X_BROWSER_TRANSPORT_BYPASS

browser-reachable code opens its own connection instead of using the one seam

a fetch( call, new WebSocket(, new XMLHttpRequest( or new EventSource( — or the global fetch handed on as a value (rpc({ fetch }), fetch: fetch, const f = window.fetch, make(globalThis.fetch); a property named fetch, a local binding and a type position are not) — in an island or a module one reaches (its import closure, followed name by name through barrels, into the app's own packages/*). Such a request skips the page's record store, the idempotency header and the principal fence. Reported by x verify's boundaries step in every app (As of 2026-10; built in, not a guards/ file, so an app cannot delete it) — there no file may hold one: the three seams are the framework's, inside node_modules, and the walk stops at that boundary. In this repository bun run browser-transport runs the same rule with the seams as files: packages/core/src/client-dispatch.ts for fetch, packages/realtime/src/browser-socket.ts for sockets, packages/storage/src/upload-client.ts for XHR, nothing for EventSource; the service worker's files are exempt. Blind spots, stated: a browser module that is no island, names no seam and is imported by neither; a request made inside an installed package; a computed member (globalThis['fetch']); a bare fetch( in a file that binds a local fetch. A route.ts, a job and a test are server code and never reported

x verify --only boundaries --json after replacing the call the finding names: an action → await browserClient.<action>(input) (rpc<Api['actions']> in apps/web/shared/browser-client.ts); a read → useQuery(<QUERY_REF>, input); a socket or SSE → useQuery / useChannel; a file → uploadFile({ file, grant }) from @ultimat3/storage; anything else → clientTransport({ method, url }) from @ultimat3/core/page; a fetch passed as a value → delete it (rpc() and queryClient() send through clientTransport when given none) and move the module that took it onto one of the above