perf: reduce Therapy startup and sidebar layout work

.github/workflows/ci.yml

@@ -413,8 +413,15 @@ jobs:
           NEXT_BUILD_CPUS: "4"
         run: npm run build
 
+      # Step timeout (not job timeout): a stuck exit must fail this step quickly
+      # as `failure` so "Re-run failed jobs" actually re-runs Build. Job-level
+      # cancellation after timeout-minutes left Build as `cancelled`, which the
+      # failed-only rerun path skips — the PR #1489 loop. Invoke `node` directly
+      # so an npm lifecycle wrapper cannot keep the step alive after the check
+      # has printed success.
       - name: Bundle budget (enforced — fails on >tolerancePct gzip growth vs baseline)
-        run: npm run check:bundle-budget
+        timeout-minutes: 3
+        run: node scripts/check-bundle-budget.mjs
 
       - name: Deployment boot smoke
         if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')

Dockerfile

@@ -26,7 +26,13 @@ WORKDIR /app
 COPY package.json package-lock.json .npmrc ./
 COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs
 COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs
-RUN npm ci
+# Registry blips (ECONNRESET) have failed CI app-image builds mid-install; retry
+# the whole `npm ci` rather than relying only on per-request fetch retries.
+RUN for attempt in 1 2 3; do \
+      npm ci --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \
+      if [ "$attempt" -eq 3 ]; then exit 1; fi; \
+      sleep $((attempt * 10)); \
+    done
 
 FROM node:24-bookworm-slim AS build
 WORKDIR /app
@@ -59,7 +65,11 @@ WORKDIR /app
 COPY package.json package-lock.json .npmrc ./
 COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs
 COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs
-RUN npm ci --omit=dev
+RUN for attempt in 1 2 3; do \
+      npm ci --omit=dev --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \
+      if [ "$attempt" -eq 3 ]; then exit 1; fi; \
+      sleep $((attempt * 10)); \
+    done
 
 FROM node:24-bookworm-slim AS runner
 WORKDIR /app

Dockerfile.worker

@@ -24,7 +24,12 @@ WORKDIR /app
 COPY package.json package-lock.json .npmrc ./
 COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs
 COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs
-RUN npm ci
+# Same install-retry contract as the app Dockerfile (registry ECONNRESET flakes).
+RUN for attempt in 1 2 3; do \
+      npm ci --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \
+      if [ "$attempt" -eq 3 ]; then exit 1; fi; \
+      sleep $((attempt * 10)); \
+    done
 COPY . .
 RUN node scripts/build-worker.mjs
 
@@ -35,7 +40,11 @@ WORKDIR /app
 COPY package.json package-lock.json .npmrc ./
 COPY scripts/check-node-engine.cjs scripts/check-node-engine.cjs
 COPY scripts/install-git-hooks.mjs scripts/install-git-hooks.mjs
-RUN npm ci --omit=dev
+RUN for attempt in 1 2 3; do \
+      npm ci --omit=dev --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000 && break; \
+      if [ "$attempt" -eq 3 ]; then exit 1; fi; \
+      sleep $((attempt * 10)); \
+    done
 
 FROM node:24-bookworm-slim AS runner
 RUN apt-get update \

docs/scripts-index.md

@@ -1,6 +1,6 @@
 # Scripts index
 
-Curated map of `scripts/` (197 files) and the `package.json` script surface (212 entries),
+Curated map of `scripts/` (198 files) and the `package.json` script surface (212 entries),
 grouped by purpose. This is orientation, not an exhaustive per-file listing — the authoritative
 command list is `package.json`, and `npm run docs:check-scripts` verifies every `npm run <x>`
 referenced in docs resolves to a real script. `npm run docs:update` refreshes the exact counts above.

next.config.ts

@@ -123,6 +123,20 @@ const nextConfig: NextConfig = {
         source: "/manifest.webmanifest",
         headers: [{ key: "Cache-Control", value: "public, max-age=0, must-revalidate" }],
       },
+      {
+        // Therapy catalogues are content-addressed by the generator. A new data
+        // revision gets a new URL, so browsers and the CDN can retain old bytes
+        // without revalidation while an already-open client finishes using them.
+        source: "/therapy-compass-data/:asset(therapies(?:-(?:home|index))?\\.[a-f0-9]{16}\\.json)",
+        headers: [{ key: "Cache-Control", value: "public, max-age=31536000, immutable" }],
+      },
+      {
+        // Compatibility aliases for deployment-straddling clients. These names
+        // stay stable across regenerations, so force revalidation instead of
+        // inheriting the hashed-asset immutable policy above.
+        source: "/therapy-compass-data/:asset(therapies(?:-(?:home|index))?\\.json)",
+        headers: [{ key: "Cache-Control", value: "public, max-age=0, must-revalidate" }],
+      },
     ];
   },
 };