Fix taskset missing in container build by installing util-linux and adding fallback

The homepage mixed four different translucent washes (surface 44-60% plus a
backdrop-filter each), rendered the same four counters twice, and showed a
dangling "Welcome to " eyebrow because the localized string expected the hotel
name. A missing theme wallpaper replaced the whole sky gradient with flat
white, and stale CMS image references produced broken images and 404s.

Replace the ad-hoc panels with one opaque, theme-derived `.panel` token set
(surface, border, shadow, header, radius) and a `.panel-float` variant for the
counter strip that straddles the hero edge. The strip is now the single home
of the four headline counters; a failed read renders "unavailable" instead of
silently dropping a cell. Add the fourth feature card (Games) that already had
translated copy, link recent users to their profiles, and fall back to themed
placeholders for news covers and camera photos without an upload.

Add `pages.home.heroEyebrow` to all 25 locales, layer the CMS wallpaper over
`--site-bg-gradient` instead of replacing it, and keep the sky in dark mode.
Add `publicAssetExists` so local uploads that no longer exist are skipped
(wallpaper, help topics) rather than rendered broken. Fix the `/help` topic
icons to use the `/assets/images/help-center/` base the detail page already
used.

Throttle the spotlight glow to one update per animation frame, drop the dead
`.glass-chip` rules, define the missing `.panel-float`, and fix the stat
divider and reduced-motion selectors. Stat labels use the readable text token
so they clear WCAG AA, and the language button's accessible name now contains
its visible label.

Verified: tsc, biome, 3590 unit tests, i18n audit unchanged, axe 0 violations
at 390/768/1024/1280/1440 in light and dark, quality e2e 16/16.

.dockerignore

@@ -26,6 +26,25 @@ bun.lockb
 public/nitro-assets
 public/swf
 
+# Testbronnen draaien op de host (pnpm test:ui / test:integration / test:e2e),
+# de image heeft ze niet nodig. In de image zouden ze alleen de typecheck van
+# `next build` meebepalen en de image van @playwright/test, vitest, msw,
+# testcontainers en drizzle-kit afhankelijk maken.
+e2e/
+integration/
+
+# Databasebackups (~232MB, dagelijkse rotatie): horen niet in de buildcontext.
+# Ze maakten elke context groot en invalideerden bij elke rotatie de
+# `COPY . .`-laag, waardoor de Next-build volledig opnieuw draaide.
+backups/
+
+# Wordt tijdens de build opnieuw gegenereerd door `pnpm assets:editor`
+# (bron: node_modules/tinymce) en staat niet in git.
+public/vendor/
+
+# Lokale buildcache voor `docker compose build` (cache_from/cache_to).
+.docker-cache/
+
 .deploy.lock
 logs
 

.env.example

@@ -3,8 +3,14 @@
 # ==============================================================================
 
 # --- DATABASE (High Performance Pooling & Strict Timeouts) ---
-DATABASE_URL="mysql://user:password@localhost:3306/dbname?charset=utf8mb4&connection_limit=150&connect_timeout=5"
-DATABASE_POOL_SIZE=150
+# The pool size is governed by DATABASE_POOL_SIZE (src/lib/db.ts); the
+# `connection_limit` in the URL is only honoured by tools that read the URL
+# directly (drizzle-kit, scripts). Keep both in step and keep them well below
+# MariaDB's `max_connections` (151 by default) or the emulator and any second
+# CMS instance get "Too many connections". README §performance: pool size 25.
+# DATABASE_URL supports both MySQL/MariaDB ("mysql://...") and PostgreSQL ("postgres://...").
+DATABASE_URL="mysql://user:password@localhost:3306/dbname?charset=utf8mb4&connection_limit=25&connect_timeout=5"
+DATABASE_POOL_SIZE=25
 DATABASE_IDLE_TIMEOUT_MS=60000
 DATABASE_CONNECT_TIMEOUT_MS=5000
 
@@ -59,6 +65,10 @@ AUTH_SECRET=your-super-secret-auth-key-change-this-min-32-chars
 APP_KEY=base64:your-app-key-here=
 # Bcrypt cost factor for new password hashes.
 BCRYPT_COST=12
+# Password-length policy for every new password (register, password reset and
+# staff-created accounts). Minimum: 5-30. Maximum: 30-128.
+PASSWORD_MIN_LENGTH=12
+PASSWORD_MAX_LENGTH=128
 
 # --- ANTI-DDOS (app-layer gate, production only) ---
 # On by default in production. Set to "false" to disable (not recommended).

.gitea/workflows/renovate.yaml

@@ -29,16 +29,16 @@ jobs:
           LOG_LEVEL: ${{ github.event.inputs.debug == 'true' && 'debug' || 'info' }}
         shell: bash
         run: |
-              docker run --rm \
-                --memory=6g \
-                --memory-swap=6g \
-                -e RENOVATE_PLATFORM=gitea \
-                -e RENOVATE_ENDPOINT=https://gitlab.epicnabbo.nl/ \
-                -e RENOVATE_TOKEN \
-                -e RENOVATE_REPOSITORIES='["remco/EpicNext-Cms"]' \
-                -e RENOVATE_AUTODISCOVER=false \
-                -e RENOVATE_BINARY_SOURCE=install \
-                -e LOG_LEVEL \
-                -e RENOVATE_ONBOARDING=true \
-                -e RENOVATE_REQUIRE_CONFIG=required \
-                "renovate/renovate:${RENOVATE_VERSION}"
+          docker run --rm \
+            --memory=6g \
+            --memory-swap=6g \
+            -e RENOVATE_PLATFORM=gitea \
+            -e RENOVATE_ENDPOINT=https://gitlab.epicnabbo.nl/ \
+            -e RENOVATE_TOKEN \
+            -e RENOVATE_REPOSITORIES='["remco/EpicNext-Cms"]' \
+            -e RENOVATE_AUTODISCOVER=false \
+            -e RENOVATE_BINARY_SOURCE=install \
+            -e LOG_LEVEL \
+            -e RENOVATE_ONBOARDING=true \
+            -e RENOVATE_REQUIRE_CONFIG=required \
+            "renovate/renovate:${RENOVATE_VERSION}"

.gitignore

@@ -57,6 +57,9 @@ blob-report/
 build-reports/
 !/docs/performance-budgets.md
 
+# Local buildcache (docker compose cache_from/cache_to)
+.docker-cache/
+
 # One-off local snapshots (o.a. catalog-integrity/pre-fix.json): runtime-werk,
 # geen bron. Per map opgeslagen om een incident terug te kunnen lezen.
 backups/

.nvmrc

@@ -1 +1 @@
-26.10.0
+26.12.1

CATALOG_EXPORT.md

@@ -26,15 +26,15 @@ This source change alone does not configure or deploy the production service.
 
 ## Exported content
 
-| Source | Repository destination |
-| --- | --- |
-| Configured Nitro bundles, including furniture, figures, effects and pets | `Gamedata/bundled` |
-| Configured furni icons | `Gamedata/icons` |
-| Existing badge/catalog images | `Gamedata/c_images` |
-| FurnitureData and supported public game-data JSON files | `Gamedata/config` |
-| Existing localized FurnitureData files | `catalogue version 2 ( Final (Dev)/langs furnidata` |
-| `items_base`, `catalog_pages`, `catalog_items` | `catalogue version 2 ( Final (Dev)/sqls` |
-| `catalog_pages_bc`, `catalog_items_bc`, when present | Same SQL directory |
+| Source                                                                   | Repository destination                              |
+| ------------------------------------------------------------------------ | --------------------------------------------------- |
+| Configured Nitro bundles, including furniture, figures, effects and pets | `Gamedata/bundled`                                  |
+| Configured furni icons                                                   | `Gamedata/icons`                                    |
+| Existing badge/catalog images                                            | `Gamedata/c_images`                                 |
+| FurnitureData and supported public game-data JSON files                  | `Gamedata/config`                                   |
+| Existing localized FurnitureData files                                   | `catalogue version 2 ( Final (Dev)/langs furnidata` |
+| `items_base`, `catalog_pages`, `catalog_items`                           | `catalogue version 2 ( Final (Dev)/sqls`            |
+| `catalog_pages_bc`, `catalog_items_bc`, when present                     | Same SQL directory                                  |
 
 SQL is read in one consistent, read-only InnoDB transaction. Dumps contain table
 definitions and deterministic upserts with hexadecimal UTF-8 string literals.

