Secrets from Server Actions Across the RSC Client Serialization Boundary
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-universal-runes-ssr-memory-isolation
frontendcritical

Svelte 5 Universal Runes SSR Isolation and Memory Leak Prevention

Enforces strict request-scoped lifecycle boundaries on Svelte 5 universal reactive runes ($state, $derived) within .svelte.ts modules. Prohibits module-level reactive singletons and unmanaged $effect.root allocations that persist across concurrent SSR requests and cause multi-tenant cross-contamination or memory exhaustion.

Blocks:Module-scoped universal runes persisting across concurrent SSR requests, causing data cross-contamination and heap leaks.
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-module-isolation
frontendcritical

Vite 6 Environment API Runtime Module Isolation and Cross-Graph Leakage Prevention

Mandates strict environment boundary isolation in Vite 6 multi-runtime module graphs (Browser, Node.js, and workerd). Enforces environment-scoped plugin hooks, explicit resolution conditions, and runtime boundary guards to eliminate cross-environment module pollution and hydration failures.

Blocks:Leaking runtime-specific singletons, un-scoped plugin transforms, and incompatible native APIs across shared Vite 6 Environment graphs.
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-origin-crypto-binding
frontendcritical

React 19 Server Action Cryptographic Binding and Strict Origin Verification

Enforces strict origin validation and cryptographically signed server closures across React 19 Server Actions. Eliminates unauthorized direct RPC invocation and CSRF mutations by mandating same-origin verification, session-derived state over mutable client arguments, and tamper-proof closure binding.

Blocks:Exposing Unauthenticated Direct RPC Endpoints via Unbounded Server Actions and Missing Origin Checks
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-taint-boundary-isolation
frontendcritical

Next.js 15 PPR Dynamic Taint Boundary and Secret Isolation Guardrail

Enforces strict runtime isolation between statically prerendered PPR shells and dynamic server execution contexts in Next.js 15. Mandates the use of React Server Component taint APIs (`experimental_taintObjectReference`, `experimental_taintUniqueValue`) and explicit Suspense dynamic boundaries to prevent auth credentials, tenant contexts, and server secrets from leaking into client bundles or static build caches.

Blocks:Baking dynamic runtime credentials or untainted tenant sessions into prerendered static streaming shells
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-boundary-isolation-standard
frontendcritical

Next.js 15 Partial Prerendering (PPR) Boundary Isolation & Static Shell Guarantees

Enforces strict segregation between static build-time edge shells and dynamic streaming micro-boundaries in Next.js 15 applications using React 19. Awaiting dynamic I/O primitives (cookies, headers, searchParams, uncached fetch) outside of an explicit React Suspense boundary de-optimizes the entire route segment to full SSR, eliminating edge TTFB advantages.

Blocks:Leaking Dynamic Accessors to Route Shells Causing Full-Route Dynamic De-Optimization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-universal-runes-microfrontend-contract
frontendcritical

Svelte 5 Universal Runes Reactive State and Micro-Frontend Boundary Guardrail

Enforces fine-grained signal reactivity via Svelte 5 universal runes ($state, $derived, $effect) across module boundaries and micro-frontend envelopes. Guarantees that internal proxy-wrapped state mutations remain encapsulated and are bridged to external foreign frameworks (React, Vue, Web Components) through explicit snapshots or readonly getter protocols rather than leaking raw reactive proxies across boundaries.

Blocks:Leaking Svelte 5 Deep Reactive Proxies Across Framework Boundaries and Bypassing Universal Module Contracts
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-raw-state-boundary-standard
frontendcritical

Svelte 5 Runes Raw State Boundary Standard for High-Frequency Telemetry

Enforces the mandatory application of $state.raw over deep $state proxies for high-frequency telemetry streams, WebSockets, and real-time dashboard data feeds in Svelte 5. Deep proxy wrapping on sub-second data ingress causes catastrophic garbage collection churn and UI frame drops. High-frequency state must treat payload objects as immutable structures updated via atomic reference reassignment.

Blocks:Wrapping High-Frequency Ingress Payloads in Recursive Deep-Reactive $state Proxies
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamicio-boundary-invariant
frontendcritical

Next.js 15 PPR & DynamicIO Deterministic Boundary Guardrail

Enforces strict structural boundaries between static prerender shells and dynamic streaming Suspense holes under Next.js 15 Partial Prerendering (PPR) and DynamicIO. Isolates dynamic API calls (cookies, headers, searchParams, uncached I/O) within explicit React Suspense boundaries to eliminate silent static bailouts and request cache poisoning.

Blocks:Leaking Un-Suspended Request-Time APIs into Static Prerender Shells
Targets:Cursor•Claude•Windsurf•Codex
react19-optimistic-action-rollback-boundaries
frontendcritical

React 19 Concurrent Optimistic Mutation and Rollback Boundary Isolation

Enforces strict transactional state containment and deterministic error boundary contracts across useActionState and useOptimistic during concurrent transition interruptions. Mandates explicit reconciliation identifiers and prevents unhandled server action rejections from desynchronizing UI trees or corrupting optimistic queues.

Blocks:Unbounded Optimistic State Mutations with Leaked Transition Errors and Ghost State Inconsistencies
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-proxy-sandboxing
frontendcritical

Svelte 5 Runes Universal Reactive Proxy Sandboxing & Memory Boundary Isolation

Enforces strict boundary encapsulation when passing Svelte 5 `$state` deep proxies across asynchronous boundaries like Web Workers, XState machines, or IndexedDB storage engines. Prevents silent proxy detachment, prototype serialization corruption, and unbounded memory leaks by requiring explicit structured cloning via `$state.snapshot()` and raw proxy sandboxing.

Blocks:Leaking Svelte 5 $state Proxies Directly into PostMessage, Structured Clone, or External Finite State Machine Contexts
Targets:Cursor•Claude•Windsurf•Codex
react-19-actions-optimistic-rollback-standard
frontendcritical

React 19 Server Actions and useOptimistic Deterministic Rollback Standard

Enforces strict atomicity and deterministic rollback patterns when handling asynchronous Server Actions in React 19. Prohibits manual state synchronization, stale closure variable captures during async pauses, and unhandled Server Action rejections that corrupt optimistic UI representations.

Blocks:Manual State Synchronization and Stale Closure Mutation During Async Server Action Rejections
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-boundary-isolation-pattern
frontendcritical

Svelte 5 Runes Reactive Boundary Isolation and Pure Derivation Standard

Enforces deterministic, fine-grained reactivity boundaries in Svelte 5 utilizing explicit $state and pure $derived.by runes. Prohibits cross-component shared state mutation leaks, bidirectional prop mutation anti-patterns, and implicit side-effects inside reactive derivations.

Blocks:Mutating Shared External State Inside Complex Derivations or Leaking Mutable $state Proxies Across Component Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react19-server-actions-idempotency-rollback-boundaries
frontendcritical

React 19 Server Actions Idempotency Keys and Optimistic Rollback Snapshots

Enforces strict boundary isolation between React 19 optimistic UI mutations and server-side execution. Mandates cryptographically unique idempotency keys per user-initiated mutation and deterministic rollback state snapshots to prevent split-brain UI states, out-of-order resolution, and duplicate server mutations during network partitions.

Blocks:Unkeyed Server Action Execution with Non-Deterministic Optimistic Drift
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-memory-scoping-root-effect-teardown
frontendcritical

Svelte 5 Universal Runes Memory Scoping and Root Effect Teardown

Enforces strict memory boundary management and explicit root effect disposal for Svelte 5 universal runes instantiated outside component lifecycles. Guarantees that reactive closures in long-lived client contexts, service modules, and micro-frontend hosts do not retain detached DOM nodes or leak heap across view transitions.

Blocks:Unmanaged $effect.root Instantiations and Leaked Universal Reactive Closures Across View Transitions
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-useoptimistic-reconciliation
frontendcritical

Deterministic Rollback Semantics and Optimistic Reconciliation in React 19

Governs state reconciliation across concurrent Server Actions and React 19 useOptimistic projections. Guarantees deterministic rollbacks, prevents visual tearing from out-of-order async resolutions, and enforces immutable transition pipelines.

Blocks:Unsequenced Out-of-Order Optimistic Mutations and Ad-Hoc Rollback State Causing UI Tearing
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-isolation
frontendcritical

React 19 Server Actions Optimistic State Isolation & Sequence Invariance

Enforces deterministic state isolation when interleaving React 19 useActionState and useOptimistic during high-frequency concurrent mutations. Prevents UI tearing and out-of-order state reconciliation in collaborative workspaces by tethering optimistic updates strictly to canonical server action base state. Eliminates synchronization race conditions by strictly disallowing intermediate useState synchronization layers.

Blocks:Leaking unversioned local state buffers across useOptimistic boundaries during rapid concurrent Server Action executions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-boundary-signal-leakage-prevention
frontendcritical

Svelte 5 Universal Runes Boundary & Signal Leakage Prevention

Enforces strict boundary encapsulation between Svelte 5 fine-grained reactive signals ($state, $derived, $effect) and external un-tracked DOM cycles or universal runtime singletons. Eliminates memory leaks and uncollected component subtrees caused by escaped reactive closures and unmanaged effect roots.

Blocks:Escaping Reactive Signal Graphs into Long-Lived DOM Handlers and Uncontained Universal Modules
Targets:Cursor•Claude•Windsurf•Codex
react19-server-component-tainted-object-boundary
frontendcritical

React 19 Server Component Tainted Object Invariant

Enforces strict boundary isolation for sensitive server-side payloads using React 19 experimental taint APIs. Guarantees that raw database models, authorization secrets, and sensitive tokens cannot be serialized and passed across the Server-to-Client component boundary, mandating explicit projection to client-safe Data Transfer Objects (DTOs).

Blocks:Passing Untainted Raw Server Entities or Secrets Directly Across the RSC Serialization Boundary
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-optimistic-boundaries
frontendcritical

React 19 Server Actions Idempotency Keys and Optimistic State Rollback Invariants

Enforces strict client-generated UUIDv7 or nanoid idempotency tokens for all mutating React 19 Server Actions, coupled with non-blocking useOptimistic state bindings. Guarantees deterministic rollback upon action failure, prevents dual execution under network retries, and eliminates UI drift across concurrent distributed transitions.

Blocks:Non-Idempotent Server Action Submissions with Blocking or Un-Rollbackable Optimistic State
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-lifecycle-boundary-invariant
frontendcritical

Svelte 5 Runes Universal Reactivity & Deep Mutation Boundary Standard

Enforces strict state ownership, cleanup boundaries, and async lifecycle containment in Svelte 5 fine-grained reactivity. Prevents microtask race conditions, stale proxy mutations post-unmount, and uncontrolled proxy overhead on non-reactive external structures.

Blocks:Unbounded Async Mutations & Leaked Effect Proxies Across Svelte 5 Rune Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-chunk-isolation-treeshaking
frontendcritical

Vite 6 & Rolldown: Deterministic Chunk Isolation and Pure Tree-Shaking

Enforces strict module boundary isolation, explicit tree-shaking annotations, and deterministic chunk distribution for Vite 6 powered by Rolldown. Eliminates circular dependency deadlocks and barrel file cascades to guarantee sub-50ms hot module replacement (HMR) and zero-vendor dead-code leakage in Rust-native build pipelines.

Blocks:Monolithic Barrel Re-Exports and Unmarked Side-Effects Poisoning Rolldown Module Invalidation Graph
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-io-boundary-isolation
frontendcritical

Strict Suspense Boundary Isolation for Next.js 15 Dynamic I/O and PPR

Enforces compile-time and runtime isolation of dynamic asynchronous operations behind React Suspense boundaries in Next.js 15. Prevents dynamic I/O leaks—such as uncached database queries, headers(), cookies(), or unresolved searchParams—from poisoning the root static prerender shell and degrading initial Time to First Byte (TTFB).

Blocks:Unenclosed Asynchronous Dynamic I/O Poisoning the Static Prerender Shell
Targets:Cursor•Claude•Windsurf•Codex
tanstack-query-v5-offline-mutation-queuing-deduplication
frontendcritical

TanStack Query v5: Bounded Serialized Mutation Queuing and Idempotency Guardrail

Enforces strict mutation idempotency and deterministic serial execution for offline-capable frontend clients using TanStack Query v5. Prevents out-of-order replays, duplicate resource creation, and poison-pill queue blockages during network transitions via mutation scopes, client-side idempotency keys, and bounded storage.

Blocks:Unscoped, Non-Idempotent Mutation Replay Causing Race Conditions and Duplicate Writes on Network Recovery
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-runtime-isolation
frontendcritical

Vite 6 Environment API Deterministic Runtime Boundary Isolation

Enforces deterministic module resolution boundaries and isolated module graphs across distinct Vite 6 execution contexts (browser, Node.js SSR, and edge/workerd runtimes). Prevents runtime leakage, cross-environment cache contamination, and invalid export condition resolution in multi-target architectures.

Blocks:Global Resolution Bleed and Cross-Runtime Module Graph Contamination
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-invariants
frontendcritical

Svelte 5 Runes State Architecture, Derived Tracking, and Snippet Composition

Enforces deterministic reactivity paradigms in Svelte 5 by mandating fine-grained runes ($state, $derived, $props, $effect) and snippet composition while eliminating legacy Svelte 3/4 semantics ($: labels, export let, <slot />). Prohibits state mutation loops within reactive tracking contexts and mandates unidirectional data derivation to prevent ghost renders, signal desynchronization, and memory leaks.

Blocks:Mutating State Inside $effect Instead of $derived and Persisting Legacy Slot/Export Bindings
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-serialization-isolation
frontendcritical

React 19 Server Actions Boundary Isolation & State Serialization Standard

Enforces rigid boundary isolation for React 19 Server Actions and action state transitions across the client-server boundary. Prevents Flight protocol serialization crashes, closure memory leaks, and credential leakage by mandating explicit Data Transfer Object (DTO) projection and prohibiting non-serializable references in action closures and return states.

Blocks:Leaking Sensitive Server State and Unserializable References via Unbounded Server Action Closures
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-state-invariant
frontendcritical

React 19 Transactional Server Actions & Optimistic State Synchronization Guardrail

Enforces deterministic state reconciliation and optimistic rollbacks across progressive hydration boundaries using React 19 primitives (useActionState, useOptimistic, startTransition). Prevents race conditions, state tearing, and phantom mutations during concurrent asynchronous Server Action dispatches.

Blocks:Uncoordinated Manual Optimistic State Mutation with Unbound Async Dispatches Causing Concurrent UI Tearing
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-reactive-memory-isolation
frontendcritical

Svelte 5 Runes SSR Reactive Scope Isolation and Cross-Request Leak Prevention

Declaring module-scoped `$state()` or reactive rune proxies in Svelte 5 causes catastrophic state bleeding and memory leaks across concurrent SSR request threads. In server runtimes (Node.js, Bun, Cloudflare Workers), module scope is shared across all concurrent executions, meaning global reactive state exposes authenticated user data across requests. Engineers must quarantine reactive runes inside per-request component trees via Svelte Context or request-bound state factory instances.

Blocks:Exporting Singleton `$state` Proxies in Module Scope During Server-Side Rendering
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-isolation
frontendcritical

Next.js 15 PPR Dynamic Hole Isolation and Static Shell Determinism

Enforces strict isolation of dynamic runtime operations inside localized React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic bailouts (headers, cookies, searchParams, un-cached data queries) from leaking upward and de-optimizing edge-cacheable static shell generation into fully dynamic SSR passes. Guarantees deterministic Time-To-First-Byte (TTFB) at edge Points of Presence (POPs) by mandating non-dynamic layouts and strict dynamic hole sandboxing.

Blocks:Unbounded Dynamic Access Leaking Across Layout Hierarchies Causing Static Shell De-optimization
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-decoupling
frontendcritical

Vite 6 Environment API: Multi-Runtime Module Decoupling and Graph Isolation

Enforces strict boundary isolation and dedicated compilation graphs across client, Node.js, and workerd/edge runtimes using the Vite 6 Environment API. Prevents runtime-specific polyfill bleeding, Node.js built-in leakage into edge/browser bundles, and illegal cross-environment module graph invalidations in hybrid SSR architectures.

Blocks:Monolithic ModuleGraph Sharing and Legacy SSR Flag Branching Leaking Runtime Globals
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-state-raw-deep-proxy-isolation
frontendcritical

Svelte 5 $state.raw Deep Proxy Isolation for High-Frequency State

Enforces immutable reference tracking via Svelte 5 '$state.raw' for high-frequency telemetry, large collections, and canvas/WebGL render buffers. Using standard deep reactive '$state' on volatile datasets creates hundreds of recursive Proxy instances per frame, triggering severe garbage collection churn and micro-task scheduler saturation.

Blocks:Wrapping high-frequency telemetry streams, large arrays, or canvas frame buffers in deeply reactive '$state' proxies.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-distributed-cache-tag-invalidation-boundary
frontendcritical

Next.js 15 Distributed Cache Tag Invalidation Boundary

Mandates deterministic compound cache key topology and synchronized multi-region invalidation boundaries when utilizing Next.js 15's 'use cache', 'cacheTag', and 'cacheLife' APIs. Prevents stale edge node divergence and regional split-brain reads across geo-distributed deployments by enforcing namespaced, compound cache tags and distributed cache consistency.

Blocks:Unscoped Global Tags and In-Memory Revalidation in Multi-Region Distributed Clusters
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-streaming-isolation
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Hole Streaming Isolation

Next.js 15 Partial Prerendering requires strict boundary separation between static prerendered shells and dynamic runtime execution. Invoking dynamic APIs (e.g., cookies(), headers(), searchParams, or uncached database reads) in a route component without wrapping it in an explicit React Suspense boundary invalidates the prerendered shell and forces full-route server-side rendering de-optimization.

Blocks:Calling dynamic request-time APIs directly in root layouts or page components without Suspense containment, de-optimizing the static shell into full SSR.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-preload-cache-invalidation-invariants
frontendcritical

TanStack Router Preload Cache Synchronization and Mutation Invalidation Standards

Enforces deterministic loader cache lifecycles, abort signal propagation, and synchronous route invalidation across rapid client transitions in TanStack Router. Prevents race conditions and stale-data read anomalies caused by asynchronous preloads competing with concurrent mutations or fast navigational switches.

Blocks:Unsynchronized In-Flight Route Preloads Overwriting Fresh Mutation State and Creating Stale Loader Anomalies
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-fallback-invariants
frontendcritical

Next.js 15 PPR Static Shell Isolation & Streaming Fallback Invariants

Enforces strict isolation between static prerendered page shells and dynamic runtime components in Next.js 15 Partial Prerendering (PPR). Mandates deterministic dimensional reservation via static fallback skeletons wrapped in React Suspense boundaries to eliminate layout shifts, waterfalls, and dynamic bailout de-optimizations during static analysis.

Blocks:Uncontained Dynamic Operations Leaking Into Static Shells and Dynamic Skeletons Causing PPR De-optimization
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-universal-reactivity-isolation
frontendcritical

Svelte 5 Runes: Universal Reactivity Isolation & Cross-Request SSR Leak Prevention

Enforces strict encapsulation of Svelte 5 rune primitives ($state, $derived) and explicit lifecycle termination ($effect.root) inside per-request contexts. Prevents catastrophic multi-tenant state bleed and memory retention hazards across concurrent requests in long-lived Node.js and Edge SSR runtimes.

Blocks:Module-Scoped $state Singletons Leaking User Data Across Concurrent SSR Sessions
Targets:Cursor•Claude•Windsurf•Codex
react-19-resource-pre-orchestration-metadata-guardrail
frontendcritical

React 19 Document Metadata and Resource Pre-orchestration Standard

Enforces React 19 native document metadata hoisting and deterministic resource pre-orchestration using stylesheet precedence and react-dom preloading APIs. Prevents Cumulative Layout Shift (CLS) and Flash of Unstyled Content (FOUC) caused by non-deterministic asset injection in asynchronous streaming SSR pipelines. Guarantees deduplication across concurrent Suspense boundaries by strictly delegating asset lifecycle management to the React runtime.

Blocks:Imperative DOM Head Injection and Unprecedenced Link Tags in Streaming Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-ppr-boundaries
frontendcritical

Enforce Next.js 15 Dynamic I/O Isolation and Deterministic PPR Boundaries

Prevents catastrophic prerender de-optimizations and cascading I/O waterfalls in Next.js 15 with Partial Prerendering (PPR) and Dynamic I/O enabled. Mandates that all uncached dynamic operations are strictly encapsulated within React Suspense boundaries, preventing dynamic state from poisoning the static shell.

Blocks:Leaking Uncached Dynamic Operations into Static Shells Collapsing PPR into Dynamic SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-mutation-isolation-boundaries
frontendcritical

Svelte 5 Runes Fine-Grained Reactive State & Deep Mutation Isolation

Enforces strict isolation boundaries around Svelte 5 $state proxies to eliminate microfrontend state tearing, infinite cyclic re-render loops, and untracked cross-boundary mutations. Requires explicit read/write separation via $state.snapshot, strict $state.raw for external payload exchanges, and mandatory untrack() encapsulation in effects.

Blocks:Leaking Deep $state Proxies Across Boundaries and Triggering Cascading Reactive Loops via Implicit Effect Reads
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-teardown-reconciliation
frontendcritical

Svelte 5 Runes Signal-DOM Deterministic Teardown & Lifecycle Reconciliation

Enforces deterministic teardown of fine-grained reactive $effect graphs and asynchronous execution chains during rapid client-side transitions in Svelte 5. Prevents detached DOM nodes, stale signal emissions, and catastrophic memory leaks caused by lingering async closures capturing component runes across route unmount boundaries.

Blocks:Dangling Async Runes Closures Retaining Detached DOM and Uncollected Reactive Graphs
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-isolation-standard
frontendcritical

Next.js 15 Partial Prerendering (PPR) Shell Isolation & Boundary Decoupling

Mandates strict boundary decoupling between static shell prerendering and dynamic streaming holes in Next.js 15 PPR routes. Dynamic APIs (cookies, headers, searchParams, and uncached data sources) must be strictly isolated inside dedicated Suspense boundaries to prevent prerender bailouts, shell invalidation, and dynamic context leakage.

Blocks:Accessing Dynamic Context in Route Shells or Suspense Fallbacks Causing Full-Tree Prerender Bailouts
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-boundary-standard
frontendcritical

Strict Multi-Runtime Module Resolution Boundary via Vite 6 Environment API

Enforces complete structural isolation between Edge, Node.js (SSR), and Client (Browser) module graphs using Vite 6's Environment API. Eliminates silent runtime symbol leaks, unintended secret exposure, and browser bundling failures caused by sharing untyped runtime-agnostic module paths. Mandates explicit environment conditions, separated module instances, and zero cross-runtime direct imports.

Blocks:Cross-Runtime Symbol Contamination via Shared Module Graphs in Vite SSR Pipelines
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-concurrency
frontendcritical

React 19 Server Actions & Optimistic Concurrency Invariants

Mandates deterministic state reconciliation for React 19 mutations using useActionState and useOptimistic within strict transition boundaries. Prevents state divergence, lost updates, and orphaned optimistic UI under high network latency or out-of-order response arrival.

Blocks:Decoupled Client State Mirroring and Fire-and-Forget Server Actions Causing Torn State Under Network Jitter
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-isolation-vite-6-environme-532
frontendcritical

Vite 6 Environment API Multi-Runtime Isolation and Boundary Protocol

Enforces strict isolation across client, Node.js (SSR), and Edge/workerd runtime module graphs using the Vite 6 Environment API. Prevents runtime cross-contamination, illegal module execution via deprecated APIs, and leakage of Node.js-specific built-ins into edge and browser compilation targets.

Blocks:Cross-Contaminating Multi-Target Module Graphs and Relying on Deprecated Single-SSR APIs
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-concurrency-isolation
frontendcritical

Svelte 5 Runes SSR State Isolation & Request Concurrency Guardrail

Universal Svelte 5 runes ($state, $derived) declared at module scope create persistent singletons in Node.js/SSR runtimes that survive across individual HTTP transactions. Any mutable rune instantiated outside the component lifecycle or Svelte context leaks user sessions, permissions, and reactive proxies across concurrent requests. All dynamic or user-specific state must be instantiated per-request using context encapsulation or factory injection.

Blocks:Module-Scoped Runes Singletons Leaking State Across Concurrent SSR Requests
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-shell-fallback-boundaries
frontendcritical

Next.js 15 PPR Dynamic Shell and Suspense Boundary Isolation

Enforces strict static HTML skeleton delivery at the edge by isolating dynamic runtime operations within granular React Suspense boundaries. Any access to uncached dynamic I/O, headers, cookies, or searchParams outside a Suspense boundary triggers an uncaught route-level dynamic bailout, collapsing Partial Prerendering into full-page SSR and defeating edge TTFB optimization.

Blocks:Un-Suspended Dynamic Function Calls and Leaked Runtime State Forcing Full-Route SSR De-optimization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-isolation-proxy-traps
frontendcritical

Svelte 5 Runes Reactive Isolation & Deep Proxy Trap Guardrails

Enforces strict fine-grained reactivity boundaries in Svelte 5 by preventing deep proxy leaks into external systems and eliminating destructuring-induced reactive loss. Guarantees memory safety and deterministic rendering through explicit $state.raw usage for heavy/external references and $state.snapshot for boundary handoffs.

Blocks:Leaking Svelte 5 $state deep reactive proxies across package boundaries and destructuring reactive primitives
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-csrf-validation
frontendcritical

React 19 Server Actions Idempotency & CSRF Strict Origin Validation

Enforces strict origin checking, host header verification, and cryptographic idempotency key caching for React 19 Server Actions. Guarantees cross-site POST replay resilience and prevents duplicate execution of mutating server functions in modern RSC architectures under network retry or concurrent submission conditions.

Blocks:Executing Non-Idempotent Server Actions Without Origin Validation or Replay Protection
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-ssr-context-isolation
frontendcritical

Vite 6 Environment API: Multi-Runtime SSR State and Module Context Isolation

Enforces strict isolation boundaries across Client, Node.js, and Edge/Workerd environments within Vite 6 multi-runtime setups. Prevents cross-environment module graph pollution, ambient global mutations, and shared memory leakage across asynchronous request contexts during unified SSR compilation and execution.

Blocks:Global Module Singletons and Unisolated Cross-Runtime Module Graphs in Vite 6 SSR
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-boundaries-production-standard
frontendcritical

Next.js 15 PPR Boundary Isolation and Deterministic Shell Invariants

Enforces strict structural segregation between prerendered static layout shells and dynamic streaming leaves under Next.js 15 Partial Prerendering (PPR). Mandates explicit React Suspense boundaries around all dynamic I/O operations (headers, cookies, searchParams promises, uncached queries) to guarantee zero prerender shell collapse and deterministic, layout-shift-free fallback streaming.

Blocks:Leaking Dynamic Request Context or Un-Suspended Async Components into Static Shells Causing Full Route Prerender De-optimization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-module-singleton-lifecycle-boundaries
frontendcritical

Svelte 5 Module-Level Reactive Singletons and Effect Lifecycle Boundaries

Enforces strict encapsulation and lifecycle boundaries for module-level Svelte 5 runes ($state, $derived) shared across components. Prevents runaway reactive dependencies, dangling untracked effects, and memory leaks by forbidding naked effects in module scope and mandating explicit $effect.root cleanup contracts.

Blocks:Instantiating Naked $effect Calls in Module Scope and Leaking Cross-Component Signal Subscriptions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-effect-isolation
frontendcritical

Svelte 5 Runes Async Boundary & Effect Teardown Isolation

Enforces synchronous dependency tracking and explicit cancellation isolation for asynchronous operations inside Svelte 5 $effect runes. In Svelte 5, reactive signal reads after an await boundary lose tracking, and async callbacks return Promises that drop cleanup teardowns. This standard guarantees lifecycle-safe asynchronous task execution and prevents orphaned listeners during client-side route transitions.

Blocks:Asynchronous Effect Cleanup Loss and Post-Await Reactivity Tracking Leaks
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-streaming-invariants
frontendcritical

Next.js 15 PPR Dynamic Hole Streaming Invariants and Shell Isolation

Enforces strict physical boundary isolation between static Server-Side Generation (SSG) shells and dynamic streaming edge chunks under Next.js 15 Partial Prerendering (PPR). Mandates the encapsulation of dynamic runtime data fetches inside isolated Suspense boundaries paired with dimensionally stable skeleton fallbacks to prevent cascading waterfall stalls, de-opt of static page shells into dynamic SSR, and Cumulative Layout Shift (CLS) thrashing.

Blocks:Dynamic Runtime Intrusion Poisoning Static PPR Shells into Blocking SSR Waterfalls
Targets:Cursor•Claude•Windsurf•Codex
react-19-metadata-asset-preloading-standard
frontendcritical

React 19 Native Metadata Hoisting and Asset Preloading Standard

Mandates declarative document metadata (<title>, <meta>, <link>) with explicit precedence attributes and programmatic react-dom preloading APIs (preload, preinit). Eliminates client-side DOM head mutations, prevents asset waterfalls during React Server Component (RSC) streaming, and guarantees deduplicated, zero-FOUC resource loading.

Blocks:Mutating document.head in client effects, omitting precedence on stylesheets, or relying on legacy external head managers causing FOUC and network waterfalls.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-module-state-ssr-isolation
frontendcritical

Svelte 5 Runes Module-State Boundary Isolation & Cross-Request SSR Leak Prevention

Enforces strict lifecycle boundaries around Svelte 5 module-scoped runes ($state, $derived) in universal and SSR applications. Module-level reactive declarations persist across multiple server requests within shared Node/serverless runtimes, precipitating catastrophic cross-tenant data contamination and unbounded memory exhaustion. All mutable reactive state within SSR-traversed code paths must be strictly scoped to component trees via Context API, request locals, or lifecycle-bound factory instantiations.

Blocks:Shared Module-Scope $state() in Universal Modules Inducing Cross-User Session Leakage
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-cryptographic-argument-verification
frontendcritical

React 19 Server Actions Cryptographic Argument Verification & Boundary Invariants

Enforces strict cryptographic verification, authoritative session extraction, and schema parsing for all bound closure arguments and payload parameters across React 19 Server Action boundaries. Prevents Insecure Direct Object References (IDOR), boundary parameter tampering, and privileged action escalation in client-server RPC pipelines.

Blocks:Implicit Trust in Bound Server Action Arguments and Unsigned Client-Transited Closure State
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-invariants
frontendcritical

React 19 Server Actions & useActionState Idempotency and State Reconciliation Guardrail

Enforces strict mutation idempotency, cryptographically validated client transaction tokens, and deterministic state reconciliation across React 19 useActionState and useOptimistic boundaries. Prevents duplicate state mutations, replay attacks, and inconsistent optimistic rollbacks during transient network failures and rapid concurrent form dispatches in full-stack SSR environments.

Blocks:Non-Idempotent Server Action Invocations and Unbounded Optimistic UI Desynchronization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-lifecycle-isolation
frontendcritical

Svelte 5 Runes $effect Lifecycle and Memory Isolation Standards

Enforces strict boundary constraints and deterministic microtask execution for Svelte 5 $effect, $effect.pre, and $effect.root runes. Eliminates cyclic signal cascading, unmanaged listener memory leaks, and improper synchronization across fine-grained universal reactivity trees. Mandates explicit untracking of non-dependent state reads and strict teardown semantics.

Blocks:Cyclic Signal Updates and Leaked Subscriptions via Implicitly Tracked Side-Effects in Svelte 5 Runes
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-reconciliation
frontendcritical

React 19 Server Actions & useOptimistic Multi-Flight Reconciliation Guardrail

Enforces deterministic rollback boundaries, monotonic sequence tracking, and transition containment for React 19 useOptimistic integrated with Server Actions. Eliminates ghost state clobbering, race-conditioned rollbacks, and out-of-order state reconciliation during concurrent multi-flight mutations and network partitions.

Blocks:Unsequenced Multi-Flight Server Actions with Naked useOptimistic State Clobbering
Targets:Cursor•Claude•Windsurf•Codex
vite-6-heterogeneous-environment-isolation-standard
frontendcritical

Vite 6 Environment API: Heterogeneous Multi-Runtime Isolation & Asset Sandbox Standard

Enforces strict runtime module boundary isolation, deterministic environment-keyed resolution conditions, and sandboxed asset compilation across Edge, Web Worker, SSR, and Client targets using the Vite 6 Environment API. Eliminates shared module graph pollution, illegal native Node/DOM API cross-imports, and leaked execution contexts in federated micro-app architectures.

Blocks:Monolithic Module Resolution and Shared Memory Leaks Across Heterogeneous Runtimes in Vite Builds
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-distributed-cache-tag-tenant-isolation
frontendcritical

Next.js 15 Distributed Cache-Tag Partitioning & Multi-Tenant Cache Key Guardrail

Enforces strict cryptographic tenant-prefixing and structural key partitioning on Next.js 15 'use cache' directives and fetch cache tags. Prevents cross-tenant data exfiltration and CDN cache poisoning under distributed stale-while-revalidate cycles by mandating validated tenant-scoped cache boundaries and immutable tag schemas.

Blocks:Global Unpartitioned Cache-Tag Collisions & Cross-Tenant Edge Leaks
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-cryptographic-idempotency
frontendcritical

React 19 Server Actions Cryptographic Idempotency and Replay Guardrail

Enforces cryptographic replay protection and deterministic state reconciliation for React 19 Server Actions interacting with optimistic UI mutations. Prevents double-charge scenarios, orphaned side effects, and state desynchronization caused by automated browser retries, network blips, or concurrent optimistic dispatches. Mandates server-side idempotency keys backed by atomic reservation stores and signed action tokens.

Blocks:Blind Server Action Dispatches Subject to Network Retries and Concurrent Duplicate Executions
Targets:Cursor•Claude•Windsurf•Codex
wasm-component-model-microfrontend-isolation
frontendcritical

Wasm Component Model Isolation Standard for Untrusted Microfrontends

Enforces strict capability-based isolation for federated third-party microfrontends using the WebAssembly Component Model and WASI interfaces. Prohibits direct host DOM references, credential access, and ambient network calls, mandating typed WIT contract boundaries, virtualized memory quotas, and declarative host-side canvas or vDOM marshaling.

Blocks:Executing Third-Party Microfrontends via Unsandboxed Eval or Unrestricted Iframe/DOM Injection
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-concurrent-mutation-fencing
frontendcritical

React 19 Server Actions Concurrent Mutation Fencing & Optimistic Reconciliation

Enforces deterministic state reconciliation during concurrent React 19 Server Actions execution using transactional fencing tokens and monotonic epoch sequences. Prevents stale server responses and multi-tab race conditions from clobbering higher-version optimistic state or corrupting local caches. Mandates versioned payload validation within useActionState, useOptimistic, and Server Action transaction boundaries.

Blocks:Unfenced Server Actions with Naked useOptimistic Resulting in Stale Response Overwrite
Targets:Cursor•Claude•Windsurf•Codex
tauri-v2-ipc-zero-copy-buffer-protocol
frontendcritical

Tauri 2.0 Multi-Process IPC Zero-Copy Binary Buffer Architecture

Enforces raw binary ArrayBuffer payload handling and Rust-backed Channel streaming for high-throughput AI inferencing in Tauri 2.0. Eliminates base64/JSON string serialization bottlenecks and prevents IPC heap exhaustion caused by unmanaged deserialization bursts between the webview renderer and native Rust engine.

Blocks:JSON and Base64-Encoded High-Frequency Tensor Serialization over Tauri IPC
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactivity-boundary-ownership-invariant
frontendcritical

Svelte 5 Runes Reactivity Boundary & Ownership Invariant

Enforces strict state ownership and unidirectional data flow within Svelte 5 Runes architectures. Prohibits state mutation inside $effect runes and forbids leaking mutable reactive proxies across decoupled micro-frontend boundaries to eliminate infinite update loops and non-deterministic state synchronization.

Blocks:Mutating $state inside $effect Runes and Leaking Mutable Reactive Proxies Across Micro-Frontend Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite-6-rolldown-mfe-chunk-invariant-guardrail
frontendcritical

Vite 6 / Rolldown Micro-Frontend Federation Chunk Invariant Guardrail

Enforces strict sub-resource integrity (SRI), singleton-instance runtime locking, and resilient version skew mitigation across distributed Module Federation remotes powered by Vite 6 and Rolldown. Prevents catastrophic chunk drift, dual-react runtime crashes, and man-in-the-middle poisoning across dynamically fetched remote entry points.

Blocks:Dynamic Unpinned Federation Manifest Ingestion with Split Singletons and Missing SRI Hashes
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-rollback-abort-signal
frontendcritical

Deterministic Optimistic Rollback and AbortSignal Lifecycle in React 19 Actions

Enforces strict atomicity and deterministic rollback guarantees when orchestrating Server Actions using useOptimistic and useActionState in React 19. Mandates explicit AbortController lifecycle management across concurrent action dispatches to prevent out-of-order state reconciliation and orphaned network requests. Prohibits unbounded optimistic mutations that lack synchronization with native transition boundaries.

Blocks:Unbounded Optimistic UI State with Uncanceled Concurrent Action Mutations
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-cache-life-quarantine-boundary
frontendcritical

Next.js 15 'use cache' Isolation & Dynamic Route Quarantine Boundary

Enforces strict boundary isolation between Next.js 15 'use cache' directives and dynamic runtime inputs. Cached functions must receive primitive, deterministic arguments and quarantine dynamic context accessors like cookies(), headers(), and searchParams to outer consumer boundaries to prevent cross-tenant cache pollution and prerendering bailouts.

Blocks:Coupling Dynamic Runtime Accessors Directly Inside 'use cache' Scopes or Leaking Unsanitized Route Context into Shared Cache Keys
Targets:Cursor•Claude•Windsurf•Codex
react19-action-optimistic-rollback-boundaries-production-standard
frontendcritical

React 19 Action Optimistic Rollback Boundaries and Transactional Revert Invariants

Enforces strict transactional rollback boundaries between useActionState and useOptimistic across React 19 asynchronous transitions. Prevents UI-server state divergence, ghost states, and orphaned local mutations during network dropouts, server action rejections, or interrupted concurrent dispatches.

Blocks:Decoupled Local Mutation and Unbounded Optimistic Side-Effects During Failed Server Actions
Targets:Cursor•Claude•Windsurf•Codex
vite-6-preload-dependency-manifest-pruning
frontendcritical

Vite 6 Transitive Modulepreload Pruning for Dynamic Route Manifests

Mandates explicit pruning of transitive modulepreload dependencies using Vite 6's build.modulePreload.resolveDependencies API. Prevents browser network saturation and main-thread evaluation waterfalls caused by default unconstrained ESM preload graph generation in complex code-split architectures.

Blocks:Unconstrained Dynamic Route Preloading Causing Transitive Modulepreload Network Flooding
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-cache-life-guardrail
frontendcritical

Next.js 15 Dynamic I/O & `use cache` Compiler Boundary Invariant

Enforces strict structural boundaries between prerendered static layouts and dynamic request-time I/O in Next.js 15 Canary/Dynamic I/O modes. Prohibits direct reads of uncached asynchronous APIs inside shared layout trees and mandates explicit caching scopes using `use cache` paired with `cacheLife` and `cacheTag`. Ensures that runtime fetches are isolated within dynamic Suspense boundaries to eliminate accidental dynamic opt-outs and cascading SSR waterfalls.

Blocks:Awaiting Uncached Request-Scoped Dynamic APIs inside Static Layout Components Triggering Full-Tree Dynamic Bailing and Cascading Waterfalls
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-state-raw-mutation-isolation-guardrail
frontendcritical

Svelte 5 Runes $state.raw Mutation Isolation Guardrail

Mandates explicit shallow reactivity using `$state.raw` for high-frequency or large-scale streaming datasets to eliminate runaway deep-proxy memory overhead. Enforces complete reference re-assignment when emitting state changes and strictly forbids in-place deep mutations on raw runes. Isolates UI render cycles from high-throughput payload ingestion to guarantee sub-16ms frame budgets in real-time dashboards.

Blocks:Deep Reactive Proxy Poisoning via Deep $state Wrappers on High-Frequency Ingestion Streams
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-sandbox
frontendcritical

Vite 6 Multi-Runtime Environment Isolation & Global Sandbox Standard

Mandates isolated environment execution contexts using the Vite 6 Environment API across Node.js, Cloudflare Workerd, and Edge runtimes during SSR bundling. Prevents cross-runtime globalThis pollution, leakage of Node.js globals (Buffer, process) into edge isolates, and shared module graph corruption.

Blocks:Monolithic SSR configuration leaking Node.js primitives into Edge/Workerd runtimes via unisolated shared module graphs.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-context-boundary-pinning
frontendcritical

Next.js 15 Async Context Boundary Pinning and Request-Scope Isolation

Enforces strict boundary pinning and lifecycle isolation for Next.js 15 asynchronous request-bound APIs (`cookies()`, `headers()`, `params`, and `searchParams`). Prevents un-memoized promise escapes, dynamic context tearing across concurrent SSR stream chunks, and illegal promise references inside static or memoized cache boundaries.

Blocks:Leaking Raw Request Promises or Module-Level Dynamic Context Across Suspense and Cache Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-module-graph-bailout-guardrail
frontendcritical

Vite 6 Rolldown Static ESM Tree-Shaking Bailout Guardrail

Enforces strict static ESM purity and explicit side-effect boundary demarcation across hybrid micro-frontend dependencies. Prevents Rolldown from bailing out of module-graph tree-shaking, avoiding duplicate vendor singletons and monolithic runtime chunk generation.

Blocks:Dynamic Interop and Implicit Side Effects Triggering Rolldown Module Graph De-Optimization
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotent-mutation-boundary
frontendcritical

React 19 Server Actions Cryptographic Idempotency & State Reconciliation Boundary

Enforces cryptographically signed idempotency keys and state reconciliation tokens across React 19 useActionState transitions and Server Actions. Prevents duplicate transactional side effects, phantom re-executions during packet loss, and stale DOM state reconciliation under network degradation or double submissions.

Blocks:Un-fenced Server Actions with Blind Form Submissions Allowing Duplicate Mutations and Desynchronized Action State
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-cross-request-isolation
frontendcritical

Svelte 5 Runes SSR Cross-Request State Leakage Prevention

Enforces strict lexical encapsulation of Svelte 5 reactive runes ($state, $derived) within component lifecycles and context trees during Server-Side Rendering (SSR). Module-level mutable state in shared server processes leaks across concurrent multi-tenant requests, causing catastrophic data corruption and security breaches.

Blocks:Global Module-Level Runes Instantiation in Server-Rendered Contexts
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-reactivity-isolation-standard
frontendcritical

Svelte 5 Runes Universal Reactivity Isolation and Microtask Decoupling

Enforces strict boundary isolation between fine-grained Svelte 5 runes ($state, $derived, $effect) and asynchronous microtask/streaming event sources. Prevents UI thread starvation and infinite microtask re-render cycles by decoupling high-frequency ingestion pipelines into staging buffers before synchronizing with reactive signal graphs.

Blocks:Direct asynchronous signal mutation inside high-frequency microtask loops and unthrottled WebSocket callbacks triggering reactive dependency thrashing
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-partitioning
frontendcritical

Deterministic Multi-Runtime Module Partitioning via Vite 6 Environment API

Enforces strict compilation graph boundaries across client, Node.js SSR, and edge-worker environments using the Vite 6 Environment API. Eliminates cross-runtime pollution, prevents leaked server secrets, and guarantees deterministic module resolution across heterogeneous runtimes without relying on legacy dual-bundle hacks.

Blocks:Monolithic Isomorphic Bundling and Global Runtime Flag Pollution
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-effect-lifecycle-isolation
frontendcritical

Svelte 5 Runes Effect Lifecycle Isolation and Mutation Purity

Enforces architectural boundaries for Svelte 5 runes ($effect, $effect.pre, $derived, $state) to eliminate infinite reactive invalidation loops, memory leaks, and race conditions. Mandates pure synchronous derivation via $derived, selective reactive dependency isolation with untrack(), and mandatory disposal teardown closures for all ambient allocations.

Blocks:Synchronous State Mutation and Untracked Side-Effects Inside $effect Causing Cascade Render Loops and Memory Leaks
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-cache-tag-boundary
frontendcritical

Next.js 15 PPR Dynamic Hole and Multi-Tenant Cache-Tag Boundary Guardrail

Enforces strict isolation between static edge prerendered shells and dynamic, cookie-dependent streaming subtrees under Next.js 15 Partial Prerendering (PPR). Prevents catastrophic cross-tenant cache contamination, dynamic bailout cascading, and layout tearing by mandating scoped Suspense boundaries and tenant-partitioned cache tags.

Blocks:Baking Dynamic Tenant Context into Static Shells or Sharing Unpartitioned Cache Tags Across PPR Dynamic Holes
Targets:Cursor•Claude•Windsurf•Codex
react-19-streaming-metadata-reconciliation-standard
frontendcritical

Deterministic React 19 Document Metadata Reconciliation in Distributed Streaming Runtimes

Mandates the strict adoption of native React 19 metadata hoisting semantics across nested React Server Components (RSC) to guarantee zero layout shift (CLS) and deterministic deduplication. Prohibits legacy client-side mutation abstractions (e.g., react-helmet, next/head, direct DOM manipulation) that cause hydration mismatches and uncoordinated flushes during edge streaming. Enforces explicit precedence hierarchies on hoisted resource links to ensure atomic rendering and eliminate Flash of Unstyled Content (FOUC).

Blocks:Mutating document metadata via client-side effects or legacy wrappers during edge streaming
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-boundary-guardrail
frontendcritical

Next.js 15 Partial Prerendering (PPR) Streaming Boundary Guardrail

Enforces strict isolation of dynamic runtime contexts from static prerender shells in Next.js 15 Partial Prerendering (PPR) architectures. Prevents dynamic request-time APIs (cookies, headers, searchParams, and uncached data fetches) from de-optimizing prerendered HTML shells into full dynamic request rendering or leaking request-bound state across concurrent streams.

Blocks:Dynamic Context Leakage into Static Shells via Unguarded Request APIs
Targets:Cursor•Claude•Windsurf•Codex
react-19-streaming-metadata-hoisting-hydration-guardrail
frontendcritical

Deterministic Metadata Hoisting and Rehydration Safety in React 19 Streaming SSR

Enforces strict adherence to React 19 native document metadata hoisting semantics and asset prioritization during streaming SSR. Prevents client-server hydration mismatch errors, stylesheet cascade order corruption, and redundant script re-execution when asynchronous Suspense boundaries resolve out-of-order.

Blocks:Imperative Head Mutation and Missing Precedence in Streaming Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-taint-boundary-standard
frontendcritical

React 19 Server Component Taint Boundary & Secret Isolation Standard

Enforces compiler-level isolation of sensitive credentials, tenant metadata, and database records across React Server Component (RSC) serialization boundaries. Mandates the registration of taint primitives to block inadvertent transmission of server-only secrets to client component trees or Flight payload serializations.

Blocks:Exposing Raw Server-Side Entities and Auth Tokens Directly to Client Components
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-cryptographic-rpc-binding
frontendcritical

TanStack Start Cryptographic RPC Binding and Manifest Decoupling

Guarantees tamper-proof remote procedure invocation in TanStack Start by cryptographically signing server function IDs and strictly decoupling client-side route hydration manifests. Prevents unauthorized endpoint enumeration, payload tampering, and arbitrary remote code execution via forged RPC call descriptors.

Blocks:Invoking Naked Server Functions Without Cryptographic Attestation and Schema Invariants
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-boundary-standard
frontendcritical

Next.js 15 PPR Dynamic Boundary & Suspense Micro-Segmentation Standard

Enforces strict structural boundaries between static pre-rendered shells and streaming dynamic micro-segments under Next.js 15 Partial Prerendering (PPR). Prevents dynamic runtime access (cookies, headers, searchParams, and uncached fetches) from leaking past React Suspense barriers, preserving instant edge delivery and preventing unhandled waterfall suspensions under high-concurrency loads.

Blocks:Dynamic Runtime Leakage De-optimizing Static PPR Edge Shells via Top-Level Async Execution
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-ssr-sandboxing
frontendcritical

Vite 6 Environment API Multi-Runtime SSR Sandboxing Standard

Mandates strict module graph isolation and runtime sandboxing across heterogeneous targets (Node.js, Bun, Edge/Workerd) using Vite 6's Environment API. Prohibits global pollution and legacy monolithic ssrLoadModule execution patterns that cause cross-runtime leakage during SSR compilation and evaluation.

Blocks:Leaking Host Node.js Globals and Sharing Monolithic Module Graphs Across Heterogeneous SSR Runtimes
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-vite-6-environme-640
frontendcritical

Vite 6 Environment API Multi-Runtime SSR Execution Isolation

Enforces strict process, module graph, and memory isolation between distinct execution environments (Workerd/Cloudflare, Node.js, WebAssembly, and Client) when using Vite 6 Environment API. Prevents shared mutable state leakage, incorrect runtime primitive contamination, and invalid module runner resolution across heterogeneous dev and SSR graphs.

Blocks:Global Scope Pollution and Shared Module Graph Bleed Across Heterogeneous Vite 6 SSR Runtimes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-643
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Context Boundary Standard

Mandates strict isolation of dynamic request contexts (cookies, headers, searchParams, and uncached data fetches) within React Suspense boundaries to guarantee static shell delivery under Next.js 15 Partial Prerendering. Prevents route-level dynamic de-optimization and eliminates streaming waterfalls.

Blocks:Accessing Dynamic Context in Top-Level Layouts or Pages Collapsing PPR to Full Dynamic SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-lifecycle-isolation
frontendcritical

Svelte 5 Universal Runes SSR Isolation and Reactive Root Lifecycle Invariant

Enforces strict isolation of Svelte 5 universal runes ($state, $derived) and explicit lifecycle disposal of $effect.root instances during SSR. Prohibits module-level reactive state singletons in server runtimes to prevent cross-request memory retention, data contamination across tenants, and unbounded heap exhaustion.

Blocks:Global Module-Scoped Runes and Orphaned Effect Roots Inducing Cross-Request SSR State Leakage
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-key-guardrail
frontendcritical

Mandatory Idempotency Keys for Mutating React 19 Server Actions

Enforces network-resilient mutations across React 19 Server Actions by requiring client-generated, cryptographically unique idempotency tokens bound to submission state. Under high-latency or unstable mobile network transitions, automatic or user-driven retries must guarantee strict exactly-once execution semantics at the persistence layer. Without this guardrail, duplicate executions corrupt state, duplicate financial transactions, and create unrecoverable orphaned records.

Blocks:Unbounded Server Action Invocations Allowing Duplicate Execution Under Mobile Network Retries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-cache-invalidation-invariant
frontendcritical

Next.js 15 Dynamic I/O & Distributed Cache Invalidation Invariant

Enforces strict boundaries between cached computation and dynamic runtime I/O in Next.js 15 with dynamicIO enabled. Mandates deterministic, hierarchical cache tags and isolates mutation-sensitive reads via explicit dynamic boundaries to prevent distributed stale read cascades and cache stampedes across edge regions.

Blocks:Global Unscoped Cache Tags and Leaking Dynamic Context into 'use cache' Scopes
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-module-isolation-standard
frontendcritical

Vite 6 Environment API Runtime Module Isolation and Secret Boundary Standard

Enforces strict runtime module graph boundaries across client, server, and edge environments using Vite 6's Environment API. Eliminates credential leakage by invalidating shared module caches and barring server-only dependencies from traversing into client compilation passes. Guarantees immutable separation between WebWorker, Node.js, and browser execution contexts during dev HMR and multi-environment builds.

Blocks:Implicit Cross-Environment Imports and Shared Module Cache Infiltration Leaking Server Secrets into Client Bundles
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-cryptographic-nonce-replay-prevention
frontendcritical

React 19 Server Actions Cryptographic Nonce & Mutation Idempotency Boundary

Mandates cryptographically verifiable, single-use idempotency nonces across all stateful React 19 Server Actions. Defeats replay attacks, eliminates duplicate mutations during optimistic streaming retries, and prevents cross-site state injection in multi-step transitions.

Blocks:Unbounded Server Action Invocations Permitting Replay Exploits and Concurrent Double-Mutation Execution
Targets:Cursor•Claude•Windsurf•Codex
declarative-shadow-dom-ssr-hydration-boundary-standard
frontendcritical

Declarative Shadow DOM SSR Hydration Boundary Isolation Standard

Enforces strict Declarative Shadow DOM (DSD) boundaries for server-rendered web components and micro-frontends to eliminate Cumulative Layout Shift (CLS) and DOMException conflicts during client hydration. Mandates the use of standardized template attributes and non-destructive shadow root adoption before client scripts execute.

Blocks:Imperative attachShadow Overwrites and Missing shadowrootmode Fallbacks Causing FOUC and Hydration Crashes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-boundary-contract
frontendcritical

Next.js 15 PPR Shell Hydration & Dynamic Hole Boundary Contract

Enforces strict isolation of dynamic runtime functions (cookies, headers, searchParams) inside granular React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Guarantees instantaneous edge delivery of the deterministic static shell while preventing route-wide de-optimization to runtime SSR and eliminating streaming hydration mismatches.

Blocks:Accessing dynamic runtime primitives at page or layout roots without Suspense encapsulation, collapsing the static shell into edge SSR.
Targets:Cursor•Claude•Windsurf•Codex
vite6-mf-bidirectional-singleton-isolation-standard
frontendcritical

Vite 6 Bi-Directional Module Federation Shared Singleton & Edge Memory Isolation Standard

Enforces deterministic shared dependency resolution, strict singleton scoping, and context lifecycle isolation for Vite 6 bi-directional Module Federation. Prevents split-brain context corruption (e.g., duplicated React/Zustand instances) and cross-request memory leaks during edge-node SSR hydration.

Blocks:Lax Shared Dependency Declarations and Global Symbol Leaks in Bi-Directional Edge Remotes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-boundary-standard-next-js-15-parti-940
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Boundary Standard

Enforces strict structural segregation between static edge cache shells and dynamic streaming Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic API leakage (such as async cookies, headers, and uncached data fetches) from poisoning static page shells and collapsing entire routes into dynamic runtime execution.

Blocks:Uncontained Dynamic API Access in Static Route Shells Causing Full PPR De-optimization
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-sandboxing
frontendcritical

Vite 6 Environment API Multi-Runtime Module Sandboxing and Isolation

Enforces architectural isolation of distinct module graphs and execution contexts across Node.js, Edge (workerd), and browser targets using the Vite 6 Environment API. Prevents cross-runtime global state leakage, invalid Node.js built-in resolution in Edge/client bundles, and cross-polluted module caches in universal SSR pipelines.

Blocks:Cross-Runtime Module Graph Pollution and Shared Global State in Universal Vite 6 SSR
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-taint-boundary-serialization
frontendcritical

React 19 RSC Taint Boundary Serialization Invariant

Mandates strict object-level and cryptographic value taint tracking via React 19 Taint APIs to prevent sensitive server-only entities, database records, and secret tokens from crossing the React Server Component Flight serialization boundary. Enforces explicit DTO projection and immediate failure on inadvertent client exposure.

Blocks:Leaking Raw Database Models or Cryptographic Secrets to Client Components via RSC Flight Stream Serialization
Targets:Cursor•Claude•Windsurf•Codex
vite6-subresource-integrity-dynamic-chunk-signing
frontendcritical

Cryptographic Integrity and Dynamic Chunk Signing for Module Federation

Enforces strict SHA-384 Subresource Integrity (SRI) and signed hash manifests for all asynchronous dynamic imports and Module Federation remotes in Vite 6. Eliminates arbitrary remote code execution via CDN tampering or cache-poisoning at the edge by mandating cryptographic provenance verification before chunk evaluation.

Blocks:Unsigned Dynamic Chunk Fetching and Blind Execution via Unvalidated Module Federation Entrypoints
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-heterogeneous-ssr-isolation
frontendcritical

Vite 6 Heterogeneous SSR Runtime Isolation via Environment API

Enforces strict runtime-agnostic module separation and module graph isolation across Node.js, WinterCG (Edge), and Browser environments utilizing Vite 6's Environment API. Prevents cross-environment global pollution, host-specific built-in leakage, and shared runtime singleton corruption during multi-target SSR compilation and hydration.

Blocks:Monolithic SSR Module Graph and Cross-Contaminating Host Primitives
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-hole-isolation
frontendcritical

Next.js 15 PPR Dynamic Streaming Hole Boundary Isolation

Enforces strict boundary isolation between static prerender shells and dynamic streaming holes under Next.js 15 Partial Prerendering (PPR). Mandates that dynamic data access (cookies, headers, searchParams, and uncached dynamic fetches) resides exclusively inside isolated React Suspense boundaries with deterministic, static-safe fallbacks to prevent edge-cache poisoning or de-opting the static layout shell.

Blocks:Dynamic Context Leakage into Static Shell De-opting Next.js 15 PPR to Dynamic SSR
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-race-isolation
frontendcritical

React 19 Server Actions & Optimistic State Race Condition Isolation

Enforces strict monotonic sequence tracking, AbortController propagation, and immutable transition isolation within React 19 useOptimistic and Server Action pipelines. Prevents out-of-order state reconciliation and stale server responses from clobbering concurrent user mutations without blocking the primary rendering thread. Guarantees linearizable client cache convergence through transaction epoch identifiers.

Blocks:Unordered concurrent server action dispatches overwriting recent optimistic state with stale payload responses
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-replay-shield-production-standard
frontendcritical

React 19 Server Actions Idempotency & Replay Shield Standard

Enforces deterministic client-generated idempotency keys and atomic server-side deduplication for mutating React 19 Server Actions. Eliminates duplicate transactions and race conditions during network retries while preventing optimistic UI desynchronization.

Blocks:Blind Server Action Invocations and Transient Idempotency Generating Duplicate Side Effects on Network Retries
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-scope-isolation
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Scope De-escalation Boundary

Enforces strict compile-time and runtime isolation between static prerendered HTML shells and dynamic streaming holes in Next.js 15. Prevents credential, session token, and tenant identity leakage into edge-cached static artifacts by guaranteeing that dynamic functions (cookies, headers, searchParams, and dynamic data access) execute exclusively within explicit Suspense boundaries.

Blocks:Dynamic Scope Creep Poisoning Static Prerender Shells
Targets:Cursor•Claude•Windsurf•Codex
sqlite-wasm-opfs-multitab-concurrency
frontendcritical

SQLite-Wasm OPFS Multi-Tab Concurrency & SyncAccessHandle Lease Protocol

Enforces crash-safe multi-tab SQLite-Wasm persistence over the Origin Private File System (OPFS) without file handle collisions or silent database corruption. Mandates dedicated Web Worker isolation, the SAHPool VFS or Web Lock lease orchestration, and strict validation of cross-origin isolation headers for SharedArrayBuffer atomic primitives.

