@teamscala/service-boot 0.23.319 → 0.23.321

package/src/server-error-page.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The branded HTML error page for a FAILED PAGE RENDER — the page-server
+ * render catch's response surface (constitution `error-responses-via-error-
+ * report`). When SSR resolve+render fails (render budget exhausted, DEGRADED
+ * protective layer, a thrown loader), the browser is mid-navigation: serving
+ * a JSON body there is the violation this closes (2026-07-24: the operator
+ * saw a raw `{"error":"Request failed"}` blob where the dashboard should be).
+ *
+ * Classification stays in `buildErrorReport` (`@teamscala/os`) — the ONE
+ * classifier; this file is ONLY the HTML shaper for the page-navigation
+ * surface (API/ORPC `onError` keeps the JSON body, consumed by code). It
+ * renders the report's already-decided status + Retry-After + message, so the
+ * screen, the log line, and the GlitchTip event all share one `errorId`.
+ *
+ * Deliberately NOT a Puck page: it must render even when data loading is what
+ * failed. Sibling of `resource-not-found.ts` (the missing-resource floor) —
+ * same dark branded template + org-logo resolver, distinct trigger.
+ */
+import type { ErrorReport } from "@teamscala/os/errors/error-report";
+/**
+ * Render an `ErrorReport` as a branded HTML page. Pure shaper — the caller
+ * classifies via `buildErrorReport` and resolves the logo first. Skew-tolerant
+ * by construction: a missing logo degrades to a plain branded dark page.
+ */
+export declare function buildServerErrorPageResponse(report: ErrorReport, logoUrl?: string | null): Response;

package/src/start-scheduled-jobs.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Starts `service_install.scheduled_jobs[]`. Two kinds:
+ *
+ *   - `long_running`: handler invoked once at boot, runs for the lifetime of
+ *      the process (e.g. SSE subscribers, WAL watchers). Failures are logged.
+ *   - `recurring`: declared here but cron scheduling lands via pg-boss in a
+ *      follow-up — currently a no-op log.
+ *
+ * Implementations are registered by server_packages via
+ * ctx.registerScheduledJob during the mount phase.
+ */
+import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import type { MountRegistry } from "@teamscala/os/runtime-contracts/mount-context";
+export declare function startScheduledJobs(config: ServiceInstallConfig, mountRegistry: MountRegistry, serviceSlug: string): void;