Dockerfile

@@ -1,23 +1,45 @@
 # syntax=docker/dockerfile:1
-FROM node:26.10.0-alpine AS migrations
+FROM node:26.12.1-alpine AS migrations
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
 
-# Installeer git, bash en pnpm v12. bash is nodig voor
+# Installeer git, bash en corepack. bash is nodig voor
 # scripts/with-memory-cap.sh (gebruikt bashisme zoals arrays en BASH_REMATCH);
 # Alpine levert geen bash mee.
+#
+# pnpm komt niet meer uit een losgepind npm-pakket, maar uit corepack: die
+# leest de versie én de sha512-hash uit de `packageManager`-pin van
+# package.json. Daarmee kan de image nooit uit sync raken met het lockfile
+# (vroeger stond hier [email protected] terwijl package.json 12.11.2 voorschreef)
+# en wordt de gedownloade pnpm-binary ook in de runtime-image bewaard.
 RUN --mount=type=cache,target=/var/cache/apk \
-    apk add --no-cache git bash \
-    && npm install -g [email protected]
+    --mount=type=cache,target=/root/.npm \
+    apk add --no-cache git bash util-linux \
+    && npm install -g [email protected] \
+    && corepack enable pnpm
+
+# corepack bewaart de gedownloade pnpm buiten de cache-mount, zodat de runtime
+# (`docker run --entrypoint pnpm <migrations-image> db:migrate`) pnpm ook
+# zonder netwerk kan gebruiken.
+ENV COREPACK_HOME="/usr/local/share/corepack"
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 
 # Stel het PATH zo in dat Alpine pnpm gegarandeerd overal herkent
 ENV PNPM_HOME="/usr/local/share/pnpm"
 ENV PATH="$PNPM_HOME:/usr/local/bin:$PATH"
 
+# Alleen package.json: de `packageManager`-pin bepaalt welke pnpm corepack
+# installeert. Deze laag blijft gecachet wanneer alleen de lockfile verandert.
+COPY package.json ./
+RUN corepack install
+
 COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml* .npmrc* ./
 
-# Voer de installatie uit met de pnpm v12 store cache-mount
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
+# Voer de installatie uit met de pnpm v12 store cache-mount. De mount moet op
+# de store staan die pnpm ook echt gebruikt ($PNPM_HOME/store/v11); met het
+# oude pad (/root/.local/share/pnpm/store) cache'te de mount niets en
+# downloadde elke build alle packages opnieuw.
+RUN --mount=type=cache,target=/usr/local/share/pnpm/store \
     pnpm install --frozen-lockfile --ignore-scripts
 
 COPY . .
@@ -52,7 +74,7 @@ RUN --mount=type=cache,target=/app/.next/cache \
     pnpm run build \
     && PERFORMANCE_COMMIT_SHA="$NEXT_DEPLOYMENT_ID" node scripts/performance-report.mjs --output-dir build-reports
 
-FROM node:26.10.0-alpine AS runner
+FROM node:26.12.1-alpine AS runner
 ARG NEXT_DEPLOYMENT_ID="unknown"
 LABEL org.opencontainers.image.revision="$NEXT_DEPLOYMENT_ID"
 WORKDIR /app

biome.json

@@ -25,6 +25,10 @@
 			},
 			"style": {
 				"noDescendingSpecificity": "off"
+			},
+			"correctness": {
+				"noComponentHookFactories": "off",
+				"usePlaywrightValidDescribeCallback": "off"
 			}
 		}
 	},

deployment/proxy/compose.loopback.yml

@@ -6,4 +6,10 @@ services:
       HOSTNAME: 127.0.0.1
       PORT: "3002"
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "fetch('http://127.0.0.1:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))",
+        ]

deployment/proxy/nginx.conf

@@ -39,6 +39,13 @@ http {
     server_tokens off;
     keepalive_timeout 30s;
 
+    # Gamedata/icons are served from disk by alias locations. Caching the
+    # stat/open results avoids a syscall storm on every room load.
+    open_file_cache max=10000 inactive=30s;
+    open_file_cache_valid 60s;
+    open_file_cache_min_uses 2;
+    open_file_cache_errors off;
+
     client_max_body_size 64m;
     client_body_buffer_size 16k;
     client_header_buffer_size 1k;

docker-compose.yml

@@ -1,5 +1,20 @@
 # ─────────────────────────────────────────────────────────────────────────────
-# Next.js CMS — blue/green
+# Next.js CMS — single slot on port 3002
+#
+# ── Eigenaar van poort 3002 ─────────────────────────────────────────────────
+# Deze repo kent twee deploy-paden die allebei op poort 3002 willen:
+#   * `scripts/ci-deploy.sh` (blue/green, docker run) — de eigenaar op een
+#     CI-host. Elke push naar main bouwt daar een nieuwe image, draait de
+#     migrations en zet nginx pas om na health + e2e + imaging.
+#   * deze compose-`cms`-service — bedoeld voor een LOSSE host zonder CI.
+#
+# Ze kunnen niet naast elkaar draaien: wie op 3002 zit, blokkeert de ander met
+# `EADDRINUSE`. Daarom staat `cms` achter een profile. Een bloot
+# `docker compose up -d` start dus alleen byparr en kan nooit de live CI-release
+# van de site drukken. De service start alleen als je hem expliciet noemt
+# (`docker compose up -d cms`, `docker compose build cms`, ...): Compose schakelt
+# het profile van een expliciet genoemde service vanzelf in. Op een CI-host wil
+# je dat dus juist NOOIT doen.
 # ─────────────────────────────────────────────────────────────────────────────
 x-cms: &cms
   image: epicnext-cms:${CMS_RELEASE:-local}
@@ -14,8 +29,20 @@ x-cms: &cms
     dockerfile: Dockerfile
     args:
       NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}
-  # Runtime host networking IS required: blue/green needs per-release host ports
-  # (3002/3003) and nginx reaches the slot over 127.0.0.1.
+    # Lokale buildcache op schijf. `scripts/docker-prune.sh` brengt de
+    # daemon-cache na elke deploy terug tot 4GB, waardoor de lagen van de
+    # vorige release verdwijnen. Deze export overleeft die prune: een rebuild
+    # na een lockfile-wijziging hergebruikt dan de al gedownloade packages
+    # (pnpm store) in plaats van ze opnieuw te downloaden.
+    # De map ligt binnen de buildcontext, zodat buildx een ontbrekende
+    # cachemap stilzwijgend negeert i.p.v. de build te laten falen; zowel
+    # .dockerignore als .gitignore sluiten de map uit.
+    cache_from:
+      - type=local,src=.docker-cache/cms
+    cache_to:
+      - type=local,dest=.docker-cache/cms,mode=max
+  # Runtime host networking IS required: nginx reaches the CMS over 127.0.0.1
+  # on the single port that is actually served (3002).
   network_mode: host
   stop_grace_period: 15s
   restart: unless-stopped
@@ -28,13 +55,17 @@ x-cms: &cms
     - /var/www/Gamedata:/var/www/Gamedata
 
   # ── Resource limits ──
-  mem_limit: 6g
-  memswap_limit: 7g
-  cpus: 2.0
-  pids_limit: 512
+  mem_limit: 4g
+  memswap_limit: 5g
 
   healthcheck:
-    test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"]
+    test:
+      [
+        "CMD",
+        "node",
+        "-e",
+        "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))",
+      ]
     interval: 15s
     timeout: 5s
     retries: 3
@@ -43,21 +74,19 @@ x-cms: &cms
 services:
   cms:
     <<: *cms
+    # Alleen starten als je deze host bewust compose-only beheert.
+    profiles: ["cms"]
     container_name: epicnext-cms
     environment:
       - HOSTNAME=0.0.0.0
       - PORT=3002
 
-  cms-green:
-    <<: *cms
-    container_name: epicnext-cms-green
-    profiles: ["green"]
-    environment:
-      - HOSTNAME=0.0.0.0
-      - PORT=3003
-
   byparr:
-    image: ghcr.io/thephaseless/byparr:latest
+    image: ghcr.io/thephaseless/byparr:v3.0.4
+    # `latest` is een drijvende tag. Zonder pull_policy haalt compose de
+    # bestaande image nooit opnieuw op en blijft byparr hangen op de eerste
+    # versie die ooit werd binnengehaald.
+    pull_policy: always
     container_name: byparr
     network_mode: host
     restart: unless-stopped
@@ -69,4 +98,4 @@ services:
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 30s
+      start_period: 30s