Blocks:Direct OPFS SyncAccessHandle Acquisition Across Multiple Tabs Causing NoModificationAllowedError and Database Corruption
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-isolation-standard
frontendcritical

Svelte 5 Runes Reactive Isolation & High-Frequency State Invariant

Enforces deterministic boundaries between fine-grained reactive state ($state) and high-frequency or deeply nested external datasets ($state.raw). Prevents infinite cross-component render loops, memory exhaustion from recursive Proxy wrapping, and cascading downstream recalculations.

Blocks:Wrapping High-Frequency Telemetry in Deep $state Proxies with Bidirectional Effect Feedback
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-edge-cache-invariant
frontendcritical

Next.js 15 Partial Prerendering (PPR) Edge Cache Invariant Standard

Enforces strict isolation between static prerendered HTML shells and dynamic stream chunks under Next.js 15 Partial Prerendering (PPR). Mandates explicit Suspense boundaries around all dynamic context (cookies, headers, searchParams, and uncached data fetches) to prevent edge cache poisoning and cross-session identity leakage.

Blocks:Dynamic session and auth context escaping Suspense boundaries into statically prerendered edge-cached shells.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-stream-isolation-standard
frontendcritical

Next.js 15 PPR Dynamic Stream Isolation & Static Shell Preservation

Enforces strict isolation of dynamic runtime operations (cookies, headers, searchParams, and uncached fetches) inside React Suspense boundaries for Next.js 15 Partial Prerendering (PPR). Prevents accidental de-optimization of static edge-prerendered shells into full server-rendered waterfall executions.

Blocks:Leaking Dynamic Contexts Outside Suspense Boundaries Causing Complete Route De-optimization
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-closure-parameter-tamper-proofing
frontendcritical

React 19 Server Functions Closure Parameter Tamper-Proofing & Integrity Guard

Enforces cryptographic verification or server-session reconciliation on bound closure arguments in React 19 Server Functions. Bound arguments (via Function.prototype.bind or JSX outer scope capture) are serialized to the client and transmitted back across untrusted network boundaries, creating injection vectors if accepted without authorization validation.

Blocks:Implicit Trust of Serialized Closure State and Bound Arguments in Server Actions
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler-ref-mutation-invariants
frontendcritical

React 19 Compiler Reactivity & Ref Mutation Invariants

Defines strict purity and ref lifecycle boundaries for React 19 compiler-optimized memoization blocks. Enforces that mutable ref reads and writes are restricted exclusively to effects and event handlers, preventing stale DOM references within memoized scopes and avoiding compiler de-optimizations. Guarantees that compiler-generated reactive blocks remain deterministic without triggering cascading re-renders across component boundaries.

Blocks:Reading or Mutating ref.current During Render Phase in Compiler-Optimized Scopes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-api-boundaries
frontendcritical

Next.js 15 Async Request API Resolution Boundaries and Streaming Invariants

Next.js 15 transitions dynamic request contexts (cookies, headers, params, and searchParams) to asynchronous Promises to enable Dynamic I/O and Partial Prerendering (PPR). Eagerly awaiting these APIs at layout or page root scopes triggers premature dynamic bailouts and collapses downstream streaming boundaries into cascading server-side waterfalls.

Blocks:Top-level sequential awaiting of request context promises collapsing streaming trees into blocking micro-waterfalls.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-async-effect-boundary-memory-leak-prevention
frontendcritical

Svelte 5 Runes Async Effect Boundary & Memory Leak Prevention

Enforces strict lifecycle boundaries and deterministic cancellation for asynchronous operations initiated inside Svelte 5 `$effect` blocks. Prevents detached DOM nodes, stale closures, and listener accumulation in long-lived single-page applications by mandating AbortController propagation, synchronous teardown returns, and isolation of untracked async execution paths.

Blocks:Unbounded Async Operations in $effect Without AbortController Teardown Leading to Retained Scope References
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-static-dynamic-boundary-invariant
frontendcritical

Next.js 15 PPR Static-Dynamic Boundary and Suspense Isolation Invariant

Enforces strict isolation between static prerendered shells and dynamic streaming subtrees under Next.js 15 Partial Prerendering (PPR). Guarantees dynamic data access (cookies, headers, searchParams, connection, uncached fetch) is quarantined behind React Suspense boundaries to prevent full-route de-optimization and cascading hydration bailouts.

Blocks:Top-Level Dynamic Access Poisoning Static Prerender Shells via Unwrapped Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-ppr-dynamic-hole-boundary-standard
frontendcritical

React 19 PPR Deterministic Dynamic Hole Boundary Standard

Enforces strict physical boundaries between static build-time shells and deferred dynamic execution contexts under React 19 Partial Prerendering (PPR). Prevents dynamic I/O leakage into static prerender passes, eliminates client-side Cumulative Layout Shift (CLS) via mandatory skeleton geometry preservation, and prohibits nested streaming waterfalls.

Blocks:Dynamic I/O Pollution of Static Prerender Shells Causing Build De-optimization and Cascade Waterfalls
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-rollback
frontendcritical

React 19 Server Actions Idempotency and Optimistic Rollback Standard

Requires all mutating React 19 Server Actions to bind a client-generated cryptographic idempotency key validated against an atomic distributed lock before executing side-effects. Mandates pairing useOptimistic with useActionState to guarantee deterministic UI rollback without phantom client persistence when network partitions or server exceptions occur.

Blocks:Unkeyed Server Actions with Naked useState Optimism Causing Double-Writes and Phantom UI States
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-ssr-streaming-boundary-isolation
frontendcritical

TanStack Router SSR Dehydration & Streaming Boundary Isolation

Enforces strict decoupling of critical SSR route loaders from slow secondary microservices and third-party integrations using TanStack Router's deferred streaming boundaries. Prevents non-essential promises from stalling HTTP response headers and First Contentful Paint (FCP) by mandating explicit defer() wrapping paired with React Suspense and Await boundaries.

Blocks:Monolithic Loader Await Pattern Blocking SSR Shell and TTFB
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-idempotency-boundary
frontendcritical

React 19 Optimistic Transition Idempotency Boundary & Cryptographic Action Deduplication

Mandates client-side generation and propagation of cryptographic idempotency tokens bound to React 19 useOptimistic and useActionState transitions. Prevents duplicate execution of non-idempotent Server Actions during network degradation, concurrent dispatches, and automatic transition revalidations while guaranteeing deterministic rollback safety.

Blocks:Unbounded Server Action Dispatch Within Optimistic Transitions Causing Duplicate Invocations and Ghost State Desynchronization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-signal-graph-cycle-guardrail
frontendcritical

Svelte 5 Runes Fine-Grained Reactive Signal Graph Cycle Guardrail

Enforces strict Directed Acyclic Graph (DAG) topology across Svelte 5 rune dependencies ($state, $derived, $effect) to prevent microtask thrashing and infinite update cascades. Mandates explicit dependency truncation via untrack() and prohibits cyclic feedback loops induced by mutating state within reactive tracking contexts.

Blocks:Cyclic Microtask Exhaustion via Unbounded $effect State Mutations and Bidirectional Prop Cascades
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-hmac-integrity-boundary
frontendcritical

React 19 Server Action Cryptographic HMAC Integrity and State Boundary Verification

Enforces cryptographic HMAC integrity verification and replay-attack defenses for all serialized parameters and boundary state passed to React 19 Server Actions. Client-facing action endpoints generated by React Server Components (RSC) must reject any tampered payloads, stale timestamps, or forged closures across distributed server tiers.

Blocks:Implicit Trust in Client-Serialized Action Closures and Plaintext Hidden Form State
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-shadow-dom-hydration-boundary-standard
frontendcritical

Svelte 5 Runes Shadow DOM Hydration and Micro-Frontend Memory Boundary

Enforces strict lifecycle boundaries and reactive runtime isolation when mounting Svelte 5 Custom Elements within Shadow DOM boundaries. Prevents cross-micro-frontend reactive context leakage, orphaned Rune signal graph subscriptions, and dual-tree DOM reconciliation conflicts between host and guest runtimes.

Blocks:Leaking Svelte 5 Signal Graphs and Orphaned Effect Roots across Unmanaged Custom Element Shadow Roots
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-rollback-invariant
frontendcritical

React 19 Server Actions Optimistic State Rollback Invariant

Enforces strict atomicity and deterministic rollback patterns when pairing React 19's `useOptimistic` with Server Actions across asynchronous transition boundaries. Guarantees that transient network partitions or server-side rejections cleanly restore the canonical snapshot without UI tearing or stale reference leaks. Mandates wrapping server mutations within `useActionState` or `startTransition` and prohibits manual synchronization via decoupled `useEffect` or external mutable state caches.

Blocks:Unbounded Optimistic UI Tearing and Desynchronization via Manual State Reassignment Across Async Actions
Targets:Cursor•Claude•Windsurf•Codex
vite-6-module-federation-isolation-dependency-negotiation-standard
frontendcritical

Vite 6 Module Federation Isolation & SemVer Dependency Negotiation Standard

Enforces strict runtime sandbox boundaries, scoped shared dependency singletons, and deterministic SemVer negotiation across heterogeneous Vite 6 micro-frontend remotes. Prevents runtime state collisions, dual framework instantiation, and cascading boundary crashes via isolated share scopes and error-contained remote resolution.

Blocks:Unpinned Shared Dependencies and Direct Window Mutations Across Federated Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-optimistic-rollback
frontendcritical

React 19 Server Action Idempotency and Optimistic Rollback Invariant

Enforces strict idempotency and deterministic rollback semantics across React 19 Server Actions and optimistic client states. Prevents phantom state drift, out-of-order resolution during network partitions, and concurrent mutation desynchronization by mandating useActionState, useOptimistic, and monotonic idempotency tokens.

Blocks:Ad-Hoc State Management with Unbounded Optimistic Drift and Non-Idempotent Server Mutations
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-lifecycle-teardown-standard
frontendcritical

Svelte 5 Runes Dynamic Graph Teardown and Root Boundary Standard

Mandates deterministic lifecycle boundary isolation and teardown functions for nested $effect, $derived, and dynamic signal graphs in long-lived single-page applications and microfrontends. Prevents subscriber retention leaks across microfrontend boundaries by enforcing $effect.root encapsulation, explicit signal detachment, and disciplined use of untrack().

Blocks:Leaking Svelte 5 Reactive Subscriptions Across Microfrontend Mounts via Orphaned $effect Graphs
Targets:Cursor•Claude•Windsurf•Codex
react19-flight-payload-pii-sanitization-guardrail
frontendcritical

React 19 Flight Payload PII & Secret Sanitization Guardrail

Enforces strict boundary contracts between React 19 Server Components and Client Components to prevent secret and PII leakage over the wire. The React Flight serialization protocol sends raw prop values and bound Server Action closures directly to the browser DOM/network tab. This standard mandates explicit DTO projection, zero-spread object passing across client boundaries, and active use of React 19 taint APIs.

Blocks:Passing Unsanitized Server Entities, Direct ORM Models, or Closed-Over Secrets Across the RSC-to-Client Flight Serialization Boundary
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-derivation-loop-quarantine
frontendcritical

Svelte 5 Runes Reactive Derivation Microtask Loop Quarantine

Enforces strict mathematical purity, acyclic dependency graph topology, and synchronous boundary quarantine for Svelte 5 $derived and $derived.by evaluation trees. Prohibits state mutation, hidden signal feedback cycles, and recursive dependency reads that trigger 'effect_update_depth_exceeded' runtime crashes or microtask starvation on the UI main thread.

Blocks:Mutating State or Introducing Circular Graph Reads Inside $derived and $derived.by Trees
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-state-abort-signal-propagation
frontendcritical

React 19 Concurrent Action State AbortSignal Propagation

Mandates strict AbortSignal binding and lifecycle cancellation across concurrent React 19 useActionState dispatches. Guarantees that superseded asynchronous mutations are immediately aborted at the transport layer, preventing out-of-order state settlement and orphaned server operations.

Blocks:Uncancelled Concurrent Action Invocations Causing Race Condition State Overrides
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-action-context-isolation
frontendcritical

Next.js 15 Server Action Ephemeral Request Context Boundary & Origin Verification

Enforces strict runtime cryptographic origin verification and isolated AsyncLocalStorage boundaries across Next.js 15 Server Actions. Prevents cross-request context bleeding, state contamination, and unauthorized action invocation across concurrent serverless execution environments.

Blocks:Global Mutable State Leaks & Unverified Cross-Site Server Action Executions
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-state-optimistic-ui-idempotency
frontendcritical

React 19 Action State & Optimistic UI Idempotency Boundary

Guarantees deterministic rollback behavior and prevents dangling mutation states during concurrent optimistic updates across distributed network partitions. Mandates strict transaction-scoped idempotency keys, non-mutating update reducers, and explicit abort-signal binding in React 19 useActionState and useOptimistic transitions. Ensures UI state remains strictly reconcilable when async Server Actions fail, timeout, or arrive out of sequence.

Blocks:Non-Idempotent Concurrent Mutations with Dangling Optimistic Reducer States
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-concurrent-optimistic-rollback-standard
frontendcritical

React 19 Server Actions Concurrent Optimistic Rollback Standard

Enforces deterministic state reconciliation and eliminates race-condition tearing across multiplexed React 19 Server Actions. Guarantees that concurrent out-of-order server responses discard stale acknowledgments and preserve in-flight optimistic projections using monotonic sequence tags. Prevents cascading rollback anomalies when rapid sequential mutations resolve non-deterministically.

Blocks:Out-of-Order Optimistic State Tearing via Unsequenced Server Action Mutations
Targets:Cursor•Claude•Windsurf•Codex
nextjs-ppr-edge-hole-cache-stampede-guardrail
frontendcritical

Next.js 15 PPR Dynamic Streaming Hole Cache-Stampede Guardrail

Enforces deterministic request coalescing, multi-tiered cache invalidation, and circuit-breaker fallbacks on dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Prevents downstream microservice saturation caused by dog-piling / cache stampedes during high-concurrency cold-starts and edge CDN cache misses.

Blocks:Unmemoized Direct Upstream Service Invocations Inside Uncached PPR Dynamic Holes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-streaming-invariant
frontendcritical

Next.js 15 Partial Prerendering (PPR) Shell & Suspense Hole Isolation Invariant

Enforces strict architectural separation between the static prerendered HTML shell and dynamic runtime streaming holes in Next.js 15 PPR. Mandates that all dynamic data access—including cookies, headers, uncached database queries, and searchParams—is encapsulated inside dedicated React Suspense boundaries to preserve edge static generation and guarantee sub-50ms TTFB at enterprise scale.

Blocks:Dynamic Contamination of Static Shell Collapsing Route to Full SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-mutation-effect-boundary
frontendcritical

Svelte 5 Runes Signal Mutation & Effect Isolation Boundary

Enforces unidirectional reactive state transitions in Svelte 5 by strictly prohibiting synchronous state mutations inside $derived runes, $effect primitives, and render paths. Guarantees deterministic fine-grained reactive state propagation while strictly preventing circular dependency cascades across enterprise component libraries.

Blocks:Reactive Loop Cascade via Cyclical Signal Mutation inside Svelte 5 Effects and Computed Proxies
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-effect-disposer-bounds
frontendcritical

Svelte 5 Runes Fine-Grained Effect Disposer Bounds & Teardown Lifecycle

Enforces strict cleanup contracts and scope boundaries for Svelte 5 $effect and $effect.pre runes within high-frequency streaming dashboards. Guarantees that dynamically mounted DOM branch transitions and reactive subscription switches explicitly return teardown disposers to prevent catastrophic detached DOM and WebSocket listener leaks.

Blocks:Unbounded Async Side-Effects and Missing Teardown Disposers in Svelte 5 $effect Runes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-taint-boundaries-and-sensitive-closure-isolation
frontendcritical

Next.js 15 Server Action Taint Boundaries & Sensitive Closure Isolation

Enforces strict runtime assertions using React's experimental_taintObjectReference and experimental_taintUniqueValue to prevent cryptographic credentials, secret tokens, and sensitive tenant metadata from crossing the server-to-client serialization boundary. Prevents accidental closure captures in Next.js 15 Server Actions and Server Components by enforcing explicit data transfer objects (DTOs) and taint registry invocations on hydrated entities.

Blocks:Leaking Ambient Secrets, Database Records, or Auth Tokens Across Server-to-Client Serialization Boundaries via Closure Capture
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-async-effect-teardown-invariants
frontendcritical

Svelte 5 Runes Async Effect Teardown & Untracked Invariants

Enforces synchronous cleanup registration in Svelte 5 $effect runes and explicit lifecycle cancellation boundaries. Prevents orphaned reactive subscriptions, uncollected event listeners, and post-unmount microtask race conditions caused by asynchronous effect callbacks.

Blocks:Passing Async Callbacks to $effect Runes and Omitting Synchronous Teardown Handlers
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-static-shell-isolation
frontendcritical

Next.js 15 PPR Boundary Static Shell Isolation and Layout Shift Prevention

Enforces deterministic boundaries between edge-cacheable static shells and streamed dynamic subtrees in Next.js 15 Partial Prerendering (PPR). Guarantees sub-50ms TTFB by strictly isolating runtime dynamic operations (cookies, headers, searchParams, and uncached data) inside Suspense boundaries. Mandates dimensionally stable skeleton fallbacks to prevent Cumulative Layout Shift (CLS) during client-side hydration stalls.

Blocks:Uncontained Dynamic Entry Points Demoting Edge Static Shells to Server-Side Bottlenecks with Hydration Layout Shift
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-rollback-idempotency-standard
frontendcritical

React 19 Server Action Optimistic State Rollback & Cryptographic Idempotency Standard

Enforces cryptographically random client-generated idempotency tokens and transactional state reconciliation across all React 19 Server Actions paired with useOptimistic. Prevents duplicate backend mutations, ghost entities, and desynchronized local states during intermittent mobile network dropouts or retry storms.

Blocks:Un-reverted useOptimistic updates and bare Server Actions vulnerable to retry replay bugs and ghost state
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-standard
frontendcritical

Vite 6 Environment API Deterministic Multi-Runtime Isolation Standard

Enforces deterministic module graph segregation and runtime boundaries across heterogeneous environments (Workerd, Node, Browser) using Vite 6 Environment APIs. Prevents dual-package hazards, runtime context leaks, and accidental bundle pollution caused by legacy SSR flags or unified module resolution paths.

Blocks:Unified Module Resolution Bleeding Server Secrets or Dual-Package Singletons across Heterogeneous Runtimes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-cache-life-boundary-standard
frontendcritical

Next.js 15 Partial Prerendering (PPR) Cache-Life Boundary Standard

Enforces strict isolation between prerendered static layout shells and dynamic request-time streaming slots in Next.js 15. Requires explicit `use cache` scoping and explicit `cacheLife` profiles to prevent dynamic request headers (e.g., cookies, session tokens) from contaminating shared edge cache layers. Eliminates cross-tenant cache poisoning and de-opt cascading across React Suspense boundaries.

Blocks:Dynamic Request Leaks Inside Prerendered Shells and Untyped Unscoped Edge Cache Bleed
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-taint-boundary-protection
frontendcritical

React 19 Taint Object API Boundary Enforcement for RSC Serialization

Enforces mandatory registration of cryptographic keys, raw database records, and PII using React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs. Prevents unintentional serialization of server-side secrets across the Server-to-Client Component boundary within React Server Component (RSC) Flight streams.

Blocks:Passing Untainted Raw Records or Secrets Directly to Client Component Props Across RSC Flight Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-async-transition-microtask-fence
frontendcritical

React 19 Async Transition Microtask Priority Inversion Fence

Prevents UI thread starvation and discrete event input latency by enforcing explicit macrotask-yielding fences within React 19 asynchronous transitions. Prevents microtask queue saturation from inverting transition priorities and blocking React's internal fiber scheduler and user-driven discrete interactions.

Blocks:Starving Main Thread via Unbounded Microtask Cascades Inside React 19 Async Transitions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hydration-boundary-standard
frontendcritical

Next.js 15 Partial Prerendering Dynamic Micro-Suspense and Fallback Isolation Standard

Enforces strict structural boundaries between the static prerender shell and runtime dynamic streams under Next.js 15 Partial Prerendering (PPR). Guarantees that dynamic request contexts, asynchronous headers, and unstable data reads are sealed inside isolated React Suspense boundaries with zero-dependency static fallbacks, preventing static shell deopt and server-side request starvation under high concurrent traffic.

Blocks:Leaking Dynamic Accessors Across the Static Shell Boundary or Rendering Dynamic Fallbacks
Targets:Cursor•Claude•Windsurf•Codex
react19-compiler-deterministic-mutation-escape-guardrails
frontendcritical

React 19 Compiler Interior Reference Mutation and Memoization Graph Integrity Guardrail

Enforces strict interior reference immutability and deterministic pure functional transformations across complex client-side state trees. Eliminates post-render interior mutations and leaking aliases that shatter React 19's automatically synthesized memoization blocks ($_memoize) and trigger catastrophic de-optimizations or cascading re-renders.

Blocks:Mutating Nested Heap References Post-Derivation Breaking Compiler Dependency Graphs
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-boundary-guardrail
frontendcritical

Next.js 15 PPR Static Shell Preservation & Suspense Dynamic Boundary Guardrail

Next.js 15 Partial Prerendering (PPR) mandates that the root shell of pages and layouts remain strictly static to allow immediate edge HTML streaming. Unwrapping dynamic async functions (e.g., cookies(), headers(), searchParams) outside of explicit Suspense boundaries de-optimizes the entire route tree into full dynamic server rendering. All dynamic context, uncached data fetches, and runtime request reads must be encapsulated within isolated child components wrapped in Suspense.

Blocks:Top-Level Dynamic Request Invocations Bypassing Suspense and Collapsing Edge Prerendered Shells
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-lifecycle-teardown-guardrail
frontendcritical

Svelte 5 Runes Universal Reactivity & Lifecycle Boundary Isolation

Enforces strict lifecycle boundaries and explicit effect disposal when crossing component contexts with universal runes (.svelte.ts). Prevents memory leaks caused by unbounded $effect.root scopes, detached signal listeners, and stale closure traps when reactive state instances escape Svelte component lifecycle trees into global or shared singletons.

Blocks:Leaking Unbounded Universal Runes and Stale Closures Across Component Mount Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-streaming-hydration-watermark-standard
frontendcritical

React 19 RSC Selective Hydration and Streaming Watermark Standard

Enforces deterministic out-of-order partial hydration boundaries across deeply nested React 19 Server Components and Suspense boundaries. Prevents layout thrashing, cascading hydration waterfalls, and client-side mismatch bailouts by establishing rigid layout watermarks with strict CSS containment and non-cascading fallback constraints.

Blocks:Uncontained Deep Suspense Fallbacks Inducing Cumulative Layout Shift (CLS) and Cascade Hydration Deadlocks
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-cross-runtime-isolation-invariant
frontendcritical

Vite 6 Environment API Strict Cross-Runtime Module Isolation Guardrail

Enforces architectural boundary isolation across heterogeneous runtime environments (browser, node, workerd, edge) using the Vite 6 Environment API. Prevents cross-contamination of runtime-specific module graphs, accidental leaking of Node/Edge primitives into browser bundles, and leaky module resolution during unified multi-target SSR builds.

Blocks:Cross-Runtime Graph Contamination and Deprecated Monolithic SSR Configuration in Vite 6
Targets:Cursor•Claude•Windsurf•Codex
next15-ppr-shell-stream-hydration-invariant
frontendcritical

Next.js 15 Partial Prerendering (PPR) Shell-Stream Hydration Invariant

Enforces strict isolation of dynamic runtime access (cookies, headers, uncached data) behind explicit Suspense boundaries in Next.js 15 Partial Prerendering (PPR). Prevents static shell de-optimization, delayed Time-to-First-Byte (TTFB), and client-side hydration thrashing caused by mismatched skeleton geometries under network jitter.

Blocks:Leaking Dynamic Request Data into Route Shells and Unbounded Fallback Skeletons
Targets:Cursor•Claude•Windsurf•Codex
react-19-taint-api-serialization-guardrails
frontendcritical

React 19 Taint API & RSC Boundary Data Leakage Prevention

Enforces deterministic data masking and memory-level boundary protection using React 19's experimental Taint APIs (experimental_taintObjectReference and experimental_taintUniqueValue). Prevents cryptographic secrets, authentication tokens, internal tenant identifiers, and unmasked PII from leaking across the React Server Component (RSC) serialization boundary into client bundles.

Blocks:Passing Raw Database Records or Unsanitized Context Containing Secrets Directly Across the RSC Flight Boundary
Targets:Cursor•Claude•Windsurf•Codex
astro-5-content-layer-cache-invalidation-guardrail
frontendcritical

Astro 5 Content Layer Reactive Cache Invalidation & Static Pre-rendering Boundaries

Enforces strict memory-bounded ingestion and deterministic cache invalidation within Astro 5 Content Layer custom loaders and hybrid pre-rendering routes. Guarantees deterministic static site generation (SSG) artifact stability and eliminates heap exhaustion during high-volume multi-tenant asset ingestion by forbidding in-memory entry buffering and un-hashed reactive cache bypasses.

Blocks:Unbounded In-Memory Accumulation and Volatile Cache Eviction in Astro 5 Custom Content Loaders
Targets:Cursor•Claude•Windsurf•Codex
nextjs-ppr-dynamic-streaming-abort-boundary-invariant
frontendcritical

Next.js 15 PPR Dynamic Streaming Abort Boundary and Circuit-Breaker Invariant

Enforces deterministic client-side fallback rendering and downstream microservice circuit-breaking when Partial Prerendering (PPR) dynamic stream holes exceed strict time-to-first-byte (TTFB) or streaming budget deadlines. Guarantees that suspended dynamic server components abort stalled upstream network requests using cooperative AbortController signals, preventing resource starvation and edge worker execution lockups.

Blocks:Unbounded React Suspense holes in PPR that block streaming indefinitely and cascade microservice latency into edge worker timeouts.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-reactive-cycle-containment-standard
frontendcritical

Svelte 5 Runes Reactive Cycle Containment & Microtask Starvation Prevention

Enforces strict mathematical purity in $derived and $derived.by execution graphs to prevent microtask-loop starvation in high-frequency trading and monitoring dashboards. Prohibits reading transitively mutated state inside reactive derivations and enforces decoupled asynchronous state propagation via discrete effect handlers and event queues.

Blocks:Asynchronous Mutation Cascade Triggered Inside or Synchronously Downstream of $derived.by Computation Graphs
Targets:Cursor•Claude•Windsurf•Codex
react-19-tainted-reference-serialization-guardrail
frontendcritical

React 19 Server-to-Client Tainted Reference Serialization Boundary

Enforces strict cryptographic and object-level poisoning using React 19's taintObjectReference and taintUniqueValue APIs across all Server Component data fetchers. Prevents catastrophic security leakage of API secrets, database credentials, and raw cryptographic keys through the React Server Component (RSC) Flight serialization protocol to client bundles.

Blocks:Exposing Raw Server Credentials and Sensitive Objects to RSC Flight Serialization Graphs
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-isolation-guardrail
frontendcritical

Vite 6 Environment API Cross-Runtime State Isolation & HMR Invariant

Enforces strict process, context, and module graph isolation across heterogeneous SSR runtimes (Workerd, Bun, Node) within the Vite 6 Environment API. Prevents shared memory corruption, cross-runtime prototype pollution, and out-of-order state leakage during Hot Module Replacement (HMR).

Blocks:Cross-Pollinating Global State and Unified Module Graphs Across Heterogeneous Vite 6 DevEnvironments
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-memory-boundary-invariant
frontendcritical

Svelte 5 Runes Memory Boundary & Proxy Graph Isolation Invariant

Enforces strict memory boundary hygiene between Svelte 5 fine-grained reactive proxy graphs ($state) and long-lived outer micro-frontend (MFE) contexts. Unsanitized sharing of deep reactive state creates implicit signal dependency retain-cycles that prevent garbage collection of detached MFE DOM nodes, component trees, and reactive effects.

Blocks:Exposing Raw Svelte 5 Reactive Proxies Across Long-Lived Micro-Frontend Shells and Event Buses
Targets:Cursor•Claude•Windsurf•Codex
nextjs-react19-taint-api-data-leakage-guardrail
frontendcritical

Next.js 15 & React 19 Taint Object API Serialization Boundary Guardrail

Enforces strict boundary isolation of sensitive server-side secrets, raw database models, and PII from React Server Component (RSC) serialization boundaries using React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs. Prevents accidental transmission of credentials, authentication tokens, and sensitive record fields to client bundles.

Blocks:Passing Unprojected Server Entities or Credentials Directly to Client Component Props Across RSC Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-components-taint-api-standard
frontendcritical

Enforce React 19 Experimental Taint API for Boundary Serialization Safety

Enforces deterministic data boundary protection in React 19 Server Components using experimental_taintObjectReference and experimental_taintUniqueValue. Guarantees that raw cryptographic secrets, database tokens, and sensitive PII records cannot be serialized across the Server-to-Client Component boundary by throwing runtime errors during the React Flight serialization pass.

Blocks:Leaking Raw Sensitive Records or Operational Credentials across the Server-Client Boundary via Flight Serialization
Targets:Cursor•Claude•Windsurf•Codex
react19-activity-webgl-context-preservation-boundary
frontendcritical

React 19 Activity WebGL Context Lifecycle and Resource Preservation Guardrail

Mandates explicit WebGL context preservation, tick loop suspension, and resource lifecycle management when wrapping Three.js, Babylon.js, or raw WebGL renderers inside React 19 `<Activity>` boundaries. Components hidden via the Activity API remain mounted in memory with DOM attachment preserved or detached into an offscreen state, necessitating immediate RAF cancellation, buffer preservation, and idempotent context restoration upon visibility reactivation.

Blocks:Unbounded RAF loops and naive canvas unmount cleansers during React 19 Activity state transitions
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-hole-boundary-standard
frontendcritical

Next.js 15 PPR Dynamic Hole Isolation and Suspense Boundary Standard

Enforces strict component-level dynamic hole boundaries in Next.js 15 Partial Prerendering (PPR) architectures. Dynamic execution contexts (cookies, headers, searchParams, and uncached data fetches) must be strictly isolated inside dedicated async leaf components wrapped by explicit React Suspense boundaries with layout-stable fallbacks. Prevents static shell de-opt, cascading waterfalls, and TTFB degradation in enterprise storefronts.

Blocks:Dynamic Context Leakage into Static Shells Causing Full-Page PPR De-Optimization
Targets:Cursor•Claude•Windsurf•Codex
react-19-resource-preloading-dedup-standard
frontendcritical

React 19 Native Resource Preloading & Document Head Deduplication Standard

Enforces React 19 native document metadata hoisting and react-dom resource preloading APIs across micro-frontend boundaries. Eliminates manual DOM script/link injections that cause style flickering (FOUC), duplicate tag mounting, and broken concurrency during asynchronous module transitions. Guarantees deterministic asset deduplication by leveraging React's built-in href and precedence matching engine.

Blocks:Manual DOM Link/Script Append Injections and Imperative Document Head Mutation
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-vite-6-environme-725
frontendcritical

Vite 6 Environment API Multi-Runtime Compilation Boundary Isolation

Enforces strict runtime module boundary isolation across client, SSR Node.js, and edge worker execution contexts using the Vite 6 Environment API. Prevents toxic module leakage such as Node.js built-ins or server secrets bundling into client chunks by mandating explicit per-environment export conditions, isolated Rollup configurations, and environment-aware plugin hooks.

Blocks:Monolithic Multi-Target Compilation and Cross-Environment Module Bleed
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler-closure-idempotence
frontendcritical

React 19 Compiler Idempotence & Closure Immutability Invariant

Enforces strict mathematical purity, render-phase side-effect freedom, and closure immutability across React 19 functional components and custom hooks. Prevents React Compiler memoization bailouts, dirty-read stale state hazards, and catastrophic auto-memoization cache invalidation loops caused by mutating inputs, lexical escapes, or unstable reference creation during render.

Blocks:Mutating Render-Path References and In-Flight Closure Leaks Causing Compiler Bailouts and Infinite Invalidation Spirals
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-secret-fence
frontendcritical

Vite 6 Multi-Runtime Environment API Secret Fence Standard

Enforces strict compile-time boundary isolation across Vite 6 Environment API runtimes (Client, Node SSR, Edge). Prevents server-only credentials, platform bindings, and non-distributable server module graphs from leaking into client-targeted compilation units.

Blocks:Cross-Runtime Module Graph Contamination Leaking Server Secrets into Client Artifacts
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-sandboxing
frontendcritical

Vite 6 Environment API Multi-Runtime Module Sandboxing Standard

Enforces strict runtime boundary isolation when cross-compiling shared libraries across browser, edge, Node.js, and workerd targets within a single Vite 6 dev server instance. Guarantees that module graphs, resolve conditions, and transform pipelines remain sandboxed to prevent runtime global contamination and invalid target execution.

Blocks:Cross-contaminating module graphs and resolve conditions across browser, workerd, and Node.js runtimes using legacy single-target Vite paradigms.
Targets:Cursor•Claude•Windsurf•Codex
react-19-concurrent-optimistic-rollback-invariant
frontendcritical

React 19 Concurrent Action Optimistic Rollback State Invariant

Enforces deterministic state reconciliation during concurrent React 19 micro-frontend mutations using useActionState and useOptimistic. Prevents state tear, race-condition flashes, and corrupted rollbacks when multiple disjoint transactional mutations resolve out-of-order across micro-frontend boundaries. Mandates monotonic transaction sequence numbering and idempotent reduction contracts for all optimistic buffers.

Blocks:Unsequenced Optimistic Overwrites and Non-Atomic Rollbacks in Concurrent Action Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-cache-isolation-boundary
frontendcritical

Next.js 15 PPR Cache Isolation and Dynamic Slot Boundary Enforcement

Enforces strict physical boundaries between static prerendered layout shells and dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Mandates the encapsulation of dynamic runtime data access (headers, cookies, searchParams, and un-cached I/O) within dedicated React Suspense boundaries to prevent layout cache de-opt, CDN edge cache thrashing, and critical PII leakage via static shell baking.

Blocks:Dynamic Hook Invocation and Header Leaks Inside Static Layout Shells
Targets:Cursor•Claude•Windsurf•Codex
angular-19-zoneless-signals-guardrail
frontendcritical

Angular 19 Zoneless Signals & Deterministic Change Detection Guardrail

Enforces strict zoneless architecture in Angular 19 by removing Zone.js runtime monkey-patching in favor of explicit reactive signals and microtask scheduling. Prevents silent UI update failures caused by untracked mutable class properties modified during asynchronous events. Mandates the use of Signal primitives, resource APIs, and RxJS-to-Signal bridges across all presentation and state layers.

Blocks:Mutating Un-signaled Class Properties in Async Handlers Under Zoneless Execution
Targets:Cursor•Claude•Windsurf•Codex
react-19-resource-preload-dedup-invariant
frontendcritical

React 19 Document Resource Preload Priority & Deduplication Invariant

Enforces deterministic asset preloading and deduplication via React 19's native resource dispatchers and hoisted metadata elements. Eliminates client-side waterfalls, DOM mutation side-effects, and duplicate script execution by integrating directly with React's streaming resource discovery engine.

Blocks:Imperative Head Injections and Client-Side useEffect Preloading Waterfall
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-root-lifecycle-isolation
frontendcritical

Svelte 5 Runes Memory Lifecycle Isolation & $effect.root Teardown Guardrail

Strictly governs the instantiation, scoping, and teardown of non-component reactive graphs using Svelte 5 runes. Enforces explicit disposal of $effect.root scopes to eliminate Node.js/Bun heap leaks during streaming SSR and prevent runaway reactive dependency cycles across client-side page transitions.

Blocks:Leaking Detached Reactive Roots and Request-Polluting Singletons in Streaming SSR
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-boundary-segmentation-standard
frontendcritical

Vite 6 Environment API Segmentation and Zero-Leak Module Isolation

Enforces strict boundary segmentation across browser, Node.js, and edge runtimes using the Vite 6 Environment API. Guarantees zero module leak, deterministic polyfill elimination, and isolated module graphs during unified client, SSR, and edge builds.

Blocks:Monolithic Multi-Target Configs Causing Node Polyfill Leakage and Runtime Boundary Cross-Contamination
Targets:Cursor•Claude•Windsurf•Codex
vite-6-rolldown-dynamic-chunk-graph-fencing
frontendcritical

Vite 6 Rolldown Dynamic Import Chunk Graph Fencing and Waterfall Containment

Enforces deterministic module chunk boundaries and compile-time cycle elimination in Vite 6 and Rolldown architectures. Prevents transitive chunk bleed and deep HTTP cascade preloading waterfalls across distributed enterprise micro-frontends by fencing dynamic imports behind strict architectural barriers and explicit chunk grouping strategies.

Blocks:Unconstrained Dynamic Imports Causing Synthetic Common Chunk Splitting and Cascading Waterfall Fetches
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-rune-streaming-hydration-boundary-standard
frontendcritical

Svelte 5 Rune-Derived Streaming Hydration Boundary Standard

Enforces deterministic client reconciliation boundaries for asynchronous and derived rune primitives during progressive HTML streaming. Prevents client-side hydration mismatches, DOM tearing, and microtask race conditions caused by evaluating unstable $derived expressions against streamed promise payloads.

Blocks:Directly evaluating raw streamed promises inside synchronous $derived runes without hydration boundary guards
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-scope-isolation-standard
frontendcritical

Svelte 5 Runes Reactive Scope Isolation Standard

Enforces strict lifecycle boundaries and reactive scope containment for Svelte 5 runes ($state, $derived, $effect) instantiated in long-lived non-component contexts and external stores. Prevents memory leaks and untracked microtask state desynchronization caused by uncontained $effect.root scopes and asynchronous state mutations across route transitions.

Blocks:Dangling Root Runes and Orphaned $effect Subscriptions Leaking Memory Across Route Navigation
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-vite-6-environme-419
frontendcritical

Vite 6 Environment API Cross-Runtime Hydration Isolation Standard

Enforces strict execution-boundary isolation between client, Node.js, workerd, and Bun environments using the Vite 6 Environment API. Prevents runtime-specific global pollution, invalid isomorphic imports, and unvalidated environment state serialization during isomorphic hydration.

Blocks:Leaking Runtime-Specific Globals and Bindings Across Vite 6 Multi-Environment Module Graphs
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-cache-guardrail
frontendcritical

Next.js 15 PPR Dynamic Hole Isolation and Static Shell Guardrail

Next.js 15 Partial Prerendering (PPR) combines static shell prerendering with streamed dynamic holes. Un-cached dynamic APIs (e.g., cookies(), headers(), searchParams, or uncached fetches) invoked outside of explicit React Suspense boundaries poison the prerender phase and de-opt the entire route into full dynamic SSR, triggering cascading edge stalls and invalidating CDN cache strategies.

Blocks:Unbounded Dynamic APIs Poisoning Next.js 15 Prerender Shells and Forcing Route-Wide Dynamic De-opt
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-module-graph-boundary
frontendcritical

Vite 6 Environment API Server-Client Module Graph Boundary Invariant

Vite 6 introduces the Environment API to provide isolated module graphs for discrete runtimes (e.g., client, ssr, edge workers). Sharing mutable plugin caches, referencing legacy root server.moduleGraph, or failing to isolate module graph traversal across environments causes catastrophic server secret leaks, Node.js runtime leakage into client bundles, and untracked cross-environment memory leaks.

Blocks:Global Plugin Caching and Root ModuleGraph Cross-Contamination Across Vite 6 Environments
Targets:Cursor•Claude•Windsurf•Codex
react-19-taint-boundary-protection
frontendcritical

React 19 Server Data Tainting & Serialization Boundary Isolation

Enforces strict isolation of sensitive server-side state, user PII, and credentials using React 19 taint APIs (experimental_taintUniqueValue and experimental_taintObjectReference). Prevents accidental exposure of raw database models, cryptographic keys, and private tokens through Server-to-Client Component serialization boundaries.

Blocks:Leaking Raw Database Records and Environment Secrets to Client Component Props via RSC Serialization
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-standard
frontendcritical

Vite 6 Environment API Cross-Runtime Module Graph & Memory Isolation

Mandates strict separation of module evaluation graphs, runtime instances, and HMR boundaries across Client, SSR (Node.js), and Edge environments utilizing Vite 6's Environment API. Prevents cross-runtime state pollution, module graph contamination, and invalid module executions across heterogeneous target runtimes.

Blocks:Cross-Runtime Memory Leakage and Module Graph Contamination via Legacy Unified Server APIs
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-boundary-guardrail
frontendcritical

Vite 6 Environment API Custom Runtime Boundary Guardrail

Enforces strict isolation of client, server, and edge module graphs using the Vite 6 Environment API. Prevents cross-target compilation leakage, runtime polyfill bleeding, and secret exposure by scoping transforms, module resolutions, and runtime instances strictly to designated environment runtimes.

Blocks:Cross-Target Module Graph Pollution via Shared Legacy Vite Plugin Contexts
Targets:Cursor•Claude•Windsurf•Codex
react19-useoptimistic-rollback-reconciliation
frontendcritical

React 19 useOptimistic Rollback and Concurrency Reconciliation Contract

Enforces deterministic state reconciliation and error boundary isolation for React 19 useOptimistic during high-frequency concurrent server actions and transient network drops. Mandates that all optimistic transitions maintain monotonic versioning, execute strictly within Action or transition scopes, and preserve source-of-truth immutability upon rejection.

Blocks:Unbounded Server Action Calls with Out-of-Order State Tearing and Manual Rollback Flags
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-cleanup-isolation
frontendcritical

Svelte 5 Runes Fine-Grained Reactive Effect Cleanup Isolation

Mandates strict synchronous teardown returns inside Svelte 5 `$effect` and `$effect.pre` blocks to prevent detached DOM and listener memory leaks in dynamic micro-frontend lifecycles. Forbids passing async executors directly to `$effect`, requiring inner asynchronous tasks to track and cancel in-flight work via explicit AbortController references. Enforces clean disposal of third-party observer and subscription instances before subsequent reactive triggers or component unmounting.

Blocks:Dangling Subscriptions and Leaked Async Tasks via Async $effect Callback Signatures
Targets:Cursor•Claude•Windsurf•Codex
react-19-hoisted-asset-preloading-watermark
frontendcritical

React 19 Deterministic Hoisted Resource Preloading and Waterfall Prevention

Enforces deterministic layout-level resource preloading using React 19 react-dom hoisting APIs (preload, preinit, preinitModule) to eradicate sub-tree request waterfall cascades during concurrent client-side transitions. Guarantees that critical fonts, stylesheets, and module chunks are pre-warmed during the initial render phase rather than discovered post-mount inside leaf nodes.

Blocks:Imperative useEffect Asset Injections and Deep Sub-Tree Discovery Waterfalls
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-suspense-streaming-invariant
frontendcritical

Next.js 15 Partial Prerendering (PPR) Boundary Isolation Invariant

Enforces strict boundary encapsulation between static CDN pre-rendered shells and dynamic React Server Components (RSC) micro-streams. Prevents dynamic request accessors (headers, cookies, searchParams, uncached fetch calls) from leaking into root execution contexts, which collapses the static prerender shell into full dynamic SSR and introduces cascading client-side waterfalls.

Blocks:Dynamic Accessor Leakage in Outer Layouts and Top-Level Shells Collapsing PPR
Targets:Cursor•Claude•Windsurf•Codex
react-19-resource-precedence-guardrail
frontendcritical

React 19 Asset Preloading and Resource Hint Precedence Guardrail

Enforces deterministic resource loading using React 19 native DOM APIs (preload, preinit, prefetchDNS, connect) and explicit style precedence descriptors over imperative link tags and CSS-in-JS runtime injections. Prevents Flash of Unstyled Content (FOUC), layout shifts, and cascading render-blocking in concurrent transitions by ensuring asset discovery happens during render preparation rather than layout effects.

Blocks:Imperative Link Tag Injection and Unordered Stylesheet Ingestion Triggering Layout Shifts in Concurrent Mode
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-flight-protocol-serialization-barrier
frontendcritical

React 19 RSC Flight Protocol Serialization Barrier and Boundary Tainting

Enforces a strict serialization and sanitization boundary when crossing from React Server Components (RSC) to Client Components via the Flight protocol. Eliminates prototype poisoning, accidental server-state leakage, and non-POJO hydration bugs by mandating explicit Data Transfer Object (DTO) projection and React taint protection APIs.

Blocks:Passing Raw Database Entities, Prototype-Bearing Instances, or Server Context directly to Client Components
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-cryptographic-rpc-envelope-guardrail
frontendcritical

TanStack Start Cryptographic RPC Envelope & Schema Coercion Guardrail

Enforces runtime schema coercion and cryptographic replay validation on all TanStack Start server functions (`createServerFn`). Prevents unvalidated payload execution, state manipulation via raw JSON injection, and duplicate execution of stateful mutations.

Blocks:Unvalidated and Replayable TanStack Start Server Function Mutations
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-isolation-boundary-production-standard
frontendcritical

Svelte 5 Runes Reactive Isolation Boundary & Cascading Cycle Protection

Enforces deterministic state synchronization and strict reactive boundaries within Svelte 5 application trees. Prevents runaway fine-grained signal loops, microtask queue starvation, and silent subscription leakage caused by un-isolated mutations inside $derived runes, ambient $effect tracking, and cross-boundary mutable state sharing.

Blocks:Unbounded Signal Feedback Loops and Ambient Reactive Entanglement Across Rune Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-actions-origin-attestation
frontendcritical

Next.js 15 Server Action Distributed Edge Origin Attestation Invariant

Next.js 15 Server Actions mandate strict runtime Host, X-Forwarded-Host, and Origin header attestation to eliminate state-mutating request injection behind distributed CDNs and multi-tenant edge proxies. Relying on default host validation without explicit origin allowlisting permits cross-origin invocations and host-poisoning attacks across split-edge architectures.

Blocks:Implicit Trust of Origin and Host Headers in Edge-Terminated Server Actions
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-module-graph-isolation
frontendcritical

Vite 6 Environment API Module Graph and Runtime Isolation Standard

Enforces strict isolation across Vite 6 environments (client, ssr, edge, and worker) via discrete module graphs, distinct resolution conditions, and environment-scoped plugin hooks. Eliminates cross-runtime contamination, Node polyfill leakage into browser bundles, and module cache poisoning in isomorphic enterprise applications.

Blocks:Monolithic Module Graph Resolution and Ambient Node Polyfill Leakage Across Isomorphic Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-sandboxing
frontendcritical

Vite 6 Environment API Hybrid Runtime Sandboxing

Enforces strict module resolution, execution isolation, and runner virtualization across heterogeneous server runtimes (Workflows, Edge/workerd, Node.js) using the Vite 6 Environment API. Prevents runtime cross-contamination, global state bleed, and illegal platform-specific primitive leakage across concurrent SSR compilation targets.

Blocks:Monolithic SSR resolution leaking Node-specific primitives into Edge/Workflow environments via legacy server.ssrLoadModule APIs
Targets:Cursor•Claude•Windsurf•Codex
tanstack-query-v5-stream-cancellation-gc-eviction
frontendcritical

TanStack Query v5 Stream Cancellation and Bounded Memory Eviction

High-frequency streaming interfaces (SSE, WebSockets, or chunked transfer feeds) managed by TanStack Query v5 must explicitly link query cancellation tokens to the underlying transport abort protocol. Infinite streaming queries must configure strict sliding memory bounds using maxPages and deterministic garbage collection eviction timeouts (gcTime) to prevent runaway heap expansion and catastrophic browser tab crashes on unmount.

Blocks:Ignoring QueryFunctionContext.signal in streaming queries while accumulating unbounded infinite pages with unevicted cache lifetimes.
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-concurrent-rollback-guardrails
frontendcritical

React 19 useActionState Concurrent Optimistic Mutation & Deterministic Rollback Guardrails

Enforces strict monotonic sequencing and transactional reconciliation when combining React 19 useActionState and useOptimistic across concurrent Server Action invocations. Prevents race conditions, out-of-order resolution overwrites, and unhandled state wedging during network failures or rollback sequences.

Blocks:Out-of-Order Flight Overwrites and Wedged Optimistic UI States in Concurrent Server Action Pipelines
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-microtask-cycle-detection
frontendcritical

Svelte 5 Runes Reactive Graph Microtask Flush Cycle Prevention

Enforces strict acyclic dependency topology in Svelte 5 reactive graphs to eliminate microtask flush loops (ERR_SVELTE_TOO_MANY_UPDATES) and runtime re-entrancy bugs. Prohibits state synchronization through side-effect loops, mandating pure derived computations ($derived / $derived.by) and explicit untracked boundary guards.

Blocks:Mutating Reactive Runes Inside Unbounded $effect Chains Causing Infinite Microtask Batches
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-hydration-boundary-invariant
frontendcritical

Next.js 15 PPR Static Shell & Dynamic Hole Hydration Invariant

Next.js 15 Partial Prerendering (PPR) combines a deterministic static HTML shell generated at build time with edge-streamed dynamic holes. Invoking dynamic APIs (cookies(), headers(), connection(), or uncached async queries) outside an explicit React Suspense boundary collapses the static shell, causing edge CDN cache poisoning or total de-optimization to dynamic rendering.

Blocks:Leaking Dynamic Request Primitives into Root Shell Trees Outside Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-concurrent-optimistic-reconciliation
frontendcritical

Deterministic Action Queuing & Rollback Idempotency in React 19 Optimistic Mutations

Enforces deterministic action sequencing, monotonic state reconciliation, and transactional rollback semantics during concurrent React 19 Server Action execution. Prevents UI tearing, state drift, and race-conditioned stale overwrites during rapid asynchronous user interactions by mandating native useOptimistic and useActionState primitives wrapped inside concurrent transitions.

Blocks:Unsequenced Fire-and-Forget Server Actions with Manual Desynchronized Optimistic State
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-isolation-standard-svelte-5-runes-f-955
frontendcritical

Svelte 5 Runes Fine-Grained Reactive Isolation and Asynchronous Boundary Standard

Enforces strict isolation and boundary guarantees when sharing signal-driven state across asynchronous pipelines and federated micro-frontends in Svelte 5. Prevents broken dependency tracking caused by async context degradation and eliminates memory leaks or state desynchronization from leaking reactive proxy objects across foreign domains.

Blocks:Leaking Mutable Reactive Proxies Across Micro-Frontend Boundaries and Tracking Across Async Await Yields
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-graph-isolation
frontendcritical

Vite 6 Environment API Multi-Runtime Module Graph & Context Isolation

Enforces strict isolation across Vite 6 execution environments (browser, Node.js SSR, and Edge runtimes) using the Environment API. Guarantees zero cross-contamination of module instances, transform caches, and environment variables across heterogeneous execution targets during universal development and bundling.

Blocks:Monolithic Module Graph Querying and Cross-Environment Plugin Cache Leakage
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-runtime-isolation
frontendcritical

Vite 6 Environment API Cross-Runtime Module Isolation Standard

Enforces strict module execution boundaries across heterogeneous execution targets (Client, Node SSR, and Edge Workers) using Vite 6's Environment API. Prevents cross-environment memory leaks, shared runtime state bleed, and unsafe module graph contamination in unified multi-target builds.

Blocks:Shared Ambient Singletons and Unscoped Plugins Leaking Across DevEnvironment Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-cache-life-tag-invalidation-consistency
frontendcritical

Next.js 15 Monotonic Cache Life & Tag Invalidation Guardrail

Enforces strict monotonic read-after-write consistency across Next.js 15 edge nodes and the Data Cache layer during distributed database mutations. Prevents stale-while-revalidate race conditions and cross-region cache drift by mandating deterministic cacheLife profiles, entity-scoped cacheTag strategies, and post-commit tag revalidation barriers.

Blocks:Executing un-scoped revalidateTag calls before write durability or using ambient cacheLife settings that serve stale edge state post-mutation.
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-data-taint-boundary
frontendcritical

React 19 RSC Taint Boundary & Cryptographic Secret Protection

Enforces compiler- and runtime-level data tainting via React 19 experimental_taintUniqueValue and experimental_taintObjectReference across the Data Access Layer (DAL). Guarantees that cryptographic keys, authentication tokens, and raw entity models containing sensitive fields cannot be serialized into React Server Component (RSC) flight payloads or leaked to client bundles.

Blocks:Passing Untainted Raw Database Entities or Cryptographic Secrets Through RSC Boundaries to Client Components
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-scope-isolation
frontendcritical

Svelte 5 Runes SSR Cross-Request Scope Isolation & Leak Prevention

Enforces strict request-boundary isolation for Svelte 5 reactive runes ($state, $derived) in server-side rendering (SSR) runtimes. Module-scoped reactive runes in persistent server runtimes like Node.js and Bun persist across concurrent requests, resulting in cross-user data leakage and critical security vulnerabilities. All mutable user, tenant, or request-specific reactive states must be encapsulated within Svelte Context or instantiated per-request lifecycle.

Blocks:Module-Level $state Singletons Leaking Concurrent Request Data in SSR Runtimes
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-decoupling-vite-6-environme-769
frontendcritical

Strict Module & Environment Isolation via Vite 6 Environment API

Enforces complete module graph and execution environment segregation across client, edge (workerd), and Node.js runtimes using the Vite 6 Environment API. Prevents cross-runtime module leakage, unconditioned Node.js built-ins in edge/client bundles, and monolithic plugin side-effects across heterogeneous runtime boundaries.

Blocks:Cross-Pollinating Module Graphs and Leaking Server Runables into Heterogeneous Vite Environments
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-optimistic-replay-invariants
frontendcritical

React 19 useActionState & Optimistic Update Idempotent Replay Standard

Enforces strict synchronization between React 19 useActionState, useOptimistic, and server actions. Prevents orphaned client-side UI drift and state inconsistency during transient network partitions, server rejections, and retry storms by binding client-generated idempotency keys with deterministic rollback boundaries.

Blocks:Unreconciled Optimistic State with Non-Idempotent Server Actions Causing Ghost UI Drift
Targets:Cursor•Claude•Windsurf•Codex
svelte5-ssr-runes-context-leakage-isolation
frontendcritical

Svelte 5 Rune-Driven SSR Context Leakage & Module Isolation Standard

Enforces strict lifecycle encapsulation of Svelte 5 universal reactive primitives ($state, $derived) within server-side rendering contexts. Prevents cross-request multi-tenant state corruption and session hijacking caused by module-scoped reactive singletons in shared server runtime processes.

Blocks:Module-Scope Mutable Runes Leaking Tenant State Across Concurrent SSR Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-router-cache-stale-time-governance
frontendcritical

Next.js 15 Client-Side Router Cache Stale-Time Governance

Next.js 15 changes the default Router Cache staleTimes to 0 seconds for dynamic renders, yet misconfigurations in Link prefetching, unstable cache revalidation, and route-segment configs can re-introduce silent cache persistence or trigger severe server thrashing. This standard strictly governs client-side router cache invalidation, fetch revalidation flags, and explicit staleTimes in next.config.js to eliminate mutated state desynchronization across client navigations.

Blocks:Uncontrolled Client Navigation Cache Retaining Mutated State or Triggering Unchecked Dynamic Request Thrashing
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-taint-object-guardrails
frontendcritical

React 19 Server Components Experimental Taint Object and Value Guardrails

Enforces compiler-level and runtime tainted token boundaries using React 19 experimental taint APIs (taintObjectReference and taintUniqueValue) across all Server-to-Client component serialization boundaries. Prevents multi-tenant credentials, cryptographic secrets, database instances, and raw internal entities from leaking into client-side flight payloads.

Blocks:Passing un-tainted raw entity models and cryptographic tokens directly across Server/Client component props
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-worker-proxy-transfer-barrier
frontendcritical

Svelte 5 Deep-Proxy Signal Barrier for Web Worker Structured Clones

Svelte 5 wraps reactive objects created via `$state` in deep reactivity proxies tightly coupled to the Universal Signal runtime graph. Passing or serializing these proxies directly across Web Worker boundaries triggers DataCloneError exceptions or corrupts reactivity tracking, causing permanent state desynchronization. All state exiting or entering thread contexts must traverse an explicit barrier via `$state.snapshot()`.

Blocks:Direct Inter-Thread Serialization of Svelte 5 Live Signal Proxies via postMessage or structuredClone
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-server-taint-boundary
frontendcritical

Mandatory React 19 RSC Server Taint Boundary and Secret Isolation

Enforces strict isolation of server-only secrets, cryptographic material, and raw database models using React 19's Server Taint APIs (taintObjectReference, taintUniqueValue) alongside explicit Data Transfer Object (DTO) projection. Prevents accidental serialization of sensitive backend credentials and internal domain models into React Server Component (RSC) streaming Flight protocol payloads sent to the client browser.

Blocks:Leaking Raw Database Entities and Environment Secrets Through RSC Flight Wire Payloads
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-immutability-dom-detach-barrier
frontendcritical

Svelte 5 Snippet Parameter Immutability and DOM Detach Barrier

Enforces strict immutability of parameters passed into Svelte 5 snippets and establishes clean teardown barriers for dynamic snippet renders. Mutating snippet arguments or closing over mutating outer rune state within dynamic SSR snippets causes reactive signal desynchronization, hydration mismatches, and memory leaks from orphaned DOM references.

Blocks:Mutating Snippet Closure Arguments or Leaking Outer Reactive Runes into Snippet Dynamic Blocks
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-chunk-splitting-singleton-guardrail
frontendcritical

Vite 6 Rolldown Deterministic Chunk Splitting & Singleton Module De-duplication

Enforces deterministic chunk boundary isolation and strict singleton module de-duplication in Vite 6 when targeting the Rolldown Rust-native bundling engine. Guarantees that runtime-critical singletons (e.g., React context, TanStack Query clients, Zustand stores) resolve to identical canonical modules across independently hydrated micro-frontends.

Blocks:Implicit Dynamic Splitting Permitting Duplicate Singleton Instances Across Hydrated Micro-Frontends
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-optimistic-rollback-invariant
frontendcritical

React 19 useOptimistic Atomic Transition and Canonical Rollback Invariant

Enforces strict isolation between canonical store state and React 19 useOptimistic projection pipelines within asynchronous Action transitions. Guarantees that network aborts, server action rejections, or concurrent interruptions deterministically revert the active UI tree without leaving uncommitted state in external or parent stores.

Blocks:Preemptive Canonical Store Sync and Unbounded Optimistic Mutation Dispatches
Targets:Cursor•Claude•Windsurf•Codex
react-router-v7-single-fetch-streaming-fence
frontendcritical

React Router v7 Single Fetch Streaming Hydration Fence & Microtask Isolation

Enforces bounded microtask execution and AbortSignal propagation in React Router v7 Single Fetch loaders serializing via turbo-stream. Prevents partial hydration deadlocks and dangling fiber states across rapid client navigations by establishing deterministic streaming hydration fences.