package/src/two-phase-boot.d.ts

@@ -0,0 +1,136 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Two-phase boot for UI services. Splits the boot process into:
+ * 1. Minimal app (tool-only surface): ORPC, data routes, auth gates
+ * 2. Full app (with pages and hydration): adds block discovery, page routes,
+ *    client asset building, boot hooks, scheduled jobs
+ *
+ * The minimal app starts serving immediately (<10s), then the full app is
+ * built in the background and atomically swapped in. This eliminates the
+ * ~25s channel outage window during scala-agents restart.
+ */
+import { Hono, type Context } from "hono";
+import type { ServiceInstallConfig } from "./load-service-install-row.ts";
+import { mountServerPackages } from "./mount-server-packages.ts";
+import type { PageServerDeps } from "./ui-service.ts";
+import type { CreatePageHandler } from "./types.ts";
+/**
+ * Set the real page handler (called when Phase 2 completes).
+ */
+export declare function setPageHandler(handler: CreatePageHandler): void;
+/**
+ * Get the current page handler state.
+ */
+export declare function getPageHandlerState(): {
+    ready: boolean;
+    hasHandler: boolean;
+};
+/**
+ * `/health` for a UI service — 200 ONLY once the full app can actually render
+ * a page, 503 before that.
+ *
+ * This endpoint is not decoration: it is the wake gate for every scale-to-zero
+ * app. `scala-activator` (`@teamscala/scale-to-zero`) holds the client's TCP
+ * connection through a cold wake and pipes it the instant `isHealthy(port)` —
+ * a plain `GET /health` — returns ok, which is what `scale-to-zero-apps-sleep-
+ * on-demand` means by "`/health`-gates the wake (the client never sees a boot
+ * 503)".
+ *
+ * It previously answered a flat `{status:"ok"}` as soon as the MINIMAL app was
+ * serving, because the readiness gate flips ready after phase 1 so the ORPC/MCP
+ * surface can accept traffic early. But phase 1 CANNOT render: the phase-1 page
+ * handler below returns 503 until `setPageHandler` runs at the phase-2 swap. So
+ * `/health` reported ready while every page 503'd, the activator believed the
+ * wake had landed, and it piped the customer's first request straight into that
+ * window — the customer got the 503.
+ *
+ * Measured 2026-07-31 on quiz-dev/sign-dev: the activator logged `awake` for
+ * scala-quiz at 05:58:25.446 and the app logged `GET / 503 3ms` at 05:58:25.452
+ * — 6ms later, and 1004ms BEFORE "Swapped from minimal app to full app". Nine
+ * such 503s on scala-quiz and two on scala-sign, every one 0-23ms (the
+ * placeholder, which does no render work). scala-public logged ZERO, which is
+ * the whole reason it looked healthy while the other two did not: the gap is a
+ * RACE whose width is the phase-1→phase-2 build time (1420ms cold, 137ms warm),
+ * not a config difference between the apps.
+ *
+ * Gating this on `fullAppReady` makes the signal honest for every consumer at
+ * once (the activator's wake gate, `poller-post-restart-health-gate`, any
+ * health-gated router) rather than teaching each one its own probe, and it is
+ * what `readiness-gated-boot` already requires: "/health returns 503 until
+ * ready, 200 after — so it is the real readiness signal", a service being
+ * "binary: fully-ready or cleanly-unavailable". A UI service that cannot render
+ * is not ready, per `liveness-by-capability-not-process-existence` — liveness is
+ * a probe of the capability being REQUESTED, never of process existence or of
+ * some other surface that happens to answer.
+ *
+ * The early readiness-gate flip is deliberately left alone: it gates the ORPC
+ * tool surface, which genuinely IS usable at phase 1. Only this endpoint, whose
+ * one consumer contract is "can you serve me a page", is moved to phase 2.
+ */
+export declare function healthHandler(c: Context): Response;
+export interface MinimalAppResult {
+    app: Hono;
+    mountRegistry: Awaited<ReturnType<typeof mountServerPackages>>;
+    apiRouteCount: number;
+    wsRouteCount: number;
+    pageRouteCount: number;
+    config: ServiceInstallConfig;
+    serviceSlug: string;
+    databaseUrl: string;
+    blockPackages: string[];
+    components: Record<string, unknown>;
+    loaded: string[];
+    skipped: string[];
+}
+export interface FullAppResult {
+    app: Hono;
+    blocks: {
+        slug: string;
+        packagePath: string;
+    }[];
+    routes: string[];
+    pgBossJobs: Array<{
+        handlerSlug: string;
+    }>;
+}
+/**
+ * Build the minimal tool-only app. This excludes the expensive operations:
+ * - Client asset building (Vite build)
+ * - Boot hooks (may have expensive initialization)
+ * - Scheduled jobs (can start later)
+ * - pg-boss (can start later)
+ *
+ * CRITICAL: All route registration MUST happen here before serving, because
+ * Hono's RegExpRouter compiles on the first request and becomes immutable.
+ * Once compiled, no new routes can be added. So we include:
+ * - Block discovery and page routes (registers all page paths)
+ * - All other routes (API, WS, data, static assets)
+ *
+ * The minimal app includes everything needed for MCP tools and ORPC:
+ * - Error handling, readiness gate, health check
+ * - Security headers, CORS, compression, timing
+ * - Content gate access, auth gates, static assets
+ * - ORPC router, API routes, WS routes, data routes, page routes
+ */
+export declare function buildMinimalApp(config: ServiceInstallConfig, serviceSlug: string, databaseUrl: string): Promise<MinimalAppResult>;
+/**
+ * Build the full app with hydration. This adds the expensive operations that
+ * were deferred from the minimal app:
+ * - Client asset building (Vite build)
+ * - Boot hooks (may have expensive initialization)
+ * - Scheduled jobs (can start later)
+ * - pg-boss (can start later)
+ *
+ * This runs in the background after the minimal app is already serving.
+ * NOTE: All routes (including page routes) are already registered in Phase 1,
+ * so we don't need to modify the app here. The app reference stays the same.
+ */
+export declare function buildFullApp(minimalResult: MinimalAppResult, deps: PageServerDeps): Promise<FullAppResult>;
+/**
+ * Swap the minimal app for the full app. This atomically replaces the
+ * app reference that Bun.serve is using.
+ */
+export declare function swapToFullApp(fullApp: Hono, serviceSlug: string): void;

