Fix Docker workspace lockfile drift and add sync guard

deployment/docker/README.md

@@ -21,6 +21,7 @@ It is separate from the repo-root `docker-compose.yml`, which is still the light
 - `deployment/docker/Dockerfile.service`: shared Bun runtime image for most services
 - `deployment/docker/Dockerfile.ingest-options`: Bun runtime plus Python dependencies for Databento and IBKR adapters
 - `deployment/docker/Dockerfile.web`: multi-stage build for the Next.js web app
+- `deployment/docker/workspace-root/`: deployment-specific workspace snapshot (`package.json`, `tsconfig.base.json`, `bun.lock`) used by Docker builds
 - `deployment/docker/clickhouse/listen.xml`: forces ClickHouse to listen on IPv4 for other containers on the Docker network
 - `deployment/docker/.env.example`: container-oriented environment template
 
@@ -185,6 +186,22 @@ If NPM is on multiple networks and names collide (for example another stack also
 
 ## Updating the deployment
 
+This deployment installs dependencies from `deployment/docker/workspace-root/bun.lock` (not the repo-root lockfile).
+
+When dependencies change in any workspace used by Docker builds, refresh and validate the deployment snapshot first:
+
+```bash
+bun run sync:docker-workspace
+bun run check:docker-workspace
+```
+
+Then validate the VPS build path:
+
+```bash
+cd deployment/docker
+docker compose build web
+```
+
 When you pull new code:
 
 ```bash

deployment/docker/workspace-root/bun.lock

@@ -12,6 +12,7 @@
       "name": "@islandflow/web",
       "dependencies": {
         "@islandflow/types": "workspace:*",
+        "@tanstack/react-virtual": "^3.13.24",
         "lightweight-charts": "^4.2.0",
         "next": "^14.2.4",
         "react": "^18.3.1",
@@ -81,6 +82,7 @@
         "@islandflow/bus": "workspace:*",
         "@islandflow/config": "workspace:*",
         "@islandflow/observability": "workspace:*",
+        "@islandflow/refdata": "workspace:*",
         "@islandflow/storage": "workspace:*",
         "@islandflow/types": "workspace:*",
         "redis": "^5.10.0",
@@ -207,6 +209,10 @@
 
     "@swc/helpers": ["@swc/helpers@0.5.5", "", { "dependencies": { "@swc/counter": "^0.1.3", "tslib": "^2.4.0" } }, "sha512-KGYxvIOXcceOAbEk4bi/dVLEK9z8sZ0uBB3Il5b1rhfClSpcX0yfRO0KmTkqR2cnQDymwLB+25ZyMzICg/cm/A=="],
 
+    "@tanstack/react-virtual": ["@tanstack/react-virtual@3.13.24", "", { "dependencies": { "@tanstack/virtual-core": "3.14.0" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-aIJvz5OSkhNIhZIpYivrxrPTKYsjW9Uzy+sP/mx0S3sev2HyvPb7xmjbYvokzEpfgYHy/HjzJ2zFAETuUfgCpg=="],
+
+    "@tanstack/virtual-core": ["@tanstack/virtual-core@3.14.0", "", {}, "sha512-JLANqGy/D6k4Ujmh8Tr25lGimuOXNiaVyXaCAZS0W+1390sADdGnyUdSWNIfd49gebtIxGMij4IktRVzrdr12Q=="],
+
     "@types/node": ["@types/node@20.19.27", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-N2clP5pJhB2YnZJ3PIHFk5RkygRX5WO/5f0WC08tp0wd+sv0rsJk3MqWn3CbNmT2J505a5336jaQj4ph1AdMug=="],
 
     "@types/prop-types": ["@types/prop-types@15.7.15", "", {}, "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw=="],

deployment/docker/workspace-root/package.json

@@ -12,7 +12,9 @@
     "dev:infra": "docker compose up",
     "dev:infra:down": "docker compose down",
     "dev:web": "bun --cwd=apps/web run dev",
-    "dev:services": "bun run scripts/dev-services.ts"
+    "dev:services": "bun run scripts/dev-services.ts",
+    "sync:docker-workspace": "bun run scripts/sync-docker-workspace.ts",
+    "check:docker-workspace": "bun run scripts/check-docker-workspace.ts"
   },
   "devDependencies": {
     "typescript-language-server": "^5.1.3"

deployment/docker/workspace-root/tsconfig.base.json

@@ -8,6 +8,6 @@
     "isolatedModules": true,
     "resolveJsonModule": true,
     "skipLibCheck": true,
-    "noEmit": true
-  }
+    "noEmit": true,
+  },
 }