Production Posture

A short checklist to run before you ship. Each item is one line and a link to the page that covers it in full.

Connection & identity

• Use a durable storage on every secure connection. A memory-backed store mints a new crypto identity on each load, and the peer’s pin rejects every one after the first, permanently. → Identity & Trust
• Know how to recover an identity_pin_mismatch. It’s permanent for that id+key pair. Recover under a new persistent id, or clear the peer-side pin. → Identity & Trust
• On Cloudflare, persist the TOFU pins (the serveWireDurableObject default), so a hibernation wake doesn’t forget them and trust whichever key shows up next as if it were first contact. → Identity & Trust
• Pick a security level deliberately. authenticated is the floor; use encrypted for anything sensitive on the wire. → Security Levels

Realm state

• Bound your state cardinality. The engine caps each frame and write, not the total tree. Cap growing records (rosters, logs) with a rule. → Limits & Production
• Prefer transient / ephemeral for presence-shaped state, so it never persists and cold-starts empty. → Limits & Production
• Mind at-rest storage. encrypted protects data on the wire, not the DO’s SQLite. Keep secrets out of persisted state, and out of rejection errors. → Realm Security

Observation & exposure

• The library logs no payload content by default. Nothing about a write’s values, an action’s input, or a realm’s state leaves the process on its own. Any observation you turn on can expose user data, so scope wireTap to an allow-list, not whole frames.
• Devtools are inert in production, fail-closed. The handles disable when NODE_ENV === "production" (or stage: "production" on a DO), the token never lives in the app bundle, and no endpoint is registered. Shipping a build with devtools wired costs nothing. → The Devtools Window → in production

Versioning & errors

• Upgrade every @nice-code/* package in lockstep, and rely on the wire-format skew promise to deploy without a flag-day. → Stability & Versioning
• Program against error ids, never messages. Every id the stack can raise is listed with what to do about it. → Error Reference