docs/cms-upgrade-2026-09.md

@@ -2,20 +2,20 @@
 
 ## Operator changes
 
-| Area | Behavior and location |
-| --- | --- |
-| Release | Deployment checks HTTP health, release identity and Chromium pages before marking the running image verified. Registry publication reuses that verified digest on the shared runner; independent hosts build and verify their own image. |
-| Shared HK | Dialogs scroll within the available viewport. Table column preferences persist per page in the current browser session; filters already remain in the URL. No favorites added. |
-| Catalog Studio | Dedicated detail drawer and five separate completeness states: SQL, offers, furnidata, icon and Nitro. Sprite/type conflicts are consistently excluded from import and linked to audit. Missing source files are never represented as available. |
-| Operations | Command center includes permission-filtered error groups, personal import failures, open support tickets and news drafts. A failed source is shown separately from an empty source. |
-| Error center | Retained occurrence counts, first/last times, identified users, release counts, self-assignment and recognized local links. Assignment requires edit permission and is audited. |
-| News | Private server-backed autosave, recover/discard/retry, prior saved revisions restored as a draft, and concurrent-edit detection. New status/search filters and pagination make older drafts reachable. |
-| Jobs | Cancellation finishes the current item and stops pending items. Completed work stays completed. Uncertain interrupted mutations are excluded from retry. Live lease checks stop known stale worker writes. |
-| Installation | `/admin/devops/installation` shows release, DB latency, Redis, emulator, storage permissions, migration history and worker heartbeat. Renderer defaults are recognized. Registry access is explicitly unverified from the web process. |
-| Public dashboard | Current/next published event, clearer unread-message action, useful empty/error states and mobile layout refinements. |
-| Audit | Exact actor/action and UTC date filters, readable recorded before/after values and permission-protected CSV of the filtered page, capped at 100 rows. |
-| Performance | Active import polling remains 5 seconds; idle polling is 30 seconds and pauses in hidden tabs. History returns at most 30 owned jobs and initially renders 50 items per job. Health probes are deduplicated within a render; diagnostics report observed probe duration. |
-| Text | New messages are translated in English, Italian and Dutch. Other locales have explicit English fallback strings. Existing translation debt is not reported as resolved. |
+| Area             | Behavior and location                                                                                                                                                                                                                                                    |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Release          | Deployment checks HTTP health, release identity and Chromium pages before marking the running image verified. Registry publication reuses that verified digest on the shared runner; independent hosts build and verify their own image.                                 |
+| Shared HK        | Dialogs scroll within the available viewport. Table column preferences persist per page in the current browser session; filters already remain in the URL. No favorites added.                                                                                           |
+| Catalog Studio   | Dedicated detail drawer and five separate completeness states: SQL, offers, furnidata, icon and Nitro. Sprite/type conflicts are consistently excluded from import and linked to audit. Missing source files are never represented as available.                         |
+| Operations       | Command center includes permission-filtered error groups, personal import failures, open support tickets and news drafts. A failed source is shown separately from an empty source.                                                                                      |
+| Error center     | Retained occurrence counts, first/last times, identified users, release counts, self-assignment and recognized local links. Assignment requires edit permission and is audited.                                                                                          |
+| News             | Private server-backed autosave, recover/discard/retry, prior saved revisions restored as a draft, and concurrent-edit detection. New status/search filters and pagination make older drafts reachable.                                                                   |
+| Jobs             | Cancellation finishes the current item and stops pending items. Completed work stays completed. Uncertain interrupted mutations are excluded from retry. Live lease checks stop known stale worker writes.                                                               |
+| Installation     | `/admin/devops/installation` shows release, DB latency, Redis, emulator, storage permissions, migration history and worker heartbeat. Renderer defaults are recognized. Registry access is explicitly unverified from the web process.                                   |
+| Public dashboard | Current/next published event, clearer unread-message action, useful empty/error states and mobile layout refinements.                                                                                                                                                    |
+| Audit            | Exact actor/action and UTC date filters, readable recorded before/after values and permission-protected CSV of the filtered page, capped at 100 rows.                                                                                                                    |
+| Performance      | Active import polling remains 5 seconds; idle polling is 30 seconds and pauses in hidden tabs. History returns at most 30 owned jobs and initially renders 50 items per job. Health probes are deduplicated within a render; diagnostics report observed probe duration. |
+| Text             | New messages are translated in English, Italian and Dutch. Other locales have explicit English fallback strings. Existing translation debt is not reported as resolved.                                                                                                  |
 
 ## Deployment requirements
 
@@ -37,7 +37,6 @@
 ## Verification
 
 Local verification on 2026-09-09:
-
 - Production build succeeded with fixture configuration and an intentionally unavailable database. Build-time fallback logs are expected in this check.
 - Full Vitest run: 254 files passed, 4 skipped; 1,466 tests passed, 6 skipped. Coverage thresholds passed (19.89% lines); this does not imply exhaustive coverage.
 - Global Biome rules/import checks passed across 1,328 files; modified source/locales were formatted separately to avoid unrelated Windows line-ending changes.

docs/operations/docker-installation.md

@@ -81,7 +81,7 @@ The direct template intentionally records the CDN/edge socket address when place
 
 ### Local verification and deployment boundary
 
-`pnpm exec vitest run --coverage.enabled=false scripts/proxy-config.test.mjs` runs the installed Docker Compose CLI against a disposable clone configuration, without contacting Docker Engine, building images or reading the real `.env`. It verifies selection through `.env`, loopback/port override precedence, the IPv4 healthcheck and preservation of mounts, release selection and host networking. It explicitly skips when Compose is unavailable. This is not a container-start or network-isolation test.
+`pnpm exec vitest run --coverage.enabled=false scripts/proxy-config.test.mjs` runs the installed Docker Compose CLI against a disposable clone configuration, without contacting Docker Engine, building images or reading the real `.env`. It verifies selection through `.env`, loopback/port override precedence, the IPv4 healthcheck and preservation of mounts, release selection and host networking. The `cms` service is behind the `cms` profile (so a bare `docker compose up -d` cannot claim port 3002 on a CI-managed host), so the test renders the configuration with `--profile cms`. It explicitly skips when Compose is unavailable. This is not a container-start or network-isolation test.
 
 `pnpm test:integration` additionally starts disposable Nginx containers from the actual templates, supplies a temporary test certificate, and sends real HTTPS requests with forged identity headers. It checks direct-mode replacement even with an inherited real-IP rule, rejection of untrusted peers, and acceptance through an explicitly trusted peer. This requires Docker Engine and the OpenSSL CLI and does not read deployment credentials. The templates must still pass `nginx -t` on the intended host after its hostname/certificate substitution, then the listener and trusted-header checks above; the disposable fixture cannot certify that host or its firewall.
 

docs/performance-budgets.md

@@ -14,12 +14,11 @@ For each configured App Router route, resolve its exact app path using `app-path
 
 The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every client chunk that route's client-reference manifest lists. This includes layout, page and boundary/loading entries.
 
-The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk *path* still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
+The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk _path_ still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
 
 > The build runs webpack (`next build --webpack`), so the `clientModules` path is the live one. An earlier revision only read `entryJSFiles`, and after the switch to webpack every route reported `unavailable` while the command still exited 0 — the budgets were silently not being measured. When a bundler switch changes the manifest layout again, re-check this section rather than trusting a clean exit.
 
 The definition follows the data exposed by the installed Next 16.3.8 build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
-
 - Raw bytes are filesystem byte lengths of unique JavaScript assets in that envelope.
 - Gzip bytes are the **sum of independent gzip level 9 compressions** of those files using the recorded Node/zlib runtime. They are not gzip of concatenated source, nor observed CDN transfer sizes.
 - Deployment query strings and `/_next/` prefixes are normalized before deduplication. Shared files count once per route; each route is measured independently, with no misleading cross-route total.
@@ -34,16 +33,15 @@ Baselines were last recalibrated against a local webpack production build (Next
 
 The image build compiles the app, then runs `scripts/performance-report.mjs` in the same `RUN` layer (`Dockerfile:48-53`). In `mode: enforce` a failing route therefore fails the image build, which blocks both the PR `preflight` job and the `deploy` job. Recalibrate the table and `scripts/performance-budgets.json` **together** in the same commit whenever the envelope legitimately grows (new route dependency, Next upgrade).
 
-| Route | Baseline raw bytes | Baseline gzip bytes | Raw limit | Gzip limit |
-| --- | ---: | ---: | ---: | ---: |
-| `/me` | 621460 | 195411 | 716800 | 225280 |
-| `/news` | 616712 | 193199 | 716800 | 225280 |
-| `/events` | 617121 | 193450 | 716800 | 225280 |
-| `/search` | 618536 | 194216 | 716800 | 225280 |
-| `/admin/catalog` | 1049094 | 330369 | 1208320 | 389120 |
-| `/admin/studio/furni` | 1397566 | 447765 | 1607680 | 522240 |
+| Route                 | Baseline raw bytes | Baseline gzip bytes | Raw limit | Gzip limit |
+| --------------------- | -----------------: | ------------------: | --------: | ---------: |
+| `/me`                 |             621460 |              195411 |    716800 |     225280 |
+| `/news`               |             616712 |              193199 |    716800 |     225280 |
+| `/events`             |             617121 |              193450 |    716800 |     225280 |
+| `/search`             |             618536 |              194216 |    716800 |     225280 |
+| `/admin/catalog`      |            1049094 |              330369 |   1208320 |     389120 |
+| `/admin/studio/furni` |            1397566 |              447765 |   1607680 |     522240 |
 
 Configured limits are positive integer bytes; `null` explicitly means observe-only. `scripts/performance-budgets.json` runs `mode: enforce`: an `over-budget` route prints `Performance budgets enforced: <route> (over-budget)` and exits non-zero. Missing production `BUILD_ID`, unsupported manifests, missing routes or missing referenced assets produce `unavailable` with a reason and **no partial/zero total**; under `enforce` an `unavailable` route also fails the command, so a bundler change that breaks measurement cannot pass quietly. Malformed budget configuration or an unwritable output directory always fails the command. Set `mode` back to `informational` only while recalibrating, never as a permanent state.
 