Blocks:Unbounded turbo-stream Promises Starving Microtask Queues and Deadlocking Component Hydration on Interrupted Navigations
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-vite-6-environme-583
frontendcritical

Vite 6 Environment API: Multi-Runtime Context & Memory Isolation Invariants

Enforces strict runtime boundary separation and deterministic module evaluation across divergent execution targets (Browser DOM, Node.js SSR, Edge/workerd) using the Vite 6 Environment API. Prevents cross-environment state pollution, invalidated cross-runtime module graph caching, and catastrophic CJS/ESM interop leaks in hybrid compilation topologies.

Blocks:Global Plugin State Sharing and Legacy SSR Pipeline Coupling Across Heterogeneous Runtimes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-after-background-execution-standard
frontendcritical

Next.js 15 after() Post-Response Execution and Serverless Task Drain Standard

Next.js 15 introduces 'after()' to schedule asynchronous microtasks that execute reliably after a streaming or buffered response completes. Failing to use 'after()' in serverless runtimes results in either dropped background execution due to container freezing or artificial response latency from blocking unneeded awaits in the critical response path.

Blocks:Detached Floating Promises and Blocking Side-Effects in Serverless Response Handlers
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-react-taint-boundary-protection
frontendcritical

Next.js 15 Experimental React Taint Object Boundary Enforcement

Enforces strict boundary isolation using React's experimental taint APIs in Next.js 15 to prevent raw database records, ORM entities, and cryptographic keys from serializing into React Server Component (RSC) flight payloads. Guarantees that any server-only object or sensitive token inadvertently passed to a Client Component triggers an immediate execution halt.

Blocks:Implicit Flight Payload Leaks of Database Entities and Cryptographic Tokens Across RSC Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite-6-rolldown-module-federation-chunk-isolation
frontendcritical

Vite 6 Rolldown Module Federation Chunk Isolation & Singleton Integrity

Enforces deterministic shared runtime singletons and strict CSS/DOM chunk scoping boundaries across decoupled microfrontends compiled via Vite 6 with Rolldown. Prevents catastrophic duplicate runtime instantiation (such as dual React contexts and broken hooks) and uncontained CSS cascading collisions between host containers and dynamically loaded remotes.

Blocks:Dual Runtime Singleton Splitting and Global Style Collision via Unbounded Rolldown Federation Bundling
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-ssr-scope-isolation-standard
frontendcritical

Svelte 5 Runes SSR Reactive Scope Isolation & Context Encapsulation

Enforces strict lexical and contextual isolation for Svelte 5 reactive runes in SSR environments. Module-level $state declarations share memory across concurrent requests in persistent Node.js/edge worker runtimes, causing critical cross-tenant data contamination and memory leaks. Mutable reactive proxies must strictly be encapsulated within request-scoped contexts, factory functions, or component instances.

Blocks:Module-Level $state Declarations Causing Cross-Request State Pollution in SvelteKit SSR
Targets:Cursor•Claude•Windsurf•Codex
react19-server-action-idempotency-replay-boundary
frontendcritical

Cryptographically Enforced Idempotency & Replay Boundaries in React 19 Server Actions

Enforces client-generated cryptographically unique idempotency tokens across React 19 mutating Server Actions combined with atomic server-side deduplication. Guarantees that transient network drops, browser auto-replays, and concurrent optimistic UI updates cannot produce duplicate database mutations or financial double-charges.

Blocks:Non-Idempotent Server Actions Prone to Silent Duplicate Execution and Phantom State Mutations
Targets:Cursor•Claude•Windsurf•Codex
react19-server-action-idempotency-protocol
frontendcritical

React 19 Server Action Idempotency-Key Protocol & Optimistic Mutation Deduplication

Enforces strictly deduplicated, at-most-once mutation guarantees across transient client network retries during React 19 optimistic UI transitions. Requires client-side generation of cryptographically secure idempotency keys bounded to user action lifecycles and server-side atomic reservation before state execution.

Blocks:Blind Server Action Invocations and Regenerated Request Keys Causing Duplicate Ledger Mutations on Transient Retries
Targets:Cursor•Claude•Windsurf•Codex
vite6-dynamic-esm-microfrontend-sri-standard
frontendcritical

Vite 6 Dynamic ESM Micro-Frontend Subresource Integrity (SRI) Standard

Mandates cryptographic origin verification and tamper-proofing for federated chunks resolved at runtime across decoupled CDN deployments. Enforces deterministic manifest-driven SRI verification via link-modulepreload pre-injection or cryptographically validated dynamic import wrappers in Vite 6 host applications.

Blocks:Blind Dynamic ESM Remote Execution Without Cryptographic Subresource Integrity Validation
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-async-boundary-enforcement
frontendcritical

Next.js 15 Partial Prerendering (PPR) Async Request API Boundary Enforcement

Next.js 15 Partial Prerendering couples static shell delivery with dynamic streaming. Awaiting dynamic request APIs (cookies, headers, connection, or unresolved searchParams) in root page components or layouts destroys the static pre-rendered shell and collapses the route into full dynamic SSR. Dynamic accessor invocation must be strictly isolated to leaf Server Components wrapped in explicit Suspense boundaries.

Blocks:Awaiting Dynamic APIs at Route Root Causing Full-Route Dynamic Bailout and Static Shell Collapse
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-after-task-execution-standard
frontendcritical

Next.js 15 after() Lifecycle Standard for Non-Blocking Post-Response Tasks

Next.js 15 introduces after() to coordinate secondary tasks that must execute only after the response stream is finalized without inflating TTFB. Un-awaited floating promises in serverless runtimes lead to frozen lambdas and dropped tasks, while awaiting background tasks directly degrades response latency.

Blocks:Dangling Floating Promises or Awaited Background Telemetry in Route Handlers and Server Actions
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-proxy-boundary-isolation
frontendcritical

Svelte 5 Runes Proxy Boundary Isolation across Workers and Micro-Frontends

Svelte 5 wraps deeply reactive state in internal reactive proxies via `$state()` runes. Passing these proxies across thread boundaries (Web Workers) triggers structured clone algorithm failures (DataCloneError), while passing them across micro-frontend boundaries causes cross-runtime signal leaks, retain cycles, and untracked cascade reactivity. Engineers must enforce explicit boundary snapshotting and immutability fences using `$state.snapshot()` before data exits the Svelte reactive context.

Blocks:Leaking Svelte 5 Reactive Proxy References Across Boundary Fences (Web Workers & Micro-Frontends)
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-isolation-vite-6-environme-508
frontendcritical

Vite 6 Environment API Cross-Runtime State Isolation & Module Graph Guardrail

Enforces strict module graph separation across client, SSR, and Edge runtimes leveraging the Vite 6 Environment API. Prevents runtime state pollution, server-side secret leaks via client module graph inclusion, and invalid node built-in resolution in edge and browser environments.

Blocks:Cross-Boundary Module Graph Leakage & Runtime Contamination via Shared Bundler Contexts
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-requeststore-context-isolation
frontendcritical

Next.js 15 Async Request Context and RequestStore Lifespan Isolation

Enforces immutable asynchronous resolution of dynamic APIs (`headers()`, `cookies()`, `params`, `searchParams`) strictly within bounded RequestStore lifespans in Next.js 15. Prohibits escaping `AsyncLocalStorage` boundaries through module-level caching, detached microtasks, or singleton smuggling to eliminate cross-request context bleeding during concurrent streaming SSR.

Blocks:Escaping RequestStore Scopes via Module Singletons or Detached Promises from headers() and cookies()
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-segregation
frontendcritical

Vite 6 Environment API Runtime Segregation and Boundary Isolation

Enforces strict runtime segregation across client, SSR, and edge environments using Vite 6's Environment API. Prevents cross-runtime contamination, inadvertent leakage of private server-side secrets or Node built-in APIs into browser bundles, and ensures isolated module graphs with distinct resolve conditions.

Blocks:Leaking Server Modules or Secrets to Client Builds via Unified Vite 5-style Configuration
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-cycle-guardrail
frontendcritical

Svelte 5 Runes Reactive Graph Cycle and Evaluation Depth Guardrail

Enforces topological acyclicity and bounded evaluation depth across Svelte 5 rune-based signal graphs. Prevents runtime ERR_SVELTE_TOO_MANY_UPDATES microtask panics by prohibiting cyclic feedback between $effect mutations and $derived signal graphs, mandating explicit cycle-break boundaries via untrack() and single-source-of-truth architectures.

Blocks:Cascading Microtask Loops via Reciprocal $effect State Feedback and Impure $derived Graphs
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-reversion-standard
frontendcritical

React 19 Server Action Optimistic State Reversion and Concurrent Queue Rollback Standard

Mandates atomic optimistic state management using React 19's native useOptimistic paired with useActionState across asynchronous Server Actions. Prohibits manual imperative useState rollbacks inside async try-catch blocks that induce state tearing during concurrent action execution.

Blocks:Manual Imperative State Rollback via Async Try-Catch Blocks in Concurrent Action Handlers
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-cross-runtime-isolation
frontendcritical

Vite 6 Environment API Cross-Runtime Boundary and Global Isolation

Enforces strict boundary isolation and distinct module execution pipelines across heterogeneous runtimes (client, Node.js, workerd, Edge) using the Vite 6 Environment API. Prevents shared in-memory state, global namespace contamination (e.g., leaking Node.js process or Buffer into Edge/workerd), and cross-environment module graph leakage during multi-target development and SSR evaluation.

Blocks:Cross-Runtime Scope Pollution and Shared In-Memory Module Graphs in Multi-Target Vite SSR
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-resolution-guardrail
frontendcritical

Next.js 15 Async Dynamic Request Context Resolution and Streaming Isolation Guardrail

Next.js 15 transforms all dynamic request APIs (`cookies()`, `headers()`, `params`, `searchParams`) into asynchronous operations to enforce strict isolation during concurrent React Server Component (RSC) streaming. Synchronous access or unawaited deferred context extraction causes request-scope contamination, hydration mismatches, and severe security vulnerabilities where concurrent streaming requests bleed tenant or authentication state.

Blocks:Synchronous Access of Dynamic Request Contexts and Cross-Request Scope Pollution in RSC Streaming Trees
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-microtask-scheduler-loop-guardrail
frontendcritical

Svelte 5 Runes Microtask Scheduler Loop & State Tearing Guardrail

Enforces strict boundaries around asynchronous operations inside Svelte 5 runes ($effect, $derived) to prevent microtask scheduler loops and state tearing. Svelte 5's fine-grained push-pull signals batch synchronous reads and writes; interleaving async awaits directly within reactive contexts without untrack() or local transaction state causes circular reactivity queues and stale signal closures across tick boundaries.

Blocks:Mutating reactive state across un-isolated async ticks in $effect triggering infinite scheduler cascades
Targets:Cursor•Claude•Windsurf•Codex
react19-server-actions-idempotency-replay-defense
frontendcritical

React 19 Server Actions Idempotency & Cryptographic Replay Defense Standard

Enforces strict mutation idempotency and cryptographic token binding for React 19 Server Actions paired with speculative optimistic UI transitions. Prevents duplicate state mutations, double-spends, and replayed Flight RPC payloads across concurrent network retries and optimistic rollbacks.

Blocks:Unprotected Server Action Mutation Invoked Across Speculative Transitions Without Idempotency Locks
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-cross-root-context-boundary
frontendcritical

Svelte 5 Polymorphic Snippet Isolation and Cross-Root Context Bridging

Mandates explicit context isolation, type-safe contract bridging, and deterministic lifecycle teardown when passing Svelte 5 polymorphic snippets across independent root mounts or micro-frontend boundaries. Prevents detached reactive tree memory leaks and ambient context lookup failures across disparate application runtimes.

Blocks:Direct Cross-Root Snippet Execution Without Context Bridging and Lifecycle Teardown
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-taint-and-action-signature-verification
frontendcritical

Next.js 15 Server Actions Cryptographic Taint & Action Signature Verification

Enforces strict runtime cryptographic taint tracking via experimental_taintObjectReference and experimental_taintUniqueValue to prevent ambient server secrets and raw domain entities from leaking across the React Server Component (RSC) serialization boundary. Mandates cryptographic signature verification, explicit Data Transfer Object (DTO) projection, and Zod input validation on all Next.js 15 Server Action invocation entry points.

Blocks:Leaking Raw Domain Objects or Ambient Secrets across RSC Serialization Boundaries Without Taint Traps or Signature Verification
Targets:Cursor•Claude•Windsurf•Codex
react19-server-transition-cancellation-boundary
frontendcritical

Deterministic Server Component Transition Cancellation & Interruption Boundaries

Enforces deterministic AbortController integration and epoch sequence synchronization across concurrent React 19 Server Actions and Transitions. Prevents stale flight streams and out-of-order asynchronous server responses from overwriting active client-side optimistic mutations during rapid user interactions.

Blocks:Unbounded Concurrent Server Transitions Overwriting Optimistic UI with Stale RSC Payloads
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-ssr-guardrail
frontendcritical

Vite 6 Environment API Multi-Runtime SSR Boundary Standard

Enforces strict module execution isolation, decoupled module graphs, and runtime-targeted resolve conditions across heterogeneous SSR environments (Node.js, Bun, Workerd) using Vite 6 Environment API. Prevents cross-runtime symbol contamination, node global leakage into edge runtimes, and obsolete legacy ssrLoadModule invocation patterns.

Blocks:Monolithic SSR Module Graphs and Legacy ssrLoadModule Bleeding Cross-Runtime Dependencies
Targets:Cursor•Claude•Windsurf•Codex
react19-cache-request-boundary-invariant
frontendcritical

React 19 Server cache() Request Lifespan & State Leakage Guardrail

Enforces deterministic, request-scoped memoization boundaries for React 19's server-side cache() utility across React Server Component (RSC) execution graphs. Prevents cross-request state leakage, memory bloat, and stale data propagation caused by persistent module-level closures or unmemoized asynchronous dispatch. Mandates referential equality discipline and pure functional boundaries when deriving data within server environments.

Blocks:Global Module-Level Memoization or Unbound Closures Leaking Cross-Request Server State
Targets:Cursor•Claude•Windsurf•Codex
react19-server-actions-idempotency-optimistic-mutation
frontendcritical

React 19 Server Actions Idempotency & Deterministic Optimistic Invariant

Enforces cryptographic idempotency tokens and transactional sequence identity across React 19 Server Action dispatches and optimistic mutations. Guarantees deterministic state rollback and prevents double-execution artifacts or stale-response clobbering during degraded network transitions and concurrent dispatches.

Blocks:Non-Idempotent Concurrent Action Dispatching with Uncorrelated Optimistic State Mutation
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-boundary
frontendcritical

Vite 6 Environment API Multi-Runtime Module Isolation Boundary

Vite 6 replaces legacy monolithic SSR handling with the Environment API, enabling independent module graphs, runner pipelines, and transform contexts across heterogeneous runtimes (Node.js, workerd, Edge, browser). This guardrail strictly enforces execution context isolation, per-environment resolution conditions, and scoped plugin lifecycle hooks to prevent catastrophic module leakage, invalid native bindings, and cross-runtime graph contamination.

Blocks:Leaking Node Built-ins and Cross-Polluting Module Graphs Across Vite 6 Environments
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-reactive-proxy-serialization-guardrail
frontendcritical

Svelte 5 Runes Reactive Proxy Serialization Guardrail

Enforces explicit dereferencing and snapshotting of Svelte 5 rune reactive proxies before passing data across Web Worker message ports, BroadcastChannels, or SSR-to-client hydration state boundaries. Deeply reactive state generated via $state() wraps structures in JavaScript Proxies that fail structured clone algorithms or retain hidden component lifecycle bindings, causing cross-boundary memory leaks and silent mutation tracking failures. Production systems must mandate explicit $state.snapshot() extraction and structured schema-validated transfer.

Blocks:Passing $state Reactive Proxies Across Structured Clone Boundaries Causing Clone Failures and State Retainment
Targets:Cursor•Claude•Windsurf•Codex
wasm-component-sharedarraybuffer-zero-leak-standard
frontendcritical

Deterministic Teardown and Memory Isolation for SharedArrayBuffer WebAssembly Components

Enforces deterministic lifecycle teardown contracts (AsyncDisposable) for WebAssembly Component Model instances backed by SharedArrayBuffer and multi-threaded linear memory. In long-lived single-page applications, uncoordinated garbage collection fails to reclaim SharedArrayBuffer linear allocations and pooled worker memory, leading to browser tab exhaustion and memory leaks.

Blocks:Leaking SharedArrayBuffer allocations and dangling Worker references via non-deterministic GC reliance on Wasm unmount
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-optimistic-rollback-standard
frontendcritical

React 19 Action Optimistic Rollback and State Synchronization Invariant

Enforces deterministic optimistic mutation contracts using React 19 useOptimistic and useActionState primitives. Prevents phantom state desynchronization, stale UI anomalies, and unhandled transition rejections when asynchronous Server Actions fail.

Blocks:Unsynchronized Manual Local State Mutation with Unhandled Server Action Rejections
Targets:Cursor•Claude•Windsurf•Codex
webgpu-compute-worker-memory-barrier-sync
frontendcritical

WebGPU Compute Pipeline Memory Barrier & Worker Synchronization Standard

Mandates deterministic execution ordering and explicit memory barrier synchronization for multi-stage compute passes and OffscreenCanvas frame transfers across Web Worker threads. Prevents Read-After-Write (RAW) tensor buffer hazards and cross-thread race conditions during client-side local LLM inference by enforcing explicit queue submission fencing, staging buffer lifecycle management, and synchronized buffer mapping.

Blocks:Unfenced Cross-Worker Buffer Re-use and Asynchronous Compute Race Hazards
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-client-segment-cache-crypto-tag-pinning
frontendcritical

Next.js 15 Client Router Segment Cache Cryptographic Tag Pinning Standard

Enforces cryptographic deployment revision tag pinning for Next.js 15 App Router client-side segment cache payloads during zero-downtime rolling deployments. Prevents hydration skew, chunk execution crashes, and stale React Server Component (RSC) tree stitching by deterministically invalidating client router memory upon server release divergence.

Blocks:Unpinned Client Segment Prefetching Causing Hydration Skew and Action Desync During Rolling Deploys
Targets:Cursor•Claude•Windsurf•Codex
react-19-activity-hydration-deferral-guardrail
frontendcritical

React 19 Activity Hydration Deferral and Layout Budget Guardrail

Enforces deferred hydration and execution suppression for inactive view trees and off-screen panels using React 19 Activity boundaries. Prevents synchronous layout effect cascades, DOM measurement thrashing, and main-thread budget depletion during concurrent server transitions.

Blocks:Eager Mounting and Synchronous Layout Thrashing in Hidden View Panes During Concurrent Transitions
Targets:Cursor•Claude•Windsurf•Codex
vite-6-rolldown-chunk-tree-shaking-isolation-standard
frontendcritical

Vite 6 & Rolldown Module Tree-Shaking and Edge SSR Side-Effect Isolation Standard

Mandates absolute module-level side-effect isolation for Vite 6 Rolldown-native edge SSR compilation to guarantee deterministic sub-50ms cold-start execution. Eliminates module-scope object allocations, un-annotated global initializations, and barrel-file side-effect leaks that destabilize tree-shaking boundaries in isolated V8 edge runtimes.

Blocks:Eager Module-Scope Instantiation and Leaky Dynamic Imports in Edge SSR Runtimes
Targets:Cursor•Claude•Windsurf•Codex
react-19-async-hydration-promise-dedupe
frontendcritical

React 19 Async Resource Hydration & Promise De-duplication Standard

Mandates deterministic microtask de-duplication and memory eviction for async resources unwrapped via React 19's `use()` API. Enforces request-scoped cache boundaries and WeakMap-backed promise registries to prevent infinite suspension loops and server memory leaks during concurrent streaming hydration.

Blocks:Instantiating Uncached Promises in Render or Using Unbounded Global Caches with use()
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-multitenant-cache-fencing
frontendcritical

Next.js 15 Multi-Tenant Cache Key Fencing & Stale Lifecycle Invariants

Enforces cryptographically isolated cache namespaces and deterministic cacheLife profiles when utilizing Next.js 15's 'use cache' directive in multi-tenant environments. Prevents cross-tenant data exfiltration and stale cache bleeding across Edge and CDN runtimes by requiring tenant-isolated cacheTag prefixes and bounded invalidation lifecycles.

Blocks:Global Unpartitioned 'use cache' Directives Causing Multi-Tenant Cache Bleeding and Unbounded Staleness
Targets:Cursor•Claude•Windsurf•Codex
react-19-optimistic-action-rollback-isolation
frontendcritical

React 19 Optimistic Action Rollback Isolation & State Monotonicity

Enforces strict optimistic state monotonicity and deterministic error rollback across asynchronous React 19 concurrent transitions. Prohibits manual side-effect rollbacks in detached closures, uncoordinated useOptimistic mutations, and out-of-order resolution leaks during concurrent action dispatches. Ensures UI state transitions strictly derive from canonical server state while preserving deterministic branch isolation on network failures.

Blocks:Uncoordinated React 19 useOptimistic mutation dispatching with manual closure-based rollbacks causing race condition state corruption
Targets:Cursor•Claude•Windsurf•Codex
speculation-rules-cross-origin-partitioning-standard
frontendcritical

Mandatory Partitioning and Credential Isolation for W3C Speculation Rules API

Enforces strict isolation, anonymous credential modes, and Sec-Purpose headers validation when using the W3C Speculation Rules API for prefetching and prerendering. Prevents cross-site information leaks (XS-Leaks), speculative timing attacks, and CSRF/state mutation via unpartitioned cross-origin speculative fetching.

Blocks:Unrestricted Credentialed Speculative Execution Across Origins Without Partitioning Guards
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-cache-signal-invalidation-standard
frontendcritical

React 19 Server Components Cache Signal Invalidation Standard

Enforces strict AbortSignal wiring, cryptographic cache tagging, and deterministic revalidation semantics across async data boundaries in React 19 Server Component hierarchies. Prevents orphaned server-side rendering promises and stale hydration mismatches by coupling cache lifetime directly to request lifecycle signals and cryptographically signed tags.

Blocks:Dangling fetch requests without AbortSignal propagation and unstructured string tags causing hydration desyncs
Targets:Cursor•Claude•Windsurf•Codex
vite6-runtime-css-inversion-guardrail
frontendcritical

Vite 6 Runtime CSS Chunk Inversion Ordering & Cascade Guardrail

Enforces deterministic runtime CSS chunk injection and cascade boundary isolation across Vite 6 micro-frontend host and remote topologies. Prevents catastrophic stylesheet specificity leakage, non-deterministic cascade overrides, and Flash of Unstyled Content (FOUC) triggered by race conditions during asynchronous, heterogeneous module preloading.

Blocks:Unordered Document Head Injection Causing Runtime CSS Specificity Inversion
Targets:Cursor•Claude•Windsurf•Codex
react-19-useactionstate-optimistic-reentrancy-guardrail
frontendcritical

Deterministic Re-entrancy and Rollback Invariants for React 19 useActionState and useOptimistic

Enforces deterministic snapshot isolation, monotonic sequencing, and tear-free rollbacks across concurrent React 19 useActionState invocations coupled with useOptimistic. Prevents state corruption, out-of-order resolution tearing, and destructive rollbacks when interleaved asynchronous server actions fail or resolve non-deterministically.

Blocks:Non-Deterministic Optimistic Overwrites and Destructive Rollbacks in Interleaved Server Actions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-effect-root-disposal-invariant
frontendcritical

Svelte 5 $effect.root Disposal and Microtask Boundary Invariant

Enforces deterministic teardown of unparented fine-grained reactive roots instantiated via $effect.root outside of standard Svelte component lifecycles. Prevents cross-request memory retention during SSR, node heap exhaustion, and zombie listener execution across asynchronous microtask boundaries in dynamic client-server execution paths.

Blocks:Orphaned $effect.root Instantiations and Unbounded Asynchronous Reactive Registrations
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-isolation-standard
frontendcritical

Vite 6 Environment API Multi-Runtime Sandbox Isolation Standard

Enforces strict boundary separation across Vite 6 environments (client, ssr, edge, workerd) to prevent cross-runtime module graph pollution, unauthorized Node.js built-in leakage, and environment-mismatched bundle poisoning. Mandates programmatic isolation via Vite 6 Environment API configurations, environment-scoped plugin hooks, and explicit package export condition targeting.

Blocks:Cross-Runtime Module Graph Leaks and Monolithic Plugin State Poisoning
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-use-cache-tag-invalidation
frontendcritical

Next.js 15 Dynamic I/O & 'use cache' Cryptographic Boundary Standard

Enforces strict tenant isolation and deterministic cache tagging under Next.js 15 Dynamic I/O architecture. Mandates that all cached execution scopes using the 'use cache' directive bind cryptographic, tenant-scoped cache tags and cacheLife profiles, eliminating multi-tenant data bleed across prerendered edge runtimes and persistent cache stores.

Blocks:Global Unscoped 'use cache' Directives Causing Multi-Tenant Cache Pollution and Cross-Tenant Data Leaks
Targets:Cursor•Claude•Windsurf•Codex
react19-compiler-memo-invalidation-boundary
frontendcritical

React 19 Compiler Closure Purity and Dynamic Memoization Invalidation Boundaries

Enforces strict immutability, closure purity, and input dependency stability to maintain React 19 Compiler memoization block validity. Prevents cascading subtree re-renders caused by in-place object mutations, unstable closure capture, and leaky reactive scopes that force the compiler to de-optimize or continuously bust auto-generated cache slots.

Blocks:In-Place Mutation and Non-Idempotent Render Closures Triggering Full Memoization Slot De-Optimization
Targets:Cursor•Claude•Windsurf•Codex
tauri-v2-ipc-zero-copy-binary-boundary
frontendcritical

Tauri 2.0 IPC Zero-Copy ArrayBuffer & Channel Binary Transfer Boundary

Enforces zero-serialization binary streaming between the Tauri Core Rust runtime and web client WebViews using Tauri 2.0 Channels or raw binary Response types. Prohibits base64 strings or JSON integer array representations of byte arrays (`Vec<u8>`) across the IPC boundary to eliminate memory thrashing, main thread serialization locks, and quadratic GC allocation churn.

Blocks:Serializing Raw Byte Buffers into Base64 Strings or JSON Number Arrays across Tauri IPC
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-isolation-vite-6-environme-503
frontendcritical

Vite 6 Multi-Environment Isolation and Cross-Runtime Boundary Enforcement

Vite 6 Environment API allows distinct execution contexts (Node SSR, Workerd edge, React Server Components, and client bundles) to run in unified dev and build pipelines. In multi-runtime setups, you must enforce strict module boundary isolation, dedicated DevEnvironment configs, and explicit runtime export conditions to prevent host Node.js globals and stateful module graphs from cross-pollinating isolated runtimes.

Blocks:Cross-Pollinating Node.js Globals and Sharing Module Execution Caches Across Isolated Vite 6 Environments
Targets:Cursor•Claude•Windsurf•Codex
vite6-cross-runtime-environment-isolation-standard
frontendcritical

Vite 6 Environment API Cross-Runtime Module Isolation Standard

Enforces strict memory, global scope, and module graph isolation when simultaneously executing client, edge-worker (WinterCG), and Node.js runtimes in Vite 6 pipelines. Prevents cross-runtime state leakage, unisolated global mutations, and corrupted Hot Module Replacement (HMR) broadcasts across environment boundaries.

Blocks:Shared Module Graph Contamination and Global Scope Bleed Across Vite 6 Multi-Runtime Environments
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-hole-concurrency-barrier
frontendcritical

Next.js 15 PPR Dynamic Hole Isolation and Edge Stampede Barrier

Enforces strict isolation between static pre-rendered shells and dynamic asynchronous streaming holes under Next.js 15 Partial Prerendering (PPR). Mandates boundary encapsulation using React Suspense with deduped, cached dynamic loaders to prevent blocking Time to First Byte (TTFB) at distributed edge points of presence (POPs). Eliminates thundering-herd cache stampedes across edge workers during traffic spikes by coupling React cache() with stale-while-revalidate data primitives.

Blocks:Leaking Dynamic Accessors to Component Shells and Uncached Multi-Hole Suspense Stampedes
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-streaming-hole-hydration-fence
frontendcritical

Next.js 15 Partial Prerendering (PPR) Streaming Hole Hydration Fence Standard

Enforces strict structural boundaries and layout-stable hydration fences around dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Prevents dynamic data bailout of static prerender shells, uncoordinated cumulative layout shifts (CLS), and client-side hydration race conditions across progressive streaming boundaries.

Blocks:Unbounded Dynamic Hole Streaming Causing PPR De-optimization and Hydration Layout Collapse
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-boundary
frontendcritical

Next.js 15 Async Request Context & Dynamic Data Boundary Guardrail

Enforces strict asynchronous resolution of Next.js 15 dynamic request APIs (cookies, headers, params, searchParams) and prevents cross-request context leakage in React 19 concurrent server rendering environments. Prohibits global or module-scoped mutable request caches that risk multi-tenant contamination during concurrent microtask execution.

Blocks:Synchronous consumption or module-scoped caching of request primitives leaking tenant data across concurrent server renders
Targets:Cursor•Claude•Windsurf•Codex
react-19-metadata-hoisting-style-precedence
frontendcritical

React 19 Document Metadata Hoisting and Deterministic Style Precedence Guardrail

Enforces native React 19 document metadata hoisting and deterministic stylesheet cascade precedence across concurrent server-client streaming transitions. Eliminates Flash of Unstyled Content (FOUC) and Cumulative Layout Shift (CLS) by mandating explicit precedence attributes on stylesheets and utilizing react-dom resource discovery APIs over legacy imperative link injection.

Blocks:Imperative Client-Side DOM Injection or Missing Precedence on Streaming Stylesheets Inducing Cascade Inversion
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-weakref-context-gc-guardrail
frontendcritical

Vite 6 Environment API WeakRef & FinalizationRegistry Context Reclamation

Enforces strict memory reclamation for multi-runtime SSR module evaluations using Vite 6's Environment API. Strong references to transient DevEnvironment runner scopes, execution contexts, and evaluated module graphs MUST be replaced with WeakRef and tracked via FinalizationRegistry to prevent fatal heap exhaustion during Hot Module Replacement (HMR).

Blocks:Retaining Strong References to Multi-Runtime SSR ModuleRunner Contexts Across HMR Cycles
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-async-derived-race-condition-guardrail
frontendcritical

Svelte 5 Runes Async State & Effect Cancellation Fence Guardrail

Enforces deterministic cancellation fences and monotonic generation checks for asynchronous operations driven by Svelte 5 runes. Prevents state tearing, out-of-order promise settlement, and microtask memory leaks during rapid client-side transitions by requiring AbortController cleanups in effects and custom resource runes.

Blocks:Unfenced Async Invocations within Runes Resulting in Stale Promise Overwrites and State Tearing
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-boundary-isolation-contract
frontendcritical

Next.js 15 Partial Prerendering (PPR) Boundary Isolation Contract

Enforces strict isolation between static pre-rendered HTML shells and dynamic React 19 streaming slots within Next.js 15 PPR architectures. Prevents accidental dynamic context leakage that causes entire page trees to de-optimize to dynamic SSR and trigger cascading hydration bailouts under high concurrency. Mandates explicit React Suspense boundaries around all dynamic I/O primitives including headers(), cookies(), and uncached fetch invocations.

Blocks:Dynamic Hook Leakage Inducing Full-Route Static Shell Bailout
Targets:Cursor•Claude•Windsurf•Codex
vite-6-ssr-environment-module-partitioning
frontendcritical

Vite 6 Environment API Multi-Runtime Module Partitioning and State Isolation

Enforces strict runtime module graph partitioning and dedicated execution environments using the Vite 6 Environment API. Prevents cross-environment memory pollution, platform global contamination (e.g., Node.js built-ins in Workerd/Edge runtimes), and split-brain singleton states across Universal SSR targets.

Blocks:Monolithic Module Graph Evaluation and Cross-Runtime State Bleed in Multi-Target SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-state-mutation-drain-guardrail
frontendcritical

Svelte 5 Runes Async State Mutation & Reactive Graph Drain Guardrail

Enforces strict boundaries on asynchronous state mutations within Svelte 5 rune-based reactivity ($effect, $state, and $derived). Prevents unbounded microtask-driven signal cascades, infinite reactive graph flush loops, and orphaned state writes across component teardown or hydration transitions.

Blocks:Unbounded Async State Mutation Inside $effect Inducing Infinite Microtask Flush Loops
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-taint-isolation
frontendcritical

Next.js 15 Dynamic I/O & React Taint Cryptographic Boundary Standard

Guarantees cryptographic and contextual isolation between server-only sensitive data and client-serialized component boundaries during Next.js 15 Dynamic I/O prerendering. Mandates strict usage of React Taint APIs at Data Access Layers (DAL) to prevent runtime serialization of secrets into React Server Component (RSC) flight data payloads.

Blocks:Leaking Raw Domain Secrets and Un-cached Request Primitives Across RSC Serialization Boundaries
Targets:Cursor•Claude•Windsurf•Codex
module-federation-2-remote-integrity-singleton-guardrail
frontendcritical

Module Federation 2.0 Dynamic Remote Integrity & Shared Dependency Guardrail

Enforces cryptographic manifest validation, subresource integrity (SRI), and strict semver singleton resolution when dynamically loading Module Federation 2.0 remotes across heterogeneous CDNs. Prevents supply-chain remote hijacking and dual-instantiation runtime crashes in shared runtime singletons like React, React-DOM, and state managers. Mandates centralized federation runtime plugins for dynamic URL ingestion and error boundary fallbacks.

Blocks:Unvalidated Remote Script Injection with Unpinned Shared Singleton Collisions
Targets:Cursor•Claude•Windsurf•Codex
tanstack-query-v5-offline-mutation-optimistic-rollback-standard
frontendcritical

Deterministic TanStack Query v5 Offline Mutation Queuing and Optimistic Rollback

Enforces strict mutation context snapshotting, deterministic rollback chains, and queue-aware cache invalidations in TanStack Query v5 during offline replay. Prevents client-state tearing and phantom cache overwrites when synchronizing persisted mutation queues against eventually consistent backend services. Ensures optimistic updates preserve immutable snapshots and cancel in-flight queries before mutating the QueryClient cache.

Blocks:Unbounded Optimistic Cache Mutation without In-Flight Query Cancellation or Immutable Snapshot Rollback
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-taint-api-guardrail
frontendcritical

React 19 Server Components Taint API Serialization Guardrail

Enforces strict boundary isolation between Server Components and Client Components by mandating the use of React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs. Prevents inadvertent serialization and wire-format exfiltration of server-only secrets, credentials, user PII, and session tokens across the RSC boundary into client-accessible bundles. Requires explicit taint registration at the data-access layer for any object or scalar value containing sensitive material.

Blocks:Passing Untainted Server Credentials, Raw Database Records, or Auth Tokens Across the RSC Wire Boundary
Targets:Cursor•Claude•Windsurf•Codex
module-federation-2-dynamic-remote-abi-versioning
frontendcritical

Module Federation 2.0 Dynamic Remote ABI Versioning and Singleton Integrity Guardrail

Enforces strict singleton resolution and explicit ABI runtime contract negotiation across Module Federation 2.0 dynamic remotes. Eliminates catastrophic cross-container failures caused by multiple shared instance initialization (e.g., React contexts, design systems, state managers) and semantic contract drift across independently deployed micro-frontends.

Blocks:Permissive Shared Scope Resolution and Unchecked Dynamic Remote Invocations Causing Split-Brain Singletons and Silent Runtime ABI Desynchronization
Targets:Cursor•Claude•Windsurf•Codex
react19-server-actions-idempotency-optimistic-replay-standard
frontendcritical

React 19 Server Actions Idempotency Key & Optimistic Subtree Replay Standard

Enforces client-generated idempotency keys and deterministic optimistic subtree reconciliation for React 19 Server Actions. Guarantees deduplicated backend execution during edge network retransmissions and eliminates optimistic UI layout shifts or dropped state transitions during server reconciliation.

Blocks:Naive Server Action Invocations Lacking Client-Side Idempotency Keys and Stable Optimistic Identity Reconciliation
Targets:Cursor•Claude•Windsurf•Codex
react-19-optimistic-rollback-boundary
frontendcritical

React 19 Optimistic State Transition Rollback Boundary Invariants

Enforces transactional rollback guarantees when mutating optimistic state via useOptimistic and useActionState in React 19 concurrent pipelines. Eliminates split-brain UI desynchronization caused by unhandled Server Action rejections, concurrent transition clobbering, and uncoordinated local state mutation outside the transition lifecycle.

Blocks:Split-Brain UI Drift via Unbound Optimistic State Mutation and Missing Transition Rollback Barriers
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-cross-runtime-isolation
frontendcritical

Vite 6 Environment API Cross-Runtime Shared Memory & Module Graph Isolation

Vite 6 introduces multi-environment orchestration allowing concurrent execution of client, SSR (Node), and edge/workerd runtimes within a unified dev server. This rule enforces strict module execution and heap boundaries between environments, prohibiting cross-runtime in-memory singleton access, cross-environment module graph contamination, and non-serializable IPC payloads.

Blocks:Cross-Runtime Memory Leakage and Module Graph Contamination via Unscoped Singletons in Vite 6 DevEnvironments
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-state-optimistic-mutation-invariant
frontendcritical

React 19 Action State Transition and Optimistic Mutation Queue Invariant

Enforces strict queue serialization and deterministic rollback reconciliation when combining React 19's useActionState and useOptimistic primitives during concurrent server actions. Guarantees that optimistic UI state branches cleanly reconcile against server-committed state without race conditions, stale closure overwrites, or out-of-order rollbacks.

Blocks:Unserialized Concurrent Mutations with Orphaned Optimistic States and Desynchronized Rollbacks
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-universal-store-leak-prevention
frontendcritical

Svelte 5 Runes Universal Store Cross-Request State Leakage Prevention

Enforces strict per-request isolation for Svelte 5 reactive runes ($state) in universal and server-side rendering (SSR) environments. In persistent runtime worker environments (Node.js, Bun, Cloudflare Workers), module-level reactive singletons bleed authenticated sessions, PII, and request mutations across concurrent user requests. Engineers must encapsulate mutable state within component contexts or per-request lifecycle factories.

Blocks:Module-Scoped $state() Singletons Leaking Concurrent User Sessions During SSR
Targets:Cursor•Claude•Windsurf•Codex
tanstack-query-v5-structural-sharing-gc-guardrail
frontendcritical

TanStack Query v5 Structural Sharing & GC Boundary Guardrail

Enforces strict immutability boundaries and explicit structural sharing controls for TanStack Query v5 in long-lived client sessions. Prevents catastrophic heap fragmentation, runaway replaceEqualDeep recursive traversals, and detached DOM retention caused by unbounded high-frequency cache invalidations.

Blocks:Unbounded replaceEqualDeep traversals and stale reference closures across high-frequency cache writes.
Targets:Cursor•Claude•Windsurf•Codex
coop-atomics-sharedarraybuffer-fencing
frontendcritical

Cross-Origin Isolation and Atomics Fencing for SharedArrayBuffer Concurrency

Mandates strict cross-origin isolation headers (COOP/COEP) to safely instantiate SharedArrayBuffer without Spectre exposure, combined with explicit Atomics memory fencing between main-thread rendering pipelines and WebAssembly worker pools. Forbids un-synchronized shared memory mutation and illegal main-thread Atomics.wait calls to prevent browser freezing and torn reads.

Blocks:Unsynchronized SharedArrayBuffer Access and Main-Thread Blocking Atomics Under Insecure Origin Isolation
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-backpressure-controller
frontendcritical

Next.js 15 PPR Streaming Backpressure & Memory Bounded Flow Control

Mandates explicit backpressure management and bounded queue controls for dynamic streaming slots under Next.js 15 Partial Prerendering (PPR). Prevents edge memory exhaustion and event-loop blocking caused by unthrottled producer push-streams outpacing slow client TCP windows during static shell flushes.

Blocks:Unthrottled Push-Streaming to Edge Response Pipes Without Desired-Size Flow Control
Targets:Cursor•Claude•Windsurf•Codex
tauri-v2-granular-ipc-capability-sandboxing
frontendcritical

Mandatory Declarative ACL Capability Sandboxing for Tauri 2.0 IPC Invocations

Tauri 2.0 deprecates global allowlists in favor of compile-time Access Control List (ACL) capabilities and scoped permission sets. Frontend webview calls to core commands and official plugins must map strictly to explicit, minimal capability manifests defined under src-tauri/capabilities. Arbitrary shell execution, unscoped filesystem operations, and unvalidated dynamic invoke targets are strictly prohibited to prevent complete host compromise via XSS.

Blocks:Unrestricted IPC Invocations and Permissive Wildcard Capabilities Enabling Host-Level Compromise
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-concurrent-hydration-barrier
frontendcritical

React 19 Server Actions Concurrent Hydration Barrier Standard

Enforces deterministic queue-and-rollback boundaries for React 19 Server Actions triggered during selective or streaming hydration. Eliminates client-server state desynchronization and tearing by ensuring optimistic updates and server action transitions maintain strict transactional invariants prior to full DOM hydration.

Blocks:Unbounded Server Action Invocations and Direct State Mutations Before Complete Hydration
Targets:Cursor•Claude•Windsurf•Codex
vite-6-module-federation-isolated-singleton-standard
frontendcritical

Vite 6 Module Federation Isolated Dependency Singleton Standard

Enforces strict singleton configuration and shared dependency isolation across Vite 6 federated remotes and hosts using modern Module Federation. Prevents dual-engine runtime collisions, broken React Context trees, invalid hook invocations, and desynchronized state stores caused by unconstrained ESM bundle resolution.

Blocks:Unpinned and Non-Singleton Federated ESM Dependencies Inducing Dual Runtime Instantiation and Broken React Context
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-key-pipeline
frontendcritical

Deterministic Server Action Idempotency Transport and Replay-Safety Pipeline

Enforces deterministic client-side generation and transport of cryptographically secure idempotency keys across React 19 useActionState transitions, optimistic updates, and automatic network retries. Prevents double-mutations, race conditions, and corrupted optimistic states by mandating distributed cache reservation tokens coupled to payload hashes.

Blocks:Ad-Hoc Server Actions Vulnerable to Duplicate Mutations Under Flaky Networks and Optimistic Transitions
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-boundary-enforcement
frontendcritical

Vite 6 Environment API Multi-Runtime Module Boundary Guardrails

Enforces strict module separation across client DOM, Node.js SSR, and Edge Worker compilation environments using the Vite 6 Environment API. Prevents runtime-specific symbol leaks, illegal module graph bridging, and non-deterministic tree-shaking failures across disparate execution targets.

Blocks:Cross-Runtime Symbol Contamination via Shared Module Graphs and Permissive Conditional Resolvers
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-transition-abort-controller-propagation
frontendcritical

Deterministic AbortController Propagation in React 19 Action Transitions

Enforces explicit AbortController signal propagation and deterministic teardown across React 19 asynchronous action transitions. Prevents zombie state resolutions, out-of-order race conditions, and catastrophic layout thrashing across concurrent View Transitions during rapid user interactions.

Blocks:Firing detached asynchronous fetches inside React 19 startTransition without lifecycle-bound AbortSignal propagation.
Targets:Cursor•Claude•Windsurf•Codex
duckdb-wasm-memory-spilling-guardrail
frontendcritical

DuckDB-WASM Linear Memory Arena Ceilings and Disk Spilling Guardrail

Enforces strict WebAssembly linear memory limits and Origin Private File System (OPFS)/IndexedDB disk-spilling configurations for DuckDB-WASM instances. Prevents browser tab crashes and uncatchable WebAssembly.Memory out-of-bounds faults by setting hard memory budgets and redirecting intermediate query scratch buffers to browser-backed storage.

Blocks:Unbounded DuckDB-WASM In-Memory Execution Without Memory Limits or Scratch Filesystem Tiering
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-fallback-boundary-isolation
frontendcritical

Next.js 15 PPR Dynamic Fallback Boundary Isolation and Stream Resiliency

Enforces strict boundary encapsulation of dynamic runtime access within React Suspense during Next.js 15 Partial Prerendering (PPR). Prevents dynamic context leakage from de-optimizing the static pre-rendered shell and mandates edge-resilient stream termination with deterministic static fallbacks.

Blocks:Unenclosed Dynamic Context Ingestion Collapsing PPR Static Shells and Causing Edge Worker Stream Hangs
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-async-context-invariants
frontendcritical

Next.js 15 Dynamic I/O Async Request Context Unwrapping Invariant

Under Next.js 15's Dynamic I/O execution model, request-bound contexts (`cookies()`, `headers()`, `params`, `searchParams`) yield asynchronous promises that must be consumed through granular boundaries. Unconditional top-level awaiting or premature promise unwrapping in layout or page shells blocks prerender waterfalls, invalidates Partial Prerendering (PPR), and triggers cross-request data pollution. Strict leaf-node unwrapping wrapped in explicit React Suspense boundaries is mandated to preserve static pre-generation guarantees.

Blocks:Awaiting Dynamic Request Promises at Root Shells Without Suspense Isolation Under Dynamic I/O
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-static-quarantine
frontendcritical

Next.js 15 PPR Dynamic-Static Boundary Quarantine & Context Isolation

Enforces strict isolation between edge-cached static shells and runtime dynamic segments under Next.js 15 Partial Prerendering (PPR). Prevents request-bound primitives like cookies, headers, and authentication claims from leaking into statically prerendered ASTs, and ensures dynamic data holes are strictly enclosed within explicit React Suspense boundaries.

Blocks:Accessing Request-Scoped Dynamic Context Outside Suspense Boundaries in PPR Shells
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-optimistic-rollback-sync
frontendcritical

React 19 useOptimistic Rollback Synchronization and Concurrency Protocol

Enforces deterministic optimistic reconciliation, monotonic revision sequencing, and active transaction lifecycle tracking when executing concurrent React 19 Server Actions. Guarantees that out-of-order network resolutions or transient network failures cannot roll back subsequent forward state or introduce ghost writes into the UI.

Blocks:Unsequenced useOptimistic mutations permitting out-of-order action resolutions to revert newer client states
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-effect-abortsignal-lifetime-binding-standard
frontendcritical

Svelte 5 $effect AbortSignal Lifecycle Binding & Zombie Execution Guardrail

Enforces deterministic cancellation and resource deallocation across all asynchronous or event-driven Svelte 5 $effect and $effect.pre invocations. Mandates binding an AbortController instance to the effect's synchronous teardown function to prevent memory leaks, race conditions, and zombie execution trees during rapid reactive graph invalidations.

Blocks:Unbounded Async Operations in $effect Producing Zombie Execution and State Invalidation Races
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-optimistic-rollback-reconciliation
frontendcritical

React 19 Deterministic useOptimistic Rollback and Concurrency Reconciliation

Enforces transactional optimistic state management in React 19 by binding useOptimistic directly to canonical base states managed by useActionState or props within startTransition boundaries. Prevents race conditions, phantom rollbacks, and torn UI renders during concurrent, out-of-order Server Action rejections by requiring immutable monotonic action envelopes and disallowing parallel imperative local state mutations.

Blocks:Imperative State Mirroring and Non-Monotonic Optimistic Queuing Leading to Torn UI Rollbacks
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-async-signal-tear-prevention
frontendcritical

Svelte 5 Runes Async Signal Tear Prevention Guardrail

Prevents state tearing and non-deterministic dependency tracking across microtask turns in Svelte 5 fine-grained reactivity. Guarantees that $state signals mutate synchronously in atomic transactions or explicitly untracked contexts when crossing Promise boundaries. Mandates untrack() for reads after await within effects to prevent zombie listeners and inconsistent reactive graph transitions.

Blocks:Mutating and Reading $state Runes Across Microtask Continuations in Untracked $effect Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
vite-6-ssr-modulerunner-isolated-realm-cleanup
frontendcritical

Vite 6 SSR ModuleRunner Isolated Realm Cleanup and Heap Invariant

Enforces deterministic heap boundary teardown, explicit runner destruction, and cross-request cache eviction when utilizing Vite 6 Environment API and ModuleRunner. Prevents cascading memory leaks and cross-tenant state pollution caused by lingering module evaluations, unevicted module caches, and orphaned evaluation contexts in long-running development and edge SSR runtimes.

Blocks:Retaining persistent ModuleRunner instances across SSR request boundaries without realm teardown or explicit cache eviction.
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-scope-fencing
frontendcritical

Vite 6 Environment API Runtime Scope Fencing and Realm Isolation

Enforces strict module execution graph isolation and condition boundaries across distinct client, server (Node.js), and edge runtime realms using Vite 6 Environment API. Prevents silent SSR secret exfiltration, invalid cross-realm tree-shaking, and global pollution caused by deprecated ssrLoadModule invocation and shared module runners.

Blocks:Leaking SSR secrets and cross-realm globals via legacy ssrLoadModule and unfenced Vite environment graphs
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-teardown-standard
frontendcritical

Svelte 5 Runes Reactive Effect Teardown and Boundary Invariant

Enforces strict disposal mechanics and teardown callbacks for root-level and asynchronous $effect executions within dynamic microfrontend architectures. In dynamically unmounted host boundaries, unhandled $effect triggers and nested asynchronous subscriptions bypass automatic component garbage collection, causing catastrophic heap leaks and detached DOM node retention. All asynchronous observables, EventTarget listeners, and polling loops initialized inside $effect blocks must return synchronous teardown functions or execute inside explicit $effect.root wrappers.

Blocks:Dangling Root $effect Subscriptions and Missing Synchronous Teardowns in Dynamic Mounts
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-key-barrier
frontendcritical

React 19 Server Actions Idempotency Key Barrier Standard

Enforces deterministic client-generated mutation tokens across React 19 optimistic transitions and server action invocations. Guarantees that transient cellular network dropouts, automated browser retries, and rapid multi-tap events do not cause duplicate backend execution, double charges, or inconsistent state transitions.

Blocks:Unbounded Server Action Invocation Without Deterministic Client Mutation Tokens
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-transition-concurrent-abort-governor
frontendcritical

React 19 Action Transition Cascading Abort Governor

Enforces deterministic cancellation and cleanup of interrupted React 19 Action transitions by binding monotonic sequence IDs and cascading AbortController signals to every concurrent Server Action execution. Guarantees that fast-following user actions preempt and immediately abort in-flight asynchronous operations, preventing stale out-of-order mutations from clobbering concurrent optimistic state transitions.

Blocks:Un-aborted Interrupted Server Actions Mutating State and Clashing with Optimistic Updates
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-universal-runes-ssr-isolation
frontendcritical

Svelte 5 Universal Runes SSR Request-State Isolation Guardrail

Enforces strict request-scoped lifecycle boundaries for Svelte 5 universal runes ($state, $derived) within server-side rendering (SSR) environments. Prevents module-level reactive singletons from retaining and leaking cross-tenant state, session tokens, or user data across concurrent Node.js/Edge render cycles. Mandates that all universal rune state containers are bound to component tree contexts or request lifecycles.

Blocks:Exporting Module-Level Universal Rune Singletons in .svelte.ts Files During SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-deep-effect-resource-disposal-pattern
frontendcritical

Svelte 5 Runes Deep Effect Resource Disposal Pattern

Enforces synchronous return-based cleanup contracts and AbortController scoping inside Svelte 5 `$effect` and `$effect.root` runes. Eliminates orphaned subscriptions, memory leaks, and cross-boundary event pollutions in long-lived isomorphic micro-frontends undergoing dynamic mounting cycles. Prevents asynchronous unhandled teardowns across complex signal trees.

Blocks:Dangling Subscriptions and Asynchronous Void Cleanup in Svelte 5 $effect Blocks
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-dynamic-io-async-fencing
frontendcritical

Next.js 15 Dynamic I/O Async Request and Metric Fencing

Enforces strict boundary isolation between compile-time prerendering and deferred runtime I/O in Next.js 15 with dynamicIO enabled. Prevents unintentional route-wide dynamic de-optimizations by mandating explicit Suspense fencing and caching directives around asynchronous request hooks and telemetry emitters.

Blocks:Unfenced Async Request Hooks and Runtime Telemetry Collapsing Prerendered Shells
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-auth-leak-guardrail
frontendcritical

Next.js 15 PPR Dynamic Hole Isolation and Request Context Boundary Guardrail

Enforces strict physical boundary separation between static prerender shells and dynamic streaming holes under Next.js 15 Partial Prerendering (PPR). Prevents dynamic APIs such as cookies(), headers(), and authenticated session resolution from de-optimizing static prerender shells or leaking request-scoped identity artifacts into globally cached assets.

Blocks:Evaluating dynamic request context outside Suspense boundaries in Next.js 15 PPR routes
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler-interior-mutation-isolation
frontendcritical

React 19 Compiler Interior Mutation & Reactive Subgraph Isolation

Enforces absolute immutability of props, hook inputs, and shared state within components optimized by the React 19 Compiler (Forget). Prevents silent rendering desynchronization, broken reactive memoization scopes, and memory leaks caused when downstream interior mutations escape compiler tracking boundaries or taint upstream cached references.

Blocks:Mutating Shared Props or Intermediate Scoped Structures Breaking React 19 Auto-Memoization
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-vite-6-environme-493
frontendcritical

Vite 6 Multi-Runtime Environment API Module Graph Isolation Standard

Enforces strict module graph isolation across distinct execution targets (client, ssr, workerd/edge) using Vite 6's Environment API. Prevents cross-runtime symbol contamination, invalid module caching across disparate compilation contexts, and broken HMR state synchronizations during concurrent SSR and client dev cycles.

Blocks:Monolithic Module Graph Leaks and Deprecated ssrLoadModule Traversal in Heterogeneous Runtimes
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-reconciliation-react-19-server--668
frontendcritical

Deterministic Optimistic Reconciliation and Race-Condition Prevention in React 19 Server Actions

Enforces strict atomicity and deterministic rollback guarantees during concurrent React 19 Server Action dispatches via `useActionState` and `useOptimistic`. Prevents UI tearing, stale server payloads overwriting in-flight optimistic layers, and state desynchronization without relying on external global stores.

Blocks:Unbounded Optimistic UI Tearing and Desynchronized Rollbacks via Naked Server Action Mutations
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-universal-runes-micro-frontend-reactive-boundary
frontendcritical

Svelte 5 Universal Runes Cross-MFE Fine-Grained Reactive Boundary Protocol

Enforces fine-grained signal reactivity boundaries across micro-frontend (MFE) integrations using Svelte 5 universal runes (.svelte.ts). Prohibits coarse-grained serialized state snapshot exchange across custom element boundaries that trigger redundant Virtual DOM reconciliation passes and destroy granular signal tracking.

Blocks:Monolithic State Snapshot Bridging Inducing Host Virtual DOM Reconciliation Cascades
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-taint-boundary-enforcement
frontendcritical

React 19 RSC Taint Boundary Enforcement for Secrets and Sensitive Domain Entities

Enforces strict runtime serialization barriers across the React Server Component (RSC) boundary using React 19's taint APIs to prevent credentials, secrets, and raw database entities from crossing into Client Components. Mandates immediate tainting of sensitive values and object references at the data-access layer alongside explicit Data Transfer Object (DTO) projections. Eliminates accidental exposure through prop spreading, implicit serialization, or Server Action returns.

Blocks:Passing Untainted Raw Database Entities or Server Secrets Directly to Client Component Props
Targets:Cursor•Claude•Windsurf•Codex
react19-useactionstate-transactional-ordering
frontendcritical

React 19 useActionState Transactional Mutation Ordering & Rollback Guardrail

Enforces strict monotonic sequence numbering, idempotent mutation tickets, and exact rollback invariants across concurrent React 19 useActionState and useOptimistic transitions. Prevents out-of-order race conditions from clobbering fresher client-side states when parallel server actions resolve unpredictably.

Blocks:Unsequenced concurrent server action resolutions clobbering optimistic states with stale remote snapshots
Targets:Cursor•Claude•Windsurf•Codex
nextjs-ppr-static-shell-isolation-guardrail
frontendcritical

Next.js 15 PPR Static Shell Isolation & Dynamic Boundary Guardrail

Enforces strict encapsulation of dynamic runtime primitives (cookies(), headers(), searchParams) within dedicated React Suspense boundaries when targeting Next.js 15 Partial Prerendering (PPR). Guarantees that root layouts and marketing chrome are compiled to immutable static HTML at the edge, eliminating runtime cache de-optimization and route-level dynamic bailout.

Blocks:Unbounded Dynamic I/O Hoisting Causing Premature PPR Bailout and Edge De-optimization
Targets:Cursor•Claude•Windsurf•Codex
web-locks-client-state-sync-standard
frontendcritical

Web Locks API State Synchronization and Concurrency Control Guardrail

Enforces deterministic cross-tab synchronization and prevents IndexedDB write-skew anomalies during high-frequency optimistic state mutations and queue drains. Mandates atomic, scoped synchronization via the native Web Locks API (`navigator.locks.request`) paired with cross-context invalidation signals across concurrent browsing contexts (tabs, dedicated workers, and service workers).

Blocks:Unsynchronized Read-Modify-Write Cycles and Optimistic Queue Drains Across Concurrent Tabs Causing IndexedDB Write-Skew and State Regression
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-hole-containment
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Hole Boundary Isolation

Enforces strict React Suspense encapsulation and dynamic context isolation for Next.js 15 Partial Prerendering (PPR) routes. Prevents dynamic APIs (cookies, headers, uncached fetches) from escaping leaf boundaries and deoptimizing the pre-rendered static shell into blocking dynamic server rendering.

Blocks:Uncontained Dynamic API Access Deoptimizing Static PPR Shells into Blocking SSR
Targets:Cursor•Claude•Windsurf•Codex
react-19-activity-offscreen-state-isolation
frontendcritical

React 19 Activity (Offscreen) Subtree & Layout Suspension Isolation

Enforces strict isolation of deferred component subtrees encapsulated within React 19 Activity boundaries. Prevents layout thrashing, desynchronized UI hydration, and torn concurrent state reads by disallowing synchronous DOM layout measurements and direct global store writes while the subtree is deferred or hidden.

Blocks:Executing Synchronous DOM Measurements and Global Store Mutations Inside Inactive React 19 Activity Subtrees
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-key-guardrail
frontendcritical

React 19 Server Action Idempotency Key Guardrail

Enforces deterministic deduplication of state mutations across React 19 Server Actions interacting with optimistic UI transitions. Unmanaged optimistic rollbacks and automatic form resubmissions cause duplicate side-effects (e.g., double billing, duplicate records) across asynchronous network boundaries. All mutating Server Actions MUST require and validate client-generated UUIDv7 or cryptographic idempotency keys cached in a distributed transactional store.

Blocks:Executing non-idempotent Server Actions inside useActionState or useOptimistic without persistent transaction keys
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-dual-runtime-boundary
frontendcritical

Vite 6 Environment API Dual-Runtime Isolation Guardrail

Enforces strict isolation between Workerd (Edge) and Node.js environments during full-stack SSR compilation using Vite 6's Environment API. Prevents leaking Node.js built-ins, process state, and host-specific globals into edge isolates while guaranteeing deterministic module resolution boundaries.

