fix: guard upload limits in production builds

.claude/skills/gates/SKILL.md

@@ -24,7 +24,7 @@ Check these before believing any result.
   for exactly this reason — if installed packages do not match `package-lock.json`, treat any test,
   lint, or typecheck result as void until `npm ci` has run. Its own failure message says as much.
 - **`verify:cheap` stops at the first failing check.** Everything after that point never ran. Do not
-  describe the change as broadly verified when the gate died at check 2 of 30.
+  describe the change as broadly verified when the gate died at check 2 of 31.
 - **`format:check` is required in CI but is not part of `verify:cheap`.** A locally green
   `verify:cheap` can still fail CI on formatting. Run `npx prettier --write <changed files>` before
   pushing — scoped to your files, never `prettier --write .`, which sweeps the whole tree.

.github/workflows/ci.yml

@@ -193,6 +193,9 @@ jobs:
       - name: Installed dependency parity
         run: npm run check:installed-lock-parity
 
+      - name: Upload-limit parity
+        run: npm run check:upload-limit-parity
+
       - name: GitHub Actions pin check
         run: npm run check:github-actions
 

.github/workflows/docker-image.yml

@@ -55,6 +55,7 @@ jobs:
             NEXT_PUBLIC_SUPABASE_URL=https://sjrfecxgysukkwxsowpy.supabase.co
             NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=placeholder-ci-publishable-key
             NEXT_PUBLIC_MAX_UPLOAD_MB=
+            MAX_UPLOAD_MB=
             ALLOW_LOW_RAM_BUILD=1
 
   worker-image:

CLAUDE.md

@@ -138,7 +138,7 @@ Verification pyramid — run the **smallest gate that covers the change**, then
 | Gate                                      | What it is                                                                                                                                                                            |
 | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `npm run test:focused -- --files <paths>` | Source-only iteration. Fails closed for deleted files and test infrastructure — then run `npm run test`.                                                                              |
-| `npm run verify:cheap`                    | The broad local gate: 27 static/consistency gates + `lint` + `typecheck` + full offline unit suite                                                                                    |
+| `npm run verify:cheap`                    | The broad local gate: 28 static/consistency gates + `lint` + `typecheck` + full offline unit suite                                                                                    |
 | `npm run verify:pr-local`                 | Closest local mirror of the PR gate; adds format and conditional build / client-bundle scan / RAG fixture validation. `-- --dry-run --files <paths>` shows selection without running. |
 | `npm run verify:ui`                       | Chromium production journeys. Run `npm run ensure` first.                                                                                                                             |
 | `npm run verify:phone-chrome`             | Phone-chrome changes; selects affected owners/journeys before escalating to `verify:ui`                                                                                               |

Dockerfile

@@ -11,6 +11,7 @@
 # production image:
 #   docker build \
 #     --build-arg NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_... \
+#     --build-arg MAX_UPLOAD_MB=150 \
 #     --build-arg NEXT_PUBLIC_MAX_UPLOAD_MB=150 \
 #     -t clinical-kb-app .
 # Server-side secrets (SUPABASE_SERVICE_ROLE_KEY, OPENAI_API_KEY, ...) are
@@ -34,10 +35,10 @@ COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 ARG NEXT_PUBLIC_SUPABASE_URL=https://sjrfecxgysukkwxsowpy.supabase.co
 ARG NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=placeholder-build-publishable-key
-# Optional browser upload-limit mirror (clamped client-side). Must be set at
-# build time to inline into the client bundle — runtime Railway vars alone are
-# not enough when operators lower MAX_UPLOAD_MB.
+# The server value is also exposed to the build so the parity guard can compare
+# the runtime configuration Railway supplies with the public value Next inlines.
 ARG NEXT_PUBLIC_MAX_UPLOAD_MB=
+ARG MAX_UPLOAD_MB=
 ENV NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}
 ENV NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=${NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY}
 ENV NEXT_PUBLIC_MAX_UPLOAD_MB=${NEXT_PUBLIC_MAX_UPLOAD_MB}
@@ -47,7 +48,11 @@ ENV NEXT_PUBLIC_MAX_UPLOAD_MB=${NEXT_PUBLIC_MAX_UPLOAD_MB}
 # while still completing this Next build.
 ARG ALLOW_LOW_RAM_BUILD=0
 ENV ALLOW_LOW_RAM_BUILD=${ALLOW_LOW_RAM_BUILD}
-RUN npm run build
+# MAX_UPLOAD_MB remains a runtime-only server variable. Copy its build argument
+# into the parity guard's checker-only name, then remove MAX_UPLOAD_MB from the
+# Next build process so application env validation cannot mistake an empty
+# build argument for a runtime value.
+RUN UPLOAD_LIMIT_PARITY_SERVER_MB="${MAX_UPLOAD_MB}" env -u MAX_UPLOAD_MB npm run build
 
 FROM node:24-bookworm-slim AS prod-deps
 WORKDIR /app