The previous two pages are catalogues of mistakes. This one is the short list of habits that makes most of those mistakes impossible to write, framed for the job you are interviewing for: you are not fixing leaks in one app, you are shipping runtime code into every app that installs your layer or module. A consumer cannot patch your plugin, usually cannot find it in a snapshot, and will report the symptom as "the framework is leaking". So the bar for your code is higher than for theirs, and these are the six rules that raise it.

Know

• Request-lifetime data has a home, and it is never module scope. On the server that is event.context; in universal code it is useState, nuxtApp.provide or a value returned from the plugin. Runtime code in a layer or module contains no module-scope mutable state — no let, no Map, no ref() at the top level of a file that ends up in the server bundle. A frozen config object is fine; anything you write to is not.
• Anything with a global side effect is .client, or lazy, or scoped. Timers, window/document access, heavy SDK initialisation, connections: put it in a .client.ts plugin so it never enters the server bundle, or create it lazily on first use and wrap it in an effectScope() you keep a handle to and can stop(). "Scoped" is the difference between a side effect and a leak.
• Every cache is bounded, keyed deliberately, and documented. A bound is a max plus a ttl (or maxAge plus staleMaxAge); a deliberate key is one you wrote yourself and whose value space you can describe in a sentence. Prefer Nitro's cache layer or an unstorage driver over a hand-rolled Map, so production can point it at Redis and a restart does not lose the world. Then write it down in the README — memory behaviour is part of your public API.
• Composables own their cleanup. Create effects synchronously so the caller's scope adopts them, register teardown with onScopeDispose (or VueUse's tryOnScopeDispose, which is a no-op outside a scope) rather than onUnmounted, and return the stop function as well, so a caller outside a component can still do the right thing.
• Anything you subscribe to hands back an unsubscribe — pass it on. nuxtApp.hook(), nitroApp.hooks.hook(), router.afterEach() and hookable in general return removers. A layer's event-bus or hook wrapper must return that function too, or you have designed a leak into your API.
• Module setup that spawns anything registers a close handler. Child processes, watchers, sockets and dev servers started in setup() outlive nuxt dev restarts otherwise. nuxt.hook('close', …) is the teardown, and it costs three lines.

How it works

A composable that is correct in every context a consumer can call it from — component, plugin scope, detached scope, and SSR:

import { getCurrentScope, onScopeDispose, shallowRef } from 'vue'

export function useLivePrice(symbol: string) {
  const price = shallowRef<number | null>(null)

  // SSR: return the same shape, create nothing. No socket, no timer, no leak.
  if (import.meta.server) return { price, stop: () => {} }

  const socket = new WebSocket(`wss://prices.internal/${symbol}`)
  const controller = new AbortController()
  socket.addEventListener('message', e => { price.value = JSON.parse(e.data).price }, { signal: controller.signal })

  const stop = () => { controller.abort(); socket.close() }

  // adopted by a component's scope, a plugin's effectScope, or anything else that owns one
  if (getCurrentScope()) onScopeDispose(stop)
  else if (import.meta.dev) console.warn('[team-layer] useLivePrice() called outside an effect scope — call stop() yourself')

  // returning `stop` is not optional: it is the escape hatch for callers with no scope
  return { price, stop }
}

A cache with a bound, a key you can describe, and no request objects captured:

// Nitro's cache layer: swap the storage driver for Redis in production, no code change
export const getRates = defineCachedFunction(
  async (base: string) => $fetch<Rates>(`https://api.internal/rates/${base}`),
  {
    name: 'rates',
    group: 'team-layer',
    maxAge: 60 * 15,
    staleMaxAge: 60 * 60,
    // primitives only — never close over `event`, `nuxtApp` or anything request-shaped
    getKey: (base: string) => base.toUpperCase().slice(0, 3),
  },
)

A module that spawns something in dev and cleans up after itself:

import { spawn } from 'node:child_process'
import { addServerPlugin, createResolver, defineNuxtModule } from '@nuxt/kit'

export default defineNuxtModule({
  meta: { name: '@team/nuxt-preview', configKey: 'preview' },
  setup(options, nuxt) {
    const resolver = createResolver(import.meta.url)
    addServerPlugin(resolver.resolve('./runtime/server/plugin'))

    if (!nuxt.options.dev) return

    const child = spawn('node', [resolver.resolve('./bin/preview.mjs')], { stdio: 'inherit' })
    // without this, every dev restart orphans one more process and its file watchers
    nuxt.hook('close', () => { child.kill() })

    // the watcher callback does work only — it never registers more hooks
    nuxt.hook('builder:watch', (_event, path) => {
      if (path.endsWith('.preview.json')) regeneratePreview(path)
    })
  },
})

And the paragraph in the README that turns all of this into something a consumer can reason about:

## Memory behaviour

| What | Lifetime | Bound |
| --- | --- | --- |
| `getRates()` | Nitro `cache` storage (in-memory by default) | 15 min `maxAge`, key = 3-letter currency code |
| `useLivePrice()` | the caller's effect scope | socket closed on scope dispose; `stop()` exported |
| `preview` child process | `nuxt dev` only | killed on the `close` hook |

No module-scope mutable state ships in this layer's runtime code. Point
`nitro.storage.cache` at Redis in production if you run more than one instance.

The review checklist

Run this over every PR that touches runtime code in the layer. It takes two minutes and catches almost everything on the previous two pages.

• No module-scope let, Map, Set, array or ref() in anything under runtime/, server/ or app/plugins/.
• Every new setInterval, setTimeout loop, addEventListener, observer or connection has a matching teardown in the same file — and the file is .client.ts if it touches the browser.
• Every watch / watchEffect / computed outside a component sits inside an effectScope() that something stops.
• Every new cache has a name, an explicit key function, a maxAge, and a line in the README.
• Every hook() / on() call either lives in a plugin (once per lifetime) or its remover is captured and called.
• Nothing request-shaped (event, nuxtApp, a Vue app instance) is captured by a closure that outlives the request.
• Module setup() that spawns a process, watcher or server has a nuxt.hook('close', …).
• The memory watermark test still passes, and the threshold was not raised to make it pass.

Exercise

Be able to say