package/src/two-phase-boot.ts

@@ -54,7 +54,6 @@ import { registerPageRoutes } from "./register-page-routes.ts";
 import { runBootHookList } from "./run-boot-hook-list.ts";
 import { buildClientAssets } from "./build-client-assets.ts";
 import { discoverBlocks } from "./discover-blocks.ts";
-import { registerPageServerClient } from "./register-page-server-client.ts";
 import { swapApp } from "./mutable-app-ref.ts";
 import type { CreatePageHandler } from "./types.ts";
 
@@ -64,60 +63,13 @@ let realPageHandler: CreatePageHandler | null = null;
 let fullAppReady = false;
 
 /**
- * Set the real page handler (called when Phase 2 completes on an SSR service).
- *
- * Registering the SSR handler implies the full app is built, so this also flips
- * readiness — but the reverse does NOT hold, which is why `markFullAppReady`
- * exists separately. See its note.
+ * Set the real page handler (called when Phase 2 completes).
  */
 export function setPageHandler(handler: CreatePageHandler): void {
 	realPageHandler = handler;
-	markFullAppReady();
-}
-
-/**
- * Flip readiness once phase 2 has built the full app.
- *
- * SEPARATE FROM `setPageHandler` BECAUSE THE TWO FACTS CAME APART. Readiness
- * means "phase 2 finished"; the page handler means "this service renders pages
- * server-side". Every service was SSR, so one flag honestly carried both — until
- * `render_mode=client` (`granular runtime`) made a service that completes phase 2
- * and never registers an SSR handler.
- *
- * Leaving readiness inside `setPageHandler` made such a service PERMANENTLY
- * un-ready: `/health` answered `{"status":"starting"}` forever while the process
- * was healthy and serving. That is the failure `readiness-gated-boot` is written
- * against — a service must be "binary: fully-ready or cleanly-unavailable", and
- * a never-ready health signal makes the activator's wake gate and every
- * health-gated router treat a working service as down.
- *
- * Measured 2026-08-07 on scala-agents-ui: boot completed in 5023ms, "Full app
- * built: 50 block(s)" logged, `GET /` correctly 302'd to sign-in, and `/health`
- * still reported starting — while three untouched UI services reported ok.
- */
-export function markFullAppReady(): void {
 	fullAppReady = true;
 }
 
-/**
- * Reset both phase-2 flags. TEST-ONLY.
- *
- * `fullAppReady` is module state that only ever transitions false -> true in
- * production, and Bun shares a module instance across every test file in a run —
- * so the SSR readiness test and the client-only readiness test contaminate each
- * other purely by file order. Splitting them across files does NOT isolate them;
- * it only hides the coupling until CI runs them together.
- *
- * A test that passes alone and fails in a suite is worse than no test, so the
- * reset is exported rather than left as an ordering convention nobody can see.
- * Never called from production code — `setPageHandler`/`markFullAppReady` are
- * the only writers on the boot path.
- */
-export function __resetPhase2StateForTest(): void {
-	realPageHandler = null;
-	fullAppReady = false;
-}
-
 /**
  * Get the current page handler state.
  */
@@ -295,6 +247,16 @@ export async function buildMinimalApp(
 		preloadServerPackages(serverPackages),
 	);
 	const ttlPromise = runStep("init-gate-ttls", () => initGateTtls());
+	const discoverPromise = runStep("discover-blocks", () =>
+		discoverBlocks(blockPackages),
+	);
+	// Attach an immediate rejection sink: discoverPromise is fired here but
+	// awaited much later (after the gate chain + mounts). If discoverBlocks
+	// rejects during that overlap window, the rejection would surface as an
+	// unhandledRejection before the await below can catch it. The sink is a
+	// no-op — the real error still propagates at the `await discoverPromise`
+	// site because each consumer of a rejected promise receives the rejection.
+	discoverPromise.catch(() => {});
 
