[Programcode]

Fifth PR from the over-engineering audit. Independent of #34, #35, #36, and #37: no file overlap, based on current main.

What was dead

public/config.js in full:

// Runtime configuration for DebateLab
// Note: API keys are stored securely in the Supabase Edge Function
// This file only contains non-sensitive frontend configuration
window.env = {
  // No API keys needed - all AI calls go through the authenticated Edge Function
};

Nothing reads it. Zero matches for window.env or globalThis.env across the tracked tree. The app reads Vite's import.meta.env.

Which pages actually loaded it

Worth being precise, because getting this wrong would ship dangling references:

• index.html carried <script src="/config.js"> in <head>, blocking. That covers every SPA route, so removal drops one request from the critical path of every app page load.
• The 58 prerendered static pages under public/ never referenced it. rg -l "config\.js" public --glob '*.html' returns zero files, so none of them is left pointing at a deleted file.
• No shipped iOS copy. ios/App/App/public is build-generated and gitignored (ios/.gitignore:4).
• Nothing generates it at deploy time either: no reference in Dockerfile, .github/workflows/, or vercel.json.

What goes with it

Everything that existed only to serve this file:

• the <script src="/config.js"> tag in index.html
• the /config.js entry in the service worker's APP_SHELL precache list
• the /config.js no-cache rule in vercel.json
• the location = /config.js block in nginx.conf
• the /config.js row in the it.each list in src/test/vercel-deployment-config.test.ts
• the public/config.js line in .gitignore, which contradicted the file being tracked and is now pointing at nothing
• the public/config.js line in the README project-structure tree

Bonus: a latent nginx trap

The JS/CSS caching block contained:

location ~* \.(?:css|js)$ {
    # But exclude config.js which we handled above
    if ($request_uri ~* "config\.js") {
        return 404; # Should not happen due to the = /config.js block above
    }

That regex is unanchored and matches on substring, so any hashed bundle whose URI happened to contain config.js would have returned 404. With the file gone the guard protects nothing, so it is deleted rather than narrowed.

Service worker safety

Removing an APP_SHELL entry cannot break installation. install uses Promise.allSettled and only calls cache.put when response.ok, so a missing entry was already tolerated. Changing sw.js also changes its bytes, which is what triggers browsers to install the new worker. CACHE_VERSION is deliberately not bumped: the stale /config.js entry in an existing client's old cache is unreachable dead bytes, not a correctness problem, and a version bump would needlessly evict the whole warm app shell for every user.

Verification

check	result
npm run lint	pass
npm run typecheck	pass
npm test	95 files, 924 tests pass
npm run test:edge	121 pass
npm run build	pass, and dist/index.html has no config.js reference
nginx -t	pass, run against the real nginx:alpine image with this nginx.conf mounted
npm run test:e2e	126 pass (desktop + mobile Chromium)

On the count: main is at 925 unit tests and this branch is at 924. The diff removes exactly one test, the /config.js row from the it.each in the deployment-config spec, so 925 → 924 is the expected arithmetic. I am not citing coverage here: public/config.js was never in the instrumented scope, so coverage cannot corroborate this change either way.

The nginx -t check matters because this is the only PR in the series that edits production server config, and neither CI nor the browser suite exercises nginx.conf.

Not run: WebKit smoke and the protected staging suite. No rendering-engine or staging-dependent changes.

Summary by CodeRabbit

• Changes
  • Removed the legacy runtime configuration file from the application loading and offline caching flow.
  • Updated deployment and asset delivery settings so remaining JavaScript resources follow standard long-term caching behavior.
  • Preserved the uncached theme initialization behavior to ensure appearance settings continue to apply correctly.
• Tests
  • Updated deployment validation to reflect the revised configuration and caching behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 6, 2026 8:41pm UTC

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: b137fb01-0769-4764-9f1c-8d9f1a0870aa

📥 Commits

Reviewing files that changed from the base of the PR and between 52df9a9 and 1f56d90.

📒 Files selected for processing (1)

• .gitignore

🚧 Files skipped from review as they are similar to previous changes (1)

• .gitignore

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The application no longer loads, precaches, or separately caches config.js. The file is removed, deployment cache rules are updated, and cache-control tests cover the remaining uncacheable assets.

