distill: best practices from 2026-04-19 cross-project run

Adds 3 new topic files (ai-parallel-agents, api-integration,
python-patterns) and extends 21 existing topic files with new gotchas
and patterns surfaced from memory across tracked projects. Index
updated accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

networking.md

@@ -32,6 +32,16 @@ Auto-renewing proxies (Caddy, Traefik with Let's Encrypt, etc.) that also suppor
 
 **Rule:** Use automatic certificate management for all sites. Don't mix file-loaded and automatic certs unless you understand the matching priority.
 
+## Reverse Proxies Ignore Labels on Stopped Containers
+
+Docker-label-based routing (Traefik, Caddy-docker-proxy, nginx-proxy) silently drops routes whose target containers are not running. Flags like `allowEmptyServices` do not help — the router only sees the labels of *running* containers.
+
+This breaks on-demand and "scale-to-zero" backends: the proxy has no route to the stopped container, so the wake-up request never reaches whatever is meant to start it. Requests 404 (or worse, go to the wrong backend) until the container happens to be up.
+
+**Rule:** For any backend that may not always be running, declare the route in **dynamic file config**, not container labels. File-config routes exist regardless of container state — the router can then proxy to a "wake" handler, return a holding page, or queue the request.
+
+**Validation:** always test routing with the backend container **stopped**, not just running. If the route disappears when the container stops, the config is wrong for on-demand use.
+
 ## Cilium DNAT Resolves LB VIP Before NetworkPolicy Evaluation
 
 Cilium performs DNAT on LoadBalancer VIP traffic before evaluating NetworkPolicy. Traffic to a VIP is rewritten to a backend pod IP before the policy check. For egress to LoadBalancer services in CiliumNetworkPolicy, use `toEndpoints` targeting the backend pods (by namespace/label), not `toCIDR` targeting the VIP.