 	// Public access endpoints — MUST be registered before the auth gate (Hono
 	// dispatches middleware + handlers in registration order; the content-gate
@@ -343,21 +305,6 @@ export async function buildMinimalApp(
 		await runStep("mount-orpc-router", () => mountOrpcRouter(app, serviceSlug));
 	}
 
-	// Register the in-process ORPC server client BEFORE discoverBlocks — it
-	// calls getServerClient() which needs the client set here. Must follow
-	// mount-orpc-router (which builds the router getAppRouter uses).
-	// Previously ran inside register-page-routes (too late — discoverBlocks
-	// fired before it, hitting the empty-router fallback).
-	await runStep("register-page-server-client", () =>
-		registerPageServerClient(serviceSlug),
-	);
-
-	// NOW fire discoverBlocks (getServerClient is set). Awaited below before
-	// register-page-routes consumes the result.
-	const discoverPromise = runStep("discover-blocks", () =>
-		discoverBlocks(blockPackages),
-	);
-
 	const wsRouteCount = await runStep("register-ws-routes", () =>
 		registerWsRoutes(app, config, mountRegistry, serviceSlug),
 	);
@@ -429,8 +376,7 @@ export async function buildMinimalApp(
 				// (the same pulsating-logo holding page scale-to-zero uses) —
 				// never bare plain text (loading-via-logo-loading).
 					if (!fullAppReady || !realPageHandler) {
-						const logo = await resolveErrorPageLogo(serviceSlug);
-						return new Response(buildWakingPageHtml({ logoUrl: logo }), {
+						return new Response(buildWakingPageHtml({}), {
 							status: 503,
 							headers: {
 								"content-type": "text/html; charset=utf-8",
@@ -552,25 +498,11 @@ export async function buildFullApp(
 			`${Object.keys(components).length} component(s)`,
 	);
 
-	// Set the real page handler so the dynamic handler in Phase 1 can delegate to it.
-	// Client-only services (render_mode=client) have no SSR page handler — skip
-	// (they serve via the client bundle, never SSR). Guarded so undefined is a
-	// no-op rather than a crash.
-	if (deps.createPageHandler) {
-		setPageHandler(deps.createPageHandler);
-		log.info(
-			`[two-phase-boot:${serviceSlug}] Real page handler registered - page routes now delegate to full app`,
-		);
-	} else {
-		// The full app IS built — this service simply never renders server-side,
-		// so readiness is flipped directly rather than as a side effect of
-		// registering an SSR handler that will never exist. Without this a
-		// client-only service is permanently un-ready (see markFullAppReady).
-		markFullAppReady();
-		log.info(
-			`[two-phase-boot:${serviceSlug}] Client-only mode (render_mode=client) — no SSR page handler registered`,
-		);
-	}
+	// Set the real page handler so the dynamic handler in Phase 1 can delegate to it
+	setPageHandler(deps.createPageHandler);
+	log.info(
+		`[two-phase-boot:${serviceSlug}] Real page handler registered - page routes now delegate to full app`,
+	);
 
 	const resolvedBlocks = loaded.map((slug) => ({
 		slug,

package/src/two-phase-health-gate.test.ts

@@ -27,14 +27,9 @@
  * 137ms warm), which is why one app looked healthy and the others did not.
  */
 