Blocks:Leaking Node.js runtime primitives and ambient process state into Workerd edge SSR execution contexts.
Targets:Cursor•Claude•Windsurf•Codex
webgpu-pipeline-compilation-memory-budgeting
frontendcritical

WebGPU Asynchronous Pipeline Pre-warming and Deterministic VRAM Budgeting

Enforces non-blocking WebGPU initialization and deterministic resource allocation to prevent runtime frame drops and browser GPU process termination. Mandates explicit asynchronous pipeline pre-compilation via createRenderPipelineAsync/createComputePipelineAsync and strict VRAM accounting with deterministic buffer and texture lifecycle disposal.

Blocks:Synchronous Pipeline Creation in Render Paths and Unbudgeted VRAM Allocation Leading to Tab Crashes
Targets:Cursor•Claude•Windsurf•Codex
angular-19-zoneless-signal-graph-reactive-consistency-boundary
frontendcritical

Angular 19 Zoneless Signal-Graph Reactive Consistency Boundary

Enforces an acyclic, glitch-free signal derivation graph in Angular 19 zoneless runtimes. Eliminates diamond-dependency inconsistencies, circular microtask queuing, and SSR hydration mismatches by banning signal-writing side-effects in favor of pure derivations and linked signals.

Blocks:Mutating writable signals inside effects to synchronize state, inducing diamond-dependency microtask tearing and broken hydration.
Targets:Cursor•Claude•Windsurf•Codex
react19-use-action-state-transition-coalescing-invariant
frontendcritical

React 19 useActionState Concurrent Transition Queue Coalescing Invariant

Enforces strict deterministic sequential resolution of overlapping concurrent transitions triggered by rapid user actions in React 19. Prevents UI tearing, optimistic state corruption, and race conditions by ensuring asynchronous action handlers consumed by useActionState never bypass React's internal fiber transition queue with uncoordinated external mutable state or unsynchronized ref access.

Blocks:Bypassing React 19 Fiber Transition Queueing with Unsynchronized Refs or Non-Transitioned Async Mutators
Targets:Cursor•Claude•Windsurf•Codex
react19-rsc-taint-boundary-guardrail
frontendcritical

React 19 Server Component Cryptographic & Credential Taint Boundary Invariants

Enforces strict cryptographic and identity isolation by utilizing React 19's experimental taint APIs alongside server-only boundary declarations. Prevents accidental serialization of raw user records, API keys, and sensitive tokens across the React Server Components (RSC) Flight protocol payload boundary to client components. Mandates explicit data projection patterns to sanitize all payloads traversing the server-client boundary.

Blocks:Leaking Sensitive Entity Objects and Tokens Across RSC Serialization Boundaries Without Taint Traps
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-runtime-leakage-fence
frontendcritical

Vite 6 Environment API Cross-Runtime Module Graph Isolation & Secret Fence

Enforces strict isolation between Vite 6 client, edge, and SSR runtime module graphs using the Environment API. Prevents server-only credentials, platform bindings, and unpolyfilled Node.js built-ins from traversing the module boundary into client-facing bundles.

Blocks:Unfenced Module Sharing Between SSR/Edge and Client Graphs Leading to Token Exfiltration and Runtime Failures
Targets:Cursor•Claude•Windsurf•Codex
vite6-multiruntime-environment-boundary-isolation
frontendcritical

Vite 6 Environment API: Strict Multi-Runtime Module Boundary Isolation

Enforces strict runtime module isolation using Vite 6 Environment API across Client, Node.js, and Workerd compilation targets. Eliminates server-side secret exposure, platform-specific polyfill contamination, and native runtime module leakage into browser asset graphs through dedicated environment pipelines and conditional resolution.

Blocks:Monolithic Multi-Target Vite Configurations Leaking Server Secrets and Node Runtimes into Browser Bundles
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-reconciliation
frontendcritical

Deterministic Optimistic State Reconciliation and Rollback Invariant

Enforces deterministic reconciliation and transactional rollback of client optimistic states during aborted, timed-out, or failed React 19 Server Actions. Eliminates state tearing, uncoordinated multi-state resets, and cascading layout thrashing by mandating idiomatic use of useOptimistic alongside useActionState within transition boundaries.

Blocks:Ad-Hoc Imperative Optimistic State Management with Manual Rollbacks Triggering Layout Thrashing
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-effect-teardown-guardrail
frontendcritical

Svelte 5 Runes Microtask & Async $effect Lifecycle Teardown Guardrail

Enforces strict synchronous cleanup return contracts and AbortController cancellation patterns within Svelte 5 $effect runes. Prevents detached DOM tree leaks, race conditions, and orphaned microtasks in long-lived single-page dashboards.

Blocks:Passing Async Functions to $effect or Omitting Microtask Abort Mechanisms Leading to Leaked Closures
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-components-secret-taint-invariant
frontendcritical

React 19 Server Components Secret Taint Invariant

Enforces server-side cryptographic and PII memory tainting using React 19's experimental_taintUniqueValue and experimental_taintObjectReference APIs. Guarantees that sensitive environment secrets, credentials, and raw PII records are structurally barred from serializing across the React Server Components (RSC) client-server network boundary.

Blocks:Passing Un-tainted Raw Database Records or API Credentials Through Server Components to Client Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-cross-runtime-sandbox-invariant
frontendcritical

Vite 6 Environment API Cross-Runtime Sandbox Invariant

Enforces strict execution boundaries across heterogeneous runtimes (Browser, Node.js SSR, and Edge/Workerd) managed by the Vite 6 Environment API. Prohibits ambient global state pollution, cross-runtime module graph leakage, and legacy non-scoped SSR hooks during build and HMR cycles. Guarantees deterministic module evaluation across concurrently active DevEnvironment instances.

Blocks:Ambient Global Mutation and Cross-Environment Module Graph Coupling in Multi-Runtime Vite Applications
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-shell-isolation-invariant
frontendcritical

Next.js 15 PPR Streaming Shell & Dynamic Context Isolation Invariant

Enforces strict structural boundaries between static CDN-cacheable shells and dynamic user-context suspense holes under Next.js 15 Partial Prerendering (PPR). Prevents dynamic request APIs (cookies, headers, authentication session tokens) from bubbling up to the static prerender phase, eliminating edge cache poisoning and authentication context leaks.

Blocks:Accessing Dynamic Request APIs Outside Suspense Boundaries in PPR Routes
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-rollback
frontendcritical

React 19 Server Action Idempotency and Atomic Optimistic Rollback Standard

Enforces strict end-to-end idempotency semantics and atomic client-side state reconciliation for React 19 Server Actions. Guarantees that concurrent dispatches and network partitions neither execute duplicate backend mutations nor leave optimistic client UI in an unrecoverable, desynchronized state.

Blocks:Non-idempotent Server Actions dispatched across concurrent transitions with decoupled, unrolled optimistic state
Targets:Cursor•Claude•Windsurf•Codex
svelte5-mfe-signal-lifecycle-boundary-guardrail
frontendcritical

Svelte 5 Micro-Frontend Signal Lifecycle Boundary & Root Teardown Invariant

Enforces strict signal boundaries and deterministic teardown contracts for federated Svelte 5 micro-frontends. Prevents cross-boundary reactivity leakage and orphaned reactive subscriptions by mandating $effect.root isolation and explicit unmount execution during micro-frontend detachment.

Blocks:Leaking Svelte 5 Module-Level Runes and Untracked Signal Graphs Across Federated Host Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-unwrapping
frontendcritical

Next.js 15 Async Request Context Unwrapping and Request-Scope Isolation

Next.js 15 converts dynamic server APIs (cookies, headers, params, and searchParams) into asynchronous promises to optimize edge rendering and Partial Prerendering (PPR). Accessing these APIs synchronously or leaking request context into module-scoped variables causes cross-request data contamination and race conditions in concurrent runtimes.

Blocks:Synchronous Access to Dynamic APIs and Module-Level Request Context Leaks
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-search-schema-ssr-guardrail
frontendcritical

Deterministic Search Param Validation & SSR Hydration Boundaries in TanStack Router v1

Mandates explicit runtime schema validation with bidirectional coercion (via Zod or Valibot) for all TanStack Router v1 route search parameters. Guarantees deterministic server-side serialization and client-side hydration by requiring fallback boundaries and `.catch()` defaults to prevent React SSR hydration mismatches and unhandled route crashes from malformed query strings.

Blocks:Uncoerced, Non-Resilient Search Param Schemas Triggering SSR Hydration Mismatches and Route Deserialization Crashes
Targets:Cursor•Claude•Windsurf•Codex
webgpu-compute-workgroup-barrier-memory-coherency
frontendcritical

WebGPU Workgroup Barrier Synchronization and Memory Layout Invariant

Mandates explicit workgroup barrier synchronization and strict memory layout alignments (16-byte struct alignment and 256-byte dynamic offset boundaries) in WebGPU compute pipelines. Prevents GPU race conditions, torn reads, and device loss during high-frequency client-side neural network tensor operations. Enforces deterministic coherency between cooperative thread loads into workgroup shared memory and subsequent compute passes.

Blocks:Missing workgroupBarrier() and unpadded WGSL uniform structs causing GPU race conditions and silent output corruption
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-streaming-loader-context-isolation-guardrail
frontendcritical

TanStack Start Streaming Loader Request-Scoped Context Isolation

Enforces strict request-scoped context isolation during TanStack Start deferred SSR streaming. Prevents cross-tenant state pollution, leaked server-side caches, and async context interleaving when resolving deferred loader promises across concurrent HTTP chunks.

Blocks:Module-Level Shared State and Unscoped Singletons in Deferred Streaming Loaders
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-dynamic-boundary-guardrail
frontendcritical

Deterministic Separation of Static Shell and Dynamic Streaming in Next.js 15 PPR

Enforces strict structural isolation between pre-rendered static edge shells and runtime dynamic streaming promises in Next.js 15 Partial Prerendering (PPR). Dynamic runtime evaluations—such as reading request headers, cookies, or calling un-cached auth APIs—must be encapsulated strictly within React Suspense boundaries to prevent dynamic user credentials from leaking into globally cached CDN pre-renders or causing runtime de-opts.

Blocks:Dynamic Request Introspection Executing Outside Explicit Suspense Boundaries in PPR Shells
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-state-optimistic-reconciliation
frontendcritical

React 19 Action State Optimistic Reconciliation and Rollback Barrier

Mandates monotonic transaction sequencing and immutable rollback barriers when pairing React 19 useActionState with useOptimistic. Prevents state corruption, ghost rollbacks, and out-of-order resolution artifacts during concurrent asynchronous server mutations.

Blocks:Unsequenced optimistic mutations and ad-hoc state rollbacks causing race-condition clobbering and state tearing.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-preload-quota-guardrail
frontendcritical

TanStack Router Dynamic Preload Rate & Memory Budget Guardrail

Enforces adaptive, connection-aware, and LRU-capped route preloading within TanStack Router applications. Prevents browser main-thread jank, client-side memory blowup, and mobile cellular data exhaustion by wrapping default route preloading hooks with Save-Data awareness, concurrency throttling, and type-safe cache eviction budgets.

Blocks:Unbounded Link Preloading Under High Route Tree Complexity Leading to Network Thrashing and Out-of-Memory Crashes
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-reactive-graph-cycle-derived-mutation
frontendcritical

Svelte 5 Reactive Graph Cycle & Derived Mutation Guardrail

Enforces strict mathematical purity in Svelte 5 reactive derivations and prevents cyclic dependency graphs. Prohibits state mutation side effects inside `$derived` and `$derived.by` blocks while mandating termination bounds and untracked reads in `$effect` synchronizations.

Blocks:Mutating $state Inside $derived Blocks or Creating Unbounded $effect Feedback Loops
Targets:Cursor•Claude•Windsurf•Codex
module-federation-2-strict-singleton-reconciliation-barrier
frontendcritical

Strict Singleton Version Reconciliation and Split-Brain Prevention Barrier in Module Federation 2.0

Enforces strict singleton version reconciliation, explicit shared scope initialization barriers, and fail-fast failover strategies across Module Federation 2.0 micro-frontends. Prevents split-brain state mutations, duplicate event bus instances, and runtime React/Zustand context degradation caused by loose semver fallbacks or uncoordinated remotes. Mandates runtime assertions and deterministic host-driven container registration.

Blocks:Uncoordinated Eager Imports and Loose Semver Sharing Permitting Multi-Instance Context Partitioning
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-optimistic-rollback-isolation
frontendcritical

React 19 useActionState Deterministic Optimistic Rollback & Transition Isolation

Enforces strict pairing of React 19 useActionState with useOptimistic to guarantee deterministic rollback semantics and eliminate state tearing under concurrent network partitions. Prohibits ad-hoc useState dual-bookkeeping for optimistic UI and requires monotonic sequence validation to prevent stale server responses from overwriting newer local state.

Blocks:Manual useState Dual-Bookkeeping and Uncoordinated useActionState Inducing State Tearing on Action Failure
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-vite-6-environme-825
frontendcritical

Vite 6 Environment API Multi-Runtime Module Execution Boundary

Enforces strict isolation between client, worker/edge (e.g., Workerd), and Node.js execution runtimes when configuring Vite 6 multi-environment pipelines. Prevents cross-environment module graph leakage, improper resolve condition inheritance, and runtime host crash hazards caused by calling legacy SSR APIs in multi-target architectures.

Blocks:Leaking Node.js Built-ins and Shared Module Graphs into Edge Runtimes via Legacy Vite SSR APIs
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-taint-boundary
frontendcritical

React 19 Server Taint API Object-Reference Boundary Enforcement

Enforces strict secret and credential boundary encapsulation across the React Server Component (RSC) serialization perimeter using React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs. Prevents inadvertent transmission of cryptographic keys, access tokens, and sensitive infrastructure config payloads across the wire to Client Component trees through runtime and build-time serialization assertions.

Blocks:Exposing Raw Server-Side Secret Contexts or Unsanitized User-Profile Records Directly to Client Component Trees
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-worker-runtime-isolation
frontendcritical

Vite 6 Environment API Worker-Runtime Context Isolation Standard

Enforces strict runtime module isolation and global scope compartmentalization between client, Node SSR, and Edge/Worker execution environments using Vite 6's Environment API. Prevents cross-environment prototype pollution, global scope bleed, and single-module-graph invalidation bugs during unified full-stack HMR and production bundling passes.

Blocks:Global Scope Bleed and Shared Module Graph Pollution Across Heterogeneous Runtimes
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-effect-root-scope-teardown-invariant
frontendcritical

Svelte 5 Runes $effect.root Dynamic Scope Teardown Invariant

Dynamic reactive computations spawned outside a component's lifecycle via $effect.root must register explicit teardown callbacks and expose an idempotent disposal contract. Failing to invoke cleanup functions returned by $effect.root creates orphaned reactive nodes that persist inside the runtime signal graph, leading to unbound memory leaks and duplicate micro-task executions in long-running SPAs.

Blocks:Unbounded Reactive Root Instantiation Without Idempotent Lifecycle Cleanup
Targets:Cursor•Claude•Windsurf•Codex
react-19-actions-optimistic-rollback
frontendcritical

React 19 Concurrent Action Lifecycle & Optimistic State Rollback Invariants

Enforces deterministic transactional boundaries between client-side optimistic UI state and server actions in React 19. Prevents split-brain state desynchronization by strictly coupling useOptimistic updates to useActionState action dispatch lifecycles, ensuring automatic atomic rollback during transient mutation failures.

Blocks:Manual State Reversion and Ad-Hoc Promise Catching Bypassing React 19 Transactional Action Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-async-reactive-graph-isolation
frontendcritical

Svelte 5 Runes Async Reactive Graph Lifecycle Isolation in Hybrid SSR Hydration

Mandates strict boundary isolation for asynchronous microfrontend state transitions within Svelte 5's signal-based rune reactivity graph. Precludes unbounded circular dependency loops, untracked cross-boundary signal subscriptions, and SSR hydration memory leaks by requiring explicit teardown signals and decoupled async state boundaries.

Blocks:Unbounded Cross-Boundary Reactive Loops via Implicit Untracked Async Rune Subscription During Hydration
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-taint-object-api-guardrail
frontendcritical

Next.js 15 Taint Object API Data-Boundary Leakage Guardrail

Enforces deterministic data-boundary isolation using React and Next.js 15 Taint APIs (`experimental_taintObjectReference` and `experimental_taintUniqueValue`) across all Data Access Layers (DAL). Programmatically prevents raw ORM entities, cryptographic secrets, and internal identifiers from crossing the Server Component serialization barrier into client RSC Flight payloads.

Blocks:Passing Raw Database Records or Cryptographic Secrets across Server-Client Component Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-optimistic-action-reconciliation-standard
frontendcritical

React 19 Action-Driven Optimistic UI Rollback & Monotonic State Reconciliation

Guarantees deterministic state reconciliation and eliminates orphaned visual mutations when concurrent optimistic updates resolve out-of-order over lossy networks. Enforces React 19 native action boundaries, useOptimistic immutability, and monotonic sequence tracking to eliminate race-induced UI corruption.

Blocks:Imperative State Rollbacks and Unversioned Optimistic Mutations in React 19 Transitions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-use-cache-salt-tenant-isolation
frontendcritical

Next.js 15 'use cache' Salt-Isolated Multi-Tenant Keying and Tagging

Next.js 15's 'use cache' directive evaluates functions in isolated boundaries without ambient request cookies or session headers. Multi-tenant data functions must explicitly accept cryptographically salted and verified tenant identifiers in function arguments and tag calls with HMAC-derived tenant prefixes to prevent catastrophic cross-tenant cache poisoning and leakage.

Blocks:Unsalted Tenant IDs or Ambient Session Assumptions in Next.js 15 'use cache' Scopes
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-ast-worker-isolation
frontendcritical

Vite 6 Rolldown AST Multi-Thread Worker Isolation and Serialization

Enforces strict thread-local AST serialization and immutable data boundaries across Rolldown parallel Rust worker threads in Vite 6 enterprise monorepos. Prevents V8 heap fragmentation, N-API deadlocks, and cross-thread memory churn by forbidding shared mutable JS AST representations across worker pools during parallel transform passes. Mandates zero-copy binary buffers or structured cloning for thread boundaries.

Blocks:Cross-Thread Shared AST References and Mutable Global Module Graph Leaks
Targets:Cursor•Claude•Windsurf•Codex
react19-concurrent-action-optimistic-rollback-invariant
frontendcritical

React 19 Concurrent useActionState Monotonic Optimistic Rollback Invariant

Enforces strict monotonic sequencing and transactional consistency between React 19 useActionState and useOptimistic hooks. Prevents UI state tearing and stale rollback cascades caused by out-of-order execution and resolution of concurrent Server Actions across optimistic component subtrees.

Blocks:Unsequenced useOptimistic updates torn by out-of-order useActionState server action rejections
Targets:Cursor•Claude•Windsurf•Codex
vite6-ssr-environment-runtime-isolation
frontendcritical

Vite 6 Environment API Multi-Runtime SSR Isolation & Memory Leak Prevention

Enforces strict heap separation and lifecycle boundary governance across Vite 6 DevEnvironment instances (e.g., Node.js and Edge/workerd runtimes). Guarantees that concurrent SSR module evaluations, HMR invalidations, and singleton states do not cross-contaminate or leak heap memory across runtime compilation contexts.

Blocks:Cross-Runtime Global Mutation and Uncollected ModuleRunner Closures in Multi-Environment SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-state-raw-high-frequency-telemetry
frontendcritical

Svelte 5 $state.raw Proxy Bypass for High-Frequency Telemetry Invariant

Enforces shallow reactivity via $state.raw for streaming telemetry, WebSockets, WebRTC streams, and high-throughput real-time dashboards in Svelte 5. Bypasses recursive reactive proxy allocation on dense arrays and nested objects to eliminate GC thrashing and microtask queue saturation. Guarantees 60fps rendering budgets by treating streaming updates as atomic buffer replacements or coupled with animation-frame throttling.

Blocks:Deep Reactive Proxy Trapping of High-Throughput Streaming Datasets Causing GC Stalls and Frame Dropping
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-quarantine
frontendcritical

Next.js 15 Async Request Context Quarantine Standard

Enforces strict isolation boundaries between dynamic async request APIs (headers, cookies) and prerenderable layout segments in Next.js 15. Prevents dynamic bailout cascade and edge-cache poisoning where dynamic customer identity leaks into shared static edge caches.

Blocks:Awaiting Dynamic Request Headers or Cookies in Root/Shared Layouts Causing Cache De-opt or Identity Poisoning
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-signal-graph-cycle-isolation
frontendcritical

Svelte 5 Runes Signal Graph Cycle Isolation & Teardown Invariant

Enforces strict unidirectional data flow and deterministic cleanup within Svelte 5 runes ($state, $derived, $effect, and untrack) across long-running enterprise dashboards. Prohibits state mutations inside reactive contexts that read the same signal graph, preventing cyclic dependency cascades and unbounded microtask queue exhaustion.

Blocks:Bi-directional State Mutation and Missing Teardown in Svelte 5 Runes Triggering Microtask Death-Spirals
Targets:Cursor•Claude•Windsurf•Codex
view-transitions-l2-cross-document-guardrail
frontendcritical

View Transitions API Level 2 Cross-Document Coordination & Containment Standard

Enforces strict pseudo-element allocation budgets, explicit viewport containment, and declarative lifecycle coordination across cross-document (MPA) navigations. Prevents GPU memory saturation, compositing thrashing, and sub-16ms frame drops caused by unbounded view-transition-name registration and unconstrained off-screen texture snapshots.

Blocks:Unbounded Pseudo-Element Allocation and Uncontained Full-Document Snapshots Inducing Compositor Stalls During Cross-Document Navigation
Targets:Cursor•Claude•Windsurf•Codex
react-19-taint-api-memory-isolation-standard
frontendcritical

React 19 Taint API & Server Component Memory Isolation Standard

Enforces strict boundaries around cryptographic secrets, raw database entity models, and sensitive environment variables to prevent accidental serialization into React Server Component (RSC) Flight payload streams. Mandates the use of experimental_taintObjectReference and experimental_taintUniqueValue alongside Data Transfer Object (DTO) projection patterns at all boundary seams.

Blocks:Leaking Raw Database Records or Cryptographic Secrets into Client Component Props and RSC Flight Streams
Targets:Cursor•Claude•Windsurf•Codex
vite-6-rolldown-environment-api-boundary-invariant
frontendcritical

Vite 6 Rolldown Environment API Isomorphic Boundary Invariant

Mandates absolute runtime module isolation across Vite 6 Environment API compilation units (Client, SSR, Edge/Workerd, WebWorker) to prevent cross-runtime module graph pollution. Prohibits heuristic runtime environment branch sniffing in shared bundles and enforces strict Rolldown build-time condition mapping and chunk graph separation.

Blocks:Ambient Runtime Guards and Monolithic Chunks Polluting Vite 6 Multi-Environment Graphs
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-components-taint-api-boundary
frontendcritical

React 19 Server Components Experimental Taint API Boundary Enforcement

Enforces strict runtime serialization boundaries using React 19's experimental taint APIs (experimental_taintObjectReference and experimental_taintUniqueValue) alongside 'server-only' package barriers. Prevents accidental leakage of cryptographic secrets, tokens, PII, and full database entity models into React Server Component (RSC) Flight streams transmitted to the client.

Blocks:Leaking Raw Server Secrets or Hydrated Database Entities Directly into Client Flight Payloads
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-cross-request-leak-prevention
frontendcritical

Svelte 5 Runes Cross-Request SSR Scope Isolation Standard

Enforces strict request-level boundary isolation for Svelte 5 runes ($state, $derived) during Server-Side Rendering (SSR) and asynchronous streaming. Prohibits module-level reactive rune singletons that persist in Node/worker process memory across concurrent HTTP requests, preventing cross-user data contamination and race conditions.

Blocks:Module-Level Rune State Instantiation in SSR Contexts Leaking Cross-Request Data
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-io-boundary-quarantine
frontendcritical

Next.js 15 PPR Dynamic IO Boundary Quarantine Invariant

Enforces strict isolation of dynamic asynchronous operations, headers, cookies, and un-cached fetch calls within dedicated React Suspense boundaries under Next.js 15 Partial Prerendering (PPR) and experimental dynamicIO. Guarantees that dynamic runtime data fetching never de-optimizes the enclosing static layout shell into dynamic-render mode or causes unhandled microtask rejections during static export passes.

Blocks:Leaking dynamic I/O across un-quarantined React Server Component boundaries, de-optimizing the PPR static shell to dynamic runtime rendering.
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-suspense-deadlock-mitigation
frontendcritical

React 19 RSC Suspense Deadlock Mitigation & Bounded Streaming Invariants

Enforces strict deadline-driven AbortSignal timeouts and deterministic boundary fallbacks on all asynchronous React Server Components (RSC). Prevents unresolved server-side promises from stalling edge chunked transfer streams and exhausting HTTP/3 QUIC connection pools.

Blocks:Unbounded Async RSC Evaluation Inducing Edge Stream Stalls and Connection Exhaustion
Targets:Cursor•Claude•Windsurf•Codex
webgpu-device-loss-recovery-buffer-reclamation
frontendcritical

WebGPU Device Loss Recovery and Idempotent VRAM Buffer Reclamation Standard

Mandates asynchronous WebGPU context restoration and idempotent VRAM buffer staging pipelines to guarantee UI resilience against OS-level compositor drops, GPU driver resets (TDR), and system sleep/wake cycles. Enforces complete resource tracking and explicit buffer destruction to prevent GPU memory leaks and client runtime crashes.

Blocks:Monolithic GPU Resource Initialization Assuming Indestructible GPUDevice Lifetimes Without Loss Recovery Or Explicit Reclamation
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-context-isolation
frontendcritical

Svelte 5 Runes SSR Reactive Context Isolation Standard

Enforces strict isolation of Svelte 5 runes ($state, $derived) and signal graphs to component subtrees and request boundaries during Server-Side Rendering (SSR). Prohibits module-level reactive singletons in shared modules to prevent cross-tenant state leaks and uncollected signal nodes across concurrent HTTP requests.

Blocks:Module-Scope $state Singletons Causing Cross-Request Data Leaks in SSR
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-secret-guardrail
frontendcritical

Vite 6 Environment API Dual-Target Compilation Secret Guardrail

Enforces strict module graph boundary validation across Vite 6 environments (client, ssr, workerd) using the Environment API. Prevents private server credentials, database connections, and server-only modules from bridging into client and edge workerd compilation targets during multi-environment builds.

Blocks:Cross-environment leakage of server secrets into client bundle via unpartitioned Vite 6 Environment module graphs
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-context-teardown-guardrail
frontendcritical

Svelte 5 Snippet Context Scoping and Effect Teardown Guardrail

Enforces deterministic reactive signal disposal and DOM lifecycle isolation when Svelte 5 snippets cross asynchronous, deferred, or portal boundaries. Prevents uncollected fine-grained reactive subscriptions, detached DOM nodes, and memory leaks caused by snippets capturing parent reactive scopes that outlive rendering contexts.

Blocks:Escaping Snippet Closures to Asynchronous Registries Without Controlled Reactive Ownership Roots
Targets:Cursor•Claude•Windsurf•Codex
react19-server-actions-idempotency-key-quarantine
frontendcritical

React 19 Server Actions Idempotency Key & Replay Quarantine Guardrail

Enforces mandatory cryptographic client-generated idempotency tokens and atomic server-side mutation deduplication across React 19 Server Actions. Guarantees that network retries, optimistic re-triggers, and flaky transport reconciliations execute mutations exactly once while returning cached determinism for replayed requests. Quarantines concurrent re-entrancy and prevents phantom duplicate resource creation in distributed backends.

Blocks:Executing naked non-idempotent React 19 Server Actions without cryptographic mutation keys, risking duplicate side effects during transport retry storms
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-untrack-guardrail
frontendcritical

Svelte 5 Runes Asynchronous Effect Isolation and Untrack Guardrail

Enforces strict isolation of fine-grained reactive signals within asynchronous Svelte 5 runes ($effect, $derived). Mandates untrack() for non-triggering dependencies and requires AbortController cancellation patterns to permanently eliminate post-microtask race conditions and cyclic dependency loops.

Blocks:Unquarantined Asynchronous State Mutation and Post-Await Signal Leaks in Svelte 5 Runes
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-module-isolation-standard
frontendcritical

Vite 6 Environment API Multi-Runtime Module Isolation Invariant

Enforces complete memory, module graph, and execution isolation across compilation targets (client, edge/workerd, node) via the Vite 6 Environment API. Prevents cross-runtime prototype pollution, server secret leakage into client bundles, and broken transform caches caused by shared plugin state. Deprecates legacy monolithic SSR primitives in favor of per-environment module runners and isolated graph invalidation.

Blocks:Leaking Shared Plugin State and Cross-Executing Code Across Vite Runtime Environments
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-signal-diamond-settling-standard
frontendcritical

Svelte 5 Fine-Grained Signal Topological Diamond Dependency Settling Standard

Enforces synchronous topological graph evaluation across Svelte 5 runes ($state, $derived, $effect) to eliminate diamond dependency glitches and torn reads. Prohibits breaking the reactive directed acyclic graph (DAG) via side-effect-driven state mutations and asynchronous signal propagation.

Blocks:Mutating $state inside $effect to bridge derived branches, introducing diamond torn reads and cascading microtask churn
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-boundary-standard
frontendcritical

Next.js 15 Dynamic I/O Async Request Context Boundary Standard

Enforces strict structural isolation between prerendered layout/component trees and Next.js 15 asynchronous dynamic request primitives (cookies, headers, dynamic route params, searchParams). Prevents dynamic de-opt waterfalls, cross-request cache pollution, and build-time dynamic server usage exceptions under the Dynamic I/O compiler.

Blocks:Top-Level Awaiting of Dynamic Primitives Poisoning Prerender Trees and De-opting Static Layout Shells
Targets:Cursor•Claude•Windsurf•Codex
react19-use-action-state-optimistic-vector-rollback
frontendcritical

React 19 useActionState and useOptimistic Deterministic Vector Rollback Standard

Enforces strict monotonic state vector pairing between React 19's useActionState and useOptimistic primitives. Guarantees deterministic state reconciliation and prevents DOM visual desynchronization or UI tearing when asynchronous Server Actions reject, time out, or abort mid-flight. Mandates immutable payload tracking and explicit error channel propagation rather than silent unhandled optimistic drift.

Blocks:Dangling optimistic state accumulation and UI visual tearing on Server Action rejection
Targets:Cursor•Claude•Windsurf•Codex
react19-use-action-state-mutation-serialization
frontendcritical

React 19 useActionState Optimistic Mutation Serialization Guardrail

Enforces monotonic state versioning and optimistic rollback safety when utilizing React 19 useActionState alongside useOptimistic. Unordered asynchronous resolution of concurrent server actions leads to state tearing, phantom mutations, and desynchronized form state unless mutations carry serialized epoch identifiers and deterministic rebase mechanics.

Blocks:Concurrent useActionState Invocations Overwriting Newer Optimistic UI State via Out-of-Order Server Resolutions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-boundary-guardrail-production-standard
frontendcritical

Next.js 15 Partial Prerendering (PPR) Static-Dynamic Isolation Guardrail

Enforces strict isolation boundaries between pre-rendered static shells and dynamic asynchronous streaming holes under Next.js 15 Partial Prerendering. Prevents dynamic bailout cascade where accessing dynamic functions (cookies, headers, searchParams, uncached I/O) outside explicit Suspense boundaries de-optimizes static pre-renders into full SSR or triggers micro-hydration mismatches.

Blocks:Accessing Dynamic Contexts or Uncached I/O Outside Explicit Suspense Boundaries in PPR Routes
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-key-replay-barrier
frontendcritical

React 19 Server Action Idempotency Key and Replay Barrier Architecture

Enforces deterministic client-side generation of cryptographic idempotency keys coupled with atomic server-side mutation verification across React 19 Server Actions. Prevents duplicate state execution and race conditions during network retries, optimistic UI rollbacks, and rapid client-side transitions.

Blocks:Executing non-idempotent Server Actions without client-anchored replay barriers during concurrent transitions and network failures
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-runtime-isolation-boundary-standard
frontendcritical

Vite 6 Environment API Runtime Isolation and Prototype Boundary Guardrail

Enforces strict runtime boundary isolation when configuring multi-environment applications using Vite 6's Environment API and ModuleRunner. Prevents cross-target global scope pollution, host-level prototype mutation, and shared module cache contamination across heterogeneous SSR runtimes (Node.js, Edge/Workerd, Browser micro-frontends).

Blocks:Global Scope Mutation and Cross-Environment Prototype Contamination via Unisolated Vite 6 Module Runners
Targets:Cursor•Claude•Windsurf•Codex
react-19-actions-optimistic-state-rollback-invariants
frontendcritical

React 19 Actions and Optimistic State Rollback Invariants

Enforces strict transactional boundaries for React 19 optimistic mutations using useOptimistic and useActionState inside concurrent transitions. Eliminates silent data drift, UI tearing, and race conditions caused by manual ad-hoc rollback mechanisms.

Blocks:Imperative State Rollback via Ad-Hoc useState/useRef Bypassing React 19 Transition Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-root-memory-barrier
frontendcritical

Svelte 5 Runes: Explicit Cleanup Boundaries for Dynamic $effect.root Outside Component Tree

Enforces strict explicit cleanup boundaries and deterministic disposal contracts on dynamic $effect.root instances created outside standard component trees. Prevents signal dependency retention, orphaned subscriptions, and catastrophic heap exhaustion in long-lived SSR instances and detached stateful singletons.

Blocks:Orphaned $effect.root allocations in shared modules and SSR contexts without lifecycle-bound teardown handlers.
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-streaming-serialization-resiliency-standard
frontendcritical

React 19 Server Components Streaming Serialization Resiliency Standard

Enforces deterministic error handling and serialization boundaries across deep React Server Component (RSC) trees. Guarantees that unhandled promise rejections and non-serializable payload failures yield stable React Suspense/Error Boundary fallback chunks rather than terminating the HTTP chunked transfer-encoding stream mid-flight. Eliminates connection resets, malformed RSC payload wire states, and silent client-side hydration crashes in streaming environments.

Blocks:Streaming Unhandled Promise Rejections and Non-Serializable Types Across RSC Boundaries
Targets:Cursor•Claude•Windsurf•Codex
wasmgc-host-thread-memory-isolation-guardrail
frontendcritical

WebAssembly WasmGC Host-Thread Isolation and Cross-Heap Reference Bounds

Enforces strict process and thread boundaries between the browser UI thread and garbage-collected WebAssembly (WasmGC) runtimes. Mandates execution within dedicated Web Workers and forbids retaining strong bidirectional host-guest references that trigger cross-heap cycles, main-thread jank, and uncollectable memory leaks.

Blocks:Executing WasmGC modules synchronously on the UI thread while retaining circular JS-to-Wasm externref references
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-boundary-vite-6-environme-855
frontendcritical

Vite 6 Environment API Cross-Runtime Module Isolation Boundary

Mandates strict runtime module-resolution barriers between Edge, Node.js, and Browser execution graphs using Vite 6's Environment API. Eliminates Node built-in leakage, prevents isomorphic runtime pollution, and guarantees deterministic bundle isolation across heterogeneous target runtimes.

Blocks:Leaking Node.js Built-ins and Shared Module Graph Contamination via Imperfect SSR Separation
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-864
frontendcritical

Next.js 15 PPR Dynamic Hole Boundary Isolation & Static Shell Preservation

Enforces strict isolation of runtime dynamic I/O (cookies, headers, uncached data) inside localized React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Guarantees an immutable static document shell emitted at build time for sub-50ms edge TTFB while streaming dynamic holes concurrently without execution waterfalls.

Blocks:Dynamic API Hoisting De-optimizing Static Shells into Blocking Dynamic SSR
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-dynamic-sri-chaining
frontendcritical

Vite 6 Rolldown Cryptographic Dynamic ESM Chunk Integrity Chaining

Enforces strict SHA-384 Subresource Integrity (SRI) validation across all static entry points and asynchronously imported ESM chunks compiled by Vite 6 and Rolldown. Guarantees an unbroken cryptographic chain of trust from initial HTML bootstrapping through runtime dynamic imports to prevent CDN supply-chain tampering and cache poisoning.

Blocks:Unvalidated Dynamic ESM Imports Permitting Malicious CDN Script Replacement
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-components-taint-boundary-guardrail
frontendcritical

React 19 Server Components Taint Boundary and Secret Leakage Prevention

Enforces static and runtime serialization boundaries in React 19 Server Components using experimental_taintObjectReference and experimental_taintUniqueValue. Guarantees that server-only entities, database records, and environment secrets cannot be serialized across the React Server Components (RSC) payload boundary into Client Component trees.

Blocks:Leaking Raw Server Objects or Tokens Across the RSC-to-Client Serialization Boundary
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-after-lifecycle-quarantine
frontendcritical

Next.js 15 after() Async Execution Quarantine and Error Isolation

Ensures background tasks scheduled via Next.js 15's after() cannot cause uncaught exceptions, exceed serverless execution timeouts, or leak resources across requests. Mandates deterministic timeouts, error isolation boundaries, and decoupled telemetry sinks so that deferred post-response work never destabilizes runtime workers.

Blocks:Unbounded, Unhandled Async Execution in Next.js 15 after() Causing Server Worker Crashes and Zombie Runtimes
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-optimistic-rollback-boundary
frontendcritical

React 19 useActionState Optimistic Mutation Rollback Boundary

Enforces deterministic transactional client state reconciliation across concurrent React 19 async transitions. Mandates pairing useActionState with useOptimistic under atomic state boundaries to guarantee zero-drift rollback during network failures or server rejections.

Blocks:Mutating independent useState mirrors alongside useActionState transitions, leading to phantom optimistic UI and irreversible desynchronization on network failure.
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-async-derived-dependency-isolation-standard
frontendcritical

Svelte 5 Runes Async Dependency Isolation & Boundary Standard

Enforces strict synchronous dependency extraction boundaries when integrating asynchronous operations with Svelte 5 runes. Prevents reactive graph cycle contamination, untracked post-await signal mutations, and race-condition memory leaks by enforcing AbortController-guarded resource primitives.

Blocks:Post-Await Signal Dereferencing and Unbounded Async Execution in Rune Pipelines
Targets:Cursor•Claude•Windsurf•Codex
react19-server-cache-life-dynamic-tag-invalidation
frontendcritical

React 19 Server Cache-Life & Multi-Tenant Dynamic Tag Invalidation Invariant

Mandates cryptographically isolated, tenant-scoped dynamic cache tags and bounded cache-life profiles across React 19 Server Component caching boundaries. Eliminates multi-region edge cache desynchronization and prevents multi-tenant data bleed in distributed server environments.

Blocks:Unscoped Global Edge Caching and State Bleed via Ambient Server Component Cache Tags
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-hydration-graph-teardown
frontendcritical

Svelte 5 Runes Reactive Graph Isolation and SSR Teardown Standard

Enforces strict boundary encapsulation of Svelte 5 reactive signal graphs within component trees and explicit root scopes. Prohibits global module-scoped rune allocations and untracked dynamic subscriptions that lead to memory leaks in SSR worker threads and retained signal graphs post-hydration. Mandates explicit graph disposal via $effect.root cleanup functions and per-request context factories.

Blocks:Global Module-Level Runes and Unscoped Reactive Signal Graphs in Universal Code
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-flight-stream-taint-sanitization
frontendcritical

React 19 Server Components Flight Stream Taint-Checking and Boundary Sanitization

Enforces strict payload boundary sanitization and React 19 taint-checking primitives to prevent server-only data and credentials from leaking into the React Flight serialization stream. Requires all database records and secret tokens to be explicitly tainted upon acquisition and converted to explicit Data Transfer Objects (DTOs) before crossing RSC-to-Client component boundaries.

Blocks:Leaking Sensitive Server State and Unfiltered ORM Entities Directly into Client Flight Stream Payloads
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-memoization-isolation
frontendcritical

Next.js 15 Async Request Context & Request-Memoization Tenant Isolation

Enforces strict execution boundary isolation for Next.js 15 React Server Components (RSC) and React 19 request memoization. Prohibits floating unawaited microtasks, global mutable tenant storage, and un-isolated React.cache usage that corrupts AsyncLocalStorage context across concurrent streaming boundaries.

Blocks:Leaking Cross-Tenant Context via Detached Microtasks and Module-Level State in RSC Streaming
Targets:Cursor•Claude•Windsurf•Codex
vite6-mfe-sri-manifest-boundary-guardrail
frontendcritical

Vite 6 Federated Micro-Frontend Dynamic Subresource Integrity (SRI) Manifest Boundary

Enforces runtime cryptographic verification (SHA-384/SHA-512) for all dynamically resolved remote micro-frontend entry chunks and federated modules in Vite 6 architectures. Mandates immutable manifest-driven hash validation with strict cross-origin policies prior to script execution, coupled with sandboxed fallback boundaries to prevent remote code injection and CDN poisoning.

Blocks:Unvalidated Dynamic Script Injection and Bare Dynamic Imports of Remote Micro-Frontend Chunks
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-replay-guardrail
frontendcritical

React 19 Server Actions Idempotency-Key Replay and Distributed Rollback Guardrail

Mandates deterministic client-generated idempotency keys, network-partition retry buffers, and transactional optimistic state rollbacks across React 19 Server Actions. Guarantees that intermittent HTTP failures, duplicate submission races, and network reconnection replays never trigger duplicate mutations or stale phantom UI states in distributed environments.

Blocks:Naked Server Actions Without Client-Side Idempotency Tokens and Rollback Barriers
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-hole-cache-poisoning-guardrail
frontendcritical

Next.js 15 PPR Dynamic Hole Cache Poisoning Guardrail

Enforces strict boundary isolation between static shell generation and dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Prevents accidental evaluation and exposure of session identifiers, authorization tokens, or personalized tenant data inside statically prerendered shells and shared CDN edge caches.

Blocks:Leaking Personalized Tenant Context or Session Tokens into Prerendered Shell Fallbacks under Next.js 15 PPR
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-envelope
frontendcritical

Deterministic Optimistic Mutation Envelope for Concurrent Server Actions

Enforces monotonic sequence envelopes for React 19 optimistic updates and Server Action dispatches. Eliminates phantom UI rollbacks, state clobbering, and visual flickers caused by out-of-order resolution or rejection of concurrent asynchronous transitions.

Blocks:Unversioned Closure Snapshots and LIFO Rollback Collisions in Concurrent Server Actions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-boundary-guardrail
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Hole Boundary Isolation

Enforces strict isolation of dynamic runtime APIs (`cookies()`, `headers()`, `searchParams`, and un-cached data sources) inside dedicated React Suspense boundaries. Prevents unintended static shell de-optimizations where accessing dynamic functions at the route root converts the entire route into a dynamic runtime SSR request, negating PPR benefits.

Blocks:Accessing dynamic runtime APIs in top-level page components causing full static shell de-optimization
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-boundary-guard
frontendcritical

Next.js 15 PPR Dynamic Boundary & Static Shell Leak Guard

Enforces strict physical separation between statically prerendered edge shells and dynamically streamed SSR holes under Next.js 15 Partial Prerendering (PPR). Guarantees that request-bound dynamic APIs (cookies, headers, searchParams) and authenticated user state are encapsulated strictly within React Suspense boundaries, preventing auth session leaks into edge caches or dynamic bailout crashes.

Blocks:Dynamic Context Extraction Outside Suspense Boundaries in PPR Shells
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-optimistic-rollback-react-19-server--369
frontendcritical

React 19 Server Action Idempotency and Deterministic Optimistic Rollback Boundaries

Enforces deterministic client-side optimistic rollbacks and server-side mutation deduplication across React 19 Server Actions. Guarantees that optimistic updates via useOptimistic and useActionState bind directly to deterministic idempotency tokens, preventing ghost state commits and duplicate execution during transient network dropouts or browser reconnects.

Blocks:Executing non-idempotent Server Actions without deterministic rollback anchors or client mutation tokens
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-microtask-reactivity-graph-standard
frontendcritical

Svelte 5 Runes Microtask Graph & Deterministic Signal Derivation Standard

Enforces strict push-pull topological isolation within Svelte 5 runes ($state, $derived, $effect) during ultra-high-frequency state mutations (e.g., WebSocket feeds, canvas frame loops, high-rate telemetry). Mandates untracked boundary separation and explicit microtask-batched state transitions to eliminate cyclic signal re-entrancy and microtask starvation. Prevents catastrophic infinite notification cascades in Svelte's push-pull reactive dependency graph.

Blocks:Mutating reactive state inside an untracked $effect dependency or synchronous cross-signal mutation loop triggering runaway microtask cascade.
Targets:Cursor•Claude•Windsurf•Codex
vite-rolldown-federation-singleton-boundary
frontendcritical

Vite 6 Rolldown Module Federation Singleton & Symbol Isolation Invariant

Enforces deterministic runtime singleton boundaries and strict AST tree-shaking across Vite 6 and Rolldown federated micro-frontends. Prevents dual-package hazards, duplicate React/state-store runtime instantiation, and catastrophic symbol leaks across asynchronous federated boundaries.

Blocks:Dual-Instance Leaks and Tree-Shaking Bailout via Unconstrained Federated Shared Dependencies
Targets:Cursor•Claude•Windsurf•Codex
react-19-taint-api-serialization-guard
frontendcritical

React 19 Object Taint API and Serialization Boundary Guardrail

Enforces strict compile-time and runtime serialization boundaries between React Server Components (RSC) and Client Components. Mandates the explicit application of React 19 experimental_taintObjectReference and experimental_taintUniqueValue on sensitive domain entities, secrets, and raw database records to eliminate server-to-client credential and PII leakage.

Blocks:Leaking unredacted database entities or secrets across RSC boundary into Client Component props or Server Action responses
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-decoupling-standard
frontendcritical

Next.js 15 PPR Dynamic Hole Decoupling and Static Shell Isolation

Enforces strict isolation of dynamic runtime APIs (cookies, headers, connection, dynamic fetch) within Suspense-bounded leaf components under Next.js 15 Partial Prerendering (PPR). Prevents dynamic context evaluation from bubbling up to layout shells, guaranteeing instant static shell delivery and resilient micro-hole streaming.

Blocks:Dynamic Request API Cascade Poisoning Static Shell Prerender
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-shell-suspense-boundary-standard
frontendcritical

Next.js 15 PPR Dynamic Shell Boundary & Suspense Fallback Quarantine Standard

Enforces strict AST-level separation between statically prerendered layout shells and runtime streaming dynamic holes in Next.js 15 Partial Prerendering (PPR). Mandates complete quarantine of dynamic API invocations (cookies, headers, searchParams, and uncached dynamic data fetchers) inside explicit Suspense boundaries with deterministic, zero-dynamic fallback components to eliminate hydration cascades and accidental dynamic bailouts.

Blocks:Dynamic Hook Leaking Above Suspense Boundary Causing Full-Page Static Shell Eviction
Targets:Cursor•Claude•Windsurf•Codex
tanstack-query-v5-stream-hydration-protocol
frontendcritical

TanStack Query v5 Progressive Suspense Chunk Hydration & Stream Ingestion Protocol

Enforces deterministic ingestion of streaming SSR chunks into TanStack Query v5 client caches without duplicate network fetches or Suspense boundary layout thrashing. Coordinates progressive stream deserialization, non-zero cache stale time, and stable query client identity across progressive hydration boundaries.

Blocks:Hydration Refetch Storms and Suspense Boundary Tearing via Zero-Stale Streaming Chunk Ingestion
Targets:Cursor•Claude•Windsurf•Codex
react-19-preload-hoisting-hydration-order-guardrail
frontendcritical

React 19 Native Resource Hoisting & Streaming Preload Order Guardrail

Enforces strict utilization of React 19 native document metadata and asset preloading primitives (preload, preconnect, prefetchDNS) within streaming server-rendered microfrontends. Prohibits dynamic imperative head mutation via external head managers or asynchronous useEffect injection to eliminate FOUC, cumulative layout shift (CLS), and head hydration mismatches during concurrent HTML stream chunks.

Blocks:Dynamic Imperative Head Injection and Late Client-Side Preloading During Streaming Suspense
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-effect-root-teardown-boundary
frontendcritical

Svelte 5 $effect.root Deterministic Teardown Boundary in Micro-Frontend Shells

Enforces strict capture, storage, and deterministic invocation of the disposal function returned by $effect.root when creating reactive rune scopes outside the standard Svelte component tree. Prevents detached signal subgraphs, leaked runtime subscriptions, and cross-application memory growth inside long-lived single-page micro-frontend host containers.

Blocks:Discarding $effect.root Disposal Handles During Micro-Frontend Mounting and Service Instantiation
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-ssr-context-isolation-vite-6-environme-368
frontendcritical

Vite 6 Environment API Multi-Runtime SSR Context Isolation Invariant

Enforces strict boundary isolation and module runner sandboxing across concurrent Vite 6 Environment API runtimes (Client, Node.js, and Workerd). Prevents mutable module-scoped singletons, global prototype pollution, and cross-runtime reference leakage during concurrent server-side evaluation. Mandates AsyncLocalStorage-backed context dispatching or explicit environment-scoped dependency injection containers.

Blocks:Cross-Runtime Global Pollution and Leaky Module-Level Singletons in Multi-Environment SSR
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-optimistic-state-reconciliation-boundary
frontendcritical

React 19 Action Optimistic State Reconciliation & Buffer Boundary

Guarantees that concurrent asynchronous server action transitions rolling back optimistic state preserve active user input buffers, cursor positions, and pending microtasks without triggering layout recalculation race conditions or flash of uncommitted content (FOUC). Requires strict isolation between optimistic feed state and controlled form input models using non-blocking transitions.

Blocks:Binding Draft Input State Directly to useOptimistic Rollback Boundaries Causing Focus Loss and Dropped Keystrokes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-action-idempotency-pipeline
frontendcritical

Next.js 15 Cryptographic Server Action Replay Prevention & Idempotency Pipeline

Enforces an atomic, distributed idempotency pipeline for all state-mutating Next.js 15 Server Actions. Guarantees exactly-once execution semantics across network retries, browser re-submissions, and double-clicks by binding cryptographic payload digests and distributed lock caches to authenticated caller sessions.

Blocks:Executing state-mutating Server Actions directly from client calls without distributed lock acquisition and payload-bound idempotency keys.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-deterministic-serialization-invariant
frontendcritical

Svelte 5 Snippet Deterministic Slot Serialization and Recursive Hydration Guardrail

Mandates deterministic invocation, stable key identity, and symmetric SSR-to-client fallback evaluation when composing recursive and dynamic component layouts with Svelte 5 first-class snippets. Prevents fatal DOM tree divergence, unhandled hydration mismatches, and layout thrashing triggered by ambient runtime divergence or non-deterministic snippet parameter evaluation.

Blocks:Ambient state evaluation, unkeyed recursive invocation, and asymmetric snippet fallback rendering causing SSR-to-client hydration divergence.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-boundary-invariant
frontendcritical

Next.js 15 Partial Prerendering (PPR) Shell Boundary Invariant

Enforces strict physical decoupling between static edge prerendered layout shells and dynamic streaming Suspense holes under Next.js 15 PPR. Prevents accidental dynamic runtime de-opt (such as reading un-awaited searchParams, cookies, headers, or dynamic data at the shell level) which cascades TTFB penalties across entire route segments and triggers destructive hydration mismatches.

Blocks:Dynamic Scope Creep Poisoning Static Shell Prerendering
Targets:Cursor•Claude•Windsurf•Codex
css-view-transitions-l2-prerender-isolation
frontendcritical

CSS View Transitions L2 Cross-Document Prerender Isolation Standard

Prevents GPU surface buffer leaks, render-tree thrashing, and snapshot race conditions during Speculation Rules-driven multi-page navigations. Enforces explicit gating of pseudo-element capture states (`view-transition-name`) behind the `document.prerendering` lifecycle and requires deterministic resource release on aborted prerenders.

Blocks:Unconditional Static View-Transition Snapshot Binding During Speculative Prerender Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-streaming-guardrail
frontendcritical

Next.js 15 Partial Prerendering (PPR) Static Shell and Suspense Boundary Guardrail

Enforces strict synchronous static shell boundaries around asynchronous streaming subtrees when Next.js 15 Partial Prerendering (PPR) is enabled. Unenclosed dynamic operations like cookies(), headers(), searchParams, or uncached fetches bubble up and trigger full-route dynamic SSR bailouts, destroying sub-50ms TTFB guarantees.

Blocks:Awaiting dynamic data directly inside page or layout roots without Suspense containment, collapsing the prerendered static shell.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-boundary-isolation
frontendcritical

Next.js 15 Partial Prerendering Dynamic Boundary Isolation

Guarantees that static shell emission remains decoupled from dynamic I/O operations under Partial Prerendering (PPR). Prevents dynamic execution contexts (cookies, headers, searchParams, uncached data) from leaking into root page/layout components, ensuring immediate TTFB delivery of pre-rendered shells while dynamic content streams in isolation.

Blocks:Dynamic Scope Leaks De-optimizing Static Route Shells into Blocking SSR Streams
Targets:Cursor•Claude•Windsurf•Codex
react-19-actions-idempotency-boundary
frontendcritical

React 19 Actions & useActionState Async Idempotency Boundary Standard

Enforces strict mutation idempotency tokens and explicit abort propagation across React 19 transitions and useActionState boundaries. Prevents optimistic state tearing, ghost rollbacks, and concurrent double-dispatch races during high-latency network drops and rapid user interactions.

Blocks:Non-Idempotent useActionState Handlers Lacking In-Flight Abort Signals and Transaction Keys
Targets:Cursor•Claude•Windsurf•Codex
vite6-multi-environment-module-isolation-guardrail
frontendcritical

Vite 6 Multi-Environment Module Isolation & Runtime Boundary Guardrail

Enforces strict module boundary isolation across heterogeneous runtimes (Client, Node SSR, and Edge/Workerd) using the Vite 6 Environment API. Prevents runtime-specific API pollution, accidental credential leakage, and invalid cross-environment module evaluation across decoupled compilation matrices.

Blocks:Cross-Environment Module Bleed and Dynamic Dual-Runtime Imports across Heterogeneous Matrices
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-proxy-demarcation-standard
frontendcritical

Svelte 5 Runes Signal Proxy Demarcation and Deep Mutation Boundary Standard

Enforces strict signal demarcation boundaries across deep reactive $state proxies to eliminate microtask queue saturation and cascading fine-grained re-render thrashing. Mandates $state.raw for high-frequency or external telemetry streams and dictates $state.snapshot boundaries across module, web worker, and inter-service boundaries.

Blocks:Unbounded Deep In-Place Proxy Mutation in High-Frequency Event Pipelines
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-cache-life-invariants
frontendcritical

Next.js 15 Dynamic I/O and Cache-Life Invalidation Standard

Governs deterministic `use cache` profiles and explicit `cacheTag` lifecycles under React 19 Dynamic I/O (`experimental.dynamicIO: true`). Eliminates silent stale data cross-contamination and un-tracked runtime dynamic leaks across hybrid streaming routes by enforcing strict isolation of caching scopes and revalidation boundaries.

Blocks:Implicit Caching via Ambiguous Dynamic Access and Missing Invalidation Tags Under Dynamic I/O
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-raw-state-telemetry-guardrail
frontendcritical

Svelte 5 High-Frequency Telemetry Invariant: Enforce $state.raw Immutability Boundaries

Mandates the usage of $state.raw for high-frequency telemetry streams, WebSockets, and sensor feeds to prevent fine-grained reactivity cascade storms and deep proxy-wrapping overhead. Enforces an immutable update paradigm where raw state is replaced via atomic reference assignment rather than in-place mutation.

Blocks:Deep Proxy Virtualization of Rapid Telemetry Payloads via Standard $state Triggering Reactive Micro-Storms and Heap Churn
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-effect-signal-cancellation
frontendcritical

Strict AbortController Signal Cancellation in Svelte 5 Runes Async Effects

Enforces synchronous cleanup contract adherence and mandatory AbortController propagation inside Svelte 5 $effect and $effect.pre rune boundaries. Prevents stale closure race conditions, out-of-order state mutations, and orphaned async microtasks when reactive dependencies cycle rapidly.

Blocks:Uncontrolled Async Microtasks and Return of Promises in Svelte 5 $effect Rune Closures
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-isolation-vite-6-environme-241
frontendcritical

Vite 6 Environment API Multi-Runtime Module Graph & HMR Boundary Enforcement

Enforces strict isolation between heterogeneous runtime environments (client, node SSR, edge/workerd, and RSC) using the Vite 6 Environment API. Guarantees that module graphs, transform pipelines, and hot-module replacement (HMR) boundaries do not leak state or trigger invalid cross-runtime graph mutations across isolated execution contexts.

Blocks:Cross-Runtime Module Graph Contamination and Unscoped Legacy SSR Invalidation
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-transition-async-cancellation-guardrail
frontendcritical

React 19 Async Transition Cancellation & Bailout Boundary Enforcement

Enforces deterministic cancellation and boundary bailouts for React 19 async transitions (startTransition and useActionState). Ensures external network requests, caching, and imperative side effects abort cleanly when superseded by newer transitions or component unmounts, preventing zombie writes and race conditions.

Blocks:Dangling Un-aborted Async Promises and Stale External Side Effects in React 19 Transitions
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-reactive-graph-cycle-push-pull-leak-guardrail
frontendcritical

Svelte 5 Runes Reactive Graph Cycle Prevention and Push-Pull Leak Guardrail

Enforces strict structural constraints on Svelte 5 rune topologies ($state, $derived, $effect) to eliminate infinite evaluation loops and subscription leaks. Protects against memory bloat and microtask exhaustion under high-throughput telemetry updates by mandating untracked reads, bounded buffers, and decoupled frame rendering.

Blocks:Dynamic Graph Dependency Churn and Cyclic Invalidation Under High-Frequency Stream Mutation
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler-ref-mutation-invariant
frontendcritical

React 19 Compiler Auto-Memoization: Ref Mutation and Render-Phase Invariant Guardrail

Enforces strict compliance with React 19 Compiler memoization heuristics by prohibiting reads and writes to ref.current during client component render execution. Guarantees deterministic auto-memoization graphs and eliminates cache corruption caused by untracked mutable escapes outside React's reactive flow.

Blocks:Render-Phase Ref Mutation and Escape Analysis Invalidation in React 19
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-shell-boundary-contract
frontendcritical

Next.js 15 Partial Prerendering (PPR) Shell Boundary & Dynamic Leak Isolation

Enforces strict structural isolation between static prerendered HTML shells and dynamic streaming Suspense holes under Next.js 15 Partial Prerendering (PPR). Mandates that dynamic data lookups (cookies, headers, auth sessions, searchParams) are strictly quarantined inside explicit React Suspense boundaries to eliminate CDN/Edge-cache credential leakage and prevent dynamic bailout cascades across static shell components.