 Synthetic tests cover shared-chunk deduplication, exact byte/gzip calculations, route bootstrap selection, missing data, safe parsing and CLI exit behavior in both modes. Run `pnpm exec vitest run --coverage.enabled=false scripts/performance-report.test.mjs`.
-

drizzle.config.ts

@@ -6,12 +6,16 @@ import { defineConfig } from "drizzle-kit";
 // This DB is shared with the Arcturus emulator — NEVER run `drizzle-kit migrate`
 // or `push` against it. CMS DDL stays in drizzle/migrations/*.sql applied by
 // `pnpm db:migrate`. Use `pnpm db:generate` only for draft SQL under drizzle/drafts/.
+const dbUrl = process.env.DATABASE_URL ?? "";
+const isPostgres =
+	dbUrl.startsWith("postgres://") || dbUrl.startsWith("postgresql://");
+
 export default defineConfig({
-	dialect: "mysql",
+	dialect: isPostgres ? "postgresql" : "mysql",
 	schema: "./src/db/schema.ts",
 	out: "./drizzle/drafts",
 	dbCredentials: {
-		url: process.env.DATABASE_URL ?? "",
+		url: dbUrl,
 	},
 	strict: true,
 	verbose: true,

drizzle/drafts/README.md

@@ -1 +1 @@
-Draft SQL from `pnpm db:generate` (drizzle-kit). Never apply these automatically — copy reviewed statements into drizzle/migrations/ as numbered CMS migrations, then `pnpm db:migrate`.
+Draft SQL from `pnpm db:generate` (drizzle-kit). Never apply these automatically — copy reviewed statements into drizzle/migrations/ as numbered CMS migrations, then `pnpm db:migrate`.

e2e/ui/draft-recovery.spec.ts

@@ -116,9 +116,14 @@ test("saving while recovery is pending enables recovery for subsequent edits", a
 test("unmount flush retains an edit before the autosave interval", async ({
 	page,
 }) => {
+	// Install the fake clock before navigation so every page timer is faked,
+	// then jump forward to a fixed pause point. Using wall-clock `new Date()`
+	// for both calls raced under load: the fake clock ticks in real time
+	// between the calls and can pass the target ("Cannot fast-forward to the
+	// past"). The 60s jump only fires no-op persists on a clean form.
+	await page.clock.install({ time: new Date("2030-01-01T12:00:00Z") });
 	await page.goto("/admin/articles/recovery");
-	await page.clock.install();
-	await page.clock.pauseAt(new Date());
+	await page.clock.pauseAt(new Date("2030-01-01T12:01:00Z"));
 	await page.locator('input[name="title"]').fill("Immediate final edit");
 	await page
 		.getByRole("button", { name: "Close editor fixture", exact: true })

e2e/ui/process-shim.mjs

@@ -0,0 +1,25 @@
+// Minimal `process` shim injected into the UI fixture bundle. Server-only
+// modules that leak into the bundle reference the `process` global at module
+// scope (release ids, paths, etc). esbuild's `inject` rewrites those free
+// identifier references to import from this file so evaluation cannot crash
+// in the browser.
+
+export const process = {
+	env: { NODE_ENV: "production" },
+	platform: "linux",
+	arch: "x64",
+	version: "v20.0.0",
+	versions: { node: "20.0.0" },
+	argv: [],
+	cwd: () => "/",
+	nextTick: (fn, ...args) => setTimeout(() => fn(...args), 0),
+	on: () => {},
+	once: () => {},
+	emit: () => {},
+	exit: () => {},
+	hrtime: Object.assign(() => [0, 0], { bigint: () => 0n }),
+	memoryUsage: () => ({ heapUsed: 0, rss: 0 }),
+	pid: 0,
+};
+
+export default process;

next.config.ts

@@ -158,7 +158,15 @@ const nextConfig: NextConfig = {
 	},
 
 	experimental: {
-		optimizePackageImports: ["lucide-react", "date-fns"],
+		// Barrel-heavy packages: without this every import pulls the whole
+		// module graph into the chunk that first touches it.
+		optimizePackageImports: [
+			"lucide-react",
+			"motion",
+			"@dnd-kit/core",
+			"@dnd-kit/sortable",
+			"@tanstack/react-virtual",
+		],
 		useTypeScriptCli: true,
 		hideLogsAfterAbort: true,
 	},
@@ -167,6 +175,21 @@ const nextConfig: NextConfig = {
 		formats: ["image/avif", "image/webp"],
 	},
 
+	// The SWF/Nitro image pipeline (src/lib/services/swf, src/lib/services/image-*)
+	// pulls shared helpers into several server chunks that webpack reports as a
+	// circular dependency between chunks with runtime. The cycle only affects
+	// server-side module caching of already-loaded chunks and has no runtime
+	// impact, so suppress the noisy warning instead of refactoring the shared
+	// helpers (which would risk the hot image path). Revisit if a real deadlock
+	// appears.
+	webpack(config) {
+		config.ignoreWarnings = [
+			...(config.ignoreWarnings ?? []),
+			/Circular dependency between chunks with runtime/,
+		];
+		return config;
+	},
+
 	async headers() {
 		return [
 			{

playwright.config.ts

@@ -1,22 +1,39 @@
 import { defineConfig, devices } from "@playwright/test";
+
+// Deploy gate: keep this suite deterministic and light. One worker, one browser
+// engine, no live dev server and no parallelism — that is what keeps the host
+// from pinning at 100% CPU while the specs run.
 export default defineConfig({
 	testDir: "./e2e",
-	testIgnore: ["**/ui/**", "**/news-real/**", "**/quality/**"],
+	testIgnore: ["**/ui/**", "**/imaging/**", "**/news-real/**", "**/quality/**"],
+	forbidOnly: !!process.env.CI,
 	fullyParallel: false,
 	workers: 1,
-	retries: 1,
+	retries: process.env.CI ? 1 : 0,
 	timeout: 30000,
+	expect: { timeout: 10000 },
+	globalTimeout: 10 * 60 * 1000,
+	maxFailures: process.env.CI ? 10 : undefined,
 	reporter: [["list"], ["html", { open: "never" }]],
-	expect: {
-		toHaveScreenshot: {
-			animations: "disabled",
-			caret: "hide",
-			maxDiffPixelRatio: 0.02,
-		},
-	},
 	use: {
 		baseURL: process.env.PLAYWRIGHT_BASE_URL || "http://127.0.0.1:3002",
 		trace: "retain-on-failure",
+		screenshot: "only-on-failure",
+		video: "off",
+		launchOptions: {
+			args: [
+				"--disable-gpu",
+				"--disable-software-rasterizer",
+				"--disable-dev-shm-usage",
+				"--disable-background-networking",
+				"--disable-default-apps",
+				"--disable-extensions",
+				"--disable-sync",
+				"--metrics-recording-only",
+				"--mute-audio",
+				"--no-first-run",
+			],
+		},
 	},
 	projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
 });

playwright.ui.config.ts

@@ -1,8 +1,24 @@
+import { randomInt } from "node:crypto";
 import { defineConfig } from "@playwright/test";
 
-const port = Number(process.env.UI_TEST_PORT || 3107);
-if (!Number.isInteger(port) || port < 1024 || port > 65535)
-	throw Error("Invalid UI_TEST_PORT");
+// The fixture server binds a loopback port. The CI runner packs several jobs
+// onto the shared host network (capacity > 1), so a fixed port makes concurrent
+// runs fight over the bind: one wins, the other's browser then gets
+// "connection refused". Pick one random high port for the whole run and pass it
+// to every worker through the environment, unless a port is pinned explicitly
+// (e.g. a developer reusing a manually started fixture server).
+function fixturePort() {
+	const requested = Number(process.env.UI_TEST_PORT);
+	if (Number.isInteger(requested) && requested >= 1024 && requested <= 65535)
+		return requested;
+	const shared = Number(process.env.PW_UI_TEST_PORT);
+	if (Number.isInteger(shared) && shared >= 1024 && shared <= 65535)
+		return shared;
+	const port = randomInt(30000, 50000);
+	process.env.PW_UI_TEST_PORT = String(port);
+	return port;
+}
+const port = fixturePort();
 const baseURL = `http://127.0.0.1:${port}`;
 export default defineConfig({
 	testDir: "./e2e/ui",
@@ -65,7 +81,7 @@ export default defineConfig({
 		command: "node e2e/ui/fixture-server.mjs",
 		url: `${baseURL}/health`,
 		timeout: 120000,
-		reuseExistingServer: true,
+		reuseExistingServer: !process.env.CI,
 		env: { UI_TEST_PORT: String(port) },
 	},
 });

pnpm-workspace.yaml

@@ -1,9 +1,9 @@
 packages:
-  - '.'
+  - "."
 