-import { beforeAll, describe, expect, test } from "bun:test";
+import { describe, expect, test } from "bun:test";
 import { Hono } from "hono";
-import {
-	__resetPhase2StateForTest,
-	getPageHandlerState,
-	healthHandler,
-	setPageHandler,
-} from "./two-phase-boot.ts";
+import { healthHandler, setPageHandler, getPageHandlerState } from "./two-phase-boot.ts";
 
 /** Mount the real handler exactly as buildMinimalApp does. */
 const app = new Hono().get("/health", healthHandler);
@@ -46,12 +41,6 @@ const app = new Hono().get("/health", healthHandler);
  * hook and adding one would exist only for tests.
  */
 describe("/health is gated on page-serving readiness", () => {
-	// Bun shares one module instance across test files, so a sibling file that
-	// marks the app ready would otherwise decide this file's first assertion.
-	beforeAll(() => {
-		__resetPhase2StateForTest();
-	});
-
 	test("before the phase-2 swap it reports 503, not ready", async () => {
 		expect(getPageHandlerState().ready).toBe(false);
 

package/src/types.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Shared type definitions for service-boot boot helpers.
+ */
+type RendererComponent = (props: Record<string, unknown>) => unknown;
+export interface RendererComponentEntry {
+    render: RendererComponent;
+    fields?: Record<string, {
+        type: string;
+    }>;
+    /** block_schema.defaults, carried onto the entry by discoverBlocks so
+     *  buildPuckConfig merges them under authored props at SSR
+     *  (blocks-fully-programmable). */
+    defaultProps?: Record<string, unknown>;
+}
+export interface PageHandlerExtras {
+    htmlTemplate: string;
+    userId?: string;
+    orgId?: string;
+    searchParams?: Record<string, string>;
+    nonce?: string;
+}
+export type CreatePageHandler = (config: PageHandlerConfig) => (request: Request, extras: PageHandlerExtras) => Promise<Response>;
+export interface PageHandlerConfig {
+    components: Record<string, RendererComponentEntry>;
+    providers?: string[];
+    loadData: (request: Request) => Promise<unknown>;
+    renderMode?: "public" | "portals" | "utility";
+    /**
+     * Owning service slug — used by the page-server render catch to resolve
+     * the branded logo on the render-error page. Mirrors service-runtime's
+     * PageHandlerConfig.
+     */
+    serviceSlug?: string;
+    /**
+     * Redirect a signed-in user's `/` to their org-scoped portal dashboard.
+     * Set only for services serving a `/*` catchall page_route (the portal);
+     * single-site portal-mode services serve their real page at `/`.
+     * Mirrors service-runtime's PageHandlerConfig (1.15.82).
+     */
+    portalHomeRedirect?: boolean;
+}
+export type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";

package/src/ui-service.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Boots a `kind: "ui"` service. Reads the service_install registry row and
+ * orchestrates a fixed pipeline of single-purpose stages onto one Hono app
+ * served by @teamscala/service-runtime/serve (one Bun.serve in dev and prod).
+ */
+import { Hono } from "hono";
+import type { ServiceInstallConfig } from "./load-service-install-row.ts";
+export interface ResolvedBlock {
+    slug: string;
+    packagePath: string;
+}
+export interface UiServiceBootResult {
+    kind: "ui";
+    blocks: ResolvedBlock[];
+    routes: string[];
+    port: number;
+    app: Hono;
+}
+/**
+ * Page-server symbols injected by the caller. service-boot is tier 4
+ * (server) and must not import from tier 2 (`@teamscala/service-runtime`)
+ * per `installer-and-runtime` Rule 1. The runtime's bin entrypoint
+ * boot pipeline imports these from `page-server/` (same package —
+ * legal) and passes them down here.
+ */
+export interface PageServerDeps {
+    createPageHandler: import("./types.ts").CreatePageHandler;
+}
+/**
+ * Boots a UI service using two-phase boot for fast availability.
+ *
+ * Phase 1 (fast): Build and serve minimal tool-only app (ORPC, data routes,
+ * auth gates). This becomes available within ~10s, enabling the MCP tool
+ * surface to accept requests immediately after restart.
+ *
+ * Phase 2 (background): Build full app (pages, hydration) and atomically swap
+ * it in. The readiness gate flips to ready after Phase 1, not Phase 2.
+ *
+ * The interim mitigation (503 + gateway retry + circuit breaker) remains in
+ * place and is NOT undone.
+ */
+export declare function bootUiService(config: ServiceInstallConfig, serviceSlug: string, deps: PageServerDeps, databaseUrl: string): Promise<UiServiceBootResult>;

