Ramonda

client-only-request-read

This fails the run. Where it is wrong about your code, // ramonda-check-ignore <reason> on the line says so, and the reason is printed on every run.

Reported when a requestContext() read is on a path that only runs in the browser, where the value it names is never available.

The framework reports the same fault while running, as RMD025 — but only once the line actually runs. This is the same fault proved from the source instead.

The browser's request scope carries the live url, the values whose keys opted into exposeToClient and which the server seeded — and nothing else. Cookies and headers are never among them: a cookie belongs to the server, and an httpOnly one is invisible to JavaScript in any case.

So read the request where it exists and keep the answer. @created and @mounted default to shared, which means they run during the server render too, and @state is what carries a value across to the browser:

@created seedUser() { this.user = requestContext().get(currentUser); }

That also survives hydration: @created is skipped on the client and the state is restored from the page, so the browser never re-reads the request at all.

If the value really is needed in the browser, opt its key in — requestKey("currentUser", { exposeToClient: true }) — and expose only what is safe to publish: a display name, an id, a role, never a session token. A key that is exposed is not reported here, because whether the server seeded it is a runtime fact.

requestContext().url is live in the browser and is never reported.

A STATIC build will not catch this for you. The read never runs during the render, so the build's per-request poison is never touched: the page bakes cleanly and the fault arrives in the browser as RMD025. That is the reason this rule exists.

Next