Blocks:Dynamic Authentication & Header Access Leaking into Static Prerender Shells
Targets:Cursor•Claude•Windsurf•Codex
react-19-taint-boundary-enforcement
frontendcritical

React 19 Server Component Tainted Value Boundary Enforcement

Enforces compiler- and runtime-verified data boundary invariants in React 19 and Next.js App Router applications using experimental_taintObjectReference and experimental_taintUniqueValue. Guarantees that raw data-access objects, secrets, and database records containing sensitive customer domain models cannot cross the React Server Component serialization boundary to the client. Mandates explicit Data Transfer Object (DTO) mapping and immediate tainting at the Data Access Layer (DAL).

Blocks:Passing un-sanitized raw database entities, API tokens, or ORM model instances across the RSC serialization boundary to Client Components
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-effect-root-microfrontend-cleanup-invariant
frontendcritical

Svelte 5 Runes Effect Root Lifecycle Invariant in Micro-Frontends

Enforces deterministic unmounting of Svelte 5 rune trees embedded in host shell micro-frontend architectures via explicit $effect.root cleanup invocations. Without wrapping imperative programmatic mount calls in $effect.root or retaining the disposal function for teardown, detached DOM trees, orphaned reactive signals, and memory leaks persist indefinitely across route switches.

Blocks:Uncontained Imperative Mount and Unmanaged Runes Scope in Micro-Frontend Wrappers
Targets:Cursor•Claude•Windsurf•Codex
angular-19-zoneless-signal-graph-boundary
frontendcritical

Angular 19 Zoneless Signal Graph Change Detection & Streaming Boundary Guardrail

Enforces architectural boundaries for Angular 19 zoneless applications under high-frequency streaming workloads. Mandates that signal state mutations are pure, acyclic, and coalesced, forbidding synchronous signal writes inside computation graphs or rendering cycles to prevent infinite microtask loops and UI degradation.

Blocks:Synchronous Signal Writes Inside Reactive Graphs and Uncoalesced High-Frequency Stream Thrashing in Zoneless Runtimes
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-vite-6-environme-269
frontendcritical

Vite 6 Environment API Multi-Runtime State Partitioning & Module Graph Isolation

Enforces strict isolation of module graphs, transform pipelines, and memory spaces between Edge (WinterCG) and Node.js SSR runtimes during concurrent compilation under Vite 6. Prevents cross-runtime symbol contamination, shared plugin closure state leaks, and invalid platform polyfill resolution in unified micro-frontend monorepos.

Blocks:Global Plugin State Sharing and Cross-Runtime Module Graph Pollution in Concurrent Environments
Targets:Cursor•Claude•Windsurf•Codex
react-19-asset-preloading-dedup-barrier
frontendcritical

React 19 Native Resource Preloading and Streaming Deduplication Barrier

Enforces deterministic utilization of React 19 native react-dom resource preloading APIs (preload, preinit, preconnect) over manual DOM injection or unstructured link tags. Guarantees deterministic priority injection during concurrent streaming SSR while preventing duplicate network waterfalls, memory leaks, and hydration mismatch layout shifts.

Blocks:Imperative DOM Head Link Injection and Un-hoisted Custom Link Elements Bypassing React 19 Streaming Head Pipeline
Targets:Cursor•Claude•Windsurf•Codex
vite6-deterministic-chunk-boundaries
frontendcritical

Deterministic Module Graph Chunk Boundary Invariant in Vite 6

Enforces strict structural boundary isolation and deterministic content-hashing across Rollup/Rolldown chunks in Vite 6. Eliminates catastrophic cross-chunk cache-invalidation cascades across global CDN layers when incremental business-logic changes occur.

Blocks:Monolithic vendor bundling and unconstrained manualChunks predicates causing global CDN cache bust cascades
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-rollback-invariant-react-19-server--448
frontendcritical

React 19 Server Actions Optimistic UI Rollback and Telemetry Invariant

Guarantees deterministic rollback of client-side optimistic states and telemetry emission when non-idempotent Server Actions reject, abort, or race against React 19 concurrent router transitions. Mandates strict encapsulation using useActionState with useOptimistic, enforcing serial action execution and structured error envelopes to prevent orphaned UI states and client-server desynchronization.

Blocks:Ad-Hoc setState Optimism Colliding with Server Action Failures and Concurrent Navigation
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-multitenant-context-isolation
frontendcritical

React 19 Server Action Multi-Tenant Context Poisoning Invariant

Enforces strict request-scoped isolation in React 19 Server Actions using immutable AsyncLocalStorage to prevent cross-tenant data leaks and state poisoning during concurrent asynchronous executions. Prohibits global singleton mutations and client-supplied tenant identifiers as authoritative context.

Blocks:Cross-tenant state bleeding via module-scoped state or client-spoofed tenant parameters in React 19 Server Actions.
Targets:Cursor•Claude•Windsurf•Codex
react-19-taint-api-serialization-boundary
frontendcritical

Enforcing React 19 Experimental Taint API Data Serialization Boundaries

Guarantees cryptographic-level runtime prevention of sensitive server-side objects, PII, and credentials leaking across Server Component boundaries into client bundles. Mandates proactive registration with React 19 experimental_taintObjectReference and experimental_taintUniqueValue across all server-side data access layers and secret retrieval paths.

Blocks:Leaking Raw Server State and Sensitive Primitive Secrets Across Server-to-Client Serialization Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-vite-6-environme-876
frontendcritical

Vite 6 Environment API Multi-Runtime State & Module Boundary Isolation

Enforces strict module execution boundaries, module graph separation, and memory isolation between heterogeneous runtime targets (e.g., workerd/Cloudflare Workers, Node.js SSR runners, and Client DOM) using the Vite 6 Environment API. Prevents cross-environment reference leakage, dual-package hazard instantiation, and state pollution during unified SSR and dev orchestration.

Blocks:Cross-Environment State Leaks and Shared Module Graph Contamination in Unified SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-ownership-and-teardown
frontendcritical

Svelte 5 Runes Effect Ownership and Resource Teardown Standard

Enforces deterministic lifecycle management and lexical root ownership for Svelte 5 runes ($effect, $effect.pre, $effect.root) in high-churn environments and micro-frontends. Prevents orphaned reactive loops, memory leaks, and dangling cross-application subscriptions caused by creating effects outside component initialization contexts or omitting explicit teardown handlers.

Blocks:Instantiating unbounded effects in asynchronous callbacks or omitting explicit teardown for unmanaged effect roots
Targets:Cursor•Claude•Windsurf•Codex
wasi-component-model-host-memory-isolation
frontendcritical

WASI 0.2 Component Model Host Memory Isolation & Boundary Enforcement

Enforces strict host-guest memory isolation and capability-based virtualization when executing third-party WASI 0.2 WebAssembly components in browser runtimes. Prohibits ambient authority exposure and mutable host memory sharing across the WebAssembly Canonical ABI boundary.

Blocks:Executing Third-Party Wasm Components on the Main Thread with Ambient Authority and Shared Linear Memory
Targets:Cursor•Claude•Windsurf•Codex
vite-rolldown-federation-sri-attestation
frontendcritical

Subresource Integrity Attestation and Contract Validation for Federated Micro-Frontends

Enforces deterministic cryptographic digest verification and strict runtime schema contract validation on dynamic remote container manifests and emitted Rolldown ESM chunks. Prevents edge supply-chain injection attacks and poisoned dynamic imports by requiring immutable SHA-384/SHA-512 SRI attestation headers before hydrating cross-origin micro-frontend components. Guarantees fail-closed isolation if dynamic remote modules diverge from pre-attested cryptographic lockfiles.

Blocks:Blind Cross-Origin Remote Container Execution Without Cryptographic Digest Pinning and Runtime Type Enforcement
Targets:Cursor•Claude•Windsurf•Codex
svelte5-async-derived-race-demuxing-protocol
frontendcritical

Svelte 5 Asynchronous State Race Demuxing & Abort Protocol

Enforces deterministic demultiplexing and cancellation for asynchronous side-effects and resource mutations triggered by fine-grained Svelte 5 runes. Prevents out-of-order promise resolutions from clobbering active state runes during high-frequency dependency invalidations.

Blocks:Uncoordinated Asynchronous Side-Effects Overwriting Svelte 5 Reactive State with Stale Promise Resolutions
Targets:Cursor•Claude•Windsurf•Codex
react19-rsc-tainted-object-boundary-enclosure
frontendcritical

React 19 Server Components Taint Boundary Enclosure Standard

Enforces the cryptographic boundary protection of sensitive domain models and secret values in React 19 Server Components. Mandates the explicit application of React taint APIs (`experimental_taintObjectReference` and `experimental_taintUniqueValue`) within the Data Access Layer (DAL) to prevent runtime serialization of backend secrets across the RSC Flight protocol stream to Client Components.

Blocks:Leaking Raw Sensitive Domain Models and Secrets Across RSC Serialization Boundaries
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-dynamic-context-memory-guardrail
frontendcritical

Svelte 5 Runes Dynamic Context Memory Retention Guardrail

Prevents catastrophic detached DOM nodes and cumulative heap memory leaks caused by unbound $state signals, root-less $effect.root closures, and shared module-level context references leaking across deeply nested, dynamically unmounted Svelte 5 component trees. Mandates strict lifecycle scoping, clean teardown of reactive context subscribers, and isolation of module-level reactive stores.

Blocks:Escaping Rune Subscriptions and Leaked Module-Level Context References in Dynamic Component Subtrees
Targets:Cursor•Claude•Windsurf•Codex
next15-ppr-streaming-hydration-barrier
frontendcritical

Next.js 15 PPR Streaming Shell Hydration Barrier and Suspense Boundary Contract

Enforces strict boundary isolation when splicing dynamic streaming fragments into prerendered static shells under Next.js 15 Partial Prerendering (PPR). Guarantees zero Cumulative Layout Shift (CLS) and eliminates React hydration mismatch panics by requiring dimensionally locked, semantically identical Suspense fallbacks around every dynamic data hole. Mandates that all dynamic API accesses (cookies, headers, searchParams) are strictly quarantined beneath deterministic boundaries.

Blocks:Leaking Dynamic Accessors into Static Shells and Supplying Undimensioned Generic Suspense Fallbacks
Targets:Cursor•Claude•Windsurf•Codex
angular-19-zoneless-signal-cycle-guardrail
frontendcritical

Angular 19 Zoneless Signal Graph Cycle & Microtask Starvation Prevention

Enforces strict Directed Acyclic Graph (DAG) topologies across Angular 19 zoneless signal architectures to prevent microtask queue starvation, continuous re-render churn, and runtime cycle exceptions (such as NG0600 or NG0103). Mandates unidirectional data flow by prohibiting cyclic signal mutations within effects and enforcing pure, derivation-based computed signals.

Blocks:Cyclic Signal Mutation in Effects or Cross-Signal Ping-Pong Starving the Microtask Queue
Targets:Cursor•Claude•Windsurf•Codex
wasi-02-canonical-abi-boundary-guardrail
frontendcritical

WASI 0.2 Component Model Canonical ABI Boundary & Memory Isolation

Enforces strict sandboxed linear memory isolation and deterministic Canonical ABI serialization across polyglot WebAssembly micro-frontends executing in browser runtimes. Prohibits manual guest memory manipulation, direct ArrayBuffer pointer passing, and out-of-band heap mutation in favor of type-safe WIT (WebAssembly Interface Type) lifting and lowering operations.

Blocks:Bypassing Canonical ABI via Manual Linear Memory Slicing and Raw Heap Allocation
Targets:Cursor•Claude•Windsurf•Codex
next15-ppr-dynamic-io-boundary-invariant
frontendcritical

Next.js 15 Partial Prerendering (PPR) and Dynamic-IO Boundary Isolation

Enforces strict isolation between static prerendered shell hierarchies and asynchronous dynamic I/O micro-tasks in Next.js 15. Prevents dynamic data APIs (cookies, headers, searchParams, uncached queries) from de-optimizing parent route shells into runtime SSR waterfalls. Mandates explicit React Suspense boundaries around all dynamic leaf nodes with synchronous, deterministic fallback skeletons.

Blocks:Unwrapped Dynamic API Invocation at Route Root De-optimizing Static Shells into Blocking SSR
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-anchor-isolation
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Anchor Isolation Guardrail

Enforces deterministic boundaries between static shell prerendering and dynamic streaming holes in Next.js 15 PPR architectures. Prevents accidental de-opt of static page shells, edge cache pollution, and hydration mismatch cascades caused by unisolated dynamic data reads (e.g., cookies, headers, dynamic searchParams) leaking into static ancestors.

Blocks:Dynamic Anchor Leakage Causing Shell De-optimization and Hydration Mismatches
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-graph-teardown-invariant
frontendcritical

Svelte 5 Runes Reactive Graph Cycle Detection and Teardown Invariant

Enforces strict lifecycle boundaries and disposal invariants for Svelte 5 fine-grained reactive graphs across client-side SPA route transitions. Prohibits orphaned module-level $effect.root allocations and cyclic signal updates to prevent memory leaks and graph thrashing.

Blocks:Orphaned Module-Level Effect Roots and Self-Triggering Reactive Cycles in Svelte 5 Runes
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-protocol
frontendcritical

React 19 Server Action Idempotency & Replay-Resilience Protocol

Enforces client-originated idempotency tokens and atomic server-side deduplication for all mutating React 19 Server Actions. Guarantees strictly-once execution during transient network retries and optimistic UI reconciliation across useActionState and useOptimistic transitions.

Blocks:Server-Generated Keys and Naked Mutations Causing Duplicate Side-Effects and Phantom Re-executions
Targets:Cursor•Claude•Windsurf•Codex
wasm-component-model-mfe-isolation-standard
frontendcritical

Wasm Component Model (WASI 0.2) Micro-Frontend Sandbox Isolation Standard

Enforces strict linear-memory isolation and capability-attenuated WIT (WebAssembly Interface Type) host bindings for untrusted third-party micro-frontend UI widgets. Eliminates iframe DOM overhead while preventing untrusted code from accessing ambient globals, raw DOM handles, or host process memory. Mandates the use of the canonical ABI for structured UI rendering events over unidirectional virtual command buffers.

Blocks:Leaking Ambient DOM Handles and Unattenuated Host Capabilities to Untrusted Wasm Micro-Frontends
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-boundary-validation
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Boundary and Fallback Isolation

Mandates strict boundary encapsulation and pure static fallbacks for dynamic operations in Next.js 15 Partial Prerendering (PPR) routes. Prevents dynamic API calls like cookies(), headers(), and uncached I/O from bailing out static shell prerendering and de-optimizing edge cache hit ratios.

Blocks:Unbounded Dynamic API Invocations Triggering Global SSR Bailouts on Static Edge Shells
Targets:Cursor•Claude•Windsurf•Codex
react-19-async-context-suspension-boundary-standard
frontendcritical

React 19 Async Context Propagation and Suspension Boundary Standard

Enforces request-scoped promise memoization and granular suspension boundary hierarchy when consuming asynchronous resources via the React 19 use() API in SSR environments. Prevents unmemoized promise re-allocations on re-render ticks from creating infinite suspension loops, stream stalls, and Node.js thread-pool exhaustion.

Blocks:Instantiating Uncached Promises Inline in Component Trees Consumed via use() During SSR Streaming
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-only-module-leak-guardrail
frontendcritical

Next.js 15 Build-Time Dynamic Server-Only Module Leak Guardrail

Enforces strict static isolation between Next.js 15 Server Component runtimes and client hydration manifests to prevent inadvertent bundling of secrets, DB clients, and native bindings. Mandates build-time fail-closed poison pills ('server-only') and structural module boundary isolation to eliminate client-side credential exposure and hydration bloat.

Blocks:Leaking Sensitive Server Runtime Modules or Native Secrets into Client Bundles via Transitive Barrel Imports
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-boundary-isolation
frontendcritical

Vite 6 Environment API Runtime Graph Boundary Isolation

Enforces strict runtime boundary isolation across heterogenous target environments (Client, Node SSR, Edge/Workerd, and RSC) using the Vite 6 Environment API. Prevents module graph pollution, illegal global polyfill sharing, and non-deterministic state leaks during multi-target evaluation.

Blocks:Cross-Environment Global State Leakage via Legacy ssrLoadModule and Shared Lexical Plugin Caches
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-action-host-header-csrf-guard
frontendcritical

Deterministic Origin and Host-Header Verification in Next.js 15 Server Actions

Enforces strict origin-to-host cryptographic alignment and explicit allowed-origin whitelisting for Next.js 15 Server Actions in distributed multi-tenant environments. Prevents cross-site request forgery (CSRF), host-header cache poisoning, and tenant context confusion across layered reverse-proxy architectures.

Blocks:Trusting mutable Host or X-Forwarded-Host headers inside Server Actions without strict reverse-proxy sanitization and origin matching
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-rollback-react-19-server--252
frontendcritical

React 19 Server Actions Idempotency & Optimistic Rollback Invariant

Enforces deterministic client-side mutation tracking, cryptographically secure idempotency keys, and strict rollback boundaries across concurrent React 19 transitions. Prevents UI state drift, phantom updates, and double-mutation execution during network retries or component re-renders.

Blocks:Non-Idempotent Server Actions with Unbounded Optimistic State Mutations and Silent Rollback Omission
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-request-scope-boundary-isolation
frontendcritical

Next.js 15 PPR Request-Scope Boundary Isolation and Dynamic Bailout Prevention

Next.js 15 Partial Prerendering (PPR) combines static shell pre-generation with dynamic streaming within the same route. Request-scoped Dynamic APIs (e.g., cookies(), headers(), searchParams, connection()) must be isolated strictly inside dedicated leaf Server Components wrapped in React Suspense boundaries to prevent cascading dynamic bailouts that collapse the static prerender shell into full runtime SSR.

Blocks:Leaking Request-Scoped Dynamic APIs into Root Component Shells Collapsing the PPR Prerender Tree
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ownership-detached-effect-cleanup
frontendcritical

Svelte 5 Deep Signal Runes Ownership & Detached Effect Cleanup Guardrail

Enforces strict reactive ownership boundaries and deterministic teardown for Svelte 5 runes ($state, $effect, $derived) instantiated across asynchronous boundaries or dynamic service scopes. Prevents runaway memory leaks and orphaned reactive computations in long-lived single-page applications by mandating explicit $effect.root scoping and deterministic lifecycle cleanup for unparented signals.

Blocks:Spawning un-scoped reactive effects and deep signal graphs across async boundaries without deterministic $effect.root disposal
Targets:Cursor•Claude•Windsurf•Codex
react19-asset-preloading-deduplication-standard
frontendcritical

React 19 Asset Preloading & Resource Hint Deduplication Standard

Enforces deterministic, declarative priority dispatch using React 19's native resource loading APIs (preload, preinit, prefetchDNS, preconnect) across concurrent and streaming render boundaries. Eliminates critical request chains, stylesheet-driven render blocks, and duplicate head tag emissions caused by imperative or uncoordinated hint injection in deeply nested asynchronous server and client components.

Blocks:Ad-Hoc Imperative Head Mutators and Duplicative Preload Directives Across Streaming Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react19-taint-object-api-boundary-enforcement-production-standard
frontendcritical

React 19 Taint Object API Boundary Enforcement for RSC Serialization

Enforces strict application of React 19's experimental_taintObjectReference and experimental_taintUniqueValue APIs to prevent sensitive server-side data models and cryptographic secrets from crossing the React Server Component (RSC) boundary. This guardrail ensures that server-only entities trigger deterministic build-time or runtime Flight serialization aborts if inadvertently forwarded to Client Components.

Blocks:Leaking Raw Server Data Models and Sensitive Primitives Across Client Boundaries via RSC Flight Serialization
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-cache-isolation
frontendcritical

Next.js 15 Async Request Scope & Multi-Tenant Cache Isolation Guardrail

Enforces strict boundary isolation between Next.js 15 asynchronous dynamic request APIs (await cookies(), await headers(), searchParams) and shared data caching mechanisms (unstable_cache, Data Cache, shared CDN edge layers). Prevents critical cross-tenant data poisoning and authorization bypasses caused by persisting tenant-scoped or user-scoped data into shared cache partitions.

Blocks:Persisting Tenant-Specific Data into Shared Data Caches via Dynamic Async Request Closures
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-scheduling-boundary
frontendcritical

Svelte 5 Runes Async State Scheduling Boundary & Microtask Isolation

Enforces strict synchronous execution invariants across Svelte 5 reactive graphs, prohibiting asynchronous execution within $derived and untracked microtask mutations in $effect. Prevents state bifurcations, unhandled rejection leaks, and out-of-order reactive graph tearing by establishing explicit AbortController teardowns and task boundary isolation.

Blocks:Asynchronous Contamination of Synchronous Reactive Derivations and Untracked Effect Race Conditions
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-standard-vite-6-environme-794
frontendcritical

Vite 6 Environment API Runtime Isolation and Module Graph Segregation

Mandates strict runtime module graph isolation between heterogeneous client, edge, and server environments using the Vite 6 Environment API. Enforces separate resolution conditions and environment-scoped plugin hooks to prevent cross-runtime global pollution, token leakage, and SSR hydration corruption.

Blocks:Monolithic Legacy SSR Configuration and Cross-Environment Module Graph Bleed
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-boundary-isolation-next-js-15-parti-278
frontendcritical

Next.js 15 PPR Static Shell and Dynamic Streaming Boundary Isolation

Enforces strict isolation between static prerendered HTML shells and dynamic streaming microtasks in Next.js 15 Partial Prerendering (PPR). Dynamic runtime APIs and non-cached data access must never leak into root layout/page entry points without an intervening Suspense boundary, preventing route-level de-optimization and catastrophic edge TTFB regressions.

Blocks:Un-isolated Dynamic Function Invocation Collapsing the Static Shell into Blocking SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-graph-untrack-invariant
frontendcritical

Svelte 5 Runes Reactive Graph Deep Mutation and Untrack Invariant

Enforces deterministic signal dependency tracking in Svelte 5 by establishing strict boundaries between reactive triggers and non-reactive graph reads or deep mutations. Mandates the use of untrack() inside effects to prevent unintended dependency subscription loops, cyclic cascade thrashing, and memory degradation across high-frequency mutable UI graphs.

Blocks:Cyclic Signal Thrashing via Unbounded Reactive Reads in Deeply Mutated Svelte 5 Effects
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-taint-boundary-standard-react-19-server--197
frontendcritical

React 19 Server Components Cryptographic Object Taint Boundary Standard

Enforces strict cryptographic serialization boundaries across React 19 Server Components using experimental_taintObjectReference and experimental_taintUniqueValue primitives. Guarantees that raw data layer entities, credentials, and PII are structurally blocked from crossing RSC serialization boundaries into client bundles. Prevents silent data exfiltration by failing fast during RSC payload streaming if tainted memory references or scalar values are referenced in client props.

Blocks:Accidental Client Serialization of Raw DB Entities, Internal Auth Tokens, or PII Across RSC Boundaries
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-vite-6-environme-755
frontendcritical

Vite 6 Environment API Multi-Runtime SSR Isolation Protocol

Enforces strict isolated execution boundaries and per-runtime ModuleRunner instances when leveraging the Vite 6 Environment API across heterogeneous targets (e.g., Client, Node.js SSR, and Cloudflare Workers). Eliminates cross-environment state leaks, shared module graph contamination, and illegal global namespace access between isolated worker runtimes and host processes.

Blocks:Global Module Graph Bleed and Shared ModuleRunner Execution Across Heterogeneous Runtimes
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-signal-graph-cycle-guardrail-svelte-5-runes-s-961
frontendcritical

Svelte 5 Runes Signal Graph Cycle and Deep State Mutation Guardrail

Enforces strict signal purity and cycle-free reactive graphs across Svelte 5 enterprise applications. Prohibits state mutation side effects inside $derived expressions, eliminates recursive reactive loops within $effect blocks, and mandates explicit state boundary encapsulation for complex nested telemetry and dashboard models.

Blocks:Cyclic Signal Graph Cascades, Side-Effect Leaks in $derived Runes, and Untracked Deep Proxy Mutations
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-boundary-invariant
frontendcritical

Vite 6 Environment API Multi-Runtime Context Boundary Invariant

Enforces strict physical isolation across execution environments (client, Node.js SSR, and edge runtimes) within the Vite 6 Environment API. Prevents cross-runtime module graph pollution, leaked global polyfills, and improper shared plugin state across disparate target runtimes during isomorphic build and dev evaluation.

Blocks:Conflating Module Resolution Contexts and Leaking Node Polyfills into Edge Runtimes via Legacy SSR Flags
Targets:Cursor•Claude•Windsurf•Codex
react19-useoptimistic-transactional-mutex-guardrail
frontendcritical

React 19 useOptimistic Monotonic Versioning and Mutex Reconciliation

Enforces strict monotonic sequencing and transactional state tracking for React 19 useOptimistic hooks to prevent race conditions and UI ghost-rollbacks caused by out-of-order network resolutions. All optimistic operations must carry epoch timestamps or incremental sequence IDs, rejecting stale server reconciliations that arrive after newer optimistic actions have dispatched.

Blocks:Unversioned Concurrent Optimistic State Mutation with Out-of-Order Server Rollback
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-after-background-task-timeout-guardrail
frontendcritical

Next.js 15 after() Background Task Boundary and Execution Timeout Guardrail

Governs the usage of the Next.js 15 after() API within Server Components, Server Actions, and Route Handlers. Mandates strict execution timeouts, comprehensive error isolation, and cancellation semantics to prevent unhandled promise rejections, stalled serverless microVM teardowns, and zombie telemetry tasks.

Blocks:Unbounded floating promises and unisolated after() callbacks starving serverless concurrency and throwing unhandled rejections
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-ssr-context-leak-prevention-standard
frontendcritical

Svelte 5 Runes SSR Reactive Context Leak Prevention Standard

Enforces strict isolation of fine-grained reactive runes ($state, $derived) during Server-Side Rendering (SSR) to prevent cross-request tenant bleeding and memory leaks. Prohibits module-level singleton state instances and mandates scoped context encapsulation via Svelte's context API or per-request instantiation boundaries.

Blocks:Global Module-Level Runes Instantiation Permeating Concurrent Server Requests
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-streaming-fallback-standard
frontendcritical

Next.js 15 PPR Dynamic Micro-Segment Streaming and Timeout Invariants

Next.js 15 Partial Prerendering (PPR) requires that dynamic micro-segments inside statically prerendered shells are isolated in discrete Suspense boundaries with bounded AbortSignal timeouts. Unbounded dynamic data fetching inside dynamic streaming holes exhausts edge worker concurrency, blocks stream completion, and degrades client perceived latency under downstream latency spikes. All dynamic holes must enforce deterministic fallback states when downstream dependencies breach strict latency budgets.

Blocks:Unbounded Dynamic Fetching Inside Unisolated or Non-Resilient Suspense Boundaries in PPR Routes
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-cryptographic-replay-deduplication-standard
frontendcritical

React 19 Server Actions Cryptographic Replay Deduplication Standard

Enforces mandatory client-generated cryptographically secure idempotency keys and server-side atomic state locking across distributed RPC boundaries for non-idempotent React 19 Server Actions. Prevents catastrophic double-execution of financial transactions, state mutations, and external API requests caused by network retry flaps, connection timeouts, or unconstrained client re-submissions. Guarantees linearizable mutation guarantees by unifying distributed atomic locks with deterministic response caching.

Blocks:Executing Non-Idempotent React 19 Server Actions Without Distributed Locks and Replay Nonces
Targets:Cursor•Claude•Windsurf•Codex
react-19-optimistic-mutation-rollback-invariant
frontendcritical

React 19 Deterministic Optimistic Rollback and Transition Boundary Invariant

Enforces deterministic, tear-free optimistic rollbacks under concurrent server mutations using React 19's useOptimistic and startTransition APIs. Precludes full-tree reconciliation cascades and state desynchronization caused by ad-hoc useState rollback flags or uncoordinated top-level context mutations during server action execution.

Blocks:Ad-Hoc Imperative State Rollback Cascades in Concurrent Transitions
Targets:Cursor•Claude•Windsurf•Codex
angular-19-signal-graph-cycle-quarantine-standard
frontendcritical

Angular 19 Signal-Based Reactive Graph Cycle Quarantine Standard

Enforces architectural quarantine mechanisms against reactive graph circularity and microtask starvation in zoneless Angular 19 applications. Eliminates cascading downstream signal writes, misuse of allowSignalWrites in effects, and un-isolated high-frequency event ingestion within the reactive graph. Mandates untracked boundary containment and computed derivation purity to ensure deterministic change detection passes.

Blocks:Cyclic Signal Mutations via Cascading Effects and Unbounded High-Frequency State Writes
Targets:Cursor•Claude•Windsurf•Codex
react19-action-transition-abortsignal-demuxing-standard
frontendcritical

Deterministic AbortSignal Demultiplexing for React 19 use() Transitions

Enforces deterministic cancellation and cleanup of pending micro-tasks, asynchronous action transitions, and concurrent resource fetches consumed via React 19's use() API. Rapid route transitions and superseded useTransition calls must multiplex and demultiplex AbortSignals at route boundaries to prevent memory leaks, orphan micro-task execution, and out-of-order state settlement across nested Suspense boundaries.

Blocks:Ghost Promises and Stale Micro-Task Settlement via Unlinked use() Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-optimistic-rollback
frontendcritical

React 19 Server Actions Idempotency & Optimistic State Rollback Invariant

Enforces deterministic client-side state reconciliation across optimistic updates and asynchronous Server Actions in React 19. Mandates client-generated idempotency tokens and transactional transitions via useOptimistic and useActionState to prevent phantom state mutations and UI divergence on network failures or concurrent action rejections.

Blocks:Unbounded manual state mutation during asynchronous Server Actions without idempotency guards and deterministic optimistic rollback
Targets:Cursor•Claude•Windsurf•Codex
react-19-document-metadata-async-hoisting-standard
frontendcritical

React 19 Document Metadata Async Hoisting & Deduplication Standard

Governs document metadata (<title>, <meta>, <link>) handling across streaming server-side rendering and async transitions in React 19. Eliminates hydration mismatches, document head mutation races, and metadata flashes by enforcing native React 19 metadata hoisting and deterministic deduplication invariants over legacy third-party wrappers or imperative DOM writes.

Blocks:Imperative head mutations and legacy third-party head wrappers inducing streaming metadata races and hydration flash.
Targets:Cursor•Claude•Windsurf•Codex
react-19-async-transition-abortsignal-invariant
frontendcritical

React 19 Async Transitions Deterministic AbortSignal DOM Disconnect Standard

Enforces deterministic lifecycle-bound cancellation for asynchronous actions and transitions executed via React 19 transitions and action states. Guarantees that pending network I/O, server actions, and microtask pipelines register an explicit AbortSignal tied to component unmount and concurrent boundary re-renders, preventing post-unmount execution and memory retention across phantom DOM trees.

Blocks:Unbounded async transitions executing beyond component unmount, causing memory leaks and phantom reconciliation
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-hole-timeout-standard
frontendcritical

Next.js 15 PPR Dynamic Hole Streaming Flush-Timeout Standard

Enforces deterministic flush timeouts and boundary encapsulation for dynamic streaming holes in Next.js 15 Partial Prerendering (PPR). Prevents high-latency downstream microservices and slow dynamic queries from blocking early static shell edge delivery or stalling HTTP streaming responses. Mandates AbortController timeouts, granular React Suspense fallback boundaries, and non-blocking error fallbacks.

Blocks:Unbounded Async Hole Execution Stalling Edge Shell Delivery and HTTP Streaming
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-hydration-guardrail
frontendcritical

Next.js 15 PPR Dynamic Hole Hydration & Latency Boundary Guardrail

Enforces strict isolation of dynamic runtime primitives within React Suspense boundaries paired with dimensionally-locked micro-skeletons for Next.js 15 Partial Prerendering (PPR). Prevents dynamic stream queries from blocking the static pre-rendered edge shell or inducing Cumulative Layout Shift (CLS) cascades upon hydration. Mandates strict latency timeouts on async dynamic holes to safeguard Time to First Byte (TTFB) and stream completion.

Blocks:Top-Level Dynamic Accessors and Naked Suspense Holes De-optimizing Static Edge Shells and Triggering Hydration Shifts
Targets:Cursor•Claude•Windsurf•Codex
react-19-multitab-optimistic-ledger-reconciliation
frontendcritical

React 19 Multi-Tab Optimistic Action Ledger Reconciliation via Web Locks and BroadcastChannel

Enforces a transactional, monotonic action ledger across decoupled browser tabs using the Web Locks API and BroadcastChannel to govern React 19 optimistic updates. Guarantees deterministic rollback, prevents split-brain state divergence, and maintains eventual consistency across concurrent sessions during asynchronous server mutations and network failures.

Blocks:Decoupled Multi-Tab Divergence via Uncoordinated In-Memory Optimistic Mutations and Silent Remote Tab Failure
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-fallback-boundary
frontendcritical

Next.js 15 PPR Shell Fallback Boundary & Static Shell Isolation

Next.js 15 Partial Prerendering (PPR) combines static build-time shell delivery with dynamic HTTP streaming. Any request-bound dynamic API (such as cookies(), headers(), dynamic route parameters, or un-cached data fetching) accessed outside an explicit React Suspense boundary causes the static shell to block, destroying initial Byte-to-First-Chunk streaming guarantees. This standard mandates strict boundary encapsulation for all dynamic operations.

Blocks:Awaiting Dynamic APIs in Top-Level Page Shells Without Suspense Boundaries in PPR Routes
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-module-state-isolation
frontendcritical

Svelte 5 Runes Server-Side Module State Isolation Standard

Disallows root-level module-scoped $state and $derived runes in universal and server-evaluated files to prevent cross-request tenant memory pollution during Server-Side Rendering (SSR). In persistent runtime processes like Node.js, Bun, or Cloudflare Workers, module-level state survives individual request lifecycles and leaks sensitive tenant data across concurrent clients. All reactive state evaluated during SSR must be strictly scoped to the request lifecycle via Svelte Context or factory functions.

Blocks:Module-Scoped Top-Level $state in SSR Modules Causing Cross-Tenant Data Leakage
Targets:Cursor•Claude•Windsurf•Codex
angular-19-defer-signal-decoupling-standard
frontendcritical

Angular 19 Signal-Based Defer Hydration Dependency Decoupling Standard

Prevents client hydration deadlocks, circular signal evaluation cycles, and DOM layout thrashing during incremental hydration in Angular 19. Mandates strict decoupling between reactive signals driving @defer triggers (hydrate/when) and the internal signals consumed inside deferred component subtrees. Eliminates premature bundle fetching and hydration waterfalls caused by shared signal graph contamination across boundary scopes.

Blocks:Coupling @defer trigger conditions with internal component signal trees causing hydration deadlocks and bundle bloat
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-optimistic-error-convergence
frontendcritical

React 19 useOptimistic Mutation Error State Convergence Invariant

Enforces deterministic state reconciliation between optimistic UI branches and server rejection states in React 19. Guarantees that optimistic mutations strictly derive from authoritative base states inside React Transitions to eliminate phantom client states during network failures, retries, and race conditions.

Blocks:Detached Optimistic Mutation with Unsynchronized Error Rollback and Phantom State Drift
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-boundary-isolation-standard
frontendcritical

Svelte 5 Runes SSR Boundary and Cross-Request Memory Isolation Guardrail

Mandates deterministic request isolation in Svelte 5 applications by strictly forbidding module-scoped mutable rune state in SSR runtime environments. Enforces per-request context providers and factory-instantiated state boundaries to eliminate cross-request state pollution and race conditions during high-concurrency Node.js and Bun SSR hydration.

Blocks:Module-Level $state() Singletons Leaking User Sessions Across Concurrent SSR Requests
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-optimistic-reconciliation-guardrail
frontendcritical

React 19 useActionState Optimistic UI Reconciliation and State Tearing Shield

Guarantees strict transactional consistency between useActionState and useOptimistic across concurrent asynchronous transitions. Prevents state tearing, phantom rollbacks, and race-condition regressions caused by out-of-order network resolutions via monotonically increasing transition sequencing and deterministic server state reconciliation.

Blocks:Interleaving Async Transitions Overwriting Fresh Optimistic State with Out-of-Order Stale Action Snapshots
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-signal-teardown-boundary-invariant
frontendcritical

Svelte 5 Runes Signal Graph Boundary Teardown and Memory Isolation

Mandates deterministic signal graph isolation and explicit $effect.root lifecycle containment for non-component reactive states across micro-frontend (MFE) boundaries. Prevents detached signal nodes, circular subscriber retention, and memory leaks caused by unbounded runes instantiations across independent host and remote runtime contexts.

Blocks:Unbounded Signal Graph Instantiation Across Isolated Host-Remote Lifecycle Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-io-leakage-guardrail
frontendcritical

Next.js 15 Partial Prerendering Dynamic I/O Leakage Guardrail

Enforces strict isolation between static pre-rendered CDN shells and dynamic request-time boundaries under Next.js 15 Partial Prerendering (PPR) and Dynamic I/O. Prevents silent inclusion of personalized data into shared cache artifacts by requiring runtime storage access (headers, cookies, searchParams, uncached I/O) to be contained within explicit Suspense boundaries and async dynamic contracts.

Blocks:Leaking Request-Scoped State into Static Prerendered Shells via Unbounded Dynamic Access
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-untrack-effect-boundary-standard
frontendcritical

Svelte 5 Runes: Explicit Untrack Boundaries in Reactive Effects

Enforces strict dependency isolation within Svelte 5 reactive effects by requiring explicit untrack boundaries for non-triggering state reads. In Svelte 5, $effect synchronously tracks all fine-grained signals accessed during execution, predisposing systems to catastrophic re-trigger cascades and cyclic graph thrashing if passive reads are left unbounded. Wrapping ambient reads, logging metadata, and external callbacks in untrack() ensures effects trigger deterministically only on explicit, intentional dependency shifts.

Blocks:Implicit Dependency Leakage and Cyclic Loop Explosions via Unbounded Signal Reads inside $effect
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-isolated-runtime-boundary
frontendcritical

Strict Isolation of Client, Server, and Edge Runtime Environments in Vite 6

Enforces strict runtime module isolation using the Vite 6 Environment API across client, SSR node, and edge runtimes. Prevents cross-environment module graph leakage, prototype pollution, and execution of server secrets in client bundles during development HMR and production compilation.

Blocks:Cross-Environment Module Graph Leakage and Unbound Shared State via Legacy ssrLoadModule
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler-strict-structural-immutability
frontendcritical

React 19 Compiler Strict Structural Immutability Guardrail

The React 19 Compiler relies on strict structural immutability across component render passes to synthesize fine-grained auto-memoization blocks and safe reactive scopes. Mutating props, hook returns, or intermediate state in-place violates the compiler's escape analysis assumptions, silently de-optimizing the memoization graph and inducing tearing or stale render cycles. All state transitions, array operations, and prop transforms must strictly adhere to functional updates, pure transformations, or non-destructive copying primitives.

Blocks:In-place mutation of props, hook return values, or referenced state that invalidates React 19 compiler memoization boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-after-lifecycle-isolation-guardrail
frontendcritical

Next.js 15 after() Async Context Lifecycle Isolation & Bounded Execution

Mandates that all post-response asynchronous side-effects in Next.js 15 Route Handlers and Server Actions use `after()` with deterministic timeout bounds and explicit error containment. Prevents frozen unhandled promises, container memory leaks, and runaway serverless compute billing caused by naked detached tasks.

Blocks:Spawning detached floating promises or unbounded async tasks in `after()` that trigger billing timeouts and leak serverless contexts.
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-vite-6-environme-276
frontendcritical

Vite 6 Environment API Multi-Runtime SSR Module Graph Isolation

Enforces strict module graph and runtime isolation using the Vite 6 Environment API across heterogeneous deployment targets (browser, Node.js, and Edge/workerd). Prevents non-deterministic module resolution, runtime global pollution, and cross-runtime cache poisoning during unified full-stack compilation.

Blocks:Cross-contaminating runtime globals and unpartitioned module graphs via legacy monolithic Vite SSR APIs.
Targets:Cursor•Claude•Windsurf•Codex
react-19-concurrent-activity-boundary-preservation
frontendcritical

React 19 Concurrent Activity Boundary State Preservation Standard

Governs state preservation, effect lifecycle invariants, and DOM isolation within React 19 Concurrent Activity boundaries. Enforces idempotent effect cleanups, prevents uncommitted background fiber side-effect leaks, and eliminates state desynchronization during hidden pre-rendering and route transitions.

Blocks:Leaking background subscriptions or corrupting external state during hidden Activity boundary lifecycles
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-unhandled-promise-isolation
frontendcritical

Next.js 15 Async Request Context Boundary & Unhandled Promise Isolation

Enforces deterministic resolution and strict boundary isolation for Next.js 15 asynchronous request APIs (cookies, headers, params, and searchParams). Prevents dynamic AsyncLocalStorage context detachment, worker thread deadlocks, and unhandled promise rejections caused by floating promises crossing request lifecycle boundaries.

Blocks:Leaking Unresolved Dynamic Request Promises Across Async Boundaries or Background Tasks
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-key-guardrail-react-19-server--856
frontendcritical

React 19 Server Actions Client Idempotency Keys & Optimistic Rollback Standard

Enforces mandatory client-generated cryptographic idempotency keys and resilient rollback state boundaries for all mutating React 19 Server Actions. Guarantees that concurrent action replays, automated browser retries, and network reconnection storms cannot duplicate non-idempotent server-side side effects.

Blocks:Executing Non-Idempotent Server Actions Without Client-Seeded Cryptographic Tokens and Optimistic State Reconciliation
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-segregation-standard
frontendcritical

Vite 6 Environment API Multi-Runtime Module Segregation Standard

Enforces strict module evaluation boundaries and environment isolation across Node.js, workerd, and edge runtimes in Vite 6 multi-environment setups. Prevents ambient Node globals, un-isolated Vite transform pipelines, and shared module graphs from leaking platform-specific capabilities across heterogeneous execution contexts.

Blocks:Cross-Runtime Global Leakage and Shared Module Graph Contamination in Heterogeneous Vite 6 Environments
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-boundary-quarantine
frontendcritical

Next.js 15 PPR Dynamic Fallback Boundary Quarantine

Mandates strict architectural quarantine for dynamic component trees under Next.js 15 Partial Prerendering (PPR). Prevents dynamic API calls (headers, cookies, connection, and uncached data fetching) from poisoning prerendered static edge shells during prefetch and initial render passes.

Blocks:Unconfined Dynamic Execution Leaking Beyond Suspense Boundaries During Edge Prefetch
Targets:Cursor•Claude•Windsurf•Codex
speculation-rules-prerender-isolation-standard
frontendcritical

Speculation Rules API Prerender Sandbox & Credential Isolation Standard

Enforces strict origin isolation, side-effect gating, and ephemeral partition boundaries for Speculation Rules API prerender candidates. Prevents side-channel timing attacks, cross-origin unpartitioned credential exfiltration, and premature invocation of stateful mutations during hidden speculative rendering.

Blocks:Unbounded Cross-Origin Prerender Injection and Ungated Lifecycle Mutation Side-Effects
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-taint-cryptographic-boundary
frontendcritical

React 19 RSC Cryptographic Boundary & Tainted Values Quarantine

Enforces strict isolation of cryptographic keys, sensitive credentials, and unhashed tokens within React 19 Server Components using experimental_taintUniqueValue and experimental_taintObjectReference. Guarantees that private server-side security primitives are never serialized across the RSC Flight protocol to client component trees.

Blocks:Exposing Raw Cryptographic Material and Plaintext Secrets to RSC Client Serialization Payloads
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-distributed-cache-stampede-mutex
frontendcritical

Next.js 15 Distributed Cache Stampede Mutex Invariant

Enforces distributed atomic locking with soft-lease mechanics across multi-region serverless runtimes during Next.js 15 Incremental Cache revalidation. Prevents catastrophic thundering herd database collapse by ensuring exactly one worker recomputes expired cache keys while concurrent serverless invocations serve soft-stale payloads.

Blocks:Uncoordinated Multi-Region Serverless Revalidation Triggering Database Connection Saturation and Outages
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-effect-scope-lifecycle-invariant
frontendcritical

Svelte 5 Runes Reactive Effect Scope Lifecycle and Cleanup Invariant

Enforces strict scope boundaries and deterministic teardown for Svelte 5 $effect and $effect.root runes in long-lived client microfrontends. Guarantees that asynchronous operations, streaming subscriptions, and fine-grained signal dependencies register synchronous cleanup routines to prevent memory retention and detached subtree execution.

Blocks:Dangling Asynchronous Event Subscriptions and Unbounded Memory Leaks via Implicit Effect Context Loss
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-lifecycle-effect-root-teardown
frontendcritical

Svelte 5 Runes Async Lifecycle & $effect.root Teardown Standard

Enforces deterministic teardown of reactive dependencies and effects across asynchronous execution contexts and non-component modules in Svelte 5. Prevents catastrophic client-side memory leaks and zombie listeners caused by orphaned effects spawned across microtask boundaries or outside owner hierarchies.

Blocks:Orphaned Reactive Effects via Async Microtasks and Unscoped Non-Component Root Subscriptions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-ppr-suspense-boundaries
frontendcritical

Mandatory Suspense Encapsulation for Next.js 15 Dynamic IO and PPR

Enforces that any uncached runtime data access, dynamic APIs (headers, cookies, searchParams), or uncached database operations under Next.js 15 dynamicIO/Partial Prerendering (PPR) are encapsulated within dedicated, isolated React Suspense boundaries. Prevents runtime de-optimization cascades where an uncached operation at a page or root layout level bubbles up and forces an entire static shell into dynamic runtime execution.

Blocks:Leaking Dynamic IO and Runtime APIs to Page-Level Shells De-optimizing Static Partial Prerendering
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-cascading-abort-propagation
frontendcritical

React 19 Server Actions Cascading AbortController Propagation Standard

Enforces deterministic client-to-server cancellation signal propagation across distributed React 19 Server Action boundaries. Prevents orphan execution threads, database connection exhaustion, and non-deterministic state mutations when users navigate away or unmount pending UI transitions.

Blocks:Fire-and-forget Server Action dispatch without cascading client abort signals to downstream upstream services
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-polymorphic-snippet-layout-reentrancy-invariant
frontendcritical

Svelte 5 Snippet Monomorphism & Layout Re-entrancy Invariant

Enforces strict monomorphic parameter signatures and non-reentrant termination guards for Svelte 5 Snippets within layout trees. Polymorphic snippet parameter bags and dynamically mutated slot contracts induce V8 hidden-class deoptimizations (megamorphic call sites) and trigger runaway microtask loops through recursive signal invalidations.

Blocks:Ad-Hoc Polymorphic Snippet Arguments and Unguarded Recursive Snippet Invocation
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-optimistic-rollback-reentrancy-invariant
frontendcritical

React 19 Optimistic Action Atomic Re-entrancy & Monotonic Rollback Invariant

Enforces atomic, monotonically sequenced rollback handling within React 19 concurrent Actions and useOptimistic primitives. Guarantees that out-of-order completion or rejection of concurrent asynchronous actions does not corrupt optimistic UI state or induce stale re-render cascades.

Blocks:Ad-Hoc Imperative State Clobbering and Unsequenced Rollbacks in Concurrent React 19 Transitions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-streaming-boundary
frontendcritical

Next.js 15 PPR Shell Isolation and Zero-Waterfall Streaming Guardrail

Next.js 15 Partial Prerendering (PPR) requires strict architectural isolation between prerendered static layout shells and dynamic server streams. Awaiting dynamic runtime data (headers, cookies, searchParams, or uncached database calls) at the layout or root page level blocks static shell extraction and degrades edge TTFB beyond the 50ms threshold. All dynamic asynchronous operations must be encapsulated inside distinct leaf server components wrapped in explicit React Suspense boundaries.

Blocks:Awaiting Dynamic APIs or Data at the Route Root De-opting PPR Shell Generation
Targets:Cursor•Claude•Windsurf•Codex
vite-6-module-federation-runtime-singleton-deduplication
frontendcritical

Vite 6 Module Federation Runtime Singleton Deduplication Invariant

Enforces strict runtime singleton deduplication and asynchronous boundary bootstrapping in Vite 6 micro-frontend architectures. Prevents dual-instance framework execution, broken context providers, and split reactive runtimes when integrating independently deployed remotes and hosts.

Blocks:Dual-Instance Framework Execution and Split Contexts Caused by Unbound Vite MF Singletons
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-tainted-reference-isolation
frontendcritical

React 19 Server Components Tainted Reference Isolation for PII & Secrets

Enforces deterministic boundaries between React Server Components (RSC) and Client Components by mandating React 19 taint APIs (`experimental_taintUniqueValue` and `experimental_taintObjectReference`) on all sensitive entities. Prevents accidental serialization of database entity models, auth tokens, and personally identifiable information across network boundaries. Requires explicit data transfer object (DTO) projections before passing data to Client Components.

Blocks:Leaking Raw Database Records or Cryptographic Secrets to Client Components Across the RSC Wire Protocol
Targets:Cursor•Claude•Windsurf•Codex
vite6-runtime-environment-api-context-quarantine
frontendcritical

Vite 6 Runtime Environment API Context Quarantine & Multi-Runtime Isolation

Enforces complete execution isolation and zero global state pollution across concurrent SSR, Edge worker, and client runtimes using the Vite 6 Environment API. Mandates explicit DevEnvironment bindings, ModuleRunner abstraction, and AsyncLocalStorage context encapsulation over global namespace patching.

Blocks:Global Scope Mutation and Cross-Runtime Leaks via Legacy ssrLoadModule and Shared Singletons
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-hydration-barrier-guardrail
frontendcritical

Next.js 15 PPR Dynamic Boundary Isolation and Shell Invariant

Enforces strict isolation of dynamic runtime inputs (such as cookies(), headers(), and searchParams) within React Suspense micro-boundaries under Next.js 15 Partial Prerendering (PPR). Guarantees a deterministic static outer layout shell during build time while preventing cascading dynamic de-optimization, hydration mismatches, and premature fallback triggers across server components.

Blocks:Dynamic Context Leakage into Static PPR Shell Inducing Entire-Route SSR Downgrade
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-concurrent-abort-propagation
frontendcritical

React 19 Concurrent Server Action AbortSignal Propagation & Reentrancy Guard

Enforces deterministic cancellation and disposal of inflight Server Action micro-tasks and downstream upstream fetch pipelines during rapid user transitions. Prevents out-of-order state overwrites and dangling backend executions by coupling React 19 transition lifecycles with explicit AbortController instances.

Blocks:Unbounded concurrent Server Action execution causing race-condition state corruptions via out-of-order resolution
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-context-isolation-guardrail
frontendcritical

Next.js 15 Dynamic I/O Async Request Context Isolation Standard

Enforces strict isolation boundaries around Next.js 15 asynchronous dynamic request APIs (cookies, headers, connection, searchParams) under Dynamic I/O. Prevents dynamic contagion across static React Server Component (RSC) trees by mandating leaf-level isolation, Suspense encapsulation, and explicit boundary containment.

Blocks:Unbounded Dynamic Contagion via Top-Level Awaited Request Context in Static RSC Trees
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-dynamic-signal-cleanup-invariant
frontendcritical

Svelte 5 Runes Dynamic Signal Tree Memory Leak & Effect Disposal Invariant

Mandates deterministic teardown and lifecycle anchoring for dynamic signals, derived computations, and effects created across deeply nested component trees and state modules in Svelte 5. Prevents silent memory accumulation, detached reactive subscriber trees, and zombie microtask execution caused by uncontained signal instantiations.

Blocks:Escaping Svelte 5 Component Effect Hierarchy via Unbound Dynamic Signals and Undisposed $effect.root Allocations
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-api-cache-isolation
frontendcritical

Next.js 15 Async Request Context & Cache Boundary Isolation

Next.js 15 converts request primitives (cookies, headers, params, searchParams) to asynchronous Promises and enforces dynamic boundaries. Strict isolation must be maintained between async request context primitives and static/shared caching layers (such as unstable_cache) to prevent cross-tenant data leakage and cache poisoning.

Blocks:Accessing Dynamic Request Primitives Inside Shared Cache Callbacks or Unkeyed Shared Fetches
Targets:Cursor•Claude•Windsurf•Codex
vite6-module-federation-hmr-state-reconciliation
frontendcritical

Vite 6 Module Federation Hot Module Replacement (HMR) State Reconciliation Guardrail

Enforces deterministic cross-remote module graph invalidation, isolated boundary lifecycle disposal, and synchronized runtime registry cleanup during Hot Module Replacement (HMR) in Vite 6 Module Federation architectures. Eliminates cascade invalidation loops, memory leaks from dangling host listeners, and catastrophic full-page reloads when shared dependencies or exposed federation modules are updated in development mode.

Blocks:Cascade Boundary Invalidation and Leaked Remote State Causing Cyclic Hard Refreshes in Vite 6 MF
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-environment-sharding-standard
frontendcritical

Vite 6 Rolldown Environment-Scoped Module Sharding Standard

Enforces strict compile-time runtime isolation between client, server, and worker graphs under the Vite 6 Environment API and Rolldown bundler. Prohibits cross-environment symbol bleed, insecure conditional imports relying on runtime presence checks, and shared barrel exports that leak server-only secrets or database primitives into browser manifests. Mandates compile-time condition sharding, environment module manifests, and strict virtual boundary checks.

Blocks:Leaking Server Credentials and Secrets via Unisolated Runtime-Guarded Barrel Imports Across Vite 6 Environments
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-transition-idempotency
frontendcritical

React 19 useActionState Deterministic Client Idempotency Guardrail

Enforces deterministic, pre-transition generation of client idempotency keys when pairing React 19 useActionState with optimistic rendering. Prevents duplicate mutations and split-brain state desynchronization caused by re-generating UUIDs inside re-entrant async actions or concurrent render passes during network retries.

Blocks:Generating Nonce or Idempotency Keys Inside Re-Entrant Actions or Volatile Render Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-reactive-proxy-teardown-invariant
frontendcritical

Svelte 5 Fine-Grained Reactive Proxy Teardown and Lifetime Scoping Invariant

Enforces deterministic subscriber disposal and boundary isolation for shared mutable $state proxies in Svelte 5. Prevents catastrophic client-side memory retention caused by module-level reactive singletons capturing component scope closures without explicit teardown during client-side navigation.

Blocks:Module-Level $state Proxies Leaking Retained Component Scopes Across Route Transitions
Targets:Cursor•Claude•Windsurf•Codex
vite-6-module-federation-sri-csp-guardrail
frontendcritical

Vite 6 Module Federation Dynamic Remote SRI & CSP Nonce Guardrail

Dynamic micro-frontend remote container resolution under the Vite 6 runtime environment must enforce automated Subresource Integrity (SRI) hashing and Content Security Policy (CSP) nonce synchronization. Omitting cryptographic hash validation on dynamically loaded remote entry bundles exposes host applications to supply-chain tampering and remote-code execution via compromised CDN edges.

Blocks:Arbitrary Dynamic Remote Script Injection Without SRI Verification or CSP Nonce Binding
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-hole-cache-fence
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Hole Cache Fence

Enforces strict tenant isolation and credential segregation within Next.js 15 Partial Prerendering (PPR) architectures. Prevents cross-request session poisoning and unintended build-time evaluation of per-user identity contexts by fencing dynamic user data within Suspense boundaries wrapped in dynamic request boundaries. Guarantees that static shell segments remain context-agnostic, while tenant-specific, cookie-dependent, or header-dependent payloads execute exclusively inside deferred dynamic streaming holes.

Blocks:Leaking Multi-Tenant Identity Contexts into the Pre-rendered Static Shell or Prematurely Collapsing PPR into Full Dynamic Rendering
Targets:Cursor•Claude•Windsurf•Codex
vite6-multi-runtime-hydration-integrity
frontendcritical

Vite 6 Environment API Multi-Runtime Hydration Integrity and Module Isolation Guardrail

Enforces deterministic module evaluation, condition resolution, and state isolation across heterogeneous runtime targets (Node.js, Edge Workers, and Browser) via the Vite 6 Environment API. Prevents cross-environment module graph leakage, single-binary state contamination, and runtime-induced hydration discrepancies during simultaneous multi-runtime builds.

Blocks:Cross-Runtime Module Graph Contamination and Non-Deterministic Hydration Failure
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-module-isolation-guardrail
frontendcritical

Vite 6 Environment API Runtime Module Isolation Barrier

Enforces strict compile-time and runtime module isolation across heterogeneous Vite 6 environments (client, ssr, edge). Prevents Node.js built-ins, privileged server SDKs, and sensitive server-only variables from leaking into browser or edge module subgraphs during isomorphic full-stack builds.

Blocks:Leaking Server Privileges and Node.js Runtimes into Browser Bundles via Legacy Monolithic SSR Configs
Targets:Cursor•Claude•Windsurf•Codex
react19-server-action-idempotency-key-transport-standard
frontendcritical

React 19 Server Action Idempotency-Key Deterministic Transport Standard

Enforces deterministic client-generated idempotency tokens across React 19 Server Action transitions and form submissions to prevent duplicate database writes under automated network retries and double-submit scenarios. Requires pairing React 19 useActionState/useTransition with client-side UUID generation persisted across failed or in-flight attempts, validated and cached on the server via atomic distributed locks before mutation execution.

Blocks:Ephemeral Server Action Invocations Lacking Client-Side Idempotency Tokens Permitting Duplicate Mutations Under Retry
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-dynamic-boundary-guardrail
frontendcritical

Next.js 15 Async Request APIs & Dynamic PPR Boundary Guardrail

Next.js 15 enforces asynchronous access for runtime dynamic inputs (cookies, headers, params, and searchParams) to decouple prerendered static shells from dynamic request execution. Synchronously accessing these APIs or awaiting them directly at the root page/layout level without Suspense isolation causes unhandled promise rejections, breaks Partial Prerendering (PPR), and triggers silent de-optimization of static routes into full-page on-demand SSR.

Blocks:Synchronous Dynamic API Invocation and Top-Level Shell Dynamic Unwrapping
Targets:Cursor•Claude•Windsurf•Codex
rolldown-deterministic-module-chunking-invariant
frontendcritical

Rolldown Deterministic Module Chunking & Federated Edge Invariant

Enforces byte-for-byte reproducible bundle hashes, topological module ordering, and shared-dependency singleton deduplication across federated Vite 6 and Rolldown edge builds. Prevents module identity drift, dual-package hazard at runtime edge nodes, and volatile chunk graph invalidations caused by non-deterministic dynamic chunk allocation.

Blocks:Non-Deterministic Dynamic Chunk Splitting and Platform-Dependent Path Ingestion
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-key-pipeline
frontendcritical

React 19 Server Actions Idempotency Key Pipeline & Deduplication Invariant

Enforces an atomic idempotency key pipeline across React 19 Server Actions, useActionState, and optimistic UI updates. Guarantees that network drops, rapid-fire user submissions, and automatic transport retries never trigger duplicate writes, unauthorized double-billing, or corrupted transactional state.