 allowBuilds:
-  '@parcel/watcher': true
-  '@swc/core': true
+  "@parcel/watcher": true
+  "@swc/core": true
   cpu-features: true
   esbuild: true
   msw: true
@@ -13,12 +13,12 @@ allowBuilds:
 minimumReleaseAge: 60
 
 overrides:
-  glob: '^11.0.0'
-  '@esbuild-kit/core-utils': 'npm:tsx@^4.23.15'
-  '@esbuild-kit/esm-loader': 'npm:tsx@^4.23.15'
-  source-map-js: '1.2.2'
+  glob: "^11.0.0"
+  "@esbuild-kit/core-utils": "npm:tsx@^4.23.15"
+  "@esbuild-kit/esm-loader": "npm:tsx@^4.23.15"
+  source-map-js: "1.2.2"
   # GHSA advisory: postcss-selector-parser <7.1.6. Pulled in only by
   # @tailwindcss/typography (build-time prose selectors), which pins 6.0.10
   # exactly and has no upstream bump. The API subset it uses is unchanged in
   # v7, so force the patched major.
-  postcss-selector-parser: '^7.1.6'
+  postcss-selector-parser: "^7.1.6"

renovate.json

@@ -61,7 +61,7 @@
 			"enabled": false
 		},
 		{
-			"description": "De pnpm packageManager-pin is afgestemd op Docker en de runner-toolchain; niet automatisch bumpen",
+			"description": "De pnpm packageManager-pin blijft handmatig: Docker (corepack) en de runner volgen de pin automatisch, maar een bump raakt ook de lockfile en de README-versietabel (scripts/sync-readme-versions.mjs)",
 			"matchPackageNames": ["pnpm"],
 			"enabled": false
 		}

scripts/ci-deploy.sh

@@ -42,13 +42,10 @@ old_container=""
 new_container=""
 blue_green=0
 
-# Resource limits voor de container. Zonder deze limieten kan één geheugenlek de
-# hele host vullen, met MariaDB, nginx en Traefik als slachtoffer. 2 CPU laat
-# achtergrondwerk toe zonder de hele kernel aan één release te geven.
+# CPU en pids zijn bewust verwijderd; memory blijft gelimiteerd op 4g/5g swap
+# om een geheugenlek niet de host te laten vullen (MariaDB, nginx, Traefik).
 mem_limit="4g"
 mem_swap_limit="5g"
-cpu_limit="2"
-pids_limit="512"
 
 is_current() {
   local head
@@ -300,7 +297,6 @@ start_candidate() {
     done < "$deploy_dir/.env"
     docker run -d --name "$name" --restart always --net=host \
       --memory="$mem_limit" --memory-swap="$mem_swap_limit" \
-      --cpus="$cpu_limit" --pids-limit="$pids_limit" \
       "${ENV_ARGS[@]}" -e "PORT=$port" -e HOSTNAME=0.0.0.0 \
       -v "$deploy_dir/public/nitro-assets:/app/public/nitro-assets" \
       -v "$deploy_dir/public/swf:/app/public/swf" \
@@ -416,9 +412,26 @@ pnpm install --frozen-lockfile
 pnpm exec playwright install chromium firefox webkit
 
 echo "Building $image"
+# Duurzame buildcache buiten de werkboom. De CI-werkboom wordt na elke job
+# gewist en `docker builder prune` gooit de buildcache weg, waarna de hele
+# pnpm-laag opnieuw gedownload moet worden. Een lokale cache-export overleeft
+# allebei. Een lege CMS_BUILD_CACHE_DIR schakelt de cache uit.
+build_cache_dir="${CMS_BUILD_CACHE_DIR-/var/cache/epicnext-cms-buildcache}"
+build_cache_flags=()
+if [ -n "$build_cache_dir" ]; then
+  if mkdir -p "$build_cache_dir" 2>/dev/null && [ -w "$build_cache_dir" ]; then
+    build_cache_flags=(
+      --cache-from "type=local,src=$build_cache_dir"
+      --cache-to "type=local,dest=$build_cache_dir,mode=max"
+    )
+  else
+    echo "Warning: buildcache $build_cache_dir is niet beschrijfbaar; build zonder hergebruikte cache." >&2
+  fi
+fi
 # No --network=host: BuildKit only grants it via --allow=network.host, and the
 # build needs nothing but outbound internet (apk, pnpm, next/font/google).
 DOCKER_BUILDKIT=1 docker build --progress=plain --cache-from epicnext-cms:latest \
+  ${build_cache_flags[@]+"${build_cache_flags[@]}"} \
   --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 check_current
 # Read reports from the already-built image; do not start an extra application.

scripts/ci-preflight.sh

@@ -39,6 +39,23 @@ pnpm exec playwright install chromium
 export NEWS_E2E_IMAGE="$image"
 export NEWS_E2E_RELEASE="$sha"
 build_attempted=1
+# Duurzame buildcache buiten de tijdelijke werkmap, zodat de lagen van een
+# vorige preflight hergebruikt worden in plaats van opnieuw gedownload. Eigen
+# map, gescheiden van de release-cache: een branch-preflight mag nooit de cache
+# van de release-build voeden. Een lege CMS_BUILD_CACHE_DIR schakelt het uit.
+build_cache_dir="${CMS_BUILD_CACHE_DIR-/var/cache/epicnext-cms-preflight-cache}"
+build_cache_flags=()
+if [ -n "$build_cache_dir" ]; then
+  if mkdir -p "$build_cache_dir" 2>/dev/null && [ -w "$build_cache_dir" ]; then
+    build_cache_flags=(
+      --cache-from "type=local,src=$build_cache_dir"
+      --cache-to "type=local,dest=$build_cache_dir,mode=max"
+    )
+  else
+    echo "Warning: buildcache $build_cache_dir is niet beschrijfbaar; build zonder hergebruikte cache." >&2
+  fi
+fi
 DOCKER_BUILDKIT=1 docker build --progress=plain \
+  ${build_cache_flags[@]+"${build_cache_flags[@]}"} \
   --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 NEWS_E2E_IMAGE="$image" NEWS_E2E_RELEASE="$sha" node --import tsx e2e/news-real/run.ts

scripts/docker-update.sh

@@ -126,7 +126,9 @@ if [[ -n "${CMS_IMAGE_REPOSITORY:-}" ]]; then
   docker tag "$app_reference" "epicnext-cms:$CMS_RELEASE"
   docker tag "$remote_migration_image" "$migration_image"
 else
-  docker build --target migrations --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" -t "$migration_image" . >>"$LOG_FILE" 2>&1
+  docker build --target migrations --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" \
+    --cache-from type=local,src=.docker-cache/cms \
+    -t "$migration_image" . >>"$LOG_FILE" 2>&1
   docker compose build --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" cms >>"$LOG_FILE" 2>&1
 fi
 expected_image="$(docker image inspect --format '{{.Id}}' "epicnext-cms:$CMS_RELEASE")"

scripts/nginx-sync.sh

@@ -78,13 +78,24 @@ else
   if install_file "$PROXY_DIR/cms_upstream_servers.conf" "$NGINX_DIR/snippets/cms_upstream_servers.conf"; then changed=1; fi
 fi
 
-if [[ ! -f "$NGINX_DIR/sites-enabled/cms.conf" ]]; then
+# sites-enabled/cms.conf must be a symlink, not a copy. A regular file here
+# silently shadows sites-available/cms.conf, so nginx keeps serving stale
+# config even though the sync updated sites-available.
+enabled="$NGINX_DIR/sites-enabled/cms.conf"
+if [[ -L "$enabled" && "$(readlink "$enabled")" == "../sites-available/cms.conf" ]]; then
+  echo "= $enabled symlink up to date"
+else
   if [[ "$MODE" == "check" ]]; then
-    echo "- sites-enabled/cms.conf missing"
+    echo "- $enabled is not the expected symlink"
     changed=1
   else
-    ln -sf ../sites-available/cms.conf "$NGINX_DIR/sites-enabled/cms.conf"
-    echo "+ linked sites-enabled/cms.conf"
+    mkdir -p "$NGINX_DIR/sites-enabled"
+    if [[ -e "$enabled" || -L "$enabled" ]]; then
+      mkdir -p "$BACKUP_DIR"
+      cp -a "$enabled" "$BACKUP_DIR/cms-enabled.conf"
+    fi
+    ln -sfn ../sites-available/cms.conf "$enabled"
+    echo "+ linked $enabled"
     changed=1
   fi
 fi

scripts/performance-budgets.json

@@ -2,6 +2,11 @@
 	"schemaVersion": 1,
 	"mode": "enforce",
 	"routes": [
+		{
+			"route": "/",
+			"maxInitialRawBytes": 716800,
+			"maxInitialGzipBytes": 225280
+		},
 		{
 			"route": "/me",
 			"maxInitialRawBytes": 716800,

scripts/proxy-config.test.mjs

@@ -18,7 +18,7 @@ const hasCompose =
 	}).status === 0;
 
 it.skipIf(!hasCompose)(
-	"loads the loopback profile from .env for bare Compose commands without changing mounts or host networking",
+	"loads the loopback override from .env for the cms service without changing mounts or host networking",
 	() => {
 		const directory = mkdtempSync(path.join(tmpdir(), "cms-proxy-config-"));
 		try {
@@ -50,9 +50,12 @@ it.skipIf(!hasCompose)(
 					["CMS_RELEASE", "HOSTNAME", "PORT"].includes(key)
 				)
 					delete environment[key];
+			// `cms` is behind the `cms` profile so a bare `docker compose up -d`
+			// can never squat port 3002 on a CI-managed host. Selecting the
+			// profile here keeps the loopback/port-override contract under test.
 			const result = spawnSync(
 				"docker",
-				["compose", "config", "--format", "json"],
+				["compose", "--profile", "cms", "config", "--format", "json"],
 				{ cwd: directory, env: environment, encoding: "utf8", timeout: 15_000 },
 			);
 			expect(result.status, result.stderr).toBe(0);

scripts/with-memory-cap.sh

@@ -118,6 +118,13 @@ systemd_cmd=()
 # starten. De markering maakt dat afdwingbaar in next.config.ts.
 export CMS_MEMORY_CAPPED=1
 