package/src/ws-boot-self-test.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Post-listen WebSocket self-test. Runs after serveStart binds the port.
+ * For each declared websocket_routes path, opens a synthetic WebSocket
+ * connection and asserts 101 upgrade. Non-101 → BootFatalError.
+ *
+ * This catches the class of bugs where:
+ * - WS route registered after ORPC catch-all (order-dependent 404)
+ * - fetchWithPeerPort clones the Request on WS upgrade (breaks Bun.upgrade identity)
+ * - websocket_routes config row is stale / missing a handler
+ *
+ * Runs synchronously after serveStart so the boot aborts before the service
+ * reports healthy.
+ */
+import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+export declare function runWsBootSelfTest(config: ServiceInstallConfig, serviceSlug: string, port: number): Promise<void>;

package/src/auth-gate.test.ts

@@ -1,70 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The signed-out screen must be able to render its own branding.
- */
-
-import { describe, expect, test } from "bun:test";
-import { isStaticAssetPath } from "./auth-gate.ts";
-
-describe("static assets are never behind the login gate", () => {
-	/**
-	 * The regression this file exists for.
-	 *
-	 * Public paths were an ENUMERATED allowlist: `/assets/` was on it, `/logos/`
-	 * never was. So `/logos/cropped.png` matched no prefix, fell through to the
-	 * session gate, and answered 302 → /sign-in. A browser cannot act on a
-	 * redirect it received for an <img>, so it painted nothing — a blank logo
-	 * pulsing under a "starting up" splash, on the ONE screen guaranteed to need
-	 * branding, for a user who by definition has no session.
-	 *
-	 * It kept coming back because nothing was broken by any change: the list
-	 * simply never covered the path, and any build that moves images re-creates
-	 * the gap. Enumerating what is public makes every new asset private by
-	 * default; a predicate makes that unrepresentable.
-	 */
-	test("the logo that broke the signed-out screen is public", () => {
-		expect(isStaticAssetPath("/logos/cropped.png")).toBe(true);
-		expect(isStaticAssetPath("/logos/companyLogo.png")).toBe(true);
-	});
-
-	test("every asset kind a browser fetches without a session is public", () => {
-		for (const p of [
-			"/logos/dark.svg",
-			"/img/hero.webp",
-			"/brand/mark.avif",
-			"/fonts/inter.woff2",
-			"/styles/main.css",
-			"/assets/chunk-4efmn1eh.js",
-			"/favicon.ico",
-		]) {
-			expect(isStaticAssetPath(p)).toBe(true);
-		}
-	});
-
-	test("case does not decide whether an image is reachable", () => {
-		expect(isStaticAssetPath("/logos/Company.PNG")).toBe(true);
-		expect(isStaticAssetPath("/logos/Mark.SVG")).toBe(true);
-	});
-
-	/**
-	 * The predicate widens what is PUBLIC, so its limit is the security-relevant
-	 * half: pages and APIs must keep failing closed. A path is an asset because
-	 * of its EXTENSION, never because it merely contains an asset-looking word.
-	 */
-	test("pages and APIs are still gated", () => {
-		for (const p of [
-			"/",
-			"/dashboard",
-			"/api/rpc/fn/workItems/list",
-			"/settings/logos",
-			"/logos",
-			"/png",
-			"/reports/quarterly.pdf",
-		]) {
-			expect(isStaticAssetPath(p)).toBe(false);
-		}
-	});
-});