Blocks:Blind Mutation Dispatch Without Cryptographic Idempotency Headers or Distributed Deduplication Locking
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-isolation-production-standard
frontendcritical

Vite 6 Environment API Module-Graph Isolation Standard

Enforces strict module-graph separation and runtime-targeted execution via Vite 6 Environment APIs across browser, SSR, and edge environments. Prevents cross-runtime state leakage, invalid Node.js/browser primitive cross-contamination, and shared plugin cache corruption during multi-runtime builds.

Blocks:Monolithic Module Graph Traversal and Shared Plugin State Across Disparate Runtime Environments
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-action-origin-host-binding
frontendcritical

Strict Cryptographic Origin and Host-Header Binding for Next.js 15 Server Actions

Enforces deterministic origin and host-header verification inside Next.js 15 Server Action invocations and edge proxy middleware to neutralize multitenant Host-header poisoning, cross-site action execution, and CDN edge cache pollution. Next.js 15 performs basic origin matching against the Host header, but multi-tenant deployments behind reverse proxies, CDNs, or custom domains require strict cryptographic whitelist validation against an absolute tenant authority.

Blocks:Trusting Implicit Framework CSRF Checks on Next.js 15 Server Actions in Multi-Tenant CDN Topologies
Targets:Cursor•Claude•Windsurf•Codex
react19-server-action-optimistic-interruption-invariant
frontendcritical

Deterministic Optimistic Rollback Invariant for Concurrent React 19 Server Actions

Guarantees deterministic rollback of client-side optimistic UI state without DOM tearing, state leakage, or flash-of-stale-content (FOSC) during rapid concurrent React 19 Server Action dispatches and cancellations. Mandates strict isolation of transition boundaries using useOptimistic paired with canonical action transitions and cancellation tokens rather than unmanaged client state synchronization.

Blocks:Unsynchronized useState and un-sequenced useOptimistic updates causing state desynchronization and tearing during aborted Server Actions
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-cryptographic-idempotency-react-19-server--258
frontendcritical

React 19 Server Actions Cryptographic Idempotency & Stream Replay Standard

Enforces deterministic cryptographic idempotency and atomic replay guards for all mutating React 19 Server Actions over progressive HTTP/3 streams. Prevents duplicate execution, financial double-spend, and corrupted state trees caused by QUIC connection migrations, network drops, and aggressive browser auto-retries during partial stream emissions.

Blocks:Blind mutating Server Actions vulnerable to HTTP/3 QUIC connection retry replays and unkeyed double-execution
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler-reference-purity-guardrail
frontendcritical

React 19 Compiler Reactive Reference Purity and Immutability Guardrail

Enforces strict mathematical purity, reference stabilization, and structural immutability in React 19 environments utilizing the React Compiler (React Forget). Prevents accidental escape hatches, mutable state aliasing, and render-phase side effects that de-optimize the compiler's intermediate representation (HIR) and trigger catastrophic memoization invalidation cascades across the component tree.

Blocks:In-Place Mutation and Non-Pure Reference Escapes Bypassing React Compiler SSA Optimization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-state-leakage-guardrail
frontendcritical

Svelte 5 Runes Context Isolation Guardrail for Universal SSR State

Enforces strict isolation of Svelte 5 reactive state in multi-tenant SSR runtimes by prohibiting top-level module-scoped $state() singletons in universal modules. Eliminates cross-request data pollution by mandating scoped dependency injection via getContext/setContext or per-request factory lifecycles.

Blocks:Module-Scoped Reactive Singletons Causing Cross-Tenant Data Leakage in Concurrent SSR Runtimes
Targets:Cursor•Claude•Windsurf•Codex
react-19-activity-suspense-restoration-guardrail
frontendcritical

React 19 Activity Offscreen Suspense Restoration Standard

Enforces strict layout measurement isolation and effect lifecycle guards when utilizing React 19 Activity primitives for backgrounded subtrees. Prevents cascading synchronous reflows, ResizeObserver thrash loops, and destructive DOM ref destruction during hidden-to-visible transitions. Guarantees deterministic DOM state restoration, scroll persistence, and stable hydration across concurrent boundaries.

Blocks:Unconditioned Layout Observers and Unstable Effect Lifecycles in Backgrounded Activity Subtrees
Targets:Cursor•Claude•Windsurf•Codex
webgpu-compute-pipeline-memory-synchronization-barrier
frontendcritical

WebGPU Compute Pipeline Memory Synchronization and Pass Transition Guardrail

Enforces deterministic memory coherence across dependent compute dispatches during client-side WebGPU parallel ML inference. WebGPU does not guarantee write-after-read (WAR), read-after-write (RAW), or write-after-write (WAW) coherence between dispatches within the same compute pass. Engineers must separate dependent kernel dispatches across explicit compute pass boundaries or command encoder transitions to introduce hardware-level execution and memory barriers.

Blocks:Consecutive Dispatches Sharing Read-Write Storage Buffers Within a Single Compute Pass
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-dedup-rollback-production-standard
frontendcritical

React 19 Server Action State-Deduplication & Optimistic Rollback Invariant

Enforces deterministic client-side optimistic state reconciliation and prevents double-commit mutations during concurrent React 19 Server Action executions. Mandates client-generated idempotency keys, monotonic sequencing, and strict rollback guards across volatile network transitions to ensure out-of-order responses do not corrupt client or server state.

Blocks:Unsequenced optimistic mutations without client-side idempotency keys and error-reconciling rollback boundaries.
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-worker-ssr-memory-isolation
frontendcritical

Vite 6 Environment API Memory Pool Isolation for Worker SSR Runtimes

Enforces strict garbage collection boundaries and lifecycle isolation for Vite 6 ModuleRunner instances inside long-running Node.js worker pools and Edge SSR processes. Prevents cross-request module cache pollution, retained singleton graph leaks, and unbounded heap growth across concurrent SSR transactions.

Blocks:Global ModuleRunner Re-use and Unbounded Graph Caching in Long-Running SSR Worker Threads
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler-memoization-boundary-standard
frontendcritical

React 19 Compiler Auto-Memoization Escape Hatch Boundary Standard

Enforces strict boundary encapsulation when interfacing React 19 Compiler auto-memoized trees with non-idiomatic imperative references or external stores. Prevents silent compiler optimization bailouts, memoization cache thrashing, and cascading de-optimizations across deep component subtrees by isolating mutable state and imperative adapters at designated boundary points.

Blocks:Leaking Mutable External Subscriptions and Render-Time Ref Mutations into Auto-Memoized Component Subtrees
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-server-action-cryptographic-origin-binding
frontendcritical

Next.js 15 Server Action Cryptographic Host & Action-ID Binding Standard

Next.js 15 Server Actions expose implicitly addressable HTTP endpoints identified by dynamic action hashes. In multi-tenant and hardened zero-trust environments, actions must not rely solely on ambient cookie transport; they must cryptographically verify that the incoming Host/Origin, authenticated tenant boundary, and target Action ID match a signed, tamper-proof context token to eliminate blind CSRF, proxy-header spoofing, and cross-tenant replay attacks.

Blocks:Ambient Multi-Tenant State Mutation via Unbound Server Actions Without Origin-Tenant-Action Cryptographic Attestation
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-serialization
frontendcritical

React 19 useActionState Concurrent Transition Serialization and Micro-Task Reconciliation

Enforces strict monotonic sequencing and payload reconciliation for React 19 useActionState transitions across asynchronous micro-task boundaries. Prevents zombie state divergence, torn renders, and stale closure overwrite during high-concurrency client mutations by mandating monotonic flight identifiers and atomic transition wrappers.

Blocks:Unsequenced Async Mutation Dispatch Creating Out-of-Order Reconciliations and Zombie State Torn Renders
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-isolation-vite-6-environme-636
frontendcritical

Vite 6 Environment API Multi-Runtime Boundary Isolation Standard

Enforces strict compile-time module graph and symbol isolation across distinct runtime targets (client, edge/workerd, and Node SSR) using the Vite 6 Environment API. Prevents fatal runtime crashes and catastrophic security disclosures caused by native Node.js built-ins, private server credentials, or unpolyfilled symbols leaking into browser or edge worker distribution bundles.

Blocks:Shared SSR Module Graph Leaking Node Built-ins and Secrets into Edge and Client Bundles
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-signal-closure-detached-dom-quarantine
frontendcritical

Svelte 5 Snippet Signal Closure Detached DOM Quarantine Standard

Enforces strict boundary isolation and subscriber teardown for Svelte 5 snippets capturing reactive runes. Prevents invisible single-page application heap memory leaks caused by fine-grained signal dependency graphs pinning unmounted or detached DOM tree fragments in closure memory.

Blocks:Persisting Snippet Functions or Signal Closures Outside Active Ownership Lifecycles Leading to Detached DOM Tree Retention
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-effect-boundary-guardrail
frontendcritical

Svelte 5 Runes Asynchronous Effect Boundary & Micro-task Isolation Standard

Enforces strict synchronous dependency boundaries and deterministic lifecycle cancellations inside Svelte 5 $effect runes. Prevents silent dependency drop-offs across micro-task queues, state corruption from out-of-order promise resolutions, and memory leaks across dynamic island unmounts.

Blocks:Mutating state or consuming signals past asynchronous ticks without explicit untrack boundaries and cancellation teardowns in Svelte 5 runes.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-fallback-boundary-invariant
frontendcritical

Next.js 15 Partial Prerendering (PPR) Fallback Boundary Invariant

Enforces strict isolation of dynamic Server Components inside explicit React Suspense boundaries when Partial Prerendering (PPR) is enabled. Calling runtime dynamic APIs (cookies, headers, searchParams, un-cached data queries) outside a Suspense boundary de-optimizes the entire prerendered shell into blocking dynamic SSR, introducing waterfall cascades and hydration mismatches.

Blocks:Leaking Dynamic Request Contexts into Prerendered Shell Layouts Without Suspense Isolation
Targets:Cursor•Claude•Windsurf•Codex
react19-compiler-deterministic-memoization-closure-invariant
frontendcritical

React 19 Compiler Deterministic Memoization Closure Invariant Guardrail

Guarantees React 19 compiler auto-memoization stability by prohibiting non-serializable closure mutations, post-render object leakage, and impure closure escapes. Violating these invariants forces the compiler to invalidate reactive dependency memoization slots, triggering cascading subtree de-optimizations and uncontrolled re-renders.

Blocks:Mutating Closed-Over Scope Objects and Shared Render Targets Causing React Compiler Memoization Bailout
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-scope-cleanup-boundary
frontendcritical

Svelte 5 $effect.root Scope Cleanup Invariant in SSR Streaming

Enforces mandatory deterministic teardown of universal $effect.root scopes within server-side rendering (SSR) and streaming pipelines. Svelte 5 reactive scopes instantiated outside standard component hierarchies persist in the node process memory unless their teardown callback is invoked, causing cross-request data leaks and signal graph memory bloat.

Blocks:Instantiating unbounded $effect.root reactive scopes during SSR without lifecycle-bound teardown handlers.
Targets:Cursor•Claude•Windsurf•Codex
react-19-asset-preloading-style-precedence
frontendcritical

React 19 Asset Preloading & Style Precedence Invariant

Mandates explicit style precedence tiers via the 'precedence' prop and native 'react-dom' resource preloading APIs across all asynchronously streamed components. Guarantees deterministic CSS cascade ordering and eliminates Cumulative Layout Shifts (CLS) and Flash of Unstyled Content (FOUC) caused by out-of-order Suspense streaming.

Blocks:Omitting the 'precedence' attribute on linked stylesheets or using client-side DOM injection in useEffect during streaming renders
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-optimistic-rollback-concurrency
frontendcritical

React 19 Action Optimistic Rollback and Concurrency Invariant

Mandates monotonic sequence tagging and atomic state reconciliation across concurrent useOptimistic and useActionState microtask lifecycles. High-latency network transitions and out-of-order server action rejections must never allow stale microtasks to clobber concurrent in-flight states or trigger unquarantined error cascade unmounts.

Blocks:Unversioned In-Flight State Collisions and Global UI Teardown via Unbounded Concurrent Action Rollbacks
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-hydration-mismatch-quarantine-standard
frontendcritical

Svelte 5 Dynamic Snippet Hydration Mismatch Quarantine and State Isolation Standard

Mandates isolated client-repair boundaries and deterministic placeholder fallbacks for non-deterministic or deeply nested dynamic Svelte 5 snippets during SSR hydration. Prevents DOM tree invalidation cascades, root-level re-rendering, and reactive rune ($state) destruction when server-rendered markup diverges from client initialization.

Blocks:Unquarantined dynamic snippets consuming non-deterministic or client-only state during SSR, triggering cascade hydration mismatches and full component tree remounts.
Targets:Cursor•Claude•Windsurf•Codex
svelte5-async-effect-teardown-state-mirroring-invariant
frontendcritical

Svelte 5 Runes Async Effect Teardown and State Mirroring Invariant

Enforces deterministic signal disposal and prevents micro-memory leaks during async transitions in Svelte 5. Prohibits direct async executor callbacks in $effect runes and mandates AbortController-backed synchronous teardowns with cancellation checks before state mutation.

Blocks:Direct Async $effect Callbacks Swallowing Teardown Functions and Causing Out-of-Order State Mutations
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-vite-6-environme-469
frontendcritical

Vite 6 Environment API Cross-Runtime Module Isolation Barrier

Enforces strict physical isolation between client, server, and worker module graphs using the Vite 6 Environment API. Prevents runtime pollution, invalid cross-environment imports (such as Node.js built-ins leaking into edge or browser bundles), and shared mutable plugin state across compilation environments during multi-environment SSR builds.

Blocks:Cross-Runtime Module Graph Contamination via Legacy SSR Flags and Shared Plugin State
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-after-lifecycle-telemetry-draining-boundary
frontendcritical

Next.js 15 after() Deterministic Execution & Telemetry Draining Boundary

Next.js 15 introduces unstable_after/after to execute asynchronous background tasks after response transmission has finished. Because serverless runtimes terminate container instances immediately once all registered promises resolve, any unhandled promise rejections, missing execution timeouts, or unbound telemetry flushes will lead to silent process eviction, log truncation, and zombie connection leaks.

Blocks:Unbounded fire-and-forget background operations in after() causing runtime execution starvation and truncated telemetry flushes
Targets:Cursor•Claude•Windsurf•Codex
svelte5-derived-by-untracked-read-boundary
frontendcritical

Svelte 5 $derived.by Untracked Read Boundary Isolation

Enforces strict isolation of telemetry, logging, and side-channel diagnostic state access inside Svelte 5 `$derived.by` computation blocks using `untrack()`. Failure to wrap non-computational reads registers unwanted reactive dependencies in Svelte's reactive graph, causing re-computation loops and memory leaks.

Blocks:Implicit Tracking of Telemetry and Diagnostics in $derived.by Blocks
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-watermark
frontendcritical

React 19 Server Action Optimistic State Watermark Reconciliation Guardrail

Mandates monotonic sequence watermarking for all concurrent React 19 Server Actions interacting with optimistic UI state. Prevents out-of-order streaming server resolutions from stomping newer optimistic writes or executing stale rollbacks that corrupt user-perceived state.

Blocks:Unsequenced Concurrent Server Actions Causing Stale Overwrites and Phantom Rollbacks
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-hole-isolation
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Hole Hydration Boundary Isolation

Enforces strict isolation of dynamic data access within Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakage that de-optimizes static edge shell prerendering when accessing headers, cookies, or high-latency downstream microservices.

Blocks:Dynamic execution leakage poisoning the static PPR edge shell via uncontained runtime hooks or top-level promises
Targets:Cursor•Claude•Windsurf•Codex
react19-metadata-hoisting-sri-pinning
frontendcritical

React 19 Document Head Metadata Hoisting and Subresource Integrity Pinning

Enforces deterministic cryptographic Subresource Integrity (SRI) validation and explicit precedence tagging for dynamically hoisted stylesheets, scripts, and preloads in React 19. Prevents hydration mismatches, supply-chain script tampering, and unpinned layout shifts when the React runtime reconciles native DOM head tags against server-rendered asset manifests.

Blocks:Dynamic head hoisting without cryptographic hash validation or missing React precedence markers.
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-ssr-sandboxing-vite-6-environme-144
frontendcritical

Vite 6 Environment API Heterogeneous SSR Sandboxing Invariant

Enforces absolute module graph separation and runtime boundary isolation across client, Node SSR, and edge runtimes using Vite 6's Environment API. Eliminates leakage of server-only primitives, Node.js native built-ins, and secure credentials into client bundle targets or client HMR channels. Mandates environment-conditioned plugin execution and strict per-environment resolve conditions.

Blocks:Cross-Environment Module Graph Contamination and Server Primitive Leakage in Vite 6 SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte5-effect-root-microfrontend-disposal-invariant
frontendcritical

Svelte 5 Runes $effect.root Scope Disposal Invariant in Microfrontend Shells

Microfrontend hosts and dynamic adapters initializing Svelte 5 runtimes outside standard component hierarchies MUST encapsulate all manual reactive contexts within `$effect.root` and bind the returned teardown closure directly to the shell's unmount lifecycle. Failing to invoke root disposal locks signal dependency graphs into memory, producing zombie reactive triggers, event loop bloat, and unbounded heap growth during rapid mount/unmount cycles.

Blocks:Dangling $effect.root Allocations and Uncollected Reactive Contexts in Dynamic Shell Adapters
Targets:Cursor•Claude•Windsurf•Codex
react19-useactionstate-concurrent-transition-guardrail
frontendcritical

React 19 useActionState Concurrent Transition Reconciliation & Optimistic Serialization Standard

Enforces strict monotonic sequencing and reconciliation boundaries for React 19 useActionState and useOptimistic primitives when handling concurrent transition updates over overlapping entity trees. Prevents out-of-order execution, stale state regressions, and flash-of-stale-content (FOSC) artifacts caused by uncoordinated async Server Actions. Mandates explicit transition boundaries and transactional rollback reconciliation vectors.

Blocks:Overlapping Independent useActionState Actions Cause Stale Closures and Optimistic UI Tearing
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-stream-isolation
frontendcritical

Next.js 15 PPR Shell-Stream Cache Boundary and Header Isolation

Enforces deterministic boundaries between the static prerender shell and runtime streaming chunks under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakage into the prerender phase and prohibits ambient dynamic read contamination across React Suspense boundaries, eliminating cache stampedes and sensitive credential/header exposure in CDN-cached shells.

Blocks:Accessing Uncached Dynamic Contexts Outside Suspense Boundaries in PPR
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-worker-sandbox-isolation
frontendcritical

Strict Vite 6 Environment API Multi-Runtime Memory and Process Boundary Guardrail

Enforces isolated execution boundaries across Vite 6 Environment API runtimes by decoupling Node.js host servers from edge-worker virtual environments. Prevents cross-realm prototype pollution and non-public environment variable leakage through strict runtime boundary segregation and explicit runner configuration.

Blocks:Executing edge worker runtimes within the Node.js root SSR execution context sharing global scope and process.env
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-invariant
frontendcritical

Next.js 15 Partial Prerendering (PPR) Shell and Dynamic Stream Isolation

Enforces strict architectural isolation between static prerendered HTML shells and dynamic request-time streaming slots in Next.js 15. Prevents edge cache poisoning, dynamic de-opt cascade, and client-side hydration mismatches caused by invoking dynamic APIs outside of explicit React Suspense boundaries.

Blocks:Leaking Dynamic Request Context into Static Shell Roots Triggering Edge Cache Invalidation and Full-Route Dynamic De-optimization
Targets:Cursor•Claude•Windsurf•Codex
vite-rolldown-federation-boundary-isolation
frontendcritical

Vite 6 Rolldown Module Federation Chunk Boundary and Lifecycle Isolation

Enforces strict chunk boundary isolation and deterministic initialization sequencing across dynamic module federation remotes in Vite 6 with Rolldown. Prevents cyclic dependency deadlocks, shared singleton scope contamination, and cross-micro-frontend memory retention leaks through isolated async bootstrap fencing and explicit cleanup lifecycles.

Blocks:Unfenced Synchronous Federation Imports Inducing Rolldown Module Graph Deadlocks and Leaked Shared Scopes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-cache-barrier
frontendcritical

Next.js 15 Partial Prerendering (PPR) Streaming Cache Isolation Barrier

Enforces a strict architectural barrier between the pre-rendered static shell and runtime streaming Suspense boundaries in Next.js 15 PPR. Prevents dynamic request APIs and volatile cache tags from leaking into the pre-rendered shell, eliminating cache thrashing and route de-optimization.

Blocks:Dynamic Context Leakage Collapsing Next.js 15 PPR Static Shells into Full Dynamic SSR
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-boundary-standard-vite-6-environme-545
frontendcritical

Vite 6 Environment API Cross-Runtime Module Boundary & AST Virtualization

Enforces strict hermetic AST virtualization and module isolation across concurrent Browser, Edge Worker (WinterCG), and Node.js SSR runtime execution targets via the Vite 6 Environment API. Eliminates architectural leaks caused by legacy binary SSR assumptions and prevents cross-contamination of runtime-specific module graphs.

Blocks:Leaking Node.js Built-ins or Global Module Graph State into Edge and Client Runtimes via Legacy Binary SSR Assumptions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-store-isolation-barrier
frontendcritical

Next.js 15 Async Request Store Deterministic Isolation Barrier

Enforces synchronous context boundary separation for asynchronous headers(), cookies(), params, and searchParams in Next.js 15 concurrent streaming SSR. Prohibits global or module-scoped retention of dynamic request contexts to prevent cross-request memory contamination and race conditions during async microtask interleaving. Guarantees deterministic per-request execution frames using React Server Component boundaries and React 19 async unwrap primitives.

Blocks:Global Module-Level Hoisting and Synchronous Consumption of Dynamic Async Request Stores
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-runtime-module-isolation-boundary
frontendcritical

Vite 6 Environment API Runtime Module Isolation and Evaluation Boundary

Enforces strict runtime module graph isolation between Workerd, Node.js, and Client environments within Vite 6 multi-environment configurations. Prevents execution graph poisoning, cross-runtime prototype pollution, and illegal native binding leakage across heterogeneous SSR execution targets.

Blocks:Global Module Graph Leakage and Heterogeneous Runtime Pollution in Multi-Target Vite 6 SSR
Targets:Cursor•Claude•Windsurf•Codex
react19-server-action-taint-crypto-boundary
frontendcritical

React 19 Server Action Object Taint and Cryptographic Token Boundary

Enforces zero-trust payload boundaries across React Server Components and Server Actions by mandating React 19 experimental_taintObjectReference and experimental_taintUniqueValue on all data access layer (DAL) entities and cryptographic secrets. Prevents raw database objects, ORM records, and sensitive operational credentials from serializing into React Flight client protocol streams. Requires explicit, schema-validated Data Transfer Objects (DTOs) and HMAC-signed cryptographic tokens for any state traversing the client-server boundary.

Blocks:Returning raw ORM/DB entities or unsealed identifiers directly across Server Action boundaries without object tainting and explicit projection
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-cache-isolation
frontendcritical

Next.js 15 Dynamic I/O Speculative Execution and Cache Key Isolation Standard

Enforces strict boundary demarcation between speculative pre-rendering and dynamic runtime execution under Next.js 15 dynamicIO. Mandates explicit cryptographic tenant/user cache key derivation and prohibits unisolated ambient request context in 'use cache' directives to eliminate cross-request cache poisoning.

Blocks:Cross-Tenant Cache Poisoning via Ambient Context Leaks in 'use cache' Directives Under Speculative Execution
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-streaming-isolation
frontendcritical

Next.js 15 Async Request Context and Streaming Isolation Standard

Next.js 15 converts synchronous request APIs (cookies, headers, params, searchParams) to asynchronous Promises. Awaiting dynamic request context at root layouts or page components blocks Partial Prerendering (PPR), forces the entire component tree into dynamic SSR, and creates catastrophic initial streaming waterfalls.

Blocks:Awaiting Dynamic Request Promises at Component Roots Triggering Cascading Waterfalls and PPR Collapse
Targets:Cursor•Claude•Windsurf•Codex
react19-compiler-reference-identity-invariant
frontendcritical

React 19 Compiler Auto-Memoization Reference Identity Invariants for External Subscriptions

While the React 19 compiler automates memoization for internal JSX subtrees, it does not guarantee persistent object identity or referential stability across render passes when feeding external subscription stores, event emitters, or effect dependencies. Developers must decouple external synchronization targets from compiler-scoped reactive allocations to prevent cache thrashing and tearing in state stores.

Blocks:Relying on React 19 compiler auto-memoization to preserve stable reference identities for external store subscribers, Map keys, and effect dependency lists
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-boundary-next-js-15-async-935
frontendcritical

Next.js 15 Async Request Context Boundary Guardrail

Next.js 15 transitions dynamic request APIs (`headers()`, `cookies()`, `params`, and `searchParams`) to asynchronous Promises. Accessing these properties synchronously or binding them across asynchronous execution boundaries breaks the React Server Component (RSC) AsyncLocalStorage context and risks cross-request data leaks under concurrent dynamic rendering.

Blocks:Synchronous Request Context Access and Async Execution Boundary Leaks
Targets:Cursor•Claude•Windsurf•Codex
vite6-ssr-environment-isolation-barrier
frontendcritical

Vite 6 Environment API Heterogeneous SSR Runtime Isolation

Enforces strict runtime and module-graph boundary isolation across heterogeneous SSR execution targets (e.g., Workerd, Node.js, Deno) cohabiting a single Vite 6 dev server. Mandates dedicated DevEnvironment instances, eliminates legacy ssrLoadModule usage, and prevents cross-environment global singleton leakage.

Blocks:Cross-Runtime Module Graph Contamination & Deprecated ssrLoadModule Invocations in Heterogeneous SSR Dev Servers
Targets:Cursor•Claude•Windsurf•Codex
react19-action-state-hydration-interlock
frontendcritical

React 19 Action-State Hydration Interlock & Progressive Enhancement Queueing

Enforces strict transactional integrity during Progressive Enhancement by decoupling native multi-part form submissions from unhydrated Server Action closures. Forms utilizing React 19's `useActionState` and Server Actions must interlock submission events until the client runtime has fully hydrated action references, preventing race conditions, dual-submission anomalies, and lost client state transitions.

Blocks:Submitting unhydrated native forms during SSR bootstrap causing unhandled multi-part boundary desynchronization and orphaned client action state.
Targets:Cursor•Claude•Windsurf•Codex
react-19-activity-webgl-context-suspension
frontendcritical

React 19 Activity WebGL/WebGPU Context Suspension & Resource Teardown Invariant

Enforces proactive suspension of WebGL/WebGPU render loops and transient GPU memory deallocation when component subtrees transition into hidden React 19 Activity boundaries. Prevents host OS VRAM exhaustion, hardware context loss (webglcontextlost), and GPU thread starvation during background navigation.

Blocks:Leaking Active WebGL/WebGPU Contexts and Render Loops Inside Hidden React 19 Activity Subtrees
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-context-leak-guardrail
frontendcritical

Svelte 5 Polymorphic Snippet Lifecycle and Closure Retain Cycle Prevention

Mandates deterministic lifecycle management and closure scoping for polymorphic Svelte 5 snippets passed across reactive boundaries. Prevents detached DOM subtree retention and memory leaks caused by capturing lexical state in long-lived contexts during dynamic component unmounting.

Blocks:Retaining Detached Snippet Closures and Lexical State in Long-Lived Contexts
Targets:Cursor•Claude•Windsurf•Codex
react-19-metadata-hoisting-preload-deduplication
frontendcritical

React 19 Native Document Metadata Hoisting & Resource Preload Invariants

Enforces strict utilization of React 19 native document metadata hoisting (<title>, <meta>, <link>) and standard ReactDOM preload APIs (preload, preinit, preconnect) within render trees. Prevents runtime DOM mutation race conditions, SSR streaming head desynchronization, and hydration cascading waterfalls caused by legacy third-party head wrappers.

Blocks:Mutating Head via Legacy Head Managers or Imperative useEffect Injection
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-shell-boundary-standard
frontendcritical

Next.js 15 Partial Prerendering (PPR) Streaming Shell Boundary Guardrail

Enforces strict isolation between prerendered static layout shells and dynamic runtime components in Next.js 15 PPR. Dynamically evaluated APIs such as cookies(), headers(), searchParams, or dynamic uncached fetch requests must never bleed into root layout or page-level static contexts, guaranteeing near-zero edge TTFB via granular Suspense boundaries.

Blocks:Leaking Dynamic Accessors into Static Shell Layouts Deoptimizing PPR to Full SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-immutability-scope-isolation
frontendcritical

Svelte 5 Snippet Parameter Immutability & Scope Isolation

Enforces unidirectional data flow and strict parameter immutability within Svelte 5 snippets (`{#snippet ...}`). Prohibits mutating snippet-passed references or binding directly to external parent scopes from inside snippet blocks, which breaks reactive isolation boundaries and triggers cascading re-render loops or memory leaks across component boundaries.

Blocks:Mutating Snippet Arguments Directly or Creating Bidirectional State Couplings Across Snippet Closures
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-boundary-payload-isolation
frontendcritical

Next.js 15 PPR Dynamic Stream Isolation and Static Shell Invariant

Enforces strict isolation of dynamic runtime headers, cookies, and asynchronous flight data within React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakage into the pre-rendered static shell, eliminating non-deterministic microtask stalls and full-route dynamic de-optimization during high-concurrency stale-while-revalidate cycles.

Blocks:Unbounded Dynamic Operations Causing Static Shell De-optimization and Flight Payload Bleed
Targets:Cursor•Claude•Windsurf•Codex
vite-6-dynamic-mfe-dependency-quarantine-standard
frontendcritical

Vite 6 Dynamic Microfrontend Dependency Tree Isolation and Quarantine Standard

Enforces strict runtime module isolation, scoped dependency registries, and deterministic chunk deduplication across federated Vite 6 microfrontends. Prevents shared reactive core corruption (e.g., dual React Dispatcher instances, Vue reactive context splits) and unconstrained asynchronous vendor chunk collision across host and remote module boundaries.

Blocks:Leaking Global Module Singletons and Unquarantined Asynchronous Vendor Chunks Across Micro-App Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react19-use-action-state-optimistic-rollback-invariant
frontendcritical

React 19 useActionState & useOptimistic Transactional Rollback Invariant

Enforces deterministic transactional synchronization between Server Actions and client-side optimistic UI updates using React 19's useActionState and useOptimistic primitives. Eliminates state tearing, orphaned optimistic renders, and unhandled rejections during concurrent mutation failures by mandating wrapped action dispatchers and explicit rollback boundaries.

Blocks:Decoupled Optimistic Mutations Causing Permanent State Tearing on Server Action Failure
Targets:Cursor•Claude•Windsurf•Codex
vite6-module-runner-ssr-execution-isolation-standard
frontendcritical

Vite 6 Module Runner SSR Execution Context Isolation Standard

Enforces strict execution context isolation for Vite 6 Module Runner instances during server-side rendering (SSR). Prevents cross-request global singleton bleeding, uncollected module cache accumulation, and race conditions by isolating module evaluation within ephemeral worker threads or isolated runner environments.

Blocks:Reusing a single ModuleRunner instance or shared module cache across concurrent SSR requests
Targets:Cursor•Claude•Windsurf•Codex
react19-optimistic-action-mutation-boundary
frontendcritical

React 19 Deterministic Optimistic Action Mutation Boundary

Enforces deterministic reconciliation between client optimistic state via useOptimistic and idempotent server action responses under transient network failures. Guarantees that mutations executed inside useTransition or Server Form Actions remain transactional, prevent out-of-order state tearing, and rollback safely without ghost mutations or race conditions.

Blocks:Unbounded Optimistic State Mutations with Disjoint Local State Reconciliations and Non-Idempotent Server Actions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-cross-mfe-reactivity-bridge
frontendcritical

Svelte 5 Runes Cross-Microfrontend Reactive Graph Boundary Isolation

Enforces isolated signal graph destruction across micro-frontend boundaries using Svelte 5's $effect.root() and explicit teardown contracts. Prevents zombie subscriptions and detached DOM tree retention when reactive proxies bridge isolated runtime realms into a long-lived host shell.

Blocks:Leaking Cross-Boundary Svelte 5 Runes via Raw Proxies and Missing $effect.root Teardown
Targets:Cursor•Claude•Windsurf•Codex
svelte5-deep-reactive-proxy-fencing-state-raw
frontendcritical

Svelte 5 Deep Reactive Proxy Fencing ($state.raw) for High-Frequency Telemetry

Prevents catastrophic reactive proxy instantiation and garbage collection thrashing in Svelte 5 applications processing high-frequency data streams. Mandates the use of $state.raw for streaming telemetry, time-series arrays, and binary buffers to bypass recursive proxy wrapping. Enforces atomic reference reassignments rather than in-place deep property mutations.

Blocks:Unbounded Deep Proxy Wrapping of Ingested High-Frequency Stream Payloads via Standard $state()
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-transition-interruption-idempotency
frontendcritical

React 19 Action Transition Interruption and Optimistic State Reconciliation Standard

Enforces deterministic state reconciliation and idempotent mutation execution when concurrent React 19 asynchronous Action transitions are interrupted, canceled, or resolved out-of-order. Guarantees monotonic sequence tracking and atomic rollback safety across useActionState and useOptimistic boundaries.

Blocks:Out-of-Order Transition Settlement and Phantom State Overwrite in Async Server Actions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-universal-signal-microfrontend-federation-standard
frontendcritical

Svelte 5 Universal Signal Microfrontend State Federation Standard

Enforces strict signal boundaries and lifecycle synchronization across federated microfrontend remotes using Svelte 5 universal reactivity ($state, $derived, $effect.root). Prevents cross-runtime signal capture, cyclical batching cascades, and detached DOM memory leaks when microfrontends mount and unmount independently.

Blocks:Leaking Raw Svelte 5 Runes Across MFE Host-Remote Boundaries and Capturing Un-isolated Effects
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-action-multitenant-boundary-isolation
frontendcritical

Next.js 15 Server Action Host & Origin Cryptographic Tenant Boundary Isolation

Next.js 15 Server Actions in multi-tenant reverse proxy architectures must cryptographically bind incoming Origin and Host headers to the authenticated session's tenant scope. Failure to validate cross-tenant boundaries permits forged action executions, cross-tenant CSRF replays, and hostile tenant impersonation across shared root domains.

Blocks:Cross-Tenant Server Action Execution via Unvalidated Host/Origin Forwarding
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-after-context-drain-budget-standard
frontendcritical

Next.js 15 after() Post-Response Execution and Drain Budget Standard

Enforces deterministic wall-clock timeout caps, explicit AbortSignal propagation, and strict top-level error isolation for tasks scheduled via Next.js 15 after(). Prevents serverless runtime exhaustion, compute billing spikes, and unhandled process crashes during the post-response lifecycle.

Blocks:Unbounded, unshielded background promises inside after() exhausting platform drain budgets
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-hermeticity
frontendcritical

Vite 6 Environment API Multi-Runtime State Hermeticity Invariant

Vite 6 introduces multi-environment compilation (e.g., client, Node.js SSR, and Cloudflare Workerd/Edge) within a single pipeline. This invariant strictly enforces complete state and module hermeticity across concurrent runtimes and requests, prohibiting module-scope mutable singletons, enforcing `this.environment` context isolation in plugins, and securing request boundaries via runtime-native scoping like AsyncLocalStorage.

Blocks:Cross-Request State Contamination and Runtime Pollution via Shared Singletons in Vite 6 Universal Builds
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-boundary-isolation-standard
frontendcritical

Svelte 5 Runes Cross-Island Reactive Boundary Isolation Standard

Enforces strict boundary encapsulation and lifecycle disposal for Svelte 5 reactive graphs operating across micro-frontend islands. Prevents cross-context memory leaks and uncontrolled cascade loops by prohibiting shared mutable $state proxies and uncontained reactive subscriptions across isolated runtime contexts.

Blocks:Leaking Raw Mutable $state Proxies and Detached $effect Subscriptions Across Micro-Frontend Island Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-action-cryptographic-idempotency
frontendcritical

Next.js 15 Server Action Cryptographic Idempotency via Distributed Atomic Ledgers

Enforces deterministic, cryptographically signed idempotency keys across all mutating Next.js 15 Server Actions to prevent duplicate side-effects from aggressive client-side network retries. Mandates atomic distributed lock-and-cache validation via edge-compatible ledgers (e.g., Upstash Redis) before executing sensitive business logic.

Blocks:Executing State-Mutating Server Actions Without Atomic Distributed Deduplication Tokens
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-components-object-taint-boundary
frontendcritical

React 19 Server Components Object Taint Boundary Enforcement

Mandates the explicit registration of sensitive runtime objects, secrets, and PII using React 19 Taint APIs (`experimental_taintObjectReference`, `experimental_taintUniqueValue`) at the Server Component data-access layer. Ensures that any serialization attempt across the React Server Component (RSC) to Client Component flight protocol boundary immediately terminates with a deterministic fatal error.

Blocks:Passing Raw Database Records or Secrets Across the Server-Client Serialization Boundary
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-streaming-barrier
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Streaming Barrier Invariant

Enforces strict physical boundaries between static build-time shells and dynamic asynchronous RSC execution streams under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakages (such as un-suspended cookies(), headers(), searchParams, or dynamic uncached DB reads) from destabilizing static prerender boundaries and cascading into severe TTFB stalls.

Blocks:Dynamic Scope Ingress and Unbounded Dynamic De-opt in Static Shell Layouts
Targets:Cursor•Claude•Windsurf•Codex
react19-server-actions-optimistic-rollback-guardrail
frontendcritical

React 19 useOptimistic Rollback and Server Action Idempotency Guardrail

Enforces strict transition boundaries, idempotent dispatch payloads, and deterministic error handling for React 19 useOptimistic mutations paired with asynchronous Server Actions. Prevents phantom UI states, broken microtask rollback semantics, and out-of-order race conditions during server rejections.

Blocks:Detached Asynchronous Optimistic State Updates Without Transition Scopes or Idempotency Keys
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-boundary-microtask-loop-quota
frontendcritical

Svelte 5 Runes Effect Boundary & Reactive Loop Quota Enforcement

Enforces strict boundaries around $effect executions and state mutations in Svelte 5. Prevents runaway reactive cascades, cyclic microtask schedule exhaustion, and Svelte update quota crashes by mandating pure derivations via $derived and explicit boundary gating via untrack().

Blocks:Mutating Tracked State Inside $effect Triggering Cyclic Microtask Cascades
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-actions-idempotency-key
frontendcritical

Next.js 15 Server Actions Distributed Idempotency Key Invariant

Next.js 15 Server Actions execute mutations over HTTP POST endpoints that lack built-in network deduplication, exposing financial and state-altering workflows to duplicate execution during mobile client retries or network handoffs. Distributed systems require every mutating Server Action to enforce an atomic acquire-evaluate-persist workflow using a client-generated idempotency key validated against an atomic distributed lock or persistent datastore before triggering external side effects. This guarantees strict exactly-once semantics across volatile mobile environments.

Blocks:Executing Non-Idempotent Server Actions Relying Solely on Client UI State Disabling
Targets:Cursor•Claude•Windsurf•Codex
vite-6-module-runner-environment-isolation-guardrail
frontendcritical

Vite 6 Environment API Module Runner Deterministic Memory & Runtime Isolation Guardrail

Enforces deterministic lifecycle disposal, module graph cache invalidation, and strict global scope hygiene across concurrent SSR micro-frontends executed via Vite 6 Environment API Module Runner. Prevents host memory leaks and cross-context pollution caused by lingering module evaluators, unclosed runners, and detached closure retention in long-running Vite server runtimes.

Blocks:Unbounded ModuleRunner Instantiation and Leaked Module Cache Closures in Vite 6 Multi-Tenant SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-graph-snapshot-immutability
frontendcritical

Svelte 5 Runes Reactive Graph Snapshot Immutability Invariant

Enforces strict immutable boundaries and snapshot stabilization on complex nested signal derivations in Svelte 5 runes. Prevents reactive graph thrashing, unintended cascading re-evaluations, and memory retention leaks caused by leaking mutable proxy references or mutating internal state within derived computations.

Blocks:Mutating internal reactive proxies or returning un-snapshotted nested objects inside $derived runes
Targets:Cursor•Claude•Windsurf•Codex
react19-useactionstate-monotonicity-boundary
frontendcritical

React 19 useActionState Optimistic Transition Monotonicity Boundary

Enforces version vector or monotonic Lamport sequence tagging across React 19 concurrent Actions and useOptimistic transitions. Prevents out-of-order asynchronous action resolution from overwriting newer authoritative server state or invalidating optimistic rollback queues during fast-paced concurrent dispatches.

Blocks:Unsequenced useActionState Dispatches Regressing Server State via Out-of-Order Promise Resolution
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-closure-cryptographic-integrity-sealing
frontendcritical

React 19 Server Actions Closure Cryptographic Integrity & Anti-Replay Sealing

Enforces zero-trust cryptographic sealing and anti-replay validation on serialized closure parameters within React 19 Server Actions. Guarantees that bound server action states cannot be tampered with, replayed across cluster regions, or forged when traversing distributed zero-trust networks.

Blocks:Implicitly Trusting Serialized Server Action Bound Arguments Without Cryptographic Nonce and Ephemeral Session Verification
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-module-federation-singleton-isolation
frontendcritical

Vite 6 Rolldown Module Federation Context Singleton Isolation

Enforces strict runtime singleton deduplication across micro-frontend boundaries powered by Vite 6 and Rolldown-based Module Federation. Prevents catastrophic React/Vue engine duplications, corrupted UI contexts, and broken hook dispatchers caused by loose semver matching or missing shared host fallbacks.

Blocks:Dual-Engine Instantiation and Split React/Vue Contexts via Misconfigured Module Federation Shared Scopes
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-dynamic-io-suspense-timeout-sentinel
frontendcritical

Next.js 15 Dynamic I/O Suspense Boundary Strict Timeout Sentinel

Enforces deterministic streaming within Next.js 15 Partial Prerendering (PPR) and Dynamic I/O architectures by mandating strict timeout sentinels on async React Server Components. Prevents unbounded microtask execution from exceeding edge runtime streaming deadlines, eliminating hanging stream connections and 504 Gateway Timeouts.

Blocks:Unbounded Async Server Component I/O Stalling Edge Streaming Pipelines
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-effect-cycle-termination-invariant
frontendcritical

Svelte 5 Runes Reactive Effect Cycle Termination and State Graph Invariant

Enforces deterministic termination on Svelte 5 `$effect` executions by strictly isolating signal reads from reactive mutations. Prevents recursive scheduler microtask loops and main-thread exhaustion across cross-component signal boundaries.

Blocks:Bi-Directional State Synchronization and Self-Triggering Signal Mutations in $effect Blocks
Targets:Cursor•Claude•Windsurf•Codex
react-19-resource-hint-hoisting-deduplication
frontendcritical

React 19 Deterministic Resource Hoisting and Preload Deduplication Standard

Enforces declarative asset prioritization using React 19's native react-dom hoisting APIs (preload, preinit, preconnect) while forbidding imperative DOM head mutations and useEffect-based link injection. This guarantees that asset hints are discovered during the initial render pass and deduplicated across concurrent streaming SSR chunks to eliminate network waterfall stalls and flash of unstyled content (FOUC).

Blocks:Imperative DOM Head Injection and Client-Deferred Asset Preloading in Streaming SSR
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-action-ephemeral-nonce-guard
frontendcritical

Next.js 15 Server Action Ephemeral Request-Binding Nonce Verification

Mutative Next.js 15 Server Actions rendered in pre-hydrated HTML forms are susceptible to cross-site request forgery, stale token replay, and race-condition double submissions. All mutative server actions must validate a cryptographically secure, single-use ephemeral nonce bound to the user session using constant-time comparison before modifying state.

Blocks:Trusting Default Origin Headers Without Ephemeral Nonce Verification in Server Actions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-rune-cycle-interceptor
frontendcritical

Svelte 5 Runes Fine-Grained Reactive Proxy Cycle Interceptor

Prevents infinite signal evaluation cascades and main-thread microtask exhaustion by establishing deterministic recursion depth budgeting across nested Svelte 5 $derived signals, $state proxies, and $effect boundaries. Enforces explicit separation between pure signal derivations and state mutations to prevent cyclic microtask starvation.

Blocks:Cyclic $state Mutation Inside $effect or Eager $derived Invocation Causing Browser Thread Lockup
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-universal-context-boundary-isolation-standard
frontendcritical

Svelte 5 Universal Context Boundary Isolation and SSR Reactive Graph Concurrency Guardrail

Enforces rigid request-boundary isolation for Svelte 5 reactive primitives ($state, $derived) in multi-tenant SSR environments. Prevents catastrophic cross-request data leaks and signal graph memory accumulation by eliminating module-level reactive singletons in favor of scoped component tree contexts.

Blocks:Module-Scoped Reactive Singletons Leaking Multi-Tenant State and Retaining Signal Graphs in High-Concurrency SSR
Targets:Cursor•Claude•Windsurf•Codex
react-19-asset-preload-suspense-deadlock
frontendcritical

React 19 Asset Preload Suspense-Deadlock Mitigation Standard

Enforces non-blocking resource hints and deterministic stylesheet precedence hoisting in React 19 streaming SSR architectures. Prevents dynamic asset preloads inside streaming Suspense boundaries from deadlocking edge hydration workers and blocking critical path commits.

Blocks:Injecting blocking stylesheet precedence or synchronous preinit calls inside edge-streamed Suspense boundaries
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-root-effect-disposal-guardrail
frontendcritical

Svelte 5 Runes $effect.root Boundary Containment and Deterministic Disposal

Enforces strict lifecycle containment via $effect.root across dynamically mounted micro-frontend islands, external adapters, and unmanaged reactive scopes. Prevents critical memory leaks and zombie reactive graph execution by mandating deterministic teardown of unparented Svelte 5 runtime effects.

Blocks:Unmanaged Dynamic Reactive Graph Allocation Without $effect.root Teardown Binding
Targets:Cursor•Claude•Windsurf•Codex
vite-6-rolldown-deterministic-chunking
frontendcritical

Vite 6 & Rolldown Deterministic Chunk Boundary & AST Hashing Invariant

Enforces identical AST module partitioning, pure vendor boundary allocations, and deterministic content-addressed hash generation between client and SSR module execution graphs. Prevents dynamic import skew, cross-boundary symbol leaks, and cascading runtime hydration mismatches during rolling canary rollouts.

Blocks:Non-Deterministic Manual Chunk Splitting Causing SSR/Client Split-Graph Divergence
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-boundary-standard-vite-6-environme-374
frontendcritical

Vite 6 Environment API Multi-Runtime Module Graph Isolation Standard

Enforces strict isolation of module graphs, transform pipelines, and execution runtimes across multi-target SSR architectures using Vite 6's Environment API. Eliminates cross-runtime state pollution, illegal host-runtime API leaks, and redundant module transformations across Client, Node.js, and WinterCG workerd environments.

Blocks:Monolithic Module Graph Bleed and Deprecated ssrLoadModule Usage Across Disjoint Runtimes
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-optimistic-rollback-determinism
frontendcritical

React 19 Action Optimistic Rollback Determinism & Transaction Isolation

Enforces deterministic transactional rollbacks for React 19 optimistic updates executed within asynchronous actions and transitions. Prohibits ad-hoc imperative state mutations and unanchored optimistic state that diverge during concurrent action interruptions, network failures, or transition aborts.

Blocks:Ad-Hoc Imperative State Drift and Phantom Reconciliations in Concurrent React 19 Action Failures
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-deep-rune-async-mutation-boundary
frontendcritical

Svelte 5 Deep Rune Reactive Graph Mutation Boundary Enforcement

Enforces strict boundaries around Svelte 5 deep reactive proxies ($state) across asynchronous microtask schedules. Prohibits incremental deep object mutations interspersed with 'await' boundaries to eliminate reactive graph desynchronization, infinite effect loops, and partial UI state tearing.

Blocks:Asynchronous Deep Proxy Mutation across Microtask Boundaries without Snapshot Isolation
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-server-actions-crypto-taint-boundary
frontendcritical

Next.js 15 Server Actions Cryptographic Token & Tainted Record Boundary

Enforces strict cryptographic verification of Server Action payloads and guarantees zero data leakage across the React Flight boundary using React 19 taint APIs. Prevents client-side parameter tampering on server actions and accidental serialization of server-only secrets into React Server Component (RSC) streams.

Blocks:Trusting unverified client-supplied identifiers in Server Actions and serializing raw database/secret objects across the Flight RPC boundary
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-signal-tree-teardown-and-boundary-isolation
frontendcritical

Svelte 5 Signal-Tree Teardown and Boundary Isolation Standard

Mandates deterministic lifecycle cleanup and boundary isolation for deep reactive $state and $derived dependency graphs in Svelte 5. Prevents orphan signal nodes, retained subscriber closures, and micro-memory leaks during high-frequency telemetry streaming across dynamic route transitions.

Blocks:Leaking Signal Trees via Unbounded Global Subscriptions and Dangling Derived Effects During Route Transitions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-cache-tag-distributed-idempotency
frontendcritical

Next.js 15 Distributed Cache-Tag Revalidation and Idempotency Guardrail

Guarantees atomic, cross-region edge cache invalidation when invoking revalidateTag within Next.js 15 Server Actions. Enforces distributed idempotency locks and fencing tokens to prevent split-brain cache states, thundering herds, and stale-while-revalidate race conditions across multi-zone CDN deployments.

Blocks:Unfenced Server Action revalidateTag invocations causing cross-region split-brain cache contamination
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-scope-isolation
frontendcritical

Vite 6 Environment API Multi-Runtime Module Scope Boundary Enforcement

Enforces strict isolation of module resolution graphs and global scope boundaries across Vite 6 client, edge worker, and Node.js SSR environments. Prevents cross-runtime polyfill pollution, leaking Node.js built-ins into Web Worker/Edge environments, and accidental cross-contamination of client bundles with SSR dependencies.

Blocks:Cross-Environment Module Graph Bleed and Ambient Global Polyfill Contamination
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-rollback-barrier
frontendcritical

React 19 Server Action Optimistic Rollback Barrier & Flight Hydration Integrity

Enforces an atomic transaction barrier across React 19 Server Action invocations and optimistic UI reconciliations. Guarantees that rejected actions cleanly purge transient optimistic states without desynchronizing concurrent Flight stream RSC payloads or corrupting client-side fiber state.

Blocks:Leaking optimistic mutations to external state stores or unmanaged closures that poison concurrent RSC Flight stream hydration upon action rejection.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-hydration-standard
frontendcritical

Next.js 15 Partial Prerendering Dynamic Hole Hydration Standard

Enforces strict isolation of dynamic runtime boundaries within Next.js 15 Partial Prerendering (PPR) architectures to eliminate client-side hydration race conditions and micro-waterfalls. Mandates deterministic Suspense fallback boundaries and restricts runtime dynamic APIs (cookies, headers, searchParams) exclusively to deferred Server Component leaves. Prevents distributed edge node execution mismatches during asynchronous chunk streaming.

Blocks:Dynamic State Bleed into Static Shells and Cascading Suspense Micro-Waterfalls in PPR
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-optimistic-concurrent-rollback-invariant
frontendcritical

React 19 useOptimistic Concurrent Action Rollback Invariant

Guarantees deterministic client-server state convergence during interleaved asynchronous Server Actions and concurrent transitions. Enforces strict derivation of optimistic state from canonical action state, preventing UI flashes, torn states, and unhandled race conditions during network failures or out-of-order action resolution.

Blocks:Imperative Client State Syncing and Disjointed Transitions Breaking useOptimistic Rollback Guarantees
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-signal-graph-disposal-standard
frontendcritical

Svelte 5 Runes Signal Graph Disposal Standard

Enforces strict lifecycle-bound cleanup for Svelte 5 runes effects and untracked external event subscriptions within high-frequency client transitions. Prevents detached component DOM subtrees from retaining stale reactive dependencies and inducing catastrophic memory leaks across SPA navigation cycles.

Blocks:Escaping Effect Roots and Uncleaned External Event Listeners Retaining Detached Svelte 5 Signal Subgraphs
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-ssr-sandboxing-isolation
frontendcritical

Vite 6 Environment API: Deterministic Isomorphic SSR Sandboxing & Boundary Isolation

Enforces deterministic runtime isolation boundaries across SSR execution targets using the Vite 6 Environment API and decoupled Module Runners. Eliminates cross-realm global contamination between client, Node.js, and edge targets by disallowing host global mutation and preventing cross-environment module graph leakage.

Blocks:Mutating Host Globals and Using Legacy ssrLoadModule Across Heterogeneous Runtime Environments
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-boundary-proxy-isolation
frontendcritical

Svelte 5 Runes State Boundary Proxy Isolation Guardrail

Enforces deterministic state boundary serialization when passing Svelte 5 reactive proxies across Web Workers, micro-frontends, or cross-runtime message channels. Deep signal-backed state created via $state() must be explicitly un-proxied using $state.snapshot() before boundary traversal to prevent DataCloneError exceptions, memory retention leaks, and cross-runtime reactive feedback loops.

Blocks:Passing Raw Svelte 5 $state Proxies Across Worker Message Ports or Micro-Frontend Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-guard
frontendcritical

React 19 Server Action Cryptographic Idempotency & Replay Guard

Enforces cryptographically unique client-generated idempotency tokens across React 19 Server Actions and concurrent optimistic mutations. Guarantees zero duplicate distributed mutations across transient mobile/network retries and rapid multi-tap UI submissions via server-side atomic acquisition leases.

Blocks:Unbounded Server Action Invocations with Blind Retries and Server-Generated Request Identifiers
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-io-boundary-isolation-production-standard
frontendcritical

Next.js 15 Partial Prerendering dynamicIO Boundary Isolation Invariant

Enforces strict architectural boundary isolation between static prerendered HTML shells and dynamic streaming operations under Next.js 15 Partial Prerendering (PPR) and dynamicIO. Mandates that un-cached dynamic operations (e.g., cookies(), headers(), dynamic fetch, un-cached DB calls) are strictly encapsulated inside dedicated leaf Server Components wrapped in explicit React Suspense boundaries. Prevents route-level static deoptimizations and cascading cache busts across prerendered application shells.

Blocks:Top-Level Dynamic Access Without Suspense Cascading Route Deoptimization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-state-tearing-isolation
frontendcritical

Svelte 5 Runes State-Tearing Isolation and Async Mutation Standard

Enforces strict transactional mutation boundaries and microtask isolation for Svelte 5 runes ($state, $derived, $effect) across asynchronous operations and island boundaries. Eliminates state tearing, stale tracking leaks across await points, and uncontrolled DOM flush loops in distributed reactive contexts.

Blocks:Asynchronous Rune Mutation Across Microtask Boundaries Causing State Tearing and Orphan Flush Cycles
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-fallback-determinism
frontendcritical

Next.js 15 PPR Deterministic Suspense Boundaries & Zero-CLS Fallback Architecture

Enforces strict isolation between static prerender shells and dynamic streaming holes under Next.js 15 Partial Prerendering (PPR). Mandates layout-deterministic Suspense fallbacks to eliminate Cumulative Layout Shift (CLS) and guarantees zero runtime de-opt of static prerendering caused by uncontained dynamic data access.

Blocks:Leaking Dynamic Context into Prerender Shells with Non-Geometric or Missing Suspense Fallbacks
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-dynamic-mfe-sri-attestation-guardrail
frontendcritical

Vite 6 Rolldown Dynamic Micro-Frontend SRI Attestation & Graph Isolation

Enforces strict runtime Subresource Integrity (SRI) attestation and isolated module graph boundaries for dynamically federated remote micro-frontends under Vite 6 and Rolldown. Dynamic ESM imports bypass native browser script-tag integrity checks, creating critical supply chain attack vectors when loading external chunks into the host execution context. This guardrail mandates SHA-384/SHA-512 cryptographic verification of remote manifests and chunks via Web Crypto prior to module graph evaluation.

Blocks:Unvalidated Dynamic ESM Ingestion of Remote Micro-Frontend Chunks
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-idempotency
frontendcritical

React 19 Server Action Optimistic Idempotency Key Pipeline

Enforces a strict cryptographic client-generated idempotency key pipeline paired with React 19's useOptimistic hook during concurrent Server Action dispatches. Guarantees deterministic state rollback, prevents duplicate distributed executions during flaky network retries, and eliminates race conditions under React's asynchronous transitions.

Blocks:Unkeyed Server Action Invocations Triggering Ghost Mutations and Corrupting Optimistic Concurrent UI Trees
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-multi-runtime-isolation-standard-vite-6-environme-128
frontendcritical

Vite 6 Environment API Multi-Runtime Context Isolation Standard

Enforces strict memory, configuration, and module-graph boundary separation between heterogeneous target runtimes (e.g., Cloudflare Workers/workerd and Node.js) using the Vite 6 Environment API. Prevents runtime pollution, invalid cross-runtime polyfill leakage, and module graph cache poisoning during dual-target SSR builds. Mandates explicit environment-scoped resolve conditions, isolated runner instances, and contextual plugin execution.

Blocks:Cross-Runtime Module Graph Contamination via Shared Vite SSR State and Global Conditions
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-deterministic-chunking-standard
frontendcritical

Vite 6 and Rolldown Deterministic Module Chunk Boundary Isolation Standard

Enforces deterministic AST-driven chunking boundaries and explicit module isolation in Vite 6 with Rolldown. Prevents cascading edge CDN cache invalidations across federated micro-frontends caused by non-deterministic dynamic chunking, circular import graphs, and leaky barrel exports.

Blocks:Implicit Dynamic Splitting Inducing Cascading Edge Cache Invalidation Across Micro-Frontends
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-untracked-signal-boundaries
frontendcritical

Svelte 5 Runes Reactive Engine: Untracked Boundaries & Derivation Determinism

Enforces deterministic signal derivation ordering and prevents microtask queue deadlocks in Svelte 5 fine-grained reactive runtime. Mandates explicit untracked boundary isolation via untrack() for cross-component writes and strictly forbids state mutations within derived signal computations.

Blocks:Cyclic Signal Graph Cascades and Microtask Starvation via Implicit Dependency Capture in Runes Effects
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-dynamic-io-ppr-boundaries
frontendcritical

Next.js 15 Dynamic IO and PPR Asynchronous Boundary Enforcement

Next.js 15 Dynamic IO with Partial Prerendering (PPR) mandates that dynamic data sources (cookies, headers, searchParams, and uncached dynamic fetches) are quarantined behind strict React Suspense boundaries. Top-level synchronous or layout-level un-suspended dynamic accesses de-opt the static shell, leak contextual request state into shared prerender buffers, and trigger client hydration mismatch panics.