+# Gebruik hoogstens de helft van de cores, zodat de machine niet op 100% CPU
+# piekt, maar behoud voldoende parallelle kracht op (Ryzen) hosts.
+cpu_count="$(nproc 2>/dev/null || echo 1)"
+worker_cores=$((cpu_count / 2))
+[ "$worker_cores" -lt 1 ] && worker_cores=1
+cpu_affinity="0-$((worker_cores - 1))"
+
 # Echt proberen, niet alleen uitzoeken of het bestand bestaat: `systemd-run`
 # zonder rechten faalt met "Access denied", en dat moet dan een nette
 # terugval naar ulimit worden in plaats van een kapotte build.
@@ -174,7 +181,7 @@ run_systemd() {
 	# expliciet: deze host heeft geen swap.
 	local high=$((effective * 95 / 100))
 	echo "[mem-cap] systemd cgroup MemoryHigh=$((high / 1024 / 1024))MB MemoryMax=$((effective / 1024 / 1024))MB MemorySwapMax=0: $*" >&2
-	exec "${systemd_cmd[@]}" -p "MemoryHigh=$high" -p "MemoryMax=$effective" -p "MemorySwapMax=0" "$@"
+	exec "${systemd_cmd[@]}" -E "PATH=$PATH" -p "MemoryHigh=$high" -p "MemoryMax=$effective" -p "MemorySwapMax=0" -p "AllowedCPUs=$cpu_affinity" "$@"
 }
 
 run_ulimit() {
@@ -186,7 +193,11 @@ run_ulimit() {
 		echo "[mem-cap] ulimit -v $virtual_kb werd geweigerd" >&2
 		return 1
 	}
-	exec "$@"
+	if command -v taskset >/dev/null 2>&1; then
+		exec taskset -c "$cpu_affinity" "$@"
+	else
+		exec "$@"
+	fi
 }
 
 run_refuse() {
@@ -197,7 +208,11 @@ run_refuse() {
 
 run_opted_out() {
 	echo "[mem-cap] WAARSCHUWING: plafond bewust uitgeschakeld, dit commando kan de machine laten OOM-killed worden: $*" >&2
-	exec "$@"
+	if command -v taskset >/dev/null 2>&1; then
+		exec taskset -c "$cpu_affinity" "$@"
+	else
+		exec "$@"
+	fi
 }
 
 case "$backend" in

src/actions/admin-badge-upload.ts

@@ -60,7 +60,6 @@ export async function uploadBadge(formData: FormData): Promise<void> {
 	try {
 		const buffer = Buffer.from(await file.arrayBuffer());
 		const gif = await toBadgeGif(buffer);
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await writeFile(target, gif);
 	} catch {
 		back("error", "Could not process or write the badge file");

src/actions/admin-maintenance.ts

@@ -32,7 +32,7 @@ async function upsertSetting(key: string, value: string): Promise<void> {
 		.values({
 			key,
 			value,
-			// eslint-disable-next-line security/detect-object-injection -- key is one of 3 known const values
+			// key is one of 3 known const values
 			comment: COMMENTS[key] ?? null,
 		})
 		.onDuplicateKeyUpdate({ set: { value } });

src/actions/admin-radio-points.ts

@@ -71,10 +71,10 @@ export async function savePoints(formData: FormData): Promise<void> {
 			POINTS_KEYS.map((key) =>
 				db
 					.insert(WebsiteSetting)
-					// eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
+					// key from POINTS_KEYS const
 					.values({ key, value: values[key], comment: "Radio points" })
 					.onDuplicateKeyUpdate({
-						// eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
+						// key from POINTS_KEYS const
 						set: { value: values[key] },
 					}),
 			),

src/actions/admin-theme.ts

@@ -112,7 +112,7 @@ export async function saveTheme(formData: FormData): Promise<void> {
 export async function applyPreset(formData: FormData): Promise<void> {
 	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const name = String(formData.get("preset") ?? "").normalize("NFC");
-	// eslint-disable-next-line security/detect-object-injection -- guarded by null check below
+	// guarded by null check below
 	const preset = PRESETS[name];
 	if (!preset) redirect("/admin/theme");
 

src/actions/password-reset.ts

@@ -6,6 +6,7 @@ import { redirect } from "next/navigation";
 import { env } from "@/env";
 import { invalidateLoginCache } from "@/lib/auth/login-core";
 import { hashPassword } from "@/lib/auth/password";
+import { passwordPolicy } from "@/lib/auth/password-policy";
 import { revokeUserCredentials } from "@/lib/auth/session-revocation";
 import { db, PasswordReset, User } from "@/lib/db";
 import { logger } from "@/lib/logger";
@@ -109,7 +110,11 @@ export async function resetPassword(formData: FormData): Promise<void> {
 	}
 
 	let error: "password" | "invalid" | "failed" | null = null;
-	if (password.length < 12) error = "password";
+	if (
+		password.length < passwordPolicy.minLength ||
+		password.length > passwordPolicy.maxLength
+	)
+		error = "password";
 
 	if (!error) {
 		try {

src/actions/register.ts

@@ -5,6 +5,7 @@ import { after } from "next/server";
 import { z } from "zod";
 import { sendVerification } from "@/lib/auth/email-verification";
 import { hashPassword } from "@/lib/auth/password";
+import { passwordPolicy } from "@/lib/auth/password-policy";
 import { DEFAULT_AVATAR_FIGURE } from "@/lib/avatar-figure";
 import { invalidateKey } from "@/lib/cached-db";
 import { db, User } from "@/lib/db";
@@ -83,6 +84,11 @@ function hasDisposableEmailDomain(email: string): boolean {
 	return domain ? DISPOSABLE_EMAIL_DOMAINS.has(domain) : false;
 }
 
+// Rendered into the schema below and mapped back to a locale-independent code
+// via `ZOD_MESSAGE_CODES`, so the length always reflects the configured policy.
+const PASSWORD_MIN_MESSAGE = `Password must be at least ${passwordPolicy.minLength} characters`;
+const PASSWORD_MAX_MESSAGE = "Password is too long";
+
 const registerSchema = z
 	.object({
 		username: z
@@ -105,8 +111,8 @@ const registerSchema = z
 			),
 		password: z
 			.string()
-			.min(12, "Password must be at least 12 characters") // Increased min length
-			.max(128, "Password is too long") // Added max length
+			.min(passwordPolicy.minLength, PASSWORD_MIN_MESSAGE)
+			.max(passwordPolicy.maxLength, PASSWORD_MAX_MESSAGE)
 			.regex(/[A-Z]/, "Password must contain at least one uppercase letter")
 			.regex(/[a-z]/, "Password must contain at least one lowercase letter")
 			.regex(/[0-9]/, "Password must contain at least one digit")
@@ -160,8 +166,8 @@ const ZOD_MESSAGE_CODES: Record<string, RegisterErrorCode> = {
 	"This username is reserved": "usernameReserved",
 	"Enter a valid email address": "emailValid",
 	"Temporary email domains are not allowed": "emailDisposable",
-	"Password must be at least 12 characters": "passwordMinLength",
-	"Password is too long": "passwordMaxLength",
+	[PASSWORD_MIN_MESSAGE]: "passwordMinLength",
+	[PASSWORD_MAX_MESSAGE]: "passwordMaxLength",
 	"Password must contain at least one uppercase letter": "passwordUpper",
 	"Password must contain at least one lowercase letter": "passwordLower",
 	"Password must contain at least one digit": "passwordDigit",

src/actions/save-favicon.ts

@@ -31,9 +31,7 @@ export async function saveFavicon(
 		}
 
 		const buffer = upload.bytes;
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await mkdir(baseDir, { recursive: true });
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await writeFile(filePath, buffer);
 
