getCurrentUser is wrapped in React cache so pages that call it from
several components validate the session once per request. Cross-request
caching ("use cache", unstable_cache, module-level storage) stays
forbidden for cleo data and sessions: the PHP app writes to the same DB,
and a cached session would keep a logged-out user signed in.
CLAUDE.md and the cleo-code-review skill now state both rules.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mark steps 1-6 as ordered with mandatory mechanical checks (reference
check before delete, session chain, zod messages, import order), add the
CRLF caveat for prettier on Windows, and spell out the report format
with a concrete example.
Deardo Satria