Blocks:Awaiting dynamic request APIs at root page/layout level without Suspense encapsulation, collapsing PPR into SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-boundary-cleanup-standard
frontendcritical

Svelte 5 Runes Async Boundary & $effect.root Cleanup Invariant

Enforces deterministic lifecycle disposal for Svelte 5 reactive trees crossing asynchronous boundaries or instantiated outside component trees. Prevents zombie computations, uncollected signal subgraphs, and memory exhaustion in isomorphic streaming SSR and long-lived single-page applications.

Blocks:Instantiating Unmanaged $effect.root Subgraphs or Creating Reactive Effects Across Await Boundaries Without Explicit Teardown
Targets:Cursor•Claude•Windsurf•Codex
react-19-useoptimistic-reconciliation-invariants
frontendcritical

React 19 useOptimistic Rollback and Server State Reconciliation Invariants

Enforces transactional integrity and deterministic reconciliation when using React 19 useOptimistic under high-frequency mutations and unstable network conditions. Guarantees that optimistic updates occur strictly within React Transition boundaries and rely on immutable base states to prevent state tearing, ghost rollbacks, and race-condition UI thrashing. Mandates idempotent sequence tracking so rejected mutations cleanly roll back without corrupting subsequent inflight actions.

Blocks:Mutating Parallel Local State and Bypassing Transition Boundaries in React 19 Optimistic UI
Targets:Cursor•Claude•Windsurf•Codex
react19-activity-offscreen-state-preservation-standard
frontendcritical

React 19 Activity API Offscreen Fiber State Preservation and Resource Management

Establishes production invariants for React 19 Activity (Offscreen) boundary usage during multi-tab and multi-view navigation. Enforces deterministic DOM detachment, fiber cache retention, and strict cleanup of background render timers, web workers, and WebGL contexts to prevent memory bloat and CPU starvation.

Blocks:Uncontrolled Background Fiber Execution and Memory Leakage via Hidden React 19 Activity Boundaries
Targets:Cursor•Claude•Windsurf•Codex
tauri-v2-dynamic-capability-scope-invariant
frontendcritical

Tauri 2.0 Dynamic Capability Scope and Remote Webview Isolation Invariant

Enforces strict origin-to-command capability mapping and deterministic window labeling in Tauri 2.0 architectures to prevent privilege escalation via IPC bridge exposure. Guarantees that dynamically spawned webviews and remote contexts cannot inherit ambient native permissions or execute unauthorized backend commands.

Blocks:Spawning Dynamic Webview Contexts with Ambient Capability Inheritance and Unscoped Remote IPC Execution
Targets:Cursor•Claude•Windsurf•Codex
nextjs-ppr-streaming-abort-guardrail
frontendcritical

Next.js 15 PPR Streaming AbortSignal Propagation Standard

Enforces mandatory AbortSignal propagation across all async data fetching, downstream HTTP clients, and database queries within Next.js 15 Partial Prerendering (PPR) dynamic Suspense boundaries. Prevents catastrophic database connection pool starvation and orphaned Node.js/Edge compute when streaming HTTP responses are terminated prematurely by client disconnects.

Blocks:Orphaned database queries and detached fetch operations executing post-client-disconnect in streamed PPR boundaries.
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-standard-vite-6-environme-199
frontendcritical

Vite 6 Environment API Multi-Runtime Context Isolation & Memory Sandboxing

Enforces strict memory, execution context, and global scope isolation when executing heterogeneous SSR pipelines across browser, Node.js, and edge workers via Vite 6 Environment API. Prevents cross-runtime state leakage, globalThis pollution, and invalid shared module cache reuse during concurrent Hot Module Replacement (HMR).

Blocks:Cross-Environment Global Scope Contamination and Shared Module Graph Leaks in Multi-Runtime SSR
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-graph-boundary
frontendcritical

Svelte 5 Runes Reactive Graph Boundary and Root Lifecycle Isolation

Enforces strict reactive graph boundary isolation and explicit lifecycle management using $effect.root and untrack() in non-component modules and long-running services. Prevents microtask starvation and unbounded memory retention caused by orphaned signal dependencies and circular reactive evaluations in single-page applications.

Blocks:Unbounded Signal Graph Leaks and Microtask Starvation via Unscoped Dynamic Runes
Targets:Cursor•Claude•Windsurf•Codex
react-19-tainted-reference-server-action-replay-boundary
frontendcritical

React 19 Tainted Reference & Server Action Replay Boundary Enforcement

Guarantees that sensitive server-side objects, environmental secrets, and raw cryptographic credentials cannot be serialized across the React Server Components (RSC) wire protocol using React 19 experimental taint primitives. Enforces strict cryptographic nonce verification, session binding, and atomic idempotency consumption across all mutating Server Actions to eradicate replay and duplicate execution vectors.

Blocks:Exposing Raw Cryptographic Secrets Across the RSC Protocol and Executing Un-fenced Mutating Server Actions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-isolation-standard
frontendcritical

Svelte 5 Runes Reactive Isolation & SSR State Leak Standard

Enforces strict request-lifecycle scoping for Svelte 5 runes ($state, $derived) in universal and SSR execution environments. Prohibits module-level reactive declarations that persist in Node/Bun worker memory, eliminating cross-request state pollution, data leakage between authenticated sessions, and memory leaks in long-running processes.

Blocks:Global Module-Level Runes Leaking User Session State Across Concurrent SSR Requests
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-hmac-sealing-guardrail
frontendcritical

React 19 Server Actions Bound Closure State HMAC Sealing & Verification Invariant

Guarantees that arguments bound to React 19 Server Actions via `.bind()` or closure capture cannot be tampered with or replayed across client-server RPC transitions. Any mutable or privileged bound parameters transmitted across the network boundary must be cryptographically signed with an HMAC token and verified against the authenticated session context before execution.

Blocks:Trusting Client-Supplied Bound Arguments in Server Actions Without Cryptographic Integrity Verification
Targets:Cursor•Claude•Windsurf•Codex
react-19-concurrent-action-serialized-transition-boundary
frontendcritical

React 19 Concurrent Action State Serialized Transition Boundary

Enforces strict transition boundaries and deterministic state serialization across React 19 Actions and optimistic rollbacks. Prevents UI tearing, stale closure overwrites, and uncoordinated rollbacks during rapid concurrent mutations by isolating mutating transitions within useActionState and useOptimistic primitives.

Blocks:Out-of-band async mutations corrupting optimistic queues and causing split-brain UI tearing on action rollbacks
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-server-actions-tainted-state-boundary-guardrail
frontendcritical

Next.js 15 Server Actions Tainted State & PII Serialization Guardrail

Enforces deterministic boundaries between server-only secrets/unmasked PII and client-accessible states within Next.js 15 Server Components and Server Actions. Mandates the use of experimental_taintObjectReference and experimental_taintUniqueValue to eliminate inadvertent serialization leaks through action return payloads or component props.

Blocks:Returning Raw Data Entities or Tokens from Server Actions Causing Accidental Payload Serialization
Targets:Cursor•Claude•Windsurf•Codex
react-19-concurrent-resource-disposal-guardrail
frontendcritical

React 19 Concurrent Interruption Resource Disposal Standard

Enforces strict passive allocation paradigms in React 19 concurrent mode to eliminate leaks of unmanaged browser primitives (WebGL contexts, Web Workers, Observers, and SharedArrayBuffers). In React 19, concurrent render passes can yield, suspend, or abort before mounting; any side effects or allocations initiated during the render phase bypass commit cleanup, accumulating uncollected GPU/OS-level handles. All lifecycle allocations must be deferred strictly to passive commit phases (useEffect) or wrapped in idempotent cleanup abstractions guarded against discarded frames.

Blocks:Eager Resource Allocation During Concurrent Render Passes Without Deferred Commit Lifecycle Guards
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-ssr-context-isolation
frontendcritical

Svelte 5 Runes SSR Reactive Context Isolation Standard

Enforces strict boundary encapsulation of Svelte 5 reactive primitives ($state, $derived) within request-scoped lifecycle contexts during Node.js SSR. Prevents catastrophic cross-tenant and cross-session data leaks caused by module-scoped reactive singletons retaining state across concurrent HTTP requests in long-running server runtimes.

Blocks:Module-Scoped $state Primitives Leaking Cross-Request Session Context in Node.js SSR
Targets:Cursor•Claude•Windsurf•Codex
vite-6-module-federation-remote-sandboxing-standard
frontendcritical

Vite 6 Module Federation Cross-Origin Remote Sandboxing Standard

Enforces boundary isolation for independently deployed cross-origin remote micro-frontends integrated via Vite 6 Module Federation. Mandates runtime CSS encapsulation via Shadow DOM and execution confinement via JavaScript Proxy boundaries or SES realms to preclude prototype pollution, global object collision, and cascade destruction.

Blocks:Unsandboxed Cross-Origin Remote Execution and Global CSS Injection
Targets:Cursor•Claude•Windsurf•Codex
react19-useoptimistic-concurrent-transition-barrier
frontendcritical

React 19 useOptimistic Concurrent Transition Rollback Barrier

Enforces strict monotonic sequence barriers and atomic transition scoping when using React 19 useOptimistic. Prevents phantom UI flashes and stale state overwrites caused by out-of-order promise fulfillment in concurrent microtask queues by binding optimistic updates to deterministic transaction IDs and synchronous action boundaries.

Blocks:Unbounded concurrent useOptimistic mutations yielding race conditions and phantom rollbacks during out-of-order network resolutions
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-rune-effect-root-lifecycle-boundary
frontendcritical

Svelte 5 Rune Effect-Root Boundary Enforcement for Micro-Frontend Lifecycle Management

Enforces strict containment of fine-grained reactive dependency graphs within explicit $effect.root scopes when initializing Svelte 5 runic state outside Svelte component tree boundaries. Guarantees deterministic destruction and total garbage collection across dynamic micro-frontend mount and unmount lifecycles.

Blocks:Instantiating ambient rune effects and mount calls without explicit $effect.root teardown handles during micro-frontend interop
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-boundary-quarantine
frontendcritical

Next.js 15 PPR Streaming Boundary Quarantine and Dynamic Shell Isolation

Next.js 15 Partial Prerendering (PPR) generates a shared static shell at build time while streaming dynamic segments on demand. Dynamic request contexts (cookies, headers, auth tokens) accessed outside explicit React Suspense boundaries trigger static shell de-optimization or risk baking user-specific credential states into statically cached CDN shells. Strict quarantine mandates that all dynamic data access occurs exclusively inside isolated dynamic sub-trees wrapped in suspense boundaries with deterministic static fallbacks.

Blocks:Unquarantined Dynamic Request Access Poisoning Static Shell Prerender Cache
Targets:Cursor•Claude•Windsurf•Codex
react19-rsc-client-boundary-serialization-guardrail
frontendcritical

React 19 RSC Flight Boundary Serialization and Closure Sanitization Guardrail

Enforces strict serialization boundaries and Data Transfer Object (DTO) projection when passing data across React Server Component (Flight protocol) boundaries to Client Components. Prevents runtime serialization crashes, circular reference locks, prototype pollution, and catastrophic secret or connection pool exfiltration via memory pointers.

Blocks:Passing unmapped ORM entities, sensitive closure states, or non-serializable objects across the RSC-to-Client boundary
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-boundary-isolation-vite-6-environme-747
frontendcritical

Vite 6 Environment API Cross-Runtime Boundary Isolation

Enforces strict boundary isolation, module graph partitioning, and target-specific resolution conditions using the Vite 6 Environment API. Prevents silent runtime pollution such as Node.js built-ins leaking into workerd/Cloudflare Workers and synthetic server polyfills inflating browser client bundles.

Blocks:Ambient Node Builtin Leakage and Monolithic SSR Target Conflation in Vite Heterogeneous Builds
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler-purity-auto-memoization-hygiene
frontendcritical

React 19 Compiler Auto-Memoization Purity and Side-Effect Hygiene Standard

Enforces strict functional purity and idempotent render-phase execution required by the React 19 Compiler (React Forget). Prevents compiler memoization bailouts, cache invalidation storms, and unstable reference identity shifts caused by impure reads, mutable ref access during render, and in-place object mutations.

Blocks:Render-Phase Mutation and Volatile Reference Reads Invalidating React 19 Compiler Memoization Blocks
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-optimistic-rollback-isolation-react-19-useacti-554
frontendcritical

React 19 useActionState and useOptimistic Transactional Rollback Boundary Isolation

Enforces strict isolation boundaries when coordinating React 19 useActionState with useOptimistic across concurrent mutations. Guarantees that asynchronous server action failures revert local speculative state without leaking invalid, uncommitted optimistic states into adjacent sibling trees, global caches, or shared Context providers.

Blocks:Global Context Optimistic Contamination and Cross-Tree Dirty State Leakage on Server Mutation Rejection
Targets:Cursor•Claude•Windsurf•Codex
sharedarraybuffer-atomics-worker-render-pipeline-standard
frontendcritical

SharedArrayBuffer, Atomics, and Zero-Allocation Worker Pipeline Standard

Enforces lock-free ring buffers, explicit atomic memory fences, and zero-allocation frame loops across Web Workers feeding OffscreenCanvas rendering contexts. Guarantees memory barrier ordering and eliminates CPU-saturating spin-locks, torn reads, and garbage collection pauses across cross-thread shared memory boundaries.

Blocks:Spin-Locking Shared Buffers and Unsynchronized TypedArray Reads Causing Torn Frames and GC Stutters
Targets:Cursor•Claude•Windsurf•Codex
webgpu-wasm-linear-memory-isolation-fence
frontendcritical

WebGPU / WebAssembly Linear Memory Isolation Fence Architecture

Enforces strict memory isolation fences between WebAssembly dynamic linear memory heaps and WebGPU queue pipelines during client-side tensor inference. Prevents browser tab crashes, GPU process termination, and detached ArrayBuffer exceptions caused by runtime Wasm heap growth (memory.grow) invalidating views during asynchronous buffer transfers.

Blocks:Streaming Volatile WebAssembly Heap Views Directly into WebGPU Operations Across Asynchronous Execution Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-rollback-react-19-server--219
frontendcritical

React 19 Server Action Idempotency & Optimistic Rollback Barrier

Enforces deterministic transactional barriers across React 19 Server Actions and optimistic updates. Mandates client-generated idempotency keys, monotonic revision fencing, and strict rollback envelopes to prevent UI desynchronization and duplicate database mutations during transient network failures, double submissions, or aborted transitions.

Blocks:Unfenced Server Actions with Blind Optimistic Mutations and Non-Idempotent Payloads
Targets:Cursor•Claude•Windsurf•Codex
next15-ppr-static-dynamic-isolation-perimeter
frontendcritical

Next.js 15 PPR Static-Dynamic Isolation Perimeter & Boundary Enforcement

Enforces strict structural boundaries between edge-cacheable static prerender shells and dynamic React Server Component streams under Next.js 15 Partial Prerendering (PPR). Prevents catastrophic static-deoptimization, user credential leakage in edge-cached prerender payloads, and Cumulative Layout Shift (CLS) caused by asymmetric fallback geometries.

Blocks:Leaking dynamic request-bound APIs into static route shells causing edge cache poisoning or total de-optimization
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-cache-boundary-segmentation
frontendcritical

Next.js 15 Partial Prerendering (PPR) Deterministic Cache Boundary Enforcement

Enforces strict structural boundaries between static prerendered HTML shells and dynamic React Server Component streams in Next.js 15 Partial Prerendering. Requires all dynamic functions (cookies, headers, searchParams, and uncached data fetches) to be strictly encapsulated within explicit Suspense boundaries with deterministic, dynamic-free fallbacks to prevent edge CDN cache poisoning and build-time dynamic bailout propagation.

Blocks:Dynamic Context Leakage into Static Shells Causing Edge CDN Cache Poisoning and Static De-optimization
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-effect-async-cancellation-boundary
frontendcritical

Svelte 5 $effect Cleanup and Asynchronous Task Cancellation Boundary

Enforces synchronous teardown return contracts and deterministic AbortController cancellation inside Svelte 5 $effect runes. Prevents floating asynchronous microtasks from mutating unmounted component state or causing cross-render race conditions by binding all async execution lifecycles to reactive scope disposal boundaries.

Blocks:Async $effect Function Signatures and Unbound Microtask State Mutation
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-suspense-boundary-isolation
frontendcritical

Next.js 15 PPR Dynamic Suspense Boundary and Shell Isolation Standard

Enforces strict structural segregation between static edge-cached shell chunks and deferred dynamic runtime microtasks under Next.js 15 Partial Prerendering (PPR). Dynamic runtime APIs (cookies, headers, searchParams, and uncached data fetches) must be encapsulated within explicit Suspense boundaries to prevent full-route static de-optimization and concurrent hydration mismatches.

Blocks:Dynamic Context Leaking Across Static Prerender Shells via Unguarded Root Executions
Targets:Cursor•Claude•Windsurf•Codex
wasmgc-shared-arraybuffer-microfrontend-isolation
frontendcritical

WasmGC Shared ArrayBuffer Memory Boundary Isolation in Micro-Frontends

Federated micro-frontends utilizing WebAssembly Garbage Collection (WasmGC) and SharedArrayBuffer must enforce strict linear memory isolation and host reference boundary encapsulation. Direct passing of WasmGC heap references (externref/anyref) or shared underlying linear buffers across federated boundaries introduces cross-origin memory leaks, thread contention, and non-deterministic GC teardown cycles. Inter-module communication must instead traverse structured message ports or isolated transient serialization buffers governed by explicit lifecycle ownership.

Blocks:Leaking SharedArrayBuffer References and GC External References Across Federated Module Boundaries
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-signal-isolation-guardrail
frontendcritical

Svelte 5 Runes Fine-Grained Reactivity Signal Isolation Guardrail

Enforces strict signal boundary encapsulation for Svelte 5 $state and $derived runes across microfrontend (MFE) and multi-root boundaries. Prohibits leaking reactive proxy references and cross-root signal subscriptions that cause orphan dependency nodes, broken lifecycle garbage collection, and silent memory leaks.

Blocks:Exposing Raw Svelte 5 Reactive Proxies Across Microfrontend Roots Causing Retained Memory Graph Leaks
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-sandbox
frontendcritical

Vite 6 Environment API Deterministic Multi-Runtime Isolation Guardrail

Enforces strict boundary isolation across client, SSR, and edge worker module graphs using the Vite 6 Environment API. Guarantees deterministic module evaluation and eliminates cross-tenant state pollution caused by shared module runner instances and un-isolated module-level singletons during SSR dev and bundling.

Blocks:Cross-Tenant State Bleed via Shared Module Graphs and Legacy ssrLoadModule Singletons
Targets:Cursor•Claude•Windsurf•Codex
react19-server-actions-closure-boundary-secret-fencing
frontendcritical

React 19 Server Actions Closure Boundary & Secret Fencing Standard

Enforces strict isolation of privileged execution contexts and environment secrets from React 19 Server Actions and Server Component render trees. Prevents accidental closure capture and automatic serialization across the React Flight wire protocol boundary by mandating decoupled action files, explicit DTO projection, and the 'server-only' package.

Blocks:Capturing Server Secrets, Database Instances, or Sensitive Props in Lexical Closures of Server Actions
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-fallback-isolation-standard
frontendcritical

Next.js 15 PPR Shell Isolation and Dynamic Streaming Boundary Standard

Enforces deterministic edge delivery of static application shells by strictly isolating dynamic streaming segments within explicit React Suspense boundaries. Prevents runtime dynamic API leaks from de-optimizing Partial Prerendering (PPR) into dynamic SSR and ensures dynamic segment failures do not abort client TTFB.

Blocks:Leaking Dynamic Request APIs into the Static Shell or Omitting Isolated Suspense Fallbacks
Targets:Cursor•Claude•Windsurf•Codex
react-19-tainted-object-leakage-barrier
frontendcritical

React 19 Server Components Taint API Serialization Barrier

Guarantees cryptographic secrets, private access tokens, and sensitive raw PII are structurally blocked from crossing the React Server Component (RSC) to Client Component flight serialization boundary. Mandates the explicit application of React 19's experimental_taintUniqueValue and experimental_taintObjectReference at data-access layer boundaries before passing domain entities to rendering pipelines.

Blocks:Passing Untainted Domain Models Containing Secrets or Unhashed PII Across Server-Client Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-io-shell-isolation
frontendcritical

Next.js 15 PPR Dynamic IO Shell Isolation Standard

Enforces strict architectural boundaries between static prerendered HTML shells and asynchronous streaming promises under Next.js 15 Partial Prerendering (PPR) and Dynamic IO. Prevents synchronous resolution of dynamic operations—such as cookies(), headers(), searchParams, or uncached I/O—outside of explicit Suspense boundaries, eliminating cascading prerender deoptimizations and build-time dynamic bailouts.

Blocks:Leaking Dynamic Server Execution into Root Shell Contexts via Un-Suspended Async Operations
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-graph-tearing-boundary
frontendcritical

Svelte 5 Runes Reactive Graph Boundary & Microtask Tearing Prevention

Enforces strict synchronous transactional boundaries across Svelte 5 runes ($state, $effect, $derived) during high-throughput event processing. Eliminates race conditions and reactive graph tearing caused by interleaving microtask yields (await) within signal subscription contexts during high-frequency enterprise telemetry streaming.

Blocks:Interleaving Microtask Awaits within $effect Contexts and Discontinuous Multi-Signal Telemetry Mutations
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-fallback-isolation-fence
frontendcritical

Next.js 15 Partial Prerendering (PPR) Fallback Isolation Fence

Enforces strict isolation fences between static prerender shells and dynamic micro-segments under Next.js 15 Partial Prerendering (PPR). Guarantees dynamic runtime execution (cookies, headers, non-deterministic database access) is sequestered behind explicit React Suspense boundaries with pure, static skeleton fallbacks, ensuring instant edge shell transmission without dynamic pipeline stalling.

Blocks:Leaking Dynamic Accessors to Root Scope or Polluting Fallbacks with Uncached Dynamic State
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-lifecycle-after-boundary-standard
frontendcritical

Next.js 15 Async Request Lifecycle & Bounded next/after Execution Guardrail

Enforces deterministic post-response task scheduling in Next.js 15 Route Handlers and Server Actions using the official next/after execution boundary. Prevents premature runtime suspension in serverless environments, unhandled promise rejections, memory/socket leaks, and artificial TTFB inflation caused by running auxiliary workloads in the critical rendering path.

Blocks:Unbounded Floating Promises and Blocking Auxiliary Workloads in Request Paths
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-dynamic-io-boundary-serialization
frontendcritical

React 19 RSC Dynamic I/O Boundary & Microtask Serialization Invariant

Enforces strict isolation between static prerendering phases and dynamic user context access under React 19 Dynamic I/O semantics. Prevents cross-tenant context leakage and cache poisoning by guaranteeing dynamic primitives are partitioned inside Suspense microtask boundaries.

Blocks:Dynamic Authentication and Header Access Leaking into Static RSC Prerender Artifacts
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-hydration-boundary-guardrail
frontendcritical

Deterministic Hydration Boundaries and Effect Teardowns in Svelte 5 Runes

Enforces synchronous effect cleanup registration and strict asynchronous signal tracking boundaries within Svelte 5 reactive graphs during SSR streaming and client hydration. Prevents memory leaks, uncollected reactive scopes, and microtask cascade loops caused by async effects returning Promises rather than deterministic teardown functions.

Blocks:Asynchronous Effect Initialization Bypassing Synchronous Teardown and Leaking Reactive Signal Graphs
Targets:Cursor•Claude•Windsurf•Codex
react19-server-action-idempotency-key-fencing
frontendcritical

React 19 Server Actions Idempotency Key Fencing & Transition Guardrail

Enforces cryptographically verifiable idempotency tokens across React 19 Server Action transitions and form submissions to prevent duplicate state-modifying mutations during client network retries or automated form resubmissions. Guarantees that mutating Server Actions atomically fence incoming execution requests using client-seeded uniqueness keys backed by distributed locks or reservation tables before executing transactional payloads.

Blocks:Unprotected Mutating Server Actions Permitting Duplicate Execution on Network Retries and Double Submissions
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-cross-runtime-isolation-vite-6-environme-854
frontendcritical

Vite 6 Environment API Cross-Runtime Artifact Isolation Guardrail

Enforces strict module graph boundary isolation across client, Node SSR, and Edge Worker targets using the Vite 6 Environment API. Prevents tree-shake poisoning, secret leakage, and incompatible runtime symbol resolution by enforcing isolated module resolve conditions, separate dependency pipelines, and compile-time boundary validation.

Blocks:Cross-Runtime Graph Contamination and Tree-Shake Poisoning via Monolithic Module Bundling
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-microtask-flusher-standard
frontendcritical

Svelte 5 Runes Deterministic Reactivity and Microtask Flusher Guardrail

Enforces bounded execution depth and deterministic signal evaluation across nested Svelte 5 rune graphs ($state, $derived, $effect). Prevents cascading microtask churn, cyclical flusher invalidation, and state tearing under heavy concurrent event dispatch through pure derivation trees, explicit untracking, and transactional state synchronization.

Blocks:Mutating $state inside $effect chains causing cyclic microtask flushes and frame drops
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-standard-vite-6-environme-917
frontendcritical

Vite 6 Environment API Multi-Runtime Module Graph Isolation

Enforces strict physical separation of client, Node.js SSR, and edge worker module graphs using the Vite 6 Environment API. Prevents cross-runtime prototype pollution, execution context bleeding, and critical server secret exfiltration caused by shared module caches during universal bundling.

Blocks:Monolithic SSR Module Graph Collapsing Client, Node, and Edge Execution Contexts
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-transition-rollback-invariant
frontendcritical

React 19 Concurrent Action Transition Deterministic Rollback and Optimistic Lock Invalidation

Enforces synchronous error boundary rollbacks and optimistic lock invalidation during React 19 concurrent action transitions. Prevents split-brain UI states, zombie optimistic updates, and corrupted client caches caused by interleaved, aborted, or rejected Server Actions.

Blocks:Decoupled Manual Optimistic State and Uncoordinated Interleaved Server Actions Causing Stale Lock Poisoning
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-graph-purity
frontendcritical

Svelte 5 Runes Reactive Graph Purity Boundary

Enforces strict synchronous dependency tracking and purity invariants across Svelte 5 reactive runes ($derived, $derived.by, $effect). Prevents untracked asynchronous race conditions, memory leaks, and cascading cyclic re-renders by mandating synchronous reads, explicit AbortController lifecycle teardowns, and mutation-free derivation boundaries.

Blocks:Untracked Post-Await State Access and Unbounded Async Side Effects in Runes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-multi-region-cache-purge-atomicity
frontendcritical

Next.js 15 Multi-Region Cache Tag Purge Atomicity Standard

Enforces strict cache coherence and atomic invalidation protocols across globally distributed edge Points of Presence (PoPs) in Next.js 15. Prevents torn-read states during concurrent Server Action mutations by mandating monotonic epoch-tagged cache envelopes and session-bound read fencing.

Blocks:Uncoordinated Multi-Tag Purges in Server Actions Inducing Cross-Region Edge Split-Brain
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-boundary-teardown
frontendcritical

Svelte 5 Runes Async Boundary Isolation & Reactive Teardown Enforcement

Strictly enforces that Svelte 5 signal derivations ($derived, $derived.by) remain purely synchronous to prevent tracking context detachment. Mandates that asynchronous microtasks and data fetches be isolated within $effect scopes with deterministic AbortController teardowns to eliminate memory leaks and stale mutations during rapid DOM unmounting.

Blocks:Executing Async Microtasks Within Synchronous Derivations Causing Detached Signal Tracking and Post-Teardown Memory Leaks
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-io-boundary-isolation-next-js-15-parti-785
frontendcritical

Next.js 15 PPR Dynamic IO Context Isolation

Enforces strict architectural separation between static prerender trees and streaming Suspense holes under Next.js 15 Partial Prerendering (PPR) and Dynamic IO flags. Prevents accidental route-level de-optimization by prohibiting dynamic API access (cookies, headers, un-cached data fetching) outside explicitly isolated Suspense-wrapped leaf components. Guarantees compile-time enforcement of cacheable shells and predictable incremental streaming delivery.

Blocks:Dynamic context leakage into static layouts and parent shells poisoning the PPR prerender boundary
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-shell-isolation
frontendcritical

Deterministic Static-to-Dynamic Shell Isolation in Next.js 15 PPR

Enforces strict boundary encapsulation between the edge-cached static shell and dynamic streaming segments under Next.js 15 Partial Prerendering (PPR). Mandates that dynamic context reads, unmemoized requests, and runtime I/O are strictly sequestered behind Suspense boundaries to prevent de-optimizing the pre-rendered shell into a blocking, dynamic server-rendered response.

Blocks:Leaking Dynamic Context Reads into the Static Shell Root, Collapsing Edge-Streamable PPR into Blocking Dynamic SSR
Targets:Cursor•Claude•Windsurf•Codex
react19-useoptimistic-monotonic-sequence-validation
frontendcritical

React 19 useOptimistic Monotonic Sequence Validation and Fencing

Enforces monotonic mutation sequence fencing within React 19 useOptimistic reducers and server action handlers. Prevents state regressions, out-of-order resolution jitter, and stale optimistic rollbacks during high-frequency concurrent server action dispatches.

Blocks:Unfenced Optimistic Mutations Collapsing Under Out-of-Order Network Resolution
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-vite-6-environme-259
frontendcritical

Vite 6 Environment API Isomorphic Runtime Isolation Standard

Enforces strict memory isolation, runner boundaries, and resolve condition partitioning across Node.js, Workerd (edge), and browser environments using the Vite 6 Environment API. Prevents cross-runtime prototype pollution, illegal host-specific globals leakage, and legacy single-graph SSR execution flaws.

Blocks:Conflating Server Execution Environments via Legacy Vite 5 SSR APIs and Leaking Node Globals into Workerd or Browser Runtimes
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-rsc-taint-object-reference-fencing
frontendcritical

Next.js 15 RSC Experimental Taint Object Reference Fencing

Enforces strict cryptographic taint fences on raw domain models and secrets using React's experimental_taintObjectReference and experimental_taintUniqueValue in Next.js 15 Server Components. This categorically eliminates the risk of PII, secret keys, or sensitive backend state crossing the Server-Client serialization wire into client bundles.

Blocks:Passing Raw Server-Side Domain Entities or Unmasked Credentials Directly to Client Components
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-server-boundary-standard
frontendcritical

Vite 6 Environment API Server Boundary Standard

Enforce strict isolation between client, ssr, and workerd environments using Vite 6 new Environment API.

Blocks:AI bundles server-only Node native modules into edge worker environments.
Targets:Cursor•Claude•Windsurf•Codex
By:
E
Evan You
Maintainer
svelte-5-snippet-hydration-mismatch-boundary
frontendcritical

Svelte 5 Snippet Hydration Mismatch Boundary Guardrail

Enforces strict isolation boundaries around Svelte 5 snippets subjected to asynchronous or dynamic state drift during SSR hydration. Prevents structural tree tear-down by isolating snippet invocations inside targeted boundary components, preserving fine-grained reactive runes ($state, $derived) in sibling nodes during reconciliation.

Blocks:Global Subtree Unmounting Caused by Bare Dynamic Snippets During Async Hydration Drift
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-rsc-streaming-injection-nonce-isolation
frontendcritical

Next.js 15 RSC Streaming Lexical Boundary & Cryptographic Nonce Isolation

Enforces strict cryptographic nonce propagation and lexical boundary escaping on asynchronously streamed React Server Component (RSC) HTML chunks. Prevents DOM clobbering and arbitrary script execution caused by premature lexical breakout or unescaped tag delimiters injected into the downstream streaming pipe.

Blocks:Unsanitized inline script emission and missing nonce binding in dynamic RSC streaming blocks
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-shell-streaming-memory-cap
frontendcritical

Next.js 15 PPR Shell Streaming Memory Cap and Backpressure Invariants

Enforces strict streaming backpressure, payload budgeting, and socket lifecycle controls for Next.js 15 Partial Prerendering (PPR). Prevents unbuffered Node.js stream buffer saturation, V8 heap exhaustion, and HTTP socket starvation during concurrent dynamic React Server Component (RSC) hydration over chunked transfer.

Blocks:Unbounded Dynamic Payload Fetching and Missing Stream Timeouts in Monolithic PPR Holes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-use-cache-tag-swr-boundary-guardrail
frontendcritical

Next.js 15 'use cache' Cache-Tag Stale-While-Revalidate Boundary Guardrail

Enforces strict boundary isolation between transactional Server Action writes and edge-cached 'use cache' layout derivations in Next.js 15. Prevents stale read anomalies by requiring deterministic cache tagging, immediate post-mutation tag invalidation, and strict separation of transactional return payloads from eventual edge revalidation.

Blocks:Coupling Server Action Mutations to Un-invalidated 'use cache' Derivations with Inconsistent Read Replicas
Targets:Cursor•Claude•Windsurf•Codex
tauri2-webview-isolation-ipc-scoping-invariant
frontendcritical

Tauri 2.0 Ephemeral Webview Isolation & Scoped IPC Guardrail

Enforces strict process, storage, and IPC boundary separation between primary execution contexts and auxiliary or ephemeral renderer windows in Tauri 2.0. Eliminates cross-webview side-channel exfiltration and memory contamination by requiring distinct window labels, explicit capability mapping, and segregated storage partitions.

Blocks:Spawning Auxiliary Renderers with Default Host Capabilities and Shared Memory/Storage Contexts
Targets:Cursor•Claude•Windsurf•Codex
react-19-concurrent-action-transition-boundary-standard
frontendcritical

React 19 Concurrent Action Transition and Optimistic Boundary Invariant Standard

Enforces deterministic coordination between React 19 useActionState, useOptimistic, and startTransition boundaries across concurrent Server Component streaming trees. Guarantees that asynchronous mutation rollbacks, deferred payloads, and optimistic state reconciliations prevent frame tearing and visual flicker during microtask interruptions.

Blocks:Unbounded Async Mutations Causing Optimistic Frame Tearing and Stale Stream Drift
Targets:Cursor•Claude•Windsurf•Codex
react-19-action-transition-abort-signal-propagation-invariant
frontendcritical

React 19 Action Transition AbortSignal Propagation Invariant

Enforces deterministic lifecycle binding between React 19 Action Transitions (`useActionState`, `startTransition`) and underlying I/O tasks via explicit AbortSignal propagation. Guarantees that pending async microtasks, fetch payloads, and optimistic state reconciliations immediately terminate upon component unmount, route transition, or action preemption, preventing memory leaks, network contention, and stale cache hydration.

Blocks:Unlinked Async Action Microtasks Causing Post-Unmount Network Contention and Stale State Rehydration
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-boundary-standard
frontendcritical

Next.js 15 Partial Prerendering Dynamic Hole Boundary Standard

Enforces strict Suspense encapsulation for dynamic runtime operations (cookies, headers, searchParams, uncached fetch calls) under Next.js 15 Partial Prerendering (PPR). Prevents dynamic execution leakage into the static prerender shell, edge cache poisoning, and catastrophic hydration mismatches.

Blocks:Unbounded Dynamic Context Leakage Poisoning Static Shell Prerenders
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-sandboxing-standard
frontendcritical

Vite 6 Environment API Runtime Sandboxing Standard

Vite 6 introduces the Environment API to provide distinct, sandboxed module graphs and execution contexts for client, SSR, and custom runtime targets (e.g., edge workers). This standard mandates explicit per-environment configuration, boundary fencing via environment-aware plugin hooks, and the deprecation of legacy server-side execution APIs to eliminate cross-environment credential leaks and compilation contamination.

Blocks:Leaking Server Secrets and Private Backend Modules into Client Artifacts via Legacy Monolithic Configuration and Unscoped Vite Plugins
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-fallback-boundary-standard
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Fallback Boundary Standard

Enforces strict isolation of dynamic runtime operations within deterministic React Suspense boundaries for Next.js 15 Partial Prerendering (PPR). Guarantees instantaneous edge-cached static shell delivery while eliminating de-optimizations, cascading dynamic leaks, and hydration mismatches during dynamic chunk streaming.

Blocks:Unbounded Dynamic Invocations Collapsing Static Route Shells into Full Dynamic SSR
Targets:Cursor•Claude•Windsurf•Codex
dsd-hydration-boundary-streaming-isolation
frontendcritical

Declarative Shadow DOM Hydration Boundary & Isolation Standard

Enforces deterministic, non-destructive streaming hydration for Web Components utilizing Declarative Shadow DOM (DSD) across heterogeneous micro-frontends. Eliminates runtime DOMExceptions caused by redundant shadow root attachment, prevents Flash of Unstyled Content (FOUC) during chunked SSR streaming, and prevents memory leaks from detached event boundaries in nested framework islands.

Blocks:Destructive Re-Attachment of Existing Declarative Shadow Roots and InnerHTML Hydration Wipeouts
Targets:Cursor•Claude•Windsurf•Codex
react19-useoptimistic-serialization-boundary
frontendcritical

React 19 useOptimistic Dynamic Serialization Boundary and State Isolation

Enforces strict immutability, deterministic pure-reducer updates, and structured-cloneable payload boundaries within React 19 useOptimistic hooks. Prohibits direct object mutation, non-serializable optimistic payloads, and shared object references that trigger visual tearing, reconciliation races, and hydration mismatch during concurrent Server Action streaming.

Blocks:Mutating Existing State References and Passing Non-Serializable Instances to useOptimistic Update Reducers
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-async-derived-dependency-isolation-invariant
frontendcritical

Svelte 5 Runes Async Derived Dependency Isolation Invariant

Svelte 5's $derived rune must strictly remain synchronous and free of untracked post-await dependency reads to prevent asynchronous dependency leakage and cascading reactive loops. Asynchronous state derivation must explicitly isolate its trigger dependencies, encapsulate pending promises through un-tracked invocations or dedicated resource state holders, and prevent unawaited Promise resolutions from executing downstream effect loops.

Blocks:Leaking Reactive Dependencies Across Asynchronous Execution Boundaries in Derived Runes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-use-cache-cryptographic-tenant-tagging
frontendcritical

Next.js 15 'use cache' Cryptographic Tenant-Fenced Tagging Standard

Enforces deterministic, cryptographically signed tenant prefixes on all cache tags generated within Next.js 15 'use cache' scopes. Raw or guessable tenant string interpolations (e.g., 'tenant-123:orders') create cross-tenant cache contamination, tag-purging denial of service, and edge-level data leak risks across shared regional CDN infrastructure.

Blocks:Predictable String Interpolation in Multi-Tenant 'use cache' Tags Causing Edge Cache Contamination
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-boundary-hydration-isolation-invariant
frontendcritical

Svelte 5 Snippet Boundary Hydration Isolation for Custom Elements

Fences reactive Svelte 5 snippet slots inside custom web components with explicit hydration boundaries and isolated signal scopes. Prevents destructive hydration mismatches, parent light-DOM invalidation cascades, and slot-projection de-synchronization during SSR hydration. Ensures dynamic snippet projection adheres to strict autonomous shadow DOM boundaries.

Blocks:Directly projecting un-isolated Svelte 5 reactive snippets into Shadow DOM slots, inducing parent-child hydration thrashing.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-after-background-execution-boundary
frontendcritical

Next.js 15 after() Serverless Execution Lifetime and Microtask Drain Guardrail

Enforces the use of Next.js 15 after() for all post-response telemetry, auditing, and cache synchronization tasks. Prevents abrupt lambda freeze termination and zombie microtask pollution caused by uncoordinated fire-and-forget promises in serverless runtimes.

Blocks:Unbounded Fire-and-Forget Floating Promises Silently Freezing in Serverless Execution Contexts
Targets:Cursor•Claude•Windsurf•Codex
react-19-optimistic-state-idempotency-guardrail
frontendcritical

React 19 Speculative Mutation Rollback and Action Idempotency Guardrail

Enforces deterministic state reversion and strict idempotency for React 19 speculative mutations via `useOptimistic` and `useActionState`. Guarantees zero UI tearing, duplicate dispatches, or zombie DOM state across network latency and intermittent server rejections.

Blocks:Bypassing React 19 transition boundaries with un-keyed manual useState rollbacks that tear UI state on network failure
Targets:Cursor•Claude•Windsurf•Codex
react-19-concurrent-action-hydration-interleaving
frontendcritical

React 19 Concurrent Action-State Hydration Interleaving Guardrail

Enforces deterministic synchronization between optimistic updates and server action states during selective hydration over streaming SSR in React 19. Prevents UI tearing, state rollback races, and hydration mismatches caused by concurrent action dispatch interleaving with progressive boundary hydration.

Blocks:Manual useState/useEffect optimistic emulation racing against React 19 selective hydration transitions
Targets:Cursor•Claude•Windsurf•Codex
vite-6-mfe-style-cascade-dedup-guardrail
frontendcritical

Vite 6 Micro-Frontend Style Cascade Precedence and Runtime Deduplication

Enforces strict document.head style insertion boundaries, CSSOM link tag deduplication, and deterministic cascade layering across dynamic Module Federation mounts in Vite 6. Prevents asynchronous micro-app chunk injections from trampling host design system tokens, altering specificity hierarchies, or bloating the CSSOM with duplicate vendor sheets.

Blocks:Uncoordinated Head Injections and Non-Deterministic Asynchronous Remote CSS Mounting
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-streaming-ssr-abortsignal-propagation
frontendcritical

Next.js 15 Streaming SSR Downstream AbortSignal Propagation Protocol

Mandates explicit AbortSignal cascading from incoming HTTP/3 client request streams to all downstream microservices, gRPC channels, and distributed database queries during Next.js 15 chunked React Server Component (RSC) and Web Stream execution. Prevents uncollected zombie promises, thread pool exhaustion, and memory leaks when clients prematurely sever connections during active streaming SSR.

Blocks:Orphaned Downstream Compute via Unbound Fetch and Detached Streaming Lifecycles
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-cryptographic-replay-barrier
frontendcritical

React 19 Server Actions: Cryptographic Replay Barrier & Monotonic Token Invariant

Enforces single-use cryptographic idempotency tokens bound to server action payloads in React 19 to neutralize double-submit race conditions and network replay hazards. Protects progressive enhancement forms and direct client RPC invocations by atomically consuming tokens via transactional storage before executing state-changing operations.

Blocks:Naked Server Actions Executing Unchecked State Mutations Subject to Double-Submit and Replay Cascades
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-shadow-dom-mfe-isolation-guardrail
frontendcritical

Vite 6 Environment API & Scoped Custom Element Micro-Frontend Sandbox Isolation

Guarantees runtime sandbox separation and eliminates prototype pollution and custom element collisions across independently deployed micro-frontend remotes. Mandates configuring Vite 6 runtime environments paired with Scoped CustomElementRegistry instances inside isolated Shadow DOM boundaries.

Blocks:Global Window Pollution and Shared CustomElementRegistry Across Micro-Frontend Remotes
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-guardrail
frontendcritical

React 19 Server Actions Cryptographic Idempotency Guardrail

Enforces distributed cryptographic idempotency keys on mutating React 19 Server Actions across edge environments. Prevents duplicate state modifications, double-billing, and race conditions resulting from aggressive client or network retry policies by mandating atomic deduplication checks in shared storage backends before executing transactional payloads.

Blocks:Blind Mutation in React 19 Server Actions without Distributed Idempotency Locks
Targets:Cursor•Claude•Windsurf•Codex
react-19-metadata-hoisting-hydration-barrier
frontendcritical

React 19 Document Metadata Hoisting & Hydration Conflict Barrier

Enforces deterministic document metadata hoisting and deduplication standards in React 19 applications. Eliminates client-side hydration thrashing, duplicate <head> elements, and race conditions caused by concurrent asynchronous server components and legacy imperative head managers.

Blocks:Emitting unkeyed concurrent meta tags across suspended async boundaries while mutating document.head imperatively.
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-ssr-isolation-guardrail
frontendcritical

Vite 6 Environment API Module-Graph SSR Boundary & Runtime Isolation

Enforces strict boundary separation between client, Node.js, and edge module graphs using the Vite 6 Environment API. Eliminates cross-runtime singleton leaks, improper HMR propagation, and shared state bleed between SSR execution contexts during local development and build pipelines.

Blocks:Accessing Legacy Shared ModuleGraph and ssrLoadModule Leading to Cross-Runtime State Contamination
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-raw-state-proxy-bypass-standard
frontendcritical

Svelte 5 $state.raw Proxy Bypass Standard for High-Throughput Streams

Enforces the mandatory use of Svelte 5's $state.raw() rune for large external state trees, high-frequency streaming collections, and immutable third-party data structures. Prevents catastrophic garbage collection thrashing and main-thread freezing caused by deep recursive proxy wrapping on high-volume incoming payloads.

Blocks:Wrapping Large or Streaming Data Payloads in Deeply Reactive Svelte 5 $state() Proxies
Targets:Cursor•Claude•Windsurf•Codex
react-19-activity-offscreen-cache-isolation-invariant
frontendcritical

React 19 Activity API Offscreen Component Cache Isolation Invariant

Enforces strict cache isolation and deferred execution for backgrounded UI trees managed by React 19 Activity (<Activity mode="hidden">). Prevents active layout recalculation, uncontrolled microtask execution, and un-deferred asynchronous state dispatches that induce frame drop and layout thrashing upon component restoration.

Blocks:Executing unthrottled DOM measurements and non-deferred microtask state updates inside hidden Activity boundaries.
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-key-guardrail-react-19-server--219
frontendcritical

React 19 Server Action Idempotency-Key Mutation Guardrail

Enforces strict idempotency guarantees across React 19 Server Actions by binding state mutations to cryptographically unique or client-scoped deterministic transaction keys. Prevents double-submit races, distributed side-effect amplification, and database divergence during optimistic updates, transitions, and network retries.

Blocks:Unbounded Server Action Mutations Without Idempotency Scopes Causing Duplicate Side-Effects
Targets:Cursor•Claude•Windsurf•Codex
svelte5-rune-sharedarraybuffer-worker-offload
frontendcritical

Svelte 5 Rune State Offloading via SharedArrayBuffer & Atomics Invariants

Enforces non-blocking high-frequency compute graphs by isolating CPU-intensive operations into dedicated Web Workers synchronized across a SharedArrayBuffer. Mandates Svelte 5 fine-grained $state reactivity bound strictly via microtask-coalesced TypedArray views, preventing UI micro-stutters, race conditions, and uncoordinated atomic writes.

Blocks:Mutating Svelte 5 Runes Directly in Worker Callbacks or Calling Structured Clone PostMessage on High-Frequency Compute Frames
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-dynamic-io-secret-tainting-standard
frontendcritical

Next.js 15 Dynamic IO Server Secret Tainting and Build Shell Isolation Standard

Enforces strict compile-time and runtime boundary fencing to guarantee tenant-scoped cryptographic secrets, private keys, and authorization credentials are never accidentally embedded into pre-rendered static shells during Next.js 15 Dynamic IO builds. Leverages React Server Component object tainting ('experimental_taintUniqueValue' and 'experimental_taintObjectReference') alongside the dynamicIO flag to block secret leakage across serialization boundaries. Mandates deterministic dynamic scope tagging whenever tenant-scoped data or secrets are accessed.

Blocks:Leaking Raw Tenant Keys into Pre-rendered Prerender Shells via Untainted RSC Props under Dynamic IO
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-dynamic-boundary-isolation
frontendcritical

Next.js 15 PPR Dynamic Boundary Isolation and Session Leak Prevention

Enforces strict isolation of dynamic runtime functions (cookies, headers, searchParams) inside explicit React Suspense boundaries under Next.js 15 Partial Prerendering (PPR). Prevents dynamic user-session data and personalization tokens from prematurely de-opting static prerender shells or bleeding into edge-cached static distribution layers during streaming hydration.

Blocks:Unwrapped Dynamic Hook Invocation Leaking Personalized State into Prerendered Static Shells
Targets:Cursor•Claude•Windsurf•Codex
vite6-cross-realm-prototype-isolation
frontendcritical

Vite 6 Environment API Cross-Realm Prototype Isolation & Scope Boundary Standard

Enforces strict prototype isolation and cross-realm defensive boundaries when executing multiple SSR microfrontend islands using the Vite 6 Environment API. Prevents runtime cross-contamination, memory leaks across HMR cycles, and prototype pollution caused by shared global intrinsics.

Blocks:Mutating Shared Global Intrinsics or Exchanging Raw Uncloned Objects Across Vite 6 Environment Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-idempotency-rollback-react-19-server--809
frontendcritical

React 19 Server Actions Idempotency & Optimistic Rollback Protocol

Enforces deterministic state synchronization between client and server across high-latency or unstable mobile-web boundaries. Mandates client-generated idempotency tokens paired with React 19 useActionState and useOptimistic primitives to prevent duplicate mutations and eliminate zombie optimistic states upon network failures.

Blocks:Non-Idempotent Mutations with Leaky Unchecked Optimistic UI
Targets:Cursor•Claude•Windsurf•Codex
tauri-v2-granular-ipc-capability-acl-sandboxing
frontendcritical

Tauri 2.0 IPC Granular Capability ACL Sandboxing and Boundary Hardening

Enforces strict principle-of-least-privilege IPC boundaries in Tauri 2.0 applications by eliminating wildcard native plugin permissions and unbounded invoke calls. All frontend interactions with native host APIs must route through strongly-typed command wrappers constrained by granular, path-scoped capability manifests bound exclusively to authorized webview labels.

Blocks:Direct Webview Invocations of Wildcard Plugin Commands Exposing Arbitrary Native Host Execution via XSS
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-deduplication
frontendcritical

React 19 Server Action Idempotency-Key Deduplication Guardrail

Enforces deterministic client-side generation and server-side atomic validation of idempotency keys across all mutating React 19 Server Actions. Guarantees that concurrent submissions, network retry storms, and transient timeout replay loops cannot cause duplicate side effects or non-reentrant state corruptions. Mandates atomic distributed lock/reservation primitives prior to executing durable business mutations.

Blocks:Blind Execution of Non-Idempotent React 19 Server Actions on Optimistic Retries
Targets:Cursor•Claude•Windsurf•Codex
svelte5-async-effect-race-condition-fence
frontendcritical

Svelte 5 Untracked Async Effect Race-Condition Fence

Enforces strict cancellation tokens and AbortController fences within Svelte 5 $effect workflows. Prevents out-of-order promise resolutions from clobbering fine-grained reactive state when rapid UI inputs re-trigger asynchronous tasks.

Blocks:Unfenced Async State Resolution in Svelte 5 $effect Causing Stale UI Clobbering
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-isolation-guardrail
frontendcritical

Vite 6 Environment API Runtime Module Isolation Guardrail

Enforces strict boundary isolation and prevents cross-runtime prototype pollution and state leakage across browser, web worker/worklet, and server-side runtime graphs using the Vite 6 Environment API. Guarantees that compilation transforms, dependency caches, and ModuleRunner instances operate within deterministic, hermetically isolated runtime execution contexts.

Blocks:Cross-Runtime State Bleed and Shared Module Graph Pollution via Legacy Vite SSR Loaders
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-after-lifecycle-boundary
frontendcritical

Next.js 15 after() Post-Response Lifecycle & Serverless Execution Boundary

Guarantees secondary compute routines, audit trails, and analytics outlive the primary HTTP response lifecycle without freezing in serverless runtimes or penalizing Time to First Byte (TTFB). Mandates next/server's after() API over floating fire-and-forget promises and synchronous pre-response execution.

Blocks:Floating Unawaited Promises or Blocking Side-Effects in Serverless Request Handlers
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-ssr-state-isolation-barrier
frontendcritical

Svelte 5 Runes SSR Cross-Request Reactive Isolation Standard

Enforces strict architectural boundaries on Svelte 5 $state runes within universal and server-side contexts. Top-level reactive singletons in shared modules persist across the entire Node.js/Bun process lifetime, causing catastrophic cross-request data leaks and multi-tenant session poisoning in SSR applications.

Blocks:Module-Level Singleton Reactive Runes Mutating Across Concurrent Server Requests
Targets:Cursor•Claude•Windsurf•Codex
duckdb-wasm-worker-memory-isolation
frontendcritical

DuckDB-Wasm Dedicated Worker & Memory Pool Isolation Guardrail

Restricts all in-browser analytical compute with DuckDB-Wasm to isolated Web Worker execution contexts bounded by strict WebAssembly memory pools and watchdog monitors. Prohibits main-thread database instantiation and unconstrained buffer growth that induce rendering pipeline starvation and fatal browser tab terminations.

Blocks:Direct Main-Thread DuckDB Instantiation and Uncapped WebAssembly Memory Allocation
Targets:Cursor•Claude•Windsurf•Codex
nextjs15-ppr-cryptographic-shell-hole-isolation
frontendcritical

Next.js 15 PPR Cryptographic Shell-Hole and Streaming Boundary Isolation

Enforces strict cryptographic boundary isolation for Next.js 15 Partial Prerendering (PPR) dynamic streaming slots embedded in static shells. Dynamic holes resolved inside static ISR shells must validate HMAC-signed resume tokens and scope dynamic runtime access behind isolated Suspense boundaries to prevent edge cache poisoning and SSR injection.

Blocks:Unsigned Dynamic Suspense Holes Leaking Tainted Context into Static Shells or Allowing Slot Boundary Forgery
Targets:Cursor•Claude•Windsurf•Codex
vite-6-workerd-ssr-context-boundary
frontendcritical

Vite 6 Environment API Workerd-SSR Context Boundary Enforcement

Vite 6's Environment API enables isolated multi-runtime pipelines (e.g., client, edge/workerd, and node). Engineers must enforce strict compile-time module resolution barriers, condition fencing, and bundle virtualization to prevent Node.js native primitives, un-sandboxed global access, and private server secrets from leaking into Cloudflare Workerd edge worker bundles.

Blocks:Leaking Node.js Builtins and Un-sandboxed Host Globals into Vite 6 Workerd SSR Environments
Targets:Cursor•Claude•Windsurf•Codex
react19-async-transition-optimistic-rollback-standard
frontendcritical

React 19 Async Transition Error Boundary & Optimistic Rollback Standard

Mandates transactional reconciliation of optimistic UI mutations using React 19 useOptimistic and useActionState primitives within async Transitions. Guarantees deterministic rollback of speculative state updates when asynchronous actions reject, preventing UI-server desynchronization and unhandled transition faults.

Blocks:Manual Asynchronous Rollback via Secondary setState Calls and Swallowed Transition Failures
Targets:Cursor•Claude•Windsurf•Codex
whatwg-streams-backpressure-pipeline-standard
frontendcritical

WHATWG Streams API Backpressure-Driven Byte Stream Decoding Pipeline Standard

Enforces strict backpressure propagation, unbuffered zero-copy chunk handoff, and BYOB (Bring Your Own Buffer) reader semantics across browser streaming pipelines. Mandates that multi-gigabyte binary streams are consumed using chunk-aligned transform loops and dedicated Web Workers to eliminate main-thread stalls and unbounded heap growth.

Blocks:Unbounded ArrayBuffer Aggregation and Unconstrained Async Loop Ingestion Without Backpressure
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-cycle-fence-boundary
frontendcritical

Svelte 5 Runes Invalidation Fence & Microtask Boundary Convergence

Enforces strict unidirectional data flow and deterministic microtask boundary fencing within Svelte 5 fine-grained reactive graphs ($state, $derived, $effect). Prohibits bidirectional state mutations inside reactive effects to eliminate cascading dependency tearing and infinite graph invalidation loops under high-frequency stream ingress.

Blocks:Mutating Dependent $state Inside $effect Causing Microtask Invalidation Cycles and Signal Graph Tearing
Targets:Cursor•Claude•Windsurf•Codex
tauri-v2-ipc-scoped-capability-webview-isolation-standard
frontendcritical

Tauri 2.0 Scoped IPC Capabilities & Multi-Webview Isolation Standard

Enforces granular IPC capability scoping and strict multi-webview runtime isolation within Tauri 2.0 desktop applications. Guarantees that secondary, untrusted, or multi-tenant webviews cannot invoke native privileged commands or execute cross-origin privilege escalations via shared IPC channels.

Blocks:Wildcard Window Targeting and Unrestricted IPC Exposure Across Multi-Webview Boundaries
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-tiered-cache-tags-distributed-purge-consistency
frontendcritical

Next.js 15 Tiered Cache Tags & Distributed Purge Consistency Invariant

Enforces a hierarchical, deterministic tagging schema for Next.js 15 Data Cache and unstable_cache invocations across distributed edge regions. Prevents thundering herds, race conditions, and stale read states during high-concurrency revalidation events by coupling tag granularities with distributed locks and stale-while-revalidate invariants.

Blocks:Global Path Invalidation and Flat Tags Triggering Multi-Region Edge Stampedes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-boundary
frontendcritical

Next.js 15 PPR Dynamic Hole Boundary & Static Shell Cache-Isolation

Enforces strict boundary segregation between static shell pre-rendering and dynamic micro-task streaming in Next.js 15 Partial Prerendering (PPR). Mandates that all dynamic functions (cookies, headers, searchParams, and uncached data fetches) are strictly isolated within Suspense boundaries to prevent full-page static shell de-optimization and catastrophic dynamic session leakage into shared CDN caches.

Blocks:Accessing Dynamic Runtime Context at Page Root Shell Level Causing PPR De-optimization or Session Poisoning in Edge CDN Caches
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-streaming-barrier
frontendcritical

Next.js 15 Partial Prerendering (PPR) Dynamic Hole Streaming Barrier & Zero-CLS Fallbacks

Enforces strict isolation of dynamic React Server Components inside Suspense boundaries with dimensionally matched fallbacks when using Next.js 15 Partial Prerendering (PPR). Guarantees dynamic execution contexts (cookies, headers, un-cached data queries) never leak into the edge-cached static shell, preventing runtime de-opts and layout shifts (CLS).

Blocks:Leaking Dynamic Request APIs into Shell Scope and Unbounded Dynamic Fallback Layout Shifts
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-untrack-async-boundary-lexical-isolation
frontendcritical

Svelte 5 Untrack Asynchronous Boundary Lexical Scope Isolation

Enforces strict synchronous boundaries when using Svelte 5's untrack primitive to prevent reactive tracking context leakage. Svelte 5's reactivity runtime unsets the active reaction synchronously and reinstates it via a finally block; passing async functions to untrack or reading runes after await statements causes stealth dependencies, race conditions, and infinite reactive cascades.

Blocks:Passing Async Callbacks to untrack or Reading Rune State Across Await Boundaries
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-cross-worker-proxy-invariant
frontendcritical

Svelte 5 Runes Cross-Worker State Synchronization & Proxy Isolation Standard

Enforces deterministic state boundaries between Svelte 5 Runes reactivity and Web Worker thread pools. Guarantees that deeply reactive proxies created by $state() are snapshot-sanitized prior to postMessage serialization, preventing runtime DataCloneError exceptions, thread-boundary proxy leakage, and reactive graph tearing.