 		const url = `/api/media/favicon/${filename}`;
@@ -46,7 +44,6 @@ export async function saveFavicon(
 				const oldPath = path.resolve(baseDir, oldName);
 				if (oldPath.startsWith(baseDir + path.sep)) {
 					try {
-						// eslint-disable-next-line security/detect-non-literal-fs-filename
 						await unlink(oldPath);
 					} catch {
 						/* ignore if file doesn't exist */
@@ -85,7 +82,6 @@ export async function deleteFavicon(): Promise<{
 				const oldPath = path.resolve(baseDir, oldName);
 				if (oldPath.startsWith(baseDir + path.sep)) {
 					try {
-						// eslint-disable-next-line security/detect-non-literal-fs-filename
 						await unlink(oldPath);
 					} catch {
 						/* ignore */

src/actions/save-logo.ts

@@ -29,9 +29,7 @@ export async function saveLogo(
 		}
 
 		const buffer = upload.bytes;
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await mkdir(baseDir, { recursive: true });
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await writeFile(filePath, buffer);
 
 		const url = `/api/media/logo/${filename}`;

src/actions/theme-manager.ts

@@ -278,14 +278,12 @@ export async function uploadBackground(formData: FormData): Promise<void> {
 
 	let uploaded = false;
 	try {
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await mkdir(MEDIA_ROOT, { recursive: true });
 		const ext = file.name.split(".").pop() ?? "png";
 		const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
 		const bytes = await file.arrayBuffer();
 		const filePath = resolveMediaPath(name);
 		if (filePath.startsWith(MEDIA_ROOT + path.sep)) {
-			// eslint-disable-next-line security/detect-non-literal-fs-filename
 			await writeFile(filePath, Buffer.from(bytes));
 			await writeSetting("background_image", `/api/media/${name}`);
 			await writeSetting(
@@ -319,7 +317,7 @@ export async function applyPresetManager(formData: FormData): Promise<void> {
 	const name = String(formData.get("preset") ?? "")
 		.normalize("NFC")
 		.trim();
-	// eslint-disable-next-line security/detect-object-injection -- guarded by null check below
+	// guarded by null check below
 	const preset = PRESETS[name];
 	if (!preset) redirect(MANAGER_PATH);
 

src/app/(site)/apply/staff/page.tsx

@@ -142,7 +142,6 @@ export default async function ApplyStaffPage({
 							<article key={String(position.id)} className="content-card">
 								<div className="content-card-head">
 									{team?.badge ? (
-										/* eslint-disable-next-line @next/next/no-img-element */
 										<img
 											src={`${BADGE_IMG_BASE}=${encodeURIComponent(team.badge)}`}
 											alt={rankName}

src/app/(site)/apply/team/page.tsx

@@ -120,7 +120,6 @@ export default async function ApplyTeamPage({
 							<article key={String(team.id)} className="content-card">
 								<div className="content-card-head">
 									{team.badge ? (
-										/* eslint-disable-next-line @next/next/no-img-element */
 										<img
 											src={`${BADGE_IMG_BASE}=${encodeURIComponent(team.badge)}`}
 											alt={team.rankName}

src/app/(site)/badges/page.tsx

@@ -48,7 +48,6 @@ export default async function BadgesPage() {
 									alignItems: "flex-start",
 								}}
 							>
-								{/* eslint-disable-next-line @next/next/no-img-element */}
 								<img
 									src={`${BADGE_IMG_BASE}=${encodeURIComponent(badge.badgeKey)}`}
 									alt={badge.badgeName}

src/app/(site)/draw-badge/page.tsx

@@ -190,7 +190,6 @@ export default async function DrawBadgePage({
 											{b.badgeUrl ? (
 												// Badge images are arbitrary external URLs stored by the
 												// draw-badge tool, so a plain <img> is correct here.
-												// eslint-disable-next-line @next/next/no-img-element
 												<img
 													src={b.badgeUrl}
 													alt=""

src/app/(site)/guilds/[id]/page.tsx

@@ -149,7 +149,6 @@ export default async function GuildPage({
 					style={{ display: "flex", gap: "1.25rem", alignItems: "flex-start" }}
 				>
 					{guild.badge ? (
-						// eslint-disable-next-line @next/next/no-img-element
 						<img
 							src={`https://habbo-stories-content.s3.amazonaws.com/badge-part-images/${guild.badge}.gif`}
 							alt={`${guild.name} badge`}

src/app/(site)/guilds/page.tsx

@@ -74,7 +74,6 @@ export default async function GuildsPage() {
 								}}
 							>
 								{g.badge ? (
-									// eslint-disable-next-line @next/next/no-img-element
 									<img
 										src={`https://habbo-stories-content.s3.amazonaws.com/badge-part-images/${g.badge}.gif`}
 										alt={`${g.name} badge`}

src/app/(site)/help/[category]/page.tsx

@@ -6,6 +6,7 @@ import { ContentCard } from "@/components/public/ui";
 import { SanitizedHtml } from "@/components/shared/sanitized-html";
 import { db, WebsiteHelpCenterCategories } from "@/lib/db";
 import { resolveHotelName } from "@/lib/hotel-name";
+import { publicAssetExists } from "@/lib/public-asset";
 import { sanitize } from "@/lib/sanitize";
 
 // Asset path matches AtomCMS's Blade view: asset('/assets/images/help-center/<image_url>').
@@ -99,7 +100,10 @@ export default async function HelpCategoryPage({
 	const title = withHotel(cat.name, hotelName);
 	const content = withHotel(cat.content, hotelName);
 	const buttonText = withHotel(cat.buttonText, hotelName);
-	const imageSrc = cat.imageUrl ? `${HELP_IMAGE_BASE}/${cat.imageUrl}` : "";
+	const imageSrc =
+		cat.imageUrl && publicAssetExists(`${HELP_IMAGE_BASE}/${cat.imageUrl}`)
+			? `${HELP_IMAGE_BASE}/${cat.imageUrl}`
+			: "";
 	const hasButton = Boolean(cat.buttonText && cat.buttonText.trim() !== "");
 
 	return (
@@ -110,7 +114,6 @@ export default async function HelpCategoryPage({
 
 			<ContentCard icon="❓" title={title} subtitle={t("topicSubtitle")}>
 				{imageSrc ? (
-					// eslint-disable-next-line @next/next/no-img-element
 					<img
 						src={imageSrc}
 						alt=""

src/app/(site)/layout.tsx

@@ -1,4 +1,5 @@
 import dynamic from "next/dynamic";
+import { headers } from "next/headers";
 import { NextIntlClientProvider } from "next-intl";
 import { getLocale, getMessages } from "next-intl/server";
 import type { ReactNode } from "react";
@@ -34,28 +35,43 @@ export default async function SiteLayout({
 }: {
 	children: ReactNode;
 }) {
-	const [session, locale, messages] = await Promise.all([
+	const [session, locale, messages, h] = await Promise.all([
 		auth(),
 		getLocale(),
 		getMessages(),
+		headers(),
 	]);
 	const clientMessages = publicClientMessages(messages);
 
+	// The landing pages render their own AuthTopBar (logo + live online), so the
+	// global site banner / navigation is hidden there to keep them clean and
+	// avoid showing the same chrome twice. Everything else keeps the chrome.
+	const pathname = h.get("x-pathname");
+	const isLandingPage =
+		pathname === "/" || pathname === "/login" || pathname === "/register";
+
 	return (
 		<NextIntlClientProvider locale={locale} messages={clientMessages}>
 			<CloudsField />
 			{/* Site chrome is public: hiding it all for anonymous visitors used to
 			    strand them — from /news, /leaderboard or /shop there was no way to
-			    reach any other page at all. */}
-			<div data-theme-block="top_header">
-				<TopHeader session={session} />
-			</div>
-			<div data-theme-block="site_header">
-				<SiteHeader />
-			</div>
-			<div data-theme-block="navigation">
-				<Navigation session={session} />
-			</div>
+			    reach any other page at all. Only the standalone landing pages opt
+			    out, because they carry their own header. */}
+			{!isLandingPage && (
+				<div data-theme-block="top_header">
+					<TopHeader session={session} />
+				</div>
+			)}
+			{!isLandingPage && (
+				<div data-theme-block="site_header">
+					<SiteHeader />
+				</div>
+			)}
+			{!isLandingPage && (
+				<div data-theme-block="navigation">
+					<Navigation session={session} />
+				</div>
+			)}
 			<main>
 				<div
 					data-theme-block="content_grid"

src/app/(site)/leaderboard/page.tsx

@@ -171,7 +171,7 @@ export default async function LeaderboardPage({
 	const rows = await (active === "credits"
 		? loadCreditsRows()
 		: active === "diamonds" || active === "duckets"
-			? // eslint-disable-next-line security/detect-object-injection -- active validated as "diamonds"|"duckets" in this branch
+			? // active validated as "diamonds"|"duckets" in this branch
 				loadCurrencyRows(CURRENCY_TYPE[active])
 			: loadSettingsRows(
 					SETTINGS_FIELD[active as keyof typeof SETTINGS_FIELD],

