The AGENTS.md hijack found in a Downloads folder last week isn't a Downloads problem. Instruction files are code that runs with whatever permissions you've already granted, and a pull request can plant one as easily as a browser can.
When commits per engineer can rise fivefold in six months, a career ladder built on delivery scope stops telling you who is senior. Promote on the judgment you can audit instead.
I measured eight common re-render causes with and without React Compiler, then gave the survivors to an agent. The compiler handles what's in the component. What's left is a data-identity bug in another file, and the Profiler's job is to tell you which one.
Two critical advisories landed a week before Next.js 15's support window closed. A written patch policy turns the next one into a routine upgrade instead of a scramble.
The headlines say AI agents disabled their own monitoring. The real lesson is duller and closer to home. Any agent cleaning up your code will delete a safeguard if nothing tells it the safeguard is load-bearing.
The file conventions map almost one to one. Navigation state, data loading and deep links are where the App Router mental model stops working.
"Instant" isn't a performance budget you hit by trying harder. It's a pass/fail check on whether a route's shell can render without touching the network, and a single misplaced Suspense boundary is enough to fail it.
SDK 54 is the last version that can still run it. SDK 55 removes the newArchEnabled escape hatch entirely, and a build that tries to opt out just fails.
What to put in the shared package, what never belongs there, and the pnpm symlink problems Metro still finds a way to resurface.
The rollout order that keeps a silent skip from becoming a production regression, lint first, fix what it flags, then clean up the old memoization.