fix(tpv-dev-in-prod): tPV production is running next dev (HMR + React DevTools visible)

project/scripts/monolith.sh

@@ -362,6 +362,78 @@ spawn_service() {
   fi
 }
 
+# Markers exclusive to next dev (Turbopack). Any hit means the server is
+# serving the dev build on a port that prod should own. Add new markers here
+# if a future Next.js version uses different ones.
+HMR_MARKERS=(
+  '/__next_hmr'
+  'react-refresh'
+  'Download the React DevTools'
+  'webpack-hmr'
+  '__webpack_require__'
+  '_devPagesManifest'
+)
+# Services powered by Next.js (backend uses Fastify, so it is excluded).
+NEXT_SERVICES=(admin tpv frontend storefront)
+
+# smoke_check_no_dev_markers
+#   For each Next.js service in prod mode, verify the server is NOT next dev:
+#     1. Root HTML must not contain any HMR_MARKERS substring.
+#     2. GET /_next/hmr must respond 404 or 426 (not 200/101/405).
+#     3. Startup log must not contain "(Turbopack)".
+#   Returns 0 if clean, 1 if any check fails.
+smoke_check_no_dev_markers() {
+  local service port url log body hmr_code marker failed=0
+  echo '[INFO] Smoke check: verifying Next.js services are NOT serving next dev (HMR-free)...'
+  for service in "${NEXT_SERVICES[@]}"; do
+    port="$(service_port "$service")"
+    url="$(service_url "$service")"
+    log="$(log_file "$service")"
+
+    # 1) HTML root must not contain dev-only markers
+    if body="$(curl --max-time 5 -fsS "$url" 2>/dev/null)"; then
+      for marker in "${HMR_MARKERS[@]}"; do
+        if printf '%s' "$body" | grep -qF "$marker"; then
+          echo "[FAIL] $service root HTML contains dev-only marker: $marker" >&2
+          failed=1
+        fi
+      done
+    else
+      echo "[FAIL] $service root not reachable at $url" >&2
+      failed=1
+    fi
+
+    # 2) HMR endpoint must reject (404 or 426 expected in prod)
+    hmr_code="$(curl --max-time 5 -sS -o /dev/null -w '%{http_code}' "$url/_next/hmr" 2>/dev/null || true)"
+    case "$hmr_code" in
+      404|426) ;;
+      '')
+        echo "[FAIL] $service /_next/hmr did not respond (curl returned empty)" >&2
+        failed=1
+        ;;
+      *)
+        echo "[FAIL] $service /_next/hmr returned HTTP $hmr_code (expected 404 or 426; a dev server is likely active)" >&2
+        failed=1
+        ;;
+    esac
+
+    # 3) Startup banner must not include "(Turbopack)"
+    if [[ -f "$log" ]] && head -20 "$log" 2>/dev/null | grep -qF '(Turbopack)'; then
+      echo "[FAIL] $service startup banner shows (Turbopack) — dev server is active" >&2
+      failed=1
+    fi
+  done
+
+  if (( failed )); then
+    echo '[FAIL] DEV MODE DETECTED on prod start. Refusing to continue.' >&2
+    echo '       Stop every next dev process on these ports and rerun.' >&2
+    echo '       See docs/HOWTO-monolith.md §3.1 for the recovery runbook.' >&2
+    return 1
+  fi
+  echo '[OK] All Next.js services are HMR-free (prod start confirmed).'
+  return 0
+}
+
 start_all() {
   ensure_env
   clear_stale_deployments
@@ -375,6 +447,13 @@ start_all() {
   [[ "$MODE" == "prod" ]] && build_prod
   sync_uploads
   for service in "${SERVICES[@]}"; do spawn_service "$service"; done
+  if [[ "$MODE" == "prod" ]]; then
+    if ! smoke_check_no_dev_markers; then
+      echo '[FAIL] Smoke check failed; stopping just-started services to leave a clean state.' >&2
+      stop_all
+      exit 1
+    fi
+  fi
   echo
   print_urls
 }