src/app/(site)/news/rss.xml/route.ts

@@ -0,0 +1,25 @@
+import { resolveHotelName } from "@/lib/hotel-name";
+import { buildNewsRss } from "@/lib/news-rss";
+import { appBaseUrl } from "@/lib/seo";
+import { getNewsList } from "@/lib/services/news-list";
+
+// Built per request so the feed never needs a database connection during
+// `next build`, matching the sitemap and robots routes.
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+	const [hotelName, items] = await Promise.all([
+		resolveHotelName(),
+		getNewsList(30),
+	]);
+
+	return new Response(
+		buildNewsRss(items, { hotelName, appUrl: appBaseUrl() }),
+		{
+			headers: {
+				"Content-Type": "application/rss+xml; charset=utf-8",
+				"Cache-Control": "public, s-maxage=300, stale-while-revalidate=600",
+			},
+		},
+	);
+}

src/app/(site)/rares/[category]/page.tsx

@@ -108,7 +108,6 @@ export default async function RareCategoryPage({
 						}}
 					>
 						{badgeSrc ? (
-							// eslint-disable-next-line @next/next/no-img-element
 							<img
 								src={badgeSrc}
 								alt={`${cat.name} badge`}
@@ -150,7 +149,6 @@ export default async function RareCategoryPage({
 										<tr key={String(r.id)}>
 											<td>
 												{iconSrc ? (
-													// eslint-disable-next-line @next/next/no-img-element
 													<img
 														src={iconSrc}
 														alt=""

src/app/(site)/rares/page.tsx

@@ -88,7 +88,6 @@ export default async function RareValuesPage() {
 							>
 								<div className="content-card-head">
 									{badgeSrc ? (
-										// eslint-disable-next-line @next/next/no-img-element
 										<img
 											src={badgeSrc}
 											alt={`${c.name} badge`}

src/app/(site)/reset/page.tsx

@@ -3,6 +3,7 @@ import { getTranslations } from "next-intl/server";
 import { resetPassword } from "@/actions/password-reset";
 import Link from "@/components/link";
 import { ContentCard } from "@/components/public/ui";
+import { passwordPolicy } from "@/lib/auth/password-policy";
 
 export async function generateMetadata(): Promise<Metadata> {
 	const t = await getTranslations("pages.reset");
@@ -41,8 +42,12 @@ export default async function ResetPage({
 					<input
 						name="password"
 						type="password"
-						placeholder={t("passwordPlaceholder")}
+						placeholder={t("passwordPlaceholder", {
+							min: passwordPolicy.minLength,
+						})}
 						autoComplete="new-password"
+						minLength={passwordPolicy.minLength}
+						maxLength={passwordPolicy.maxLength}
 						required
 					/>
 					<button type="submit" className="btn btn-primary">
@@ -58,7 +63,7 @@ export default async function ResetPage({
 							marginBottom: 0,
 						}}
 					>
-						{t(errorKey)}
+						{t(errorKey, { min: passwordPolicy.minLength })}
 					</p>
 				) : null}
 				<p

src/app/(site)/room/[id]/page.tsx

@@ -16,7 +16,7 @@ const STATE_LABELS: Record<string, { label: string; icon: string }> = {
 };
 
 function describeState(state: string): { label: string; icon: string } {
-	// eslint-disable-next-line security/detect-object-injection -- STATE_LABELS has known keys, fallback provided
+	// STATE_LABELS has known keys, fallback provided
 	return STATE_LABELS[state] ?? { label: state || "Unknown", icon: "🚪" };
 }
 

src/app/(site)/shop/page.tsx

@@ -249,7 +249,6 @@ export default async function ShopPage({
 										}}
 									>
 										{a.iconUrl ? (
-											// eslint-disable-next-line @next/next/no-img-element
 											<img
 												src={a.iconUrl}
 												alt=""

src/app/(site)/u/[username]/page.tsx

@@ -366,7 +366,6 @@ async function ProfilePage({
 						flexWrap: "wrap",
 					}}
 				>
-					{/* eslint-disable-next-line @next/next/no-img-element */}
 					<ProfileImage
 						src={avatar}
 						alt={user.username}

src/app/admin-next/layout.tsx

@@ -1,4 +1,6 @@
 import { notFound } from "next/navigation";
+import { NextIntlClientProvider } from "next-intl";
+import { getLocale, getMessages } from "next-intl/server";
 import type { ReactNode } from "react";
 import { env } from "@/env";
 import { isHousekeepingPreviewEnabled } from "@/features/housekeeping/foundation/preview-gate";
@@ -27,5 +29,13 @@ export default async function AdminNextLayout({
 		notFound();
 	}
 
-	return children;
+	// Staff tree: re-install the full catalogue the root layout scopes down to
+	// the public subset (nested providers replace the parent set).
+	const [locale, messages] = await Promise.all([getLocale(), getMessages()]);
+
+	return (
+		<NextIntlClientProvider locale={locale} messages={messages}>
+			{children}
+		</NextIntlClientProvider>
+	);
 }

src/app/admin/ads/ads-table.tsx

@@ -49,7 +49,6 @@ export function AdsTable({ ads }: { ads: AdRow[] }) {
 					{ads.map((ad) => (
 						<tr key={ad.id}>
 							<td>
-								{/* eslint-disable-next-line @next/next/no-img-element */}
 								<img
 									src={ad.image}
 									alt=""

src/app/admin/calendar/[id]/page.tsx

@@ -103,7 +103,6 @@ export default async function AdminCalendarCampaign({
 
 			<div className="admin-card flex items-center gap-5 mb-6">
 				{campaign.image ? (
-					// eslint-disable-next-line @next/next/no-img-element
 					<img
 						className="w-24 h-24 object-cover"
 						src={campaign.image}

src/app/admin/calendar/page.tsx

@@ -98,7 +98,6 @@ export default async function AdminCalendar() {
 								className="admin-card hover article"
 							>
 								{c.image ? (
-									// eslint-disable-next-line @next/next/no-img-element
 									<img className="article-img" src={c.image} alt={c.name} />
 								) : (
 									<div className="article-img" />

src/app/admin/devops/antiddos/page.tsx

@@ -87,7 +87,7 @@ export default async function AdminAntiDdosPage() {
 					const ip = key.replace("antiddos:block:", "");
 					return {
 						ip,
-						ttlMs: ttlMs > 0 ? ttlMs : 0,
+						ttlMs: Math.max(ttlMs, 0),
 						count: violationCounts.get(ip) ?? 0,
 						source: "gate" as const,
 					};

src/app/admin/guilds/[id]/page.tsx

@@ -96,7 +96,6 @@ export default async function AdminGuildDetailPage({
 			<div className="flex flex-wrap items-start justify-between gap-4">
 				<div className="flex items-center gap-4">
 					{guild.badge ? (
-						// eslint-disable-next-line @next/next/no-img-element
 						<img
 							src={`https://habbo-stories-content.s3.amazonaws.com/badge-part-images/${guild.badge}.gif`}
 							alt=""

src/app/admin/guilds/page.tsx

@@ -155,7 +155,6 @@ export default async function AdminGuildsPage({
 											<td className="muted">{g.id}</td>
 											<td>
 												{g.badge ? (
-													// eslint-disable-next-line @next/next/no-img-element
 													<img
 														src={`https://habbo-stories-content.s3.amazonaws.com/badge-part-images/${g.badge}.gif`}
 														alt=""

src/app/admin/layout.tsx

@@ -1,7 +1,8 @@
 import { eq } from "drizzle-orm";
 import { LogOut } from "lucide-react";
 import { redirect } from "next/navigation";
-import { getTranslations } from "next-intl/server";
+import { NextIntlClientProvider } from "next-intl";
+import { getLocale, getMessages, getTranslations } from "next-intl/server";
 import type { ReactNode } from "react";
 import { AdminHubChrome } from "@/components/admin/admin-hub-chrome";
 import { AdminMobileWrapper } from "@/components/admin/admin-mobile-wrapper";
@@ -40,8 +41,13 @@ export default async function AdminLayout({
 		if (!u?.twoFactorConfirmedAt) redirect("/settings/2fa?error=staffrequired");
 	}
 
+	// The root layout ships the reduced catalogue so public pages do not carry
+	// the ~195 KB of staff-tool strings. Nested providers replace the parent
+	// set rather than merging, so staff route groups re-install the full one.
+	const [locale, messages] = await Promise.all([getLocale(), getMessages()]);
+
 	return (
-		<>
+		<NextIntlClientProvider locale={locale} messages={messages}>
 			{csrfToken ? <meta name="csrf-token" content={csrfToken} /> : null}
 			<AdminMobileWrapper sidebar={<Sidebar staff={staff} />}>
 				<div
@@ -56,7 +62,7 @@ export default async function AdminLayout({
 				</div>
 			</AdminMobileWrapper>
 			<AdminToaster />
-		</>
+		</NextIntlClientProvider>
 	);
 }