package/src/fn-routers/task-sync-close.test.ts

@@ -1,44 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- */
-
-import { describe, expect, it } from "bun:test";
-import { closedTaskState } from "./task-sync-close.ts";
-
-const task = {
-	id: "task-1",
-	kind_data: {
-		lane: { session: "acp-session", cli_kind: "zerostack", live: true },
-		assignee_type: "agent",
-	},
-};
-
-describe("closedTaskState", () => {
-	it("marks completed work done and the lane non-live", () => {
-		expect(closedTaskState(task, "completed")).toEqual({
-			task_id: "task-1",
-			task_status: "done",
-			completed: true,
-			kind_data: {
-				lane: { session: "acp-session", cli_kind: "zerostack", live: false },
-				assignee_type: "agent",
-			},
-		});
-	});
-
-	it("archives every disposition that does not prove completion", () => {
-		for (const disposition of [
-			"needs_retry",
-			"failed",
-			"orchestrator_closed",
-			"orphaned",
-		] as const) {
-			const state = closedTaskState(task, disposition);
-			expect(state.task_status).toBe("archived");
-			expect(state.completed).toBe(false);
-			expect((state.kind_data.lane as { live: boolean }).live).toBe(false);
-		}
-	});
-});

package/src/fn-routers/task-sync-close.ts

@@ -1,82 +0,0 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Lane-close write-through for task-sync. The session-owning fleet runtime
- * calls this ORPC procedure before releasing an ACP lane, so work_items remains
- * the durable lifecycle source without a second raw-SQL writer in the host.
- */
-
-import { ORPCError } from "@orpc/server";
-import * as v from "valibot";
-import { authed, type Context } from "./auth-router.ts";
-import type { Prisma, WorkItem } from "./task-sync-router.ts";
-
-export const closeLaneInput = v.object({
-	lane_session: v.pipe(v.string(), v.minLength(1, "lane_session is required")),
-	disposition: v.picklist([
-		"completed",
-		"needs_retry",
-		"failed",
-		"orchestrator_closed",
-		"orphaned",
-	]),
-});
-
-export interface ClosedTaskState {
-	task_id: string;
-	task_status: "done" | "archived";
-	completed: boolean;
-	kind_data: Record<string, unknown>;
-}
-
-export function closedTaskState(
-	task: Pick<WorkItem, "id" | "kind_data">,
-	disposition: v.InferOutput<typeof closeLaneInput>["disposition"],
-): ClosedTaskState {
-	const completed = disposition === "completed";
-	const lane =
-		task.kind_data.lane && typeof task.kind_data.lane === "object"
-			? (task.kind_data.lane as Record<string, unknown>)
-			: {};
-	return {
-		task_id: task.id,
-		task_status: completed ? "done" : "archived",
-		completed,
-		kind_data: { ...task.kind_data, lane: { ...lane, live: false } },
-	};
-}
-
-export const closeLaneHandler = authed
-	.input(closeLaneInput)
-	.handler(async ({ input, context }) => {
-		const prisma = (context as Context).prisma as Prisma;
-		const task = await prisma.work_items.findFirst({
-			where: {
-				kind: "task",
-				kind_data: { path: ["lane", "session"], equals: input.lane_session },
-			},
-			orderBy: { created_at: "desc" },
-		});
-		if (!task) {
-			throw new ORPCError("NOT_FOUND", {
-				message: `No task is bound to ACP lane ${input.lane_session}`,
-			});
-		}
-		const state = closedTaskState(task, input.disposition);
-		await prisma.work_items.update({
-			where: { id: task.id },
-			data: {
-				kind_data: state.kind_data,
-				status: state.task_status,
-				completed: state.completed,
-			},
-			select: { id: true },
-		});
-		return {
-			task_id: state.task_id,
-			task_status: state.task_status,
-			reconciled: true,
-		};
-	});