Blocks:Direct Serialization of Svelte 5 Reactive Proxies and Unsynchronized Worker Mutability Leading to DataCloneError and State Tearing
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-ssr-target-isolation-guardrail
frontendcritical

Vite 6 Environment API SSR Runtime Target Isolation Guardrail

Enforces strict module graph separation, dedicated DevEnvironment instances, and isolated global/hot scopes across client, edge, and node runtimes in Vite 6 SSR architectures. Prevents cross-environment state leakage, dual-module graph contamination, and cumulative memory leaks caused by sharing server-side state or module execution runners across distinct request boundaries.

Blocks:Global Module Contamination and Shared Environment State in Vite SSR
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-strict-search-validation
frontendcritical

TanStack Router Strict Search Param Validation and Schema Sanitization

Enforces deterministic, runtime-validated search parameter parsing on all TanStack Router routes prior to component mounting. Guarantees that query state is structurally sanitized via resilient Zod or Valibot schemas with fallback defaults, preventing SSR hydration mismatches, NaN/prototype pollution, and unhandled boundary crashes caused by malformed or adversarial URLs.

Blocks:Accessing Unvalidated Query Strings via Loose Typing, Raw Window APIs, or Non-Sanitized Route Search Definitions
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-optimistic-rollback-integrity
frontendcritical

React 19 Server Action Optimistic Mutation & Deterministic Rollback Guardrails

Enforces deterministic state synchronization during concurrent React 19 Server Action mutations by anchoring optimistic state directly to transition-scoped boundaries via useOptimistic and useActionState. Prevents UI desynchronization, stale-closure overwrites, and clobbered concurrent mutations caused by imperative useState snapshots in catch blocks.

Blocks:Manual useState Snapshot Reversion in Server Action Catch Blocks Causing Race-Condition Rollbacks
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-snippet-template-scoping-guardrail
frontendcritical

Svelte 5 Snippet Context Scoping and Memory Leak Prevention

Enforces strict lexical and reactive scoping rules for Svelte 5 snippets passed across recursive component boundaries. Prevents implicit closure over parent component runes ($state, $derived) and context lookups (getContext) that trigger unintended reactive context bleeding and cyclic memory retention across unmounted tree segments.

Blocks:Implicit Parent Lexical Closure and Context Bleed Inside Recursive Snippet Invocations
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-reactive-ownership-graph-invariant
frontendcritical

Svelte 5 Reactive Ownership Graph & Unidirectional Signal Invariant

Enforces strict unidirectional dependency trees and explicit ownership bounds within Svelte 5 Runes architecture. Eliminates synchronous circular re-render loops ('effect_update_depth_exceeded') and cross-component signal race conditions by forbidding state-synchronization side-effects and unshielded bi-directional mutations.

Blocks:Cyclic Signal Mutation and Synchronous State Synchronization in Effects
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-universal-runes-boundary-effect-destruction
frontendcritical

Svelte 5 Universal Runes Boundary & Effect Destruction Invariants

Enforces strict lifecycle ownership, root scoping ($effect.root), and deterministic cleanup protocols for universal runes (.svelte.ts) spanning SSR hydration boundaries and component unmount lifecycles. Prevents reactive graph leaks, cross-request state contamination, and orphaned effect subscriptions in nested state domains.

Blocks:Unbounded Universal Effects and Leaked Nested Reactive Scopes Across Hydration Boundaries
Targets:Cursor•Claude•Windsurf•Codex
webgpu-pipeline-caching-worker-fence-isolation
frontendcritical

WebGPU Compute Pipeline Compilation Caching & Cross-Worker Buffer Fence Isolation

Enforces asynchronous shader pre-compilation with persistent IndexedDB pipeline descriptor caching to eliminate UI main-thread jank and shader stutter. Mandates strict GPU queue completion fencing and unmap-before-transfer invariants across dedicated Web Workers to prevent GPUDevice lost panics and concurrent memory mutation.

Blocks:Main-Thread Synchronous Pipeline Creation and Unfenced Worker Buffer Remapping
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-action-state-concurrent-rollback
frontendcritical

React 19 useActionState Concurrent Optimistic Rollback Standard

Mandates deterministic rollback trees and atomic state reconciliation across concurrent React 19 form transitions. Eliminates race conditions, out-of-order write hazards, and UI tearing by binding optimistic state strictly through React 19 transition primitives rather than unversioned imperative local state.

Blocks:Decoupled imperative local state mutations alongside interleaved asynchronous useActionState transitions resulting in stale-closure overwrites and non-deterministic rollback tearing.
Targets:Cursor•Claude•Windsurf•Codex
tauri-2-multiwindow-ipc-state-mutex-standard
frontendcritical

Tauri 2.0 Multi-Window IPC State Synchronization Mutex Standard

Enforces deterministic, serialized state transitions across isolated Tauri 2.0 webview windows by delegating mutable state mutations exclusively to a Rust-managed transactional state mutex via typed IPC commands. Prohibits direct inter-window communication, optimistic unverified local state overrides, and peer-to-peer event bus broadcasts that induce split-brain conditions.

Blocks:Optimistic Frontend State Mutation with Unsynchronized Cross-Window Custom Events
Targets:Cursor•Claude•Windsurf•Codex
react19-use-optimistic-interleaved-rollback-barrier
frontendcritical

React 19 useOptimistic Monotonic Sequence and Interleaved Rollback Barrier

Enforces strict monotonic transaction sequence barriers and idempotent revision tracking for React 19 useOptimistic when orchestrating concurrent Server Actions. Guarantees deterministic state convergence and prevents UI tearing or ghost rollbacks caused by out-of-order network responses and interleaved server action failures.

Blocks:Unversioned useOptimistic Reducers Permitting Out-of-Order Rollback and UI Tearing
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-untrack-boundary-isolation
frontendcritical

Svelte 5 Runes Reactive Isolation and Untrack Boundary Enforcement

Enforces purity in Svelte 5 $derived computations and mandates the explicit use of untrack() inside $effect blocks to sever accidental dependency tracking. Eliminates circular reactive cascades and runaway rendering loops caused by asynchronous state writes and uncontrolled signal reads.

Blocks:Unbounded Signal Cascades and Impure Derivations Triggering ERR_SVELTE_TOO_MANY_UPDATES
Targets:Cursor•Claude•Windsurf•Codex
react19-activity-offscreen-reconciliation-guardrail
frontendcritical

React 19 <Activity> Offscreen State Reconciliation and Subscription Guardrail

Enforces strict memory reclamation and explicit subscription teardowns for subtrees managed by React 19's <Activity> (Offscreen) API. Offscreen subtrees preserve internal state while detaching DOM nodes; failing to decouple long-lived event emitters, timers, WebSocket listeners, and canvas render loops leads to massive memory leaks, phantom state updates, and CPU saturation.

Blocks:Persisting Active Subscriptions and Continuous Render Loops in Deactivated <Activity> Subtrees
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-streaming-guardrail
frontendcritical

Next.js 15 Async Dynamic APIs and Streaming Isolation Standard

Enforces strict isolation of request-scoped context in Next.js 15 App Router by mandating asynchronous consumption of dynamic APIs (cookies, headers, params) and prohibiting module-level mutable caching. Prevents cross-request state bleeding and session poisoning across concurrent streaming server renders.

Blocks:Synchronous Dynamic API Reads and Module-Scoped Request Context Pollution
Targets:Cursor•Claude•Windsurf•Codex
tauri-v2-multiwindow-ipc-capability-scoping
frontendcritical

Tauri 2.0 Multi-Window IPC Capability Isolation & Sandboxing Standard

Enforces strict capability scoping and explicit label sandboxing for dynamically spawned secondary webviews in Tauri 2.0. Prevents privilege escalation and remote code execution by ensuring dynamic windows, preview contexts, and untrusted frames cannot inherit wildcard native Rust IPC commands or system dialog access.

Blocks:Assigning Wildcard Window Capabilities or Spawning Unrestricted WebviewWindows for Untrusted Content
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-replay-idempotency-standard
frontendcritical

React 19 Server Actions Cryptographic Replay & Idempotency Standard

Enforces cryptographically signed monotonic nonces and distributed atomic claim locks on React 19 Server Actions to eliminate double-execution, race conditions, and distributed replay attacks across edge runtimes. Mandates strict validation of ephemeral HMAC-signed action tokens before executing any state-mutating operation.

Blocks:Unvalidated and Naked Server Actions Vulnerable to Distributed Replay Attacks and Double Mutations
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-suspense-boundary-standard
frontendcritical

Deterministic Static-to-Dynamic PPR Streaming Suspense Boundaries in Next.js 15

Enforces strict layout-locked React Suspense boundaries around all dynamic runtime holes when using Next.js 15 Partial Prerendering (PPR). Guarantees static shell pre-generation without de-opting to dynamic SSR, prevents Cumulative Layout Shift (CLS) via dimensionally matched fallback skeletons, and prevents unhandled DynamicServerError stream aborts.

Blocks:Unbounded dynamic API calls and dimensionally mismatched fallbacks triggering full-route PPR de-optimization and post-hydration layout shifts
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-rollback-invariant-react-19-server--881
frontendcritical

React 19 Server Actions: Deterministic Optimistic Rollback & Hydration Boundary Invariant

Enforces strict atomicity and deterministic rollback patterns for speculative UI states when invoking React 19 Server Actions. Guarantees that concurrent mutation failures, hydration boundaries, and unhandled server rejections preserve accessible focus trees, prevent layout thrashing, and avoid split-brain state desynchronization.

Blocks:Ad-Hoc Speculative State Mutation via useState with Unsynchronized Server Action Rejections
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-circularity-effect-root-scoping
frontendcritical

Svelte 5 Runes Reactive Graph Circularity & Effect Root Scoping Guardrail

Enforces strict lifecycle bounding for Svelte 5 $effect.root scopes and eliminates cascading microtask reactivity cycles. Mandates deterministic cleanup disposal for non-component signal trees and isolates state mutation loops using untrack() and pure derivations to prevent browser thread saturation.

Blocks:Unbounded $effect.root allocations and cyclic $state mutations inside effects causing ERR_SVELTE_TOO_MANY_UPDATES
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-async-cancellation-guardrail
frontendcritical

Svelte 5 Runes Async Mutation Cancellation & Fine-Grained State Protection

Prevents race conditions, out-of-order mutations, and stale asynchronous writes from corrupting Svelte 5 signal dependency graphs. Mandates deterministic cleanup, AbortController propagation, and generation checks for all asynchronous processes tied to runes reactivity.

Blocks:Unbounded Asynchronous Closures Mutating Fine-Grained State Runes Out-of-Order
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-streaming-hydration-guardrail
frontendcritical

Next.js 15 PPR & Streaming Hydration Isolation Guardrail

Next.js 15 Partial Prerendering (PPR) delivers an instant static HTML shell while streaming dynamic components over the same HTTP connection. Invoking dynamic request-time APIs (such as headers(), cookies(), searchParams, or un-cached data sources) outside of an explicit React Suspense boundary de-optimizes the entire page segment to dynamic SSR at request time. Dynamic subtrees must be isolated within Suspense boundaries whose fallback skeletons structurally mirror dynamic components to prevent streaming hydration mismatches.

Blocks:Uncontained Dynamic Request APIs Forcing Full Dynamic SSR and Streamed Hydration Collapse
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-rune-state-proxy-isolation-standard
frontendcritical

Svelte 5 High-Frequency Telemetry Isolation via $state.raw

Mandates the use of $state.raw for high-frequency streaming data, binary buffers, and large collections in Svelte 5. By bypassing recursive reactive proxy tree synthesis, applications eliminate massive memory allocation overhead, micro-tick thrashing, and garbage collection stutter during sustained telemetry ingestion. Deep reactivity must be explicitly decoupled from raw ingest buffers and reserved exclusively for leaf presentation primitives.

Blocks:Wrapping high-frequency telemetry payloads in standard $state runes causing recursive proxy thrashing and frame drops
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-state-guardrail
frontendcritical

Svelte 5 Runes Asynchronous State Transition and Signal Dependency Guardrail

Enforces rigid synchronous tracking boundaries on Svelte 5 reactive runes ($state, $derived, $effect) to eliminate microtask dependency drops. Prevents unhandled teardown cascades, stale state overwrites, and memory leaks during concurrent asynchronous UI transitions.

Blocks:Naked Async $effect Callbacks Reading Signals Post-Await with Untracked Dependencies and Out-of-Order Teardowns
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-v1-search-param-schema-invariant
frontendcritical

TanStack Router v1 Runtime Search Parameter Validation and Isolation Invariant

Enforces strict runtime schema validation and serialization isolation for all route search parameters via validateSearch at the route boundary. Eliminates client-side prototype pollution, malformed state propagation, and unchecked type-casting across nested route transitions.

Blocks:Bypassing runtime validation via TypeScript type assertions or unconstrained record parsing in route search configurations
Targets:Cursor•Claude•Windsurf•Codex
react-19-useactionstate-optimistic-rollback-barrier
frontendcritical

React 19 useActionState Optimistic Rollback Barrier & Race-Condition Defense

Enforces strict transactional synchronization between React 19 useActionState and useOptimistic primitives. Eliminates zombie speculative UI states, stale hydration mismatches, and out-of-order reconciliation when server actions execute across high-latency networks or experience transit failures.

Blocks:Ad-Hoc Imperative Rollback Logic and Decoupled Optimistic State via Standard useState Hooks
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-runtime-sandbox-isolation
frontendcritical

Vite 6 Environment API Multi-Runtime Sandbox & Memory Guardrails

Enforces deterministic process boundaries, memory limits, and module execution sandboxing across heterogeneous Vite 6 environments (Workerd, Node.js, Deno). Prevents host runtime pollution, IPC starvation, and cross-environment global prototype leaks during dev-server and SSR build phases.

Blocks:Global Scope Bleed and Unbounded Memory Allocation in Vite 6 Mixed SSR Runners
Targets:Cursor•Claude•Windsurf•Codex
vite6-rolldown-module-federation-boundary-isolation
frontendcritical

Vite 6 Rolldown Module Federation AST Boundary and Scope Isolation

Enforces strict Rust-based AST graph separation in Vite 6 (Rolldown) to eliminate runtime global-scope pollution, duplicate vendor chunk execution, and multi-version framework instantiation across dynamic federated remotes. Guarantees that shared singleton runtimes (such as React or Vue context dispatchers) are pinned to immutable host scopes while dynamic exposed remotes use isolated chunk evaluation contexts.

Blocks:Implicit Scope Leakage and Dual-Framework Instantiation via Unpinned Module Federation Sharing
Targets:Cursor•Claude•Windsurf•Codex
tauri-v2-capability-scoped-zero-copy-ipc
frontendcritical

Tauri 2.0 IPC Capability-Scoped Zero-Copy ArrayBuffer Isolation

Enforces fine-grained Tauri 2.0 ACL capability scoping and raw binary TypedArray/ArrayBuffer transfers across the Webview-to-Core boundary. Prohibits base64 or JSON-serialized byte arrays to eliminate GC pressure, heap fragmentation, and unauthorized IPC capability escalation.

Blocks:Passing Large Binary Blobs via Base64/JSON Serialization Over Unscoped Tauri IPC Commands
Targets:Cursor•Claude•Windsurf•Codex
tanstack-start-streaming-hydration-chunk-cancellation-barrier
frontendcritical

TanStack Start Streaming Hydration Chunk Cancellation Barrier

Mandates strict AbortSignal binding between HTTP transport streams, TanStack Start server functions, and client-side deferred hydration loaders. Prevents orphaned server-side computations, dangling database queries, and uncollected client hydration chunks when a user navigates away or disconnects mid-stream.

Blocks:Orphaned Deferred Loaders and Unbounded Server Execution After Stream Disconnection
Targets:Cursor•Claude•Windsurf•Codex
react-19-metadata-preload-cascade-suppression-standard
frontendcritical

React 19 Document Metadata Preload Cascade Suppression Standard

Enforces strict priority scheduling and deterministic consolidation for React 19 native document metadata hoisting (<title>, <meta>, <link rel='stylesheet'>, and ReactDOM preload APIs). Prevents unstructured concurrent metadata injection that triggers browser resource discovery race conditions, FOUC, and Cumulative Layout Shift (CLS) storms.

Blocks:Unbounded Component-Level Dynamic Preloading and Late-Discovered Hoisted Stylesheets
Targets:Cursor•Claude•Windsurf•Codex
tauri2-multiwindow-shmem-frame-sync-standard
frontendcritical

Tauri 2.0 Multi-Window Shared Memory Frame Synchronization Standard

Mandates atomic fence synchronization and triple-buffered shared memory structures for cross-window canvas streaming across decoupled Tauri 2.0 WebViews. Eliminates buffer tearing, out-of-order frame presentation, and garbage collection thrashing inherent in serializing frame buffers over the native IPC event bus.

Blocks:Unsynchronized Raw Buffer Broadcasts via Tauri Event Bus Causing Frame Tearing and Serialization Bottlenecks
Targets:Cursor•Claude•Windsurf•Codex
vite-rolldown-federation-chunk-eviction-fence
frontendcritical

Vite 6 Rolldown Module Federation Chunk Eviction & Memory Boundary Fence

Enforces deterministic lifecycle reclamation, global symbol purge, and style tag teardown when dynamic federated remotes are unmounted in Vite 6 and Rolldown architectures. Prevents cross-remote prototype pollution, shared scope symbol collisions, and retain cycles within the host runtime.

Blocks:Dangling Remote Containers, Leaked Scope Registries, and Uncollected Federated DOM Artifacts
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-optimistic-reentrancy-isolation
frontendcritical

React 19 Optimistic State Isolation and Transactional Reentrancy Guardrail

Enforces deterministic transaction isolation and causal consistency for concurrent React 19 Server Actions paired with useOptimistic. Prevents UI state tearing, ghost rollbacks, and race-condition overwrites caused by interleaved, out-of-order network resolutions through monotonic sequence stamping and journaled base-state reconciliation.

Blocks:Naive optimistic state patching prone to out-of-order overwrites and phantom rollbacks during concurrent Server Action invocations
Targets:Cursor•Claude•Windsurf•Codex
next15-ppr-hydration-watermark-invariant
frontendcritical

Next.js 15 PPR Static Shell Hydration Watermark Invariant

Enforces strict isolation between static prerendered shells and dynamic streaming Suspense boundaries in Next.js 15 Partial Prerendering (PPR). Guarantees deterministic microtask execution order and prevents client-side hydration mismatch cascading caused by unisolated asynchronous context access under high-latency edge streaming.

Blocks:Dynamic State Leakage Across Static PPR Boundaries Causing Cascading Hydration De-optimization
Targets:Cursor•Claude•Windsurf•Codex
react-19-asset-preloading-priority-watermark-standard
frontendcritical

React 19 Streaming SSR Asset Preloading and 103 Early Hints Watermark Standard

Enforces deterministic asset preloading tiers during React 19 concurrent streaming SSR (renderToPipeableStream/renderToReadableStream) to eliminate stylesheet and font waterfalls. Mandates the use of react-dom preloading APIs (preload, preinit) synchronized with server-level HTTP 103 Early Hints before Suspense boundaries yield control.

Blocks:Deferred In-Tree Preloading Inside Nested Suspense Boundaries Inducing Render-Blocking Asset Waterfalls
Targets:Cursor•Claude•Windsurf•Codex
react-19-activity-offscreen-boundary-standard
frontendcritical

React 19 Activity API Offscreen Boundary and Memory Retention Invariant

Governs the use of React 19's unstable_Activity (Offscreen API) across deep route transitions and tabbed panels. Enforces explicit lifecycle suspension, event listener teardown, and cancellation of pending asynchronous tasks during hidden states to prevent detached DOM memory leaks while retaining client-side component state.

Blocks:Uncontrolled Offscreen Activity Causing Detached DOM Leaks and Unthrottled Hidden Renders
Targets:Cursor•Claude•Windsurf•Codex
wasmgc-sharedarraybuffer-cross-origin-isolation-invariant
frontendcritical

WasmGC SharedArrayBuffer Cross-Origin Isolation and COOP/COEP Enforcement

Enforces strict Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) invariants across all root documents, service workers, and micro-frontend entrypoints to guarantee window.crossOriginIsolated is true. This prevents catastrophic runtime crashes when allocating shared WebAssembly.Memory instances for hardware-accelerated multithreaded WasmGC workloads. It also ensures all cross-origin subresources and workers declare appropriate Cross-Origin Resource Policy (CORP) headers.

Blocks:Instantiating Multithreaded WasmGC or SharedArrayBuffer Without Complete Cross-Origin Isolation and CORP Verification
Targets:Cursor•Claude•Windsurf•Codex
react-19-use-optimistic-server-action-rollback-guardrail
frontendcritical

React 19 useOptimistic Server Action Rollback & Layout Drift Invariants

Enforces deterministic UI state reconciliation and eliminates layout drift during concurrent React 19 Server Actions under high network latency or execution failure. Mandates explicit state pass-through via useActionState alongside useOptimistic, stable optimistic keys, and atomic rollback boundaries to prevent desynchronization between transient transitions and persistent server state. Forbids non-transitioned optimistic dispatching, unkeyed list appends, and local uncoordinated state shadowing.

Blocks:Unbounded Optimistic Mutating and Non-Transition Mutation Dispatch Causing Permanent Ghost State and Layout Drift
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-streaming-barrier-next-js-15-ppr-d-719
frontendcritical

Next.js 15 PPR Dynamic Hole Streaming Barrier Standard

Enforces strict boundary isolation for dynamic request data, asynchronous dynamic APIs, and streaming chunks under Next.js 15 Partial Prerendering (PPR). Guarantees that request-bound state cannot contaminate static edge shells or emit unhandled streaming rejections during deferred hydration.

Blocks:Accessing Uncached Request APIs Outside Suspense Boundaries or Emitting Unbounded Dynamic Stream Rejections into Static Shells
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-isolation-boundary
frontendcritical

Vite 6 Environment API Multi-Runtime Isolation Boundary

Enforces strict isolation of module graphs, resolution conditions, and transform pipelines across Edge, Node, and Workerd runtimes using the Vite 6 Environment API. Prevents cross-runtime symbol pollution, conflicting export conditions, and shared transform state in unified multi-target SSR compilations.

Blocks:Collapsing multi-target SSR compilation into a monolithic SSR pipeline with shared resolution conditions and cross-polluted transforms
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-coop-coep-isolation-shell
frontendcritical

Next.js 15 Cross-Origin Isolation (COOP/COEP) Shell Standard

Enforces strict process-level browser isolation (Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy) required for high-performance primitives such as SharedArrayBuffer and WebAssembly multi-threading in Next.js 15 App Router. Mandates that all federated layouts, edge middleware, and external asset loaders explicitly declare CORP/COEP headers to prevent render-tree lockouts and catastrophic iframe/asset degradation. Precludes cross-origin communication leakages and unauthorized cross-process memory inspection across federated boundary routes.

Blocks:Global COOP/COEP Header Ingestion Without CORP Boundary Management and Credential Handling
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-nonce-idempotency-pipeline
frontendcritical

React 19 Flight Stream Nonce-Binding and Idempotency Architecture

Enforces cryptographic nonce binding and atomic idempotency locks for all mutating React 19 Server Actions across the RSC Flight stream wire protocol. Prevents catastrophic double-commits, phantom mutations, and non-repudiation failures during transient transport resets or browser-level retry cascades.

Blocks:Naked Server Action Submissions Vulnerable to Flight Stream Retries and Duplicate Mutation Commits
Targets:Cursor•Claude•Windsurf•Codex
tanstack-router-search-param-canonicalization
frontendcritical

TanStack Router Type-Safe URL Search Parameter Canonicalization & Validation Invariant

Enforces strict runtime structural validation and sanitization on all TanStack Router search parameters via validated schemas in the validateSearch hook. Prevents unvalidated search params from triggering open redirects, bypassing access controls, injecting script vectors into DOM sinks, or corrupting client-side state.

Blocks:Type Casting Unvalidated Search Params Leading to Client-Side State Injection and XSS Vulnerabilities
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-cyclic-mutation-fence
frontendcritical

Svelte 5 Runes Reactive Graph Cyclic Mutation Fence

Enforces strict computation purity within Svelte 5 `$derived` and `$derived.by` runes to safeguard the push-pull reactive graph. Unbatched signal mutations, deep object state writes, and implicit side effects within derived calculations cause dependency graph thrashing, non-deterministic re-evaluations, and catastrophic circular update loops in complex single-page architectures. Computations must remain referentially transparent projections of state, offloading mutations exclusively to explicit user event handlers or untracked `$effect` fences.

Blocks:Mutating Root or Proxied $state Signals Directly Inside $derived Computations
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-isolation-boundary-standard
frontendcritical

Svelte 5 Runes Reactive Isolation Boundary Standard Across Micro-Frontends

Enforces strict isolation boundaries when exposing or consuming Svelte 5 reactive rune graphs across host-remote micro-frontend architectures. Prevents cross-instance signal retention leaks and unbounded cascading re-renders by mandating immutable snapshots ($state.snapshot) and untracked proxy adapters at federation seams.

Blocks:Cross-Boundary Signal Leakage and Cascading Render Storms via Direct $state Proxy Exposure
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-abortsignal-backpressure
frontendcritical

React 19 Server Action Backpressure & AbortSignal Propagation Guardrail

Enforces strict AbortSignal binding and cancellation tokens across React 19 concurrent transitions and Server Actions. Prevents phantom background writes, stale state overwrites, and desynchronized optimistic UI by halting upstream RPCs and database transactions when client transitions are superseded or aborted.

Blocks:Uncancellable Fire-and-Forget Server Actions Overwriting Fresh State After Client Navigation
Targets:Cursor•Claude•Windsurf•Codex
svelte5-runes-reactive-graph-cycle-guardrail
frontendcritical

Svelte 5 Runes Reactive Graph Cycle & Depth Bounding Guardrail

Enforces static determinism and runtime cycle/depth bounding across Svelte 5 runes ($state, $derived, $effect) to eliminate cascading reactive microtask storms. Mandates untracked async dependency isolation, mutation-free derivations, and cancellation semantics across asynchronous boundaries.

Blocks:Unbounded Feedback Cascades and Untracked Async Re-entries in Svelte 5 Signal Graphs
Targets:Cursor•Claude•Windsurf•Codex
react-19-concurrent-action-hydration-lock
frontendcritical

React 19 Concurrent Action Hydration Interleaving Lock

Enforces deterministic serialization between progressive streaming SSR hydration chunks and user-dispatched concurrent action transitions. Guarantees that interactive actions dispatched on partially hydrated streaming components are safely queued through React 19 native action boundaries, eliminating DOM desynchronization, fiber tearing, and hydration mismatch panics.

Blocks:Mutating state via uncoordinated async handlers or imperative DOM updates during streaming SSR hydration
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-cross-island-signal-boundary-enforcement
frontendcritical

Svelte 5 Runes Cross-Island Signal Boundary & Teardown Enforcement

Enforces deterministic lifecycle and memory boundary isolation when sharing Svelte 5 runes ($state, $derived, $effect.root) across heterogeneous micro-frontend islands. Guarantees that fine-grained reactive subscriptions and detached signal dependency graphs are explicitly disposed during island unmounting to prevent cross-framework memory leaks.

Blocks:Unbounded Cross-Island Signal Subscriptions via Undisposed $effect.root Trees
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-distributed-idempotency-fencing
frontendcritical

React 19 Server Action Distributed Idempotency Key Fencing

Prevents duplicate mutations, race conditions, and unauthorized replays during network retries or progressive enhancement form submissions by cryptographically binding an idempotency token across the React Server Component (RSC) wire boundary. Mandates distributed atomic fencing and cache-aside replay handling before executing non-reversible side-effects.

Blocks:Unfenced Server Actions Executing Duplicate Side-Effects on Network Retries or Rapid Clicks
Targets:Cursor•Claude•Windsurf•Codex
vite-6-environment-api-runtime-isolation-vite-6-environme-913
frontendcritical

Vite 6 Environment API Multi-Runtime Module Execution Isolation

Enforces strict runtime module and state isolation across client, SSR Node, and edge worker compilation environments using the Vite 6 Environment API. Prevents cross-environment global state pollution, prototype tampering, and memory leaks by ensuring each runner uses isolated module runners, environment-scoped dev plugins, and runtime-agnostic module evaluation.

Blocks:Global Module Evaluation Sharing and Unscoped State Leakage Across Heterogeneous Vite Environments
Targets:Cursor•Claude•Windsurf•Codex
react19-resource-hint-multiplexing-watermark
frontendcritical

React 19 Resource Hint Multiplexing & Layout Watermark Guardrail

Enforces deterministic, top-level resource hint orchestration using React 19 native DOM preinit and preload APIs at layout watermarks. Prevents duplicate network requests, priority inversion, and client-side streaming waterfalls caused by fragmented, ad-hoc asset loading across nested Server-Client Component boundaries.

Blocks:Ad-Hoc Client-Side Resource Injection and Leaf-Level Hint Thrashing
Targets:Cursor•Claude•Windsurf•Codex
svelte5-universal-runes-ssr-leak-guardrail
frontendcritical

Svelte 5 Universal Runes SSR Memory Retention & Cross-Request Contamination Guardrail

Enforces strict isolation of universal reactive runes ($state, $derived) within request and component lifecycles in Svelte 5 SSR environments. Module-level reactive rune instantiations persist across concurrent HTTP requests in Node.js/Bun/Deno runtimes, causing critical multi-tenant data leaks and unbounded memory retention. All shared reactive state MUST be scoped to Svelte contexts, request events, or per-instance class closures.

Blocks:Global Module-Level Rune Declarations Leaking Multi-Tenant State and Retaining Memory in SSR Runtimes
Targets:Cursor•Claude•Windsurf•Codex
vite-6-sharedarraybuffer-coop-coep-memory-ownership
frontendcritical

Vite 6 SharedArrayBuffer Cross-Origin Isolation and Memory Ownership Standard

Enforces strict Cross-Origin Isolation via COOP and COEP credentialless headers across Vite 6 development and production preview environments. Mandates explicit memory management patterns including zero-copy Transferable streams, Atomics-based synchronization for SharedArrayBuffer, and deterministic ownership transfer between the main thread and Web Workers to eliminate race conditions and memory leaks.

Blocks:Unsynchronized SharedArrayBuffer Mutations and Structured Clone Overhead Without Isolation Headers
Targets:Cursor•Claude•Windsurf•Codex
react19-rsc-taint-boundary-protection
frontendcritical

React 19 Server Components Tainted Reference Boundary Enforcement

Enforces strict application of React 19 taint primitives (experimental_taintObjectReference and experimental_taintUniqueValue) across server-side data access layers. Guarantees that private tenant credentials, cryptographic secrets, and unscrubbed domain models are structurally blocked from crossing the React Server Component serialization boundary during streaming SSR.

Blocks:Leaking Raw Tenant Credentials and Private Keys Across the RSC-Client Serialization Boundary
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-io-boundary-guardrail
frontendcritical

Next.js 15 PPR Dynamic IO Boundary and Prerender Shell Guardrail

Enforces deterministic separation between static prerender shells and dynamic runtime execution paths under Next.js 15 Partial Prerendering (PPR) and Dynamic IO. Prevents dynamic data APIs (headers, cookies, searchParams, and uncached fetch operations) from executing outside React Suspense boundaries, which de-optimizes partial static generation into full on-demand SSR.

Blocks:Accessing Runtime Request Headers and Uncached IO Outside Suspense Boundaries
Targets:Cursor•Claude•Windsurf•Codex
react-19-optimistic-mutation-reentrancy-rollback-standard
frontendcritical

React 19 Optimistic Mutation Re-entrancy & Rollback Guardrail

Enforces deterministic state reconciliation during concurrent, re-entrant Server Action executions using React 19 useOptimistic and useActionState primitives. Prevents view-model divergence, stale baseline clobbering, and uncoordinated rollbacks caused by out-of-order network resolutions in asynchronous optimistic mutations.

Blocks:Non-Deterministic Optimistic Rollback and Out-of-Order Clobbering in Concurrent Transitions
Targets:Cursor•Claude•Windsurf•Codex
react19-rsc-taint-api-policy
frontendcritical

React 19 Server Components Taint API Serialization Barrier Enforcement

Enforces strict server-side boundary validation using React 19's experimental Taint APIs (taintObjectReference and taintUniqueValue). Ensures that raw database entities containing sensitive customer data, cryptographic keys, and backend API tokens are irrevocably marked as untransferable before crossing the React Server Component (RSC) to Client Component serialization boundary. Mandates explicit data transfer object (DTO) projection to prevent accidental exposure via Flight payload serialization.

Blocks:Passing Unsanitized Server Entities or Environment Secrets Directly to Client Component Props
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-sandbox-worker-isolation
frontendcritical

Vite 6 Environment API Worker-Thread Sandbox Isolation and Lifecycle Management

Enforces strict process and worker-thread isolation across heterogeneous runtime targets (Client, Node SSR, Edge/Workerd) utilizing the Vite 6 Environment API. Prevents module graph cross-contamination, polyfill pollution of global scopes, and heap accumulation by mandating explicit environment runners, isolated resolution conditions, and deterministic lifecycle teardowns.

Blocks:Monolithic Dev Server Runtime Sharing Module Graphs and Ambient State Across SSR and Edge Targets
Targets:Cursor•Claude•Windsurf•Codex
react19-useactionstate-concurrent-mutex
frontendcritical

React 19 useActionState Deterministic Concurrency and Monotonic Sequence Guardrail

Enforces deterministic serialization and monotonic sequence verification for asynchronous mutations managed by React 19 useActionState. Prevents race conditions, out-of-order reconciliations, and stale payload overrides during high-frequency user interactions while preserving non-blocking optimistic UI updates.

Blocks:Unsequenced useActionState Mutations Causing Stale Clashes and Out-of-Order Overwrites
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-isolation-next-js-15-parti-855
frontendcritical

Next.js 15 Partial Prerendering Dynamic Hole Isolation and Layout Stability

Enforces deterministic boundaries between static prerendered HTML shells and dynamic asynchronous streaming segments under Next.js 15 Partial Prerendering (PPR). Guarantees dynamic data fetching functions execute strictly within explicitly bounded React Suspense boundaries equipped with dimension-locked fallbacks to eliminate cascading layout shifts (CLS) and TTFB regression over multiplexed HTTP/3 connections.

Blocks:Dynamic Scope Creep Causing Static Shell De-opt and Cascading Layout Shifts
Targets:Cursor•Claude•Windsurf•Codex
vite6-environment-api-multi-runtime-ssr-guardrail-vite-6-environme-593
frontendcritical

Vite 6 Environment API Multi-Runtime SSR Guardrail

Enforces strict isolation between Client, Node.js, and WinterCG edge runtimes using Vite 6 Environment APIs. Prevents cross-runtime global pollution, invalid module externalization, and cross-boundary state leakage during unified multi-environment SSR bundling.

Blocks:Monolithic SSR configurations leaking Node.js built-ins or browser globals across heterogeneous runtime environments
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-reactive-context-isolation
frontendcritical

Svelte 5 Runes Fine-Grained Reactive Context Isolation Invariant

Enforces strict lifecycle-bound encapsulation for Svelte 5 runes ($state, $effect, $derived) within micro-frontend architectures and component hierarchies. Prevents memory leaks caused by module-level signal subscriptions and cross-boundary graph pollution where external event cascades trigger untracked reactive evaluation in unmounted sub-trees.

Blocks:Module-Scoped Signal Retention and Unbounded Cross-Boundary Reactive Graph Pollution
Targets:Cursor•Claude•Windsurf•Codex
web-streams-backpressure-cooperative-drain-invariant
frontendcritical

Web Streams Backpressure Cooperative Drain Invariant

Enforces strict backpressure propagation and zero-overflow cooperative drain across client-side Web Streams processing high-throughput telemetry, binary blobs, and large artifacts. Prohibits decoupled asynchronous chunk queuing and unthrottled producer reads to prevent V8/Chromium renderer heap exhaustion and browser tab termination.

Blocks:Unbounded Async Enqueueing and Decoupled Stream Pumps Overwhelming Browser Tab Heap
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-cycle-barrier
frontendcritical

Svelte 5 Runes Microtask Re-entrancy & Reactive Dependency Cycle Barrier

Enforces strict unidirectional data flow and non-cyclical dependency invariants across Svelte 5 custom runes and effect handlers. Prevents catastrophic microtask queue starvation and synchronous infinite re-entrancy caused by bi-directional state mutations across nested reactive contexts.

Blocks:Bi-directional Ping-Pong Synchronization via Cascading $effect State Mutations
Targets:Cursor•Claude•Windsurf•Codex
react19-server-actions-optimistic-rollback-reseed-invariant
frontendcritical

React 19 Server Actions Optimistic Mutation Rollback & Reseed Invariant

Enforces deterministic reconciliation between client optimistic state via useOptimistic, server action response payloads via useActionState, and persistent form inputs. Prevents UI tearing, lost user focus/draft input, and ghost state when edge server actions fail or experience high-latency network partitions.

Blocks:Ad-Hoc Imperative useState Optimism with Unchecked Form Resets on Action Failure
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-key-standard
frontendcritical

React 19 Server Action Client-Side UUIDv7 Idempotency Standard

Enforces client-synthesized UUIDv7 idempotency keys on all state-mutating React 19 Server Actions paired with optimistic updates. Guarantees exactly-once mutation semantics across spotty mobile network reconnections, duplicate form submissions, and automated retry loops. Prevents duplicated side effects such as repeat charges, duplicate ledger entries, and orphaned database rows.

Blocks:Submitting Blind Server Actions and Optimistic State Without Client-Generated Idempotency Keys
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes-async-hydration-boundary
frontendcritical

Svelte 5 Runes Async Hydration Boundary Guardrail

Enforces strict isolation of asynchronous microtask execution from Svelte 5 synchronous signal tracking to prevent reactive graph tearing. In Svelte 5, the active reactive tracking context ($effect, $derived) is synchronously bound and detaches across await points and microtask queues. This rule prevents orphaned signals, missed invalidations, and DOM hydration mismatches between SSR streaming chunks and client signal graphs.

Blocks:Microtask Suspension Within Runes Tracking Context Causing Hydration Graph Tearing
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-actions-concurrent-optimistic-mutex-standard
frontendcritical

React 19 Server Actions Monotonic Optimistic Mutex Standard

Enforces strict monotonic mutation sequencing and client-side transaction serialization across concurrent React 19 Server Action invocations and multi-tab dynamic UI updates. Prevents out-of-order resolution, lost updates, and optimistic state clobbering by mandating versioned optimistic transitions coupled with client-side Web Locks and monotonic revision vectors.

Blocks:Unordered Server Action dispatching with naive useOptimistic state overrides causing out-of-order state corruption and multi-tab divergence.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-ppr-dynamic-hole-timeout-fallback-invariant
frontendcritical

Next.js 15 PPR Dynamic Hole Streaming Timeout and Circuit-Breaker Invariant

Enforces deterministic streaming latency in Next.js 15 Partial Prerendering (PPR) by mandating strict execution timeouts and circuit-breaker fallbacks on all dynamic Suspense holes. Prevents upstream microservice degradation from stalling HTTP/2 streaming responses, exhausting edge connection limits, or causing 504 Gateway Timeouts.

Blocks:Unbounded Dynamic Suspense Streaming Holding Open Server Streams and Inducing Edge Connection Exhaustion
Targets:Cursor•Claude•Windsurf•Codex
react-19-rsc-taint-boundary-enforcement
frontendcritical

React 19 RSC Taint API & Cryptographic Boundary Enforcement

Enforces strict cryptographic serialization boundaries in React 19 Server Components using experimental_taintUniqueValue and taintObjectReference. Guarantees that internal database records, private API tokens, and cryptographic keys are blocked at the RSC serialization layer from leaking to client bundles.

Blocks:Unchecked Secret and Session Deserialization Across RSC-to-Client Component Props
Targets:Cursor•Claude•Windsurf•Codex
react-19-server-action-idempotency-boundary
frontendcritical

React 19 Server Action Idempotency and Nonce-Gated Reentrancy Control

Enforces client-generated idempotency keys and sequence-gated state reconciliation for React 19 Server Actions. Eliminates duplicate server mutations, out-of-order race conditions, and corrupted optimistic UI state during burst submissions or unstable network conditions.

Blocks:Un-keyed Direct Server Action Invocations and Naked useOptimistic State Transitions Under Burst Traffic
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-async-request-context-als-leak-guardrail
frontendcritical

Next.js 15 Async Request Context & AsyncLocalStorage Isolation Standard

Enforces strict isolation of Node.js AsyncLocalStorage (ALS) and Next.js 15 dynamic asynchronous request boundaries during concurrent React Server Component (RSC) streaming renders. Prevents cross-request telemetry contamination, cryptographic context bleed, and tenant credential mixing caused by un-scoped ALS contexts, module-level singletons, and microtask interleaving.

Blocks:Global Module-Level State and Unbounded AsyncLocalStorage Execution Leaking Across Interleaved Streaming RSC Render Passes
Targets:Cursor•Claude•Windsurf•Codex
nextjs-15-app-router
frontendcritical

Next.js 15 App Router & Server Actions Standard

Strict architecture guardrails for Next.js 15: strictly App Router (no pages/ bleed), async request APIs (cookies, headers, params), and secure Server Actions.

Blocks:AI outputs legacy pages/ router, synchronous cookies(), or unvalidated server actions vulnerable to CSRF.
Targets:Cursor•Claude•Windsurf•Codex
react-19-compiler
frontend

React 19 Compiler & Modern Hooks Architecture

Conventions for React 19: utilize React Compiler automatic memoization, replace boilerplate useMemo/useCallback, adopt useActionState, useOptimistic, and Server Actions.

Blocks:AI wraps every primitive function in useCallback/useMemo out of habit and hallucinates legacy useEffect data fetching.
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4
frontend

Tailwind CSS v4 Modern Theme & Pure CSS Standard

Guardrails for Tailwind CSS v4: use @import 'tailwindcss', @theme directive in CSS, native cascade layers, and pure CSS variables instead of tailwind.config.js.

Blocks:AI attempts to generate a legacy tailwind.config.js, uses deprecated @apply syntax, or confuses v3 arbitrary values.
Targets:Cursor•Claude•Windsurf•Codex
vue-3-composition-api
frontend

Vue 3.5+ Composition API & Script Setup Standard

Strict Vue 3.5+ architecture: pure <script setup lang='ts'>, reactive props destructuring, shallowRef for performance, and zero Options API legacy code.

Blocks:AI mixes this.$refs, Options API data()/methods(), or fails to use Vue 3.5 reactive props destructure.
Targets:Cursor•Claude•Windsurf•Codex
typescript-strict-core
frontendcritical

TypeScript Strict Mode & Zero Any Standard

Enterprise TypeScript discipline: strict null checks, no 'any' types, discriminated unions for state modeling, and the satisfies operator.

Blocks:AI uses 'as any', loose object index signatures, or overlooks discriminated union narrowing.
Targets:Cursor•Claude•Windsurf•Codex
zustand-v5-state
frontend

Zustand v5 Atomic State & Clean Selectors Standard

Production Zustand v5 patterns: use atomic selector hooks to prevent unnecessary re-renders, avoid giant monolithic stores, and strictly enforce immutable state mutations.

Blocks:AI calls useStore() without selectors causing the entire component tree to re-render on every state change.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-query-v5
frontend

TanStack Query v5 Server State & Cache Factory

Best practices for TanStack Query v5: queryKey factories for bulletproof cache invalidation, mutation optimistic updates, and elimination of useEffect data fetching.

Blocks:AI uses inline strings for query keys, causing impossible cache invalidations or N+1 fetch waterfalls.
Targets:Cursor•Claude•Windsurf•Codex
shadcn-ui-radix
frontend

shadcn/ui & Radix UI Component Composition Discipline

Guardrails for shadcn/ui and Radix UI: composition with cva (class-variance-authority), accessibility attributes, and preventing CSS class specificity conflicts.

Blocks:AI writes hardcoded style overrides on shadcn components, breaking dark mode and accessibility.
Targets:Cursor•Claude•Windsurf•Codex
astro-5-content
frontend

Astro 5 Islands & Content Layer Standard

Conventions for Astro 5: zero-JS HTML by default, island client directives (client:load, client:visible), and the modern Astro Content Layer API.

Blocks:AI loads heavy client-side JavaScript across the entire page, defeating Astro's zero-JS performance premise.
Targets:Cursor•Claude•Windsurf•Codex
svelte-5-runes
frontend

Svelte 5 Runes & Modern Reactivity Standard

Guardrails for Svelte 5: adopt runes ($state, $derived, $effect, $props) and strictly avoid deprecated Svelte 3/4 'let' reactive assignments ($:).

Blocks:AI generates legacy Svelte 4 '$:' syntax or 'export let prop' which are deprecated in Svelte 5.
Targets:Cursor•Claude•Windsurf•Codex
zod-v3-validation
frontendcritical

Zod Schema Validation & Strict Sanitization

Bulletproof data validation using Zod: enforce safeParse, handle type coercion safely, sanitize strings, and prevent prototype pollution.

Blocks:AI uses .parse() directly causing unhandled runtime crashes, or relies on unsafe type assertions instead of safeParse.
Targets:Cursor•Claude•Windsurf•Codex
vitest-testing-frontend
frontend

Vitest & Testing Library User-Centric Test Standard

Conventions for Vitest & React/Vue Testing Library: test user behavior rather than implementation details, use screen.getByRole, and mock network calls cleanly with MSW.

Blocks:AI tests internal state values and props, writes fragile test selectors, or tests implementation details.
Targets:Cursor•Claude•Windsurf•Codex
remix-react-router-v7
frontend

React Router v7 / Remix Data Architecture Standard

Guardrails for React Router v7 & Remix: standard loaders and actions, progressive enhancement, error boundaries, and clientLoader caching.

Blocks:AI uses useEffect for fetching in React Router or fails to implement route error boundaries.
Targets:Cursor•Claude•Windsurf•Codex
css-modern-container
frontend

Modern CSS Grid, Subgrid & Container Queries Standard

Responsive layout architecture: CSS container queries (@container), subgrid alignment, clamp() fluid typography, and zero hardcoded fixed-pixel breakpoints.

Blocks:AI uses fixed pixel widths that break mobile viewports, or writes dozens of rigid media queries.
Targets:Cursor•Claude•Windsurf•Codex
micro-frontend-module-federation
frontend

Module Federation 2.0 & Micro-Frontend Discipline

Guardrails for Micro-Frontends: Module Federation 2.0 shared dependency singletons, isolated CSS scoping, and resilient runtime error boundaries.

Blocks:AI duplicates React runtime instances causing dual-hook crashes, or leaks global CSS across micro-apps.
Targets:Cursor•Claude•Windsurf•Codex
biome-linter-formatter
frontend

Biome Modern Toolchain & Rust-Powered Linter Discipline

Production guidelines for Biome (Rust-native linter/formatter). Replaces legacy ESLint + Prettier toolchain sprawl with sub-millisecond single-binary checks, strict import organization, and zero-config speed.

Blocks:AI scaffolds obsolete .eslintrc.json and .prettierrc configs with conflicting plugins instead of modern biome.json.
Targets:Cursor•Claude•Windsurf•Codex
playwright-e2e-testing
frontendcritical

Playwright Resilient E2E & Web-First Assertions Standard

Battle-tested End-to-End testing architecture with Playwright. Forbids arbitrary sleeps, manual timeouts, and brittle XPath selectors; mandates web-first auto-retrying assertions and accessible locators.

Blocks:AI writes flaky tests with page.waitForTimeout(5000) and brittle XPath selectors that fail under network latency.
Targets:Cursor•Claude•Windsurf•Codex
react-hook-form-zod
frontend

React Hook Form & Zod Strict Uncontrolled Validation

High-performance form state management with React Hook Form and Zod schema validation. Eliminates per-keystroke re-render waterfalls via uncontrolled inputs, enforces type-safe resolvers, and manages loading states.

Blocks:AI binds every form input to useState causing massive re-renders on every keystroke and loose manual validation.
Targets:Cursor•Claude•Windsurf•Codex
storybook-v8-csf3
frontend

Storybook 8 Component Story Format (CSF3) Standard

Modern component-driven development with Storybook 8 and CSF3. Replaces deprecated CSF2 template factories (Template.bind({})) with declarative Meta/StoryObj typing, play functions for interaction tests, and autodocs.

Blocks:AI outputs deprecated CSF2 Template.bind({}) or legacy storiesOf syntax that fails TypeScript checking in Storybook 8.
Targets:Cursor•Claude•Windsurf•Codex
dnd-kit-accessible-drag-drop
frontend

dnd kit Modern & Accessible Drag-and-Drop Architecture

Lightweight, modular, and accessible drag-and-drop powered by @dnd-kit/core and @dnd-kit/sortable. Forbids deprecated react-beautiful-dnd, supports keyboard navigation, touch screens, and React 19 concurrent mode.

Blocks:AI imports deprecated react-beautiful-dnd which crashes in React 18/19 StrictMode and lacks keyboard accessibility.
Targets:Cursor•Claude•Windsurf•Codex
turborepo-monorepo-best-practices
frontendcritical

Turborepo 2+ Monorepo Pipeline & Strict Boundary Architecture

Production guidelines for Turborepo 2+ monorepos. Mandates strict package.json exports, hermetic task inputs/outputs caching declarations, boundary linting, and forbids implicit sibling workspace imports.

Blocks:AI scaffolds circular workspace imports, omits turbo.json hash boundaries, and causes cache misses across build pipelines.
Targets:Cursor•Claude•Windsurf•Codex
tanstack-table-v8-virtualization
frontend

TanStack Table v8 & Virtualized Row Architecture

Enterprise data grid architecture using headless TanStack Table v8 and @tanstack/react-virtual. Eliminates browser main-thread freezes on 10,000+ row datasets through DOM element recycling, memoized column accessors, and debounced filtering.

Blocks:AI maps 5,000 un-virtualized <tr> elements directly to the DOM with inline sort functions, freezing the browser UI.
Targets:Cursor•Claude•Windsurf•Codex
threejs-webgl-lifecycle-cleanup
frontendcritical

Three.js & WebGL Memory Lifecycle and GPU Resource Disposal

Production guidelines for 3D graphics in modern web applications. Mandates rigorous GPU buffer disposal (geometries, textures, render targets), animation frame cleanup, and context loss recovery to eliminate fatal memory leaks.

Blocks:AI instantiates Three.js scenes inside React useEffect without calling dispose() on geometries and textures, crashing user browser tabs.
Targets:Cursor•Claude•Windsurf•Codex
webrtc-realtime-media-stream
frontendcritical

WebRTC Realtime MediaStream & ICE Candidate Resilient Architecture

Production WebRTC audio/video communications standard. Mandates polite peer negotiation, candidate queuing before remote description, iceconnectionstatechange monitoring, and deterministic MediaStreamTrack teardown.

Blocks:AI attempts to addIceCandidate() before setRemoteDescription() executes, causing silent peer connection drops.
Targets:Cursor•Claude•Windsurf•Codex
tailwind-v4-container-fluid
frontend

Tailwind CSS v4 Container Queries & Fluid Typography System

Modern modular styling with Tailwind CSS v4 container queries (@container) and CSS clamp() fluid scales. Forbids fixed viewport breakpoints on nested components, eliminates brittle @apply statements, and enforces pure CSS theme variables.

Blocks:AI binds nested card components to viewport breakpoints (md: flex), breaking responsive layouts inside sidebars.
Targets:Cursor•Claude•Windsurf•Codex
pwa-workbox-offline-cache-invalidation
frontendcritical

Progressive Web App (PWA) Workbox 7 & Cache Invalidation Architecture

Production architecture for Service Workers and Workbox 7. Mandates NetworkFirst for HTML navigation routes, CacheFirst with explicit content hashing for immutable static assets, and immediate registration skipWaiting lifecycle orchestration to prevent users from being permanently trapped on stale application bundles.

Blocks:AI generates a naive Service Worker caching all requests with CacheFirst, causing browsers to permanently serve obsolete HTML bundles even after redeployment.
Targets:Cursor•Claude•Windsurf•Codex
wasm-rust-web-worker-offscreen
frontendcritical

WebAssembly (WASM) Rust & Web Worker Heavy Compute Architecture

Production architecture for WebAssembly compute pipelines. Enforces offloading Rust/WASM binaries into dedicated Web Workers with zero-copy Transferable ArrayBuffers and OffscreenCanvas, eliminating main thread frame drops and browser UI freezing.

Blocks:AI loads and executes synchronous WebAssembly compute algorithms directly on the browser main UI thread, causing UI freezes and severe INP degradation.
Targets:Cursor•Claude•Windsurf•Codex
core-web-vitals-inp-lcp-optimization
frontendcritical

Core Web Vitals (INP, LCP, CLS) & Main Thread Yielding Standard

Production performance engineering standard for modern web applications. Mandates Interaction to Next Paint (INP) < 200ms using scheduler.yield() chunking, explicit layout dimensions preventing Cumulative Layout Shift (CLS), and priority resource loading (fetchpriority='high').

Blocks:AI executes large data transformation loops synchronously in event handlers, blocking the main thread and resulting in catastrophic INP failures (>500ms).
Targets:Cursor•Claude•Windsurf•Codex
next-intl-app-router-localization
frontend

Next.js 15 App Router & next-intl Dynamic Localization Architecture

Enterprise internationalization standard for Next.js 15 App Router. Mandates server-side translation resolution via next-intl, type-safe translation keys, clean routing middleware with alternate hreflang tags, and zero client bundle bloat from translation dictionaries.

Blocks:AI passes massive monolithic JSON translation dictionaries to client-side Context providers, bloating client bundle size and destroying Next.js 15 SSR caching.
Targets:Cursor•Claude•Windsurf•Codex
react-use-transition-concurrency
frontendcritical

React 19 Concurrent Rendering & useTransition Non-Urgent Update Slicing

Production standard for non-blocking concurrent UI updates in React 18/19. Mandates wrapping high-latency state updates (search filtering, tab switching, large list sorting) in useTransition / startTransition to maintain 60 FPS input responsiveness, eliminating main thread stutter and INP penalties. (Semgrep rule: react-unbatched-state-transitions)

Blocks:AI executes high-latency state filtering synchronously on user typing, blocking the main thread and triggering catastrophic Interaction to Next Paint (INP) failures.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-server-actions-csrf-authorization
frontendcritical

Next.js 15 Server Actions Session Authorization & CSRF Mitigation Standard

Enterprise security standard for Next.js 15 Server Actions. Mandates strict session authentication checks inside action bodies, Zod payload schema validation, CSRF origin verification, and prevents exposed POST mutations without authorization. (OWASP A01:2021 Broken Access Control / CWE-352).

Blocks:AI treats Next.js Server Actions like private internal functions, omitting session authentication and permitting unauthenticated public POST mutations.
Targets:Cursor•Claude•Windsurf•Codex
css-subgrid-nested-alignment
frontend

Modern CSS Grid Subgrid & Form Layout Track Inheritance Standard

Production standard for multi-column form and card alignments using CSS Grid Level 2 Subgrid. Eliminates manual fixed pixel offsets and JavaScript resize observers by allowing nested card items to align directly to the parent grid track definition.

Blocks:AI writes brittle JavaScript resize observers or hardcoded pixel heights to align cards across variable-length headers and buttons in grid layouts.
Targets:Cursor•Claude•Windsurf•Codex
typescript-satisfies-operator-narrowing
frontend

TypeScript satisfies Operator vs Type Assertion Casting Standard

Production TypeScript typing standard. Mandates using the 'satisfies' operator for configuration objects, themes, and route definitions to validate schema conformity while preserving exact literal types, strictly forbidding 'as Type' type assertions that mask missing properties.

Blocks:AI uses 'as ConfigType' or ': Record<string, any>' annotations, blowing away specific literal keys and breaking autocompletion and type narrowing.
Targets:Cursor•Claude•Windsurf•Codex
graphql-persisted-queries-apollo
frontend

GraphQL Automatic Persisted Queries (APQ) & DoS Defense Architecture

Production architecture for GraphQL clients (Apollo Client / Urql). Mandates Automatic Persisted Queries (APQ) with SHA-256 hashes, query whitelisting in production, and disables arbitrary client-crafted GraphQL strings to prevent query complexity Denial of Service attacks. (OWASP API Top 10).

Blocks:AI sends massive raw multi-kilobyte GraphQL query strings in every HTTP request body, enabling DoS attacks and wasting upstream mobile bandwidth.
Targets:Cursor•Claude•Windsurf•Codex
nextjs-dynamic-io-partial-prerendering
frontendcritical

Next.js 15 dynamicIO & Partial Prerendering (PPR) Streaming Standard

Production standard for Next.js 15 Partial Prerendering and experimental.dynamicIO. Enforces explicit React Suspense boundaries around dynamic cookies/searchParams calls, allowing static page shells to prerender instantly from CDN edges while streaming dynamic user slots.

Blocks:AI accesses dynamic request headers or cookies at the layout or root page level, de-optimizing the entire page to slow SSR dynamic rendering.
Targets:Cursor•Claude•Windsurf•Codex
react-aria-accessibility-focus-trap
frontend

Accessible Modals & Focus Trap Management Standard (WCAG 2.2 AA)

Production accessibility engineering standard for interactive web components. Mandates strict focus trapping within open dialogs, automatic restoration of focus to triggering elements upon dismissal, Escape key closing, and screen-reader ARIA live region notifications. (WCAG 2.2 Level AA).

Blocks:AI creates custom dialog modals using plain <div> tags without focus trapping or ARIA attributes, leaving keyboard and screen-reader users permanently trapped.
Targets:Cursor•Claude•Windsurf•Codex
zustand-immer-middleware-immutability
frontend

Zustand & Immer Middleware Deep Structural State Mutation Discipline

State management standard for Zustand v5 combined with Immer middleware. Enforces type-safe draft mutations for deeply nested states, prevents accidental manual object spread mistakes, and eliminates memory leak references in complex global client states.

Blocks:AI writes buggy 5-level deep object spread syntax (...state.a.b.c) inside Zustand actions, accidentally mutating nested objects or dropping sibling keys.
Targets:Cursor•Claude•Windsurf•Codex

Frequently Asked Questions • Frontend & Modern Web Engineering Guardrails

Why does AI frequently hallucinate legacy pages/ directory in Next.js 15?

LLMs are trained heavily on legacy Next.js 12–14 codebases where the Pages router was prevalent. The Next.js 15 App Router rule injects strict negative constraints that explicitly disallow pages/ directory creations and enforce Server Actions boundary protections.

How do agent rules optimize React 19 Compiler performance?

React 19 Compiler performs automatic memoization at build time. Our rule forbids excessive manual useMemo and useCallback boilerplate, enforcing modern primitives like useActionState and useOptimistic.

What IDE formats are supported for Frontend rules?

All rules can be exported directly into Cursor (.mdc), Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot configuration files.

Explore Other Architectural Categories:View All 5462 Rules