chore: deploy Next production environment

[XonkelX]

Deployment

• Vercel Hobby project next-queue, connected only to XonkelX/next-queue
• Production: https://next-queue-omega.vercel.app
• Supabase Free project in us-east-1; status ACTIVE_HEALTHY
• Production branch main, repository root, Next.js preset, Node.js 22.x, standard npm run build
• Production-only environment variable names: NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
• No service-role key, database password, or server secret is used by the application
• Web Analytics and Speed Insights disabled; no storage, marketplace integration, custom domain, paid feature, trial, or billing method

Changes

• Configure the final canonical URL, Open Graph metadata, robots, and sitemap
• Restore CONNECTED only after an online authoritative refresh succeeds
• Add a read-only production smoke suite, including invalid-queue behavior
• Patch Next.js and vulnerable transitive dependencies; audit is clean
• Document the deployed Free/Hobby architecture, validation evidence, cleanup, limits, and risks

Production validation

• Queue creation: anonymous initialization, persistence, one-time staff code, and creator authorization passed
• Staff claim: unauthorized denial, generic invalid-code failure, valid claim, hidden code after use, and refresh persistence passed
• Customer joins: unique ordered numbers, correct personal positions, and private names absent from display passed
• Multi-client synchronization: two staff, five customers, and display converged without refresh; nine contexts at peak
• Concurrency: simultaneous call-next attempts produced exactly one serving entry and converged on both staff screens
• Idempotency: same request ID produced one side effect and one revision increment; type mismatch was rejected
• Lifecycle: call, complete, skip, pause, reopen, and close behavior passed
• Reconnect: offline display resynchronized from an authoritative snapshot without duplicates and returned to Connected
• Refresh persistence: customer ownership, staff membership, queue state, and public-safe display persisted
• Privacy: no private name, customer UUID, staff code/hash, auth token, service credential, SQL error, stack trace, or private Realtime subscription was exposed
• Accessibility: zero serious/critical Axe findings across six routes; keyboard, focus, announcements, reduced motion, offline messaging, and 200% zoom passed
• Responsive: 320, 375, 768, 1024, and 1440 px plus 1920×1080 display passed with no horizontal overflow
• Console/logging: zero production console or hydration errors during final browser validation

Cleanup

• Temporary queues removed: 1 full QA queue
• Temporary anonymous users removed: 25 total (23 full QA, 2 final revalidation)
• Final rows: queues=0, queue_entries=0, queue_entry_private=0, queue_staff_memberships=0, queue_staff_access=0, queue_staff_access_attempts=0, queue_commands=0, queue_events=0
• Final Auth users: 0
• All QA sessions closed; local browser snapshots/logs and the one-time staff credential were discarded

Validation

• Vitest: 33 passed
• pgTAP: 62 passed
• Integration: 11 passed
• Realtime controller: 9 passed
• Playwright application: 15 passed
• Production smoke with temporary QA queue: 13 passed, 0 skipped
• Final read-only production smoke after cleanup: 10 passed, 1 skipped (display-specific test requires an intentionally deleted temporary queue)
• Production HTTP: /, /demo, /about, queue surfaces during QA, /robots.txt, and /sitemap.xml returned 200; invalid queue rendered the intended unavailable state
• Formatting, lint, typecheck, local database reset, database lint, generated database types, build, secret/path scan, migration comparison, and diff check passed
• npm audit: 0 vulnerabilities
• Story 2 post-merge CI: quality, database, and browser jobs passed
• Story 3 CI run 30179714285: quality passed in 57s, database passed in 3m18s, browser passed in 4m05s
• Vercel deployment dpl_EBun57um5Jm5CkqUbzAadp3pCXkp: Ready

Costs

• Vercel Hobby only
• Supabase Free only
• No Pro trial or paid plan
• No billing method
• No paid analytics or Speed Insights
• No paid storage or marketplace add-on
• No custom domain purchase

Risks

• Supabase Free may pause after inactivity; it paused during final revalidation and was restored without an upgrade
• Free-tier database, bandwidth, connection, build, and function quotas apply
• Clearing browser site data loses anonymous ownership and staff membership
• A lost one-time staff code cannot be recovered without an existing authorized session
• Basic database throttling is not advanced bot/WAF abuse protection
• The architecture targets small service queues, not unbounded enterprise scale
• No commercial uptime, backup, recovery, support, or performance SLA

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
next-queue	Ready	Preview, Comment	Jul 26, 2026 12:33am

[XonkelX]

Final review passed. Verified production metadata and canonical URLs, public-only Supabase browser configuration, reconnect/cleanup behavior, secret-free diff/history, documentation, and unchanged forward-only migration history. One material smoke-test issue was fixed in 4f40571 so queue-route checks no longer create anonymous browser identities; the revised production smoke suite passed 9/9 with Auth users unchanged at 0 and all eight application tables at 0. Updated quality, database, browser, and Vercel checks are green.