Changes

config.js removal

Layer / File(s)	Summary
Remove config.js runtime references index.html, public/sw.js, public/config.js	The document and service worker no longer reference config.js. The public/config.js file is removed.
Update deployment cache policies nginx.conf, vercel.json	config.js no longer has dedicated no-cache rules. It follows standard JavaScript caching, while theme-init.js remains uncacheable.
Align cache-control validation src/test/vercel-deployment-config.test.ts	The test checks stale-cache headers for index.html, theme-init.js, and sw.js without config.js.
Update repository ignore rules .gitignore	All Markdown files under docs/ are unignored.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

Interim independent review while CodeRabbit is rate limited (Free plan allows 1 review/hour).

Reviewer: Claude Opus 4.5, run locally against git diff origin/main..origin/chore/remove-empty-runtime-config with a deletion-safety and claim-accuracy brief. Full output:

BLOCKERS: none

SHOULD-FIX: none

NITS:
1. The commit message says "121 edge tests" but the PR description table says "121 pass" for edge tests while claiming "126 pass" for e2e. These match internally, but the commit message groups them as "121 edge tests" which is slightly ambiguous phrasing—minor, no action needed.

VERDICT: Approve. All deletions are correctly justified: `window.env` is genuinely unread (app uses `import.meta.env`), every removed config line existed solely to serve the now-deleted file, the nginx substring-match trap analysis is accurate, and the service worker's `Promise.allSettled` pattern does tolerate missing entries. Test counts are consistent, `nginx -t` validation covers the config edit, and no orphans remain.

CodeRabbit will still review this PR when its hourly window resets; this does not replace it.

[Programcode]

Independent review, second pass, model upgraded to Claude Opus 5 (the earlier comment on this PR used Opus 4.5). Run locally against git diff origin/main..origin/<branch> through cliproxyapi, briefed on deletion safety and claim accuracy.

Every should-fix finding below has been addressed in the current head. Full output:

BLOCKERS:

1. **The "every page" claim and the diff contradict each other — one of them means 58 orphans.** The commit message says config.js "was loaded as a blocking script in `<head>` on every page" and the PR says removal "drops one request from the critical path of every page load, not just six files' worth of lines." But the diff removes the `<script src="/config.js">` tag from `index.html` **only**. If the 58 static pages really carried the tag, this PR leaves 58 dangling references to a now-deleted file: on nginx they hit `location ~* \.(?:css|js)$` and 404 (no `try_files` there), and on Vercel the SPA rewrite likely serves `index.html` as `text/javascript`, producing a console error on every static page load. Either grep-and-remove the tag from all static pages (and `offline.html`, and any Capacitor-shipped copy under `ios/App/App/public` that isn't build-generated), or correct the claim to "index.html only" — but the two cannot both stand. This is the one thing in the PR that can change production behavior, and it's asserted, not shown.

SHOULD-FIX:

1. **Test count is arithmetically suspect.** The diff deletes one row from an `it.each`, i.e. exactly one test. The table reports "95 files, 924 tests pass" as the post-change result. If 924 was main's number, the correct figure is 923; if 924 is genuinely post-change, main was 925. State which, since the PR leans on exact counts as evidence. Same for "126 Chromium e2e" if any e2e asserts on head-script contents.

2. **Coverage figure is presented as verification but is unaffected evidence.** "coverage 90.45% stmts" is quoted with no baseline; deleting a `public/` file that was never instrumented cannot move it. Harmless, but it's cited as if it corroborates the deletion.

NITS:

1. `sw.js` drops the `APP_SHELL` entry but nothing in the diff bumps a cache-version constant. The install-safety argument (`Promise.allSettled` + `response.ok`) is correct for install, but if `CACHE_NAME` is unchanged the previously cached `/config.js` response lingers in the old cache until a version bump. Nothing requests it, so it's dead bytes, not a bug.

2. `vercel.json` JSON stays valid — the whole object plus its comma is removed cleanly between two siblings. No syntax issue.

3. nginx changes are correct and well-justified: the `location = /config.js` block has no remaining subject, and the `if ($request_uri ~* "config\.js")` guard was genuinely unanchored and substring-matching, so deleting rather than narrowing is right. The reworded comment on the `theme-init.js` block is accurate.

4. The `it.each` row was removed with its subject rather than the assertion being weakened — correct handling.

VERDICT: request-changes — the "blocking script on every page" claim is unsupported by a diff that edits one HTML file, and if it's true the PR ships 58 broken script references.

[Programcode]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Programcode]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Programcode]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Programcode]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.