Production Posture

A short pre-flight before you ship. Each item is one line and a link to the page that owns the full story — this page is the map, not the manual.

Connection & identity

• Use a durable storage on every secure connection. A memory-backed store re-mints the crypto identity each load and gets pinned-out after the first — permanently. → Identity & Trust
• Know how to recover an identity_pin_mismatch. It’s permanent for that id+key pair; recover under a new persistent id or clear the peer-side pin. → Identity & Trust
• On Cloudflare, persist the TOFU pins (the serveWireDurableObject default) so a hibernation wake doesn’t re-TOFU. → Identity & Trust
• Pick a security level deliberately. authenticated is the floor; use encrypted for anything sensitive on the wire. → Security Levels

Realm state

• Bound your state cardinality. The engine caps each frame and write, not the total tree — cap growing records (rosters, logs) with a rule. → Limits & Production
• Prefer transient / ephemeral for presence-shaped state, so it never persists and cold-starts empty. → Limits & Production
• Mind at-rest storage. encrypted seals the wire, not the DO’s SQLite — keep secrets out of persisted state, and out of rejection errors. → Realm Security

Observation & exposure

• The library logs no payload content by default. Nothing about a write’s values, an action’s input, or a realm’s state leaves the process on its own. Any observation you turn on can surface user data — scope wireTap to an allow-list, not whole frames.
• Devtools are inert in production, fail-closed. The handles disable when NODE_ENV === "production" (or stage: "production" on a DO), the token never lives in the app bundle, and no endpoint is registered — shipping a build with devtools wired costs nothing. → The Devtools Window → in production

Versioning & errors

• Upgrade every @nice-code/* package in lockstep, and lean on the wire-format skew promise to deploy without a flag-day. → Stability & Versioning
• Program against error ids, never messages. Every id the stack can raise, with what to do about it. → Error Reference